MC9S12ZVM-Family
Reference Manual
HCS12
Microcontrollers
Rev. 1.3
20 JAN 2014
MC9S12ZVMRMV1
freescale.com
To provide the most up-to-date information, the document revision on the Internet is the most current. A
printed copy may be an earlier revision. To verify you have the latest information available, refer to :
freescale.com.
The following revision history table summarizes changes contained in this document. The individual
module sections contain revision history tables with more detailed information.
This document contains information for all constituent modules, with the exception of the S12Z CPU. For
S12ZCPU information please refer to the CPU S12Z Reference Manual.
Revision History
Date
Revision
Level
12 Dec 2013
1.2
Replaced generic 8-channel TIM section with specific 4-channel TIM section
Textual enhancements and corrections throughout
Updated electrical parameter section and added parameters for temperataures up to 175°C
- Added Table A-5
- Merged Table A-8 and A-9 into Table A-9. Values updated. .
- Table A-15. Parameter #2. max changed from 800uA to 1050uA
- Table A-15. Inserted new C class parameter ISUPS at 85C. typ. 80uA
- Appendices B,D and E. Updated parameter values based on characterization results.
- Appendix C. Added parameter values for range above T=150°C
- Table F-3. Merged rows 2a and 2b. Merged rows 6a and 6b.
- Appendix G. Merged tables G-1 and G-2.
- Tables H-1 and H-2 values updated.
20 JAN 2014
1.3
Updated Stop mode description for BDC enabled case
Removed false reference to modified clock monitor assert frequency
Updated electricals for 175°C Grade0
- Removed temperature range disclaimer from electrical parameter spec.footer
- Added sentence above table A-3
- Table D-1. LINPHY parameters 12a and 12b replaced by 12a, 12b and 12c- Table D-2. LINPHY wake up pulse over whole temperature range
- Table E-1. FET gate charge spec. updated
Description
Freescale Semiconductor reserves the right to make changes without further notice to any products herein. Freescale Semiconductor makes no warranty,
representation or guarantee regarding the suitability of its products for any particular purpose, nor does Freescale Semiconductor assume any liability arising out of
the application or use of any product or circuit, and specifically disclaims any and all liability, including without limitation consequential or incidental damages. “Typical”
parameters that may be provided in Freescale Semiconductor data sheets and/or specifications can and do vary in different applications and actual performance may
vary over time. All operating parameters, including “Typicals”, must be validated for each customer application by customer’s technical experts. Freescale
Semiconductor does not convey any license under its patent rights nor the rights of others. Freescale Semiconductor products are not designed, intended, or
authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other
application in which the failure of the Freescale Semiconductor product could create a situation where personal injury or death may occur. Should Buyer purchase or
use Freescale Semiconductor products for any such unintended or unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor and its officers,
employees, subsidiaries, affiliates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly
or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that Freescale Semiconductor was
negligent regarding the design or manufacture of the part.
Chapter 1
Device Overview MC9S12ZVM-Family
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1.2.1 MC9S12ZVM-Family Member Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1.2.2 Functional Differences Between N06E and 0N95G Masksets . . . . . . . . . . . . . . . . . . . . 18
1.2.3 Functional Differences Between 1N95G and 0N95G Masksets . . . . . . . . . . . . . . . . . . . 20
Chip-Level Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Module Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.4.1 S12Z Central Processor Unit (CPU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.4.2 Embedded Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1.4.3 Clocks, Reset & Power Management Unit (CPMU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
1.4.4 Main External Oscillator (XOSCLCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
1.4.5 Timer (TIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.4.6 Pulse width Modulator with Fault protection (PMF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.4.7 Programmable Trigger Unit (PTU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.4.8 LIN physical layer transceiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.4.9 Serial Communication Interface Module (SCI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.10 Multi-Scalable Controller Area Network (MSCAN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.11 Serial Peripheral Interface Module (SPI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.12 Analog-to-Digital Converter Module (ADC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.13 Supply Voltage Sensor (BATS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4.14 On-Chip Voltage Regulator system (VREG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4.15 Gate Drive Unit (GDU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4.16 Current Sense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Device Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
1.6.1 Part ID Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Signal Description and Device Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.7.1 Pin Assignment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.7.2 Detailed External Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
1.7.3 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.7.4 Package and Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Internal Signal Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
1.8.1 ADC Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
1.8.2 Motor Control Loop Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
1.8.3 Device Level PMF Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.4 BDC Clock Source Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.5 LINPHY Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.6 FTMRZ Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.7 CPMU Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1.9.1 Chip Configuration Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1.9.2 Debugging Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1.9.3 Low Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
3
1.10 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
1.10.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
1.10.2 Securing the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
1.10.3 Operation of the Secured Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
1.10.4 Unsecuring the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
1.10.5 Reprogramming the Security Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
1.10.6 Complete Memory Erase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
1.11 Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
1.11.1 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
1.11.2 Interrupt Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
1.11.3 Effects of Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
1.12 Module device level dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
1.12.1 CPMU COP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
1.12.2 CPMU High Temperature Trimming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
1.12.3 Flash IFR Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
1.13 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
1.13.1 ADC Calibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
1.13.2 SCI Baud Rate Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
1.13.3 Motor Control Application Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
1.13.4 BDCM Complementary Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
1.13.5 BLDC Six-Step Commutation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
1.13.6 PMSM Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
1.13.7 Power Domain Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Chapter 2
Port Integration Module (S12ZVMPIMV1)
2.1
2.2
2.3
2.4
2.5
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
2.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
2.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
2.3.1 Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
2.3.2 PIM Registers 0x0200-0x020F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
2.3.3 PIM Generic Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
2.3.4 PIM Generic Register Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
2.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
2.4.2 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
2.4.3 Pin I/O Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
2.4.4 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
2.4.5 Pin interrupts and Key-Wakeup (KWU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
2.4.6 Over-Current Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Initialization and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
2.5.1 Port Data and Data Direction Register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
2.5.2 Over-Current Protection on EVDD1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
MC9S12ZVM Family Reference Manual Rev. 1.3
4
Freescale Semiconductor
Chapter 3
Memory Mapping Control (S12ZMMCV1)
3.1
3.2
3.3
3.4
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
3.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
3.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
3.3.1 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
3.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
3.4.1 Global Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
3.4.2 Illegal Accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
3.4.3 Uncorrectable ECC Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Chapter 4
Interrupt (S12ZINTV0)
4.1
4.2
4.3
4.4
4.5
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
4.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
4.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
4.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
4.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
4.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
4.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
4.4.1 S12Z Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
4.4.2 Interrupt Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
4.4.3 Priority Decoder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
4.4.4 Reset Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
4.4.5 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
4.4.6 Interrupt Vector Table Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
4.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
4.5.2 Interrupt Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
4.5.3 Wake Up from Stop or Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Chapter 5
Background Debug Controller (S12ZBDCV2)
5.1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
5.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
5
5.2
5.3
5.4
5.5
5.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
5.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
5.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
5.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
5.4.2 Enabling BDC And Entering Active BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
5.4.3 Clock Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
5.4.4 BDC Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
5.4.5 BDC Access Of Internal Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
5.4.6 BDC Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
5.4.7 Serial Interface Hardware Handshake (ACK Pulse) Protocol . . . . . . . . . . . . . . . . . . . . 175
5.4.8 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
5.4.9 Hardware Handshake Disabled (ACK Pulse Disabled) . . . . . . . . . . . . . . . . . . . . . . . . . 178
5.4.10 Single Stepping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
5.4.11 Serial Communication Timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
5.5.1 Clock Frequency Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Chapter 6
S12Z Debug (S12ZDBGV2) Module
6.1
6.2
6.3
6.4
6.5
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
6.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
6.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
6.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
6.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
6.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
6.2.1 External Event Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
6.2.2 Profiling Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
6.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
6.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
6.4.1 DBG Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
6.4.2 Comparator Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
6.4.3 Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
6.4.4 State Sequence Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
6.4.5 Trace Buffer Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
6.4.6 Code Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
6.4.7 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
MC9S12ZVM Family Reference Manual Rev. 1.3
6
Freescale Semiconductor
6.5.1
6.5.2
6.5.3
6.5.4
Avoiding Unintended Breakpoint Re-triggering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Debugging Through Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Breakpoints from other S12Z sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Code Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Chapter 7
ECC Generation Module (SRAM_ECCV1)
7.1
7.2
7.3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
7.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
7.2.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
7.2.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
7.3.1 Aligned 2 and 4 Byte Memory Write Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
7.3.2 Other Memory Write Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
7.3.3 Memory Read Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
7.3.4 Memory Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
7.3.5 Interrupt Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
7.3.6 ECC Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
7.3.7 ECC Debug Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Chapter 8
S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1
8.2
8.3
8.4
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
8.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
8.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
8.1.3 S12CPMU_UHV_V6 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
8.2.1 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
8.2.2 EXTAL and XTAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
8.2.3 VSUP — Regulator Power Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
8.2.4 VDDA, VSSA — Regulator Reference Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
8.2.5 VDDX, VSSX— Pad Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
8.2.6 BCTL— Base Control Pin for external PNP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
8.2.7 VSS1,2 — Core Ground Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
8.2.8 VDD— Core Logic Supply Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
8.2.9 VDDF— NVM Logic Supply Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
8.2.10 API_EXTCLK — API external clock output pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
8.2.11 TEMPSENSE — Internal Temperature Sensor Output Voltage . . . . . . . . . . . . . . . . . . 252
Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
8.4.1 Phase Locked Loop with Internal Filter (PLL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
7
8.5
8.6
8.7
8.4.2 Startup from Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
8.4.3 Stop Mode using PLLCLK as source of the Bus Clock . . . . . . . . . . . . . . . . . . . . . . . . 295
8.4.4 Full Stop Mode using Oscillator Clock as source of the Bus Clock . . . . . . . . . . . . . . . 296
8.4.5 External Oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
8.4.6 System Clock Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
8.5.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
8.5.2 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
8.5.3 Oscillator Clock Monitor Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
8.5.4 PLL Clock Monitor Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
8.5.5 Computer Operating Properly Watchdog (COP) Reset . . . . . . . . . . . . . . . . . . . . . . . . . 301
8.5.6 Power-On Reset (POR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
8.5.7 Low-Voltage Reset (LVR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
8.6.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
8.7.1 General Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
8.7.2 Application information for COP and API usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
8.7.3 Application Information for PLL and Oscillator Startup . . . . . . . . . . . . . . . . . . . . . . . . 305
Chapter 9
Analog-to-Digital Converter (ADC12B_LBA_V1)
9.1
9.2
9.3
9.4
9.5
9.6
9.7
9.8
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
9.2.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
9.2.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
9.3.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
9.4.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
9.4.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
9.5.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
9.5.2 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
9.5.3 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
9.7.1 ADC Conversion Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
9.7.2 ADC Sequence Abort Done Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
9.7.3 ADC Error and Conversion Flow Control Issue Interrupt . . . . . . . . . . . . . . . . . . . . . . . 365
Use Cases and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366
9.8.1 List Usage — CSL single buffer mode and RVL single buffer mode . . . . . . . . . . . . . . 366
9.8.2 List Usage — CSL single buffer mode and RVL double buffer mode . . . . . . . . . . . . . 366
9.8.3 List Usage — CSL double buffer mode and RVL double buffer mode . . . . . . . . . . . . . 367
MC9S12ZVM Family Reference Manual Rev. 1.3
8
Freescale Semiconductor
9.8.4 List Usage — CSL double buffer mode and RVL single buffer mode . . . . . . . . . . . . . 367
9.8.5 List Usage — CSL double buffer mode and RVL double buffer mode . . . . . . . . . . . . . 368
9.8.6 RVL swapping in RVL double buffer mode and related registers ADCIMDRI and
ADCEOLRI 368
9.8.7 Conversion flow control application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
9.8.8 Continuous Conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372
9.8.9 Triggered Conversion — Single CSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
9.8.10 Fully Timing Controlled Conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374
Chapter 10
Supply Voltage Sensor - (BATSV3)
10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
10.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
10.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
10.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376
10.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376
10.2.1 VSUP — Voltage Supply Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376
10.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
10.3.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
10.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
10.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
10.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
10.4.2 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
Chapter 11
Timer Module (TIM16B4CV3) Block Description
11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
11.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
11.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
11.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
11.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
11.2.1 IOC3 - IOC0 — Input Capture and Output Compare Channel 3-0 . . . . . . . . . . . . . . . . 387
11.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
11.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
11.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399
11.4.1 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400
11.4.2 Input Capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401
11.4.3 Output Compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401
11.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
11.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
11.6.1 Channel [3:0] Interrupt (C[3:0]F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
11.6.2 Timer Overflow Interrupt (TOF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
9
Chapter 12
Freescale’s Scalable Controller Area Network (S12MSCANV3)
12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
12.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
12.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
12.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
12.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
12.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
12.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
12.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
12.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
12.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
12.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
12.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
12.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428
12.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
12.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
12.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
12.4.3 Identifier Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442
12.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
12.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450
12.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 454
12.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 454
12.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
12.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
12.5.2 Bus-Off Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
Chapter 13
Programmable Trigger Unit (PTUV2)
13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
13.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
13.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458
13.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
13.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
13.2.1 PTUT0 — PTU Trigger 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
13.2.2 PTUT1 — PTU Trigger 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
13.2.3 PTURE — PTUE Reload Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460
13.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460
13.3.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460
13.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
13.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
13.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
13.4.2 Memory based trigger event list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480
13.4.3 Reload mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
MC9S12ZVM Family Reference Manual Rev. 1.3
10
Freescale Semiconductor
13.4.4 Async reload event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
13.4.5 Interrupts and error handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482
13.4.6 Debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
Chapter 14
Pulse Width Modulator with Fault Protection (PMF15B6CV3)
14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
14.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
14.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
14.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
14.2 Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
14.2.1 PWM0–PWM5 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
14.2.2 FAULT0–FAULT5 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
14.2.3 IS0–IS2 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
14.2.4 Global Load OK Signal — glb_ldok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
14.2.5 Commutation Event Signal — async_event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
14.2.6 Commutation Event Edge Select Signal — async_event_edge_sel[1:0] . . . . . . . . . . . . 490
14.2.7 PWM Reload Event Signals — pmf_reloada,b,c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
14.2.8 PWM Reload-Is-Asynchronous Signal — pmf_reload_is_async . . . . . . . . . . . . . . . . . 490
14.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
14.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
14.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
14.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523
14.4.1 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523
14.4.2 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524
14.4.3 PWM Generator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524
14.4.4 Independent or Complementary Channel Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 528
14.4.5 Deadtime Generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
14.4.6 Top/Bottom Correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531
14.4.7 Asymmetric PWM Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537
14.4.8 Variable Edge Placement PWM Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538
14.4.9 Double Switching PWM Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
14.4.10Output Polarity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
14.4.11Software Output Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
14.4.12PWM Generator Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544
14.4.13Fault Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
14.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
14.6 Clocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
14.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
14.8 Initialization and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
14.8.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
14.8.2 BLDC 6-Step Commutation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
11
Chapter 15
Serial Communication Interface (S12SCIV6)
15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557
15.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557
15.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
15.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
15.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
15.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
15.2.1 TXD — Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
15.2.2 RXD — Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
15.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
15.3.1 Module Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
15.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561
15.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 574
15.4.1 Infrared Interface Submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575
15.4.2 LIN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575
15.4.3 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576
15.4.4 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
15.4.5 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
15.4.6 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583
15.4.7 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591
15.4.8 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592
15.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592
15.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592
15.5.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593
15.5.3 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593
15.5.4 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596
15.5.5 Recovery from Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596
Chapter 16
Serial Peripheral Interface (S12SPIV5)
16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
16.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
16.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
16.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
16.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
16.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
16.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
16.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
16.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
16.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601
MC9S12ZVM Family Reference Manual Rev. 1.3
12
Freescale Semiconductor
16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609
16.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610
16.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611
16.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612
16.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617
16.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618
16.4.6 Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619
16.4.7 Low Power Mode Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620
Chapter 17
Gate Drive Unit (GDUV4)
17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623
17.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623
17.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624
17.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
17.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
17.2.1 HD — High-Side Drain Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
17.2.2 VBS[2:0] — Bootstrap Capacitor Connection Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
17.2.3 HG[2:0] — High-Side Gate Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
17.2.4 HS[2:0] — High-Side Source Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
17.2.5 VLS[2:0] — Voltage Supply for Low-Side Pre-Drivers . . . . . . . . . . . . . . . . . . . . . . . . 626
17.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628
17.3.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628
17.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629
17.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647
17.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647
17.4.2 Low-Side FET Pre-Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647
17.4.3 High-Side FET Pre-Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 648
17.4.4 Charge Pump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650
17.4.5 Desaturation Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651
17.4.6 Phase Comparators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652
17.4.7 Fault Protection Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652
17.4.8 Current Sense Amplifier and Overcurrent Comparator . . . . . . . . . . . . . . . . . . . . . . . . . 656
17.4.9 GDU DC Link Voltage Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657
17.4.10Boost Converter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658
17.4.11Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659
17.5 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660
17.5.1 FET Pre-Driver Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660
17.5.2 Calculation of Bootstrap Capacitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661
Chapter 18
LIN Physical Layer (S12LINPHYV2)
18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663
18.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
13
18.2
18.3
18.4
18.5
18.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 664
18.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
18.2.1 LIN — LIN Bus Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
18.2.2 LGND — LIN Ground Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
18.2.3 VLINSUP — Positive Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
18.2.4 LPTxD — LIN Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
18.2.5 LPRxD — LIN Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
18.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
18.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.4.2 Slew Rate and LIN Mode Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.4.3 Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676
18.4.4 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679
Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682
18.5.1 Module Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682
18.5.2 Interrupt handling in Interrupt Service Routine (ISR) . . . . . . . . . . . . . . . . . . . . . . . . . . 682
Chapter 19
128 KB Flash Module (S12ZFTMRZ128K512V2)
19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686
19.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686
19.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687
19.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688
19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688
19.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
19.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693
19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713
19.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713
19.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713
19.4.3 Flash Block Read Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713
19.4.4 Internal NVM resource . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714
19.4.5 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714
19.4.6 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 719
19.4.7 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 720
19.4.8 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736
19.4.9 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737
19.4.10Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737
19.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737
19.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 738
19.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 738
19.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 739
MC9S12ZVM Family Reference Manual Rev. 1.3
14
Freescale Semiconductor
19.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739
Appendix A
MCU Electrical Specifications
A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 741
Appendix B
CPMU Electrical Specifications (VREG, OSC, IRC, PLL)
B.1 VREG Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757
B.2 IRC and OSC Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759
B.3 Phase Locked Loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759
Appendix C
ADC Electrical Specifications
C.1 ADC Operating Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763
Appendix D
LINPHY Electrical Specifications
D.1 Static Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
D.2 Dynamic Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770
Appendix E
GDU Electrical Specifications
Appendix F
NVM Electrical Parameters
F.1
F.2
F.3
NVM Timing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
NVM Reliability Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
NVM Factory Shipping Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
Appendix G
BATS Electrical Specifications
G.1 Static Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 781
G.2 Dynamic Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782
Appendix H
SPI Electrical Specifications
H.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
15
Appendix I
MSCAN Electrical Specifications
Appendix J
Package Information
Appendix K
Ordering Information
Appendix L
Detailed Register Address Map
L.1
L.2
L.3
L.4
L.5
L.6
L.7
L.8
L.9
L.10
L.11
L.12
L.13
L.14
L.15
L.16
L.17
L.18
L.19
L.20
0x0000–0x0003 Part ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793
0x0010–0x001F S12ZINT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794
0x0070-0x00FF S12ZMMC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794
0x0100-0x017F S12ZDBG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795
0x0200-0x02FF PIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799
0x0380-0x039F FTMRZ128K512 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803
0x03C0-0x03CF SRAM_ECC_32D7P. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804
0x0500-x053F PMF15B6C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 805
0x0580-0x059F PTU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 809
0x05C0-0x05FF TIM0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811
0x0600-0x063F ADC0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813
0x0640-0x067F ADC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815
0x06A0-0x06BF GDU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817
0x06C0-0x06DF CPMU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818
0x06F0-0x06F7 BATS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820
0x0700-0x0707 SCI0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820
0x0710-0x0717 SCI1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 822
0x0780-0x0787 SPI0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 822
0x0800–0x083F CAN0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 823
0x0980-0x0987 LINPHY0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 824
MC9S12ZVM Family Reference Manual Rev. 1.3
16
Freescale Semiconductor
Chapter 1
Device Overview MC9S12ZVM-Family
Table 1-1. Revision History
Version
Number
Revision
Date
Sections
Affected
1.4
12.Dec.2012
Section 1.4.8
Section 1.4.9
Section 1.2.1
Figure 1-5
•
•
•
•
1.5
19.Jun.2013
Section 1.2.3
Section 1.4.8
Section 1.6.1
• Documented differences between 0N95G and 1N95G masksets
• Updated LINPHY feature list
• Updated Part ID table
1.6
03.Jan.2014
Section 1.2.2
• Removed false reference to modified clock monitor assert frequency
1.1
Description of Changes
Added LINPHY dominant timeout to feature list
Changed SCI baud rate select to 16-bit
Added S12ZVML32 to family
Added S12ZVM pinout
Introduction
The MC9S12ZVM-Family is an automotive 16-bit microcontroller family using the NVM + UHV
technology that offers the capability to integrate 40 V analog components. This family reuses many
features from the existing S12/S12X portfolio. The particular differentiating features of this family are the
enhanced S12Z core, the combination of dual-ADC synchronized with PWM generation and the
integration of “high-voltage” analog modules, including the voltage regulator (VREG), Gate Driver Unit
(GDU) and a Local Interconnect Network (LIN) physical layer. These features enable a fully integrated
single chip solution to drive up to 6 external power MOSFETs for BLDC or PMSM motor drive
applications.
The MC9S12ZVM-Family includes error correction code (ECC) on RAM and flash memory, EEPROM
for diagnostic or data storage, a fast analog-to-digital converter (ADC) and a frequency modulated phase
locked loop (IPLL) that improves the EMC performance. The MC9S12ZVM-Family delivers an optimized
solution with the integration of several key system components into a single device, optimizing system
architecture and achieving significant space savings. The MC9S12ZVM-Family delivers all the
advantages and efficiencies of a 16-bit MCU while retaining the low cost, power consumption, EMC, and
code-size efficiency advantages currently enjoyed by users of existing S12(X) families. The
MC9S12ZVM-Family is available in two different pinout options, both using the 64-pin LQFP-EP
package to accommodate both LIN and CAN based applications. In addition to the I/O ports available in
each module, further I/O ports are available with interrupt capability allowing wake-up from stop or wait
modes.
The MC9S12ZVM-Family is a general-purpose family of devices suitable for a range of applications,
including:
• 3-phase sensorless BLDC motor control for
— Fuel pump
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
17
Chapter 1 Device Overview MC9S12ZVM-Family
•
— Water pump
— Oil pump
— A/C compressor
— HVAC blower
— Engine cooling fan
— Electric vehicle battery cooling fan
Brush DC motor control that need driving in 2 directions, along with PWM control for
— Reversible wiper
— Trunk opener
1.2
Features
This section describes the key features of the MC9S12ZVM-Family.
1.2.1
MC9S12ZVM-Family Member Comparison
Table 1-2 provides a summary of feature set differences within the MC9S12ZVM-Family. All other
features are common to all MC9S12ZVM-Family members.
Table 1-2. S12ZVM -Family Differences
Feature
S12ZVML32
S12ZVM32
S12ZVML64
S12ZVMC64
S12ZVML128
S12ZVMC128
32 KB
32 KB
64 KB
64 KB
128 KB
128 KB
512 Bytes
–
512 Bytes
512 Bytes
512 Bytes
512 Bytes
RAM (ECC)
2 KB
2 KB
4 KB
4 KB
8 KB
8 KB
LIN Physical
layer
1
–
1
–
1
–
CAN VREG
–
–
–
1
–
1
SCI
2
1(1)
2
2
2
2
SPI
1
1
1
1
1
1
ADC channels
4+5
4+5
4+5
4+5
4+5
4+5
PMF channels
6
6
6
6
6
6
TIM channels
4
4
4
4
4
4
MSCAN(2)
–
–
1
1
1
1
Flash (ECC)
EEPROM (ECC)
1. Options featuring a single SCI include the SCI1 instantiation
2. External CAN physical interface required
1.2.2
Functional Differences Between N06E and 0N95G Masksets
NOTE
N95G also includes bug fixes that are not listed here because they do not constitute
MC9S12ZVM Family Reference Manual Rev. 1.3
18
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
specification changes. Please refer to the Mask Set Errata documents for details.
• Device Level
— Changed BDC fast clock source from core clock to bus clock
— Added exposed pad electrical connection to die VSS.
— Device level current injection immunity improved
— GDU register address range changed
— Removed mapping of VRL to PAD7
— Added ADC reference voltages to IFR
— Increased over voltage detect thresholds to allow operating range up to 26.5V
• GDU
— Added status flags for overvoltage on HD pin and low voltage on VLS
— Blanking time: start internal blanking time generator with HGx/LGx instead of PWM signal
— Added over current shutdown feature
— Added low pass filter to desaturation comparators
• SCI V6 replaces V5
— Enhanced baud rate options
• LINPHY
— Direct Power Injection (DPI) robustness improvements
— TX dominant timeout feature
— Internal pull-up adjusted to stay in 27KOhm to 40KOhm range
• OSC, CPMU:
— Added full swing Pierce mode
— Added a configuration bit OMRE (Oscillator Monitor Reset Enable) that will enable the
Monitor Reset. By default, clock monitor reset disabled (OMRE=0).
• PTU:
— Allow swapping the trigger list at every reload event with load_ok active
— Made the TG0LIST and TG1LIST writable if the associated TG0/TG1 is disabled
— Allow SW to clear the PTULDOK bit when the PTU is disabled
• FTMRZ:
— Added wait state configuration option bits for bus accesses
— Removed interdependency of DFDF and SFDIF bits
— Changed FTMRZ behavior when forbidden simultaneous P-flash/D-flash operations occur
• DBG:
— Added register access restrictions when DBG is disarmed but a profiling transmission is still
active
— Added a register bit to indicate that the profiling transmission is still active
• BDC
— Improved handling of attempted internal accesses during STOP mode
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
19
Chapter 1 Device Overview MC9S12ZVM-Family
1.2.3
•
1.3
Functional Differences Between 1N95G and 0N95G Masksets
GDU version changed from V2 to V4
— Added low side driver shutdown flexibility in overvoltage case
– Switched off if overvoltage condition and GOCA1=1
– Switched on if overvoltage condition and GOCA1=0
— Changed time constant of HD overvoltage monitor to improve noise filtering
Chip-Level Features
On-chip modules available within the family include the following features:
• S12Z CPU core
• 128, 64 or 32 KB on-chip flash with ECC
• 512 byte EEPROM with ECC
• 8, 4 or 2 KB on-chip SRAM with ECC
• Phase locked loop (IPLL) frequency multiplier with internal filter
• 1 MHz internal RC oscillator with +/-1.3% accuracy over rated temperature range
• 4-20MHz amplitude controlled pierce oscillator
• Internal COP (watchdog) module
• 6-channel, 15-bit pulse width modulator with fault protection (PMF)
• Low side and high side FET pre-drivers for each phase
— Gate drive pre-regulator
— LDO (Low Dropout Voltage Regulator) (typically 11V)
— High side gate supply generated using bootstrap circuit with external diode and capacitor
— Sustaining charge pump with two external capacitors and diodes
— High side drain (HD) monitoring on internal ADC channel using HD/5 voltage
• Two parallel analog-to-digital converters (ADC) with 12-bit resolution and up to 9 channels
available on external pins
• Programmable Trigger Unit (PTU) for synchronization of PMF and ADC
• One serial peripheral interface (SPI) module
• One serial communication interface (SCI) module with interface to internal LIN physical layer
transceiver (with RX connected to a timer channel for frequency calibration purposes, if desired)
• Up to one additional SCI (not connected to LIN physical layer)
• One on-chip LIN physical layer transceiver fully compliant with the LIN 2.2 standard
• 4-channel timer module (TIM) with input capture/output compare
• MSCAN (1 Mbit/s, CAN 2.0 A, B software compatible) module
• On-chip voltage regulator (VREG) for regulation of input supply and all internal voltages
— Optional VREG ballast control output to supply an external CAN physical layer
• Two current sense circuits for overcurrent detection or torque measurement
MC9S12ZVM Family Reference Manual Rev. 1.3
20
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
•
Autonomous periodic interrupt (API)
20mA high-current output for use as Hall sensor supply
Supply voltage sense with low battery warning
Chip temperature sensor
1.4
Module Features
The following sections provide more details of the integrated modules.
1.4.1
S12Z Central Processor Unit (CPU)
The S12Z CPU is a revolutionary high-speed core, with code size and execution efficiencies over the S12X
CPU. The S12Z CPU also provides a linear memory map eliminating the inconvenience and performance
impact of page swapping.
• Harvard Architecture - parallel data and code access
• 3 stage pipeline
• 32-Bit wide instruction and databus
• 32-Bit ALU
• 24-bit addressing, of 16MB linear address space
• Instructions and Addressing modes optimized for C-Programming & Compiler
• Optimized address path so it is capable to run at 50MHz without Flash wait states
— MAC unit 32bit += 32bit*32bit
— Hardware divider
— Single cycle multi-bit shifts (Barrel shifter)
— Special instructions for fixed point math
• Unimplemented opcode traps
• Unprogrammed byte value (0xFF) defaults to SWI instruction
1.4.1.1
•
Background debug controller (BDC) with single-wire interface
— Non-intrusive memory access commands
— Supports in-circuit programming of on-chip nonvolatile memory
1.4.1.2
•
Background Debug Controller (BDC)
Debugger (DBG)
Enhanced DBG module including:
— Four comparators (A, B, C and D) each configurable to monitor PC addresses or addresses of
data accesses
— A and C compare full address bus and full 32-bit data bus with data bus mask register
— B and D compare full address bus only
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
21
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
— Three modes: simple address/data match, inside address range, or outside address range
— Tag-type or force-type hardware breakpoint requests
State sequencer control
64 x 64-bit circular trace buffer to capture change-of-flow addresses or address and data of every
access
— Begin, End and Mid alignment of tracing to trigger
Profiling mode for external visibility of internal program flow
1.4.2
Embedded Memory
1.4.2.1
•
•
Memory Access Integrity
Illegal address detection
ECC support on embedded NVM and system RAM
1.4.2.2
Flash
On-chip flash memory on the MC9S12ZVM-family on the features the following:
• Up to128 KB of program flash memory
— 32 data bits plus 7 syndrome ECC (error correction code) bits allow single bit fault correction
and double fault detection
— Erase sector size 512 bytes
— Automated program and erase algorithm
— User margin level setting for reads
— Protection scheme to prevent accidental program or erase
1.4.2.3
•
Up to 512 bytes EEPROM
— 16 data bits plus 6 syndrome ECC (error correction code) bits allow single bit error correction
and double fault detection
— Erase sector size 4 bytes
— Automated program and erase algorithm
— User margin level setting for reads
1.4.2.4
•
EEPROM
SRAM
Up to 8 KB of general-purpose RAM with ECC
— Single bit error correction and double bit error detection
MC9S12ZVM Family Reference Manual Rev. 1.3
22
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.4.3
•
•
•
•
•
•
Clocks, Reset & Power Management Unit (CPMU)
Real time interrupt (RTI)
Clock monitor, supervising the correct function of the oscillator (CM)
Computer operating properly (COP) watchdog
— Configurable as window COP for enhanced failure detection
— Can be initialized out of reset using option bits located in flash memory
System reset generation
Autonomous periodic interrupt (API) (combination with cyclic, watchdog)
Low Power Operation
— RUN mode is the main full performance operating mode with the entire device clocked.
— WAIT mode when the internal CPU clock is switched off, so the CPU does not execute
instructions.
— Pseudo STOP - system clocks are stopped but the oscillator the RTI, the COP, and API modules
can be enabled
— STOP - the oscillator is stopped in this mode, all clocks are switched off and all counters and
dividers remain frozen, with the exception of the COP and API which can optionally run from
ACLK.
1.4.3.1
•
Phase-locked-loop clock frequency multiplier
— No external components required
— Reference divider and multiplier allow large variety of clock rates
— Automatic bandwidth control mode for low-jitter operation
— Automatic frequency lock detector
— Configurable option to spread spectrum for reduced EMC radiation (frequency modulation)
— Reference clock sources:
– Internal 1 MHz RC oscillator (IRC)
– External 4-20 MHz crystal oscillator/resonator
1.4.3.2
•
1.4.4
•
Internal Phase-Locked Loop (IPLL)
Internal RC Oscillator (IRC)
Trimmable internal 1MHz reference clock.
— Trimmed accuracy over -40°C to 150°C junction temperature range: ±1.3%max.
Main External Oscillator (XOSCLCP)
Amplitude controlled Pierce oscillator using 4 MHz to 20 MHz crystal
— Current gain control on amplitude output
— Signal with low harmonic distortion
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
23
Chapter 1 Device Overview MC9S12ZVM-Family
—
—
—
—
—
1.4.5
•
•
1.4.6
•
•
•
•
•
•
1.4.7
•
•
•
•
•
1.4.8
•
•
•
•
•
•
•
•
•
Low power
Good noise immunity
Eliminates need for external current limiting resistor
Trans conductance sized for optimum start-up margin for typical crystals
Oscillator pins shared with GPIO functionality
Timer (TIM)
4 x 16-bit channels Timer module for input capture or output compare
16-bit free-running counter with 8-bit precision prescaler
Pulse width Modulator with Fault protection (PMF)
6 x 15-bit channel PWM resolution
Each pair of channels can be combined to generate a PWM signal (with independent control of
edges of PWM signal)
Dead time insertion available for each complementary pair
Center-aligned or edge-aligned outputs
Programmable clock select logic with a wide range of frequencies
Programmable fault detection
Programmable Trigger Unit (PTU)
Enables synchronization between PMF and ADC
2 trigger input sources and software trigger source
2 trigger outputs
One 16-bit delay register pre-trigger output
Operation in One-Shot or Continuous modes
LIN physical layer transceiver
Compliant with LIN Physical Layer 2.2 specification.
Compliant with the SAE J2602-2 LIN standard.
Standby mode with glitch-filtered wake-up.
Slew rate selection optimized for the baud rates: 10.4kBit/s, 20kBit/s and Fast Mode (up to
250kBit/s).
Switchable 34kW/330kW pull-ups (in shutdown mode, 330kW only)
Current limitation for LIN Bus pin falling edge.
Over-current protection.
LIN TxD-dominant timeout feature monitoring the LPTxD signal.
Automatic transmitter shutdown in case of an over-current or TxD-dominant timeout.
MC9S12ZVM Family Reference Manual Rev. 1.3
24
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
•
Fulfills the OEM “Hardware Requirements for LIN (CAN and FlexRay) Interfaces in Automotive
Applications” v1.3.
1.4.9
•
•
•
•
•
•
•
•
Serial Communication Interface Module (SCI)
Full-duplex or single-wire operation
Standard mark/space non-return-to-zero (NRZ) format
Selectable IrDA 1.4 return-to-zero-inverted (RZI) format with programmable pulse widths
16-bit baud rate selection
Programmable character length
Programmable polarity for transmitter and receiver
Active edge receive wakeup
Break detect and transmit collision detect supporting LIN
1.4.10
•
•
•
•
•
Implementation of the CAN protocol — Version 2.0A/B
Five receive buffers with FIFO storage scheme
Three transmit buffers with internal prioritization using a “local priority” concept
Flexible maskable identifier filter supports two full-size (32-bit) extended identifier filters, or four
16-bit filters, or either 8-bit filters
Programmable wake-up functionality with integrated low-pass filter
1.4.11
•
•
•
•
•
•
Serial Peripheral Interface Module (SPI)
Configurable 8- or 16-bit data size
Full-duplex or single-wire bidirectional
Double-buffered transmit and receive
Master or slave mode
MSB-first or LSB-first shifting
Serial clock phase and polarity options
1.4.12
•
Multi-Scalable Controller Area Network (MSCAN)
Analog-to-Digital Converter Module (ADC)
Dual ADC
— 12-bit resolution
— Up to 9 external channels & 8 internal channels
— 2.5us for single 12-bit resolution conversion
— Left or right aligned result data
— Continuous conversion mode
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
25
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
Programmers model with list based command and result storage architecture
ADC directly writes results to RAM, preventing stall of further conversions
Internal signals monitored with the ADC module
— VRH, VRL, (VRL+VRH)/2, Vsup monitor, Vbg, TempSense, GDU phase, GDU DC-link
External pins can also be used as digital I/O
1.4.13
•
•
•
Monitoring of supply (VSUP) voltage
Internal ADC interface from an internal resistive divider
Generation of low or high voltage interrupts
1.4.14
•
•
•
On-Chip Voltage Regulator system (VREG)
Voltage regulator
— Linear voltage regulator directly supplied by VSUP
— Low-voltage detect on VSUP
— Power-on reset (POR)
— Low-voltage reset (LVR) for VDDX domain
— External ballast device support to reduce internal power dissipation
— Capable of supplying both the MCU internally plus external components
— Over-temperature interrupt
Internal voltage regulator
— Linear voltage regulator with bandgap reference
— Low-voltage detect on VDDA
— Power-on reset (POR) circuit
— Low-voltage reset for VDD domain
Package option for VREG ballast control output to supply external CANPHY
1.4.15
•
•
•
•
•
•
•
•
Supply Voltage Sensor (BATS)
Gate Drive Unit (GDU)
Low side and high side FET pre-drivers for each phase
Gate drive pre-regulator LDO (Low Dropout Voltage Regulator)
High side gate supply done via bootstrap circuit with external diode and capacitor
Sustaining charge pump with two external capacitors and diodes
Optional boost convertor configuration with voltage feedback
FET-Predriver desaturation and error recognition
Monitoring of FET High Side drain (HD) voltage
Diagnostic failure management
MC9S12ZVM Family Reference Manual Rev. 1.3
26
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.4.16
•
Current Sense
2 channel, integrated op-amp functionality
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
27
Chapter 1 Device Overview MC9S12ZVM-Family
Block Diagram
ADC0
AN0_[4:0]
12-bit
VRH
Analog-Digital Converter VRL
2K, 4K, 8KB RAM with ECC
512 bytes EEPROM with ECC
Current Sense Circuits
VDD
VSS2
VDDF
VSS1
VDDX1/VDDX2
VSUP
BCTL
VDDC
BCTLC
Voltage Regulator
(Nominal 12V)
CAN VREG
BATS
Voltage Supply Monitor
S12ZCPU
Interrupt Module
PE0
PE1
PTE
BKGD
RESET
TEST
AMPP1
AMPM1
AMP1
HD
CP
VCP
VLS_OUT
BST
VSSB
VBS[2:0]
HG[2:0]
HS[2:0]
VLS[2:0]
LG[2:0]
LS[2:0]
PMF
15-bit 6 channel
Pulse Width Modulator
DBG
Debug Module
4 Comparators
Trace Buffer
PWM0
PWM1
PWM2
PWM3
PWM4
PWM5
IOC0_0
TIM
16-bit 4-Channel Timer IOC0_1
Clock Monitor
EXTAL
IOC0_2
COP
Watchdog
Low Power Pierce
IOC0_3
Real
Time
Interrupt
XTAL Oscillator
PTURE
Auton. Periodic Int. PTU
Programmable Trigger PTUT0
PLL with Frequency
PTUT1
Modulation option Internal RC Oscillator Unit
BDC
Background
Debug Controller
Reset Generation
and Test Entry
LINPHY0
LIN0
LGND
GDU
Gate Drive Unit
LIN0
LGND
PTAD / KWAD
AMPP0
AMPM0
AMP0
PAD[8:5]
RXD1
SCI1
Asynchronous Serial IF TXD1
RXD0
SCI0
Asynchronous Serial IF TXD0
RXCAN0
CAN0
TXCAN0
msCAN 2.0B
MISO0
SPI0
MOSI0
SCK0
Synchronous Serial IF
SS0
HD
CP
VCP
VLS_OUT
BST
VSSB
VBS[2:0]
HG[2:0]
HS[2:0]
VLS[2:0]
LG[2:0]
LS[2:0]
PTP / KWP
32K, 64K, 128KB Flash with ECC
ADC1
AN1_[3:0]
12-bit
VRH
Analog-Digital Converter VRL
PAD[4:0]
PP0
PP1
PP2
PTT
5V Analog Supply
VDDA/VSSA
PT0
PT1
PT2
PT3
PTS / KWS
1.5
PS0
PS1
PS2
PS3
PS4
PS5
Block Diagram shows the maximum configuration
Not all pins or all peripherals are available on all devices and packages.
Rerouting options are not shown.
Figure 1-1. MC9S12ZVM-Family Block Diagram
MC9S12ZVM Family Reference Manual Rev. 1.3
28
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.6
Device Memory Map
Table 1-3 shows the device register memory map. All modules that can be instantiated more than once on
S12 devices are listed with an index number, even if they are only instantiated once on this device family.
