S9S12XS256J0MALR

MC9S12XS256 Reference Manual Covers MC9S12XS Family MC9S12XS256 MC9S12XS128 MC9S12XS64 HCS12 Microcontrollers MC9S12XS256RMV1 Rev. 1.13 08/2012 freescale.com To provide the most up-to-date information, the document revision on the World Wide Web is the most current. A printed copy may be an earlier revision. To verify you have the latest information available, refer to freescale.com. This document contains information for the complete S12XS Family and thus includes a set of separate flash (FTMR) module sections to cover the whole family. A full list of family members and options is included in the appendices. This document contains information for all constituent modules, with the exception of the CPU. For CPU information please refer to CPU12XV1 in the CPU12/CPU12X Reference Manual. Revision History Date November, 2010 Jul, 2011 Aug, 2012 Revision Level Description 1.11 Updated Chapter 3 Memory Mapping Control (S12XMMCV4) Updated Chapter 11 Freescale’s Scalable Controller Area Network (S12MSCANV3) Updated Chapter 14 Serial Communication Interface (S12SCIV5) Updated footnotes on table 1-2 Updated note in Appendix F Ordering Information 1.12 Corrected API accuracy in feature list Corrected name of pin #27 in 80QFP pinout (PE5->PE4) Updated Chapter 2 Port Integration Module (S12XSPIMV1) Updated Chapter 11 Freescale’s Scalable Controller Area Network (S12MSCANV3) 1.13 Updated Chapter 4 Interrupt (S12XINTV2) Updated Chapter 8 S12XE Clocks and Reset Generator (S12XECRGV1) Updated VDDF max. voltage in Appendix A Electrical Characteristics Minor editorial corrections in: Chapter 2 Port Integration Module (S12XSPIMV1) Chapter 5 Background Debug Module (S12XBDMV2) Chapter 6 S12X Debug (S12XDBGV3) Module Chapter 1 Device Overview S12XS Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 Chapter 2 Port Integration Module (S12XSPIMV1) . . . . . . . . . . . . . . . . . . . . . . . . . . .59 Chapter 3 Memory Mapping Control (S12XMMCV4) . . . . . . . . . . . . . . . . . . . . . . . .127 Chapter 4 Interrupt (S12XINTV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .151 Chapter 5 Background Debug Module (S12XBDMV2) . . . . . . . . . . . . . . . . . . . . . . .169 Chapter 6 S12X Debug (S12XDBGV3) Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195 Chapter 7 Security (S12XS9SECV2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .231 Chapter 8 S12XE Clocks and Reset Generator (S12XECRGV1) . . . . . . . . . . . . . . .237 Chapter 9 Pierce Oscillator (S12XOSCLCPV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . .267 Chapter 10 Analog-to-Digital Converter (ADC12B16CV1) . . . . . . . . . . . . . . . . . . . . .271 Chapter 11 Freescale’s Scalable Controller Area Network (S12MSCANV3) . . . . . .295 Chapter 12 Periodic Interrupt Timer (S12PIT24B4CV1) . . . . . . . . . . . . . . . . . . . . . . .349 Chapter 13 Pulse-Width Modulator (S12PWM8B8CV1) . . . . . . . . . . . . . . . . . . . . . . .365 Chapter 14 Serial Communication Interface (S12SCIV5) . . . . . . . . . . . . . . . . . . . . . .397 Chapter 15 Serial Peripheral Interface (S12SPIV5) . . . . . . . . . . . . . . . . . . . . . . . . . . .435 Chapter 16 Timer Module (TIM16B8CV2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .461 Chapter 17 Voltage Regulator (S12VREGL3V3V1) . . . . . . . . . . . . . . . . . . . . . . . . . . .489 Chapter 18 256 KByte Flash Module (S12XFTMR256K1V1). . . . . . . . . . . . . . . . . . . .507 Chapter 19 128 KByte Flash Module (S12XFTMR128K1V1). . . . . . . . . . . . . . . . . . . .557 Chapter 20 64 KByte Flash Module (S12XFTMR64K1V1). . . . . . . . . . . . . . . . . . . . . .607 Appendix A Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .657 Appendix B Package Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .698 Appendix C PCB Layout Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .708 Appendix D Derivative Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .712 Appendix E Detailed Register Address Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .713 Appendix F Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .735 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 3 S12XS Family Reference Manual, Rev. 1.13 4 Freescale Semiconductor Chapter 1 Device Overview S12XS Family 1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.1.4 Device Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.1.5 Address Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.1.6 Detailed Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.1.7 Part ID Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.2.1 Device Pinout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.2.2 Pin Assignment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.2.3 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.2.4 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.3 System Clock Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1.4.1 Chip Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1.4.2 Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.4.3 Freeze Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.6 Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.6.1 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.6.2 Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.6.3 Effects of Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.7 ATD0 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.7.1 External Trigger Input Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.7.2 ATD0 Channel[17] Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.8 VREG Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.8.1 Temperature Sensor Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.9 BDM Clock Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.10 Oscillator Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Chapter 2 Port Integration Module (S12XSPIMV1) 2.1 2.2 2.3 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 2.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 2.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 5 2.3.1 2.3.2 2.3.3 2.3.4 2.3.5 2.3.6 2.3.7 2.3.8 2.3.9 2.3.10 2.3.11 2.3.12 2.3.13 2.3.14 2.3.15 2.3.16 2.3.17 2.3.18 2.3.19 2.3.20 2.3.21 2.3.22 2.3.23 2.3.24 2.3.25 2.3.26 2.3.27 2.3.28 2.3.29 2.3.30 2.3.31 2.3.32 2.3.33 2.3.34 2.3.35 2.3.36 2.3.37 2.3.38 2.3.39 2.3.40 2.3.41 2.3.42 2.3.43 2.3.44 2.3.45 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Port A Data Register (PORTA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Port B Data Register (PORTB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Port A Data Direction Register (DDRA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Port B Data Direction Register (DDRB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 PIM Reserved Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Port E Data Register (PORTE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Port E Data Direction Register (DDRE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Ports ABEK, BKGD pin Pull-up Control Register (PUCR) . . . . . . . . . . . . . . . . . . . . . . 79 Ports ABEK Reduced Drive Register (RDRIV) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 ECLK Control Register (ECLKCTL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 IRQ Control Register (IRQCR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 PIM Reserved Register PIMTEST . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Port K Data Register (PORTK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Port K Data Direction Register (DDRK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Port T Data Register (PTT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Port T Input Register (PTIT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Port T Data Direction Register (DDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Port T Reduced Drive Register (RDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Port T Pull Device Enable Register (PERT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Port T Polarity Select Register (PPST) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Port T Routing Register (PTTRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Port S Data Register (PTS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Port S Input Register (PTIS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Port S Data Direction Register (DDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Port S Reduced Drive Register (RDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Port S Pull Device Enable Register (PERS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Port S Polarity Select Register (PPSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Port S Wired-Or Mode Register (WOMS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Port M Data Register (PTM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Port M Input Register (PTIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Port M Data Direction Register (DDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Port M Reduced Drive Register (RDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Port M Pull Device Enable Register (PERM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Port M Polarity Select Register (PPSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Port M Wired-Or Mode Register (WOMM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Module Routing Register (MODRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Port P Data Register (PTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Port P Input Register (PTIP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Port P Data Direction Register (DDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Port P Reduced Drive Register (RDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 S12XS Family Reference Manual, Rev. 1.13 6 Freescale Semiconductor 2.4 2.5 2.3.46 Port P Pull Device Enable Register (PERP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 2.3.47 Port P Polarity Select Register (PPSP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 2.3.48 Port P Interrupt Enable Register (PIEP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 2.3.49 Port P Interrupt Flag Register (PIFP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.50 Port H Data Register (PTH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.51 Port H Input Register (PTIH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.52 Port H Data Direction Register (DDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.53 Port H Reduced Drive Register (RDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 2.3.54 Port H Pull Device Enable Register (PERH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 2.3.55 Port H Polarity Select Register (PPSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.56 Port H Interrupt Enable Register (PIEH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.57 Port H Interrupt Flag Register (PIFH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 2.3.58 Port J Data Register (PTJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 2.3.59 Port J Input Register (PTIJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.3.60 Port J Data Direction Register (DDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.3.61 Port J Reduced Drive Register (RDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 2.3.62 Port J Pull Device Enable Register (PERJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 2.3.63 Port J Polarity Select Register (PPSJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 2.3.64 Port J Interrupt Enable Register (PIEJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 2.3.65 Port J Interrupt Flag Register (PIFJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 2.3.66 Port AD0 Data Register 0 (PT0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 2.3.67 Port AD0 Data Register 1 (PT1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 2.3.68 Port AD0 Data Direction Register 0 (DDR0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 2.3.69 Port AD0 Data Direction Register 1 (DDR1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 2.3.70 Port AD0 Reduced Drive Register 0 (RDR0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 2.3.71 Port AD0 Reduced Drive Register 1 (RDR1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.72 Port AD0 Pull Up Enable Register 0 (PER0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.73 Port AD0 Pull Up Enable Register 1 (PER1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.3.74 PIM Reserved Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.4.2 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2.4.3 Pins and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.4.4 Pin interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.5.1 Port Data and Data Direction Register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Chapter 3 Memory Mapping Control (S12XMMCV4) 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 3.1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 3.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 3.1.3 S12X Memory Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 3.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 3.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 7 3.2 3.3 3.4 3.5 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 3.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 3.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 3.4.1 MCU Operating Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 3.4.2 Memory Map Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 3.4.3 Chip Bus Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 3.5.1 CALL and RTC Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Chapter 4 Interrupt (S12XINTV2) 4.1 4.2 4.3 4.4 4.5 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 4.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 4.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 4.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 4.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 4.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 4.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 4.4.1 S12X Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 4.4.2 Interrupt Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 4.4.3 XGATE Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 4.4.4 Priority Decoders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 4.4.5 Reset Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 4.4.6 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 4.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 4.5.2 Interrupt Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 4.5.3 Wake Up from Stop or Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Chapter 5 Background Debug Module (S12XBDMV2) 5.1 5.2 5.3 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 5.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 5.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 5.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 5.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 5.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 S12XS Family Reference Manual, Rev. 1.13 8 Freescale Semiconductor 5.4 5.3.3 Family ID Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 5.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 5.4.2 Enabling and Activating BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 5.4.3 BDM Hardware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 5.4.4 Standard BDM Firmware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 5.4.5 BDM Command Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 5.4.6 BDM Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 5.4.7 Serial Interface Hardware Handshake Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 5.4.8 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 5.4.9 SYNC — Request Timed Reference Pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 5.4.10 Instruction Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 5.4.11 Serial Communication Time Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Chapter 6 S12X Debug (S12XDBGV3) Module 6.1 6.2 6.3 6.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 6.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 6.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 6.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 6.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 6.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 6.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 6.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 6.4.1 S12XDBG Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 6.4.2 Comparator Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 6.4.3 Trigger Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 6.4.4 State Sequence Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 6.4.5 Trace Buffer Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 6.4.6 Tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 6.4.7 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Chapter 7 Security (S12XS9SECV2) 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 7.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 7.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 7.1.3 Securing the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 7.1.4 Operation of the Secured Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 7.1.5 Unsecuring the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 7.1.6 Reprogramming the Security Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 9 7.1.7 Complete Memory Erase (Special Modes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 Chapter 8 S12XE Clocks and Reset Generator (S12XECRGV1) 8.1 8.2 8.3 8.4 8.5 8.6 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 8.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 8.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238 8.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 8.2.1 VDDPLL, VSSPLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 8.2.2 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 8.4.1 Functional Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 8.4.2 Operation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 8.4.3 Low Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 8.5.1 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 8.6.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 Chapter 9 Pierce Oscillator (S12XOSCLCPV2) 9.1 9.2 9.3 9.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 9.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 9.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 9.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 9.2.1 VDDPLL and VSSPLL — Operating and Ground Voltage Pins . . . . . . . . . . . . . . . . . . . . 268 9.2.2 EXTAL and XTAL — Input and Output Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 9.4.1 Gain Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 9.4.2 Clock Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 9.4.3 Wait Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 9.4.4 Stop Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 Chapter 10 Analog-to-Digital Converter (ADC12B16CV1) 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 10.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 10.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 S12XS Family Reference Manual, Rev. 1.13 10 Freescale Semiconductor 10.2 10.3 10.4 10.5 10.6 10.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 10.1.4 Block Diagram of Input structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 10.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 10.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 10.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292 10.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292 10.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 Chapter 11 Freescale’s Scalable Controller Area Network (S12MSCANV3) 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295 11.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 11.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 11.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 11.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 11.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 11.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 11.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 11.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 11.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 11.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 11.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 11.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 11.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 11.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 11.4.3 Identifier Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334 11.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340 11.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342 11.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 11.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 11.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 11.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 11.5.2 Bus-Off Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 Chapter 12 Periodic Interrupt Timer (S12PIT24B4CV1) 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 12.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 11 12.2 12.3 12.4 12.5 12.6 12.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 12.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 12.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350 Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360 12.4.1 Timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360 12.4.2 Interrupt Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361 12.4.3 Hardware Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362 12.5.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362 12.5.2 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362 12.5.3 Flag Clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363 Chapter 13 Pulse-Width Modulator (S12PWM8B8CV1) 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365 13.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365 13.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 13.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 13.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 13.2.1 PWM7 — PWM Channel 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.2.2 PWM6 — PWM Channel 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.2.3 PWM5 — PWM Channel 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.2.4 PWM4 — PWM Channel 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.2.5 PWM3 — PWM Channel 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.2.6 PWM3 — PWM Channel 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.2.7 PWM3 — PWM Channel 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.2.8 PWM3 — PWM Channel 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 13.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368 13.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383 13.4.1 PWM Clock Select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383 13.4.2 PWM Channel Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386 13.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 13.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 Chapter 14 Serial Communication Interface (S12SCIV5) 14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397 14.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397 14.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398 S12XS Family Reference Manual, Rev. 1.13 12 Freescale Semiconductor 14.2 14.3 14.4 14.5 14.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398 14.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 14.2.1 TXD — Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 14.2.2 RXD — Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 14.3.1 Module Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 14.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413 14.4.1 Infrared Interface Submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414 14.4.2 LIN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414 14.4.3 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415 14.4.4 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416 14.4.5 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 14.4.6 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 14.4.7 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430 14.4.8 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431 14.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431 14.5.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431 14.5.3 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432 14.5.4 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434 14.5.5 Recovery from Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434 Chapter 15 Serial Peripheral Interface (S12SPIV5) 15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435 15.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435 15.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435 15.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435 15.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436 15.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437 15.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437 15.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437 15.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438 15.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438 15.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438 15.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438 15.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439 15.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447 15.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 15.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449 15.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450 15.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455 15.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 13 15.4.6 Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 15.4.7 Low Power Mode Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458 Chapter 16 Timer Module (TIM16B8CV2) 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 16.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 16.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462 16.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 16.2.1 IOC7 — Input Capture and Output Compare Channel 7 Pin . . . . . . . . . . . . . . . . . . . . 465 16.2.2 IOC6 — Input Capture and Output Compare Channel 6 Pin . . . . . . . . . . . . . . . . . . . . 465 16.2.3 IOC5 — Input Capture and Output Compare Channel 5 Pin . . . . . . . . . . . . . . . . . . . . 465 16.2.4 IOC4 — Input Capture and Output Compare Channel 4 Pin . . . . . . . . . . . . . . . . . . . . 465 16.2.5 IOC3 — Input Capture and Output Compare Channel 3 Pin . . . . . . . . . . . . . . . . . . . . 465 16.2.6 IOC2 — Input Capture and Output Compare Channel 2 Pin . . . . . . . . . . . . . . . . . . . . 465 16.2.7 IOC1 — Input Capture and Output Compare Channel 1 Pin . . . . . . . . . . . . . . . . . . . . 466 16.2.8 IOC0 — Input Capture and Output Compare Channel 0 Pin . . . . . . . . . . . . . . . . . . . . 466 16.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483 16.4.1 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 16.4.2 Input Capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485 16.4.3 Output Compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485 16.4.4 Pulse Accumulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486 16.4.5 Event Counter Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486 16.4.6 Gated Time Accumulation Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487 16.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487 16.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487 16.6.1 Channel [7:0] Interrupt (C[7:0]F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488 16.6.2 Pulse Accumulator Input Interrupt (PAOVI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488 16.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488 16.6.4 Timer Overflow Interrupt (TOF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488 Chapter 17 Voltage Regulator (S12VREGL3V3V1) 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 17.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 17.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 17.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490 17.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492 17.2.1 VDDR — Regulator Power Input Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492 17.2.2 VDDA, VSSA — Regulator Reference Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 492 S12XS Family Reference Manual, Rev. 1.13 14 Freescale Semiconductor 17.2.3 VDD, VSS — Regulator Output1 (Core Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . 492 17.2.4 VDDF — Regulator Output2 (NVM Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493 17.2.5 VDDPLL, VSSPLL — Regulator Output3 (PLL) Pins . . . . . . . . . . . . . . . . . . . . . . . . . 493 17.2.6 VDDX — Power Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493 17.2.7 VREGEN — Optional Regulator Enable Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493 17.2.8 VREG_API — Optional Autonomous Periodical Interrupt Output Pin . . . . . . . . . . . . . . 493 17.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493 17.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494 17.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495 17.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 17.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 17.4.2 Regulator Core (REG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 17.4.3 Low-Voltage Detect (LVD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 17.4.4 Power-On Reset (POR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 17.4.5 Low-Voltage Reset (LVR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 17.4.6 HTD - High Temperature Detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 17.4.7 Regulator Control (CTRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 17.4.8 Autonomous Periodical Interrupt (API) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 17.4.9 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 17.4.10Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 17.4.11Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 Chapter 18 256 KByte Flash Module (S12XFTMR256K1V1) 18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507 18.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508 18.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508 18.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509 18.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510 18.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510 18.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511 18.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514 18.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 18.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 18.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 18.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553 18.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554 18.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554 18.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554 18.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554 18.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 555 18.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 556 18.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 15 Chapter 19 128 KByte Flash Module (S12XFTMR128K1V1) 19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557 19.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558 19.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558 19.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559 19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560 19.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560 19.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561 19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564 19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585 19.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585 19.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590 19.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 19.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 19.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 19.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 19.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 19.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 605 19.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 606 19.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 Chapter 20 64 KByte Flash Module (S12XFTMR64K1V1) 20.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 20.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 20.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 20.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 20.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 20.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 20.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 20.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615 20.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 20.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 20.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640 20.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653 20.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654 20.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654 20.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654 20.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655 20.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 655 20.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 656 20.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 S12XS Family Reference Manual, Rev. 1.13 16 Freescale Semiconductor Appendix A Electrical Characteristics A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 A.1.1 Parameter Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 A.1.2 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 A.1.3 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 A.1.4 Current Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 A.1.5 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 A.1.6 ESD Protection and Latch-up Immunity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660 A.1.7 Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661 A.1.8 Power Dissipation and Thermal Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662 A.1.9 I/O Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666 A.1.10 Supply Currents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669 A.2 ATD Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673 A.2.1 ATD Operating Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673 A.2.2 Factors Influencing Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673 A.2.3 ATD Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 A.3 NVM, Flash. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679 A.3.1 Timing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679 A.3.2 NVM Reliability Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683 A.4 Voltage Regulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685 A.5 Output Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686 A.5.1 Resistive Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686 A.5.2 Capacitive Loads. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686 A.5.3 Chip Power-up and Voltage Drops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686 A.6 Reset, Oscillator and PLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 A.6.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 A.6.2 Oscillator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690 A.6.3 Phase Locked Loop. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 A.7 MSCAN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 A.8 SPI Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694 A.8.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694 A.8.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696 Appendix B Package Information B.1 112-pin LQFP Mechanical Dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699 B.2 80-Pin QFP Mechanical Dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 702 B.3 64-Pin LQFP Mechanical Dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705 Appendix C PCB Layout Guidelines C.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708 C.1.1 112-Pin LQFP Recommended PCB Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 17 C.1.2 80-Pin QFP Recommended PCB Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 710 C.1.3 64-Pin LQFP Recommended PCB Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711 Appendix D Derivative Differences D.1 Memory Sizes and Package Options S12XS family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 712 Appendix E Detailed Register Address Map E.1 Detailed Register Map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713 Appendix F Ordering Information F.1 Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 735 S12XS Family Reference Manual, Rev. 1.13 18 Freescale Semiconductor Chapter 1 Device Overview S12XS Family 1.1 Introduction The new S12XS family of 16-bit micro controllers is a compatible, reduced version of the S12XE family. These families provide an easy approach to develop common platforms from low-end to high-end applications, minimizing the redesign of software and hardware. Targeted at generic automotive applications and CAN nodes, some typical examples of these applications are: Body Controllers, Occupant Detection, Door Modules, RKE Receivers, Smart Actuators, Lighting Modules and Smart Junction Boxes amongst many others. The S12XS family retains many of the features of the S12XE family including Error Correction Code (ECC) on Flash memory, a separate Data-Flash Module for code or data storage, a Frequency Modulated Locked Loop (IPLL) that improves the EMC performance and a fast ATD converter. S12XS family delivers 32-bit performance with all the advantages and efficiencies of a 16-bit MCU while retaining the low cost, power consumption, EMC and code-size efficiency advantages currently enjoyed by users of Freescale’s existing 16-bit S12 and S12X MCU families. Like members of other S12X families, the S12XS family runs 16-bit wide accesses without wait states for all peripherals and memories. The S12XS family is available in 112-pin LQFP, 80-pin QFP, 64-pin LQFP package options and maintains a high level of pin compatibility with the S12XE family. In addition to the I/O ports available in each module, up to 18 further I/O ports are available with interrupt capability allowing Wake-Up from stop or wait modes. The peripheral set includes MSCAN, SPI, two SCIs, an 8-channel 24-bit periodic interrupt timer, 8channel 16-bit Timer, 8-channel PWM and up to 16- channel 12-bit ATD converter. Software controlled peripheral-to-port routing enables access to a flexible mix of the peripheral modules in the lower pin count package options. 1.1.1 Features Features of the S12XS Family are listed here. Please see Table D-1 for memory options and Table D-2 for the peripheral features that are available on the different family members. • 16-bit CPU12X — Upward compatible with S12 instruction set with the exception of five Fuzzy instructions (MEM, WAV, WAVR, REV, REVW) which have been removed — Enhanced indexed addressing — Access to large data segments independent of PPAGE S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 19 Device Overview S12XS Family • • • • • • • • INT (interrupt module) — Seven levels of nested interrupts — Flexible assignment of interrupt sources to each interrupt level. — External non-maskable high priority interrupt (XIRQ) — The following inputs can act as Wake-up Interrupts – IRQ and non-maskable XIRQ – CAN receive pins – SCI receive pins – Depending on the package option up to 20 pins on ports J, H and P configurable as rising or falling edge sensitive MMC (module mapping control) DBG (debug module) — Monitoring of CPU bus with tag-type or force-type breakpoint requests — 64 x 64-bit circular trace buffer captures change-of-flow or memory access information BDM (background debug mode) OSC_LCP (oscillator) — Low power loop control Pierce oscillator utilizing a 4MHz to 16MHz crystal — Good noise immunity — Full-swing Pierce option utilizing a 2MHz to 40MHz crystal — Transconductance sized for optimum start-up margin for typical crystals IPLL (Internally filtered, frequency modulated phase-locked-loop clock generation) — No external components required — Configurable option to spread spectrum for reduced EMC radiation (frequency modulation) CRG (clock and reset generation) — COP watchdog — Real time interrupt — Clock monitor — Fast wake up from STOP in self clock mode Memory Options — 64, 128 and 256 Kbyte Flash — Flash General Features – 64 data bits plus 8 syndrome ECC (Error Correction Code) bits allow single bit failure correction and double fault detection – Erase sector size 1024 bytes – Automated program and erase algorithm – Protection scheme to prevent accidental program or erase – Security option to prevent unauthorized access – Sense-amp margin level setting for reads — 4 and 8 Kbyte Data Flash space S12XS Family Reference Manual, Rev. 1.13 20 Freescale Semiconductor Device Overview S12XS Family • • • • – 16 data bits plus 6 syndrome ECC (Error Correction Code) bits allow single bit failure correction and double fault detection – Erase sector size 256 bytes – Automated program and erase algorithm — 4, 8 and 12 Kbyte RAM 16-channel, 12-bit Analog-to-Digital converter — 8/10/12 Bit resolution — 3µs, 10-bit single conversion time — Left or right justified result data — External and internal conversion trigger capability — Internal oscillator for conversion in Stop modes — Wake from low power modes on analog comparison > or Addmax Two types of triggers — Tagged — This triggers just before a specific instruction begins execution — Force — This triggers on the first instruction boundary after a match occurs. The following types of breakpoints — CPU12X breakpoint entering BDM on breakpoint (BDM) — CPU12X breakpoint executing SWI on breakpoint (SWI) TRIG Immediate software trigger independent of comparators Four trace modes S12XS Family Reference Manual, Rev. 1.13 196 Freescale Semiconductor S12X Debug (S12XDBGV3) Module — Normal: change of flow (COF) PC information is stored (see Section 6.4.5.2.1) for change of flow definition. — Loop1: same as Normal but inhibits consecutive duplicate source address entries — Detail: address and data for all cycles except free cycles and opcode fetches are stored — Pure PC: All program counter addresses are stored. 4-stage state sequencer for trace buffer control — Tracing session trigger linked to Final State of state sequencer — Begin, End, and Mid alignment of tracing to trigger • 6.1.4 Modes of Operation The S12XDBG module can be used in all MCU functional modes. During BDM hardware accesses and whilst the BDM module is active, CPU12X monitoring is disabled. Thus breakpoints, comparators, and CPU12X bus tracing are disabled . When the CPU12X enters active BDM Mode through a BACKGROUND command, with the S12XDBG module armed, the S12XDBG remains armed. The S12XDBG module tracing is disabled if the MCU is secure. However, breakpoints can still be generated if the MCU is secure. Table 6-3. Mode Dependent Restriction Summary BDM Enable BDM Active MCU Secure Comparator Matches Enabled Breakpoints Possible Tagging Possible Tracing Possible x x 1 Yes Yes Yes No 0 0 0 Yes Only SWI Yes Yes 0 1 0 1 0 0 Yes Yes Yes Yes 1 1 0 No No No No Active BDM not possible when not enabled S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 197 S12X Debug (S12XDBGV3) Module 6.1.5 Block Diagram TAGS TAGHITS BREAKPOINT REQUESTS S12XCPU SECURE COMPARATOR B COMPARATOR C COMPARATOR D MATCH0 COMPARATOR MATCH CONTROL COMPARATOR A BUS INTERFACE S12XCPU BUS TAG & TRIGGER CONTROL LOGIC MATCH1 TRIGGER STATE STATE SEQUENCER STATE MATCH2 MATCH3 TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 6-1. Debug Module Block Diagram 6.2 External Signal Description The S12XDBG sub-module features no external signals. 6.3 6.3.1 Memory Map and Registers Module Memory Map A summary of the registers associated with the S12XDBG sub-block is shown in Table 6-2. Detailed descriptions of the registers and bits are given in the subsections that follow. Address Name Bit 7 0x0020 DBGC1 R W 0x0021 DBGSR R W 0x0022 DBGTCR 0x0023 DBGC2 ARM TBF R reserved W R W 0 6 0 TRIG 0 5 4 3 2 reserved BDM DBGBRK reserved 0 0 0 SSF2 TSOURCE 0 TRANGE 0 1 Bit 0 COMRV SSF1 SSF0 TRCMOD TALIGN CDCM ABCM 0 Figure 6-2. Quick Reference to S12XDBG Registers S12XS Family Reference Manual, Rev. 1.13 198 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Address Name Bit 7 Bit 15 6 Bit 14 5 Bit 13 4 Bit 12 3 Bit 11 2 Bit 10 1 Bit 9 Bit 0 Bit 8 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 SC3 SC2 SC1 SC0 0x0024 DBGTBH R W 0x0025 DBGTBL R W Bit 7 0x0026 DBGCNT R W 0 0x0027 DBGSCRX 0 0 0 0 0x0027 DBGMFR R W R W 0 0 0 0 MC3 MC2 MC1 MC0 NDB TAG BRK RW RWE reserved COMPE SZ TAG BRK RW RWE reserved COMPE Bit 22 21 20 19 18 17 Bit 16 0x00281 0x00282 DBGXCTL R (COMPA/C) W DBGXCTL R (COMPB/D) W 0 SZE 0 CNT 0x0029 DBGXAH R W 0x002A DBGXAM R W Bit 15 14 13 12 11 10 9 Bit 8 0x002B DBGXAL R W Bit 7 6 5 4 3 2 1 Bit 0 0x002C DBGXDH R W Bit 15 14 13 12 11 10 9 Bit 8 0x002D DBGXDL R W Bit 7 6 5 4 3 2 1 Bit 0 0x002E DBGXDHM R W Bit 15 14 13 12 11 10 9 Bit 8 1 Bit 0 R Bit 7 6 5 4 3 2 W 1 This represents the contents if the Comparator A or C control register is blended into this address. 2 This represents the contents if the Comparator B or D control register is blended into this address 0x002F DBGXDLM Figure 6-2. Quick Reference to S12XDBG Registers 6.3.2 Register Descriptions This section consists of the S12XDBG control and trace buffer register descriptions in address order. Each comparator has a bank of registers that are visible through an 8-byte window between 0x0028 and 0x002F in the S12XDBG module register address map. When ARM is set in DBGC1, the only bits in the S12XDBG module registers that can be written are ARM, TRIG, and COMRV[1:0]. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 199 S12X Debug (S12XDBGV3) Module 6.3.2.1 Debug Control Register 1 (DBGC1) Address: 0x0020 7 R W Reset 6 ARM 0 0 TRIG 0 5 4 3 2 reserved BDM DBGBRK reserved 0 0 0 0 1 0 COMRV 0 0 Figure 6-3. Debug Control Register (DBGC1) Read: Anytime Write: Bits 7, 1, 0 anytime Bit 6 can be written anytime but always reads back as 0. Bits 5:2 anytime S12XDBG is not armed. NOTE If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the ARM bit is cleared due to the hardware disarm. NOTE When disarming the S12XDBG by clearing ARM with software, the contents of bits[5:2] are not affected by the write, since up until the write operation, ARM = 1 preventing these bits from being written. These bits must be cleared using a second write if required. Table 6-4. DBGC1 Field Descriptions Field Description 7 ARM Arm Bit — The ARM bit controls whether the S12XDBG module is armed. This bit can be set and cleared by user software and is automatically cleared on completion of a tracing session, or if a breakpoint is generated with tracing not enabled. On setting this bit the state sequencer enters State1. 0 Debugger disarmed 1 Debugger armed 6 TRIG Immediate Trigger Request Bit — This bit when written to 1 requests an immediate trigger independent of comparator signal status. When tracing is complete a forced breakpoint may be generated depending upon DBGBRK and BDM bit settings. This bit always reads back a 0. Writing a 0 to this bit has no effect. If TSOURCE is clear no tracing is carried out. If tracing has already commenced using BEGIN- or MID trigger alignment, it continues until the end of the tracing session as defined by the TALIGN bit settings, thus TRIG has no affect. In secure mode tracing is disabled and writing to this bit has no effect. 0 Do not trigger until the state sequencer enters the Final State. 1 Trigger immediately . 5 reserved 4 BDM This bit is reserved, setting it has no meaning or effect. Background Debug Mode Enable — This bit determines if an S12X breakpoint causes the system to enter Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDM is not enabled by the ENBDM bit in the BDM module, then breakpoints default to SWI. 0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint. 1 Breakpoint to BDM, if BDM enabled. Otherwise breakpoint to SWI S12XS Family Reference Manual, Rev. 1.13 200 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-4. DBGC1 Field Descriptions (continued) Field Description 3 DBGBRK S12XDBG Breakpoint Enable Bit — The DBGBRK bit controls whether the debugger will request a breakpoint to S12XCPU upon reaching the state sequencer Final State. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If tracing is not enabled, the breakpoint is generated immediately. Please refer to Section 6.4.7 for further details. 0 No breakpoint on trigger. 1 Breakpoint on trigger 1–0 COMRV Comparator Register Visibility Bits — These bits determine which bank of comparator register is visible in the 8-byte window of the S12XDBG module address map, located between 0x0028 to 0x002F. Furthermore these bits determine which register is visible at the address 0x0027. See Table 6-5. Table 6-5. COMRV Encoding 6.3.2.2 COMRV Visible Comparator Visible Register at 0x0027 00 Comparator A DBGSCR1 01 Comparator B DBGSCR2 10 Comparator C DBGSCR3 11 Comparator D DBGMFR Debug Status Register (DBGSR) Address: 0x0021 R 7 6 5 4 3 2 1 0 TBF 0 0 0 0 SSF2 SSF1 SSF0 — 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset POR = Unimplemented or Reserved Figure 6-4. Debug Status Register (DBGSR) Read: Anytime Write: Never Table 6-6. DBGSR Field Descriptions Field Description 7 TBF Trace Buffer Full — The TBF bit indicates that the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines will be valid data, regardless of the value of DBGCNT bits CNT[6:0]. