 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| hcs12x microcontrollers freescale.com because of an order from the united states international trade commission, bga-packaged product lines and partnumber s indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xep100 reference manual covers mc9s12xe family mc9s12xep100rmv1 1rev. 1.21 04/2010
to provide the most up-to-date information, the document revision on the world wide web is the most current. a printed copy may be an earlier revision. to verif, refer to: http://freescale.com/ this document contains information for the complete s12xe-family and thus includes a set of separate ftm module sections to cover the whole family. a full list of family members and options is included in the appendices. this document contains information for all constituent modules, with the exception of the s12x cpu. for s12x cpu information please refer to cpu12xv2 in the cpu12/cpu12x reference manual. because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 revision history date revision description jan,2008 1.15 added further s12xes384 derivative updated ftm, dbg, sci sections may,2008 1.16 figure b-3 1 value corrected. added lvr minimum assert level enhanced reset pin description. iic register name corrected corrected d-flash size reference for xeg128 changed module revision history tables to a uni?d format corrected corrupted formats jul, 2008 1.17 added module run idd values added 3.3v expansion bus timing corrected nvm timing parameters changed iic scl divider note sep, 2008 1.18 updated nvm timing parameter section for brownout case speci?d time delay from reset to start of cpu code execution added nvm patch part ids enhanced ect gpio / timer function transitioning description dec, 2008 1.19 updated 208mapbga thermal parameters revised tim ?g clearing procedure corrected crg register address added maskset identi?r suf? for atmc fab fixed typos aug, 2009 1.20 added 208mapbga disclaimer added vreapi to pt5. added lvr note to electricals. updates to tim/ect/xgate/sci/mscan (see embedded rev. history) apr,2010 1.21 ftm section (see ftm revision history) pim section (see pim revision history) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 3 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 1 device overview mc9s12xe-family. . . . . . . . . . . . . . . . . . . . . 27 chapter 2 port integration module (s12xep100pimv1) . . . . . . . . . . . . . . 89 chapter 3 memory mapping control (s12xmmcv4) . . . . . . . . . . . . . . . . 187 chapter 4 memory protection unit (s12xmpuv1) . . . . . . . . . . . . . . . . . 227 chapter 5 external bus interface (s12xebiv4) . . . . . . . . . . . . . . . . . . . . 241 chapter 6 interrupt (s12xintv2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 chapter 7 background debug module (s12xbdmv2) . . . . . . . . . . . . . . 277 chapter 8 s12x debug (s12xdbgv3) module . . . . . . . . . . . . . . . . . . . . 303 chapter 9 security (s12xe9secv2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345 chapter 10 xgate (s12xgatev3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 chapter 11 s12xe clocks and reset generator (s12xecrgv1) . . . . . . 467 chapter 12 pierce oscillator (s12xosclcpv2) . . . . . . . . . . . . . . . . . . . . 497 chapter 13 analog-to-digital converter (adc12b16cv1) . . . . . . . . . . . . 501 chapter 14 enhanced capture timer (ect16b8cv3). . . . . . . . . . . . . . . . 525 chapter 15 inter-integrated circuit (iicv3) block description. . . . . . . . . 577 chapter 16 scalable controller area network (s12mscanv3) . . . . . . . . 603 chapter 17 periodic interrupt timer (s12pit24b8cv2) . . . . . . . . . . . . . . 657 chapter 18 periodic interrupt timer (s12pit24b4cv2) . . . . . . . . . . . . . . 675 chapter 19 pulse-width modulator (s12pwm8b8cv1) . . . . . . . . . . . . . . 689 chapter 20 serial communication interface (s12sciv5) . . . . . . . . . . . . . 721 chapter 21 serial peripheral interface (s12spiv5) . . . . . . . . . . . . . . . . . . 759 chapter 22 timer module (tim16b8cv2) block description . . . . . . . . . . 785 chapter 23 voltage regulator (s12vregl3v3v1) . . . . . . . . . . . . . . . . . . 813 chapter 24 128 kbyte flash module (s12xftm128k2v1) . . . . . . . . . . . . 829 chapter 25 256 kbyte flash module (s12xftm256k2v1) . . . . . . . . . . . . 889 mc9s12xe-family reference manual , rev. 1.21 4 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 26 384 kbyte flash module (s12xftm384k2v1) . . . . . . . . . . . . 951 chapter 27 512 kbyte flash module (s12xftm512k3v1) . . . . . . . . . . . 1013 chapter 28 768 kbyte flash module (s12xftm768k4v2) . . . . . . . . . . . 1075 chapter 29 1024 kbyte flash module (s12xftm1024k5v2) . . . . . . . . . 1137 appendix a electrical characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199 appendix b package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255 appendix c pcb layout guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1260 appendix d derivative differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1265 appendix e detailed register address map. . . . . . . . . . . . . . . . . . . . . . . 1268 appendix f ordering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1319 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 5 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 blank page mc9s12xe-family reference manual , rev. 1.21 6 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 blank page mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 7 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 1 device overview mc9s12xe-family 1.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 1.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.1.4 device memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.1.5 address mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34 1.1.6 detailed register map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.1.7 part id assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40 1.2 signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.2.1 device pinout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.2.2 pin assignment overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.2.3 detailed signal descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.2.4 power supply pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72 1.3 system clock description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 1.4 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.4.1 chip con?uration summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.4.2 power modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.4.3 freeze mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.4.4 system states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.5 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6 resets and interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.1 resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.2 vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.3 effects of reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 1.7 adc0 con?uration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.7.1 external trigger input connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.7.2 adc0 channel[17] connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.8 adc1 external trigger input connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 6 1.9 mpu con?uration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.10 vreg con?uration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.10.1 temperature sensor con?uration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.11 s12xepim con?uration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.12 oscillator con?uration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 chapter 2 port integration module (s12xep100pimv1) 2.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 2.1.1 overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 mc9s12xe-family reference manual , rev. 1.21 8 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 2.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 2.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 2.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98 2.3.1 memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 2.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 2.3.3 port a data register (porta) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.4 port b data register (portb) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.5 port a data direction register (ddra) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.6 port b data direction register (ddrb) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.7 port c data register (portc) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 2.3.8 port d data register (portd) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.9 port c data direction register (ddrc) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.10 port d data direction register (ddrd) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 2.3.11 port e data register (porte) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.3.12 port e data direction register (ddre) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 2.3.13 s12x_ebi ports, bkgd pin pull-up control register (pucr) . . . . . . . . . . . . . . . . . . 114 2.3.14 s12x_ebi ports reduced drive register (rdriv) . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 2.3.15 eclk control register (eclkctl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 2.3.16 pim reserved register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 8 2.3.17 irq control register (irqcr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.18 pim reserved register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.19 port k data register (portk) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.3.20 port k data direction register (ddrk) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.3.21 port t data register (ptt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2.3.22 port t input register (ptit) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.3.23 port t data direction register (ddrt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.3.24 port t reduced drive register (rdrt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.3.25 port t pull device enable register (pert) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.3.26 port t polarity select register (ppst) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.3.27 pim reserved register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4 2.3.28 pim reserved register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4 2.3.29 port s data register (pts) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 2.3.30 port s input register (ptis) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.3.31 port s data direction register (ddrs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.3.32 port s reduced drive register (rdrs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 2.3.33 port s pull device enable register (pers) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 2.3.34 port s polarity select register (ppss) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 2.3.35 port s wired-or mode register (woms) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.3.36 pim reserved register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 9 2.3.37 port m data register (ptm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 2.3.38 port m input register (ptim) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 2.3.39 port m data direction register (ddrm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.3.40 port m reduced drive register (rdrm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3.41 port m pull device enable register (perm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3.42 port m polarity select register (ppsm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 9 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 2.3.43 port m wired-or mode register (womm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 2.3.44 module routing register (modrr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 2.3.45 port p data register (ptp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 2.3.46 port p input register (ptip) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 2.3.47 port p data direction register (ddrp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.3.48 port p reduced drive register (rdrp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 2.3.49 port p pull device enable register (perp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 2.3.50 port p polarity select register (ppsp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 2.3.51 port p interrupt enable register (piep) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 2.3.52 port p interrupt flag register (pifp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 2.3.53 port h data register (pth) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 2.3.54 port h input register (ptih) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 2.3.55 port h data direction register (ddrh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 2.3.56 port h reduced drive register (rdrh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 2.3.57 port h pull device enable register (perh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 2.3.58 port h polarity select register (ppsh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 2.3.59 port h interrupt enable register (pieh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.3.60 port h interrupt flag register (pifh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.3.61 port j data register (ptj) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 49 2.3.62 port j input register (ptij) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 0 2.3.63 port j data direction register (ddrj) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 2.3.64 port j reduced drive register (rdrj) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 2.3.65 port j pull device enable register (perj) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 2.3.66 port j polarity select register (ppsj) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 2.3.67 port j interrupt enable register (piej) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 2.3.68 port j interrupt flag register (pifj) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 2.3.69 port ad0 data register 0 (pt0ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 2.3.70 port ad0 data register 1 (pt1ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 2.3.71 port ad0 data direction register 0 (ddr0ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 2.3.72 port ad0 data direction register 1 (ddr1ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 2.3.73 port ad0 reduced drive register 0 (rdr0ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 2.3.74 port ad0 reduced drive register 1 (rdr1ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 2.3.75 port ad0 pull up enable register 0 (per0ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 2.3.76 port ad0 pull up enable register 1 (per1ad0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 2.3.77 port ad1 data register 0 (pt0ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 2.3.78 port ad1 data register 1 (pt1ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 2.3.79 port ad1 data direction register 0 (ddr0ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 2.3.80 port ad1 data direction register 1 (ddr1ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 2.3.81 port ad1 reduced drive register 0 (rdr0ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 2.3.82 port ad1 reduced drive register 1 (rdr1ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 2.3.83 port ad1 pull up enable register 0 (per0ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 2.3.84 port ad1 pull up enable register 1 (per1ad1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 2.3.85 port r data register (ptr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 2.3.86 port r input register (ptir) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 2.3.87 port r data direction register (ddrr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 mc9s12xe-family reference manual , rev. 1.21 10 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 2.3.88 port r reduced drive register (rdrr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 2.3.89 port r pull device enable register (perr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 2.3.90 port r polarity select register (ppsr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 2.3.91 pim reserved register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 7 2.3.92 port r routing register (ptrrr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 2.3.93 port l data register (ptl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 2.3.94 port l input register (ptil) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 2.3.95 port l data direction register (ddrl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 2.3.96 port l reduced drive register (rdrl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 2.3.97 port l pull device enable register (perl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 2.3.98 port l polarity select register (ppsl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 2.3.99 port l wired-or mode register (woml) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 2.3.100port l routing register (ptlrr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 2.3.101port f data register (ptf) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3 2.3.102port f input register (ptif) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 5 2.3.103port f data direction register (ddrf) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 2.3.104port f reduced drive register (rdrf) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 2.3.105port f pull device enable register (perf) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 2.3.106port f polarity select register (ppsf) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 2.3.107pim reserved register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 77 2.3.108port f routing register (ptfrr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 2.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.1 general . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.2 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.3 pins and ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 2.4.4 pin interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 2.5 initialization information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 2.5.1 port data and data direction register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 chapter 3 memory mapping control (s12xmmcv4) 3.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 3.1.1 terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 3.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 3.1.3 s12x memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 3.1.4 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 89 3.1.5 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 3.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 3.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 3.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 3.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 3.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 3.4.1 mcu operating mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 3.4.2 memory map scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 3.4.3 chip access restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 11 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.4.4 chip bus control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 3.5 initialization/application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 3.5.1 call and rtc instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 3.5.2 port replacement registers (prrs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 3.5.3 on-chip rom control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 chapter 4 memory protection unit (s12xmpuv1) 4.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.1 preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.2 overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.3 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 4.1.4 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 29 4.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 4.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 29 4.3.1 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 4.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 4.4.1 protection descriptors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 4.4.2 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 4.5 initialization/application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 4.5.1 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 chapter 5 external bus interface (s12xebiv4) 5.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 5.1.1 glossary or terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.3 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 42 5.1.4 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 5.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 5.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 45 5.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 5.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 5.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 5.4.1 operating modes and external bus properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 5.4.2 internal visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 5.4.3 accesses to port replacement registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 5.4.4 stretched external bus accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 5.4.5 data select and data direction signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 5.4.6 low-power options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 6 5.5 initialization/application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 5.5.1 normal expanded mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 5.5.2 emulation modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 mc9s12xe-family reference manual , rev. 1.21 12 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 6 interrupt (s12xintv2) 6.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 6.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 6.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 6.1.3 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 63 6.1.4 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 6.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 6.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 65 6.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 6.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 6.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 6.4.1 s12x exception requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 6.4.2 interrupt prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 6.4.3 xgate requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 73 6.4.4 priority decoders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 6.4.5 reset exception requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 6.4.6 exception priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 6.5 initialization/application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.1 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.2 interrupt nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.3 wake up from stop or wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 chapter 7 background debug module (s12xbdmv2) 7.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 7.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 7.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 78 7.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 7.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 7.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 80 7.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 7.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 7.3.3 family id assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 7.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 7.4.1 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 7.4.2 enabling and activating bdm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 7.4.3 bdm hardware commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 7.4.4 standard bdm firmware commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 7.4.5 bdm command structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 7.4.6 bdm serial interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 91 7.4.7 serial interface hardware handshake protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 7.4.8 hardware handshake abort procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 7.4.9 sync ?request timed reference pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 13 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.4.10 instruction tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 7.4.11 serial communication time out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 chapter 8 s12x debug (s12xdbgv3) module 8.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 8.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 8.1.2 overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 8.1.3 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 8.1.4 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 05 8.1.5 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 8.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324 8.4.1 s12xdbg operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325 8.4.2 comparator modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 25 8.4.3 trigger modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 8.4.4 state sequence control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 0 8.4.5 trace buffer operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1 8.4.6 tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339 8.4.7 breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340 chapter 9 security (s12xe9secv2) 9.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345 9.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345 9.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 46 9.1.3 securing the microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 9.1.4 operation of the secured microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 9.1.5 unsecuring the microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 9.1.6 reprogramming the security bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 9.1.7 complete memory erase (special modes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 chapter 10 xgate (s12xgatev3) 10.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 10.1.1 glossary of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 10.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352 10.1.3 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 10.1.4 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 10.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354 10.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354 mc9s12xe-family reference manual , rev. 1.21 14 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354 10.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 10.4.1 xgate risc core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 2 10.4.2 programmer s model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 2 10.4.3 memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373 10.4.4 semaphores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.4.5 software error detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 6 10.5 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 10.5.1 incoming interrupt requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 10.5.2 outgoing interrupt requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 10.6 debug mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 10.6.1 debug features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 10.6.2 leaving debug mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 9 10.7 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.8 instruction set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380 10.8.1 addressing modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380 10.8.2 instruction summary and usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383 10.8.3 cycle notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385 10.8.4 thread execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386 10.8.5 instruction glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386 10.8.6 instruction coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459 10.9 initialization and application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 10.9.1 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 10.9.2 code example (transmit "hello world!" on sci) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 10.9.3 stack support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464 chapter 11 s12xe clocks and reset generator (s12xecrgv1) 11.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467 11.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467 11.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468 11.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468 11.2 signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 11.2.1 v ddpll , v sspll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 11.2.2 reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 11.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 11.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 11.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 11.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 11.4.1 functional blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 11.4.2 operation modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 11.4.3 low power options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 90 11.5 resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492 11.5.1 description of reset operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493 11.6 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 15 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.6.1 description of interrupt operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496 chapter 12 pierce oscillator (s12xosclcpv2) 12.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497 12.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497 12.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497 12.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 12.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 12.2.1 v ddpll and v sspll ?operating and ground voltage pins . . . . . . . . . . . . . . . . . . . . 498 12.2.2 extal and xtal ?input and output pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 12.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.4.1 gain control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.4.2 clock monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.4.3 wait mode operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 00 12.4.4 stop mode operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 00 chapter 13 analog-to-digital converter (adc12b16cv1) 13.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501 13.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501 13.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 13.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 13.2 signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 13.2.1 detailed signal descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 13.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 13.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 13.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521 13.4.1 analog sub-block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521 13.4.2 digital sub-block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522 13.5 resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 13.6 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 chapter 14 enhanced capture timer (ect16b8cv3) 14.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525 14.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526 14.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526 14.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 14.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 14.2.1 ioc7 ?input capture and output compare channel 7 . . . . . . . . . . . . . . . . . . . . . . . . 527 14.2.2 ioc6 ?input capture and output compare channel 6 . . . . . . . . . . . . . . . . . . . . . . . . 527 mc9s12xe-family reference manual , rev. 1.21 16 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.2.3 ioc5 ?input capture and output compare channel 5 . . . . . . . . . . . . . . . . . . . . . . . . 528 14.2.4 ioc4 ?input capture and output compare channel 4 . . . . . . . . . . . . . . . . . . . . . . . . 528 14.2.5 ioc3 ?input capture and output compare channel 3 . . . . . . . . . . . . . . . . . . . . . . . . 528 14.2.6 ioc2 ?input capture and output compare channel 2 . . . . . . . . . . . . . . . . . . . . . . . . 528 14.2.7 ioc1 ?input capture and output compare channel 1 . . . . . . . . . . . . . . . . . . . . . . . . 528 14.2.8 ioc0 ?input capture and output compare channel 0 . . . . . . . . . . . . . . . . . . . . . . . . 528 14.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528 14.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528 14.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528 14.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 14.4.1 enhanced capture timer modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570 14.4.2 reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 574 14.4.3 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575 chapter 15 inter-integrated circuit (iicv3) block description 15.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 15.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 15.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 15.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 15.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 15.2.1 iic_scl ?serial clock line pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 15.2.2 iic_sda ?serial data line pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 15.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 15.3.1 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 15.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591 15.4.1 i-bus protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591 15.4.2 operation in run mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596 15.4.3 operation in wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 6 15.4.4 operation in stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 6 15.5 resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596 15.6 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596 15.7 application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597 15.7.1 iic programming examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597 chapter 16 freescale? scalable controller area network (s12mscanv3) 16.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 16.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 16.1.2 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 16.1.3 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605 16.1.4 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605 16.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 16.2.1 rxcan ?can receiver input pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 17 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.2.2 txcan ?can transmitter output pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 16.2.3 can system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 16.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 16.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 16.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 16.3.3 programmer s model of message storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628 16.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639 16.4.1 general . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639 16.4.2 message storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639 16.4.3 identi?r acceptance filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 2 16.4.4 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 648 16.4.5 low-power options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 50 16.4.6 reset initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654 16.4.7 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654 16.5 initialization/application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 16.5.1 mscan initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 56 16.5.2 bus-off recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 chapter 17 periodic interrupt timer (s12pit24b8cv2) 17.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 17.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 17.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 17.1.3 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 17.1.4 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 17.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 17.3 register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669 17.4.1 timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670 17.4.2 interrupt interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671 17.4.3 hardware trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671 17.5 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 17.5.1 startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 17.5.2 shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 17.5.3 flag clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 17.6 application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 chapter 18 periodic interrupt timer (s12pit24b4cv2) 18.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 18.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 18.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 18.1.3 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 18.1.4 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676 mc9s12xe-family reference manual , rev. 1.21 18 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676 18.3 register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676 18.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685 18.4.1 timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685 18.4.2 interrupt interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.4.3 hardware trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.5 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.5.1 startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.5.2 shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.5.3 flag clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.6 application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 chapter 19 pulse-width modulator (s12pwm8b8cv1) 19.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 19.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 19.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690 19.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690 19.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690 19.2.1 pwm7 ?pwm channel 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.2.2 pwm6 ?pwm channel 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.2.3 pwm5 ?pwm channel 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.2.4 pwm4 ?pwm channel 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.2.5 pwm3 ?pwm channel 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.2.6 pwm3 ?pwm channel 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.2.7 pwm3 ?pwm channel 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.2.8 pwm3 ?pwm channel 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 19.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 19.4.1 pwm clock select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 19.4.2 pwm channel timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 710 19.5 resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 718 19.6 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719 chapter 20 serial communication interface (s12sciv5) 20.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721 20.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721 20.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 722 20.1.3 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 722 20.1.4 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723 20.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 19 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.2.1 txd ?transmit pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4 20.2.2 rxd ?receive pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4 20.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 20.3.1 module memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 20.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725 20.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737 20.4.1 infrared interface submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 738 20.4.2 lin support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 738 20.4.3 data format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739 20.4.4 baud rate generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 40 20.4.5 transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 741 20.4.6 receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 746 20.4.7 single-wire operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 54 20.4.8 loop operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 20.5 initialization/application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 20.5.1 reset initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 20.5.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 20.5.3 interrupt operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756 20.5.4 recovery from wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758 20.5.5 recovery from stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758 chapter 21 serial peripheral interface (s12spiv5) 21.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759 21.1.1 glossary of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759 21.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759 21.1.3 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759 21.1.4 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 21.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.2.1 mosi ?master out/slave in pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.2.2 miso ?master in/slave out pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.2.3 ss ?sla v e select pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 21.2.4 sck ?serial clock pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 21.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 21.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 21.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 21.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 771 21.4.1 master mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772 21.4.2 slave mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773 21.4.3 transmission formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 74 21.4.4 spi baud rate generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779 21.4.5 special features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780 21.4.6 error conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 781 21.4.7 low power mode options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782 mc9s12xe-family reference manual , rev. 1.21 20 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 22 timer module (tim16b8cv2) block description 22.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 785 22.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786 22.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786 22.1.3 block diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 22.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 789 22.2.1 ioc7 ?input capture and output compare channel 7 pin . . . . . . . . . . . . . . . . . . . . 789 22.2.2 ioc6 ?input capture and output compare channel 6 pin . . . . . . . . . . . . . . . . . . . . 789 22.2.3 ioc5 ?input capture and output compare channel 5 pin . . . . . . . . . . . . . . . . . . . . 789 22.2.4 ioc4 ?input capture and output compare channel 4 pin . . . . . . . . . . . . . . . . . . . . 789 22.2.5 ioc3 ?input capture and output compare channel 3 pin . . . . . . . . . . . . . . . . . . . . 789 22.2.6 ioc2 ?input capture and output compare channel 2 pin . . . . . . . . . . . . . . . . . . . . 789 22.2.7 ioc1 ?input capture and output compare channel 1 pin . . . . . . . . . . . . . . . . . . . . 790 22.2.8 ioc0 ?input capture and output compare channel 0 pin . . . . . . . . . . . . . . . . . . . . 790 22.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 790 22.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 790 22.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 790 22.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 807 22.4.1 prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808 22.4.2 input capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 809 22.4.3 output compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 809 22.4.4 pulse accumulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810 22.4.5 event counter mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 10 22.4.6 gated time accumulation mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810 22.5 resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.6 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.6.1 channel [7:0] interrupt (c[7:0]f) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.6.2 pulse accumulator input interrupt (paovi) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.6.3 pulse accumulator over?w interrupt (paovf) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.6.4 timer over?w interrupt (tof) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 chapter 23 voltage regulator (s12vregl3v3v1) 23.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 23.1.1 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 23.1.2 modes of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 23.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 23.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 23.2.1 vddr ?regulator power input pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 23.2.2 vdda, vssa ?regulator reference supply pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 23.2.3 vdd, vss ?regulator output1 (core logic) pins . . . . . . . . . . . . . . . . . . . . . . . . . . 816 23.2.4 vddf ?regulator output2 (nvm logic) pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817 23.2.5 vddpll, vsspll ?regulator output3 (pll) pins . . . . . . . . . . . . . . . . . . . . . . . . . 817 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 21 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.2.6 vddx ?power input pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817 23.2.7 v regen optional regulator enable pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817 23.2.8 v reg_api optional autonomous periodical interrupt output pin . . . . . . . . . . . . . . 817 23.3 memory map and register de?ition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817 23.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 824 23.4.1 general . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 824 23.4.2 regulator core (reg) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 4 23.4.3 low-voltage detect (lvd) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 824 23.4.4 power-on reset (por) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825 23.4.5 low-voltage reset (lvr) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825 23.4.6 htd - high temperature detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825 23.4.7 regulator control (ctrl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825 23.4.8 autonomous periodical interrupt (api) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825 23.4.9 resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.10description of reset operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.11interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 chapter 24 128 kbyte flash module (s12xftm128k2v1) 24.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829 24.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 830 24.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 831 24.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832 24.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833 24.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834 24.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834 24.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 839 24.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860 24.4.1 flash command operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860 24.4.2 flash command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864 24.4.3 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883 24.4.4 wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885 24.4.5 stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885 24.5 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885 24.5.1 unsecuring the mcu using backdoor key access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886 24.5.2 unsecuring the mcu in special single chip mode using bdm . . . . . . . . . . . . . . . . . 887 24.5.3 mode and security effects on flash command availability . . . . . . . . . . . . . . . . . . . . . 887 24.6 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887 chapter 25 256 kbyte flash module (s12xftm256k2v1) 25.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 mc9s12xe-family reference manual , rev. 1.21 22 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 25.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 25.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891 25.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892 25.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893 25.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 25.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 25.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 899 25.