Table 1-3. Module Register Address Ranges
Address
Module
Size
(Bytes)
0x0000–0x0003
Part ID Register Section 1.6.1
4
0x0004–0x000F
Reserved
12
0x0010–0x001F
INT
16
0x0020–0x006F
Reserved
80
0x0070–0x008F
MMC
32
0x0090–0x00FF
MMC Reserved
112
0x0100–0x017F
DBG
128
0x0180–0x01FF
Reserved
128
0x0200–0x02FF
PIM
256
0x0300–0x037F
Reserved
128
0x0380–0x039F
FTMRZ
32
0x03A0–0x03BF
Reserved
32
0x03C0–0x03CF
RAM ECC
16
0x03D0–0x04FF
Reserved
304
0x0500–0x053F
PMF
64
0x0540–0x057F
Reserved
64
0x0580–0x059F
PTU
32
0x05A0–0x05BF
Reserved
32
0x05C0–0x05EF
TIM0
48
0x05F0–0x05FF
Reserved
16
0x0600–0x063F
ADC0
64
0x0640–0x067F
ADC1
64
0x0680–0x069F
Reserved
32
(1)0x06A0–0x06BF
GDU
32
0x06C0–0x06DF
CPMU
32
0x06E0–0x06EF
Reserved
16
0x06F0–0x06F7
BATS
8
0x06F8–0x06FF
Reserved
8
0x0700–0x0707
SCI0
8
0x0708–0x070F
Reserved
8
0x0710–0x0717
SCI1
8
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
29
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-3. Module Register Address Ranges
Address
Module
Size
(Bytes)
0x0718–0x077F
Reserved
104
0x0780–0x0787
SPI0
8
0x0788–0x07FF
Reserved
120
0x0800–0x083F
CAN0
64
0x0840–0x097F
Reserved
320
0x0980–0x0987
LINPHY
8
0x0988–0x0FFF
Reserved
1656
1. Address range = 0x0690-0x069F on Maskset N06E
NOTE
Reserved register space shown above is not allocated to any module. This
register space is reserved for future use. Writing to these locations has no
effect. Read access to these locations returns zero.
MC9S12ZVM Family Reference Manual Rev. 1.3
30
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Register Space
0x00_0000
0x00_1000
4 KB
RAM
max. 1 MByte - 4 KB
0x10_0000
EEPROM
max. 1 MByte - 48 KB
Reserved
Reserved (read only)
NVM IFR
512 Byte
0x1F_4000
6 KB
0x1F_8000
256 Byte
0x1F_C000
0x20_0000
Unmapped
6 MByte
0x80_0000
Program NVM
max. 8 MB
Unmapped
address range
Low address aligned
High address aligned
0xFF_FFFF
Figure 1-2. MC9S12ZVM-Family Global Memory Map. (See Table 1-2 for individual device details)
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
31
Chapter 1 Device Overview MC9S12ZVM-Family
1.6.1
Part ID Assignments
The part ID is located in four 8-bit registers at addresses 0x0000-0x0003. The read-only value is a unique
part ID for each revision of the chip. Table 1-4 shows the assigned part ID number and mask set number.
Table 1-4. Assigned Part ID Numbers
Device
Mask Set Number
Part ID
MC9S12ZVM128
N06E
0x00170000
LIN
MC9S12ZVM128
N06E
0x00170001
CAN-VREG
MC9S12ZVM128
N56G
0x00171000
LIN
N56G
0x00171xxx
CAN-VREG / LIN
MC9S12ZVM128
0N95G
0x00172000
LIN
MC9S12ZVM128
0N95G
0x00172001
CAN-VREG
MC9S12ZVM128
1N95G
0x00172100
LIN
MC9S12ZVM128
1N95G
0x00172101
CAN-VREG
MC9S12ZVM32
TBD
0x00150000
LIN
(1)
MC9S12ZVM128
Bonding Option
1. This version for Freescale internal engineering puirposes only
1.7
Signal Description and Device Pinouts
This section describes signals that connect off-chip. It includes pin out diagrams a table of signal
properties, and detailed discussion of signals. Internal inter module signal mapping at device level is
described in 1.8 Internal Signal Mapping.
1.7.1
Pin Assignment Overview
Table 1-5 provides a summary of which ports are available.
Table 1-5. Port Availability by Package Option
Port
64 LQFP
Port AD
PAD[8:0]
Port E
PE[1:0]
Port P
PP[2:0]
Port S
PS[5:0]
Port T
PT[3:0]
sum of ports
24
MC9S12ZVM Family Reference Manual Rev. 1.3
32
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
NOTE
To avoid current drawn from floating inputs, all non-bonded pins should be
configured as output or configured as input with a pull up or pull down
device enabled
1.7.2
Detailed External Signal Descriptions
This section describes the properties of signals available at device pins. Signal names associated with
modules that can be instantiated more than once on an S12 are indexed, even if the module is only
instantiated once on the MC9S12ZVM-Family. If a signal already includes a channel number, then the index
is inserted before the channel number. Thus ANx_y corresponds to AN instance x, channel number y.
1.7.2.1
RESET — External Reset Signal
The RESET signal is an active low bidirectional control signal. It acts as an input to initialize the MCU to
a known start-up state, and an output when an internal MCU function causes a reset. The RESET pin has
an internal pull-up device.
1.7.2.2
TEST — Test Pin
This input only pin is reserved for factory test. This pin has an internal pull-down device.
NOTE
The TEST pin must be tied to ground in all applications.
1.7.2.3
MODC — Mode C Signal
The MODC signal is used as an MCU operating mode select during reset. The state of this signal is latched
to the MODC bit at the rising edge of RESET. The signal has an internal pull-up device.
1.7.2.4
PAD[8:0] / KWAD[8:0] — Port AD, Input Pins of ADC
PAD[8:0] are general-purpose input or output signals. The signals can be configured on per signal basis as
interrupt inputs with wake-up capability (KWAD[8:0]). These signals can have a pull-up or pull-down
device selected and enabled on per signal basis. During and out of reset the pull devices are disabled.
1.7.2.5
PE[1:0] — Port E I/O Signals
PE[1:0] are general-purpose input or output signals. The signals can have a pull-down device, enabled by
on a per pin basis. Out of reset the pull-down devices are enabled.
1.7.2.6
PP[2:0] / KWP[2:0] — Port P I/O Signals
PP[2:0] are general-purpose input or output signals. The signals can be configured on per signal basis as
interrupt inputs with wake-up capability (KWP[2:0]). They can have a pull-up or pull-down device
selected and enabled on per signal basis. During and out of reset the pull devices are disabled.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
33
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.7
PS[5:0] / KWS[5:0] — Port S I/O Signals
PS[5:0] are general-purpose input or output signals. The signals can be configured on per signal basis as
interrupt inputs with wake-up capability (KWS[5:0]). They can have a pull-up or pull-down device
selected and enabled on per signal basis. During and out of reset the pull-up devices are enabled.
1.7.2.8
PT[3:0] — Port T I/O Signals
PT[3:0] are general-purpose input or output signals. They can have a pull-up or pull-down device selected
and enabled on per signal basis. During and out of reset the pull devices are disabled.
1.7.2.9
AN0_[4:0], AN1_[3:0]— ADC Input Signals
These are the analog inputs of the Analog-to-Digital Converters. ADC0 has 5 analog input channels
connected to PAD port pins. ADC1 has 4 analog input channels connected to PAD port pins.
1.7.2.10
VRH, VRL — ADC Reference Signals
VRH and VRL are the reference voltage input pins for the analog-to-digital converter.
1.7.2.11
SPI0 Signals
1.7.2.11.1
SS0 Signal
This signal is associated with the slave select SS functionality of the serial peripheral interface SPI0.
1.7.2.11.2
SCK0 Signal
This signal is associated with the serial clock SCK functionality of the serial peripheral interface SPI0.
1.7.2.11.3
MISO0 Signal
This signal is associated with the MISO functionality of the serial peripheral interface SPI0. This signal
acts as master input during master mode or as slave output during slave mode.
1.7.2.11.4
MOSI0 Signal
This signal is associated with the MOSI functionality of the serial peripheral interface SPI0. This signal
acts as master output during master mode or as slave input during slave mode
1.7.2.12
1.7.2.12.1
SCI[1:0] Signals
RXD[1:0] Signals
These signals are associated with the receive functionality of the serial communication interfaces
(SCI[1:0]).
MC9S12ZVM Family Reference Manual Rev. 1.3
34
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.12.2
TXD[1:0] Signals
These signals are associated with the transmit functionality of the serial communication interfaces
(SCI[1:0]).
1.7.2.13
1.7.2.13.1
CAN0 Signals
RXCAN0 Signal
This signal is associated with the receive functionality of the scalable controller area network controller
(MSCAN0).
1.7.2.13.2
TXCAN0 Signal
This signal is associated with the transmit functionality of the scalable controller area network controller
(MSCAN0).
1.7.2.14
Timer IOC0_[3:0] Signals
The signals IOC0_[3:0] are associated with the input capture or output compare functionality of the timer
(TIM0) module.
1.7.2.15
PWM[5:0] Signals
The signals PWM[5:0] are associated with the PMF module digital channel outputs.
1.7.2.16
1.7.2.16.1
PTU Signals
PTUT[1:0] Signals
These signals are the PTU trigger output signals. These signals are routed to pins for debugging purposes.
1.7.2.16.2
PTURE Signal
This signal is the PTU reload enable output signal. This signal is routed to a pin for debugging purposes.
1.7.2.17
Interrupt Signals — IRQ and XIRQ
IRQ is a maskable level or falling edge sensitive input. XIRQ is a non-maskable level-sensitive interrupt.
1.7.2.18
1.7.2.18.1
Oscillator and Clock Signals
Oscillator Pins — EXTAL and XTAL
EXTAL and XTAL are the crystal driver and external clock pins. On reset all the device clocks are derived
from the internal PLLCLK, independent of EXTAL and XTAL. XTAL is the oscillator output.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
35
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.18.2
ECLK
This signal is associated with the output of the bus clock (ECLK).
NOTE
This feature is only intended for debug purposes at room temperature.
It must not be used for clocking external devices in an application.
1.7.2.19
1.7.2.19.1
BDC and Debug Signals
BKGD — Background Debug signal
The BKGD signal is used as a pseudo-open-drain signal for the background debug communication. The
BKGD signal has an internal pull-up device.
1.7.2.19.2
PDO — Profiling Data Output
This is the profiling data output signal used when the DBG module profiling feature is enabled. This signal
is output only and provides a serial, encoded data stream that can be used by external development tools
to reconstruct the internal CPU code flow.
1.7.2.19.3
PDOCLK — Profiling Data Output Clock
This is the PDO clock signal used when the DBG module profiling feature is enabled. This signal is output
only. During code profiling this is the clock signal that can be used by external development tools to sample
the PDO signal.
1.7.2.19.4
DBGEEV — External Event Input
This signal is the DBG external event input. It is input only. Within the DBG module, it allows an external
event to force a state sequencer transition, or trace buffer entry, or to gate trace buffer entries. A falling
edge at the external event signal constitutes an event. Rising edges have no effect. The maximum frequency
of events is half the internal core bus frequency.
1.7.2.20
FAULT5 — External Fault Input
This is the PMF fault input signal, with configurable polarity, that can be used to disable PMF operation
when asserted. Asynchronous shutdown of the GDU outputs HG[2:0] and LG[2:0] is not supported. Select
QSMPm[1:0] > 0 in PMF.
1.7.2.21
1.7.2.21.1
LIN Physical Layer Signals
LIN0
This pad is connected to the single-wire LIN data bus. This signal is only available on S12ZVML versions.
1.7.2.21.2
LP0TXD
This is the LIN physical layer transmitter input signal.
MC9S12ZVM Family Reference Manual Rev. 1.3
36
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.21.3
LP0RXD
This is the LIN physical layer receiver output signal.
1.7.2.21.4
LP0DR1
This is the LIN LP0DR1 register bit, visible at the designated pin for debug purposes.
1.7.2.22
Gate Drive Unit (GDU) Signals
These are associated with driving the external FETs.
1.7.2.22.1
HD — FET predriver High side Drain Input
This is the drain connection of the external high-side FETs. The voltage present at this input is scaled down
by an internal voltage divider, and can be routed to the internal ADC via an analog multiplexer.
This is also used as the LINPHY supply, VLINSUP.
1.7.2.22.2
VBS[2:0] - Bootstrap Capacitor Connections
These signals are the bootstrap capacitor connections for phases HS[2:0]. The capacitor connected
between HS[2:0] and these signals provides the gate voltage and current to drive the external FET.
1.7.2.22.3
HG[2:0] - High-Side Gate signals
The pins are the gate drives for the three high-side power FETs. The drivers provide a high current with
low impedance to turn on and off the high-side power FETs.
1.7.2.22.4
HS[2:0] - High-Side Source signals
The pins are the source connection for the high-side power FETs and the drain connection for the low-side
power FETs. The low voltage end of the bootstrap capacitor is also connected to this pin.
1.7.2.22.5
VLS[2:0] - Voltage Supply for Low -Side Drivers
The pins are the voltage supply pins for the three low-side FET pre-drivers. This pins should be connected
to the voltage regulator output pin VLS_OUT.
1.7.2.22.6
LG[2:0] - Low-Side Gate signals
The pins are the gate drives for the low-side power FETs. The drivers provide a high current with low
impedance to turn on and off the low-side power FETs.
1.7.2.22.7
LS[2:0] - Low-Side Source signals
The pins are the low-side source connections for the low-side power FETs. The pins are the power ground
pins used to return the gate currents from the low-side power FETs.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
37
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.22.8
CP - Charge Pump Output signal
This pin is the switching node of the charge pump circuit. The supply voltage for charge pump driver is
the output of the voltage regulator VLS_OUT. The output voltage of this pin switches typically between
0V and 11V. Must be left unconnected if not used.
1.7.2.22.9
VCP - Charge Pump Input for High-Side Driver Supply
This is the charge pump input for the FET high-side gate drive supply circuit. The pin must be left
unconnected if not used.
1.7.2.22.10 BST - Boost signal
This pin provides the basic switching elements required to implement a boost converter for low battery
voltage conditions. This requires external diodes, capacitors and a coil. This pin must be left unconnected
if not used.
1.7.2.22.11 VSSB - Boost Ground signal
This pin is a separate ground pin for the on chip boost converter switching device.
1.7.2.22.12 VLS_OUT - 11V Voltage Regulator Output
This pin is the output of the integrated voltage regulator. The output voltage is typically VVLS=11V. The
input voltage to the voltage regulator is the VSUP pin.
1.7.2.22.13 AMPP[1:0] - Current Sense Amplifier Non-Inverting Input
These are the current sense amplifier non-inverting inputs.
1.7.2.22.14 AMPM[1:0] - Current Sense Amplifier Inverting Input
These are the current sense amplifier inverting inputs.
1.7.2.22.15 AMP[1:0] - Current Sense Amplifier Output
These are the current sense amplifier outputs.
1.7.2.23
CAN Physical Interface Support
The MCU can supply an external CAN physical interface device directly, thus removing the need for an
external voltage regulator.
1.7.2.23.1
BCTLC
BCTLC provides the base current of an external bipolar that supplies an external CAN physical interface.
This signal is only available on S12ZVMC versions.
MC9S12ZVM Family Reference Manual Rev. 1.3
38
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.23.2
VDDC
VDDC is the CANPHY supply. This is the output voltage of the external bipolar, fed back to the MCU.
This signal is only available on S12ZVMC versions.
1.7.2.24
High Current Output — EVDD1
This is a high current, low voltage drop output intended for supplying external devices in a range of up to
20mA. Configuring the pin direction as output automatically enables the high current capability.
1.7.2.25
BCTL
BCTL is the ballast connection for the on chip voltage regulator. It provides the base current of an external
bipolar for the VDDX and VDDA supplies.
1.7.3
Power Supply Pins
The power and ground pins are described below. Because fast signal transitions place high, short-duration
current demands on the power supply, use bypass capacitors with high-frequency characteristics and place
them as close to the MCU as possible.
NOTE
All ground pins must be connected together in the application.
1.7.3.1
VDDX1, VDDX2, VSSX1 — Digital I/O Power and Ground Pins
VDDX1, VDDX2 are voltage regulator outputs to supply the digital I/O drivers.
The VSSX1 pin is the ground pin for the digital I/O drivers.
Bypass requirements on VDDX2, VDDX1, VSSX1 depend on how heavily the MCU pins are loaded.
1.7.3.2
VDDA, VSSA — Power Supply Pins for ADC
These are the power supply and ground pins for the analog-to-digital converter and the voltage regulator.
1.7.3.3
VDD, VSS2 — Core Power and Ground Pin
The VDD voltage supply of nominally 1.8V is generated by the internal voltage regulator. The return
current path is through the VSS2 pin.
1.7.3.4
VDDF, VSS1 — NVM Power and Ground Pin
The VDDF voltage supply of nominally 2.8V is generated by the internal voltage regulator. The return
current path is through the VSS1 pin.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
39
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.3.5
LGND — LINPHY Ground Pin
LGND is the ground pin for the LIN physical layer LINPHY. This signal is only available on S12ZVM(L)
versions, for which it must be connected to board ground, even if the LINPHY is not used.
1.7.3.6
VSUP — Voltage Supply Pin for Voltage Regulator
VSUP is the main supply pin typically coming from the car battery/alternator in the 12V supply voltage
range. This is the voltage supply input from which the voltage regulator generates the on chip voltage
supplies. It must be protected externally against a reverse battery connection.
1.7.4
Package and Pinouts
The following package options are offered.
• 64LQFP-EP (exposed pad) with internal LIN PHY.
• 64LQFP-EP (exposed pad) without internal LIN PHY but with CAN VREG to support the addition
of a low cost external CAN PHY.
The exposed pad must be connected to a grounded contact pad on the PCB.
The exposed pad has an electrical connection within the package to VSSFLAG (VSSX die connection).
The pin out details are shown in the following diagrams. Signals in brackets denote routing options.
NOTE
For the S12ZVM32 derivative the pins 1 and 64 are unused. Pin 64 must be
connected to ground and pin1 left unconnected.
MC9S12ZVM Family Reference Manual Rev. 1.3
40
Freescale Semiconductor
64
63
62
61
60
59
58
57
56
55
54
53
52
51
50
49
The exposed pad on the package bottom must be
connected to a grounded contact pad on the PCB.
LGND
VSSX1
VDDX1
PP0 / EVDD1 / KWP0 / (PWM0) / ECLK / FAULT5 / XIRQ
PP1 / KWP1 / (PWM1) / IRQ
PP2 / KWP2 / (PWM2)
VDDF
VSS1
PE0 / EXTAL
PE1 / XTAL
RESET
PT3 / IOC0_3 / (SS0)
PT2 / IOC0_2 / (PWM5) / (SCK0)
PT1 / IOC0_1 / (PWM4) / (MOSI0) / (TXD0) / LP0DR1 / PTURE
PT0 / IOC0_0 / (PWM3) / (MISO0) / (RXD0)
HS1
Chapter 1 Device Overview MC9S12ZVM-Family
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
MC9S12ZVML Versions
64-pin LQFP-EP
48
47
46
45
44
43
42
41
40
39
38
37
36
35
34
33
HG1
VBS1
VLS1
LG1
LS1
LS2
LG2
VLS2
VBS2
HG2
HS2
HS0
HG0
VBS0
VLS0
LG0
VDDX2
TEST
VSS2
VDD
AN0_0 / AMP0 / KWAD0 / PAD0
AN0_1 / AMPM0 / KWAD1 / PAD1
AN0_2 / AMPP0 / KWAD2 / PAD2
AN0_3 / KWAD3 / PAD3
AN0_4 / KWAD4 / PAD4
AN1_0 / AMP1 / KWAD5 / PAD5
(SS0) / AN1_1 / AMPM1 / KWAD6 / PAD6
AN1_2 / AMPP1 / KWAD7 / PAD7
VRH / AN1_3 / KWAD8 / PAD8
VDDA
VSSA
LS0
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
LIN0
MODC / BKGD
PTUT0 / (LP0RXD) / RXCAN0 / RXD1 / KWS0 / PS0
PTUT1 / (LP0TXD) / TXCAN0 / TXD1 / KWS1 / PS1
MISO0 / (RXD1) / KWS2 / PS2
MOSI0 / (TXD1) / DBGEEV / KWS3 / PS3
PDOCLK / SCK0 / KWS4 / PS4
PDO / SS0 / KWS5 / PS5
BCTL
HD
VCP
BST
VSSB
CP
VLS_OUT
VSUP
Figure 1-3. MC9S12ZVM-Family 64-pin LQFP pin out - LIN PHY option
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
41
Chapter 1 Device Overview MC9S12ZVM-Family
64
63
62
61
60
59
58
57
56
55
54
53
52
51
50
49
VDDC
VSSX1
VDDX1
PP0 / EVDD1 / KWP0 / (PWM0) / ECLK / FAULT5 / XIRQ
PP1 / KWP1 / (PWM1) / IRQ
PP2 / KWP2 / (PWM2)
VDDF
VSS1
PE0 / EXTAL
PE1 / XTAL
RESET
PT3 / IOC0_3 / (SS0)
PT2 / IOC0_2 / (PWM5) / (SCK0)
PT1 / IOC0_1 / (PWM4) / (MOSI0) / (TXD0) / PTURE
PT0 / IOC0_0 / (PWM3) / (MISO0) / (RXD0)
HS1
The exposed pad on the package bottom must be
connected to a grounded contact pad on the PCB.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
MC9S12ZVMC Versions
64-pin LQFP-EP
48
47
46
45
44
43
42
41
40
39
38
37
36
35
34
33
HG1
VBS1
VLS1
LG1
LS1
LS2
LG2
VLS2
VBS2
HG2
HS2
HS0
HG0
VBS0
VLS0
LG0
VDDX2
TEST
VSS2
VDD
AN0_0 / AMP0 / KWAD0 / PAD0
AN0_1 / AMPM0 / KWAD1 / PAD1
AN0_2 / AMPP0 / KWAD2 / PAD2
AN0_3 / KWAD3 / PAD3
AN0_4 / KWAD4 / PAD4
AN1_0 / AMP1 / KWAD5 / PAD5
(SS0) / AN1_1 / AMPM1 / KWAD6 / PAD6
AN1_2 / AMPP1 / KWAD7 / PAD7
VRH / AN1_3 / KWAD8 / PAD8
VDDA
VSSA
LS0
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
BCTLC
MODC / BKGD
PTUT0 / RXCAN0 / RXD1 / KWS0 / PS0
PTUT1 / TXCAN0 / TXD1 / KWS1 / PS1
MISO0 / (RXD1) / KWS2 / PS2
MOSI0 / (TXD1) / DBGEEV / KWS3 / PS3
PDOCLK / SCK0 / KWS4 / PS4
PDO / SS0 / KWS5 / PS5
BCTL
HD
VCP
BST
VSSB
CP
VLS_OUT
VSUP
Figure 1-4. MC9S12ZVM-Family 64-pin LQFP pin out - External CAN PHY option
MC9S12ZVM Family Reference Manual Rev. 1.3
42
Freescale Semiconductor
VDDX2
TEST
VSS2
VDD
AN0_0 / AMP0 / KWAD0 / PAD0
AN0_1 / AMPM0 / KWAD1 / PAD1
AN0_2 / AMPP0 / KWAD2 / PAD2
AN0_3 / KWAD3 / PAD3
AN0_4 / KWAD4 / PAD4
AN1_0 / AMP1 / KWAD5 / PAD5
(SS0) / AN1_1 / AMPM1 / KWAD6 / PAD6
AN1_2 / AMPP1 / KWAD7 / PAD7
VRH / AN1_3 / KWAD8 / PAD8
VDDA
VSSA
LS0
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
64
63
62
61
60
59
58
57
56
55
54
53
52
51
50
49
N.C. (connect to ground on board)
VSSX1
VDDX1
PP0 / EVDD1 / KWP0 / (PWM0) / ECLK / FAULT5 / XIRQ
PP1 / KWP1 / (PWM1) / IRQ
PP2 / KWP2 / (PWM2)
VDDF
VSS1
PE0 / EXTAL
PE1 / XTAL
RESET
PT3 / IOC0_3 / (SS0)
PT2 / IOC0_2 / (PWM5) / (SCK0)
PT1 / IOC0_1 / (PWM4) / (MOSI0) / PTURE
PT0 / IOC0_0 / (PWM3) / (MISO0)
HS1
Chapter 1 Device Overview MC9S12ZVM-Family
The exposed pad on the package bottom must be
connected to a grounded contact pad on the PCB.
N.C.
MODC / BKGD
PTUT0 / RXD1 / KWS0 / PS0
PTUT1 / TXD1 / KWS1 / PS1
MISO0 / (RXD1) / KWS2 / PS2
MOSI0 / (TXD1) / DBGEEV / KWS3 / PS3
PDOCLK / SCK0 / KWS4 / PS4
PDO / SS0 / KWS5 / PS5
BCTL
HD
VCP
BST
VSSB
CP
VLS_OUT
VSUP
Freescale Semiconductor
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
MC9S12ZVM32 Version
64-pin LQFP-EP
48
47
46
45
44
43
42
41
40
39
38
37
36
35
34
33
HG1
VBS1
VLS1
LG1
LS1
LS2
LG2
VLS2
VBS2
HG2
HS2
HS0
HG0
VBS0
VLS0
LG0
Figure 1-5. MC9S12ZVM32 64-pin LQFP pin out
MC9S12ZVM Family Reference Manual Rev. 1.3
43
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-6. Pin Summary (Sheet 1 of 3)
LQFP
Option
Function
64
L
64
C
Pin
1st
Func.
2nd
Func.
3rd
Func.
4th
Func.
5th
Func.
1
—
LIN
—
—
—
—
—
—
1
BCTLC
—
—
—
—
2
2
BKGD
MODC
—
—
3
3
PS0
KWS0
RXD1
4
4
PS1
KWS1
5
5
PS2
6
6
7
Power
Supply
Internal Pull
Resistor
CTRL
Reset
State
—
—
—
—
—
—
—
—
—
VDDX
—
Up
RXCAN0
LP0RXD
PTUT0
VDDX
PERS/
PPSS
Up
TXD1
TXCAN0
LP0TXD
PTUT1
VDDX
PERS/
PPSS
Up
KWS2
RXD1
MISO0
—
—
VDDX
PERS/
PPSS
Up
PS3
KWS3
DBGEEV
TXD1
MOSI0
—
VDDX
PERS/
PPSS
Up
7
PS4
KWS4
SCK0
PDOCLK
—
—
VDDX
PERS/
PPSS
Up
8
8
PS5
KWS5
SS0
PDO
—
—
VDDX
PERS/
PPSS
Up
9
9
BCTL
—
—
—
—
—
—
—
—
10
10
HD
—
—
—
—
—
—
—
—
11
11
VCP
—
—
—
—
—
—
—
—
12
12
BST
—
—
—
—
—
—
—
—
13
13
VSSB
—
—
—
—
—
—
—
—
14
14
CP
—
—
—
—
—
—
—
—
15
15
VLS_OUT
—
—
—
—
—
—
—
—
16
16
VSUP
—
—
—
—
—
VSUP
—
—
17
17
VDDX2
—
—
—
—
—
VDDX
—
—
18
18
TEST
—
—
—
—
—
—
RESET
Down
19
19
VSS2
—
—
—
—
—
—
—
—
20
20
VDD
—
—
—
—
—
VDD
—
—
21
21
PAD0
KWAD0
AN0_0
AMP0
—
—
VDDA
PERADL/
PPSADL
Off
22
22
PAD1
KWAD1
AN0_1
AMPM0
—
—
VDDA
PERADL/
PPSADL
Off
MC9S12ZVM Family Reference Manual Rev. 1.3
44
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-6. Pin Summary (Sheet 2 of 3)
LQFP
Option
Function
Power
Supply
Internal Pull
Resistor
64
L
64
C
Pin
1st
Func.
2nd
Func.
3rd
Func.
4th
Func.
5th
Func.
23
23
PAD2
KWAD2
AN0_2
AMPP0
—
—
VDDA
PERADL/
PPSADL
Off
24
24
PAD3
KWAD3
AN0_3
—
—
—
VDDA
PERADL/
PPSADL
Off
25
25
PAD4
KWAD4
AN0_4
—
—
—
VDDA
PERADL/
PPSADL
Off
26
26
PAD5
KWAD5
AN1_0
AMP1
—
—
VDDA
PERADL/
PPSADL
Off
27
27
PAD6
KWAD6
AN1_1
AMPM1
SS0
—
VDDA
PERADL/
PPSADL
Off
28
28
PAD7
KWAD7
AN1_2
AMPP1
—
—
VDDA
PERADL/
PPSADL
Off
29
29
PAD8
KWAD8
AN1_3
VRH
—
—
VDDA
PERADH/
PPSADH
Off
30
30
VDDA
—
—
—
—
—
VDDA
—
—
31
31
VSSA
—
—
—
—
—
—
—
—
32
32
LS0
—
—
—
—
—
—
—
—
33
33
LG0
—
—
—
—
—
—
—
—
34
34
VLS0
—
—
—
—
—
—
—
—
35
35
VBS0
—
—
—
—
—
—
—
—
36
36
HG0
—
—
—
—
—
—
—
—
37
37
HS0
—
—
—
—
—
—
—
—
38
38
HS2
—
—
—
—
—
—
—
—
39
39
HG2
—
—
—
—
—
—
—
—
40
40
VBS2
—
—
—
—
—
—
—
—
41
41
VLS2
—
—
—
—
—
—
—
—
42
42
LG2
—
—
—
—
—
—
—
—
43
43
LS2
—
—
—
—
—
—
—
—
44
44
LS1
—
—
—
—
—
—
—
—
45
45
LG1
—
—
—
—
—
—
—
—
46
46
VLS1
—
—
—
—
—
—
—
—
47
47
VBS1
—
—
—
—
—
—
—
—
48
48
HG1
—
—
—
—
—
—
—
—
CTRL
Reset
State
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
45
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-6. Pin Summary (Sheet 3 of 3)
LQFP
Option
Function
64
L
64
C
Pin
1st
Func.
2nd
Func.
3rd
Func.
4th
Func.
5th
Func.
49
49
HS1
—
—
—
—
—
50
50
PT0
IOC0_0
PWM3
MISO0
RXD0
51
51
PT1
IOC0_1
PWM4
MOSI0
52
52
PT2
IOC0_2
PWM5
53
53
PT3
IOC0_3
54
54
RESET
55
55
56
Power
Supply
Internal Pull
Resistor
CTRL
Reset
State
—
—
—
—
VDDX
PERT/
PPST
Off
TXD0
LP0DR1/
PTURE
VDDX
PERT/
PPST
Off
SCK0
—
—
VDDX
PERT/
PPST
Off
SS0
—
—
—
VDDX
PERT/
PPST
Off
—
—
—
—
—
VDDX
TEST pin
Up
PE1
XTAL
—
—
—
—
VDDX
PERE/
PPSE
Down
56
PE0
EXTAL
—
—
—
—
VDDX
PERE/
PPSE
Down
57
57
VSS1
—
—
—
—
—
—
—
—
58
58
VDDF
—
—
—
—
—
VDDF
—
—
59
59
PP2
KWP2
PWM2
—
—
—
VDDX
PERP/
PPSP
Off
60
60
PP1
KWP1
PWM1
IRQ
—
—
VDDX
PERP/
PPSP
Off
61
61
PP0 /
EVDD1
KWP0
PWM0
ECLK
FAULT5
XIRQ
VDDX
PERP/
PPSP
Off
62
62
VDDX1
—
—
—
—
—
VDDX
—
—
63
63
VSSX1
—
—
—
—
—
—
—
—
64
—
LGND
—
—
—
—
—
—
—
—
—
64
VDDC
—
—
—
—
—
—
—
—
1.8
Internal Signal Mapping
This section specifies the mapping of inter-module signals at device level.
1.8.1
1.8.1.1
ADC Connectivity
ADC Reference Voltages
For both ADC modules, VRH_1 is mapped to VDDA; VRH_0 is mapped to PAD[8]; VRL_0 and VRL_1
are both mapped to VSSA, whereby VRL_1 is the preferred reference for low noise.
MC9S12ZVM Family Reference Manual Rev. 1.3
46
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.8.1.2
ADC Internal Channels
The ADC0 and ADC1 internal channel mapping is shown in Table 1-7 and Table 1-8 respectively.
The GDU current sense amplifier outputs are mapped to pins with ADC input functionality. Thus
configuring the ADC to convert these pin channels automatically converts the current sense outputs.
The ADC internal temperature sensors must be calibrated by the user. No electrical parameters are
specified for these sensors. The VREG temperature sensor electrical parameters are given in the
appendices.
Table 1-7. Usage of ADC0 Internal Channels
ADCCMD_1 CH_SEL[5:0]
ADC Channel
Usage
0
0
1
0
0
0
Internal_0
ADC0 temperature sensor
0
0
1
0
0
1
Internal_1
VREG temperature sensor or bandgap (VBG)(1)
0
0
1
0
1
0
Internal_2
GDU phase multiplexer voltage
0
0
1
0
1
1
Internal_3
GDU DC link voltage monitor
0
0
1
1
0
0
Internal_4
BATS VSUP sense voltage
0
0
1
1
0
1
Internal_5
Reserved
0
0
1
1
1
0
Internal_6
Reserved
0
0
1
1
1
1
Internal_7
Reserved
1. Selectable in CPMU
Table 1-8. Usage of ADC1 Internal Channels
ADCCMD_1 CH_SEL[5:0]
ADC Channel
Usage
0
0
1
0
0
0
Internal_0
ADC1 temperature sensor
0
0
1
0
0
1
Internal_1
VREG temperature sensor or bandgap (VBG)(1)
0
0
1
0
1
0
Internal_2
GDU phase multiplexer voltage
0
0
1
0
1
1
Internal_3
GDU DC link voltage monitor
0
0
1
1
0
0
Internal_4
Reserved
0
0
1
1
0
1
Internal_5
Reserved
0
0
1
1
1
0
Internal_6
Reserved
0
0
1
1
1
1
Internal_7
Reserved
1. Selectable in CPMU
1.8.2
Motor Control Loop Signals
The motor control loop signals are described in 1.13.3.1 Motor Control Loop Overview
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
47
Chapter 1 Device Overview MC9S12ZVM-Family
1.8.3
Device Level PMF Connectivity
Table 1-9. Mapping of PMF signals
1.8.4
PMF Connection
Usage
Channel0
High-Side Gate and Source Pins HG[0], HS[0]
Channel1
Low-Side Gate and Source Pins LG[0], LS[0]
Channel2
High-Side Gate and Source Pins HG[1], HS[1]
Channel3
Low-Side Gate and Source Pins LG[1], LS[1]
Channel4
High-Side Gate and Source Pins HG[2], HS[2]
Channel5
Low-Side Gate and Source Pins LG[2], LS[2]
FAULT5
External FAULT5 pin
FAULT4
HD Over voltage or GDU over current
FAULT3
VLS under voltage
FAULT2
GDU Desaturation[2] or GDU over current
FAULT1
GDU Desaturation[1] or GDU over current
FAULT0
GDU Desaturation[0] or GDU over current
IS2
GDU Phase Status[2]
IS1
GDU Phase Status[1]
IS0
GDU Phase Status[0]
async_event_edge_sel[1:0]
Tied to b11 (both edges active)
BDC Clock Source Connectivity
The BDC clock, BDCCLK, is mapped to the IRCCLK generated in the CPMU module.
The BDC clock, BDCFCLK is mapped to the device bus clock, generated in the CPMU module.
1.8.5
LINPHY Connectivity
The VLINPHY supply is connected to the device HD pin.
1.8.6
FTMRZ Connectivity
The soc_erase_all_req input to the flash module is driven directly by a BDC erase flash request resulting
from the BDC ERASE_FLASH command.
The FTMRZ FCLKDIV register is forced to 0x05 by the BDC ERASE_FLASH command. This
configures the clock frequency correctly for the initial bus frequency on leaving reset. The bus frequency
must not be changed before launching the ERASE_FLASH command.
1.8.7
CPMU Connectivity
The API clock generated in the CPMU is not mapped to a device pin in the MC9S12ZVM-Family.
MC9S12ZVM Family Reference Manual Rev. 1.3
48
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.9
Modes of Operation
The MCU can operate in different modes. These are described in 1.9.1 Chip Configuration Modes.
The MCU can operate in different power modes to facilitate power saving when full system performance
is not required. These are described in 1.9.3 Low Power Modes.
Some modules feature a software programmable option to freeze the module status whilst the background
debug module is active to facilitate debugging. This is referred to as freeze mode at module level.
1.9.1
Chip Configuration Modes
The different modes and the security state of the MCU affect the debug features (enabled or disabled).
The operating mode out of reset is determined by the state of the MODC signal during reset (Table 1-10).
The MODC bit in the MODE register shows the current operating mode and provides limited mode
switching during operation. The state of the MODC signal is latched into this bit on the rising edge of
RESET.
Table 1-10. Chip Modes
Chip Modes
1.9.1.1
MODC
Normal single chip
1
Special single chip
0
Normal Single-Chip Mode
This mode is intended for normal device operation. The opcode from the on-chip memory is being
executed after reset (requires the reset vector to be programmed correctly). The processor program is
executed from internal memory.
1.9.1.2
Special Single-Chip Mode
This mode is used for debugging operation, boot-strapping, or security related operations. The background
debug mode (BDM) is active on leaving reset in this mode.
1.9.2
Debugging Modes
The background debug mode (BDM) can be activated by the BDC module or directly when resetting into
Special Single-Chip mode. Detailed information can be found in the BDC module section.
Writing to internal memory locations using the debugger, whilst code is running or at a breakpoint, can
change the flow of application code.
The MC9S12ZVM-Family supports BDC communication throughout the device Stop mode. During Stop
mode, writes to control registers can alter the operation and lead to unexpected results. It is thus
recommended not to reconfigure the peripherals during STOP using the debugger.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
49
Chapter 1 Device Overview MC9S12ZVM-Family
The DBG module supports breakpoint, tracing and profiling features. At board level the profiling pins can
use the same 6-pin connector typically used for the BDC BKGD pin. The connector pin mapping shown
in Figure 1-6 is supported by device evaluation boards and leading development tool vendors.
GND
2
1
BKGD
RST
4
3
PDO
VDDX
6
5
PDOCLK
Figure 1-6. Standard Debug Connector Pin Mapping
1.9.3
Low Power Modes
The device has two dynamic-power modes (run and wait) and two static low-power modes stop and pseudo
stop). For a detailed description refer to the CPMU section.
• Dynamic power mode: Run
— Run mode is the main full performance operating mode with the entire device clocked. The user
can configure the device operating speed through selection of the clock source and the phase
locked loop (PLL) frequency. To save power, unused peripherals must not be enabled.
• Dynamic power mode: Wait
— This mode is entered when the CPU executes the WAI instruction. In this mode the CPU does
not execute instructions. The internal CPU clock is switched off. All peripherals can be active
in system wait mode. For further power consumption the peripherals can individually turn off
their local clocks. Asserting RESET, XIRQ, IRQ, or any other interrupt that is not masked,
either locally or globally by a CCR bit, ends system wait mode.
• Static power modes:
Static power (Stop) modes are entered following the CPU STOP instruction unless an NVM
command is active. When no NVM commands are active, the Stop request is acknowledged and
the device enters either Stop or Pseudo Stop mode. Further to the general system aspects of Stop
mode discussed here, the motor control loop specific considerations are described in
Section 1.13.3.10.
— Pseudo-stop: In this mode the system clocks are stopped but the oscillator is still running and
the real time interrupt (RTI), watchdog (COP) and Autonomous Periodic Interrupt (API) may
be enabled. Other peripherals are turned off. This mode consumes more current than system
STOP mode but, as the oscillator continues to run, the full speed wake up time from this mode
is significantly shorter.
— Stop: In this mode the oscillator is stopped and clocks are switched off. The counters and
dividers remain frozen. The autonomous periodic interrupt (API) may remain active but has a
very low power consumption. The key pad, SCI and MSCAN transceiver modules can be
configured to wake the device, whereby current consumption is negligible.
If the BDC is enabled in Stop mode, the VREG remains in full performance mode and the
CPMU continues operation as in run mode. With BDC enabled and BDCCIS bit set, then all
clocks remain active to allow BDC access to internal peripherals. If the BDC is enabled and
MC9S12ZVM Family Reference Manual Rev. 1.3
50
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
BDCCIS is clear, then the BDCSI clock remains active, but bus and core clocks are disabled.
With the BDC enabled during Stop, the VREG full performance mode and clock activity lead
to higher current consumption than with BDC disabled. If the BDC is enabled in Stop mode,
then the BATS voltage monitoring remains enabled.
1.10
Security
The MCU security mechanism prevents unauthorized access to the flash memory. It must be emphasized
that part of the security must lie with the application code. An extreme example would be application code
that dumps the contents of the internal memory. This would defeat the purpose of security. Also, if an
application has the capability of downloading code through a serial port and then executing that code (e.g.
an application containing bootloader code), then this capability could potentially be used to read the
EEPROM and Flash memory contents even when the microcontroller is in the secure state. In this example,
the security of the application could be enhanced by requiring a response authentication before any code
can be downloaded.
Device security details are also described in the flash block description.
1.10.1
Features
The security features of the S12Z chip family are:
• Prevent external access of the non-volatile memories (Flash, EEPROM) content
• Restrict execution of NVM commands
1.10.2
Securing the Microcontroller
The chip can be secured by programming the security bits located in the options/security byte in the Flash
memory array. These non-volatile bits keep the device secured through reset and power-down.
This byte can be erased and programmed like any other Flash location. Two bits of this byte are used for
security (SEC[1:0]). The contents of this byte are copied into the Flash security register (FSEC) during a
reset sequence.
The meaning of the security bits SEC[1:0] is shown in Table 1-11. For security reasons, the state of device
security is controlled by two bits. To put the device in unsecured mode, these bits must be programmed to
SEC[1:0] = ‘10’. All other combinations put the device in a secured mode. The recommended value to put
the device in secured state is the inverse of the unsecured state, i.e. SEC[1:0] = ‘01’.
Table 1-11. Security Bits
SEC[1:0]
Security State
00
1 (secured)
01
1 (secured)
10
0 (unsecured)
11
1 (secured)
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
51
Chapter 1 Device Overview MC9S12ZVM-Family
NOTE
Please refer to the Flash block description for more security byte details.
1.10.3
Operation of the Secured Microcontroller
By securing the device, unauthorized access to the EEPROM and Flash memory contents is prevented.
Secured operation has the following effects on the microcontroller:
1.10.3.1
•
•
Background debug controller (BDC) operation is completely disabled.
Execution of Flash and EEPROM commands is restricted (described in flash block description).