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit. 2–0 SSF[2:0] State Sequencer Flag Bits — The SSF bits indicate in which state the State Sequencer is currently in. During a debug session on each transition to a new state these bits are updated. If the debug session is ended by software clearing the ARM bit, then these bits retain their value to reflect the last state of the state sequencer before disarming. If a debug session is ended by an internal trigger, then the state sequencer returns to state0 and these bits are cleared to indicate that state0 was entered during the session. On arming the module the state sequencer enters state1 and these bits are forced to SSF[2:0] = 001. See Table 6-7. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 201 S12X Debug (S12XDBGV3) Module Table 6-7. SSF[2:0] — State Sequence Flag Bit Encoding 6.3.2.3 SSF[2:0] Current State 000 State0 (disarmed) 001 State1 010 State2 011 State3 100 Final State 101,110,111 Reserved Debug Trace Control Register (DBGTCR) Address: 0x0022 R W Reset 7 6 reserved TSOURCE 0 0 5 4 3 TRANGE 0 2 1 TRCMOD 0 0 0 TALIGN 0 0 0 Figure 6-5. Debug Trace Control Register (DBGTCR) Read: Anytime Write: Bits 7:6 only when S12XDBG is neither secure nor armed. Bits 5:0 anytime the module is disarmed. WARNING DBGTCR[7] is reserved. Setting this bit maps the tracing to an unimplemented bus, thus preventing proper operation. Table 6-8. DBGTCR Field Descriptions Field Description 6 TSOURCE Trace Source Control Bits — The TSOURCE enables the tracing session. If the MCU system is secured, this bit cannot be set and tracing is inhibited. 0 No tracing selected 1 Tracing selected 5–4 TRANGE Trace Range Bits — The TRANGE bits allow filtering of trace information from a selected address range when tracing from the CPU12X in Detail Mode. To use a comparator for range filtering, the corresponding COMPE bits must remain cleared. If the COMPE bit is not clear then the comparator will also be used to generate state sequence triggers. See Table 6-9. 3–2 TRCMOD Trace Mode Bits — See Section 6.4.5.2 for detailed Trace Mode descriptions. In Normal Mode, change of flow information is stored. In Loop1 Mode, change of flow information is stored but redundant entries into trace memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. See Table 6-10. 1–0 TALIGN Trigger Align Bits — These bits control whether the trigger is aligned to the beginning, end or the middle of a tracing session. See Table 6-11. S12XS Family Reference Manual, Rev. 1.13 202 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-9. TRANGE Trace Range Encoding TRANGE Tracing Range 00 Trace from all addresses (No filter) 01 Trace only in address range from $00000 to Comparator D 10 Trace only in address range from Comparator C to $7FFFFF 11 Trace only in range from Comparator C to Comparator D Table 6-10. TRCMOD Trace Mode Bit Encoding TRCMOD Description 00 Normal 01 Loop1 10 Detail 11 Pure PC Table 6-11. TALIGN Trace Alignment Encoding 6.3.2.4 TALIGN Description 00 Trigger at end of stored data 01 Trigger before storing data 10 Trace buffer entries before and after trigger 11 Reserved Debug Control Register2 (DBGC2) Address: 0x0023 R 7 6 5 4 0 0 0 0 0 0 0 3 0 1 CDCM W Reset 2 0 0 ABCM 0 0 0 = Unimplemented or Reserved Figure 6-6. Debug Control Register2 (DBGC2) Read: Anytime Write: Anytime the module is disarmed. This register configures the comparators for range matching. Table 6-12. DBGC2 Field Descriptions Field Description 3–2 CDCM[1:0] C and D Comparator Match Control — These bits determine the C and D comparator match mapping as described in Table 6-13. 1–0 ABCM[1:0] A and B Comparator Match Control — These bits determine the A and B comparator match mapping as described in Table 6-14. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 203 S12X Debug (S12XDBGV3) Module Table 6-13. CDCM Encoding CDCM Description 00 Match2 mapped to comparator C match....... Match3 mapped to comparator D match. 01 Match2 mapped to comparator C/D inside range....... Match3 disabled. 10 Match2 mapped to comparator C/D outside range....... Match3 disabled. 11 Reserved(1) 1. Currently defaults to Match2 mapped to comparator C : Match3 mapped to comparator D Table 6-14. ABCM Encoding ABCM Description 00 Match0 mapped to comparator A match....... Match1 mapped to comparator B match. 01 Match 0 mapped to comparator A/B inside range....... Match1 disabled. 10 Match 0 mapped to comparator A/B outside range....... Match1 disabled. 11 Reserved(1) 1. Currently defaults to Match0 mapped to comparator A : Match1 mapped to comparator B 6.3.2.5 Debug Trace Buffer Register (DBGTBH:DBGTBL) Address: 0x0024, 0x0025 15 R W 14 13 12 11 10 9 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 8 7 6 5 4 3 2 1 0 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 POR X X X X X X X X X X X X X X X X Other Resets — — — — — — — — — — — — — — — — Figure 6-7. Debug Trace Buffer Register (DBGTB) Read: Only when unlocked AND not secured AND not armed AND with the TSOURCE bit set. Write: Aligned word writes when disarmed unlock the trace buffer for reading but do not affect trace buffer contents. Table 6-15. DBGTB Field Descriptions Field Description 15–0 Bit[15:0] Trace Buffer Data Bits — The Trace Buffer Register is a window through which the 64-bit wide data lines of the Trace Buffer may be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to the next address to be read. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module is disarmed. The DBGTB register can be read only as an aligned word, any byte reads or misaligned access of these registers will return 0 and will not cause the trace buffer pointer to increment to the next trace buffer address. The same is true for word reads while the debugger is armed. The POR state is undefined Other resets do not affect the trace buffer contents. . S12XS Family Reference Manual, Rev. 1.13 204 Freescale Semiconductor S12X Debug (S12XDBGV3) Module 6.3.2.6 Debug Count Register (DBGCNT) Address: 0x0026 7 R 6 5 4 0 3 2 1 0 — 0 — 0 — 0 CNT W Reset POR 0 0 — 0 — 0 — 0 — 0 = Unimplemented or Reserved Figure 6-8. Debug Count Register (DBGCNT) Read: Anytime Write: Never Table 6-16. DBGCNT Field Descriptions Field Description 6–0 CNT[6:0] Count Value — The CNT bits [6:0] indicate the number of valid data 64-bit data lines stored in the Trace Buffer. Table 6-17 shows the correlation between the CNT bits and the number of valid data lines in the Trace Buffer. When the CNT rolls over to zero, the TBF bit in DBGSR is set and incrementing of CNT will continue in endtrigger or mid-trigger mode. The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by power-on-reset initialization but is not cleared by other system resets. Thus should a reset occur during a debug session, the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset occurred. The DBGCNT register is not decremented when reading from the trace buffer. Table 6-17. CNT Decoding Table 6.3.2.7 TBF (DBGSR) CNT[6:0] Description 0 0000000 No data valid 0 0000001 32 bits of one line valid 0 0000010 0000100 0000110 .. 1111100 1 line valid 2 lines valid 3 lines valid .. 62 lines valid 0 1111110 63 lines valid 1 0000000 64 lines valid; if using Begin trigger alignment, ARM bit will be cleared and the tracing session ends. 1 0000010 .. .. 1111110 64 lines valid, oldest data has been overwritten by most recent data Debug State Control Registers There is a dedicated control register for each of the state sequencer states 1 to 3 that determines if transitions from that state are allowed, depending upon comparator matches or tag hits, and defines the S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 205 S12X Debug (S12XDBGV3) Module next state for the state sequencer following a match. The three debug state control registers are located at the same address in the register address map (0x0027). Each register can be accessed using the COMRV bits in DBGC1 to blend in the required register. The COMRV = 11 value blends in the match flag register (DBGMFR). Table 6-18. State Control Register Access Encoding 6.3.2.7.1 COMRV Visible State Control Register 00 DBGSCR1 01 DBGSCR2 10 DBGSCR3 11 DBGMFR Debug State Control Register 1 (DBGSCR1) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 W Reset 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 6-9. Debug State Control Register 1 (DBGSCR1) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 00. The state control register 1 selects the targeted next state whilst in State1. The matches refer to the match channels of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 6-19. DBGSCR1 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State1, based upon the match event. Table 6-20. State1 Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 Description Any match triggers to state2 Any match triggers to state3 Any match triggers to Final State Match2 triggers to State2....... Other matches have no effect Match2 triggers to State3....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match0 triggers to State2....... Match1 triggers to State3....... Other matches have no effect S12XS Family Reference Manual, Rev. 1.13 206 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-20. State1 Sequencer Next State Selection (continued) SC[3:0] 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State2....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State2....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers to Final State....... Other matches have no effect Match3 has no effect....... All other matches (M0,M1,M2) trigger to State2 Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 6-39 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 6.3.2.7.2 Debug State Control Register 2 (DBGSCR2) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 W Reset 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 6-10. Debug State Control Register 2 (DBGSCR2) Read: If COMRV[1:0] = 01 Write: If COMRV[1:0] = 01 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 01. The state control register 2 selects the targeted next state whilst in State2. The matches refer to the match channels of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 6-21. DBGSCR2 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State2, based upon the match event. Table 6-22. State2 —Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 Description Any match triggers to state1 Any match triggers to state3 Any match triggers to Final State Match3 triggers to State1....... Other matches have no effect Match3 triggers to State3....... Other matches have no effect S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 207 S12X Debug (S12XDBGV3) Module Table 6-22. State2 —Sequencer Next State Selection (continued) SC[3:0] 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Match3 triggers to Final State....... Other matches have no effect Match0 triggers to State1....... Match1 triggers to State3....... Other matches have no effect Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State1....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers Final State....... Other matches have no effect Match2 triggers to State1..... Match3 trigger to Final State Match2 has no affect, all other matches (M0,M1,M3) trigger to Final State Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 6-39 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 6.3.2.7.3 Debug State Control Register 3 (DBGSCR3) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 W Reset 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 6-11. Debug State Control Register 3 (DBGSCR3) Read: If COMRV[1:0] = 10 Write: If COMRV[1:0] = 10 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 10. The state control register three selects the targeted next state whilst in State3. The matches refer to the match channels of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 6-23. DBGSCR3 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State3, based upon the match event. Table 6-24. State3 — Sequencer Next State Selection SC[3:0] 0000 0001 Description Any match triggers to state1 Any match triggers to state2 S12XS Family Reference Manual, Rev. 1.13 208 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-24. State3 — Sequencer Next State Selection SC[3:0] 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to Final State Match0 triggers to State1....... Other matches have no effect Match0 triggers to State2....... Other matches have no effect Match0 triggers to Final State.......Match1 triggers to State1...Other matches have no effect Match1 triggers to State1....... Other matches have no effect Match1 triggers to State2....... Other matches have no effect Match1 triggers to Final State....... Other matches have no effect Match2 triggers to State2....... Match0 triggers to Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State2....... Other matches have no effect Match3 triggers to State2....... Match1 triggers to Final State....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match3 triggers to Final State....... Other matches have no effect Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 6-39 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 6.3.2.7.4 Debug Match Flag Register (DBGMFR) Address: 0x0027 R 7 6 5 4 3 2 1 0 0 0 0 0 MC3 MC2 MC1 MC0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 6-12. Debug Match Flag Register (DBGMFR) Read: If COMRV[1:0] = 11 Write: Never DBGMFR is visible at 0x0027 only with COMRV[1:0] = 11. It features four flag bits each mapped directly to a channel. Should a match occur on the channel during the debug session, then the corresponding flag is set and remains set until the next time the module is armed by writing to the ARM bit. Thus the contents are retained after a debug session for evaluation purposes. These flags cannot be cleared by software, they are cleared only when arming the module. A set flag does not inhibit the setting of other flags. Once a flag is set, further triggers on the same channel have no affect. 6.3.2.8 Comparator Register Descriptions Each comparator has a bank of registers that are visible through an 8-byte window in the S12XDBG module register address map. Comparators A and C consist of 8 register bytes (3 address bus compare registers, two data bus compare registers, two data bus mask registers and a control register). S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 209 S12X Debug (S12XDBGV3) Module Comparators B and D consist of four register bytes (three address bus compare registers and a control register). Each set of comparator registers is accessible in the same 8-byte window of the register address map and can be accessed using the COMRV bits in the DBGC1 register. If the Comparators B or D are accessed through the 8-byte window, then only the address and control bytes are visible, the 4 bytes associated with data bus and data bus masking read as zero and cannot be written. Furthermore the control registers for comparators B and D differ from those of comparators A and C. Table 6-25. Comparator Register Layout 0x0028 CONTROL Read/Write Comparators A,B,C,D 0x0029 ADDRESS HIGH Read/Write Comparators A,B,C,D 0x002A ADDRESS MEDIUM Read/Write Comparators A,B,C,D 0x002B ADDRESS LOW Read/Write Comparators A,B,C,D 0x002C DATA HIGH COMPARATOR Read/Write Comparator A and C only 0x002D DATA LOW COMPARATOR Read/Write Comparator A and C only 0x002E DATA HIGH MASK Read/Write Comparator A and C only 0x002F DATA LOW MASK Read/Write Comparator A and C only 6.3.2.8.1 Debug Comparator Control Register (DBGXCTL) The contents of this register bits 7 and 6 differ depending upon which comparator registers are visible in the 8-byte window of the DBG module register address map. Address: 0x0028 7 R 0 W Reset 0 6 5 4 3 2 1 0 NDB TAG BRK RW RWE reserved COMPE 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 6-13. Debug Comparator Control Register (Comparators A and C) Address: 0x0028 R W Reset 7 6 5 4 3 2 1 0 SZE SZ TAG BRK RW RWE reserved COMPE 0 0 0 0 0 0 0 0 Figure 6-14. Debug Comparator Control Register (Comparators B and D) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. WARNING DBGXCTL[1] is reserved. Setting this bit maps the corresponding comparator to an S12XS Family Reference Manual, Rev. 1.13 210 Freescale Semiconductor S12X Debug (S12XDBGV3) Module unimplemented bus, thus preventing proper operation. The DBGC1_COMRV bits determine which comparator control, address, data and datamask registers are visible in the 8-byte window from 0x0028 to 0x002F as shown in Section Table 6-26. Table 6-26. Comparator Address Register Visibility COMRV Visible Comparator 00 DBGACTL, DBGAAH ,DBGAAM, DBGAAL, DBGADH, DBGADL, DBGADHM, DBGADLM 01 DBGBCTL, DBGBAH, DBGBAM, DBGBAL 10 DBGCCTL, DBGCAH, DBGCAM, DBGCAL, DBGCDH, DBGCDL, DBGCDHM, DBGCDLM 11 DBGDCTL, DBGDAH, DBGDAM, DBGDAL Table 6-27. DBGXCTL Field Descriptions Field Description 7 SZE (Comparators B and D) Size Comparator Enable Bit — The SZE bit controls whether access size comparison is enabled for the associated comparator. This bit is ignored if the TAG bit in the same register is set. 0 Word/Byte access size is not used in comparison 1 Word/Byte access size is used in comparison 6 NDB (Comparators A and C Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator register value or when the data bus differs from the register value. Furthermore data bus bits can be individually masked using the comparator data mask registers. This bit is only available for comparators A and C. This bit is ignored if the TAG bit in the same register is set. This bit position has an SZ functionality for comparators B and D. 0 Match on data bus equivalence to comparator register contents 1 Match on data bus difference to comparator register contents 6 SZ (Comparators B and D) Size Comparator Value Bit — The SZ bit selects either word or byte access size in comparison for the associated comparator. This bit is ignored if the SZE bit is cleared or if the TAG bit in the same register is set. This bit position has NDB functionality for comparators A and C 0 Word access size will be compared 1 Byte access size will be compared 5 TAG Tag Select — This bit controls whether the comparator match will cause a trigger or tag the opcode at the matched address. Tagged opcodes trigger only if they reach the execution stage of the instruction queue. 0 Trigger immediately on match 1 On match, tag the opcode. If the opcode is about to be executed a trigger is generated 4 BRK Break — This bit controls whether a channel match terminates a debug session immediately, independent of state sequencer state. To generate an immediate breakpoint the module breakpoints must be enabled using DBGBRK. 0 The debug session termination is dependent upon the state sequencer and trigger conditions. 1 A match on this channel terminates the debug session immediately; breakpoints if active are generated, tracing, if active, is terminated and the module disarmed. 3 RW Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the associated comparator . The RW bit is not used if RWE = 0. 0 Write cycle will be matched 1 Read cycle will be matched 2 RWE Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the associated comparator. This bit is not used for tagged operations. 0 Read/Write is not used in comparison 1 Read/Write is used in comparison S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 211 S12X Debug (S12XDBGV3) Module Table 6-27. DBGXCTL Field Descriptions (continued) Field Description 0 COMPE Determines if comparator is enabled 0 The comparator is not enabled 1 The comparator is enabled for state sequence triggers or tag generation Table 6-28 shows the effect for RWE and RW on the comparison conditions. These bits are not useful for tagged operations since the trigger occurs based on the tagged opcode reaching the execution stage of the instruction queue. Thus these bits are ignored if tagged triggering is selected. Table 6-28. Read or Write Comparison Logic Table 6.3.2.8.2 RWE Bit RW Bit RW Signal Comment 0 x 0 RW not used in comparison 0 x 1 RW not used in comparison 1 0 0 Write 1 0 1 No match 1 1 0 No match 1 1 1 Read Debug Comparator Address High Register (DBGXAH) Address: 0x0029 7 R 0 W Reset 0 6 5 4 3 2 1 0 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 6-15. Debug Comparator Address High Register (DBGXAH) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. Table 6-29. DBGXAH Field Descriptions Field Description 6–0 Bit[22:16] Comparator Address High Compare Bits — The Comparator address high compare bits control whether the selected comparator will compare the address bus bits [22:16] to a logic one or logic zero. . 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one S12XS Family Reference Manual, Rev. 1.13 212 Freescale Semiconductor S12X Debug (S12XDBGV3) Module 6.3.2.8.3 Debug Comparator Address Mid Register (DBGXAM) Address: 0x002A R W Reset 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 Figure 6-16. Debug Comparator Address Mid Register (DBGXAM) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. Table 6-30. DBGXAM Field Descriptions Field 7–0 Bit[15:8] Description Comparator Address Mid Compare Bits— The Comparator address mid compare bits control whether the selected comparator will compare the address bus bits [15:8] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 6.3.2.8.4 Debug Comparator Address Low Register (DBGXAL) Address: 0x002B R W Reset 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Figure 6-17. Debug Comparator Address Low Register (DBGXAL) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. Table 6-31. DBGXAL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Address Low Compare Bits — The Comparator address low compare bits control whether the selected comparator will compare the address bus bits [7:0] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 213 S12X Debug (S12XDBGV3) Module 6.3.2.8.5 Debug Comparator Data High Register (DBGXDH) Address: 0x002C R W Reset 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 Figure 6-18. Debug Comparator Data High Register (DBGXDH) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. Table 6-32. DBGXAH Field Descriptions Field Description 7–0 Bits[15:8] Comparator Data High Compare Bits — The Comparator data high compare bits control whether the selected comparator compares the data bus bits [15:8] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparators A and C. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one 6.3.2.8.6 Debug Comparator Data Low Register (DBGXDL) Address: 0x002D R W Reset 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Figure 6-19. Debug Comparator Data Low Register (DBGXDL) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. Table 6-33. DBGXDL Field Descriptions Field Description 7–0 Bits[7:0] Comparator Data Low Compare Bits — The Comparator data low compare bits control whether the selected comparator compares the data bus bits [7:0] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparators A and C. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one S12XS Family Reference Manual, Rev. 1.13 214 Freescale Semiconductor S12X Debug (S12XDBGV3) Module 6.3.2.8.7 Debug Comparator Data High Mask Register (DBGXDHM) Address: 0x002E R W Reset 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 Figure 6-20. Debug Comparator Data High Mask Register (DBGXDHM) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. Table 6-34. DBGXDHM Field Descriptions Field Description 7–0 Bits[15:8] Comparator Data High Mask Bits — The Comparator data high mask bits control whether the selected comparator compares the data bus bits [15:8] to the corresponding comparator data compare bits. This register is available only for comparators A and C. 0 Do not compare corresponding data bit 1 Compare corresponding data bit 6.3.2.8.8 Debug Comparator Data Low Mask Register (DBGXDLM) Address: 0x002F R W Reset 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Figure 6-21. Debug Comparator Data Low Mask Register (DBGXDLM) Read: Anytime. See Table 6-26 for visible register encoding. Write: If DBG not armed. See Table 6-26 for visible register encoding. Table 6-35. DBGXDLM Field Descriptions Field Description 7–0 Bits[7:0] Comparator Data Low Mask Bits — The Comparator data low mask bits control whether the selected comparator compares the data bus bits [7:0] to the corresponding comparator data compare bits. This register is available only for comparators A and C. 0 Do not compare corresponding data bit 1 Compare corresponding data bit 6.4 Functional Description This section provides a complete functional description of the S12XDBG module. If the part is in secure mode, the S12XDBG module can generate breakpoints but tracing is not possible. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 215 S12X Debug (S12XDBGV3) Module 6.4.1 S12XDBG Operation Arming the S12XDBG module by setting ARM in DBGC1 allows triggering, and storing of data in the trace buffer and can be used to cause breakpoints to the CPU12X . The DBG module is made up of four main blocks, the comparators, control logic, the state sequencer, and the trace buffer. The comparators monitor the bus activity of the CPU12X . Comparators can be configured to monitor address and databus. Comparators can also be configured to mask out individual data bus bits during a compare and to use R/W and word/byte access qualification in the comparison. When a match with a comparator register value occurs the associated control logic can trigger the state sequencer to another state (see Figure 6-22). Either forced or tagged triggers are possible. Using a forced trigger, the trigger is generated immediately on a comparator match. Using a tagged trigger, at a comparator match, the instruction opcode is tagged and only if the instruction reaches the execution stage of the instruction queue is a trigger generated. In the case of a transition to Final State, bus tracing is triggered and/or a breakpoint can be generated. Independent of the state sequencer, a breakpoint can be triggered by writing to the TRIG bit in the DBGC1 control register. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. 6.4.2 Comparator Modes The S12XDBG contains four comparators, A, B, C, and D. Each comparator compares the selected address bus with the address stored in DBGXAH, DBGXAM, and DBGXAL. Furthermore, comparators A and C also compare the data buses to the data stored in DBGXDH, DBGXDL and allow masking of individual data bus bits. S12X comparator matches are disabled in BDM and during BDM accesses. The comparator match control logic configures comparators to monitor the buses for an exact address or an address range. The comparator configuration is controlled by the control register contents and the range control by the DBGC2 contents. On a match a trigger can initiate a transition to another state sequencer state (see Section 6.4.3”). The comparator control register also allows the type of access to be included in the comparison through the use of the RWE, RW, SZE, and SZ bits. The RWE bit controls whether read or write comparison is enabled for the associated comparator and the RW bit selects either a read or write access for a valid match. Similarly the SZE and SZ bits allows the size of access (word or byte) to be considered in the compare. Only comparators B and D feature SZE and SZ. The TAG bit in each comparator control register is used to determine the triggering condition. By setting TAG, the comparator will qualify a match with the output of opcode tracking logic and a trigger occurs before the tagged instruction executes (tagged-type trigger). Whilst tagging, the RW, RWE, SZE, and SZ bits are ignored and the comparator register must be loaded with the exact opcode address. If the TAG bit is clear (forced type trigger) a comparator match is generated when the selected address appears on the system address bus. If the selected address is an opcode address, the match is generated S12XS Family Reference Manual, Rev. 1.13 216 Freescale Semiconductor S12X Debug (S12XDBGV3) Module when the opcode is fetched from the memory. This precedes the instruction execution by an indefinite number of cycles due to instruction pipe lining. For a comparator match of an opcode at an odd address when TAG = 0, the corresponding even address must be contained in the comparator register. Thus for an opcode at odd address (n), the comparator register must contain address (n–1). Once a successful comparator match has occurred, the condition that caused the original match is not verified again on subsequent matches. Thus if a particular data value is verified at a given address, this address may not still contain that data value when a subsequent match occurs. Comparators C and D can also be used to select an address range to trace from. This is determined by the TRANGE bits in the DBGTCR register. The TRANGE encoding is shown in Table 6-9. If the TRANGE bits select a range definition using comparator D, then comparator D is configured for trace range definition and cannot be used for address bus comparisons. Similarly if the TRANGE bits select a range definition using comparator C, then comparator C is configured for trace range definition and cannot be used for address bus comparisons. Match[0, 1, 2, 3] map directly to Comparators[A, B, C, D] respectively, except in range modes (see Section 6.3.2.4). Comparator priority rules are described in the trigger priority section (Section 6.4.3.4). 6.4.2.1 Exact Address Comparator Match (Comparators A and C) With range comparisons disabled, the match condition is an exact equivalence of address/data bus with the value stored in the comparator address/data registers. Further qualification of the type of access (R/W, word/byte) is possible. Comparators A and C do not feature SZE or SZ control bits, thus the access size is not compared. Table 637 lists access considerations without data bus compare. Table 6-36 lists access considerations with data bus comparison. To compare byte accesses DBGxDH must be loaded with the data byte, the low byte must be masked out using the DBGxDLM mask register. On word accesses the data byte of the lower address is mapped to DBGxDH. Table 6-36. Comparator A and C Data Bus Considerations Access Address DBGxDH DBGxDL DBGxDHM DBGxDLM Example Valid Match Word ADDR[n] Data[n] Data[n+1] $FF $FF MOVW #$WORD ADDR[n] config1 Byte ADDR[n] Data[n] x $FF $00 MOVB #$BYTE ADDR[n] config2 Word ADDR[n] Data[n] x $FF $00 MOVW #$WORD ADDR[n] config2 Word ADDR[n] x Data[n+1] $00 $FF MOVW #$WORD ADDR[n] config3 Code may contain various access forms of the same address, i.e. a word access of ADDR[n] or byte access of ADDR[n+1] both access n+1. At a word access of ADDR[n], address ADDR[n+1] does not appear on the address bus and so cannot cause a comparator match if the comparator contains ADDR[n]. Thus it is not possible to monitor all data accesses of ADDR[n+1] with one comparator. To detect an access of ADDR[n+1] through a word access of ADDR[n] the comparator can be configured to ADDR[n], DBGxDL is loaded with the data pattern and DBGxDHM is cleared so only the data[n+1] is compared on accesses of ADDR[n]. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 217 S12X Debug (S12XDBGV3) Module NOTE Using this configuration, a byte access of ADDR[n] can cause a comparator match if the databus low byte by chance contains the same value as ADDR[n+1] because the databus comparator does not feature access size comparison and uses the mask as a “don’t care” function. Thus masked bits do not prevent a match. Comparators A and C feature an NDB control bit to determine if a match occurs when the data bus differs to comparator register contents or when the data bus is equivalent to the comparator register contents. 6.4.2.2 Exact Address Comparator Match (Comparators B and D) Comparators B and D feature SZ and SZE control bits. If SZE is clear, then the comparator address match qualification functions the same as for comparators A and C. If the SZE bit is set the access size (word or byte) is compared with the SZ bit value such that only the specified type of access causes a match. Thus if configured for a byte access of a particular address, a word access covering the same address does not lead to match. Table 6-37. Comparator Access Size Considerations Comparator Address SZE SZ8 Condition For Valid Match Comparators A and C ADDR[n] — — Word and byte accesses of ADDR[n](1) MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] Comparators B and D ADDR[n] 0 X Word and byte accesses of ADDR[n]1 MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] Comparators B and D ADDR[n] 1 0 Word accesses of ADDR[n]1 MOVW #$WORD ADDR[n] Comparators ADDR[n] 1 1 Byte accesses of ADDR[n] B and D MOVB #$BYTE ADDR[n] 1. A word access of ADDR[n-1] also accesses ADDR[n] but does not generate a match. The comparator address register must contain the exact address used in the code. 6.4.2.3 Data Bus Comparison NDB Dependency Comparators A and C each feature an NDB control bit, which allows data bus comparators to be configured to either trigger on equivalence or trigger on difference. This allows monitoring of a difference in the contents of an address location from an expected value. When matching on an equivalence (NDB=0), each individual data bus bit position can be masked out by clearing the corresponding mask bit (DBGxDHM/DBGxDLM), so that it is ignored in the comparison. A match occurs when all data bus bits with corresponding mask bits set are equivalent. If all mask register bits are clear, then a match is based on the address bus only, the data bus is ignored. When matching on a difference, mask bits can be cleared to ignore bit positions. A match occurs when any data bus bit with corresponding mask bit set is different. Clearing all mask bits, causes all bits to be ignored and prevents a match because no difference can be detected. In this case address bus equivalence does not cause a match. S12XS Family Reference Manual, Rev. 1.13 218 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-38. NDB and MASK bit dependency 6.4.2.4 NDB DBGxDHM[n] / DBGxDLM[n] Comment 0 0 Do not compare data bus bit. 0 1 Compare data bus bit. Match on equivalence. 1 0 Do not compare data bus bit. 1 1 Compare data bus bit. Match on difference. Range Comparisons When using the AB comparator pair for a range comparison, the data bus can also be used for qualification by using the comparator A data and data mask registers. Furthermore the DBGACTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access. The corresponding DBGBCTL bits are ignored. Similarly when using the CD comparator pair for a range comparison, the data bus can also be used for qualification by using the comparator C data and data mask registers. Furthermore the DBGCCTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access if tagging is not selected. The corresponding DBGDCTL bits are ignored. The SZE and SZ control bits are ignored in range mode. The comparator A and C TAG bits are used to tag range comparisons for the AB and CD ranges respectively. The comparator B and D TAG bits are ignored in range modes. In order for a range comparison using comparators A and B, both COMPEA and COMPEB must be set; to disable range comparisons both must be cleared. Similarly for a range CD comparison, both COMPEC and COMPED must be set. The comparator A and C BRK bits are used for the AB and CD ranges respectively, the comparator B and D BRK bits are ignored in range mode. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. 6.4.2.4.1 Inside Range (CompAC_Addr ≤ address ≤ CompBD_Addr) In the Inside Range comparator mode, either comparator pair A and B or comparator pair C and D can be configured for range comparisons by the control register (DBGC2). The match condition requires that a valid match for both comparators happens on the same bus cycle. A match condition on only one comparator is not valid. An aligned word access which straddles the range boundary will cause a trigger only if the aligned address is inside the range. 6.4.2.4.2 Outside Range (address < CompAC_Addr or address > CompBD_Addr) In the Outside Range comparator mode, either comparator pair A and B or comparator pair C and D can be configured for range comparisons. A single match condition on either of the comparators is recognized as valid. An aligned word access which straddles the range boundary will cause a trigger only if the aligned address is outside the range. Outside range mode in combination with tagged triggers can be used to detect if the opcode fetches are from an unexpected range. In forced trigger modes the outside range trigger would typically be activated at any interrupt vector fetch or register access. This can be avoided by setting the upper or lower range limit to $7FFFFF or $000000 respectively. Interrupt vector fetches do not cause taghits S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 219 S12X Debug (S12XDBGV3) Module 6.4.3 Trigger Modes Trigger modes are used as qualifiers for a state sequencer change of state. The control logic determines the trigger mode and provides a trigger to the state sequencer. The individual trigger modes are described in the following sections. 6.4.3.1 Forced Trigger On Comparator Match If a forced trigger comparator match occurs, the trigger immediately initiates a transition to the next state sequencer state whereby the corresponding flags in DBGSR are set. The state control register for the current state determines the next state for each trigger. Forced triggers are generated as soon as the matching address appears on the address bus, which in the case of opcode fetches occurs several cycles before the opcode execution. For this reason a forced trigger at an opcode address precedes a tagged trigger at the same address by several cycles. 6.4.3.2 Trigger On Comparator Related Taghit If a CPU12X taghit occurs, a transition to another state sequencer state is initiated and the corresponding DBGSR flags are set. For a comparator related taghit to occur, the S12XDBG must first generate tags based on comparator matches. When the tagged instruction reaches the execution stage of the instruction queue a taghit is generated by the CPU12X. The state control register for the current state determines the next state for each trigger. 6.4.3.3 TRIG Immediate Trigger Independent of comparator matches it is possible to initiate a tracing session and/or breakpoint by writing the TRIG bit in DBGC1 to a logic “1”. If configured for begin or mid aligned tracing, this triggers the state sequencer into the Final State, if configured for end alignment, setting the TRIG bit disarms the module, ending the session. If breakpoints are enabled, a forced breakpoint request is issued immediately (end alignment) or when tracing has completed (begin or mid alignment). 6.4.3.4 Trigger Priorities In case of simultaneous triggers, the priority is resolved according to Table 6-39. The lower priority trigger is suppressed. It is thus possible to miss a lower priority trigger if it occurs simultaneously with a trigger of a higher priority. The trigger priorities described in Table 6-39 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches in each state sequencer state. When configured for range modes a simultaneous match of comparators A and C generates an active match0 whilst match2 is suppressed. If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the ARM bit is cleared due to the hardware disarm. Table 6-39. Trigger Priorities Priority Source Action S12XS Family Reference Manual, Rev. 1.13 220 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-39. Trigger Priorities Highest Lowest 6.4.4 TRIG Trigger immediately to final state (begin or mid aligned tracing enabled) Trigger immediately to state 0 (end aligned or no tracing enabled) Match0 (force or tag hit) Trigger to next state as defined by state control registers Match1 (force or tag hit) Trigger to next state as defined by state control registers Match2 (force or tag hit) Trigger to next state as defined by state control registers Match3 (force or tag hit) Trigger to next state as defined by state control registers State Sequence Control ARM = 0 State 0 (Disarmed) ARM = 1 State1 State2 ARM = 0 Session Complete (Disarm) Final State State3 ARM = 0 Figure 6-22. State Sequencer Diagram The state sequencer allows a defined sequence of events to provide a trigger point for tracing of data in the trace buffer. Once the S12XDBG module has been armed by setting the ARM bit in the DBGC1 register, then state1 of the state sequencer is entered. Further transitions between the states are then controlled by the state control registers and depend upon a selected trigger mode condition being met. From Final State the only permitted transition is back to the disarmed state0. Transition between any of the states 1 to 3 is not restricted. Each transition updates the SSF[2:0] flags in DBGSR accordingly to indicate the current state. Alternatively by setting the TRIG bit in DBGSC1, the state machine can be triggered to state0 or Final State depending on tracing alignment. Independent of the state sequencer, each comparator channel can be individually configured to generate an immediate breakpoint when a match occurs through the use of the BRK bits in the DBGxCTL registers. Thus it is possible to generate an immediate breakpoint on selected channels, whilst a state sequencer transition can be initiated by a match on other channels. If a debug session is ended by a trigger on a channel with BRK = 1, the state sequencer transitions through Final State for a clock cycle to state0. This is independent of tracing and breakpoint activity, thus with tracing and breakpoints disabled, the state sequencer enters state0 and the debug module is disarmed. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 221 S12X Debug (S12XDBGV3) Module 6.4.4.1 Final State On entering Final State a trigger may be issued to the trace buffer according to the trace position control as defined by the TALIGN field (see Section 6.3.2.3). If TSOURCE in the trace control register DBGTCR is cleared then the trace buffer is disabled and the transition to Final State can only generate a breakpoint request. In this case or upon completion of a tracing session when tracing is enabled, the ARM bit in the DBGC1 register is cleared, returning the module to the disarmed state0. If tracing is enabled, a breakpoint request can occur at the end of the tracing session. If neither tracing nor breakpoints are enabled then when the final state is reached it returns automatically to state0 and the debug module is disarmed. 6.4.5 Trace Buffer Operation The trace buffer is a 64 lines deep by 64-bits wide RAM array. The S12XDBG module stores trace information in the RAM array in a circular buffer format. The RAM array can be accessed through a register window (DBGTBH:DBGTBL) using 16-bit wide word accesses. After each complete 64-bit trace buffer line is read, an internal pointer into the RAM is incremented so that the next read will receive fresh information. Data is stored in the format shown in Table 6-40. After each store the counter register bits DBGCNT[6:0] are incremented. Tracing of CPU12X activity is disabled when the BDM is active. Reading the trace buffer whilst the DBG is armed returns invalid data and the trace buffer pointer is not incremented. 6.4.5.1 Trace Trigger Alignment Using the TALIGN bits (see Section 6.3.2.3) it is possible to align the trigger with the end, the middle, or the beginning of a tracing session. If End or Mid tracing is selected, tracing begins when the ARM bit in DBGC1 is set and State1 is entered. The transition to Final State if End is selected signals the end of the tracing session. The transition to Final State if Mid is selected signals that another 32 lines will be traced before ending the tracing session. Tracing with Begin-Trigger starts at the opcode of the trigger. 6.4.5.1.1 Storing with Begin-Trigger Storing with Begin-Trigger, data is not stored in the Trace Buffer until the Final State is entered. Once the trigger condition is met the S12XDBG module will remain armed until 64 lines are stored in the Trace Buffer. If the trigger is at the address of the change-of-flow instruction the change of flow associated with the trigger will be stored in the Trace Buffer. Using Begin-trigger together with tagging, if the tagged instruction is about to be executed then the trace is started. Upon completion of the tracing session the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 6.4.5.1.2 Storing with Mid-Trigger Storing with Mid-Trigger, data is stored in the Trace Buffer as soon as the S12XDBG module is armed. When the trigger condition is met, another 32 lines will be traced before ending the tracing session, irrespective of the number of lines stored before the trigger occurred, then the S12XDBG module is disarmed and no more data is stored. Using Mid-trigger with tagging, if the tagged instruction is about to S12XS Family Reference Manual, Rev. 1.13 222 Freescale Semiconductor S12X Debug (S12XDBGV3) Module be executed then the trace is continued for another 32 lines. Upon tracing completion the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 6.4.5.1.3 Storing with End-Trigger Storing with End-Trigger, data is stored in the Trace Buffer until the Final State is entered, at which point the S12XDBG module will become disarmed and no more data will be stored. If the trigger is at the address of a change of flow instruction the trigger event will not be stored in the Trace Buffer. 6.4.5.2 Trace Modes The S12XDBG module can operate in four trace modes. The mode is selected using the TRCMOD bits in the DBGTCR register. The modes are described in the following subsections. The trace buffer organization is shown in Table 6-40. 6.4.5.2.1 Normal Mode In Normal Mode, change of flow (COF) program counter (PC) addresses will be stored. COF addresses are defined as follows : • Source address of taken conditional branches (long, short, bit-conditional, and loop primitives) • Destination address of indexed JMP, JSR, and CALL instruction • Destination address of RTI, RTS, and RTC instructions. • Vector address of interrupts, except for SWI and BDM vectors LBRA, BRA, BSR, BGND as well as non-indexed JMP, JSR, and CALL instructions are not classified as change of flow and are not stored in the trace buffer. Change-of-flow addresses stored include the full 23-bit address bus of CPU12X and an information byte, which contains a source/destination bit to indicate whether the stored address was a source address or destination address. NOTE When an CPU12X COF instruction with destination address is executed, the destination address is stored to the trace buffer on instruction completion, indicating the COF has taken place. If an interrupt occurs simultaneously then the next instruction carried out is actually from the interrupt service routine. The instruction at the destination address of the original program flow gets exectuted after the interrupt service routine. In the following example an IRQ interrupt occurs during execution of the indexed JMP at address MARK1. The BRN at the destination (SUB_1) is not executed until after the IRQ service routine but the destination address is entered into the trace buffer to indicate that the indexed JMP COF has taken place. MARK1 MARK2 LDX JMP NOP #SUB_1 0,X ; IRQ interrupt occurs during execution of this ; S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 223 S12X Debug (S12XDBGV3) Module SUB_1 BRN * ADDR1 NOP DBNE A,PART5 IRQ_ISR LDAB STAB RTI #$F0 VAR_C1 ; JMP Destination address TRACE BUFFER ENTRY 1 ; RTI Destination address TRACE BUFFER ENTRY 3 ; ; Source address TRACE BUFFER ENTRY 4 ; IRQ Vector $FFF2 = TRACE BUFFER ENTRY 2 ; The execution flow taking into account the IRQ is as follows MARK1 IRQ_ISR SUB_1 ADDR1 6.4.5.2.2 LDX JMP LDAB STAB RTI BRN NOP DBNE #SUB_1 0,X #$F0 VAR_C1 ; ; ; * A,PART5 ; ; Loop1 Mode Loop1 Mode, similarly to Normal Mode also stores only COF address information to the trace buffer, it however allows the filtering out of redundant information. The intent of Loop1 Mode is to prevent the Trace Buffer from being filled entirely with duplicate information from a looping construct such as delays using the DBNE instruction or polling loops using BRSET/BRCLR instructions. Immediately after address information is placed in the Trace Buffer, the S12XDBG module writes this value into a background register. This prevents consecutive duplicate address entries in the Trace Buffer resulting from repeated branches. Loop1 Mode only inhibits consecutive duplicate source address entries that would typically be stored in most tight looping constructs. It does not inhibit repeated entries of destination addresses or vector addresses, since repeated entries of these would most likely indicate a bug in the user’s code that the S12XDBG module is designed to help find. 6.4.5.2.3 Detail Mode In Detail Mode, address and data for all memory and register accesses is stored in the trace buffer. This mode also features information byte entries to the trace buffer, for each address byte entry. The information byte indicates the size of access (word or byte) and the type of access (read or write). When tracing CPU12X activity in Detail Mode, all cycles are traced except those when the CPU12X is either in a free or opcode fetch cycle, the address range can be limited to a range specified by the TRANGE bits in DBGTCR. This function uses comparators C and D to define an address range inside which CPU12X activity should be traced (see Table 6-40). Thus the traced CPU12X activity can be restricted to particular register range accesses. 