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 920 25.4.1 flash command operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 920 25.4.2 flash command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 926 25.4.3 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 946 25.4.4 wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948 25.4.5 stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948 25.5 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948 25.5.1 unsecuring the mcu using backdoor key access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949 25.5.2 unsecuring the mcu in special single chip mode using bdm . . . . . . . . . . . . . . . . . 950 25.5.3 mode and security effects on flash command availability . . . . . . . . . . . . . . . . . . . . . 950 25.6 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 950 chapter 26 384 kbyte flash module (s12xftm384k2v1) 26.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952 26.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952 26.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953 26.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954 26.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 955 26.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 956 26.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 956 26.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 961 26.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 982 26.4.1 flash command operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 982 26.4.2 flash command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 987 26.4.3 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1008 26.4.4 wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1010 26.4.5 stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1010 26.5 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1010 26.5.1 unsecuring the mcu using backdoor key access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1011 26.5.2 unsecuring the mcu in special single chip mode using bdm . . . . . . . . . . . . . . . . 1012 26.5.3 mode and security effects on flash command availability . . . . . . . . . . . . . . . . . . . . 1012 26.6 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 chapter 27 512 kbyte flash module (s12xftm512k3v1) 27.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 23 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 27.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 27.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015 27.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016 27.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1017 27.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018 27.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018 27.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 023 27.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1044 27.4.1 flash command operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1044 27.4.2 flash command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048 27.4.3 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069 27.4.4 wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071 27.4.5 stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071 27.5 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071 27.5.1 unsecuring the mcu using backdoor key access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072 27.5.2 unsecuring the mcu in special single chip mode using bdm . . . . . . . . . . . . . . . . 1073 27.5.3 mode and security effects on flash command availability . . . . . . . . . . . . . . . . . . . . 1073 27.6 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 chapter 28 768 kbyte flash module (s12xftm768k4v2) 28.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076 28.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076 28.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077 28.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078 28.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079 28.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080 28.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080 28.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 085 28.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1106 28.4.1 flash command operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1106 28.4.2 flash command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1110 28.4.3 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1132 28.4.4 wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133 28.4.5 stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133 28.5 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133 28.5.1 unsecuring the mcu using backdoor key access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1134 28.5.2 unsecuring the mcu in special single chip mode using bdm . . . . . . . . . . . . . . . . 1135 28.5.3 mode and security effects on flash command availability . . . . . . . . . . . . . . . . . . . . 1135 28.6 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1135 chapter 29 1024 kbyte flash module (s12xftm1024k5v2) 29.1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1138 mc9s12xe-family reference manual , rev. 1.21 24 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 29.1.1 glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1138 29.1.2 features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1139 29.1.3 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140 29.2 external signal description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141 29.3 memory map and registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142 29.3.1 module memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142 29.3.2 register descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 148 29.4 functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1169 29.4.1 flash command operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1169 29.4.2 flash command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1173 29.4.3 interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1194 29.4.4 wait mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1196 29.4.5 stop mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1196 29.5 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1196 29.5.1 unsecuring the mcu using backdoor key access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197 29.5.2 unsecuring the mcu in special single chip mode using bdm . . . . . . . . . . . . . . . . 1198 29.5.3 mode and security effects on flash command availability . . . . . . . . . . . . . . . . . . . . 1198 29.6 initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198 appendix a electrical characteristics a.1 general . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199 a.1.1 parameter classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199 a.1.2 power supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199 a.1.3 pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1200 a.1.4 current injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 a.1.5 absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 a.1.6 esd protection and latch-up immunity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1202 a.1.7 operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 4 a.1.8 power dissipation and thermal characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1205 a.1.9 i/o characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1208 a.1.10 supply currents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1212 a.2 atd characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1217 a.2.1 atd operating characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1217 a.2.2 factors influencing accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1217 a.2.3 atd accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 219 a.3 nvm, flash and emulated eeprom. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1222 a.3.1 timing parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 22 a.3.2 nvm reliability parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1229 a.4 voltage regulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1231 a.5 output loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1231 a.5.1 resistive loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1232 a.5.2 capacitive loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1232 a.5.3 chip power-up and voltage drops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1232 a.6 reset, oscillator and pll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1233 mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 25 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.6.1 startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1233 a.6.2 oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 a.6.3 phase locked loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 6 a.7 external interface timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238 a.7.1 mscan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238 a.7.2 spi timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238 a.7.3 external bus timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 4 appendix b package information b.1 208 mapbga. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256 b.2 144-pin lqfp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256 b.3 112-pin lqfp package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258 b.4 80-pin qfp package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259 appendix c pcb layout guidelines appendix d derivative differences d.1 memory sizes and package options s12xe - family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1265 d.2 pinout explanations: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1267 appendix e detailed register address map appendix f ordering information mc9s12xe-family reference manual , rev. 1.21 26 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 27 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 1 device overview mc9s12xe-family 1.1 introduction the mc9s12xe-family of micro controllers is a further development of the s12xd-family including new features for enhanced system integrity and greater functionality. these new features include a memory protection unit (mpu) and error correction code (ecc) on the flash memory together with enhanced eeprom functionality (eee), an enhanced xgate, an internally ?tered, frequency modulated phase locked loop (ipll) and an enhanced atd. the e-family extends the s12x product range up to 1mb of flash memory with increased i/o capability in the 208-pin version of the ?gship mc9s12xe100. the mc9s12xe-family delivers 32-bit performance with all the advantages and ef?iencies of a 16 bit mcu. it retains the low cost, power consumption, emc and code-size ef?iency advantages currently enjoyed by users of freescale s existing 16-bit mc9s12 and s12x mcu families. there is a high level of compatibility between the s12xe and s12xd families. the mc9s12xe-family features an enhanced version of the performance-boosting xgate co-processor which is programmable in ??language and runs at twice the bus frequency of the s12x with an instruction set optimized for data movement, logic and bit manipulation instructions and which can service any peripheral module on the device. the new enhanced version has improved interrupt handling capability and is fully compatible with the existing xgate module. the mc9s12xe-family is composed of standard on-chip peripherals including up to 64kbytes of ram, eight asynchronous serial communications interfaces (sci), three serial peripheral interfaces (spi), an 8- channel ic/oc enhanced capture timer (ect), two 16-channel, 12-bit analog-to-digital converters, an 8- channel pulse-width modulator (pwm), ve can 2.0 a, b software compatible modules (mscan12), two inter-ic bus blocks (iic), an 8-channel 24-bit periodic interrupt timer (pit) and an 8-channel 16-bit standard timer module (tim). the mc9s12xe-family uses 16-bit wide accesses without wait states for all peripherals and memories. the non-multiplexed expanded bus interface available on the 144/208-pin versions allows an easy interface to external memories. in addition to the i/o ports available in each module, up to 26 further i/o ports are available with interrupt capability allowing wake-up from stop or wait modes. the mc9s12xe-family is available in 208- pin mapbga, 144-pin lqfp, 112-pin lqfp or 80-pin qfp options. 1.1.1 features features of the mc9s12xe-family are listed here. please see table d-2.for memory options and table d- 2. for the peripheral features that are available on the different family members. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 28 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16-bit cpu12x upward compatible with mc9s12 instruction set with the exception of ve fuzzy instructions (mem, wav, wavr, rev, revw) which have been removed enhanced indexed addressing access to large data segments independent of ppage int (interrupt module) eight levels of nested interrupts flexible assignment of interrupt sources to each interrupt level. external non-maskable high priority interrupt (xirq) internal non-maskable high priority memory protection unit interrupt up to 24 pins on ports j, h and p con?urable as rising or falling edge sensitive interrupts ebi (external bus interface)(available in 208-pin and 144-pin packages only) up to four chip select outputs to select 16k, 1m, 2m and up to 4mbyte address spaces each chip select output can be con?ured to complete transaction on either the time-out of one of the two wait state generators or the deassertion of ewait signal mmc (module mapping control) dbg (debug module) monitoring of cpu and/or xgate busses with tag-type or force-type breakpoint requests 64 x 64-bit circular trace buffer captures change-of-?w or memory access information bdm (background debug mode) mpu (memory protection unit) 8 address regions de?able per active program task address range granularity as low as 8-bytes no write / no execute protection attributes non-maskable interrupt on access violation xgate programmable, high performance i/o coprocessor module transfers data to or from all peripherals and ram without cpu intervention or cpu wait states performs logical, shifts, arithmetic, and bit operations on data can interrupt the hcs12x cpu signalling transfer completion triggers from any hardware module as well as from the cpu possible two interrupt levels to service high priority tasks hardware support for stack pointer initialisation osc_lcp (oscillator) low power loop control pierce oscillator utilizing a 4mhz to 16mhz crystal good noise immunity full-swing pierce option utilizing a 2mhz to 40mhz crystal transconductance sized for optimum start-up margin for typical crystals ipll (internally ?tered, frequency modulated phase-locked-loop clock generation) chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 29 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 no external components required con?urable option to spread spectrum for reduced emc radiation (frequency modulation) crg (clock and reset generation) cop watchdog real time interrupt clock monitor fast wake up from stop in self clock mode memory options 128k, 256k, 384k, 512k, 768k and 1m byte flash 2k, 4k byte emulated eeprom 12k, 16k, 24k, 32k, 48k and 64k byte ram flash general features 64 data bits plus 8 syndrome ecc (error correction code) bits allow single bit failure correction and double fault detection erase sector size 1024 bytes automated program and erase algorithm d-flash features up to 32 kbytes of d-flash memory with 256 byte sectors for user access. dedicated commands to control access to the d-flash memory over eee operation. single bit fault correction and double bit fault detection within a word during read operations. automated program and erase algorithm with verify and generation of ecc parity bits. fast sector erase and word program operation. ability to program up to four words in a burst sequence emulated eeprom features automatic eee ?e handling using an internal memory controller. automatic transfer of valid eee data from d-flash memory to buffer ram on reset. ability to monitor the number of outstanding eee related buffer ram words left to be programmed into d-flash memory. ability to disable eee operation and allow priority access to the d-flash memory. ability to cancel all pending eee operations and allow priority access to the d-flash memory. two 16-channel, 12-bit analog-to-digital converters 8/10/12 bit resolution ? s, 10-bit single conversion time left/right, signed/unsigned result data external and internal conversion trigger capability internal oscillator for conversion in stop modes wake from low power modes on analog comparison > or <= match five mscan (1 m bit per second, can 2.0 a, b software compatible modules) five receive and three transmit buffers chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 30 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 flexible identi?r ?ter programmable as 2 x 32 bit, 4 x 16 bit, or 8x8bit four separate interrupt channels for rx, tx, error, and wake-up low-pass ?ter wake-up function loop-back for self-test operation ect (enhanced capture timer) 8 x 16-bit channels for input capture or output compare 16-bit free-running counter with 8-bit precision prescaler 16-bit modulus down counter with 8-bit precision prescaler four 8-bit or two 16-bit pulse accumulators tim (standard timer module) 8 x 16-bit channels for input capture or output compare 16-bit free-running counter with 8-bit precision prescaler 1 x 16-bit pulse accumulator pit (periodic interrupt timer) up to eight timers with independent time-out periods time-out periods selectable between 1 and 2 24 bus clock cycles time-out interrupt and peripheral triggers 8 pwm (pulse-width modulator) channels 8 channel x 8-bit or 4 channel x 16-bit pulse width modulator programmable period and duty cycle per channel center- or left-aligned outputs programmable clock select logic with a wide range of frequencies fast emergency shutdown input three serial peripheral interface modules (spi) con?urable for 8 or 16-bit data size eight serial communication interfaces (sci) standard mark/space non-return-to-zero (nrz) format selectable irda 1.4 return-to-zero-inverted (rzi) format with programmable pulse widths two inter-ic bus (iic) modules multi-master operation software programmable for one of 256 different serial clock frequencies broadcast mode support 10-bit address support on-chip voltage regulator two parallel, linear voltage regulators with bandgap reference low-voltage detect (lvd) with low-voltage interrupt (lvi) power-on reset (por) circuit 3.3v and 5v range operation low-voltage reset (lvr) chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 31 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 low-power wake-up timer (api) available in all modes including full stop mode trimmable to +-5% accuracy time-out periods range from 0.2ms to ~13s with a 0.2ms resolution input/output up to 152 general-purpose input/output (i/o) pins plus 2 input-only pins hysteresis and con?urable pull up/pull down device on all input pins con?urable drive strength on all output pins package options 208-pin mapbga 144-pin low-pro?e quad ?t-pack (lqfp) 112-pin low-pro?e quad ?t-pack (lqfp) 80-pin quad ?t-pack (qfp) 50mhz maximum cpu bus frequency, 100mhz maximum xgate bus frequency 1.1.2 modes of operation memory map and bus interface modes: normal and emulation operating modes normal single-chip mode normal expanded mode emulation of single-chip mode emulation of expanded mode special operating modes special single-chip mode with active background debug mode special test mode ( freescale use only ) low-power modes: system stop modes pseudo stop mode full stop mode with fast wake-up option system wait mode operating system states supervisor state user state chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 32 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.1.3 block diagram figure 1-1 shows a block diagram of the mc9s12xe-family devices figure 1-1. mc9s12xe-family block diagram 12k ?64k bytes ram reset extal xtal 2k ?4k bytes eeprom bkgd vddr periodic interrupt clock monitor single-wire background test voltage regulator debug module vdd atd0 enhanced multilevel interrupt module ioc[7:0] pt[7:0] ptt ptad0 sci0 miso mosi ps3 ps0 ps1 ps2 sck ss spi0 pts an[15:0] pad[15:0] vddpll xgate x 16-bit 8 channel pr[7:0] ptr 8/10/12-bit 16-channel analog-digital converter enhanced capture timer ect ioc[7:0] 16-bit 8 channel timer tim atd1 ptad1 an[15:0] pad[31:16] 8/10/12-bit 16-channel analog-digital converter asynchronous serial if pp[7:0] ptp (int) pwm[7:0] 8-bit 8 channel pulse width modulator pwm pit pd[7:0] ptd pc[7:0] ptc data[15:8] data[7:0] pb[7:0] ptb addr[7:0] pa[7:0] pta addr[15:8] pk[7:0] ptk addr[22:16] ewait xirq xclks/eclkx2 irq eclk pe4 pe3 pe2 pe1 pe0 pe7 pe6 pe5 pte r w/ we lstrb/ lds moda/ taglo/ re modb/ taghi vddf 128k ?1m bytes flash cpu12x amplitude controlled low power pierce or full drive pierce oscillator cop watchdog ipll with frequency modulation option debug module 4 address breakpoints 2 data breakpoints 512 byte trace buffer reset generation and test entry rxd txd sci1 asynchronous serial if rxd txd ps7 ps4 ps5 ps6 miso mosi ph3 ph0 ph1 ph2 sck ss spi2 pth (wake-up int) ph7 ph4 ph5 ph6 miso mosi sck ss spi1 can0 pm3 pm0 pm1 pm2 ptm mscan 2.0b rxcan txcan can1 mscan 2.0b rxcan txcan pm7 pm4 pm5 pm6 can2 mscan 2.0b rxcan txcan can3 mscan 2.0b rxcan txcan sci4 pl3 pl0 pl1 pl2 ptl asynchronous serial if rxd txd sci5 asynchronous serial if rxd txd pl7 pl4 pl5 pl6 sci6 asynchronous serial if rxd txd sci7 asynchronous serial if rxd txd sci2 pj3 pj0 pj1 pj2 ptj (wake-up int.) asynchronous serial if rxd txd pj7 pj4 pj5 pj6 iic1 inter ic module sda scl can4 mscan 2.0b rxcan txcan pf3 pf0 pf1 pf2 ptf cs0 cs1 pf7 pf4 pf5 pf6 iic0 inter ic module sda scl sci3 asynchronous serial if rxd txd cs2 cs3 synchronous serial if synchronous serial if synchronous serial if non-multiplexed external bus interface async. periodic int. 8ch 16-bit timer memory protection mpu 8 regions int chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 33 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.1.4 device memory map table 1-1 shows the device register memory map. table 1-1. device register memory map address module size (bytes) 0x0000?x0009 pim (port integration module ) 10 0x000a?x000b mmc (memory map control) 2 0x000c?x000d pim (port integration module) 2 0x000e?x000f ebi (external bus interface) 2 0x0010?x0017 mmc (memory map control) 8 0x0018?x0019 reserved 2 0x001a?x001b device id register 2 0x001c?x001f pim (port integration module) 4 0x0020?x002f dbg (debug module) 16 0x0030?x0031 reserved 2 0x0032?x0033 pim (port integration module) 2 0x0034?x003f ecrg (clock and reset generator) 12 0x0040?x007f ect (enhanced capture timer 16-bit 8-channel)s 64 0x0080?x00af atd1 (analog-to-digital converter 12-bit 16-channel) 48 0x00b0?x00b7 iic1 (inter ic bus) 8 0x00b8?x00bf sci2 (serial communications interface) 8 0x00c0?x00c7 sci3 (serial communications interface) 8 0x00c8?x00cf sci0 (serial communications interface) 8 0x00d0?x00d7 sci1 (serial communications interface) 8 0x00d8?x00df spi0 (serial peripheral interface) 8 0x00e0?x00e7 iic0 (inter ic bus) 8 0x00e8?x00ef reserved 8 0x00f0?x00f7 spi1 (serial peripheral interface) 8 0x00f8?x00ff spi2 (serial peripheral interface) 8 0x0100?x0113 ftm control registers 20 0x0114?x011f mpu (memory protection unit) 12 0x0120?x012f int (interrupt module) 16 0x0130?x0137 sci4 (serial communications interface) 8 0x0138?x013f sci5 (serial communications interface) 8 0x0140?x017f can0 64 0x0180?x01bf can1 64 0x01c0?x01ff can2 64 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 34 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note reserved register space shown in table 1-1 is not allocated to any module. this register space is reserved for future use. writing to these locations have no effect. read access to these locations returns zero. 1.1.5 address mapping figure 1-2 shows s12xe cpu & bdm local address translation to the global memory map. it indicates also the location of the internal resources in the memory map. eeeprom size is presented like a ?ed 256 kbyte in the memory map. 0x0200?x023f can3 64 0x0240?x027f pim (port integration module) 64 0x0280?x02bf can4 64 0x02c0?x02ef atd0 (analog-to-digital converter 12 bit 16-channel) 48 0x02f0?x02f7 voltage regulator 8 0x02f8?x02ff reserved 8 0x0300?x0327 pwm (pulse-width modulator 8 channels) 40 0x0328?x032f reserved 8 0x0330?x0337 sci6 (serial communications interface) 8 0x0338?x033f sci7 (serial communications interface) 8 0x0340?x0367 pit (periodic interrupt timer) 40 0x0368?x037f pim (port integration module) 24 0x0380?x03bf xgate 64 0x03c0?x03cf reserved 16 0x03d0?x03ff tim (timer module) 48 0x0400?x07ff reserved 1024 table 1-1. device register memory map (continued) address module size (bytes) chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 35 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-2. mc9s12xe100 global memory map 0x7f_ffff 0x00_0000 0x13_ffff 0x0f_ffff 256 k eeeprom ram 0x00_07ff epage rpage ppage 0x3f_ffff cpu and bdm local memory map global memory map flashsize ramsize cs3 cs1 cs0 0x1f_ffff cs2 0xffff reset vectors 0xc000 0x8000 unpaged 0x4000 0x1000 0x0000 16k flash window 0x0c00 0x2000 0x0800 8k ram 4k ram window 1k eeprom 2k registers 1k eeprom window 16k flash unpaged 16k flash 2k registers unimplemented ram external space ram_low flash flash_low unimplemented flash resources note: on smaller derivatives the ?sh memory map is split into 2 ranges separated by an unimplemeted range, as depicted by the dashed lines. for more information refer to tables below and mmc section. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 36 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 unimplemented ram pages are mapped externally in expanded modes. accessing unimplemented ram pages in single chip modes causes an illegal address reset if the mpu is not con?ured to ?g an mpu protection error in that range. accessing unimplemented flash pages in single chip modes causes an illegal address reset if the mpu is not con?ured to ?g an mpu protection error in that range. the partid value should be referenced regarding the speci? memory map for any given device. for devices sharing the same part id, the memory regions which are implemented on the larger device but not supported on the smaller device are implemented but untested on that smaller device. these regions do not appear as unimplemented in the memory map and do not result in an illegal address reset if erroneously accessed. table 1-2. unimplemented range mapping to part id from the above the following examples can be derived. the 9s12xep768 is currently only available as a 9s12xep100 die, thus the unimplemented flash pages are those of the 9s12xep100 device map. the 9s12xeq384, 9s12xeg384, 9s12xes384 are currently only available as a 9s12xeq512 die, thus the unimplemented flash pages are those of the 9s12xeq512 device map. the 9s12xeg128 is currently only available as a 9s12xet256 die, thus the unimplemented flash pages are those of the 9s12xet256 device map. the range between 0x10_0000 and 0x13_ffff is mapped to eeprom resources. the actual eeprom and data?sh block sizes are listed in table 1-4 . within eeprom resource range an address range exists which is neither used by eeprom resources nor remapped to external resources via chip selects (see the ftm/mmc descriptions for details). these ranges do not constitute unimplemented areas. accessing reserved registers within the 2k register space does not generate an illegal address reset. the ?ed 8k ram default location in the global map is 0x0f_e000- 0x0f_ffff. this is subject to remapping when con?uring the local address map for a larger ram access range. mask set number part id ram_low ee_low flash blocks registers xm22e $cc8x 0x0f_0000 0x13_f000 b3, b2, b1s, b1n, b0 2k xm48h $cc9x 0x0f_0000 0x13_f000 b3, b2, b1s, b1n, b0 2k xm25j $c48x 0x0f_8000 0x13_f000 b1n, b1s, b0 2k xm53j $c08x 0x0f_c000 0x13_f000 b1s, b0(128k) 2k chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 37 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-3 shows xgate local address translation to the global memory map. it indicates also the location of used internal resources in the memory map. table 1-3. xgate resources table 1-4. derivative dependent memory parameters internal resource size /kbyte $address xgate ram 32k xgram_low = 0x0f_8000 flash 30k (1) 1. this value is calculated by the following formula: (64k -2k- xgramsize) xgflash_high = 0x78_8000 device flash_low ppage (1) 1. number of 16k pages addressable via ppage register ram_low rpage (2) 2. number of 4k pages addressing the ram. ram can also be mapped to 0x4000 - 0x7fff ee_low epage 9s12xep100 0x70_0000 64 0x0f_0000 16 0x13_f000 4 (3) + 32 (4) 3. number of 1k pages addressing the cache ram via the epage register counting downwards from 0xff 4. number of 1k pages addressing the data flash via the epage register starting upwards from 0x00 9s12xep768 0x74_0000 48 0x0f_4000 12 0x13_f000 4 + 32 9s12xeq512 0x78_0000 32 0x0f_8000 8 0x13_f000 4 + 32 9s12xex384 0x78_0000 (5) 5. the 384k memory map is split into a 128k block from 0x78_0000 to 0x79_ffff and a 256k block from 0x7c_0000 to 0x7f_ffff 24 0x0f_a000 6 0x13_f000 4 + 32 9s12xet256 9s12xea256 (6) 6. the 9s12xea devices are a special bondout for access to extra adc channels in 80qfp. available in 80qfp only. warning: not pin-compatible with rest of family. 0x78_0000 (7) 7. the 256k memory map is split into a 128k block from 0x78_0000 to 0x79_ffff and a 128k block from 0x7e_0000 to 0x7f_ffff 16 0x0f_c000 4 0x13_f000 4 + 32 9s12xeg128 9s12xea128 6 0x78_0000 (8) 8. the 128k memory map is split into a 64k block from 0x78_0000 to 0x78_ffff and a 64k block from 0x7f_0000 to 0x7f_ffff 8 0x0f_d000 3 0x13_f800 2 + 32 table 1-5. derivative dependent flash block mapping device 0x70_0000 0x74_0000 0x78_0000 0x7a_0000 0x7c_0000 0x7e_0000 9s12xep100 b3 b2 b1s b1n b0 9s12xep768 b2 b1s b1n b0 9s12xeq512 b1s b1n b0 9s12xex384 b1s b0 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 38 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 block b1 is divided into two 128k blocks. the xgate is always mapped to block b1s. on the 9s12xeg128 the ?sh is divided into two 64k blocks b0 and b1s, the b1s range extending from 0x78_0000 to 0x78_ffff, the b0 range extending from 0x7f_0000 to 0x7f_ffff. the block b0 is a reduced size 128k block on the 256k derivative. on the larger derivatives b0 is a 256k block. the block b0 is a reduced size 64k block on the 128k derivative. 9s12xet256 9s12xea256 (1) b1s b0(128k) 9s12xeg128 9s12xea128 1 b1s (64k) b0 (64k) 1. the 9s12xea devices are special bondouts for access to extra adc channels in 80qfp. available in 80qfp only. warning: not pin-compatible with rest of family. table 1-5. derivative dependent flash block mapping (continued) device 0x70_0000 0x74_0000 0x78_0000 0x7a_0000 0x7c_0000 0x7e_0000 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 39 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-3. xgate global address mapping 0x7f_ffff 0x00_0000 0x0f_ffff 0xffff 0x0000 registers flash ram 0x0800 registers 0x00_07ff xgate local memory map global memory map flashsize xgramsize ramsize 0x78_0800 flash ram xgram_low xgflash_high chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 40 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.1.6 detailed register map the detailed register map is listed in appendix a. 1.1.7 part id assignments the part id is located in two 8-bit registers partidh and partidl (addresses 0x001a and 0x001b). the read-only value is a unique part id for each revision of the chip. table 1-6 shows the assigned part id number and mask set number. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 41 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the version id is a word located in a ?sh information row at 0x40_00e8. the version id number indicates a speci? version of internal nvm variables used to patch nvm errata. the default is no patch (0xffff). 1.2 signal description table 1-6. assigned part id numbers device mask set number part id (1) 1. the coding is as follows: bit 15-12: major family identi?r bit 11-6: minor family identi?r bit 5-4: major mask set revision number including fab transfers bit 3-0: minor ?non full ?mask set revision version id mc9s12xep100 0m22e 0xcc80 0xffff mc9s12xep100 1m22e 0xcc80 0xffff mc9s12xep100 2m22e 0xcc82 0xffff mc9s12xep100 0m48h 0xcc90 0xffff mc9s12xep100 1m48h 0xcc91 0xffff mc9s12xep100 2m48h 0xcc92 0xffff mc9s12xep100 3m48h 0xcc93 0xffff mc9s12xep100 4m48h 0xcc94 0xffff mc9s12xep100 5m48h 0xcc94 0x0004 mc9s12xep768 (2) 2. currently available as mc9s12xep100 die only 4m48h 0xcc94 0xffff mc9s12xep768 2 5m48h 0xcc94 0x0004 mc9s12xeq512 0m25j 0xc480 0xffff mc9s12xeq512 1m25j 0xc481 0xffff mc9s12xeq512 2m25j 0xc482 0xffff mc9s12xeq512 3m25j 0xc482 0x0004 mc9s12xeq384 (3) 3. currently available as mc9s12xeq512 die only 2m25j 0xc482 0xffff mc9s12xeq384 3 3m25j 0xc482 0x0004 mc9s12xeg384 3 2m25j 0xc482 0xffff mc9s12xeg384 3 3m25j 0xc482 0x0004 mc9s12xes384 3 2m25j 0xc482 0xffff mc9s12xes384 3 3m25j 0xc482 0x0004 mc9s12xet256 0m53j 0xc080 0xffff mc9s12xet256 1m53j 0xc081 0xffff mc9s12xet256 2m53j 0xc081 0x0004 mc9s12xea256 1m53j 0xc081 0xffff mc9s12xea256 2m53j 0xc081 0x0004 mc9s12xeg128 (4) 4. currently available as mc9s12xet256 die only 1m53j 0xc081 0xffff mc9s12xeg128 4 2m53j 0xc081 0x0004 mc9s12xea128 4 1m53j 0xc081 0xffff mc9s12xea128 4 2m53j 0xc081 0x0004 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 42 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 this section describes signals that connect off-chip. it includes a pinout diagram, a table of signal properties, and detailed discussion of signals. it is built from the signal description sections of the block user guides of the individual ip blocks on the device. 1.2.1 device pinout the mc9s12xe-family offers pin-compatible packaged devices to assist with system development and accommodate expansion of the application. note smaller derivatives within the mc9s12xe-family feature a subset of the listed modules. refer to appendix d derivative differences for more information about derivative device module subset and to table 1-7. port availability by package option and table 1-9. pin-out summary for details of pins available in different package options. the mc9s12xe-family devices are offered in the following package options: 208-pin mapbga package with an external bus interface (address/data bus) 144-pin lqfp package with an external bus interface (address/data bus) 112-pin lqfp without external bus interface 80-pin qfp without external bus interface chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 43 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-4. - pin assignments, 208 mapbga package 12345678910111213141516 a n.c. n.c. pp7 pm0 pm1 pf5 pf3 pf1 pj6 ps6 ps5 ps3 pm6 pad19 n.c. n.c. b n.c. pp2 pp6 pf7 pf6 pf4 pf2 pf0 test ps4 ps1 pad23 pad21 pad18 pad31 n.c. c pj2 pp1 pp4 pp5 pk7 pm2 pm4 pj5 ps7 ps2 pm7 pad20 vrl pad16 pad07 pad14 d pk1 pj3 pp0 pp3 vddx pm3 pm5 pj4 pj7 vddx ps0 pad22 vrh pad17 pad30 pad29 e pk0 pk3 pk2 pk6 vssa pad15 pad06 pad28 f pr1 pr0 pt0 vddx vdda pad05 pad13 pad27 g pt2 pt3 pr2 pt1 vssx vssx vssx vssx vdda pad12 pad04 pad11 h pr3 pr4 pt4 vddf vssx vssx vssx vssx vssa pad26 pad03 pad10 j pt5 pr5 pt6 vss1 vssx vssx vssx vssx vss2 pad09 pad25 pad02 k pr6 pt7 pk4 pr7 vssx vssx vssx vssx vdd pd7 pad24 pad01 l pk5 pj1 bkgd vddx vddx pd4 pad00 pad08 m pj0 pc0 pb1 pc1 pa6 pa2 pd5 pd6 n pc2 pc3 pb2 pc7 pl1 pe6 vddx vddr vss3 ph3 ph1 vddx pe1 pa1 pa 5 pa 7 p pb0 pb3 pb4 pc4 pl2 pl0 pe4 reset pl7 pl6 ph0 pe2 pe0 pa0 pa 3 pa 4 r n.c. pb5 pb6 pb7 pc6 ph6 ph4 pe5 vss pll vdd pll ph2 pl4 pd1 pd3 pe3 n.c. t n.c. n.c. pc5 pl3 ph7 ph5 pe7 vss pll extal xtal vdd pll pl5 pd0 pd2 n.c. n.c. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 44 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-5. mc9s12xe-family pin assignments 144-pin lqfp package timioc3/ ss1/pwm3/kwp3/pp3 timioc2/sck1/pwm2/kwp2/pp2 timioc1/mosi1/pwm1/kwp1/pp1 timioc0/miso1/pwm0/kwp0/pp0 cs1/kwj2/pj2 acc/addr22/pk6 addr19/pk3 iqstat2/addr18/pk2 iqstat1/addr17/pk1 iqstat0/addr16/pk0 ioc0/pt0 ioc1/pt1 ioc2/pt2 ioc3/pt3 vddf vss1 ioc4/pt4 vregapi/ioc5/pt5 ioc6/pt6 ioc7/pt7 acc/addr21/pk5 acc/addr20/pk4 txd2/kwj1/pj1 rxd2/kwj0/pj0 modc/bkgd vddx4 vssx4 data8/pc0 data9/pc1 data10/pc2 data11/pc3 uds/addr0/pb0 addr1/pb1 addr2/pb2 addr3/pb3 addr4/pb4 addr5/pb5 addr6/pb6 addr7/pb7 data12/pc4 data13/pc5 data14/pc6 data15/pc7 txd5/ ss2/kwh7/ph7 rxd5/sck2/kwh6/ph6 txd4/mosi2/kwh5/ph5 rxd4/miso2/kwh4/ph 4 xclks/eclk2x/pe7 t a ghi/modb/pe6 re/ t a glo/moda/pe5 eclk/pe4 vssx2 vddx2 reset vddr vss3 vsspll extal xtal vddpll txd7/ ss1/kwh3/ph3 rxd7/sck1/kwh2/ph2 txd6/mosi1/kwh1/ph1 rxd6/miso1/kwh0/ph0 data0/pd0 data1/pd1 data2/pd2 data3/pd3 eromctl/ lds/ lstrb/pe3 we/r w/pe2 irq/pe1 xirq/pe0 vrh vdda1 pad17/an17 pad16/an16 pad15/an15 pad07/an07 pad14/an14 pad06/an06 pad13/an13 pad05/an05 pad12/an12 pad04/an04 pad11/an11 pad03/an03 pad10/an10 pad02/an02 pad09/an09 pad01/an01 pad08/an08 pad00/an00 vss2 vdd pd7/data7 pd6/data6 pd5/data5 pd4/data4 vddx3 vssx3 pa7/addr15 pa6/addr14 pa5/addr13 pa4/addr12 pa3/addr11 pa2/addr10 pa1/addr9 pa0/addr8 pp4/kwp4/pwm4/miso2/timioc4 pp5/kpw5/pwm5/mosi2/timioc5 pp6/kwp6/pwm6/ ss2/timioc6 pp7/kwp7/pwm7/sck2/timioc7 pk7/romctl/ ew ait vddx1 vssx1 pm0/rxcan0 pm1/txcan0 pm2/rxcan1/rxcan0/miso0 pm3/txcan1/txcan0/ ss0 pm4/rxcan2/rxcan0/rxcan4/mosi0 pm5/txcan2/txcan0/txcan4/sck0 pj4/kwj4/sda1/ cs0 pj5/kwj5/scl1/ cs2 pj6/kwj6/rxcan4/sda0/rxcan0 pj7/kwj7/txcan4/scl0/txacan0 test ps7/ ss0 ps6/sck0 ps5/mosi0 ps4/miso0 ps3/txd1 ps2/rxd1 ps1/txd0 ps0/rxd0 pm6/rxcan3/rxcan4/rxd3 pm7/txcan3/txcan4/txd3 pad23/an23 pad22/an22 pad21/an21 pad20/an20 pad19/an19 pad18/an18 vssa1 vrl pins shown in bold are not available on the 80 qfp package pins shown in bold-italics neither available on the 112 lqfp nor on the 80 qfp package option 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 mc9s12xe-family 144 lqfp chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 45 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-6. mc9s12xe-family pin assignments 112-pin lqfp package vrh vdda1 pad15/an15 pad07/an07 pad14/an14 pad06/an06 pad13/an13 pad05/an05 pad12/an12 pad04/an04 pad11/an11 pad03/an03 pad10/an10 pad02/an02 pad09/an09 pad01/an01 pad08/an08 pad00/an00 vss2 vdd pa7 pa6 pa5 pa4 pa3 pa2 pa1 pa0 pp4/kwp4/pwm4/miso2/timioc4 pp5/kpw5/pwm5/mosi2/timioc5 pp6/kwp6/pwm6/ ss2/timioc6 pp7/kwp7/pwm7/sck2/timioc7 pk7 vddx1 vssx1 pm0/rxcan0 pm1/txcan0 pm2/rxcan1/rxcan0/miso0 pm3/txcan1/txcan0/ ss0 pm4/rxcan2/rxcan0/rxcan4/mosi0 pm5/txcan2/txcan0/txcan4/sck0 pj6/kwj6/rxcan4/sda0/rxcan0 pj7/kwj7/txcan4/scl0/txcan0 test ps7/ ss0 ps6/sck0 ps5/mosi0 ps4/miso0 ps3/txd1 ps2/rxd1 ps1/txd0 ps0/rxd0 pm6/rxcan3/rxcan4/rxd3 pm7/txcan3/txcan4/txd3 vssa1 vrl timioc3/ ss1/pwm3/kwp3/pp3 timioc2/sck1/pwm2/kwp2/pp2 timioc1/mosi1/pwm1/kwp1/pp1 timioc0/miso1/pwm0/kwp0/pp0 pk3 pk2 pk1 pk0 ioc0/pt0 ioc1/pt1 ioc2/pt2 ioc3/pt3 vddf vss1 ioc4/pt4 vregapi/ioc5/pt5 ioc6/pt6 ioc7/pt7 pk5 pk4 txd2/kwj1/pj1 rxd2/kwj0/pj0 modc/bkgd pb0 pb1 pb2 pb3 pb4 pb5 pb6 pb7 txd5/ ss2/kwh7/ph7 rxd5/sck2/kwh6/ph6 txd4/mosi2/kwh5/ph5 rxd4/miso2/kwh4/ph4 eclk2x/ xclks/pe7 modb/pe6 moda/pe5 eclk/pe4 vssx2 vddx2 reset vddr vss3 vsspll extal xtal vddpll txd7/ ss1/kwh3/ph3 rxd7/sck1/kwh2/ph2 txd6/mosi1/kwh1/ph1 rxd6/miso1/kwh0/ph0 pe3 pe2 irq/pe1 xirq/pe0 pins shown in bold are not available on the 80 qfp package mc9s12xe-family 112lqfp 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 46 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-7. mc9s12xe-family pin assignments 80-pin qfp package 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 vrh vdda1 pad07/an07 pad06/an06 pad05/an05 pad04/an04 pad03/an03 pad02/an02 pad01/an01 pad00/an00 vss2 vdd pa 7 pa 6 pa 5 pa 4 pa 3 pa 2 pa 1 pa 0 pp4/kwp4/pwm4/miso2/timioc4 pp5/kwp5/pwm5/mosi2/timioc5 pp7/kwp7/pwm7/sck2/timioc7 vddx1 vssx1 pm0/rxcan0 pm1/txcan0 pm2/rxcan1/rxcan0/miso0 pm3/txcan1/txcan0/ ss0 pm4/rxcan2/rxcan0/rxcan4/mosi0 pm5/txcan2/txcan0/txcan4/sck0 pj6/kwj6/rxcan4/sda0/rxcan0 pj7/kwj7/txcan4/scl0/txcan0 test ps3/txd1 ps2/rxd1 ps1/txd0 ps0/rxd0 vssa1 vrl timioc3/ss1/pwm3/kwp3/pp3 timioc2/sck1/pwm2/kwp2/pp2 timioc1/mosi1/pwm1/kwp1/pp1 timioc0/miso1/pwm0/kwp0/pp0 ioc0/pt0 ioc1/pt1 ioc2/pt2 ioc3/pt3 vddf vss1 ioc4/pt4 vregapi/ioc5/pt5 ioc6/pt6 ioc7/pt7 modc/bkgd pb0 pb1 pb2 pb3 pb4 pb5 pb6 pb7 eclk2x/ xclks/pe7 modb/pe6 moda/pe5 eclk/pe4 vssx2 vddx2 reset vddr vss3 vsspll extal xtal vddpll pe3 pe2 irq/pe1 xirq/pe0 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 mc9s12xe-family 80qfp chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 47 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 1-8. mc9s12xea256/mc9s12xea128 80-pin qfp package pin assignment note special bond-out to provide access to extra adc channels in 80qfp. warning: not pin-compatible with rest of family. the mc9s12xet256 and mc9s12xeg128 use the standard 80qfp bond-out, compatible with other family members. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 vrh vdda1 pad07/an07 pad06/an06 pad05/an05 pad04/an04 pad11/an11 pad03/an03 pad10/an10 pad02/an02 pad09/an09 pad01/an01 pad08/an08 pad00/an00 vss2 vdd pa 3 pa 2 pa 1 pa 0 pp4/kwp4/pwm4/miso2/timioc4 pp5/kwp5/pwm5/mosi2/timioc5 pp7/kwp7/pwm7/sck2/timioc7 vddx1 vssx1 pm0/rxcan0 pm1/txcan0 pm2/rxcan1/rxcan0/miso0 pm3/txcan1/txcan0/ ss0 pm4/rxcan2/rxcan0/rxcan4/mosi0 pm5/txcan2/txcan0/txcan4/sck0 pj6/kwj6/rxcan4/sda0/rxcan0 pj7/kwj7/txcan4/scl0/txcan0 test ps3/txd1 ps2/rxd1 ps1/txd0 ps0/rxd0 vssa1 vrl timioc3/ss1/pwm3/kwp3/pp3 timioc2/sck1/pwm2/kwp2/pp2 timioc1/mosi1/pwm1/kwp1/pp1 timioc0/miso1/pwm0/kwp0/pp0 ioc0/pt0 ioc1/pt1 ioc2/pt2 ioc3/pt3 vddf vss1 ioc4/pt4 vregapi/ioc5/pt5 ioc6/pt6 ioc7/pt7 modc/bkgd pb0 pb1 pb2 pb3 pb4 pb5 pb6 pb7 eclk2x/ xclks/pe7 modb/pe6 moda/pe5 eclk/pe4 vssx2 vddx2 reset vddr vss3 vsspll extal xtal vddpll pe3 pe2 irq/pe1 xirq/pe0 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 mc9s12xea256 mc9s12xea128 80qfp chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 48 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.2 pin assignment overview table 1-7 provides a summary of which ports are available for each package option. routing of pin functions is summarized in table 1-8 . table 1-9 provides a pin out summary listing the availability of individual pins for each package option. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 49 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 1-10 provides a list of individual pin functionality table 1-7. port availability by package option port 208 mapbga 144 lqfp 112 lqfp standard 80 qfp xea256 (1) 80 qfp 1. the 9s12xea256 is a special bondout for access to extra adc channels in 80qfp. available in 80qfp / 256k memory size only. warning: not pin-compatible with rest of family. the 9s12xet256 is the standard 256k/80qfp bondout, compatible with other family members. port ad/adc channels 32/32 24/24 16/16 8/8 12/12 port a pins 88884 port b pins 88888 port c pins 88000 port d pins 88000 port e pins inc. irq/xirq input only 88888 port f 80000 port h 88800 port j 87422 port k 88700 port l 80000 port m 88866 port p 88877 port r 80000 port s 88844 port t 88888 sum of ports 152 119 91 59 59 i/o power pairs vddx/vssx 7/7 4/4 2/2 2/2 2/2 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 50 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 1-8. peripheral - port routing options (1) can0 can1 can2 can3 can4 sci0 sci1 sci2 sci3 sci4 sci5 sci6 sci7 spi0 spi1 spi2 iic0 iic1 cs0 cs1 cs2 cs3 tim pf[0] x pf[1] x pf[2] x pf[3] x pf[5:4] x pf[7:6] x ph[1:0] o x ph[3:2] o x ph[5:4] o x ph[7:6] o x pj[0] o o pj[1] o pj[2] o pj[3] pj[4] oo pj[5] oo pj[7:6] x o o pl[1:0] x pl[3:2] x pl[5:4] x pl[7:6] x pm[1:0] o pm[3:2] x o x pm[5:4] x o x x pm[7:6] o x o pp[3:0] o x pp[7:4] o x pr[7:0] o chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 51 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 ps[1:0] o ps[3:2] o ps[7:4] o 1. ??denotes reset condition, ??denotes a possible rerouting under software control table 1-9. pin-out summary (sheet 1 of 7) 208 mapbga lqfp 144 lqfp 112 qfp (1) 80 pin 2nd func. 3rd func. 4th func. 5th func. d4 1 1 1 pp3 kwp3 pwm3 ss1 timioc3 b2 2 2 2 pp2 kwp2 pwm2 sck1 timioc2 c2 3 3 3 pp1 kwp1 pwm1 mosi1 timioc1 d3 4 4 4 pp0 kwp0 pwm0 miso1 timioc0 d2 pj3 kwj3 c1 5 pj2 kwj2 cs1 e4 6 pk6 addr22 acc2 e2 7 5 pk3 addr19 iqstat3 e3 8 6 pk2 addr18 iqstat2 d1 9 7 pk1 addr17 iqstat1 e1 10 8 pk0 addr16 iqstat0 vddx vddx7 vssx vssx7 f3 11 9 5 pt0 ioc0 f2 pr0 timioc0 g4 12 10 6 pt1 ioc1 f1 pr1 timioc1 g1 13 11 7 pt2 ioc2 g3 pr2 timioc2 g2 14 12 8 pt3 ioc3 h1 pr3 timioc3 h4 15 13 9 vddf table 1-8. peripheral - port routing options (1) (continued) can0 can1 can2 can3 can4 sci0 sci1 sci2 sci3 sci4 sci5 sci6 sci7 spi0 spi1 spi2 iic0 iic1 cs0 cs1 cs2 cs3 tim chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 52 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 j4 16 14 10 vss1 h3 17 15 11 pt4 ioc4 h2 pr4 timioc4 j1 18 16 12 pt5 ioc5 vregapi j2 pr5 timioc5 j3 19 17 13 pt6 ioc6 k1 pr6 timioc6 k2 20 18 14 pt7 ioc7 k4 pr7 timioc7 l1 21 19 pk5 addr21 acc1 k3 22 20 pk4 addr20 acc0 l2 23 21 pj1 kwj1 txd2 m1 24 22 pj0 kwj0 rxd2 cs3 l3 25 23 15 bkgd modc vddx 26 vddx4 vssx 27 vssx4 m2 28 pc0 data8 m4 29 pc1 data9 n1 30 pc2 data10 n2 31 pc3 data11 p1 32 24 16 pb0 addr0 ivd0 uds m3 33 25 17 pb1 addr1 ivd1 n3 34 26 18 pb2 addr2 ivd2 p2 35 27 19 pb3 addr3 ivd3 p3 36 28 20 pb4 addr4 ivd4 r2 37 29 21 pb5 addr5 ivd5 r3 38 30 22 pb6 addr6 ivd6 r4 39 31 23 pb7 addr7 ivd7 p4 40 pc4 data12 table 1-9. pin-out summary (sheet 2 of 7) 208 mapbga lqfp 144 lqfp 112 qfp (1) 80 pin 2nd func. 3rd func. 4th func. 5th func. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 53 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 t3 41 pc5 data13 r5 42 pc6 data14 n4 43 pc7 data15 t4 pl3 txd5 t5 44 32 ph7 kwh7 ss2 txd5 p5 pl2 rxd5 r6 45 33 ph6 kwh6 sck2 rxd5 n5 pl1 txd4 t6 46 34 ph5 kwh5 mosi2 txd4 p6 pl0 rxd4 r7 47 35 ph4 kwh4 miso2 rxd4 t7 48 36 24 pe7 xclks eclkx2 n6 49 37 25 pe6 modb t a ghi r8 50 38 26 pe5 moda t a glo re p7 51 39 27 pe4 eclk vssx 52 40 28 vssx2 vddx 53 41 29 vddx2 p8 54 42 30 reset n8 55 43 31 vddr n9 56 44 32 vss3 r9/t8 57 45 33 vsspll t9 58 46 34 extal t10 59 47 35 xtal r10/t11 60 48 36 vddpll p9 pl7 txd7 n10 61 49 ph3 kwh3 ss1 txd7 p10 pl6 rxd7 r11 62 50 ph2 kwh2 sck1 rxd7 t12 pl5 txd6 table 1-9. pin-out summary (sheet 3 of 7) 208 mapbga lqfp 144 lqfp 112 qfp (1) 80 pin 2nd func. 3rd func. 4th func. 5th func. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 54 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 n11 63 51 ph1 kwh1 mosi1 txd6 r12 pl4 rxd6 p11 64 52 ph0 kwh0 miso1 rxd6 t13 65 pd0 data0 r13 66 pd1 data1 t14 67 pd2 data2 r14 68 pd3 data3 vddx vddx5 vssx vssx5 r15 69 53 37 pe3 lstrb lds eromctl p12 70 54 38 pe2 r w we n13 71 55 39 pe1 irq p13 72 56 40 pe0 xirq p14 73 57 41 pa0 addr8 ivd8 n14 74 58 42 pa1 addr9 ivd9 m14 75 59 43 pa2 addr10 ivd10 p15 76 60 44 pa3 addr11 ivd11 p16 77 61 45 pa4 addr12 ivd12 n15 78 62 46 pa5 addr13 ivd13 m13 79 63 47 pa6 addr14 ivd14 n16 80 64 48 pa7 addr15 ivd15 vssx 81 vssx3 vddx 82 vddx3 l14 83 pd4 data4 m15 84 pd5 data5 m16 85 pd6 data6 k14 86 pd7 data7 k13 87 65 49 vdd j13 88 66 50 vss2 table 1-9. pin-out summary (sheet 4 of 7) 208 mapbga lqfp 144 lqfp 112 qfp (1) 80 pin 2nd func. 3rd func. 4th func. 5th func. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 55 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 l15 89 67 51 pad00 an00 l16 90 68 pad08 an08 k15 pad24 an24 k16 91 69 52 pad01 an01 j14 92 70 pad09 an09 j15 pad25 an25 j16 93 71 53 pad02 an02 h16 94 72 pad10 an10 h14 pad26 an26 h13 vssa2 g13 vdda2 h15 95 73 54 pad03 an03 g16 96 74 pad11 an11 f16 pad27 an27 g15 97 75 55 pad04 an04 g14 98 76 pad12 an12 e16 pad28 an28 f14 99 77 56 pad05 an05 f15 100 78 pad13 an13 d16 pad29 an29 e15 101 79 57 pad06 an06 c16 102 80 pad14 an14 d15 pad30 an30 c15 103 81 58 pad07 an07 e14 104 82 pad15 an15 b15 pad31 an31 c14 105 pad16 an16 d14 106 pad17 an17 f13 107 83 59 vdda1 table 1-9. pin-out summary (sheet 5 of 7) 208 mapbga lqfp 144 lqfp 112 qfp (1) 80 pin 2nd func. 3rd func. 4th func. 5th func. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 56 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 d13 108 84 60 vrh c13 109 85 61 vrl e13 110 86 62 vssa1 b14 111 pad18 an18 a14 112 pad19 an19 c12 113 pad20 an20 b13 114 pad21 an21 d12 115 pad22 an22 b12 116 pad23 an23 c11 117 87 pm7 txcan3 txcan4 txd3 a13 118 88 pm6 rxcan3 rxcan4 rxd3 d11 119 89 63 ps0 rxd0 b11 120 90 64 ps1 txd0 c10 121 91 65 ps2 rxd1 a12 122 92 66 ps3 txd1 vssx vssx6 vddx vddx6 b10 123 93 ps4 miso0 a11 124 94 ps5 mosi0 a10 125 95 ps6 sck0 c9 126 96 ps7 ss0 b9 127 97 67 test d9 128 98 68 pj7 kwj7 txcan4 scl0 txcan0 a9 129 99 69 pj6 kwj6 rxcan4 sda0 rxcan0 c8 130 pj5 kwj5 scl1 cs2 b8 pf0 cs0 d8 131 pj4 kwj4 sda1 cs0 a8 pf1 cs1 d7 132 100 70 pm5 txcan2 txcan0 txcan4 sck0 table 1-9. pin-out summary (sheet 6 of 7) 208 mapbga lqfp 144 lqfp 112 qfp (1) 80 pin 2nd func. 3rd func. 4th func. 5th func. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 57 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 b7 pf2 cs2 c7 133 101 71 pm4 rxcan2 rxcan0 rxcan4 mosi0 a7 pf3 cs3 d6 134 102 72 pm3 txcan1 txcan0 ss0 b6 pf4 sda0 c6 135 103 73 pm2 rxcan1 rxcan0 miso0 a6 pf5 scl0 a5 136 104 74 pm1 txcan0 b5 pf6 rxd3 a4 137 105 75 pm0 rxcan0 b4 pf7 txd3 vssx 138 106 76 vssx1 vddx 139 107 77 vddx1 c5 140 108 pk7 romctl ew ait a3 141 109 78 pp7 kwp7 pwm7 sck2 timioc7 b3 142 110 pp6 kwp6 pwm6 ss2 timioc6 c4 143 111 79 pp5 kwp5 pwm5 mosi2 timioc5 c3 144 112 80 pp4 kwp4 pwm4 miso2 timioc4 1. standard 80qfp only. note that xea256 80qfp is not compatible table 1-9. pin-out summary (sheet 7 of 7) 208 mapbga lqfp 144 lqfp 112 qfp (1) 80 pin 2nd func. 3rd func. 4th func. 5th func. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 58 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 1-10. signal properties summary (sheet 1 of 4) pin name function 1 pin name function 2 pin name function 3 pin name function 4 pin name function 5 power supply internal pull resistor description ctrl reset state extal v ddpll na na oscillator pins xtal v ddpll na na reset v ddx pullup external reset test n.a. reset pin down test input bkgd modc v ddx always on up background debug pad[31:16] an[31:16] v dda per0ad1 per1ad1 disabled port ad inputs of atd1, analog inputs of atd1 pad[15:0] an[15:0] v dda per0ad0 per1ad0 disabled port ad inputs of atd0, analog inputs of atd0 pa[7:0] addr[15:8] ivd[15:8] v ddx pucr disabled port a i/o, address bus, internal visibility data pb[7:1] addr[7:1] ivd[7:0] v ddx pucr disabled port b i/o, address bus, internal visibility data pb0 addr0 uds v ddx pucr disabled port b i/o, address bus, upper data strobe pc[7:0] data[15:8] v ddx pucr disabled port c i/o, data bus pd[7:0] data[7:0] v ddx pucr disabled port d i/o, data bus pe7 eclkx2 xclks v ddx pucr up port e i/o, system clock output, clock select pe6 t a ghi modb v ddx while reset pin is low: down port e i/o, tag high, mode input pe5 re moda t a glo v ddx while reset pin is low: down port e i/o, read enable, mode input, tag low input pe4 eclk v ddx pucr up port e i/o, bus clock output pe3 lstrb lds eromctl v ddx pucr up port e i/o, low byte data strobe, eromon control pe2 r/ w we v ddx pucr up port e i/o, read/write pe1 irq v ddx pucr up port e input, maskable interrupt pe0 xirq v ddx pucr up port e input, non-maskable interrupt pf7 txd3 v ddx perf/ ppsf up port f i/o, interrupt, txd of sci3 pf6 rxd3 v ddx perf/ ppsf up port f i/o, interrupt, rxd of sci3 pf5 scl0 v ddx perf/ ppsf up port f i/o, interrupt, scl of iic0 pf4 sda0 v ddx perf/ ppsf up port f i/o, interrupt, sda of iic0 pf3 cs3 v ddx perf/ ppsf up port f i/o, interrupt, chip select 3 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 59 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 pf2 cs2 v ddx perf/ ppsf up port f i/o, interrupt, chip select 2 pf1 cs1 v ddx perf/ ppsf up port f i/o, interrupt, chip select 1 pf0 cs0 v ddx perf/ ppsf up port f i/o, interrupt, chip select 0 ph7 kwh7 ss2 txd5 v ddx perh/ ppsh disabled port h i/o, interrupt, ss of spi2, txd of sci5 ph6 kwh6 sck2 rxd5 v ddx perh/ ppsh disabled port h i/o, interrupt, sck of spi2, rxd of sci5 ph5 kwh5 mosi2 txd4 v ddx perh/ ppsh disabled port h i/o, interrupt, mosi of spi2, txd of sci4 ph4 kwh4 miso2 rxd4 v ddx perh/ppsh disabled port h i/o, interrupt, miso of spi2, rxd of sci4 ph3 kwh3 ss1 txd7 v ddx perh/ppsh disabled port h i/o, interrupt, ss of spi1 ph2 kwh2 sck1 rxd7 v ddx perh/ppsh disabled port h i/o, interrupt, sck of spi1 ph1 kwh1 mosi1 txd6 v ddx perh/ppsh disabled port h i/o, interrupt, mosi of spi1 ph0 kwh0 miso1 rxd6 v ddx perh/ppsh disabled port h i/o, interrupt, miso of spi1 pj7 kwj7 txcan4 scl0 txcan0 v ddx perj/ ppsj up port j i/o, interrupt, tx of can4, scl of iic0, tx of can0 pj6 kwj6 rxcan4 sda0 rxcan0 v ddx perj/ ppsj up port j i/o, interrupt, rx of can4, sda of iic0, rx of can0 pj5 kwj5 scl1 cs2 v ddx perj/ ppsj up port j i/o, interrupt, scl of iic1, chip select 2 pj4 kwj4 sda1 cs0 v ddx perj/ ppsj up port j i/o, interrupt, sda of iic1, chip select 0 pj3 kwj3 v ddx perj/ ppsj up port j i/o, interrupt, pj2 kwj2 cs1 v ddx perj/ ppsj up port j i/o, interrupt, chip select 1 pj1 kwj1 txd2 v ddx perj/ ppsj up port j i/o, interrupt, txd of sci2 pj0 kwj0 rxd2 cs3 v ddx perj/ ppsj up port j i/o, interrupt, rxd of sci2 pk7 ew ait romctl v ddx pucr up port k i/o, ewait input , rom on control table 1-10. signal properties summary (sheet 2 of 4) pin name function 1 pin name function 2 pin name function 3 pin name function 4 pin name function 5 power supply internal pull resistor description ctrl reset state chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 60 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 pk[6:4] addr [22:20] acc[2:0] v ddx pucr up port k i/o, extended addresses, access source for external access pk[3:0] addr [19:16] iqstat [3:0] v ddx pucr up extended address, pipe status pl7 txd7 v ddx perl/ ppsl up port l i/o, txd of sci7 pl6 rxd7 v ddx perl/ ppsl up port li/o, rxd of sci7 pl5 txd6 v ddx perl/ ppsl up port l i/o, txd of sci6 pl4 rxd6 v ddx perl/ ppsl up port li/o, rxd of sci6 pl3 txd5 v ddx perl/ ppsl up port l i/o, txd of sci5 pl2 rxd5 v ddx perl/ ppsl up port li/o, rxd of sci5 pl1 txd4 v ddx perl/ ppsl up port l i/o, txd of sci4 pl0 rxd4 v ddx perl/ ppsl up port li/o, rxd of sci4 pm7 txcan3 txd3 txcan4 v ddx perm/ ppsm disabled port m i/o, tx of can3 and can4, txd of sci3 pm6 rxcan3 rxd3 rxcan4 v ddx perm/ppsm disabled port m i/o rx of can3 and can4, rxd of sci3 pm5 txcan2 txcan0 txcan4 sck0 v ddx perm/ppsm disabled port m i/ocan0, can2, can4, sck of spi0 pm4 rxcan2 rxcan0 rxcan4 mosi0 v ddx perm/ppsm disabled port m i/o, can0, can2, can4, mosi of spi0 pm3 txcan1 txcan0 ss0 v ddx perm/ppsm disabled port m i/o tx of can1, can0, ss of spi0 pm2 rxcan1 rxcan0 miso0 v ddx perm/ppsm disabled port m i/o, rx of can1, can0, miso of spi0 pm1 txcan0 v ddx perm/ppsm disabled port m i/o, tx of can0 pm0 rxcan0 v ddx perm/ppsm disabled port m i/o, rx of can0 pp7 kwp7 pwm7 sck2 timioc7 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 7 of pwm/tim , sck of spi2 pp6 kwp6 pwm6 ss2 timioc6 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 6 of pwm/tim, ss of spi2 pp5 kwp5 pwm5 mosi2 timioc5 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 5 of pwm/tim, mosi of spi2 table 1-10. signal properties summary (sheet 3 of 4) pin name function 1 pin name function 2 pin name function 3 pin name function 4 pin name function 5 power supply internal pull resistor description ctrl reset state chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 61 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 pp4 kwp4 pwm4 miso2 timioc4 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 4 of pwm/tim, miso2 of spi2 pp3 kwp3 pwm3 ss1 timioc3 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 3 of pwm/tim, ss of spi1 pp2 kwp2 pwm2 sck1 timioc2 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 2 of pwm/tim, sck of spi1 pp1 kwp1 pwm1 mosi1 timioc1 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 1 of pwm/tim, mosi of spi1 pp0 kwp0 pwm0 miso1 timioc0 v ddx perp/ ppsp disabled port p i/o, interrupt, channel 0 of pwm/tim, miso2 of spi1 pr[7:0] timioc [7:0] v ddx perr/ ppsr disabled port ri/o, tim channels ps7 ss0 v ddx pers/ ppss up port s i/o, ss of spi0 ps6 sck0 v ddx pers/ ppss up port s i/o, sck of spi0 ps5 mosi0 v ddx pers/ ppss up port s i/o, mosi of spi0 ps4 miso0 v ddx pers/ ppss up port s i/o, miso of spi0 ps3 txd1 v ddx pers/ ppss up port s i/o, txd of sci1 ps2 rxd1 v ddx pers/ ppss up port s i/o, rxd of sci1 ps1 txd0 v ddx pers/ ppss up port s i/o, txd of sci0 ps0 rxd0 v ddx pers/ ppss up port s i/o, rxd of sci0 pt[7:6] ioc[7:6] v ddx pert/ ppst disabled port t i/o, ect channels pt[5] ioc[5] vregapi v ddx pert/ ppst disabled port t i/o, ect channels pt[4:0] ioc[4:0] v ddx pert/ ppst disabled port t i/o, ect channels table 1-10. signal properties summary (sheet 4 of 4) pin name function 1 pin name function 2 pin name function 3 pin name function 4 pin name function 5 power supply internal pull resistor description ctrl reset state chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 62 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3 detailed signal descriptions note the pin list of the largest package version of each mc9s12xe-family derivative gives the complete of interface signals that also exist on smaller package options, although some of them are not bonded out. for devices assembled in smaller packages all non-bonded out pins should be con?ured as outputs after reset in order to avoid current drawn from ?ating inputs. refer to table 1-10 for affected pins. particular attention is drawn to port r, which does not have enabled pull-up/pull-down devices coming out of reset. 1.2.3.1 extal, xtal ?oscillator pins extal and xtal are the crystal driver and external clock pins. on reset all the device clocks are derived from the extal input frequency. xtal is the oscillator output. 1.2.3.2 reset ?external reset pin the reset pin is an active low bidirectional control signal. it acts as an input to initialize the mcu to a known start-up state. as an output it is driven low to indicate when any internal mcu reset source triggers. the reset pin has an internal pull-up device. 1.2.3.3 test ?test pin this input only pin is reserved for test. this pin has a pull-down device. note the test pin must be tied to v ss in all applications. 1.2.3.4 bkgd / modc ?background debug and mode pin the bkgd/modc pin is used as a pseudo-open-drain pin for the background debug communication. it is used as a mcu operating mode select pin during reset. the state of this pin is latched to the modc bit at the rising edge of reset. the bkgd pin has a pull-up device. 1.2.3.5 pad[15:0] / an[15:0] ?port ad input pins of atd0 pad[15:0] are general-purpose input or output pins and analog inputs an[15:0] of the analog-to-digital converter atd0. 1.2.3.6 pad[31:16] / an[31:16] ?port ad input pins of atd1 pad[31:16] are general-purpose input or output pins and analog inputs an[31:16] of the analog-to-digital converter atd1. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 63 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.7 pa[7:0] / addr[15:8] / ivd[15:8] ?port a i/o pins pa[7:0] are general-purpose input or output pins. in mcu expanded modes of operation, these pins are used for the external address bus. in mcu emulation modes of operation, these pins are used for external address bus and internal visibility read data. 1.2.3.8 pb[7:1] / addr[7:1] / ivd[7:1] ?port b i/o pins pb[7:1] are general-purpose input or output pins. in mcu expanded modes of operation, these pins are used for the external address bus. in mcu emulation modes of operation, these pins are used for external address bus and internal visibility read data. 1.2.3.9 pb0 / addr0 / uds / ivd[0] ?port b i/o pin 0 pb0 is a general-purpose input or output pin. in mcu expanded modes of operation, this pin is used for the external address bus addr0 or as upper data strobe signal. in mcu emulation modes of operation, this pin is used for external address bus addr0 and internal visibility read data ivd0. 1.2.3.10 pc[7:0] / data [15:8] ?port c i/o pins pc[7:0] are general-purpose input or output pins. in mcu expanded modes of operation, these pins are used for the external data bus. the input voltage thresholds for pc[7:0] can be con?ured to reduced levels, to allow data from an external 3.3-v peripheral to be read by the mcu operating at 5.0 v. the input voltage thresholds for pc[7:0] are con?ured to reduced levels out of reset in expanded and emulation modes. the input voltage thresholds for pc[7:0] are con?ured to 5-v levels out of reset in normal modes. 1.2.3.11 pd[7:0] / data [7:0] ?port d i/o pins pd[7:0] are general-purpose input or output pins. in mcu expanded modes of operation, these pins are used for the external data bus. the input voltage thresholds for pd[7:0] can be con?ured to reduced levels, to allow data from an external 3.3-v peripheral to be read by the mcu operating at 5.0 v. the input voltage thresholds for pd[7:0] are con?ured to reduced levels out of reset in expanded and emulation modes. the input voltage thresholds for pc[7:0] are con?ured to 5-v levels out of reset in normal modes. 1.2.3.12 pe7 / eclkx2 / xclks ?port e i/o pin 7 pe7 is a general-purpose input or output pin. eclkx2 is a free running clock of twice the internal bus frequency, available by default in emulation modes and when enabled in other modes. the xclks is an input signal which controls whether a crystal in combination with the internal loop controlled pierce oscillator is used or whether full swing pierce oscillator/external clock circuitry is used (refer to oscillator con?uration ). an internal pullup is enabled during reset. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 64 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.13 pe6 / modb / t a ghi ?port e i/o pin 6 pe6 is a general-purpose input or output pin. it is used as a mcu operating mode select pin during reset. the state of this pin is latched to the modb bit at the rising edge of reset. this pin is an input with a pull-down device which is only active when reset is low. t a ghi is used to tag the high half of the instruction word being read into the instruction queue. the input voltage threshold for pe6 can be con?ured to reduced levels, to allow data from an external 3.3-v peripheral to be read by the mcu operating at 5.0 v. the input voltage threshold for pe6 is con?ured to reduced levels out of reset in expanded and emulation modes. 1.2.3.14 pe5 / moda / t a glo / re ?port e i/o pin 5 pe5 is a general-purpose input or output pin. it is used as an mcu operating mode select pin during reset. the state of this pin is latched to the moda bit at the rising edge of reset. this pin is shared with the read enable re output. this pin is an input with a pull-down device which is only active when reset is low. t a glo is used to tag the low half of the instruction word being read into the instruction queue. the input voltage threshold for pe5 can be con?ured to reduced levels, to allow data from an external 3.3-v peripheral to be read by the mcu operating at 5.0 v. the input voltage threshold for pe5 is con?ured to reduced levels out of reset in expanded and emulation modes. 1.2.3.15 pe4 / eclk ?port e i/o pin 4 pe4 is a general-purpose input or output pin. it can be con?ured to drive the internal bus clock eclk. eclk can be used as a timing reference. the eclk output has a programmable prescaler. 1.2.3.16 pe3 / lstrb / lds / eromctl?port e i/o pin 3 pe3 is a general-purpose input or output pin. in mcu expanded modes of operation, lstrb or lds can be used for the low byte strobe function to indicate the type of bus access. at the rising edge of reset the state of this pin is latched to the eromon bit. 1.2.3.17 pe2 / r/ w / we port e i/o pin 2 pe2 is a general-purpose input or output pin. in mcu expanded modes of operations, this pin drives the read/write output signal or write enable output signal for the external bus. it indicates the direction of data on the external bus. 1.2.3.18 pe1 / irq ?port e input pin 1 pe1 is a general-purpose input pin and the maskable interrupt request input that provides a means of applying asynchronous interrupt requests. this will wake up the mcu from stop or wait mode. 1.2.3.19 pe0 / xirq ?port e input pin 0 pe0 is a general-purpose input pin and the non-maskable interrupt request input that provides a means of applying asynchronous interrupt requests. this will wake up the mcu from stop or wait mode. the xirq chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 65 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 interrupt is level sensitive and active low. as xirq is level sensitive, while this pin is low the mcu will not enter stop mode. 1.2.3.20 pf7 / txd3 ?port f i/o pin 7 pf7 is a general-purpose input or output pin. it can be con?ured as the transmit pin txd of serial communication interface 3 (sci3). 1.2.3.21 pf6 / rxd3 ?port f i/o pin 6 pf6 is a general-purpose input or output pin. it can be con?ured as the transmit pin rxd of serial communication interface 3 (sci3). 1.2.3.22 pf5 / scl0 ?port f i/o pin 5 pf5 is a general-purpose input or output pin. it can be con?ured as the serial clock pin scl of the iic0 module. 1.2.3.23 pf4 / sda0 ?port f i/o pin 4 pf4 is a general-purpose input or output pin. it can be con?ured as the serial data pin sda of the iic0 module. 1.2.3.24 pf[3:0] / cs[3:0] ?port f i/o pins 3 to 0 pf[3:0] are a general-purpose input or output pins. they can be con?ured as chip select outputs [3:0]. 1.2.3.25 ph7 / kwh7 / ss2 / txd5 ?port h i/o pin 7 ph7 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as slave select pin ss of the serial peripheral interface 2 (spi2). it can be con?ured as the transmit pin txd of serial communication interface 5 (sci5). 1.2.3.26 ph6 / kwh6 / sck2 / rxd5 ?port h i/o pin 6 ph6 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as serial clock pin sck of the serial peripheral interface 2 (spi2). it can be con?ured as the receive pin (rxd) of serial communication interface 5 (sci5). 1.2.3.27 ph5 / kwh5 / mosi2 / txd4 ?port h i/o pin 5 ph5 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as master output (during master mode) or slave input pin (during slave mode) mosi of the serial peripheral interface 2 (spi2). it can be con?ured as the transmit pin txd of serial communication interface 4 (sci4). chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 66 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.28 ph4 / kwh4 / miso2 / rxd4 ?port h i/o pin 4 ph4 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as master input (during master mode) or slave output (during slave mode) pin miso of the serial peripheral interface 2 (spi2). it can be con?ured as the receive pin rxd of serial communication interface 4 (sci4). 1.2.3.29 ph3 / kwh3 / ss1 ?port h i/o pin 3 ph3 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as slave select pin ss of the serial peripheral interface 1 (spi1). it can also be con?ured as the transmit pin txd of serial communication interface 7 (sci7). 1.2.3.30 ph2 / kwh2 / sck1 ?port h i/o pin 2 ph2 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as serial clock pin sck of the serial peripheral interface 1 (spi1). it can be con?ured as the receive pin rxd of serial communication interface 7 (sci7). 1.2.3.31 ph1 / kwh1 / mosi1 ?port h i/o pin 1 ph1 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as master output (during master mode) or slave input pin (during slave mode) mosi of the serial peripheral interface 1 (spi1). it can also be con?ured as the transmit pin txd of serial communication interface 6 (sci6). 1.2.3.32 ph0 / kwh0 / miso1 ?port h i/o pin 0 ph0 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as master input (during master mode) or slave output (during slave mode) pin miso of the serial peripheral interface 1 (spi1). it can be con?ured as the receive pin rxd of serial communication interface 6 (sci6). 1.2.3.33 pj7 / kwj7 / txcan4 / scl0 / txcan0?port j i/o pin 7 pj7 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as the transmit pin txcan for the scalable controller area network controller 0 or 4 (can0 or can4) or as the serial clock pin scl of the iic0 module. 1.2.3.34 pj6 / kwj6 / rxcan4 / sda0 / rxcan0 ?port j i/o pin 6 pj6 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as the receive pin rxcan for the scalable controller area network controller 0 or 4 (can0 or can4) or as the serial data pin sda of the iic0 module. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 67 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.35 pj5 / kwj5 / scl1 / cs2 ?port j i/o pin 5 pj5 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as the serial clock pin scl of the iic1 module. it can be also con?ured as chip-select output 2. 1.2.3.36 pj4 / kwj4 / sda1 / cs0 ?port j i/o pin 4 pj4 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as the serial data pin sda of the iic1 module. it can also be con?ured as chip-select output. 1.2.3.37 pj3 / kwj3 ?port j i/o pin 3 pj3 is a general-purpose input or output pins. it can be con?ured as a keypad wakeup input. 1.2.3.38 pj2 / kwj2 / cs1 ?port j i/o pin 2 pj2 is a general-purpose input or output pins. it can be con?ured as a keypad wakeup input. it can also be con?ured as chip-select output. 1.2.3.39 pj1 / kwj1 / txd2 ?port j i/o pin 1 pj1 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as the transmit pin txd of the serial communication interface 2 (sci2). 1.2.3.40 pj0 / kwj0 / rxd2 / cs3 ?port j i/o pin 0 pj0 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as the receive pin rxd of the serial communication interface 2 (sci2).it can also be con?ured as chip-select output 3. 1.2.3.41 pk7 / ew ait / romctl ?port k i/o pin 7 pk7 is a general-purpose input or output pin. during mcu emulation modes and normal expanded modes of operation, this pin is used to enable the flash eeprom memory in the memory map (romctl). at the rising edge of reset, the state of this pin is latched to the romon bit. the ew ait input signal maintains the external bus access until the external device is ready to capture data (write) or provide data (read). the input voltage threshold for pk7 can be con?ured to reduced levels, to allow data from an external 3.3-v peripheral to be read by the mcu operating at 5.0 v. 1.2.3.42 pk[6:4] / addr[22:20] / acc[2:0] ?port k i/o pin [6:4] pk[6:4] are general-purpose input or output pins. during mcu expanded modes of operation, the acc[2:0] signals are used to indicate the access source of the bus cycle. these pins also provide the expanded addresses addr[22:20] for the external bus. in emulation modes acc[2:0] is available and is time multiplexed with the high addresses chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 68 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.43 pk[3:0] / addr[19:16] / iqstat[3:0] ?port k i/o pins [3:0] pk3-pk0 are general-purpose input or output pins. in mcu expanded modes of operation, these pins provide the expanded address addr[19:16] for the external bus and carry instruction pipe information. 1.2.3.44 pl7 / txd7 ?port l i/o pin 7 pl7 is a general-purpose input or output pin. it can be con?ured as the transmit pin txd of serial communication interface 7 (sci7). 1.2.3.45 pl6 / rxd7 ?port l i/o pin 6 pl6 is a general-purpose input or output pin. it can be con?ured as the receive pin rxd of serial communication interface 7 (sci7). 1.2.3.46 pl5 / txd6 ?port l i/o pin 5 pl5 is a general-purpose input or output pin. it can be con?ured as the transmit pin txd of serial communication interface 6 (sci6). 1.2.3.47 pl4 / rxd6 ?port l i/o pin 4 pl4 is a general-purpose input or output pin. it can be con?ured as the receive pin rxd of serial communication interface 6 (sci6). 1.2.3.48 pl3 / txd5 ?port l i/o pin 3 pl3 is a general-purpose input or output pin. it can be con?ured as the transmit pin txd of serial communication interface 5 (sci5). 1.2.3.49 pl2 / rxd5 ?port l i/o pin 2 pl2 is a general-purpose input or output pin. it can be con?ured as the receive pin rxd of serial communication interface 5 (sci5). 1.2.3.50 pl1 / txd4 ?port l i/o pin 1 pl1 is a general-purpose input or output pin. it can be con?ured as the transmit pin txd of serial communication interface 4 (sci4). 1.2.3.51 pl0 / rxd4 ?port l i/o pin 0 pl0 is a general-purpose input or output pin. it can be con?ured as the receive pin rxd of serial communication interface 4 (sci4). chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 69 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.52 pm7 / txcan3 / txcan4 / txd3 ?port m i/o pin 7 pm7 is a general-purpose input or output pin. it can be con?ured as the transmit pin txcan of the scalable controller area network controller 3 or 4 (can3 or can4). pm7 can be con?ured as the transmit pin txd3 of the serial communication interface 3 (sci3). 1.2.3.53 pm6 / rxcan3 / rxcan4 / rxd3 ?port m i/o pin 6 pm6 is a general-purpose input or output pin. it can be con?ured as the receive pin rxcan of the scalable controller area network controller 3 or 4 (can3 or can4). pm6 can be con?ured as the receive pin rxd3 of the serial communication interface 3 (sci3). 1.2.3.54 pm5 / txcan0 / txcan2 / txcan4 / sck0 ?port m i/o pin 5 pm5 is a general-purpose input or output pin. it can be con?ured as the transmit pin txcan of the scalable controller area network controllers 0, 2 or 4 (can0, can2, or can4). it can be con?ured as the serial clock pin sck of the serial peripheral interface 0 (spi0). 1.2.3.55 pm4 / rxcan0 / rxcan2 / rxcan4 / mosi0 ?port m i/o pin 4 pm4 is a general-purpose input or output pin. it can be con?ured as the receive pin rxcan of the scalable controller area network controllers 0, 2, or 4 (can0, can2, or can4). it can be con?ured as the master output (during master mode) or slave input pin (during slave mode) mosi for the serial peripheral interface 0 (spi0). 1.2.3.56 pm3 / txcan1 / txcan0 / ss0 ?port m i/o pin 3 pm3 is a general-purpose input or output pin. it can be con?ured as the transmit pin txcan of the scalable controller area network controllers 1 or 0 (can1 or can0). it can be con?ured as the slave select pin ss of the serial peripheral interface 0 (spi0). 1.2.3.57 pm2 / rxcan1 / rxcan0 / miso0 ?port m i/o pin 2 pm2 is a general-purpose input or output pin. it can be con?ured as the receive pin rxcan of the scalable controller area network controllers 1 or 0 (can1 or can0). it can be con?ured as the master input (during master mode) or slave output pin (during slave mode) miso for the serial peripheral interface 0 (spi0). 1.2.3.58 pm1 / txcan0 ?port m i/o pin 1 pm1 is a general-purpose input or output pin. it can be con?ured as the transmit pin txcan of the scalable controller area network controller 0 (can0). 1.2.3.59 pm0 / rxcan0 ?port m i/o pin 0 pm0 is a general-purpose input or output pin. it can be con?ured as the receive pin rxcan of the scalable controller area network controller 0 (can0). chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 70 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.60 pp7 / kwp7 / pwm7 / sck2 / timioc7?port p i/o pin 7 pp7 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 7 output, tim channel 7, or as serial clock pin sck of the serial peripheral interface 2 (spi2). 1.2.3.61 pp6 / kwp6 / pwm6 / ss2 / timioc6?port p i/o pin 6 pp6 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 6 output, tim channel 6 or as the slave select pin ss of the serial peripheral interface 2 (spi2). 1.2.3.62 pp5 / kwp5 / pwm5 / mosi2 / timioc5?port p i/o pin 5 pp5 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 5 output, tim channel 5 or as the master output (during master mode) or slave input pin (during slave mode) mosi of the serial peripheral interface 2 (spi2). 1.2.3.63 pp4 / kwp4 / pwm4 / miso2 / timioc4?port p i/o pin 4 pp4 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 4 output, tim channel 4 or as the master input (during master mode) or slave output (during slave mode) pin miso of the serial peripheral interface 2 (spi2). 1.2.3.64 pp3 / kwp3 / pwm3 / ss1 / timioc3?port p i/o pin 3 pp3 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 3 output, tim channel 3, or as the slave select pin ss of the serial peripheral interface 1 (spi1). 1.2.3.65 pp2 / kwp2 / pwm2 / sck1 / timioc2?port p i/o pin 2 pp2 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 2 output, tim channel 2, or as the serial clock pin sck of the serial peripheral interface 1 (spi1). 1.2.3.66 pp1 / kwp1 / pwm1 / mosi1 / timioc1?port p i/o pin 1 pp1 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 1 output, tim channel 1, or master output (during master mode) or slave input pin (during slave mode) mosi of the serial peripheral interface 1 (spi1). chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 71 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.67 pp0 / kwp0 / pwm0 / miso1 / timioc0?port p i/o pin 0 pp0 is a general-purpose input or output pin. it can be con?ured as a keypad wakeup input. it can be con?ured as pulse width modulator (pwm) channel 0 output, tim channel 0 or as the master input (during master mode) or slave output (during slave mode) pin miso of the serial peripheral interface 1 (spi1). 1.2.3.68 pr[7:0] / timioc[7:0] ?port r i/o pins [7:0] pr[7:0] are general-purpose input or output pins. they can be con?ured as input capture or output compare pins ioc[7:0] of the standard timer (tim). 1.2.3.69 ps7 / ss0 ?port s i/o pin 7 ps7 is a general-purpose input or output pin. it can be con?ured as the slave select pin ss of the serial peripheral interface 0 (spi0). 1.2.3.70 ps6 / sck0 ?port s i/o pin 6 ps6 is a general-purpose input or output pin. it can be con?ured as the serial clock pin sck of the serial peripheral interface 0 (spi0). 1.2.3.71 ps5 / mosi0 ?port s i/o pin 5 ps5 is a general-purpose input or output pin. it can be con?ured as master output (during master mode) or slave input pin (during slave mode) mosi of the serial peripheral interface 0 (spi0). 1.2.3.72 ps4 / miso0 ?port s i/o pin 4 ps4 is a general-purpose input or output pin. it can be con?ured as master input (during master mode) or slave output pin (during slave mode) mosi of the serial peripheral interface 0 (spi0). 1.2.3.73 ps3 / txd1 ?port s i/o pin 3 ps3 is a general-purpose input or output pin. it can be con?ured as the transmit pin txd of serial communication interface 1 (sci1). 1.2.3.74 ps2 / rxd1 ?port s i/o pin 2 ps2 is a general-purpose input or output pin. it can be con?ured as the receive pin rxd of serial communication interface 1 (sci1). 1.2.3.75 ps1 / txd0 ?port s i/o pin 1 ps1 is a general-purpose input or output pin. it can be con?ured as the transmit pin txd of serial communication interface 0 (sci0). chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 72 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.3.76 ps0 / rxd0 ?port s i/o pin 0 ps0 is a general-purpose input or output pin. it can be con?ured as the receive pin rxd of serial communication interface 0 (sci0). 1.2.3.77 pt[7:6] / ioc[7:6] ?port t i/o pins [7:6] pt[7:6] are general-purpose input or output pins. they can be con?ured as input capture or output compare pins ioc[7:6] of the enhanced capture timer (ect). 1.2.3.78 pt[5] / ioc[5] / vreg_api?port t i/o pins [5] pt[5] is a general-purpose input or output pin. it can be con?ured as input capture or output compare pin ioc[5] of the enhanced capture timer (ect) or can be con?ured to output the vreg_api signal. 1.2.3.79 pt[4:0] / ioc[4:0] ?port t i/o pins [4:0] pt[4:0] are general-purpose input or output pins. they can be con?ured as input capture or output compare pins ioc[4:0] of the enhanced capture timer (ect). 1.2.4 power supply pins mc9s12xe-family power and ground pins are described below. because fast signal transitions place high, short-duration current demands on the power supply, use bypass capacitors with high-frequency characteristics and place them as close to the mcu as possible. note all v ss pins must be connected together in the application. 1.2.4.1 vddx[7:1], vssx[7:1] ?power and ground pins for i/o drivers external power and ground for i/o drivers. bypass requirements depend on how heavily the mcu pins are loaded. all v ddx pins are connected together internally. all v ssx pins are connected together internally. 1.2.4.2 vddr ?power pin for internal voltage regulator input to the internal voltage regulator. the internal voltage regulator is turned off, if v ddr is tied to ground 1.2.4.3 vdd, vss1,vss2,vss3 ?core power pins power is supplied to the mcu core from the internal voltage regulator, whose load capacitor must be connected to vdd. the voltage supply of nominally 1.8v is derived from the internal voltage regulator. the return current path is through the vss1,vss2 and vss3 pins. no static external loading of these pins is permitted. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 73 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.2.4.4 vddf ?nvm power pin power is supplied to the mcu nvm through vddf . the voltage supply of nominally 2.8v is derived from the internal voltage regulator. no static external loading of these pins is permitted. 1.2.4.5 vdda2, vdda1, vssa2 , vssa1 ?power supply pins for atd and voltage regulator these are the power supply and ground input pins for the analog-to-digital converters and the voltage regulator. internally the v dda pins are connected together. internally the v ssa pins are connected together. 1.2.4.6 vrh, vrl ?atd reference voltage input pins v rh and v rl are the reference voltage input pins for the analog-to-digital converter. 1.2.4.7 vddpll, vsspl ?power supply pins for pll these pins provide operating voltage and ground for the oscillator and the phased-locked loop. the voltage supply of nominally 1.8v is derived from the internal voltage regulator. this allows the supply voltage to the oscillator and pll to be bypassed independently. this voltage is generated by the internal voltage regulator. no static external loading of these pins is permitted. table 1-11. power and ground connection summary mnemonic nominal voltage description vddr 5.0 v external power supply to internal voltage regulator vddx[7:1] 5.0 v external power and ground, supply to pin drivers vssx[7:1] 0 v vdda2 , vdda1 5.0 v operating voltage and ground for the analog-to-digital converters and the reference for the internal voltage regulator, allows the supply voltage to the a/d to be bypassed independently. vssa2 , vssa1 0 v vrl 0 v reference voltages for the analog-to-digital converter. vrh 5.0 v vdd 1.8 v internal power and ground generated by internal regulator for the internal core. vss1, vss2, vss3 0v vddf 2.8 v internal power and ground generated by internal regulator for the internal nvm. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 74 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 vddpll 1.8 v provides operating voltage and ground for the phased-locked loop. this allows the supply voltage to the pll to be bypassed independently. internal power and ground generated by internal regulator. vsspll 0 v table 1-11. power and ground connection summary (continued) mnemonic nominal voltage description chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 75 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.3 system clock description the clock and reset generator module (crg) provides the internal clock signals for the core and all peripheral modules. figure 1-9 shows the clock connections from the crg to all modules. consult the crg speci?ation for details on clock generation. figure 1-9. clock connections the system clock can be supplied in several ways enabling a range of system operating frequencies to be supported: the on-chip phase locked loop (pll) the pll self clocking the oscillator the clock generated by the pll or oscillator provides the main system clock frequencies core clock and bus clock. as shown in figure 1-9 , these system clocks are used throughout the mcu to drive the core, the memories, and the peripherals. sci0 . . sci 7 spi0 . . spi2 iic0 & iic1 atd0 & atd1 can0 . . can4 crg bus clock extal xtal core clock oscillator clock ram s12x xgate flash & pit ect pim eee pwm tim chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 76 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the program flash memory and the eeprom are supplied by the bus clock and the oscillator clock. the oscillator clock is used as a time base to derive the program and erase times for the nvm s. the can modules may be con?ured to have their clock sources derived either from the bus clock or directly from the oscillator clock. this allows the user to select its clock based on the required jitter performance. in order to ensure the presence of the clock the mcu includes an on-chip clock monitor connected to the output of the oscillator. the clock monitor can be con?ured to invoke the pll self-clocking mode or to generate a system reset if it is allowed to time out as a result of no oscillator clock being present. in addition to the clock monitor, the mcu also provides a clock quality checker which performs a more accurate check of the clock. the clock quality checker counts a predetermined number of clock edges within a de?ed time window to insure that the clock is running. the checker can be invoked following speci? events such as on wake-up or clock monitor failure. 1.4 modes of operation the mcu can operate in different modes associated with mcu resource mapping and bus interface con?uration. these are described in 1.4.1 chip con?uration summary . the mcu can operate in different power modes to facilitate power saving when full system performance is not required. these are described in 1.4.2 power modes . some modules feature a software programmable option to freeze the module status whilst the background debug module is active to facilitate debugging. this is described in 1.4.3 freeze mode . for system integrity support separate system states are featured as explained in 1.4.4 system states . 1.4.1 chip con?uration summary the mcu can operate in six different modes associated with resource con?uration. the different modes, the state of romctl and eromctl signal on rising edge of reset and the security state of the mcu affect the following device characteristics: external bus interface con?uration flash in memory map, or not debug features enabled or disabled the operating mode out of reset is determined by the states of the modc, modb, and moda signals during reset (see table 1-12 ). the modc, modb, and moda bits in the mode register show the current operating mode and provide limited mode switching during operation. the states of the modc, modb, and moda signals are latched into these bits on the rising edge of reset. in normal expanded mode and in emulation modes the romon bit and the eromon bit in the mmcctl1 register de?es if the on chip ?sh memory is the memory map, or not. (see table 1-12 .) for a detailed explanation of the romon and eromon bits refer to the mmc description. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 77 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the state of the romctl signal is latched into the romon bit in the mmcctl1 register on the rising edge of reset. the state of the eromctl signal is latched into the eromon bit in the mmcctl1 register on the rising edge of reset. 1.4.1.1 normal expanded mode ports k, a, and b are con?ured as a 23-bit address bus, ports c and d are con?ured as a 16-bit data bus, and port e provides bus control and status signals. this mode allows 16-bit external memory and peripheral devices to be interfaced to the system. the fastest external bus rate is divide by 2 from the internal bus rate. 1.4.1.2 normal single-chip mode there is no external bus in this mode. the processor program is executed from internal memory. ports a, b,c,d, k, and most pins of port e are available as general-purpose i/o. 1.4.1.3 special single-chip mode this mode is used for debugging single-chip operation, boot-strapping, or security related operations. the background debug module bdm is active in this mode. the cpu executes a monitor program located in an on-chip rom. bdm ?mware waits for additional serial commands through the bkgd pin. there is no external bus after reset in this mode. 1.4.1.4 emulation of expanded mode developers use this mode for emulation systems in which the users target application is normal expanded mode. code is executed from external memory or from internal memory depending on the state of romon and eromon bit. in this mode the internal operation is visible on external bus interface. table 1-12. chip modes and data sources chip modes modc modb moda romctl eromctl data source (1) 1. internal means resources inside the mcu are read/written. internal flash means flash resources inside the mcu are read/written. emulation memory means resources inside the emulator are read/written (pru registers, flash replacement, ram, eeprom, and register space are always considered internal). external application means resources residing outside the mcu are read/written. normal single chip 1 0 0 x x internal special single chip 0 0 0 emulation single chip 0 0 1 x 0 emulation memory x 1 internal flash normal expanded 1 0 1 0 x external application 1 x internal flash emulation expanded 0 1 1 0 x external application 1 0 emulation memory 1 1 internal flash special test 0 1 0 0 x external application 1 x internal flash chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 78 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.4.1.5 emulation of single-chip mode developers use this mode for emulation systems in which the user s target application is normal single- chip mode. code is executed from external memory or from internal memory depending on the state of romon and eromon bit. in this mode the internal operation is visible on external bus interface. 1.4.1.6 special test mode this is for freescale internal use only. 1.4.2 power modes the mcu features two main low-power modes. consult the respective module description for module speci? behavior in system stop, system pseudo stop, and system wait mode. an important source of information about the clock system is the clock and reset generator description (crg). 1.4.2.1 system stop modes the system stop modes are entered if the cpu executes the stop instruction unless either the xgate is active or an nvm command is active. the xgate is active if it executes a thread or the xgfact bit in the xgmctl register is set. depending on the state of the pstp bit in the clksel register the mcu goes into pseudo stop mode or full stop mode. please refer to crg description. asserting reset, xirq, irq or any other interrupt that is not masked exits system stop modes. system stop modes can be exited by xgate or cpu activity independently, depending on the con?uration of the interrupt request. if system-stop is exited on an xgate request then, as long as the xgate does not set an interrupt ?g on the cpu and the xgate fake activity bit (fact) remains cleared, once xgate activity is completed system stop mode will automatically be re-entered. if the cpu executes the stop instruction whilst xgate is active or an nvm command is being processed, then the system clocks continue running until xgate/nvm activity is completed. if a non- masked interrupt occurs within this time then the system does not effectively enter stop mode although the stop instruction has been executed. 1.4.2.2 full stop mode the oscillator is stopped in this mode. by default all clocks are switched off and all counters and dividers remain frozen. the autonomous periodic interrupt (api) and atd modules may be enabled to self wake the device. a fast wake up mode is available to allow the device to wake from full stop mode immediately on the pll internal clock without starting the oscillator clock. 1.4.2.3 pseudo stop mode in this mode the system clocks are stopped but the oscillator is still running and the real time interrupt (rti) and watchdog (cop), api and atd modules may be enabled. other peripherals are turned off. this mode consumes more current than system stop mode but, as the oscillator continues to run, the full speed wake up time from this mode is signi?antly shorter. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 79 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.4.2.4 xgate fake activity mode this mode is entered if the cpu executes the stop instruction when the xgate is not executing a thread and the xgfact bit in the xgmctl register is set. the oscillator remains active and any enabled peripherals continue to function. 1.4.2.5 wait mode this mode is entered when the cpu executes the wai instruction. in this mode the cpu will not execute instructions. the internal cpu clock is switched off. all peripherals and the xgate can be active in system wait mode. for further power consumption the peripherals can individually turn off their local clocks. asserting reset, xirq, irq or any other interrupt that is not masked and is not routed to xgate ends system wait mode. 1.4.2.6 run mode although this is not a low-power mode, unused peripheral modules should not be enabled in order to save power. 1.4.3 freeze mode the enhanced capture timer, pulse width modulator, analog-to-digital converters, and the periodic interrupt timer provide a software programmable option to freeze the module status when the background debug module is active. this is useful when debugging application software. for detailed description of the behavior of the atd0, atd1, ect, pwm, and pit when the background debug module is active consult the corresponding block guides. 1.4.4 system states to facilitate system integrity the mcu can run in supervisor state or user state. the system states strategy is implemented by additional features on the s12x cpu and a memory protection unit. this is designed to support restricted access for code modules executed by kernels or operating systems supporting access control to system resources. the current system state is indicated by the u bit in the cpu condition code register. in user state certain cpu instructions are restricted. see the cpu reference guide for details of the u bit and of those instructions affected by user state. in the case that software task accesses resources outside those de?ed for it in the mpu a non-maskable interrupt is generated. 1.4.4.1 supervisor state this state is intended for con?uring the mpu for different tasks that are then executed in user state, returning to supervisor state on completion of each task. this is the default state following reset and can be re-entered from user state by an exception (interrupt). if the svsen bit in the mpusel register of the chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 80 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mpu is set, access to system resources is only allowed if enabled by a memory range descriptor as de?ed in the memory protection unit (mpu) description. 1.4.4.2 user state this state is intended for carrying out system tasks and is entered by setting the u bit of the condition codes register while in supervisor state. restrictions apply for the execution of several cpu instructions in user state and access to system resources is only allowed in if enabled by a memory range descriptor as de?ed in the memory protection unit (mpu) description. 1.5 security the mcu security feature allows the protection of the on chip flash and emulated eeprom memory. for a detailed description of the security features refer to the s12x9sec description. 1.6 resets and interrupts consult the s12xcpu manual and the s12xint description for information on exception processing. 1.6.1 resets resets are explained in detail in the clock reset generator (crg) description. table 1-13. reset sources and vector locations 1.6.2 vectors table 1-14 lists all interrupt sources and vectors in the default order of priority. the interrupt module (s12xint) provides an interrupt vector base register (ivbr) to relocate the vectors. associated with each i-bit maskable service request is a con?uration register. it selects if the service request is enabled, the service request priority level and whether the service request is handled either by the s12x cpu or by the xgate module. vector address reset source ccr mask local enable $fffe power-on reset (por) none none $fffe low voltage reset (lvr) none none $fffe external pin reset none none $fffe illegal address reset none none $fffc clock monitor reset none pllctl (cme, scme) $fffa cop watchdog reset none cop rate select chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 81 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 1-14. interrupt vector locations (sheet 1 of 4) vector address (1) xgate channel id (2) interrupt source ccr mask local enable stop wake up wait wake up vector base + $f8 unimplemented instruction trap none none vector base+ $f6 swi none none vector base+ $f4 xirq x bit none yes yes vector base+ $f2 irq i bit irqcr (irqen) yes yes vector base+ $f0 $78 real time interrupt i bit crgint (rtie) refer to crg interrupt section vector base+ $ee $77 enhanced capture timer channel 0 i bit tie (c0i) no yes vector base + $ec $76 enhanced capture timer channel 1 i bit tie (c1i) no yes vector base+ $ea $75 enhanced capture timer channel 2 i bit tie (c2i) no yes vector base+ $e8 $74 enhanced capture timer channel 3 i bit tie (c3i) no yes vector base+ $e6 $73 enhanced capture timer channel 4 i bit tie (c4i) no yes vector base+ $e4 $72 enhanced capture timer channel 5 i bit tie (c5i) no yes vector base + $e2 $71 enhanced capture timer channel 6 i bit tie (c6i) no yes vector base+ $e0 $70 enhanced capture timer channel 7 i bit tie (c7i) no yes vector base+ $de $6f enhanced capture timer over?w i bit tsrc2 (tof) no yes vector base+ $dc $6e pulse accumulator a over?w i bit pactl (paovi) no yes vector base + $da $6d pulse accumulator input edge i bit pactl (pai) no yes vector base + $d8 $6c spi0 i bit spi0cr1 (spie, sptie) no yes vector base+ $d6 $6b sci0 i bit sci0cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $d4 $6a sci1 i bit sci1cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $d2 $69 atd0 i bit atd0ctl2 (ascie) yes yes vector base + $d0 $68 atd1 i bit atd1ctl2 (ascie) yes yes vector base + $ce $67 port j i bit piej (piej7-piej0) yes yes vector base + $cc $66 port h i bit pieh (pieh7-pieh0) yes yes vector base + $ca $65 modulus down counter under?w i bit mcctl(mczi) no yes vector base + $c8 $64 pulse accumulator b over?w i bit pbctl(pbovi) no yes vector base + $c6 $63 crg pll lock i bit crgint(lockie) refer to crg interrupt section vector base + $c4 $62 crg self-clock mode i bit crgint (scmie) refer to crg interrupt section vector base + $c2 $61 sci6 i bit sci6cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $c0 $60 iic0 bus i bit ibcr0 (ibie) no yes chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 82 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 vector base + $be $5f spi1 i bit spi1cr1 (spie, sptie) no yes vector base + $bc $5e spi2 i bit spi2cr1 (spie, sptie) no yes vector base + $ba $5d flash fault detect i bit fcnfg2 (fdie) no no vector base + $b8 $5c flash i bit fcnfg (ccie, cbeie) no yes vector base + $b6 $5b can0 wake-up i bit can0rier (wupie) yes yes vector base + $b4 $5a can0 errors i bit can0rier (cscie, ovrie) no yes vector base + $b2 $59 can0 receive i bit can0rier (rxfie) no yes vector base + $b0 $58 can0 transmit i bit can0tier (txeie[2:0]) no yes vector base + $ae $57 can1 wake-up i bit can1rier (wupie) yes yes vector base + $ac $56 can1 errors i bit can1rier (cscie, ovrie) no yes vector base + $aa $55 can1 receive i bit can1rier (rxfie) no yes vector base + $a8 $54 can1 transmit i bit can1tier (txeie[2:0]) no yes vector base + $a6 $53 can2 wake-up i bit can2rier (wupie) yes yes vector base + $a4 $52 can2 errors i bit can2rier (cscie, ovrie) no yes vector base + $a2 $51 can2 receive i bit can2rier (rxfie) no yes vector base + $a0 $50 can2 transmit i bit can2tier (txeie[2:0]) no yes vector base + $9e $4f can3 wake-up i bit can3rier (wupie) yes yes vector base+ $9c $4e can3 errors i bit can3rier (cscie, ovrie) no yes vector base+ $9a $4d can3 receive i bit can3rier (rxfie) no yes vector base + $98 $4c can3 transmit i bit can3tier (txeie[2:0]) no yes vector base + $96 $4b can4 wake-up i bit can4rier (wupie) yes yes vector base + $94 $4a can4 errors i bit can4rier (cscie, ovrie) no yes vector base + $92 $49 can4 receive i bit can4rier (rxfie) no yes vector base + $90 $48 can4 transmit i bit can4tier (txeie[2:0]) no yes vector base + $8e $47 port p interrupt i bit piep (piep7-piep0) yes yes vector base+ $8c $46 pwm emergency shutdown i bit pwmsdn (pwmie) no yes table 1-14. interrupt vector locations (sheet 2 of 4) vector address (1) xgate channel id (2) interrupt source ccr mask local enable stop wake up wait wake up chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 83 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 vector base + $8a $45 sci2 i bit sci2cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $88 $44 sci3 i bit sci3cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $86 $43 sci4 i bit sci4cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $84 $42 sci5 i bit sci5cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $82 $41 iic1 bus i bit ibcr (ibie) no yes vector base + $80 $40 low-voltage interrupt (lvi) i bit vregctrl (lvie) no yes vector base + $7e $3f autonomous periodical interrupt (api) i bit vregapictrl (apie) yes yes vector base + $7c high temperature interrupt i bit vreghtcl (htie) no yes vector base + $7a $3d periodic interrupt timer channel 0 i bit pitinte (pinte0) no yes vector base + $78 $3c periodic interrupt timer channel 1 i bit pitinte (pinte1) no yes vector base + $76 $3b periodic interrupt timer channel 2 i bit pitinte (pinte2) no yes vector base + $74 $3a periodic interrupt timer channel 3 i bit pitinte (pinte3) no yes vector base + $72 $39 xgate software trigger 0 i bit xgmctl (xgie) no yes vector base + $70 $38 xgate software trigger 1 i bit xgmctl (xgie) no yes vector base + $6e $37 xgate software trigger 2 i bit xgmctl (xgie) no yes vector base + $6c $36 xgate software trigger 3 i bit xgmctl (xgie) no yes vector base + $6a $35 xgate software trigger 4 i bit xgmctl (xgie) no yes vector base + $68 $34 xgate software trigger 5 i bit xgmctl (xgie) no yes vector base + $66 $33 xgate software trigger 6 i bit xgmctl (xgie) no yes vector base + $64 $32 xgate software trigger 7 i bit xgmctl (xgie) no yes vector base + $62 reserved vector base + $60 reserved vector base + $5e $2f periodic interrupt timer channel 4 i bit pitinte (pinte4) no yes vector base + $5c $2e periodic interrupt timer channel 5 i bit pitinte (pinte5) no yes vector base + $5a $2d periodic interrupt timer channel 6 i bit pitinte (pinte6) no yes vector base + $58 $2c periodic interrupt timer channel 7 i bit pitinte (pinte7) no yes vector base + $56 $2b sci7 i bit sci7cr2 (tie, tcie, rie, ilie) ye s ye s vector base + $54 $2a tim timer channel 0 i bit tie (c0i) no yes vector base + $52 $29 tim timer channel 1 i bit tie (c1i) no yes vector base + $50 $28 tim timer channel 2 i bit tie (c2i) no yes table 1-14. interrupt vector locations (sheet 3 of 4) vector address (1) xgate channel id (2) interrupt source ccr mask local enable stop wake up wait wake up chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 84 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.6.3 effects of reset when a reset occurs, mcu registers and control bits are initialized. refer to the respective block descriptions for register reset states. on each reset, the flash module executes a reset sequence to load flash configuration registers and initialize the buffer ram eee partition, if required. 