1.10.3.2
•
•
Normal Single Chip Mode (NS)
Special Single Chip Mode (SS)
Background debug controller (BDC) commands are restricted
Execution of Flash and EEPROM commands is restricted (described in flash block description).
In special single chip mode the device is in active BDM after reset. In special single chip mode on a secure
device, only the BDC mass erase and BDC control and status register commands are possible. BDC access
to memory mapped resources is disabled. The BDC can only be used to erase the EEPROM and Flash
memory without giving access to their contents.
1.10.4
Unsecuring the Microcontroller
Unsecuring the microcontroller can be done using three different methods:
1. Backdoor key access
2. Reprogramming the security bits
3. Complete memory erase
1.10.4.1
Unsecuring the MCU Using the Backdoor Key Access
In normal single chip mode, security can be temporarily disabled using the backdoor key access method.
This method requires that:
• The backdoor key has been programmed to a valid value
• The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’.
• The application program programmed into the microcontroller has the capability to write to the
backdoor key locations
The backdoor key values themselves would not normally be stored within the application data, which
means the application program would have to be designed to receive the backdoor key values from an
external source (e.g. through a serial port)
The backdoor key access method allows debugging of a secured microcontroller without having to erase
the Flash. This is particularly useful for failure analysis.
MC9S12ZVM Family Reference Manual Rev. 1.3
52
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
NOTE
No backdoor key word is allowed to have the value 0x0000 or 0xFFFF.
1.10.5
Reprogramming the Security Bits
Security can also be disabled by erasing and reprogramming the security bits within the flash
options/security byte to the unsecured value. Since the erase operation will erase the entire sector
(0x7F_FE00–0x7F_FFFF) the backdoor key and the interrupt vectors will also be erased; this method is
not recommended for normal single chip mode. The application software can only erase and program the
Flash options/security byte if the Flash sector containing the Flash options/security byte is not protected
(see Flash protection). Thus Flash protection is a useful means of preventing this method. The
microcontroller enters the unsecured state after the next reset following the programming of the security
bits to the unsecured value.
This method requires that:
•
•
The application software previously programmed into the microcontroller has been designed to
have the capability to erase and program the Flash options/security byte.
The Flash sector containing the Flash options/security byte is not protected.
1.10.6
Complete Memory Erase
The microcontroller can be unsecured by erasing the entire EEPROM and Flash memory contents. If
ERASE_FLASH is successfully completed, then the Flash unsecures the device and programs the security
byte automatically.
1.11
1.11.1
Resets and Interrupts
Resets
Table 1-12. lists all reset sources and the vector locations. Resets are explained in detail in the Chapter 8,
“S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)”.
Table 1-12. Reset Sources and Vector Locations
Vector Address
Reset Source
CCR
Mask
Local Enable
0xFFFFFC
Power-On Reset (POR)
None
None
Low Voltage Reset (LVR)
None
None
External pin RESET
None
None
Clock monitor reset
None
OSCE Bit in CPMUOSC register
COP watchdog reset
None
CR[2:0] in CPMUCOP register
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
53
Chapter 1 Device Overview MC9S12ZVM-Family
1.11.2
Interrupt Vectors
Table 1-13 lists all interrupt sources and vectors in the default order of priority. The interrupt module
description provides an interrupt vector base register (IVBR) to relocate the vectors.
Table 1-13. Interrupt Vector Locations (Sheet 1 of 4)
CCR
Mask
Local Enable
Unimplemented page1 op-code trap
(SPARE)
None
None
-
-
Vector base + 0x1F4
Unimplemented page2 op-code trap
(TRAP)
None
None
-
-
Vector base + 0x1F0
Software interrupt instruction (SWI)
None
None
-
-
Vector base + 0x1EC
System call interrupt instruction
(SYS)
None
None
-
-
Vector base + 0x1E8
Machine exception
None
None
-
-
Vector Address(1)
Interrupt Source
Vector base + 0x1F8
Vector base + 0x1E4
Reserved
Vector base + 0x1E0
Reserved
Wake up
Wake up
from STOP from WAIT
Vector base + 0x1DC
Spurious interrupt
—
None
-
-
Vector base + 0x1D8
XIRQ interrupt request
X bit
None
Yes
Yes
Vector base + 0x1D4
IRQ interrupt request
I bit
IRQCR(IRQEN)
Yes
Yes
Vector base + 0x1D0
RTI time-out interrupt
I bit
CPMUINT (RTIE)
See CPMU
section
Yes
Vector base + 0x1CC
TIM0 timer channel 0
I bit
TIM0TIE (C0I)
No
Yes
Vector base + 0x1C8
TIM0 timer channel 1
I bit
TIM0TIE (C1I)
No
Yes
Vector base + 0x1C4
TIM0 timer channel 2
I bit
TIM0TIE (C2I)
No
Yes
Vector base + 0x1C0
TIM0 timer channel 3
I bit
TIM0TIE (C3I)
No
Yes
No
Yes
Vector base + 0x1BC
to
Vector base + 0x1B0
Vector base + 0x1AC
Reserved
TIM0 timer overflow
I bit
Vector base + 0x1A8
to
Vector base + 0x1A4
TIM0TSCR2(TOI)
Reserved
Vector base + 0x1A0
SPI0
I bit
SPI0CR1 (SPIE, SPTIE)
No
Yes
Vector base + 0x19C
SCI0
I bit
SCI0CR2
(TIE, TCIE, RIE, ILIE)
Yes
Yes
Vector base + 0x198
SCI1
I bit
SCI1CR2
(TIE, TCIE, RIE, ILIE)
Yes
Yes
Vector base + 0x194
Reserved
Vector base + 0x190
Reserved
MC9S12ZVM Family Reference Manual Rev. 1.3
54
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-13. Interrupt Vector Locations (Sheet 1 of 4)
Vector Address(1)
Interrupt Source
CCR
Mask
Vector base + 0x18C
ADC0 Error
I bit
ADC0EIE (IA_EIE,
CMD_EIE, EOL_EIE,
TRIG_EIE, RSTAR_EIE,
LDOK_EIE)
ADC0IE(CONIF_OIE)
No
Yes
Vector base + 0x188
ADC0 conversion sequence abort
I bit
ADC0IE(SEQAD_IE)
No
Yes
Vector base + 0x184
ADC0 conversion complete
I bit
ADC0CONIE[15:0]
No
Yes
Vector base + 0x180
Oscillator status interrupt
I bit
CPMUINT (OSCIE)
No
Yes
Vector base + 0x17C
PLL lock interrupt
I bit
CPMUINT (LOCKIE)
No
Yes
No
Yes
Vector base + 0x178
to
Vector base + 0x174
Vector base + 0x170
Local Enable
Wake up
Wake up
from STOP from WAIT
Reserved
RAM error
I bit
Vector base + 0x16C
to
Vector base + 0x168
EECIE (SBEEIE)
Reserved
Vector base + 0x164
FLASH error
I bit
FERCNFG (SFDIE)
No
Yes
Vector base + 0x160
FLASH command
I bit
FCNFG (CCIE)
No
Yes
Vector base + 0x15C
CAN0 wake-up
I bit
CAN0RIER (WUPIE)
Yes
Yes
Vector base + 0x158
CAN0 errors
I bit
CAN0RIER (CSCIE, OVRIE)
No
Yes
Vector base + 0x154
CAN0 receive
I bit
CAN0RIER (RXFIE)
No
Yes
Vector base + 0x150
CAN0 transmit
I bit
CAN0TIER (TXEIE[2:0])
No
Yes
Vector base + 0x14C
to
Vector base + 0x148
Vector base + 0x144
Reserved
LINPHY over-current interrupt
I bit
LPIE (LPDTIE,LPOCIE)
No
Yes
Vector base + 0x140 BATS supply voltage monitor interrupt
I bit
BATIE (BVHIE,BVLIE)
No
Yes
Vector base + 0x13C
GDU Desaturation Error
I bit
GDUIE (GDSEIE)
No
Yes
Vector base + 0x138
GDU Voltage Limit Detected
I bit
GDUIE (GOCIE, GHHDFIE,
GLVLSFIE)
No
Yes
Yes
Yes
Vector base + 0x134
to
Vector base + 0x128
Vector base + 0x124
Vector base + 0x120
Reserved
Port S interrupt
I bit
PIES[5:0]
Reserved
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
55
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-13. Interrupt Vector Locations (Sheet 1 of 4)
Vector Address(1)
Interrupt Source
CCR
Mask
Vector base + 0x11C
ADC1 Error
I bit
ADC1EIE (IA_EIE,
CMD_EIE, EOL_EIE,
TRIG_EIE, RSTAR_EIE,
LDOK_EIE)
ADC1IE(CONIF_OIE)
No
Yes
Vector base + 0x118
ADC1 conversion sequence abort
I bit
ADC1IE(SEQAD_IE)
No
Yes
Vector base + 0x114
ADC1 conversion complete
I bit
ADC1CONIE[15:0]
No
Yes
Vector base + 0x110
Local Enable
Wake up
Wake up
from STOP from WAIT
Reserved
Vector base + 0x10C
Port P interrupt
I bit
PIEP[2:0]
Yes
Yes
Vector base + 0x108
EVDD1 over-current interrupt
I bit
PIEP(OCIE1)
No
Yes
Vector base + 0x104
Low-voltage interrupt (LVI)
I bit
CPMULVCTL (LVIE)
No
Yes
Vector base + 0x100
Autonomous periodical interrupt
(API)
I bit
Yes
Yes
Vector base + 0xFC
High temperature interrupt
I bit
Yes
Yes
CPMUAPICTRL (APIE)
CPMUHTCTL(HTIE)
Reserved
Vector base + 0xF8
Vector base + 0xF4
Port AD interrupt
I bit
PIEADH(PIEADH0)
PIEADL(PIEADL[7:0])
Yes
Yes
Vector base + 0xF0
PTU Reload Overrun
I bit
PTUIEH(PTUROIE)
No
Yes
Vector base + 0xEC
PTU Trigger0 Error
I bit
PTUIEL(TG0AEIE,
TG0REIE,TG0TEIE)
No
Yes
Vector base + 0xE8
PTU Trigger1 Error
I bit
PTUIEL(TG1AEIE, TG1REIE,
TG1TEIE)
No
Yes
Vector base + 0xE4
PTU Trigger0 Done
I bit
PTUIEL(TG0DIE)
No
Yes
Vector base + 0xE0
PTU Trigger1 Done
I bit
PTUIEL(TG1DIE)
No
Yes
Vector base + 0xDC
to
Vector base + 0xD4
Reserved
Vector base + 0xD0
PMF Reload A
I bit
PMFENCA(PWMRIEA)
No
Yes
Vector base + 0xCC
PMF Reload B
I bit
PMFENCB(PWMRIEB)
No
Yes
Vector base + 0xC8
PMF Reload C
I bit
PMFENCC(PWMRIEC)
No
Yes
Vector base + 0xC4
PMF Fault
I bit
PMFFIE(FIE[5:0])
No
Yes
Vector base + 0xC0
PMF Reload Overrun
I bit
PMFROIE(PMFROIEA,PMF
ROIEB,PMFROIEC)
No
Yes
Vector base + 0xBC
to
Vector base + 0x10
Reserved
1. 15 bits vector address based
MC9S12ZVM Family Reference Manual Rev. 1.3
56
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.11.3
Effects of Reset
When a reset occurs, MCU registers and control bits are initialized. Refer to the respective block sections
for register reset states.
On each reset, the Flash module executes a reset sequence to load Flash configuration registers.
1.11.3.1
Flash Configuration Reset Sequence Phase
On each reset, the Flash module will hold CPU activity while loading Flash module registers from the
Flash memory. If double faults are detected in the reset phase, Flash module protection and security may
be active on leaving reset. This is explained in more detail in the Flash module description.
1.11.3.2
Reset While Flash Command Active
If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The
state of the word being programmed or the sector/block being erased is not guaranteed.
1.11.3.3
I/O Pins
Refer to the PIM section for reset configurations of all peripheral module ports.
1.11.3.4
RAM
The system RAM arrays, including their ECC syndromes, are initialized following a power on reset. All
other RAM arrays are not initialized out of any type of reset.
With the exception of a power-on-reset the RAM content is unaltered by a reset occurrence.
1.12
1.12.1
Module device level dependencies
CPMU COP Configuration
The COP time-out rate bits CR[2:0] and the WCOP bit in the CPMUCOP register are loaded from the
Flash configuration field byte at global address 0xFF_FE0E during the reset sequence. See Table 1-14 and
Table 1-15 for coding.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
57
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-14. Initial COP Rate Configuration
NV[2:0] in
FOPT Register
CR[2:0] in
CPMUCOP Register
000
111
001
110
010
101
011
100
100
011
101
010
110
001
111
000
Table 1-15. Initial WCOP Configuration
1.12.2
NV[3] in
FOPT Register
WCOP in
CPMUCOP Register
1
0
0
1
CPMU High Temperature Trimming
The value loaded from the flash into the CPMUHTTR register is a default value for the device family.
There is no device specific trimming carried out during production. The specified VHT value is a typical
value that is part dependent and should thus be calibrated.
1.12.3
Flash IFR Mapping
Table 1-16. Flash IFR Mapping
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
ADC0 reference conversion using VDDA/VSSA
IFR Byte Address
0x1F_C040 & 0x1F_C041
ADC0 reference conversion using PAD8/VSSA
0x1F_C042 & 0x1F_C043
ADC1 reference conversion using VDDA/VSSA
0x1F_C044 & 0x1F_C045
ADC1 reference conversion using PAD8/VSSA
0x1F_C046 & 0x1F_C047
1.13
1.13.1
Application Information
ADC Calibration
For applications that do not provide external ADC reference voltages, the VDDA/VSSA supplies can be
used as sources for VRH/VRL respectively. Since the VDDA must be connected to VDDX at board level
in the application, the accuracy of the VDDA reference is limited by the internal voltage regulator
accuracy. In order to compensate for VDDA reference voltage variation in this case, the reference voltage
MC9S12ZVM Family Reference Manual Rev. 1.3
58
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
is measured during production test using the internal reference voltage VBG, which has a narrow variation
over temperature and external voltage supply. VBG is mapped to an internal channel of each ADC module
(Table 1-7,Table 1-8). The resulting 12-bit left justified ADC conversion results of VBG are stored to the
flash IFR for reference, as listed in Table 1-16.
The measurement conditions of the reference conversion are listed in the device electrical parameters
appendix. By measuring the voltage VBG in the application environment and comparing the result to the
reference value in the IFR, it is possible to determine the current ADC reference voltage VRH :
StoredReference
V RH = ------------------------------------------------------- • 5V
ConvertedReference
The exact absolute value of an analog conversion can be determined as follows:
StoredReference • 5V
Result = ConvertedADInput • -----------------------------------------------------------------nConvertedReference • 2
With:
ConvertedADInput:
ConvertedReference:
StoredReference:
n:
Result of the analog to digital conversion of the desired pin
Result of internal channel conversion
Value in IFR location
ADC resolution (12 bit)
NOTE
The ADC reference voltage VRH must remain at a constant level throughout
the conversion process.
1.13.2
SCI Baud Rate Detection
The baud rate for SCI0 and SCI1 is achieved by using a timer channel to measure the data rate on the RXD
signal.
1. Establish the link:
— For SCI0: Set [T0IC3RR1:T0IC3RR0]=0b01 to disconnect IOC0_3 from TIM0 input capture
channel 3 and reroute the timer input to the RXD0 signal of SCI0.
— For SCI1: Set [T0IC3RR1:T0IC3RR0]=0b10 to disconnect IOC0_3 from TIM0 input capture
channel 3 and reroute the timer input to the RXD1 signal of SCI1.
2. Determine pulse width of incoming data: Configure TIM0 IC3 to measure time between incoming
signal edges.
1.13.3
Motor Control Application Overview
The following sections provide information for using the device in motor control applications. These
sections provide a description of motor control loop considerations that are not detailed in the individual
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
59
Chapter 1 Device Overview MC9S12ZVM-Family
module sections, since they concern device level inter module operation specific for motor control. More
detailed information is available in application notes. The applications described are as follows:
1. BDCM - wiper pumps fans
2. BLDCM - pumps, fans and blowers
– based on Hall sensors
– sensorless based on back-EMF zero crossing comparators
– sensorless based on back-EMF ADC measurements
3. PMSM - high-end wiper, pumps, fans and blowers
– simple sinewave commutation with position sensor Hall effect, sine-cos
– FOC with sine-cos position sensor
– sensorless 3-phase sinewave control
MC9S12ZVM Family Reference Manual Rev. 1.3
60
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.13.3.1
Motor Control Loop Overview
The mapping of motor control events at device level as depicted in Figure 1-7 is listed in Table 1-17,
whereby the columns list the names used in the module level descriptions
Figure 1-7. Internal Control Loop Configuration
TIM
OC0
GDU
zero crossing
comparators
GPHS
commutation_event
PMF
SENSOR
reloada async_reload
async reload
reload
async reload
PTU
If PTU enabled
If PTU enabled
reload
ADC0
dc_bus_voltage
glb_ldok
PHMUX
back-EMF
dc_bus_current
M
P1
P2
P3
glb_ldok
trigger_0
ADC1
async reload
reload
trigger_1
reload
The control loop consists of the PMF, GDU, ADC and PTU modules. The control loop operates using
either static, dynamic or asynchronous timing. In the following text the event names given in bold type
correspond to those shown in Figure 1-7. The PTU and ADC operate using lists stored in memory. These
lists define trigger points for the PTU, commands for the ADC and results from the ADC. If the PTU is
enabled the reload and async_reload events are immediately passed through to the ADC and GDU
modules.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
61
Chapter 1 Device Overview MC9S12ZVM-Family
.
Table 1-17. Control Loop Events
Device Level Event
TIM
PMF
PTU
ADC0
ADC1
commutation_event
OC0(1)
commutation_event
—
—
—
reload
—
reloada(2)
reload
Restart
Restart
async_reload
—
async_reload
async_reload
Seq_abort
Seq_abort
trigger_0
—
—
trigger_0
Trigger
—
trigger_1
—
—
trigger_1
—
Trigger
glb_ldok
—
glb_ldok
glb_ldok
LoadOK
LoadOK
1. TIM channel OC0 must be configured to toggle on both edges.
2. PMF events reloadb and reloadc are not connected at device level
Each control loop cycle is started by a PMF reload event. The PMF reload event restarts the PTU time
base. If the PTU is enabled, the reload is immediately passed through to the ADC and GDU modules.
The PMF generates the reload event at the required PWM reload frequency. The PMF reload event causes
the PTU time base to restart, to acquire the first trigger times from the list and the ADCs to start loading
the ADC conversion command from the Command Sequence List (CSL).
NOTE
In the PTU there is 7 bus cycle maximum time window after the reload
event assertion to access the first trigger times from the list. In this window
the trigger can not be generated. In the ADC there is 10 bus cycle maximum
time window after the reload event assertion to access the first ADC
command from the list. In this window the ADC conversion can not be
started. If the measurement is control loop related these delays are
negligible due to much larger delays in the PWM-GDU-feedback loop.
When the trigger time is encountered the corresponding PTU trigger generates the trigger_x event for the
associated ADC. For simultaneous sampling the PTU generates simultaneous trigger_x events for both
ADCs. At the trigger_x event the ADC starts the first conversion of the next conversion sequence in the
CSL (the first ADC command is already downloaded).
A commutation event is used by the PMF to generate an async_reload event. The async_reload is used by
the PTU to update lists and re-initialize the trigger lists. If the PTU is enabled the async_reload is
immediately passed through to the ADC.
1.13.3.2
Control Loop Timing Considerations
Delays within the separate control loop elements require consideration to ensure correct synchronization.
Regarding the raw PWM signal as the starting point and stepping through the control loop stages, the
factors shown in Figure 1-8 contribute to delays within the control loop, starting with the deadtime
MC9S12ZVM Family Reference Manual Rev. 1.3
62
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
insertion, going through the external FETs and back into the internal ADC measurements of external
voltages and currents.
Figure 1-8. Control Loop Delay Overview
PWM cycle
PWM base
PWM with
deadtime
TDEAD_x
GDU
propagation
FET
turn on
tdelon
tHGON
Current sense
settling time
(tcslsst)
ADC delay
The PWM deadtime (TDEAD_X) is an integral number of bus clock cycles, configured by the PMF
deadtime registers.
The GDU propagation delays (tdelon, tdeloff) are specified in the electrical parameter Table E-1.
The FET turn on times (tHGON) are load dependent but are specified for particular loads in the electrical
parameter Table E-1.
The current sense amplifier delay is highly dependent on external components.
The ADC delay until a result is available is specified as the conversion period NCONV in Table C-1.
1.13.3.3
Static Timing Operation
The timing frame is static if it is the same in every control cycle (defined by reload frequency) and is
relative to start of the control cycle. The only settings modified from one control cycle to the next one are
the PWM duty cycle registers.
The main control cycle synchronization event is the PMF reload event. The PMF reload event can be
generated every n PWM periods.
This mode can optionally be extended by a timer channel trigger to PMF to change the PWM channel
operation (e.g. used for BLDCM commutation). In this case, the PMF configuration can propagate the
trigger through the control loop or can prevent propagation so the static timing of the control cycle and
inter-block coherency are not affected by the trigger.
At the end of the conversion sequence the first ADC command from the new sequence is loaded and the
ADCx waits for the next trigger_x. The PTU continues to generate the trigger_x events for each trigger
time from the list until a new reload or async_reload occurs.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
63
Chapter 1 Device Overview MC9S12ZVM-Family
Before the upcoming reload event the CPU:
• reads the ADC results from the buffered Conversion Result List
• clears the conversion complete flag
• services the reload by setting new duty cycle values
• sets the PTULDOK bit (corresponding to glb_ldok) to signal the duty cycle coherence
The CPU actions are typically performed in an ISR triggered by the conversion complete flag.
1.13.3.4
Static Timing Fault Handling
The following Faults and/or errors can occur:
• Desaturation error, Overvoltage, Undervoltage, Temperature sensor, External fault
The application run-time error is handled by the GDU without CPU interaction. Firstly the FETs are
disabled and the PMF signals switched to an inactive state. To re-enable the operation first the GDU fault
and then PWM fault must be cleared, to automatically re-enable the FET driving at the next PWM
boundary.
• PTU reload overrun error
This is an application run-time error caused by the CPU not setting PTULDOK on time. Servicing this
type of error is application dependent and may range from a further reload attempt to a total shut down.
• PTU trigger generator reload error, PTU trigger generator error
Since all timing is static, this error should only occur during application debugging. This type of error
occurring in a static timing configuration indicates possible data corruption. This can be serviced by a
control loop shutdown.
• PTU memory access error, Memory access double bit ECC error
This type of error occurring in an application indicates data corruption. This can be serviced by a control
loop shutdown.
• ADC sequence overrun, ADC command overrun, ADC command error
Since all timing is static, this error should only occur during application debugging. This type of error
occurring in an application indicates possible data corruption. This can be serviced by a control loop
shutdown.
1.13.3.5
Dynamic Timing Operation
The timing frame is dynamic if the following are modified on a cycle by cycle basis:
• PMF - duty cycle value registers (PMF_VALx), modulo registers
• PTU - Trigger Event List (PTU_TELx)
• ADC - Command Sequence List (ADCx_CSL)
The main philosophy is that all cycle-by-cycle settings for cycle n need to be done within cycle n-1. The
main control cycle synchronization event is the PMF reload event, which can be generated every n PWM
periods.
MC9S12ZVM Family Reference Manual Rev. 1.3
64
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
This mode can optionally be extended by a timer channel trigger PMF to change PWM channel operation
(e.g. used for BLDCM commutation).
The event flow is the same as for static timing.
Before the upcoming reload event the CPU:
• reads the ADC results from the buffered Conversion Result List
• clears the conversion complete flag
• services the reload by setting new duty cycle values and a new PMF modulo value
• updates the non-active PTU_TELx
• updates the non-active ADCx_CSL
• sets the PTULDOK bit (corresponding to glb_ldok) to signal the duty cycle coherence
The CPU actions are typically performed in an ISR triggered by the conversion complete flag.
1.13.3.6
Dynamic Timing Fault Handling
The following Faults and/or errors can occur:
• Desaturation error, Overvoltage, Undervoltage, Temperature sensor, External fault
The application run-time error is handled by the GDU without CPU interaction. Firstly the FETs are
disabled and the PMF signals switched to an inactive state. To re-enable the operation first the GDU fault
and then PWM fault must be cleared, to automatically re-enable the FET driving at the next PWM
boundary.
• PTU reload overrun error
This is an application run-time error caused by the CPU not setting PTULDOK on time. Servicing this
type of error is application dependent and may range from a further reload attempt to a total shut down.
• PTU trigger generator reload error, PTU trigger generator error
This indicates an application run-time error caused by a settings mismatch. Servicing this type of error is
application dependent. In some cases, the ADC values for the current control cycle can be ignored.
• PTU memory access error, Memory access double bit ECC error
This type of error occurring in an application indicates possible data corruption. This can be serviced by a
control loop shutdown.
• ADC sequence overrun, ADC command overrun, ADC command error
This indicates an application run-time error caused by a settings mismatch. Servicing this type of error is
application dependent. In some cases, the ADC values for the current control cycle can be ignored.
1.13.3.7
Asynchronous Timing
This case is an extension of the dynamic timing case by an asynchronous event generated by the Timer.
Note the asynchronous term is referenced to the control cycle.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
65
Chapter 1 Device Overview MC9S12ZVM-Family
The timing frame is the same as in dynamic timing case plus it can be asynchronously restarted at any time
within the control cycle.
At the asynchronous commutation_event
• the PMF actions are:
1. counter re-start, re-initialization
2. PWM configuration re-initialization according to the selected PWM settings (center/edge-aligned
pattern, normal/inverted type etc.)
3. re-initialization of the dead time generators (in case the commutation takes place at a time when
one of the dead times is being generated)
4. re-initialization of the PWM outputs according to pre-set PWM channel output settings in double
buffered registers (mask, swap, output control)
5. re-initialization of the automatic fault clearing
6. generates async_reload event for the PTU
7. optionally updates the PWM duty cycle values based on LDOK state
• the PTU actions are:
1. abortion of the trigger_x event generation
2. re-initialization and re-start the PTU counter
3. update of the current list index TGxList based on the glb_ldok state
4. fetch first trigger time from updated TGxList
5. passes the async_reload event immediately to the ADC (if the PTU is enabled)
6. generates the reload event for the ADC
• the ADC actions are:
1. the conversion in progress is completed
2. the ADC conversion sequence is aborted and the SEQA flag is set to indicate that the final
conversion occurred during the abortion process (potentially coinciding with a commutation and is
thus less precise than under normal conditions)
3. update of the current lists index ADxLists
4. re-start of the conversion sequencing upon successful abortion - fetches the first ADC command
from the ADCx_CSL, re-sets the result pointer to the top of the list
Note: in case the lists index ADxLists is not updated at the sequence abortion the new restarted A/D
conversions will overwrite the previously converted results.
• the GDU actions are:
1. standard operation
1.13.3.8
Control Loop Startup Guidelines
The sequence for control loop start up is to firstly configure the signal measurement (inputs/feedback).
Once the measurement is properly configured (correct value is measured at defined time) the output
actuation (control action) is configured. The following modules are involved in signal measurements.
• TIM (to identify asynchronous commutation) [BLDC applications only]
MC9S12ZVM Family Reference Manual Rev. 1.3
66
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
•
PMF (to generate main synchronous events for PTU and ADC)
PTU (to generate delay relative to synchronous events generated by PMF)
ADC (to acquire analog signals under synchronous control)
GDU (zero crossing comparators, Back-EMF muxing) [application dependent]
The TIM OC0 channel identifies the commutation event and restarts the PMF counter. In order to establish
this link TIM and PMF need to be configured and started. Then to sample accurately within one PMF cycle
the PTU needs to be used, so the next step is to configure the PTU to establish PMF to PTU link. The PTU
sends triggers to the ADC to perform a measurement of control signals. So the next step is to configure the
ADC. In some cases the GDU involvement is required and therefore configured.
The control action involves the PMF (to generate the duty cycle for GDU) and the GDU (to propagate the
signal to the MOSFETs). Since the PMF has already been configured for the measurements, only the GDU
need be configured to complete startup. Sometimes the GDU can be configured earlier but the GDU output
is always enabled last.
The recommended startup sequence is summarized as follows:
• Configure TIM and PMF to establish the link between TIM OC0 commutation event and PMF
• Configure PTU to establish the PMF to PTU link and ensure correct sampling within PMF cycle
• Configure the ADC
• Configure the GDU
1.13.3.9
Control Loop Shutdown Guidelines
1. Remove energy stored in the system after the power stage
kinetic energy - stop all rotating/moving mass
magnetic energy - gracefully drive currents to zero
2. Put GDU and PMF outputs to safe state
1.13.3.10 Control Loop Stop Mode Considerations
In Stop mode the PWM, PTU, ADC can not run because the bus clock is not running. Thus the GDU must
transition to a disabled state. Before entering Stop mode the application must perform the following steps:
1. Remove energy stored in the system after the power stage
kinetic energy - stop all rotating/moving mass
magnetic energy - gracefully drive currents to zero
2. Put GDU and PMF outputs to safe state
3. Verify GDU and PMF safe states
4. Verify fault flags and service if necessary
5. Execute the STOP instruction
The return from stop is expected in reverse order:
1. On returning from Stop mode the clocks are automatically enabled coherently
2. Initialize and check device proper functionality (charge pump etc.)
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
67
Chapter 1 Device Overview MC9S12ZVM-Family
3.
4.
5.
6.
Check functionality of the external system
Initializes control loop operation, however with PMF and GDU outputs still in safe state
Read the ADC values to check the system
Start driving energy into the system
based on the measurements from the previous step, the PWM duty cycle values are calculated
7. PMF and GDU outputs are enabled (actively driven)
The device does not support putting the FETs in an active driving state during STOP as the GDU charge
pump clock is not running. This means the device cannot be put in stop mode if the FETS need to be in an
active driving state to protect the system from external energy supply (e.g. externally driven motorgenerator).
NOTE
It is imperative, that whatever the modules perform on entering/exiting Stop
mode, the pre-set complementary mode of operation and dead time insertion
must be guaranteed all the times.
1.13.3.11 Application Signal Visibility
In typical motor control applications, TIM OC0 is used internally to indicate commutation events. To
switch off OC0 visibility at port pin PT0:
• Disable output compare signal on pin PT0 in TIM: OCPD[OCPD0]=0b1.
1.13.3.12 Debug Signal Visibility
Depending on required visibility of internal signals on port pins enable the following registers:
• Set [PWMPRR]=0b1 in PIM if monitoring of internal PWM waveforms is needed. PWM5-3 are
driven out on pins PT[2:0] and PWM2-0 on pins PP[2:0].
• Enable output compare channel OC0 to output commutation event on pin PT0 in TIM:
OCPD[OCPD0]=0b0.
• Set PTUDEBUG[PTUREPE]=0b1 in PTU to output the reload event.
• Set PTUDEBUG[PTUTxPE]=0b1 with x=0,1 in PTU to output the trigger events.
1.13.4
BDCM Complementary Mode Operation
This section describes BDCM control using center aligned complementary mode with deadtime insertion.
The DC Brushed motor power stage topology is a classical full bridge as shown in Figure 1-9. The DC
Brushed motor is driven by the DC voltage source. A rotational field is created by means of commutator
and brushes on the motor. These drives are still very popular because sophisticated calculations and
algorithms such as commutation, waveform generation, or space vector modulation are not required.
MC9S12ZVM Family Reference Manual Rev. 1.3
68
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Figure 1-9. DC Brushed Motor External Configuration
+ 1/2 U
PWM
0
PWM
2
B
A
PWM
1
PWM
3
- 1/2 U
Usually the control consists of an outer, speed control loop with inner current (torque) control loop. The
inner loop controls DC voltage applied onto the motor winding. The control loop is calculated regularly
within a given period. In most cases, this period matches the PWM reload period.
Driving the DC motor from a DC voltage source, the motor can work in all four quadrants. The
complementary mode of operation with deadtime insertion is needed for smooth reversal of the motor
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
69
Chapter 1 Device Overview MC9S12ZVM-Family
current (motor torque), hence smooth full four quadrant control. Usually the center-aligned PWM is
chosen to lower electromagnetic emissions.
Figure 1-10. BDCM Control Loop Configuration
GDU
PMF
dc_bus_voltage
M
dc_bus_current0
sine/
cosine
sensor
reloada
reload
glb_ldok
PTU
trigger_0
ADC0
trigger_1
reload
ADC1
The PWM frequency selection is always a compromise between audible noise, electromagnetic emissions,
current ripples and power switching losses.
The BDCM control loop goal is to provide a controlled DC voltage to the motor winding, whereby it is
controlled cycle-by-cycle using a speed, current or torque feedback loop.
The center aligned PWM waveforms generated by the PMF module are applied to the bridge as shown in
Figure 1-11 whereby the base waveform for PWM0 and PWM1 is depicted at the top and the
complementary PWM0 and PWM1 waveforms are shown with deadtime insertion depicted by the gray
phases before the switching edges.
MC9S12ZVM Family Reference Manual Rev. 1.3
70
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Figure 1-11. BDCM Complementary Mode Waveform
PWM0, PWM1 base
PWM2, PWM3 base
TPWM
PWM0
PWM2
PWM1
PWM3
Assuming first quadrant operation, forward accelerating operation, the applied voltage at node A must
exceed the applied voltage at node B (Figure 1-9). Thus the PWM0 duty cycle must exceed the PWM2
duty cycle.
The PWM duty cycle of PWM0 defines the voltage at the first power stage branch.
The PWM duty cycle of PWM2 defines the voltage at the second power stage branch.
Modulating the PWM duty cycle every period using the function FPWM then the duty cycle is expressed as:
PWM0 duty-cycle = 0.5 + (0.5 * FPWM); For -1 tP_PASS guarantee a wakeup event.
Please refer to the appendix table “Pin Interrupt Characteristics” for pulse length limits.
To maximize current saving the RC oscillator is active only if the following condition is true on any
individual pin:
Sample count IPL[2:0]).
3. The I-bit in the condition code register (CCW) of the CPU must be cleared.
4. There is no access violation interrupt request pending.
5. There is no SYS, SWI, SPARE, TRAP, Machine Exception or XIRQ request pending.
MC9S12ZVM Family Reference Manual Rev. 1.3
138
Freescale Semiconductor
Chapter 4 Interrupt (S12ZINTV0)
NOTE
All non I-bit maskable interrupt requests always have higher priority than Ibit maskable interrupt requests. If an I-bit maskable interrupt request is
interrupted by a non I-bit maskable interrupt request, the currently active
interrupt processing level (IPL) remains unaffected. It is possible to nest
non I-bit maskable interrupt requests, e.g., by nesting SWI, SYS or TRAP
calls.
4.4.2.1
Interrupt Priority Stack
The current interrupt processing level (IPL) is stored in the condition code register (CCW) of the CPU.
This way the current IPL is automatically pushed to the stack by the standard interrupt stacking procedure.
The new IPL is copied to the CCW from the priority level of the highest priority active interrupt request
channel which is configured to be handled by the CPU. The copying takes place when the interrupt vector
is fetched. The previous IPL is automatically restored from the stack by executing the RTI instruction.
4.4.3
Priority Decoder
The INT module contains a priority decoder to determine the relative priority for all interrupt requests
pending for the CPU.
A CPU interrupt vector is not supplied until the CPU requests it. Therefore, it is possible that a higher
priority interrupt request could override the original exception which caused the CPU to request the vector.
In this case, the CPU will receive the highest priority vector and the system will process this exception first
instead of the original request.
If the interrupt source is unknown (for example, in the case where an interrupt request becomes inactive
after the interrupt has been recognized, but prior to the vector request), the vector address supplied to the
CPU defaults to that of the spurious interrupt vector.
NOTE
Care must be taken to ensure that all exception requests remain active until
the system begins execution of the applicable service routine; otherwise, the
exception request may not get processed at all or the result may be a
spurious interrupt request (vector at address (vector base + 0x0001DC)).
4.4.4
Reset Exception Requests
The INT module supports one system reset exception request. The different reset types are mapped to this
vector (for details please refer to the Clock and Power Management Unit module (CPMU)):
1. Pin reset
2. Power-on reset
3. Low-voltage reset
4. Clock monitor reset request
5. COP watchdog reset request
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
139
Chapter 4 Interrupt (S12ZINTV0)
4.4.5
Exception Priority
The priority (from highest to lowest) and address of all exception vectors issued by the INT module upon
request by the CPU are shown in Table 4-8. Generally, all non-maskable interrupts have higher priorities
than maskable interrupts. Please note that between the four software interrupts (Unimplemented op-code
trap page1/page2 requests, SWI request, SYS request) there is no real priority defined since they cannot
occur simultaneously (the S12Z CPU executes one instruction at a time).
Table 4-8. Exception Vector Map and Priority
Vector Address(1)
0xFFFFFC
Source
Pin reset, power-on reset, low-voltage reset, clock monitor reset, COP watchdog reset
(Vector base + 0x0001F8)
Unimplemented page1 op-code trap (SPARE) vector request
(Vector base + 0x0001F4)
Unimplemented page2 op-code trap (TRAP) vector request
(Vector base + 0x0001F0)
Software interrupt instruction (SWI) vector request
(Vector base + 0x0001EC)
System call interrupt instruction (SYS) vector request
(Vector base + 0x0001E8)
Machine exception vector request
(Vector base + 0x0001E4)
Reserved
(Vector base + 0x0001E0)
Reserved
(Vector base + 0x0001DC)
Spurious interrupt
(Vector base + 0x0001D8)
XIRQ interrupt request
(Vector base + 0x0001D4)
IRQ interrupt request
(Vector base + 0x000010
..
Vector base + 0x0001D0)
Device specific I-bit maskable interrupt sources (priority determined by the associated
configuration registers, in descending order)
1. 24 bits vector address based
4.4.6
Interrupt Vector Table Layout
The interrupt vector table contains 128 entries, each 32 bits (4 bytes) wide. Each entry contains a 24-bit
address (3 bytes) which is stored in the 3 low-significant bytes of the entry. The content of the most
significant byte of a vector-table entry is ignored. Figure 4-13 illustrates the vector table entry format.
Bits
[31:24]
[23:0]
(unused)
ISR Address
Figure 4-13. Interrupt Vector Table Entry
4.5
4.5.1
Initialization/Application Information
Initialization
After system reset, software should:
• Initialize the interrupt vector base register if the interrupt vector table is not located at the default
location (0xFFFE00–0xFFFFFB).
MC9S12ZVM Family Reference Manual Rev. 1.3
140
Freescale Semiconductor
Chapter 4 Interrupt (S12ZINTV0)
•
Initialize the interrupt processing level configuration data registers (INT_CFADDR,
INT_CFDATA0–7) for all interrupt vector requests with the desired priority levels. It might be a
good idea to disable unused interrupt requests.
Enable I-bit maskable interrupts by clearing the I-bit in the CCW.
Enable the X-bit maskable interrupt by clearing the X-bit in the CCW (if required).
•
•
4.5.2
Interrupt Nesting
The interrupt request priority level scheme makes it possible to implement priority based interrupt request
nesting for the I-bit maskable interrupt requests.
• I-bit maskable interrupt requests can be interrupted by an interrupt request with a higher priority,
so that there can be up to seven nested I-bit maskable interrupt requests at a time (refer to Figure 414 for an example using up to three nested interrupt requests).
I-bit maskable interrupt requests cannot be interrupted by other I-bit maskable interrupt requests per
default. In order to make an interrupt service routine (ISR) interruptible, the ISR must explicitly clear the
I-bit in the CCW (CLI). After clearing the I-bit, I-bit maskable interrupt requests with higher priority can
interrupt the current ISR.
An ISR of an interruptible I-bit maskable interrupt request could basically look like this:
• Service interrupt, e.g., clear interrupt flags, copy data, etc.
• Clear I-bit in the CCW by executing the CPU instruction CLI (thus allowing interrupt requests with
higher priority)
• Process data
• Return from interrupt by executing the instruction RTI
0
Stacked IPL
IPL in CCW
0
0
4
0
0
0
4
7
4
3
1
0
7
6
L7
5
RTI
4
RTI
Processing Levels
3
L3 (Pending)
2
L4
RTI
1
L1 (Pending)
0
RTI
Reset
Figure 4-14. Interrupt Processing Example
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
141
Chapter 4 Interrupt (S12ZINTV0)
4.5.3
4.5.3.1
Wake Up from Stop or Wait Mode
CPU Wake Up from Stop or Wait Mode
Every I-bit maskable interrupt request which is configured to be handled by the CPU is capable of waking
the MCU from stop or wait mode. Additionally machine exceptions can wake-up the MCU from stop or
wait mode.
To determine whether an I-bit maskable interrupts is qualified to wake up the CPU or not, the same settings
as in normal run mode are applied during stop or wait mode:
• If the I-bit in the CCW is set, all I-bit maskable interrupts are masked from waking up the MCU.
• An I-bit maskable interrupt is ignored if it is configured to a priority level below or equal to the
current IPL in CCW.
The X-bit maskable interrupt request can wake up the MCU from stop or wait mode at anytime, even if
the X-bit in CCW is set1. If the X-bit maskable interrupt request is used to wake-up the MCU with the Xbit in the CCW set, the associated ISR is not called. The CPU then resumes program execution with the
instruction following the WAI or STOP instruction. This feature works following the same rules like any
interrupt request, i.e. care must be taken that the X-bit maskable interrupt request used for wake-up
remains active at least until the system begins execution of the instruction following the WAI or STOP
instruction; otherwise, wake-up may not occur.
1. The capability of the XIRQ pin to wake-up the MCU with the X bit set may not be available if, for example, the XIRQ pin is
shared with other peripheral modules on the device. Please refer to the Port Integration Module (PIM) section of the MCU
reference manual for details.