6.4.5.2.4 Pure PC Mode In Pure PC Mode, tracing from the CPU the PC addresses of all executed opcodes, including illegal opcodes, are stored. S12XS Family Reference Manual, Rev. 1.13 224 Freescale Semiconductor S12X Debug (S12XDBGV3) Module 6.4.5.3 Trace Buffer Organization Referring to Table 6-40. ADRH, ADRM, ADRL denote address high, middle and low byte respectively. INF bytes contain control information (R/W, S/D etc.). The numerical suffix indicates which tracing step. The information format for Loop1 Mode and PurePC Mode is the same as that of Normal Mode. Whilst tracing in Normal or Loop1 modes each array line contains 2 data entries, thus in this case the DBGCNT[0] is incremented after each separate entry. In Detail mode DBGCNT[0] remains cleared whilst the other DBGCNT bits are incremented on each trace buffer entry. When a COF occurs a trace buffer entry is made and the corresponding CDV bit is set. Single byte data accesses in Detail Mode are always stored to the low byte of the trace buffer (CDATAL ) and the high byte is cleared. When tracing word accesses, the byte at the lower address is always stored to trace buffer byte3 and the byte at the higher address is stored to byte2. Table 6-40. Trace Buffer Organization Mode 8-Byte Wide Word Buffer 7 6 5 4 3 2 1 0 S12XCPU Detail CXINF1 CADRH1 CADRM1 CADRL1 CDATAH1 CDATAL1 CXINF2 CADRH2 CADRM2 CADRL2 CDATAH2 CDATAL2 CPU12X Other Modes CINF1 CPCH1 CPCM1 CPCL1 CINF0 CINF3 CPCH3 CPCM3 CPCL3 CINF2 CPCH0 CPCM0 CPCL0 CPCH2 CPCM2 CPCL2 S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 225 S12X Debug (S12XDBGV3) Module 6.4.5.3.1 Information Byte Organization The format of the control information byte is dependent upon the active trace mode as described below. In Normal, Loop1, or Pure PC modes tracing of CPU12X activity, CINF is used to store control information. In Detail Mode, CXINF contains the control information. CPU12X Information Byte Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CSD CVA 0 CDV 0 0 0 0 Figure 6-23. CPU12X Information Byte CINF Table 6-41. CINF Field Descriptions Field Description 7 CSD Source Destination Indicator — This bit indicates if the corresponding stored address is a source or destination address. This is only used in Normal and Loop1 mode tracing. 0 Source address 1 Destination address 6 CVA Vector Indicator — This bit indicates if the corresponding stored address is a vector address. Vector addresses are destination addresses, thus if CVA is set, then the corresponding CSD is also set. This is only used in Normal and Loop1 mode tracing. This bit has no meaning in Pure PC mode. 0 Indexed jump destination address 1 Vector destination address 4 CDV Data Invalid Indicator — This bit indicates if the trace buffer entry is invalid. It is only used when tracing from both sources in Normal, Loop1 and Pure PC modes, to indicate that the CPU12X trace buffer entry is valid. 0 Trace buffer entry is invalid 1 Trace buffer entry is valid CXINF Information Byte Bit 7 Bit 6 Bit 5 CSZ CRW Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Figure 6-24. Information Byte CXINF This describes the format of the information byte used only when tracing in Detail Mode. When tracing from the CPU12X in Detail Mode, information is stored to the trace buffer on all cycles except opcode fetch and free cycles. In this case the CSZ and CRW bits indicate the type of access being made by the CPU12X. Table 6-42. CXINF Field Descriptions Field Description 6 CSZ Access Type Indicator — This bit indicates if the access was a byte or word size access.This bit only contains valid information when tracing CPU12X activity in Detail Mode. 0 Word Access 1 Byte Access S12XS Family Reference Manual, Rev. 1.13 226 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-42. CXINF Field Descriptions (continued) Field 5 CRW 6.4.5.4 Description Read Write Indicator — This bit indicates if the corresponding stored address corresponds to a read or write access. This bit only contains valid information when tracing CPU12X activity in Detail Mode. 0 Write Access 1 Read Access Reading Data from Trace Buffer The data stored in the Trace Buffer can be read using either the background debug module (BDM) module or the CPU12X provided the S12XDBG module is not armed, is configured for tracing and the system not secured. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by an aligned word write to DBGTB when the module is disarmed. The Trace Buffer can only be read through the DBGTB register using aligned word reads, any byte or misaligned reads return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. The Trace Buffer data is read out first-in first-out. By reading CNT in DBGCNT the number of valid 64-bit lines can be determined. DBGCNT will not decrement as data is read. Whilst reading an internal pointer is used to determine the next line to be read. After a tracing session, the pointer points to the oldest data entry, thus if no overflow has occurred, the pointer points to line0, otherwise it points to the line with the oldest entry. The pointer is initialized by each aligned write to DBGTBH to point to the oldest data again. This enables an interrupted trace buffer read sequence to be easily restarted from the oldest data entry. The least significant word of each 64-bit wide array line is read out first. This corresponds to the bytes 1 and 0 of Table 6-40. The bytes containing invalid information (shaded in Table 6-40) are also read out. Reading the Trace Buffer while the S12XDBG module is armed will return invalid data and no shifting of the RAM pointer will occur. 6.4.5.5 Trace Buffer Reset State The Trace Buffer contents are not initialized by a system reset. Thus should a system reset occur, the trace session information from immediately before the reset occurred can be read out. The DBGCNT bits are not cleared by a system reset. Thus should a reset occur, the number of valid lines in the trace buffer is indicated by DBGCNT. The internal pointer to the current trace buffer address is initialized by unlocking the trace buffer thus points to the oldest valid data even if a reset occurred during the tracing session. Generally debugging occurrences of system resets is best handled using mid or end trigger alignment since the reset may occur before the trace trigger, which in the begin trigger alignment case means no information would be stored in the trace buffer. NOTE An external pin RESET that occurs simultaneous to a trace buffer entry can, in very seldom cases, lead to either that entry being corrupted or the first entry of the session being corrupted. In such cases the other contents of the trace buffer still contain valid tracing information. The case occurs when the reset assertion coincides with the trace buffer entry clock edge. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 227 S12X Debug (S12XDBGV3) Module 6.4.6 Tagging A tag follows program information as it advances through the instruction queue. When a tagged instruction reaches the head of the queue a tag hit occurs and triggers the state sequencer. Each comparator control register features a TAG bit, which controls whether the comparator match will cause a trigger immediately or tag the opcode at the matched address. If a comparator is enabled for tagged comparisons, the address stored in the comparator match address registers must be an opcode address for the trigger to occur. Using Begin trigger together with tagging, if the tagged instruction is about to be executed then the transition to the next state sequencer state occurs. If the transition is to the Final State, tracing is started. Only upon completion of the tracing session can a breakpoint be generated. Similarly using Mid trigger with tagging, if the tagged instruction is about to be executed then the trace is continued for another 32 lines. Upon tracing completion the breakpoint is generated. Using End trigger, when the tagged instruction is about to be executed and the next transition is to Final State then a breakpoint is generated immediately, before the tagged instruction is carried out. Read/Write (R/W), access size (SZ) monitoring and data bus monitoring is not useful if tagged triggering is selected, since the tag is attached to the opcode at the matched address and is not dependent on the data bus nor on the type of access. Thus these bits are ignored if tagged triggering is selected. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. S12X tagging is disabled when the BDM becomes active. 6.4.7 Breakpoints Breakpoints can be generated as follows. • From comparator channel triggers to final state. • Using software to write to the TRIG bit in the DBGC1 register. Breakpoints generated via the BDM BACKGROUND command have no affect on the CPU12X in STOP or WAIT mode. 6.4.7.1 Breakpoints From Internal Comparator Channel Final State Triggers Breakpoints can be generated when internal comparator channels trigger the state sequencer to the Final State. If configured for tagging, then the breakpoint is generated when the tagged opcode reaches the execution stage of the instruction queue. If a tracing session is selected by TSOURCE, breakpoints are requested when the tracing session has completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 6-43). If no tracing session is selected, breakpoints are requested immediately. If the BRK bit is set on the triggering channel, then the breakpoint is generated immediately independent of tracing trigger alignment. S12XS Family Reference Manual, Rev. 1.13 228 Freescale Semiconductor S12X Debug (S12XDBGV3) Module Table 6-43. Breakpoint Setup BRK TALIGN DBGBRK Breakpoint Alignment 0 00 0 Fill Trace Buffer until trigger (no breakpoints — keep running) 0 00 1 Fill Trace Buffer until trigger, then breakpoint request occurs 0 01 0 Start Trace Buffer at trigger (no breakpoints — keep running) 0 01 1 Start Trace Buffer at trigger A breakpoint request occurs when Trace Buffer is full 0 10 0 Store a further 32 Trace Buffer line entries after trigger (no breakpoints — keep running) 0 10 1 Store a further 32 Trace Buffer line entries after trigger Request breakpoint after the 32 further Trace Buffer entries 1 00,01,10 1 Terminate tracing and generate breakpoint immediately on trigger 1 00,01,10 0 Terminate tracing immediately on trigger x 11 x Reserved 6.4.7.2 Breakpoints Generated Via The TRIG Bit If a TRIG triggers occur, the Final State is entered. If a tracing session is selected by TSOURCE, breakpoints are requested when the tracing session has completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 6-43). If no tracing session is selected, breakpoints are requested immediately. TRIG breakpoints are possible even if the S12XDBG module is disarmed. 6.4.7.3 S12XDBG Breakpoint Priorities If a TRIG trigger occurs after Begin or Mid aligned tracing has already been triggered by a comparator instigated transition to Final State, then TRIG no longer has an effect. When the associated tracing session is complete, the breakpoint occurs. Similarly if a TRIG is followed by a subsequent trigger from a comparator channel, it has no effect, since tracing has already started. 6.4.7.3.1 S12XDBG Breakpoint Priorities And BDM Interfacing Breakpoint operation is dependent on the state of the S12XBDM module. If the S12XBDM module is active, the CPU12X is executing out of BDM firmware and S12X breakpoints are disabled. In addition, while executing a BDM TRACE command, tagging into BDM is disabled. If BDM is not active, the breakpoint will give priority to BDM requests over SWI requests if the breakpoint coincides with a SWI instruction in the user’s code. On returning from BDM, the SWI from user code gets executed. Table 6-44. Breakpoint Mapping Summary DBGBRK (DBGC1[3]) BDM Bit (DBGC1[4]) BDM Enabled BDM Active S12X Breakpoint Mapping 0 X X X No Breakpoint 1 0 X 0 Breakpoint to SWI 1 0 X 1 No Breakpoint S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 229 S12X Debug (S12XDBGV3) Module Table 6-44. Breakpoint Mapping Summary 1 1 0 X Breakpoint to SWI 1 1 1 0 Breakpoint to BDM 1 1 1 1 No Breakpoint BDM cannot be entered from a breakpoint unless the ENABLE bit is set in the BDM. If entry to BDM via a BGND instruction is attempted and the ENABLE bit in the BDM is cleared, the CPU12X actually executes the BDM firmware code. It checks the ENABLE and returns if ENABLE is not set. If not serviced by the monitor then the breakpoint is re-asserted when the BDM returns to normal CPU12X flow. If the comparator register contents coincide with the SWI/BDM vector address then an SWI in user code and DBG breakpoint could occur simultaneously. The CPU12X ensures that BDM requests have a higher priority than SWI requests. Returning from the BDM/SWI service routine care must be taken to avoid re triggering a breakpoint. NOTE When program control returns from a tagged breakpoint using an RTI or BDM GO command without program counter modification it will return to the instruction whose tag generated the breakpoint. To avoid re triggering a breakpoint at the same location reconfigure the S12XDBG module in the SWI routine, if configured for an SWI breakpoint, or over the BDM interface by executing a TRACE command before the GO to increment the program flow past the tagged instruction. S12XS Family Reference Manual, Rev. 1.13 230 Freescale Semiconductor Chapter 7 Security (S12XS9SECV2) Table 7-1. Revision History Version Number Revision Date Effective Date 02.00 27 Aug 2004 08 Sep 2004 reviewed and updated for S12XD architecture 02.01 21 Feb 2007 21 Feb 2007 added S12XE, S12XF and S12XS architectures 02.02 19 Apr 2007 19 Apr 2007 corrected statement about Backdoor key access via BDM on XE, XF, XS 7.1 Author Description of Changes Introduction This specification describes the function of the security mechanism in the S12XS chip family (9SEC). NOTE No security feature is absolutely secure. However, Freescale’s strategy is to make reading or copying the FLASH and/or EEPROM difficult for unauthorized users. 7.1.1 Features The user must be reminded that part of the security must lie with the application code. An extreme example would be application code that dumps the contents of the internal memory. This would defeat the purpose of security. At the same time, the user may also wish to put a backdoor in the application program. An example of this is the user downloads a security key through the SCI, which allows access to a programming routine that updates parameters stored in another section of the Flash memory. The security features of the S12XS chip family (in secure mode) are: • Protect the content of non-volatile memories (Flash, EEPROM) • Execution of NVM commands is restricted • Disable access to internal memory via background debug module (BDM) Table 7-2 gives an overview over availability of security relevant features in unsecure and secure modes. Table 7-2. Feature Availability in Unsecure and Secure Modes on S12XS Unsecure Mode Flash Array Access NS SS ✔ ✔ NX ES Secure Mode EX ST NS SS ✔ ✔ NX ES EX ST S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 231 Security (S12XS9SECV2) Table 7-2. Feature Availability in Unsecure and Secure Modes on S12XS Unsecure Mode NS SS EEPROM Array Access ✔ NVM Commands BDM NX ES Secure Mode EX ST NS SS ✔ ✔ ✔ ✔1 ✔ ✔1 ✔1 ✔ ✔ — ✔2 NX ES EX ST DBG Module Trace ✔ ✔ — — Restricted NVM command set only. Please refer to the NVM wrapper block guides for detailed information. 1 BDM hardware commands restricted to peripheral registers only. 2 7.1.2 Modes of Operation 7.1.3 Securing the Microcontroller Once the user has programmed the Flash and EEPROM, the chip can be secured by programming the security bits located in the options/security byte in the Flash memory array. These non-volatile bits will keep the device secured through reset and power-down. The options/security byte is located at address 0xFF0F (= global address 0x7F_FF0F) in the Flash memory array. This byte can be erased and programmed like any other Flash location. Two bits of this byte are used for security (SEC[1:0]). On devices which have a memory page window, the Flash options/security byte is also available at address 0xBF0F by selecting page 0x3F with the PPAGE register. The contents of this byte are copied into the Flash security register (FSEC) during a reset sequence. 0xFF0F 7 6 5 4 3 2 1 0 KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 Figure 7-1. Flash Options/Security Byte The meaning of the bits KEYEN[1:0] is shown in Table 7-3. Please refer to Section 7.1.5.1, “Unsecuring the MCU Using the Backdoor Key Access” for more information. Table 7-3. Backdoor Key Access Enable Bits KEYEN[1:0] Backdoor Key Access Enabled 00 0 (disabled) 01 0 (disabled) 10 1 (enabled) 11 0 (disabled) The meaning of the security bits SEC[1:0] is shown in Table 7-4. For security reasons, the state of device security is controlled by two bits. To put the device in unsecured mode, these bits must be programmed to S12XS Family Reference Manual, Rev. 1.13 232 Freescale Semiconductor Security (S12XS9SECV2) SEC[1:0] = ‘10’. All other combinations put the device in a secured mode. The recommended value to put the device in secured state is the inverse of the unsecured state, i.e. SEC[1:0] = ‘01’. Table 7-4. Security Bits SEC[1:0] Security State 00 1 (secured) 01 1 (secured) 10 0 (unsecured) 11 1 (secured) NOTE Please refer to the Flash block guide for actual security configuration (in section “Flash Module Security”). 7.1.4 Operation of the Secured Microcontroller By securing the device, unauthorized access to the EEPROM and Flash memory contents can be prevented. However, it must be understood that the security of the EEPROM and Flash memory contents also depends on the design of the application program. For example, if the application has the capability of downloading code through a serial port and then executing that code (e.g. an application containing bootloader code), then this capability could potentially be used to read the EEPROM and Flash memory contents even when the microcontroller is in the secure state. In this example, the security of the application could be enhanced by requiring a challenge/response authentication before any code can be downloaded. Secured operation has the following effects on the microcontroller: S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 233 Security (S12XS9SECV2) 7.1.4.1 • • • Background debug module (BDM) operation is completely disabled. Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. 7.1.4.2 • • • • Normal Single Chip Mode (NS) Special Single Chip Mode (SS) BDM firmware commands are disabled. BDM hardware commands are restricted to the register space. Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. Special single chip mode means BDM is active after reset. The availability of BDM firmware commands depends on the security state of the device. The BDM secure firmware first performs a blank check of both the Flash memory and the EEPROM. If the blank check succeeds, security will be temporarily turned off and the state of the security bits in the appropriate Flash memory location can be changed If the blank check fails, security will remain active, only the BDM hardware commands will be enabled, and the accessible memory space is restricted to the peripheral register area. This will allow the BDM to be used to erase the EEPROM and Flash memory without giving access to their contents. After erasing both Flash memory and EEPROM, another reset into special single chip mode will cause the blank check to succeed and the options/security byte can be programmed to “unsecured” state via BDM. While the BDM is executing the blank check, the BDM interface is completely blocked, which means that all BDM commands are temporarily blocked. S12XS Family Reference Manual, Rev. 1.13 234 Freescale Semiconductor Security (S12XS9SECV2) 7.1.5 Unsecuring the Microcontroller Unsecuring the microcontroller can be done by three different methods: 1. Backdoor key access 2. Reprogramming the security bits 3. Complete memory erase (special modes) 7.1.5.1 Unsecuring the MCU Using the Backdoor Key Access In normal modes (single chip and expanded), security can be temporarily disabled using the backdoor key access method. This method requires that: • The backdoor key at 0xFF00–0xFF07 (= global addresses 0x7F_FF00–0x7F_FF07) has been programmed to a valid value. • The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’. • In single chip mode, the application program programmed into the microcontroller must be designed to have the capability to write to the backdoor key locations. The backdoor key values themselves would not normally be stored within the application data, which means the application program would have to be designed to receive the backdoor key values from an external source (e.g. through a serial port). The backdoor key access method allows debugging of a secured microcontroller without having to erase the Flash. This is particularly useful for failure analysis. NOTE No word of the backdoor key is allowed to have the value 0x0000 or 0xFFFF. 7.1.6 Reprogramming the Security Bits In normal single chip mode (NS), security can also be disabled by erasing and reprogramming the security bits within Flash options/security byte to the unsecured value. Because the erase operation will erase the entire sector from 0xFE00–0xFFFF (0x7F_FE00–0x7F_FFFF), the backdoor key and the interrupt vectors will also be erased; this method is not recommended for normal single chip mode. The application software can only erase and program the Flash options/security byte if the Flash sector containing the Flash options/security byte is not protected (see Flash protection). Thus Flash protection is a useful means of preventing this method. The microcontroller will enter the unsecured state after the next reset following the programming of the security bits to the unsecured value. This method requires that: • The application software previously programmed into the microcontroller has been designed to have the capability to erase and program the Flash options/security byte, or security is first disabled using the backdoor key method, allowing BDM to be used to issue commands to erase and program the Flash options/security byte. • The Flash sector containing the Flash options/security byte is not protected. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 235 Security (S12XS9SECV2) 7.1.7 Complete Memory Erase (Special Modes) The microcontroller can be unsecured in special modes by erasing the entire EEPROM and Flash memory contents. When a secure microcontroller is reset into special single chip mode (SS), the BDM firmware verifies whether the EEPROM and Flash memory are erased. If any EEPROM or Flash memory address is not erased, only BDM hardware commands are enabled. BDM hardware commands can then be used to write to the EEPROM and Flash registers to mass erase the EEPROM and all Flash memory blocks. When next reset into special single chip mode, the BDM firmware will again verify whether all EEPROM and Flash memory are erased, and this being the case, will enable all BDM commands, allowing the Flash options/security byte to be programmed to the unsecured value. The security bits SEC[1:0] in the Flash security register will indicate the unsecure state following the next reset. S12XS Family Reference Manual, Rev. 1.13 236 Freescale Semiconductor Chapter 8 S12XE Clocks and Reset Generator (S12XECRGV1) Table 8-1. Revision History Revision Number Revision Date V01.00 26 Oct. 2005 V01.01 02 Nov 2006 8.4.1.1/8-254 Table “Examples of IPLL Divider settings”: corrected $32 to $31 V01.02 4 Mar. 2008 8.4.1.4/8-257 8.4.3.3/8-261 Corrected details V01.03 1 Sep. 2008 Table 8-14 V01.04 20 Nov. 2008 8.3.2.4/8-243 V01.05 19. Sep 2009 8.5.1/8-263 Modified Note below Table 8-17./8-263 V01.06 18. Sep 2012 Table 8-14 8.5.1 Added footnote concerning maximum clock frequencies to table Removed redundant examples from table Replaced reference to MMC documentation 8.1 Sections Affected Description of Changes Initial release added 100MHz example for PLL S12XECRG Flags Register: corrected address to Module Base + 0x0003 Introduction This specification describes the function of the Clocks and Reset Generator (S12XECRG). 8.1.1 Features The main features of this block are: • Phase Locked Loop (IPLL) frequency multiplier with internal filter — Reference divider — Post divider — Configurable internal filter (no external pin) — Optional frequency modulation for defined jitter and reduced emission — Automatic frequency lock detector — Interrupt request on entry or exit from locked condition — Self Clock Mode in absence of reference clock • System Clock Generator — Clock Quality Check — User selectable fast wake-up from Stop in Self-Clock Mode for power saving and immediate program execution — Clock switch for either Oscillator or PLL based system clocks • Computer Operating Properly (COP) watchdog timer with time-out clear window. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 237 S12XE Clocks and Reset Generator (S12XECRGV1) • • 8.1.2 System Reset generation from the following possible sources: — Power on reset — Low voltage reset — Illegal address reset — COP reset — Loss of clock reset — External pin reset Real-Time Interrupt (RTI) Modes of Operation This subsection lists and briefly describes all operating modes supported by the S12XECRG. • Run Mode All functional parts of the S12XECRG are running during normal Run Mode. If RTI or COP functionality is required the individual bits of the associated rate select registers (COPCTL, RTICTL) have to be set to a non zero value. • Wait Mode In this mode the IPLL can be disabled automatically depending on the PLLWAI bit. • Stop Mode Depending on the setting of the PSTP bit Stop Mode can be differentiated between Full Stop Mode (PSTP = 0) and Pseudo Stop Mode (PSTP = 1). — Full Stop Mode The oscillator is disabled and thus all system and core clocks are stopped. The COP and the RTI remain frozen. — Pseudo Stop Mode The oscillator continues to run and most of the system and core clocks are stopped. If the respective enable bits are set the COP and RTI will continue to run, else they remain frozen. • Self Clock Mode Self Clock Mode will be entered if the Clock Monitor Enable Bit (CME) and the Self Clock Mode Enable Bit (SCME) are both asserted and the clock monitor in the oscillator block detects a loss of clock. As soon as Self Clock Mode is entered the S12XECRG starts to perform a clock quality check. Self Clock Mode remains active until the clock quality check indicates that the required quality of the incoming clock signal is met (frequency and amplitude). Self Clock Mode should be used for safety purposes only. It provides reduced functionality to the MCU in case a loss of clock is causing severe system conditions. 8.1.3 Block Diagram Figure 8-1 shows a block diagram of the S12XECRG. S12XS Family Reference Manual, Rev. 1.13 238 Freescale Semiconductor S12XE Clocks and Reset Generator (S12XECRGV1) Illegal Address Reset S12X_MMC Power on Reset Voltage Regulator Low Voltage Reset ICRG RESET CM Fail Clock Monitor OSCCLK EXTAL Oscillator XTAL COP Timeout XCLKS Reset Generator Clock Quality Checker System Reset Bus Clock Core Clock COP RTI Oscillator Clock Registers PLLCLK VDDPLL IPLL VSSPLL Real Time Interrupt Clock and Reset Control PLL Lock Interrupt Self Clock Mode Interrupt Figure 8-1. Block diagram of S12XECRG 8.2 Signal Description This section lists and describes the signals that connect off chip. 8.2.1 VDDPLL, VSSPLL These pins provides operating voltage (VDDPLL) and ground (VSSPLL) for the IPLL circuitry. This allows the supply voltage to the IPLL to be independently bypassed. Even if IPLL usage is not required VDDPLL and VSSPLL must be connected to properly. 8.2.2 RESET RESET is an active low bidirectional reset pin. As an input it initializes the MCU asynchronously to a known start-up state. As an open-drain output it indicates that an system reset (internal to MCU) has been triggered. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 239 S12XE Clocks and Reset Generator (S12XECRGV1) 8.3 Memory Map and Registers This section provides a detailed description of all registers accessible in the S12XECRG. 8.3.1 Module Memory Map Figure 8-2 gives an overview on all S12XECRG registers. Address Name 0x0000 SYNR 0x0001 REFDV 0x0002 POSTDIV 0x0003 CRGFLG 0x0004 CRGINT 0x0005 CLKSEL 0x0006 PLLCTL 0x0007 RTICTL 0x0008 COPCTL 0x0009 FORBYP2 0x000A CTCTL2 0x000B ARMCOP Bit 7 R W R W R 6 5 4 3 VCOFRQ[1:0] SYNDIV[5:0] REFFRQ[1:0] REFDIV[5:0] 0 0 0 RTIF PORF LVRF W R 0 0 W R RTIE LOCKIF LOCKIE LOCK 0 XCLKS 0 PLLON FM1 FM0 FSTWKP RTDEC RTR6 RTR5 RTR4 RTR3 WCOP RSBCK 0 0 0 0 0 0 0 0 0 0 R 0 0 W Bit 7 Bit 6 W R W R W R W R PLLSEL PSTP CME 1 Bit 0 POSTDIV[4:0] W R 2 PLLWAI ILAF 0 0 SCMIF SCMIE SCM 0 RTIWAI COPWAI PRE PCE SCME RTR2 RTR1 RTR0 CR2 CR1 CR0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 WRTMASK W R W 2. FORBYP and CTCTL are intended for factory test purposes only. = Unimplemented or Reserved Figure 8-2. CRG Register Summary NOTE Register Address = Base Address + Address Offset, where the Base Address is defined at the MCU level and the Address Offset is defined at the module level. S12XS Family Reference Manual, Rev. 1.13 240 Freescale Semiconductor S12XE Clocks and Reset Generator (S12XECRGV1) 8.3.2 Register Descriptions This section describes in address order all the S12XECRG registers and their individual bits. 8.3.2.1 S12XECRG Synthesizer Register (SYNR) The SYNR register controls the multiplication factor of the IPLL and selects the VCO frequency range. Module Base + 0x0000 7 6 5 4 3 2 1 0 0 0 0 R VCOFRQ[1:0] SYNDIV[5:0] W Reset 0 0 0 0 0 Figure 8-3. S12XECRG Synthesizer Register (SYNR) Read: Anytime Write: Anytime except if PLLSEL = 1 NOTE Write to this register initializes the lock detector bit. ( SYNDIV + 1 ) f VCO = 2 × f OSC × ------------------------------------( REFDIV + 1 ) f VCO f PLL = -----------------------------------2 × POSTDIV f PLL f BUS = ------------2 NOTE fVCO must be within the specified VCO frequency lock range. F.BUS (Bus Clock) must not exceed the specified maximum. If POSTDIV = $00 then fPLL is same as fVCO (divide by one). The VCOFRQ[1:0] bit are used to configure the VCO gain for optimal stability and lock time. For correct IPLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK frequency as shown in Table 8-2. Setting the VCOFRQ[1:0] bits wrong can result in a non functional IPLL (no locking and/or insufficient stability). Table 8-2. VCO Clock Frequency Selection VCOCLK Frequency Ranges VCOFRQ[1:0] 32MHz TCx TC7=TCx IOCx=OMx/OLx IOC7=OM7/OL7 IOCx=OC7Dx IOCx=OC7Dx IOC7=OM7/O +OMx/OLx L7 IOC7=OM7/O L7 OC7Mx=0 TC7>TCx IOCx=OC7Dx IOCx=OC7Dx IOC7=OC7D7 +OMx/OLx IOC7=OC7D7 TC7=TCx TC7>TCx IOCx=OMx/OLx IOC7=OC7D7 Note: in Table 16-10, the IOS7 and IOSx should be set to 1 IOSx is the register TIOS bit x, OC7Mx is the register OC7M bit x, TCx is timer Input Capture/Output Compare register, IOCx is channel x, OMx/OLx is the register TCTL1/TCTL2, OC7Dx is the register OC7D bit x. IOCx = OC7Dx+ OMx/OLx, means that both OC7 event and OCx event will change channel x value. 16.3.2.9 Timer Control Register 3/Timer Control Register 4 (TCTL3 and TCTL4) Module Base + 0x000A 7 6 5 4 3 2 1 0 EDG7B EDG7A EDG6B EDG6A EDG5B EDG5A EDG4B EDG4A 0 0 0 0 0 0 0 0 R W Reset Figure 16-16. Timer Control Register 3 (TCTL3) Module Base + 0x000B 7 6 5 4 3 2 1 0 EDG3B EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A 0 0 0 0 0 0 0 0 R W Reset Figure 16-17. Timer Control Register 4 (TCTL4) S12XS Family Reference Manual, Rev. 1.13 474 Freescale Semiconductor Timer Module (TIM16B8CV2) Read: Anytime Write: Anytime. Table 16-11. TCTL3/TCTL4 Field Descriptions Field 7:0 EDGnB EDGnA Description Input Capture Edge Control — These eight pairs of control bits configure the input capture edge detector circuits. Table 16-12. Edge Detector Circuit Configuration EDGnB EDGnA Configuration 0 0 Capture disabled 0 1 Capture on rising edges only 1 0 Capture on falling edges only 1 1 Capture on any edge (rising or falling) 16.3.2.10 Timer Interrupt Enable Register (TIE) Module Base + 0x000C 7 6 5 4 3 2 1 0 C7I C6I C5I C4I C3I C2I C1I C0I 0 0 0 0 0 0 0 0 R W Reset Figure 16-18. Timer Interrupt Enable Register (TIE) Read: Anytime Write: Anytime. Table 16-13. TIE Field Descriptions Field Description 7:0 C7I:C0I Input Capture/Output Compare “x” Interrupt Enable — The bits in TIE correspond bit-for-bit with the bits in the TFLG1 status register. If cleared, the corresponding flag is disabled from causing a hardware interrupt. If set, the corresponding flag is enabled to cause a interrupt. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 475 Timer Module (TIM16B8CV2) 16.3.2.11 Timer System Control Register 2 (TSCR2) Module Base + 0x000D 7 R 6 5 4 0 0 0 TOI 3 2 1 0 TCRE PR2 PR1 PR0 0 0 0 0 W Reset 0 0 0 0 = Unimplemented or Reserved Figure 16-19. Timer System Control Register 2 (TSCR2) Read: Anytime Write: Anytime. Table 16-14. TSCR2 Field Descriptions Field 7 TOI Description Timer Overflow Interrupt Enable 0 Interrupt inhibited. 1 Hardware interrupt requested when TOF flag set. 3 TCRE Timer Counter Reset Enable — This bit allows the timer counter to be reset by a successful output compare 7 event. This mode of operation is similar to an up-counting modulus counter. 0 Counter reset inhibited and counter free runs. 1 Counter reset by a successful output compare 7. Note: If TC7 = 0x0000 and TCRE = 1, TCNT will stay at 0x0000 continuously. If TC7 = 0xFFFF and TCRE = 1, TOF will never be set when TCNT is reset from 0xFFFF to 0x0000. Note: TCRE=1 and TC7!=0, the TCNT cycle period will be TC7 x "prescaler counter width" + "1 Bus Clock", for a more detail explanation please refer to Section 16.4.3, “Output Compare 2 PR[2:0] Timer Prescaler Select — These three bits select the frequency of the timer prescaler clock derived from the Bus Clock as shown in Table 16-15. Table 16-15. Timer Clock Selection PR2 PR1 PR0 Timer Clock 0 0 0 Bus Clock / 1 0 0 1 Bus Clock / 2 0 1 0 Bus Clock / 4 0 1 1 Bus Clock / 8 1 0 0 Bus Clock / 16 1 0 1 Bus Clock / 32 1 1 0 Bus Clock / 64 1 1 1 Bus Clock / 128 S12XS Family Reference Manual, Rev. 1.13 476 Freescale Semiconductor Timer Module (TIM16B8CV2) NOTE The newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. 16.3.2.12 Main Timer Interrupt Flag 1 (TFLG1) Module Base + 0x000E 7 6 5 4 3 2 1 0 C7F C6F C5F C4F C3F C2F C1F C0F 0 0 0 0 0 0 0 0 R W Reset Figure 16-20. Main Timer Interrupt Flag 1 (TFLG1) Read: Anytime Write: Used in the clearing mechanism (set bits cause corresponding bits to be cleared). Writing a zero will not affect current status of the bit. Table 16-16. TRLG1 Field Descriptions Field Description 7:0 C[7:0]F Input Capture/Output Compare Channel “x” Flag — These flags are set when an input capture or output compare event occurs. Clearing requires writing a one to the corresponding flag bit while TEN or PAEN is set to one. When TFFCA bit in TSCR register is set, a read from an input capture or a write into an output compare channel (0x0010–0x001F) will cause the corresponding channel flag CxF to be cleared. 16.3.2.13 Main Timer Interrupt Flag 2 (TFLG2) Module Base + 0x000F 7 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 TOF W Reset 0 Unimplemented or Reserved Figure 16-21. Main Timer Interrupt Flag 2 (TFLG2) TFLG2 indicates when interrupt conditions have occurred. To clear a bit in the flag register, write the bit to one while TEN bit of TSCR1 or PAEN bit of PACTL is set to one. Read: Anytime Write: Used in clearing mechanism (set bits cause corresponding bits to be cleared). Any access to TCNT will clear TFLG2 register if the TFFCA bit in TSCR register is set. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 477 Timer Module (TIM16B8CV2) Table 16-17. TRLG2 Field Descriptions Field Description 7 TOF Timer Overflow Flag — Set when 16-bit free-running timer overflows from 0xFFFF to 0x0000. Clearing this bit requires writing a one to bit 7 of TFLG2 register while the TEN bit of TSCR1 or PAEN bit of PACTL is set to one (See also TCRE control bit explanation.) 16.3.2.14 Timer Input Capture/Output Compare Registers High and Low 0–7 (TCxH and TCxL) 0x0018 = TC4H 0x001A = TC5H 0x001C = TC6H 0x001E = TC7H Module Base + 0x0010 = TC0H 0x0012 = TC1H 0x0014 = TC2H 0x0016 = TC3H 15 14 13 12 11 10 9 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 R W Reset Figure 16-22. Timer Input Capture/Output Compare Register x High (TCxH) 0x0019 = TC4L 0x001B = TC5L 0x001D = TC6L 0x001F = TC7L Module Base + 0x0011 = TC0L 0x0013 = TC1L 0x0015 = TC2L 0x0017 = TC3L 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 R W Reset Figure 16-23. Timer Input Capture/Output Compare Register x Low (TCxL) Depending on the TIOS bit for the corresponding channel, these registers are used to latch the value of the free-running counter when a defined transition is sensed by the corresponding input capture edge detector or to trigger an output action for output compare. Read: Anytime Write: Anytime for output compare function.Writes to these registers have no meaning or effect during input capture. All timer input capture/output compare registers are reset to 0x0000. NOTE Read/Write access in byte mode for high byte should takes place before low byte otherwise it will give a different result. S12XS Family Reference Manual, Rev. 1.13 478 Freescale Semiconductor Timer Module (TIM16B8CV2) 16.3.2.15 16-Bit Pulse Accumulator Control Register (PACTL) Module Base + 0x0020 7 R 6 5 4 3 2 1 0 PAEN PAMOD PEDGE CLK1 CLK0 PAOVI PAI 0 0 0 0 0 0 0 0 W Reset 0 Unimplemented or Reserved Figure 16-24. 16-Bit Pulse Accumulator Control Register (PACTL) When PAEN is set, the PACT is enabled.The PACT shares the input pin with IOC7. Read: Any time Write: Any time Table 16-18. PACTL Field Descriptions Field 6 PAEN Description Pulse Accumulator System Enable — PAEN is independent from TEN. With timer disabled, the pulse accumulator can function unless pulse accumulator is disabled. 0 16-Bit Pulse Accumulator system disabled. 1 Pulse Accumulator system enabled. 5 PAMOD Pulse Accumulator Mode — This bit is active only when the Pulse Accumulator is enabled (PAEN = 1). See Table 16-19. 0 Event counter mode. 1 Gated time accumulation mode. 4 PEDGE Pulse Accumulator Edge Control — This bit is active only when the Pulse Accumulator is enabled (PAEN = 1). For PAMOD bit = 0 (event counter mode). See Table 16-19. 0 Falling edges on IOC7 pin cause the count to be incremented. 1 Rising edges on IOC7 pin cause the count to be incremented. For PAMOD bit = 1 (gated time accumulation mode). 0 IOC7 input pin high enables M (bus clock) divided by 64 clock to Pulse Accumulator and the trailing falling edge on IOC7 sets the PAIF flag. 1 IOC7 input pin low enables M (bus clock) divided by 64 clock to Pulse Accumulator and the trailing rising edge on IOC7 sets the PAIF flag. 3:2 CLK[1:0] Clock Select Bits — Refer to Table 16-20. 1 PAOVI 0 PAI Pulse Accumulator Overflow Interrupt Enable 0 Interrupt inhibited. 1 Interrupt requested if PAOVF is set. Pulse Accumulator Input Interrupt Enable 0 Interrupt inhibited. 1 Interrupt requested if PAIF is set. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 479 Timer Module (TIM16B8CV2) Table 16-19. Pin Action PAMOD PEDGE Pin Action 0 0 Falling edge 0 1 Rising edge 1 0 Div. by 64 clock enabled with pin high level 1 1 Div. by 64 clock enabled with pin low level NOTE If the timer is not active (TEN = 0 in TSCR), there is no divide-by-64 because the ÷64 clock is generated by the timer prescaler. Table 16-20. Timer Clock Selection CLK1 CLK0 Timer Clock 0 0 Use timer prescaler clock as timer counter clock 0 1 Use PACLK as input to timer counter clock 1 0 Use PACLK/256 as timer counter clock frequency 1 1 Use PACLK/65536 as timer counter clock frequency For the description of PACLK please refer Figure 16-30. If the pulse accumulator is disabled (PAEN = 0), the prescaler clock from the timer is always used as an input clock to the timer counter. The change from one selected clock to the other happens immediately after these bits are written. 16.3.2.16 Pulse Accumulator Flag Register (PAFLG) Module Base + 0x0021 R 7 6 5 4 3 2 0 0 0 0 0 0 1 0 PAOVF PAIF 0 0 W Reset 0 0 0 0 0 0 Unimplemented or Reserved Figure 16-25. Pulse Accumulator Flag Register (PAFLG) Read: Anytime Write: Anytime When the TFFCA bit in the TSCR register is set, any access to the PACNT register will clear all the flags in the PAFLG register. Timer module or Pulse Accumulator must stay enabled (TEN=1 or PAEN=1) while clearing these bits. S12XS Family Reference Manual, Rev. 1.13 480 Freescale Semiconductor Timer Module (TIM16B8CV2) Table 16-21. PAFLG Field Descriptions Field Description 1 PAOVF Pulse Accumulator Overflow Flag — Set when the 16-bit pulse accumulator overflows from 0xFFFF to 0x0000. Clearing this bit requires writing a one to this bit in the PAFLG register while TEN bit of TSCR1 or PAEN bit of PACTL register is set to one. 0 PAIF Pulse Accumulator Input edge Flag — Set when the selected edge is detected at the IOC7 input pin.In event mode the event edge triggers PAIF and in gated time accumulation mode the trailing edge of the gate signal at the IOC7 input pin triggers PAIF. Clearing this bit requires writing a one to this bit in the PAFLG register while TEN bit of TSCR1 or PAEN bit of PACTL register is set to one. Any access to the PACNT register will clear all the flags in this register when TFFCA bit in register TSCR(0x0006) is set. 16.3.2.17 Pulse Accumulators Count Registers (PACNT) Module Base + 0x0022 15 14 13 12 11 10 9 0 PACNT15 PACNT14 PACNT13 PACNT12 PACNT11 PACNT10 PACNT9 PACNT8 0 0 0 0 0 0 0 0 R W Reset Figure 16-26. Pulse Accumulator Count Register High (PACNTH) Module Base + 0x0023 7 6 5 4 3 2 1 0 PACNT7 PACNT6 PACNT5 PACNT4 PACNT3 PACNT2 PACNT1 PACNT0 0 0 0 0 0 0 0 0 R W Reset Figure 16-27. Pulse Accumulator Count Register Low (PACNTL) Read: Anytime Write: Anytime These registers contain the number of active input edges on its input pin since the last reset. When PACNT overflows from 0xFFFF to 0x0000, the Interrupt flag PAOVF in PAFLG (0x0021) is set. Full count register access should take place in one clock cycle. A separate read/write for high byte and low byte will give a different result than accessing them as a word. NOTE Reading the pulse accumulator counter registers immediately after an active edge on the pulse accumulator input pin may miss the last count because the input has to be synchronized with the bus clock first. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 481 Timer Module (TIM16B8CV2) 16.3.2.18 Output Compare Pin Disconnect Register(OCPD) Module Base + 0x002C 7 6 5 4 3 2 1 0 OCPD7 OCPD6 OCPD5 OCPD4 OCPD3 OCPD2 OCPD1 OCPD0 0 0 0 0 0 0 0 0 R W Reset Figure 16-28. Ouput Compare Pin Disconnect Register (OCPD) Read: Anytime Write: Anytime All bits reset to zero. Table 16-22. OCPD Field Description Field OCPD[7:0} Description Output Compare Pin Disconnect Bits 0 Enables the timer channel port. Ouptut Compare action will occur on the channel pin. These bits do not affect the input capture or pulse accumulator functions 1 Disables the timer channel port. Output Compare action will not occur on the channel pin, but the output compare flag still become set . 16.3.2.19 Precision Timer Prescaler Select Register (PTPSR) Module Base + 0x002E 7 6 5 4 3 2 1 0 PTPS7 PTPS6 PTPS5 PTPS4 PTPS3 PTPS2 PTPS1 PTPS0 0 0 0 0 0 0 0 0 R W Reset Figure 16-29. Precision Timer Prescaler Select Register (PTPSR) Read: Anytime Write: Anytime All bits reset to zero. S12XS Family Reference Manual, Rev. 1.13 482 Freescale Semiconductor Timer Module (TIM16B8CV2) Table 16-23. PTPSR Field Descriptions Field Description 7:0 PTPS[7:0] Precision Timer Prescaler Select Bits — These eight bits specify the division rate of the main Timer prescaler. These are effective only when the PRNT bit of TSCR1 is set to 1. Table 16-24 shows some selection examples in this case. The newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. The Prescaler can be calculated as follows depending on logical value of the PTPS[7:0] and PRNT bit: PRNT = 1 : Prescaler = PTPS[7:0] + 1 Table 16-24. Precision Timer Prescaler Selection Examples when PRNT = 1 PTPS7 PTPS6 PTPS5 PTPS4 PTPS3 PTPS2 PTPS1 PTPS0 Prescale Factor 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 2 0 0 0 0 0 0 1 0 3 0 0 0 0 0 0 1 1 4 0 0 0 0 0 1 0 0 5 0 0 0 0 0 1 0 1 6 0 0 0 0 0 1 1 0 7 0 0 0 0 0 1 1 1 8 0 0 0 0 1 1 1 1 16 0 0 0 1 1 1 1 1 32 0 0 1 1 1 1 1 1 64 0 1 1 1 1 1 1 1 128 1 1 1 1 1 1 1 1 256 16.4 Functional Description This section provides a complete functional description of the timer TIM16B8CV2 block. Please refer to the detailed timer block diagram in Figure 16-30 as necessary. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 483 Timer Module (TIM16B8CV2) Bus Clock CLK[1:0] PR[2:1:0] channel 7 output compare PACLK PACLK/256 PACLK/65536 MUX TCRE PRESCALER CxI TCNT(hi):TCNT(lo) CxF CLEAR COUNTER 16-BIT COUNTER TOF INTERRUPT LOGIC TOI TE TOF CHANNEL 0 16-BIT COMPARATOR OM:OL0 TC0 EDG0A C0F C0F EDGE DETECT EDG0B CH. 0 CAPTURE IOC0 PIN LOGIC CH. 0COMPARE TOV0 IOC0 PIN IOC0 CHANNEL 1 16-BIT COMPARATOR OM:OL1 EDGE DETECT EDG1B EDG1A C1F C1F TC1 CH. 1 CAPTURE IOC1 PIN LOGIC CH. 1 COMPARE TOV1 IOC1 PIN IOC1 CHANNEL2 CHANNEL7 16-BIT COMPARATOR TC7 OM:OL7 EDG7A EDGE DETECT EDG7B PAOVF C7F C7F PACNT(hi):PACNT(lo) TOV7 IOC7 PEDGE PAE PACLK/65536 CH.7 CAPTURE IOC7 PIN PA INPUT LOGIC CH. 7 COMPARE IOC7 PIN EDGE DETECT 16-BIT COUNTER PACLK PACLK/256 TEN INTERRUPT REQUEST INTERRUPT LOGIC PAIF DIVIDE-BY-64 PAOVI PAI PAOVF PAIF Bus Clock PAOVF PAOVI Figure 16-30. Detailed Timer Block Diagram 16.4.1 Prescaler The prescaler divides the bus clock by 1,2,4,8,16,32,64 or 128. The prescaler select bits, PR[2:0], select the prescaler divisor. PR[2:0] are in timer system control register 2 (TSCR2). S12XS Family Reference Manual, Rev. 1.13 484 Freescale Semiconductor Timer Module (TIM16B8CV2) The prescaler divides the bus clock by a prescalar value. Prescaler select bits PR[2:0] of in timer system control register 2 (TSCR2) are set to define a prescalar value that generates a divide by 1, 2, 4, 8, 16, 32, 64 and 128 when the PRNT bit in TSCR1 is disabled. By enabling the PRNT bit of the TSCR1 register, the performance of the timer can be enhanced. In this case, it is possible to set additional prescaler settings for the main timer counter in the present timer by using PTPSR[7:0] bits of PTPSR register. 16.4.2 Input Capture Clearing the I/O (input/output) select bit, IOSx, configures channel x as an input capture channel. The input capture function captures the time at which an external event occurs. When an active edge occurs on the pin of an input capture channel, the timer transfers the value in the timer counter into the timer channel registers, TCx. The minimum pulse width for the input capture input is greater than two bus clocks. An input capture on channel x sets the CxF flag. The CxI bit enables the CxF flag to generate interrupt requests. Timer module or Pulse Accumulator must stay enabled (TEN bit of TSCR1 or PAEN bit of PACTL regsiter must be set to one) while clearing CxF (writing one to CxF). 16.4.3 Output Compare Setting the I/O select bit, IOSx, configures channel x as an output compare channel. The output compare function can generate a periodic pulse with a programmable polarity, duration, and frequency. When the timer counter reaches the value in the channel registers of an output compare channel, the timer can set, clear, or toggle the channel pin if the corresponding OCPDx bit is set to zero. An output compare on channel x sets the CxF flag. The CxI bit enables the CxF flag to generate interrupt requests. Timer module or Pulse Accumulator must stay enabled (TEN bit of TSCR1 or PAEN bit of PACTL regsiter must be set to one) while clearing CxF (writing one to CxF). The output mode and level bits, OMx and OLx, select set, clear, toggle on output compare. Clearing both OMx and OLx results in no output compare action on the output compare channel pin. Setting a force output compare bit, FOCx, causes an output compare on channel x. A forced output compare does not set the channel flag. A channel 7 event, which can be a counter overflow when TTOV[7] is set or a successful output compare on channel 7, overrides output compares on all other output compare channels. The output compare 7 mask register masks the bits in the output compare 7 data register. The timer counter reset enable bit, TCRE, enables channel 7 output compares to reset the timer counter. A channel 7 output compare can reset the timer counter even if the IOC7 pin is being used as the pulse accumulator input. Writing to the timer port bit of an output compare pin does not affect the pin state. The value written is stored in an internal latch. When the pin becomes available for general-purpose output, the last value written to the bit appears at the pin. When TCRE is set and TC7 is not equal to 0, then TCNT will cycle from 0 to TC7. When TCNT reaches TC7 value, it will last only one bus cycle then reset to 0. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 485 Timer Module (TIM16B8CV2) Note: in Figure 16-31,if PR[2:0] is equal to 0, one prescaler counter equal to one bus clock Figure 16-31. The TCNT cycle diagram under TCRE=1 condition prescaler counter TC7 1 bus clock 0 1 TC7-1 TC7 0 TC7 event TC7 event 16.4.3.1 ----- OC Channel Initialization Internal register whose output drives OCx can be programmed before timer drives OCx. The desired state can be programmed to this Internal register by writing a one to CFORCx bit with TIOSx, OCPDx and TEN bits set to one. Setting OCPDx to zero allows Interal register to drive the programmed state to OCx. This allows a glitch free switch over of port from general purpose I/O to timer output once the OCPDx bit is set to zero. 16.4.4 Pulse Accumulator The pulse accumulator (PACNT) is a 16-bit counter that can operate in two modes: Event counter mode — Counting edges of selected polarity on the pulse accumulator input pin, PAI. Gated time accumulation mode — Counting pulses from a divide-by-64 clock. The PAMOD bit selects the mode of operation. The minimum pulse width for the PAI input is greater than two bus clocks. 