1.6.3.1 flash con?uration reset sequence (core hold phase) on each reset, the flash module will hold cpu activity while loading flash module registers and con?uration from the flash memory. the duration of this phase is given as t rst in the device electrical parameter speci?ation. if double faults are detected in the reset phase, flash module protection and security may be active on leaving reset. this is explained in more detail in the flash module section. 1.6.3.2 eee reset sequence phase (core active phase) during this phase of the reset sequence (following on from the core hold phase) the cpu can execute instructions while the ftm initialization completes and, if con?ured for eee operation, the eee ram vector base+ $4e $27 tim timer channel 3 i bit tie (c3i) no yes vector base + $4c $26 tim timer channel 4 i bit tie (c4i) no yes vector base+ $4a $25 tim timer channel 5 i bit tie (c5i) no yes vector base+ $48 $24 tim timer channel 6 i bit tie (c6i) no yes vector base+ $46 $23 tim timer channel 7 i bit tie (c7i) no yes vector base+ $44 $22 tim timer over?w i bit tsrc2 (tof) no yes vector base + $42 $21 tim pulse accumulator a over?w i bit pactl (paovi) no yes vector base+ $40 $20 tim pulse accumulator input edge i bit pactl (pai) no yes vector base + $3e $1f atd0 compare interrupt i bit atd0ctl2 (acmpie) yes yes vector base + $3c $1e atd1 compare interrupt i bit atd1ctl2 (acmpie) yes yes vector base+ $18 to vector base + $3a reserved vector base + $16 xgate software error interrupt none none no yes vector base + $14 mpu access error none none no no vector base + $12 system call interrupt (sys) none vector base + $10 spurious interrupt none 1. 16 bits vector address based 2. for detailed description of xgate channel id refer to xgate block guide table 1-14. interrupt vector locations (sheet 4 of 4) vector address (1) xgate channel id (2) interrupt source ccr mask local enable stop wake up wait wake up chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 85 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 is loaded with valid data from the d-flash eee partition. completion of this phase is indicated by the ccif ?g in the ftm fstat register becoming set. if the cpu accesses any eee ram location before the ccif ?g is set, the cpu is stalled until the ftm reset sequence is complete and the eee ram data is valid. once the ccif ?g is set, indicating the end of this phase, the eee ram can be accessed without impacting the cpu and ftm commands can be executed. 1.6.3.3 reset while flash command active if a reset occurs while any flash command is in progress, that command will be immediately aborted. the state of the word being programmed or the sector/block being erased is not guaranteed. 1.6.3.4 i/o pins refer to the pim block description for reset con?urations of all peripheral module ports. 1.6.3.5 memory the ram arrays are not initialized out of reset. 1.6.3.6 cop con?uration the cop timeout rate bits cr[2:0] and the wcop bit in the copctl register are loaded on rising edge of reset from the flash register fopt. see table 1-15 and table 1-16 for coding. the fopt register is loaded from the flash con?uration ?ld byte at global address $7fff0e during the reset sequence. if the mcu is secured the cop timeout rate is always set to the longest period (cr[2:0] = 111) after cop reset. table 1-15. initial cop rate con?uration nv[2:0] in fopt register cr[2:0] in copctl register 000 111 001 110 010 101 011 100 100 011 101 010 110 001 111 000 table 1-16. initial wcop con?uration nv[3] in fopt register wcop in copctl register 10 01 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 86 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.7 adc0 con?uration 1.7.1 external trigger input connection the adc module includes four external trigger inputs etrig0, etrig1, etrig2, and etrig3. the external trigger allows the user to synchronize adc conversion to external trigger events. table 1-17 shows the connection of the external trigger inputs. consult the atd block description for information about the analog-to-digital converter module. atd block description refererences to freeze mode are equivalent to active bdm mode. 1.7.2 adc0 channel[17] connection further to the 16 externally available channels, adc0 features an extra channel[17] that is connected to the internal temperature sensor at device level. to access this channel adc0 must use the channel encoding sc:cd:cc:cb:ca = 1:0:0:0:1 in atdctl5. for more temperature sensor information, please refer to 1.10.1 temperature sensor con?uration 1.8 adc1 external trigger input connection the adc module includes four external trigger inputs etrig0, etrig1, etrig2, and etrig3. the external trigger feature allows the user to synchronize adc conversion to external trigger events. table 1- 18 shows the connection of the external trigger inputs. consult the adc block description for information about the analog-to-digital converter module. adc block description refererences to freeze mode are equivalent to active bdm mode. table 1-17. atd0 external trigger sources external trigger input connectivity etrig0 pulse width modulator channel 1 etrig1 pulse width modulator channel 3 etrig2 periodic interrupt timer hardware trigger 0 etrig3 periodic interrupt timer hardware trigger 1 table 1-18. atd1 external trigger sources external trigger input connectivity etrig0 pulse width modulator channel 1 etrig1 pulse width modulator channel 3 etrig2 periodic interrupt timer hardware trigger 0 etrig3 periodic interrupt timer hardware trigger 1 chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 87 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.9 mpu con?uration the mpu has the option of a third bus master (cpu + xgate + other) which is not present on this device family but may be on other parts. 1.10 vreg con?uration the vregen connection of the voltage regulator is tied internally to vddr such that the voltage regulator is always enabled with vddr connected to a positive supply voltage. the device must be con?ured with the internal voltage regulator enabled. operation in conjunction with an external voltage regulator is not supported. the autonomous periodic interrupt clock output is mapped to portt[5]. the api trimming register apitr is loaded on rising edge of reset from the flash ifr option ?ld at global address 0x40_00f0 bits[5:0] during the reset sequence. currently factory programming of this ifr range is not supported. 1.10.1 temperature sensor con?uration the vreg high temperature trimming register bits vreghttr[3:0] are loaded from the internal flash during the reset sequence. to use the high temperature interrupt within the speci?d limits (t htia and t htid ) these bits must be loaded with 0x8. currently factory programming is not supported. the device temperature can be monitored on adc0 channel[17]. the internal bandgap reference voltage can also be mapped to adc0 analog input channel[17]. the voltage regulator vsel bit when set, maps the bandgap and, when clear, maps the temperature sensor to adc0 channel[17]. read access to reserved vreg register space returns ?? write accesses have no effect. this device does not support access abort of reserved vreg register space. 1.11 s12xepim con?uration on smaller derivatives the s12xepim module is a subset of the s12xep100. the registers of the unavailable ports are unimplemented. chapter 1 device overview mc9s12xe-family mc9s12xe-family reference manual , rev. 1.21 88 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1.12 oscillator con?uration the xclks is an input signal which controls whether a crystal in combination with the internal loop controlled (low power) pierce oscillator is used or whether full swing pierce oscillator/external clock circuitry is used. for this device xclks is mapped to pe7. the xclks signal selects the oscillator con?uration during reset low phase while a clock quality check is ongoing. this is the case for: power on reset or low-voltage reset clock monitor reset any reset while in self-clock mode or full stop mode the selected oscillator con?uration is frozen with the rising edge of the reset pin in any of these above described reset cases. figure 1-10. loop controlled pierce oscillator connections ( xclks = 1) figure 1-11. full swing pierce oscillator connections ( xclks = 0) figure 1-12. external clock connections ( xclks = 0) mcu extal xtal v sspll crystal or ceramic resonator c 2 c 1 mcu extal xtal r s r b v sspll crystal or ceramic resonator c 2 c 1 r b =1m ? ; r s speci?d by crystal vendor mcu extal xtal cmos-compatible external oscillator not connected mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 89 chapter 2 port integration module (s12xepimv1) 2.1 introduction 2.1.1 overview the s12xe family port integration module establishes the interface between the peripheral modules including the non-multiplexed external bus interface module (s12x_ebi) and the i/o pins for all ports. it controls the electrical pin properties as well as the signal prioritization and multiplexing on shared pins. this document covers: port a and b used as address output of the s12x_ebi port c and d used as data i/o of the s12x_ebi port e associated with the s12x_ebi control signals and the irq, xirq interrupt inputs port k associated with address output and control signals of the s12x_ebi port t associated with 1 ect module port s associated with 2 sci and 1 spi modules port m associated with 4 mscan and 1 sci module port p connected to the pwm and 2 spi modules - inputs can be used as an external interrupt source port h associated with 4 sci modules - inputs can be used as an external interrupt source port j associated with 1 mscan, 1 sci, 2 iic modules and chip select outputs - inputs can be used as an external interrupt source port ad0 and ad1 associated with two 16-channel atd modules port r associated with 1 standard timer (tim) module port l associated with 4 sci modules table 2-1. revision history revision number revision date sections affected description of changes v01.17 02 apr 2008 corrected reduced drive strength to 1/5 separated pe1,0 bit descriptions from other pe gpio v01.18 25 nov 2008 2.3.19/120 2.4.3.4/181 corrected alternative functions on port k (acc[2:0]) corrected functions on pe[5] (modb) and pe[2] (we) v01.19 18 dec 2009 added function independency to reduced drive and wired-or bit descriptions minor corrections chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 90 freescale semiconductor port f associated with iic, sci and chip select outputs most i/o pins can be con?ured by register bits to select data direction and drive strength, to enable and select pull-up or pull-down devices. note this document assumes the availability of all features (208-pin package option). some functions are not available on lower pin count package options. refer to the pin-out summary in the soc guide. 2.1.2 features the port integration module includes these distinctive registers: data and data direction registers for ports a, b, c, d, e, k, t, s, m, p, h, j, ad0, ad1, r, l, and f when used as general-purpose i/o control registers to enable/disable pull-device and select pull-ups/pull-downs on ports t, s, m, p, h, j, r, l, and f on per-pin basis control registers to enable/disable pull-up devices on ports ad0 and ad1 on per-pin basis single control register to enable/disable pull-ups on ports a, b, c, d, e, and k on per-port basis and on bkgd pin control registers to enable/disable reduced output drive on ports t, s, m, p, h, j, ad0, ad1, r, l, and f on per-pin basis single control register to enable/disable reduced output drive on ports a, b, c, d, e, and k on per- port basis control registers to enable/disable open-drain (wired-or) mode on ports s, m, and l interrupt ?g register for pin interrupts on ports p, h, and j control register to con?ure irq pin operation free-running clock outputs a standard port pin has the following minimum features: input/output selection 5v output drive with two selectable drive strengths 5v digital and analog input input with selectable pull-up or pull-down device optional features supported on dedicated pins: open drain for wired-or connections interrupt inputs with glitch filtering reduced input threshold to support low voltage applications 2.2 external signal description this section lists and describes the signals that do connect off-chip. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 91 table 2-2 shows all the pins and their functions that are controlled by the port integration module. refer to the soc guide for the availability of the individual pins in the different package options. note if there is more than one function associated with a pin, the priority is indicated by the position in the table from top (highest priority) to bottom (lowest priority). table 2-2. pin functions and priorities port pin name pin function & priority (1) i/o description pin function after reset - bkgd modc (2) i modc input during reset bkgd bkgd i/o s12x_bdm communication pin a pa[7:0] addr[15:8] mux ivd[15:8] (3) o high-order external bus address output (multiplexed with ivis data) mode dependent (4) gpio i/o general-purpose i/o b pb[7:1] addr[7:1] mux ivd[7:1] 3 o low-order external bus address output (multiplexed with ivis data) mode dependent 4 gpio i/o general-purpose i/o pb[0] addr[0] mux ivd0 3 o low-order external bus address output (multiplexed with ivis data) uds o upper data strobe gpio i/o general-purpose i/o c pc[7:0] data[15:8] i/o high-order bidirectional data input/output con?urable for reduced input threshold mode dependent 4 gpio i/o general-purpose i/o d pd[7:0] data[7:0] i/o low-order bidirectional data input/output con?urable for reduced input threshold mode dependent 4 gpio i/o general-purpose i/o chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 92 freescale semiconductor e pe[7] xclks 2 i external clock selection input during reset mode dependent 4 eclkx2 i free-running clock output at core clock rate (eclk x 2) gpio i/o general-purpose i/o pe[6] modb 2 i modb input during reset t a ghi i instruction tagging low pin con?urable for reduced input threshold gpio i/o general-purpose i/o pe[5] moda 2 i moda input during reset re o read enable signal t a glo i instruction tagging low pin con?urable for reduced input threshold gpio i/o general-purpose i/o pe[4] eclk o free-running clock output at the bus clock rate or programmable divided in normal modes gpio i/o general-purpose i/o pe[3] eromctl 2 i eromon bit control input during reset lstrb o low strobe bar output lds o lower data strobe gpio i/o general-purpose i/o pe[2] r w o read/write output for external bus we o write enable signal gpio i/o general-purpose i/o pe[1] irq i maskable level- or falling edge-sensitive interrupt input gpi i general-purpose input pe[0] xirq i non-maskable level-sensitive interrupt input gpi i general-purpose input k pk[7] romctl 2 i romon bit control input during reset mode dependent 3 ew ait i external wait signal con?urable for reduced input threshold gpio i/o general-purpose i/o pk[6:4] addr[22:20] mux acc[2:0] 3 o extended external bus address output (multiplexed with access master output) gpio i/o general-purpose i/o pk[3:0] addr[19:16] mux iqstat[3:0] 3 o extended external bus address output (multiplexed with instruction pipe status bits) gpio i/o general-purpose i/o port pin name pin function & priority (1) i/o description pin function after reset chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 93 t pt[7] ioc[7] i/o enhanced capture timer channels 7 input/output gpio gpio i/o general-purpose i/o pt[5] ioc[5] i/o enhanced capture timer channel 5 input/output vreg_api o vreg autonomous periodical interrupt output gpio i/o general-purpose i/o pt[4:0] ioc[4:0] i/o enhanced capture timer channels 4 - 0 input/output gpio i/o general-purpose i/o s ps7 ss0 i/o serial peripheral interface 0 slave select output in master mode, input in slave mode or master mode. gpio gpio i/o general-purpose i/o ps6 sck0 i/o serial peripheral interface 0 serial clock pin gpio i/o general-purpose i/o ps5 mosi0 i/o serial peripheral interface 0 master out/slave in pin gpio i/o general-purpose i/o ps4 miso0 i/o serial peripheral interface 0 master in/slave out pin gpio i/o general-purpose i/o ps3 txd1 o serial communication interface 1 transmit pin gpio i/o general-purpose i/o ps2 rxd1 i serial communication interface 1 receive pin gpio i/o general-purpose i/o ps1 txd0 o serial communication interface 0 transmit pin gpio i/o general-purpose i/o ps0 rxd0 i serial communication interface 0 receive pin gpio i/o general-purpose i/o port pin name pin function & priority (1) i/o description pin function after reset chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 94 freescale semiconductor m pm7 txcan3 o mscan3 transmit pin gpio (txcan4) o mscan4 transmit pin txd3 o serial communication interface 3 transmit pin gpio i/o general-purpose i/o pm6 rxcan3 i mscan3 receive pin (rxcan4) i mscan4 receive pin rxd3 i serial communication interface 3 receive pin gpio i/o general-purpose i/o pm5 txcan2 o mscan2 transmit pin (txcan0) o mscan0 transmit pin (txcan4) o mscan4 transmit pin (sck0) i/o serial peripheral interface 0 serial clock pin if can0 is routed to pm[3:2] the spi0 can still be used in bidirectional master mode. gpio i/o general-purpose i/o pm4 rxcan2 i mscan2 receive pin (rxcan0) i mscan0 receive pin (rxcan4) i mscan4 receive pin (mosi0) i/o serial peripheral interface 0 master out/slave in pin if can0 is routed to pm[3:2] the spi0 can still be used in bidirectional master mode. gpio i/o general-purpose i/o pm3 txcan1 o mscan1 transmit pin (txcan0) o mscan0 transmit pin ( ss0) i/o serial peripheral interface 0 slave select output in master mode, input for slave mode or master mode. gpio i/o general-purpose i/o pm2 rxcan1 i mscan1 receive pin (rxcan0) i mscan0 receive pin (miso0) i/o serial peripheral interface 0 master in/slave out pin gpio i/o general-purpose i/o pm1 txcan0 o mscan0 transmit pin gpio i/o general-purpose i/o pm0 rxcan0 i mscan0 receive pin gpio i/o general-purpose i/o port pin name pin function & priority (1) i/o description pin function after reset chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 95 p pp7 pwm7 i/o pulse width modulator input/output channel 7 gpio sck2 i/o serial peripheral interface 2 serial clock pin (timioc7) i/o timer channel 7 input/output gpio/kwp7 i/o general-purpose i/o with interrupt pp6 pwm6 o pulse width modulator output channel 6 ss2 i/o serial peripheral interface 2 slave select output in master mode, input for slave mode or master mode. (timioc6) i/o timer channel 6 input/output gpio/kwp6 i/o general-purpose i/o with interrupt pp5 pwm5 o pulse width modulator output channel 5 mosi2 i/o serial peripheral interface 2 master out/slave in pin (timioc5) i/o timer channel 5 input/output gpio/kwp5 i/o general-purpose i/o with interrupt pp4 pwm4 o pulse width modulator output channel 4 miso2 i/o serial peripheral interface 2 master in/slave out pin (timioc4) i/o timer channel 4 input/output gpio/kwp4 i/o general-purpose i/o with interrupt pp3 pwm3 o pulse width modulator output channel 3 ss1 i/o serial peripheral interface 1 slave select output in master mode, input for slave mode or master mode. (timioc3) i/o timer channel 3 input/output gpio/kwp3 i/o general-purpose i/o with interrupt pp2 pwm2 o pulse width modulator output channel 2 sck1 i/o serial peripheral interface 1 serial clock pin (timioc2) i/o timer channel 2 input/output gpio/kwp2 i/o general-purpose i/o with interrupt pp1 pwm1 o pulse width modulator output channel 1 mosi1 i/o serial peripheral interface 1 master out/slave in pin (timioc1) i/o timer channel 1 input/output gpio/kwp1 i/o general-purpose i/o with interrupt pp0 pwm0 o pulse width modulator output channel 0 miso1 i/o serial peripheral interface 1 master in/slave out pin (timioc0) i/o timer channel 0 input/output gpio/kwp0 i/o general-purpose i/o with interrupt port pin name pin function & priority (1) i/o description pin function after reset chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 96 freescale semiconductor h ph7 ( ss2) i/o serial peripheral interface 2 slave select output in master mode, input for slave mode or master mode gpio txd5 o serial communication interface 5 transmit pin gpio/kwh7 i/o general-purpose i/o with interrupt ph6 (sck2) i/o serial peripheral interface 2 serial clock pin rxd5 i serial communication interface 5 receive pin gpio/kwh6 i/o general-purpose i/o with interrupt ph5 (mosi2) i/o serial peripheral interface 2 master out/slave in pin txd4 o serial communication interface 4 transmit pin gpio/kwh5 i/o general-purpose i/o with interrupt ph4 (miso2) i/o serial peripheral interface 2 master in/slave out pin rxd4 i serial communication interface 4 receive pin gpio/kwh4 i/o general-purpose i/o with interrupt ph3 ( ss1) i/o serial peripheral interface 1 slave select output in master mode, input for slave mode or master mode. txd7 o serial communication interface 7 transmit pin gpio/kwh3 i/o general-purpose i/o with interrupt ph2 (sck1) i/o serial peripheral interface 1 serial clock pin rxd7 i serial communication interface 7 receive pin gpio/kwh2 i/o general-purpose i/o with interrupt ph1 (mosi1) i/o serial peripheral interface 1 master out/slave in pin txd6 o serial communication interface 6 transmit pin gpio/kwh1 i/o general-purpose i/o with interrupt ph0 (miso1) i/o serial peripheral interface 1 master in/slave out pin txd6 o serial communication interface 6 transmit pin gpio/kwh0 i/o general-purpose i/o with interrupt port pin name pin function & priority (1) i/o description pin function after reset chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 97 j pj7 txcan4 o mscan4 transmit pin gpio scl0 o inter integrated circuit 0 serial clock line (txcan0) o mscan0 transmit pin gpio/kwj7 i/o general-purpose i/o with interrupt pj6 rxcan4 i mscan4 receive pin sda0 i/o inter integrated circuit 0 serial data line (rxcan0) i mscan0 receive pin gpio/kwj6 i/o general-purpose i/o with interrupt pj5 scl1 o inter integrated circuit 1 serial clock line cs2 o chip select 2 gpio/kwj5 i/o general-purpose i/o with interrupt pj4 sda1 i/o inter integrated circuit 1 serial data line cs0 o chip select 0 gpio/kwj4 i/o general-purpose i/o with interrupt pj3 gpio/kwj3 i/o general-purpose i/o with interrupt pj2 cs1 o chip select 1 gpio/kwj2 i/o general-purpose i/o with interrupt pj1 txd2 o serial communication interface 2 transmit pin gpio/kwj1 i/o general-purpose i/o with interrupt pj0 rxd2 i serial communication interface 2 receive pin cs3 o chip select 3 gpio/kwj0 i/o general-purpose i/o with interrupt ad0 pad[15:0] gpio i/o general-purpose i/o gpio an[15:0] i atd0 analog inputs ad1 pad[31:16] gpio i/o general-purpose i/o gpio an[15:0] i atd1 analog inputs r pr[7:0] timioc[7:0] i/o timer channels 7- 0 input/output gpio gpio i/o general-purpose i/o port pin name pin function & priority (1) i/o description pin function after reset chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 98 freescale semiconductor 2.3 memory map and register de?ition this section provides a detailed description of all port integration module registers. l pl7 (txd7) o serial communication interface 7 transmit pin gpio gpio i/o general-purpose i/o pl6 (rxd7) i serial communication interface 7 receive pin gpio i/o general-purpose i/o pl5 (txd6) o serial communication interface 6 transmit pin gpio i/o general-purpose i/o pl4 (rxd6) i serial communication interface 6 receive pin gpio i/o general-purpose i/o pl3 (txd5) o serial communication interface 5 transmit pin gpio i/o general-purpose i/o pl2 (rxd5) i serial communication interface 5 receive pin gpio i/o general-purpose i/o pl1 (txd4) o serial communication interface 4 transmit pin gpio i/o general-purpose i/o pl0 (rxd4) i serial communication interface 4 receive pin gpio i/o general-purpose i/o f pf7 (txd3) o serial communication interface 3 transmit pin gpio gpio i/o general-purpose i/o pf6 (rxd3) i serial communication interface 3 receive pin gpio i/o general-purpose i/o pf5 (scl0) o inter integrated circuit 0 serial clock line gpio i/o general-purpose i/o pf4 (sda0) i/o inter integrated circuit 0 serial data line gpio i/o general-purpose i/o pf3 ( cs3) o chip select 3 gpio i/o general-purpose i/o pf2 ( cs2) o chip select 2 gpio i/o general-purpose i/o pf1 ( cs1) o chip select 1 gpio i/o general-purpose i/o pf0 ( cs0) o chip select 0 gpio i/o general-purpose i/o 1. signals in brackets denote alternative module routing pins. 2. function active when reset asserted. 3. only available in emulation modes or in special test mode with ivis on. 4. refer to s12x_ebi section. port pin name pin function & priority (1) i/o description pin function after reset chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 99 2.3.1 memory map register name bit 7 6 5 4 3 2 1 bit 0 0x0000 porta r pa7pa6pa5pa4pa3pa2pa1pa0 w 0x0001 portb r pb7 pb6 pb5 pb4 pb3 pb2 pb1 pb0 w 0x0002 ddra r ddra7 ddra6 ddra5 ddra4 ddra3 ddra2 ddra1 ddra0 w 0x0003 ddrb r ddrb7 ddrb6 ddrb5 ddrb4 ddrb3 ddrb2 ddrb1 ddrb0 w 0x0004 portc r pc7 pc6 pc5 pc4 pc3 pc2 pc1 pc0 w 0x0005 portd r pd7 pd6 pd5 pd4 pd3 pd2 pd1 pd0 w 0x0006 ddrc r ddrc7 ddrc6 ddrc5 ddrc4 ddrc3 ddrc2 ddrc1 ddrc0 w 0x0007 ddrd r ddrd7 ddrd6 ddrd5 ddrd4 ddrd3 ddrd2 ddrd1 ddrd0 w 0x0008 porte r pe7 pe6 pe5 pe4 pe3 pe2 pe1 pe0 w 0x0009 ddre r ddre7 ddre6 ddre5 ddre4 ddre3 ddre2 00 w 0x000a 0x000b non-pim address range r non-pim address range w 0x000c pucr r pupke bkpue 0 pupee pupde pupce pupbe pupae w 0x000d rdriv r rdpk 00 rdpe rdpd rdpc rdpb rdpa w = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 100 freescale semiconductor 0x000e 0x001b non-pim address range r non-pim address range w 0x001c eclkctl r neclk nclkx2 div16 ediv4 ediv3 ediv2 ediv1 ediv0 w 0x001d reserved r00000000 w 0x001e irqcr r irqe irqen 000000 w 0x001f reserved r00000000 w 0x0020 0x0031 non-pim address range r non-pim address range w 0x0032 portk r pk7 pk6 pk5 pk4 pk3 pk2 pk1 pk0 w 0x0033 ddrk r ddrk7 ddrk6 ddrk5 ddrk4 ddrk3 ddrk2 ddrk1 ddrk0 w 0x0034 0x023f non-pim address range r non-pim address range w 0x0240 ptt r ptt7 ptt6 ptt5 ptt4 ptt3 ptt2 ptt1 ptt0 w 0x0241 ptit r ptit7 ptit6 ptit5 ptit4 ptit3 ptit2 ptit1 ptit0 w 0x0242 ddrt r ddrt7 ddrt6 ddrt5 ddrt4 ddrt3 ddrt2 ddrt1 ddrt0 w 0x0243 rdrt r rdrt7 rdrt6 rdrt5 rdrt4 rdrt3 rdrt2 rdrt1 rdrt0 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 101 0x0244 pert r pert7 pert6 pert5 pert4 pert3 pert2 pert1 pert0 w 0x0245 ppst r ppst7 ppst6 ppst5 ppst4 ppst3 ppst2 ppst1 ppst0 w 0x0246 reserved r00000000 w 0x0247 reserved r00000000 w 0x0248 pts r pts7 pts6 pts5 pts4 pts3 pts2 pts1 pts0 w 0x0249 ptis r ptis7 ptis6 ptis5 ptis4 ptis3 ptis2 ptis1 ptis0 w 0x024a ddrs r ddrs7 ddrs6 ddrs5 ddrs4 ddrs3 ddrs2 ddrs1 ddrs0 w 0x024b rdrs r rdrs7 rdrs6 rdrs5 rdrs4 rdrs3 rdrs2 rdrs1 rdrs0 w 0x024c pers r pers7 pers6 pers5 pers4 pers3 pers2 pers1 pers0 w 0x024d ppss r ppss7 ppss6 ppss5 ppss4 ppss3 ppss2 ppss1 ppss0 w 0x024e woms r woms7 woms6 woms5 woms4 woms3 woms2 woms1 woms0 w 0x024f reserved r00000000 w 0x0250 ptm r ptm7 ptm6 ptm5 ptm4 ptm3 ptm2 ptm1 ptm0 w 0x0251 ptim r ptim7 ptim6 ptim5 ptim4 ptim3 ptim2 ptim1 ptim0 w 0x0252 ddrm r ddrm7 ddrm6 ddrm5 ddrm4 ddrm3 ddrm2 ddrm1 ddrm0 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 102 freescale semiconductor 0x0253 rdrm r rdrm7 rdrm6 rdrm5 rdrm4 rdrm3 rdrm2 rdrm1 rdrm0 w 0x0254 perm r perm7 perm6 perm5 perm4 perm3 perm2 perm1 perm0 w 0x0255 ppsm r ppsm7 ppsm6 ppsm5 ppsm4 ppsm3 ppsm2 ppsm1 ppsm0 w 0x0256 womm r womm7 womm6 womm5 womm4 womm3 womm2 womm1 womm0 w 0x0257 modrr r0 modrr6 modrr5 modrr4 modrr3 modrr2 modrr1 modrr0 w 0x0258 ptp r ptp7 ptp6 ptp5 ptp4 ptp3 ptp2 ptp1 ptp0 w 0x0259 ptip r ptip7 ptip6 ptip5 ptip4 ptip3 ptip2 ptip1 ptip0 w 0x025a ddrp r ddrp7 ddrp6 ddrp5 ddrp4 ddrp3 ddrp2 ddrp1 ddrp0 w 0x025b rdrp r rdrp7 rdrp6 rdrp5 rdrp4 rdrp3 rdrp2 rdrp1 rdrp0 w 0x025c perp r perp7 perp6 perp5 perp4 perp3 perp2 perp1 perp0 w 0x025d ppsp r ppsp7 ppsp6 ppsp5 ppsp4 ppsp3 ppsp2 ppsp1 ppsp0 w 0x025e piep r piep7 piep6 piep5 piep4 piep3 piep2 piep1 piep0 w 0x025f pifp r pifp7 pifp6 pifp5 pifp4 pifp3 pifp2 pifp1 pifp0 w 0x0260 pth r pth7 pth6 pth5 pth4 pth3 pth2 pth1 pth0 w 0x0261 ptih r ptih7 ptih6 ptih5 ptih4 ptih3 ptih2 ptih1 ptih0 w 0x0262 ddrh r ddrh7 ddrh6 ddrh5 ddrh4 ddrh3 ddrh2 ddrh1 ddrh0 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 103 0x0263 rdrh r rdrh7 rdrh6 rdrh5 rdrh4 rdrh3 rdrh2 rdrh1 rdrh0 w 0x0264 perh r perh7 perh6 perh5 perh4 perh3 perh2 perh1 perh0 w 0x0265 ppsh r ppsh7 ppsh6 ppsh5 ppsh4 ppsh3 ppsh2 ppsh1 ppsh0 w 0x0266 pieh r pieh7 pieh6 pieh5 pieh4 pieh3 pieh2 pieh1 pieh0 w 0x0267 pifh r pifh7 pifh6 pifh5 pifh4 pifh3 pifh2 pifh1 pifh0 w 0x0268 ptj r ptj7 ptj6 ptj5 ptj4 ptj3 ptj2 ptj1 ptj0 w 0x0269 ptij r ptij7 ptij6 ptij5 ptij4 ptij3 ptij2 ptij1 ptij0 w 0x026a ddrj r ddrj7 ddrj6 ddrj5 ddrj4 ddrj3 ddrj2 ddrj1 ddrj0 w 0x026b rdrj r rdrj7 rdrj6 rdrj5 rdrj4 rdrj3 rdrj2 rdrj1 rdrj0 w 0x026c perj r perj7 perj6 perj5 perj4 perj3 perj2 perj1 perj0 w 0x026d ppsj r ppsj7 ppsj6 ppsj5 ppsj4 ppsj3 ppsj2 ppsj1 ppsj0 w 0x026e piej r piej7 piej6 piej5 piej4 piej3 piej2 piej1 piej0 w 0x026f pifj r pifj7 pifj6 pifj5 pifj4 pifj3 pifj2 pifj1 pifj0 w 0x0270 pt0ad0 r pt0ad07 pt0ad06 pt0ad05 pt0ad04 pt0ad03 pt0ad02 pt0ad01 pt0ad00 w 0x0271 pt1ad0 r pt1ad07 pt1ad06 pt1ad05 pt1ad04 pt1ad03 pt1ad02 pt1ad01 pt1ad00 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 104 freescale semiconductor 0x0272 ddr0ad0 r ddr0ad07 ddr0ad06 ddr0ad05 ddr0ad04 ddr0ad03 ddr0ad02 ddr0ad01 ddr0ad00 w 0x0273 ddr1ad0 r ddr1ad07 ddr1ad06 ddr1ad05 ddr1ad04 ddr1ad03 ddr1ad02 ddr1ad01 ddr1ad00 w 0x0274 rdr0ad0 r rdr0ad07 rdr0ad06 rdr0ad05 rdr0ad04 rdr0ad03 rdr0ad02 rdr0ad01 rdr0ad00 w 0x0275 rdr1ad0 r rdr1ad07 rdr1ad06 rdr1ad05 rdr1ad04 rdr1ad03 rdr1ad02 rdr1ad01 rdr1ad00 w 0x0276 per0ad0 r per0ad07 per0ad06 per0ad05 per0ad04 per0ad03 per0ad02 per0ad01 per0ad00 w 0x0277 per1ad0 r per1ad07 per1ad06 per1ad05 per1ad04 per1ad03 per1ad02 per1ad01 per1ad00 w 0x0278 pt0ad1 r pt0ad17 pt0ad16 pt0ad15 pt0ad14 pt0ad13 pt0ad12 pt0ad11 pt0ad10 w 0x0279 pt1ad1 r pt1ad17 pt1ad16 pt1ad15 pt1ad14 pt1ad13 pt1ad12 pt1ad11 pt1ad10 w 0x027a ddr0ad1 r ddr0ad17 ddr0ad16 ddr0ad15 ddr0ad14 ddr0ad13 ddr0ad12 ddr0ad11 ddr0ad10 w 0x027b ddr1ad1 r ddr1ad17 ddr1ad16 ddr1ad15 ddr1ad14 ddr1ad13 ddr1ad12 ddr1ad11 ddr1ad10 w 0x027c rdr0ad1 r rdr0ad17 rdr0ad16 rdr0ad15 rdr0ad14 rdr0ad13 rdr0ad12 rdr0ad11 rdr0ad10 w 0x027d rdr1ad1 r rdr1ad17 rdr1ad16 rdr1ad15 rdr1ad14 rdr1ad13 rdr1ad12 rdr1ad11 rdr1ad10 w 0x027e per0ad1 r per0ad17 per0ad16 per0ad15 per0ad14 per0ad13 per0ad12 per0ad1 per0ad10 w 0x027f per1ad1 r per1ad17 per1ad16 per1ad15 per1ad14 per1ad13 per1ad12 per1ad11 per1ad10 w 0x0280 0x0267 non-pim address range r non-pim address range w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 105 0x0368 ptr r ptr7 ptr6 ptr5 ptr4 ptr3 ptr2 ptr1 ptr0 w 0x0369 ptir r ptir7 ptir6 ptir5 ptir4 ptir3 ptir2 ptir1 ptir0 w 0x036a ddrr r ddrr7 ddrr6 ddrr5 ddrr4 ddrr3 ddrr2 ddrr1 ddrr0 w 0x036b rdrr r rdrr7 rdrr6 rdrr5 rdrr4 rdrr3 rdrr2 rdrr1 rdrr0 w 0x036c perr r perr7 perr6 perr5 perr4 perr3 perr2 perr1 perr0 w 0x036d ppsr r ppsr7 ppsr6 ppsr5 ppsr4 ppsr3 ppsr2 ppsr1 ppsr0 w 0x036e reserved r00000000 w 0x036f ptrrr r ptrrr7 ptrrr6 ptrrr5 ptrrr4 ptrrr3 ptrrr2 ptrrr1 ptrrr0 w 0x0370 ptl r ptl7 ptl6 ptl5 ptl4 ptl3 ptl2 ptl1 ptl0 w 0x0371 ptil r ptil7 ptil6 ptil5 ptil4 ptil3 ptil2 ptil1 ptil0 w 0x0372 ddrl r ddrl7 ddrl6 ddrl5 ddrl4 ddrl3 ddrl2 ddrl1 ddrl0 w 0x0373 rdrl r rdrl7 rdrl6 rdrl5 rdrl4 rdrl3 rdrl2 rdrl1 rdrl0 w 0x0374 perl r perl7 perl6 perl5 perl4 perl3 perl2 perl1 perl0 w 0x0375 ppsl r ppsl7 ppsl6 ppsl5 ppsl4 ppsl3 ppsl2 ppsl1 ppsl0 w 0x0376 woml r woml7 woml6 woml5 woml4 woml3 woml2 woml1 woml0 w 0x0377 ptlrr r ptlrr7 ptlrr6 ptlrr5 ptlrr4 0000 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 106 freescale semiconductor 2.3.2 register descriptions the following table summarizes the effect of the various con?uration bits, i.e. data direction (ddr), output level (io), reduced drive (rdr), pull enable (pe), pull select (ps) on the pin function and pull device activity. the con?uration bit ps is used for two purposes: 1. con?ure the sensitive interrupt edge (rising or falling), if interrupt is enabled. 2. select either a pull-up or pull-down device if pe is active. 0x0378 ptf r ptf7 ptf6 ptf5 ptf4 ptf3 ptf2 ptf1 ptf0 w 0x0379 ptif r ptif7 ptif6 ptif5 ptif4 ptif3 ptif2 ptif1 ptif0 w 0x037a ddrf r ddrf7 ddrf6 ddrf5 ddrf4 ddrf3 ddrf2 ddrf1 ddrf0 w 0x037b rdrf r rdrf7 rdrf6 rdrf5 rdrf4 rdrf3 rdrf2 rdrf1 rdrf0 w 0x037c perf r perf7 perf6 perf5 perf4 perf3 perf2 perf1 perf0 w 0x037d ppsf r ppsf7 ppsf6 ppsf5 ppsf4 ppsf3 ppsf2 ppsf1 ppsf0 w 0x037e reserved r00000000 w 0x037f ptfrr r0 0 ptfrr5 ptfrr4 ptfrr3 ptfrr2 ptfrr1 ptfrr0 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 107 table 2-3. pin con?uration summary note all register bits in this module are completely synchronous to internal clocks during a register read. ddr io rdr pe ps (1) 1. always ??on port a, b, c, d, e, k, ad0, and ad1. ie (2) 2. applicable only on port p, h, and j. function pull device interrupt 0 x x 0 x 0 input disabled disabled 0 x x 1 0 0 input pull up disabled 0 x x 1 1 0 input pull down disabled 0 x x 0 0 1 input disabled falling edge 0 x x 0 1 1 input disabled rising edge 0 x x 1 0 1 input pull up falling edge 0 x x 1 1 1 input pull down rising edge 1 0 0 x x 0 output, full drive to 0 disabled disabled 1 1 0 x x 0 output, full drive to 1 disabled disabled 1 0 1 x x 0 output, reduced drive to 0 disabled disabled 1 1 1 x x 0 output, reduced drive to 1 disabled disabled 1 0 0 x 0 1 output, full drive to 0 disabled falling edge 1 1 0 x 1 1 output, full drive to 1 disabled rising edge 1 0 1 x 0 1 output, reduced drive to 0 disabled falling edge 1 1 1 x 1 1 output, reduced drive to 1 disabled rising edge chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 108 freescale semiconductor 2.3.3 port a data register (porta) 2.3.4 port b data register (portb) address 0x0000 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r pa 7 pa 6 pa 5 pa4 pa3 pa2 pa1 pa0 w altern. function addr15 mux ivd15 addr14 mux ivd14 addr13 mux ivd13 addr12 mux ivd12 addr11 mux ivd11 addr10 mux ivd10 addr9 mux ivd9 addr8 mux ivd8 reset 00000000 figure 2-1. port a data register (porta) table 2-4. porta register field descriptions field description 7-0 pa port a general purpose input/output data ?ata register port a pins 7 through 0 are associated with address outputs addr[15:8] respectively in expanded modes. in emulation modes the address is multiplexed with ivd[15:8]. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0001 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r pb7 pb6 pb5 pb4 pb3 pb2 pb1 pb0 w altern. function addr7 mux ivd7 addr6 mux ivd6 addr5 mux ivd5 addr4 mux ivd4 addr3 mux ivd3 addr2 mux ivd2 addr1 mux ivd1 addr0 mux ivd0 or uds reset 00000000 figure 2-2. port b data register (portb) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 109 2.3.5 port a data direction register (ddra) 2.3.6 port b data direction register (ddrb) table 2-5. portb register field descriptions field description 7-0 pb port b general purpose input/output data ?ata register port b pins 7 through 0 are associated with address outputs addr[7:0] respectively in expanded modes. in emulation modes the address is multiplexed with ivd[7:0]. in normal expanded mode pin 0 is related to the uds input. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0002 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r ddra7 ddra6 ddra5 ddra4 ddra3 ddra2 ddra1 ddra0 w reset 00000000 figure 2-3. port a data direction register (ddra) table 2-6. ddra register field descriptions field description 7-0 ddra port a data direction this register controls the data direction of pins 7 through 0. the external bus function forces the i/o state to be outputs for all associated pins. in this case the data direction bits will not change. when operating a pin as a general purpose i/o, the associated data direction bit determines whether it is an input or output. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. address 0x0003 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r ddrb7 ddrb6 ddrb5 ddrb4 ddrb3 ddrb2 ddrb1 ddrb0 w reset 00000000 figure 2-4. port b data direction register (ddrb) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 110 freescale semiconductor 2.3.7 port c data register (portc) table 2-7. ddrb register field descriptions field description 7-0 ddrb port b data direction this register controls the data direction of pins 7 through 0. the external bus function forces the i/o state to be outputs for all associated pins. in this case the data direction bits will not change. when operating a pin as a general purpose i/o, the associated data direction bit determines whether it is an input or output. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. address 0x0004 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r pc7 pc6 pc5 pc4 pc3 pc2 pc1 pc0 w altern. function data15 data14 data13 data12 data11 data10 data9 data8 reset 00000000 figure 2-5. port c data register (portc) table 2-8. portc register field descriptions field description 7-0 pc port c general purpose input/output data ?ata register port c pins 7 through 0 are associated with data i/o lines data[15:8] respectively in expanded modes. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 111 2.3.8 port d data register (portd) 2.3.9 port c data direction register (ddrc) address 0x0005 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r pd7 pd6 pd5 pd4 pd3 pd2 pd1 pd0 w altern. function data7 data6 data5 data4 data3 data2 data1 data0 reset 00000000 figure 2-6. port d data register (portd) table 2-9. portd register field descriptions field description 7-0 pd port d general purpose input/output data ?ata register port d pins 7 through 0 are associated with data i/o lines data[7:0] respectively in expanded modes. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0006 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r ddrc7 ddrc6 ddrc5 ddrc4 ddrc3 ddrc2 ddrc1 ddrc0 w reset 00000000 figure 2-7. port c data direction register (ddrc) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 112 freescale semiconductor 2.3.10 port d data direction register (ddrd) table 2-10. ddrc register field descriptions field description 7-0 ddrc port c data direction this register controls the data direction of pins 7 through 0. the external bus function controls the data direction for the associated pins. in this case the data direction bits will not change. when operating a pin as a general purpose i/o, the associated data direction bit determines whether it is an input or output. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. address 0x0007 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r ddrd7 ddrd6 ddrd5 ddrd4 ddrd3 ddrd2 ddrd1 ddrd0 w reset 00000000 figure 2-8. port d data direction register (ddrd) table 2-11. ddrd register field descriptions field description 7-0 ddrd port d data direction this register controls the data direction of pins 7 through 0. when used with the external bus this function controls the data direction for the associated pins. in this case the data direction bits will not change. when operating a pin as a general purpose i/o, the associated data direction bit determines whether it is an input or output. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 113 2.3.11 port e data register (porte) address 0x0008 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r pe7 pe6 pe5 pe4 pe3 pe2 pe1 pe0 w altern. function xclks or eclkx2 modb or taghi moda or re or taglo eclk eromctl or lstrb or lds r w or we irq xirq reset 000000 (2) 2. these registers are reset to zero. two bus clock cycles after reset release the register values are updated with the associated pin values. 2 = unimplemented or reserved figure 2-9. port e data register (porte) table 2-12. porte register field descriptions field description 7-2 pe port e general purpose input/output data ?ata register port e bits 7 through 0 are associated with external bus control signals and interrupt inputs. these include mode select (modb, moda), e clock, double frequency e clock, instruction tagging high and low ( t a ghi, t a glo), read/write (r w), read enable and write enable ( re, we), lower data select ( lds). when not used with the alternative functions, port e pins 7-2 can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. pins 6 and 5 are inputs with enabled pull-down devices while reset pin is low. pins 7 and 3 are inputs with enabled pull-up devices while reset pin is low. 1 pe port e general purpose input data and interrupt ?ata register, irq input. this pin can be used as general purpose and irq input. 0 pe port e general purpose input data and interrupt ?ata register, xirq input. this pin can be used as general purpose and xirq input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 114 freescale semiconductor 2.3.12 port e data direction register (ddre) 2.3.13 s12x_ebi ports, bkgd pin pull-up control register (pucr) address 0x0009 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r ddre7 ddre6 ddre5 ddre4 ddre3 ddre2 00 w reset 00000000 = unimplemented or reserved figure 2-10. port e data direction register (ddre) table 2-13. ddre register field descriptions field description 7-2 ddre port e data direction this register controls the data direction of pins 7 through 2. the external bus function controls the data direction for the associated pins. in this case the data direction bits will not change. when operating a pin as a general purpose i/o, the associated data direction bit determines whether it is an input or output. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. 1-0 reserved port e bit 1 (associated with irq) and bit 0 (associated with xirq) cannot be con?ured as outputs. port e, bits 1 and 0, can be read regardless of whether the alternate interrupt function is enabled. address 0x000c (prr) access: user read/write (1) 1. read:anytime in single-chip modes. write:anytime, except bkpue which is writable in special test mode only. 76543210 r pupke bkpue 0 pupee pupde pupce pupbe pupae w reset 11010000 = unimplemented or reserved figure 2-11. s12x_ebi ports, bkgd pin pull-up control register (pucr) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 115 table 2-14. pucr register field descriptions field description 7 pupke pull-up port k enable ?nable pull-up devices on all port k input pins this bit con?ures whether pull-up devices are activated, if the pins are used as inputs. this bit has no effect if the pins are used as outputs. out of reset the pull-up devices are enabled. 1 pull-up devices enabled. 0 pull-up devices disabled. 6 bkpue bkgd pin pull-up enable ?nable pull-up devices on bkgd pin this bit con?ures whether a pull-up device is activated, if the pin is used as input. this bit has no effect if the pin is used as outputs. out of reset the pull-up device is enabled. 1 pull-up device enabled. 0 pull-up device disabled. 5 reserved 4 pupee pull-up port e enable ?nable pull-up devices on all port e input pins except on pins 5 and 6 which have pull-down devices only enabled during reset. this bit has no effect on these pins. this bit con?ures whether pull-up devices are activated, if the pins are used as inputs. this bit has no effect if the pins are used as outputs. out of reset the pull-up devices are enabled. 1 pull-up devices enabled. 0 pull-up devices disabled. 3 pupde pull-up port d enable ?nable pull-up devices on all port d input pins this bit con?ures whether pull-up devices are activated, if the pins are used as inputs. this bit has no effect if the pins are used as outputs. out of reset the pull-up devices are disabled. 1 pull-up devices enabled. 0 pull-up devices disabled. 2 pupce pull-up port c enable ?nable pull-up devices on all port c input pins this bit con?ures whether pull-up devices are activated, if the pins are used as inputs. this bit has no effect if the pins are used as outputs. out of reset the pull-up devices are disabled. 1 pull-up devices enabled. 0 pull-up devices disabled. 1 pupbe pull-up port b enable ?nable pull-up devices on all port b input pins this bit con?ures whether pull-up devices are activated, if the pins are used as inputs. this bit has no effect if the pins are used as outputs. out of reset the pull-up devices are disabled. 1 pull-up devices enabled. 0 pull-up devices disabled. 0 pupae pull-up port a enable ?nable pull-up devices on all port a input pins this bit con?ures whether pull-up devices are activated, if the pins are used as inputs. this bit has no effect if the pins are used as outputs. out of reset the pull-up devices are disabled. 1 pull-up devices enabled. 0 pull-up devices disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 116 freescale semiconductor 2.3.14 s12x_ebi ports reduced drive register (rdriv) this register is used to select reduced drive for the pins associated with the s12x_ebi ports a, b, c, d, e, and k. if enabled, the pins drive at approx. 1/5 of the full drive strength. the reduced drive functionality does not take effect on the pins in emulation modes. address 0x000d (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r rdpk 00 rdpe rdpd rdpc rdpb rdpa w reset 00000000 = unimplemented or reserved figure 2-12. s12x_ebi ports reduced drive register (rdriv) table 2-15. rdriv register field descriptions field description 7 rdpk port k reduced drive ?elect reduced drive for outputs this bit con?ures the drive strength of all port k output pins as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. 6-5 reserved 4 rdpe port e reduced drive ?elect reduced drive for outputs this bit con?ures the drive strength of all port e output pins as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. 3 rdpd port d reduced drive ?elect reduced drive for outputs this bit con?ures the drive strength of all output pins as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. 2 rdpc port c reduced drive ?elect reduced drive for outputs this bit con?ures the drive strength of all output pins as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 117 2.3.15 eclk control register (eclkctl) 1 rdpb port b reduced drive ?elect reduced drive for outputs this bit con?ures the drive strength of all output pins as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. 0 rdpa port a reduced drive ?elect reduced drive for outputs this bit con?ures the drive strength of all output pins as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x001c (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r neclk nclkx2 div16 ediv4 ediv3 ediv2 ediv1 ediv0 w reset (2) : 2. reset values in emulation modes are identical to those of the target mode. mode depen- dent 1000000 ss01000000 es11000000 st01000000 ex01000000 ns11000000 nx01000000 = unimplemented or reserved figure 2-13. eclk control register (eclkctl) table 2-15. rdriv register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 118 freescale semiconductor the eclkctl register is used to control the availability of the free-running clocks and the free-running clock divider. 2.3.16 pim reserved register table 2-16. eclkctl register field descriptions field description 7 neclk no eclk ?isable eclk output this bit controls the availability of a free-running clock on the eclk pin. clock output is always active in emulation modes and if enabled in all other operating modes. 1 eclk disabled 0 eclk enabled 6 nclkx2 no eclkx2 ?isable eclkx2 output this bit controls the availability of a free-running clock on the eclkx2 pin. this clock has a ?ed rate of twice the internal bus clock. clock output is always active in emulation modes and if enabled in all other operating modes. 1 eclkx2 disabled 0 eclkx2 enabled 5 div16 free-running eclk predivider ?ivide by 16 this bit enables a divide-by-16 stage on the selected ediv rate. 1 divider enabled: eclk rate = ediv rate divided by 16 0 divider disabled: eclk rate = ediv rate 4-0 ediv free-running eclk divider ?on?ure eclk rate these bits determine the rate of the free-running clock on the eclk pin. divider is always disabled in emulation modes and active as programmed in all other operating modes. 00000 eclk rate = bus clock rate 00001 eclk rate = bus clock rate divided by 2 00010 eclk rate = bus clock rate divided by 3, ... 11111 eclk rate = bus clock rate divided by 32 address 0x001d (prr) access: user read (1) 1. read: always reads 0x00 write: unimplemented 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 2-14. pim reserved register chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 119 2.3.17 irq control register (irqcr) 2.3.18 pim reserved register this register is reserved for factory testing of the pim module and is not available in normal operation. address 0x001e access: user read/write (1) 1. read: see individual bit descriptions below. write: see individual bit descriptions below. 