MC9S12ZVM Family Reference Manual Rev. 1.3
142
Freescale Semiconductor
Chapter 5
Background Debug Controller (S12ZBDCV2)
Table 5-1. Revision History
Revision
Number
Revision Date
Sections
Affected
V2.04
03.Dec.2012
Section 5.1.3.3
Included BACKGROUND/ Stop mode dependency
V2.05
22.Jan.2013
Section 5.3.2.2
Improved NORESP description and added STEP1/ Wait mode dependency
V2.06
22.Mar.2013
Section 5.3.2.2
Improved NORESP description of STEP1/ Wait mode dependency
Description of Changes
V2.07
11.Apr.2013
V2.08
31.May.2013
Section 5.4.4.4
Section 5.4.7.1
Removed misleading WAIT and BACKGROUND interdepency description
Added subsection dedicated to Long-ACK
V2.09
29.Aug.2013
Section 5.4.4.12
Noted that READ_DBGTB is only available for devices featuring a trace buffer.
V2.10
21.Oct.2013
Section 5.1.3.3.2 Improved description of NORESP dependence on WAIT and BACKROUND
5.1
Section 5.1.3.3.1 Improved STOP and BACKGROUND interdepency description
Introduction
The background debug controller (BDC) is a single-wire, background debug system implemented in onchip hardware for minimal CPU intervention. The device BKGD pin interfaces directly to the BDC.
The S12ZBDC maintains the standard S12 serial interface protocol but introduces an enhanced handshake
protocol and enhanced BDC command set to support the linear instruction set family of S12Z devices and
offer easier, more flexible internal resource access over the BDC serial interface.
5.1.1
Glossary
Table 5-2. Glossary Of Terms
Term
Definition
DBG
On chip Debug Module
BDM
Active Background Debug Mode
CPU
S12Z CPU
SSC
Special Single Chip Mode (device operating mode
NSC
Normal Single Chip Mode (device operating mode)
BDCSI
Background Debug Controller Serial Interface. This refers to the single pin BKGD serial interface.
EWAIT
Optional S12 feature which allows external devices to delay external accesses until deassertion of EWAIT
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
143
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.1.2
Features
The BDC includes these distinctive features:
• Single-wire communication with host development system
• SYNC command to determine communication rate
• Genuine non-intrusive handshake protocol
• Enhanced handshake protocol for error detection and stop mode recognition
• Active out of reset in special single chip mode
• Most commands not requiring active BDM, for minimal CPU intervention
• Full global memory map access without paging
• Simple flash mass erase capability
5.1.3
Modes of Operation
S12 devices feature power modes (run, wait, and stop) and operating modes (normal single chip, special
single chip). Furthermore, the operation of the BDC is dependent on the device security status.
5.1.3.1
BDC Modes
The BDC features module specific modes, namely disabled, enabled and active. These modes are
dependent on the device security and operating mode. In active BDM the CPU ceases execution, to allow
BDC system access to all internal resources including CPU internal registers.
5.1.3.2
Security and Operating mode Dependency
In device run mode the BDC dependency is as follows
• Normal modes, unsecure device
General BDC operation available. The BDC is disabled out of reset.
• Normal modes, secure device
BDC disabled. No BDC access possible.
• Special single chip mode, unsecure
BDM active out of reset. All BDC commands are available.
• Special single chip mode, secure
BDM active out of reset. Restricted command set available.
When operating in secure mode, BDC operation is restricted to allow checking and clearing security by
mass erasing the on-chip flash memory. Secure operation prevents BDC access to on-chip memory other
than mass erase. The BDC command set is restricted to those commands classified as Always-available.
MC9S12ZVM Family Reference Manual Rev. 1.3
144
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.1.3.3
5.1.3.3.1
Low-Power Modes
Stop Mode
The execution of the CPU STOP instruction leads to stop mode only when all bus masters (CPU, or others,
depending on the device) have finished processing. The operation during stop mode depends on the
ENBDC and BDCCIS bit settings as summarized in Table 5-3
Table 5-3. BDC STOP Operation Dependencies
ENBDC
BDCCIS
Description Of Operation
0
0
BDC has no effect on STOP mode.
0
1
BDC has no effect on STOP mode.
1
0
Only BDCSI clock continues
1
1
All clocks continue
A disabled BDC has no influence on stop mode operation. In this case the BDCSI clock is disabled in stop
mode thus it is not possible to enable the BDC from within stop mode.
STOP Mode With BDC Enabled And BDCCIS Clear
If the BDC is enabled and BDCCIS is clear, then the BDC prevents the BDCCLK clock (Figure 5-5) from
being disabled in stop mode. This allows BDC communication to continue throughout stop mode in order
to access the BDCCSR register. All other device level clock signals are disabled on entering stop mode.
NOTE
This is intended for application debugging, not for fast flash programming.
Thus the CLKSW bit must be clear to map the BDCSI to BDCCLK.
With the BDC enabled, an internal acknowledge delays stop mode entry and exit by 2 BDCSI clock + 2
bus clock cycles. If no other module delays stop mode entry and exit, then these additional clock cycles
represent a difference between the debug and not debug cases. Furthermore if a BDC internal access is
being executed when the device is entering stop mode, then the stop mode entry is delayed until the internal
access is complete (typically for 1 bus clock cycle).
Accesses to the internal memory map are not possible when the internal device clocks are disabled. Thus
attempted accesses to memory mapped resources are suppressed and the NORESP flag is set. Resources
can be accessed again by the next command received following exit from Stop mode.
A BACKGROUND command issued whilst in stop mode remains pending internally until the device
leaves stop mode. This means that subsequent active BDM commands, issued whilst BACKGROUND is
pending, set the ILLCMD flag because the device is not yet in active BDM.
If ACK handshaking is enabled, then the first ACK, following a stop mode entry is long to indicate a stop
exception. The BDC indicates a stop mode occurrence by setting the BDCCSR bit STOP. If the host
attempts further communication before the ACK pulse generation then the OVRUN bit is set.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
145
Chapter 5 Background Debug Controller (S12ZBDCV2)
STOP Mode With BDC Enabled And BDCCIS Set
If the BDC is enabled and BDCCIS is set, then the BDC prevents core clocks being disabled in stop mode.
This allows BDC communication, for access of internal memory mapped resources, but not CPU registers,
to continue throughout stop mode.
A BACKGROUND command issued whilst in stop mode remains pending internally until the device
leaves stop mode. This means that subsequent active BDM commands, issued whilst BACKGROUND is
pending, set the ILLCMD flag because the device is not yet in active BDM.
If ACK handshaking is enabled, then the first ACK, following a stop mode entry is long to indicate a stop
exception. The BDC indicates a stop mode occurrence by setting the BDCCSR bit STOP. If the host
attempts further communication before the ACK pulse generation then the OVRUN bit is set.
5.1.3.3.2
Wait Mode
The device enters wait mode when the CPU starts to execute the WAI instruction. The second part of the
WAI instruction (return from wait mode) can only be performed when an interrupt occurs. Thus on
entering wait mode the CPU is in the middle of the WAI instruction and cannot permit access to CPU
internal resources, nor allow entry to active BDM. Thus only commands classified as Non-Intrusive or
Always-Available are possible in wait mode.
On entering wait mode, the WAIT flag in BDCCSR is set. If the ACK handshake protocol is enabled then
the first ACK generated after WAIT has been set is a long-ACK pulse. Thus the host can recognize a wait
mode occurrence. The WAIT flag remains set and cannot be cleared whilst the device remains in wait
mode. After the device leaves wait mode the WAIT flag can be cleared by writing a “1” to it.
A BACKGROUND command issued whilst in wait mode sets the NORESP bit and the BDM active
request remains pending internally until the CPU leaves wait mode due to an interrupt. The device then
enters BDM with the PC pointing to the address of the first instruction of the ISR.
With ACK disabled, further Non-Intrusive or Always-Available commands are possible, in this pending
state, but attempted Active-Background commands set NORESP and ILLCMD because the BDC is not in
active BDM state.
With ACK enabled, if the host attempts further communication before the ACK pulse generation then the
OVRUN bit is set.
Similarly the STEP1 command issued from a WAI instruction cannot be completed by the CPU until the
CPU leaves wait mode due to an interrupt. The first STEP1 into wait mode sets the BDCCSR WAIT bit.
If the part is still in Wait mode and a further STEP1 is carried out then the NORESP and ILLCMD bits are
set because the device is no longer in active BDM for the duration of WAI execution.
5.1.4
Block Diagram
A block diagram of the BDC is shown in Figure 5-1.
MC9S12ZVM Family Reference Manual Rev. 1.3
146
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
HOST
SYSTEM
BKGD
SERIAL INTERFACE CONTROL
AND SHIFT REGISTER
CLOCK DOMAIN
CONTROL
INSTRUCTION
DECODE AND
FSM
BDCSI
CORE CLOCK
ADDRESS
BUS INTERFACE
AND
CONTROL LOGIC
BDCCSR REGISTER
AND DATAPATH
CONTROL
DATA
BUS CONTROL
CPU CONTROL
ERASE FLASH
FLASH ERASED
FLASH SECURE
Figure 5-1. BDC Block Diagram
5.2
External Signal Description
A single-wire interface pin (BKGD) is used to communicate with the BDC system. During reset, this pin
is a device mode select input. After reset, this pin becomes the dedicated serial interface pin for the BDC.
BKGD is a pseudo-open-drain pin with an on-chip pull-up. Unlike typical open-drain pins, the external
RC time constant on this pin due to external capacitance, plays almost no role in signal rise time. The
custom protocol provides for brief, actively driven speed-up pulses to force rapid rise times on this pin
without risking harmful drive level conflicts. Refer to Section 5.4.6” for more details.
5.3
5.3.1
Memory Map and Register Definition
Module Memory Map
Table 5-4 shows the BDC memory map.
Table 5-4. BDC Memory Map
Global Address
Module
Size
(Bytes)
Not Applicable
BDC registers
2
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
147
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.3.2
Register Descriptions
The BDC registers are shown in Figure 5-2. Registers are accessed only by host-driven communications
to the BDC hardware using READ_BDCCSR and WRITE_BDCCSR commands. They are not accessible
in the device memory map.
Global
Address
Register
Name
Bit 7
Not
Applicable
BDCCSRH R
Not
Applicable
BDCCSRL R
W
W
ENBDC
WAIT
6
BDMACT
STOP
5
4
0
BDCCIS
RAMWF
OVRUN
= Unimplemented, Reserved
3
2
STEAL
CLKSW
NORESP
RDINV
0
1
Bit 0
UNSEC
ERASE
ILLACC
ILLCMD
= Always read zero
Figure 5-2. BDC Register Summary
5.3.2.1
BDC Control Status Register High (BDCCSRH)
Register Address: This register is not in the device memory map. It is accessible using BDC inherent addressing commands
7
R
W
ENBDC
6
BDMACT
5
BDCCIS
4
0
3
2
STEAL
CLKSW
1
0
UNSEC
ERASE
Reset
Secure AND SSC-Mode
1
1
0
0
0
0
0
0
Unsecure AND SSC-Mode
1
1
0
0
0
0
1
0
Secure AND NSC-Mode
0
0
0
0
0
0
0
0
Unsecure AND NSC-Mode
0
0
0
0
0
0
1
0
= Unimplemented, Reserved
0
= Always read zero
Figure 5-3. BDC Control Status Register High (BDCCSRH)
Read: All modes through BDC operation only.
Write: All modes through BDC operation only, when not secured, but subject to the following:
— Bits 7,3 and 2 can only be written by WRITE_BDCCSR commands.
— Bit 5 can only be written by WRITE_BDCCSR commands when the device is not in stop mode.
— Bits 6, 1 and 0 cannot be written. They can only be updated by internal hardware.
MC9S12ZVM Family Reference Manual Rev. 1.3
148
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-5. BDCCSRH Field Descriptions
Field
Description
7
ENBDC
Enable BDC — This bit controls whether the BDC is enabled or disabled. When enabled, active BDM can be
entered and non-intrusive commands can be carried out. When disabled, active BDM is not possible and the
valid command set is restricted. Further information is provided in Table 5-7.
0 BDC disabled
1 BDC enabled
Note: ENBDC is set out of reset in special single chip mode.
6
BDMACT
BDM Active Status — This bit becomes set upon entering active BDM. BDMACT is cleared as part of the active
BDM exit sequence.
0 BDM not active
1 BDM active
Note: BDMACT is set out of reset in special single chip mode.
5
BDCCIS
BDC Continue In Stop — If ENBDC is set then BDCCIS selects the type of BDC operation in stop mode (as
shown in Table 5-3). If ENBDC is clear, then the BDC has no effect on stop mode and no BDC communication
is possible.If ACK pulse handshaking is enabled, then the first ACK pulse following stop mode entry is a long
ACK. This bit cannot be written when the device is in stop mode.
0 Only the BDCSI clock continues in stop mode
1 All clocks continue in stop mode
3
STEAL
Steal enabled with ACK— This bit forces immediate internal accesses with the ACK handshaking protocol
enabled. If ACK handshaking is disabled then BDC accesses steal the next bus cycle.
0 If ACK is enabled then BDC accesses await a free cycle, with a timeout of 512 cycles
1 If ACK is enabled then BDC accesses are carried out in the next bus cycle
2
CLKSW
Clock Switch — The CLKSW bit controls the BDCSI clock source. This bit is initialized to “0” by each reset and
can be written to “1”. Once it has been set, it can only be cleared by a reset. When setting CLKSW a minimum
delay of 150 cycles at the initial clock speed must elapse before the next command can be sent. This guarantees
that the start of the next BDC command uses the new clock for timing subsequent BDC communications.
0 BDCCLK used as BDCSI clock source
1 Device fast clock used as BDCSI clock source
Note: Refer to the device specification to determine which clock connects to the BDCCLK and fast clock inputs.
1
UNSEC
Unsecure — If the device is unsecure, the UNSEC bit is set automatically.
0 Device is secure.
1 Device is unsecure.
Note: When UNSEC is set, the device is unsecure and the state of the secure bits in the on-chip Flash EEPROM
can be changed.
0
ERASE
Erase Flash — This bit can only be set by the dedicated ERASE_FLASH command. ERASE is unaffected by
write accesses to BDCCSR. ERASE is cleared either when the mass erase sequence is completed,
independent of the actual status of the flash array or by a soft reset.
Reading this bit indicates the status of the requested mass erase sequence.
0 No flash mass erase sequence pending completion
1 Flash mass erase sequence pending completion.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
149
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.3.2.2
BDC Control Status Register Low (BDCCSRL)
Register Address: This register is not in the device memory map. It is accessible using BDC inherent addressing commands
R
W
Reset
7
6
5
4
3
2
1
0
WAIT
STOP
RAMWF
OVRUN
NORESP
RDINV
ILLACC
ILLCMD
0
0
0
0
0
0
0
0
Figure 5-4. BDC Control Status Register Low (BDCCSRL)
Read: BDC access only.
Write: Bits [7:5], [3:0] BDC access only, restricted to flag clearing by writing a “1” to the bit position.
Write: Bit 4 never. It can only be cleared by a SYNC pulse.
If ACK handshaking is enabled then BDC commands with ACK causing a BDCCSRL[3:1] flag setting
condition also generate a long ACK pulse. Subsequent commands that are executed correctly generate a
normal ACK pulse. Subsequent commands that are not correctly executed generate a long ACK pulse. The
first ACK pulse after WAIT or STOP have been set also generates a long ACK. Subsequent ACK pulses
are normal, whilst STOP and WAIT remain set.
Long ACK pulses are not immediately generated if an overrun condition is caused by the host driving the
BKGD pin low whilst a target ACK is pending, because this would conflict with an attempted host
transmission following the BKGD edge. When a whole byte has been received following the offending
BKGD edge, the OVRUN bit is still set, forcing subsequent ACK pulses to be long.
Unimplemented BDC opcodes causing the ILLCMD bit to be set do not generate a long ACK because this
could conflict with further transmission from the host. If the ILLCMD is set for another reason, then a long
ACK is generated for the current command if it is a BDC command with ACK.
Table 5-6. BDCCSRL Field Descriptions
Field
Description
7
WAIT
WAIT Indicator Flag — Indicates that the device entered wait mode. Writing a “1” to this bit whilst in wait mode
has no effect. Writing a “1” after exiting wait mode, clears the bit.
0 Device did not enter wait mode
1 Device entered wait mode.
6
STOP
STOP Indicator Flag — Indicates that the CPU requested stop mode following a STOP instruction. Writing a
“1” to this bit whilst not in stop mode clears the bit. Writing a “1” to this bit whilst in stop mode has no effect.
This bit can only be set when the BDC is enabled.
0 Device did not enter stop mode
1 Device entered stop mode.
5
RAMWF
RAM Write Fault — Indicates an ECC double fault during a BDC write access to RAM.
Writing a “1” to this bit, clears the bit.
0 No RAM write double fault detected.
1 RAM write double fault detected.
MC9S12ZVM Family Reference Manual Rev. 1.3
150
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-6. BDCCSRL Field Descriptions (continued)
Field
Description
4
OVRUN
Overrun Flag — Indicates unexpected host activity before command completion.
This occurs if a new command is received before the current command completion.
With ACK enabled this also occurs if the host drives the BKGD pin low whilst a target ACK pulse is pending
To protect internal resources from misinterpreted BDC accesses following an overrun, internal accesses are
suppressed until a SYNC clears this bit.
A SYNC clears the bit.
0 No overrun detected.
1 Overrun detected when issuing a BDC command.
3
NORESP
No Response Flag — Indicates that the BDC internal action or data access did not complete. This occurs in
the following scenarios:
a) If no free cycle for an access is found within 512 core clock cycles. This could typically happen if a code loop
without free cycles is executing with ACK enabled and STEAL clear.
b) With ACK disabled or STEAL set, when an internal access is not complete before the host starts
data/BDCCSRL retrieval or an internal write access is not complete before the host starts the next BDC
command.
c) Attempted internal memory or SYNC_PC accesses during STOP mode set NORESP if BDCCIS is clear.
In the above cases, on setting NORESP, the BDC aborts the access if permitted. (For devices supporting
EWAIT, BDC external accesses with EWAIT assertions, prevent a command from being aborted until EWAIT
is deasserted).
d) If a BACKGROUND command is issued whilst the device is in wait mode the NORESP bit is set but the
command is not aborted. The active BDM request is completed when the device leaves wait mode.
Furthermore subsequent CPU register access commands during wait mode set the NORESP bit, should it
have been cleared.
e) If a command is issued whilst awaiting return from Wait mode. This can happen when using STEP1 to step
over a CPU WAI instruction, if the CPU has not returned from Wait mode before the next BDC command is
received.
f) If STEP1 is issued with the BDC enabled as the device enters Wait mode regardless of the BDMACT state.
When NORESP is set a value of 0xEE is returned for each data byte associated with the current access.
Writing a “1” to this bit, clears the bit.
0 Internal action or data access completed.
1 Internal action or data access did not complete.
2
RDINV
Read Data Invalid Flag — Indicates invalid read data due to an ECC error during a BDC initiated read access.
The access returns the actual data read from the location.
Writing a “1” to this bit, clears the bit.
0 No invalid read data detected.
1 Invalid data returned during a BDC read access.
1
ILLACC
Illegal Access Flag — Indicates an attempted illegal access. This is set in the following cases:
When the attempted access addresses unimplemented memory
When the access attempts to write to the flash array
When a CPU register access is attempted with an invalid CRN (Section 5.4.5.1).
Illegal accesses return a value of 0xEE for each data byte
Writing a “1” to this bit, clears the bit.
0 No illegal access detected.
1 Illegal BDC access detected.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
151
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-6. BDCCSRL Field Descriptions (continued)
Field
Description
0
ILLCMD
Illegal Command Flag — Indicates an illegal BDC command. This bit is set in the following cases:
When an unimplemented BDC command opcode is received.
When a DUMP_MEM{_WS}, FILL_MEM{_WS} or READ_SAME{_WS} is attempted in an illegal sequence.
When an active BDM command is received whilst BDM is not active
When a non Always-available command is received whilst the BDC is disabled or a flash mass erase is ongoing.
When a non Always-available command is received whilst the device is secure
Read commands return a value of 0xEE for each data byte
Writing a “1” to this bit, clears the bit.
0 No illegal command detected.
1 Illegal BDC command detected.
5.4
5.4.1
Functional Description
Security
If the device resets with the system secured, the device clears the BDCCSR UNSEC bit. In the secure state
BDC access is restricted to the BDCCSR register. A mass erase can be requested using the
ERASE_FLASH command. If the mass erase is completed successfully, the device programs the security
bits to the unsecure state and sets the BDC UNSEC bit. If the mass erase is unsuccessful, the device
remains secure and the UNSEC bit is not set.
For more information regarding security, please refer to device specific security information.
5.4.2
Enabling BDC And Entering Active BDM
BDM can be activated only after being enabled. BDC is enabled by setting the ENBDC bit in the BDCCSR
register, via the single-wire interface, using the command WRITE_BDCCSR.
After being enabled, BDM is activated by one of the following1:
• The BDC BACKGROUND command
• A CPU BGND instruction
• The DBG Breakpoint mechanism
Alternatively BDM can be activated directly from reset when resetting into Special Single Chip Mode.
The BDC is ready for receiving the first command 10 core clock cycles after the deassertion of the internal
reset signal. This is delayed relative to the external pin reset as specified in the device reset documentation.
On S12Z devices an NVM initialization phase follows reset. During this phase the BDC commands
classified as always available are carried out immediately, whereas other BDC commands are subject to
delayed response due to the NVM initialization phase.
NOTE
After resetting into SSC mode, the initial PC address must be supplied by
the host using the WRITE_Rn command before issuing the GO command.
1. BDM active immediately out of special single-chip reset.
MC9S12ZVM Family Reference Manual Rev. 1.3
152
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
When BDM is activated, the CPU finishes executing the current instruction. Thereafter only BDC
commands can affect CPU register contents until the BDC GO command returns from active BDM to user
code or a device reset occurs. When BDM is activated by a breakpoint, the type of breakpoint used
determines if BDM becomes active before or after execution of the next instruction.
NOTE
Attempting to activate BDM using a BGND instruction whilst the BDC is
disabled, the CPU requires clock cycles for the attempted BGND execution.
However BACKGROUND commands issued whilst the BDC is disabled
are ignored by the BDC and the CPU execution is not delayed.
5.4.3
Clock Source
The BDC clock source can be mapped to a constant frequency clock source or a PLL based fast clock. The
clock source for the BDC is selected by the CLKSW bit as shown in Figure 5-5. The BDC internal clock
is named BDCSI clock. If BDCSI clock is mapped to the BDCCLK by CLKSW then the serial interface
communication is not affected by bus/core clock frequency changes. If the BDC is mapped to BDCFCLK
then the clock is connected to a PLL derived source at device level (typically bus clock), thus can be subject
to frequency changes in application. Debugging through frequency changes requires SYNC pulses to resynchronize. The sources of BDCCLK and BDCFCLK are specified at device level.
BDC accesses of internal device resources always use the device core clock. Thus if the ACK handshake
protocol is not enabled, the clock frequency relationship must be taken into account by the host.
When changing the clock source via the CLKSW bit a minimum delay of 150 cycles at the initial clock
speed must elapse before a SYNC can be sent. This guarantees that the start of the next BDC command
uses the new clock for timing subsequent BDC communications.
BDCCLK
BDCFCLK
0
BDCSI Clock
BDC serial interface
and FSM
1
CLKSW
Core clock
BDC device resource
interface
Figure 5-5. Clock Switch
5.4.4
BDC Commands
BDC commands can be classified into three types as shown in Table 5-7.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
153
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-7. BDC Command Types
Command Type
Secure
Status
BDC
Status
Always-available
Secure or
Unsecure
Enabled or
Disabled
Non-intrusive
Active background
Unsecure
Unsecure
Enabled
Active
CPU Status
Command Set
—
•
•
•
•
Read/write access to BDCCSR
Mass erase flash memory using ERASE_FLASH
SYNC
ACK enable/disable
Code
execution
allowed
•
•
•
•
•
•
•
•
Read/write access to BDCCSR
Memory access
Memory access with status
Mass erase flash memory using ERASE_FLASH
Debug register access
BACKGROUND
SYNC
ACK enable/disable
Code
execution
halted
•
•
•
•
•
•
•
•
•
•
Read/write access to BDCCSR
Memory access
Memory access with status
Mass erase flash memory using ERASE_FLASH
Debug register access
Read or write CPU registers
Single-step the application
Exit active BDM to return to the application program (GO)
SYNC
ACK enable/disable
Non-intrusive commands are used to read and write target system memory locations and to enter active
BDM. Target system memory includes all memory and registers within the global memory map, including
external memory.
Active background commands are used to read and write all memory locations and CPU resources.
Furthermore they allow single stepping through application code and to exit from active BDM.
Non-intrusive commands can only be executed when the BDC is enabled and the device unsecure. Active
background commands can only be executed when the system is not secure and is in active BDM.
Non-intrusive commands do not require the system to be in active BDM for execution, although, they can
still be executed in this mode. When executing a non-intrusive command with the ACK pulse handshake
protocol disabled, the BDC steals the next bus cycle for the access. If an operation requires multiple cycles,
then multiple cycles can be stolen. Thus if stolen cycles are not free cycles, the application code execution
is delayed. The delay is negligible because the BDC serial transfer rate dictates that such accesses occur
infrequently.
For data read commands, the external host must wait at least 16 BDCSI clock cycles after sending the
address before attempting to obtain the read data. This is to be certain that valid data is available in the
BDC shift register, ready to be shifted out. For write commands, the external host must wait 16 bdcsi
cycles after sending the data to be written before attempting to send a new command. This is to avoid
disturbing the BDC shift register before the write has been completed. The external host must wait at least
for 16 bdcsi cycles after a control command before starting any new serial command.
MC9S12ZVM Family Reference Manual Rev. 1.3
154
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
If the ACK pulse handshake protocol is enabled and STEAL is cleared, then the BDC waits for the first
free bus cycle to make a non-intrusive access. If no free bus cycle occurs within 512 core clock cycles then
the BDC aborts the access, sets the NORESP bit and uses a long ACK pulse to indicate an error condition
to the host.
Table 5-8 summarizes the BDC command set. The subsequent sections describe each command in detail
and illustrate the command structure in a series of packets, each consisting of eight bit times starting with
a falling edge. The bar across the top of the blocks indicates that the BKGD line idles in the high state. The
time for an 8-bit command is 8 × 16 target BDCSI clock cycles.
The nomenclature below is used to describe the structure of the BDC commands. Commands begin with
an 8-bit hexadecimal command code in the host-to-target direction (most significant bit first)
/
d
dack
ad24
rd8
rd16
rd24
rd32
rd64
rd.sz
wd8
wd16
wd32
wd.sz
ss
sz
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
crn
WS
=
=
separates parts of the command
delay 16 target BDCSI clock cycles (DLY)
delay (16 cycles) no ACK; or delay (=> 32 cycles) then ACK.(DACK)
24-bit memory address in the host-to-target direction
8 bits of read data in the target-to-host direction
16 bits of read data in the target-to-host direction
24 bits of read data in the target-to-host direction
32 bits of read data in the target-to-host direction
64 bits of read data in the target-to-host direction
read data, size defined by sz, in the target-to-host direction
8 bits of write data in the host-to-target direction
16 bits of write data in the host-to-target direction
32 bits of write data in the host-to-target direction
write data, size defined by sz, in the host-to-target direction
the contents of BDCCSRL in the target-to-host direction
memory operand size (00 = byte, 01 = word, 10 = long)
(sz = 11 is reserved and currently defaults to long)
core register number, 32-bit data width
command suffix signaling the operation is with status
Table 5-8. BDC Command Summary
Command
Mnemonic
Command
Classification
ACK
Command
Structure
Description
SYNC
Always
Available
N/A
N/A(1)
Request a timed reference pulse to
determine the target BDC communication
speed
ACK_DISABLE
Always
Available
No
0x03/d
Disable the communication handshake.
This command does not issue an ACK
pulse.
ACK_ENABLE
Always
Available
Yes
0x02/dack
Enable the communication handshake.
Issues an ACK pulse after the command is
executed.
BACKGROUND
Non-Intrusive
Yes
0x04/dack
Halt the CPU if ENBDC is set. Otherwise,
ignore as illegal command.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
155
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-8. BDC Command Summary (continued)
Command
Mnemonic
Command
Classification
ACK
Command
Structure
DUMP_MEM.sz
Non-Intrusive
Yes
(0x32+4 x sz)/dack/rd.sz
Dump (read) memory based on operand
size (sz). Used with READ_MEM to dump
large blocks of memory. An initial
READ_MEM is executed to set up the
starting address of the block and to retrieve
the first result. Subsequent DUMP_MEM
commands retrieve sequential operands.
DUMP_MEM.sz_WS
Non-Intrusive
No
(0x33+4 x sz)/d/ss/rd.sz
Dump (read) memory based on operand
size (sz) and report status. Used with
READ_MEM{_WS} to dump large blocks of
memory. An initial READ_MEM{_WS} is
executed to set up the starting address of
the block and to retrieve the first result.
Subsequent DUMP_MEM{_WS}
commands retrieve sequential operands.
FILL_MEM.sz
Non-Intrusive
Yes
(0x12+4 x sz)/wd.sz/dack
Fill (write) memory based on operand size
(sz). Used with WRITE_MEM to fill large
blocks of memory. An initial WRITE_MEM
is executed to set up the starting address
of the block and to write the first operand.
Subsequent FILL_MEM commands write
sequential operands.
FILL_MEM.sz_WS
Non-Intrusive
No
(0x13+4 x sz)/wd.sz/d/ss
Fill (write) memory based on operand size
(sz) and report status. Used with
WRITE_MEM{_WS} to fill large blocks of
memory. An initial WRITE_MEM{_WS} is
executed to set up the starting address of
the block and to write the first operand.
Subsequent FILL_MEM{_WS} commands
write sequential operands.
GO
Active
Background
Yes
0x08/dack
Resume CPU user code execution
GO_UNTIL(2)
Active
Background
Yes
0x0C/dack
Go to user program. ACK is driven upon
returning to active background mode.
Non-Intrusive
Yes
0x00/dack
No operation
Active
Background
Yes
(0x60+CRN)/dack/rd32
READ_MEM.sz
Non-Intrusive
Yes
(0x30+4 x sz)/ad24/dack/rd.sz Read the appropriately-sized (sz) memory
value from the location specified by the 24bit address
READ_MEM.sz_WS
Non-Intrusive
No
(0x31+4 x sz)/ad24/d/ss/rd.sz Read the appropriately-sized (sz) memory
value from the location specified by the 24bit address and report status
READ_DBGTB
Non-Intrusive
Yes
NOP
READ_Rn
(0x07)/dack/rd32/dack/rd32
Description
Read the requested CPU register
Read 64-bits of DBG trace buffer
MC9S12ZVM Family Reference Manual Rev. 1.3
156
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-8. BDC Command Summary (continued)
Command
Mnemonic
Command
Classification
ACK
Command
Structure
READ_SAME.sz
Non-Intrusive
Yes
(0x50+4 x sz)/dack/rd.sz
Read from location. An initial READ_MEM
defines the address, subsequent
READ_SAME reads return content of
same address
READ_SAME.sz_WS
Non-Intrusive
No
(0x51+4 x sz)/d/ss/rd.sz
Read from location. An initial READ_MEM
defines the address, subsequent
READ_SAME reads return content of
same address
Always
Available
No
0x2D/rd16
SYNC_PC
Non-Intrusive
Yes
0x01/dack/rd24
WRITE_MEM.sz
Non-Intrusive
Yes
(0x10+4 x
sz)/ad24/wd.sz/dack
WRITE_MEM.sz_WS
Non-Intrusive
No
Active
Background
Yes
(0x40+CRN)/wd32/dack
WRITE_BDCCSR
Always
Available
No
0x0D/wd16
ERASE_FLASH
Always
Available
No
0x95/d
Active
Background
Yes
0x09/dack
READ_BDCCSR
WRITE_Rn
STEP1 (TRACE1)
Description
Read the BDCCSR register
Read current PC
Write the appropriately-sized (sz) memory
value to the location specified by the 24-bit
address
(0x11+4 x sz)/ad24/wd.sz/d/ss Write the appropriately-sized (sz) memory
value to the location specified by the 24-bit
address and report status
Write the requested CPU register
Write the BDCCSR register
Mass erase internal flash
Execute one CPU command.
1. The SYNC command is a special operation which does not have a command code.
2. The GO_UNTIL command is identical to the GO command if ACK is not enabled.
5.4.4.1
SYNC
The SYNC command is unlike other BDC commands because the host does not necessarily know the
correct speed to use for serial communications until after it has analyzed the response to the SYNC
command.
To issue a SYNC command, the host:
1. Ensures that the BKGD pin is high for at least 4 cycles of the slowest possible BDCSI clock without
reset asserted.
2. Drives the BKGD pin low for at least 128 cycles of the slowest possible BDCSI clock.
3. Drives BKGD high for a brief speed-up pulse to get a fast rise time. (This speedup pulse is typically
one cycle of the host clock which is as fast as the maximum target BDCSI clock).
4. Removes all drive to the BKGD pin so it reverts to high impedance.
5. Listens to the BKGD pin for the sync response pulse.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
157
Chapter 5 Background Debug Controller (S12ZBDCV2)
Upon detecting the sync request from the host (which is a much longer low time than would ever occur
during normal BDC communications), the target:
1. Discards any incomplete command
2. Waits for BKGD to return to a logic high.
3. Delays 16 cycles to allow the host to stop driving the high speed-up pulse.
4. Drives BKGD low for 128 BDCSI clock cycles.
5. Drives a 1-cycle high speed-up pulse to force a fast rise time on BKGD.
6. Removes all drive to the BKGD pin so it reverts to high impedance.
7. Clears the OVRRUN flag (if set).
The host measures the low time of this 128-cycle SYNC response pulse and determines the correct speed
for subsequent BDC communications. Typically, the host can determine the correct communication speed
within a few percent of the actual target speed and the serial protocol can easily tolerate this speed error.
If the SYNC request is detected by the target, any partially executed command is discarded. This is referred
to as a soft-reset, equivalent to a timeout in the serial communication. After the SYNC response, the target
interprets the next negative edge (issued by the host) as the start of a new BDC command or the start of
new SYNC request.
A SYNC command can also be used to abort a pending ACK pulse. This is explained in Section 5.4.8.
5.4.4.2
ACK_DISABLE
Disable host/target handshake protocol
Always Available
0x03
host →
target
D
L
Y
Disables the serial communication handshake protocol. The subsequent commands, issued after the
ACK_DISABLE command, do not execute the hardware handshake protocol. This command is not
followed by an ACK pulse.
5.4.4.3
ACK_ENABLE
Enable host/target handshake protocol
Always Available
0x02
host →
target
D
A
C
K
Enables the hardware handshake protocol in the serial communication. The hardware handshake is
implemented by an acknowledge (ACK) pulse issued by the target MCU in response to a host command.
The ACK_ENABLE command is interpreted and executed in the BDC logic without the need to interface
MC9S12ZVM Family Reference Manual Rev. 1.3
158
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
with the CPU. An ACK pulse is issued by the target device after this command is executed. This command
can be used by the host to evaluate if the target supports the hardware handshake protocol. If the target
supports the hardware handshake protocol, subsequent commands are enabled to execute the hardware
handshake protocol, otherwise this command is ignored by the target. Table 5-8 indicates which
commands support the ACK hardware handshake protocol.
For additional information about the hardware handshake protocol, refer to Section 5.4.7,” and
Section 5.4.8.”
5.4.4.4
BACKGROUND
Enter active background mode (if enabled)
Non-intrusive
0x04
host →
target
D
A
C
K
Provided ENBDC is set, the BACKGROUND command causes the target MCU to enter active BDM as
soon as the current CPU instruction finishes. If ENBDC is cleared, the BACKGROUND command is
ignored.
A delay of 16 BDCSI clock cycles is required after the BACKGROUND command to allow the target
MCU to finish its current CPU instruction and enter active background mode before a new BDC command
can be accepted.
The host debugger must set ENBDC before attempting to send the BACKGROUND command the first
time. Normally the host sets ENBDC once at the beginning of a debug session or after a target system reset.
During debugging, the host uses GO commands to move from active BDM to application program
execution and uses the BACKGROUND command or DBG breakpoints to return to active BDM.
A BACKGROUND command issued during stop or wait modes cannot immediately force active BDM
because the WAI instruction does not end until an interrupt occurs. For the detailed mode dependency
description refer to Section 5.1.3.3.
The host can recognize this pending BDM request condition because both NORESP and WAIT are set, but
BDMACT is clear. Whilst in wait mode, with the pending BDM request, non-intrusive BDC commands
are allowed.
5.4.4.5
DUMP_MEM.sz, DUMP_MEM.sz_WS
DUMP_MEM.sz
Read memory specified by debug address register, then
increment address
0x32
Non-intrusive
Data[7-0]
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
159
Chapter 5 Background Debug Controller (S12ZBDCV2)
DUMP_MEM.sz
host →
target
D
A
C
K
0x36
host →
target
D
A
C
K
0x3A
host →
target
D
A
C
K
target →
host
Data[15-8]
Data[7-0]
target →
host
target →
host
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
target →
host
target →
host
target →
host
target →
host
DUMP_MEM.sz_WS
Read memory specified by debug address register with status,
then increment address
0x33
host →
target
BDCCSRL
D
L
Y
0x37
host →
target
D
L
Y
0x3B
host →
target
D
L
Y
target →
host
Non-intrusive
Data[7-0]
target →
host
BDCCSRL
Data[15-8]
Data[7-0]
target →
host
target →
host
BDCCSRL
Data[31-24]
Data23-16]
Data[15-8]
target →
host
target →
host
target →
host
target →
host
target →
host
Data[7-0]
target →
host
DUMP_MEM{_WS} is used with the READ_MEM{_WS} command to access large blocks of memory.
An initial READ_MEM{_WS} is executed to set-up the starting address of the block and to retrieve the
first result. The DUMP_MEM{_WS} command retrieves subsequent operands. The initial address is
incremented by the operand size (1, 2, or 4) and saved in a temporary register. Subsequent
DUMP_MEM{_WS} commands use this address, perform the memory read, increment it by the current
operand size, and store the updated address in the temporary register. If the with-status option is specified,
the BDCCSRL status byte is returned before the read data. This status byte reflects the state after the
memory read was performed. If enabled, an ACK pulse is driven before the data bytes are transmitted. The
effect of the access size and alignment on the next address to be accessed is explained in more detail in
Section 5.4.5.2”.
MC9S12ZVM Family Reference Manual Rev. 1.3
160
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
NOTE
DUMP_MEM{_WS} is a valid command only when preceded by SYNC,
NOP, READ_MEM{_WS}, or another DUMP_MEM{_WS} command.
Otherwise, an illegal command response is returned, setting the ILLCMD
bit. NOP can be used for inter-command padding without corrupting the
address pointer.
The size field (sz) is examined each time a DUMP_MEM{_WS} command is processed, allowing the
operand size to be dynamically altered. The examples show the DUMP_MEM.B{_WS},
DUMP_MEM.W{_WS} and DUMP_MEM.L{_WS} commands.
5.4.4.6
FILL_MEM.sz, FILL_MEM.sz_WS
FILL_MEM.sz
Write memory specified by debug address register, then
increment address
Non-intrusive
0x12
Data[7-0]
host →
target
host →
target
0x16
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
0x1A
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
host →
target
host →
target
D
A
C
K
D
A
C
K
D
A
C
K
FILL_MEM.sz_WS
Write memory specified by debug address register with
status, then increment address
0x13
Data[7-0]
host →
target
host →
target
0x17
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
Non-intrusive
BDCCSRL
D
L
Y
target →
host
BDCCSRL
D
L
Y
target →
host
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
161
Chapter 5 Background Debug Controller (S12ZBDCV2)
FILL_MEM.sz_WS
0x1B
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
host →
target
host →
target
BDCCSRL
D
L
Y
target →
host
FILL_MEM{_WS} is used with the WRITE_MEM{_WS} command to access large blocks of memory.
An initial WRITE_MEM{_WS} is executed to set up the starting address of the block and write the first
datum. If an initial WRITE_MEM{_WS} is not executed before the first FILL_MEM{_WS}, an illegal
command response is returned. The FILL_MEM{_WS} command stores subsequent operands. The initial
address is incremented by the operand size (1, 2, or 4) and saved in a temporary register. Subsequent
FILL_MEM{_WS} commands use this address, perform the memory write, increment it by the current
operand size, and store the updated address in the temporary register. If the with-status option is specified,
the BDCCSRL status byte is returned after the write data. This status byte reflects the state after the
memory write was performed. If enabled an ACK pulse is generated after the internal write access has been
completed or aborted. The effect of the access size and alignment on the next address to be accessed is
explained in more detail in Section 5.4.5.2”
NOTE
FILL_MEM{_WS} is a valid command only when preceded by SYNC,
NOP, WRITE_MEM{_WS}, or another FILL_MEM{_WS} command.
Otherwise, an illegal command response is returned, setting the ILLCMD
bit. NOP can be used for inter command padding without corrupting the
address pointer.
The size field (sz) is examined each time a FILL_MEM{_WS} command is processed, allowing the
operand size to be dynamically altered. The examples show the FILL_MEM.B{_WS},
FILL_MEM.W{_WS} and FILL_MEM.L{_WS} commands.
5.4.4.7
GO
Go
Non-intrusive
0x08
host →
target
D
A
C
K
This command is used to exit active BDM and begin (or resume) execution of CPU application code. The
CPU pipeline is flushed and refilled before normal instruction execution resumes. Prefetching begins at the
current address in the PC. If any register (such as the PC) is altered by a BDC command whilst in BDM,
the updated value is used when prefetching resumes. If enabled, an ACK is driven on exiting active BDM.