16.4.5 Event Counter Mode Clearing the PAMOD bit configures the PACNT for event counter operation. An active edge on the IOC7 pin increments the pulse accumulator counter. The PEDGE bit selects falling edges or rising edges to increment the count. NOTE The PACNT input and timer channel 7 use the same pin IOC7. To use the IOC7, disconnect it from the output logic by clearing the channel 7 output mode and output level bits, OM7 and OL7. Also clear the channel 7 output compare 7 mask bit, OC7M7. The Pulse Accumulator counter register reflect the number of active input edges on the PACNT input pin since the last reset. The PAOVF bit is set when the accumulator rolls over from 0xFFFF to 0x0000. The pulse accumulator overflow interrupt enable bit, PAOVI, enables the PAOVF flag to generate interrupt requests. S12XS Family Reference Manual, Rev. 1.13 486 Freescale Semiconductor Timer Module (TIM16B8CV2) NOTE The pulse accumulator counter can operate in event counter mode even when the timer enable bit, TEN, is clear. 16.4.6 Gated Time Accumulation Mode Setting the PAMOD bit configures the pulse accumulator for gated time accumulation operation. An active level on the PACNT input pin enables a divided-by-64 clock to drive the pulse accumulator. The PEDGE bit selects low levels or high levels to enable the divided-by-64 clock. The trailing edge of the active level at the IOC7 pin sets the PAIF. The PAI bit enables the PAIF flag to generate interrupt requests. The pulse accumulator counter register reflect the number of pulses from the divided-by-64 clock since the last reset. NOTE The timer prescaler generates the divided-by-64 clock. If the timer is not active, there is no divided-by-64 clock. 16.5 Resets The reset state of each individual bit is listed within Section 16.3, “Memory Map and Register Definition” which details the registers and their bit fields. 16.6 Interrupts This section describes interrupts originated by the TIM16B8CV2 block. Table 16-25 lists the interrupts generated by the TIM16B8CV2 to communicate with the MCU. Table 16-25. TIM16B8CV1 Interrupts 1 Interrupt Offset1 Vector1 Priority1 Source Description C[7:0]F — — — Timer Channel 7–0 Active high timer channel interrupts 7–0 PAOVI — — — Pulse Accumulator Input Active high pulse accumulator input interrupt PAOVF — — — Pulse Accumulator Overflow Pulse accumulator overflow interrupt TOF — — — Timer Overflow Timer Overflow interrupt Chip Dependent. The TIM16B8CV2 uses a total of 11 interrupt vectors. The interrupt vector offsets and interrupt numbers are chip dependent. S12XS Family Reference Manual Rev. 1.13 Freescale Semiconductor 487 Timer Module (TIM16B8CV2) 16.6.1 Channel [7:0] Interrupt (C[7:0]F) This active high outputs will be asserted by the module to request a timer channel 7 – 0 interrupt to be serviced by the system controller. 16.6.2 Pulse Accumulator Input Interrupt (PAOVI) This active high output will be asserted by the module to request a timer pulse accumulator input interrupt to be serviced by the system controller. 16.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) This active high output will be asserted by the module to request a timer pulse accumulator overflow interrupt to be serviced by the system controller. 16.6.4 Timer Overflow Interrupt (TOF) This active high output will be asserted by the module to request a timer overflow interrupt to be serviced by the system controller. S12XS Family Reference Manual, Rev. 1.13 488 Freescale Semiconductor Chapter 17 Voltage Regulator (S12VREGL3V3V1) Table 17-1. Revision History Table Rev. No. Date (Item No.) (Submitted By) Sections Affected Substantial Change(s) V01.02 09 Sep 2005 Updates for API external access and LVR flags. V01.03 23 Sep 2005 VAE reset value is 1. V01.04 08 Jun 2007 Added temperature sensor to customer information 17.1 Introduction Module VREG_3V3 is a tri output voltage regulator that provides two separate 1.84V (typical) supplies differing in the amount of current that can be sourced and a 2.82V (typical) supply. The regulator input voltage range is from 3.3V up to 5V (typical). 17.1.1 Features Module VREG_3V3 includes these distinctive features: • Three parallel, linear voltage regulators with bandgap reference • Low-voltage detect (LVD) with low-voltage interrupt (LVI) • Power-on reset (POR) • Low-voltage reset (LVR) • High Temperature Detect (HTD) with High Temperature Interrupt (HTI) • Autonomous periodical interrupt (API) 17.1.2 Modes of Operation There are three modes VREG_3V3 can operate in: 1. Full performance mode (FPM) (MCU is not in stop mode) The regulator is active, providing the nominal supply voltages with full current sourcing capability. Features LVD (low-voltage detect), LVR (low-voltage reset), and POR (power-on reset) and HTD (High Temperature Detect) are available. The API is available. 2. Reduced power mode (RPM) (MCU is in stop mode) The purpose is to reduce power consumption of the device. The output voltage may degrade to a lower value than in full performance mode, additionally the current sourcing capability is substantially reduced. Only the POR is available in this mode, LVD, LVR and HTD are disabled. The API is available. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 489 Voltage Regulator (S12VREGL3V3V1) 3. Shutdown mode Controlled by VREGEN (see device level specification for connectivity of VREGEN). This mode is characterized by minimum power consumption. The regulator outputs are in a highimpedance state, only the POR feature is available, LVD, LVR and HTD are disabled. The API internal RC oscillator clock is not available. This mode must be used to disable the chip internal regulator VREG_3V3, i.e., to bypass the VREG_3V3 to use external supplies. 17.1.3 Block Diagram Figure 17-1 shows the function principle of VREG_3V3 by means of a block diagram. The regulator core REG consists of three parallel subblocks, REG1, REG2 and REG3, providing three independent output voltages. S12XS Family Reference Manual, Rev. 1.13 490 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) Figure 17-1. VREG_3V3 Block Diagram VBG VDDPLL REG3 VSSPLL REG VDDR VDDA VDDF REG2 VSSA VDD REG1 VSS LVD LVR LVR POR POR VDDX C HTD VREGEN CTRL API Rate Select HTI LVI API API Bus Clock LVD: Low Voltage Detect REG: Regulator Core LVR: Low Voltage Reset CTRL: Regulator Control POR: Power-on Reset API: Auto. Periodical Interrupt HTD: High Temperature Detect PIN S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 491 Voltage Regulator (S12VREGL3V3V1) 17.2 External Signal Description Due to the nature of VREG_3V3 being a voltage regulator providing the chip internal power supply voltages, most signals are power supply signals connected to pads. Table 17-2 shows all signals of VREG_3V3 associated with pins. Table 17-2. Signal Properties Name Function Reset State Pull Up VDDR Power input (positive supply) — — VDDA Quiet input (positive supply) — — VSSA Quiet input (ground) — — VDDX Power input (positive supply) — — VDD Primary output (positive supply) — — VSS Primary output (ground) — — Secondary output (positive supply) — — VDDPLL Tertiary output (positive supply) — — VSSPLL Tertiary output (ground) — — Optional Regulator Enable — — VREG Autonomous Periodical Interrupt output — — VDDF VREGEN (optional) VREG_API (optional) NOTE Check device level specification for connectivity of the signals. 17.2.1 VDDR — Regulator Power Input Pins Signal VDDR is the power input of VREG_3V3. All currents sourced into the regulator loads flow through this pin. A chip external decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDR and VSSR (if VSSR is not available VSS) can smooth ripple on VDDR. For entering Shutdown Mode, pin VDDR should also be tied to ground on devices without VREGEN pin. 17.2.2 VDDA, VSSA — Regulator Reference Supply Pins Signals VDDA/VSSA, which are supposed to be relatively quiet, are used to supply the analog parts of the regulator. Internal precision reference circuits are supplied from these signals. A chip external decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDA and VSSA can further improve the quality of this supply. 17.2.3 VDD, VSS — Regulator Output1 (Core Logic) Pins Signals VDD/VSS are the primary outputs of VREG_3V3 that provide the power supply for the core logic. These signals are connected to device pins to allow external decoupling capacitors (220 nF, X7R ceramic). S12XS Family Reference Manual, Rev. 1.13 492 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) In Shutdown Mode an external supply driving VDD/VSS can replace the voltage regulator. 17.2.4 VDDF — Regulator Output2 (NVM Logic) Pins Signals VDDF/VSS are the secondary outputs of VREG_3V3 that provide the power supply for the NVM logic. These signals are connected to device pins to allow external decoupling capacitors (220 nF, X7R ceramic). In Shutdown Mode an external supply driving VDDF/VSS can replace the voltage regulator. 17.2.5 VDDPLL, VSSPLL — Regulator Output3 (PLL) Pins Signals VDDPLL/VSSPLL are the secondary outputs of VREG_3V3 that provide the power supply for the PLL and oscillator. These signals are connected to device pins to allow external decoupling capacitors (100 nF...220 nF, X7R ceramic). In Shutdown Mode, an external supply driving VDDPLL/VSSPLL can replace the voltage regulator. 17.2.6 VDDX — Power Input Pin Signals VDDX/VSS are monitored by VREG_3V3 with the LVR feature. 17.2.7 VREGEN — Optional Regulator Enable Pin This optional signal is used to shutdown VREG_3V3. In that case, VDD/VSS and VDDPLL/VSSPLL must be provided externally. Shutdown mode is entered with VREGEN being low. If VREGEN is high, the VREG_3V3 is either in Full Performance Mode or in Reduced Power Mode. For the connectivity of VREGEN, see device specification. NOTE Switching from FPM or RPM to shutdown of VREG_3V3 and vice versa is not supported while MCU is powered. 17.2.8 VREG_API — Optional Autonomous Periodical Interrupt Output Pin This pin provides the signal selected via APIEA if system is set accordingly. See 17.3.2.3, “Autonomous Periodical Interrupt Control Register (VREGAPICL) and 17.4.8, “Autonomous Periodical Interrupt (API) for details. For the connectivity of VREG_API, see device specification. 17.3 Memory Map and Register Definition This section provides a detailed description of all registers accessible in VREG_3V3. If enabled in the system, the VREG_3V3 will abort all read and write accesses to reserved registers within it’s memory slice. See device level specification for details. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 493 Voltage Regulator (S12VREGL3V3V1) 17.3.1 Module Memory Map A summary of the registers associated with the VREG_3V3 sub-block is shown in Table 17-3. Detailed descriptions of the registers and bits are given in the subsections that follow Address Name Bit 7 0 6 0 5 4 3 0 2 HTDS VSEL VAE HTEN 0 0 0 0 LVDS 0 0 APIFES APIEA APIFE 1 Bit 0 HTIE HTIF LVIE LVIF APIE APIF 0 0 0x02F0 R VREGHTCL W 0x02F1 VREGCTRL 0x02F2 VREGAPIC R L W APICLK 0x02F3 VREGAPIT R R W APITR5 APITR4 APITR3 APITR2 APITR1 APITR0 0x02F4 VREGAPIR R H W APIR15 APIR14 APIR13 APIR12 APIR11 APIR10 APIR9 APIR8 0x02F5 VREGAPIR R L W APIR7 APIR6 APIR5 APIR4 APIR3 APIR2 APIR1 APIR0 0 0 0 0 0 0 0 0 0 0 0 HTTR3 HTTR2 HTTR1 HTTR0 R W 0x02F6 Reserved 06 R W 0x02F7 VREGHTTR R W HTOEN Table 17-3. Register Summary S12XS Family Reference Manual, Rev. 1.13 494 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) 17.3.2 Register Descriptions This section describes all the VREG_3V3 registers and their individual bits. 17.3.2.1 High Temperature Control Register (VREGHTCL) The VREGHTCL register allows to configure the VREG temperature sense features. 0x02F0 R 7 6 0 0 W Reset 0 0 5 4 3 VSEL VAE HTEN 0 1 0 2 1 0 HTIE HTIF 0 0 HTDS 0 = Unimplemented or Reserved Table 17-4. VREGHTCL Field Descriptions Field 7, 6 Reserved Description These reserved bits are used for test purposes and writable only in special modes. They must remain clear for correct temperature sensor operation. 5 VSEL Voltage Access Select Bit — If set, the bandgap reference voltage VBG can be accessed internally (i.e. multiplexed to an internal Analog to Digital Converter channel). The internal access must be enabled by bit VAE. See device level specification for connectivity. 0 An internal temperature proportional voltage VHT can be accessed internally if VAE is set. 1 Bandgap reference voltage VBG can be accessed internally if VAE is set. 4 VAE Voltage Access Enable Bit — If set, the voltage selected by bit VSEL can be accessed internally (i.e. multiplexed to an internal Analog to Digital Converter channel). See device level specification for connectivity. 0 Voltage selected by VSEL can not be accessed internally (i.e. External analog input is connected to Analog to Digital Converter channel). 1 Voltage selected by VSEL can be accessed internally. 3 HTEN High Temperature Enable Bit — If set the temperature sense is enabled. 0 The temperature sense is disabled. 1 The temperature sense is enabled. 2 HTDS High Temperature Detect Status Bit — This read-only status bit reflects the temperature status. Writes have no effect. 0 Temperature TDIE is below level THTID or RPM or Shutdown Mode. 1 Temperature TDIE is above level THTIA and FPM. 1 HTIE High Temperature Interrupt Enable Bit 0 Interrupt request is disabled. 1 Interrupt will be requested whenever HTIF is set. 0 HTIF High Temperature Interrupt Flag — HTIF — High Temperature Interrupt Flag HTIF is set to 1 when HTDS status bit changes. This flag can only be cleared by writing a 1.}Writing a 0 has no effect. If enabled (HTIE=1), HTIF causes an interrupt request. 0 No change in HTDS bit. 1 HTDS bit has changed. Note: On entering the reduced power mode the HTIF is not cleared by the VREG. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 495 Voltage Regulator (S12VREGL3V3V1) 17.3.2.2 Control Register (VREGCTRL) The VREGCTRL register allows the configuration of the VREG_3V3 low-voltage detect features. 0x02F1 R 7 6 5 4 3 2 0 0 0 0 0 LVDS 0 0 0 0 0 W Reset 0 1 0 LVIE LVIF 0 0 = Unimplemented or Reserved Figure 17-2. Control Register (VREGCTRL) Table 17-5. VREGCTRL Field Descriptions Field Description 2 LVDS Low-Voltage Detect Status Bit — This read-only status bit reflects the input voltage. Writes have no effect. 0 Input voltage VDDA is above level VLVID or RPM or shutdown mode. 1 Input voltage VDDA is below level VLVIA and FPM. 1 LVIE Low-Voltage Interrupt Enable Bit 0 Interrupt request is disabled. 1 Interrupt will be requested whenever LVIF is set. 0 LVIF Low-Voltage Interrupt Flag — LVIF is set to 1 when LVDS status bit changes. This flag can only be cleared by writing a 1. Writing a 0 has no effect. If enabled (LVIE = 1), LVIF causes an interrupt request. 0 No change in LVDS bit. 1 LVDS bit has changed. Note: On entering the Reduced Power Mode the LVIF is not cleared by the VREG_3V3. S12XS Family Reference Manual, Rev. 1.13 496 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) 17.3.2.3 Autonomous Periodical Interrupt Control Register (VREGAPICL) The VREGAPICL register allows the configuration of the VREG_3V3 autonomous periodical interrupt features. 0x02F2 7 R W Reset APICLK 0 6 5 0 0 0 0 4 3 2 1 0 APIES APIEA APIFE APIE APIF 0 0 0 0 0 = Unimplemented or Reserved Figure 17-3. Autonomous Periodical Interrupt Control Register (VREGAPICL) Table 17-6. VREGAPICL Field Descriptions Field 7 APICLK Description Autonomous Periodical Interrupt Clock Select Bit — Selects the clock source for the API. Writable only if APIFE = 0; APICLK cannot be changed if APIFE is set by the same write operation. 0 Autonomous periodical interrupt clock used as source. 1 Bus clock used as source. 4 APIES Autonomous Periodical Interrupt External Select Bit — Selects the waveform at the external pin.If set, at the external pin a clock is visible with 2 times the selected API Period (Table 17-10). If not set, at the external pin will be a high pulse at the end of every selected period with the size of half of the min period (Table 17-10). See device level specification for connectivity. 0 At the external periodic high pulses are visible, if APIEA and APIFE is set. 1 At the external pin a clock is visible, if APIEA and APIFE is set. 3 APIEA Autonomous Periodical Interrupt External Access Enable Bit — If set, the waveform selected by bit APIES can be accessed externally. See device level specification for connectivity. 0 Waveform selected by APIES can not be accessed externally. 1 Waveform selected by APIES can be accessed externally, if APIFE is set. 2 APIFE Autonomous Periodical Interrupt Feature Enable Bit — Enables the API feature and starts the API timer when set. 0 Autonomous periodical interrupt is disabled. 1 Autonomous periodical interrupt is enabled and timer starts running. 1 APIE Autonomous Periodical Interrupt Enable Bit 0 API interrupt request is disabled. 1 API interrupt will be requested whenever APIF is set. 0 APIF Autonomous Periodical Interrupt Flag — APIF is set to 1 when the in the API configured time has elapsed. This flag can only be cleared by writing a 1 to it. Clearing of the flag has precedence over setting. Writing a 0 has no effect. If enabled (APIE = 1), APIF causes an interrupt request. 0 API timeout has not yet occurred. 1 API timeout has occurred. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 497 Voltage Regulator (S12VREGL3V3V1) 17.3.2.4 Autonomous Periodical Interrupt Trimming Register (VREGAPITR) The VREGAPITR register allows to trim the API timeout period. 0x02F3 7 R W Reset 6 5 4 3 2 APITR5 APITR4 APITR3 APITR2 APITR1 APITR0 01 01 01 01 01 01 1 0 0 0 0 0 1. Reset value is either 0 or preset by factory. See Section 1 (Device Overview) for details. = Unimplemented or Reserved Figure 17-4. Autonomous Periodical Interrupt Trimming Register (VREGAPITR) Table 17-7. VREGAPITR Field Descriptions Field 7–2 APITR[5:0] Description Autonomous Periodical Interrupt Period Trimming Bits — See Table 17-8 for trimming effects. Table 17-8. Trimming Effect of APIT Bit Trimming Effect APITR[5] Increases period APITR[4] Decreases period less than APITR[5] increased it APITR[3] Decreases period less than APITR[4] APITR[2] Decreases period less than APITR[3] APITR[1] Decreases period less than APITR[2] APITR[0] Decreases period less than APITR[1] S12XS Family Reference Manual, Rev. 1.13 498 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) 17.3.2.5 Autonomous Periodical Interrupt Rate High and Low Register (VREGAPIRH / VREGAPIRL) The VREGAPIRH and VREGAPIRL register allows the configuration of the VREG_3V3 autonomous periodical interrupt rate. 0x02F4 R W Reset 7 6 5 4 3 2 1 0 APIR15 APIR14 APIR13 APIR12 APIR11 APIR10 APIR9 APIR8 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 17-5. Autonomous Periodical Interrupt Rate High Register (VREGAPIRH) 0x02F5 R W Reset 7 6 5 4 3 2 1 0 APIR7 APIR6 APIR5 APIR4 APIR3 APIR2 APIR1 APIR0 0 0 0 0 0 0 0 0 Figure 17-6. Autonomous Periodical Interrupt Rate Low Register (VREGAPIRL) Table 17-9. VREGAPIRH / VREGAPIRL Field Descriptions Field Description 15-0 APIR[15:0] Autonomous Periodical Interrupt Rate Bits — These bits define the timeout period of the API. See Table 1710 for details of the effect of the autonomous periodical interrupt rate bits. Writable only if APIFE = 0 of VREGAPICL register. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 499 Voltage Regulator (S12VREGL3V3V1) Table 17-10. Selectable Autonomous Periodical Interrupt Periods APICLK APIR[15:0] Selected Period 0 0000 0.2 ms1 0 0001 0.4 ms1 0 0002 0.6 ms1 0 0003 0.8 ms1 0 0004 1.0 ms1 0 0005 1.2 ms1 0 ..... 0 FFFD 13106.8 ms1 0 FFFE 13107.0 ms1 0 FFFF 13107.2 ms1 1 0000 2 * bus clock period 1 0001 4 * bus clock period 1 0002 6 * bus clock period 1 0003 8 * bus clock period 1 0004 10 * bus clock period 1 0005 12 * bus clock period 1 ..... ..... 1 FFFD 131068 * bus clock period 1 FFFE 131070 * bus clock period ..... 1 FFFF 131072 * bus clock period When trimmed within specified accuracy. See electrical specifications for details. 1 The period can be calculated as follows depending of APICLK: Period = 2*(APIR[15:0] + 1) * 0.1 ms or period = 2*(APIR[15:0] + 1) * bus clock period S12XS Family Reference Manual, Rev. 1.13 500 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) 17.3.2.6 Reserved 06 The Reserved 06 is reserved for test purposes. 0x02F6 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset 0 = Unimplemented or Reserved Figure 17-7. Reserved 06 17.3.2.7 High Temperature Trimming Register (VREGHTTR) The VREGHTTR register allows to trim the VREG temperature sense. Fiption 0x02F7 7 R W Reset HTOEN 0 6 5 4 0 0 0 0 0 0 3 2 1 0 HTTR3 HTTR2 HTTR1 HTTR0 01 01 01 01 1. Reset value is either 0 or preset by factory. See Section 1 (Device Overview) for details. = Unimplemented or Reserved Figure 17-8. VREGHTTR Table 17-11. VREGHTTR field descriptions Field 7 HTOEN 3–0 HTTR[3:0] Description High Temperature Offset Enable Bit — If set the temperature sense offset is enabled 0 The temperature sense offset is disabled 1 The temperature sense offset is enabled High Temperature Trimming Bits — See Table 23-16 for trimming effects. Table 17-12. Trimming Effect Bit Trimming Effect HTTR[3] Increases VHT twice of HTTR[2] HTTR[2] Increases VHT twice of HTTR[1] HTTR[1] Increases VHT twice of HTTR[0] HTTR[0] Increases VHT (to compensate Temperature Offset) S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 501 Voltage Regulator (S12VREGL3V3V1) 17.4 Functional Description 17.4.1 General Module VREG_3V3 is a voltage regulator, as depicted in Figure 17-1. The regulator functional elements are the regulator core (REG), a low-voltage detect module (LVD), a control block (CTRL), a power-on reset module (POR), and a low-voltage reset module (LVR)and a high temperature sensor (HTD). 17.4.2 Regulator Core (REG) Respectively its regulator core has three parallel, independent regulation loops (REG1,REG2 and REG3). REG1 and REG3 differ only in the amount of current that can be delivered. The regulators are linear regulator with a bandgap reference when operated in Full Performance Mode. They act as a voltage clamp in Reduced Power Mode. All load currents flow from input VDDR to VSS or VSSPLL. The reference circuits are supplied by VDDA and VSSA. 17.4.2.1 Full Performance Mode In Full Performance Mode, the output voltage is compared with a reference voltage by an operational amplifier. The amplified input voltage difference drives the gate of an output transistor. 17.4.2.2 Reduced Power Mode In Reduced Power Mode, the gate of the output transistor is connected directly to a reference voltage to reduce power consumption. Mode switching from reduced power to full performance requires a transition time of tvup, if the voltage regulator is enabled. 17.4.3 Low-Voltage Detect (LVD) Subblock LVD is responsible for generating the low-voltage interrupt (LVI). LVD monitors the input voltage (VDDA–VSSA) and continuously updates the status flag LVDS. Interrupt flag LVIF is set whenever status flag LVDS changes its value. The LVD is available in FPM and is inactive in Reduced Power Mode or Shutdown Mode. 17.4.4 Power-On Reset (POR) This functional block monitors VDD. If VDD is below VPORD, POR is asserted; if VDD exceeds VPORD, the POR is deasserted. POR asserted forces the MCU into Reset. POR Deasserted will trigger the poweron sequence. 17.4.5 Low-Voltage Reset (LVR) Block LVR monitors the supplies VDD, VDDX and VDDF. If one (or more) drops below it’s corresponding assertion level, signal LVR asserts; if all VDD,VDDX and VDDF supplies are above their S12XS Family Reference Manual, Rev. 1.13 502 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) corresponding deassertion levels, signal LVR deasserts. The LVR function is available only in Full Performance Mode. 17.4.6 HTD - High Temperature Detect Subblock HTD is responsible for generating the high temperature interrupt (HTI). HTD monitors the die temperature TDIE and continuously updates the status flag HTDS. Interrupt flag HTIF is set whenever status flag HTDS changes its value. The HTD is available in FPM and is inactive in Reduced Power Mode and Shutdown Mode. The HT Trimming bits HTTR[3:0] can be set so that the temperature offset is zero, if accurate temperature measurement is desired. See Table 23-16 for the trimming effect of APITR. 17.4.7 Regulator Control (CTRL) This part contains the register block of VREG_3V3 and further digital functionality needed to control the operating modes. CTRL also represents the interface to the digital core logic. 17.4.8 Autonomous Periodical Interrupt (API) Subblock API can generate periodical interrupts independent of the clock source of the MCU. To enable the timer, the bit APIFE needs to be set. The API timer is either clocked by a trimmable internal RC oscillator or the bus clock. Timer operation will freeze when MCU clock source is selected and bus clock is turned off. See CRG specification for details. The clock source can be selected with bit APICLK. APICLK can only be written when APIFE is not set. The APIR[15:0] bits determine the interrupt period. APIR[15:0] can only be written when APIFE is cleared. As soon as APIFE is set, the timer starts running for the period selected by APIR[15:0] bits. When the configured time has elapsed, the flag APIF is set. An interrupt, indicated by flag APIF = 1, is triggered if interrupt enable bit APIE = 1. The timer is started automatically again after it has set APIF. The procedure to change APICLK or APIR[15:0] is first to clear APIFE, then write to APICLK or APIR[15:0], and afterwards set APIFE. The API Trimming bits APITR[5:0] must be set so the minimum period equals 0.2 ms if stable frequency is desired. See Table 17-8 for the trimming effect of APITR. NOTE The first period after enabling the counter by APIFE might be reduced by API start up delay tsdel. The API internal RC oscillator clock is not available if VREG_3V3 is in Shutdown Mode. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 503 Voltage Regulator (S12VREGL3V3V1) It is possible to generate with the API a waveform at an external pin by enabling the API by setting APIFE and enabling the external access with setting APIEA. By setting APIES the waveform can be selected. If APIES is set, then at the external pin a clock is visible with 2 times the selected API Period (Table 17-10). If APIES is not set, then at the external pin will be a high pulse at the end of every selected period with the size of half of the min period (Table 17-10). See device level specification for connectivity. 17.4.9 Resets This section describes how VREG_3V3 controls the reset of the MCU.The reset values of registers and signals are provided in Section 17.3, “Memory Map and Register Definition”. Possible reset sources are listed in Table 17-13. Table 17-13. Reset Sources Reset Source Local Enable Power-on reset Always active Low-voltage reset Available only in Full Performance Mode 17.4.10 Description of Reset Operation 17.4.10.1 Power-On Reset (POR) During chip power-up the digital core may not work if its supply voltage VDD is below the POR deassertion level (VPORD). Therefore, signal POR, which forces the other blocks of the device into reset, is kept high until VDD exceeds VPORD. The MCU will run the start-up sequence after POR deassertion. The power-on reset is active in all operation modes of VREG_3V3. 17.4.10.2 Low-Voltage Reset (LVR) For details on low-voltage reset, see Section 17.4.5, “Low-Voltage Reset (LVR)”. 17.4.11 Interrupts This section describes all interrupts originated by VREG_3V3. The interrupt vectors requested by VREG_3V3 are listed in Table 17-14. Vector addresses and interrupt priorities are defined at MCU level. Table 17-14. Interrupt Vectors Interrupt Source Local Enable Low-voltage interrupt (LVI) LVIE = 1; available only in Full Performance Mode High Temperature Interrupt (HTI) HTIE=1; available only in Full Performance Mode Autonomous periodical interrupt (API) APIE = 1 S12XS Family Reference Manual, Rev. 1.13 504 Freescale Semiconductor Voltage Regulator (S12VREGL3V3V1) 17.4.11.1 Low-Voltage Interrupt (LVI) In FPM, VREG_3V3 monitors the input voltage VDDA. Whenever VDDA drops below level VLVIA, the status bit LVDS is set to 1. On the other hand, LVDS is reset to 0 when VDDA rises above level VLVID. An interrupt, indicated by flag LVIF = 1, is triggered by any change of the status bit LVDS if interrupt enable bit LVIE = 1. NOTE On entering the Reduced Power Mode, the LVIF is not cleared by the VREG_3V3. 17.4.11.2 HTI - High Temperature Interrupt In FPM VREG monitors the die temperature TDIE. Whenever TDIE exceeds level THTIA the status bit HTDS is set to 1. Vice versa, HTDS is reset to 0 when TDIE get below level THTID. An interrupt, indicated by flag HTIF=1, is triggered by any change of the status bit HTDS if interrupt enable bit HTIE=1. NOTE On entering the Reduced Power Mode the HTIF is not cleared by the VREG. 17.4.11.3 Autonomous Periodical Interrupt (API) As soon as the configured timeout period of the API has elapsed, the APIF bit is set. An interrupt, indicated by flag APIF = 1, is triggered if interrupt enable bit APIE = 1. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 505 Voltage Regulator (S12VREGL3V3V1) S12XS Family Reference Manual, Rev. 1.13 506 Freescale Semiconductor Chapter 18 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-1. Revision History Revision Number Revision Date V01.04 03 Jan 2008 V01.05 19 Dec 2008 18.1/18-507 18.4.2.4/18-542 18.4.2.6/18-544 18.4.2.11/18-54 7 18.4.2.11/18-54 7 18.4.2.11/18-54 7 V01.06 25 Sep 2009 The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: 18.3.2/18-514 - Add caution concerning register writes while command is active 18.3.2.1/18-516 - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear 18.4.1.2/18-536 - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during 18.6/18-556 reset sequence 18.1 Sections Affected Description of Changes - Cosmetic changes - Clarify single bit fault correction for P-Flash phrase - Add statement concerning code runaway when executing Read Once, Program Once, and Verify Backdoor Access Key commands from Flash block containing associated fields - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” in Section 18.4.2.11 Introduction The FTMR256K1 module implements the following: • 256 Kbytes of P-Flash (Program Flash) memory • 8 Kbytes of D-Flash (Data Flash) memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 507 256 KByte Flash Module (S12XFTMR256K1V1) CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that specific Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 18.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store for data. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once field. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register. 18.1.2 18.1.2.1 • • Features P-Flash Features 256 Kbytes of P-Flash memory composed of one 256 Kbyte Flash block divided into 256 sectors of 1024 bytes Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations S12XS Family Reference Manual, Rev. 1.13 508 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) • • • Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Flexible protection scheme to prevent accidental program or erase of P-Flash memory 18.1.2.2 • • • • • • 8 Kbytes of D-Flash memory composed of one 8 Kbyte Flash block divided into 32 sectors of 256 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of D-Flash memory Ability to program up to four words in a burst sequence 18.1.2.3 • • • D-Flash Features Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 18.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 18-1. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 509 256 KByte Flash Module (S12XFTMR256K1V1) Flash Interface Command Interrupt Request Registers Error Interrupt Request Protection 16bit internal bus P-Flash 32Kx72 16Kx72 16Kx72 sector 0 sector 1 sector 0 sector 1 sector 127 sector 127 Security Oscillator Clock (XTAL) CPU Clock Divider FCLK Memory Controller D-Flash 4Kx22 Scratch RAM 384x16 sector 0 sector 1 sector 31 Figure 18-1. FTMR256K1 Block Diagram 18.2 External Signal Description The Flash module contains no signals that connect off-chip. 18.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. S12XS Family Reference Manual, Rev. 1.13 510 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) 18.3.1 Module Memory Map The S12X architecture places the P-Flash memory between global addresses 0x7C_0000 and 0x7F_FFFF as shown in Table 18-2. The P-Flash memory map is shown in Figure 18-2. Table 18-2. P-Flash Memory Addressing Global Address Size (Bytes) 0x7C_0000 – 0x7F_FFFF 256 K Description P-Flash Block 0 Contains Flash Configuration Field (see Table 18-3) The FPROT register, described in Section 18.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 18-3. Table 18-3. Flash Configuration Field1 Global Address Size (Bytes) 0x7F_FF00 – 0x7F_FF07 8 Backdoor Comparison Key Refer to Section 18.4.2.11, “Verify Backdoor Access Key Command,” and Section 18.5.1, “Unsecuring the MCU using Backdoor Key Access” 0x7F_FF08 – 0x7F_FF0B2 4 Reserved 0x7F_FF0C2 1 P-Flash Protection byte. Refer to Section 18.3.2.9, “P-Flash Protection Register (FPROT)” 0x7F_FF0D2 1 D-Flash Protection byte. Refer to Section 18.3.2.10, “D-Flash Protection Register (DFPROT)” 0x7F_FF0E2 1 Flash Nonvolatile byte Refer to Section 18.3.2.15, “Flash Option Register (FOPT)” 0x7F_FF0F2 1 Flash Security byte Refer to Section 18.3.2.2, “Flash Security Register (FSEC)” 1 2 Description Older versions may have swapped protection byte addresses 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved field should be programmed to 0xFF. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 511 256 KByte Flash Module (S12XFTMR256K1V1) P-Flash START = 0x7C_0000 Flash Protected/Unprotected Region 224 Kbytes 0x7F_8000 0x7F_8400 0x7F_8800 0x7F_9000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_A000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x7F_C000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x7F_F000 0x7F_F800 P-Flash END = 0x7F_FFFF Flash Configuration Field 16 bytes (0x7F_FF00 - 0x7F_FF0F) Figure 18-2. P-Flash Memory Map S12XS Family Reference Manual, Rev. 1.13 512 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-4. Program IFR Fields Global Address (PGMIFRON) Size (Bytes) 0x40_0000 – 0x40_0007 8 Device ID 0x40_0008 – 0x40_00E7 224 Reserved 0x40_00E8 – 0x40_00E9 2 Version ID 0x40_00EA – 0x40_00FF 22 Reserved 0x40_0100 – 0x40_013F 64 Program Once Field Refer to Section 18.4.2.6, “Program Once Command” 0x40_0140 – 0x40_01FF 192 Reserved Field Description Table 18-5. D-Flash and Memory Controller Resource Fields Global Address Size (Bytes) 0x10_0000 – 0x10_1FFF 8,192 0x10_2000 – 0x11_FFFF 122,880 0x12_0000 – 0x12_007F 128 0x12_0080 – 0x12_0FFF 3,968 Reserved 0x12_1000 – 0x12_1FFF 4,096 Reserved 0x12_2000 – 0x12_3CFF 7,242 Reserved 0x12_3D00 – 0x12_3FFF 768 0x12_4000 – 0x12_E7FF 43,008 Reserved 0x12_E800 – 0x12_FFFF 6,144 Reserved 0x13_0000 – 0x13_FFFF 65,536 Reserved 1 Description D-Flash Memory Reserved D-Flash Nonvolatile Information Register (DFIFRON1 = 1) Memory Controller Scratch RAM (MGRAMON1 = 1) MMCCTL1 register bit S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 513 256 KByte Flash Module (S12XFTMR256K1V1) D-Flash START = 0x10_0000 D-Flash Memory 8 Kbytes D-Flash END = 0x10_1FFF 0x12_0000 D-Flash Nonvolatile Information Register (DFIFRON) 128 bytes 0x12_1000 0x12_2000 Memory Controller Scratch RAM (MGRAMON) 768 bytes 0x12_4000 0x12_E800 0x12_FFFF Figure 18-3. D-Flash and Memory Controller Resource Memory Map 18.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 18-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 7 R 6 5 4 3 2 1 0 FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 FDIVLD W R KEYEN1 W Figure 18-4. FTMR256K1 Register Summary S12XS Family Reference Manual, Rev. 1.13 514 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Address & Name 0x0002 FCCOBIX 0x0003 FECCRIX 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 DFPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV0 0x000D FRSV1 0x000E FECCRHI 0x000F FECCRLO R 7 6 5 4 3 0 0 0 0 0 2 1 0 CCOBIX2 CCOBIX1 CCOBIX0 ECCRIX2 ECCRIX1 ECCRIX0 FDFD FSFD DFDIE SFDIE MGSTAT1 MGSTAT0 DFDIF SFDIF W R 0 0 0 0 0 W R 0 0 CCIE 0 0 IGNSF W R 0 W R 0 CCIF ACCERR FPVIOL 0 0 MGBUSY RSVD 0 0 W R 0 0 W R RNV6 FPOPEN FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 DPS4 DPS3 DPS2 DPS1 DPS0 W R 0 0 DPOPEN W R CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 W R W R W R W R W R W Figure 18-4. FTMR256K1 Register Summary (continued) S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 515 256 KByte Flash Module (S12XFTMR256K1V1) Address & Name 0x0010 FOPT 0x0011 FRSV2 0x0012 FRSV3 0x0013 FRSV4 R 7 6 5 4 3 2 1 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W R W R W R W = Unimplemented or Reserved Figure 18-4. FTMR256K1 Register Summary (continued) 18.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 R 6 5 4 3 2 1 0 0 0 0 FDIVLD FDIV[6:0] W Reset 0 0 0 0 0 = Unimplemented or Reserved Figure 18-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table 18-6. FCLKDIV Field Descriptions Field 7 FDIVLD 6–0 FDIV[6:0] Description Clock Divider Loaded 0 FCLKDIV register has not been written 1 FCLKDIV register has been written since the last reset Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 18-7 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 18.4.1, “Flash Command Operations,” for more information. S12XS Family Reference Manual, Rev. 1.13 516 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 517 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-7. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) 1 2 MIN1 MAX 1.60 2.10 2.40 FDIV[6:0] 2 OSCCLK Frequency (MHz) FDIV[6:0] MIN1 2 MAX 0x01 33.60 34.65 0x20 3.15 0x02 34.65 35.70 0x21 3.20 4.20 0x03 35.70 36.75 0x22 4.20 5.25 0x04 36.75 37.80 0x23 5.25 6.30 0x05 37.80 38.85 0x24 6.30 7.35 0x06 38.85 39.90 0x25 7.35 8.40 0x07 39.90 40.95 0x26 8.40 9.45 0x08 40.95 42.00 0x27 9.45 10.50 0x09 42.00 43.05 0x28 10.50 11.55 0x0A 43.05 44.10 0x29 11.55 12.60 0x0B 44.10 45.15 0x2A 12.60 13.65 0x0C 45.15 46.20 0x2B 13.65 14.70 0x0D 46.20 47.25 0x2C 14.70 15.75 0x0E 47.25 48.30 0x2D 15.75 16.80 0x0F 48.30 49.35 0x2E 16.80 17.85 0x10 49.35 50.40 0x2F 17.85 18.90 0x11 18.90 19.95 0x12 19.95 21.00 0x13 21.00 22.05 0x14 22.05 23.10 0x15 23.10 24.15 0x16 24.15 25.20 0x17 25.20 26.25 0x18 26.25 27.30 0x19 27.30 28.35 0x1A 28.35 29.40 0x1B 29.40 30.45 0x1C 30.45 31.50 0x1D 31.50 32.55 0x1E 32.55 33.60 0x1F FDIV shown generates an FCLK frequency of >0.8 MHz FDIV shown generates an FCLK frequency of 1.05 MHz S12XS Family Reference Manual, Rev. 1.13 518 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) 18.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 R 6 5 4 KEYEN[1:0] 3 2 1 RNV[5:2] 0 SEC[1:0] W Reset F F F F F F F F = Unimplemented or Reserved Figure 18-6. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 18-3) as indicated by reset condition F in Figure 18-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 18-8. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 18-9. 5–2 RNV[5:2} Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. 1–0 SEC[1:0] Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 18-10. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 18-9. Flash KEYEN States 1 KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01 DISABLED1 10 ENABLED 11 DISABLED Preferred KEYEN state to disable backdoor key access. Table 18-10. Flash Security States SEC[1:0] Status of Security 00 SECURED 01 SECURED1 10 UNSECURED 11 SECURED S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 519 256 KByte Flash Module (S12XFTMR256K1V1) 1 Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 18.5. 18.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 R 7 6 5 4 3 0 0 0 0 0 2 1 0 CCOBIX[2:0] W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 18-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 18-11. FCCOBIX Field Descriptions Field Description 2–0 CCOBIX[1:0] Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 18.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. 18.3.2.4 Flash ECCR Index Register (FECCRIX) The FECCRIX register is used to index the FECCR register for ECC fault reporting. Offset Module Base + 0x0003 R 7 6 5 4 3 0 0 0 0 0 2 1 0 ECCRIX[2:0] W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 18-8. FECCR Index Register (FECCRIX) ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. Table 18-12. FECCRIX Field Descriptions Field Description 2-0 ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is ECCRIX[2:0] being read. See Section 18.3.2.14, “Flash ECC Error Results Register (FECCR),” for more details. S12XS Family Reference Manual, Rev. 1.13 520 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) 18.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. Offset Module Base + 0x0004 7 R 6 5 0 0 CCIE 4 3 2 0 0 IGNSF 1 0 FDFD FSFD 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 18-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 18-13. FCNFG Field Descriptions Field Description 7 CCIE Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 18.3.2.7) 4 IGNSF Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 18.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated 1 FDFD Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 18.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 18.3.2.6) 0 FSFD Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 18.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 18.3.2.6) 18.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 521 256 KByte Flash Module (S12XFTMR256K1V1) Offset Module Base + 0x0005 7 6 R 5 4 3 2 1 0 DFDIE SFDIE 0 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 18-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 18-14. FERCNFG Field Descriptions Field Description 1 DFDIE Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 18.3.2.8) 0 SFDIE Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 18.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 18.3.2.8) 18.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 R 6 5 4 ACCERR FPVIOL 0 0 0 CCIF 3 2 MGBUSY RSVD 0 0 1 0 MGSTAT[1:0] W Reset 1 0 01 01 = Unimplemented or Reserved Figure 18-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 18.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. S12XS Family Reference Manual, Rev. 1.13 522 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-15. FSTAT Field Descriptions Field Description 7 CCIF Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed 5 ACCERR Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 18.4.1.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected 4 FPVIOL Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or D-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected 3 MGBUSY 2 RSVD Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 18.4.2, “Flash Command Description,” and Section 18.6, “Initialization” for details. 18.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 R 7 6 5 4 3 2 0 0 0 0 0 0 1 0 DFDIF SFDIF 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 18-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 523 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-16. FERSTAT Field Descriptions Field Description 1 DFDIF Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. 0 No double bit fault detected 1 Double bit fault detected or an invalid Flash array read operation attempted 0 SFDIF Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or an invalid Flash array read operation attempted 18.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 R 6 5 4 3 2 1 0 RNV6 FPOPEN FPHDIS FPHS[1:0] FPLDIS FPLS[1:0] W Reset F F F F F F F F = Unimplemented or Reserved Figure 18-13. Flash Protection Register (FPROT) The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 18.3.2.9.1, “P-Flash Protection Restrictions,” and Table 18-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 18-3) as indicated by reset condition ‘F’ in Figure 18-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. S12XS Family Reference Manual, Rev. 1.13 524 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-17. FPROT Field Descriptions Field Description 7 FPOPEN Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 18-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits 6 RNV[6] Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. 5 FPHDIS Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x7F_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled 4–3 FPHS[1:0] Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 18-19. The FPHS bits can only be written to while the FPHDIS bit is set. 2 FPLDIS 1–0 FPLS[1:0] Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x7F_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 18-20. The FPLS bits can only be written to while the FPLDIS bit is set. Table 18-18. P-Flash Protection Function 1 Function1 FPOPEN FPHDIS FPLDIS 1 1 1 No P-Flash Protection 1 1 0 Protected Low Range 1 0 1 Protected High Range 1 0 0 Protected High and Low Ranges 0 1 1 Full P-Flash Memory Protected 0 1 0 Unprotected Low Range 0 0 1 Unprotected High Range 0 0 0 Unprotected High and Low Ranges For range sizes, refer to Table 18-19 and Table 18-20. Table 18-19. P-Flash Protection Higher Address Range FPHS[1:0] Global Address Range Protected Size 00 0x7F_F800–0x7F_FFFF 2 Kbytes 01 0x7F_F000–0x7F_FFFF 4 Kbytes 10 0x7F_E000–0x7F_FFFF 8 Kbytes 11 0x7F_C000–0x7F_FFFF 16 Kbytes S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 525 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-20. P-Flash Protection Lower Address Range FPLS[1:0] Global Address Range Protected Size 00 0x7F_8000–0x7F_83FF 1 Kbyte 01 0x7F_8000–0x7F_87FF 2 Kbytes 10 0x7F_8000–0x7F_8FFF 4 Kbytes 11 0x7F_8000–0x7F_9FFF 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 18-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. S12XS Family Reference Manual, Rev. 1.13 526 Freescale Semiconductor FPHDIS = 1 FPLDIS = 1 FPHDIS = 1 FPLDIS = 0 FPHDIS = 0 FPLDIS = 1 FPHDIS = 0 FPLDIS = 0 7 6 5 4 3 2 1 0 Scenario 0x7F_8000 0x7F_FFFF Scenario FPHS[1:0] FPLS[1:0] FLASH START FPOPEN = 1 256 KByte Flash Module (S12XFTMR256K1V1) FPHS[1:0] 0x7F_8000 FPOPEN = 0 FPLS[1:0] FLASH START 0x7F_FFFF Unprotected region Protected region with size defined by FPLS Protected region not defined by FPLS, FPHS Protected region with size defined by FPHS Figure 18-14. P-Flash Protection Scenarios S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 527 256 KByte Flash Module (S12XFTMR256K1V1) 18.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 18-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 18-21. P-Flash Protection Scenario Transitions To Protection Scenario1 From Protection Scenario 0 1 2 3 0 X X X X X 1 X 4 X X X X X X X X X X 6 X 7 1 X 6 7 X 3 5 5 X X 2 4 X X X X X X Allowed transitions marked with X, see Figure 18-14 for a definition of the scenarios. 18.3.2.10 D-Flash Protection Register (DFPROT) The DFPROT register defines which D-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 R 6 5 0 0 4 3 DPOPEN 2 1 0 F F DPS[4:0] W Reset F 0 0 F F F = Unimplemented or Reserved Figure 18-15. D-Flash Protection Register (DFPROT) The (unreserved) bits of the DFPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, the DFPROT register is loaded with the contents of the D-Flash protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 18-3) as indicated by reset condition F in Figure 18-15. To change the D-Flash protection that will be loaded during the reset sequence, the P-Flash sector containing the D-Flash protection byte must be unprotected, then the D-Flash protection byte must be programmed. If a double bit fault is detected while reading the S12XS Family Reference Manual, Rev. 1.13 528 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) P-Flash phrase containing the D-Flash protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the D-Flash memory fully protected. Trying to alter data in any protected area in the D-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the D-Flash memory is not possible if any of the D-Flash sectors are protected. Table 18-22. DFPROT Field Descriptions Field Description 7 DPOPEN D-Flash Protection Control 0 Enables D-Flash memory protection from program and erase with protected address range defined by DPS bits 1 Disables D-Flash memory protection from program and erase 4–0 DPS[4:0] D-Flash Protection Size — The DPS[4:0] bits determine the size of the protected area in the D-Flash memory as shown in Table 18-23. Table 18-23. D-Flash Protection Address Range DPS[4:0] Global Address Range Protected Size 0_0000 0x10_0000 – 0x10_00FF 256 bytes 0_0001 0x10_0000 – 0x10_01FF 512 bytes 0_0010 0x10_0000 – 0x10_02FF 768 bytes 0_0011 0x10_0000 – 0x10_03FF 1024 bytes 0_0100 0x10_0000 – 0x10_04FF 1280 bytes 0_0101 0x10_0000 – 0x10_05FF 1536 bytes 0_0110 0x10_0000 – 0x10_06FF 1792 bytes 0_0111 0x10_0000 – 0x10_07FF 2048 bytes 0_1000 0x10_0000 – 0x10_08FF 2304 bytes 0_1001 0x10_0000 – 0x10_09FF 2560 bytes 0_1010 0x10_0000 – 0x10_0AFF 2816 bytes 0_1011 0x10_0000 – 0x10_0BFF 3072 bytes 0_1100 0x10_0000 – 0x10_0CFF 3328 bytes 0_1101 0x10_0000 – 0x10_0DFF 3584 bytes 0_1110 0x10_0000 – 0x10_0EFF 3840 bytes 0_1111 0x10_0000 – 0x10_0FFF 4096 bytes 1_0000 0x10_0000 – 0x10_10FF 4352 bytes 1_0001 0x10_0000 – 0x10_11FF 4608 bytes 1_0010 0x10_0000 – 0x10_12FF 4864 bytes 1_0011 0x10_0000 – 0x10_13FF 5120 bytes 1_0100 0x10_0000 – 0x10_14FF 5376 bytes 1_0101 0x10_0000 – 0x10_15FF 5632 bytes S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 529 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-23. D-Flash Protection Address Range DPS[4:0] Global Address Range Protected Size 1_0110 0x10_0000 – 0x10_16FF 5888 bytes 1_0111 0x10_0000 – 0x10_17FF 6144 bytes 1_1000 0x10_0000 – 0x10_18FF 6400 bytes 1_1001 0x10_0000 – 0x10_19FF 6656 bytes 1_1010 0x10_0000 – 0x10_1AFF 6912 bytes 1_1011 0x10_0000 – 0x10_1BFF 7168 bytes 1_1100 0x10_0000 – 0x10_1CFF 7424 bytes 1_1101 0x10_0000 – 0x10_1DFF 7680 bytes 1_1110 0x10_0000 – 0x10_1EFF 7936 bytes 1_1111 0x10_0000 – 0x10_1FFF 8192 bytes 18.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 0 0 0 0 R CCOB[15:8] W Reset 0 0 0 0 Figure 18-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 0 0 0 0 R CCOB[7:0] W Reset 0 0 0 0 Figure 18-17. Flash Common Command Object Low Register (FCCOBLO) 18.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes S12XS Family Reference Manual, Rev. 1.13 530 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 18-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 18-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 18.4.2. Table 18-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) HI FCMD[7:0] defining Flash command LO 0, Global address [22:16] HI Global address [15:8] LO Global address [7:0] HI Data 0 [15:8] LO Data 0 [7:0] HI Data 1 [15:8] LO Data 1 [7:0] HI Data 2 [15:8] LO Data 2 [7:0] HI Data 3 [15:8] LO Data 3 [7:0] 000 001 010 011 100 101 18.3.2.12 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 18-18. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 531 256 KByte Flash Module (S12XFTMR256K1V1) 18.3.2.13 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000D R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 18-19. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 18.3.2.14 Flash ECC Error Results Register (FECCR) The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (see Section 18.3.2.4). Once ECC fault information has been stored, no other fault information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults the priority for fault recording is double bit fault over single bit fault. Offset Module Base + 0x000E 7 6 5 4 R 3 2 1 0 0 0 0 0 ECCR[15:8] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 18-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 7 6 5 4 R 3 2 1 0 0 0 0 0 ECCR[7:0] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 18-21. Flash ECC Error Results Low Register (FECCRLO) All FECCR bits are readable but not writable. S12XS Family Reference Manual, Rev. 1.13 532 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-25. FECCR Index Settings ECCRIX[2:0] 000 FECCR Register Content Bits [15:8] Bit[7] Bits[6:0] Parity bits read from Flash block 0 Global address [22:16] 001 Global address [15:0] 010 Data 0 [15:0] 011 Data 1 [15:0] (P-Flash only) 100 Data 2 [15:0] (P-Flash only) 101 Data 3 [15:0] (P-Flash only) 110 Not used, returns 0x0000 when read 111 Not used, returns 0x0000 when read Table 18-26. FECCR Index=000 Bit Descriptions Field 15:8 PAR[7:0] Description ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. 6–0 Global Address — The GADDR[22:16] field contains the upper seven bits of the global address having GADDR[22:16] caused the error. The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010. 18.3.2.15 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 R 3 2 1 0 F F F F NV[7:0] W Reset F F F F = Unimplemented or Reserved Figure 18-22. Flash Option Register (FOPT) All bits in the FOPT register are readable but are not writable. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 533 256 KByte Flash Module (S12XFTMR256K1V1) During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 18-3) as indicated by reset condition F in Figure 18-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. Table 18-27. FOPT Field Descriptions Field Description 7–0 NV[7:0] Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 18.3.2.16 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 18-23. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 18.3.2.17 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 18-24. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 18.3.2.18 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. S12XS Family Reference Manual, Rev. 1.13 534 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Offset Module Base + 0x0013 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 18-25. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 18.4 Functional Description 18.4.1 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution 18.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz. Table 18-7 shows recommended values for the FDIV field based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 535 256 KByte Flash Module (S12XFTMR256K1V1) 18.4.1.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 18.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. 18.4.1.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 18.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 18-26. S12XS Family Reference Manual, Rev. 1.13 536 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) START Read: FCLKDIV register Clock Register Written Check no FDIVLD Set? yes Write: FCLKDIV register Note: FCLKDIV must be set after each reset Read: FSTAT register FCCOB Availability Check CCIF Set? no Results from previous Command yes Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? yes no Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? no yes EXIT Figure 18-26. Generic Flash Command Write Sequence Flowchart S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 537 256 KByte Flash Module (S12XFTMR256K1V1) 18.4.1.3 Valid Flash Module Commands Table 18-28. Flash Commands by Mode Unsecured FCMD 1 2 3 4 5 6 7 8 18.4.1.4 Command Secured NS1 NX2 SS3 ST4 NS5 NX6 SS7 ST8 0x01 Erase Verify All Blocks ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x02 Erase Verify Block ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x03 Erase Verify P-Flash Section ∗ ∗ ∗ ∗ ∗ 0x04 Read Once ∗ ∗ ∗ ∗ ∗ 0x06 Program P-Flash ∗ ∗ ∗ ∗ ∗ 0x07 Program Once ∗ ∗ ∗ ∗ ∗ 0x08 Erase All Blocks ∗ ∗ ∗ ∗ 0x09 Erase Flash Block ∗ ∗ ∗ ∗ ∗ 0x0A Erase P-Flash Sector ∗ ∗ ∗ ∗ ∗ 0x0B Unsecure Flash ∗ ∗ ∗ ∗ 0x0C Verify Backdoor Access Key ∗ 0x0D Set User Margin Level ∗ 0x0E Set Field Margin Level 0x10 Erase Verify D-Flash Section ∗ 0x11 Program D-Flash 0x12 Erase D-Flash Sector ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode. Unsecured Normal Expanded mode. Unsecured Special Single Chip mode. Unsecured Special Mode. Secured Normal Single Chip mode. Secured Normal Expanded mode. Secured Special Single Chip mode. Secured Special Mode. P-Flash Commands Table 18-29 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. S12XS Family Reference Manual, Rev. 1.13 538 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-29. P-Flash Commands FCMD Command 0x01 Erase Verify All Blocks 0x02 Erase Verify Block 0x03 Erase Verify P-Flash Section 0x04 Read Once 0x06 Program P-Flash 0x07 Program Once Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. 0x08 Erase All Blocks Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. 0x09 Erase Flash Block Erase a P-Flash (or D-Flash) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. 0x0A Erase P-Flash Sector 0x0B Unsecure Flash 0x0C Verify Backdoor Access Key Supports a method of releasing MCU security by verifying a set of security keys. 0x0D Set User Margin Level Specifies a user margin read level for all P-Flash blocks. 0x0E Set Field Margin Level Specifies a field margin read level for all P-Flash blocks (special modes only). 18.4.1.5 Function on P-Flash Memory Verify that all P-Flash (and D-Flash) blocks are erased. Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. D-Flash Commands Table 18-30 summarizes the valid D-Flash commands along with the effects of the commands on the D-Flash block. Table 18-30. D-Flash Commands FCMD Command 0x01 Erase Verify All Blocks 0x02 Erase Verify Block 0x08 Erase All Blocks 0x09 Erase Flash Block Function on D-Flash Memory Verify that all D-Flash (and P-Flash) blocks are erased. Verify that the D-Flash block is erased. Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. Erase a D-Flash (or P-Flash) block. An erase of the full D-Flash block is only possible when DPOPEN bit in the DFPROT register is set prior to launching the command. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 539 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-30. D-Flash Commands FCMD Command Function on D-Flash Memory 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. 0x0D Set User Margin Level Specifies a user margin read level for the D-Flash block. 0x0E Set Field Margin Level Specifies a field margin read level for the D-Flash block (special modes only). 0x10 Erase Verify D-Flash Section Verify that a given number of words starting at the address provided are erased. 0x11 Program D-Flash Program up to four words in the D-Flash block. 0x12 Erase D-Flash Sector Erase all bytes in a sector of the D-Flash block. 18.4.2 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 18.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 18.4.2.1 Erase Verify All Blocks Command The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Table 18-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x01 Not required S12XS Family Reference Manual, Rev. 1.13 540 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. Table 18-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT 18.4.2.2 Error Condition Set if CCOBIX[2:0] != 000 at command launch None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be verified. Table 18-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x02 Global address [22:16] of the Flash block to be verified. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF flag will set after the Erase Verify Block operation has completed. Table 18-34. Erase Verify Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if an invalid global address [22:16] is supplied FSTAT 18.4.2.3 FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. The section to be verified cannot cross a 256 Kbyte boundary in the P-Flash memory space. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 541 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-35. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x03 Global address [22:16] of a P-Flash block 001 Global address [15:0] of the first phrase to be verified 010 Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. Table 18-36. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT Set if the requested section crosses a 256 Kbyte boundary FPVIOL 18.4.2.4 None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 18.4.2.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 18-37. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x04 Not Required 001 Read Once phrase index (0x0000 - 0x0007) 010 Read Once word 0 value 011 Read Once word 1 value 100 Read Once word 2 value 101 Read Once word 3 value Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid S12XS Family Reference Manual, Rev. 1.13 542 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. Table 18-38. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR Set if command not available in current mode (see Table 18-28) Set if an invalid phrase index is supplied FSTAT FPVIOL 18.4.2.5 None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 18-39. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 1 FCCOB Parameters 0x06 Global address [22:16] to identify P-Flash block 001 Global address [15:0] of phrase location to be programmed1 010 Word 0 program value 011 Word 1 program value 100 Word 2 program value 101 Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 543 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-40. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL 18.4.2.6 Set if the global address [22:0] points to a protected area MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 18.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 18-41. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x07 Not Required 001 Program Once phrase index (0x0000 - 0x0007) 010 Program Once word 0 value 011 Program Once word 1 value 100 Program Once word 2 value 101 Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. S12XS Family Reference Manual, Rev. 1.13 544 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) R, Table 18-42. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid phrase index is supplied Set if the requested phrase has already been programmed1 FSTAT FPVIOL 1 None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 18.4.2.7 Erase All Blocks Command The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space. Table 18-43. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x08 Not required Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 18-44. Erase All Blocks Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if command not available in current mode (see Table 18-28) FSTAT 18.4.2.8 FPVIOL Set if any area of the P-Flash or D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or D-Flash block. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 545 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-45. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters Global address [22:16] to identify Flash block 0x09 Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 18-46. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if the supplied P-Flash address is not phrase-aligned or if the D-Flash address is not word-aligned FSTAT FPVIOL 18.4.2.9 Set if an invalid global address [22:16] is supplied Set if an area of the selected Flash block is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Erase P-Flash Sector Command The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Table 18-47. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x0A Global address [22:16] to identify P-Flash block to be erased Global address [15:0] anywhere within the sector to be erased. Refer to Section 18.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. S12XS Family Reference Manual, Rev. 1.13 546 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-48. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:16] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL Set if the selected P-Flash sector is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation 18.4.2.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Table 18-49. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x0B Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 18-50. Unsecure Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if command not available in current mode (see Table 18-28) FSTAT FPVIOL Set if any area of the P-Flash or D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation 18.4.2.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 18-9). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 547 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-3). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 18-51. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0C Not required 001 Key 0 010 Key 1 011 Key 2 100 Key 3 Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 18-52. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 18.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL None MGSTAT1 None MGSTAT0 None 18.4.2.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Table 18-53. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x0D Global address [22:16] to identify the Flash block Margin level setting S12XS Family Reference Manual, Rev. 1.13 548 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set User Margin Level command are defined in Table 18-54. Table 18-54. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level1 0x0002 User Margin-0 Level2 1 2 Read margin to the erased state Read margin to the programmed state Table 18-55. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:16] is supplied FSTAT Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 18.4.2.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 18-56. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x0E Global address [22:16] to identify the Flash block Margin level setting S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 549 256 KByte Flash Module (S12XFTMR256K1V1) Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set Field Margin Level command are defined in Table 18-57. Table 18-57. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level1 0x0002 User Margin-0 Level2 0x0003 Field Margin-1 Level1 0x0004 Field Margin-0 Level2 1 2 Read margin to the erased state Read margin to the programmed state Table 18-58. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:16] is supplied FSTAT Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 18.4.2.14 Erase Verify D-Flash Section Command The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. S12XS Family Reference Manual, Rev. 1.13 550 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-59. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x10 Global address [22:16] to identify the D-Flash block 001 Global address [15:0] of the first word to be verified 010 Number of words to be verified Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF flag will set after the Erase Verify D-Flash Section operation has completed. Table 18-60. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the requested section breaches the end of the D-Flash block FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read 18.4.2.15 Program D-Flash Command The Program D-Flash operation programs one to four previously erased words in the D-Flash block. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 18-61. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x11 Global address [22:16] to identify the D-Flash block 001 Global address [15:0] of word to be programmed 010 Word 0 program value 011 Word 1 program value, if desired 100 Word 2 program value, if desired S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 551 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-61. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 101 Word 3 program value, if desired Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. The CCIF flag is set when the operation has completed. Table 18-62. Program D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the requested group of words breaches the end of the D-Flash block FPVIOL Set if the selected area of the D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation 18.4.2.16 Erase D-Flash Sector Command The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash block. Table 18-63. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x12 Global address [22:16] to identify D-Flash block Global address [15:0] anywhere within the sector to be erased. See Section 18.1.2.2 for D-Flash sector size. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase D-Flash Sector operation has completed. S12XS Family Reference Manual, Rev. 1.13 552 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) Table 18-64. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 18-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL 18.4.3 Set if the selected area of the D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 18-65. Flash Interrupt Sources Interrupt Source Global (CCR) Mask Interrupt Flag Local Enable CCIF (FSTAT register) CCIE (FCNFG register) I Bit ECC Double Bit Fault on Flash Read DFDIF (FERSTAT register) DFDIE (FERCNFG register) I Bit ECC Single Bit Fault on Flash Read SFDIF (FERSTAT register) SFDIE (FERCNFG register) I Bit Flash Command Complete NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 18.4.3.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 18.3.2.5, “Flash Configuration Register (FCNFG)”, Section 18.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 18.3.2.7, “Flash Status Register (FSTAT)”, and Section 18.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 18-27. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 553 256 KByte Flash Module (S12XFTMR256K1V1) Flash Command Interrupt Request CCIE CCIF DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 18-27. Flash Module Interrupts Implementation 18.4.4 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 18.4.3, “Interrupts”). 18.4.5 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode. 18.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 18-10). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F. The security state out of reset can be permanently changed by programming the security byte of the Flash configuration field. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 18.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 18.3.2.2), the Verify Backdoor Access Key command (see Section 18.4.2.11) allows the user to present four prospective keys for comparison to the S12XS Family Reference Manual, Rev. 1.13 554 Freescale Semiconductor 256 KByte Flash Module (S12XFTMR256K1V1) keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 18-10) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 18.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 18.4.2.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field. The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte (0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. 18.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods: • Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. • Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 555 256 KByte Flash Module (S12XFTMR256K1V1) erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method: • Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU. 18.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 18-28. 18.6 Initialization On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. S12XS Family Reference Manual, Rev. 1.13 556 Freescale Semiconductor Chapter 19 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-1. Revision History Revision Number Revision Date V01.04 03 Jan 2008 V01.05 19 Dec 2008 19.1/19-557 19.4.2.4/19-592 19.4.2.6/19-594 19.4.2.11/19-59 7 19.4.2.11/19-59 7 19.4.2.11/19-59 7 V01.06 25 Sep 2009 The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: 19.3.2/19-564 - Add caution concerning register writes while command is active 19.3.2.1/19-566 - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear 19.4.1.2/19-586 - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during 19.6/19-606 reset sequence 19.1 Sections Affected Description of Changes - Cosmetic changes - Clarify single bit fault correction for P-Flash phrase - Add statement concerning code runaway when executing Read Once, Program Once, and Verify Backdoor Access Key commands from Flash block containing associated fields - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” in Section 19.4.2.11 Introduction The FTMR128K1 module implements the following: • 128 Kbytes of P-Flash (Program Flash) memory • 8 Kbytes of D-Flash (Data Flash) memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 557 128 KByte Flash Module (S12XFTMR128K1V1) CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that specific Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 19.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store for data. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once field. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register. 19.1.2 19.1.2.1 • • Features P-Flash Features 128 Kbytes of P-Flash memory composed of one 128 Kbyte Flash block divided into 128 sectors of 1024 bytes Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations S12XS Family Reference Manual, Rev. 1.13 558 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) • • • Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Flexible protection scheme to prevent accidental program or erase of P-Flash memory 19.1.2.2 • • • • • • 8 Kbytes of D-Flash memory composed of one 8 Kbyte Flash block divided into 32 sectors of 256 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of D-Flash memory Ability to program up to four words in a burst sequence 19.1.2.3 • • • D-Flash Features Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 19.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 19-1. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 559 128 KByte Flash Module (S12XFTMR128K1V1) Flash Interface Command Interrupt Request 16bit internal bus Registers Error Interrupt Request P-Flash 16Kx72 sector 0 sector 1 Protection sector 127 Security Oscillator Clock (XTAL) CPU Clock Divider FCLK Memory Controller Scratch RAM 384x16bits D-Flash 4Kx22 sector 0 sector 1 sector 31 Figure 19-1. FTMR128K1 Block Diagram 19.2 External Signal Description The Flash module contains no signals that connect off-chip. 19.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. S12XS Family Reference Manual, Rev. 1.13 560 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) 19.3.1 Module Memory Map The S12X architecture places the P-Flash memory between global addresses 0x7E_0000 and 0x7F_FFFF as shown in Table 19-2. The P-Flash memory map is shown in Figure 19-2. Table 19-2. P-Flash Memory Addressing Global Address Size (Bytes) 0x7E_0000 – 0x7F_FFFF 128 K Description P-Flash Block 0 Contains Flash Configuration Field (see Table 19-3) The FPROT register, described in Section 19.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 19-3. Table 19-3. Flash Configuration Field1 Global Address Size (Bytes) 0x7F_FF00 – 0x7F_FF07 8 Backdoor Comparison Key Refer to Section 19.4.2.11, “Verify Backdoor Access Key Command,” and Section 19.5.1, “Unsecuring the MCU using Backdoor Key Access” 0x7F_FF08 – 0x7F_FF0B2 4 Reserved 0x7F_FF0C2 1 P-Flash Protection byte. Refer to Section 19.3.2.9, “P-Flash Protection Register (FPROT)” 0x7F_FF0D2 1 D-Flash Protection byte. Refer to Section 19.3.2.10, “D-Flash Protection Register (DFPROT)” 0x7F_FF0E2 1 Flash Nonvolatile byte Refer to Section 19.3.2.15, “Flash Option Register (FOPT)” 0x7F_FF0F2 1 Flash Security byte Refer to Section 19.3.2.2, “Flash Security Register (FSEC)” 1 2 Description Older versions may have swapped protection byte addresses 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved field should be programmed to 0xFF. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 561 128 KByte Flash Module (S12XFTMR128K1V1) P-Flash START = 0x7E_0000 Flash Protected/Unprotected Region 96 Kbytes 0x7F_8000 0x7F_8400 0x7F_8800 0x7F_9000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_A000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x7F_C000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x7F_F000 0x7F_F800 P-Flash END = 0x7F_FFFF Flash Configuration Field 16 bytes (0x7F_FF00 - 0x7F_FF0F) Figure 19-2. P-Flash Memory Map S12XS Family Reference Manual, Rev. 1.13 562 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-4. Program IFR Fields Global Address (PGMIFRON) Size (Bytes) 0x40_0000 – 0x40_0007 8 Device ID 0x40_0008 – 0x40_00E7 224 Reserved 0x40_00E8 – 0x40_00E9 2 Version ID 0x40_00EA – 0x40_00FF 22 Reserved 0x40_0100 – 0x40_013F 64 Program Once Field Refer to Section 19.4.2.6, “Program Once Command” 0x40_0140 – 0x40_01FF 192 Reserved Field Description Table 19-5. D-Flash and Memory Controller Resource Fields Global Address Size (Bytes) 0x10_0000 – 0x10_1FFF 8,192 0x10_2000 – 0x11_FFFF 122,880 0x12_0000 – 0x12_007F 128 0x12_0080 – 0x12_0FFF 3,968 Reserved 0x12_1000 – 0x12_1FFF 4,096 Reserved 0x12_2000 – 0x12_3CFF 7,242 Reserved 0x12_3D00 – 0x12_3FFF 768 0x12_4000 – 0x12_E7FF 43,008 Reserved 0x12_E800 – 0x12_FFFF 6,144 Reserved 0x13_0000 – 0x13_FFFF 65,536 Reserved 1 Description D-Flash Memory Reserved D-Flash Nonvolatile Information Register (DFIFRON1 = 1) Memory Controller Scratch RAM (MGRAMON1 = 1) MMCCTL1 register bit S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 563 128 KByte Flash Module (S12XFTMR128K1V1) D-Flash START = 0x10_0000 D-Flash Memory 8 Kbytes D-Flash END = 0x10_1FFF 0x12_0000 D-Flash Nonvolatile Information Register (DFIFRON) 128 bytes 0x12_1000 0x12_2000 Memory Controller Scratch RAM (MGRAMON) 768 bytes 0x12_4000 0x12_E800 0x12_FFFF Figure 19-3. D-Flash and Memory Controller Resource Memory Map 19.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 19-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 7 R 6 5 4 3 2 1 0 FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 FDIVLD W R KEYEN1 W Figure 19-4. FTMR128K1 Register Summary S12XS Family Reference Manual, Rev. 1.13 564 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Address & Name 0x0002 FCCOBIX 0x0003 FECCRIX 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 DFPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV0 0x000D FRSV1 0x000E FECCRHI 0x000F FECCRLO R 7 6 5 4 3 0 0 0 0 0 2 1 0 CCOBIX2 CCOBIX1 CCOBIX0 ECCRIX2 ECCRIX1 ECCRIX0 FDFD FSFD DFDIE SFDIE MGSTAT1 MGSTAT0 DFDIF SFDIF W R 0 0 0 0 0 W R 0 0 CCIE 0 0 IGNSF W R 0 W R 0 CCIF ACCERR FPVIOL 0 0 MGBUSY RSVD 0 0 W R 0 0 W R RNV6 FPOPEN FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 DPS4 DPS3 DPS2 DPS1 DPS0 W R 0 0 DPOPEN W R CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 W R W R W R W R W R W Figure 19-4. FTMR128K1 Register Summary (continued) S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 565 128 KByte Flash Module (S12XFTMR128K1V1) Address & Name 0x0010 FOPT 0x0011 FRSV2 0x0012 FRSV3 0x0013 FRSV4 R 7 6 5 4 3 2 1 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W R W R W R W = Unimplemented or Reserved Figure 19-4. FTMR128K1 Register Summary (continued) 19.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 R 6 5 4 3 2 1 0 0 0 0 FDIVLD FDIV[6:0] W Reset 0 0 0 0 0 = Unimplemented or Reserved Figure 19-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table 19-6. FCLKDIV Field Descriptions Field 7 FDIVLD 6–0 FDIV[6:0] Description Clock Divider Loaded 0 FCLKDIV register has not been written 1 FCLKDIV register has been written since the last reset Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 19-7 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 19.4.1, “Flash Command Operations,” for more information. S12XS Family Reference Manual, Rev. 1.13 566 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 567 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-7. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) 1 2 MIN1 MAX 1.60 2.10 2.40 FDIV[6:0] 2 OSCCLK Frequency (MHz) FDIV[6:0] MIN1 2 MAX 0x01 33.60 34.65 0x20 3.15 0x02 34.65 35.70 0x21 3.20 4.20 0x03 35.70 36.75 0x22 4.20 5.25 0x04 36.75 37.80 0x23 5.25 6.30 0x05 37.80 38.85 0x24 6.30 7.35 0x06 38.85 39.90 0x25 7.35 8.40 0x07 39.90 40.95 0x26 8.40 9.45 0x08 40.95 42.00 0x27 9.45 10.50 0x09 42.00 43.05 0x28 10.50 11.55 0x0A 43.05 44.10 0x29 11.55 12.60 0x0B 44.10 45.15 0x2A 12.60 13.65 0x0C 45.15 46.20 0x2B 13.65 14.70 0x0D 46.20 47.25 0x2C 14.70 15.75 0x0E 47.25 48.30 0x2D 15.75 16.80 0x0F 48.30 49.35 0x2E 16.80 17.85 0x10 49.35 50.40 0x2F 17.85 18.90 0x11 18.90 19.95 0x12 19.95 21.00 0x13 21.00 22.05 0x14 22.05 23.10 0x15 23.10 24.15 0x16 24.15 25.20 0x17 25.20 26.25 0x18 26.25 27.30 0x19 27.30 28.35 0x1A 28.35 29.40 0x1B 29.40 30.45 0x1C 30.45 31.50 0x1D 31.50 32.55 0x1E 32.55 33.60 0x1F FDIV shown generates an FCLK frequency of >0.8 MHz FDIV shown generates an FCLK frequency of 1.05 MHz S12XS Family Reference Manual, Rev. 1.13 568 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) 19.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 R 6 5 4 KEYEN[1:0] 3 2 1 RNV[5:2] 0 SEC[1:0] W Reset F F F F F F F F = Unimplemented or Reserved Figure 19-6. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 19-3) as indicated by reset condition F in Figure 19-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 19-8. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 19-9. 5–2 RNV[5:2} Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. 1–0 SEC[1:0] Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 19-10. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 19-9. Flash KEYEN States 1 KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01 DISABLED1 10 ENABLED 11 DISABLED Preferred KEYEN state to disable backdoor key access. Table 19-10. Flash Security States SEC[1:0] Status of Security 00 SECURED 01 SECURED1 10 UNSECURED 11 SECURED S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 569 128 KByte Flash Module (S12XFTMR128K1V1) 1 Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 19.5. 19.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 R 7 6 5 4 3 0 0 0 0 0 2 1 0 CCOBIX[2:0] W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 19-11. FCCOBIX Field Descriptions Field Description 2–0 CCOBIX[1:0] Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 19.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. 19.3.2.4 Flash ECCR Index Register (FECCRIX) The FECCRIX register is used to index the FECCR register for ECC fault reporting. Offset Module Base + 0x0003 R 7 6 5 4 3 0 0 0 0 0 2 1 0 ECCRIX[2:0] W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-8. FECCR Index Register (FECCRIX) ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. Table 19-12. FECCRIX Field Descriptions Field Description 2-0 ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is ECCRIX[2:0] being read. See Section 19.3.2.14, “Flash ECC Error Results Register (FECCR),” for more details. S12XS Family Reference Manual, Rev. 1.13 570 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) 19.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. Offset Module Base + 0x0004 7 R 6 5 0 0 CCIE 4 3 2 0 0 IGNSF 1 0 FDFD FSFD 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 19-13. FCNFG Field Descriptions Field Description 7 CCIE Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 19.3.2.7) 4 IGNSF Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 19.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated 1 FDFD Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 19.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 19.3.2.6) 0 FSFD Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 19.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 19.3.2.6) 19.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 571 128 KByte Flash Module (S12XFTMR128K1V1) Offset Module Base + 0x0005 7 6 R 5 4 3 2 1 0 DFDIE SFDIE 0 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 19-14. FERCNFG Field Descriptions Field Description 1 DFDIE Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 19.3.2.8) 0 SFDIE Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 19.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 19.3.2.8) 19.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 R 6 5 4 ACCERR FPVIOL 0 0 0 CCIF 3 2 MGBUSY RSVD 0 0 1 0 MGSTAT[1:0] W Reset 1 0 01 01 = Unimplemented or Reserved Figure 19-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 19.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. S12XS Family Reference Manual, Rev. 1.13 572 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-15. FSTAT Field Descriptions Field Description 7 CCIF Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed 5 ACCERR Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 19.4.1.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected 4 FPVIOL Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or D-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected 3 MGBUSY 2 RSVD Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 19.4.2, “Flash Command Description,” and Section 19.6, “Initialization” for details. 19.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 R 7 6 5 4 3 2 0 0 0 0 0 0 1 0 DFDIF SFDIF 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 573 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-16. FERSTAT Field Descriptions Field Description 1 DFDIF Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. 0 No double bit fault detected 1 Double bit fault detected or an invalid Flash array read operation attempted 0 SFDIF Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or an invalid Flash array read operation attempted 19.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 R 6 5 4 3 2 1 0 RNV6 FPOPEN FPHDIS FPHS[1:0] FPLDIS FPLS[1:0] W Reset F F F F F F F F = Unimplemented or Reserved Figure 19-13. Flash Protection Register (FPROT) The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 19.3.2.9.1, “P-Flash Protection Restrictions,” and Table 19-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 19-3) as indicated by reset condition ‘F’ in Figure 19-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. S12XS Family Reference Manual, Rev. 1.13 574 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-17. FPROT Field Descriptions Field Description 7 FPOPEN Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 19-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits 6 RNV[6] Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. 5 FPHDIS Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x7F_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled 4–3 FPHS[1:0] Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 19-19. The FPHS bits can only be written to while the FPHDIS bit is set. 2 FPLDIS 1–0 FPLS[1:0] Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x7F_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 19-20. The FPLS bits can only be written to while the FPLDIS bit is set. Table 19-18. P-Flash Protection Function 1 Function1 FPOPEN FPHDIS FPLDIS 1 1 1 No P-Flash Protection 1 1 0 Protected Low Range 1 0 1 Protected High Range 1 0 0 Protected High and Low Ranges 0 1 1 Full P-Flash Memory Protected 0 1 0 Unprotected Low Range 0 0 1 Unprotected High Range 0 0 0 Unprotected High and Low Ranges For range sizes, refer to Table 19-19 and Table 19-20. Table 19-19. P-Flash Protection Higher Address Range FPHS[1:0] Global Address Range Protected Size 00 0x7F_F800–0x7F_FFFF 2 Kbytes 01 0x7F_F000–0x7F_FFFF 4 Kbytes 10 0x7F_E000–0x7F_FFFF 8 Kbytes 11 0x7F_C000–0x7F_FFFF 16 Kbytes S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 575 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-20. P-Flash Protection Lower Address Range FPLS[1:0] Global Address Range Protected Size 00 0x7F_8000–0x7F_83FF 1 Kbyte 01 0x7F_8000–0x7F_87FF 2 Kbytes 10 0x7F_8000–0x7F_8FFF 4 Kbytes 11 0x7F_8000–0x7F_9FFF 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 19-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. S12XS Family Reference Manual, Rev. 1.13 576 Freescale Semiconductor FPHDIS = 1 FPLDIS = 1 FPHDIS = 1 FPLDIS = 0 FPHDIS = 0 FPLDIS = 1 FPHDIS = 0 FPLDIS = 0 7 6 5 4 3 2 1 0 Scenario 0x7F_8000 0x7F_FFFF Scenario FPHS[1:0] FPLS[1:0] FLASH START FPOPEN = 1 128 KByte Flash Module (S12XFTMR128K1V1) FPHS[1:0] 0x7F_8000 FPOPEN = 0 FPLS[1:0] FLASH START 0x7F_FFFF Unprotected region Protected region with size defined by FPLS Protected region not defined by FPLS, FPHS Protected region with size defined by FPHS Figure 19-14. P-Flash Protection Scenarios S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 577 128 KByte Flash Module (S12XFTMR128K1V1) 19.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 19-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 19-21. P-Flash Protection Scenario Transitions To Protection Scenario1 From Protection Scenario 0 1 2 3 0 X X X X X 1 X 4 X X X X X X X X X X 6 X 7 1 X 6 7 X 3 5 5 X X 2 4 X X X X X X Allowed transitions marked with X, see Figure 19-14 for a definition of the scenarios. 19.3.2.10 D-Flash Protection Register (DFPROT) The DFPROT register defines which D-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 R 6 5 0 0 4 3 DPOPEN 2 1 0 F F DPS[4:0] W Reset F 0 0 F F F = Unimplemented or Reserved Figure 19-15. D-Flash Protection Register (DFPROT) The (unreserved) bits of the DFPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, the DFPROT register is loaded with the contents of the D-Flash protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 19-3) as indicated by reset condition F in Figure 19-15. To change the D-Flash protection that will be loaded during the reset sequence, the P-Flash sector containing the D-Flash protection byte must be unprotected, then the D-Flash protection byte must be programmed. If a double bit fault is detected while reading the S12XS Family Reference Manual, Rev. 1.13 578 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) P-Flash phrase containing the D-Flash protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the D-Flash memory fully protected. Trying to alter data in any protected area in the D-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the D-Flash memory is not possible if any of the D-Flash sectors are protected. Table 19-22. DFPROT Field Descriptions Field Description 7 DPOPEN D-Flash Protection Control 0 Enables D-Flash memory protection from program and erase with protected address range defined by DPS bits 1 Disables D-Flash memory protection from program and erase 4–0 DPS[4:0] D-Flash Protection Size — The DPS[4:0] bits determine the size of the protected area in the D-Flash memory as shown in Table 19-23. Table 19-23. D-Flash Protection Address Range DPS[4:0] Global Address Range Protected Size 0_0000 0x10_0000 – 0x10_00FF 256 bytes 0_0001 0x10_0000 – 0x10_01FF 512 bytes 0_0010 0x10_0000 – 0x10_02FF 768 bytes 0_0011 0x10_0000 – 0x10_03FF 1024 bytes 0_0100 0x10_0000 – 0x10_04FF 1280 bytes 0_0101 0x10_0000 – 0x10_05FF 1536 bytes 0_0110 0x10_0000 – 0x10_06FF 1792 bytes 0_0111 0x10_0000 – 0x10_07FF 2048 bytes 0_1000 0x10_0000 – 0x10_08FF 2304 bytes 0_1001 0x10_0000 – 0x10_09FF 2560 bytes 0_1010 0x10_0000 – 0x10_0AFF 2816 bytes 0_1011 0x10_0000 – 0x10_0BFF 3072 bytes 0_1100 0x10_0000 – 0x10_0CFF 3328 bytes 0_1101 0x10_0000 – 0x10_0DFF 3584 bytes 0_1110 0x10_0000 – 0x10_0EFF 3840 bytes 0_1111 0x10_0000 – 0x10_0FFF 4096 bytes 1_0000 0x10_0000 – 0x10_10FF 4352 bytes 1_0001 0x10_0000 – 0x10_11FF 4608 bytes 1_0010 0x10_0000 – 0x10_12FF 4864 bytes 1_0011 0x10_0000 – 0x10_13FF 5120 bytes 1_0100 0x10_0000 – 0x10_14FF 5376 bytes 1_0101 0x10_0000 – 0x10_15FF 5632 bytes S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 579 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-23. D-Flash Protection Address Range DPS[4:0] Global Address Range Protected Size 1_0110 0x10_0000 – 0x10_16FF 5888 bytes 1_0111 0x10_0000 – 0x10_17FF 6144 bytes 1_1000 0x10_0000 – 0x10_18FF 6400 bytes 1_1001 0x10_0000 – 0x10_19FF 6656 bytes 1_1010 0x10_0000 – 0x10_1AFF 6912 bytes 1_1011 0x10_0000 – 0x10_1BFF 7168 bytes 1_1100 0x10_0000 – 0x10_1CFF 7424 bytes 1_1101 0x10_0000 – 0x10_1DFF 7680 bytes 1_1110 0x10_0000 – 0x10_1EFF 7936 bytes 1_1111 0x10_0000 – 0x10_1FFF 8192 bytes 19.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 0 0 0 0 R CCOB[15:8] W Reset 0 0 0 0 Figure 19-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 0 0 0 0 R CCOB[7:0] W Reset 0 0 0 0 Figure 19-17. Flash Common Command Object Low Register (FCCOBLO) 19.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes S12XS Family Reference Manual, Rev. 1.13 580 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 19-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 19-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 19.4.2. Table 19-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) HI FCMD[7:0] defining Flash command LO 0, Global address [22:16] HI Global address [15:8] LO Global address [7:0] HI Data 0 [15:8] LO Data 0 [7:0] HI Data 1 [15:8] LO Data 1 [7:0] HI Data 2 [15:8] LO Data 2 [7:0] HI Data 3 [15:8] LO Data 3 [7:0] 000 001 010 011 100 101 19.3.2.12 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 19-18. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 581 128 KByte Flash Module (S12XFTMR128K1V1) 19.3.2.13 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000D R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 19-19. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 19.3.2.14 Flash ECC Error Results Register (FECCR) The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (see Section 19.3.2.4). Once ECC fault information has been stored, no other fault information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults the priority for fault recording is double bit fault over single bit fault. Offset Module Base + 0x000E 7 6 5 4 R 3 2 1 0 0 0 0 0 ECCR[15:8] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 19-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 7 6 5 4 R 3 2 1 0 0 0 0 0 ECCR[7:0] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 19-21. Flash ECC Error Results Low Register (FECCRLO) All FECCR bits are readable but not writable. S12XS Family Reference Manual, Rev. 1.13 582 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-25. FECCR Index Settings ECCRIX[2:0] 000 FECCR Register Content Bits [15:8] Bit[7] Bits[6:0] Parity bits read from Flash block 0 Global address [22:16] 001 Global address [15:0] 010 Data 0 [15:0] 011 Data 1 [15:0] (P-Flash only) 100 Data 2 [15:0] (P-Flash only) 101 Data 3 [15:0] (P-Flash only) 110 Not used, returns 0x0000 when read 111 Not used, returns 0x0000 when read Table 19-26. FECCR Index=000 Bit Descriptions Field 15:8 PAR[7:0] Description ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. 6–0 Global Address — The GADDR[22:16] field contains the upper seven bits of the global address having GADDR[22:16] caused the error. The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010. 19.3.2.15 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 R 3 2 1 0 F F F F NV[7:0] W Reset F F F F = Unimplemented or Reserved Figure 19-22. Flash Option Register (FOPT) All bits in the FOPT register are readable but are not writable. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 583 128 KByte Flash Module (S12XFTMR128K1V1) During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 19-3) as indicated by reset condition F in Figure 19-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. Table 19-27. FOPT Field Descriptions Field Description 7–0 NV[7:0] Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 19.3.2.16 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 19-23. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 19.3.2.17 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 19-24. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 19.3.2.18 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. S12XS Family Reference Manual, Rev. 1.13 584 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Offset Module Base + 0x0013 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 19-25. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 19.4 Functional Description 19.4.1 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution 19.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz. Table 19-7 shows recommended values for the FDIV field based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 585 128 KByte Flash Module (S12XFTMR128K1V1) 19.4.1.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 19.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. 19.4.1.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 19.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 19-26. S12XS Family Reference Manual, Rev. 1.13 586 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) START Read: FCLKDIV register Clock Register Written Check no FDIVLD Set? yes Write: FCLKDIV register Note: FCLKDIV must be set after each reset Read: FSTAT register FCCOB Availability Check CCIF Set? no Results from previous Command yes Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? yes no Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? no yes EXIT Figure 19-26. Generic Flash Command Write Sequence Flowchart S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 587 128 KByte Flash Module (S12XFTMR128K1V1) 19.4.1.3 Valid Flash Module Commands Table 19-28. Flash Commands by Mode Unsecured FCMD 1 2 3 4 5 6 7 8 19.4.1.4 Command Secured NS1 NX2 SS3 ST4 NS5 NX6 SS7 ST8 0x01 Erase Verify All Blocks ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x02 Erase Verify Block ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x03 Erase Verify P-Flash Section ∗ ∗ ∗ ∗ ∗ 0x04 Read Once ∗ ∗ ∗ ∗ ∗ 0x06 Program P-Flash ∗ ∗ ∗ ∗ ∗ 0x07 Program Once ∗ ∗ ∗ ∗ ∗ 0x08 Erase All Blocks ∗ ∗ ∗ ∗ 0x09 Erase Flash Block ∗ ∗ ∗ ∗ ∗ 0x0A Erase P-Flash Sector ∗ ∗ ∗ ∗ ∗ 0x0B Unsecure Flash ∗ ∗ ∗ ∗ 0x0C Verify Backdoor Access Key ∗ 0x0D Set User Margin Level ∗ 0x0E Set Field Margin Level 0x10 Erase Verify D-Flash Section ∗ 0x11 Program D-Flash 0x12 Erase D-Flash Sector ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode. Unsecured Normal Expanded mode. Unsecured Special Single Chip mode. Unsecured Special Mode. Secured Normal Single Chip mode. Secured Normal Expanded mode. Secured Special Single Chip mode. Secured Special Mode. P-Flash Commands Table 19-29 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. S12XS Family Reference Manual, Rev. 1.13 588 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-29. P-Flash Commands FCMD Command 0x01 Erase Verify All Blocks 0x02 Erase Verify Block 0x03 Erase Verify P-Flash Section 0x04 Read Once 0x06 Program P-Flash 0x07 Program Once Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. 0x08 Erase All Blocks Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. 0x09 Erase Flash Block Erase a P-Flash (or D-Flash) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. 0x0A Erase P-Flash Sector 0x0B Unsecure Flash 0x0C Verify Backdoor Access Key Supports a method of releasing MCU security by verifying a set of security keys. 0x0D Set User Margin Level Specifies a user margin read level for all P-Flash blocks. 0x0E Set Field Margin Level Specifies a field margin read level for all P-Flash blocks (special modes only). 19.4.1.5 Function on P-Flash Memory Verify that all P-Flash (and D-Flash) blocks are erased. Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. D-Flash Commands Table 19-30 summarizes the valid D-Flash commands along with the effects of the commands on the D-Flash block. Table 19-30. D-Flash Commands FCMD Command 0x01 Erase Verify All Blocks 0x02 Erase Verify Block 0x08 Erase All Blocks 0x09 Erase Flash Block Function on D-Flash Memory Verify that all D-Flash (and P-Flash) blocks are erased. Verify that the D-Flash block is erased. Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. Erase a D-Flash (or P-Flash) block. An erase of the full D-Flash block is only possible when DPOPEN bit in the DFPROT register is set prior to launching the command. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 589 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-30. D-Flash Commands FCMD Command Function on D-Flash Memory 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. 0x0D Set User Margin Level Specifies a user margin read level for the D-Flash block. 0x0E Set Field Margin Level Specifies a field margin read level for the D-Flash block (special modes only). 0x10 Erase Verify D-Flash Section Verify that a given number of words starting at the address provided are erased. 0x11 Program D-Flash Program up to four words in the D-Flash block. 0x12 Erase D-Flash Sector Erase all bytes in a sector of the D-Flash block. 19.4.2 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 19.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 19.4.2.1 Erase Verify All Blocks Command The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Table 19-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x01 Not required S12XS Family Reference Manual, Rev. 1.13 590 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. Table 19-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT 19.4.2.2 Error Condition Set if CCOBIX[2:0] != 000 at command launch None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be verified. Table 19-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x02 Global address [22:16] of the Flash block to be verified. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF flag will set after the Erase Verify Block operation has completed. Table 19-34. Erase Verify Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if an invalid global address [22:16] is supplied FSTAT 19.4.2.3 FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. The section to be verified cannot cross a 128 Kbyte boundary in the P-Flash memory space. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 591 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-35. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x03 Global address [22:16] of a P-Flash block 001 Global address [15:0] of the first phrase to be verified 010 Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. Table 19-36. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT Set if the requested section crosses a 128 Kbyte boundary FPVIOL 19.4.2.4 None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 19.4.2.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 19-37. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x04 Not Required 001 Read Once phrase index (0x0000 - 0x0007) 010 Read Once word 0 value 011 Read Once word 1 value 100 Read Once word 2 value 101 Read Once word 3 value Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid S12XS Family Reference Manual, Rev. 1.13 592 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. Table 19-38. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR Set if command not available in current mode (see Table 19-28) Set if an invalid phrase index is supplied FSTAT FPVIOL 19.4.2.5 None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 19-39. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 1 FCCOB Parameters 0x06 Global address [22:16] to identify P-Flash block 001 Global address [15:0] of phrase location to be programmed1 010 Word 0 program value 011 Word 1 program value 100 Word 2 program value 101 Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 593 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-40. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL 19.4.2.6 Set if the global address [22:0] points to a protected area MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 19.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 19-41. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x07 Not Required 001 Program Once phrase index (0x0000 - 0x0007) 010 Program Once word 0 value 011 Program Once word 1 value 100 Program Once word 2 value 101 Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. S12XS Family Reference Manual, Rev. 1.13 594 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) R, Table 19-42. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid phrase index is supplied Set if the requested phrase has already been programmed1 FSTAT FPVIOL 1 None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 19.4.2.7 Erase All Blocks Command The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space. Table 19-43. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x08 Not required Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 19-44. Erase All Blocks Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if command not available in current mode (see Table 19-28) FSTAT 19.4.2.8 FPVIOL Set if any area of the P-Flash or D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or D-Flash block. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 595 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-45. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters Global address [22:16] to identify Flash block 0x09 Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 19-46. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if the supplied P-Flash address is not phrase-aligned or if the D-Flash address is not word-aligned FSTAT FPVIOL 19.4.2.9 Set if an invalid global address [22:16] is supplied Set if an area of the selected Flash block is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Erase P-Flash Sector Command The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Table 19-47. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x0A Global address [22:16] to identify P-Flash block to be erased Global address [15:0] anywhere within the sector to be erased. Refer to Section 19.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. S12XS Family Reference Manual, Rev. 1.13 596 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-48. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:16] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL Set if the selected P-Flash sector is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation 19.4.2.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Table 19-49. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x0B Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 19-50. Unsecure Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if command not available in current mode (see Table 19-28) FSTAT FPVIOL Set if any area of the P-Flash or D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation 19.4.2.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 19-9). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 597 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-3). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 19-51. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0C Not required 001 Key 0 010 Key 1 011 Key 2 100 Key 3 Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 19-52. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 19.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL None MGSTAT1 None MGSTAT0 None 19.4.2.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Table 19-53. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x0D Global address [22:16] to identify the Flash block Margin level setting S12XS Family Reference Manual, Rev. 1.13 598 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set User Margin Level command are defined in Table 19-54. Table 19-54. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level1 0x0002 User Margin-0 Level2 1 2 Read margin to the erased state Read margin to the programmed state Table 19-55. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:16] is supplied FSTAT Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 19.4.2.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 19-56. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x0E Global address [22:16] to identify the Flash block Margin level setting S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 599 128 KByte Flash Module (S12XFTMR128K1V1) Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set Field Margin Level command are defined in Table 19-57. Table 19-57. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level1 0x0002 User Margin-0 Level2 0x0003 Field Margin-1 Level1 0x0004 Field Margin-0 Level2 1 2 Read margin to the erased state Read margin to the programmed state Table 19-58. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:16] is supplied FSTAT Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 19.4.2.14 Erase Verify D-Flash Section Command The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. S12XS Family Reference Manual, Rev. 1.13 600 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-59. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x10 Global address [22:16] to identify the D-Flash block 001 Global address [15:0] of the first word to be verified 010 Number of words to be verified Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF flag will set after the Erase Verify D-Flash Section operation has completed. Table 19-60. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the requested section breaches the end of the D-Flash block FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read 19.4.2.15 Program D-Flash Command The Program D-Flash operation programs one to four previously erased words in the D-Flash block. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 19-61. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x11 Global address [22:16] to identify the D-Flash block 001 Global address [15:0] of word to be programmed 010 Word 0 program value 011 Word 1 program value, if desired 100 Word 2 program value, if desired S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 601 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-61. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 101 Word 3 program value, if desired Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. The CCIF flag is set when the operation has completed. Table 19-62. Program D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the requested group of words breaches the end of the D-Flash block FPVIOL Set if the selected area of the D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation 19.4.2.16 Erase D-Flash Sector Command The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash block. Table 19-63. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x12 Global address [22:16] to identify D-Flash block Global address [15:0] anywhere within the sector to be erased. See Section 19.1.2.2 for D-Flash sector size. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase D-Flash Sector operation has completed. S12XS Family Reference Manual, Rev. 1.13 602 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) Table 19-64. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 19-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL 19.4.3 Set if the selected area of the D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 19-65. Flash Interrupt Sources Interrupt Source Global (CCR) Mask Interrupt Flag Local Enable CCIF (FSTAT register) CCIE (FCNFG register) I Bit ECC Double Bit Fault on Flash Read DFDIF (FERSTAT register) DFDIE (FERCNFG register) I Bit ECC Single Bit Fault on Flash Read SFDIF (FERSTAT register) SFDIE (FERCNFG register) I Bit Flash Command Complete NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 19.4.3.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 19.3.2.5, “Flash Configuration Register (FCNFG)”, Section 19.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 19.3.2.7, “Flash Status Register (FSTAT)”, and Section 19.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 19-27. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 603 128 KByte Flash Module (S12XFTMR128K1V1) Flash Command Interrupt Request CCIE CCIF DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 19-27. Flash Module Interrupts Implementation 19.4.4 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 19.4.3, “Interrupts”). 19.4.5 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode. 19.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 19-10). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F. The security state out of reset can be permanently changed by programming the security byte of the Flash configuration field. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 19.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 19.3.2.2), the Verify Backdoor Access Key command (see Section 19.4.2.11) allows the user to present four prospective keys for comparison to the S12XS Family Reference Manual, Rev. 1.13 604 Freescale Semiconductor 128 KByte Flash Module (S12XFTMR128K1V1) keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 19-10) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 19.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 19.4.2.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field. The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte (0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. 19.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods: • Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. • Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 605 128 KByte Flash Module (S12XFTMR128K1V1) erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method: • Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU. 19.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 19-28. 19.6 Initialization On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. S12XS Family Reference Manual, Rev. 1.13 606 Freescale Semiconductor Chapter 20 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-1. Revision History Revision Number Revision Date V01.04 03 Jan 2008 V01.05 19 Dec 2008 20.1/20-607 20.4.2.4/20-642 20.4.2.6/20-644 20.4.2.11/20-64 8 20.4.2.11/20-64 8 20.4.2.11/20-64 8 V01.06 25 Sep 2009 The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: 20.3.2/20-615 - Add caution concerning register writes while command is active 20.3.2.1/20-617 - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear 20.4.1.2/20-636 - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during 20.6/20-656 reset sequence 20.1 Sections Affected Description of Changes - Cosmetic changes - Clarify single bit fault correction for P-Flash phrase - Add statement concerning code runaway when executing Read Once, Program Once, and Verify Backdoor Access Key commands from Flash block containing associated fields - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” in Section 20.4.2.11 Introduction The FTMR64K1 module implements the following: • 64 Kbytes of P-Flash (Program Flash) memory • 4 Kbytes of D-Flash (Data Flash) memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 607 64 KByte Flash Module (S12XFTMR64K1V1) CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that specific Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 20.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store for data. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once field. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register. 20.1.2 20.1.2.1 • • Features P-Flash Features 64 Kbytes of P-Flash memory composed of one 64 Kbyte Flash block divided into 64 sectors of 1024 bytes Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations S12XS Family Reference Manual, Rev. 1.13 608 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) • • • Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Flexible protection scheme to prevent accidental program or erase of P-Flash memory 20.1.2.2 • • • • • • 4 Kbytes of D-Flash memory composed of one 4 Kbyte Flash block divided into 16 sectors of 256 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of D-Flash memory Ability to program up to four words in a burst sequence 20.1.2.3 • • • D-Flash Features Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 609 64 KByte Flash Module (S12XFTMR64K1V1) 20.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 20-1. Figure 20-1. FTMR64K1 Block Diagram Flash Interface Command Interrupt Request 16bit internal bus Registers Error Interrupt Request P-Flash 8Kx72 sector 0 sector 1 Protection sector 63 Security Oscillator Clock (XTAL) CPU Clock Divider FCLK Memory Controller Scratch RAM 384x16bits D-Flash 2Kx22 sector 0 sector 1 sector 15 20.2 External Signal Description The Flash module contains no signals that connect off-chip. S12XS Family Reference Manual, Rev. 1.13 610 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) 20.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. 20.3.1 Module Memory Map The S12X architecture places the P-Flash memory between global addresses 0x7F_0000 and 0x7F_FFFF as shown in Table 20-2. The P-Flash memory map is shown in Figure 20-2. Table 20-2. P-Flash Memory Addressing Global Address Size (Bytes) 0x7F_0000 – 0x7F_FFFF 64 K Description P-Flash Block 0 Contains Flash Configuration Field (see Table 20-3) The FPROT register, described in Section 20.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 20-3. Table 20-3. Flash Configuration Field1 Global Address Size (Bytes) 0x7F_FF00 – 0x7F_FF07 8 Backdoor Comparison Key Refer to Section 20.4.2.11, “Verify Backdoor Access Key Command,” and Section 20.5.1, “Unsecuring the MCU using Backdoor Key Access” 0x7F_FF08 – 0x7F_FF0B2 4 Reserved 0x7F_FF0C2 1 P-Flash Protection byte. Refer to Section 20.3.2.9, “P-Flash Protection Register (FPROT)” 0x7F_FF0D2 1 D-Flash Protection byte. Refer to Section 20.3.2.10, “D-Flash Protection Register (DFPROT)” 0x7F_FF0E2 1 Flash Nonvolatile byte Refer to Section 20.3.2.15, “Flash Option Register (FOPT)” 0x7F_FF0F2 1 Flash Security byte Refer to Section 20.3.2.2, “Flash Security Register (FSEC)” 1 Description Older versions may have swapped protection byte addresses S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 611 64 KByte Flash Module (S12XFTMR64K1V1) 2 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved field should be programmed to 0xFF. S12XS Family Reference Manual, Rev. 1.13 612 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) P-Flash START = 0x7F_0000 Flash Protected/Unprotected Region 32 Kbytes 0x7F_8000 0x7F_8400 0x7F_8800 0x7F_9000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_A000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x7F_C000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x7F_F000 0x7F_F800 P-Flash END = 0x7F_FFFF Flash Configuration Field 16 bytes (0x7F_FF00 - 0x7F_FF0F) Figure 20-2. P-Flash Memory Map S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 613 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-4. Program IFR Fields Global Address (PGMIFRON) Size (Bytes) 0x40_0000 – 0x40_0007 8 Device ID 0x40_0008 – 0x40_00E7 224 Reserved 0x40_00E8 – 0x40_00E9 2 Version ID 0x40_00EA – 0x40_00FF 22 Reserved 0x40_0100 – 0x40_013F 64 Program Once Field Refer to Section 20.4.2.6, “Program Once Command” 0x40_0140 – 0x40_01FF 192 Reserved Field Description Table 20-5. D-Flash and Memory Controller Resource Fields Global Address Size (Bytes) 0x10_0000 – 0x10_0FFF 4,096 0x10_1000 – 0x11_FFFF 126,976 0x12_0000 – 0x12_007F 128 0x12_0080 – 0x12_0FFF 3,968 Reserved 0x12_1000 – 0x12_1FFF 4,096 Reserved 0x12_2000 – 0x12_3CFF 7,242 Reserved 0x12_3D00 – 0x12_3FFF 768 0x12_4000 – 0x12_E7FF 43,008 Reserved 0x12_E800 – 0x12_FFFF 6,144 Reserved 0x13_0000 – 0x13_FFFF 65,536 Reserved 1 Description D-Flash Memory Reserved D-Flash Nonvolatile Information Register (DFIFRON1 = 1) Memory Controller Scratch RAM (MGRAMON1 = 1) MMCCTL1 register bit S12XS Family Reference Manual, Rev. 1.13 614 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) D-Flash START = 0x10_0000 D-Flash Memory 4 Kbytes D-Flash END = 0x10_0FFF 0x12_0000 D-Flash Nonvolatile Information Register (DFIFRON) 128 bytes 0x12_1000 0x12_2000 Memory Controller Scratch RAM (MGRAMON) 768 bytes 0x12_4000 0x12_E800 0x12_FFFF Figure 20-3. D-Flash and Memory Controller Resource Memory Map 20.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 20-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 7 R 6 5 4 3 2 1 0 FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 FDIVLD W R KEYEN1 W Figure 20-4. FTMR64K1 Register Summary S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 615 64 KByte Flash Module (S12XFTMR64K1V1) Address & Name 0x0002 FCCOBIX 0x0003 FECCRIX 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 DFPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV0 0x000D FRSV1 0x000E FECCRHI 0x000F FECCRLO R 7 6 5 4 3 0 0 0 0 0 2 1 0 CCOBIX2 CCOBIX1 CCOBIX0 ECCRIX2 ECCRIX1 ECCRIX0 FDFD FSFD DFDIE SFDIE MGSTAT1 MGSTAT0 DFDIF SFDIF W R 0 0 0 0 0 W R 0 0 CCIE 0 0 IGNSF W R 0 W R 0 CCIF ACCERR FPVIOL 0 0 MGBUSY RSVD 0 0 W R 0 0 W R RNV6 FPOPEN FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 DPS4 DPS3 DPS2 DPS1 DPS0 W R 0 0 DPOPEN W R CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 W R W R W R W R W R W Figure 20-4. FTMR64K1 Register Summary (continued) S12XS Family Reference Manual, Rev. 1.13 616 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Address & Name 0x0010 FOPT 0x0011 FRSV2 0x0012 FRSV3 0x0013 FRSV4 R 7 6 5 4 3 2 1 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W R W R W R W = Unimplemented or Reserved Figure 20-4. FTMR64K1 Register Summary (continued) 20.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 R 6 5 4 3 2 1 0 0 0 0 FDIVLD FDIV[6:0] W Reset 0 0 0 0 0 = Unimplemented or Reserved Figure 20-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table 20-6. FCLKDIV Field Descriptions Field 7 FDIVLD 6–0 FDIV[6:0] Description Clock Divider Loaded 0 FCLKDIV register has not been written 1 FCLKDIV register has been written since the last reset Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 20-7 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 20.4.1, “Flash Command Operations,” for more information. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 617 64 KByte Flash Module (S12XFTMR64K1V1) CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. S12XS Family Reference Manual, Rev. 1.13 618 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-7. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) 1 2 MIN1 MAX 1.60 2.10 2.40 FDIV[6:0] 2 OSCCLK Frequency (MHz) FDIV[6:0] MIN1 2 MAX 0x01 33.60 34.65 0x20 3.15 0x02 34.65 35.70 0x21 3.20 4.20 0x03 35.70 36.75 0x22 4.20 5.25 0x04 36.75 37.80 0x23 5.25 6.30 0x05 37.80 38.85 0x24 6.30 7.35 0x06 38.85 39.90 0x25 7.35 8.40 0x07 39.90 40.95 0x26 8.40 9.45 0x08 40.95 42.00 0x27 9.45 10.50 0x09 42.00 43.05 0x28 10.50 11.55 0x0A 43.05 44.10 0x29 11.55 12.60 0x0B 44.10 45.15 0x2A 12.60 13.65 0x0C 45.15 46.20 0x2B 13.65 14.70 0x0D 46.20 47.25 0x2C 14.70 15.75 0x0E 47.25 48.30 0x2D 15.75 16.80 0x0F 48.30 49.35 0x2E 16.80 17.85 0x10 49.35 50.40 0x2F 17.85 18.90 0x11 18.90 19.95 0x12 19.95 21.00 0x13 21.00 22.05 0x14 22.05 23.10 0x15 23.10 24.15 0x16 24.15 25.20 0x17 25.20 26.25 0x18 26.25 27.30 0x19 27.30 28.35 0x1A 28.35 29.40 0x1B 29.40 30.45 0x1C 30.45 31.50 0x1D 31.50 32.55 0x1E 32.55 33.60 0x1F FDIV shown generates an FCLK frequency of >0.8 MHz FDIV shown generates an FCLK frequency of 1.05 MHz S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 619 64 KByte Flash Module (S12XFTMR64K1V1) 20.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 R 6 5 4 KEYEN[1:0] 3 2 1 RNV[5:2] 0 SEC[1:0] W Reset F F F F F F F F = Unimplemented or Reserved Figure 20-6. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 20-3) as indicated by reset condition F in Figure 20-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 20-8. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 20-9. 5–2 RNV[5:2} Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. 1–0 SEC[1:0] Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 20-10. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 20-9. Flash KEYEN States 1 KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01 DISABLED1 10 ENABLED 11 DISABLED Preferred KEYEN state to disable backdoor key access. Table 20-10. Flash Security States SEC[1:0] Status of Security 00 SECURED 01 SECURED1 10 UNSECURED 11 SECURED S12XS Family Reference Manual, Rev. 1.13 620 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) 1 Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 20.5. 20.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 R 7 6 5 4 3 0 0 0 0 0 2 1 0 CCOBIX[2:0] W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 20-11. FCCOBIX Field Descriptions Field Description 2–0 CCOBIX[1:0] Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 20.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. 20.3.2.4 Flash ECCR Index Register (FECCRIX) The FECCRIX register is used to index the FECCR register for ECC fault reporting. Offset Module Base + 0x0003 R 7 6 5 4 3 0 0 0 0 0 2 1 0 ECCRIX[2:0] W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-8. FECCR Index Register (FECCRIX) ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. Table 20-12. FECCRIX Field Descriptions Field Description 2-0 ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is ECCRIX[2:0] being read. See Section 20.3.2.14, “Flash ECC Error Results Register (FECCR),” for more details. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 621 64 KByte Flash Module (S12XFTMR64K1V1) 20.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. Offset Module Base + 0x0004 7 R 6 5 0 0 CCIE 4 3 2 0 0 IGNSF 1 0 FDFD FSFD 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 20-13. FCNFG Field Descriptions Field Description 7 CCIE Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 20.3.2.7) 4 IGNSF Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 20.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated 1 FDFD Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 20.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 20.3.2.6) 0 FSFD Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 20.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 20.3.2.6) 20.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. S12XS Family Reference Manual, Rev. 1.13 622 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Offset Module Base + 0x0005 7 6 R 5 4 3 2 1 0 DFDIE SFDIE 0 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 20-14. FERCNFG Field Descriptions Field Description 1 DFDIE Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 20.3.2.8) 0 SFDIE Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 20.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 20.3.2.8) 20.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 R 5 4 ACCERR FPVIOL 0 0 0 CCIF 3 2 MGBUSY RSVD 0 0 1 0 MGSTAT[1:0] W Reset 1 0 01 01 = Unimplemented or Reserved Figure 20-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 20.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 623 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-15. FSTAT Field Descriptions Field Description 7 CCIF Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed 5 ACCERR Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 20.4.1.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected 4 FPVIOL Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or D-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected 3 MGBUSY 2 RSVD Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 20.4.2, “Flash Command Description,” and Section 20.6, “Initialization” for details. 20.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 R 7 6 5 4 3 2 0 0 0 0 0 0 1 0 DFDIF SFDIF 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. S12XS Family Reference Manual, Rev. 1.13 624 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-16. FERSTAT Field Descriptions Field Description 1 DFDIF Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. 0 No double bit fault detected 1 Double bit fault detected or an invalid Flash array read operation attempted 0 SFDIF Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or an invalid Flash array read operation attempted 20.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 R 5 4 3 2 1 0 RNV6 FPOPEN FPHDIS FPHS[1:0] FPLDIS FPLS[1:0] W Reset F F F F F F F F = Unimplemented or Reserved Figure 20-13. Flash Protection Register (FPROT) The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 20.3.2.9.1, “P-Flash Protection Restrictions,” and Table 20-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 20-3) as indicated by reset condition ‘F’ in Figure 20-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 625 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-17. FPROT Field Descriptions Field Description 7 FPOPEN Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 20-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits 6 RNV[6] Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. 5 FPHDIS Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x7F_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled 4–3 FPHS[1:0] Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 20-19. The FPHS bits can only be written to while the FPHDIS bit is set. 2 FPLDIS 1–0 FPLS[1:0] Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x7F_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 20-20. The FPLS bits can only be written to while the FPLDIS bit is set. Table 20-18. P-Flash Protection Function 1 Function1 FPOPEN FPHDIS FPLDIS 1 1 1 No P-Flash Protection 1 1 0 Protected Low Range 1 0 1 Protected High Range 1 0 0 Protected High and Low Ranges 0 1 1 Full P-Flash Memory Protected 0 1 0 Unprotected Low Range 0 0 1 Unprotected High Range 0 0 0 Unprotected High and Low Ranges For range sizes, refer to Table 20-19 and Table 20-20. Table 20-19. P-Flash Protection Higher Address Range FPHS[1:0] Global Address Range Protected Size 00 0x7F_F800–0x7F_FFFF 2 Kbytes 01 0x7F_F000–0x7F_FFFF 4 Kbytes 10 0x7F_E000–0x7F_FFFF 8 Kbytes 11 0x7F_C000–0x7F_FFFF 16 Kbytes S12XS Family Reference Manual, Rev. 1.13 626 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-20. P-Flash Protection Lower Address Range FPLS[1:0] Global Address Range Protected Size 00 0x7F_8000–0x7F_83FF 1 Kbyte 01 0x7F_8000–0x7F_87FF 2 Kbytes 10 0x7F_8000–0x7F_8FFF 4 Kbytes 11 0x7F_8000–0x7F_9FFF 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 20-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 627 FPHDIS = 0 FPLDIS = 1 FPHDIS = 0 FPLDIS = 0 7 6 5 4 3 2 1 0 FPLS[1:0] FPHDIS = 1 FPLDIS = 0 0x7F_8000 0x7F_FFFF Scenario FPHS[1:0] Scenario FLASH START FPHDIS = 1 FPLDIS = 1 FPOPEN = 1 64 KByte Flash Module (S12XFTMR64K1V1) FPHS[1:0] 0x7F_8000 FPOPEN = 0 FPLS[1:0] FLASH START 0x7F_FFFF Unprotected region Protected region with size defined by FPLS Protected region not defined by FPLS, FPHS Protected region with size defined by FPHS Figure 20-14. P-Flash Protection Scenarios S12XS Family Reference Manual, Rev. 1.13 628 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) 20.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 20-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 20-21. P-Flash Protection Scenario Transitions To Protection Scenario1 From Protection Scenario 0 1 2 3 0 X X X X X 1 X 4 X X X X X X X X X X 6 X 7 1 X 6 7 X 3 5 5 X X 2 4 X X X X X X Allowed transitions marked with X, see Figure 20-14 for a definition of the scenarios. 20.3.2.10 D-Flash Protection Register (DFPROT) The DFPROT register defines which D-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 R 6 5 0 0 4 3 DPOPEN 2 1 0 F F DPS[4:0] W Reset F 0 0 F F F = Unimplemented or Reserved Figure 20-15. D-Flash Protection Register (DFPROT) The (unreserved) bits of the DFPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, the DFPROT register is loaded with the contents of the D-Flash protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 20-3) as indicated by reset condition F in Figure 20-15. To change the D-Flash protection that will be loaded during the reset sequence, the P-Flash sector containing the D-Flash protection byte must be unprotected, then the D-Flash protection byte must be programmed. If a double bit fault is detected while reading the S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 629 64 KByte Flash Module (S12XFTMR64K1V1) P-Flash phrase containing the D-Flash protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the D-Flash memory fully protected. Trying to alter data in any protected area in the D-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the D-Flash memory is not possible if any of the D-Flash sectors are protected. Table 20-22. DFPROT Field Descriptions Field Description 7 DPOPEN D-Flash Protection Control 0 Enables D-Flash memory protection from program and erase with protected address range defined by DPS bits 1 Disables D-Flash memory protection from program and erase 4–0 DPS[4:0] D-Flash Protection Size — The DPS[4:0] bits determine the size of the protected area in the D-Flash memory as shown in Table 20-23. Table 20-23. D-Flash Protection Address Range DPS[4:0] Global Address Range Protected Size 0_0000 0x10_0000 – 0x10_00FF 256 bytes 0_0001 0x10_0000 – 0x10_01FF 512 bytes 0_0010 0x10_0000 – 0x10_02FF 768 bytes 0_0011 0x10_0000 – 0x10_03FF 1024 bytes 0_0100 0x10_0000 – 0x10_04FF 1280 bytes 0_0101 0x10_0000 – 0x10_05FF 1536 bytes 0_0110 0x10_0000 – 0x10_06FF 1792 bytes 0_0111 0x10_0000 – 0x10_07FF 2048 bytes 0_1000 0x10_0000 – 0x10_08FF 2304 bytes 0_1001 0x10_0000 – 0x10_09FF 2560 bytes 0_1010 0x10_0000 – 0x10_0AFF 2816 bytes 0_1011 0x10_0000 – 0x10_0BFF 3072 bytes 0_1100 0x10_0000 – 0x10_0CFF 3328 bytes 0_1101 0x10_0000 – 0x10_0DFF 3584 bytes 0_1110 0x10_0000 – 0x10_0EFF 3840 bytes 0_1111 0x10_0000 – 0x10_0FFF 4096 bytes 20.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. S12XS Family Reference Manual, Rev. 1.13 630 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 0 0 0 0 R CCOB[15:8] W Reset 0 0 0 0 Figure 20-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 0 0 0 0 R CCOB[7:0] W Reset 0 0 0 0 Figure 20-17. Flash Common Command Object Low Register (FCCOBLO) 20.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 20-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 20-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 20.4.2. Table 20-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) HI FCMD[7:0] defining Flash command LO 0, Global address [22:16] HI Global address [15:8] LO Global address [7:0] HI Data 0 [15:8] LO Data 0 [7:0] 000 001 010 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 631 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) HI Data 1 [15:8] LO Data 1 [7:0] HI Data 2 [15:8] LO Data 2 [7:0] HI Data 3 [15:8] LO Data 3 [7:0] 011 100 101 20.3.2.12 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 20-18. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 20.3.2.13 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000D R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 20-19. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 20.3.2.14 Flash ECC Error Results Register (FECCR) The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (see Section 20.3.2.4). Once ECC fault information has been stored, no other S12XS Family Reference Manual, Rev. 1.13 632 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) fault information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults the priority for fault recording is double bit fault over single bit fault. Offset Module Base + 0x000E 7 6 5 4 R 3 2 1 0 0 0 0 0 ECCR[15:8] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 20-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 7 6 5 4 R 3 2 1 0 0 0 0 0 ECCR[7:0] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 20-21. Flash ECC Error Results Low Register (FECCRLO) All FECCR bits are readable but not writable. Table 20-25. FECCR Index Settings ECCRIX[2:0] 000 FECCR Register Content Bits [15:8] Bit[7] Bits[6:0] Parity bits read from Flash block 0 Global address [22:16] 001 Global address [15:0] 010 Data 0 [15:0] 011 Data 1 [15:0] (P-Flash only) 100 Data 2 [15:0] (P-Flash only) 101 Data 3 [15:0] (P-Flash only) 110 Not used, returns 0x0000 when read 111 Not used, returns 0x0000 when read Table 20-26. FECCR Index=000 Bit Descriptions Field 15:8 PAR[7:0] Description ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. 6–0 Global Address — The GADDR[22:16] field contains the upper seven bits of the global address having GADDR[22:16] caused the error. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 633 64 KByte Flash Module (S12XFTMR64K1V1) The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010. 20.3.2.15 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 R 3 2 1 0 F F F F NV[7:0] W Reset F F F F = Unimplemented or Reserved Figure 20-22. Flash Option Register (FOPT) All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 20-3) as indicated by reset condition F in Figure 20-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. Table 20-27. FOPT Field Descriptions Field Description 7–0 NV[7:0] Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 20.3.2.16 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 20-23. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. S12XS Family Reference Manual, Rev. 1.13 634 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) 20.3.2.17 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 20-24. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 20.3.2.18 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x0013 R 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 20-25. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 20.4 20.4.1 Functional Description Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 635 64 KByte Flash Module (S12XFTMR64K1V1) 20.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz. Table 20-7 shows recommended values for the FDIV field based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 20.4.1.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 20.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. 20.4.1.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 20.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 20-26. S12XS Family Reference Manual, Rev. 1.13 636 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) START Read: FCLKDIV register Clock Register Written Check no FDIVLD Set? yes Write: FCLKDIV register Note: FCLKDIV must be set after each reset Read: FSTAT register FCCOB Availability Check CCIF Set? no Results from previous Command yes Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? yes no Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? no yes EXIT Figure 20-26. Generic Flash Command Write Sequence Flowchart S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 637 64 KByte Flash Module (S12XFTMR64K1V1) 20.4.1.3 Valid Flash Module Commands Table 20-28. Flash Commands by Mode Unsecured FCMD 1 2 3 4 5 6 7 8 20.4.1.4 Command Secured NS1 NX2 SS3 ST4 NS5 NX6 SS7 ST8 0x01 Erase Verify All Blocks ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x02 Erase Verify Block ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x03 Erase Verify P-Flash Section ∗ ∗ ∗ ∗ ∗ 0x04 Read Once ∗ ∗ ∗ ∗ ∗ 0x06 Program P-Flash ∗ ∗ ∗ ∗ ∗ 0x07 Program Once ∗ ∗ ∗ ∗ ∗ 0x08 Erase All Blocks ∗ ∗ ∗ ∗ 0x09 Erase Flash Block ∗ ∗ ∗ ∗ ∗ 0x0A Erase P-Flash Sector ∗ ∗ ∗ ∗ ∗ 0x0B Unsecure Flash ∗ ∗ ∗ ∗ 0x0C Verify Backdoor Access Key ∗ 0x0D Set User Margin Level ∗ 0x0E Set Field Margin Level 0x10 Erase Verify D-Flash Section ∗ 0x11 Program D-Flash 0x12 Erase D-Flash Sector ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode. Unsecured Normal Expanded mode. Unsecured Special Single Chip mode. Unsecured Special Mode. Secured Normal Single Chip mode. Secured Normal Expanded mode. Secured Special Single Chip mode. Secured Special Mode. P-Flash Commands Table 20-29 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. S12XS Family Reference Manual, Rev. 1.13 638 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-29. P-Flash Commands FCMD Command 0x01 Erase Verify All Blocks 0x02 Erase Verify Block 0x03 Erase Verify P-Flash Section 0x04 Read Once 0x06 Program P-Flash 0x07 Program Once Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. 0x08 Erase All Blocks Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. 0x09 Erase Flash Block Erase a P-Flash (or D-Flash) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. 0x0A Erase P-Flash Sector 0x0B Unsecure Flash 0x0C Verify Backdoor Access Key Supports a method of releasing MCU security by verifying a set of security keys. 0x0D Set User Margin Level Specifies a user margin read level for all P-Flash blocks. 0x0E Set Field Margin Level Specifies a field margin read level for all P-Flash blocks (special modes only). 20.4.1.5 Function on P-Flash Memory Verify that all P-Flash (and D-Flash) blocks are erased. Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. D-Flash Commands Table 20-30 summarizes the valid D-Flash commands along with the effects of the commands on the D-Flash block. Table 20-30. D-Flash Commands FCMD Command 0x01 Erase Verify All Blocks 0x02 Erase Verify Block 0x08 Erase All Blocks 0x09 Erase Flash Block Function on D-Flash Memory Verify that all D-Flash (and P-Flash) blocks are erased. Verify that the D-Flash block is erased. Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. Erase a D-Flash (or P-Flash) block. An erase of the full D-Flash block is only possible when DPOPEN bit in the DFPROT register is set prior to launching the command. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 639 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-30. D-Flash Commands FCMD Command Function on D-Flash Memory 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. 0x0D Set User Margin Level Specifies a user margin read level for the D-Flash block. 0x0E Set Field Margin Level Specifies a field margin read level for the D-Flash block (special modes only). 0x10 Erase Verify D-Flash Section Verify that a given number of words starting at the address provided are erased. 0x11 Program D-Flash Program up to four words in the D-Flash block. 0x12 Erase D-Flash Sector Erase all bytes in a sector of the D-Flash block. 20.4.2 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 20.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 20.4.2.1 Erase Verify All Blocks Command The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Table 20-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x01 Not required S12XS Family Reference Manual, Rev. 1.13 640 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. Table 20-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch None MGSTAT1 Set if any errors have been encountered during the read1 MGSTAT0 Set if any non-correctable errors have been encountered during the read1 As found in the memory map for FTMR128K1. 20.4.2.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be verified. Table 20-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x02 Global address [22:16] of the Flash block to be verified. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF flag will set after the Erase Verify Block operation has completed. Table 20-34. Erase Verify Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR FSTAT 1 2 FPVIOL Set if an invalid global address [22:16] is supplied1 None MGSTAT1 Set if any errors have been encountered during the read2 MGSTAT0 Set if any non-correctable errors have been encountered during the read2 As defined by the memory map for FTMR128K1. As found in the memory map for FTMR128K1. 20.4.2.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. The section to be verified cannot cross a 128 Kbyte boundary in the P-Flash memory space. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 641 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-35. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x03 Global address [22:16] of a P-Flash block 001 Global address [15:0] of the first phrase to be verified 010 Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. Table 20-36. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if an invalid global address [22:0] is supplied1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT Set if the requested section crosses a 128 Kbyte boundary FPVIOL 1 2 None MGSTAT1 Set if any errors have been encountered during the read2 MGSTAT0 Set if any non-correctable errors have been encountered during the read2 As defined by the memory map for FTMR128K1. As found in the memory map for FTMR128K1. 20.4.2.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 20.4.2.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 20-37. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x04 Not Required 001 Read Once phrase index (0x0000 - 0x0007) 010 Read Once word 0 value 011 Read Once word 1 value 100 Read Once word 2 value 101 Read Once word 3 value S12XS Family Reference Manual, Rev. 1.13 642 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. Table 20-38. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR Set if command not available in current mode (see Table 20-28) Set if an invalid phrase index is supplied FSTAT FPVIOL 20.4.2.5 None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 20-39. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 1 FCCOB Parameters 0x06 Global address [22:16] to identify P-Flash block 001 Global address [15:0] of phrase location to be programmed1 010 Word 0 program value 011 Word 1 program value 100 Word 2 program value 101 Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 643 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-40. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL 1 Set if an invalid global address [22:0] is supplied1 Set if the global address [22:0] points to a protected area MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation As defined by the memory map for FTMR128K1. 20.4.2.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 20.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 20-41. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x07 Not Required 001 Program Once phrase index (0x0000 - 0x0007) 010 Program Once word 0 value 011 Program Once word 1 value 100 Program Once word 2 value 101 Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. S12XS Family Reference Manual, Rev. 1.13 644 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) R, Table 20-42. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if an invalid phrase index is supplied Set if the requested phrase has already been programmed1 FSTAT FPVIOL 1 None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 20.4.2.7 Erase All Blocks Command The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space. Table 20-43. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x08 Not required Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 20-44. Erase All Blocks Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if command not available in current mode (see Table 20-28) FSTAT 1 FPVIOL Set if any area of the P-Flash or D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation1 MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 As found in the memory map for FTMR128K1. 20.4.2.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or D-Flash block. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 645 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-45. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters Global address [22:16] to identify Flash block 0x09 Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 20-46. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if the supplied P-Flash address is not phrase-aligned or if the D-Flash address is not word-aligned FSTAT FPVIOL 1 2 Set if an invalid global address [22:16] is supplied1 Set if an area of the selected Flash block is protected MGSTAT1 Set if any errors have been encountered during the verify operation2 MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation2 As defined by the memory map for FTMR128K1. As found in the memory map for FTMR128K1. 20.4.2.9 Erase P-Flash Sector Command The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Table 20-47. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 FCCOB Parameters 0x0A Global address [22:16] to identify P-Flash block to be erased Global address [15:0] anywhere within the sector to be erased. Refer to Section 20.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. S12XS Family Reference Manual, Rev. 1.13 646 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-48. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL 1 Set if an invalid global address [22:16] is supplied1 Set if the selected P-Flash sector is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation As defined by the memory map for FTMR128K1. 20.4.2.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Table 20-49. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x0B Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 20-50. Unsecure Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if command not available in current mode (see Table 20-28) FSTAT 1 FPVIOL Set if any area of the P-Flash or D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation1 MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 As found in the memory map for FTMR128K1. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 647 64 KByte Flash Module (S12XFTMR64K1V1) 20.4.2.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 20-9). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 20-3). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 20-51. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0C Not required 001 Key 0 010 Key 1 011 Key 2 100 Key 3 Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 20-52. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 20.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL None MGSTAT1 None MGSTAT0 None 20.4.2.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. S12XS Family Reference Manual, Rev. 1.13 648 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-53. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0D 001 Global address [22:16] to identify the Flash block Margin level setting Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set User Margin Level command are defined in Table 20-54. Table 20-54. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level1 0x0002 User Margin-0 Level2 1 2 Read margin to the erased state Read margin to the programmed state Table 20-55. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if an invalid margin level setting is supplied FSTAT 1 Set if an invalid global address [22:16] is supplied1 FPVIOL None MGSTAT1 None MGSTAT0 None As defined by the memory map for FTMR128K1. NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 649 64 KByte Flash Module (S12XFTMR64K1V1) 20.4.2.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 20-56. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0E 001 Global address [22:16] to identify the Flash block Margin level setting Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set Field Margin Level command are defined in Table 20-57. Table 20-57. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level1 0x0002 User Margin-0 Level2 0x0003 Field Margin-1 Level1 0x0004 Field Margin-0 Level2 1 2 Read margin to the erased state Read margin to the programmed state Table 20-58. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if an invalid margin level setting is supplied FSTAT 1 Set if an invalid global address [22:16] is supplied1 FPVIOL None MGSTAT1 None MGSTAT0 None As defined by the memory map for FTMR128K1. CAUTION Field margin levels must only be used during verify of the initial factory programming. S12XS Family Reference Manual, Rev. 1.13 650 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 20.4.2.14 Erase Verify D-Flash Section Command The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Table 20-59. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x10 Global address [22:16] to identify the D-Flash block 001 Global address [15:0] of the first word to be verified 010 Number of words to be verified Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF flag will set after the Erase Verify D-Flash Section operation has completed. Table 20-60. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the requested section breaches the end of the D-Flash block FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read 20.4.2.15 Program D-Flash Command The Program D-Flash operation programs one to four previously erased words in the D-Flash block. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 651 64 KByte Flash Module (S12XFTMR64K1V1) CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 20-61. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters Global address [22:16] to identify the D-Flash block 0x11 001 Global address [15:0] of word to be programmed 010 Word 0 program value 011 Word 1 program value, if desired 100 Word 2 program value, if desired 101 Word 3 program value, if desired Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. The CCIF flag is set when the operation has completed. Table 20-62. Program D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the requested group of words breaches the end of the D-Flash block FPVIOL Set if the selected area of the D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation 20.4.2.16 Erase D-Flash Sector Command The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash block. Table 20-63. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 FCCOB Parameters 0x12 Global address [22:16] to identify D-Flash block S12XS Family Reference Manual, Rev. 1.13 652 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) Table 20-63. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 001 Global address [15:0] anywhere within the sector to be erased. See Section 20.1.2.2 for D-Flash sector size. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase D-Flash Sector operation has completed. Table 20-64. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 20-28) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL 20.4.3 Set if the selected area of the D-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 20-65. Flash Interrupt Sources Interrupt Source Global (CCR) Mask Interrupt Flag Local Enable CCIF (FSTAT register) CCIE (FCNFG register) I Bit ECC Double Bit Fault on Flash Read DFDIF (FERSTAT register) DFDIE (FERCNFG register) I Bit ECC Single Bit Fault on Flash Read SFDIF (FERSTAT register) SFDIE (FERCNFG register) I Bit Flash Command Complete NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 20.4.3.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 653 64 KByte Flash Module (S12XFTMR64K1V1) the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 20.3.2.5, “Flash Configuration Register (FCNFG)”, Section 20.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 20.3.2.7, “Flash Status Register (FSTAT)”, and Section 20.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 20-27. Flash Command Interrupt Request CCIE CCIF DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 20-27. Flash Module Interrupts Implementation 20.4.4 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 20.4.3, “Interrupts”). 20.4.5 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode. 20.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 20-10). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F. The security state out of reset can be permanently changed by programming the security byte of the Flash configuration field. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability S12XS Family Reference Manual, Rev. 1.13 654 Freescale Semiconductor 64 KByte Flash Module (S12XFTMR64K1V1) 20.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 20.3.2.2), the Verify Backdoor Access Key command (see Section 20.4.2.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 20-10) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 20.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 20.4.2.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field. The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte (0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. 20.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods: • Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 655 64 KByte Flash Module (S12XFTMR64K1V1) • Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method: • Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU. 20.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 20-28. 20.6 Initialization On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. S12XS Family Reference Manual, Rev. 1.13 656 Freescale Semiconductor Appendix A Electrical Characteristics A.1 General NOTE The electrical characteristics given in this section should be used as a guide only. Values cannot be guaranteed by Freescale and are subject to change without notice. Data are currently based on characterization data of 9S12XS128 material only unless marked differently. This supplement contains the most accurate electrical information for the S12XS family microcontroller available at the time of publication. This introduction is intended to give an overview on several common topics like power supply, current injection etc. A.1.1 Parameter Classification The electrical parameters shown in this supplement are guaranteed by various methods. To give the customer a better understanding the following classification is used and the parameters are tagged accordingly in the tables where appropriate. NOTE This classification is shown in the column labeled “C” in the parameter tables where appropriate. P: C: T: D: A.1.2 Those parameters are guaranteed during production testing on each individual device. Those parameters are achieved by the design characterization by measuring a statistically relevant sample size across process variations. Those parameters are achieved by design characterization on a small sample size from typical devices under typical conditions unless otherwise noted. All values shown in the typical column are within this category. Those parameters are derived mainly from simulations. Power Supply The S12XS family utilizes several pins to supply power to the I/O ports, A/D converter, oscillator, and PLL as well as the digital core. The VDDA, VSSA pin pairs supply the A/D converter and parts of the internal voltage regulator. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 657 Electrical Characteristics The VDDX, VSSX pin pairs [2:1] supply the I/O pins. VDDR supplies the internal voltage regulator. VDDPLL, VSSPLL pin pair supply the oscillator and the PLL. VSS1, VSS2 and VSS3 are internally connected by metal. All VDDX pins are internally connected by metal. All VSSX pins are internally connected by metal. VDDA is connected to all VDDX pins by diodes for ESD protection such that VDDX must not exceed VDDA by more than a diode voltage drop. VDDA can exceed VDDX by more than a diode drop in order to support applications with a 5V A/D converter range and 3.3V I/O pin range. VSSA and VSSX are connected by anti-parallel diodes for ESD protection. NOTE In the following context VDD35 is used for either VDDA, VDDR, and VDDX; VSS35 is used for either VSSA and VSSX unless otherwise noted. IDD35 denotes the sum of the currents flowing into the VDDA and VDDR pins. The Run mode current in the VDDX domain is external load dependent. VDD is used for VDD, VSS is used for VSS1, VSS2 and VSS3. VDDPLL is used for VDDPLL, VSSPLL is used for VSSPLL IDD is used for the sum of the currents flowing into VDD, VDDF and VDDPLL. A.1.3 Pins There are four groups of functional pins. A.1.3.1 I/O Pins The I/O pins have a level in the range of 3.13V to 5.5V. This class of pins is comprised of all port I/O pins, the analog inputs, BKGD and the RESET pins. Some functionality may be disabled. For example the BKGD pin pull up is always enabled. A.1.3.2 Analog Reference This group is made up by the VRH and VRL pins. A.1.3.3 Oscillator The pins EXTAL, XTAL dedicated to the oscillator have a nominal 1.8V level. They are supplied by VDDPLL. S12XS Family Reference Manual, Rev. 1.13 658 Freescale Semiconductor Electrical Characteristics A.1.3.4 TEST This pin is used for production testing only. The TEST pin must be tied to VSS in all applications. A.1.4 Current Injection Power supply must maintain regulation within operating VDD35 or VDD range during instantaneous and operating maximum current conditions. If positive injection current (Vin > VDD35) is greater than IDD35, the injection current may flow out of VDD35 and could result in external power supply going out of regulation. Ensure external VDD35 load will shunt current greater than maximum injection current. This will be the greatest risk when the MCU is not consuming power; e.g., if no system clock is present, or if clock rate is very low which would reduce overall power consumption. A.1.5 Absolute Maximum Ratings Absolute maximum ratings are stress ratings only. A functional operation under or outside those maxima is not guaranteed. Stress beyond those limits may affect the reliability or cause permanent damage of the device. This device contains circuitry protecting against damage due to high static voltage or electrical fields; however, it is advised that normal precautions be taken to avoid application of any voltages higher than maximum-rated voltages to this high-impedance circuit. Reliability of operation is enhanced if unused inputs are tied to an appropriate logic voltage level (e.g., either VSS35 or VDD35). S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 659 Electrical Characteristics Table A-1. Absolute Maximum Ratings1 Num Rating Symbol Min Max Unit VDD35 –0.3 6.0 V VDD –0.3 2.16 V 1 I/O, regulator and analog supply voltage 2 Digital logic supply voltage2 3 PLL supply voltage2 VDDPLL –0.3 2.16 V 4 NVM supply voltage2 VDDF –0.3 3.6 V 5 Voltage difference VDDX to VDDA ∆VDDX –6.0 0.3 V 6 Voltage difference VSSX to VSSA ∆VSSX –0.3 0.3 V 7 Digital I/O input voltage VIN –0.3 6.0 V 8 Analog reference VRH, VRL –0.3 6.0 V 9 EXTAL, XTAL VILV –0.3 2.16 V 11 Instantaneous maximum current Single pin limit for all digital I/O pins3 I –25 +25 mA 12 Instantaneous maximum current Single pin limit for EXTAL, XTAL4 I –25 +25 mA 14 Maximum current Single pin limit for power supply pins IDV –100 +100 mA 15 Storage temperature range Tstg –65 155 °C D DL Beyond absolute maximum ratings device might be damaged. The device contains an internal voltage regulator to generate the logic and PLL supply out of the I/O supply. The absolute maximum ratings apply when the device is powered from an external source. 3 All digital I/O pins are internally clamped to VSSX and VDDX, or VSSA and VDDA. 4 Those pins are internally clamped to VSSPLL and VDDPLL. 1 2 A.1.6 ESD Protection and Latch-up Immunity All ESD testing is in conformity with CDF-AEC-Q100 stress test qualification for automotive grade integrated circuits. During the device qualification ESD stresses were performed for the Human Body Model (HBM) and the Charge Device Model. A device will be defined as a failure if after exposure to ESD pulses the device no longer meets the device specification. Complete DC parametric and functional testing is performed per the applicable device specification at room temperature followed by hot temperature, unless specified otherwise in the device specification. S12XS Family Reference Manual, Rev. 1.13 660 Freescale Semiconductor Electrical Characteristics Table A-2. ESD and Latch-up Test Conditions Model Description Symbol Value Unit Series resistance R1 1500 Ohm Storage capacitance C 100 pF Number of pulse per pin Positive Negative — — 1 1 Charged Device Number of pulse per pin Positive Negative — — 3 3 Latch-up Minimum input voltage limit — –2.5 V Maximum input voltage limit — 7.5 V Human Body Table A-3. ESD and Latch-Up Protection Characteristics Num C 1 C 2 3 4 A.1.7 Symbol Min Max Unit Human Body Model (HBM) VHBM 2000 — V C Charge Device Model (CDM) corner pins Charge Device Model (CDM) edge pins VCDM 750 500 — — V C Latch-up current at TA = 125°C Positive Negative ILAT +100 –100 — — Latch-up current at TA = 27°C Positive Negative ILAT +200 –200 — — C Rating mA mA Operating Conditions This section describes the operating conditions of the device. Unless otherwise noted those conditions apply to all the following data. NOTE Please refer to the temperature rating of the device (C, V, M) with regards to the ambient temperature TA and the junction temperature TJ. For power dissipation calculations refer to Section A.1.8, “Power Dissipation and Thermal Characteristics”. Table A-4. Operating Conditions Rating I/O, regulator and analog supply voltage NVM logic supply voltage 1 Voltage difference VDDX to VDDA Symbol Min Typ Max Unit VDD35 3.13 5 5.5 V VDDF 2.7 2.8 2.98 V ∆VDDX refer to Table A-14 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 661 Electrical Characteristics Table A-4. Operating Conditions Voltage difference VDDR to VDDX ∆VDDR Voltage difference VSSX to VSSA ∆VSSX Voltage difference VSS1 , VSS2 , VSS3 , VSSPLL to VSSX ∆VSS -0.1 0 0.1 V Digital logic supply voltage1 VDD 1.72 1.8 1.98 V PLL supply voltage VDDPLL 1.72 1.8 1.98 V 2 Oscillator (Loop Controlled Pierce) (Full Swing Pierce) fosc 4 2 — — 16 40 MHz Bus frequency3 fbus 0.5 — 40 MHz Temperature Option C Operating junction temperature range Operating ambient temperature range4 TJ TA –40 –40 — 27 110 85 Temperature Option V Operating junction temperature range Operating ambient temperature range4 TJ TA –40 –40 — 27 130 105 -0.1 0 0.1 V refer to Table A-14 °C °C Temperature Option M °C Operating junction temperature range TJ –40 — 150 Operating ambient temperature range4 TA –40 27 125 The device contains an internal voltage regulator to generate the logic and PLL supply out of the I/O supply. 1 2 This refers to the oscillator base frequency. Typical crystal & resonator tolerances are supported. 3 Please refer to Table A-24 for maximum bus frequency limits with frequency modulation enabled 4 Please refer to Section A.1.8, “Power Dissipation and Thermal Characteristics” for more details about the relation between ambient temperature TA and device junction temperature TJ. NOTE Using the internal voltage regulator, operation is guaranteed in a power down until a low voltage reset assertion. A.1.8 Power Dissipation and Thermal Characteristics Power dissipation and thermal characteristics are closely related. The user must assure that the maximum operating junction temperature is not exceeded. The average chip-junction temperature (TJ) in °C can be obtained from: T T T J = Junction Temperature, [°C ] A = Ambient Temperature, [°C ] P D Θ J = T + (P • Θ ) A D JA = Total Chip Power Dissipation, [W] JA = Package Thermal Resistance, [°C/W] S12XS Family Reference Manual, Rev. 1.13 662 Freescale Semiconductor Electrical Characteristics The total power dissipation can be calculated from: P P D = P INT +P IO = Chip Internal Power Dissipation, [W] 2 P = R ⋅I IO DSON IO i i INT ∑ PIO is the sum of all output currents on I/O ports associated with VDDX, whereby R R V OL = ------------ ;for outputs driven low DSON I OL V –V DD35 OH = -------------------------------------- ;for outputs driven high DSON I OH Two cases with internal voltage regulator enabled and disabled must be considered: 1. Internal voltage regulator disabled P INT = I DD ⋅V DD DDPLL ⋅V DDPLL ⋅V +I ⋅V +I +I DDA ⋅V DDA 2. Internal voltage regulator enabled P INT = I DDR DDR DDA DDA S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 663 Electrical Characteristics Table A-5. Thermal Package Characteristics (9S12XS256)1 Num C Rating Symbol Min Typ Max Unit LQFP 112 1 D Thermal resistance LQFP 112, single sided PCB2 θJA — — 62 °C/W 2 D Thermal resistance LQFP 112, double sided PCB with 2 internal planes3 θJA — — 51 °C/W 3 D Junction to Board LQFP 112 θJB — — 39 °C/W 4 D Junction to Case LQFP 1124 θJC — — 16 °C/W 5 D Junction to Package Top LQFP 1125 ΨJT — — 3 °C/W 2 QFP 80 6 D Thermal resistance QFP 80, single sided PCB θJA — — 57 °C/W 7 D Thermal resistance QFP 80, double sided PCB with 2 internal planes3 θJA — — 45 °C/W 8 D Junction to Board QFP 80 θJB — — 29 °C/W 9 D Junction to Case QFP 804 θJC — — 20 °C/W ΨJT — — 5 °C/W 10 D 5 Junction to Package Top QFP 80 LQFP 64 11 D Thermal resistance LQFP 64, single sided PCB2 θJA — — 68 °C/W 12 D Thermal resistance LQFP 64, double sided PCB with 2 internal planes3 θJA — — 50 °C/W 13 D Junction to Board LQFP 64 θJB — — 32 °C/W D 4 θJC — — 15 °C/W 14 Junction to Case LQFP 64 5 1 2 3 4 5 ΨJT — — 3 °C/W 15 D Junction to Package Top LQFP 64 The values for thermal resistance are achieved by package simulations Junction to ambient thermal resistance, θJA was simulated to be equivalent to the JEDEC specification JESD51-2 in a horizontal configuration in natural convection. Junction to ambient thermal resistance, θJA was simulated to be equivalent to the JEDEC specification JESD51-7 in a horizontal configuration in natural convection. Junction to case thermal resistance was simulated to be equivalent to the measured values using the cold plate technique with the cold plate temperature used as the “case” temperature. This basic cold plate measurement technique is described by MILSTD 883D, Method 1012.1. This is the correct thermal metric to use to calculate thermal performance when the package is being used with a heat sink. Thermal characterization parameter ΨJT is the “resistance” from junction to reference point thermocouple on top center of the case as defined in JESD51-2. ΨJT is a useful value to use to estimate junction temperature in a steady state customer enviroment. S12XS Family Reference Manual, Rev. 1.13 664 Freescale Semiconductor Electrical Characteristics Table A-6. Thermal Package Characteristics (9S12XS128)1 Num C Rating Symbol Min Typ Max Unit LQFP 112 1 D Thermal resistance LQFP 112, single sided PCB2 θJA — — 58 °C/W 2 D Thermal resistance LQFP 112, double sided PCB with 2 internal planes3 θJA — — 48 °C/W 3 D Junction to Board LQFP 112 θJB — — 36 °C/W D 4 θJC — — 14 °C/W ΨJT — — 2 °C/W 4 5 D Junction to Case LQFP 112 5 Junction to Package Top LQFP 112 QFP 80 6 D Thermal resistance QFP 80, single sided PCB2 θJA — — 56 °C/W 7 D Thermal resistance QFP 80, double sided PCB with 2 internal planes3 θJA — — 43 °C/W 8 D Junction to Board QFP 80 θJB — — 28 °C/W 9 D Junction to Case QFP 80 4 θJC — — 19 °C/W 10 D Junction to Package Top QFP 805 ΨJT — — 5 °C/W LQFP 64 1 2 3 4 5 11 D Thermal resistance LQFP 64, single sided PCB2 θJA — — 64 °C/W 12 D Thermal resistance LQFP 64, double sided PCB with 2 internal planes3 θJA — — 46 °C/W 13 D Junction to Board LQFP 64 θJB — — 28 °C/W 14 D Junction to Case LQFP 644 θJC — — 13 °C/W ΨJT — — 2 °C/W 15 D Junction to Package Top LQFP 645 The values for thermal resistance are achieved by package simulations Junction to ambient thermal resistance, θJA was simulated to be equivalent to the JEDEC specification JESD51-2 in a horizontal configuration in natural convection. Junction to ambient thermal resistance, θJA was simulated to be equivalent to the JEDEC specification JESD51-7 in a horizontal configuration in natural convection. Junction to case thermal resistance was simulated to be equivalent to the measured values using the cold plate technique with the cold plate temperature used as the “case” temperature. This basic cold plate measurement technique is described by MILSTD 883D, Method 1012.1. This is the correct thermal metric to use to calculate thermal performance when the package is being used with a heat sink. Thermal characterization parameter ΨJT is the “resistance” from junction to reference point thermocouple on top center of the case as defined in JESD51-2. ΨJT is a useful value to use to estimate junction temperature in a steady state customer enviroment. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 665 Electrical Characteristics A.1.9 I/O Characteristics This section describes the characteristics of all I/O pins except EXTAL, XTAL, TEST and supply pins. Table A-7. 3.3-V I/O Characteristics Conditions are 3.13 V < VDD35 < 3.6 V junction temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. Num C Symbol Min Typ Max Unit P Input high voltage VIH 0.65*VDD35 — — V T Input high voltage VIH — — VDD35 + 0.3 V P Input low voltage VIL — — 0.35*VDD35 V T Input low voltage VIL VSS35 – 0.3 — — V 3 T Input hysteresis VHYS — 250 — mV 4a P Input leakage current (pins in high impedance input mode)1 Vin = VDD35 or VSS35 M Temperature range -40°C to 150°C V Temperature range -40°C to 130°C C Temperature range -40°C to 110°C I –1 –0.75 –0.5 — — — 1 0.75 0.5 µA 4b C Input leakage current (pins in high impedance input mode) Vin = VDD35 or VSS35 −40°C 27°C 70°C 85°C 100°C 105°C 110°C 120°C 125°C 130°C 150°C I — — — ±1 ±1 ±8 ±14 ±26 ±32 ±40 ±60 ±74 ±92 ±240 — nA 5 C Output high voltage (pins in output mode) Partial drive IOH = –0.75 mA V OH VDD35 – 0.4 — — V 6 P Output high voltage (pins in output mode) Full drive IOH = –4 mA VOH VDD35 – 0.4 — — V 7 C Output low voltage (pins in output mode) Partial Drive IOL = +0.9 mA VOL — — 0.4 V 8 P Output low voltage (pins in output mode) Full Drive IOL = +4.75 mA V — — 0.4 V 9 P Internal pull up resistance VIH min > input voltage > VIL max RPUL 25 — 50 KΩ 10 P Internal pull down resistance VIH min > input voltage > VIL max RPDH 25 — 50 KΩ 11 D Input capacitance Cin — 6 — pF IICS IICP –2.5 –25 1 2 12 Rating in in OL 2 T Injection current Single pin limit Total device limit, sum of all injected currents — mA 2.5 25 S12XS Family Reference Manual, Rev. 1.13 666 Freescale Semiconductor Electrical Characteristics Table A-7. 3.3-V I/O Characteristics Conditions are 3.13 V < VDD35 < 3.6 V junction temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. 13 P Port H, J, P interrupt input pulse filtered (STOP)3 tPULSE — — 3 µs 14 P Port H, J, P interrupt input pulse passed (STOP) 3 tPULSE 10 — — µs 15 D Port H, J, P interrupt input pulse filtered (STOP) tPULSE — — 3 tcyc 16 D Port H, J, P interrupt input pulse passed (STOP) tPULSE 4 — — tcyc 17 D IRQ pulse width, edge-sensitive mode (STOP) PWIRQ 1 — — tcyc PWXIRQ 18 D XIRQ pulse width with X-bit set (STOP) Maximum leakage current occurs at maximum operating temperature. 1 2 Refer to Section A.1.4, “Current Injection” for more details 3 Parameter only applies in stop or pseudo stop mode. 4 — — tosc S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 667 Electrical Characteristics Table A-8. 5-V I/O Characteristics Conditions are 4.5 V < VDD35 < 5.5 V junction temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. Num C 1 Rating Symbol Min Typ Max Unit 0.65*VDD35 — — V P Input high voltage V T Input high voltage VIH — — VDD35 + 0.3 V P Input low voltage VIL — — 0.35*VDD35 V T Input low voltage VIL VSS35 – 0.3 — — V 3 T Input hysteresis VHYS — 250 — mV 4a P Input leakage current (pins in high impedance input mode)1 Vin = VDD35 or VSS35 M Temperature range -40°C to 150°C V Temperature range -40°C to 130°C C Temperature range -40°C to 110°C I –1 –0.75 –0.5 — — — 1 0.75 0.5 µA 4b C Input leakage current (pins in high impedance input mode) Vin = VDD35 or VSS35 −40°C 27°C 70°C 85°C 100°C 105°C 110°C 120°C 125°C 130°C 150°C I — — — ±1 ±1 ±8 ±14 ±26 ±32 40 ±60 ±74 ±92 ±240 — nA 5 C Output high voltage (pins in output mode) Partial drive IOH = –2 mA V OH VDD35 – 0.8 — — V 6 P Output high voltage (pins in output mode) Full drive IOH = –10 mA VOH VDD35 – 0.8 — — V 7 C Output low voltage (pins in output mode) Partial drive IOL = +2 mA VOL — — 0.8 V 8 P Output low voltage (pins in output mode) Full drive IOL = +10 mA V — — 0.8 V 9 P Internal pull up resistance VIH min > input voltage > VIL max RPUL 25 — 50 KΩ 10 P Internal pull down resistance VIH min > input voltage > VIL max RPDH 25 — 50 KΩ 11 D Input capacitance Cin — 6 — pF T Injection current Single pin limit Total device Limit, sum of all injected currents IICS IICP –2.5 –25 13 P Port H, J, P interrupt input pulse filtered (STOP)3 tPULSE — — 3 µs 14 P Port H, J, P interrupt input pulse passed (STOP) 3 tPULSE 10 — — µs 15 D Port H, J, P interrupt input pulse filtered (STOP) tPULSE — — 3 tcyc 2 12 IH in in OL 2 — mA 2.5 25 S12XS Family Reference Manual, Rev. 1.13 668 Freescale Semiconductor Electrical Characteristics Table A-8. 5-V I/O Characteristics Conditions are 4.5 V < VDD35 < 5.5 V junction temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. 16 D Port H, J, P interrupt input pulse passed (STOP) tPULSE 4 — — tcyc 17 D IRQ pulse width, edge-sensitive mode (STOP) PWIRQ 1 — — tcyc PWXIRQ 18 D XIRQ pulse width with X-bit set (STOP) Maximum leakage current occurs at maximum operating temperature. 1 2 Refer to Section A.1.4, “Current Injection” for more details 3 Parameter only applies in stop or pseudo stop mode. 4 — — tosc A.1.10 Supply Currents This section describes the current consumption characteristics of the device as well as the conditions for the measurements. A.1.10.1 Typical Run Current Measurement Conditions Since the current consumption of the output drivers is load dependent, all measurements are without output loads and with minimum I/O activity. The currents are measured in single chip mode, S12XCPU code is executed from Flash. VDD35=5V, internal voltage regulator is enabled and the bus frequency is 40MHz using a 4MHz oscillator in loop controlled Pierce mode. Since the DBG and BDM modules are typically not used in the end application, the supply current values for these modules is not specified. An overhead of current consumption exists independent of the listed modules, due to voltage regulation and clock logic that is not dedicated to a specific module. This is listed in the table row named “overhead”. Table A-9 shows the configuration of the peripherals for typical run current. Table A-9. Module Configurations for Typical Run Supply (VDDR+VDDA) Current VDD35=5V Peripheral S12XCPU MSCAN Configuration 420 cycle loop: 384 DBNE cycles plus subroutine entry to stimulate stacking (RAM access) Configured to loop-back mode using a bit rate of 500kbit/s SPI Configured to master mode, continuously transmit data (0x55 or 0xAA) at 2Mbit/s SCI Configured into loop mode, continuously transmit data (0x55) at speed of 19200 baud PWM Configured to toggle its pins at the rate of 1kHz TIM The peripheral shall be configured in output compare mode. Pulse accumulator and modulus counter enabled. ATD The peripheral is configured to operate at its maximum specified frequency and to continuously convert voltages on all input channels in sequence. Overhead A.1.10.2 VREG supplying 1.8V from a 5V input voltage, PLL on Maximum Run Current Measurement Conditions Currents are measured in single chip mode, S12XCPU with VDD35=5.5V, internal voltage regulator enabled and a 40MHz bus frequency from a 4MHz input. Characterized parameters are derived using a S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 669 Electrical Characteristics 4MHz loop controlled Pierce oscillator. Production test parameters are tested with a 4MHz square wave oscillator. Table A-10 shows the configuration of the peripherals for maximum run current Table A-10. Module Configurations for Maximum Run Supply (VDDR+VDDA) Current VDD35=5.5V Peripheral S12XCPU MSCAN Configuration 420 cycle loop: 384 DBNE cycles plus subroutine entry to stimulate stacking (RAM access) Configured to loop-back mode using a bit rate of 1Mbit/s SPI Configured to master mode, continuously transmit data (0x55 or 0xAA) at 4Mbit/s SCI Configured into loop mode, continuously transmit data (0x55) at speed of 57600 baud PWM Configured to toggle its pins at the rate of 40kHz TIM The peripheral shall be configured in output compare mode. Pulse accumulator and modulus counter enabled. ATD The peripheral is configured to operate at its maximum specified frequency and to continuously convert voltages on all input channels in sequence. Overhead A.1.10.3 VREG supplying 1.8V from a 5V input voltage, PLL on Stop Current Conditions Unbonded ports must be correctly initialized to prevent current consumption due to floating inputs. Typical Stop current is measured with VDD35=5V, maximum Stop current is measured with VDD35=5.5V. Pseudo Stop currents are measured with the oscillator configured for 4MHz LCP mode. Production test parameters are tested with a 4MHz square wave oscillator. A.1.10.4 Measurement Results Table A-11. Module Run Supply Currents Conditions are shown in Table A-9 at ambient temperature unless otherwise noted Num C Rating Min Typ Max Unit 1 T S12XCPU — 1.1 — mA 2 T MSCAN — 0.5 — 3 T SPI — 0.4 — 4 T SCI — 0.6 — 5 T PWM — 0.9 — 6 T TIM — 0.3 — 7 T ATD — 1.7 — 8 T Overhead — 13.6 — S12XS Family Reference Manual, Rev. 1.13 670 Freescale Semiconductor Electrical Characteristics Table A-12. Run and Wait Current Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit Run supply current (No external load, Peripheral Configuration see Table A-10.) 1 1a P P Peripheral Set1 fosc=4MHz, fbus=40MHz IDD35 Peripheral Set1 Device 9S12XS256 fosc=4MHz, fbus=40MHz IDD35 mA — — 32 — — 35 mA Run supply current (No external load, Peripheral Configuration see Table A-9.) C T T Peripheral Set1 fosc=4MHz, fbus=40MHz fosc=4MHz, fbus=20MHz fosc=4MHz, fbus=8MHz T T T 2 mA IDD35 — — — 22 12.5 7 — — — Peripheral Set2 fosc=4MHz, fbus=40MHz fosc=4MHz, fbus=20MHz fosc=4MHz, fbus=8MHz — — — 21 12 7 — — — T T T Peripheral Set3 fosc=4MHz, fbus=40MHz fosc=4MHz, fbus=20MHz fosc=4MHz, fbus=8MHz — — — 21 11 6 — — — T T T Peripheral Set4 fosc=4MHz, fbus=40MHz fosc=4MHz, fbus=20MHz fosc=4MHz, fbus=8MHz — — — 21 11 6 — — — T T T Peripheral Set5 fosc=4MHz, fbus=40MHz fosc=4MHz, fbus=20MHz fosc=4MHz, fbus=8MHz — — — 21 11 5 — — — — 11 22 — 16 24 — — 10 5.4 — — — 1.8 4 3 4 5 6 Wait supply current 7 7a P P Peripheral Set ,PLL on IDDW 1 Peripheral Set ,PLL on, Device 9S12XS256 mA 2 8 T T 1 2 3 4 5 1 Peripheral Set fosc=4MHz, fbus=40MHz fosc=4MHz, fbus=8MHz 9 C All modules disabled, RTI enabled, PLL off The following peripherals are on: ATD0/TIM/PWM/SPI0/SCI0-SCI1/CAN0 The following peripherals are on: ATD0/TIM/PWM/SPI0/SCI0-SCI1 The following peripherals are on: ATD0/TIM/PWM/SPI0 The following peripherals are on: ATD0/TIM/PWM The following peripherals are on: ATD0/TIM S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 671 Electrical Characteristics Table A-13. Pseudo Stop and Full Stop Current Conditions are shown in Table A-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 300 400 — — — — — — µA 80 100 2400 2400 2400 µA Pseudo stop current (API, RTI, and COP disabled) PLL off, LCP mode 10a C C C C C C C C –40°C 27°C 70°C 85°C 105°C 110°C 130°C 150°C 10b P P P P P –40°C 27°C 110°C 130°C 150°C IDDPS — — — — — — — — 155 171 199 216 233 270 350 452 Pseudo stop current (API, RTI, and COP disabled) PLL off, FSP mode IDDPS — — — — — 60 70 160 210 400 Pseudo stop current (API, RTI, and COP enabled) PLL off, LCP mode 11 C C C C C C 27°C 70°C 85°C 105°C 125°C 150°C IDDPS — — — — — — 186 209 245 270 383 487 — — — — — — µA IDDS — — — — — — — — — 20 25 40 65 80 95 220 250 380 60 80 — — — — — — 2000 µA — — — — — 25 40 70 100 255 — — — — — µA — — — 190 230 400 — — — µA Stop Current 12 P P C C C C C C P –40°C 27°C 70°C 85°C 105°C 110°C 125°C 130°C 150°C Stop Current (API active) 13 T T T T T –40°C 27°C 85°C 110°C 130°C IDDS Stop Current (ATD active) 14 T T T 27°C 85°C 125°C IDDS S12XS Family Reference Manual, Rev. 1.13 672 Freescale Semiconductor Electrical Characteristics A.2 ATD Characteristics This section describes the characteristics of the analog-to-digital converter. A.2.1 ATD Operating Characteristics The Table A-14 and Table A-15 show conditions under which the ATD operates. The following constraints exist to obtain full-scale, full range results: VSSA ≤ VRL ≤ VIN ≤ VRH ≤ VDDA. This constraint exists since the sample buffer amplifier can not drive beyond the power supply levels that it ties to. If the input level goes outside of this range it will effectively be clipped. Table A-14. ATD Operating Characteristics Conditions are shown in Table A-4 unless otherwise noted, supply voltage 3.13 V < VDDA < 5.5 V Num C 1 Rating D Reference potential Low High Symbol Min Typ Max Unit VRL VRH VSSA VDDA/2 — — VDDA/2 VDDA V V 2 D Voltage difference VDDX to VDDA ∆VDDX –2.35 0 0.1 V 3 D Voltage difference VSSX to VSSA ∆VSSX –0.1 0 0.1 V 4 C Differential reference voltage1 VRH-VRL 3.13 5.0 5.5 V 5 C ATD Clock Frequency (derived from bus clock via the prescaler bus) 0.25 — 8.3 MHz 0.6 1 1.7 MHz — — 1.5 µs 6 P ATD Clock Frequency in Stop mode (internal generated temperature and voltage dependent clock, ICLK) 7 D ADC conversion in stop, recovery time2 fATDCLk tATDSTPRCV ATD Conversion Period3 42 ATD 20 NCONV12 — 8 D 12 bit resolution: 41 clock 19 NCONV10 — 10 bit resolution: 39 cycles 17 NCONV8 — 8 bit resolution: 1 Full accuracy is not guaranteed when differential voltage is less than 4.50 V 2 When converting in Stop Mode (ICLKSTP=1) an ATD Stop Recovery time tATDSTPRCV is required to switch back to bus clock based ATDCLK when leaving Stop Mode. Do not access ATD registers during this time. 3 The minimum time assumes a sample time of 4 ATD clock cycles. The maximum time assumes a sample time of 24 ATD clock cycles and the discharge feature (SMP_DIS) enabled, which adds 2 ATD clock cycles. A.2.2 Factors Influencing Accuracy Source resistance, source capacitance and current injection have an influence on the accuracy of the ATD. A further factor is that PortAD pins that are configured as output drivers switching. A.2.2.1 Port AD Output Drivers Switching PortAD output drivers switching can adversely affect the ATD accuracy whilst converting the analog voltage on other PortAD pins because the output drivers are supplied from the VDDA/VSSA ATD supply pins. Although internal design measures are implemented to minimize the affect of output driver noise, it S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 673 Electrical Characteristics is recommended to configure PortAD pins as outputs only for low frequency, low load outputs. The impact on ATD accuracy is load dependent and not specified. The values specified are valid under condition that no PortAD output drivers switch during conversion. A.2.2.2 Source Resistance Due to the input pin leakage current as specified in Table A-7 and Table A-8 in conjunction with the source resistance there will be a voltage drop from the signal source to the ATD input. The maximum source resistance RS specifies results in an error (10-bit resolution) of less than 1/2 LSB (2.5 mV) at the maximum leakage current. If device or operating conditions are less than worst case or leakage-induced error is acceptable, larger values of source resistance of up to 10Kohm are allowed. A.2.2.3 Source Capacitance When sampling an additional internal capacitor is switched to the input. This can cause a voltage drop due to charge sharing with the external and the pin capacitance. For a maximum sampling error of the input voltage ≤ 1LSB (10-bit resilution), then the external filter capacitor, Cf ≥ 1024 * (CINS–CINN). A.2.2.4 Current Injection There are two cases to consider. 1. A current is injected into the channel being converted. The channel being stressed has conversion values of $3FF (in 10-bit mode) for analog inputs greater than VRH and $000 for values less than VRL unless the current is higher than specified as disruptive condition. 2. Current is injected into pins in the neighborhood of the channel being converted. A portion of this current is picked up by the channel (coupling ratio K), This additional current impacts the accuracy of the conversion depending on the source resistance. The additional input voltage error on the converted channel can be calculated as: VERR = K * RS * IINJ with IINJ being the sum of the currents injected into the two pins adjacent to the converted channel. S12XS Family Reference Manual, Rev. 1.13 674 Freescale Semiconductor Electrical Characteristics Table A-15. ATD Electrical Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit RS — — 1 KΩ 1 C Max input source resistance1 2 D Total input capacitance Non sampling Total input capacitance Sampling CINN CINS — — — — 10 16 pF 3 D Input internal Resistance RINA — 5 15 kΩ 4 C Disruptive analog input current INA –2.5 — 2.5 mA 5 C Coupling ratio positive current injection Kp — — 1E-4 A/A Kn — — 3E-3 A/A 6 C Coupling ratio negative current injection Refer to A.2.2.2 for further information concerning source resistance 1 A.2.3 ATD Accuracy Table A-16 and Table A-17 specifies the ATD conversion performance excluding any errors due to current injection, input capacitance and source resistance. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 675 Electrical Characteristics A.2.3.1 ATD Accuracy Definitions For the following definitions see also Figure A-1. Differential non-linearity (DNL) is defined as the difference between two adjacent switching steps. V –V i i–1 DNL ( i ) = --------------------------- – 1 1LSB The integral non-linearity (INL) is defined as the sum of all DNLs: n INL ( n ) = ∑ V –V n 0 DNL ( i ) = --------------------- – n 1LSB i=1 S12XS Family Reference Manual, Rev. 1.13 676 Freescale Semiconductor Electrical Characteristics DNL Vi-1 10-Bit Absolute Error Boundary LSB Vi $3FF 8-Bit Absolute Error Boundary $3FE $3FD $FF $3FC $3FB $3FA $3F9 $FE $3F8 $3F7 $3F6 $3F5 10-Bit Resolution $3F3 9 Ideal Transfer Curve 2 8 8-Bit Resolution $FD $3F4 7 10-Bit Transfer Curve 6 5 1 4 3 8-Bit Transfer Curve 2 1 0 5 10 15 20 25 30 35 40 45 55 60 65 70 75 80 85 90 95 100 105 110 115 120 5000 + Vin mV Figure A-1. ATD Accuracy Definitions NOTE Figure A-1 shows only definitions, for specification values refer to Table A16 and Table A-17. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 677 Electrical Characteristics Table A-16. ATD Conversion Performance 5V range Conditions are shown in Table A-4. unless otherwise noted. VREF = VRH - VRL = 5.12V. fATDCLK = 8.0MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Rating1,2 Num C Symbol Min Typ Max Unit 1 P Resolution 12-Bit LSB — 1.25 — mV 2 P Differential Nonlinearity 12-Bit DNL -4 ±2 4 counts 3 P Integral Nonlinearity 12-Bit INL -5 ±2.5 5 counts 4 P Absolute Error3 12-Bit AE -7 ±4 7 counts 5 C Resolution 10-Bit LSB — 5 — mV 6 C Differential Nonlinearity 10-Bit DNL -1 ±0.5 1 counts 7 C Integral Nonlinearity 10-Bit INL -2 ±1 2 counts 8 C Absolute Error3 10-Bit AE -3 ±2 3 counts 9 C Resolution 8-Bit LSB — 20 — mV 10 C Differential Nonlinearity 8-Bit DNL -0.5 ±0.3 0.5 counts 11 C Integral Nonlinearity 8-Bit INL -1 ±0.5 1 counts 8-Bit AE -1.5 ±1 1.5 counts 12 C Absolute Error3 1 The 8-bit and 10-bit mode operation is structurally tested in production test. Absolute values are tested in 12-bit mode. 2 Better performance is possible using specially designed multi-layer PCBs or averaging techniques. 3 These values include the quantization error which is inherently 1/2 count for any A/D converter. Table A-17. ATD Conversion Performance 3.3V range Conditions are shown in Table A-4. unless otherwise noted. VREF = VRH - VRL = 3.3V. fATDCLK = 8.0MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Rating1,2 Num C Symbol Min Typ Max Unit 1 P Resolution 12-Bit LSB — 0.80 — mV 2 P Differential Nonlinearity 12-Bit DNL -6 ±3 6 counts 3 P Integral Nonlinearity 12-Bit INL -7 ±3 7 counts 3 4 P Absolute Error 12-Bit AE -8 ±4 8 counts 5 C Resolution 10-Bit LSB — 3.22 — mV 6 C Differential Nonlinearity 10-Bit DNL -1.5 ±1 1.5 counts 7 C Integral Nonlinearity 10-Bit INL -2 ±1 2 counts 3 8 C Absolute Error 10-Bit AE -3 ±2 3 counts 9 C Resolution 8-Bit LSB — 12.89 — mV 10 C Differential Nonlinearity 8-Bit DNL -0.5 ±0.3 0.5 counts 11 C Integral Nonlinearity 8-Bit INL -1 ±0.5 1 counts 3 8-Bit AE -1.5 ±1 1.5 counts 12 C Absolute Error The 8-bit and 10-bit mode operation is structurally tested in production test. Absolute values are tested in 12-bit mode. 1 2 Better performance is possible using specially designed multi-layer PCBs or averaging techniques. 3 These values include the quantization error which is inherently 1/2 count for any A/D converter. S12XS Family Reference Manual, Rev. 1.13 678 Freescale Semiconductor Electrical Characteristics A.3 NVM, Flash A.3.1 Timing Parameters The time base for all NVM program or erase operations is derived from the oscillator. A minimum oscillator frequency fNVMOSC is required for performing program or erase operations. The NVM modules do not have any means to monitor the frequency and will not prevent program or erase operation at frequencies above or below the specified minimum. When attempting to program or erase the NVM modules at a lower frequency, a full program or erase transition is not assured. The program and erase operations are timed using a clock derived from the oscillator using the FCLKDIV register. The frequency of this clock must be set within the limits specified as fNVMOP. The minimum program and erase times shown in Table A-18 are calculated for maximum fNVMOP and maximum fNVMBUS unless otherwise shown. The maximum times are calculated for minimum fNVMOP A.3.1.1 Erase Verify All Blocks (Blank Check) (FCMD=0x01) The time it takes to perform a blank check is dependant on the location of the first non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. Assuming that no non blank location is found, then the erase verify all blocks is given by. 1 t check = 33500 ⋅ --------------------f NVMBUS A.3.1.2 Erase Verify Block (Blank Check) (FCMD=0x02) The time it takes to perform a blank check is dependant on the location of the first non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. Assuming that no non blank location is found, then the erase verify time for a single 256K NVM array is given by 1 t check = 33500 ⋅ --------------------f NVMBUS For a 128K NVM or D-Flash array the erase verify time is given by 1 t check = 17200 ⋅ --------------------f NVMBUS A.3.1.3 Erase Verify P-Flash Section (FCMD=0x03) The maximum time depends on the number of phrases being verified (NVP) 1 t check = ( 752 + N VP ) ⋅ --------------------f NVMBUS S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 679 Electrical Characteristics A.3.1.4 Read Once (FCMD=0x04) The maximum read once time is given by 1 t = ( 400 ) ⋅ --------------------f NVMBUS A.3.1.5 Program P-Flash (FCMD=0x06) The programming time for a single phrase of four P-Flash words + associated eight ECC bits is dependant on the bus frequency as a well as on the frequency fNVMOP and can be calculated according to the following formulas. The typical phrase programming time can be calculated using the following equation 1 1 t bwpgm = 128 ⋅ ------------------------- + 1725 ⋅ ----------------------------f f NVMOP NVMBUS The maximum phrase programming time can be calculated using the following equation 1 1 t bwpgm = 130 ⋅ ------------------------- + 2125 ⋅ ----------------------------f NVMBUS f NVMOP A.3.1.6 P-Flash Program Once (FCMD=0x07) The maximum P-Flash Program Once time is given by 1 1 t bwpgm ≈ 162 ⋅ ------------------------- + 2400 ⋅ ---------------------------f NVMBUS f NVMOP A.3.1.7 Erase All Blocks (FCMD=0x08) Erasing all blocks takes: 1 1 t mass ≈ 100100 ⋅ ------------------------- + 35000 ⋅ ---------------------------f NVMBUS f NVMOP S12XS Family Reference Manual, Rev. 1.13 680 Freescale Semiconductor Electrical Characteristics A.3.1.8 Erase P-Flash Block (FCMD=0x09) Erasing a 256K NVM block takes 1 1 t mass ≈ 100100 ⋅ ------------------------- + 70000 ⋅ ---------------------------f NVMBUS f NVMOP Erasing a 128K NVM block takes 1 1 t mass ≈ 100100 ⋅ ------------------------- + 35000 ⋅ ---------------------------f NVMBUS f NVMOP A.3.1.9 Erase P-Flash Sector (FCMD=0x0A) The typical time to erase a1024-byte P-Flash sector can be calculated using 1 1 t era = ⎛ 20020 ⋅ -------------------⎞ + ⎛ 700 ⋅ ---------------------⎞ ⎝ f NVMBUS⎠ f NVMOP⎠ ⎝ The maximum time to erase a1024-byte P-Flash sector can be calculated using 1 1 t era = ⎛ 20020 ⋅ -------------------⎞ + ⎛ 1100 ⋅ ---------------------⎞ ⎝ f NVMOP⎠ ⎝ f NVMBUS⎠ A.3.1.10 Unsecure Flash (FCMD=0x0B) The maximum time for unsecuring the flash is given by 1 1 t uns = ⎛ 100100 ⋅ ------------------------- + 70000 ⋅ ----------------------------⎞ ⎝ f NVMBUS⎠ f NVMOP A.3.1.11 Verify Backdoor Access Key (FCMD=0x0C) The maximum verify backdoor access key time is given by 1 t = 400 ⋅ ---------------------------f NVMBUS A.3.1.12 Set User Margin Level (FCMD=0x0D) The maximum set user margin level time is given by 1 t = 350 ⋅ ---------------------------f NVMBUS A.3.1.13 Set Field Margin Level (FCMD=0x0E) The maximum set field margin level time is given by S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 681 Electrical Characteristics 1 t = 350 ⋅ ---------------------------f NVMBUS A.3.1.14 Erase Verify D-Flash Section (FCMD=0x10) Erase Verify D-Flash for a given number of words NW is given by . 1 t check ≈ ( 840 + N W ) ⋅ ---------------------------f NVMBUS A.3.1.15 D-Flash Programming (FCMD=0x11) D-Flash programming time is dependent on the number of words being programmed and their location with respect to a row boundary, because programming across a row boundary requires extra steps. The DFlash programming time is specified for different cases (1,2,3,4 words and 4 words across a row boundary) at a 40MHz bus frequency. The typical programming time can be calculated using the following equation, whereby Nw denotes the number of words; BC=0 if no boundary is crossed and BC=1 if a boundary is crossed. 1 1 t dpgm = ⎛ ( 15 + ( 54 ⋅ N w ) + ( 16 ⋅ BC ) ) ⋅ -------------------⎞ + ⎛ ( 460 + ( 640 ⋅ N W ) + ( 500 ⋅ BC ) ) ⋅ ---------------------⎞ ⎝ f NVMOP⎠ ⎝ f NVMBUS⎠ The maximum programming time can be calculated using the following equation 1 1 t dpgm = ⎛ ( 15 + ( 56 ⋅ N w ) + ( 16 ⋅ BC ) ) ⋅ -------------------⎞ + ⎛ ( 460 + ( 840 ⋅ N W ) + ( 500 ⋅ BC ) ) ⋅ ---------------------⎞ ⎝ f NVMOP⎠ ⎝ f NVMBUS⎠ A.3.1.16 Erase D-Flash Sector (FCMD=0x12) Typical D-Flash sector erase times are those expected on a new device, where no margin verify fails occur. They can be calculated using the following equation. 1 1 t eradf ≈ 5025 ⋅ ------------------------- + 700 ⋅ ---------------------------f NVMBUS f NVMOP Maximum D-Fash sector erase times can be calculated using the following equation. 1 1 t eradf ≈ 20100 ⋅ ------------------------- + 3300 ⋅ ---------------------------f NVMBUS f NVMOP The D-Flash sector erase time on a new device is ~5ms and can extend to 20ms as the flash is cycled. S12XS Family Reference Manual, Rev. 1.13 682 Freescale Semiconductor Electrical Characteristics Table A-18. NVM Timing Characteristics Conditions are as shown in Table A-4, with 40MHz bus and fNVMOP= 1MHz unless otherwise noted. Num C Rating Symbol Min Typ Max Unit 1 D External oscillator clock fNVMOSC 2 — 401 MHz 2 D Bus frequency for programming or erase operations fNVMBUS 1 — 40 MHz 3 D Operating frequency fNVMOP 800 — 1050 kHz 4 D P-Flash phrase programming tbwpgm — 171 183 µs 6 P P-Flash sector erase time tera — 20 21 ms 7 P Erase All Blocks (Mass erase) time tmass — 101 102 ms 7a D Unsecure Flash tuns — 101 102 ms 8 D P-Flash erase verify (blank check) time2 tcheck — — 335002 tcyc 9a D D-Flash word programming 1 word tdpgm — 97 104 µs 9b D D-Flash word programming 2 words tdpgm — 167 181 µs 9c D D-Flash word programming 3 words tdpgm — 237 258 µs 9d D D-Flash word programming 4 words tdpgm — 307 335 µs 9e D D-Flash word programming 4 words crossing row boundary tdpgm — 335 363 µs 10 D D-Flash sector erase time teradf — 5.23 21 ms — 17500 tcyc — 11 D D-Flash erase verify (blank check) time tcheck Restrictions for oscillator in crystal mode apply. 1 2 Valid for both “Erase verify all” or “Erase verify block” on 256K block without failing locations 3 This is a typical value for a new device A.3.2 NVM Reliability Parameters The reliability of the NVM blocks is guaranteed by stress test during qualification, constant process monitors and burn-in to screen early life failures. The data retention and program/erase cycling failure rates are specified at the operating conditions noted. The program/erase cycle count on the sector is incremented every time a sector or mass erase event is executed. The standard shipping condition for both the D-Flash and P-Flash memory is erased with security disabled. However it is recommended that each block or sector is erased before factory programming to ensure that the full data retention capability is achieved. Data retention time is measured from the last erase operation. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 683 Electrical Characteristics Table A-19. NVM Reliability Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit P-Flash Array 1 C Data retention at an average junction temperature of TJavg = 85°C1 after up to 10,000 program/erase cycles tPNVMRET 15 1002 — Years 2 C Data retention at an average junction temperature of TJavg = 85°C3 after less than 100 program/erase cycles tPNVMRET 20 1002 — Years 3 C P-Flash number of program/erase cycles (-40°C ≤ tj ≤ 150°C) nPFLPE 10K 100K3 — Cycles D-Flash Array 4 C Data retention at an average junction temperature of TJavg = 85°C3 after up to 50,000 program/erase cycles tDNVMRET 5 1002 — Years 5 C Data retention at an average junction temperature of TJavg = 85°C3 after less than 10,000 program/erase cycles tDNVMRET 10 1002 — Years 6 C Data retention at an average junction temperature of TJavg = 85°C3 after less than 100 program/erase cycles tDNVMRET 20 1002 — Years 7 C D-Flash number of program/erase cycles (-40°C ≤ tj ≤ 150°C) nDFLPE 50K 500K3 — Cycles 1 TJavg does not exceed 85°C in a typical temperature profile over the lifetime of a consumer, industrial or automotive application. 