76543210 r irqe irqen 000000 w reset 01000000 = unimplemented or reserved figure 2-15. irq control register (irqcr) table 2-17. irqcr register field descriptions field description 7 irqe irq select edge sensitive only special modes: read or write anytime. normal & emulation modes: read anytime, write once. 1 irq con?ured to respond only to falling edges. falling edges on the irq pin will be detected anytime irqe = 1 and will be cleared only upon a reset or the servicing of the irq interrupt. 0 irq con?ured for low level recognition. 6 irqen external irq enable read or write anytime. 1 external irq pin is connected to interrupt logic. 0 external irq pin is disconnected from interrupt logic. 5-0 reserved address 0x001f access: user read (1) 1. read: always reads 0x00 write: unimplemented note writing to this register when in special modes can alter the pin functionality. 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 2-16. pim reserved register chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 120 freescale semiconductor 2.3.19 port k data register (portk) 2.3.20 port k data direction register (ddrk) address 0x0032 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r pk7 pk6 pk5 pk4 pk3 pk2 pk1 pk0 w altern. function romctl or ewait addr22 mux acc2 addr21 mux acc1 addr20 mux acc0 addr19 mux iqstat3 addr18 mux iqstat2 addr17 mux iqstat1 addr16 mux iqstat0 reset 00000000 figure 2-17. port k data register (portk) table 2-18. portk register field descriptions field description 7-0 pk port k general purpose input/output data ?ata register port k pins 7 through 0 are associated with external bus control signals and internal memory expansion emulation pins. these include addr[22:16], access source (acc[2:0]), external wait ( ew ait) and instruction pipe signals iqstat[3:0]. bits 6-0 carry the external addresses in all expanded modes. in emulation modes the address is multiplexed with the alternate functions acc and iqstat on the respective pins. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0033 (prr) access: user read/write (1) 1. read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. write: anytime. in emulation modes, write operations will also be directed to the external bus. 76543210 r ddrk7 ddrk6 ddrk5 ddrk4 ddrk3 ddrk2 ddrk1 ddrk0 w reset 00000000 figure 2-18. port k data direction register (ddrk) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 121 2.3.21 port t data register (ptt) table 2-19. ddrk register field descriptions field description 7-0 ddrk port k data direction this register controls the data direction of pins 7 through 0. the external bus function controls the data direction for the associated pins. in this case the data direction bits will not change. when operating a pin as a general purpose i/o, the associated data direction bit determines whether it is an input or output. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. address 0x0240 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptt7 ptt6 ptt5 ptt4 ptt3 ptt2 ptt1 ptt0 w altern. function ioc7 ioc6 ioc5 ioc4 ioc3 ioc2 ioc1 ioc0 vreg_api reset 00000000 figure 2-19. port t data register (ptt) table 2-20. ptt register field descriptions field description 7-6 ptt port t general purpose input/output data ?ata register port t pins 7 through 0 are associated with ect channels ioc7 and ioc6. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 ptt port t general purpose input/output data ?ata register port t pins 5 is associated with ect channel ioc5 and the vreg_api output. the ect function takes precedence over the vreg_api and the general purpose i/o function if the related channel is enabled. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 4-0 ptt port t general purpose input/output data ?ata register port t pins 4 through 0 are associated with ect channels ioc4 through ioc0. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 122 freescale semiconductor 2.3.22 port t input register (ptit) 2.3.23 port t data direction register (ddrt) address 0x0241 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptit7 ptit6 ptit5 ptit4 ptit3 ptit2 ptit1 ptit0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-20. port t input register (ptit) table 2-21. ptit register field descriptions field description 7-0 ptit port t input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x0242 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddrt7 ddrt6 ddrt5 ddrt4 ddrt3 ddrt2 ddrt1 ddrt0 w reset 00000000 figure 2-21. port t data direction register (ddrt) table 2-22. ddrt register field descriptions field description 7-0 ddrt port t data direction this register controls the data direction of pins 7 through 0. the ect forces the i/o state to be an output for each timer port associated with an enabled output compare. in this case the data direction bits will not change. the data direction bits revert to controlling the i/o direction of a pin when the associated timer output compare is disabled. the timer input capture always monitors the state of the pin. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 123 note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on ptt or ptit registers, when changing the ddrt register. 2.3.24 port t reduced drive register (rdrt) 2.3.25 port t pull device enable register (pert) address 0x0243 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrt7 rdrt6 rdrt5 rdrt4 rdrt3 rdrt2 rdrt1 rdrt0 w reset 00000000 figure 2-22. port t reduced drive register (rdrt) table 2-23. rdrt register field descriptions field description 7-0 rdrt port t reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x0244 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pert7 pert6 pert5 pert4 pert3 pert2 pert1 pert0 w reset 00000000 figure 2-23. port t pull device enable register (pert) table 2-24. pert register field descriptions field description 7-0 pert port t pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 124 freescale semiconductor 2.3.26 port t polarity select register (ppst) 2.3.27 pim reserved register 2.3.28 pim reserved register address 0x0245 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppst7 ppst6 ppst5 ppst4 ppst3 ppst2 ppst1 ppst0 w reset 00000000 figure 2-24. port t polarity select register (ppst) table 2-25. ppst register field descriptions field description 7-0 ppst port t pull device select ?etermine pull device polarity on input pins this register selects whether a pull-down or a pull-up device is connected to the pin. 1 a pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 a pull-up device is connected to the associated pin, if enabled and if the pin is used as input. address 0x0246 access: user read (1) 1. read: always reads 0x00 write: unimplemented 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 2-25. pim reserved register address 0x0247 access: user read (1) 1. read: always reads 0x00 write: unimplemented 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 2-26. pim reserved register chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 125 2.3.29 port s data register (pts) address 0x0248 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pts7 ptst6 pts5 pts4 pts3 pts2 pts1 pts0 w altern. function ss0 sck0 mosi0 miso0 txd1 rxd1 txd0 rxd0 reset 00000000 figure 2-27. port s data register (pts) table 2-26. pts register field descriptions field description 7 pts port s general purpose input/output data ?ata register port s pin 7 is associated with the ss signal of the spi0 module . when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 pts port s general purpose input/output data ?ata register port s pin 6 is associated with the sck signal of the spi0 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 pts port s general purpose input/output data ?ata register port s pin 5 is associated with the mosi signal of the spi0 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 4 pts port s general purpose input/output data ?ata register port s pin 4 is associated with the miso signal of the spi0 module . when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 3 pts port s general purpose input/output data ?ata register port s pin 3 is associated with the txd signal of the sci1 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2 pts port s general purpose input/output data ?ata register port s bits 2 is associated with the rxd signal of the sci1 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 126 freescale semiconductor 2.3.30 port s input register (ptis) 2.3.31 port s data direction register (ddrs) 1 pts port s general purpose input/output data ?ata register port s pin 3 is associated with the txd signal of the sci0 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 pts port s general purpose input/output data ?ata register port s bits 2 is associated with the rxd signal of the sci0 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0249 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptis7 ptis6 ptis5 ptis4 ptis3 ptis2 ptis1 ptis0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-28. port s input register (ptis) table 2-27. ptis register field descriptions field description 7-0 ptis port s input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x024a access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddrs7 ddrs6 ddrs5 ddrs4 ddrs3 ddrs2 ddrs1 ddrs0 w reset 00000000 figure 2-29. port s data direction register (ddrs) table 2-26. pts register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 127 note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on pts or ptis registers, when changing the ddrs register. 2.3.32 port s reduced drive register (rdrs) table 2-28. ddrs register field descriptions field description 7-0 ddrs port s data direction this register controls the data direction of pins 7 through 0.this register con?ures each port s pin as either input or output. if spi0 is enabled, the spi0 determines the pin direction. refer to spi section for details . if the associated sci transmit or receive channel is enabled this register has no effect on the pins. the pin is forced to be an output if a sci transmit channel is enabled, it is forced to be an input if the sci receive channel is enabled. the data direction bits revert to controlling the i/o direction of a pin when the associated channel is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. address 0x024b access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrs7 rdrs6 rdrs5 rdrs4 rdrs3 rdrs2 rdrs1 rdrs0 w reset 00000000 figure 2-30. port s reduced drive register (rdrs) table 2-29. rdrs register field descriptions field description 7-0 rdrs port s reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 128 freescale semiconductor 2.3.33 port s pull device enable register (pers) 2.3.34 port s polarity select register (ppss) address 0x024c access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pers7 pers6 pers5 pers4 pers3 pers2 pers1 pers0 w reset 11111111 figure 2-31. port s pull device enable register (pers) table 2-30. pers register field descriptions field description 7-0 pers port s pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset all pull devices are enabled. 1 pull device enabled. 0 pull device disabled. address 0x024d access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppss7 ppss6 ppss5 ppss4 ppss3 ppss2 ppss1 ppss0 w reset 00000000 figure 2-32. port s polarity select register (ppss) table 2-31. ppss register field descriptions field description 7-0 ppss port s pull device select ?etermine pull device polarity on input pins this register selects whether a pull-down or a pull-up device is connected to the pin. 1 a pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 a pull-up device is connected to the associated pin, if enabled and if the pin is used as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 129 2.3.35 port s wired-or mode register (woms) 2.3.36 pim reserved register address 0x024e access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r woms7 woms6 woms5 woms4 woms3 woms2 woms1 woms0 w reset 00000000 figure 2-33. port s wired-or mode register (woms) table 2-32. woms register field descriptions field description 7-0 woms port s wired-or mode ?nable wired-or functionality this register con?ures the output pins as wired-or independent of the function used on the pins. if enabled the output is driven active low only (open-drain). a logic level of ??is not driven.this allows a multipoint connection of several serial modules. these bits have no in?ence on pins used as inputs. 1 output buffers operate as open-drain outputs. 0 output buffers operate as push-pull outputs. address 0x024f access: user read (1) 1. read: always reads 0x00 write: unimplemented 76543210 r00000000 w reset 00000000 = unimplemented or reserved u = unaffected by reset figure 2-34. pim reserved register chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 130 freescale semiconductor 2.3.37 port m data register (ptm) address 0x0250 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptm7 ptm6 ptm5 ptm4 ptm3 ptm2 ptm1 ptm0 w altern. function txcan3 rxcan3 txcan2 rxcan2 txcan1 rxcan1 txcan0 rxcan0 (txcan0) (rxcan0) (txcan0) (rxcan0) (txcan4) (rxcan4) (txcan4) (rxcan4) (sck0) (mosi0) ( ss0) (miso0) txd3 rxd3 reset 00000000 figure 2-35. port m data register (ptm) table 2-33. ptm register field descriptions field description 7-6 ptm port m general purpose input/output data ?ata register port m pins 7 and 6 are associated with txcan and rxcan signals of can3 and the routed can4, as well as with txd and rxd signals of sci3, respectively. the can3 function takes precedence over the can4, sci3 and the general purpose i/o function if the can3 module is enabled. the can4 function takes precedence over the sci3 and the general purpose i/o function if the can4 module is enabled. the sci3 function takes precedence over the general purpose i/o function if the sci3 module is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 ptm port m general purpose input/output data ?ata register port m pin 5 is associated with the txcan signal of can2 and the routed can4 and can0, as well as with sck signals of spi0. the can2 function takes precedence over the routed can0, routed can4, the routed spi0 and the general purpose i/o function if the can2 module is enabled. the routed can0 function takes precedence over the routed can4, the routed spi0 and the general purpose i/o function if the routed can0 module is enabled. the routed can4 function takes precedence over the routed spi0 and general purpose i/o function if the routed can4 module is enabled. the routed spi0 function takes precedence of the general purpose i/o function if the routed spi0 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 131 2.3.38 port m input register (ptim) 4 ptm port m general purpose input/output data ?ata register port m pin 4 is associated with the rxcan signal of can2 and the routed can4 and can0, as well as with mosi signals of spi0. the can2 function takes precedence over the routed can0, routed can4, the routed spi0 and the general purpose i/o function if the can2 module is enabled. the routed can0 function takes precedence over the routed can4, the routed spi0 and the general purpose i/o function if the routed can0 module is enabled. the routed can4 function takes precedence over the routed spi0 and general purpose i/o function if the routed can4 module is enabled. the routed spi0 function takes precedence of the general purpose i/o function if the routed spi0 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 3 ptm port m general purpose input/output data ?ata register port m pin 5 is associated with the txcan signal of can1 and the routed can0, as well as with ss0 signals of spi0. the can1 function takes precedence over the routed can0, the routed spi0 and the general purpose i/o function if the can1 module is enabled. the routed can0 function takes precedence over the routed spi0 and the general purpose i/o function if the routed can0 module is enabled. the routed spi0 function takes precedence of the general purpose i/o function if the routed spi0 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2 ptm port m general purpose input/output data ?ata register port m pin 4 is associated with the rxcan signal of can1 and the routed can0, as well as with miso signals of spi0. the can1 function takes precedence over the routed can0, the routed spi0 and the general purpose i/o function if the can1 module is enabled. the routed can0 function takes precedence over the routed spi0 and the general purpose i/o function if the routed can0 module is enabled. the routed spi0 function takes precedence of the general purpose i/o function if the routed spi0 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 1-0 ptm port m general purpose input/output data ?ata register port m pins 1 and 0 are associated with txcan and rxcan signals of can0, respectively. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0251 access: user read (1) 76543210 r ptim7 ptim6 ptim5 ptim4 ptim3 ptim2 ptim1 ptim0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-36. port m input register (ptim) table 2-33. ptm register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 132 freescale semiconductor 2.3.39 port m data direction register (ddrm) 1. read: anytime. write:never, writes to this register have no effect. table 2-34. ptim register field descriptions field description 7-0 ptim port m input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x0252 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddrm7 ddrm6 ddrm5 ddrm4 ddrm3 ddrm2 ddrm1 ddrm0 w reset 00000000 figure 2-37. port m data direction register (ddrm) table 2-35. ddrm register field descriptions field description 7 ddrm port m data direction this register controls the data direction of pin 7. the enabled can3, routed can4, or routed sci3 forces the i/o state to be an output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 6 ddrm port m data direction this register controls the data direction of pin 6. the enabled can3, routed can4, or routed sci3 forces the i/o state to be an input. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 5 ddrm port m data direction this register controls the data direction of pin 5. the enabled can2, routed can0, or routed can4 forces the i/o state to be an output. depending on the con?uration of the enabled routed spi0 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 133 note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on ptm or ptim registers, when changing the ddrm register. 4 ddrm port m data direction this register controls the data direction of pin 4. the enabled can2, routed can0, or routed can4 forces the i/o state to be an input. depending on the con?uration of the enabled routed spi0 this pin will be forced to be input or output.in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 3 ddrm port m data direction this register controls the data direction of pin 3. the enabled can1 or routed can0 forces the i/o state to be an output. depending on the con?uration of the enabled routed spi0 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 2 ddrm port m data direction this register controls the data direction of pin 2. the enabled can1 or routed can0 forces the i/o state to be an input. depending on the con?uration of the enabled routed spi0 this pin will be forced to be input or output.in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 1 ddrm port m data direction this register controls the data direction of pin 1. the enabled can0 forces the i/o state to be an output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 0 ddrm port m data direction this register controls the data direction of pin 0. the enabled can0 forces the i/o state to be an input. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. table 2-35. ddrm register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 134 freescale semiconductor 2.3.40 port m reduced drive register (rdrm) 2.3.41 port m pull device enable register (perm) address 0x0253 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrm7 rdrm6 rdrm5 rdrm4 rdrm3 rdrm2 rdrm1 rdrm0 w reset 00000000 figure 2-38. port m reduced drive register (rdrm) table 2-36. rdrm register field descriptions field description 7-0 rdrm port m reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of port m output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x0254 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r perm7 perm6 perm5 perm4 perm3 perm2 perm1 perm0 w reset 00000000 figure 2-39. port m pull device enable register (perm) table 2-37. perm register field descriptions field description 7-0 perm port m pull device enable ?nable pull-up devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input or wired-or output. this bit has no effect if the pin is used as push-pull output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 135 2.3.42 port m polarity select register (ppsm) 2.3.43 port m wired-or mode register (womm) address 0x0255 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsm7 ppsm6 ppsm5 ppsm4 ppsm3 ppsm2 ppsm1 ppsm0 w reset 00000000 figure 2-40. port m polarity select register (ppsm) table 2-38. ppsm register field descriptions field description 7-0 ppsm port m pull device select ?etermine pull device polarity on input pins this register selects whether a pull-down or a pull-up device is connected to the pin. if can is active a pull-up device can be activated on the rxcan[3:0] inputs, but not a pull-down. 1 a pull-down device is connected to the associated port m pin, if enabled by the associated bit in register perm and if the port is used as a general purpose but not as rxcan. 0 a pull-up device is connected to the associated port m pin, if enabled by the associated bit in register perm and if the port is used as general purpose or rxcan input. address 0x0256 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r womm7 womm6 womm5 womm4 womm3 womm2 womm1 womm0 w reset 00000000 figure 2-41. port m wired-or mode register (womm) table 2-39. womm register field descriptions field description 7-0 womm port m wired-or mode ?nable wired-or functionality this register con?ures the output pins as wired-or independent of the function used on the pins. if enabled the output is driven active low only (open-drain). a logic level of ??is not driven.this allows a multipoint connection of several serial modules. these bits have no in?ence on pins used as inputs. 1 output buffers operate as open-drain outputs. 0 output buffers operate as push-pull outputs. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 136 freescale semiconductor 2.3.44 module routing register (modrr) this register configures the re-routing of can0, can4, spi0, spi1, and spi2 on alternative ports. address 0x0257 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r0 modrr6 modrr5 modrr4 modrr3 modrr2 modrr1 modrr0 w reset 00000000 = unimplemented or reserved figure 2-42. module routing register (modrr) table 2-40. module routing summary module modrr related pins 6543210 rxcan txcan can0 x xxxx00 pm0 pm1 xxxxx01 pm2 pm3 xxxxx10 pm4 pm5 xxxxx11 pj6 pj7 can4 x x x 0 0 x x pj6 pj7 x x x 0 1 x x pm4 pm5 x x x 1 0 x x pm6 pm7 x x x 1 1 x x reserved miso mosi sck ss spi0 x x 0 xxxx ps4 ps5 ps6 ps7 xx1xxxx pm2 pm4 pm5 pm3 spi1 x 0 xxxxx pp0 pp1 pp2 pp3 x1xxxxx ph0 ph1 ph2 ph3 spi2 0 xxxxxx pp4 pp5 pp7 pp6 1xxxxxx ph4 ph5 ph6 ph7 chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 137 2.3.45 port p data register (ptp) address 0x0258 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptp7 ptp6 ptp5 ptp4 ptp3 ptp2 ptp1 ptp0 w altern. function pwm7 pwm6 pwm5 pwm4 pwm3 pwm2 pwm1 pwm0 sck2 ss2 mosi2 miso2 ss1 sck1 mosi1 miso1 reset 00000000 figure 2-43. port p data register (ptp) table 2-41. ptp register field descriptions field description 7 ptp port p general purpose input/output data ?ata register port p pin 6 is associated with the pwm output channel 7 and the sck signal of spi2 . the pwm function takes precedence over the spi2 and the general purpose i/o function if the pwm channel 7 is enabled. the spi2 function takes precedence of the general purpose i/o function if the routed spi2 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 ptp port p general purpose input/output data ?ata register port p pin 6 is associated with the pwm output channel 6 and the ss signal of spi2 . the pwm function takes precedence over the spi2 and the general purpose i/o function if the pwm channel 6 is enabled. the spi2 function takes precedence of the general purpose i/o function if the routed spi2 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 ptp port p general purpose input/output data ?ata register port p pin 5 is associated with the pwm output channel 5 and the mosi signal of spi2 . the pwm function takes precedence over the spi2 and the general purpose i/o function if the pwm channel 5 is enabled. the spi2 function takes precedence of the general purpose i/o function if the routed spi2 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 4 ptp port p general purpose input/output data ?ata register port p pin 4 is associated with the pwm output channel 4 and the miso signal of spi2 . the pwm function takes precedence over the spi2 and the general purpose i/o function if the pwm channel 4 is enabled. the spi2 function takes precedence of the general purpose i/o function if the routed spi2 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 138 freescale semiconductor 2.3.46 port p input register (ptip) 3 ptp port p general purpose input/output data ?ata register port p pin 3 is associated with the pwm output channel 3 and the ss signal of spi1 . the pwm function takes precedence over the spi1 and the general purpose i/o function if the pwm channel 3 is enabled. the spi1 function takes precedence of the general purpose i/o function if the routed spi1 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2 ptp port p general purpose input/output data ?ata register port p pin 2 is associated with the pwm output channel 2 and the sck signal of spi1 . the pwm function takes precedence over the spi1 and the general purpose i/o function if the pwm channel 2 is enabled. the spi1 function takes precedence of the general purpose i/o function if the routed spi1 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 1 ptp port p general purpose input/output data ?ata register port p pin 1 is associated with the pwm output channel 1 and the mosi signal of spi1 . the pwm function takes precedence over the spi1 and the general purpose i/o function if the pwm channel 1 is enabled. the spi1 function takes precedence of the general purpose i/o function if the routed spi1 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 ptp port p general purpose input/output data ?ata register port p pin 0 is associated with the pwm output channel 0 and the miso signal of spi1 . the pwm function takes precedence over the spi1 and the general purpose i/o function if the pwm channel 0 is enabled. the spi1 function takes precedence of the general purpose i/o function if the routed spi1 is enabled. when not used with the alternative functions, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0259 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptip7 ptip6 ptip5 ptip4 ptip3 ptip2 ptip1 ptip0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-44. port p input register (ptip) table 2-41. ptp register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 139 2.3.47 port p data direction register (ddrp) note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on ptp or ptip registers, when changing the ddrp register. table 2-42. ptip register field descriptions field description 7-0 ptip port p input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x025a access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddrp7 ddrp6 ddrp5 ddrp4 ddrp3 ddrp2 ddrp1 ddrp0 w reset 00000000 figure 2-45. port p data direction register (ddrp) table 2-43. ddrp register field descriptions field description 7 ddrp port p data direction this register controls the data direction of pin 7. the enabled pwm channel 7 forces the i/o state to be an output. if the pwm shutdown feature is enabled this pin is forced to be an input. in these cases the data direction bit will not change. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 6-0 ddrp port p data direction the pwm forces the i/o state to be an output for each port line associated with an enabled pwm6-0 channel. in this case the data direction bit will not change. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 140 freescale semiconductor 2.3.48 port p reduced drive register (rdrp) 2.3.49 port p pull device enable register (perp) address 0x025b access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrp7 rdrp6 rdrp5 rdrp4 rdrp3 rdrp2 rdrp1 rdrp0 w reset 00000000 figure 2-46. port p reduced drive register (rdrp) table 2-44. rdrp register field descriptions field description 7-0 rdrp port p reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x025c access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsp7 ppsp6 ppsp5 ppsp4 ppsp3 ppsp2 ppsp1 ppsp0 w reset 00000000 figure 2-47. port p pull device enable register (perp) table 2-45. perp register field descriptions field description 7-0 perp port p pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 141 2.3.50 port p polarity select register (ppsp) 2.3.51 port p interrupt enable register (piep) read: anytime. address 0x025d access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsp7 ppsp6 ppsp5 ppsp4 ppsp3 ppsp2 ppsp1 ppsp0 w reset 00000000 figure 2-48. port p polarity select register (ppsp) table 2-46. ppsp register field descriptions field description 7-0 ppsp port p pull device select ?etermine pull device polarity on input pins this register serves a dual purpose by selecting the polarity of the active interrupt edge as well as selecting a pull- up or pull-down device if enabled. 1 a rising edge on the associated port p pin sets the associated ?g bit in the pifp register. a pull-down device is connected to the associated port p pin, if enabled by the associated bit in register perp and if the port is used as input. 0 a falling edge on the associated port p pin sets the associated ?g bit in the pifp register.a pull-up device is connected to the associated port p pin, if enabled by the associated bit in register perp and if the port is used as input. address 0x025e access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r piep7 piep6 piep5 piep4 piep3 piep2 piep1 piep0 w reset 00000000 figure 2-49. port p interrupt enable register (piep) table 2-47. ppsp register field descriptions field description 7-0 piep port p interrupt enable this register disables or enables on a per-pin basis the edge sensitive external interrupt associated with port p. 1 interrupt is enabled. 0 interrupt is disabled (interrupt ?g masked). chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 142 freescale semiconductor 2.3.52 port p interrupt flag register (pifp) 2.3.53 port h data register (pth) address 0x025f access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pifp7 pifp6 pifp5 pifp4 pifp3 pifp2 pifp1 pifp0 w reset 00000000 figure 2-50. port p interrupt flag register (pifp) table 2-48. ppsp register field descriptions field description 7-0 pifp port p interrupt ?g each ?g is set by an active edge on the associated input pin. this could be a rising or a falling edge based on the state of the ppsp register. to clear this ?g, write logic level 1 to the corresponding bit in the pifp register. writing a 0 has no effect. 1 active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set). 0 no active edge pending. address 0x0260 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pth7 pth6 pth5 pth4 pth3 pth2 pth1 pth0 w altern. function ss2 sck2 mosi2 miso2 ss1 sck1 mosi1 miso1 txd5 rxd5 txd4 rxd4 txd7 rxd7 txd6 rxd6 reset 00000000 figure 2-51. port h data register (pth) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 143 table 2-49. pth register field descriptions field description 7 pth port h general purpose input/output data ?ata register port h pin 7 is associated with the txd signal of the sci5 module and the ss signal of the routed spi2. the routed spi2 function takes precedence over the sci5 and the general purpose i/o function if the routed spi2 module is enabled. the sci5 function takes precedence over the general purpose i/o function if the sci5 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 pth port h general purpose input/output data ?ata register port h pin 6 is associated with the rxd signal of the sci5 module and the sck signal of the routed spi2. the routed spi2 function takes precedence over the sci5 and the general purpose i/o function if the routed spi2 module is enabled. the sci5 function takes precedence over the general purpose i/o function if the sci5 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 pth port h general purpose input/output data ?ata register port h pin 5 is associated with the txd signal of the sci4 module and the mosi signal of the routed spi2. the routed spi2 function takes precedence over the sci4 and the general purpose i/o function if the routed spi2 module is enabled. the sci4 function takes precedence over the general purpose i/o function if the sci4 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 4 pth port h general purpose input/output data ?ata register port h pin 4 is associated with the rxd signal of the sci4 module and the miso signal of the routed spi2. the routed spi2 function takes precedence over the sci4 and the general purpose i/o function if the routed spi2 module is enabled. the sci4 function takes precedence over the general purpose i/o function if the sci4 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 3 pth port h general purpose input/output data ?ata register port h pin 3 is associated with the txd signal of the sci7 module and the ss signal of the routed spi1. the routed spi1 function takes precedence over the sci7 and the general purpose i/o function if the routed spi1 module is enabled. the sci7 function takes precedence over the general purpose i/o function if the sci7 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2 pth port h general purpose input/output data ?ata register port h pin 2 is associated with the rxd signal of the sci7 module and the sck signal of the routed spi1. the routed spi1 function takes precedence over the sci7 and the general purpose i/o function if the routed spi1 module is enabled. the sci7 function takes precedence over the general purpose i/o function if the sci7 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 144 freescale semiconductor 2.3.54 port h input register (ptih) 2.3.55 port h data direction register (ddrh) 1 pth port h general purpose input/output data ?ata register port h pin 1 is associated with the txd signal of the sci6 module and the mosi signal of the routed spi1. the routed spi1 function takes precedence over the sci6 and the general purpose i/o function if the routed spi1 module is enabled. the sci6 function takes precedence over the general purpose i/o function if the sci6 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 pth port h general purpose input/output data ?ata register port h pin 0 is associated with the rxd signal of the sci6 module and the miso signal of the routed spi1. the routed spi1 function takes precedence over the sci6 and the general purpose i/o function if the routed spi1 module is enabled. the sci6 function takes precedence over the general purpose i/o function if the sci6 is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0261 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptih7 ptih6 ptih5 ptih4 ptih3 ptih2 ptih1 ptih0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-52. port h input register (ptih) table 2-50. ptih register field descriptions field description 7-0 ptih port h input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x0262 access: user read/write (1) 76543210 r ddrh7 ddrh6 ddrh5 ddrh4 ddrh3 ddrh2 ddrh1 ddrh0 w reset 00000000 figure 2-53. port h data direction register (ddrh) table 2-49. pth register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 145 1. read: anytime. write: anytime. table 2-51. ddrh register field descriptions field description 7 ddrh port h data direction this register controls the data direction of pin 7. the enabled sci5 forces the i/o state to be an output. depending on the con?uration of the enabled routed spi2 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 6 ddrh port h data direction this register controls the data direction of pin 6. the enabled sci5 forces the i/o state to be an input. depending on the con?uration of the enabled routed spi2 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 5 ddrh port h data direction this register controls the data direction of pin 5. the enabled sci4 forces the i/o state to be an output. depending on the con?uration of the enabled routed spi2 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 4 ddrh port h data direction this register controls the data direction of pin 4. the enabled sci4 forces the i/o state to be an input. depending on the con?uration of the enabled routed spi2 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 3 ddrh port h data direction this register controls the data direction of pin 3. the enabled sci7 forces the i/o state to be an output. depending on the con?uration of the enabled routed spi1 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 2 ddrh port h data direction this register controls the data direction of pin 2. the enabled sci7 forces the i/o state to be an input. depending on the con?uration of the enabled routed spi1 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 146 freescale semiconductor note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on pth or ptih registers, when changing the ddrh register. 2.3.56 port h reduced drive register (rdrh) 1 ddrh port h data direction this register controls the data direction of pin 1. the enabled sci6 forces the i/o state to be an output. depending on the con?uration of the enabled routed spi1 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 0 ddrh port h data direction this register controls the data direction of pin 0. the enabled sci6 forces the i/o state to be an input. depending on the con?uration of the enabled routed spi1 this pin will be forced to be input or output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. address 0x0263 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrh7 rdrh6 rdrh5 rdrh4 rdrh3 rdrh2 rdrh1 rdrh0 w reset 00000000 figure 2-54. port h reduced drive register (rdrh) table 2-52. rdrh register field descriptions field description 7-0 rdrh port h reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. table 2-51. ddrh register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 147 2.3.57 port h pull device enable register (perh) 2.3.58 port h polarity select register (ppsh) address 0x0264 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r perh7 perh6 perh5 perh4 perh3 perh2 perh1 perh0 w reset 00000000 figure 2-55. port h pull device enable register (perh) table 2-53. perh register field descriptions field description 7-0 perh port h pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. address 0x0265 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsh7 ppsh6 ppsh5 ppsh4 ppsh3 ppsh2 ppsh1 ppsh0 w reset 00000000 figure 2-56. port h polarity select register (ppsh) table 2-54. ppsh register field descriptions field description 7-0 ppsh port h pull device select ?etermine pull device polarity on input pins this register serves a dual purpose by selecting the polarity of the active interrupt edge as well as selecting a pull- up or pull-down device if enabled. 1 a rising edge on the associated port h pin sets the associated ?g bit in the pifh register. a pull-down device is connected to the associated port h pin, if enabled by the associated bit in register perh and if the port is used as input. 0 a falling edge on the associated port h pin sets the associated ?g bit in the pifh register.a pull-up device is connected to the associated port h pin, if enabled by the associated bit in register perh and if the port is used as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 148 freescale semiconductor 2.3.59 port h interrupt enable register (pieh) read: anytime. 2.3.60 port h interrupt flag register (pifh) address 0x0266 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pieh7 pieh6 pieh5 pieh4 pieh3 pieh2 pieh1 pieh0 w reset 00000000 figure 2-57. port h interrupt enable register (pieh) table 2-55. ppsp register field descriptions field description 7-0 pieh port h interrupt enable this register disables or enables on a per-pin basis the edge sensitive external interrupt associated with port h. 1 interrupt is enabled. 0 interrupt is disabled (interrupt ?g masked). address 0x0267 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pifh7 pifh6 pifh5 pifh4 pifh3 pifh2 pifh1 pifh0 w reset 00000000 figure 2-58. port h interrupt flag register (pifh) table 2-56. ppsp register field descriptions field description 7-0 pifh port h interrupt ?g each ?g is set by an active edge on the associated input pin. this could be a rising or a falling edge based on the state of the ppsh register. to clear this ?g, write logic level 1 to the corresponding bit in the pifh register. writing a 0 has no effect. 1 active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set). 0 no active edge pending. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 149 2.3.61 port j data register (ptj) address 0x0268 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptj7 ptj6 ptj5 ptj4 ptj3 ptj2 ptj1 ptj0 w altern. function txcan4 rxcan4 txd2 rxd2 scl0 sda0 scl1 sda1 (txcan0) (rxcan0) cs2 cs0 cs1 cs3 reset 00000000 figure 2-59. port j data register (ptj) table 2-57. ptj register field descriptions field description 7-6 ptj port j general purpose input/output data ?ata register port j pins 7 and 6 are associated with txcan and rxcan signals of can4 and the routed can0, as well as with scl and sda signals of iic0, respectively. the can4 function takes precedence over the iic0, the routed can0 and the general purpose i/o function if the can4 module is enabled. the iic0 function takes precedence over the routed can0 and the general purpose i/o function if the iic0 is enabled. if the iic0 module takes precedence the sda0 and scl0 outputs are con?ured as open drain outputs. the routed can0 function takes precedence over the general purpose i/o function if the routed can0 module is enabled. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5-4 ptj port j general purpose input/output data ?ata register this pin is associated with the scl and sda signals of iic1, and with chip select outputs cs2 and cs0, respectively. the iic1 function takes precedence over the chip select and general purpose i/o function if the iic1 is enabled. the chip selects take precedence over the general purpose i/o. if the iic1 module takes precedence the sda1 and scl1 outputs are con?ured as open drain outputs. refer to iic section for details. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 3 ptj port j general purpose input/output data ?ata register this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2 ptj port j general purpose input/output data ?ata register this pin is associated with the chip select output signal cs2 . when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 150 freescale semiconductor 2.3.62 port j input register (ptij) 2.3.63 port j data direction register (ddrj) 1 ptj port j general purpose input/output data ?ata register this pin is associated with the txd signal of sci2 . when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 ptj port j general purpose input/output data ?ata register this pin is associated with the txd signal of sci2 and chip select output cs3. the sci function takes precedence over the chip select and general purpose i/o function if the sci2 is enabled. the chip select takes precedence over the general purpose i/o. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0269 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptij7 ptij6 ptij5 ptij4 ptij3 ptij2 ptij1 ptij0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-60. port j input register (ptij) table 2-58. ptij register field descriptions field description 7-0 ptij port j input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x026a access: user read/write (1) 76543210 r ddrj7 ddrj6 ddrj5 ddrj4 ddrj3 ddrj2 ddrj1 ddrj0 w reset 00000000 figure 2-61. port j data direction register (ddrj) table 2-57. ptj register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 151 1. read: anytime. write: anytime. table 2-59. ddrj register field descriptions field description 7 ddrj port j data direction this register controls the data direction of pin 7. the enabled can4 or routed can0 forces the i/o state to be an output. the enabled iic0 module forces this pin to be a open drain output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 6 ddrj port j data direction this register controls the data direction of pin 6. the enabled can4 or routed can0 forces the i/o state to be an input. the enabled iic0 module forces this pin to be a open drain output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 5 ddrj port j data direction this register controls the data direction of pin 5. the enabled cs2 signal forces the i/o state to be an output. the enabled iic1 module forces this pin to be a open drain output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 4 ddrj port j data direction this register controls the data direction of pin 4. the enabled cs0 signal forces the i/o state to be an output. the enabled iic1 module forces this pin to be a open drain output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 3 ddrj port j data direction this register controls the data direction of pin 3. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 2 ddrj port j data direction this register controls the data direction of pin 2. the enabled cs1 signal forces the i/o state to be an output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 152 freescale semiconductor note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on pth or ptih registers, when changing the ddrh register. 2.3.64 port j reduced drive register (rdrj) 1 ddrj port j data direction this register controls the data direction of pin 1. the enabled sci2 forces the i/o state to be an output. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. 0 ddrj port j data direction this register controls the data direction of pin 0. the enabled sci3 or cs3 signal forces the i/o state to be an output. in those cases the data direction bits will not change. the ddrm bits revert to controlling the i/o direction of a pin when the associated peripheral module is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. address 0x026b access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrj7 rdrj6 rdrj5 rdrj4 rdrj3 rdrj2 rdrj1 rdrj0 w reset 00000000 figure 2-62. port j reduced drive register (rdrj) table 2-60. rdrj register field descriptions field description 7-0 rdrj port j reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. table 2-59. ddrj register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 153 2.3.65 port j pull device enable register (perj) 2.3.66 port j polarity select register (ppsj) address 0x026c access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r perj7 perj6 perj5 perj4 perj3 perj2 perj1 perj0 w reset 11111111 figure 2-63. port j pull device enable register (perj) table 2-61. perj register field descriptions field description 7-0 perj port j pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset all pull device are enabled. 1 pull device enabled. 0 pull device disabled. address 0x026d access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsj7 ppsj6 ppsj5 ppsj4 ppsj3 ppsj2 ppsj1 ppsj0 w reset 00000000 figure 2-64. port j polarity select register (ppsj) table 2-62. ppsj register field descriptions field description 7-0 ppsj port j pull device select ?etermine pull device polarity on input pins this register serves a dual purpose by selecting the polarity of the active interrupt edge as well as selecting a pull- up or pull-down device if enabled. 1 a rising edge on the associated port j pin sets the associated ?g bit in the pifj register. a pull-down device is connected to the associated port j pin, if enabled by the associated bit in register perj and if the port is used as input. 0 a falling edge on the associated port j pin sets the associated ?g bit in the pifj register.a pull-up device is connected to the associated port j pin, if enabled by the associated bit in register perj and if the port is used as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 154 freescale semiconductor 2.3.67 port j interrupt enable register (piej) read: anytime. 2.3.68 port j interrupt flag register (pifj) address 0x026e access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r piej7 piej6 piej5 piej4 piej3 piej2 piej1 piej0 w reset 00000000 figure 2-65. port j interrupt enable register (piej) table 2-63. ppsp register field descriptions field description 7-0 piej port j interrupt enable this register disables or enables on a per-pin basis the edge sensitive external interrupt associated with port j. 1 interrupt is enabled. 0 interrupt is disabled (interrupt ?g masked). address 0x026f access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pifj7 pifj6 pifj5 pifj4 pifj3 pifj2 pifj1 pifj0 w reset 00000000 figure 2-66. port j interrupt flag register (pifj) table 2-64. ppsp register field descriptions field description 7-0 pifj port j interrupt ?g each ?g is set by an active edge on the associated input pin. this could be a rising or a falling edge based on the state of the ppsj register. to clear this ?g, write logic level 1 to the corresponding bit in the pifj register. writing a 0 has no effect. 1 active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set). 0 no active edge pending. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 155 2.3.69 port ad0 data register 0 (pt0ad0) 2.3.70 port ad0 data register 1 (pt1ad0) address 0x0270 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pt0ad07 pt0ad06 pt0ad05 pt0ad04 pt0ad03 pt0ad02 pt0ad01 pt0ad00 w altern. function an15 an14 an13 an12 an11 an10 an9 an8 reset 00000000 figure 2-67. port ad0 data register 0 (pt0ad0) table 2-65. pt0ad0 register field descriptions field description 7-0 pt0ad0 port ad0 general purpose input/output data ?ata register this register is associated with atd0 analog inputs an[15:8] on pad[15:8], respectively. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0271 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pt1ad07 pt1ad06 pt1ad05 pt1ad04 pt1ad03 pt1ad02 pt1ad01 pt1ad00 w altern. function an7 an6 an5 an4 an3 an2 an1 an0 reset 00000000 figure 2-68. port ad0 data register 1 (pt1ad0) table 2-66. pt1ad0 register field descriptions field description 7-0 pt1ad0 port ad0 general purpose input/output data ?ata register this register is associated with atd0 analog inputs an[7:0] on pad[7:0], respectively. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 156 freescale semiconductor 2.3.71 port ad0 data direction register 0 (ddr0ad0) note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on pt0ad0 registers, when changing the ddr0ad0 register. note to use the digital input function on port ad0 the atd digital input enable register (atd0dien1) has to be set to logic level ?? 2.3.72 port ad0 data direction register 1 (ddr1ad0) address 0x0272 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddr0ad07 ddr0ad06 ddr0ad05 ddr0ad04 ddr0ad03 ddr0ad02 ddr0ad01 ddr0ad00 w reset 00000000 figure 2-69. port ad0 data direction register 0 (ddr0ad0) table 2-67. ddr0ad0 register field descriptions field description 7-0 ddr0ad0 port ad0 data direction this register controls the data direction of pins 15 through 8. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. address 0x0273 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddr1ad07 ddr1ad06 ddr1ad05 ddr1ad04 ddr1ad03 ddr1ad02 ddr1ad01 ddr1ad00 w reset 00000000 figure 2-70. port ad0 data direction register 1 (ddr1ad0) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 157 note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on pt0ad0 registers, when changing the ddr1ad0 register. note to use the digital input function on port ad0 the atd digital input enable register (atd0dien1) has to be set to logic level ?? 2.3.73 port ad0 reduced drive register 0 (rdr0ad0) table 2-68. ddr1ad0 register field descriptions field description 7-0 ddr1ad0 port ad0 data direction this register controls the data direction of pins 7 through 0. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. address 0x0274 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdr0ad07 rdr0ad06 rdr0ad05 rdr0ad04 rdr0ad03 rdr0ad02 rdr0ad01 rdr0ad00 w reset 00000000 figure 2-71. port ad0 reduced drive register 0 (rdr0ad0) table 2-69. rdr0ad0 register field descriptions field description 7-0 rdr0ad0 port ad0 reduced drive ?elect reduced drive for port ad0 outputs this register con?ures the drive strength of port ad0 output pins 15 through 8 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 158 freescale semiconductor 2.3.74 port ad0 reduced drive register 1 (rdr1ad0) 2.3.75 port ad0 pull up enable register 0 (per0ad0) address 0x0275 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdr1ad07 rdr1ad06 rdr1ad05 rdr1ad04 rdr1ad03 rdr1ad02 rdr1ad01 rdr1ad00 w reset 00000000 figure 2-72. port ad0 reduced drive register 1 (rdr1ad0) table 2-70. rdr1ad0 register field descriptions field description 7-0 rdr1ad0 port ad0 reduced drive ?elect reduced drive for port ad0 outputs this register con?ures the drive strength of port ad0 output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x0276 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r per0ad07 per0ad06 per0ad05 per0ad04 per0ad03 per0ad02 per0ad01 per0ad00 w reset 00000000 figure 2-73. port ad0 pull device up register 0 (per0ad0) table 2-71. per0ad0 register field descriptions field description 7-0 per0ad0 port ad0 pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 159 2.3.76 port ad0 pull up enable register 1 (per1ad0) 2.3.77 port ad1 data register 0 (pt0ad1) address 0x0277 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r per1ad07 per1ad06 per1ad05 per1ad04 per1ad03 per1ad02 per1ad01 per1ad00 w reset 00000000 figure 2-74. port ad0 pull up enable register 1 (per1ad0) table 2-72. per1ad0 register field descriptions field description 7-0 per1ad0 port ad0 pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. address 0x0278 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pt0ad17 pt0ad16 pt0ad15 pt0ad14 pt0ad13 pt0ad12 pt0ad11 pt0ad10 w altern. function an15 an14 an13 an12 an11 an10 an9 an8 reset 00000000 figure 2-75. port ad1 data register 0 (pt0ad1) table 2-73. pt0ad1 register field descriptions field description 7-0 pt0ad1 port ad1 general purpose input/output data ?ata register this register is associated with atd1 analog inputs an[15:8] on pad[31:24], respectively. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 160 freescale semiconductor 2.3.78 port ad1 data register 1 (pt1ad1) 2.3.79 port ad1 data direction register 0 (ddr0ad1) address 0x0279 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r pt1ad17 pt1ad16 pt1ad15 pt1ad14 pt1ad13 pt1ad12 pt1ad11 pt1ad10 w altern. function an7 an6 an5 an4 an3 an2 an1 an0 reset 00000000 figure 2-76. port ad1 data register 1 (pt1ad1) table 2-74. pt1ad1 register field descriptions field description 7-0 pt1ad1 port ad1 general purpose input/output data ?ata register this register is associated with atd1 analog inputs an[7:0] on pad[23:16], respectively. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x027a access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddr0ad17 ddr0ad16 ddr0ad15 ddr0ad14 ddr0ad13 ddr0ad12 ddr0ad11 ddr0ad10 w reset 00000000 figure 2-77. port ad1 data direction register 0 (ddr0ad1) table 2-75. ddr0ad1 register field descriptions field description 7-0 ddr0ad1 port ad1 data direction this register controls the data direction of pins 15 through 8. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 161 note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on pt0ad1 registers, when changing the ddr0ad1 register. note to use the digital input function on port ad1 the atd digital input enable register (atd1dien1) has to be set to logic level ?? 2.3.80 port ad1 data direction register 1 (ddr1ad1) note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on pt0ad1 registers, when changing the ddr1ad1 register. note to use the digital input function on port ad1 the atd digital input enable register (atd1dien1) has to be set to logic level ?? address 0x027b access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddr1ad17 ddr1ad16 ddr1ad15 ddr1ad14 ddr1ad13 ddr1ad12 ddr1ad11 ddr1ad10 w reset 00000000 figure 2-78. port ad1 data direction register 1 (ddr1ad1) table 2-76. ddr1ad1 register field descriptions field description 7-0 ddr1ad1 port ad1 data direction this register controls the data direction of pins 7 through 0. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 162 freescale semiconductor 2.3.81 port ad1 reduced drive register 0 (rdr0ad1) 2.3.82 port ad1 reduced drive register 1 (rdr1ad1) address 0x027c access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdr0ad17 rdr0ad16 rdr0ad15 rdr0ad14 rdr0ad13 rdr0ad12 rdr0ad11 rdr0ad10 w reset 00000000 figure 2-79. port ad1 reduced drive register 0 (rdr0ad1) table 2-77. rdr0ad1 register field descriptions field description 7-0 rdr0ad1 port ad1 reduced drive ?elect reduced drive for port ad1 outputs this register con?ures the drive strength of port ad1 output pins 15 through 8 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x027d access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdr1ad17 rdr1ad16 rdr1ad15 rdr1ad14 rdr1ad13 rdr1ad12 rdr1ad11 rdr1ad10 w reset 00000000 figure 2-80. port ad1 reduced drive register 1 (rdr1ad1) table 2-78. rdr1ad1 register field descriptions field description 7-0 rdr1ad1 port ad1 reduced drive ?elect reduced drive for port ad1 outputs this register con?ures the drive strength of port ad1 output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 163 2.3.83 port ad1 pull up enable register 0 (per0ad1) 2.3.84 port ad1 pull up enable register 1 (per1ad1) address 0x027e access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r per0ad17 per0ad16 per0ad15 per0ad14 per0ad13 per0ad12 per0ad11 per0ad10 w reset 00000000 figure 2-81. port ad1 pull device up register 0 (per0ad1) table 2-79. per0ad1 register field descriptions field description 7-0 per0ad1 port ad1 pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. address 0x027f access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r per1ad17 per1ad16 per1ad15 per1ad14 per1ad13 per1ad12 per1ad11 per1ad10 w reset 00000000 figure 2-82. port ad1 pull up enable register 1 (per1ad1) table 2-80. per1ad1 register field descriptions field description 7-0 per1ad1 port ad1 pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 164 freescale semiconductor 2.3.85 port r data register (ptr) 2.3.86 port r input register (ptir) address 0x0368 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptr7 ptr6 ptr5 ptr4 ptr3 ptr2 ptr1 ptr0 w altern. function timioc7 timioc6 timioc5 timioc4 timioc3 timioc2 timioc1 timioc0 reset 00000000 figure 2-83. port r data register (ptr) table 2-81. ptr register field descriptions field description 7-0 ptr port r general purpose input/output data ?ata register port r pins 7 through 0 are associated with tim channels timioc7 through timioc0. when not used with the alternative function, these pins can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. address 0x0369 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptir7 ptir6 ptir5 ptir4 ptir3 ptir2 ptir1 ptir0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-84. port r input register (ptir) table 2-82. ptir register field descriptions field description 7-0 ptir port r input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 165 2.3.87 port r data direction register (ddrr) note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on ptr or ptir registers, when changing the ddrr register. 2.3.88 port r reduced drive register (rdrr) address 0x036a access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddrr7 ddrr6 ddrr5 ddrr4 ddrr3 ddrr2 ddrr1 ddrr0 w reset 00000000 figure 2-85. port r data direction register (ddrr) table 2-83. ddrr register field descriptions field description 7-0 ddrr port r data direction this register controls the data direction of pins 7 through 0. the tim forces the i/o state to be an output for each timer port associated with an enabled output compare. in this case the data direction bits will not change. the data direction bits revert to controlling the i/o direction of a pin when the associated timer output compare is disabled. the timer input capture always monitors the state of the pin. 1 associated pin is con?ured as output. 0 associated pin is con?ured as high-impedance input. address 0x036b access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrr7 rdrr6 rdrr5 rdrr4 rdrr3 rdrr2 rdrr1 rdrr0 w reset 00000000 figure 2-86. port r reduced drive register (rdrr) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 166 freescale semiconductor 2.3.89 port r pull device enable register (perr) 2.3.90 port r polarity select register (ppsr) table 2-84. rdrr register field descriptions field description 7-0 rdrr port r reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x036c access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r perr7 perr6 perr5 perr4 perr3 perr2 perr1 perr0 w reset 00000000 figure 2-87. port r pull device enable register (perr) table 2-85. perr register field descriptions field description 7-0 perr port r pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset no pull device is enabled. 1 pull device enabled. 0 pull device disabled. address 0x036d access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsr7 ppsr6 ppsr5 ppsr4 ppsr3 ppsr2 ppsr1 ppsr0 w reset 00000000 figure 2-88. port r polarity select register (ppsr) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 167 2.3.91 pim reserved register 2.3.92 port r routing register (ptrrr) table 2-86. ppsr register field descriptions field description 7-0 ppsr port r pull device select ?etermine pull device polarity on input pins this register selects whether a pull-down or a pull-up device is connected to the pin. 1 a pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 a pull-up device is connected to the associated pin, if enabled and if the pin is used as input. address 0x036e access: user read (1) 1. read: always reads 0x00 write: unimplemented 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 2-89. pim reserved register address 0x036f access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptrrr7 ptrrr6 ptrrr5 ptrrr4 ptrrr3 ptrrr2 ptrrr1 ptrrr0 w reset 00000000 = unimplemented or reserved figure 2-90. port r routing register (ptrrr) table 2-87. ptr routing register field descriptions field description 7 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc7 is available on pp7 0 timioc7 is available on pr7 6 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc6 is available on pp6 0 timioc6 is available on pr6 chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 168 freescale semiconductor 2.3.93 port l data register (ptl) 5 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc5 is available on pp5 0 timioc5 is available on pr5 4 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc4 is available on pp4 0 timioc4 is available on pr4 3 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc3 is available on pp3 0 timioc3 is available on pr3 2 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc2 is available on pp2 0 timioc2 is available on pr2 1 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc1 is available on pp1 0 timioc1 is available on pr1 0 ptrrr port r routing this register con?ures the re-routing of the associated tim channel. 1 timioc0 is available on pp0 0 timioc0 is available on pr0 address 0x0370 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptl7 ptlt6 ptl5 ptl4 ptl3 ptl2 ptl1 ptl0 w altern. function (txd7) (rxd7) (txd6) (rxd6) (txd5) (rxd5) (txd4) (rxd4) reset 00000000 figure 2-91. port l data register (ptl) table 2-87. ptr routing register field descriptions (continued) field description chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 169 table 2-88. ptl register field descriptions field description 7 ptl port l general purpose input/output data ?ata register port l pin 7 is associated with the txd signal of the sci7 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 ptl port l general purpose input/output data ?ata register port l pin 6 is associated with the rxd signal of the sci7 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 ptl port l general purpose input/output data ?ata register port l pin 5 is associated with the txd signal of the sci6 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 4 ptl port l general purpose input/output data ?ata register port l pin 4 is associated with the rxd signal of the sci6 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 3 ptl port l general purpose input/output data ?ata register port l pin 3 is associated with the txd signal of the sc5 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2 ptl port l general purpose input/output data ?ata register port l pin 2 is associated with the rxd signal of the sci5 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 1 ptl port l general purpose input/output data ?ata register port l pin 3 is associated with the txd signal of the sci4 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 ptl port l general purpose input/output data ?ata register port l pin 2 is associated with the rxd signal of the sci4 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 170 freescale semiconductor 2.3.94 port l input register (ptil) 2.3.95 port l data direction register (ddrl) address 0x0371 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptil7 ptil6 ptil5 ptil4 ptil3 ptil2 ptil1 ptil0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-92. port l input register (ptil) table 2-89. ptil register field descriptions field description 7-0 ptil port l input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x0372 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddrl7 ddrl6 ddrl5 ddrl4 ddrl3 ddrl2 ddrl1 ddrl0 w reset 00000000 figure 2-93. port l data direction register (ddrl) table 2-90. ddrl register field descriptions field description 7-0 ddrl port l data direction this register controls the data direction of pins 7 through 0.this register con?ures each port l pin as either input or output. if spi0 is enabled, the spi0 determines the pin direction. refer to spi section for details . if the associated sci transmit or receive channel is enabled this register has no effect on the pins. the pin is forced to be an output if a sci transmit channel is enabled, it is forced to be an input if the sci receive channel is enabled. the data direction bits revert to controlling the i/o direction of a pin when the associated channel is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 171 note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on ptl or ptil registers, when changing the ddrl register. 2.3.96 port l reduced drive register (rdrl) 2.3.97 port l pull device enable register (perl) address 0x0373 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrl7 rdrl6 rdrl5 rdrl4 rdrl3 rdrl2 rdrl1 rdrl0 w reset 00000000 figure 2-94. port l reduced drive register (rdrl) table 2-91. rdrl register field descriptions field description 7-0 rdrl port l reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x0374 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r perl7 perl6 perl5 perl4 perl3 perl2 perl1 perl0 w reset 11111111 figure 2-95. port l pull device enable register (perl) table 2-92. perl register field descriptions field description 7-0 perl port l pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset all pull devices are enabled. 1 pull device enabled. 0 pull device disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 172 freescale semiconductor 2.3.98 port l polarity select register (ppsl) 2.3.99 port l wired-or mode register (woml) address 0x0375 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsl7 ppsl6 ppsl5 ppsl4 ppsl3 ppsl2 ppsl1 ppsl0 w reset 00000000 figure 2-96. port l polarity select register (ppsl) table 2-93. ppsl register field descriptions field description 7-0 ppsl port l pull device select ?etermine pull device polarity on input pins this register selects whether a pull-down or a pull-up device is connected to the pin. 1 a pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 a pull-up device is connected to the associated pin, if enabled and if the pin is used as input. address 0x0376 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r woml7 woml6 woml5 woml4 woml3 woml2 woml1 woml0 w reset 00000000 figure 2-97. port l wired-or mode register (woml) table 2-94. woml register field descriptions field description 7-0 woml port l wired-or mode ?nable wired-or functionality this register con?ures the output pins as wired-or independent of the function used on the pins. if enabled the output is driven active low only (open-drain). a logic level of ??is not driven.this allows a multipoint connection of several serial modules. these bits have no in?ence on pins used as inputs. 1 output buffers operate as open-drain outputs. 0 output buffers operate as push-pull outputs. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 173 2.3.100 port l routing register (ptlrr) this register configures the re-routing of sci7, sci6, sci5, and sci4 on alternative ports. 2.3.101 port f data register (ptf) address 0x0377 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptlrr7 ptlrr6 ptlrr5 ptlrr4 0000 w reset 00000000 = unimplemented or reserved figure 2-98. port l routing register (ptlrr) table 2-95. port l routing summary module ptlrr related pins 7654 txd rxd sci7 0 x x x ph3 ph2 1 x x x pl7 pl6 sci6 x 0 x x ph1 ph0 x 1 x x pl5 pl4 sci5 x x 0 x ph7 ph6 x x 1 x pl3 pl2 sci4 x x x 0 ph5 ph4 x x x 1 pl1 pl0 address 0x0378 access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ptf7 ptft6 ptf5 ptf4 ptf3 ptf2 ptf1 ptf0 w altern. function (txd3) (rxd3) (scl0) (sda0) ( cs3) ( cs2) ( cs1) ( cs0) reset 00000000 figure 2-99. port f data register (ptf) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 174 freescale semiconductor table 2-96. ptf register field descriptions field description 7 ptf port f general purpose input/output data ?ata register port f pin 7 is associated with the txd signal of the sci3 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 ptf port f general purpose input/output data ?ata register port f pin 6 is associated with the rxd signal of the sci3 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 ptf port f general purpose input/output data ?ata register port f pin 5 is associated with the txd signal of the sci6 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 4 ptf port f general purpose input/output data ?ata register port f pin 4 is associated with the rxd signal of the sci6 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 3 ptf port f general purpose input/output data ?ata register port f pin 3 is associated with the txd signal of the sc5 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2 ptf port f general purpose input/output data ?ata register port f pin 2 is associated with the rxd signal of the sci5 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 1 ptf port f general purpose input/output data ?ata register port f pin 3 is associated with the txd signal of the sci4 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 ptf port f general purpose input/output data ?ata register port f pin 2 is associated with the rxd signal of the sci4 module. when not used with the alternative function, this pin can be used as general purpose i/o. if the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 175 2.3.102 port f input register (ptif) 2.3.103 port f data direction register (ddrf) address 0x0379 access: user read (1) 1. read: anytime. write:never, writes to this register have no effect. 76543210 r ptif7 ptif6 ptif5 ptif4 ptif3 ptif2 ptif1 ptif0 w reset uuuuuuuu = unimplemented or reserved u = unaffected by reset figure 2-100. port f input register (ptif) table 2-97. ptif register field descriptions field description 7-0 ptif port f input data this register always reads back the buffered state of the associated pins. this can also be used to detect overload or short circuit conditions on output pins. address 0x037a access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ddrf7 ddrf6 ddrf5 ddrf4 ddrf3 ddrf2 ddrf1 ddrf0 w reset 00000000 figure 2-101. port f data direction register (ddrf) table 2-98. ddrf register field descriptions field description 7-0 ddrf port f data direction this register controls the data direction of pins 7 through 0.this register con?ures each port f pin as either input or output. if spi0 is enabled, the spi0 determines the pin direction. refer to spi section for details . if the associated sci transmit or receive channel is enabled this register has no effect on the pins. the pin is forced to be an output if a sci transmit channel is enabled, it is forced to be an input if the sci receive channel is enabled. the data direction bits revert to controlling the i/o direction of a pin when the associated channel is disabled. 1 associated pin is con?ured as output. 0 associated pin is con?ured as input. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 176 freescale semiconductor note due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on ptf or ptif registers, when changing the ddrf register. 2.3.104 port f reduced drive register (rdrf) 2.3.105 port f pull device enable register (perf) address 0x037b access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r rdrf7 rdrf6 rdrf5 rdrf4 rdrf3 rdrf2 rdrf1 rdrf0 w reset 00000000 figure 2-102. port f reduced drive register (rdrf) table 2-99. rdrf register field descriptions field description 7-0 rdrf port f reduced drive ?elect reduced drive for outputs this register con?ures the drive strength of output pins 7 through 0 as either full or reduced independent of the function used on the pins. if a pin is used as input this bit has no effect. 1 reduced drive selected (approx. 1/5 of the full drive strength). 0 full drive strength enabled. address 0x037c access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r perf7 perf6 perf5 perf4 perf3 perf2 perf1 perf0 w reset 11111111 figure 2-103. port f pull device enable register (perf) table 2-100. perf register field descriptions field description 7-0 perf port f pull device enable ?nable pull devices on input pins these bits con?ure whether a pull device is activated, if the associated pin is used as an input. this bit has no effect if the pin is used as an output. out of reset all pull devices are enabled. 1 pull device enabled. 0 pull device disabled. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 177 2.3.106 port f polarity select register (ppsf) 2.3.107 pim reserved register 2.3.108 port f routing register (ptfrr) address 0x037d access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r ppsf7 ppsf6 ppsf5 ppsf4 ppsf3 ppsf2 ppsf1 ppsf0 w reset 00000000 figure 2-104. port f polarity select register (ppsf) table 2-101. ppsf register field descriptions field description 7-0 ppsf port f pull device select ?etermine pull device polarity on input pins this register selects whether a pull-down or a pull-up device is connected to the pin. 1 a pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 a pull-up device is connected to the associated pin, if enabled and if the pin is used as input. address 0x037e access: user read (1) 1. read: always reads 0x00 write: unimplemented 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 2-105. pim reserved register address 0x037f access: user read/write (1) 1. read: anytime. write: anytime. 76543210 r0 0 ptfrr5 ptfrr4 ptfrr3 ptfrr2 ptfrr1 ptfrr0 w reset 00000000 = unimplemented or reserved figure 2-106. port f routing register (ptfrr) chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 178 freescale semiconductor this register configures the re-routing of sci3, iic0, cs[3:0] on alternative ports. 2.4 functional description 2.4.1 general each pin except pe0, pe1, and bkgd can act as general purpose i/o. in addition each pin can act as an output from the external bus interface module or a peripheral module or an input to the external bus interface module or a peripheral module. 2.4.2 registers a set of con?uration registers is common to all ports with exceptions in the expanded bus interface and atd ports ( table 2-103 ). all registers can be written at any time, however a speci? con?uration might not become active. example 2-1. selecting a pull-up device this device does not become active while the port is used as a push-pull output. table 2-102. port f routing summary module ptfrr related pins 543210 txd rxd sci3 0 x x x x x pm7 pm6 1 x x x x x pf7 pf6 scl sda iic0 x 0 x x x x pj7 pj6 x 1 x x x x pf5 pf4 cs cs3 x x 0 x x x pj0 xx1xxx pf3 cs2 x x x 0 x x pj5 xxx1xx pf2 cs1 x x x x 0 x pj2 xxxx1x pf1 cs0 x x x x x 0 pj4 xxxxx1 pf0 chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 179 2.4.2.1 data register (portx, ptx) this register holds the value driven out to the pin if the pin is used as a general purpose i/o. writing to this register has only an effect on the pin if the pin is used as general purpose output. when reading this address, the buffered state of the pin is returned if the associated data direction register bit is set to ?? if the data direction register bits are set to logic level ?? the contents of the data register is returned. this is independent of any other con?uration ( figure 2-107 ). 2.4.2.2 input register (ptix) this is a read-only register and always returns the buffered state of the pin ( figure 2-107 ). 2.4.2.3 data direction register (ddrx) this register de?es whether the pin is used as an input or an output. if a peripheral module controls the pin the contents of the data direction register is ignored ( figure 2-107 ). table 2-103. register availability per port (1) 1. each cell represents one register with individual con?uration bits port data input data direction reduced drive pull enable polarity select wired- or mode interrupt enable interrupt flag routing ayes-yesyesyes----- byes-yes ----- cyes-yes ----- dyes-yes ----- eyes-yes ----- kyes-yes ----- tyesyesyesyesyesyes---- s yes yes yes yes yes yes yes - - yes m yes yes yes yes yes yes yes - - yes p yes yes yes yes yes yes - yes yes - h yes yes yes yes yes yes - yes yes - j yes yes yes yes yes yes - yes yes - ad0yes-yesyesyes----- ad1yes-yesyesyes----- ryesyesyesyesyesyes---- l yes yes yes yes yes yes yes - - yes f yes yes yes yes yes yes - - - yes chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 180 freescale semiconductor figure 2-107. illustration of i/o pin functionality 2.4.2.4 reduced drive register (rdrx) if the pin is used as an output this register allows the con?uration of the drive strength. 2.4.2.5 pull device enable register (perx) this register turns on a pull-up or pull-down device. it becomes active only if the pin is used as an input or as a wired-or output. 2.4.2.6 polarity select register (ppsx) this register selects either a pull-up or pull-down device if enabled. it becomes only active if the pin is used as an input. a pull-up device can be activated if the pin is used as a wired-or output. 2.4.2.7 wired-or mode register (womx) if the pin is used as an output this register turns off the active high drive. this allows wired-or type connections of outputs. 2.4.2.8 interrupt enable register (piex) if the pin is used as an interrupt input this register serves as a mask to the interrupt ?g to enable/disable the interrupt. pt ddr output enable module enable 1 0 1 1 0 0 pin pti data out module chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 181 2.4.2.9 interrupt ?g register (pifx) if the pin is used as an interrupt input this register holds the interrupt ?g after a valid pin event. 2.4.2.10 module routing register (modrr, ptrrr, ptlrr, ptfrr) this register supports the re-routing of the can0, can4, spi2-0, sci7-3, iic0, tim and cs[3:0] pins to alternative ports. this allows a software re-con?uration of the pinouts of the different package options with respect to above peripherals. 2.4.3 pins and ports note please refer to the soc guide to determine the pin availability in the different package options. 2.4.3.1 bkgd pin the bkgd pin is associated with the s12x_bdm and s12x_ebi modules. during reset, the bkgd pin is used as modc input. 2.4.3.2 port a, b port a pins pa[7:0] and port b pins pb[7:0] can be used for either general-purpose i/o with the external bus interface. in this case port a and port b are associated with the external address bus outputs addr15- addr8 and addr7-addr0, respectively. pb0 is the addr0 or uds output. 2.4.3.3 port c, d port c pins pc[7:0] and port d pins pd[7:0] can be used for either general-purpose i/o with the external bus interface. in this case port c and port d are associated with the external data bus inputs/outputs data15-data8 and data7-data0, respectively. these pins are con?ured for reduced input threshold in certain operating modes (refer to s12x_ebi section). 2.4.3.4 port e port e is associated with the external bus control outputs r w, lstrb, lds and re, the free-running clock outputs eclk and eclk2x, as well as with the t a ghi, t a glo, moda and modb and interrupt inputs irq and xirq. port e pins pe[7:2] can be used for either general-purpose i/o or with the alternative functions. port e pin pe[7] can be used for either general-purpose i/o or as the free-running clock eclkx2 output running at the core clock rate. the clock output is always enabled in emulation modes. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 182 freescale semiconductor port e pin pe[6] can be used for either general-purpose i/o, as t a ghi input or as modb input during reset. port e pin pe[5] can be used for either general-purpose i/o, as t a glo input, re output or as moda input during reset. port e pin pe[4] can be used for either general-purpose i/o or as the free-running clock eclk output running at the bus clock rate or at the programmed divided clock rate. the clock output is always enabled in emulation modes. port e pin pe[3] can be used for either general-purpose i/o, as lstrb or lds output, or as eromctl input during reset. port e pin pe[2] can be used for either general-purpose i/o, or as r w or we output. port e pin pe[1] can be used for either general-purpose input or as the level- or falling edge-sensitive irq interrupt input. irq will be enabled by setting the irqen con?uration bit ( 2.3.17/119 ) and clearing the i-bit in the cpu condition code register. it is inhibited at reset so this pin is initially con?ured as a simple input with a pull-up. port e pin pe[0] can be used for either general-purpose input or as the level-sensitive xirq interrupt input. xirq can be enabled by clearing the x-bit in the cpu condition code register. it is inhibited at reset so this pin is initially con?ured as a high-impedance input with a pull-up. port e pins pe[5] and pe[6] are con?ured for reduced input threshold in certain modes (refer to s12x_ebi section). 2.4.3.5 port k port k pins pk[7:0] can be used for either general-purpose i/o, or with the external bus interface. in this case port k pins pk[6:0] are associated with the external address bus outputs addr22-addr16 and pk7 is associated to the ew ait input. port k pin pe[7] is con?ured for reduced input threshold in certain modes (refer to s12x_ebi section). 2.4.3.6 port t this port is associated with the ect module. port t pins pt[7:0] can be used for either general-purpose i/o, or with the channels of the enhanced capture timer. 2.4.3.7 port s this port is associated with sci0, sci1 and spi0. port s pins ps[7:4] can be used either for general-purpose i/o, or with the spi0 subsystem. port s pins ps[3:2] can be used either for general-purpose i/o, or with the sci1 subsystem. port s pins ps[1:0] can be used either for general-purpose i/o, or with the sci0 subsystem. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 183 the spi0 pins can be re-routed. 2.4.3.8 port m this port is associated with the sci3 can4-0 and spi0. port m pins pm[7:6] can be used for either general purpose i/o, or with the can3 subsystem. port m pins pm[5:4] can be used for either general purpose i/o, or with the can2 subsystem. port m pins pm[3:2] can be used for either general purpose i/o, or with the can1 subsystem. port m pins pm[1:0] can be used for either general purpose i/o, or with the can0 subsystem. port m pins pm[5:2] can be used for either general purpose i/o, or with the spi0 subsystem. the can0, can4 and spi0 pins can be re-routed. 2.4.3.9 port p this port is associated with the pwm, spi1, spi2 and tim. port p pins pp[7:0] can be used for either general purpose i/o, or with the pwm or with the channels of the standard timer.subsystem. port p pins pp[7:4] can be used for either general purpose i/o, or with the spi2 subsystem. port p pins pp[3:0] can be used for either general purpose i/o, or with the spi1 subsystem. 2.4.3.10 port h this port is associated with the spi1, spi2, and sci7-4. port h pins ph[7:4] can be used for either general purpose i/o, or with the spi2 subsystem. port h pins ph[3:0] can be used for either general purpose i/o, or with the spi1 subsystem. port h pins ph[7:6] can be used for either general purpose i/o, or with the sci5 subsystem. port h pins ph[5:4] can be used for either general purpose i/o, or with the sci4 subsystem. port h pins ph[3:2] can be used for either general purpose i/o, or with the sci7 subsystem. port h pins ph[1:0] can be used for either general purpose i/o, or with the sci6 subsystem. 2.4.3.11 port j this port is associated with the chip selects cs[3:0] as well as with can4, can0, iic1, iic0, and sci2. port j pins pj[7:6] can be used for either general purpose i/o, or with the can4, iic0 or can0 subsystems. port j pins pj[5:4] can be used for either general purpose i/o, or with the iic1 subsystem or as chip select outputs. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 184 freescale semiconductor port j pin pj[3] can be used for general purpose i/o. port j pin pj[2] can be used for either general purpose i/o or as chip select output. port j pin pj[1] can be used for either general purpose i/o, or with the sci2 subsystem. port j pin pj[0] can be used for either general purpose i/o, or with the sci2 subsystem or as chip select output. 2.4.3.12 port ad0 this port is associated with the atd0. port ad0 pins pad[15:0] can be used for either general purpose i/o, or with the atd0 subsystem. 2.4.3.13 port ad1 this port is associated with the atd1. port ad1 pins pad[31:16] can be used for either general purpose i/o, or with the atd1 subsystem. 2.4.3.14 port r this port is associated with the tim module. port r pins pr[7:0] can be used for either general-purpose i/o, or with the channels of the standard timer. the tim channels can be re-routed. 2.4.3.15 port l this port is associated with sci7-4. port l pins pl[7:6] can be used for either general purpose i/o, or with sci7 subsystem. port l pins pl[5:4] can be used for either general purpose i/o, or with sci6 subsystem. port l pins pl[3:2] can be used for either general purpose i/o, or with sci5 subsystem. port l pins pl[1:0] can be used for either general purpose i/o, or with sci4 subsystem. 2.4.3.16 port f this port is associated with sci3, iic0 and chip selects. port l pins pl[7:6] can be used for either general purpose i/o, or with sci3 subsystem. port l pins pl[5:4] can be used for either general purpose i/o, or with iic0 subsystem. port l pins pl[3:0] can be used for either general purpose i/o, or with chip selects. chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 185 2.4.4 pin interrupts ports p, h and j offer pin interrupt capability. the interrupt enable as well as the sensitivity to rising or falling edges can be individually con?ured on per-pin basis. all bits/pins in a port share the same interrupt vector. interrupts can be used with the pins con?ured as inputs or outputs. an interrupt is generated when a bit in the port interrupt ?g register and its corresponding port interrupt enable bit are both set. the pin interrupt feature is also capable to wake up the cpu when it is in stop or wait mode. a digital ?ter on each pin prevents pulses ( figure 2-109 ) shorter than a speci?d time from generating an interrupt. the minimum time varies over process conditions, temperature and voltage ( figure 2-108 and table 2-104 ). figure 2-108. interrupt glitch filter on port p, h and j (pps=0) table 2-104. pulse detection criteria pulse mode stop stop (1) 1. these values include the spread of the oscillator frequency over temper- ature, voltage and process. unit ignored t pulse 3 bus clocks t pulse t pign uncertain 3 < t pulse < 4 bus clocks t pign < t pulse < t pval valid t pulse 4 bus clocks t pulse t pval glitch, ?tered out, no interrupt ?g set valid pulse, interrupt ?g set t pign t pval uncertain chapter 2 port integration module (s12xepimv1) mc9s12xe-family reference manual , rev. 1.21 186 freescale semiconductor figure 2-109. pulse illustration a valid edge on an input is detected if 4 consecutive samples of a passive level are followed by 4 consecutive samples of an active level directly or indirectly. the ?ters are continuously clocked by the bus clock in run and wait mode. in stop mode the clock is generated by an rc-oscillator in the port integration module. to maximize current saving the rc oscillator runs only if the following condition is true on any pin individually: sample count <= 4 and interrupt enabled (pie=1) and interrupt ?g not set (pif=0) 2.5 initialization information 2.5.1 port data and data direction register writes it is not recommended to write portx/ptx and ddrx in a word access. when changing the register pins from inputs to outputs, the data may have extra transitions during the write access. initialize the port data register before enabling the outputs. t pulse mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 187 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 3 memory mapping control (s12xmmcv4) 3.1 introduction this section describes the functionality of the module mapping control (mmc) sub-block of the s12x platform. the block diagram of the mmc is shown in figure 3-1 . the mmc module controls the multi-master priority accesses, the selection of internal resources and external space. internal buses, including internal memories and peripherals, are controlled in this module. the local address space for each master is translated to a global memory space. table 3-1. revision history revision number revision date sections affected description of changes v04.04 26 oct 2005 - reorganization of memctl0 register bits. v04.05 26 jul 2006 3.4.2.4/3-212 - updated xgate memory map v04.06 15 nov 2006 - adding autosar compliance concerning illegal cpu accesses chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 188 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.1.1 terminology 3.1.2 features the main features of this block are: paging capability to support a global 8 mbytes memory address space bus arbitration between the masters cpu, bdm and xgate table 3-2. acronyms and abbreviations logic level ? voltage that corresponds to boolean true state logic level ? voltage that corresponds to boolean false state 0x represents hexadecimal number x represents logic level don? care byte 8-bit data word 16-bit data local address based on the 64 kbytes memory space (16-bit address) global address based on the 8 mbytes memory space (23-bit address) aligned address address on even boundary mis-aligned address address on odd boundary bus clock system clock. refer to crg block guide. expanded modes normal expanded mode emulation single-chip mode emulation expanded mode special test mode single-chip modes normal single-chip mode special single-chip mode emulation modes emulation single-chip mode emulation expanded mode normal modes normal single-chip mode normal expanded mode special modes special single-chip mode special test mode ns normal single-chip mode ss special single-chip mode nx normal expanded mode es emulation single-chip mode ex emulation expanded mode st special test mode unimplemented areas areas which are accessible by the pages (rpage,ppage,epage) and not implemented external space area which is accessible in the global address range 14_0000 to 3f_ffff external resource resources (emulator, application) connected to the mcu via the external bus on expanded modes (unimplemented areas and external space) prr port replacement registers pru port replacement unit located on the emulator side mcu microcontroller unit nvm non-volatile memory; flash eeprom or rom chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 189 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 simultaneous accesses to different resources 1 (internal, external, and peripherals) (see figure 3-1 ) resolution of target bus access collision mcu operation mode control mcu security control separate memory map schemes for each master cpu, bdm and xgate rom control bits to enable the on-chip flash or rom selection port replacement registers access control generation of system reset when cpu accesses an unimplemented address (i.e., an address which does not belong to any of the on-chip modules) in single-chip modes 3.1.3 s12x memory mapping the s12x architecture implements a number of memory mapping schemes including a cpu 8 mbyte global map, de?ed using a global page (gpage) register and dedicated 23-bit address load/store instructions. a bdm 8 mbyte global map, de?ed using a global page (bdmgpr) register and dedicated 23- bit address load/store instructions. a (cpu or bdm) 64 kbyte local map, de?ed using speci? resource page (rpage, epage and ppage) registers and the default instruction set. the 64 kbytes visible at any instant can be considered as the local map accessed by the 16-bit (cpu or bdm) address. the xgate 64 kbyte local map. the mmc module performs translation of the different memory mapping schemes to the speci? global (physical) memory implementation. 3.1.4 modes of operation this subsection lists and brie? describes all operating modes supported by the mmc. 3.1.4.1 power saving modes run mode mmc is functional during normal run mode. wait mode mmc is functional during wait mode. stop mode mmc is inactive during stop mode. 3.1.4.2 functional modes single chip modes in normal and special single chip mode the internal memory is used. external bus is not active. 1. resources are also called targets. chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 190 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 expanded modes address, data, and control signals are activated in normal expanded and special test modes when accessing the external bus. access to internal resources will not cause activity on the external bus. emulation modes external bus is active to emulate, via an external tool, the normal expanded or the normal single chip mode.} 3.1.5 block diagram figure 3-1 1 shows a block diagram of the mmc. figure 3-1. mmc block diagram 3.2 external signal description the user is advised to refer to the device overview for port con?uration and location of external bus signals. some pins may not be bonded out in all implementations. table 3-3 and table 3-4 outline the pin names and functions. it also provides a brief description of their operation. 1. doted blocks and lines are optional. please refer to the device user guide for their availlibilities. peripherals flash xgate cpu bdm target bus controller dbg eeeprom ebi mmc address decoder & priority ram flexray chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 191 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 3-3. external input signals associated with the mmc signal i/o description availability modc i mode input latched after reset (active low) modb i mode input latched after reset (active low) moda i mode input latched after reset (active low) eromctl i erom control input latched after reset (active low) romctl i rom control input latched after reset (active low) table 3-4. external output signals associated with the mmc signal i/o description available in modes ns ss nx es ex st cs0 o chip select line 0 (see table 3-5 ) cs1 o chip select line 1 cs2 o chip select line 2 cs3 o chip select line 3 chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 192 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.3 memory map and registers 3.3.1 module memory map a summary of the registers associated with the mmc block is shown in figure 3-2 . detailed descriptions of the registers and bits are given in the subsections that follow. address register name bit 7 6 5 4 3 2 1 bit 0 0x000a mmcctl0 r cs3e1 cs3e0 cs2e1 cs2e0 cs1e1 cs1e0 cs0e1 cs0e0 w 0x000b mode r modc modb moda 00000 w 0x0010 gpage r 0 gp6 gp5 gp4 gp3 gp2 gp1 gp0 w 0x0011 direct r dp15 dp14 dp13 dp12 dp11 dp10 dp9 dp8 w 0x0012 reserved r 0 0 0 0 0 0 0 0 w 0x0013 mmcctl1 r tgmramon 0 eeeifron pgmifron ramhm eromon romhm romon w 0x0014 reserved r 0 0 0 0 0 0 0 0 w 0x0015 ppage r pix7 pix6 pix5 pix4 pix3 pix2 pix1 pix0 w 0x0016 rpage r rp7 rp6 rp5 rp4 rp3 rp2 rp1 rp0 w 0x0017 epage r ep7 ep6 ep5 ep4 ep3 ep2 ep1 ep0 w = unimplemented or reserved figure 3-2. mmc register summary chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 193 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.3.2 register descriptions 3.3.2.1 mmc control register (mmcctl0) read: anytime. in emulation modes read operations will return the data from the external bus. in all other modes the data is read from this register. write: anytime. in emulation modes write operations will also be directed to the external bus. the mmcctl0 register is used to control external bus functions, like: availability of chip selects. (see table 3-5 and table 3-6 ) control of different external stretch mechanism. for more detail refer to the s12x_ebi blockguide. caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. address: 0x000a prr 76543210 r cs3e1 cs3e0 cs2e1 cs2e0 cs1e1 cs1e0 cs0e1 cs0e0 w reset 0000000 r omon 1 1. romon is bit[0] of the register mmctl1 (see figure 3-10 ) = unimplemented or reserved figure 3-3. mmc control register (mmcctl0) table 3-5. chip selects function activity register bit chip modes ns ss nx es ex st cs0e[1:0], cs1e[1:0], cs2e[1:0], cs3e[1:0] disabled (1) 1. disabled: feature always inactive. disabled enabled (2) 2. enabled: activity is controlled by the appropriate register bit value. disabled enabled disabled chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 194 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 3-7 shows the address boundaries of each chip select and the relationship with the implemented resources (internal) parameters. table 3-6. mmcctl0 field descriptions field description 7? cs3e[1:0] chip select 3 enables ?these bits enable the external chip select cs3 output which is asserted during accesses to speci? external addresses. the associated global address range is shown in table 3-7 and figure 3-17 . chip select 3 is only active if enabled in normal expanded mode, emulation expanded mode. the function disabled in all other operating modes. 00 chip select 3 is disabled 01,10,11 chip select 3 is enabled 5? cs2e[1:0] chip select 2 enables ?these bits enable the external chip select cs2 output which is asserted during accesses to speci? external addresses. the associated global address range is shown in table 3-7 and figure 3-17 . chip select 2 is only active if enabled in normal expanded mode, emulation expanded mode. the function disabled in all other operating modes. 00 chip select 2 is disabled 01,10,11 chip select 2 is enabled 3? cs1e[1:0] chip select 1 enables ?these bits enable the external chip select cs1 output which is asserted during accesses to speci? external addresses. the associated global address range is shown in table 3-7 and figure 3-17 . chip select 1 is only active if enabled in normal expanded mode, emulation expanded mode. the function disabled in all other operating modes. 00 chip select 1 is disabled 01,10,11 chip select 1 is enabled 1? cs0e[1:0] chip select 0 enables ?these bits enable the external chip select cs0 output which is asserted during accesses to speci? external addresses. the associated global address range is shown in table 3-7 and figure 3-17 . chip select 0 is only active if enabled in normal expanded mode, emulation expanded mode. the function disabled in all other operating modes. 00 chip select 0 is disabled 01,10,11 chip select 0 is enabled table 3-7. global chip selects memory space chip selects bottom address top address cs3 0x00_0800 0x0f_ffff minus ramsize (1) 1. external rpage accesses in (nx, ex) cs2 (2) 2. when romhm is set (see romhm in table 3-16 ) the cs2 is asserted in the space occupied by this on- chip memory block. 0x14_0000 0x1f_ffff cs1 0x20_0000 0x3f_ffff cs0 (3) 3. when the internal nvm is enabled (see romon in section 3.3.2.5, ?mc control register (mmcctl1) ) the cs0 is not asserted in the space occupied by this on-chip memory block. 