If a GO command is issued whilst the BDM is inactive, an illegal command response is returned and the
ILLCMD bit is set.
MC9S12ZVM Family Reference Manual Rev. 1.3
162
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.4.8
GO_UNTIL
Go Until
Active Background
0x0C
host →
target
D
A
C
K
This command is used to exit active BDM and begin (or resume) execution of application code. The CPU
pipeline is flushed and refilled before normal instruction execution resumes. Prefetching begins at the
current address in the PC. If any register (such as the PC) is altered by a BDC command whilst in BDM,
the updated value is used when prefetching resumes.
After resuming application code execution, if ACK is enabled, the BDC awaits a return to active BDM
before driving an ACK pulse. timeouts do not apply when awaiting a GO_UNTIL command ACK.
If a GO_UNTIL is not acknowledged then a SYNC command must be issued to end the pending
GO_UNTIL.
If a GO_UNTIL command is issued whilst BDM is inactive, an illegal command response is returned and
the ILLCMD bit is set.
If ACK handshaking is disabled, the GO_UNTIL command is identical to the GO command.
5.4.4.9
NOP
No operation
Active Background
0x00
host →
target
D
A
C
K
NOP performs no operation and may be used as a null command where required.
5.4.4.10
READ_Rn
Read CPU register
Active Background
0x60+CRN
host →
target
Data [31-24] Data [23-16]
D
A
C
K
target →
host
target →
host
Data [15-8]
Data [7-0]
target →
host
target →
host
This command reads the selected CPU registers and returns the 32-bit result. Accesses to CPU registers
are always 32-bits wide, regardless of implemented register width. Bytes that are not implemented return
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
163
Chapter 5 Background Debug Controller (S12ZBDCV2)
zero. The register is addressed through the CPU register number (CRN). See Section 5.4.5.1 for the CRN
address decoding. If enabled, an ACK pulse is driven before the data bytes are transmitted.
If the device is not in active BDM, this command is illegal, the ILLCMD bit is set and no access is
performed.
5.4.4.11
READ_MEM.sz, READ_MEM.sz_WS
READ_MEM.sz
Read memory at the specified address
0x30
Address[23-0]
host →
target
host →
target
0x34
Address[23-0]
host →
target
host →
target
0x38
Address[23-0]
host →
target
host →
target
Non-intrusive
Data[7-0]
D
A
C
K
D
A
C
K
D
A
C
K
target →
host
Data[15-8]
Data[7-0]
target →
host
target →
host
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
target →
host
target →
host
target →
host
target →
host
READ_MEM.sz_WS
Read memory at the specified address with status
0x31
Address[23-0]
host →
target
host →
target
0x35
Address[23-0]
host →
target
host →
target
0x39
Address[23-0]
host →
target
host →
target
BDCCSRL
D
L
Y
D
L
Y
D
L
Y
target →
host
Non-intrusive
Data[7-0]
target →
host
BDCCSRL
Data [15-8]
Data [7-0]
target →
host
target →
host
BDCCSRL
Data[31-24]
Data[23-16]
Data [15-8]
target →
host
target →
host
target →
host
target →
host
target →
host
Data [7-0]
target →
host
Read data at the specified memory address. The address is transmitted as three 8-bit packets (msb to lsb)
immediately after the command.
The hardware forces low-order address bits to zero longword accesses to ensure these accesses are on 0modulo-size alignments. Byte alignment details are described in Section 5.4.5.2”. If the with-status option
is specified, the BDCCSR status byte is returned before the read data. This status byte reflects the state
MC9S12ZVM Family Reference Manual Rev. 1.3
164
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
after the memory read was performed. If enabled, an ACK pulse is driven before the data bytes are
transmitted.
The examples show the READ_MEM.B{_WS}, READ_MEM.W{_WS} and READ_MEM.L{_WS}
commands.
5.4.4.12
READ_DBGTB
Read DBG trace buffer
TB Line [31- TB Line [23- TB Line [15- TB Line [724]
16]
8]
0]
0x07
host →
target
Non-intrusive
D
A
C
K
target →
host
target →
host
target →
host
target →
host
TB Line [63- TB Line [55- TB Line [47- TB Line [3956]
48]
40]
32]
D
A
C
K
target →
host
target →
host
target →
host
target →
host
This command is only available on devices, where the DBG module includes a trace buffer. Attempted use
of this command on devices without a traace buffer return 0x00.
Read 64 bits from the DBG trace buffer. Refer to the DBG module description for more detailed
information. If enabled an ACK pulse is generated before each 32-bit longword is ready to be read by the
host. After issuing the first ACK a timeout is still possible whilst accessing the second 32-bit longword,
since this requires separate internal accesses. The first 32-bit longword corresponds to trace buffer line
bits[31:0]; the second to trace buffer line bits[63:32]. If ACK handshaking is disabled, the host must wait
16 clock cycles (DLY) after completing the first 32-bit read before starting the second 32-bit read.
5.4.4.13
READ_SAME.sz, READ_SAME.sz_WS
READ_SAME
Read same location specified by previous READ_MEM{_WS}
0x54
host →
target
D
A
C
K
Data[15-8]
Data[7-0]
target →
host
target →
host
Non-intrusive
READ_SAME_WS
Read same location specified by previous READ_MEM{_WS}
0x55
host →
target
D
L
Y
BDCCSRL
Data [15-8]
target →
host
target →
host
Non-intrusive
Data [7-0]
target →
host
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
165
Chapter 5 Background Debug Controller (S12ZBDCV2)
Read from location defined by the previous READ_MEM. The previous READ_MEM command defines
the address, subsequent READ_SAME commands return contents of same address. The example shows
the sequence for reading a 16-bit word size. Byte alignment details are described in Section 5.4.5.2”. If
enabled, an ACK pulse is driven before the data bytes are transmitted.
NOTE
READ_SAME{_WS} is a valid command only when preceded by SYNC,
NOP, READ_MEM{_WS}, or another READ_SAME{_WS} command.
Otherwise, an illegal command response is returned, setting the ILLCMD
bit. NOP can be used for inter-command padding without corrupting the
address pointer.
5.4.4.14
READ_BDCCSR
Read BDCCSR Status Register
0x2D
host →
target
D
L
Y
Always Available
BDCCSR
[15:8]
BDCCSR
[7-0]
target
→ host
target
→ host
Read the BDCCSR status register. This command can be executed in any mode.
5.4.4.15
SYNC_PC
Sample current PC
0x01
host →
target
D
A
C
K
Non-intrusive
PC
data[23–16]
PC
data[15–8]
PC
data[7–0]
target →
host
target →
host
target →
host
This command returns the 24-bit CPU PC value to the host. Unsuccessful SYNC_PC accesses return 0xEE
for each byte. If enabled, an ACK pulse is driven before the data bytes are transmitted. The value of 0xEE
is returned if a timeout occurs, whereby NORESP is set. This can occur if the CPU is executing the WAI
instruction, or the STOP instruction with BDCCIS clear, or if a CPU access is delayed by EWAIT. If the
CPU is executing the STOP instruction and BDCCIS is set, then SYNC_PC returns the PC address of the
instruction following STOP in the code listing.
This command can be used to dynamically access the PC for performance monitoring as the execution of
this command is considerably less intrusive to the real-time operation of an application than a
BACKGROUND/read-PC/GO command sequence. Whilst the BDC is not in active BDM, SYNC_PC
returns the PC address of the instruction currently being executed by the CPU. In active BDM, SYNC_PC
returns the address of the next instruction to be executed on returning from active BDM. Thus following a
write to the PC in active BDM, a SYNC_PC returns that written value.
MC9S12ZVM Family Reference Manual Rev. 1.3
166
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.4.16
WRITE_MEM.sz, WRITE_MEM.sz_WS
WRITE_MEM.sz
Write memory at the specified address
Non-intrusive
0x10
Address[23-0]
Data[7–0]
host →
target
host → target
host →
target
0x14
Address[23-0]
Data[15–8]
Data[7–0]
host →
target
host → target
host →
target
host →
target
0x18
Address[23-0]
host →
target
host → target
D
A
C
K
D
A
C
K
Data[31–24] Data[23–16]
host →
target
Data[15–8]
Data[7–0]
host →
target
host →
target
host →
target
D
A
C
K
WRITE_MEM.sz_WS
Write memory at the specified address with status
Non-intrusive
0x11
Address[23-0]
Data[7–0]
host →
target
host →
target
host →
target
0x15
Address[23-0]
Data[15–8]
Data[7–0]
host →
target
host →
target
host →
target
host →
target
0x19
Address[23-0]
host →
target
host →
target
BDCCSRL
D
L
Y
target →
host
Data[31–24] Data[23–16]
host →
target
host →
target
BDCCSRL
D
L
Y
target →
host
Data[15–8]
Data[7–0]
host →
target
host →
target
BDCCSRL
D
L
Y
target →
host
Write data to the specified memory address. The address is transmitted as three 8-bit packets (msb to lsb)
immediately after the command.
If the with-status option is specified, the status byte contained in BDCCSRL is returned after the write data.
This status byte reflects the state after the memory write was performed. The examples show the
WRITE_MEM.B{_WS}, WRITE_MEM.W{_WS}, and WRITE_MEM.L{_WS} commands. If enabled
an ACK pulse is generated after the internal write access has been completed or aborted.
The hardware forces low-order address bits to zero longword accesses to ensure these accesses are on 0modulo-size alignments. Byte alignment details are described in Section 5.4.5.2”.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
167
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.4.17
WRITE_Rn
Write general-purpose CPU register
0x40+CRN
Active Background
Data [31–24] Data [23–16] Data [15–8]
host →
target
host →
target
host →
target
host →
target
Data [7–0]
host →
target
D
A
C
K
If the device is in active BDM, this command writes the 32-bit operand to the selected CPU generalpurpose register. See Section 5.4.5.1 for the CRN details. Accesses to CPU registers are always 32-bits
wide, regardless of implemented register width. If enabled an ACK pulse is generated after the internal
write access has been completed or aborted.
If the device is not in active BDM, this command is rejected as an illegal operation, the ILLCMD bit is set
and no operation is performed.
5.4.4.18
WRITE_BDCCSR
Write BDCCSR
Always Available
0x0D
host →
target
BDCCSR
Data [15-8]
BDCCSR
Data [7-0]
host →
target
host →
target
D
L
Y
16-bit write to the BDCCSR register. No ACK pulse is generated. Writing to this register can be used to
configure control bits or clear flag bits. Refer to the register bit descriptions.
5.4.4.19
ERASE_FLASH
Erase FLASH
Always Available
0x95
host →
target
D
L
Y
Mass erase the internal flash. This command can always be issued. On receiving this command twice in
succession, the BDC sets the ERASE bit in BDCCSR and requests a flash mass erase. Any other BDC
command following a single ERASE_FLASH initializes the sequence, such that thereafter the
ERASE_FLASH must be applied twice in succession to request a mass erase. If 512 BDCSI clock cycles
elapse between the consecutive ERASE_FLASH commands then a timeout occurs, which forces a soft
reset and initializes the sequence. The ERASE bit is cleared when the mass erase sequence has been
completed. No ACK is driven.
MC9S12ZVM Family Reference Manual Rev. 1.3
168
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
During the mass erase operation, which takes many clock cycles, the command status is indicated by the
ERASE bit in BDCCSR. Whilst a mass erase operation is ongoing, Always-available commands can be
issued. This allows the status of the erase operation to be polled by reading BDCCSR to determine when
the operation is finished.
The status of the flash array can be verified by subsequently reading the flash error flags to determine if the
erase completed successfully.
ERASE_FLASH can be aborted by a SYNC pulse forcing a soft reset.
NOTE: Device Bus Frequency Considerations
The ERASE_FLASH command requires the default device bus clock
frequency after reset. Thus the bus clock frequency must not be changed
following reset before issuing an ERASE_FLASH command.
5.4.4.20
STEP1
Step1
Active Background
0x09
host →
target
D
A
C
K
This command is used to step through application code. In active BDM this command executes the next
CPU instruction in application code. If enabled an ACK is driven.
If a STEP1 command is issued and the CPU is not halted, the command is ignored.
Using STEP1 to step through a CPU WAI instruction is explained in Section 5.1.3.3.2.
5.4.5
BDC Access Of Internal Resources
Unsuccessful read accesses of internal resources return a value of 0xEE for each data byte. This enables a
debugger to recognize a potential error, even if neither the ACK handshaking protocol nor a status
command is currently being executed. The value of 0xEE is returned in the following cases.
• Illegal address access, whereby ILLACC is set
• Invalid READ_SAME or DUMP_MEM sequence
• Invalid READ_Rn command (BDM inactive or CRN incorrect)
• Internal resource read with timeout, whereby NORESP is set
5.4.5.1
BDC Access Of CPU Registers
The CRN field of the READ_Rn and WRITE_Rn commands contains a pointer to the CPU registers. The
mapping of CRN to CPU registers is shown in Table 5-9. Accesses to CPU registers are always 32-bits
wide, regardless of implemented register width. This means that the BDC data transmission for these
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
169
Chapter 5 Background Debug Controller (S12ZBDCV2)
commands is 32-bits long. The valid bits of the transfer are listed in the Valid Data Bits column. The other
bits of the transmission are redundant.
Attempted accesses of CPU registers using a CRN of 0xD,0xE or 0xF is invalid, returning the value 0xEE
for each byte and setting the ILLACC bit.
Table 5-9. CPU Register Number (CRN) Mapping
CPU Register
Valid Data Bits
Command
Opcode
Command
Opcode
D0
[7:0]
WRITE_D0
0x40
READ_D0
0x60
5.4.5.2
D1
[7:0]
WRITE_D1
0x41
READ_D1
0x61
D2
[15:0]
WRITE_D2
0x42
READ_D2
0x62
D3
[15:0]
WRITE_D3
0x43
READ_D3
0x63
D4
[15:0]
WRITE_D4
0x44
READ_D4
0x64
D5
[15:0]
WRITE_D5
0x45
READ_D5
0x65
D6
[31:0]
WRITE_D6
0x46
READ_D6
0x66
D7
[31:0]
WRITE_D7
0x47
READ_D7
0x67
X
[23:0]
WRITE_X
0x48
READ_X
0x68
Y
[23:0]
WRITE_Y
0x49
READ_Y
0x69
SP
[23:0]
WRITE_SP
0x4A
READ_SP
0x6A
PC
[23:0]
WRITE_PC
0x4B
READ_PC
0x6B
CCR
[15:0]
WRITE_CCR
0x4C
READ_CCR
0x6C
BDC Access Of Device Memory Mapped Resources
The device memory map is accessed using READ_MEM, DUMP_MEM, WRITE_MEM, FILL_MEM
and READ_SAME, which support different access sizes, as explained in the command descriptions.
When an unimplemented command occurs during a DUMP_MEM, FILL_MEM or READ_SAME
sequence, then that sequence is ended.
Illegal read accesses return a value of 0xEE for each byte. After an illegal access FILL_MEM and
READ_SAME commands are not valid, and it is necessary to restart the internal access sequence with
READ_MEM or WRITE_MEM. An illegal access does not break a DUMP_MEM sequence. After read
accesses that cause the RDINV bit to be set, DUMP_MEM and READ_SAME commands are valid, it is
not necessary to restart the access sequence with a READ_MEM.
The hardware forces low-order address bits to zero for longword accesses to ensure these accesses are
realigned to 0-modulo-size alignments.
Word accesses map to 2-bytes from within a 4-byte field as shown in Table 5-10. Thus if address bits [1:0]
are both logic “1” the access is realigned so that it does not straddle the 4-byte boundary but accesses data
from within the addressed 4-byte field.
MC9S12ZVM Family Reference Manual Rev. 1.3
170
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-10. Field Location to Byte Access Mapping
Address[1:0]
Access Size
00
01
10
11
00
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
01
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
Realigned
10
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
Realigned
11
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
Realigned
00
16-bit
Data [15:8]
Data [7:0]
01
16-bit
10
16-bit
Data [15:8]
Data [7:0]
11
16-bit
Data [15:8]
Data [7:0]
00
8-bit
01
8-bit
10
8-bit
11
8-bit
Data [15:8]
Note
Data [7:0]
Realigned
Data [7:0]
Data [7:0]
Data [7:0]
Data [7:0]
Denotes byte that is not transmitted
5.4.5.2.1
FILL_MEM and DUMP_MEM Increments and Alignment
FILL_MEM and DUMP_MEM increment the previously accessed address by the previous access size to
calculate the address of the current access. On misaligned longword accesses, the address bits [1:0] are
forced to zero, therefore the following FILL_MEM or DUMP_MEM increment to the first address in the
next 4-byte field. This is shown in Table 5-11, the address of the first DUMP_MEM.32 following
READ_MEM.32 being calculated from 0x004000+4.
When misaligned word accesses are realigned, then the original address (not the realigned address) is
incremented for the following FILL_MEM, DUMP_MEM command.
Misaligned word accesses can cause the same locations to be read twice as shown in rows 6 and 7. The
hardware ensures alignment at an attempted misaligned word access across a 4-byte boundary, as shown
in row 7. The following word access in row 8 continues from the realigned address of row 7.
d
Table 5-11. Consecutive Accesses With Variable Size
Row
Command
Address
Address[1:0]
00
01
10
11
1
READ_MEM.32
0x004003
11
Accessed
Accessed
Accessed
Accessed
2
DUMP_MEM.32
0x004004
00
Accessed
Accessed
Accessed
Accessed
3
DUMP_MEM.16
0x004008
00
Accessed
Accessed
4
DUMP_MEM.16
0x00400A
10
Accessed
Accessed
5
DUMP_MEM.08
0x00400C
00
6
DUMP_MEM.16
0x00400D
01
7
DUMP_MEM.16
0x00400E
10
8
DUMP_MEM.16
0x004010
01
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
171
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.5.2.2
READ_SAME Effects Of Variable Access Size
READ_SAME uses the unadjusted address given in the previous READ_MEM command as a base
address for subsequent READ_SAME commands. When the READ_MEM and READ_SAME size
parameters differ then READ_SAME uses the original base address buts aligns 32-bit and 16-bit accesses,
where those accesses would otherwise cross the aligned 4-byte boundary. Table 5-12 shows some
examples of this.
d
Table 5-12. Consecutive READ_SAME Accesses With Variable Size
Row
5.4.6
Command
Base Address
00
01
10
11
1
READ_MEM.32
0x004003
Accessed
Accessed
Accessed
Accessed
2
READ_SAME.32
—
Accessed
Accessed
Accessed
Accessed
3
READ_SAME.16
—
Accessed
Accessed
4
READ_SAME.08
—
5
READ_MEM.08
0x004000
Accessed
6
READ_SAME.08
—
Accessed
7
READ_SAME.16
—
Accessed
Accessed
8
READ_SAME.32
—
Accessed
Accessed
Accessed
Accessed
Accessed
9
READ_MEM.08
0x004002
Accessed
10
READ_SAME.08
—
Accessed
11
READ_SAME.16
—
Accessed
Accessed
12
READ_SAME.32
—
Accessed
Accessed
13
READ_MEM.08
0x004003
Accessed
14
READ_SAME.08
—
Accessed
15
READ_SAME.16
—
16
READ_SAME.32
—
17
READ_MEM.16
18
READ_SAME.08
19
20
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
0x004001
Accessed
Accessed
—
Accessed
READ_SAME.16
—
Accessed
Accessed
READ_SAME.32
—
Accessed
Accessed
21
READ_MEM.16
0x004003
22
READ_SAME.08
—
23
READ_SAME.16
—
24
READ_SAME.32
—
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
BDC Serial Interface
The BDC communicates with external devices serially via the BKGD pin. During reset, this pin is a mode
select input which selects between normal and special modes of operation. After reset, this pin becomes
the dedicated serial interface pin for the BDC.
The BDC serial interface uses an internal clock source, selected by the CLKSW bit in the BDCCSR
register. This clock is referred to as the target clock in the following explanation.
MC9S12ZVM Family Reference Manual Rev. 1.3
172
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
The BDC serial interface uses a clocking scheme in which the external host generates a falling edge on the
BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is
transmitted or received. Data is transferred most significant bit (MSB) first at 16 target clock cycles per
bit. The interface times out if during a command 512 clock cycles occur between falling edges from the
host. The timeout forces the current command to be discarded.
The BKGD pin is a pseudo open-drain pin and has a weak on-chip active pull-up that is enabled at all
times. It is assumed that there is an external pull-up and that drivers connected to BKGD do not typically
drive the high level. Since R-C rise time could be unacceptably long, the target system and host provide
brief drive-high (speedup) pulses to drive BKGD to a logic 1. The source of this speedup pulse is the host
for transmit cases and the target for receive cases.
The timing for host-to-target is shown in Figure 5-6 and that of target-to-host in Figure 5-7 and
Figure 5-8. All cases begin when the host drives the BKGD pin low to generate a falling edge. Since the
host and target operate from separate clocks, it can take the target up to one full clock cycle to recognize
this edge; this synchronization uncertainty is illustrated in Figure 5-6. The target measures delays from this
perceived start of the bit time while the host measures delays from the point it actually drove BKGD low
to start the bit up to one target clock cycle earlier. Synchronization between the host and target is
established in this manner at the start of every bit time.
Figure 5-6 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a
target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the
host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten
target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic
requires the pin be driven high no later than eight target clock cycles after the falling edge for a logic 1
transmission.
Since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven
signals.
BDCSI clock
(TARGET MCU)
HOST
TRANSMIT 1
HOST
TRANSMIT 0
10 CYCLES
SYNCHRONIZATION
UNCERTAINTY
EARLIEST START
OF NEXT BIT
TARGET SENSES BIT LEVEL
PERCEIVED START
OF BIT TIME
Figure 5-6. BDC Host-to-Target Serial Bit Timing
Figure 5-7 shows the host receiving a logic 1 from the target system. The host holds the BKGD pin low
long enough for the target to recognize it (at least two target clock cycles). The host must release the low
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
173
Chapter 5 Background Debug Controller (S12ZBDCV2)
drive at the latest after 6 clock cycles, before the target drives a brief high speedup pulse seven target clock
cycles after the perceived start of the bit time. The host should sample the bit level about 10 target clock
cycles after it started the bit time.
BDCSI clock
(TARGET MCU)
HOST DRIVE
TO BKGD PIN
TARGET MCU
SPEEDUP PULSE
HIGH-IMPEDANCE
HIGH-IMPEDANCE
HIGH-IMPEDANCE
PERCEIVED START
OF BIT TIME
R-C RISE
BKGD PIN
10 CYCLES
10 CYCLES
EARLIEST START
OF NEXT BIT
HOST SAMPLES BKGD PIN
Figure 5-7. BDC Target-to-Host Serial Bit Timing (Logic 1)
Figure 5-8 shows the host receiving a logic 0 from the target. The host initiates the bit time but the target
finishes it. Since the target wants the host to receive a logic 0, it drives the BKGD pin low for 13 target
clock cycles then briefly drives it high to speed up the rising edge. The host samples the bit level about 10
target clock cycles after starting the bit time.
MC9S12ZVM Family Reference Manual Rev. 1.3
174
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
BDCSI clock
(TARGET MCU)
HOST DRIVE
TO BKGD PIN
HIGH-IMPEDANCE
SPEEDUP
PULSE
TARGET MCU
DRIVE AND
SPEED-UP PULSE
PERCEIVED START
OF BIT TIME
BKGD PIN
10 CYCLES
EARLIEST START
OF NEXT BIT
10 CYCLES
HOST SAMPLES BKGD PIN
Figure 5-8. BDC Target-to-Host Serial Bit Timing (Logic 0)
5.4.7
Serial Interface Hardware Handshake (ACK Pulse) Protocol
BDC commands are processed internally at the device core clock rate. Since the BDCSI clock can be
asynchronous relative to the bus frequency, a handshake protocol is provided so the host can determine
when an issued command has been executed. This section describes the hardware handshake protocol.
The hardware handshake protocol signals to the host controller when a BDC command has been executed
by the target. This protocol is implemented by a low pulse (16 BDCSI clock cycles) followed by a brief
speedup pulse on the BKGD pin, generated by the target MCU when a command, issued by the host, has
been successfully executed (see Figure 5-9). This pulse is referred to as the ACK pulse. After the ACK
pulse has finished, the host can start the bit retrieval if the last issued command was a read command, or
start a new command if the last command was a write command or a control command.
BDCSI clock
(TARGET MCU)
HIGH-IMPEDANCE
16 CYCLES
TARGET
TRANSMITS
ACK PULSE
HIGH-IMPEDANCE
32 CYCLES
SPEED UP PULSE
MINIMUM DELAY
FROM THE BDC COMMAND
BKGD PIN
EARLIEST
START OF
NEXT BIT
16th CYCLE OF THE
LAST COMMAND BIT
Figure 5-9. Target Acknowledge Pulse (ACK)
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
175
Chapter 5 Background Debug Controller (S12ZBDCV2)
The handshake protocol is enabled by the ACK_ENABLE command. The BDC sends an ACK pulse when
the ACK_ENABLE command has been completed. This feature can be used by the host to evaluate if the
target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command,
the host knows that the target supports the hardware handshake protocol.
Unlike the normal bit transfer, where the host initiates the transmission by issuing a negative edge on the
BKGD pin, the serial interface ACK handshake pulse is initiated by the target MCU by issuing a negative
edge on the BKGD pin. Figure 5-9 specifies the timing when the BKGD pin is being driven. The host must
follow this timing constraint in order to avoid the risk of an electrical conflict at the BKGD pin.
When the handshake protocol is enabled, the STEAL bit in BDCCSR selects if bus cycle stealing is used
to gain immediate access. If STEAL is cleared, the BDC is configured for low priority bus access using
free cycles, without stealing cycles. This guarantees that BDC accesses remain truly non-intrusive to not
affect the system timing during debugging. If STEAL is set, the BDC gains immediate access, if necessary
stealing an internal bus cycle.
NOTE
If bus steals are disabled then a loop with no free cycles cannot allow access.
In this case the host must recognize repeated NORESP messages and then
issue a BACKGROUND command to stop the target and access the data.
Figure 5-10 shows the ACK handshake protocol without steal in a command level timing diagram. The
READ_MEM.B command is used as an example. First, the 8-bit command code is sent by the host,
followed by the address of the memory location to be read. The target BDC decodes the command. Then
an internal access is requested by the BDC. When a free bus cycle occurs the READ_MEM.B operation
is carried out. If no free cycle occurs within 512 core clock cycles then the access is aborted, the NORESP
flag is set and the target generates a Long-ACK pulse.
Having retrieved the data, the BDC issues an ACK pulse to the host controller, indicating that the addressed
byte is ready to be retrieved. After detecting the ACK pulse, the host initiates the data read part of the
command.
TARGET
BKGD PIN
READ_MEM.B
ADDRESS[23–0]
HOST
HOST
BYTE IS
RETRIEVED
TARGET
NEW BDC COMMAND
HOST
TARGET
BDC ISSUES THE
ACK PULSE (NOT TO SCALE)
BDC DECODES
THE COMMAND
MCU EXECUTES THE
READ_MEM.B
COMMAND
Figure 5-10. Handshake Protocol at Command Level
Alternatively, setting the STEAL bit configures the handshake protocol to make an immediate internal
access, independent of free bus cycles.
MC9S12ZVM Family Reference Manual Rev. 1.3
176
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
The ACK handshake protocol does not support nested ACK pulses. If a BDC command is not
acknowledged by an ACK pulse, the host needs to abort the pending command first in order to be able to
issue a new BDC command. The host can decide to abort any possible pending ACK pulse in order to be
sure a new command can be issued. Therefore, the protocol provides a mechanism in which a command,
and its corresponding ACK, can be aborted.
Commands With-Status do not generate an ACK, thus if ACK is enabled and a With-Status command is
issued, the host must use the 512 cycle timeout to calculate when the data is ready for retrieval.
5.4.7.1
Long-ACK Hardware Handshake Protocol
If a command results in an error condition, whereby a BDCCSRL flag is set, then the target generates a
“Long-ACK” low pulse of 64 BDCSI clock cycles, followed by a brief speed pulse. This indicates to the
host that an error has occurred. The host can subsequently read BDCCSR to determine the type of error.
Whether normal ACK or Long-ACK, the ACK pulse is not issued earlier than 32 BDCSI clock cycles after
the BDC command was issued. The end of the BDC command is assumed to be the 16th BDCSI clock
cycle of the last bit. The 32 cycle minimum delay differs from the 16 cycle delay time with ACK disabled.
If a BDC access request does not gain access within 512 core clock cycles, the request is aborted, the
NORESP flag is set and a Long-ACK pulse is transmitted to indicate an error case.
Following a STOP or WAI instruction, if the BDC is enabled, the first ACK, following stop or wait mode
entry is a long ACK to indicate an exception.
5.4.8
Hardware Handshake Abort Procedure
The abort procedure is based on the SYNC command. To abort a command that has not responded with an
ACK pulse, the host controller generates a sync request (by driving BKGD low for at least 128 BDCSI
clock cycles and then driving it high for one BDCSI clock cycle as a speedup pulse). By detecting this long
low pulse in the BKGD pin, the target executes the SYNC protocol, see Section 5.4.4.1”, and assumes that
the pending command and therefore the related ACK pulse are being aborted. After the SYNC protocol
has been completed the host is free to issue new BDC commands.
The host can issue a SYNC close to the 128 clock cycles length, providing a small overhead on the pulse
length to assure the sync pulse is not misinterpreted by the target. See Section 5.4.4.1”.
Figure 5-11 shows a SYNC command being issued after a READ_MEM, which aborts the READ_MEM
command. Note that, after the command is aborted a new command is issued by the host.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
177
Chapter 5 Background Debug Controller (S12ZBDCV2)
READ_MEM.B CMD
IS ABORTED BY THE SYNC REQUEST
(NOT TO SCALE)
BKGD PIN
READ_MEM.B
HOST
ADDRESS[23-0]
SYNC RESPONSE
FROM THE TARGET
(NOT TO SCALE)
READ_BDCCSR
TARGET
HOST
TARGET
NEW BDC COMMAND
HOST
TARGET
NEW BDC COMMAND
BDC DECODES
AND TRYS TO EXECUTE
Figure 5-11. ACK Abort Procedure at the Command Level (Not To Scale)
Figure 5-12 shows a conflict between the ACK pulse and the SYNC request pulse. The target is executing
a pending BDC command at the exact moment the host is being connected to the BKGD pin. In this case,
an ACK pulse is issued simultaneously to the SYNC command. Thus there is an electrical conflict between
the ACK speedup pulse and the SYNC pulse. As this is not a probable situation, the protocol does not
prevent this conflict from happening.
AT LEAST 128 CYCLES
BDCSI clock
(TARGET MCU)
ACK PULSE
TARGET MCU
DRIVES TO
BKGD PIN
HIGH-IMPEDANCE
ELECTRICAL CONFLICT
HOST
DRIVES SYNC
TO BKGD PIN
SPEEDUP PULSE
HOST AND TARGET
DRIVE TO BKGD PIN
HOST SYNC REQUEST PULSE
BKGD PIN
16 CYCLES
Figure 5-12. ACK Pulse and SYNC Request Conflict
5.4.9
Hardware Handshake Disabled (ACK Pulse Disabled)
The default state of the BDC after reset is hardware handshake protocol disabled. It can also be disabled
by the ACK_DISABLE BDC command. This provides backwards compatibility with the existing host
devices which are not able to execute the hardware handshake protocol. For host devices that support the
hardware handshake protocol, true non-intrusive debugging and error flagging is offered.
If the ACK pulse protocol is disabled, the host needs to use the worst case delay time at the appropriate
places in the protocol.
MC9S12ZVM Family Reference Manual Rev. 1.3
178
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
If the handshake protocol is disabled, the access is always independent of free cycles, whereby BDC has
higher priority than CPU. Since at least 2 bytes (command byte + data byte) are transferred over BKGD
the maximum intrusiveness is only once every few hundred cycles.
After decoding an internal access command, the BDC then awaits the next internal core clock cycle. The
relationship between BDCSI clock and core clock must be considered. If the host retrieves the data
immediately, then the BDCSI clock frequency must not be more than 4 times the core clock frequency, in
order to guarantee that the BDC gains bus access within 16 the BDCSI cycle DLY period following an
access command. If the BDCSI clock frequency is more than 4 times the core clock frequency, then the
host must use a suitable delay time before retrieving data (see 5.5.1/5-180). Furthermore, for stretched read
accesses to external resources via a device expanded bus (if implemented) the potential extra stretch cycles
must be taken into consideration before attempting to obtain read data.
If the access does not succeed before the host starts data retrieval then the NORESP flag is set but the
access is not aborted. The NORESP state can be used by the host to recognize an unexpected access
conflict due to stretched expanded bus accesses. Although the NORESP bit is set when an access does not
succeed before the start of data retrieval, the access may succeed in following bus cycles if the internal
access has already been initiated.
5.4.10
Single Stepping
When a STEP1 command is issued to the BDC in active BDM, the CPU executes a single instruction in
the user code and returns to active BDM. The STEP1 command can be issued repeatedly to step through
the user code one instruction at a time.
If an interrupt is pending when a STEP1 command is issued, the interrupt stacking operation occurs but
no user instruction is executed. In this case the stacking counts as one instruction. The device re-enters
active BDM with the program counter pointing to the first instruction in the interrupt service routine.
When stepping through the user code, the execution of the user code is done step by step but peripherals
are free running. Some peripheral modules include a freeze feature, whereby their clocks are halted when
the device enters active BDM. Timer modules typically include the freeze feature. Serial interface modules
typically do not include the freeze feature. Hence possible timing relations between CPU code execution
and occurrence of events of peripherals no longer exist.
If the handshake protocol is enabled and BDCCIS is set then stepping over the STOP instruction causes
the Long-ACK pulse to be generated and the BDCCSR STOP flag to be set. When stop mode is exited due
to an interrupt the device enters active BDM and the PC points to the start of the corresponding interrupt
service routine. Stepping can be continued.
Stepping over a WAI instruction, the STEP1 command cannot be finished because active BDM cannot be
entered after CPU starts to execute the WAI instruction.
Stepping over the WAI instruction causes the BDCCSR WAIT and NORESP flags to be set and, if the
handshake protocol is enabled, then the Long-ACK pulse is generated. Then the device enters wait mode,
clears the BDMACT bit and awaits an interrupt to leave wait mode. In this time non-intrusive BDC
commands are possible, although the STEP1 has actually not finished. When an interrupt occurs the device
leaves wait mode, enters active BDM and the PC points to the start of the corresponding interrupt service
routine. A further ACK related to stepping over the WAI is not generated.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
179
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.11
Serial Communication Timeout
The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If
BKGD is kept low for more than 128 target clock cycles, the target understands that a SYNC command
was issued. In this case, the target waits for a rising edge on BKGD in order to answer the SYNC request
pulse. When the BDC detects the rising edge a soft reset is generated, whereby the current BDC command
is discarded. If the rising edge is not detected, the target keeps waiting forever without any timeout limit.
If a falling edge is not detected by the target within 512 clock cycles since the last falling edge, a timeout
occurs and the current command is discarded without affecting memory or the operating mode of the
MCU. This is referred to as a soft-reset. This timeout also applies if 512 cycles elapse between 2
consecutive ERASE_FLASH commands. The soft reset is disabled whilst the internal flash mass erase
operation is pending completion.
timeouts are also possible if a BDC command is partially issued, or data partially retrieved. Thus if a time
greater than 512 BDCSI clock cycles is observed between two consecutive negative edges, a soft-reset
occurs causing the partially received command or data retrieved to be discarded. The next negative edge
at the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDC
command, or the start of a SYNC request pulse.
5.5
5.5.1
Application Information
Clock Frequency Considerations
Read commands without status and without ACK must consider the frequency relationship between
BDCSI and the internal core clock. If the core clock is slow, then the internal access may not have been
carried out within the standard 16 BDCSI cycle delay period (DLY). The host must then extend the DLY
period or clock frequencies accordingly. Taking internal clock domain synchronizers into account, the
minimum number of BDCSI periods required for the DLY is expressed by:
#DLY > 3(f(BDCSI clock) / f(core clock)) + 4
and the minimum core clock frequency with respect to BDCSI clock frequency is expressed by
Minimum f(core clock) = (3/(#DLY cycles -4))f(BDCSI clock)
For the standard 16 period DLY this yields f(core clock)>= (1/4)f(BDCSI clock)
MC9S12ZVM Family Reference Manual Rev. 1.3
180
Freescale Semiconductor
Chapter 6
S12Z Debug (S12ZDBGV2) Module
Table 6-1. Revision History Table
Revision
Number
Revision
Date
2.04
19.APR.2012
2.05
23.MAY.2012
General
2.06
10.SEP.2012
Section 6.4.5.3
2.07
18.OCT.2012
General
2.08
16.NOV.2012
Section 6.5.1
2.09
19.DEC.2012
General
2.10
28.JUN.2013
General
Section 6.3.2.21
Section 6.3.2.1
Section 6.3.2.5
2.11
15.JUL.2013
Section 6.3.2
6.1
Sections
Affected
Description Of Changes
Section 6.4.5.2.1 Documented DBGTB read dependency on PROFILE bit
Formatting changes to support DBGV3 from single source
Added NOTE about PC trace buffer entries for Comp D timestamps
Formatting corrections
Modified step over breakpoint information
Formatting corrections
Emphasized need to set TSOURCE for tracing or profiling
Corrected DBGCDM write access dependency
Corrrected ARM versus PTACT dependency
Modified DBGTBH read access dependencies
Added explicit names to state control register bit fields
Introduction
The DBG module provides on-chip breakpoints and trace buffer with flexible triggering capability to allow
non-intrusive debug of application software. The DBG module is optimized for the S12Z architecture and
allows debugging of CPU module operations.
Typically the DBG module is used in conjunction with the BDC module, whereby the user configures the
DBG module for a debugging session over the BDC interface. Once configured the DBG module is armed
and the device leaves active BDM returning control to the user program, which is then monitored by the
DBG module. Alternatively the DBG module can be configured over a serial interface using SWI routines.
6.1.1
Glossary
Table 6-2. Glossary Of Terms
Term
Definition
COF
Change Of Flow.
Change in the program flow due to a conditional branch, indexed jump or interrupt
PC
Program Counter
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
181
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-2. Glossary Of Terms
Term
Definition
BDM
Background Debug Mode.
In this mode CPU application code execution is halted.
Execution of BDC “active BDM” commands is possible.
BDC
Background Debug Controller
WORD
16-bit data entity
Data Line
64-bit data entity
CPU
S12Z CPU module
Trigger
A trace buffer input that triggers tracing start, end or mid point
6.1.2
Overview
The comparators monitor the bus activity of the CPU. A single comparator match or a series of matches
can trigger bus tracing and/or generate breakpoints. A state sequencer determines if the correct series of
matches occurs. Similarly an external event can trigger bus tracing and/or generate breakpoints.
The trace buffer is visible through a 2-byte window in the register address map and can be read out using
standard 16-bit word reads.
6.1.3
•
•
•
•
Features
Four comparators (A, B, C, and D)
— Comparators A and C compare the full address bus and full 32-bit data bus
— Comparators A and C feature a data bus mask register
— Comparators B and D compare the full address bus only
— Each comparator can be configured to monitor PC addresses or addresses of data accesses
— Each comparator can select either read or write access cycles
— Comparator matches can force state sequencer state transitions
Three comparator modes
— Simple address/data comparator match mode
— Inside address range mode, Addmin ≤ Address ≤ Addmax
— Outside address range match mode, Address < Addmin or Address > Addmax
State sequencer control
— State transitions forced by comparator matches
— State transitions forced by software write to TRIG
— State transitions forced by an external event
The following types of breakpoints
— CPU breakpoint entering active BDM on breakpoint (BDM)
MC9S12ZVM Family Reference Manual Rev. 1.3
182
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
•
•
•
— CPU breakpoint executing SWI on breakpoint (SWI)
Trace control
— Tracing session triggered by state sequencer
— Begin, End, and Mid alignment of tracing to trigger
Four trace modes
— Normal: change of flow (COF) PC information is stored (see Section 6.4.5.2.1) for change of
flow definition.
— Loop1: same as Normal but inhibits consecutive duplicate source address entries
— Detail: address and data for all read/write access cycles are stored
— Pure PC: All program counter addresses are stored.
2 Pin (data and clock) profiling interface
— Output of code flow information
6.1.4
Modes of Operation
The DBG module can be used in all MCU functional modes.
The DBG module can issue breakpoint requests to force the device to enter active BDM or an SWI ISR.
The BDC BACKGROUND command is also handled by the DBG to force the device to enter active BDM.
When the device enters active BDM through a BACKGROUND command with the DBG module armed,
the DBG remains armed.
6.1.5
Block Diagram
B
EXTERNAL EVENT
TRIG
COMPARATOR A
COMPARATOR B
COMPARATOR C
COMPARATOR D
MATCH0
COMPARATOR
MATCH CONTROL
CPU BUS
BUS INTERFACE
REGISTERS
MATCH1
STATE SEQUENCER
AND
EVENT CONTROL
BREAKPOINT
REQUESTS
MATCH2
MATCH3
TRACE
CONTROL
TRIGGER
TRACE BUFFER
PROFILE
OUTPUT
READ TRACE DATA (DBG READ DATA BUS)
Figure 6-1. Debug Module Block Diagram
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
183
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.2
6.2.1
External Signal Description
External Event Input
The DBG module features an external event input signal, DBGEEV. The mapping of this signal to a device
pin is specified in the device specific documentation. This function can be enabled and configured by the
EEVE field in the DBGC1 control register. This signal is input only and allows an external event to force
a state sequencer transition, or trace buffer entry, or to gate trace buffer entries. With the external event
function enabled, a falling edge at the external event pin constitutes an event. Rising edges have no effect.