2 Typical data retention values are based on intrinsic capability of the technology measured at high temperature and de-rated to 25°C using the Arrhenius equation. For additional information on how Freescale defines Typical Data Retention, please refer to Engineering Bulletin EB618 3 TJavg does not exceed 85°C in a typical temperature profile over the lifetime of a consumer, industrial or automotive application. S12XS Family Reference Manual, Rev. 1.13 684 Freescale Semiconductor Electrical Characteristics A.4 Voltage Regulator Table A-20. Voltage Regulator Electrical Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C 1 P Input Voltages 2 P 3 4 1 2 3 4 5 Characteristic Symbol Min Typical Max Unit VVDDR,A 3.13 — 5.50 V Output Voltage Core Full Performance Mode Reduced Power Mode (MCU STOP mode) VDD 1.72 — 1.84 1.60 1.98 — V V P Output Voltage Flash Full Performance Mode Reduced Power Mode (MCU STOP mode) VDDF 2.60 — 2.82 2.20 2.98 — V V P Output Voltage PLL Full Performance Mode Reduced Power Mode (MCU STOP mode) VDDPLL 1.72 — 1.84 1.60 1.98 — V V 5 P Low Voltage Interrupt1 Assert Level Deassert Level VLVIA VLVID 4.04 4.19 4.23 4.38 4.40 4.49 V V 6 P VDDX Low Voltage Reset 2 3 Assert Level Deassert Level VLVRXA VLVRXD — — 3.02 — — 3.13 V V 7 C Trimmed API internal clock4 ∆f / fnominal dfAPI -5 — +5 % 8 D The first period after enabling the counter by APIFE might be reduced by API start up delay tsdel — — 100 µs 9 T Temperature Sensor Slope dVTS 5.05 5.25 5.45 mV/oC 10 T High Temperature Interrupt Assert5 Assert (VREGHTTR=$88) Deassert (VREGHTTR=$88) THTIA THTID 120 110 132 122 144 134 oC oC VBG 1.13 1.21 1.32 V 11 P Bandgap Reference Voltage Monitors VDDA, active only in Full Performance Mode. Indicates I/O & ADC performance degradation due to low supply voltage. Device functionality is guaranteed on power down to the LVR assert level Monitors VDDX, active only in Full Performance Mode. MCU is monitored by the POR in RPM (see Figure A-2) The API Trimming bits must be set that the minimum period equals to 0.2 ms. A hysteresis is guaranteed by design S12XS Family Reference Manual, Rev. 1.13 685 Freescale Semiconductor Electrical Characteristics A.5 Output Loads A.5.1 Resistive Loads The voltage regulator is intended to supply the internal logic and oscillator. It allows no external DC loads. A.5.2 Capacitive Loads The capacitive loads are specified in Table A-21. Ceramic capacitors with X7R dielectricum are required. Table A-21. S12XS family - Capacitive Loads Num Characteristic Symbol Min Recommended Max Unit 1 VDD/VDDF external capacitive load CDDext 176 220 264 nF 3 VDDPLL external capacitive load CDDPLLext 80 220 264 nF A.5.3 Chip Power-up and Voltage Drops LVI (low voltage interrupt), POR (power-on reset) and LVRs (low voltage reset) handle chip power-up or drops of the supply voltage. Their function is shown in Figure A-2 . V VDDX VLVID VLVIA VLVRXD VLVRXA VDD VPORD t LVI LVI enabled LVI disabled due to LVR POR LVRX Figure A-2. S12XS family - Chip Power-up and Voltage Drops (not scaled) S12XS Family Reference Manual, Rev. 1.13 686 Freescale Semiconductor Electrical Characteristics V VDDR, VDDX VDDA >= 0 t Figure A-3. S12XS family Power Sequencing During power sequencing VDDA can be powered up before VDDR, VDDX. VDDR and VDDX must be powered up together adhering to the operating conditions differential. VRH power up must follow VDDA to avoid current injection. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 687 Electrical Characteristics A.6 Reset, Oscillator and PLL This section summarizes the electrical characteristics of the various startup scenarios for oscillator and phase-locked loop (PLL). A.6.1 Startup Table A-22 summarizes several startup characteristics explained in this section. Detailed description of the startup behavior can be found in the Clock and Reset Generator (CRG) block description Table A-22. Startup Characteristics Conditions are shown in Table A-4unless otherwise noted Num C Rating Symbol Min Typ Max Unit PWRSTL 2 — — tosc 1 D Reset input pulse width, minimum input time 2 D Startup from reset nRST 192 — 196 nosc 3 D Wait recovery startup time tWRS — — 14 tcyc 50 100 µs 4 D Fast wakeup from STOP1 — tfws Including voltage regulator startup; V /V filter capacitors 220 nF, V = 5 V, T= 25°C DD DDF DD35 1 A.6.1.1 POR The release level VPORR and the assert level VPORA are derived from the VDD supply. They are also valid if the device is powered externally. After releasing the POR reset the oscillator and the clock quality check are started. If after a time tCQOUT no valid oscillation is detected, the MCU will start using the internal self clock. The fastest startup time possible is given by nuposc. A.6.1.2 SRAM Data Retention Provided an appropriate external reset signal is applied to the MCU, preventing the CPU from executing code when VDD35 is out of specification limits, the SRAM contents integrity is guaranteed if after the reset the PORF bit in the CRG flags register has not been set. A.6.1.3 External Reset When external reset is asserted for a time greater than PWRSTL the CRG module generates an internal reset, and the CPU starts fetching the reset vector without doing a clock quality check, if there was an oscillation before reset. A.6.1.4 Stop Recovery Out of stop the controller can be woken up by an external interrupt. A clock quality check as after POR is performed before releasing the clocks to the system. If the MCU is woken-up by an interrupt and the fast wake-up feature is enabled (FSTWKP = 1 and SCME = 1), the system will resume operation in self-clock mode after tfws. S12XS Family Reference Manual, Rev. 1.13 688 Freescale Semiconductor Electrical Characteristics A.6.1.5 Pseudo Stop and Wait Recovery The recovery from pseudo stop and wait is essentially the same since the oscillator is not stopped in both modes. The controller can be woken up by internal or external interrupts. After twrs the CPU starts fetching the interrupt vector. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 689 Electrical Characteristics A.6.2 Oscillator Table A-23. Oscillator Characteristics Conditions are shown in Table A-4. unless otherwise noted Num C Symbol Min Typ Max Unit 1a C Crystal oscillator range (loop controlled Pierce) fOSC 4.0 — 16 MHz 1b C Crystal oscillator range (full swing Pierce) 1,2 fOSC 2.0 — 40 MHz 2 P Startup Current iOSC 100 — — µA 3a C Oscillator start-up time (LCP, 4MHz)3 tUPOSC — 2.2 10 ms 3b C Oscillator start-up time (LCP, 8MHz)3 tUPOSC — 1.1 8 ms 3c C Oscillator start-up time (LCP, 16MHz)3 tUPOSC — 0.75 5 ms 4a C Oscillator start-up time (full swing Pierce, 2MHz)3 tUPOSC — 5.2 40 ms 4b C Oscillator start-up time (full swing Pierce, 4MHz)3 tUPOSC — 3 20 ms 4c C Oscillator start-up time (full swing Pierce, 8MHz)3 tUPOSC — 1.8 10 ms 4d C Oscillator start-up time (full swing Pierce, 16MHz)3 tUPOSC — 1.2 5 ms 4e C Oscillator start-up time (full swing Pierce, 40MHz)3 tUPOSC — 1 4 ms 5 D Clock Quality check time-out tCQOUT 0.45 — 2.5 s 6 P Clock Monitor Failure Assert Frequency fCMFA 200 400 800 KHz 7 P External square wave input frequency fEXT 2.0 — 50 MHz 8 D External square wave pulse width low tEXTL 9.5 — — ns 9 D External square wave pulse width high tEXTH 9.5 — — ns 10 D External square wave rise time tEXTR — — 1 ns 11 D External square wave fall time tEXTF — — 1 ns 12 D Input Capacitance (EXTAL, XTAL pins) CIN — 7 — pF 13 P EXTAL Pin Input High Voltage VIH,EXTAL 0.75*VDDPLL — — V T EXTAL Pin Input High Voltage,4 VIH,EXTAL — — VDDPLL + 0.3 V P EXTAL Pin Input Low Voltage VIL,EXTAL — — 0.25*VDDPLL V ,4 T EXTAL Pin Input Low Voltage VIL,EXTAL VSSPLL - 0.3 — — V VHYS,EXTAL — 180 — mV 14 15 C EXTAL Pin Input Hysteresis EXTAL Pin oscillation amplitude (loop controlled VPP,EXTAL — 0.9 — Pierce) Depending on the crystal a damping series resistor might be necessary Only valid if full swing Pierce oscillator/external clock mode is selected These values apply for carefully designed PCB layouts with capacitors that match the crystal/resonator requirements.. Only applies if EXTAL is externally driven 16 1 2 3 4 Rating C V S12XS Family Reference Manual, Rev. 1.13 690 Freescale Semiconductor Electrical Characteristics A.6.3 Phase Locked Loop A.6.3.1 Jitter Information With each transition of the clock fcmp, the deviation from the reference clock fref is measured and input voltage to the VCO is adjusted accordingly.The adjustment is done continuously with no abrupt changes in the clock output frequency. Noise, voltage, temperature and other factors cause slight variations in the control loop resulting in a clock jitter. This jitter affects the real minimum and maximum clock periods as illustrated in Figure A-4. 1 0 2 3 N-1 N tmin1 tnom tmax1 tminN tmaxN Figure A-4. Jitter Definitions The relative deviation of tnom is at its maximum for one clock period, and decreases towards zero for larger number of clock periods (N). Defining the jitter as: t (N) t (N) ⎞ ⎛ max min J ( N ) = max ⎜ 1 – ----------------------- , 1 – ----------------------- ⎟ N⋅t N⋅t ⎝ nom nom ⎠ S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 691 Electrical Characteristics For N < 1000, the following equation is a good fit for the maximum jitter: j1 J ( N ) = -------- + j 2 N J(N) 1 5 10 20 N Figure A-5. Maximum bus clock jitter approximation NOTE On timers and serial modules a prescaler will eliminate the effect of the jitter to a large extent. Table A-24. IPLL Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 P Self Clock Mode frequency1 fSCM 1 — 4 MHz 2 T VCO locking range fVCO 32 — 120 MHz 3 T Reference Clock fREF 1 — 40 MHz 4 D Lock Detection |∆Lock| 0 — 1.5 %2 5 D Un-Lock Detection |∆unl| 0.5 — 2.5 %2 7 C Time to lock tlock — 214 150 + 256/fREF µs 8 C Jitter fit parameter 13 j1 — — 1.2 % 9 C Jitter fit parameter 23 j2 — — 0 % 10 C Bus Frequency for FM1=1, FM0=1 (frequency modulation in PLLCTL register of s12xe_crg) fbus — — 38 MHz 11 C Bus Frequency for FM1=1, FM0=0 (frequency modulation in PLLCTL register of s12xe_crg) fbus — — 39 MHz 12 C Bus Frequency for FM1=0, FM0=1 (frequency fbus — — 39 MHz modulation in PLLCTL register of s12xe_crg) 1 Bus frequency is equivalent to fSCM/2 2 % deviation from target frequency 3 fOSC=4MHz, fBUS=40MHz equivalent fPLL=80MHz: REFDIV=$00, REFRQ=01, SYNDIV=$09, VCOFRQ=01, POSTDIV=$00 S12XS Family Reference Manual, Rev. 1.13 692 Freescale Semiconductor Electrical Characteristics A.7 MSCAN Table A-25. MSCAN Wake-up Pulse Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 P MSCAN wakeup dominant pulse filtered tWUP — — 1.5 µs 2 P MSCAN wakeup dominant pulse pass tWUP 5 — — µs S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 693 Electrical Characteristics A.8 SPI Timing This section provides electrical parametrics and ratings for the SPI. In Table A-26 the measurement conditions are listed. Table A-26. Measurement Conditions Description Drive mode Load capacitance CLOAD1, on all outputs Thresholds for delay measurement points 1 Timing specified for equal load on all SPI output pins. Avoid asymmetric load. A.8.1 Value Unit Full drive mode — 50 pF (20% / 80%) VDDX V Master Mode In Figure A-6 the timing diagram for master mode with transmission format CPHA = 0 is depicted. SS (Output) 2 1 SCK (CPOL = 0) (Output) 5 12 13 3 6 Bit MSB-1. . . 1 MSB IN2 10 MOSI (Output) 13 4 SCK (CPOL = 1) (Output) MISO (Input) 12 4 LSB IN 9 MSB OUT2 Bit MSB-1. . . 1 11 LSB OUT 1. If configured as an output. 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1, bit 2... MSB. Figure A-6. SPI Master Timing (CPHA = 0) S12XS Family Reference Manual, Rev. 1.13 694 Freescale Semiconductor Electrical Characteristics In Figure A-7 the timing diagram for master mode with transmission format CPHA=1 is depicted. SS (Output) 1 2 12 13 3 12 13 SCK (CPOL = 0) (Output) 4 4 SCK (CPOL = 1) (Output) 5 MISO (Input) 6 MSB IN2 Port Data LSB IN 11 9 MOSI (Output) Bit MSB-1. . . 1 Master MSB OUT2 Bit MSB-1. . . 1 Master LSB OUT Port Data 1.If configured as output 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1,bit 2... MSB. Figure A-7. SPI Master Timing (CPHA = 1) In Table A-27 the timing characteristics for master mode are listed. Table A-27. SPI Master Mode Timing Characteristics Num C Characteristic Symbol fsck Min 1/2048 Typ Max Unit — 1/21 fbus 1 D SCK frequency 1 D SCK period tsck 2 — 2048 tbus 2 D Enable lead time tlead — 1/2 — tsck 3 D Enable lag time 4 D Clock (SCK) high or low time tlag — 1/2 — tsck twsck — 1/2 — tsck 5 D Data setup time (inputs) tsu 8 — — ns 6 D Data hold time (inputs) thi 8 — — ns 9 D Data valid after SCK edge tvsck — — 29 ns 10 D Data valid after SS fall (CPHA = 0) tvss — — 15 ns 11 D Data hold time (outputs) tho 20 — — ns 12 D Rise and fall time inputs trfi — — 8 ns trfo — — 8 ns 13 1See D Rise and fall time outputs Figure A-8. S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 695 Electrical Characteristics fSCK/fbus 1/2 1/4 5 15 10 25 20 35 30 fbus [MHz] 40 Figure A-8. Derating of maximum fSCK to fbus ratio in Master Mode A.8.2 Slave Mode In Figure A-9 the timing diagram for slave mode with transmission format CPHA = 0 is depicted. SS (Input) 1 12 13 3 12 13 SCK (CPOL = 0) (Input) 4 2 4 SCK (CPOL = 1) (Input) 10 8 7 MISO (Output) 9 See Note Slave MSB 5 MOSI (Input) Bit MSB-1 . . . 1 11 11 Slave LSB OUT See Note 6 MSB IN Bit MSB-1. . . 1 LSB IN NOTE: Not defined Figure A-9. SPI Slave Timing (CPHA = 0) S12XS Family Reference Manual, Rev. 1.13 696 Freescale Semiconductor Electrical Characteristics In Figure A-10 the timing diagram for slave mode with transmission format CPHA = 1 is depicted. SS (Input) 3 1 2 12 13 12 13 SCK (CPOL = 0) (Input) 4 4 SCK (CPOL = 1) (Input) See Note 7 Slave MSB OUT 5 MOSI (Input) 8 11 9 MISO (Output) Bit MSB-1 . . . 1 Slave LSB OUT 6 MSB IN Bit MSB-1 . . . 1 LSB IN NOTE: Not defined Figure A-10. SPI Slave Timing (CPHA = 1) In Table A-28 the timing characteristics for slave mode are listed. Table A-28. SPI Slave Mode Timing Characteristics 1 Num C 1 D 1 Characteristic Symbol Min Typ Max Unit SCK frequency fsck DC — 1/4 fbus D SCK period tsck 4 — ∞ tbus 2 D Enable lead time tlead 4 — — tbus 3 D Enable lag time tlag 4 — — tbus 4 D Clock (SCK) high or low time twsck 4 — — tbus 5 D Data setup time (inputs) tsu 8 — — ns 6 D Data hold time (inputs) thi 8 — — ns 7 D Slave access time (time to data active) ta — — 20 ns 8 D Slave MISO disable time tdis — — 22 ns 9 D Data valid after SCK edge tvsck — — 29 + 0.5 ⋅ tbus1 ns 1 ns 10 D Data valid after SS fall tvss — — 29 + 0.5 ⋅ tbus 11 D Data hold time (outputs) tho 20 — — ns 12 D Rise and fall time inputs trfi — — 8 ns trfo — — 8 ns 13 D Rise and fall time outputs 0.5 tbus added due to internal synchronization delay S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 697 Package Information Appendix B Package Information This section provides the physical dimensions of the S12XS family packages. S12XS Family Reference Manual, Rev. 1.13 698 Freescale Semiconductor Package Information B.1 112-pin LQFP Mechanical Dimensions Figure B-1. 112-pin LQFP (case no. 987) - page 1 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 699 Package Information Figure B-2. 112-pin LQFP (case no. 987) - page 2 S12XS Family Reference Manual, Rev. 1.13 700 Freescale Semiconductor Package Information Figure B-3. 112-pin LQFP (case no. 987) - page 3 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 701 Package Information B.2 80-Pin QFP Mechanical Dimensions Figure B-4. 80-pin QFP (case no. 841B) - page 1 S12XS Family Reference Manual, Rev. 1.13 702 Freescale Semiconductor Package Information Figure B-5. 80-pin QFP (case no. 841B) - page 2 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 703 Package Information Figure B-6. 80-pin QFP (case no. 841B) - page 3 S12XS Family Reference Manual, Rev. 1.13 704 Freescale Semiconductor Package Information B.3 64-Pin LQFP Mechanical Dimensions S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 705 Package Information Figure B-7. 64-pin LQFP (case no. 840F) - page 2 S12XS Family Reference Manual, Rev. 1.13 706 Freescale Semiconductor Package Information Figure B-8. 64-pin LQFP (case no. 840F) - page 3 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 707 PCB Layout Guidelines Appendix C PCB Layout Guidelines C.1 General The PCB must be carefully laid out to ensure proper operation of the voltage regulator as well as of the MCU itself. The following rules must be observed: • Every supply pair must be decoupled by a ceramic capacitor connected as near as possible to the corresponding pins . • Central point of the ground star should be the VSS3 pin. • Use low ohmic low inductance connections between VSS1, VSS2 and VSS3. • VSSPLL must be directly connected to VSS3. • Keep traces of VSSPLL, EXTAL, and XTAL as short as possible and occupied board area for C7, C8, and Q1 as small as possible. • Do not place other signals or supplies underneath area occupied by C7, C8, and Q1 and the connection area to the MCU. • Central power input should be fed in at the VDDA/VSSA pins. Example layouts are illustrated on the following pages. Table C-1. Recommended Decoupling Capacitor Choice Component Purpose Type Value C1 VDDF filter capacitor Ceramic X7R 220 nF C2 N/A — — C3 VDDX2 filter capacitor X7R/tantalum >=100 nF C4 VDDPLL filter capacitor Ceramic X7R 220 nF C5 OSC load capacitor C6 OSC load capacitor C7 VDDR filter capacitor X7R/tantalum >=100 nF C8 N/A — — From crystal manufacturer C9 VDD filter capacitor Ceramic X7R 220 nF C10 VDDA1 filter capacitor Ceramic X7R >=100 nF C11 VDDX1 filter capacitor X7R/tantalum >=100 nF Q1 Quartz — — S12XS Family Reference Manual, Rev. 1.13 708 Freescale Semiconductor PCB Layout Guidelines C.1.1 112-Pin LQFP Recommended PCB Layout Figure C-1. 112-Pin LQFP Recommended PCB Layout (Loop Controlled Pierce Oscillator) S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 709 PCB Layout Guidelines C.1.2 80-Pin QFP Recommended PCB Layout Figure C-2. 80-Pin QFP Recommended PCB Layout (Loop Controlled Pierce Oscillator) S12XS Family Reference Manual, Rev. 1.13 710 Freescale Semiconductor PCB Layout Guidelines C.1.3 64-Pin LQFP Recommended PCB Layout TBD Figure C-3. 64-Pin LQFP Recommended PCB Layout (Loop Controlled Pierce Oscillator) S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 711 Derivative Differences Appendix D Derivative Differences D.1 Memory Sizes and Package Options S12XS family Table D-1. Package and Memory Options of S12XS family Device Package Flash RAM Data Flash 9S12XS256 112 LQFP 256K 12K 8K 128K 8K 8K 64K 4K 4K 80 QFP 64 LQFP 9S12XS128 112 LQFP 80 QFP 64 LQFP 9S12XS64 112 LQFP 80 QFP 64 LQFP Table D-2. Peripheral Options of S12XS family Members Device Package 9S12XS256 112 LQFP 1 2 1 80 QFP 1 2 1 64 LQFP 1 2 1 8ch 112 LQFP 1 2 1 8ch 9S12XS128 9S12XS64 CAN SCI SPI TIM PIT A/D PWM 8ch 4ch 16ch 8ch 8ch 4ch 8ch 8ch 4ch 8ch 8ch 4ch 16ch 8ch 80 QFP 1 2 1 8ch 4ch 8ch 8ch 64 LQFP 1 2 1 8ch 4ch 8ch 8ch 112 LQFP 1 2 1 8ch 4ch 16ch 8ch 80 QFP 1 2 1 8ch 4ch 8ch 8ch 64 LQFP 1 2 1 8ch 4ch 8ch 8ch NOTE For the 80QFP and 64LQFP package options, several peripheral functions can be routed under software control to different pins. Not all functions are available simultaneously. For details see Table 1-5. S12XS Family Reference Manual, Rev. 1.13 712 Freescale Semiconductor Detailed Register Address Map Appendix E Detailed Register Address Map E.1 Detailed Register Map The following tables show the detailed register map of the S12XS family. 0x0000–0x0009 Port Integration Module (PIM) Map 1 of 5 Address Name 0x0000 PORTA 0x0001 PORTB 0x0002 DDRA 0x0003 DDRB 0x0004 Reserved 0x0005 Reserved 0x0006 Reserved 0x0007 Reserved 0x0008 PORTE 0x0009 DDRE R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PA7 PA6 PA5 PA4 PA3 PA2 PA1 PA 0 PB7 PB6 PB5 PB4 PB3 PB2 PB1 PB0 DDRA7 DDRA6 DDRA5 DDRA4 DDRA3 DDRA2 DDRA1 DDRA0 DDRB7 DDRB6 DDRB5 DDRB4 DDRB3 DDRB2 DDRB1 DDRB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PE7 PE6 PE5 PE4 PE3 PE2 PE1 PE0 DDRE7 DDRE6 DDRE5 DDRE4 DDRE3 DDRE2 0 0 0x000A–0x000B Module Mapping Control (S12XMMC) Map 1 of 2 Address Name 0x000A Reserved 0x000B MODE R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bit 3 Bit 2 Bit 1 Bit 0 0 0 PUPBE PUPAE 0 0 RDPB RDPA MODC 0x000C–0x000D Port Integration Module (PIM) Map 2 of 5 Address Name 0x000C PUCR 0x000D RDRIV R W R W Bit 7 Bit 6 PUPKE BKPUE RDPK 0 Bit 5 0 0 Bit 4 PUPEE RDPE S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 713 Detailed Register Address Map 0x000E–0x000F Reserved Register Space Address Name 0x000E Reserved 0x000F Reserved R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0010–0x0017 Module Mapping Control (S12XMMC) Map 2 of 2 Address Name 0x0010 GPAGE 0x0011 DIRECT 0x0012 Reserved 0x0013 MMCCTL1 0x0014 Reserved 0x0015 PPAGE 0x0016 RPAGE 0x0017 EPAGE Bit 7 R 0 W R DP15 W R 0 W R MGRAMO N W R 0 W R PIX7 W R RP7 W R EP7 W Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 GP6 GP5 GP4 GP3 GP2 GP1 GP0 DP14 DP13 DP12 DP11 DP10 DP9 DP8 0 0 0 0 0 0 0 DFIFRON PGMIFRO N 0 0 0 0 0 0 0 0 0 0 0 PIX6 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 RP6 RP5 RP4 RP3 RP2 RP1 RP0 EP6 EP5 EP4 EP3 EP2 EP1 EP0 0 0x0018–0x001B Miscellaneous Peripheral Address Name 0x0018 Reserved 0x0019 Reserved 0x001A PARTIDH 0x001B PARTIDL R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PARTIDH PARTIDL 0x001C–0x001D Port Integration Module (PIM) Map 3 of 5 Address Name 0x001C ECLKCTL 0x001D Reserved R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 NECLK NCLKX2 DIV16 EDIV4 EDIV3 EDIV2 EDIV1 EDIV0 0 0 0 0 0 0 0 0 S12XS Family Reference Manual, Rev. 1.13 714 Freescale Semiconductor Detailed Register Address Map 0x001E–0x001F Port Integration Module (PIM) Map 3 of 5 Address Name 0x001E IRQCR 0x001F Reserved R W R W Bit 7 Bit 6 IRQE IRQEN 0 0 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0020–0x002F Debug Module (S12XDBG) Map Address Name Bit 7 Bit 6 Bit 5 R 0 0x0020 DBGC1 ARM reserved BDM DBGBRK reserved W TRIG R TBF 0 0 0 0 SSF2 0x0021 DBGSR W R 0x0022 DBGTCR reserved TSOURCE TRANGE TRCMOD W R 0 0 0 0 0x0023 DBGC2 CDCM W R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 0x0024 DBGTBH W R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 0x0025 DBGTBL W R 0 CNT 0x0026 DBGCNT W R 0 0 0 0 0x0027 DBGSCRX SC3 SC2 W R 0 0 0 0 MC3 MC2 0x0027 DBGMFR W R 0 DBGXCTL NDB TAG BRK RW RWE 0x00281 (COMPA/C) W R DBGXCTL SZE SZ TAG BRK RW RWE 0x00282 (COMPB/D) W R 0 0x0029 DBGXAH Bit 22 21 20 19 18 W R 0x002A DBGXAM Bit 15 14 13 12 11 10 W R 0x002B DBGXAL Bit 7 6 5 4 3 2 W R 0x002C DBGXDH Bit 15 14 13 12 11 10 W R 0x002D DBGXDL Bit 7 6 5 4 3 2 W R 0x002E DBGXDHM Bit 15 14 13 12 11 10 W R 0x002F DBGXDLM Bit 7 6 5 4 3 2 W 1 This represents the contents if the Comparator A or C control register is blended into this address 2 This represents the contents if the Comparator B or D control register is blended into this address COMRV SSF1 SSF0 TALIGN ABCM Bit 9 Bit 8 Bit 1 Bit 0 SC1 SC0 MC1 MC0 reserved COMPE reserved COMPE 17 Bit 16 9 Bit 8 1 Bit 0 9 Bit 8 1 Bit 0 9 Bit 8 1 Bit 0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 715 Detailed Register Address Map 0x0030–0x0031 Reserved Register Space Address Name 0x0030 Reserved 0x0031 Reserved R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0032–0x0033 Port Integration Module (PIM) Map 4 of 5 Address Name 0x0032 PORTK 0x0033 DDRK Bit 7 R W R W PK7 DDRK7 Bit 6 0 0 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PK5 PK4 PK3 PK2 PK1 PK0 DDRK5 DDRK4 DDRK3 DDRK2 DDRK1 DDRK0 Bit 3 Bit 2 Bit 1 Bit 0 0x0034–0x003F Clock and Reset Generator (CRG) Map Address Name 0x0034 SYNR 0x0035 REFDV 0x0036 POSTDIV 0x0037 CRGFLG 0x0038 CRGINT 0x0039 CLKSEL 0x003A PLLCTL 0x003B RTICTL 0x003C COPCTL 0x003D FORBYP 0x003E CTCTL 0x003F ARMCOP Bit 7 Bit 6 R VCOFRQ[1:0] W R REFFRQ[1:0] W R 0 0 W R RTIF PORF W R 0 RTIE W R PLLSEL PSTP W R CME PLLON W R RTDEC RTR6 W R RSBCK W WCOP R W R W R W Bit 5 Bit 4 SYNDIV[5:0] REFDIV[5:0] 0 LVRF 0 POSTDIV[4:0] LOCKIF LOCKIE LOCK 0 XCLKS 0 FM1 FM0 FSTWKP RTR5 RTR4 RTR3 0 0 0 0 0 WRTMAS K 0 0 0 0 0 Bit 7 0 6 0 5 PLLWAI 0 0 Reserved For Factory Test 0 Reserved For Factory Test 0 0 4 3 ILAF 0 0 SCMIF SCMIE SCM 0 RTIWAI COPWAI PRE PCE SCME RTR2 RTR1 RTR0 CR2 CR1 CR0 0 0 0 0 0 0 0 2 0 1 0 Bit 0 S12XS Family Reference Manual, Rev. 1.13 716 Freescale Semiconductor Detailed Register Address Map 0x0040–0x006F Timer Module (TIM) Map Address Name 0x0040 TIOS 0x0041 CFORC 0x0042 OC7M 0x0043 OC7D 0x0044 TCNTH 0x0045 TCNTL 0x0046 TSCR1 0x0047 TTOV 0x0048 TCTL1 0x0049 TCTL2 0x004A TCTL3 0x004B TCTL4 0x004C TIE 0x004D TSCR2 0x004E TFLG1 0x004F TFLG2 0x0050 TC0H 0x0051 TC0L 0x0052 TC1H 0x0053 TC1L 0x0054 TC2H 0x0055 TC2L 0x0056 TC3H R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 IOS7 IOS6 IOS5 IOS4 IOS3 IOS2 IOS1 IOS0 0 FOC7 0 FOC6 0 FOC5 0 FOC4 0 FOC3 0 FOC2 0 FOC1 0 FOC0 OC7M7 OC7M6 OC7M5 OC7M4 OC7M3 OC7M2 OC7M1 OC7M0 OC7D7 OC7D6 OC7D5 OC7D4 OC7D3 OC7D2 OC7D1 OC7D0 Bit 15 14 13 12 11 10 9 Bit 8 Bit 7 6 5 4 3 2 1 Bit 0 TEN TSWAI TSFRZ TFFCA PRNT 0 0 0 TOV7 TOV6 TOV5 TOV4 TOV3 TOV2 TOV1 TOV0 OM7 OL7 OM6 OL6 OM5 OL5 OM4 OL4 OM3 OL3 OM2 OL2 OM1 OL1 OM0 OL0 EDG7B EDG7A EDG6B EDG6A EDG5B EDG5A EDG4B EDG4A EDG3B EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A C7I C6I C5I C4I C3I C2I C1I C0I 0 0 0 TCRE PR2 PR1 PR0 C6F C5F C4F C3F C2F C1F C0F 0 0 0 0 0 0 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 TOI C7F TOF S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 717 Detailed Register Address Map 0x0040–0x006F Timer Module (TIM) Map Address Name 0x0057 TC3L 0x0058 TC4H 0x0059 TC4L 0x005A TC5H 0x005B TC5L 0x005C TC6H 0x005D TC6L 0x005E TC7H 0x005F TC7L 0x0060 PACTL 0x0061 PAFLG 0x0062 PACNTH 0x0063 PACNTL 0x0064– 0x006B Reserved 0x006C OCPD 0x006D Reserved 0x006E PTPSR 0x006F Reserved Bit 7 R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R 0 W R 0 W R PACNT15 W R PACNT7 W R 0 W R OCPD7 W R W R PTPS7 W R 0 W Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PAEN PAMOD PEDGE CLK1 CLK0 PAOVI PAI 0 0 0 0 0 PAOVF PAIF PACNT14 PACNT13 PACNT12 PACNT11 PACNT10 PACNT9 PACNT8 PACNT6 PACNT5 PACNT4 PACNT3 PACNT2 PACNT1 PACNT0 0 0 0 0 0 0 0 OCPD6 OCPD5 OCPD4 OCPD3 OCPD2 OCPD1 OCPD0 PTPS6 PTPS5 PTPS4 PTPS3 PTPS2 PTPS1 PTPS0 0 0 0 0 0 0 0 0x0070–0x00C7 Reserved Register Space Address 0x00700x00C7 Name Reserved R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 S12XS Family Reference Manual, Rev. 1.13 718 Freescale Semiconductor Detailed Register Address Map 0x00C8–0x00CF Asynchronous Serial Interface (SCI0) Map Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 R IREN TNP1 TNP0 SBR12 SBR11 W R SBR7 SBR6 SBR5 SBR4 SBR3 0x00C9 SCI0BDL1 W R LOOPS SCISWAI RSRC M WAKE 0x00CA SCI0CR11 W R 0 0 0 0 RXEDGIF 0x00C8 SCI0ASR12 W R 0 0 0 0 RXEDGIE 0x00C9 SCI0ACR12 W R 0 0 0 0 0 0x00CA SCI0ACR22 W R 0x00CB SCI0CR2 TIE TCIE RIE ILIE TE W R TDRE TC RDRF IDLE OR 0x00CC SCI0SR1 W R 0 0 0x00CD SCI0SR2 AMAP TXPOL RXPOL W R R8 0 0 0 0x00CE SCI0DRH T8 W R R7 R6 R5 R4 R3 0x00CF SCI0DRL W T7 T6 T5 T4 T3 1 Those registers are accessible if the AMAP bit in the SCI0SR2 register is set to zero 2 Those registers are accessible if the AMAP bit in the SCI0SR2 register is set to one 0x00C8 SCI0BDH1 Bit 2 Bit 1 Bit 0 SBR10 SBR9 SBR8 SBR2 SBR1 SBR0 ILT PE PT BERRV BERRIF BKDIF BERRIE BKDIE BERRM1 BERRM0 BKDFE RE RWU SBK NF FE PF BRK13 TXDIR 0 0 0 R2 T2 R1 T1 R0 T0 0 RAF 0x00D0–0x00D7 Asynchronous Serial Interface (SCI1) Map Address Name 0x00D0 SCI1BDH1 0x00D1 SCI1BDL1 0x00D2 SCI1CR11 0x00D0 SCI1ASR12 0x00D1 SCI1ACR12 0x00D2 SCI1ACR22 0x00D3 SCI1CR2 0x00D4 SCI1SR1 Bit 7 R IREN W R SBR7 W R LOOPS W R RXEDGIF W R RXEDGIE W R 0 W R TIE W R TDRE W Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 TNP1 TNP0 SBR12 SBR11 SBR10 SBR9 SBR8 SBR6 SBR5 SBR4 SBR3 SBR2 SBR1 SBR0 SCISWAI RSRC M WAKE ILT PE PT 0 0 0 0 BERRV BERRIF BKDIF 0 0 0 0 BERRIE BKDIE 0 0 0 0 BERRM1 BERRM0 BKDFE TCIE RIE ILIE TE RE RWU SBK TC RDRF IDLE OR NF FE PF 0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 719 Detailed Register Address Map 0x00D0–0x00D7 Asynchronous Serial Interface (SCI1) Map (continued) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 R 0 0 AMAP TXPOL RXPOL W R R8 0 0 0 0x00D6 SCI1DRH T8 W R R7 R6 R5 R4 R3 0x00D7 SCI1DRL W T7 T6 T5 T4 T3 1 Those registers are accessible if the AMAP bit in the SCI1SR2 register is set to zero 2 Those registers are accessible if the AMAP bit in the SCI1SR2 register is set to one 0x00D5 SCI1SR2 Bit 2 Bit 1 Bit 0 BRK13 TXDIR 0 0 0 R2 T2 R1 T1 R0 T0 RAF 0x00D8–0x00DF Serial Peripheral Interface (SPI0) Map Address Name 0x00D8 SPI0CR1 0x00D9 SPI0CR2 0x00DA SPI0BR 0x00DB SPI0SR 0x00DC SPI0DRH 0x00DD SPI0DRL 0x00DE Reserved 0x00DF Reserved R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 SPIE SPE SPTIE MSTR CPOL CPHA SSOE LSBFE MODFEN BIDIROE SPISWAI SPC0 SPR2 SPR1 SPR0 0 0 XFRW 0 0 0 SPPR2 SPPR1 SPPR0 SPIF 0 SPTEF MODF 0 0 0 0 R15 T15 R7 T7 0 R14 T14 R6 T6 0 R13 T13 R5 T5 0 R12 T12 R4 T4 0 R11 T11 R3 T3 0 R10 T10 R2 T2 0 R9 T9 R1 T1 0 R8 T8 R0 T0 0 0 0 0 0 0 0 0 0 0x00E0–0x00FF Reserved Register Space Address Name 0x00E00x00FF Reserved R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0x0100–0x0113 NVM Control Register (FTMR) Map Address Name 0x0100 FCLKDIV 0x0101 FSEC 0x0102 FCCOBIX 0x0103 FECCRIX Bit 7 R FDIVLD W R KEYEN1 W R 0 W R 0 W Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 S12XS Family Reference Manual, Rev. 1.13 720 Freescale Semiconductor Detailed Register Address Map 0x0100–0x0113 NVM Control Register (FTMR) Map (continued) Address Name 0x0104 FCNFG 0x0105 FERCNFG 0x0106 FSTAT 0x0107 FERSTAT 0x0108 FPROT 0x0109 DFPROT 0x010A FCCOBHI 0x010B FCCOBLO 0x010C Reserved 0x010D Reserved 0x010E FECCRHI 0x010F FECCRLO 0x0110 FOPT 0x0111 Reserved 0x0112 Reserved 0x0113 Reserved Bit 7 R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W CCIE 0 CCIF 0 FPOPEN Bit 6 Bit 5 0 0 0 0 0 ACCERR FPVIOL 0 FPHDIS 0 0 RNV6 Bit 4 Bit 3 Bit 2 0 0 0 0 MGBUSY RSVD 0 0 0 FPHS1 FPHS0 DPS4 IGNSF Bit 1 Bit 0 FDFD FSFD DFDIE SFDIE MGSTAT1 MGSTAT0 DFDIF SFDIF FPLDIS FPLS1 FPLS0 DPS3 DPS2 DPS1 DPS0 0 0 CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 DPOPEN 0x0114–0x011F Reserved Register Space Address 0x01140x011F Name Reserved R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 721 Detailed Register Address Map 0x0120–0x012F Interrupt Module (S12XINT) Map Address Name 0x0120 Reserved 0x0121 IVBR 0x0122 Reserved 0x0123 Reserved 0x0124 Reserved 0x0125 Reserved 0x0126 INT_XGPRIO 0x0127 INT_CFADDR 0x0128 INT_CFDATA0 0x0129 INT_CFDATA1 0x012A INT_CFDATA2 0x012B INT_CFDATA3 0x012C INT_CFDATA4 0x012D INT_CFDATA5 0x012E INT_CFDATA6 0x012F INT_CFDATA7 R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 IVB_ADDR[7:0] 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 INT_CFADDR[7:4] RQST RQST RQST RQST RQST RQST RQST RQST 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 XILVL[2:0] 0 0 0 PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] 0x00130–0x013F Reserved Register Space Address 0x01300x013F Name Reserved R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 TIME WUPE SLPRQ INITRQ BORM WUPM SLPAK INITAK 0x0140–0x017F MSCAN (CAN0) Map Address Name 0x0140 CAN0CTL0 0x0141 CAN0CTL1 Bit 7 R RXFRM W R CANE W Bit 6 RXACT CLKSRC CSWAI LOOPB SYNCH LISTEN S12XS Family Reference Manual, Rev. 1.13 722 Freescale Semiconductor Detailed Register Address Map 0x0140–0x017F MSCAN (CAN0) Map (continued) Address Name 0x0142 CAN0BTR0 0x0143 CAN0BTR1 0x0144 CAN0RFLG 0x0145 CAN0RIER 0x0146 CAN0TFLG 0x0147 CAN0TIER 0x0148 CAN0TARQ 0x0149 CAN0TAAK 0x014A CAN0TBSEL 0x014B CAN0IDAC 0x014C Reserved 0x014D CAN0MISC 0x014E CAN0RXERR 0x014F CAN0TXERR 0x01500x0153 CAN0IDAR0CAN0IDAR3 0x0154- CAN0IDMR00x0157 CAN0IDMR3 0x01580x015B CAN0IDAR4CAN0IDAR7 0x015C- CAN0IDMR40x015F CAN0IDMR7 0x01600x016F CAN0RXFG 0x01700x017F CAN0TXFG Bit 7 R SJW1 W R SAMP W R WUPIF W R WUPIE W R 0 W R 0 W R 0 W R 0 W R 0 W R 0 W R 0 W R 0 W R RXERR7 W R TXERR7 W R AC7 W R AM7 W R AC7 W R AM7 W R W R W Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 SJW0 BRP5 BRP4 BRP3 BRP2 BRP1 BRP0 TSEG22 TSEG21 TSEG20 TSEG13 TSEG12 TSEG11 TSEG10 RSTAT1 RSTAT0 TSTAT1 TSTAT0 OVRIF RXF CSCIE RSTATE1 RSTATE0 TSTATE1 TSTATE0 OVRIE RXFIE 0 0 0 0 TXE2 TXE1 TXE0 0 0 0 0 TXEIE2 TXEIE1 TXEIE0 0 0 0 0 ABTRQ2 ABTRQ1 ABTRQ0 0 0 0 0 ABTAK2 ABTAK1 ABTAK0 0 0 0 0 TX2 TX1 TX0 IDAM1 IDAM0 0 IDHIT2 IDHIT1 IDHIT0 0 0 0 0 0 0 0 0 0 0 0 0 0 RXERR6 RXERR5 RXERR4 RXERR3 RXERR2 RXERR1 RXERR0 TXERR6 TXERR5 TXERR4 TXERR3 TXERR2 TXERR1 TXERR0 AC6 AC5 AC4 AC3 AC2 AC1 AC0 AM6 AM5 AM4 AM3 AM2 AM1 AM0 AC6 AC5 AC4 AC3 AC2 AC1 AC0 AM6 AM5 AM4 AM3 AM2 AM1 AM0 CSCIF 0 BOHOLD FOREGROUND RECEIVE BUFFER (See Detailed MSCAN Foreground Receive and Transmit Buffer Layout) FOREGROUND TRANSMIT BUFFER (See Detailed MSCAN Foreground Receive and Transmit Buffer Layout) S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 723 Detailed Register Address Map Detailed MSCAN Foreground Receive and Transmit Buffer Layout Address 0xXXX0 0xXXX1 0xXXX2 0xXXX3 Name Extended ID Standard ID CANxRIDR0 Extended ID Standard ID CANxRIDR1 Extended ID Standard ID CANxRIDR2 Extended ID Standard ID CANxRIDR3 0xXXX4- CANxRDSR00xXXXB CANxRDSR7 0xXXXC CANRxDLR 0xXXXD Reserved 0xXXXE CANxRTSRH 0xXXXF 0xXX10 0xXX0x XX10 0xXX12 0xXX13 CANxRTSRL Extended ID CANxTIDR0 Standard ID Extended ID CANxTIDR1 Standard ID Extended ID CANxTIDR2 Standard ID Extended ID CANxTIDR3 Standard ID 0xXX14- CANxTDSR0– 0xXX1B CANxTDSR7 0xXX1C CANxTDLR 0xXX1D CANxTTBPR 0xXX1E CANxTTSRH R R W R R W R R W R R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 ID28 ID10 ID27 ID9 ID26 ID8 ID25 ID7 ID24 ID6 ID23 ID5 ID22 ID4 ID21 ID3 ID20 ID2 ID19 ID1 ID18 ID0 SRR=1 RTR IDE=1 IDE=0 ID17 ID16 ID15 ID14 ID13 ID12 ID11 ID10 ID9 ID8 ID7 ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DLC3 DLC2 DLC1 DLC0 TSR15 TSR14 TSR13 TSR12 TSR11 TSR10 TSR9 TSR8 TSR7 TSR6 TSR5 TSR4 TSR3 TSR2 TSR1 TSR0 ID28 ID27 ID26 ID25 ID24 ID23 ID22 ID21 ID10 ID9 ID8 ID7 ID6 ID5 ID4 ID3 ID20 ID19 ID18 SRR=1 IDE=1 ID17 ID16 ID15 ID2 ID1 ID0 RTR IDE=0 ID14 ID13 ID12 ID11 ID10 ID9 ID8 ID7 ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DLC3 DLC2 DLC1 DLC0 PRIO7 PRIO6 PRIO5 PRIO4 PRIO3 PRIO2 PRIO1 PRIO0 TSR15 TSR14 TSR13 TSR12 TSR11 TSR10 TSR9 TSR8 S12XS Family Reference Manual, Rev. 1.13 724 Freescale Semiconductor Detailed Register Address Map Detailed MSCAN Foreground Receive and Transmit Buffer Layout (continued) Address Name 0xXX1F CANxTTSRL R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 TSR7 TSR6 TSR5 TSR4 TSR3 TSR2 TSR1 TSR0 0x0180–0x023F Reserved Register Space Address Name 0x01800x023F Reserved R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0x0240–0x027F Port Integration Module (PIM) Map 5 of 5 Address Name 0x0240 PTT 0x0241 PTIT 0x0242 DDRT 0x0243 RDRT 0x0244 PERT 0x0245 PPST 0x0246 Reserved 0x0247 PTTRR Bit 7 R PTT7 W R PTIT7 W R DDRT7 W R RDRT7 W R PERT7 W R PPST7 W R 0 W R PTTRR7 W Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PTT6 PTT5 PTT4 PTT3 PTT2 PTT1 PTT0 PTIT6 PTIT5 PTIT4 PTIT3 PTIT2 PTIT1 PTIT0 DDRT6 DDRT5 DDRT4 DDRT3 DDRT2 DDRT1 DDRT0 RDRT6 RDRT5 RDRT4 RDRT3 RDRT2 RDRT1 RDRT0 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 PPST6 PPST5 PPST4 PPST3 PPST2 PPST1 PPST0 0 0 0 0 0 0 0 PTTRR6 PTTRR5 PTTRR4 PTTRR2 PTTRR1 PTTRR0 0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 725 Detailed Register Address Map 0x0240–0x027F Port Integration Module (PIM) Map 5 of 5 Address Name 0x0248 PTS 0x0249 PTIS 0x024A DDRS 0x024B RDRS 0x024C PERS 0x024D PPSS 0x024E WOMS 0x024F Reserved 0x0250 PTM 0x0251 PTIM 0x0252 DDRM 0x0253 RDRM 0x0254 PERM 0x0255 PPSM 0x0256 WOMM 0x0257 MODRR 0x0258 PTP 0x0259 PTIP 0x025A DDRP 0x025B RDRP 0x025C PERP 0x025D PPSP 0x025E PIEP 0x025F PIFP R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PTS7 PTS6 PTS5 PTS4 PTS3 PTS2 PTS1 PTS0 PTIS7 PTIS6 PTIS5 PTIS4 PTIS3 PTIS2 PTIS1 PTIS0 DDRS7 DDRS6 DDRS5 DDRS4 DDRS3 DDRS2 DDRS1 DDRS0 RDRS7 RDRS6 RDRS5 RDRS4 RDRS3 RDRS2 RDRS1 RDRS0 PERS7 PERS6 PERS5 PERS4 PERS3 PERS2 PERS1 PERS0 PPSS7 PPSS6 PPSS5 PPSS4 PPSS3 PPSS2 PPSS1 PPSS0 WOMS7 WOMS6 WOMS5 WOMS4 WOMS3 WOMS2 WOMS1 WOMS0 0 0 0 0 0 0 0 0 PTM7 PTM6 PTM5 PTM4 PTM3 PTM2 PTM1 PTM0 PTIM7 PTIM6 PTIM5 PTIM4 PTIM3 PTIM2 PTIM1 PTIM0 DDRM7 DDRM6 DDRM5 DDRM4 DDRM3 DDRM2 DDRM1 DDRM0 RDRM7 RDRM6 RDRM5 RDRM4 RDRM3 RDRM2 RDRM1 RDRM0 PERM7 PERM6 PERM5 PERM4 PERM3 PERM2 PERM1 PERM0 PPSM7 PPSM6 PPSM5 PPSM4 PPSM3 PPSM2 PPSM1 PPSM0 WOMM7 WOMM6 WOMM5 WOMM4 WOMM3 WOMM2 WOMM1 WOMM0 MODRR7 MODRR6 0 0 0 0 PTP7 PTP6 PTP5 PTP4 PTP3 PTP2 PTP1 PTP0 PTIP7 PTIP6 PTIP5 PTIP4 PTIP3 PTIP2 PTIP1 PTIP0 DDRP7 DDRP6 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 RDRP7 RDRP6 RDRP5 RDRP4 RDRP3 RDRP2 RDRP1 RDRP0 PERP7 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 PPSP7 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSS0 PIEP7 PIEP6 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 PIFP7 PIFP6 PIFP5 PIFP4 PIFP3 PIFP2 PIFP1 PIFP0 0 MODRR4 S12XS Family Reference Manual, Rev. 1.13 726 Freescale Semiconductor Detailed Register Address Map 0x0240–0x027F Port Integration Module (PIM) Map 5 of 5 Address Name 0x0260 PTH 0x0261 PTIH 0x0262 DDRH 0x0263 RDRH 0x0264 PERH 0x0265 PPSH 0x0266 PIEH 0x0267 PIFH 0x0268 PTJ 0x0269 PTIJ 0x026A DDRJ 0x026B RDRJ 0x026C PERJ 0x026D PPSJ 0x026E PIEJ 0x026f PIFJ 0x0270 PT0AD0 0x0271 PT1AD0 0x0272 DDR0AD0 0x0273 DDR1AD0 0x0274 RDR0AD0 0x0275 RDR1AD0 R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PTH7 PTH6 PTH5 PTH4 PTH3 PTH2 PTH1 PTH0 PTIH7 PTIH6 PTIH5 PTIH4 PTIH3 PTIH2 PTIH1 PTIH0 DDRH7 DDRH6 DDRH5 DDRH4 DDRH3 DDRH2 DDRH1 DDRH0 RDRH7 RDRH6 RDRH5 RDRH4 RDRH3 RDRH2 RDRH1 RDRH0 PERH7 PERH6 PERH5 PERH4 PERH3 PERH2 PERH1 PERH0 PPSH7 PPSH6 PPSH5 PPSH4 PPSH3 PPSH2 PPSH1 PPSH0 PIEH7 PIEH6 PIEH5 PIEH4 PIEH3 PIEH2 PIEH1 PIEH0 PIFH7 PIFH6 PIFH5 PIFH4 PIFH3 PIFH2 PIFH1 PIFH0 PTJ7 PTJ6 0 0 0 0 PTJ1 PTJ0 PTIJ7 PTIJ6 0 0 0 0 PTIJ1 PTIJ0 DDRJ7 DDRJ6 0 0 0 0 DDRJ1 DDRJ0 RDRJ7 RDRJ6 0 0 0 0 RDRJ1 RDRJ0 PERJ7 PERJ6 0 0 0 0 PERJ1 PERJ0 PPSJ7 PPSJ6 0 0 0 0 PPSJ1 PPSJ0 PIEJ7 PIEJ6 0 0 0 0 PIEJ1 PIEJ0 PIFJ7 PIFJ6 0 0 0 0 PIFJ1 PIFJ0 PT0AD0 7 PT1AD0 7 PT0AD0 6 PT1AD0 6 PT0AD0 5 PT1AD0 5 PT0AD0 4 PT1AD0 4 PT0AD0 3 PT1AD0 3 PT0AD0 2 PT1AD0 2 PT0AD0 1 PT1AD0 1 PT0AD0 0 PT1AD0 0 DDR0AD0 DDR0AD0 DDR0AD0 DDR0AD0 DDR0AD0 DDR0AD0 DDR0AD0 DDR0AD0 7 6 5 4 3 2 1 0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 7 6 5 4 3 2 1 0 RDR0AD0 RDR0AD0 RDR0AD0 RDR0AD0 RDR0AD0 RDR0AD0 RDR0AD0 RDR0AD0 7 6 5 4 3 2 1 0 RDR1AD0 RDR1AD0 RDR1AD0 RDR1AD0 RDR1AD0 RDR1AD0 RDR1AD0 RDR1AD0 7 6 5 4 3 2 1 0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 727 Detailed Register Address Map 0x0240–0x027F Port Integration Module (PIM) Map 5 of 5 Address Name 0x0276 PER0AD0 0x0277 PER1AD0 0x02780x027F Reserved Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R PER0AD0 PER0AD0 PER0AD0 PER0AD0 PER0AD0 PER0AD0 PER0AD0 PER0AD0 7 6 5 4 3 2 1 0 W R PER1AD0 PER1AD0 PER1AD0 PER1AD0 PER1AD0 PER1AD0 PER1AD0 PER1AD0 7 6 5 4 3 2 1 0 W R 0 0 0 0 0 0 0 0 W 0x0280–0x02BF Reserved Register Space Address Name 0x02800x02BF Reserved R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Bit 1 Bit 0 WRAP1 WRAP0 ETRIG CH1 ETRIG CH0 ASCIE ACMPIE FRZ1 FRZ0 PRS1 PRS0 CB CA CC1 CC0 0 0 CMPE9 CMPE8 CMPE1 CMPE0 CCF9 CCF8 CCF1 CCF0 IEN9 IEN8 IEN1 IEN0 CMPHT9 CMPHT8 0x02C0–0x02EF Analog-to-Digital Converter 12-Bit 16-Channel (ATD0) Map Address Name 0x02C0 ATD0CTL0 0x02C1 ATD0CTL1 0x02C2 ATD0CTL2 0x02C3 ATD0CTL3 0x02C4 ATD0CTL4 0x02C5 ATD0CTL5 0x02C6 ATD0STAT0 0x02C7 Reserved 0x02C8 ATD0CMPEH 0x02C9 ATD0CMPEL 0x02CA ATD0STAT2H 0x02CB ATD0STAT2L 0x02CC ATD0DIENH 0x02CD ATD0DIENL 0x02CE ATD0CMPHTH Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 R 0 0 0 0 WRAP3 WRAP2 W R ETRIG ETRIG ETRIG SRES1 SRES0 SMP_DIS SEL CH3 CH2 W R 0 AFFC ICLKSTP ETRIGLE ETRIGP ETRIGE W R DJM S8C S4C S2C S1C FIFO W R SMP2 SMP1 SMP0 PRS4 PRS3 PRS2 W R 0 SC SCAN MULT CD CC W R 0 CC3 CC2 SCF ETORF FIFOR W R 0 0 0 0 0 0 W R CMPE15 CMPE14 CMPE13 CMPE12 CMPE11 CMPE10 W R CMPE7 CMPE6 CMPE5 CMPE4 CMPE3 CMPE2 W R CCF15 CCF14 CCF13 CCF12 CCF11 CCF10 W R CCF7 CCF6 CCF5 CCF4 CCF3 CCF2 W R IEN15 IEN14 IEN13 IEN12 IEN11 IEN10 W R IEN7 IEN6 IEN5 IEN4 IEN3 IEN2 W R CMPHT15 CMPHT14 CMPHT13 CMPHT12 CMPHT11 CMPHT10 W S12XS Family Reference Manual, Rev. 1.13 728 Freescale Semiconductor Detailed Register Address Map 0x02C0–0x02EF Analog-to-Digital Converter 12-Bit 16-Channel (ATD0) Map (continued) Address Name R CMPHT7 W R Bit15 ATD0DR0H W R Bit7 ATD0DR0L W R Bit15 ATD0DR1H W R Bit7 ATD0DR1L W R Bit15 ATD0DR2H W R Bit7 ATD0DR2L W R Bit15 ATD0DR3H W R Bit7 ATD0DR3L W R Bit15 ATD0DR4H W R Bit7 ATD0DR4L W R Bit15 ATD0DR5H W R Bit7 ATD0DR5L W R Bit15 ATD0DR6H W R Bit7 ATD0DR6L W R Bit15 ATD0DR7H W R Bit7 ATD0DR7L W R Bit15 ATD0DR8H W R Bit7 ATD0DR8L W R Bit15 ATD0DR9H W R Bit7 ATD0DR9L W R Bit15 ATD0DR10H W R Bit7 ATD0DR10L W 0x02CF ATD0CMPHTL 0x02D0 0x02D1 0x02D2 0x02D3 0x02D4 0x02D5 0x02D6 0x02D7 0x02D8 0x02D9 0x02DA 0x02DB 0x02DC 0x02DD 0x02DE 0x02DF 0x02E0 0x02E1 0x02E2 0x02E3 0x02E4 0x02E5 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CMPHT6 CMPHT5 CMPHT4 CMPHT3 CMPHT2 CMPHT1 CMPHT0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 14 13 12 11 10 9 Bit8 Bit6 0 0 0 0 0 0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 729 Detailed Register Address Map 0x02C0–0x02EF Analog-to-Digital Converter 12-Bit 16-Channel (ATD0) Map (continued) Address Name 0x02E6 ATD0DR11H 0x02E7 ATD0DR11L 0x02E8 ATD0DR12H 0x02E9 ATD0DR12L 0x02EA ATD0DR13H 0x02EB ATD0DR13L 0x02EC ATD0DR14H 0x02ED ATD0DR14L 0x02EE ATD0DR15H 0x02EF ATD0DR15L R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit15 14 13 12 11 10 9 Bit8 Bit7 Bit6 0 0 0 0 0 0 Bit15 14 13 12 11 10 9 Bit8 Bit7 Bit6 0 0 0 0 0 0 Bit15 14 13 12 11 10 9 Bit8 Bit7 Bit6 0 0 0 0 0 0 Bit15 14 13 12 11 10 9 Bit8 Bit7 Bit6 0 0 0 0 0 0 Bit15 14 13 12 11 10 9 Bit8 Bit7 Bit6 0 0 0 0 0 0 Bit 2 Bit 1 Bit 0 HTIE HTIF LVIE LVIF APIE APIF 0 0 0x02F0–0x02F7 Voltage Regulator (VREG_3V3) Map Address Name 0x02F0 VREGHTCL 0x02F1 VREGCTRL 0x02F2 VREGAPICL 0x02F3 VREGAPITR 0x02F4 VREGAPIRH 0x02F5 VREGAPIRL 0x02F6 Reserved 0x02F7 VREGHTTR Bit 7 R 0 W R 0 W R APICLK W R APITR5 W R APIR15 W R APIR7 W R 0 W R HTOEN W Bit 6 0 Bit 5 Bit 4 Bit 3 HTDS VSEL VAE HTEN 0 0 0 0 LVDS 0 0 APIFES APIEA APIFE APITR4 APITR3 APITR2 APITR1 APITR0 APIR14 APIR13 APIR12 APIR11 APIR10 APIR9 APIR8 APIR6 APIR5 APIR4 APIR3 APIR2 APIR1 APIR0 0 0 0 0 0 0 0 0 0 0 HTTR3 HTTR2 HTTR1 HTTR0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0x02F8–0x02FF Reserved Address Name 0x02F8– 0x02FF Reserved R W S12XS Family Reference Manual, Rev. 1.13 730 Freescale Semiconductor Detailed Register Address Map 0x0300–0x0327 Pulse Width Modulator 8-Bit 8-Channel (PWM) Map Address 0x0300 0x0301 0x0302 0x0303 0x0304 0x0305 0x0306 0x0307 0x0308 0x0309 0x030A 0x030B 0x030C 0x030D 0x030E 0x030F 0x0310 0x0311 0x0312 0x0313 0x0314 0x0315 0x0316 Name Bit 7 R PWME7 W R PWMPOL PPOL7 W R PWMCLK PCLK7 W R 0 PWMPRCLK W R PWMCAE CAE7 W R PWMCTL CON67 W R 0 PWMTST Test Only W R 0 PWMPRSC W R PWMSCLA Bit 7 W R PWMSCLB Bit 7 W R 0 PWMSCNTA W R 0 PWMSCNTB W R Bit 7 PWMCNT0 W 0 R Bit 7 PWMCNT1 W 0 R Bit 7 PWMCNT2 W 0 R Bit 7 PWMCNT3 W 0 R Bit 7 PWMCNT4 W 0 R Bit 7 PWMCNT5 W 0 R Bit 7 PWMCNT6 W 0 R Bit 7 PWMCNT7 W 0 R PWMPER0 Bit 7 W R PWMPER1 Bit 7 W R PWMPER2 Bit 7 W PWME Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PWME6 PWME5 PWME4 PWME3 PWME2 PWME1 PWME0 PPOL6 PPOL5 PPOL4 PPOL3 PPOL2 PPOL1 PPOL0 PCLK6 PCLK5 PCLK4 PCLK3 PCLK2 PCLK1 PCLK0 PCKB2 PCKB1 PCKB0 PCKA2 PCKA1 PCKA0 CAE6 CAE5 CAE4 CAE3 CAE2 CAE1 CAE0 CON45 CON23 CON01 PSWAI PFRZ 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 6 5 4 3 2 1 Bit 0 6 5 4 3 2 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 6 0 6 0 6 0 6 0 6 0 6 0 6 0 6 0 5 0 5 0 5 0 5 0 5 0 5 0 5 0 5 0 4 0 4 0 4 0 4 0 4 0 4 0 4 0 4 0 3 0 3 0 3 0 3 0 3 0 3 0 3 0 3 0 2 0 2 0 2 0 2 0 2 0 2 0 2 0 2 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 Bit 0 0 Bit 0 0 Bit 0 0 Bit 0 0 Bit 0 0 Bit 0 0 Bit 0 0 Bit 0 0 6 5 4 3 2 1 Bit 0 6 5 4 3 2 1 Bit 0 6 5 4 3 2 1 Bit 0 0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 731 Detailed Register Address Map 0x0300–0x0327 Pulse Width Modulator 8-Bit 8-Channel (PWM) Map Address Name 0x0317 PWMPER3 0x0318 PWMPER4 0x0319 PWMPER5 0x031A PWMPER6 0x031B PWMPER7 0x031C PWMDTY0 0x031D PWMDTY1 0x031E PWMDTY2 0x031F PWMDTY3 0x0320 PWMDTY4 0x0321 PWMDTY5 0x0322 PWMDTY6 0x0323 PWMDTY7 0x0324 PWMSDN 0x0325 Reserved 0x0326 Reserved 0x0327 Reserved R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 PWM7IN PWMIE PWM7INL PWM7 ENA 0 0 0 PWM RSTRT 0 0 PWMIF 0 0 0 PWMLVL 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0x0328–0x033F Reserved Address Name 0x0328– 0x033F Reserved R W S12XS Family Reference Manual, Rev. 1.13 732 Freescale Semiconductor Detailed Register Address Map 0x00340–0x0367 – Periodic Interrupt Timer (PIT) Map Address Name 0x0340 PITCFLMT 0x0341 PITFLT 0x0342 PITCE 0x0343 PITMUX 0x0344 PITINTE 0x0345 PITTF 0x0346 PITMTLD0 0x0347 PITMTLD1 0x0348 PITLD0 (hi) 0x0349 PITLD0 (lo) 0x034A PITCNT0 (hi) 0x034B PITCNT0 (lo) 0x034C PITLD1 (hi) 0x034D PITLD1 (lo) 0x034E PITCNT1 (hi) 0x034F PITCNT1 (lo) 0x0350 PITLD2 (hi) 0x0351 PITLD2 (lo) 0x0352 PITCNT2 (hi) 0x0353 PITCNT2 (lo) 0x0354 PITLD3 (hi) 0x0355 PITLD3 (lo) R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PITE PITSWAI PITFRZ 0 0 0 0 0 0 PFLT3 0 PFLT2 0 PFLMT1 0 PFLT1 0 PFLMT0 0 PFLT0 0 0 0 0 0 0 PCE3 PCE2 PCE1 PCE0 0 0 0 0 PMUX3 PMUX2 PMUX1 PMUX0 0 0 0 0 PINTE3 PINTE2 PINTE1 PINTE0 0 0 0 0 PTF3 PTF2 PTF1 PTF0 PMTLD7 PMTLD6 PMTLD5 PMTLD4 PMTLD3 PMTLD2 PMTLD1 PMTLD0 PMTLD7 PMTLD6 PMTLD5 PMTLD4 PMTLD3 PMTLD2 PMTLD1 PMTLD0 PLD15 PLD14 PLD13 PLD12 PLD11 PLD10 PLD9 PLD8 PLD7 PLD6 PLD5 PLD4 PLD3 PLD2 PLD1 PLD0 PCNT15 PCNT14 PCNT13 PCNT12 PCNT11 PCNT10 PCNT9 PCNT8 PCNT7 PCNT6 PCNT5 PCNT4 PCNT3 PCNT2 PCNT1 PCNT0 PLD15 PLD14 PLD13 PLD12 PLD11 PLD10 PLD9 PLD8 PLD7 PLD6 PLD5 PLD4 PLD3 PLD2 PLD1 PLD0 PCNT15 PCNT14 PCNT13 PCNT12 PCNT11 PCNT10 PCNT9 PCNT8 PCNT7 PCNT6 PCNT5 PCNT4 PCNT3 PCNT2 PCNT1 PCNT0 PLD15 PLD14 PLD13 PLD12 PLD11 PLD10 PLD9 PLD8 PLD7 PLD6 PLD5 PLD4 PLD3 PLD2 PLD1 PLD0 PCNT15 PCNT14 PCNT13 PCNT12 PCNT11 PCNT10 PCNT9 PCNT8 PCNT7 PCNT6 PCNT5 PCNT4 PCNT3 PCNT2 PCNT1 PCNT0 PLD15 PLD14 PLD13 PLD12 PLD11 PLD10 PLD9 PLD8 PLD7 PLD6 PLD5 PLD4 PLD3 PLD2 PLD1 PLD0 S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 733 Detailed Register Address Map Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PCNT14 PCNT13 PCNT12 PCNT11 PCNT10 PCNT9 PCNT8 PCNT6 PCNT5 PCNT4 PCNT3 PCNT2 PCNT1 PCNT0 0 0 0 0 0 0 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 R PCNT15 W R 0x0357 PITCNT3 (lo) PCNT7 W R 0 0x0358– Reserved 0x0367 W 0x0356 PITCNT3 (hi) 0x0368–0x077F Reserved Address 0x0368 Name Reserved R W S12XS Family Reference Manual, Rev. 1.13 734 Freescale Semiconductor Ordering Information Appendix F Ordering Information F.1 Ordering Information The following figure provides an ordering part number example for the devices covered by this data book. There are two options when ordering a device. Customers must choose between ordering either the maskspecific part number or the generic / mask-independent part number. Ordering the mask-specific part number enables the customer to specify which particular maskset they will receive whereas ordering the generic maskset means that FSL will ship the currently preferred maskset (which may change over time). In either case, the marking on the device will always show the generic / mask-independent peritoneums and the mask set number. NOTE The max length for the part number is 15 characters. Due to this limitation, in some situations, some characters are omitted. The mask identifier suffix and the Tape & Reel suffix are often both omitted from the part number which is actually marked on the device. For specific part numbers to order, please contact your local sales office. The below figure illustrates the structure of a typical mask-specific ordering number for the S12XS family devices. S 9 S12X S256 J1 C AL R Tape & Reel: R = Tape & Reel No R = No Tape & Reel Package Option: AE = 64 LQFP AA = 80 QFP AL = 112 LQFP Temperature Option: C = -40˚C to 85˚C V = -40˚C to 105˚C M = -40˚C to 125˚C Maskset identifier Suffix: First digit usually references wafer fab Second digit usually differentiates mask rev (this suffix is omitted in generic part numbers) Device Title Controller Family Main Memory Type: 9 = Flash Status / Partnumber type: S or SC = Maskset specific part number MC = Generic / mask-independent part number P or PC = prototype status (pre qualification) Figure F-1. Order Part Number Example S12XS Family Reference Manual, Rev. 1.13 Freescale Semiconductor 735 Ordering Information S12XS Family Reference Manual, Rev. 1.13 736 Freescale Semiconductor How to Reach Us: Home Page: www.freescale.com USA/Europe or Locations Not Listed: Freescale Semiconductor Technical Information Center, CH370 1300 N. Alma School Road Chandler, Arizona 85224 1-800-521-6274 or 480-768-2130 Europe, Middle East, and Africa: +44 1296 380 456 (English) +46 8 52200080 (English) +49 89 92103 559 (German) +33 1 69 35 48 48 (French) Japan: Freescale Semiconductor Japan Ltd. Technical Information Center 3-20-1, Minami-Azabu, Minato-ku Tokyo 106-0047, Japan 0120-191014 or +81-3-3440-3569 Asia/Pacific: Freescale Semiconductor Hong Kong Ltd. Technical Information Center 2 Dai King Street Tai Po Industrial Estate Tai Po, N.T., Hong Kong 852-26668334 For Literature Requests Only: Freescale Semiconductor Literature Distribution Center P.O. Box 5405 Denver, Colorado 80217 1-800-441-2447 or 303-675-2140 Fax: 303-675-2150 Information in this document is provided solely to enable system and software implementers to use Freescale Semiconductor products. There are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. Freescale Semiconductor reserves the right to make changes without further notice to any products herein. Freescale Semiconductor makes no warranty, representation or guarantee regarding the suitability of its products for any particular purpose, nor does Freescale Semiconductor assume any liability arising out of the application or use of any product or circuit, and specifically disclaims any and all liability, including without limitation consequential or incidental damages. “Typical” parameters that may be provided in Freescale Semiconductor data sheets and/or specifications can and do vary in different applications and actual performance may vary over time. All operating parameters, including “Typicals”, must be validated for each customer application by customer’s technical experts. Freescale Semiconductor does not convey any license under its patent rights nor the rights of others. Freescale Semiconductor products are not designed, intended, or authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other application in which the failure of the Freescale Semiconductor product could create a situation where personal injury or death may occur. Should Buyer purchase or use Freescale Semiconductor products for any such unintended or unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor and its officers, employees, subsidiaries, affiliates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that Freescale Semiconductor was negligent regarding the design or manufacture of the part. Freescale™ and the Freescale logo are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners. Java and all other Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. © Freescale Semiconductor, Inc. 2007. All rights reserved. MC9S12XS256RMV1 Rev. 1.13 08/2012