0x40_0000 0x7f_ffff minus flashsize (4) 4. external ppage accesses in (nx, ex) chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 195 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.3.2.2 mode register (mode) read: anytime. in emulation modes read operations will return the data read from the external bus. in all other modes the data are read from this register. write: only if a transition is allowed (see figure 3-5 ). in emulation modes write operations will be also directed to the external bus. the mode bits of the mode register are used to establish the mcu operating mode. caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. address: 0x000b prr 76543210 r modc modb moda 00000 w reset modc 1 modb 1 moda 1 00000 1. external signal (see table 3-3 ). = unimplemented or reserved figure 3-4. mode register (mode) table 3-8. mode field descriptions field description 7? modc, modb, moda mode select bits these bits control the current operating mode during reset high (inactive). the external mode pins modc, modb, and moda determine the operating mode during reset low (active). the state of the pins is latched into the respective register bits after the reset signal goes inactive (see figure 3-4 ). write restrictions exist to disallow transitions between certain modes. figure 3-5 illustrates all allowed mode changes. attempting non authorized transitions will not change the mode bits, but it will block further writes to these register bits except in special modes. both transitions from normal single-chip mode to normal expanded mode and from emulation single-chip to emulation expanded mode are only executed by writing a value of 3?101 (write once). writing any other value will not change the mode bits, but will block further writes to these register bits. changes of operating modes are not allowed when the device is secured, but it will block further writes to these register bits except in special modes. in emulation modes reading this address returns data from the external bus which has to be driven by the emulator. it is therefore responsibility of the emulator hardware to provide the expected value (i.e. a value corresponding to normal single chip mode while the device is in emulation single-chip mode or a value corresponding to normal expanded mode while the device is in emulation expanded mode). chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 196 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-5. mode transition diagram when mcu is unsecured normal single-chip 100 normal expanded 101 emulation expanded 011 emulation single-chip 001 special test 010 special single-chip 000 101 101 011 011 101 000 010 100 001 001 100 101 reset (ss) 110 111 000 reset reset reset reset reset 010 101 011 001 100 (ex) (nx) (ns) (es) (st) reset transition done by external pins (modc, modb, moda) transition done by write access to the mode register 110 111 illegal (modc, modb, moda) pin values. do not use. (reserved for future use). chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 197 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.3.2.3 global page index register (gpage) read: anytime write: anytime the global page index register is used to construct a 23 bit address in the global map format. it is only used when the cpu is executing a global instruction (gldaa, gldab, gldd, glds, gldx, gldy,gstaa, gstab, gstd, gsts, gstx, gsty) (see cpu block guide). the generated global address is the result of concatenation of the cpu local address [15:0] with the gpage register [22:16] (see figure 3-7 ). caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. figure 3-7. gpage address mapping example 3-1. this example demonstrates usage of the gpage register ldx #0x5000 ;set gpage offset to the value of 0x5000 movb #0x14, gpage ;initialize gpage register with the value of 0x14 gldaa x ;load accu a from the global address 0x14_5000 address: 0x0010 76543210 r0 gp6 gp5 gp4 gp3 gp2 gp1 gp0 w reset 00000000 = unimplemented or reserved figure 3-6. global page index register (gpage) table 3-9. gpage field descriptions field description 6? gp[6:0] global page index bits 6? these page index bits are used to select which of the 128 64-kilobyte pages is to be accessed. bit16 bit 0 bit15 bit22 cpu address [15:0] gpage register [6:0] global address [22:0] chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 198 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.3.2.4 direct page register (direct) read: anytime write: anytime in special modes, one time only in other modes. this register determines the position of the 256 byte direct page within the memory map.it is valid for both global and local mapping scheme. caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. figure 3-9. direct address mapping bits [22:16] of the global address will be formed by the gpage[6:0] bits in case the cpu executes a global instruction in direct addressing mode or by the appropriate local address to the global address expansion (refer to section 3.4.2.1.1, ?xpansion of the local address map ). example 3-2. this example demonstrates usage of the direct addressing mode movb #0x80,direct ;set direct register to 0x80. write once only. ;global data accesses to the range 0xxx_80xx can be direct. ;logical data accesses to the range 0x80xx are direct. ldy <00 ;load the y index register from 0x8000 (direct access). ;< operator forces direct access on some assemblers but in address: 0x0011 76543210 r dp15 dp14 dp13 dp12 dp11 dp10 dp9 dp8 w reset 00000000 figure 3-8. direct register (direct) table 3-10. direct field descriptions field description 7? dp[15:8] direct page index bits 15? ?these bits are used by the cpu when performing accesses using the direct addressing mode. the bits from this register form bits [15:8] of the address (see figure 3-9 ). bit15 bit0 bit7 bit22 cpu address [15:0] global address [22:0] bit8 bit16 dp [15:8] chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 199 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 ;many cases assemblers are ?irect page aware?and can ;automatically select direct mode. 3.3.2.5 mmc control register (mmcctl1) read: anytime. in emulation modes read operations will return the data from the external bus. in all other modes the data are read from this register. write: refer to each bit description. in emulation modes write operations will also be directed to the external bus. caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. address: 0x0013 prr 76543210 r tgmramon 0 eeeifron pgmifron ramhm eromon romhm romon w reset 00000er omctl 0 romctl = unimplemented or reserved figure 3-10. mmc control register (mmcctl1) table 3-11. mmcctl1 field descriptions field description 7 tgmramon eee tag ram and ftm scratch ram visible in the memory map write: anytime this bit is used to made the eee tag ram nd ftm scratch ram visible in the global memory map. 0 not visible in the memory map. 1 visible in the memory map. 5 eeeifron eee ifr visible in the memory map write: anytime this bit is used to made the ifr sector of eee data flash visible in the global memory map. 0 not visible in the memory map. 1 visible in the memory map. 4 pgmifron program ifr visible in the memory map write: anytime this bit is used to made the ifr sector of the program flash visible in the global memory map. 0 not visible in the memory map. 1 visible in the memory map. 3 ramhm ram only in higher half of the memory map write: once in normal and emulation modes and anytime in special modes 0 accesses to $4000?7fff will be mapped to $14_4000-$14_7fff in the global memory space (external access). 1 accesses to $4000?7fff will be mapped to $0f_c000-$0f_ffff in the global memory space (ram area). chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 200 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 eromon and romon control the visibility of the flash in the memory map for cpu or bdm (not for xgate). both local and global memory maps are affected. 2 eromon enables emulated flash or rom memory in the memory map write: never this bit is used in some modes to de?e the placement of the emulated flash or rom (refer to table 3-12 ) 0 disables the emulated flash or rom in the memory map. 1 enables the emulated flash or rom in the memory map. 1 romhm flash or rom only in higher half of memory map write: once in normal and emulation modes and anytime in special modes 0 the ?ed page of flash or rom can be accessed in the lower half of the memory map. accesses to 0x4000?x7fff will be mapped to 0x7f_4000-0x7f_7fff in the global memory space. 1 disables access to the flash or rom in the lower half of the memory map.these physical locations of the flash or rom can still be accessed through the program page window. accesses to 0x4000?x7fff will be mapped to 0x14_4000-0x14_7fff in the global memory space (external access). 0 romon enable flash or rom in the memory map write: once in normal and emulation modes and anytime in special modes. this bit is used in some modes to de?e the placement of the rom (refer to table 3-12 ) 0 disables the flash or rom from the memory map. 1 enables the flash or rom in the memory map. table 3-12. data sources when cpu or bdm is accessing flash area chip modes romon eromon data source (1) 1. internal flash means flash resources inside the mcu are read/written. emulation memory means resources inside the emulator are read/written (pru registers, ?sh replacement, ram, eeprom and register space are always considered internal). external application means resources residing outside the mcu are read/written. stretch (2) 2. the external access stretch mechanism is part of the ebi module (refer to ebi block guide for details). normal single chip x x internal flash n special single chip emulation single chip x 0 emulation memory n x 1 internal flash normal expanded 0 x external application y 1 x internal flash n emulation expanded 0 x external application y 1 0 emulation memory n 1 1 internal flash special test 0 x external application n 1 x internal flash table 3-11. mmcctl1 field descriptions (continued) field description chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 201 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.3.2.6 program page index register (ppage) read: anytime write: anytime these eight index bits are used to page 16 kbyte blocks into the flash page window located in the local (cpu or bdm) memory map from address 0x8000 to address 0xbfff (see figure 3-12 ). this supports accessing up to 4 mbytes of flash (in the global map) within the 64 kbyte local map. the ppage register is effectively used to construct paged flash addresses in the local map format. the cpu has special access to read and write this register directly during execution of call and rtc instructions.. caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. figure 3-12. ppage address mapping note writes to this register using the special access of the call and rtc instructions will be complete before the end of the instruction execution. address: 0x0015 76543210 r pix7 pix6 pix5 pix4 pix3 pix2 pix1 pix0 w reset 11111110 figure 3-11. program page index register (ppage) table 3-13. ppage field descriptions field description 7? pix[7:0] program page index bits 7? ?these page index bits are used to select which of the 256 flash or rom array pages is to be accessed in the program page window. bit14 bit0 1 address [13:0] ppage register [7:0] global address [22:0] bit13 bit21 address: cpu local address or bdm local address chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 202 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the ?ed 16k page from 0x4000?x7fff (when romhm = 0) is the page number 0xfd. the reset value of 0xfe ensures that there is linear flash space available between addresses 0x4000 and 0xffff out of reset. the ?ed 16k page from 0xc000-0xffff is the page number 0xff. 3.3.2.7 ram page index register (rpage) read: anytime write: anytime these eight index bits are used to page 4 kbyte blocks into the ram page window located in the local (cpu or bdm) memory map from address 0x1000 to address 0x1fff (see figure 3-14 ) . this supports accessing up to 1022 kbyte of ram (in the global map) within the 64 kbyte local map. the ram page index register is effectively used to construct paged ram addresses in the local map format . caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. figure 3-14. rpage address mapping note because ram page 0 has the same global address as the register space, it is possible to write to registers through the ram space when rpage = 0x00. address: 0x0016 76543210 r rp7 rp6 rp5 rp4 rp3 rp2 rp1 rp0 w reset 11111101 figure 3-13. ram page index register (rpage) bit18 bit0 bit11 0 address [11:0] rpage register [7:0] global address [22:0] bit12 bit19 0 address: cpu local address or bdm local address 0 chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 203 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the reset value of 0xfd ensures that there is a linear ram space available between addresses 0x1000 and 0x3fff out of reset. the ?ed 4k page from 0x2000?x2fff of ram is equivalent to page 254 (page number 0xfe). the ?ed 4k page from 0x3000?x3fff of ram is equivalent to page 255 (page number 0xff). 3.3.2.8 eeprom page index register (epage) read: anytime write: anytime these eight index bits are used to page 1 kbyte blocks into the eeprom page window located in the local (cpu or bdm) memory map from address 0x0800 to address 0x0bff (see figure 3-16 ). this supports accessing up to 256 kbyte of eeprom (in the global map) within the 64 kbyte local map. the eeprom page index register is effectively used to construct paged eeprom addresses in the local map format. caution xgate write access to this register during an cpu access which makes use of this register could lead to unexpected results. table 3-14. rpage field descriptions field description 7? rp[7:0] ram page index bits 7? these page index bits are used to select which of the 256 ram array pages is to be accessed in the ram page window. address: 0x0017 76543210 r ep7 ep6 ep5 ep4 ep3 ep2 ep1 ep0 w reset 11111110 figure 3-15. eeprom page index register (epage) chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 204 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-16. epage address mapping the reset value of 0xfe ensures that there is a linear eeprom space available between addresses 0x0800 and 0x0fff out of reset. the ?ed 1k page 0x0c00?x0fff of eeprom is equivalent to page 255 (page number 0xff). 3.4 functional description the mmc block performs several basic functions of the s12x sub-system operation: mcu operation modes, priority control, address mapping, select signal generation and access limitations for the system. each aspect is described in the following subsections. 3.4.1 mcu operating mode normal single-chip mode there is no external bus in this mode. the mcu program is executed from the internal memory and no external accesses are allowed. special single-chip mode this mode is generally used for debugging single-chip operation, boot-strapping or security related operations. the active background debug mode is in control of the cpu code execution and the bdm ?mware is waiting for serial commands sent through the bkgd pin. there is no external bus in this mode. table 3-15. epage field descriptions field description 7? ep[7:0] eeprom page index bits 7? ?these page index bits are used to select which of the 256 eeprom array pages is to be accessed in the eeprom page window. bit16 bit0 bit9 address [9:0] epage register [7:0] global address [22:0] bit10 bit17 0 0 1 00 address: cpu local address or bdm local address chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 205 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 emulation single-chip mode tool vendors use this mode for emulation systems in which the user s target application is normal single-chip mode. code is executed from external or internal memory depending on the set-up of the eromon bit (see section 3.3.2.5, ?mc control register (mmcctl1) ). the external bus is active in both cases to allow observation of internal operations (internal visibility). normal expanded mode the external bus interface is con?ured as an up to 23-bit address bus, 8 or 16-bit data bus with dedicated bus control and status signals. this mode allows 8 or 16-bit external memory and peripheral devices to be interfaced to the system. the fastest external bus rate is half of the internal bus rate. an external signal can be used in this mode to cause the external bus to wait as desired by the external logic. emulation expanded mode tool vendors use this mode for emulation systems in which the user s target application is normal expanded mode. special test mode this mode is an expanded mode for factory test. 3.4.2 memory map scheme 3.4.2.1 cpu and bdm memory map scheme the bdm ?mware lookup tables and bdm register memory locations share addresses with other modules; however they are not visible in the memory map during user s code execution. the bdm memory resources are enabled only during the read_bd and write_bd access cycles to distinguish between accesses to the bdm memory area and accesses to the other modules. (refer to bdm block guide for further details). when the mcu enters active bdm mode, the bdm ?mware lookup tables and the bdm registers become visible in the local memory map in the range 0xff00-0xffff (global address 0x7f_ff00 - 0x7f_ffff) and the cpu begins execution of ?mware commands or the bdm begins execution of hardware commands. the resources which share memory space with the bdm module will not be visible in the memory map during active bdm mode. please note that after the mcu enters active bdm mode the bdm ?mware lookup tables and the bdm registers will also be visible between addresses 0xbf00 and 0xbfff if the ppage register contains value of 0xff. chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 206 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-17. expansion of the local address map 0x7f_ffff 0x00_0000 0x14_0000 0x10_0000 0x00_0800 epage rpage ppage cpu and bdm local memory map global memory map 0xffff reset vectors 0xc000 0x8000 unpaged 0x4000 0x1000 0x0000 16k flash window 0x0c00 0x2000 0x0800 8k ram 4k ram window 1k eeprom 2k registers 1k eeprom window 16k flash unpaged 16k flash 2k registers 2k ram 253*4k paged ram 1k eeprom 255*1k paged eeprom 253 *16k paged flash 16k flash (ppage 0xfd) 8k ram external space 16k flash (ppage 0xfe) 16k flash (ppage 0xff) 0x00_1000 0x0f_e000 0x13_fc00 0x40_0000 0x7f_4000 0x7f_8000 0x7f_c000 1m minus 2 kilobytes 256 kilobytes 4 mbytes 2.75 mbytes chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 207 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.4.2.1.1 expansion of the local address map expansion of the cpu local address map the program page index register in mmc allows accessing up to 4 mbyte of flash or rom in the global memory map by using the eight page index bits to page 256 16 kbyte blocks into the program page window located from address 0x8000 to address 0xbfff in the local cpu memory map. the page value for the program page window is stored in the ppage register. the value of the ppage register can be read or written by normal memory accesses as well as by the call and rtc instructions (see section 3.5.1, ?all and rtc instructions ). control registers, vector space and parts of the on-chip memories are located in unpaged portions of the 64-kilobyte local cpu address space. the starting address of an interrupt service routine must be located in unpaged memory unless the user is certain that the ppage register will be set to the appropriate value when the service routine is called. however an interrupt service routine can call other routines that are in paged memory. the upper 16- kilobyte block of the local cpu memory space (0xc000?xffff) is unpaged. it is recommended that all reset and interrupt vectors point to locations in this area or to the other unpaged sections of the local cpu memory map. table 3-16 summarizes mapping of the address bus in flash/external space based on the address, the ppage register value and value of the romhm bit in the mmcctl1 register. the ram page index register allows accessing up to 1 mbyte ? kbytes of ram in the global memory map by using the eight rpage index bits to page 4 kbyte blocks into the ram page window located in the local cpu memory space from address 0x1000 to address 0x1fff. the eeprom page index register epage allows accessing up to 256 kbytes of eeprom in the system by using the eight epage index bits to page 1 kbyte blocks into the eeprom page window located in the local cpu memory space from address 0x0800 to address 0x0bff. table 3-16. global flash/rom allocated local cpu address romhm external access global address 0x4000?x7fff 0 no 0x7f_4000 ?x7f_7fff 1 yes 0x14_4000?x14_7fff 0x8000?xbfff n/a no (1) 1. the internal or the external bus is accessed based on the size of the memory resources implemented on-chip. please refer to figure 1-23 for further details. 0x40_0000?x7f_ffff n/a yes 1 0xc000?xffff n/a no 0x7f_c000?x7f_ffff chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 208 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 expansion of the bdm local address map ppage, rpage, and epage registers are also used for the expansion of the bdm local address to the global address. these registers can be read and written by the bdm. the bdm expansion scheme is the same as the cpu expansion scheme. 3.4.2.2 global addresses based on the global page cpu global addresses based on the global page the seven global page index bits allow access to the full 8 mbyte address map that can be accessed with 23 address bits. this provides an alternative way to access all of the various pages of flash, ram and eee as well as additional external memory. the gpage register is used only when the cpu is executing a global instruction (see section 3.3.2.3, ?lobal page index register (gpage) ). the generated global address is the result of concatenation of the cpu local address [15:0] with the gpage register [22:16] (see figure 3-7 ). bdm global addresses based on the global page the seven bdmgpr global page index bits allow access to the full 8 mbyte address map that can be accessed with 23 address bits. this provides an alternative way to access all of the various pages of flash, ram and eee as well as additional external memory. the bdm global page index register (bdmgpr) is used only in the case the cpu is executing a ?mware command which uses a global instruction (like gldd, gstd) or by a bdm hardware command (like write_w, write_byte, read_w, read_byte). see the bdm block guide for further details. the generated global address is a result of concatenation of the bdm local address with the bdmgpr register [22:16] in the case of a hardware command or concatenation of the cpu local address and the bdmgpr register [22:16] in the case of a ?mware command (see figure 3-18 ). chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 209 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-18. bdmgpr address mapping 3.4.2.3 implemented memory map the global memory spaces reserved for the internal resources (ram, eee, and flash) are not determined by the mmc module. size of the individual internal resources are however xed in the design of the device cannot be changed by the user. please refer to the device user guide for further details. figure 3-19 and table 3-17 show the memory spaces occupied by the on-chip resources. please note that the memory spaces have ?ed top addresses. when the device is operating in expanded modes except emulation single-chip mode, accesses to global addresses which are not occupied by the on-chip resources (unimplemented areas or external memory space) result in accesses to the external bus (see figure 3-19 ). table 3-17. global implemented memory space internal resource $address ram ram_low = 0x10_0000 minus ramsize (1) 1. ramsize is the hexadecimal value of ram size in bytes flash flash_low = 0x80_0000 minus flashsize (2) 2. flashsize is the hexadecimal value of flash size in bytes bit16 bit0 bit15 bit22 bdm local address bdmgpr register [6:0] global address [22:0] bit16 bit0 bit15 bit22 cpu local address bdmgpr register [6:0] global address [22:0] bdm hardware command bdm firmware command chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 210 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 in emulation single-chip mode, accesses to global addresses which are not occupied by the on-chip resources (unimplemented areas) result in accesses to the external bus. cpu accesses to global addresses which are occupied by external memory space result in an illegal access reset (system reset) in case of no mpu error. bdm accesses to the external space are performed but the data will be unde?ed. in single-chip modes accesses by the cpu (except for ?mware commands) to any of the unimplemented areas (see figure 3-19 ) will result in an illegal access reset (system reset) in case of no mpu error. bdm accesses to the unimplemented areas are allowed but the data will be unde?ed. no misaligned word access from the bdm module will occur; these accesses are blocked in the bdm module (refer to bdm block guide). misaligned word access to the last location of ram is performed but the data will be unde?ed. misaligned word access to the last location of any global page (64 kbyte) by any global instruction, is performed by accessing the last byte of the page and the ?st byte of the same page, considering the above mentioned misaligned access cases. the non-internal resources (unimplemented areas or external space) are used to generate the chip selects (cs0,cs1,cs2 and cs3) (see figure 3-19 ), which are only active in normal expanded, emulation expanded (see section 3.3.2.1, ?mc control register (mmcctl0) ). chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 211 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-19. s12xe cpu & bdm global address mapping 0x7f_ffff 0x00_0000 0x13_ffff 0x0f_ffff 256 k eeeprom ram 0x00_07ff epage rpage ppage 0x3f_ffff cpu and bdm local memory map global memory map flashsize ramsize cs3 cs1 cs0 0x1f_ffff cs2 0xffff reset vectors 0xc000 0x8000 unpaged 0x4000 0x1000 0x0000 16k flash window 0x0c00 0x2000 0x0800 8k ram 4k ram window 1k eeprom 2k registers 1k eeprom window 16k flash unpaged 16k flash 2k registers unimplemented ram external space ram_low flash flash_low unimplemented flash chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 212 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.4.2.4 xgate memory map scheme 3.4.2.4.1 expansion of the xgate local address map the xgate 64 kbyte memory space allows access to internal resources only (registers, ram, and flash). the 2 kilobyte register address range is the same register address range as for the cpu and the bdm module (see table 3-18 ). xgate can access the flash in single chip modes, even when the mcu is secured. in expanded modes, xgate can not access the flash when mcu is secured. the local address of the xgate ram access is translated to the global ram address range. the xgate shares the ram resource with the cpu and the bdm module (see table 3-18 ). xgate ram size (xgramsize) may be lower or equal to the mcu ram size (ramsize).in case of xgate ram size less than 32 kbytes (see figure 3-20 ), the gap in the xgate local memory map will result in an illegal ram access (see section 3.4.3.1, ?llegal xgate accesses ) the local address of the xgate flash access is always translated to the global address 0x78_0800 - 0x78_7fff. example 3-3. is a general example of the xgate memory map implementation. example 3-3. the mcu flashsize is 64 kbytes (0x10000) and mcu ramsize is 32 kbytes (0x8000). the xgate ramsize is 16 kbytes (0x4000). the space occupied by the xgate ram in the global address space will be: bottom address: (0x10_0000 minus 0x4000) = 0x0f_c000 top address: 0x0f_ffff xgate accesses to local address range 0x0800?x7fff will result always in accesses to the following flash block in the global address space: bottom address: 0x78_0800 top address: 0x78_7fff the gap range in the local memory map 0x8000?xbfff will be translated in the global address space: 0x0f_8000 - 0x0f_bfff (illegal xgate access to system ram). table 3-18. xgate implemented memory space internal resource $address xgate ram xgram_low = 0x0f_0000 plus (0x1_0000 minus xgramsize) (1) 1. xgramsize is the hexadecimal value of xgate ram size in bytes. chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 213 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-20. xgate global address mapping 0x7f_ffff 0x00_0000 0x0f_ffff 0xffff 0x0000 registers flash ram 0x0800 registers 0x00_07ff xgate local memory map global memory map flashsize xgramsize ramsize 0x78_0800 flash ram xgram_low 0x78_7fff 0x7fff xgramsize unimplemented area chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 214 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.4.2.5 memory con?uration two bits in the mmcctl1 register (romhm, ramhm) con?ure the mapping of the local address (0x4000-0x7fff) in the global memory map. romhm, ramhm are write once in normal and emulation modes and anytime in special modes. three areas are identi?d (see figure 3-21 ): program flash (0x7f_4000-0x7f_7fff) when romhm = 0. external space (0x14_4000-0x14_7fff) when romhm = 1 and ramhm = 0. xsram space (0x0f_c000-0x0f_ffff) when romhm = 1 and ramhm = 1. table 3-19 shows the translation from the local memory map to the global memory map taking in consideration the different con?urations of romhm and ramhm. table 3-20 describes the application note of the ram con?uration and its dedicated global address. table 3-19. romhm and ramhm address location local address romhm ramhm global address location 0x4000 - 0x7fff 0 x 0x7f_4000 - 0x7f_7fff internal flash 1 0 0x14_4000 - 0x14_7fff external space 11 0x0f_c000 - 0x0f_ffff bottom of the implemented ram 0x2000 - 0x3fff 0x0f_a000 - 0x0f_bfff fixed up to 8k ram 0x2000 - 0x3fff 1 0 0x0f_e000 - 0x0f_ffff fixed up to 8k ram table 3-20. ram con?uration phase rpage romhm ramhm ram area global address after reset rpage = 0xfd (reset value) 0 0 12 kilobytes 0x0f_d000 - 0x0f_ffff during setup rpage = 0xfd (reset value) 1 1 24 kilobytes 0x0f_a000 - 0x0f_ffff normal operation (0x00 <= rpage <= 0xf9) 1 1 28 kilobytes 0x00_0000 - 0x0f_9fff (0xfa <= rpage <= 0xff) 1 1 24 kilobytes 0x0f_a000 - 0x0f_ffff chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 215 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-21. romhm, ramhm memory con?uration 0x7f_ffff 0x00_0000 0x14_0000 0x10_0000 0x00_0800 cpu and bdm local memory map global memory map 0xffff reset vectors 0xc000 0x8000 0x4000 0x1000 0x0000 16k flash window 0x0c00 0x2000 0x0800 8k ram 4k ram window 1k eeprom 2k registers 1k eeprom window unpaged 16k flash 2k registers 2k ram 251*4k paged ram 1k eeprom 255*1k paged eeprom 253 *16k paged flash 16k flash 16k flash (ppage 0xfe) 16k flash (ppage 0xff) 0x00_1000 0x0f_c000 0x13_fc00 0x40_0000 0x7f_4000 0x7f_8000 0x7f_c000 1m minus 2 kilobytes 256 kilobytes 4 mbytes 2.75 mbytes 8k ram 16k ram 1 1 1 0 0 x romhm ramhm romhm ramhm romhm ramhm 0x0f_a000 0x14_4000 external space 16k external chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 216 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.4.2.5.1 system xsram system xsram has two ways to be accessed by the cpu. one is by the programming of rpage and the ?ed xsram areas con?ured by the values of romhm, ramhm, or by the usage of the global instruction and the usage of gpage. figure 3-22 shows the memory map for the implemented xsram. the size of the implemented xsram is done by the device de?ition and denoted by ramsize. figure 3-22. s12xe system ram in the memory map 0x7f_ffff 0x00_0000 0x13_ffff 0x0f_ffff eeprom area 0x00_07ff 0x3f_ffff ram area in the memory map flash area ramsize reg. area external space area unimplemented ram ram area 16k ram 8k ram unimplemented ram 8k ram 0x0f_ffff 0x0f_ffff 0x0f_c000 0x0f_a000 0x0f_e000 0x00_0800 0x00_0800 romhm = 1 ramhm = 0 romhm = 0 ramhm = x romhm = 1 ramhm = 1 chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 217 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.4.3 chip access restrictions cpu and xgate accesses are watched in the memory protection unit (see mpu block guide). in case of access violation, the suspect master is acknowledged with an indication of an error; the victim target will not be accessed. other violations mpu is not handling are listed below. 3.4.3.1 illegal xgate accesses a possible access error is ?gged by the mmc and signalled to xgate under the following conditions: xgate performs misaligned word (in case of load-store or opcode or vector fetch accesses). xgate accesses the register space (in case of opcode or vector fetch). xgate performs a write to flash in any modes (in case of load-store access). xgate performs an access to a secured flash in expanded modes (in case of load-store or opcode or vector fetch accesses). for further details refer to the xgate block guide. 3.4.4 chip bus control the mmc controls the address buses and the data buses that interface the s12x masters (cpu, bdm and xgate) with the rest of the system (master buses). in addition the mmc handles all cpu read data bus swapping operations. all internal and external resources are connected to speci? target buses (see figure 3-23 1 ). 1. doted blocks and lines are optional. please refer to the device user guide for their availlibilities. chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 218 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-23. mmc block diagram 3.4.4.1 master bus prioritization regarding access con?cts on target buses the arbitration scheme allows only one master to be connected to a target at any given time. the following rules apply when prioritizing accesses from different masters to the same target bus: cpu always has priority over bdm and xgate. xgate access to pru registers constitutes a special case. it is always granted and stalls the cpu for its duration. xgate has priority over bdm. bdm has priority over cpu and xgate when its access is stalled for more than 128 cycles. in the later case the suspect master will be stalled after ?ishing the current operation and the bdm will gain access to the bus. in emulation modes all internal accesses are visible on the external bus as well and the external bus is used during access to the pru registers. 3.5 initialization/application information 3.5.1 call and rtc instructions call and rtc instructions are uninterruptable cpu instructions that automate page switching in the program page window. the call instruction is similar to the jsr instruction, but the subroutine that is ipbi flash cpu bdm eee ebi mmc ?rossbar switch xsram xgate bdm ftm s12x1 s12x0 xgate xbus3 xbus0 xbus1 xram xbus2 blkx dbg resources flexray s12x2 chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 219 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 called can be located anywhere in the local address space or in any flash or rom page visible through the program page window. the call instruction calculates and stacks a return address, stacks the current ppage value and writes a new instruction-supplied value to the ppage register. the ppage value controls which of the 256 possible pages is visible through the 16 kbyte program page window in the 64 kbyte local cpu memory map. execution then begins at the address of the called subroutine. during the execution of the call instruction, the cpu performs the following steps: 1. writes the current ppage value into an internal temporary register and writes the new instruction- supplied ppage value into the ppage register 2. calculates the address of the next instruction after the call instruction (the return address) and pushes this 16-bit value onto the stack 3. pushes the temporarily stored ppage value onto the stack 4. calculates the effective address of the subroutine, re?ls the queue and begins execution at the new address this sequence is uninterruptable. there is no need to inhibit interrupts during the call instruction execution. a call instruction can be performed from any address to any other address in the local cpu memory space. the ppage value supplied by the instruction is part of the effective address of the cpu. for all addressing mode variations (except indexed-indirect modes) the new page value is provided by an immediate operand in the instruction. in indexed-indirect variations of the call instruction a pointer speci?s memory locations where the new page value and the address of the called subroutine are stored. using indirect addressing for both the new page value and the address within the page allows usage of values calculated at run time rather than immediate values that must be known at the time of assembly. the rtc instruction terminates subroutines invoked by a call instruction. the rtc instruction unstacks the ppage value and the return address and re?ls the queue. execution resumes with the next instruction after the call instruction. during the execution of an rtc instruction the cpu performs the following steps: 1. pulls the previously stored ppage value from the stack 2. pulls the 16-bit return address from the stack and loads it into the pc 3. writes the ppage value into the ppage register 4. re?ls the queue and resumes execution at the return address this sequence is uninterruptable. the rtc can be executed from anywhere in the local cpu memory space. the call and rtc instructions behave like jsr and rts instruction, they however require more execution cycles. usage of jsr/rts instructions is therefore recommended when possible and call/rtc instructions should only be used when needed. the jsr and rts instructions can be used to access subroutines that are already present in the local cpu memory map (i.e. in the same page in the program memory page window for example). however calling a function located in a different page requires usage of the call instruction. the function must be terminated by the rtc instruction. because the rtc instruction restores contents of the ppage register from the stack, functions terminated with the rtc instruction must be called using the call instruction even when the correct page is already present chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 220 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 in the memory map. this is to make sure that the correct ppage value will be present on stack at the time of the rtc instruction execution. 3.5.2 port replacement registers (prrs) registers used for emulation purposes must be rebuilt by the in-circuit emulator hardware to achieve full emulation of single chip mode operation. these registers are called port replacement registers (prrs) (see table 1-25 ). prrs are accessible from cpu, bdm and xgate using different access types (word aligned, word-misaligned and byte). each access to prrs will be extended to 2 bus cycles for write or read accesses independent of the operating mode. in emulation modes all write operations result in simultaneous writing to the internal registers (peripheral access) and to the emulated registers (external access) located in the pru in the emulator. all read operations are performed from external registers (external access) in emulation modes. in all other modes the read operations are performed from the internal registers (peripheral access). due to internal visibility of cpu accesses the cpu will be halted during xgate or bdm access to any prr. this rule applies also in normal modes to ensure that operation of the device is the same as in emulation modes. a summary of prr accesses: an aligned word access to a prr will take 2 bus cycles. a misaligned word access to a prrs will take 4 cycles. if one of the two bytes accessed by the misaligned word access is not a prr, the access will take only 3 cycles. a byte access to a prr will take 2 cycles. chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 221 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.5.3 on-chip rom control the mcu offers two modes to support emulation. in the ?st mode (called generator) the emulator provides the data instead of the internal flash and traces the cpu actions. in the other mode (called observer) the internal flash provides the data and all internal actions are made visible to the emulator. 3.5.3.1 rom control in single-chip modes in single-chip modes the mcu has no external bus. all memory accesses and program fetches are internal (see figure 3-24 ). table 3-21. prr listing prr name prr local address prr location porta 0x0000 pim portb 0x0001 pim ddra 0x0002 pim ddrb 0x0003 pim portc 0x0004 pim portd 0x0005 pim ddrc 0x0006 pim ddrd 0x0007 pim porte 0x0008 pim ddre 0x0009 pim mmcctl0 0x000a mmc mode 0x000b mmc pucr 0x000c pim rdriv 0x000d pim ebictl0 0x000e ebi ebictl1 0x000f ebi reserved 0x0012 mmc mmcctl1 0x0013 mmc eclkctl 0x001c pim reserved 0x001d pim portk 0x0032 pim ddrk 0x0033 pim chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 222 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-24. rom in single chip modes 3.5.3.2 rom control in emulation single-chip mode in emulation single-chip mode the external bus is connected to the emulator. if the eromon bit is set, the internal flash provides the data and the emulator can observe all internal cpu actions on the external bus. if the eromon bit is cleared, the emulator provides the data (generator) and traces the all cpu actions (see figure 3-25 ). figure 3-25. rom in emulation single-chip mode 3.5.3.3 rom control in normal expanded mode in normal expanded mode the external bus will be connected to the application. if the romon bit is set, the internal flash provides the data. if the romon bit is cleared, the application memory provides the data (see figure 3-26 ). mcu flash no external bus eromon = 1 emulator mcu eromon = 0 emulator flash mcu flash observer generator chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 223 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-26. rom in normal expanded mode romon = 1 application mcu romon = 0 application mcu flash memory memory chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 224 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3.5.3.4 rom control in emulation expanded mode in emulation expanded mode the external bus will be connected to the emulator and to the application. if the romon bit is set, the internal flash provides the data. if the eromon bit is set as well the emulator observes all cpu internal actions, otherwise the emulator provides the data and traces all cpu actions (see figure 3-27 ). when the romon bit is cleared, the application memory provides the data and the emulator will observe the cpu internal actions (see figure 3-28 ). figure 3-27. romon = 1 in emulation expanded mode eromon = 1 application mcu flash memory emulator eromon = 0 application mcu memory emulator flash generator observer chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 225 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 3-28. romon = 0 in emulation expanded mode 3.5.3.5 rom control in special test mode in special test mode the external bus is connected to the application. if the romon bit is set, the internal flash provides the data, otherwise the application memory provides the data (see figure 3-29 ). figure 3-29. rom in special test mode application mcu memory emulator observer application mcu memory romon = 0 application mcu memory romon = 1 flash chapter 3 memory mapping control (s12xmmcv4) mc9s12xe-family reference manual , rev. 1.21 226 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 227 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 4 memory protection unit (s12xmpuv1) 4.1 introduction the mpu module provides basic functionality required to protect memory mapped resources from undesired accesses. multiple address range comparators compare memory accesses against eight memory protection descriptors located in the mpu module to determine if each access is valid or not. the comparison is sensitive to which bus master generates the access and the type of the access. the mpu module can be used to isolate memory ranges accessible by different bus masters. it can be also be used by an operating system or software kernel to isolate the regions of memory ?egally available to speci? software tasks, with the kernel re-con?uring the task speci? memory protection descriptors in supervisor state during task-switching. 4.1.1 preface the following terms and abbreviations are used in the document. table 4-2. terminology 4.1.2 overview the mpu module monitors the bus activity of each bus master. the data describing each access is fed into multiple address range comparators. the output of the comparators is used to determine if a particular table 4-1. revision history revision number revision date sections affected description of changes v01.04 14 sep 2005 4.3.1.1/4-231 4.4.1/4-237 - added note to only use the cpu to clear the ae ?g. - added disclaimer to avoid changing descriptors while they are in use because of other bus-masters doing accesses. v01.05 14 mar 2006 4.3.1.1/4-231 4.4/4-237 - clari?d that interrupt generation is independent of aef bit state. - corrected preliminary statement about execution of violating accesses. v01.06 09 oct 2006 - made revision history entries public. term meaning mcu micro-controller unit mpu memory protection unit cpu s12x central processing unit (see s12xcpu reference manual) xgate xgate co-processor (see xgate chapter) supervisor state refers to the supervisor state of the s12xcpu (see s12xcpu reference manual) user state refers to the user state of the s12xcpu (see s12xcpu reference manual) chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual , rev. 1.21 228 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 access is allowed or represents an access violation. if an access violation caused by the s12x cpu is detected, the mpu module raises an access violation interrupt. if the mpu module detects an access violation caused by a bus master other than the s12x cpu, it ?gs an access error condition to the respective master. in addition to the restrictions de?ed for memory ranges in the mpu descriptors, accesses to memory not covered by any mpu descriptor (even read accesses!) are considered access violations. figure 4-1 shows a block diagram of the mpu module. figure 4-1. block diagram 4.1.3 features protects memory from undesired accesses coming from up to 3 bus masters 1 eight memory protection descriptors each descriptor can cover the full global memory map (8 mbytes) each descriptor has a granularity of 8 bytes 1. master 3 can be implemented or left out depending the chip con?uration. please refer to the device reference manual for information about the availability and function of master 3. bus interface data access op-code fetch status registers cpu mmc mpu protection descriptors bus interface data access ?aster3 bus interface data access op-code fetch xgate access validation bus interface bus interface bus interface mpu monitoring access validation mpu monitoring access validation mpu monitoring protection descriptors comparators comparators comparators access violation interrupt chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 229 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 each descriptor can be con?ured to allow one of four types of access privilege for the de?ed memory region bus master has full access (read, write and execute enabled) bus master can read and execute (write illegal) bus master can read and write (execution illegal) bus master can only read (write and execution illegal) accesses to memory not covered by any protection descriptor will cause an access violation 4.1.4 modes of operation the mpu module can be used in all mcu modes. 4.2 external signal description the mpu module has no external signals. 4.3 memory map and register de?ition this section provides a detailed description of address space and registers used by the mpu module. chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual , rev. 1.21 230 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4.3.1 register descriptions this section describes in address order all the mpu module registers and their individual bits. figure 4-2. mpu register summary register name bit 7 6 5 4 3 2 1 bit 0 0x0000 mpuflg r aef wpf nexf 0 0 0 0 svsf w 0x0001 mpuastat0 r 0 addr[22:16] w 0x0002 mpuastat1 r addr[15:8] w 0x0003 mpuastat2 r addr[7:0] w 0x0004 reserved r00000000 w 0x0005 mpusel r svsen 0000 sel[2:0] w 0x0006 mpudesc0 (1) 1. the module addresses 0x0006 ? 0x000b represent a window in the register map through which different descriptor registers are visible. r mstr0 mstr1 mstr2 mstr3 low_addr[22:19] w 0x0007 mpudesc1 1 r low_addr[18:11] w 0x0008 mpudesc2 1 r low_addr[10:3] w 0x0009 mpudesc3 1 r wp nex 00 high_addr[22:19] w 0x000a mpudesc4 1 r high_addr[18:11] w 0x000b mpudesc5 1 r high_addr[10:3] w = unimplemented or reserved chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 231 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4.3.1.1 mpu flag register (mpuflg) figure 4-3. mpu flag register (mpuflg) read: anytime write: write of 1 clears ?g, write of 0 ignored table 4-3. mpuflg field descriptions if the aef bit is set further violations are not captured into the mpu status registers. the status of the aef bit has no effect on the access restrictions, i.e. access restrictions for all masters are still enforced if the aef bit is set. also, the non-maskable hardware interrupt for violating accesses coming from the s12x cpu is generated regardless of the state of the aef bit. address: module base + 0x0000 76543210 r aef wpf nexf 0000 svsf w reset 0 0 0 00000 field description 7 aef access error flag ?this bit is the cpu access error interrupt ?g. it is set if a cpu access violation has occurred. at the same time this bit is set, all the other status ?gs in this register and the access violation address bits in the mpuastatn registers are captured. clear this ?g by writing a one. note: if a cpu access error is ?gged and both the wpf bit and the nexf bit are zero, the access violation was caused by an access to memory not covered by the mpu descriptors. note: while this bit is set, the cpu in supervisor state (?aster 0? can read from and write to the peripheral register space even if there is no memory protection descriptor explicitly allowing this. this is to prevent the case that the cpu cannot clear the aef bit if the registers are write protected for the cpu in supervisor state. note: this bit should only be cleared by an access from the s12x cpu. otherwise, when using one of the other masters (such as the xgate) to clear this bit, the status ?gs and the address status registers may not get updated correctly if a cpu access causes a violation in the same bus cycle. 