If configured for gating trace buffer entries, then a low level at the pin allows entries, but a high level
suppresses entries. The maximum frequency of events is half the internal core bus frequency. The function
is explained in the EEVE field description.
NOTE
Due to input pin synchronization circuitry, the DBG module sees external
events 2 bus cycles after they occur at the pin. Thus an external event
occurring less than 2 bus cycles before arming the DBG module is perceived
to occur whilst the DBG is armed.
When the device is in stop mode the synchronizer clocks are disabled and
the external events are ignored.
6.2.2
Profiling Output
The DBG module features a profiling data output signal PDO. The mapping of this signal to a device pin
is specified in the device specific documentation. The device pin is enabled for profiling by setting the
PDOE bit. The profiling function can be enabled by the PROFILE bit in the DBGTCRL control register.
This signal is output only and provides a serial, encoded data stream that can be used by external
development tools to reconstruct the internal CPU code flow, as specified in Section 6.4.6. During code
profiling the device PDOCLK output is used as a clock signal.
6.3
6.3.1
Memory Map and Registers
Module Memory Map
A summary of the registers associated with the DBG module is shown in Figure 6-2. Detailed descriptions
of the registers and bits are given in the subsections that follow.
Address
Name
0x0100
DBGC1
R
W
0x0101
DBGC2
R
W
Bit 7
6
5
4
3
2
ARM
0
TRIG
reserved
BDMBP
BRKCPU
reserved
0
0
0
0
CDCM
1
Bit 0
EEVE
ABCM
Figure 6-2. Quick Reference to DBG Registers
MC9S12ZVM Family Reference Manual Rev. 1.3
184
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Address
Name
Bit 7
6
5
0x0102
DBGTCRH
R
reserved
W
0x0103
DBGTCRL
R
W
0
0
0
0
0x0104
DBGTB
R
W
Bit 15
Bit 14
Bit 13
0x0105
DBGTB
R
W
Bit 7
Bit 6
Bit 5
0x0106
DBGCNT
R
W
0
0x0107
DBGSCR1
R
W
C3SC1
C3SC0
C2SC1
C2SC0
0x0108
DBGSCR2
R
W
C3SC1
C3SC0
C2SC1
0x0109
DBGSCR3
R
W
C3SC1
C3SC0
0x010A
DBGEFR
0x010B
DBGSR
R
W
0x010C0x010F
Reserved
0x0110
TSOURCE
4
3
TRANGE
2
1
TRCMOD
Bit 0
TALIGN
DSTAMP
PDOE
PROFILE
STAMP
Bit 12
Bit 11
Bit 10
Bit 9
Bit 8
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
C1SC1
C1SC0
C0SC1
C0SC0
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
TRIGF
0
EEVF
ME3
ME2
ME1
ME0
TBF
0
0
PTACT
0
SSF2
SSF1
SSF0
R
W
0
0
0
0
0
0
0
0
DBGACTL
R
W
0
NDB
INST
RW
RWE
reserved
COMPE
0x01110x0114
Reserved
R
W
0
0
0
0
0
0
0
0x0115
DBGAAH
R
W
DBGAA[23:16]
0x0116
DBGAAM
R
W
DBGAA[15:8]
0x0117
DBGAAL
R
W
DBGAA[7:0]
0x0118
DBGAD0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x0119
DBGAD1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x011A
DBGAD2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
CNT
R PTBOVF
W
0
0
Figure 6-2. Quick Reference to DBG Registers
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
185
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Address
Name
Bit 7
6
5
4
3
2
1
Bit 0
0x011B
DBGAD3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x011C
DBGADM0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x011D
DBGADM1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x011E
DBGADM2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
0x011F
DBGADM3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x0120
DBGBCTL
R
W
0
0
RW
RWE
reserved
COMPE
0x01210x0124
Reserved
R
W
0
0
0
0
0
0
0x0125
DBGBAH
R
W
DBGBA[23:16]
0x0126
DBGBAM
R
W
DBGBA[15:8]
0x0127
DBGBAL
R
W
DBGBA[7:0]
0x01280x012F
Reserved
R
W
0
0
0
0
0
0x0130
DBGCCTL
R
W
0
RW
RWE
reserved
COMPE
0x01310x0134
Reserved
R
W
0
0
0
0
0
0x0135
DBGCAH
R
W
DBGCA[23:16]
0x0136
DBGCAM
R
W
DBGCA[15:8]
0x0137
DBGCAL
R
W
DBGCA[7:0]
0x0138
DBGCD0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x0139
DBGCD1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x013A
DBGCD2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
INST
0
0
0
NDB
INST
0
0
0
0
0
0
0
Figure 6-2. Quick Reference to DBG Registers
MC9S12ZVM Family Reference Manual Rev. 1.3
186
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Address
Name
Bit 7
6
5
4
3
2
1
Bit 0
0x013B
DBGCD3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x013C
DBGCDM0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x013D
DBGCDM1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x013E
DBGCDM2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
0x013F
DBGCDM3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x0140
DBGDCTL
R
W
0
0
RW
RWE
reserved
COMPE
0x01410x0144
Reserved
R
W
0
0
0
0
0
0
0x0145
DBGDAH
R
W
DBGDA[23:16]
0x0146
DBGDAM
R
W
DBGDA[15:8]
0x0147
DBGDAL
R
W
DBGDA[7:0]
0x01480x017F
Reserved
R
W
0
0
0
0
0
INST
0
0
0
0
0
0
Figure 6-2. Quick Reference to DBG Registers
6.3.2
Register Descriptions
This section consists of the DBG register descriptions in address order. When ARM is set in DBGC1, the
only bits in the DBG module registers that can be written are ARM, and TRIG
6.3.2.1
Debug Control Register 1 (DBGC1)
Address: 0x0100
7
0x0100
Reset
ARM
0
6
0
TRIG
0
5
4
3
2
reserved
BDMBP
BRKCPU
reserved
0
0
0
0
1
0
EEVE
0
0
Figure 6-3. Debug Control Register (DBGC1)
Read: Anytime
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
187
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Write: Bit 7 Anytime with the exception that it cannot be set if PTACT is set. An ongoing profiling session
must be finished before DBG can be armed again.
Bit 6 can be written anytime but always reads back as 0.
Bits 5:0 anytime DBG is not armed and PTACT is clear.
NOTE
On a write access to DBGC1 and simultaneous hardware disarm from an
internal event, the hardware disarm has highest priority, clearing the ARM
bit and generating a breakpoint, if enabled.
NOTE
When disarming the DBG by clearing ARM with software, the contents of
bits[5:0] are not affected by the write, since up until the write operation,
ARM = 1 preventing these bits from being written. These bits must be
cleared using a second write if required.
Table 6-3. DBGC1 Field Descriptions
Field
Description
7
ARM
Arm Bit — The ARM bit controls whether the DBG module is armed. This bit can be set and cleared by register
writes and is automatically cleared when the state sequencer returns to State0 on completing a debugging
session. On setting this bit the state sequencer enters State1.
0 Debugger disarmed. No breakpoint is generated when clearing this bit by software register writes.
1 Debugger armed
6
TRIG
Immediate Trigger Request Bit — This bit when written to 1 requests an immediate transition to final state
independent of comparator status. This bit always reads back a 0. Writing a 0 to this bit has no effect.
0 No effect.
1 Force state sequencer immediately to final state.
4
BDMBP
Background Debug Mode Enable — This bit determines if a CPU breakpoint causes the system to enter
Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDC is not enabled,
then no breakpoints are generated.
0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint.
1 Breakpoint to BDM, if BDC enabled. Otherwise no breakpoint.
3
BRKCPU
CPU Breakpoint Enable — The BRKCPU bit controls whether the debugger requests a breakpoint to CPU upon
transitions to State0. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If
tracing is not enabled, the breakpoint is generated immediately. Please refer to Section 6.4.7 for further details.
0 Breakpoints disabled
1 Breakpoints enabled
1–0
EEVE
External Event Enable — The EEVE bits configure the external event function. Table 6-4 explains the bit
encoding.
Table 6-4. EEVE Bit Encoding
EEVE
Description
00
External event function disabled
01
External event forces a trace buffer entry if tracing is enabled
10
External event is mapped to the state sequencer, replacing comparator channel 3
11
External event pin gates trace buffer entries
MC9S12ZVM Family Reference Manual Rev. 1.3
188
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.2
Debug Control Register2 (DBGC2)
Address: 0x0101
R
7
6
5
4
0
0
0
0
0
0
0
3
0
1
CDCM
W
Reset
2
0
0
ABCM
0
0
0
= Unimplemented or Reserved
Figure 6-4. Debug Control Register2 (DBGC2)
Read: Anytime.
Write: Anytime the module is disarmed and PTACT is clear.
This register configures the comparators for range matching.
Table 6-5. DBGC2 Field Descriptions
Field
Description
3–2
CDCM[1:0]
C and D Comparator Match Control — These bits determine the C and D comparator match mapping as
described in Table 6-6.
1–0
ABCM[1:0]
A and B Comparator Match Control — These bits determine the A and B comparator match mapping as
described in Table 6-7.
Table 6-6. CDCM Encoding
CDCM
Description
00
Match2 mapped to comparator C match....... Match3 mapped to comparator D match.
01
Match2 mapped to comparator C/D inside range....... Match3 disabled.
10
Match2 mapped to comparator C/D outside range....... Match3 disabled.
11
Reserved(1)
1. Currently defaults to Match2 mapped to inside range: Match3 disabled.
Table 6-7. ABCM Encoding
ABCM
Description
00
Match0 mapped to comparator A match....... Match1 mapped to comparator B match.
01
Match0 mapped to comparator A/B inside range....... Match1 disabled.
10
Match0 mapped to comparator A/B outside range....... Match1 disabled.
11
Reserved(1)
1. Currently defaults to Match0 mapped to inside range: Match1 disabled
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
189
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.3
Debug Trace Control Register High (DBGTCRH)
Address: 0x0102
R
W
Reset
7
6
5
reserved
TSOURCE
0
0
4
3
TRANGE
0
2
1
TRCMOD
0
0
0
TALIGN
0
0
0
Figure 6-5. Debug Trace Control Register (DBGTCRH)
Read: Anytime.
Write: Anytime the module is disarmed and PTACT is clear.
WARNING
DBGTCR[7] is reserved. Setting this bit maps the tracing to an unimplemented bus, thus
preventing proper operation.
This register configures the trace buffer for tracing and profiling.
Table 6-8. DBGTCRH Field Descriptions
Field
6
TSOURCE
Description
Trace Control Bits — The TSOURCE enables the tracing session.
0 No CPU tracing/profiling selected
1 CPU tracing/profiling selected
5–4
TRANGE
Trace Range Bits — The TRANGE bits allow filtering of trace information from a selected address range when
tracing from the CPU in Detail mode. These bits have no effect in other tracing modes. To use a comparator for
range filtering, the corresponding COMPE bit must remain cleared. If the COMPE bit is set then the comparator
is used to generate events and the TRANGE bits have no effect. See Table 6-9 for range boundary definition.
3–2
TRCMOD
Trace Mode Bits — See Section 6.4.5.2 for detailed Trace Mode descriptions. In Normal Mode, change of flow
information is stored. In Loop1 Mode, change of flow information is stored but redundant entries into trace
memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. See
Table 6-10.
1–0
TALIGN
Trigger Align Bits — These bits control whether the trigger is aligned to the beginning, end or the middle of a
tracing or profiling session. See Table 6-11.
Table 6-9. TRANGE Trace Range Encoding
TRANGE
Tracing Range
00
Trace from all addresses (No filter)
01
Trace only in address range from $00000 to Comparator D
10
Trace only in address range from Comparator C to $FFFFFF
11
Trace only in range from Comparator C to Comparator D
Table 6-10. TRCMOD Trace Mode Bit Encoding
TRCMOD
Description
00
Normal
MC9S12ZVM Family Reference Manual Rev. 1.3
190
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-10. TRCMOD Trace Mode Bit Encoding
TRCMOD
Description
01
Loop1
10
Detail
11
Pure PC
Table 6-11. TALIGN Trace Alignment Encoding
TALIGN
Description
00
Trigger ends data trace
01
Trigger starts data trace
10
32 lines of data trace follow trigger
11(1)
Reserved
1. Tracing/Profiling disabled.
6.3.2.4
Debug Trace Control Register Low (DBGTCRL)
Address: 0x0103
R
7
6
5
4
0
0
0
0
0
0
0
0
W
Reset
3
2
1
0
DSTAMP
PDOE
PROFILE
STAMP
0
0
0
0
= Unimplemented or Reserved
Figure 6-6. Debug Trace Control Register Low (DBGTCRL)
Read: Anytime.
Write: Anytime the module is disarmed and PTACT is clear.
This register configures the profiling and timestamp features
Table 6-12. DBGTCRL Field Descriptions
Field
3
DSTAMP
2
PDOE
1
PROFILE
Description
Comparator D Timestamp Enable — This bit, when set, enables Comparator D matches to generate
timestamps in Detail, Normal and Loop1 trace modes.
0 Comparator D match does not generate timestamp
1 Comparator D match generates timestamp if timestamp function is enabled
Profile Data Out Enable — This bit, when set, configures the device profiling pins for profiling.
0 Device pins not configured for profiling
1 Device pins configured for profiling
Profile Enable — This bit, when set, enables the profile function, whereby a subsequent arming of the DBG
activates profiling.
When PROFILE is set, the TRCMOD bits are ignored.
0 Profile function disabled
1 Profile function enabled
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
191
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-12. DBGTCRL Field Descriptions (continued)
Field
Description
0
STAMP
Timestamp Enable — This bit, when set, enables the timestamp function. The timestamp function adds a
timestamp to each trace buffer entry in Detail, Normal and Loop1 trace modes.
0 Timestamp function disabled
1 Timestamp function enabled
6.3.2.5
Debug Trace Buffer Register (DBGTB)
Address: 0x0104, 0x0105
15
R
W
14
13
12
11
10
9
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
POR
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
Other
Resets
—
—
—
—
—
—
—
—
—
—
—
—
—
—
—
—
Figure 6-7. Debug Trace Buffer Register (DBGTB)
Read: Only when unlocked AND not armed and the TSOURCE bit is set, otherwise an error code (0xEE)
is returned. Only aligned word read operations are supported. Misaligned word reads or byte reads return
the error code 0xEE for each byte. The PROFILE bit must be clear to read profiling data,
Write: Aligned word writes when the DBG is disarmed and both PTACT and PROFILE are clear unlock
the trace buffer for reading but do not affect trace buffer contents.
Table 6-13. DBGTB Field Descriptions
Field
Description
15–0
Bit[15:0]
Trace Buffer Data Bits — The Trace Buffer Register is a window through which the lines of the trace buffer may
be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to
the next address to be read. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The
trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module
is disarmed. The DBGTB register can be read only as an aligned word. Byte reads or misaligned access of these
registers returns 0xEE and does not increment the trace buffer pointer. Similarly word reads while the debugger
is armed or trace buffer is locked return 0xEEEE. The POR state is undefined Other resets do not affect the trace
buffer contents.
6.3.2.6
Debug Count Register (DBGCNT)
Address: 0x0106
7
R
6
5
4
0
3
2
1
0
—
0
—
0
—
0
CNT
W
Reset
POR
0
0
—
0
—
0
—
0
—
0
= Unimplemented or Reserved
Figure 6-8. Debug Count Register (DBGCNT)
MC9S12ZVM Family Reference Manual Rev. 1.3
192
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Read: Anytime.
Write: Never.
Table 6-14. DBGCNT Field Descriptions
Field
Description
6–0
CNT[6:0]
Count Value — The CNT bits [6:0] indicate the number of valid data lines stored in the trace buffer. Table 6-15
shows the correlation between the CNT bits and the number of valid data lines in the trace buffer. When the CNT
rolls over to zero, the TBF bit in DBGSR is set. Thereafter incrementing of CNT continues if configured for endalignment or mid-alignment.
The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by
power-on-reset initialization but is not cleared by other system resets. If a reset occurs during a debug session,
the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset
occurred. The DBGCNT register is not decremented when reading from the trace buffer.
Table 6-15. CNT Decoding Table
6.3.2.7
TBF (DBGSR)
CNT[6:0]
Description
0
0000000
No data valid
0
0000001
32 bits of one line valid
0
0000010
0000100
0000110
..
1111100
1 line valid
2 lines valid
3 lines valid
..
62 lines valid
0
1111110
63 lines valid
1
0000000
64 lines valid; if using Begin trigger alignment,
ARM bit is cleared and the tracing session ends.
1
0000010
..
1111110
64 lines valid,
oldest data has been overwritten by most recent data
Debug State Control Register 1 (DBGSCR1)
Address: 0x0107
R
W
Reset
7
6
5
4
3
2
1
0
C3SC1
C3SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
0
0
0
0
0
0
0
0
Figure 6-9. Debug State Control Register 1 (DBGSCR1)
Read: Anytime.
Write: If DBG is not armed and PTACT is clear.
The state control register 1 selects the targeted next state whilst in State1. The matches refer to the outputs
of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.12”.
Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control
register.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
193
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-16. DBGSCR1 Field Descriptions
Field
Description
1–0
C0SC[1:0]
Channel 0 State Control.
These bits select the targeted next state whilst in State1 following a match0.
3–2
C1SC[1:0]
Channel 1 State Control.
These bits select the targeted next state whilst in State1 following a match1.
5–4
C2SC[1:0]
Channel 2 State Control.
These bits select the targeted next state whilst in State1 following a match2.
7–6
C3SC[1:0]
Channel 3 State Control.
If EEVE !=10, these bits select the targeted next state whilst in State1 following a match3.
If EEVE = 10, these bits select the targeted next state whilst in State1 following an external event.
Table 6-17. State1 Match State Sequencer Transitions
CxSC[1:0]
Function
00
Match has no effect
01
Match forces sequencer to State2
10
Match forces sequencer to State3
11
Match forces sequencer to Final State
In the case of simultaneous matches, the match on the higher channel number (3...0) has priority.
6.3.2.8
Debug State Control Register 2 (DBGSCR2)
Address: 0x0108
R
W
Reset
7
6
5
4
3
2
1
0
C3SC1
C3SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
0
0
0
0
0
0
0
0
Figure 6-10. Debug State Control Register 2 (DBGSCR2)
Read: Anytime.
Write: If DBG is not armed and PTACT is clear.
The state control register 2 selects the targeted next state whilst in State2. The matches refer to the outputs
of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.12”.
Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control
register.
Table 6-18. DBGSCR2 Field Descriptions
Field
Description
1–0
C0SC[1:0]
Channel 0 State Control.
These bits select the targeted next state whilst in State2 following a match0.
3–2
C1SC[1:0]
Channel 1 State Control.
These bits select the targeted next state whilst in State2 following a match1.
MC9S12ZVM Family Reference Manual Rev. 1.3
194
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-18. DBGSCR2 Field Descriptions (continued)
Field
Description
5–4
C2SC[1:0]
Channel 2 State Control.
These bits select the targeted next state whilst in State2 following a match2.
7–6
C3SC[1:0]
Channel 3 State Control.
If EEVE !=10, these bits select the targeted next state whilst in State2 following a match3.
If EEVE =10, these bits select the targeted next state whilst in State2 following an external event.
Table 6-19. State2 Match State Sequencer Transitions
CxSC[1:0]
Function
00
Match has no effect
01
Match forces sequencer to State1
10
Match forces sequencer to State3
11
Match forces sequencer to Final State
In the case of simultaneous matches, the match on the higher channel number (3...0) has priority.
6.3.2.9
Debug State Control Register 3 (DBGSCR3)
Address: 0x0109
R
W
Reset
7
6
5
4
3
2
1
0
C3SC1
C3SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
0
0
0
0
0
0
0
0
Figure 6-11. Debug State Control Register 3 (DBGSCR3)
Read: Anytime.
Write: If DBG is not armed and PTACT is clear.
The state control register three selects the targeted next state whilst in State3. The matches refer to the
outputs of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.12”.
Comparators must be enabled by setting the comparator enable bit in the associated DBGxCTL control
register.
Table 6-20. DBGSCR3 Field Descriptions
Field
Description
1–0
C0SC[1:0]
Channel 0 State Control.
These bits select the targeted next state whilst in State3 following a match0.
3–2
C1SC[1:0]
Channel 1 State Control.
These bits select the targeted next state whilst in State3 following a match1.
5–4
C2SC[1:0]
Channel 2 State Control.
These bits select the targeted next state whilst in State3 following a match2.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
195
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-20. DBGSCR3 Field Descriptions (continued)
Field
7–6
C3SC[1:0]
Description
Channel 3 State Control.
If EEVE !=10, these bits select the targeted next state whilst in State3 following a match3.
If EEVE =10, these bits select the targeted next state whilst in State3 following an external event.
Table 6-21. State3 Match State Sequencer Transitions
CxSC[1:0]
Function
00
Match has no effect
01
Match forces sequencer to State1
10
Match forces sequencer to State2
11
Match forces sequencer to Final State
In the case of simultaneous matches, the match on the higher channel number (3....0) has priority.
6.3.2.10
Debug Event Flag Register (DBGEFR)
Address: 0x010A
R
7
6
5
4
3
2
1
0
PTBOVF
TRIGF
0
EEVF
ME3
ME2
ME1
ME0
0
0
0
0
0
0
0
W
Reset
0
= Unimplemented or Reserved
Figure 6-12. Debug Event Flag Register (DBGEFR)
Read: Anytime.
Write: Never
DBGEFR contains flag bits each mapped to events whilst armed. Should an event occur, then the
corresponding flag is set. With the exception of TRIGF, the bits can only be set when the ARM bit is set.
The TRIGF bit is set if a TRIG event occurs when ARM is already set, or if the TRIG event occurs
simultaneous to setting the ARM bit.All other flags can only be cleared by arming the DBG module. Thus
the contents are retained after a debug session for evaluation purposes.
A set flag does not inhibit the setting of other flags.
Table 6-22. DBGEFR Field Descriptions
Field
7
PTBOVF
6
TRIGF
Description
Profiling Trace Buffer Overflow Flag — Indicates the occurrence of a trace buffer overflow event during a
profiling session.
0 No trace buffer overflow event
1 Trace buffer overflow event
TRIG Flag — Indicates the occurrence of a TRIG event during the debug session.
0 No TRIG event
1 TRIG event
MC9S12ZVM Family Reference Manual Rev. 1.3
196
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-22. DBGEFR Field Descriptions
Field
4
EEVF
3–0
ME[3:0]
6.3.2.11
Description
External Event Flag — Indicates the occurrence of an external event during the debug session.
0 No external event
1 External event
Match Event[3:0]— Indicates a comparator match event on the corresponding comparator channel.
Debug Status Register (DBGSR)
Address: 0x010B
R
7
6
5
4
3
2
1
0
TBF
0
0
PTACT
0
SSF2
SSF1
SSF0
—
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
Reset
POR
= Unimplemented or Reserved
Figure 6-13. Debug Status Register (DBGSR)
Read: Anytime.
Write: Never.
Table 6-23. DBGSR Field Descriptions
Field
Description
7
TBF
Trace Buffer Full — The TBF bit indicates that the trace buffer has been filled with data since it was last armed.
If this bit is set, then all trace buffer lines contain valid data, regardless of the value of DBGCNT bits CNT[6:0].
The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset
initialization. Other system generated resets have no affect on this bit
4
PTACT
Profiling Transmission Active — The PTACT bit, when set, indicates that the profiling transmission is still
active. When clear, PTACT then profiling transmission is not active. The PTACT bit is set when profiling begins
with the first PTS format entry to the trace buffer. The PTACT bit is cleared when the profiling transmission ends.
2–0
SSF[2:0]
State Sequencer Flag Bits — The SSF bits indicate the current State Sequencer state. During a debug session
on each transition to a new state these bits are updated. If the debug session is ended by software clearing the
ARM bit, then these bits retain their value to reflect the last state of the state sequencer before disarming. If a
debug session is ended by an internal event, then the state sequencer returns to State0 and these bits are
cleared to indicate that State0 was entered during the session. On arming the module the state sequencer enters
State1 and these bits are forced to SSF[2:0] = 001. See Table 6-24.
Table 6-24. SSF[2:0] — State Sequence Flag Bit Encoding
SSF[2:0]
Current State
000
State0 (disarmed)
001
State1
010
State2
011
State3
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
197
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-24. SSF[2:0] — State Sequence Flag Bit Encoding
6.3.2.12
SSF[2:0]
Current State
100
Final State
101,110,111
Reserved
Debug Comparator A Control Register (DBGACTL)
Address: 0x0110
7
R
6
0
W
Reset
0
5
NDB
INST
0
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-14. Debug Comparator A Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-25. DBGACTL Field Descriptions
Field
Description
6
NDB
Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator
register value or when the data bus differs from the register value. This bit is ignored if the INST bit in the
same register is set.
0 Match on data bus equivalence to comparator register contents
1 Match on data bus difference to comparator register contents
5
INST
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
3
RW
2
RWE
0
COMPE
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is ignored when INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
Table 6-26 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if INST
is set, because matches based on opcodes reaching the execution stage are data independent.
MC9S12ZVM Family Reference Manual Rev. 1.3
198
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-26. Read or Write Comparison Logic Table
6.3.2.13
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
1
1
1
Read match
Debug Comparator A Address Register (DBGAAH, DBGAAM, DBGAAL)
Address: 0x0115, DBGAAH
23
22
21
R
19
18
17
16
DBGAA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0116, DBGAAM
15
R
DBGAA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0117, DBGAAL
7
R
DBGAA[7:0]
W
Reset
0
0
0
0
Figure 6-15. Debug Comparator A Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-27. DBGAAH, DBGAAM, DBGAAL Field Descriptions
Field
Description
23–16
DBGAA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
15–0
DBGAA
[15:0]
Comparator Address Bits [15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
199
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.14
Debug Comparator A Data Register (DBGAD)
Address: 0x0118, 0x0119, 0x011A, 0x011B
31
R
W
W
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
Reset
R
30
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
Reset
0
0
0
0
0
0
0
Figure 6-16. Debug Comparator A Data Register (DBGAD)
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGAD0, DBGAD1, DBGAD2, DBGAD3
map to DBGAD[31:0] respectively.
Table 6-28. DBGAD Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGAD0,
DBGAD1)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
15–0
Bits[15:0]
(DBGAD2,
DBGAD3)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
6.3.2.15
Debug Comparator A Data Mask Register (DBGADM)
Address: 0x011C, 0x011D, 0x011E, 0x011F
31
R
W
Reset
R
W
Reset
30
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
0
0
0
0
0
0
0
Figure 6-17. Debug Comparator A Data Mask Register (DBGADM)
Read: Anytime.
MC9S12ZVM Family Reference Manual Rev. 1.3
200
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGADM0, DBGADM1, DBGADM2,
DBGADM3 map to DBGADM[31:0] respectively.
Table 6-29. DBGADM Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGADM0,
DBGADM1)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
15-0
Bits[15:0]
(DBGADM2,
DBGADM3)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
6.3.2.16
Debug Comparator B Control Register (DBGBCTL)
Address: 0x0120
R
7
6
0
0
0
0
W
Reset
5
INST
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-18. Debug Comparator B Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-30. DBGBCTL Field Descriptions
Field(1)
5
INST
3
RW
2
RWE
0
COMPE
Description
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is ignored when INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
1. If the ABCM field selects range mode comparisons, then DBGACTL bits configure the comparison, DBGBCTL is ignored.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
201
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-31 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if INST
is set, as matches based on instructions reaching the execution stage are data independent.
Table 6-31. Read or Write Comparison Logic Table
6.3.2.17
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
1
1
1
Read match
Debug Comparator B Address Register (DBGBAH, DBGBAM, DBGBAL)
Address: 0x0125, DBGBAH
23
22
21
R
19
18
17
16
DBGBA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0126, DBGBAM
15
R
DBGBA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0127, DBGBAL
7
R
DBGBA[7:0]
W
Reset
0
0
0
0
Figure 6-19. Debug Comparator B Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-32. DBGBAH, DBGBAM, DBGBAL Field Descriptions
Field
Description
23–16
DBGBA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
15–0
DBGBA
[15:0]
Comparator Address Bits[15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.3
202
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.18
Debug Comparator C Control Register (DBGCCTL)
Address: 0x0130
7
R
0
W
Reset
6
5
NDB
INST
0
0
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-20. Debug Comparator C Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-33. DBGCCTL Field Descriptions
Field
Description
6
NDB
Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator
register value or when the data bus differs from the register value. This bit is ignored if the INST bit in the
same register is set.
0 Match on data bus equivalence to comparator register contents
1 Match on data bus difference to comparator register contents
5
INST
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
3
RW
2
RWE
0
COMPE
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is not used if INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
Table 6-34 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if INST
is set, because matches based on opcodes reaching the execution stage are data independent.
Table 6-34. Read or Write Comparison Logic Table
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
203
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-34. Read or Write Comparison Logic Table
6.3.2.19
RWE Bit
RW Bit
RW Signal
Comment
1
1
1
Read match
Debug Comparator C Address Register (DBGCAH, DBGCAM, DBGCAL)
Address: 0x0135, DBGCAH
23
22
21
R
19
18
17
16
DBGCA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0136, DBGCAM
15
R
DBGCA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0137, DBGCAL
7
R
DBGCA[7:0]
W
Reset
0
0
0
0
Figure 6-21. Debug Comparator C Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-35. DBGCAH, DBGCAM, DBGCAL Field Descriptions
Field
Description
23–16
DBGCA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
15–0
DBGCA
[15:0]
Comparator Address Bits[15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.3
204
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.20
Debug Comparator C Data Register (DBGCD)
Address: 0x0138, 0x0139, 0x013A, 0x013B
31
R
W
W
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
Reset
R
30
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
Reset
0
0
0
0
0
0
0
Figure 6-22. Debug Comparator C Data Register (DBGCD)
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGCD0, DBGCD1, DBGCD2, DBGCD3
map to DBGCD[31:0] respectively.
XGATE data accesses have a maximum width of 16-bits and are mapped to DBGCD[15:0].
Table 6-36. DBGCD Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGCD0,
DBGCD1)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
15–0
Bits[15:0]
(DBGCD2,
DBGCD3)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
6.3.2.21
Debug Comparator C Data Mask Register (DBGCDM)
Address: 0x013C, 0x013D, 0x013E, 0x013F
31
R
W
Reset
R
W
Reset
30
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
0
0
0
0
0
0
0
Figure 6-23. Debug Comparator C Data Mask Register (DBGCDM)
Read: Anytime.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
205
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGCDM0, DBGCDM1, DBGCDM2,
DBGCDM3 map to DBGCDM[31:0] respectively.
XGATE data accesses have a maximum width of 16-bits and are mapped to DBGCDM[15:0].
Table 6-37. DBGCDM Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGCDM0,
DBGCDM1)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
15–0
Bits[15:0]
(DBGCDM2,
DBGCDM3)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
6.3.2.22
Debug Comparator D Control Register (DBGDCTL)
Address: 0x0140
R
7
6
0
0
0
0
W
Reset
5
INST
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-24. Debug Comparator D Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-38. DBGDCTL Field Descriptions
Field(1)
5
INST
3
RW
2
RWE
0
COMPE
Description
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is ignored if INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
MC9S12ZVM Family Reference Manual Rev. 1.3
206
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
1. If the CDCM field selects range mode comparisons, then DBGCCTL bits configure the comparison, DBGDCTL is ignored.
Table 6-39 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if INST
is set, because matches based on opcodes reaching the execution stage are data independent.
Table 6-39. Read or Write Comparison Logic Table
6.3.2.23
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
1
1
1
Read match
Debug Comparator D Address Register (DBGDAH, DBGDAM, DBGDAL)
Address: 0x0145, DBGDAH
23
22
21
R
19
18
17
16
DBGDA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0146, DBGDAM
15
R
DBGDA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0147, DBGDAL
7
R
DBGDA[7:0]
W
Reset
0
0
0
0
Figure 6-25. Debug Comparator D Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-40. DBGDAH, DBGDAM, DBGDAL Field Descriptions
Field
Description
23–16
DBGDA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
207
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-40. DBGDAH, DBGDAM, DBGDAL Field Descriptions
Field
Description
15–0
DBGDA
[15:0]
Comparator Address Bits[15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
6.4
Functional Description
This section provides a complete functional description of the DBG module.
6.4.1
DBG Operation
The DBG module operation is enabled by setting ARM in DBGC1. When armed it supports storing of data
in the trace buffer and can be used to generate breakpoints to the CPU. The DBG module is made up of
comparators, control logic, the trace buffer, and the state sequencer, Figure 6-1.
The comparators monitor the bus activity of the CPU. Comparators can be configured to monitor opcode
addresses (effectively the PC address) or data accesses. Comparators can be configured during data
accesses to mask out individual data bus bits and to use R/W access qualification in the comparison.
Comparators can be configured to monitor a range of addresses.
When configured for data access comparisons, the match is generated if the address (and optionally data)
of a data access matches the comparator value.
Configured for monitoring opcode addresses, the match is generated when the associated opcode reaches
the execution stage of the instruction queue, but before execution of that opcode.
When a match with a comparator register value occurs, the associated control logic can force the state
sequencer to another state (see Figure 6-26).
The state sequencer can transition freely between the states 1, 2 and 3. On transition to Final State bus
tracing can be triggered. On completion of tracing the state sequencer enters State0. If tracing is disabled
or End aligned tracing is enabled then the state sequencer transitions immediately from Final State to
State0. The transition to State0 generates breakpoints if breakpoints are enabled.
Independent of the comparators, state sequencer transitions can be forced by the external event input or by
writing to the TRIG bit in the DBGC1 control register.
The trace buffer is visible through a 2-byte window in the register address map and can be read out using
standard 16-bit word reads.
6.4.2
Comparator Modes
The DBG contains four comparators, A, B, C, and D. Each comparator compares the address stored in
DBGXAH, DBGXAM, and DBGXAL with the PC (opcode addresses) or selected address bus (data
MC9S12ZVM Family Reference Manual Rev. 1.3
208
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
accesses). Furthermore, comparators A and C can compare the data buses to values stored in DBGXD3-0
and allow data bit masking.
The comparators can monitor the buses for an exact address or an address range. The comparator
configuration is controlled by the control register contents and the range control by the DBGC2 contents.
The comparator control register also allows the type of data access to be included in the comparison
through the use of the RWE and RW bits. The RWE bit controls whether the access type is compared for
the associated comparator and the RW bit selects either a read or write access for a valid match.
The INST bit in each comparator control register is used to determine the matching condition. By setting
INST, the comparator matches opcode addresses, whereby the databus, data mask, RW and RWE bits are
ignored. The comparator register must be loaded with the exact opcode address.
The comparator can be configured to match memory access addresses by clearing the INST bit.
Each comparator match can force a transition to another state sequencer state (see Section 6.4.3”).
Once a successful comparator match has occurred, the condition that caused the original match is not
verified again on subsequent matches. Thus if a particular data value is matched at a given address, this
address may not contain that data value when a subsequent match occurs.
Comparators C and D can also be used to select an address range to trace from, when tracing CPU accesses
in Detail mode. This is determined by the TRANGE bits in the DBGTCRH register. The TRANGE
encoding is shown in Table 6-9. If the TRANGE bits select a range definition using comparator D and the
COMPE bit is clear, then comparator D is configured for trace range definition. By setting the COMPE bit
the comparator is configured for address bus comparisons, the TRANGE bits are ignored and the tracing
range function is disabled. Similarly if the TRANGE bits select a range definition using comparator C and
the COMPE bit is clear, then comparator C is configured for trace range definition.
Match[0, 1, 2, 3] map directly to Comparators [A, B, C, D] respectively, except in range modes (see
Section 6.3.2.2”). Comparator priority rules are described in the event priority section (Section 6.4.3.5”).
6.4.2.1
Exact Address Comparator Match
With range comparisons disabled, the match condition is an exact equivalence of address bus with the
value stored in the comparator address registers. Qualification of the type of access (R/W) is also possible.
Code may contain various access forms of the same address, for example a 16-bit access of ADDR[n] or
byte access of ADDR[n+1] both access n+1. The comparators ensure that any access of the address defined
by the comparator address register generates a match, as shown in the example of Table 6-41. Thus if the
comparator address register contains ADDR[n+1] any access of ADDR[n+1] matches. This means that a
16-bit access of ADDR[n] or 32-bit access of ADDR[n-1] also match because they also access
ADDR[n+1]. The right hand columns show the contents of DBGxA that would match for each access.
Table 6-41. Comparator Address Bus Matches
Access
Address
ADDR[n]
ADDR[n+1]
ADDR[n+2]
ADDR[n+3]
32-bit
ADDR[n]
Match
Match
Match
Match
16-bit
ADDR[n]
Match
Match
No Match
No Match
16-bit
ADDR[n+1]
No Match
Match
Match
No Match
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
209
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-41. Comparator Address Bus Matches
Access
Address
ADDR[n]
ADDR[n+1]
ADDR[n+2]
ADDR[n+3]
8-bit
ADDR[n]
Match
No Match
No Match
No Match
If the comparator INST bit is set, the comparator address register contents are compared with the PC, the
data register contents and access type bits are ignored. The comparator address register must be loaded
with the address of the first opcode byte.
6.4.2.2
Address and Data Comparator Match
Comparators A and C feature data comparators, for data access comparisons. The comparators do not
evaluate if accessed data is valid. Accesses across aligned 32-bit boundaries are split internally into
consecutive accesses. The data comparator mapping to accessed addresses for the CPU is shown in
Table 6-42, whereby the Address column refers to the lowest 2 bits of the lowest accessed address. This
corresponds to the most significant data byte.
Table 6-42. Comparator Data Byte Alignment
Address[1:0]
Data Comparator
00
DBGxD0
01
DBGxD1
10
DBGxD2
11
DBGxD3
The fixed mapping of data comparator bytes to addresses within a 32-bit data field ensures data matches
independent of access size. To compare a single data byte within the 32-bit field, the other bytes within
that field must be masked using the corresponding data mask registers. This ensures that any access of that
byte (32-bit,16-bit or 8-bit) with matching data causes a match. If no bytes are masked then the data
comparator always compares all 32-bits and can only generate a match on a 32-bit access with correct 32bit data value. In this case, 8-bit or 16-bit accesses within the 32-bit field cannot generate a match even if
the contents of the addressed bytes match because all 32-bits must match. In Table 6-43 the Access
Address column refers to the address bits[1:0] of the lowest accessed address (most significant data byte).
Table 6-43. Data Register Use Dependency On CPU Access Type
Memory Address[2:0]
Case
Access
Address
Access
Size
000
001
010
011
1
00
32-bit
DBGxD0
DBGxD1
DBGxD2
DBGxD3
2
01
32-bit
DBGxD1
DBGxD2
DBGxD3
3
10
32-bit
4
11
32-bit
5
00
16-bit
6
01
16-bit
7
10
16-bit
DBGxD2
DBGxD0
100
101
110
DBGxD0
DBGxD3
DBGxD0
DBGxD1
DBGxD3
DBGxD0
DBGxD1
DBGxD2
DBGxD1
DBGxD1
DBGxD2
DBGxD2
DBGxD3
MC9S12ZVM Family Reference Manual Rev. 1.3
210
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Memory Address[2:0]
Case
Access
Address
Access
Size
8
11
16-bit
9
00
8-bit
10
01
8-bit
11
10
8-bit
12
11
8-bit
13
00
8-bit
000
001
010
011
100
DBGxD3
DBGxD0
101
110
DBGxD0
DBGxD1
DBGxD2
DBGxD3
DBGxD0
Denotes byte that is not accessed.
For a match of a 32-bit access with data compare, the address comparator must be loaded with the address
of the lowest accessed byte. For Case1 Table 6-43 this corresponds to 000, for Case2 it corresponds to 001.
To compare all 32-bits, it is required that no bits are masked.
6.4.2.3
Data Bus Comparison NDB Dependency
The NDB control bit allows data bus comparators to be configured to either match on equivalence or on
difference. This allows monitoring of a difference in the contents of an address location from an expected
value.
When matching on an equivalence (NDB=0), each individual data bus bit position can be masked out by
clearing the corresponding mask bit, so that it is ignored in the comparison. A match occurs when all data
bus bits with corresponding mask bits set are equivalent. If all mask register bits are clear, then a match is
based on the address bus only, the data bus is ignored.
When matching on a difference, mask bits can be cleared to ignore bit positions. A match occurs when any
data bus bit with corresponding mask bit set is different. Clearing all mask bits, causes all bits to be ignored
and prevents a match because no difference can be detected. In this case address bus equivalence does not
cause a match. Bytes that are not accessed are ignored. Thus when monitoring a multi byte field for a
difference, partial accesses of the field only return a match if a difference is detected in the accessed bytes.
Table 6-44. NDB and MASK bit dependency
6.4.2.4
NDB
DBGADM
Comment
0
0
Do not compare data bus bit.
0
1
Compare data bus bit. Match on equivalence.
1
0
Do not compare data bus bit.
1
1
Compare data bus bit. Match on difference.
Range Comparisons
Range comparisons are accurate to byte boundaries. Thus for data access comparisons a match occurs if
at least one byte of the access is in the range (inside range) or outside the range (outside range). For opcode
comparisons only the address of the first opcode byte is compared with the range.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
211
Chapter 6 S12Z Debug (S12ZDBGV2) Module
When using the AB comparator pair for a range comparison, the data bus can be used for qualification by
using the comparator A data and data mask registers. Similarly when using the CD comparator pair for a
range comparison, the data bus can be used for qualification by using the comparator C data and data mask
registers. The DBGACTL/DBGCCTL RW and RWE bits can be used to qualify the range comparison on
either a read or a write access. The corresponding DBGBCTL/DBGDCTL bits are ignored. The
DBGACTL/DBGCCTL COMPE/INST bits are used for range comparisons. The DBGBCTL/DBGDCTL
COMPE/INST bits are ignored in range modes.
6.4.2.4.1
Inside Range (CompAC_Addr ≤ address ≤ CompBD_Addr)
In the Inside Range comparator mode, either comparator pair A and B or comparator pair C and D can be
configured for range comparisons by the control register (DBGC2). The match condition requires a
simultaneous valid match for both comparators. A match condition on only one comparator is not valid.
6.4.2.4.2
Outside Range (address < CompAC_Addr or address > CompBD_Addr)
In the Outside Range comparator mode, either comparator pair A and B or comparator pair C and D can
be configured for range comparisons. A single match condition on either of the comparators is recognized
as valid. Outside range mode in combination with opcode address matches can be used to detect if opcodes
are from an unexpected range.
NOTE
When configured for data access matches, an outside range match would
typically occur at any interrupt vector fetch or register access. This can be
avoided by setting the upper or lower range limit to $FFFFFF or $000000
respectively. Interrupt vector fetches do not cause opcode address matches.
6.4.3
Events
Events are used as qualifiers for a state sequencer change of state. The state control register for the current
state determines the next state for each event. An event can immediately initiate a transition to the next
state sequencer state whereby the corresponding flag in DBGSR is set.
6.4.3.1
6.4.3.1.1
Comparator Match Events
Opcode Address Comparator Match
The comparator is loaded with the address of the selected instruction and the comparator control register
INST bit is set. When the opcode reaches the execution stage of the instruction queue a match occurs just
before the instruction executes, allowing a breakpoint immediately before the instruction boundary. The
comparator address register must contain the address of the first opcode byte for the match to occur.
Opcode address matches are data independent thus the RWE and RW bits are ignored. CPU compares are
disabled when BDM becomes active.
MC9S12ZVM Family Reference Manual Rev. 1.3
212
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.3.1.2
Data Access Comparator Match
Data access matches are generated when an access occurs at the address contained in the comparator
address register. The match can be qualified by the access data and by the access type (read/write). The
breakpoint occurs a maximum of 2 instructions after the access in the CPU flow. Note, if a COF occurs
between access and breakpoint, the opcode address of the breakpoint can be elsewhere in the memory map.
Opcode fetches are not classed as data accesses. Thus data access matches are not possible on opcode
fetches.
6.4.3.2
External Event
The DBGEEV input signal can force a state sequencer transition, independent of internal comparator
matches. The DBGEEV is an input signal mapped directly to a device pin and configured by the EEVE
field in DBGC1. The external events can change the state sequencer state, or force a trace buffer entry, or
gate trace buffer entries.
If configured to change the state sequencer state, then the external match is mapped to DBGSCRx bits
C3SC[1:0]. In this configuration, internal comparator channel3 is de-coupled from the state sequencer but
can still be used for timestamps. The DBGEFR bit EEVF is set when an external event occurs.
6.4.3.3
Setting The TRIG Bit
Independent of comparator matches it is possible to initiate a tracing session and/or breakpoint by writing
the TRIG bit in DBGC1 to a logic “1”. This forces the state sequencer into the Final State. If configured
for End aligned tracing or for no tracing, the transition to Final State is followed immediately by a
transition to State0. If configured for Begin- or Mid Aligned tracing, the state sequencer remains in Final
State until tracing is complete, then it transitions to State0.
Breakpoints, if enabled, are issued on the transition to State0.
6.4.3.4
Profiling Trace Buffer Overflow Event
During code profiling a trace buffer overflow forces the state sequencer into the disarmed State0 and, if
breakpoints are enabled, issues a breakpoint request to the CPU.
6.4.3.5
Event Priorities
If simultaneous events occur, the priority is resolved according to Table 6-45. Lower priority events are
suppressed. It is thus possible to miss a lower priority event if it occurs simultaneously with an event of a
higher priority. The event priorities dictate that in the case of simultaneous matches, the match on the
higher comparator channel number (3,2,1,0) has priority.
If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm
from an internal event, then the ARM bit is cleared due to the hardware disarm.
Table 6-45. Event Priorities
Priority
Source
Action
Highest
TB Overflow
Immediate force to state 0, generate breakpoint and terminate tracing
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
213
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-45. Event Priorities
TRIG
Force immediately to final state
DBGEEV
Force to next state as defined by state control registers (EEVE=2’b10)
Match3
Force to next state as defined by state control registers
Match2
Force to next state as defined by state control registers
Match1
Force to next state as defined by state control registers
Match0
Force to next state as defined by state control registers
Lowest
6.4.4
State Sequence Control
State 0
(Disarmed)
ARM = 1
State1
Final State
State2
State3
Figure 6-26. State Sequencer Diagram
The state sequencer allows a defined sequence of events to provide a breakpoint and/or a trigger point for
tracing of data in the trace buffer. When the DBG module is armed by setting the ARM bit in the DBGC1
register, the state sequencer enters State1. Further transitions between the states are controlled by the state
control registers and depend upon event occurrences (see Section 6.4.3). From Final State the only
permitted transition is back to the disarmed State0. Transition between the states 1 to 3 is not restricted.
Each transition updates the SSF[2:0] flags in DBGSR accordingly to indicate the current state. If
breakpoints are enabled, then an event based transition to State0 generates the breakpoint request. A
transition to State0 resulting from writing “0” to the ARM bit does not generate a breakpoint request.
6.4.4.1
Final State
On entering Final State a trigger may be issued to the trace buffer according to the trigger position control
as defined by the TALIGN field (see Section 6.3.2.3”).
If tracing is enabled and either Begin or Mid aligned triggering is selected, the state sequencer remains in
Final State until completion of the trace. On completion of the trace the state sequencer returns to State0
and the debug module is disarmed; if breakpoints are enabled, a breakpoint request is generated.
If tracing is disabled or End aligned triggering is selected, then when the Final State is reached the state
sequencer returns to State0 immediately and the debug module is disarmed. If breakpoints are enabled, a
breakpoint request is generated on transitions to State0.
MC9S12ZVM Family Reference Manual Rev. 1.3
214
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.5
Trace Buffer Operation
The trace buffer is a 64 lines deep by 64-bits wide RAM array. If the TSOURCE bit is set the DBG module
can store trace information in the RAM array in a circular buffer format. Data is stored in mode dependent
formats, as described in the following sections. After each trace buffer entry, the counter register DBGCNT
is incremented. Trace buffer rollover is possible when configured for End- or Mid-Aligned tracing, such
that older entries are replaced by newer entries. Tracing of CPU activity is disabled when the BDC is
active.
The RAM array can be accessed through the register DBGTB using 16-bit wide word accesses. After each
read, the internal RAM pointer is incremented so that the next read will receive fresh information. Reading
the trace buffer whilst the DBG is armed returns invalid data and the trace buffer pointer is not
incremented.
In Detail mode the address range for CPU access tracing can be limited to a range specified by the
TRANGE bits in DBGTCRH. This function uses comparators C and D to define an address range inside
which accesses should be traced. Thus traced accesses can be restricted, for example, to particular register
or RAM range accesses.
The external event pin can be configured to force trace buffer entries in Normal or Loop1 trace modes. All
tracing modes support trace buffer gating. In Pure PC and Detail modes external events do not force trace
buffer entries.
If the external event pin is configured to gate trace buffer entries then any trace mode is valid.
6.4.5.1
Trace Trigger Alignment
Using the TALIGN bits (see Section 6.3.2.3”) it is possible to align the trigger with the end, the middle, or
the beginning of a tracing session.
If End or Mid-Alignment is selected, tracing begins when the ARM bit in DBGC1 is set and State1 is
entered. The transition to Final State if End-Alignment is selected, ends the tracing session. The transition
to Final State if Mid-Alignment is selected signals that another 32 lines are traced before ending the tracing
session. Tracing with Begin-Alignment starts at the trigger and ends when the trace buffer is full.
Table 6-46. Tracing Alignment
TALIGN
Tracing Begin
Tracing End
00
On arming
At trigger
01
At trigger
When trace buffer is full
10
On arming
When 32 trace buffer lines have
been filled after trigger
11
6.4.5.1.1
Reserved
Storing with Begin-Alignment
Storing with Begin-Alignment, data is not stored in the trace buffer until the Final State is entered. Once
the trigger condition is met the DBG module remains armed until 64 lines are stored in the trace buffer.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
215
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Using Begin-Alignment together with opcode address comparisons, if the instruction is about to be
executed then the trace is started. If the trigger is at the address of a COF instruction, whilst tracing COF
addresses, then that COF address is stored to the trace buffer. If breakpoints are enabled, the breakpoint is
generated upon entry into State0 on completion of the tracing session; thus the breakpoint does not occur
at the instruction boundary.
6.4.5.1.2
Storing with Mid-Alignment
Storing with Mid-Alignment, data is stored in the trace buffer as soon as the DBG module is armed. When
the trigger condition is met, another 32 lines are traced before ending the tracing session, irrespective of
the number of lines stored before the trigger occurred, then the DBG module is disarmed and no more data
is stored. Using Mid-Alignment with opcode address triggers, if the instruction is about to be executed then
the trace is continued for another 32 lines. If breakpoints are enabled, the breakpoint is generated upon
entry into State0 on completion of the tracing session; thus the breakpoint does not occur at the instruction
boundary. When configured for Compressed Pure-PC tracing, the MAT info bit is set to indicate the last
PC entry before a trigger event.
6.4.5.1.3
Storing with End-Alignment
Storing with End-Alignment, data is stored in the trace buffer until the Final State is entered. Following
this trigger, the DBG module immediately transitions to State0. If the trigger is at the address of a COF
instruction the trigger event is not stored in the trace buffer.
6.4.5.2
Trace Modes
The DBG module can operate in four trace modes. The mode is selected using the TRCMOD bits in the
DBGTCRH register. Normal, Loop1 and Detail modes can be configured to store a timestamp with each
entry, by setting the STAMP bit. The modes are described in the following subsections.
In addition to the listed trace modes it is also possible to use code profiling to fill the trace buffer with a
highly compressed COF format. This can be subsequently read out in the same fashion as the listed trace
modes (see Section 6.4.6).
6.4.5.2.1
Normal Mode
In Normal Mode, change of flow (COF) program counter (PC) addresses are stored.
CPU COF addresses are defined as follows:
• Source address of taken conditional branches (bit-conditional, and loop primitives)
• Destination address of indexed JMP and JSR instruction.s
• Destination address of RTI and RTS instructions.
• Vector address of interrupts
BRA, BSR, BGND as well as non-indexed JMP and JSR instructions are not classified as change of flow
and are not stored in the trace buffer.
COF addresses stored include the full address bus of CPU and an information byte, which contains bits to
indicate whether the stored address was a source, destination or vector address.
MC9S12ZVM Family Reference Manual Rev. 1.3
216
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
NOTE
When a CPU indexed jump instruction is executed, the destination address
is stored to the trace buffer on instruction completion, indicating the COF
has taken place. If an interrupt occurs simultaneously then the next
instruction carried out is actually from the interrupt service routine. The
instruction at the destination address of the original program flow gets
executed after the interrupt service routine.
In the following example an IRQ interrupt occurs during execution of the
indexed JMP at address MARK1. The NOP at the destination (SUB_1) is
not executed until after the IRQ service routine but the destination address
is entered into the trace buffer to indicate that the indexed JMP COF has
taken place.
MARK1:
MARK2:
LD
JMP
NOP
SUB_1:
NOP
ADDR1:
NOP
DBNE
IRQ_ISR: LD
ST
RTI
X,#SUB_1
(0,X)
; IRQ interrupt occurs during execution of this
;
; JMP Destination address TRACE BUFFER ENTRY 1
; RTI Destination address TRACE BUFFER ENTRY 3
;
; Source address TRACE BUFFER ENTRY 4
D0,PART5
D1,#$F0
D1,VAR_C1
; IRQ Vector $FFF2 = TRACE BUFFER ENTRY 2
;
The execution flow taking into account the IRQ is as follows
LD
MARK1:
JMP
IRQ_ISR: LD
ST
RTI
SUB_1:
NOP
NOP
ADDR1:
DBNE
X,#SUB_1
(0,X)
D1,#$F0
D1,VAR_C1
;
;
;
;
;
D0,PART5
The Normal Mode trace buffer format is shown in the following tables. Whilst tracing in Normal or Loop1
modes each array line contains 2 data entries, thus in this case the DBGCNT[0] is incremented after each
separate entry. Information byte bits indicate if an entry is a source, destination or vector address.
The external event input can force trace buffer entries independent of COF occurrences, in which case the
EEVI bit is set and the PC value of the last instruction is stored to the trace buffer. If the external event
coincides with a COF buffer entry a single entry is made with the EEVI bit set.
Normal mode profiling with timestamp is possible when tracing from a single source by setting the
STAMP bit in DBGTCRL. This results in a different format (see Table 6-48).
Table 6-47. Normal and Loop1 Mode Trace Buffer Format without Timestamp
8-Byte Wide Trace Buffer Line
Mode
7
6
5
4
3
2
1
0
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
217
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-47. Normal and Loop1 Mode Trace Buffer Format without Timestamp
CPU
CINF1
CPCH1
CPCM1
CPCL1
CINF0
CPCH0
CPCM0
CPCL0
CINF3
CPCH3
CPCM3
CPCL3
CINF2
CPCH2
CPCM2
CPCL2
Table 6-48. Normal and Loop1 Mode Trace Buffer Format with Timestamp
8-Byte Wide Trace Buffer Line
Mode
CPU
7
6
5
4
3
2
1
0
Timestamp
Timestamp
Reserved
Reserved
CINF0
CPCH0
CPCM0
CPCL0
Timestamp
Timestamp
Reserved
Reserved
CINF1
CPCH1
CPCM1
CPCL1
CINF contains information relating to the CPU.
CPU Information Byte CINF For Normal And Loop1 Modes
Bit 7
Bit 6
CET
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
CTI
EEVI
0
TOVF
Figure 6-27. CPU Information Byte CINF
Table 6-49. CINF Bit Descriptions
Field
Description
7–6
CET
CPU Entry Type Field — Indicates the type of stored address of the trace buffer entry as described in Table 6-50
3
CTI
Comparator Timestamp Indicator — This bit indicates if the trace buffer entry corresponds to a comparator
timestamp.
0 Trace buffer entry initiated by trace mode specification conditions or timestamp counter overflow
1 Trace buffer entry initiated by comparator D match
2
EEVI
External Event Indicator — This bit indicates if the trace buffer entry corresponds to an external event.
0 Trace buffer entry not initiated by an external event
1 Trace buffer entry initiated by an external event
0
TOVF
Timestamp Overflow Indicator — Indicates if the trace buffer entry corresponds to a timestamp overflow
0 Trace buffer entry not initiated by a timestamp overflow
1 Trace buffer entry initiated by a timestamp overflow
Table 6-50. CET Encoding
CET
Entry Type Description
00
Non COF opcode address (entry forced by an external event)
01
Vector destination address
MC9S12ZVM Family Reference Manual Rev. 1.3
218
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-50. CET Encoding
CET
Entry Type Description
10
Source address of COF opcode
11
Destination address of COF opcode
6.4.5.2.2
Loop1 Mode
Loop1 Mode, similarly to Normal Mode also stores only COF address information to the trace buffer, it
however allows the filtering out of redundant information.
The intent of Loop1 Mode is to prevent the trace buffer from being filled entirely with duplicate
information from a looping construct such as delays using the DBNE instruction. The DBG monitors trace
buffer entries and prevents consecutive duplicate address entries resulting from repeated branches.
Loop1 Mode only inhibits consecutive duplicate source address entries that would typically be stored in
most tight looping constructs. It does not inhibit repeated entries of destination addresses or vector
addresses, since repeated entries of these could indicate a bug in application code that the DBG module is
designed to help find.
The trace buffer format for Loop1 Mode is the same as that of Normal Mode.
6.4.5.2.3
Detail Mode
When tracing CPU activity in Detail Mode, address and data of data and vector accesses are traced. The
information byte indicates the size of access and the type of access (read or write).
ADRH, ADRM, ADRL denote address high, middle and low byte respectively. The numerical suffix
indicates which tracing step. DBGCNT increments by 2 for each line completed.
If timestamps are enabled then each CPU entry can span 2 trace buffer lines, whereby the second line
includes the timestamp. If a valid PC occurs in the same cycle as the timestamp, it is also stored to the trace
buffer and the PC bit is set. The second line featuring the timestamp is only stored if no further data access
occurs in the following cycle. This is shown in Table 6-52, where data accesses 2 and 3 occur in
consecutive cycles, suppressing the entry2 timestamp. If 2 lines are used for an entry, then DBGCNT
increments by 4. A timestamp line is indicated by bit1 in the TSINF byte. The timestamp counter is only
reset each time a timestamp line entry is made. It is not reset when the data and address trace buffer line
entry is made.
Table 6-51. Detail Mode Trace Buffer Format without Timestamp
8-Byte Wide Trace Buffer Line
Mode
CPU
Detail
7
6
5
4
3
2
1
0
CDATA31
CDATA21
CDATA11
CDATA01
CINF1
CADRH1
CADRM1
CADRL1
CDATA32
CDATA22
CDATA12
CDATA02
CINF2
CADRH2
CADRM2
CADRL2
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
219
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-52. Detail Mode Trace Buffer Format with Timestamp
8-Byte Wide Trace Buffer Line
Mode
CPU
Detail
7
6
5
4
3
2
1
0
CDATA31
CDATA21
CDATA11
CDATA01
CINF1
CADRH1
CADRM1
CADRL1
Timestamp
Timestamp
Reserved
Reserved
TSINF1
CPCH1
CPCM1
CPCL1
CDATA32
CDATA22
CDATA12
CDATA02
CINF2
CADRH2
CADRM2
CADRL2
CDATA33
CDATA23
CDATA13
CDATA03
CINF3
CADRH3
CADRM3
CADRL3
Timestamp
Timestamp
Reserved
Reserved
TSINF3
CPCH3
CPCM3
CPCL3
Detail Mode data entries store the bytes aligned to the address of the MSB accessed (Byte1 Table 6-53).
Thus accesses split across 32-bit boundaries are wrapped around.
Table 6-53. Detail Mode Data Byte Alignment
Access
Address
Access
Size
CDATA31
CDATA21
CDATA11
CDATA01
00
32-bit
Byte1
Byte2
Byte3
Byte4
01
32-bit
Byte4
Byte1
Byte2
Byte3
10
32-bit
Byte3
Byte4
Byte1
Byte2
11
32-bit
Byte2
Byte3
Byte4
Byte1
00
24-bit
Byte1
Byte2
Byte3
01
24-bit
Byte1
Byte2
10
24-bit
Byte3
11
24-bit
Byte2
Byte3
00
16-bit
Byte1
Byte2
01
16-bit
Byte1
10
16-bit
16-bit
Byte2
00
8-bit
Byte1
01
8-bit
10
8-bit
11
8-bit
Byte2
Byte1
Byte1
11
Byte3
Byte2
Byte1
Byte2
Byte1
Byte1
Byte1
Byte1
Denotes byte that is not accessed.
Information Bytes
BYTE
Bit 7
CINF
TSINF
Bit 6
CSZ
0
0
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
CRW
0
0
0
0
0
0
0
CTI
PC
1
TOVF
Figure 6-28. Information Bytes CINF and XINF
When tracing in Detail Mode, CINF provides information about the type of CPU access being made.
MC9S12ZVM Family Reference Manual Rev. 1.3
220
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
TSINF provides information about a timestamp. Bit1 indicates if the byte is a TSINF byte.
Table 6-54. CINF Field Descriptions
Field
Description
7–6
CSZ
Access Type Indicator — This field indicates the CPU access size.
00 8-bit Access
0116-bit Access
10 24-bit Access
11 32-bit Access
5
CRW
Read/Write Indicator — Indicates if the corresponding stored address corresponds to a read or write access.
0 Write Access
1 Read Access
Table 6-55. TSINF Field Descriptions
Field
Description
3
CTI
Comparator Timestamp Indicator — This bit indicates if the trace buffer entry corresponds to a comparator
timestamp.
0 Trace buffer entry initiated by trace mode specification conditions or timestamp counter overflow
1 Trace buffer entry initiated by comparator D match
2
PC
Program Counter Valid Indicator — Indicates if the PC entry is valid on the timestamp line.
0 Trace buffer entry does not include PC value
1 Trace buffer entry includes PC value
0
TOVF
6.4.5.2.4
Timestamp Overflow Indicator — Indicates if the trace buffer entry corresponds to a timestamp overflow
0 Trace buffer entry not initiated by a timestamp overflow
1 Trace buffer entry initiated by a timestamp overflow
Pure PC Mode
In Pure PC Mode, the PC addresses of all opcodes loaded into the execution stage, including illegal
opcodes, are stored.
Tracing from a single source, compression is implemented to increase the effective trace depth. A
compressed entry consists of the lowest PC byte only. A full entry consists of all PC bytes. If the PC
remains in the same 256 byte range, then a compressed entry is made, otherwise a full entry is made. The
full entry is always the last entry of a record.
Each trace buffer line consists of 7 payload bytes, PLB0-6, containing full or compressed CPU PC
addresses and 1 information byte to indicate the type of entry (compressed or base address) for each
payload byte.
Each trace buffer line is filled from right to left. The final entry on each line is always a base address, used
as a reference for the previous entries on the same line. Whilst tracing, a base address is typically stored
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
221
Chapter 6 S12Z Debug (S12ZDBGV2) Module
in bytes[6:4], the other payload bytes may be compressed or complete addresses as indicated by the info
byte bits.
Table 6-56. Pure PC Mode Trace Buffer Format Single Source
8-Byte Wide Trace Buffer Line
Mode
CPU
7
6
5
4
3
2
1
0
CXINF
BASE
BASE
BASE
PLB3
PLB2
PLB1
PLB0
If the info bit for byte3 indicates a full CPU PC address, whereby bytes[5:3] are used, then the info bit
mapped to byte[4] is redundant and the byte[6] is unused because a line overflow has occurred. Similarly
a base address stored in bytes[4:2] causes line overflow, so bytes[6:5] are unused.
CXINF[6:4] indicate how many bytes in a line contain valid data, since tracing may terminate before a
complete line has been filled.
CXINF Information Byte Source Tracing
7
CXINF
MAT
6
5
PLEC
4
3
2
1
0
NB3
NB2
NB1
NB0
Figure 6-29. Pure PC Mode CXINF
Table 6-57. CXINF Field Descriptions
Field
Description
MAT
Mid Aligned Trigger— This bit indicates a mid aligned trigger position. When a mid aligned trigger occurs, the
next trace buffer entry is a base address and the counter is incremented to a new line, independent of the number
of bytes used on the current line. The MAT bit is set on the current line, to indicate the position of the trigger.
When configured for begin or end aligned trigger, this bit has no meaning.
NOTE: In the case when ARM and TRIG are simultaneously set together in the same cycle that a new PC value
is registered, then this PC is stored to the same trace buffer line and MAT set.
0 Line filled without mid aligned trigger occurrence
1 Line last entry is the last PC entry before a mid aligned trigger
PLEC[2:0]
NBx
Payload Entry Count— This field indicates the number of valid bytes in the trace buffer line
Binary encoding is used to indicate up to 7 valid bytes.
Payload Compression Indicator— This field indicates if the corresponding payload byte is the lowest byte of a
base PC entry
0 Corresponding payload byte is a not the lowest byte of a base PC entry
1 Corresponding payload byte is the lowest byte of a base PC entry
Pure PC mode tracing does not support timestamps or external event entries.
6.4.5.3
Timestamp
When set, the STAMP bit in DBGTCRL configures the DBG to add a timestamp to trace buffer entries in
Normal, Loop1 and Detail trace buffer modes. The timestamp is generated from a 16-bit counter and is
stored to the trace buffer line each time a trace buffer entry is made.
MC9S12ZVM Family Reference Manual Rev. 1.3
222
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
The number of core clock cycles since the last entry equals the timestamp + 1. The core clock runs at twice
the frequency of the bus clock. The timestamp of the first trace buffer entry is 0x0000. With timestamps
enabled trace buffer entries are initiated in the following ways:
• according to the trace mode specification, for example COF PC addresses in Normal mode
• on a timestamp counter overflow
If the timestamp counter reaches 0xFFFF then a trace buffer entry is made, with timestamp=
0xFFFF and the timestamp overflow bit TOVF is set.
• on a match of comparator D
If STAMP and DSTAMP are set then comparator D is used for forcing trace buffer entries with
timestamps. The state control register settings determine if comparator D is also used to trigger the
state sequencer. Thus if the state control register configuration does not use comparator D, then it
is used solely for the timestamp function. If comparator D initiates a timestamp then the CTI bit is
set in the INFO byte. This can be used in Normal/Loop1 mode to indicate when a particular data
access occurs relative to the PC flow. For example when the timing of an access may be unclear
due to the use of indexes.
NOTE
If comparator D is configured to match a PC address then associated
timestamps trigger a trace buffer entry during execution of the previous
instruction. Thus the PC stored to the trace buffer is that of the previous
instruction.The comparator must contain the PC address of the instruction’s
first opcode byte
Timestamps are disabled in Pure PC mode.
6.4.5.4
Reading Data from Trace Buffer
The data stored in the trace buffer can be read using either the background debug controller (BDC) module
or the CPU provided the DBG module is not armed and is configured for tracing by TSOURCE. When the
ARM bit is set the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for
reading by an aligned word write to DBGTB when the module is disarmed. The trace buffer can only be
read through the DBGTB register using aligned word reads. Reading the trace buffer while the DBG
module is armed, or trace buffer locked returns 0xEE and no shifting of the RAM pointer occurs. Any byte
or misaligned reads return 0xEE and do not cause the trace buffer pointer to increment to the next trace
buffer address.
Reading the trace buffer is prevented by internal hardware whilst profiling is active because the RAM
pointer is used to indicate the next row to be transmitted. Thus attempted reads of DBGTB do not return
valid data when the PROFILE bit is set. To initialize the pointer and read profiling data, the PROFILE bit
must be cleared and remain cleared.
The trace buffer data is read out first-in first-out. By reading CNT in DBGCNT the number of valid 64-bit
lines can be determined. DBGCNT does not decrement as data is read.
Whilst reading, an internal pointer is used to determine the next line to be read. After a tracing session, the
pointer points to the oldest data entry, thus if no overflow has occurred, the pointer points to line0. The
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
223
Chapter 6 S12Z Debug (S12ZDBGV2) Module
pointer is initialized by each aligned write to DBGTB to point to the oldest data again. This enables an
interrupted trace buffer read sequence to be easily restarted from the oldest data entry. After reading all
trace buffer lines, the next read wraps around and returns the contents of line0.
The least significant word of each 64-bit wide array line is read out first. All bytes, including those
containing invalid information are read out.
6.4.5.5
Trace Buffer Reset State
The trace buffer contents are not initialized by a system reset. Thus should a system reset occur, the trace
session information from immediately before the reset occurred can be read out. The DBGCNT bits are
not cleared by a system reset. Thus should a reset occur, the number of valid lines in the trace buffer is
indicated by DBGCNT. The internal pointer is cleared by a system reset. It can be initialized by an aligned
word write to DBGTB following a reset during debugging, so that it points to the oldest valid data again.
Debugging occurrences of system resets is best handled using mid or end trigger alignment since the reset
may occur before the trace trigger, which in the begin trigger alignment case means no information would
be stored in the trace buffer.
6.4.6
6.4.6.1
Code Profiling
Code Profiling Overview
Code profiling supplies encoded COF information on the PDO pin and the reference clock on the
PDOCLK pin. If the TSOURCE bit is set then code profiling is enabled by setting the PROFILE bit. The
associated device pin is configured for code profiling by setting the PDOE bit. Once enabled, code
profiling is activated by arming the DBG. During profiling, if PDOE is set, the PDO operates as an output
pin at a half the internal bus frequency, driving both high and low.
Independent of PDOE status, profiling data is stored to the trace buffer and can be read out in the usual
manner when the debug session ends and the PROFILE bit has been cleared.
The external debugger uses both edges of the clock output to strobe the data on PDO. The first PDOCLK
edge is used to sample the first data bit on PDO.
Figure 6-30. Profiling Output Interface
CLOCK
PDOCLK
DATA
TBUF
PDO
DEV TOOL
DBG
MCU
MC9S12ZVM Family Reference Manual Rev. 1.3
224
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Figure 6-31 shows the profiling clock, PDOCLK, whose edges are offset from the bus clock, to ease setup
and hold time requirements relative to PDO, which is synchronous to the bus clock.
Figure 6-31. PDO Profiling Clock Control
STROBE
BUS CLOCK
PDO
CLOCK ENABLE
PDOCLK
The trace buffer is used as a temporary storage medium to store COF information before it is transmitted.
COF information can be transmitted whilst new information is written to the trace buffer. The trace buffer
data is transmitted at PDO least significant bit first. After the first trace buffer entry is made, transmission
begins in the first clock period in which no further data is written to the trace buffer.
If a trace buffer line transmission completes before the next trace buffer line is ready, then the clock output
is held at a constant level until the line is ready for transfer.
6.4.6.2
Profiling Configuration, Alignment and Mode Dependencies
The PROFILE bit must be set and the DBG armed to enable profiling. Furthermore the PDOE bit must be
set to configure the PDO and PDOCLK pins for profiling.
If TALIGN is configured for End-Aligned tracing then profiling begins as soon as the module is armed.
If TALIGN is configured for Begin-aligned tracing, then profiling begins when the state sequencer enters
Final State and continues until a software disarm or trace buffer overflow occurs; thus profiling does not
terminate after 64 line entries have been made.
Mid-Align tracing is not supported whilst profiling; if the TALIGN bits are configured for Mid-Align
tracing when PROFILE is set, then the alignment defaults to end alignment.
Profiling entries continue until either a trace buffer overflow occurs or the DBG is disarmed by a state
machine transition to State0. The profiling output transmission continues, even after disarming, until all
trace buffer entries have been transmitted. The PTACT bit indicates if a profiling transmission is still
active. The PTBOVF indicates if a trace buffer overflow has occurred.
The profiling timestamp feature is used only for the PTVB and PTW formats, thus differing from
timestamps offered in other modes.
Profiling does not support trace buffer gating. The external pin gating feature is ignored during profiling.
When the DBG module is disarmed but profiling transmission is ongoing, register write accesses are
suppressed.
When the DBG module is disarmed but profiling transmission is still ongoing, reading from the DBGTB
returns the code 0xEE.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
225
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.6.3
Code Profiling Internal Data Storage Format
When profiling starts, the first trace buffer entry is made to provide the start address. This uses a 4 byte
format (PTS), including the INFO byte and a 3-byte PC start address. In order to avoid trace buffer
overflow a fully compressed format is used for direct (conditional branch) COF information.
Table 6-58. Profiling Trace buffer line format
Format
8-Byte Wide Trace Buffer Line
7
6
5
4
3
1
PC Start Address
PTS
PTIB
2
Indirect
Indirect
PTHF
0
INFO
Indirect
Direct
Direct
Direct
Direct
INFO
0
Direct
Direct
Direct
Direct
INFO
PTVB
Timestamp
Timestamp
Vector
Direct
Direct
Direct
Direct
INFO
PTW
Timestamp
Timestamp
0
Direct
Direct
Direct
Direct
INFO
The INFO byte indicates the line format used. Up to 4 bytes of each line are dedicated to branch COFs.
Further bytes are used for storing indirect COF information (indexed jumps and interrupt vectors).
Indexed jumps force a full line entry with the PTIB format and require 3-bytes for the full 24-bit
destination address. Interrupts force a full line entry with the PTVB format, whereby vectors are stored as
a single byte and a 16-bit timestamp value is stored simultaneously to indicate the number of bus cycles
relative to the previous COF. At each trace buffer entry the 16-bit timestamp counter is cleared. The device
vectors use address[8:0] whereby address[1:0] are constant zero for vectors. Thus the value stored to the
PTVB vector byte is equivalent to (Vector Address[8:1]).
After the PTS entry, the pointer increments and the DBG begins to fill the next line with direct COF
information. This continues until the direct COF field is full or an indirect COF occurs, then the INFO byte
and, if needed, indirect COF information are entered on that line and the pointer increments to the next line.
If a timestamp overflow occurs, indicating a 65536 bus clock cycles without COF, then an entry is made
with the TSOVF bit set, INFO[6] (Table 6-59) and profiling continues.
If a trace buffer overflow occurs, a final entry is made with the TBOVF bit set, profiling is terminated and
the DBG is disarmed. Trace buffer overflow occurs when the trace buffer contains 64 lines pending
transmission.
Whenever the DBG is disarmed during profiling, a final entry is made with the TERM bit set to indicate
the final entry.
When a final entry is made then by default the PTW line format is used, except if a COF occurs in the same
cycle in which case the corresponding PTIB/PTVB/PTHF format is used. Since the development tool
receives the INFO byte first, it can determine in advance the format of data it is about to receive. The
MC9S12ZVM Family Reference Manual Rev. 1.3
226
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
transmission of the INFO byte starts when a line is complete. Whole bytes are always transmitted. The
grey shaded bytes of Table 6-58 are not transmitted.
Figure 6-32. INFO byte encoding
7
6
5
4
0
TSOVF
TBOVF
TERM
3
2
1
0
Line Format
Table 6-59. Profiling Format Encoding
6.4.6.4
INFO[3:0]
Line Format
Source
Description
0000
PTS
CPU
Initial CPU entry
0001
PTIB
CPU
Indexed jump with up to 31 direct COFs
0010
PTHF
CPU
31 direct COFs without indirect COF
0011
PTVB
CPU
Vector with up to 31 direct COFs
0111
PTW
CPU
Error (Error codes in INFO[7:4])
Others
Reserved
CPU
Reserved
INFO[7:4]
Bit Name
INFO[7]
Reserved
CPU
Reserved
INFO[6]
TSOVF
CPU
Timestamp Overflow
INFO[5]
TBOVF
CPU
Trace Buffer Overflow
INFO[4]
TERM
CPU
Profiling terminated by disarming
Vector[7:0]
Vector[7:0]
CPU
Device Interrupt Vector Address [8:1]
Description
Direct COF Compression
Each branch COF is stored to the trace buffer as a single bit (0=branch not taken, 1=branch taken) until an
indirect COF (indexed jump, return, or interrupt) occurs. The branch COF entries are stored in the byte
fields labelled “Direct” in Table 6-58. These entries start at byte1[0] and continue through to byte4[7], or
until an indirect COF occurs, whichever occurs sooner. The entries use a format whereby the left most
asserted bit is always the stop bit, which indicates that the bit to its right is the first direct COF and byte1[0]
is the last COF that occurred before the indirect COF. This is shown in Table 6-60, whereby the Bytes 4 to
1 of the trace buffer are shown for 3 different cases. The stop bit field for each line is shaded.
In line0, the left most asserted bit is Byte4[7]. This indicates that all remaining 31 bits in the 4-byte field
contain valid direct COF information, whereby each 1 represents branch taken and each 0 represents
branch not taken. The stop bit of line1 indicates that all 30 bits to it’s right are valid, after the 30th direct
COF entry, an indirect COF occurred, that is stored in bytes 7 to 5. In this case the bit to the left of the stop
bit is redundant. Line2 indicates that an indirect COF occurred after 8 direct COF entries. The indirect
COF address is stored in bytes 7 to 5. All bits to the left of the stop bit are redundant.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
227
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Line
Byte4
Byte3
Byte2
Byte1
Line0
1
0
0
1
0
0
1
0
0
1
0
1
1
0
0
1
0
0
1
0
0
0
0
1
1
0
0
0
0
1
1
0
Line1
0
1
1
0
0
1
0
1
1
0
0
1
0
0
1
0
1
1
0
0
1
0
0
1
0
1
1
0
0
1
0
0
Line2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
0
1
Table 6-60. Profiling Direct COF Format
6.4.7
Breakpoints
Breakpoints can be generated by state sequencer transitions to State0. Transitions to State0 are forced by
the following events
• Through comparator matches via Final State.
• Through software writing to the TRIG bit in the DBGC1 register via Final State.
• Through the external event input (DBGEEV) via Final State.
• Through a profiling trace buffer overflow event.
Breakpoints are not generated by software writes to DBGC1 that clear the ARM bit.
6.4.7.1
Breakpoints From Comparator Matches or External Events
Breakpoints can be generated when the state sequencer transitions to State0 following a comparator match
or an external event.
If a tracing session is selected by TSOURCE, the transition to State0 occurs when the tracing session has
completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on
completion of the subsequent trace. If End aligned tracing or no tracing session is selected, the transition
to State0 and associated breakpoints are immediate.
6.4.7.2
Breakpoints Generated Via The TRIG Bit
When TRIG is written to “1”, the Final State is entered. If a tracing session is selected by TSOURCE,
State0 is entered and breakpoints are requested only when the tracing session has completed, thus if Begin
or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent
trace. If no tracing session is selected, the state sequencer enters State0 immediately and breakpoints are
requested. TRIG breakpoints are possible even if the DBG module is disarmed.
6.4.7.3
DBG Breakpoint Priorities
If a TRIG occurs after Begin or Mid aligned tracing has already been triggered by a comparator instigated
transition to Final State, then TRIG no longer has an effect. When the associated tracing session is
complete, the breakpoint occurs. Similarly if a TRIG is followed by a subsequent comparator match, it has
no effect, since tracing has already started.
MC9S12ZVM Family Reference Manual Rev. 1.3
228
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.7.3.1
DBG Breakpoint Priorities And BDC Interfacing
Breakpoint operation is dependent on the state of the S12ZBDC module. BDM cannot be entered from a
breakpoint unless the BDC is enabled (ENBDC bit is set in the BDC). If BDM is already active,
breakpoints are disabled. In addition, while executing a BDC STEP1 command, breakpoints are disabled.
When the DBG breakpoints are mapped to BDM (BDMBP set), then if a breakpoint request, either from
a BDC BACKGROUND command or a DBG event, coincides with an SWI instruction in application code,
(i.e. the DBG requests a breakpoint at the next instruction boundary and the next instruction is an SWI)
then the CPU gives priority to the BDM request over the SWI request.
On returning from BDM, the SWI from user code gets executed. Breakpoint generation control is
summarized in Table 6-61.
Table 6-61. Breakpoint Mapping Summary
6.5
6.5.1
BRKCPU
BDMBP Bit
(DBGC1[4])
BDC
Enabled
BDM
Active
Breakpoint
Mapping
0
X
X
X
No Breakpoint
1
0
X
0
Breakpoint to SWI
1
0
1
1
No Breakpoint
1
1
0
X
No Breakpoint
1
1
1
0
Breakpoint to BDM
1
1
1
1
No Breakpoint
Application Information
Avoiding Unintended Breakpoint Re-triggering
Returning from an instruction address breakpoint using an RTI or BDC GO command without PC
modification, returns to the instruction that generated the breakpoint. If an active breakpoint or trigger still
exists at that address, this can re-trigger, disarming the DBG. If configured for BDM breakpoints, the user
must apply the BDC STEP1 command to increment the PC past the current instruction.
If configured for SWI breakpoints, the DBG can be re configured in the SWI routine. If a comparator match
occurs at an SWI vector address then a code SWI and DBG breakpoint SWI could occur simultaneously.
In this case the SWI routine is executed twice before returning.
6.5.2
Debugging Through Reset
To debug through reset, the debugger can recognize a reset occurrence and pull the device BKGD pin low.
This forces the device to leave reset in special single chip (SSC) mode, because the BKGD pin is used as
the MODC signal in the reset phase. When the device leaves reset in SSC mode, CPU execution is halted
and the device is in active BDM. Thus the debugger can configure the DBG for tracing and breakpoints
before returning to application code execution. In this way it is possible to analyze the sequence of events
emerging from reset. The recommended handling of the internal reset scenario is as follows:
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
229
Chapter 6 S12Z Debug (S12ZDBGV2) Module
•
•
•
•
•
•
6.5.3
When a reset occurs the debugger pulls BKGD low until the reset ends, forcing SSC mode entry.
Then the debugger reads the reset flags to determine the cause of reset.
If required, the debugger can read the trace buffer to see what happened just before reset. Since the
trace buffer and DBGCNT register are not affected by resets other than POR.
The debugger configures and arms the DBG to start tracing on returning to application code.
The debugger then sets the PC according to the reset flags.
Then the debugger returns to user code with GO or STEP1.
Breakpoints from other S12Z sources
The DBG is neither affected by CPU BGND instructions, nor by BDC BACKGROUND commands.
6.5.4
Code Profiling
The code profiling data output pin PDO is mapped to a device pin that can also be used as GPIO in an
application. If profiling is required and all pins are required in the application, it is recommended to use
the device pin for a simple output function in the application, without feedback to the chip. In this way the
application can still be profiled, since the pin has no effect on code flow.
The PDO provides a simple bit stream that must be strobed at both edges of the profiling clock when
profiling. The external development tool activates profiling by setting the DBG ARM bit, with PROFILE
and PDOE already set. Thereafter the first bit of the profiling bit stream is valid at the first rising edge of
the profiling clock. No start bit is provided. The external development tool must detect this first rising edge
after arming the DBG. To detect the end of profiling, the DBG ARM bit can be monitored using the BDC.
MC9S12ZVM Family Reference Manual Rev. 1.3
230
Freescale Semiconductor
Chapter 7
ECC Generation Module (SRAM_ECCV1)
7.1
Introduction
The purpose of ECC logic is to detect and correct as much as possible memory data bit errors. These soft
errors, mainly generated by alpha radiation, can occur randomly during operation. "Soft error" means that
only the information inside the memory cell is corrupt; the memory cell itself is not damaged. A write
access with correct data solves the issue. If the ECC algorithm is able to correct the data, then the system
can use this corrected data without any issues. If the ECC algorithm is able to detect, but not correct the
error, then the system is able to ignore the memory read data to avoid system malfunction.
The ECC value is calculated based on an aligned 2 byte memory data word. The ECC algorithm is able to
detect and correct single bit ECC errors. Double bit ECC errors will be detected but the system is not able
to correct these errors. This kind of ECC code is called SECDED code. This ECC code requires 6
additional parity bits for each 2 byte data word.
7.1.1
Features
The SRAM_ECC module provides the ECC logic for the system memory based on a SECDED algorithm.
The SRAM_ECC module includes the following features:
•
SECDED ECC code
–
Single bit error detection and correction per 2 byte data word
–
Double bit error detection per 2 byte data word
•
Memory initialization function
•
Byte wide system memory write access
•
Automatic single bit ECC error correction for read and write accesses
•
Debug logic to read and write raw use data and ECC values
7.2
Memory Map and Register Definition
This section provides a detailed description of all memory and registers for the SRAM_ECC module.
7.2.1
Register Summary
Figure 7-1 shows the summary of all implemented registers inside the SRAM_ECC module.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
231
Chapter 7 ECC Generation Module (SRAM_ECCV1)
NOTE
Register Address = Module Base Address + Address Offset, where the
Module Base Address is defined at the MCU level and the Address Offset is
defined at the module level.
Address Offset
Register Name
0x0000
ECCSTAT
R
0x0001
ECCIE
R
0x0002
ECCIF
R
0x0003 - 0x0006
Reserved
R
0x0007
ECCDPTRH
R
0x0008
ECCDPTRM
0x0009
ECCDPTRL
Bit 7
6
5
4
3
2
1
Bit 0
0
0
0
0
0
0
0
RDY
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
W
W
SBEEIE
SBEEIF
0
W
DPTR[23:16]
W
R
DPTR[15:8]
W
R
W
0x000A - 0x000B
Reserved
R
0x000C
ECCDDH
R
0x000D
ECCDDL
R
0x000E
ECCDE
R
0x000F
ECCDCMD
R
0
DPTR[7:1]
0
0
0
0
0
0
0
0
ECCDW
ECCDR
W
DDATA[15:8]
W
DDATA[7:0]
W
0
0
DECC[5:0]
W
W
ECCDRR
0
0
0
0
0
= Unimplemented, Reserved, Read as zero
Figure 7-1. SRAM_ECC Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.3
232
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
7.2.2
Register Descriptions
This section consists of register descriptions in address order. Each description includes a standard register
diagram with an associated figure number. Details of register bit and field functions follow the register
diagrams, in bit order.
7.2.2.1
ECC Status Register (ECCSTAT)
Access: User read only(1)
Module Base + 0x00000
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
RDY
0
0
0
0
0
0
0
0
W
Reset
1. Read: Anytime
Write: Never
Figure 7-2. ECC Status Register (ECCSTAT)
Table 7-2. ECCSTAT Field Description
Field
Description
0
RDY
ECC Ready— Shows the status of the ECC module.
0 Internal SRAM initialization is ongoing, access to the SRAM is disabled
1 Internal SRAM initialization is done, access to the SRAM is enabled
7.2.2.2
ECC Interrupt Enable Register (ECCIE)
Access: User read/write(1)
Module Base + 0x00001
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
SBEEIE
W
Reset
0
0
0
0
0
0
0
0
1. Read: Anytime
Write: Anytime
Figure 7-3. ECC Interrupt Enable Register (ECCIE)
Table 7-3. ECCIE Field Description
Field
0
SBEEIE
Description
Single bit ECC Error Interrupt Enable — Enables Single ECC Error interrupt.
0 Interrupt request is disabled
1 Interrupt will be requested whenever SBEEIF is set
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
233
Chapter 7 ECC Generation Module (SRAM_ECCV1)
7.2.2.3
ECC Interrupt Flag Register (ECCIF)
Access: User read/write(1)
Module Base + 0x0002
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
SBEEIF
W
Reset
0
0
0
0
0
0
0
0
1. Read: Anytime
Write: Anytime, write 1 to clear
Figure 7-4. ECC Interrupt Flag Register (ECCIF)
Table 7-4. ECCIF Field Description
Field
0
SBEEIF
Description
Single bit ECC Error Interrupt Flag — The flag is set to 1 when a single bit ECC error occurs.
0 No occurrences of single bit ECC error since the last clearing of the flag
1 Single bit ECC error has occured since the last clearing of the flag
MC9S12ZVM Family Reference Manual Rev. 1.3
234
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
ECC Debug Pointer Register (ECCDPTRH, ECCDPTRM,
ECCDPTRL)
7.2.2.4
Access: User read/write(1)
Module Base + 0x0007
7
6
5
4
3
2
1
0
0
0
0
0
R
DPTR[23:16]
W
Reset
0
0
0
0
Module Base + 0x0008
7
Access: User read/write
6
5
4
3
2
1
0
0
0
0
0
R
DPTR[15:8]
W
Reset
0
0
0
0
Module Base + 0x0009
7
Access: User read/write
6
5
4
3
2
1
R
0
0
DPTR[7:1]
W
Reset
0
0
0
0
0
0
0
0
= Unimplemented
Figure 7-5. ECC Debug Pointer Register (ECCDPTRH, ECCDPTRM, ECCDPTRL)
1. Read: Anytime
Write: Anytime
Table 7-5. ECCDPTR Register Field Descriptions
Field
Description
DPTR
[23:0]
ECC Debug Pointer — This register contains the system memory address which will be used for a debug
access. Address bits not relevant for SRAM address space are not writeable, so the software should read back
the pointer value to make sure the register contains the intended memory address. It is possible to write an
address value to this register which points outside the system memory. There is no additional monitoring of the
register content; therefore, the software must make sure that the address value points to the system memory
space.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
235
Chapter 7 ECC Generation Module (SRAM_ECCV1)
ECC Debug Data (ECCDDH, ECCDDL)
7.2.2.5
Access: User read/write(1)
Module Base + 0x000C
7
6
5
4
3
2
1
0
0
0
0
0
R
DDATA[15:8]
W
Reset
0
0
0
0
Module Base + 0x000D
7
Access: User read/write
6
5
4
3
2
1
0
0
0
0
0
R
DDATA[7:0]
W
Reset
0
0
0
0
= Unimplemented
Figure 7-6. ECC Debug Data (ECCDDH, ECCDDL)
1. Read: Anytime
Write: Anytime
Table 7-6. ECCDD Register Field Descriptions
Field
Description
DDATA
[23:0]
7.2.2.6
ECC Debug Raw Data — This register contains the raw data which will be written into the system memory
during a debug write command or the read data from the debug read command.
ECC Debug ECC (ECCDE)
Access: User read/write(1)
Module Base + 0x000E
R
7
6
0
0
5
4
3
2
1
0
0
0
0
DECC[5:0]
W
Reset
0
0
0
0
0
1. Read: Anytime
Write: Anytime
Figure 7-7. ECC Debug ECC (ECCDE)
Table 7-7. ECCDE Field Description
Field
Description
5:0
ECC Debug ECC — This register contains the raw ECC value which will be written into the system memory
DECC[5:0] during a debug write command or the ECC read value from the debug read command.
MC9S12ZVM Family Reference Manual Rev. 1.3
236
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
7.2.2.7
ECC Debug Command (ECCDCMD)
Access: User read/write(1)
Module Base + 0x000F
7
R
6
5
4
3
2
0
0
0
0
0
ECCDRR
1
0
ECCDW
ECCDR
0
0
W
Reset
0
0
0
0
0
0
1. Read: Anytime
Write: Anytime, in special mode only
Figure 7-8. ECC Debug Command (ECCDCMD)
Table 7-8. ECCDCMD Field Description
Field
Description
7
ECC Disable Read Repair Function— Writing one to this register bit will disable the automatic single bit ECC
ECCDRR error repair function during read access; see also chapter 7.3.7, “ECC Debug Behavior”.
0 Automatic single ECC error repair function is enabled
1 Automatic single ECC error repair function is disabled
1
ECCDW
ECC Debug Write Command — Writing one to this register bit will perform a debug write access, to the system
memory. During this access the debug data word (DDATA) and the debug ECC value (DECC) will be written to
the system memory address defined by DPTR. If the debug write access is done, this bit is cleared. Writing 0
has no effect. It is not possible to set this bit if the previous debug access is ongoing (ECCDW or ECCDR bit set).
0
ECCDR
ECC Debug Read Command — Writing one to this register bit will perform a debug read access from the
system memory address defined by DPTR. If the debug read access is done, this bit is cleared and the raw
memory read data are available in register DDATA and the raw ECC value is available in register DECC. Writing
0 has no effect. If the ECCDW and ECCDR bit are set at the same time, then only the ECCDW bit is set and the
Debug Write Command is performed. It is not possible to set this bit if the previous debug access is ongoing
(ECCDW or ECCDR bit set).
7.3
Functional Description
The bus system allows 1, 2, 3 and 4 byte write access to a 4 byte aligned memory address, but the ECC
value is generated based on an aligned 2 byte data word. Depending on the access type, the access is
separated into different access cycles. Table 7-9 shows the different access types with the expected number
of access cycles and the performed internal operations.
Table 7-9. Memory access cycles
Access type
ECC
error
access
cycle
Internal operation
Memory
content
Error indication
2 and 4 byte
aligned write
access
—
1
write to memory
new data
—
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
237
Chapter 7 ECC Generation Module (SRAM_ECCV1)
Table 7-9. Memory access cycles
Access type
1 or 3 byte write,
non-aligned 2
byte write
read access
ECC
error
access
cycle
no
2
single
bit
2
double
bit
2
no
1
single
bit
1(1)
double
bit
1
Internal operation
Memory
content
Error indication
read data from the memory
write old + new data to the memory
read data from the memory
write corrected + new data to the
memory
read data from the memory
ignore write data
read from memory
read data from the memory
write corrected data back to memory
old + new
data
—
corrected +
new data
SBEEIF
unchanged
initiator module is
informed
unchanged
-
corrected
data
SBEEIF
read from memory
unchanged data mark as invalid
1. The next back to back read access to the memory will be delayed by one clock cycle
The single bit ECC error generates an interrupt when enabled. The double bit ECC errors are reported by
the SRAM_ECC module, but handled at MCU level. For more information, see the MMC description.
7.3.1
Aligned 2 and 4 Byte Memory Write Access
During an aligned 2 or 4 byte memory write access, no ECC check is performed. The internal ECC logic
generates the new ECC value based on the write data and writes the data words together with the generated
ECC values into the memory.
7.3.2
Other Memory Write Access
Other types of write accesses are separated into a read-modify-write operation. During the first cycle, the
logic reads the data from the memory and performs an ECC check. If no ECC errors were detected then
the logic generates the new ECC value based on the read and write data and writes the new data word
together with the new ECC value into the memory. If required both 2 byte data words are updated.
If the module detects a single bit ECC error during the read cycle, then the logic generates the new ECC
value based on the corrected read and new write read. In the next cycle, the new data word and the new
ECC value are written into the memory. If required both 2 byte data words are updated. The SBEEIF bit
is set. Hence, the single bit ECC error was corrected by the write access. Figure 7-9 shows an example of
a 2 byte non-aligned memory write access.
If the module detects a double bit ECC error during the read cycle, then the write access to the memory is
blocked and the initiator module is informed about the error.
MC9S12ZVM Family Reference Manual Rev. 1.3
238
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
.
2 byte use data
ECC
2 byte use data
read out data
and correct if
single bit ECC
error was found
4 byte read data from system memory
read out data
and correct if
single bit ECC
error was found
correct read data
correct read data
write data
correct
read data write data
ECC
write data
ECC
write data
2 byte write data
correct
read data ECC
4 byte write data to system memory
Figure 7-9. 2 byte non-aligned write access
7.3.3
Memory Read Access
During each memory read access an ECC check is performed. If the logic detects a single bit ECC error,
then the module corrects the data, so that the access initiator module receives correct data. In parallel, the
logic writes the corrected data back to the memory, so that this read access repairs the single bit ECC error.
This automatic ECC read repair function is disabled by setting the ECCDRR bit.
If a single bit ECC error was detected, then the SBEEIF flag is set.
If the logic detects a double bit ECC error, then the data word is flagged as invalid, so that the access
initiator module can ignore the data.
7.3.4
Memory Initialization
To avoid spurious ECC error reporting, memory operations that allow a read before a first write (like the
read-modify-write operation of the unaligned access) require that the memory contains valid ECC values
before the first read-modify-write access is performed. The ECC module provides logic to initialize the
complete memory content with zero during the power up phase. During the initialization process the access
to the SRAM is disabled and the RDY status bit is cleared. If the initialization process is done, SRAM
access is possible and the RDY status bit is set.
7.3.5
Interrupt Handling
This section describes the interrupts generated by the SRAM_ECC module and their individual sources.
Vector addresses and interrupt priority are defined at the MCU level.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
239
Chapter 7 ECC Generation Module (SRAM_ECCV1)
Table 7-10. SRAM_ECC Interrupt Sources
Module Interrupt Sources
Single bit ECC error
7.3.6
Local Enable
ECCIE[SBEEIE]
ECC Algorithm
The table below shows the equation for each ECC bit based on the 16 bit data word.
Table 7-11. ECC Calculation
7.3.7
ECC bit
Use data
ECC[0]
~ ( ^ ( data[15:0] & 0x443F ) )
ECC[1]
~ ( ^ ( data[15:0] & 0x13C7 ) )
ECC[2]
~ ( ^ ( data[15:0] & 0xE1D1 ) )
ECC[3]
~ ( ^ ( data[15:0] & 0xEE60 ) )
ECC[4]
~ ( ^ ( data[15:0] & 0x3E8A ) )
ECC[5]
~ ( ^ ( data[15:0] & 0x993C ) )
ECC Debug Behavior
For debug purposes, it is possible to read and write the uncorrected use data and the raw ECC value directly
from the memory. For these debug accesses a register interface is available. The debug access is performed
with the lowest priority; other memory accesses must be done before the debug access starts. If a debug
access is requested during an ongoing memory initialization process, then the debug access is performed
if the memory initialization process is done.
If the ECCDRR bit is set, then the automatic single bit ECC error repair function for all read accesses is
disabled. In this case a read access from a system memory location with single bit ECC error will produce
correct data and the single bit ECC error is flagged by the SBEEIF, but the data inside the system memory
are unchanged.
By writing wrong ECC values into the system memory the debug access can be used to force single and
double bit ECC errors to check the software error handling.
It is not possible to set the ECCDW or ECCDR bit if the previous debug access is ongoing (ECCDW or
ECCDR bit active). This ensures that the ECCDD and ECCDE registers contains consistent data. The
software should read out the status of the ECCDW and ECCDR register bit before a new debug access is
requested.
7.3.7.1
ECC Debug Memory Write Access
Writing one to the ECCDW bit performs a debug write access to the memory address defined by register
DPTR. During this access, the raw data DDATA and the ECC value DECC are written directly into the
system memory. If the debug write access is done, the ECCDW register bit is cleared. The debug write
MC9S12ZVM Family Reference Manual Rev. 1.3
240
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
access is always a 2 byte aligned memory access, so that no ECC check is performed and no single or
double bit ECC error indication is activated.
7.3.7.2
ECC Debug Memory Read Access
Writing one to the ECCDR bit performs a debug read access from the memory address defined by register
DPTR. If the ECCDR bit is cleared then the register DDATA contains the uncorrected read data from the
memory. The register DECC contains the ECC value read from the memory. Independent of the ECCDRR
register bit setting, the debug read access will not perform an automatic ECC repair during read access.
During the debug read access no ECC check is performed, so that no single or double bit ECC error
indication is activated.
If the ECCDW and the ECCDR bits are set at the same time, then only the debug write access is performed.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
241
Chapter 7 ECC Generation Module (SRAM_ECCV1)
MC9S12ZVM Family Reference Manual Rev. 1.3
242
Freescale Semiconductor
Chapter 8
S12 Clock, Reset and Power Management Unit
(S12CPMU_UHV_V6)
Revision History
Rev. No.
(Item No)
V06.02
V06.03
V06.04
V06.05
8.1
Date
(Submitted By)
20 Dec. 2012
18 June 2013
21 Aug. 2013
3 Jan. 2014
Sections Affected
Substantial Change(s)
• Format and font corrections
• Table 8-31. CPMUOSC2 Field Descriptions: removed Bit6 and
Bit4-0 description as these bits no longer exist.
• EXTCON register Bit: correct reset value to 1
• PMRF register Bit: corrected description
• Memory map: corrected address typo CPMUAPIRH register
•
•
•
•
corrected bit numbering for CSAD Bit
fPLLRST changed to fVCORST
corrected typo in heading of CPMUOSC2 Field Description
changed frequency upper limit of external Pierce Oscillator
(XOSCLCP) from 16MHz to 20MHz
• corrected description of CSAD Bit
Introduction
This specification describes the function of the Clock, Reset and Power Management Unit
(S12CPMU_UHV_V6).
• The Pierce oscillator (XOSCLCP) provides a robust, low-noise and low-power external clock
source. It is designed for optimal start-up margin with typical crystal oscillators.
• The Voltage regulator (VREGAUTO) operates from the range 6V to 18V. It provides all the
required chip internal voltages and voltage monitors.
• The Phase Locked Loop (PLL) provides a highly accurate frequency multiplier with internal filter.
• The Internal Reference Clock (IRC1M) provides a 1MHz internal clock.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
243
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1.1
Features
The Pierce Oscillator (XOSCLCP) contains circuitry to dynamically control current gain in the output
amplitude. This ensures a signal with low harmonic distortion, low power and good noise immunity.
• Supports crystals or resonators from 4MHz to 20MHz.
• High noise immunity due to input hysteresis and spike filtering.
• Low RF emissions with peak-to-peak swing limited dynamically
• Transconductance (gm) sized for optimum start-up margin for typical crystals
• Dynamic gain control eliminates the need for external current limiting resistor
• Integrated resistor eliminates the need for external bias resistor
• Low power consumption: Operates from internal 1.8V (nominal) supply, Amplitude control limits
power
• Optional oscillator clock monitor reset
• Optional full swing mode for higher immunity against noise injection on the cost of higher power
consumption and increased emission
The Voltage Regulator (VREGAUTO) has the following features:
• Input voltage range from 6 to 18V (nominal operating range)
• Low-voltage detect (LVD) with low-voltage interrupt (LVI)
• Power-on reset (POR)
• Low-voltage reset (LVR)
• On Chip Temperature Sensor and Bandgap Voltage measurement via internal ADC channel.
• Voltage Regulator providing Full Performance Mode (FPM) and Reduced Performance Mode
(RPM)
• External ballast device support to reduce internal power dissipation
• Capable of supplying both the MCU internally plus external components
• Over-temperature interrupt
The Phase Locked Loop (PLL) has the following features:
• Highly accurate and phase locked frequency multiplier
• Configurable internal filter for best stability and lock time
• Frequency modulation for defined jitter and reduced emission
• Automatic frequency lock detector
• Interrupt request on entry or exit from locked condition
• PLL clock monitor reset
• Reference clock either external (crystal) or internal square wave (1MHz IRC1M) based.
• PLL stability is sufficient for LIN communication in slave mode, even if using IRC1M as reference
clock
The Internal Reference Clock (IRC1M) has the following features:
MC9S12ZVM Family Reference Manual Rev. 1.3
244
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
•
•
Frequency trimming
(A factory trim value for 1MHz is loaded from Flash Memory into the IRCTRIM register after
reset, which can be overwritten by application if required)
Temperature Coefficient (TC) trimming.
(A factory trim value is loaded from Flash Memory into the IRCTRIM register to turn off TC
trimming after reset. Application can trim the TC if required by overwriting the IRCTRIM
register).
Other features of the S12CPMU_UHV_V6 include
• Oscillator clock monitor to detect loss of crystal
• Autonomous periodical interrupt (API)
• Bus Clock Generator
— Clock switch to select either PLLCLK or external crystal/resonator based Bus Clock
— PLLCLK divider to adjust system speed
• System Reset generation from the following possible sources:
— Power-on reset (POR)
— Low-voltage reset (LVR)
— COP time-out
— Loss of oscillation (Oscillator clock monitor fail)
— Loss of PLL clock (PLL clock monitor fail)
— External pin RESET
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
245
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1.2
Modes of Operation
This subsection lists and briefly describes all operating modes supported by the S12CPMU_UHV_V6.
8.1.2.1
Run Mode
The voltage regulator is in Full Performance Mode (FPM).
NOTE
The voltage regulator is active, providing the nominal supply voltages with
full current sourcing capability (see also Appendix for VREG electrical
parameters). The features ACLK clock source, Low Voltage Interrupt (LVI),
Low Voltage Reset (LVR) and Power-On Reset (POR) are available.
The Phase Locked Loop (PLL) is on.
The Internal Reference Clock (IRC1M) is on.
The API is available.
•
•
•
PLL Engaged Internal (PEI)
— This is the default mode after System Reset and Power-On Reset.
— The Bus Clock is based on the PLLCLK.
— After reset the PLL is configured for 50MHz VCOCLK operation.
Post divider is 0x03, so PLLCLK is VCOCLK divided by 4, that is 12.5MHz and Bus Clock is
6.25MHz.
The PLL can be re-configured for other bus frequencies.
— The reference clock for the PLL (REFCLK) is based on internal reference clock IRC1M.
PLL Engaged External (PEE)
— The Bus Clock is based on the PLLCLK.
— This mode can be entered from default mode PEI by performing the following steps:
– Configure the PLL for desired bus frequency.
– Program the reference divider (REFDIV[3:0] bits) to divide down oscillator frequency if
necessary.
– Enable the external oscillator (OSCE bit).
– Wait for oscillator to start up (UPOSC=1) and PLL to lock (LOCK=1).
PLL Bypassed External (PBE)
— The Bus Clock is based on the Oscillator Clock (OSCCLK).
— The PLLCLK is always on to qualify the external oscillator clock. Therefore it is necessary to
make sure a valid PLL configuration is used for the selected oscillator frequency.
— This mode can be entered from default mode PEI by performing the following steps:
– Make sure the PLL configuration is valid for the selected oscillator frequency.
MC9S12ZVM Family Reference Manual Rev. 1.3
246
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
– Enable the external oscillator (OSCE bit).
– Wait for oscillator to start up (UPOSC=1).
– Select the Oscillator Clock (OSCCLK) as source of the Bus Clock (PLLSEL=0).
— The PLLCLK is on and used to qualify the external oscillator clock.
8.1.2.2
Wait Mode
For S12CPMU_UHV_V6 Wait Mode is the same as Run Mode.
8.1.2.3
Stop Mode
This mode is entered by executing the CPU STOP instruction.
The voltage regulator is in Reduced Performance Mode (RPM).
NOTE
The voltage regulator output voltage may degrade to a lower value than in
Full Performance Mode (FPM), additionally the current sourcing capability
is substantially reduced (see also Appendix for VREG electrical
parameters). Only clock source ACLK is available and the Power On Reset
(POR) circuitry is functional. The Low Voltage Interrupt (LVI) and Low
Voltage Reset (LVR) are disabled.
The API is available.
The Phase Locked Loop (PLL) is off.
The Internal Reference Clock (IRC1M) is off.
Core Clock and Bus Clock are stopped.
Depending on the setting of the PSTP and the OSCE bit, Stop Mode can be differentiated between Full
Stop Mode (PSTP = 0 or OSCE=0) and Pseudo Stop Mode (PSTP = 1 and OSCE=1). In addition, the
behavior of the COP in each mode will change based on the clocking method selected by
COPOSCSEL[1:0].
• Full Stop Mode (PSTP = 0 or OSCE=0)
External oscillator (XOSCLCP) is disabled.
— If COPOSCSEL1=0:
The COP and RTI counters halt during Full Stop Mode.
After wake-up from Full Stop Mode the Core Clock and Bus Clock are running on PLLCLK
(PLLSEL=1). COP and RTI are running on IRCCLK (COPOSCSEL0=0, RTIOSCSEL=0).
— If COPOSCSEL1=1:
The clock for the COP is derived from ACLK (trimmable internal RC-Oscillator clock). During
Full Stop Mode the ACLK for the COP can be stopped (COP static) or running (COP active)
depending on the setting of bit CSAD. When bit CSAD is set the ACLK clock source for the
COP is stopped during Full Stop Mode and COP continues to operate after exit from Full Stop
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
247
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
•
Mode. For this COP configuration (ACLK clock source, CSAD set) a latency time (please refer
to CSAD bit description for details) occurs when entering or exiting (Full, Pseudo) Stop Mode.
When bit CSAD is clear the ACLK clock source is on for the COP during Full Stop Mode and
COP is operating.
During Full Stop Mode the RTI counter halts.
After wake-up from Full Stop Mode the Core Clock and Bus Clock are running on PLLCLK
(PLLSEL=1). The COP runs on ACLK and RTI is running on IRCCLK (COPOSCSEL0=0,
RTIOSCSEL=0).
Pseudo Stop Mode (PSTP = 1 and OSCE=1)
External oscillator (XOSCLCP) continues to run.
— If COPOSCSEL1=0:
If the respective enable bits are set (PCE=1 and PRE=1) the COP and RTI will continue to run
with a clock derived from the oscillator clock.
The clock configuration bits PLLSEL, COPOSCSEL0, RTIOSCSEL are unchanged.
— If COPOSCSEL1=1:
If the respective enable bit for the RTI is set (PRE=1) the RTI will continue to run with a clock
derived from the oscillator clock.
The clock for the COP is derived from ACLK (trimmable internal RC-Oscillator clock). During
Pseudo Stop Mode the ACLK for the COP can be stopped (COP static) or running (COP active)
depending on the setting of bit CSAD. When bit CSAD is set the ACLK for the COP is stopped
during Pseudo Stop Mode and COP continues to operate after exit from Pseudo Stop Mode.
For this COP configuration (ACLK clock source, CSAD set) a latency time (please refer to
CSAD bit description for details) occurs when entering or exiting (Pseudo, Full) Stop Mode.
When bit CSAD is clear the ACLK clock source is on for the COP during Pseudo Stop Mode
and COP is operating.
The clock configuration bits PLLSEL, COPOSCSEL0, RTIOSCSEL are unchanged.
NOTE
When starting up the external oscillator (either by programming OSCE bit
to 1 or on exit from Full Stop Mode with OSCE bit already 1) the software
must wait for a minimum time equivalent to the startup-time of the external
oscillator tUPOSC before entering Pseudo Stop Mode.
8.1.2.4
Freeze Mode (BDM active)
For S12CPMU_UHV_V6 Freeze Mode is the same as Run Mode except for RTI and COP which can be
frozen in Active BDM Mode with the RSBCK bit in the CPMUCOP register. After exiting BDM Mode
RTI and COP will resume its operations starting from this frozen status.
Additionally the COP can be forced to the maximum time-out period in Active BDM Mode. For details
please see also the RSBCK and CR[2:0] bit description field of Table 8-13 in Section 8.3.2.10,
“S12CPMU_UHV_V6 COP Control Register (CPMUCOP)
MC9S12ZVM Family Reference Manual Rev. 1.3
248
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1.3
S12CPMU_UHV_V6 Block Diagram
VSUP
vsup
monitor
ADC
VDDA
Low Voltage Detect VDDA
Low Voltage Detect
VSSA
VDDX
Voltage
VDDX, VDD, VDDF
Regulator
LVRF
6V to 18V
Power-On Detect
(VREGAUTO)
PORF
VSSX
VSS1,2
VDD
VDDF
VDDC
BCTL
BCTLC
LVIE Low Voltage Interrupt
LVDS
S12CPMU_UHV
COP time-out
COPRF
PMRF
OMRF
osc monitor fail
Power-On Reset
System Reset
Reset
Generator
PLL monitor fail
RESET
OSCCLK
OSCCLK
Monitor
EXTAL
Loop
Controlled
REFDIV[3:0]
IRCTRIM[9:0]
Pierce
XTAL Oscillator
Internal
(XOSCLCP)
Reference
Reference
4MHz-20MHz
Divider
Clock
(IRC1M)
PSTP
OSCMOD
IRCCLK
OSCCLK
UPOSC UPOSC=0 sets PLLSEL bit
REFCLK
FBCLK
Phase
locked
Loop with
internal
Filter (PLL)
Post
Divider
1,2,.32
divide
by 4
Oscillator status Interrupt
OSCIE
PLLSEL
POSTDIV[4:0]
OSCE
Lock
detect
IRCCLK
ECLK2X
(Core Clock)
PLLCLK
HTDS
High
Temperature
Sense
VCOFRQ[1:0]
LOCK
LOCKIE
Divide by
2*(SYNDIV+1)
ACLK
CSAD
SYNDIV[5:0]
divide
by 2
IRCCLK
COPOSCSEL1
Bus Clock
divide
by 2
Watchdog
UPOSC=0 clears
CPMUCOP
APIE
RTIE
RTICLK
PCE
Autonomous API_EXTCLK
Periodic
Interrupt (API)
APICLK
COP time-out
to Reset
Generator IRCCLK
OSCCLK
COPOSCSEL0
PLL lock interrupt
ACLK
RC
Osc.
COPCLK COP
HT Interrupt
HTIE
VCOCLK
REFFRQ[1:0]
UPOSC
ECLK
divide
by 2 (Bus Clock)
OSCCLK
RTIOSCSEL
API Interrupt
RTI Interrupt
Real Time
Interrupt (RTI)
PRE
CPMURTI
Figure 8-1. Block diagram of S12CPMU_UHV_V6
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
249
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
Figure 8-2 shows a block diagram of the XOSCLCP.
OSCMOD
Peak
Detector
Clock monitor fail
Monitor
+
_
Gain Control
OSCCLK
VDD=1.8V
VSS
Rf
Quartz Crystals
EXTAL
or
Ceramic Resonators
XTAL
C1
C2
VSS
VSS
Figure 8-2. XOSCLCP Block Diagram
MC9S12ZVM Family Reference Manual Rev. 1.3
250
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.2
Signal Description
This section lists and describes the signals that connect off chip as well as internal supply nodes and special
signals.
8.2.1
RESET
Pin RESET is an active-low bidirectional pin. As an input it initializes the MCU asynchronously to a
known start-up state. As an open-drain output it indicates that an MCU-internal reset has been triggered.
8.2.2
EXTAL and XTAL
These pins provide the interface for a crystal to control the internal clock generator circuitry. EXTAL is
the input to the crystal oscillator amplifier. XTAL is the output of the crystal oscillator amplifier. If
XOSCLCP is enabled, the MCU internal OSCCLK_LCP is derived from the EXTAL input frequency. If
OSCE=0, the EXTAL pin is pulled down by an internal resistor of approximately 200 kΩ and the XTAL
pin is pulled down by an internal resistor of approximately 700 kΩ.
NOTE
Freescale recommends an evaluation of the application board and chosen
resonator or crystal by the resonator or crystal supplier.
The loop controlled circuit (XOSCLCP) is not suited for overtone
resonators and crystals.
8.2.3
VSUP — Regulator Power Input Pin
Pin VSUP is the power input of VREGAUTO. All currents sourced into the regulator loads flow through
this pin.
A suitable reverse battery protection network can be used to connect VSUP to the car battery supply
network.
8.2.4
VDDA, VSSA — Regulator Reference Supply Pins
Pins VDDA and VSSA,are used to supply the analog parts of the regulator. Internal precision reference
circuits are supplied from these signals.
An off-chip decoupling capacitor (220 nF(X7R ceramic)) between VDDA and VSSA is required and can
improve the quality of this supply.
VDDA has to be connected externally to VDDX.
8.2.5
VDDX, VSSX— Pad Supply Pins
VDDX is the supply domain for the digital Pads.
An off-chip decoupling capacitor (10µF plus 220 nF(X7R ceramic)) between VDDX and VSSX is
required.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
251
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
This supply domain is monitored by the Low Voltage Reset circuit.
VDDX has to be connected externally to VDDA.
8.2.6
BCTL— Base Control Pin for external PNP
BCTL is the ballast connection for the on chip voltage regulator. It provides the base current of an external
BJT (PNP) of the VDDX and VDDA supplies. An additional 5.6KΩ resistor between emitter and base of
the BJT is required.
8.2.7
VSS1,2 — Core Ground Pins
VSS1,2 are the core logic supply return pins. They must be grounded.
8.2.8
VDD— Core Logic Supply Pin
VDD is the supply domain for the core logic.
An off-chip decoupling capacitor (220 nF(X7R ceramic)) between VDD and VSS is required and can
improve the quality of this supply.
This supply domain is monitored by the Low Voltage Reset circuit and The Power On Reset circuit.
8.2.9
VDDF— NVM Logic Supply Pin
VDDF is the supply domain for the NVM logic.
An off-chip decoupling capacitor (220 nF(X7R ceramic)) between VDDF and VSS is required and can
improve the quality of this supply.
This supply domain is monitored by the Low Voltage Reset circuit.
8.2.10
API_EXTCLK — API external clock output pin
This pin provides the signal selected via APIES and is enabled with APIEA bit. See the device
specification if this clock output is available on this device and to which pin it might be connected.
8.2.11
TEMPSENSE — Internal Temperature Sensor Output Voltage
Depending on the VSEL setting either the voltage level generated by the temperature sensor or the VREG
bandgap voltage is driven to a special channel input of the ADC Converter. See device level specification
for connectivity of ADC special channels.
MC9S12ZVM Family Reference Manual Rev. 1.3
252
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.3
Memory Map and Registers
This section provides a detailed description of all registers accessible in the S12CPMU_UHV_V6.
8.3.1
Module Memory Map
The S12CPMU_UHV_V6 registers are shown in Figure 8-3.
Address
Offset
Register
Name
Bit 7
6
5
4
3
2
1
Bit 0
0x0000
R
CPMU
RESERVED00 W
0
0
0
0
0
0
0
0
0x0001
R
CPMU
RESERVED01 W
0
0
0
0
0
0
0
0
0x0002
R
CPMU
RESERVED02 W
0
0
0
0
0
0
0
0
R
0
PORF
LVRF
OMRF
PMRF
0x0003
CPMURFLG
0x0004
CPMU
SYNR
0x0005
CPMU
REFDIV
0x0006
CPMU
POSTDIV
0x0007
CPMUIFLG
0x0008
CPMUINT
0x0009
CPMUCLKS
0x000A
CPMUPLL
0x000B
CPMURTI
0x000C
CPMUCOP
0x000D
RESERVED
CPMUTEST0
0x000E
RESERVED
CPMUTEST1
W
R
W
R
W
R
0
VCOFRQ[1:0]
REFFRQ[1:0]
0
COPRF
SYNDIV[5:0]
0
0
0
0
0
0
0
0
PLLSEL
PSTP
CSAD
COP
OSCSEL1
0
0
FM1
FM0
RTDEC
RTR6
RTR5
WCOP
RSBCK
0
0
0
0
0
REFDIV[3:0]
POSTDIV[4:0]
W
R
W
R
W
R
W
R
RTIF
RTIE
W
R
W
R
W
R
0
LOCK
0
0
0
PRE
PCE
RTI
OSCSEL
COP
OSCSEL0
0
0
0
0
RTR4
RTR3
RTR2
RTR1
RTR0
0
0
CR2
CR1
CR0
0
0
0
0
0
0
0
0
0
0
0
0
LOCKIF
LOCKIE
WRTMASK
OSCIF
OSCIE
UPOSC
0
W
R
W
= Unimplemented or Reserved
Figure 8-3. CPMU Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
253
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
Address
Offset
Register
Name
0x000F
CPMU
ARMCOP
0x0010
CPMU
HTCTL
0x0011
CPMU
LVCTL
0x0012
CPMU
APICTL
0x0013 CPMUACLKTR
0x0014
CPMUAPIRH
0x0015
CPMUAPIRL
0x0016
RESERVED
CPMUTEST3
0x0017
CPMUHTTR
0x0018
CPMU
IRCTRIMH
0x0019
CPMU
IRCTRIML
0x001A
CPMUOSC
0x001B
CPMUPROT
0x001C
RESERVED
CPMUTEST2
0x001D
CPMU
VREGCTL
0x001E
CPMUOSC2
0x001F
Bit 7
6
5
4
3
2
1
Bit 0
R
0
0
0
0
0
0
0
0
W
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
R
0
0
HTIE
HTIF
0
0
0
LVIE
LVIF
0
0
APIE
APIF
ACLKTR5
ACLKTR4
ACLKTR3
0
0
APIR15
APIR14
APIR13
APIR12
APIR11
APIR10
APIR9
APIR8
APIR7
APIR6
APIR5
APIR4
APIR3
APIR2
APIR1
APIR0
0
0
0
0
0
0
0
0
0
0
0
HTTR3
HTTR2
HTTR1
HTTR0
W
R
VSEL
0
HTE
HTDS
0
0
LVDS
APIES
APIEA
APIFE
W
R
W
R
W
R
W
R
W
R
APICLK
ACLKTR2 ACLKTR1 ACLKTR0
W
R
W
HTOE
R
W
R
W
R
IRCTRIM[9:8]
IRCTRIM[7:0]
W
R
0
TCTRIM[4:0]
OSCE
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
EXTCON
EXTXON
INTXON
OMRE
OSCMOD
0
0
Reserved
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
R
W
R
W
R
W
R
CPMU
RESERVED1F W
0
PROT
0
= Unimplemented or Reserved
Figure 8-3. CPMU Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.3
254
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.3.2
Register Descriptions
This section describes all the S12CPMU_UHV_V6 registers and their individual bits.
Address order is as listed in Figure 8-3
8.3.2.1
S12CPMU_UHV_V6 Reset Flags Register (CPMURFLG)
This register provides S12CPMU_UHV_V6 reset flags.
Module Base + 0x0003
7
R
6
5
PORF
LVRF
Note 1
Note 2
0
4
3
0
2
1
0
OMRF
PMRF
Note 4
Note 5
0
COPRF
W
Reset
0
0
Note 3
0
1. PORF is set to 1 when a power on reset occurs. Unaffected by System Reset.
2. LVRF is set to 1 when a low voltage reset occurs. Unaffected by System Reset. Set by power on reset.
3. COPRF is set to 1 when COP reset occurs. Unaffected by System Reset. Cleared by power on reset.
4. OMRF is set to 1 when an oscillator clock monitor reset occurs. Unaffected by System Reset. Cleared by power on reset.
5. PMRF is set to 1 when a PLL clock monitor reset occurs. Unaffected by System Reset. Cleared by power on reset.
= Unimplemented or Reserved
Figure 8-4. S12CPMU_UHV_V6 Flags Register (CPMURFLG)
Read: Anytime
Write: Refer to each bit for individual write conditions
Table 8-1. CPMURFLG Field Descriptions
Field
Description
6
PORF
Power on Reset Flag — PORF is set to 1 when a power on reset occurs. This flag can only be cleared by writing
a 1. Writing a 0 has no effect.
0 Power on reset has not occurred.
1 Power on reset has occurred.
5
LVRF
Low Voltage Reset Flag — LVRF is set to 1 when a low voltage reset occurs. This flag can only be cleared by
writing a 1. Writing a 0 has no effect.
0 Low voltage reset has not occurred.
1 Low voltage reset has occurred.
3
COPRF
COP Reset Flag — COPRF is set to 1 when a COP (Computer Operating Properly) reset occurs. Refer to 8.5.5,
“Computer Operating Properly Watchdog (COP) Reset and 8.3.2.10, “S12CPMU_UHV_V6 COP Control
Register (CPMUCOP) for details.This flag can only be cleared by writing a 1. Writing a 0 has no effect.
0 COP reset has not occurred.
1 COP reset has occurred.
MC9S12ZVM Family Reference Manual Rev. 1.3
Freescale Semiconductor
255
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
Table 8-1. CPMURFLG Field Descriptions (continued)
Field
Description
1
OMRF
Oscillator Clock Monitor Reset Flag — OMRF is set to 1 when a loss of oscillator (crystal) clock occurs. Refer
to8.5.3, “Oscillator Clock Monitor Reset for details.This flag can only be cleared by writing a 1. Writing a 0 has
no effect.
0 Loss of oscillator clock reset has not occurred.
1 Loss of oscillator clock reset has occurred.
0
PMRF
PLL Clock Monitor Reset Flag — PMRF is set to 1 when a loss of PLL clock occurs. This flag can only be
cleared by writing a 1. Writing a 0 has no effect.
0 Loss of PLL clock reset has not occurred.
1 Loss of PLL clock reset has occurred.
8.3.2.2
S12CPMU_UHV_V6 Synthesizer Register (CPMUSYNR)
The CPMUSYNR register controls the multiplication factor of the PLL and selects the VCO frequency
range.
Module Base + 0x0004
7
6
5
4
3
2
1
0
0
0
0
R
VCOFRQ[1:0]
SYNDIV[5:0]
W
Reset
0
1
0
1
1
Figure 8-5. S12CPMU_UHV_V6 Synthesizer Register (CPMUSYNR)
Read: Anytime
Write: If PROT=0 (CPMUPROT register) and PLLSEL=1 (CPMUCLKS register), then write anytime.
Else write has no effect.
NOTE
Writing to this register clears the LOCK and UPOSC status bits.
If PLL has locked (LOCK=1)
f VCO = 2 × f REF × ( SYNDIV + 1 )
NOTE
fVCO must be within the specified VCO frequency lock range. Bus
frequency fbus must not exceed the specified maximum.
The VCOFRQ[1:0] bits are used to configure the VCO gain for optimal stability and lock time. For correct
PLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK
MC9S12ZVM Family Reference Manual Rev. 1.3
256
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
frequency as shown in Table 8-2. Setting the VCOFRQ[1:0] bits incorrectly can result in a non functional
PLL (no locking and/or insufficient stability).
Table 8-2. VCO Clock Frequency Selection
8.3.2.3
VCOCLK Frequency Ranges
VCOFRQ[1:0]
32MHz
工商网监
湘ICP备2023018690号