6 wpf write-protect violation flag this ?g is set if the current cpu access violation has occurred because of an attempt to write to memory con?ured as read-only. the wpf bit is read-only; it will be automatically updated when the next access violation is ?gged with the aef bit. 5 nexf no-execute violation flag this bit is set if the current cpu access violation has occurred because of an attempt to fetch code from memory con?ured as no-execute. the nexf bit is read-only; it will be automatically updated when the next access violation is ?gged with the aef bit. 0 svsf supervisor state flag ?this bit is set if the current cpu access violation occurred while the cpu was in supervisor state. this bit is cleared if the current cpu access violation occurred while the cpu was in user state. the supervisor state ?g is read-only; it will be automatically updated when the next cpu access violation is ?gged with the aef bit. chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual , rev. 1.21 232 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4.3.1.2 mpu address status register 0 (mpuastat0) figure 4-4. mpu address status register 0 (mpuastat0) read: anytime write: never table 4-4. mpuastat0 field descriptions 4.3.1.3 mpu address status register 1 (mpuastat1) figure 4-5. mpu address status register 1 (mpuastat1) read: anytime write: never table 4-5. mpuastat1 field descriptions address: module base + 0x0001 76543210 r 0 addr[22:16] w reset 0 0 0 00000 field description 6? addr[22:16] access violation address bits ?the addr[22:16] bits contain bits [22:16] of the global address which caused the current access violation interrupt. these bits are unde?ed if the access error ?g bit (aef) in the mpuflg register is not set. address: module base + 0x0002 76543210 r addr[15:8] w reset 0 0 0 00000 field description 7? addr[15:8] access violation address bits the addr[15:8] bits contain bits [15:8] of the global address which caused the current access violation interrupt. these bits are unde?ed if the access error ?g bit (aef) in the mpuflg register is not set. chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 233 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4.3.1.4 mpu address status register 2 (mpuastat2) figure 4-6. mpu address status register (mpuastat2) read: anytime write: never table 4-6. mpuastat2 field descriptions 4.3.1.5 mpu descriptor select register (mpusel) figure 4-7. mpu descriptor select register (mpusel) read: anytime write: anytime table 4-7. mpusel field descriptions address: module base + 0x0003 76543210 r addr[7:0] w reset 0 0 0 00000 field description 7? addr[7:0] access violation address bits ?the addr[7:0] bits contain bits [7:0] of the global address which caused the current access violation interrupt. these bits are unde?ed if the access error ?g bit (aef) in the mpuflg register is not set. address: module base + 0x0005 76543210 r svsen 0000 sel[2:0] w reset 0 0 0 00000 field description 7 svsen mpu supervisor state enable bit this bit enables the memory protection for the cpu in supervisor state. if this bit is cleared, the mpu does not affect any accesses coming from the cpu in supervisor state. this is to prevent the cpu from locking out itself while con?uring the protection descriptors (during initialization after a system reset and during the update of the protection descriptors for a task switch). the memory protection functionality for the other bus-masters is unaffected by this bit. 0 mpu is disabled for the cpu in supervisor state 1 mpu is enabled for the cpu in supervisor state 2? sel[2:0] descriptor select bits ?the sel[2:0] bits select which descriptor is visible in the mpu descriptor register window (mpudesc0?pudesc5). chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual , rev. 1.21 234 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4.3.1.6 mpu descriptor register 0 (mpudesc0) figure 4-8. mpu descriptor register 0 (mpudesc0) read: anytime write: anytime table 4-8. mpudesc0 field descriptions a descriptor can be con?ured as valid for more than one bus-master at the same time by setting multiple master select bits to one. setting all master select bits of a descriptor to zero disables the descriptor. 4.3.1.7 mpu descriptor register 1 (mpudesc1) figure 4-9. mpu descriptor register 1 (mpudesc1) read: anytime write: anytime address: module base + 0x0006 76543210 r mstr0 mstr1 mstr2 mstr3 low_addr[22:19] w reset 1 (1) 1. initialized as set for descriptor 0 only, cleared for all others 1 1 1 1 1 (2) 2. initialized as set for descriptor 0 only, if mstr3 is implemented on the device 0000 field description 7 mstr0 master 0 select bit ?if this bit is set the descriptor is valid for bus master 0 (cpu in supervisor state). 6 mstr1 master 1 select bit ?if this bit is set the descriptor is valid for bus master 1 (cpu in user state). 5 mstr2 master 2 select bit ?if this bit is set the descriptor is valid for bus master 2 (xgate). 4 mstr3 master 3 select bit ?if this bit is set the descriptor is valid for bus master 3. 3? low_addr[ 22:19] memory range lower boundary address bits ?the low_addr[22:19] bits represent bits [22:19] of the global memory address that is used as the lower boundary for the described memory range. address: module base + 0x0007 76543210 r low_addr[18:11] w reset 0 0 0 00000 chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 235 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 4-9. mpudesc1 field descriptions 4.3.1.8 mpu descriptor register 2 (mpudesc2) figure 4-10. mpu descriptor register 2 (mpudesc2) read: anytime write: anytime table 4-10. mpudesc2 field descriptions 4.3.1.9 mpu descriptor register 3 (mpudesc3) figure 4-11. mpu descriptor register 3 (mpudesc3) read: anytime write: anytime table 4-11. mpudesc3 field descriptions field description 7? low_addr[ 18:11] memory range lower boundary address bits ?the low_addr[18:11] bits represent bits [18:11] of the global memory address that is used as the lower boundary for the described memory range. address: module base + 0x0008 76543210 r low_addr[10:3] w reset 0 0 0 00000 field description 7? low_addr[ 10:3] memory range lower boundary address bits the low_addr[10:3] bits represent bits [10:3] of the global memory address that is used as the lower boundary for the described memory range. address: module base + 0x0009 76543210 r wp nex 00 high_addr[22:19] w reset 0 0 0 01111 field description 7 wp write-protect bit ?the wp bit causes the described memory range to be treated as write-protected. if this bit is set every attempt to write in the described memory range causes an access violation. chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual , rev. 1.21 236 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4.3.1.10 mpu descriptor register 4 (mpudesc4) figure 4-12. mpu descriptor register 4 (mpudesc4) read: anytime write: anytime table 4-12. mpudesc4 field descriptions 4.3.1.11 mpu descriptor register 5 (mpudesc5) figure 4-13. mpu descriptor register 5 (mpudesc5) read: anytime write: anytime table 4-13. mpudesc5 field descriptions 6 nex no-execute bit the nex bit prevents the described memory range from being used as code memory. if this bit is set every op-code fetch in this memory range causes an access violation. 3? high_addr[ 22:19] memory range upper boundary address bits ?the high_addr[22:19] bits represent bits [22:19] of the global memory address that is used as the upper boundary for the described memory range. address: module base + 0x000a 76543210 r high_addr[18:11] w reset 1 1 1 11111 field description 7? high_addr[ 18:11] memory range upper boundary address bits ?the high_addr[18:11] bits represent bits [18:11] of the global memory address that is used as the upper boundary for the described memory range. address: module base + 0x000b 76543210 r high_addr[10:3] w reset 1 1 1 11111 field description 7? high_addr[ 10:3] memory range upper boundary address bits ?the high_addr[10:3] bits represent bits [10:3] of the global memory address that is used as the upper boundary for the described memory range. field description chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 237 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4.4 functional description the mpu module provides memory protection for accesses coming from multiple masters in the system. this is done by monitoring bus traf? of each master and compare this with the con?uration information from a set of eight programmable descriptors located in the mpu module. if the mpu module detects an access violation caused by the s12x cpu, it will assert the cpu access violation interrupt signal. if the mpu module detects an access violation caused by a bus master other than the s12x cpu, it raises an access error signal. please refer to the documentation chapter of the individual master modules (i.e. xgate, etc.) for more information about the access error condition. violating accesses are not executed. the return value of a violating read access is unde?ed for both 8 bit and 16 bit accesses. note accesses from bdm are not restricted. bdm hardware accesses always bypass the mpu module. during execution of bdm ?mware code s12x cpu accesses are masked from the mpu module as well. 4.4.1 protection descriptors each of the eight protection descriptors can be used to restrict the allowed types of memory accesses for a given memory range. each of these memory ranges can cover up the entire 23 bits global memory range (8 mbytes). the descriptors are banked in the mpu module register map. each descriptor can be selected for modifying using the sel bits in the mpu descriptor select (mpusel) register. table 4-14 gives an overview of the types of accesses that can be con?ured using the protection descriptors. table 4-14. access types the granularity of each descriptor is 8 bytes. this means the protection comparators in the mpu module cover only address bits [22:3] of each access. the lower address bits [2:0] are ignored. note a mis-aligned word access to the upper boundary address of a descriptor is always ?gged as an access violation. wp nex meaning 0 0 read, write and execute 0 1 read, write 1 0 read and execute 1 1 read only chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual , rev. 1.21 238 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note con?uring the lower boundary address of a descriptor to be higher than the upper boundary address of a descriptor causes this descriptor to be ignored by the comparator block. this effectively disables the descriptor. note avoid changing descriptors while they are in active use to validate accesses from bus-masters. this can be done by temporarily disabling the affected master during the update (xgate, master 3, switch s12x cpu states). otherwise accesses from bus-masters affected by a descriptor which is updated concurrently could yield unde?ed results. 4.4.1.1 overlapping descriptors if the memory ranges of two protection descriptors de?ed for the same bus-master overlap, the access restrictions for the overlapped memory range are accumulated. for example: a memory protection descriptor de?es memory range 0x40_0000 ? 0x41_ffff as wp=1, nex=0 (read and execute) another descriptor de?es memory range 0x41_0000 ? 0x43_ffff as wp=0, nex=1 (read and write) the resulting access rights for the overlapping range 0x41_0000 ? 0x41_ffff are wp=1, nex=1 (read only) 4.4.1.2 implicitly de?ed memory descriptors as mentioned in the bit description of the access error flag (aef) in the mpuflg register ( table 4-3 ), there is an additional memory range implicitly de?ed only while the aef bit is set: the cpu in supervisor state can read from and write to the peripheral register space even if there is no memory protection descriptor explicitly allowing this. this is to prevent the case that the cpu cannot clear the aef bit if the registers are write protected for the cpu in supervisor state. the register address space containing the page registers (epage, rpage, gpage, ppage) at 0x0010 ? 0x0017 gets special treatment. it is de?ed like this: the s12x cpu can always read and write these registers, regardless of the con?uration in the descriptors. xgate or master3 (if available) are never allowed to read or write these registers, even if the descriptor con?uration allows accesses for other masters than the s12x cpu. 4.4.1.3 op-code pre-fetch cycles and the nex bit some bus-masters (cpu, xgate) do a pre-fetch of program-code past the current instruction. the s12xcpu pre-fetches two words past the current instruction, the xgate pre-fetches one word, even if the pre-fetched code is not executed. the mpu module has no way of knowing this at the time when the pre-fetch cycles occur. therefore this will result in an access violation if the op-code pre-fetch accesses a memory range marked as ?o-execute (nex=1). this must be taken into account when de?ing memory chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 239 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 ranges with the nex bit set adjacent to memory used for program code. the best way to do this would be to leave some ?l-bytes between the memory ranges in this case, i.e. do not set the upper memory boundary to the address of the last op-code but to a following address which is at least two words (four bytes) away. 4.4.2 interrupts this section describes all interrupts originated by the mpu module. 4.4.2.1 description of interrupt operation the mpu module generates one interrupt request. it cannot be masked locally in the mpu module and is meant to be used as the source of a non-maskable hardware interrupt request for the s12x cpu 4.4.2.2 cpu access error interrupt an s12x cpu access error interrupt request is generated if the mpu module has detected an illegal memory access originating from the s12x cpu. this is a non-maskable hardware interrupt. due to the non-maskable nature of this interrupt, the de-assertion of this interrupt request is coupled to the s12x cpu interrupt vector fetch instead of the local access error ?g (aef). this means leaving the access error ?g (aef) in the mpuflg register set will not cause the same interrupt to be serviced again after leaving the interrupt service routine with ?ti? instead, the interrupt request will be asserted again only when the next illegal s12x cpu access is detected. 4.5 initialization/application information 4.5.1 initialization after reset the mpu module is in an uncon?ured state, with all eight protection descriptors covering the whole memory map. the master bits are all set for descriptor ? and cleared for all other descriptors. the s12xcpu in supervisor state can access everything because the svsen bit in the mpusel register is cleared by a system reset. after system reset every master has full access to the memory map because of descriptor ?? in order to use the mpu module to protect memory ranges from undesired accesses, software needs to: initialize the protection descriptors. make sure there are meaningful interrupt service routines de?ed for the access violation interrupts because these are non-maskable (see s12xint chapter for details). initialize peripherals and other masters for use (i.e. set-up xgate, master3 if applicable). enable the mpu protection for the s12x cpu in supervisor state, if desired. switch the s12x cpu to user state, if desired. table 4-15. interrupt vectors interrupt source ccr mask local enable s12x cpu access error interrupt (aef) ?? chapter 4 memory protection unit (s12xmpuv1) mc9s12xe-family reference manual , rev. 1.21 240 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 241 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 5 external bus interface (s12xebiv4) 5.1 introduction this document describes the functionality of the xebi block controlling the external bus interface. the xebi controls the functionality of a non-multiplexed external bus (a.k.a. ?xpansion bus? in relationship with the chip operation modes. dependent on the mode, the external bus can be used for data exchange with external memory, peripherals or pru, and provide visibility to the internal bus externally in combination with an emulator. table 5-1. revision history revision number revision date sections affected description of changes v04.01 12 sep 2005 - added csx stretch description. v04.02 23 may 2006 - internal updates v04.03 24 jul 2006 - removed term ivis chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 242 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.1.1 glossary or terms 5.1.2 features the xebi includes the following features: output of up to 23-bit address bus and control signals to be used with a non-muxed external bus bidirectional 16-bit external data bus with option to disable upper half visibility of internal bus activity 5.1.3 modes of operation single-chip modes the external bus interface is not available in these modes. expanded modes address, data, and control signals are activated on the external bus in normal expanded mode and special test mode. emulation modes the external bus is activated to interface to an external tool for emulation of normal expanded mode or normal single-chip mode applications. bus clock system clock. refer to crg block guide. expanded modes normal expanded mode emulation single-chip mode emulation expanded mode special test mode single-chip modes normal single-chip mode special single-chip mode emulation modes emulation single-chip mode emulation expanded mode normal modes normal single-chip mode normal expanded mode special modes special single-chip mode special test mode ns normal single-chip mode ss special single-chip mode nx normal expanded mode es emulation single-chip mode ex emulation expanded mode st special test mode external resource addresses outside mcu prr port replacement registers pru port replacement unit emulmem external emulation memory access source cpu or bdm or xgate chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 243 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 refer to the s12x_mmc section for a detailed description of the mcu operating modes. 5.1.4 block diagram figure 5-1 is a block diagram of the xebi with all related i/o signals. figure 5-1. xebi block diagram 5.2 external signal description the user is advised to refer to the soc section for port configuration and location of external bus signals. note the following external bus related signals are described in other sections: eclk, eclkx2 (free-running clocks) ?pim section t a ghi, t a glo (tag inputs) ?pim section, s12x_dbg section table 5-2 outlines the pin names and gives a brief description of their function. refer to the soc section and pim section for reset states of these pins and associated pull-ups or pull-downs. xebi addr[22:0] data[15:0] lstrb r w uds lds re we ew ait acc[2:0] iqstat[3:0] ivd[15:0] cs[3:0] chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 244 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 5-2. external system signals associated with xebi signal i (1) /o 1. all inputs are capable of reducing input threshold level ebi signal multiplex (t)ime (2) (f)unction (3) 2. time-multiplex means that the respective signals share the same pin on chip level and are active alternating in a dedicated time slot (in modes where applicable). 3. function-multiplex means that one of the respective signals sharing the same pin on chip level continuously uses the pin depending on con?uration and reset state. description available in modes ns ss nx es ex st re o read enable, indicates external read access no no yes no no no addr[22:20] o t external address no no yes yes yes yes acc[2:0] o access source no no no yes yes yes addr[19:16] o t external address no no yes yes yes yes iqstat[3:0] o instruction queue status no no no yes yes yes addr[15:1] o t external address no no yes yes yes yes ivd[15:1] o internal visibility read data no no no yes yes yes addr0 o t f external address no no no yes yes yes ivd0 o internal visibility read data no no no yes yes yes uds o upper data select, indicates external access to the high byte data[15:8] no no yes no no no lstrb o f low strobe, indicates valid data on data[7:0] no no no yes yes yes lds o lower data select, indicates external access to the low byte data[7:0] no no yes no no no r w o f read/write, indicates the direction of internal data transfers no no no yes yes yes we o write enable, indicates external write access no no yes no no no cs[3:0] o chip select no no yes no yes no data[15:8] i/o bidirectional data (even address) no no yes yes yes yes data[7:0] i/o bidirectional data (odd address) no no yes yes yes yes ew ait i external control for external bus access stretches (adding wait states) no no yes no yes no chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 245 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.3 memory map and register de?ition this section provides a detailed description of all registers accessible in the xebi . 5.3.1 module memory map the registers associated with the xebi block are shown in figure 5-2 . 5.3.2 register descriptions the following sub-sections provide a detailed description of each register and the individual register bits. all control bits can be written anytime, but this may have no effect on the related function in certain operating modes. this allows specific configurations to be set up before changing into the target operating mode. note depending on the operating mode an available function may be enabled, disabled or depend on the control register bit. reading the register bits will re?ct the status of related function only if the current operating mode allows user control. please refer the individual bit descriptions. 5.3.2.1 external bus interface control register 0 (ebictl0) read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes, the data is read from this register. write: anytime. in emulation modes, write operations will also be directed to the external bus. register name bit 7 6 5 4 3 2 1 bit 0 0x0e ebictl0 r ithrs 0 hdbe asiz4 asiz3 asiz2 asiz1 asiz0 w 0x0f ebictl1 r0 exstr12 exstr11 exstr10 0 exstr02 exstr01 exstr00 w = unimplemented or reserved figure 5-2. xebi register summary module base +0x000e (prr) 76543210 r ithrs 0 hdbe asiz4 asiz3 asiz2 asiz1 asiz0 w reset 00111111 = unimplemented or reserved figure 5-3. external bus interface control register 0 (ebictl0) chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 246 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 this register controls input pin threshold level and determines the external address and data bus sizes in normal expanded mode. if not in use with the external bus interface, the related pins can be used for alternative functions. external bus is available as programmed in normal expanded mode and always full-sized in emulation modes and special test mode; function not available in single-chip modes. table 5-3. ebictl0 field descriptions field description 7 ithrs reduced input threshold ?this bit selects reduced input threshold on external data bus pins and speci? control input signals which are in use with the external bus interface in order to adapt to external devices with a 3.3 v, 5 v tolerant i/o. the reduced input threshold level takes effect depending on ithrs, the operating mode and the related enable signals of the ebi pin function as summarized in table 5-4 . 0 input threshold is at standard level on all pins 1 reduced input threshold level enabled on pins in use with the external bus interface 5 hdbe high data byte enable ?this bit enables the higher half of the 16-bit data bus. if disabled, only the lower 8- bit data bus can be used with the external bus interface. in this case the unused data pins and the data select signals ( uds and lds) are free to be used for alternative functions. 0 data[15:8], uds, and lds disabled 1 data[15:8], uds, and lds enabled 4? asiz[4:0] external address bus size these bits allow scalability of the external address bus. the programmed value corresponds to the number of available low-aligned address lines (refer to table 5-5 ). all address lines addr[22:0] start up as outputs after reset in expanded modes. this needs to be taken into consideration when using alternative functions on relevant pins in applications which utilize a reduced external address bus. table 5-4. input threshold levels on external signals ithrs external signal ns ss nx es ex st 0 data[15:8] t a ghi, t a glo standard standard standard reduced reduced standard data[7:0] ew ait standard standard 1 data[15:8] t a ghi, t a glo standard standard reduced if hdbe = 1 reduced reduced reduced data[7:0] reduced ew ait reduced if ewait enabled (1) 1. ewait function is enabled if at least one csx line is con?ured respectively in mmcctl0. refer to s12x_mmc section and table 5-6 . standard reduced if ewait enabled 1 standard table 5-5. external address bus size asiz[4:0] available external address lines 00000 none 00001 uds 00010 addr1, uds chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 247 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.3.2.2 external bus interface control register 1 (ebictl1) read: anytime. in emulation modes, read operations will return the data from the external bus, in all other modes the data is read from this register. write: anytime. in emulation modes, write operations will also be directed to the external bus. this register allows programming of two independent values determining the amount of additional stretch cycles for external accesses (wait states). with two bits in s12x_mmc register mmcctl0 for every individual csx line one of the two counter options or the ew ait input is selected as stretch source. the chip select outputs can also be disabled to free up the pins for alternative functions ( table 5-6 ). refer also to s12x_mmc section for register bit descriptions. if ew ait input usage is selected in mmcctl0 the minimum number of stretch cycles is 2 for accesses to the related address range. if con?ured respectively, stretch cycles are added as programmed or dependent on ew ait in normal expanded mode and emulation expanded mode; function not available in all other operating modes. 00011 addr[2:1], uds :: 10110 addr[21:1], uds 10111 : 11111 addr[22:1], uds module base +0x000f (prr) 76543210 r0 exstr12 exstr11 exstr10 0 exstr02 exstr01 exstr00 w reset 01110111 = unimplemented or reserved figure 5-4. external bus interface control register 1 (ebictl1) table 5-6. chip select function csxe1 csxe0 function 00 csx disabled 01 csx stretched with exstr0 10 csx stretched with exstr1 11 csx stretched with ew ait table 5-5. external address bus size asiz[4:0] available external address lines chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 248 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.4 functional description this section describes the functions of the external bus interface. the availability of external signals and functions in relation to the operating mode is initially summarized and described in more detail in separate sub-sections. 5.4.1 operating modes and external bus properties a summary of the external bus interface functions for each operating mode is shown in table 5-9 . table 5-7. ebictl1 field descriptions field description 6? exstr1[2:0] external access stretch option 1 bits 2, 1, 0 this three bit ?ld determines the amount of additional clock stretch cycles on every access to the external address space as shown in table 5-8 . 2? exstr0[2:0] external access stretch option 0 bits 2, 1, 0 this three bit ?ld determines the amount of additional clock stretch cycles on every access to the external address space as shown in table 5-8 . table 5-8. external access stretch bit de?ition exstrx[2:0] number of stretch cycles 000 1 001 2 010 3 011 4 100 5 101 6 110 7 111 8 table 5-9. summary of functions properties (if enabled) single-chip modes expanded modes normal single-chip special single-chip normal expanded emulation single-chip emulation expanded special test timing properties prr access (1) 2 cycles read internal write internal 2 cycles read internal write internal 2 cycles read internal write internal 2 cycles read external write int & ext 2 cycles read external write int & ext 2 cycles read internal write internal internal access visible externally 1 cycle 1 cycle 1 cycle external address access and unimplemented area access (2) max. of 2 to 9 programmed cycles or n cycles of ext. wait (3) 1 cycle max. of 2 to 9 programmed cycles or n cycles of ext. wait 3 1 cycle chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 249 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.4.2 internal visibility internal visibility allows the observation of the internal cpu address and data bus as well as the determination of the access source and the cpu pipe (queue) status through the external bus interface. internal visibility is always enabled in emulation single chip mode and emulation expanded mode. internal cpu accesses are made visible on the external bus interface except cpu execution of bdm firmware instructions. internal reads are made visible on addrx/ivdx (address and read data multiplexed, see table 5-12 to table 5-14 ), internal writes on addrx and datax (see table 5-15 to table 5-17 ). r w and lstrb show the type of access. external read data are also visible on ivdx. during ?o access?cycles r w is held in read position while lstrb is undetermined. all accesses which make use of the external bus interface are considered external accesses. flash area address access (4) 1 cycle 1 cycle 1 cycle signal properties bus signals addr[22:1] data[15:0] addr[22:20]/ acc[2:0] addr[19:16]/ iqstat[3:0] addr[15:0]/ ivd[15:0] data[15:0] addr[22:20]/ acc[2:0] addr[19:16]/ iqstat[3:0] addr[15:0]/ ivd[15:0] data[15:0] addr[22:0] data[15:0] data select signals (if 16-bit data bus) uds lds addr0 lstrb addr0 lstrb addr0 lstrb data direction signals re we r wr wr w chip selects cs0 cs1 cs2 cs3 cs0 cs1 cs2 cs3 external wait feature ew ait ew ait reduced input threshold enabled on refer to table 5-4 data[15:0] ew ait data[15:0] ew ait refer to table 5-4 1. incl. s12x_ebi registers 2. refer to s12x_mmc section. 3. if ewait enabled for at least one csx line (refer to s12x_mmc section), the minimum number of external bus cycles is 3. 4. available only if con?ured appropriately by romon and eromon (refer to s12x_mmc section). table 5-9. summary of functions (continued) properties (if enabled) single-chip modes expanded modes normal single-chip special single-chip normal expanded emulation single-chip emulation expanded special test chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 250 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.4.2.1 access source signals (acc) the access source can be determined from the external bus control signals acc[2:0] as shown in table 5- 10 . 5.4.2.2 instruction queue status signals (iqstat) the cpu instruction queue status (execution-start and data-movement information) is brought out as iqstat[3:0] signals. for decoding of the iqstat values, refer to the s12x_cpu section. 5.4.2.3 internal visibility data (ivd) depending on the access size and alignment, either a word of read data is made visible on the address lines or only the related data byte will be presented in the eclk low phase. for details refer to table 5-11 . invalid ivd are brought out in case of non-cpu read accesses. 5.4.2.4 emulation modes timing a bus access lasts 1 eclk cycle. in case of a stretched external access (emulation expanded mode), up to an infinite amount of eclk cycles may be added. addrx values will only be shown in eclk high phases, while accx, iqstatx, and ivdx values will only be presented in eclk low phases. based on this multiplex timing, accx are only shown in the current (first) access cycle. iqstatx and (for read accesses) ivdx follow in the next cycle. if the access takes more than one bus cycle, accx display null (0x000) in the second and all following cycles of the access. iqstatx display null (0x0000) from the third until one cycle after the access to indicate continuation. table 5-10. determining access source from control signals acc[2:0] access description 000 repetition of previous access cycle 001 cpu access 010 bdm external access 011 xgate prr access 100 no access (1) 1. denotes also cpu accesses to bdm ?mware and bdm registers (iqstatx are ?xxx?and r w = 1 in these cases) 101 cpu access error 110, 111 reserved table 5-11. ivd read data output access ivd[15:8] ivd[7:0] word read of data at an even and even+1 address ivd(even) ivd(even+1) word read of data at an odd and odd+1 internal ram address (misaligned) ivd(odd+1) ivd(odd) byte read of data at an even address ivd(even) addr[7:0] (rep.) byte read of data at an odd address addr[15:8] (rep.) ivd(odd) chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 251 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the resulting timing pattern of the external bus signals is outlined in the following tables for read, write and interleaved read/write accesses. three examples represent different access lengths of 1, 2, and n? bus cycles. non-shaded bold entries denote all values related to access #0. the following terminology is used: ?ddr??value(addrx); small letters denote the logic values at the respective pins ???unde?ed output pin values ???tristate pins ???dependent on previous access (read or write); ivdx: ?vd?or ?? datax: ?ata?or ? 5.4.2.4.1 read access timing table 5-12. read access (1 cycle) access #0 access #1 bus cycle -> ... 123 ... eclk phase ... high low high low high low ... addr[22:20] / acc[2:0] ... addr 0 acc 0 addr 1 acc 1 addr 2 acc 2 ... addr[19:16] / iqstat[3:0] ... iqstat -1 iqstat 0 iqstat 1 ... addr[15:0] / ivd[15:0] ... ? ivd 0 ivd 1 ... data[15:0] (internal read) ... ? zz z z z ... data[15:0] (external read) ... ? z data 0 z data 1 z ... r w ...111111... table 5-13. read access (2 cycles) access #0 access #1 bus cycle -> ... 123 ... eclk phase ... high low high low high low ... addr[22:20] / acc[2:0] ... addr 0 acc 0 addr 0 000 addr 1 acc 1 ... addr[19:16] / iqstat[3:0] ... iqstat-1 iqstat 0 0000 ... addr[15:0] / ivd[15:0] ... ? x ivd 0 ... data[15:0] (internal read) ... ? zzzz z ... data[15:0] (external read) ... ? z z z data 0 z ... r w ...111111... table 5-14. read access (n? cycles) access #0 access #1 bus cycle -> ... 123 ... n ... eclk phase ... high low high low high low ... high low ... addr[22:20] / acc[2:0] ... addr 0 acc 0 addr 0 000 addr 0 000 ... addr 1 acc 1 ... addr[19:16] / iqstat[3:0] ... iqstat-1 iqstat 0 0000 ... 0000 ... addr[15:0] / ivd[15:0] ... ? xx ... ivd 0 ... data[15:0] (internal read) ... ? zzzzz ... z z ... chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 252 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.4.2.4.2 write access timing 5.4.2.4.3 read-write-read access timing data[15:0] (external read) ... ? zzzzz ... data 0 z ... r w ...111111...11... table 5-15. write access (1 cycle) access #0 access #1 access #2 bus cycle -> ... 123 ... eclk phase ... high low high low high low ... addr[22:20] / acc[2:0] ... addr 0 acc 0 addr 1 acc 1 addr 2 acc 2 ... addr[19:16] / iqstat[3:0] ... iqstat -1 iqstat 0 iqstat 1 ... addr[15:0] / ivd[15:0] ... ? x x ... data[15:0] (write) ... ? data 0 data 1 data 2 ... r w ...001111... table 5-16. write access (2 cycles) access #0 access #1 bus cycle -> ... 123 ... eclk phase ... high low high low high low ... addr[22:20] / acc[2:0] ... addr 0 acc 0 addr 0 000 addr 1 acc 1 ... addr[19:16] / iqstat[3:0] ... iqstat-1 iqstat 0 0000 ... addr[15:0] / ivd[15:0] ... ? xx ... data[15:0] (write) ... ? data 0 x ... r w ...000011... table 5-17. write access (n? cycles) access #0 access #1 bus cycle -> ... 123 ... n ... eclk phase ... high low high low high low ... high low ... addr[22:20] / acc[2:0] ... addr 0 acc 0 addr 0 000 addr 0 000 ... addr 1 acc 1 ... addr[19:16] / iqstat[3:0] ... iqstat-1 iqstat 0 0000 ... 0000 ... addr[15:0] / ivd[15:0] ... ? x x ... x ... data[15:0] (write) ... ? data 0 x ... r w ...000000...11... table 5-18. interleaved read-write-read accesses (1 cycle) access #0 access #1 access #2 bus cycle -> ... 123 ... table 5-14. read access (n? cycles) chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 253 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.4.3 accesses to port replacement registers all read and write accesses to prr addresses take two bus clock cycles independent of the operating mode. if writing to these addresses in emulation modes, the access is directed to both, the internal register and the external resource while reads will be treated external. the xebi control registers also belong to this category. 5.4.4 stretched external bus accesses in order to allow fast internal bus cycles to coexist in a system with slower external resources, the xebi supports stretched external bus accesses (wait states) for each external address range related to one of the 4 chip select lines individually. this feature is available in normal expanded mode and emulation expanded mode for accesses to all external addresses except emulation memory and prr. in these cases the fixed access times are 1 or 2 cycles, respectively. stretched accesses are controlled by: 1. exstr1[2:0] and exstr0[2:0] bits in the ebictl1 register con?uring a ?ed amount of stretch cycles individually for each csx line in mmcctl0 2. activation of the external wait feature for each csx line mmcctl0 register 3. assertion of the external ew ait signal when at least one csx line is con?ured for ewait the exstrx[2:0] control bits can be programmed for generation of a fixed number of 1 to 8 stretch cycles. if the external wait feature is enabled, the minimum number of additional stretch cycles is 2. an arbitrary amount of stretch cycles can be added using the ewait input. ewait needs to be asserted at least for a minimal specified time window within an external access cycle for the internal logic to detect it and add a cycle (refer to electrical characteristics). holding it for additional cycles will cause the external bus access to be stretched accordingly. write accesses are stretched by holding the initiator in its current state for additional cycles as programmed and controlled by external wait after the data have been driven out on the external bus. this results in an extension of time the bus signals and the related control signals are valid externally. read data are not captured by the system in normal expanded mode until the specified setup time before the re rising edge. eclk phase ... high low high low high low ... addr[22:20] / acc[2:0] ... addr 0 acc 0 addr 1 acc 1 addr 2 acc 2 ... addr[19:16] / iqstat[3:0] ... iqstat -1 iqstat 0 iqstat 1 ... addr[15:0] / ivd[15:0] ... ? ivd 0 x ... data[15:0] (internal read) ... ? zz (write) data 1 z ... data[15:0] (external read) ... ? z data 0 (write) data 1 z ... r w ...110011... table 5-18. interleaved read-write-read accesses (1 cycle) (continued) chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 254 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read data are not captured in emulation expanded mode until the specified setup time before the falling edge of eclk. in emulation expanded mode, accesses to the internal flash or the emulation memory (determined by eromon and romon bits; see s12x_mmc section for details) always take 1 cycle and stretching is not supported. in case the internal flash is taken out of the map in user applications, accesses are stretched as programmed and controlled by external wait. 5.4.5 data select and data direction signals the s12x_ebi supports byte and word accesses at any valid external address. the big endian system of the mcu is extended to the external bus; however, word accesses are restricted to even aligned addresses. the only exception is the visibility of misaligned word accesses to addresses in the internal ram as this module exclusively supports these kind of accesses in a single cycle. with the above restriction, a fixed relationship is implied between the address parity and the dedicated bus halves where the data are accessed: data[15:8] is related to even addresses and data[7:0] is related to odd addresses. in expanded modes the data access type is externally determined by a set of control signals, i.e., data select and data direction signals, as described below. the data select signals are not available if using the external bus interface with an 8-bit data bus. 5.4.5.1 normal expanded mode in normal expanded mode, the external signals re, we, uds, lds indicate the access type (read/write), data size and alignment of an external bus access ( table 5-19 ). 5.4.5.2 emulation modes and special test mode in emulation modes and special test mode, the external signals lstrb, r w, and addr0 indicate the access type (read/write), data size and alignment of an external bus access. misaligned accesses to the table 5-19. access in normal expanded mode access re we uds lds data[15:8] data[7:0] i/o data(addr) i/o data(addr) word write of data on data[15:0] at an even and even+1 address 1 0 0 0 out data(even) out data(odd) byte write of data on data[7:0] at an odd address 1 0 1 0 in x out data(odd) byte write of data on data[15:8] at an even address 1 0 0 1 out data(even) in x word read of data on data[15:0] at an even and even+1 address 0 1 0 0 in data(even) in data(odd) byte read of data on data[7:0] at an odd address 0 1 1 0 in x in data(odd) byte read of data on data[15:8] at an even address 0 1 0 1 in data(even) in x indicates no access 1 1 1 1 in x in x unimplemented 1 1 1 0 in x in x 11 0 1 in x in x chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 255 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 internal ram and misaligned xgate prr accesses in emulation modes are the only type of access that are able to produce lstrb = addr0 = 1. this is summarized in table 5-20 . table 5-20. access in emulation modes and special test mode access r w lstrb addr0 data[15:8] data[7:0] i/o data(addr) i/o data(addr) word write of data on data[15:0] at an even and even+1 address 0 0 0 out data(even) out data(odd) byte write of data on data[7:0] at an odd address 0 0 1 in x out data(odd) byte write of data on data[15:8] at an even address 0 1 0 out data(odd) in x word write at an odd and odd+1 internal ram address (misaligned ?only in emulation modes) 0 1 1 out data(odd+1) out data(odd) word read of data on data[15:0] at an even and even+1 address 1 0 0 in data(even) in data(even+1) byte read of data on data[7:0] at an odd address 1 0 1 in x in data(odd) byte read of data on data[15:8] at an even address 1 1 0 in data(even) in x word read at an odd and odd+1 internal ram address (misaligned - only in emulation modes) 1 1 1 in data(odd+1) in data(odd) chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 256 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.4.6 low-power options the xebi does not support any user-controlled options for reducing power consumption. 5.4.6.1 run mode the xebi does not support any options for reducing power in run mode. power consumption is reduced in single-chip modes due to the absence of the external bus interface. operation in expanded modes results in a higher power consumption, however any unnecessary toggling of external bus signals is reduced to the lowest indispensable activity by holding the previous states between external accesses. 5.4.6.2 wait mode the xebi does not support any options for reducing power in wait mode. 5.4.6.3 stop mode the xebi will cease to function in stop mode. 5.5 initialization/application information this section describes the external bus interface usage and timing. typical customer operating modes are normal expanded mode and emulation modes, specifically to be used in emulator applications. taking the availability of the external wait feature into account the use cases are divided into four scenarios: normal expanded mode external wait feature disabled external wait feature enabled emulation modes emulation single-chip mode (without wait states) emulation expanded mode (with optional access stretching) normal single-chip mode and special single-chip mode do not have an external bus. special test mode is used for factory test only. therefore, these modes are omitted here. all timing diagrams referred to throughout this section are available in the electrical characteristics appendix of the soc section. 5.5.1 normal expanded mode this mode allows interfacing to external memories or peripherals which are available in the commercial market. in these applications the normal bus operation requires a minimum of 1 cycle stretch for each external access. chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 257 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5.5.1.1 example 1a: external wait feature disabled the first example of bus timing of an external read and write access with the external wait feature disabled is shown in figure ?xample 1a: normal expanded mode ?read followed by write the associated supply voltage dependent timing are numbers given in table ?xample 1a: normal expanded mode timing v dd5 = 5.0 v (ewait disabled) table ?xample 1a: normal expanded mode timing v dd5 = 3.0 v (ewait disabled) systems designed this way rely on the internal programmable access stretching. these systems have predictable external memory access times. the additional stretch time can be programmed up to 8 cycles to provide longer access times. 5.5.1.2 example 1b: external wait feature enabled the external wait operation is shown in this example. it can be used to exceed the amount of stretch cycles over the programmed number in exstr[2:0]. the feature must be enabled by configuring at least one csx line for ewait. if the ewait signal is not asserted, the number of stretch cycles is forced to a minimum of 2 cycles. if ewait is asserted within the predefined time window during the access it will be strobed active and another stretch cycle is added. if strobed inactive, the next cycle will be the last cycle before the access is finished. ewait can be held asserted as long as desired to stretch the access. an access with 1 cycle stretch by ewait assertion is shown in figure ?xample 1b: normal expanded mode ?stretched read access figure ?xample 1b: normal expanded mode ?stretched write access the associated timing numbers for both operations are given in table ?xample 1b: normal expanded mode timing v dd5 = 5.0 v (ewait enabled) table ?xample 1b: normal expanded mode timing v dd5 = 3.0 v (ewait enabled) it is recommended to use the free-running clock (eclk) at the fastest rate (bus clock rate) to synchronize the ewait input signal. 5.5.2 emulation modes in emulation mode applications, the development systems use a custom pru device to rebuild the single- chip or expanded bus functions which are lost due to the use of the external bus with an emulator. accesses to a set of registers controlling the related ports in normal modes (refer to soc section) are directed to the external bus in emulation modes which are substituted by prr as part of the pru. accesses to these registers take a constant time of 2 cycles. depending on the setting of romon and eromon (refer to s12x_mmc section), the program code can be executed from internal memory or an optional external emulation memory (emulmem). no wait chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 258 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 state operation (stretching) of the external bus access is done in emulation modes when accessing internal memory or emulation memory addresses. in both modes observation of the internal operation is supported through the external bus (internal visibility). 5.5.2.1 example 2a: emulation single-chip mode this mode is used for emulation systems in which the target application is operating in normal single-chip mode. figure 5-5 shows the pru connection with the available external bus signals in an emulator application. figure 5-5. application in emulation single-chip mode the timing diagram for this operation is shown in: figure ?xample 2a: emulation single-chip mode ?read followed by write the associated timing numbers are given in: table ?xample 2a: emulation single-chip mode timing (ewait disabled) timing considerations: signals muxed with address lines addrx, i.e., ivdx, iqstatx and accx, have the same timing. lstrb has the same timing as r w. s12x_ebi addr[22:0]/ivd[15:0] data[15:0] eclk eclkx2 lstrb r w addr[22:20]/acc[2:0] addr[19:16]/ prr ports pru iqstat[3:0] emulmem emulator chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 259 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 eclkx2 rising edges have the same timing as eclk edges. the timing for accesses to pru registers, which take 2 cycles to complete, is the same as the timing for an external non-prr access with 1 cycle of stretch as shown in example 2b. 5.5.2.2 example 2b: emulation expanded mode this mode is used for emulation systems in which the target application is operating in normal expanded mode. if the external bus is used with a pru, the external device rebuilds the data select and data direction signals uds, lds, re, and we from the addr0, lstrb, and r w signals. figure 5-6 shows the pru connection with the available external bus signals in an emulator application. figure 5-6. application in emulation expanded mode the timings of accesses with 1 stretch cycle are shown in figure ?xample 2b: emulation expanded mode ?read with 1 stretch cycle figure ?xample 2b: emulation expanded mode ?write with 1 stretch cycle the associated timing numbers are given in s12x_ebi addr[22:0]/ivd[15:0] data[15:0] eclk eclkx2 lstrb r w uds lds re we addr[22:20]/acc[2:0] addr[19:16]/ cs[3:0] prr ports pru iqstat[3:0] emulmem emulator ewait chapter 5 external bus interface (s12xebiv4) mc9s12xe-family reference manual , rev. 1.21 260 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table ?xample 2b: emulation expanded mode timing v dd5 = 5.0 v (ewait disabled)?(this also includes examples for alternative settings of 2 and 3 additional stretch cycles) timing considerations: if no stretch cycle is added, the timing is the same as in emulation single-chip mode. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 261 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 6 interrupt (s12xintv2) 6.1 introduction the xint module decodes the priority of all system exception requests and provides the applicable vector for processing the exception to either the cpu or the xgate module. the xint module supports: i bit and x bit maskable interrupt requests one non-maskable unimplemented op-code trap one non-maskable software interrupt (swi) or background debug mode request one non-maskable system call interrupt (sys) three non-maskable access violation interrupt one spurious interrupt vector request three system reset vector requests each of the i bit maskable interrupt requests can be assigned to one of seven priority levels supporting a ?xible priority scheme. for interrupt requests that are con?ured to be handled by the cpu, the priority scheme can be used to implement nested interrupt capability where interrupts from a lower level are automatically blocked if a higher level interrupt is being processed. interrupt requests con?ured to be handled by the xgate module can be nested one level deep. note the hprio register and functionality of the original s12 interrupt module is no longer supported, since it is superseded by the 7-level interrupt request priority scheme. table 6-1. revision history revision number revision date sections affected description of changes v02.00 01 jul 2005 6.1.2/6-262 initial v2 release, added new features: - xgate threads can be interrupted. - sys instruction vector. - access violation interrupt vectors. v02.04 11 jan 2007 6.3.2.2/6-267 6.3.2.4/6-268 - added notes for devices without xgate module. v02.05 20 mar 2007 6.4.6/6-274 - fixed priority de?ition for software exceptions. v02.06 07 jan 2008 6.1.2/6-262 - added clari?ation of ?ake-up from stop or wait by xirq with x bit set feature. chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 262 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.1.1 glossary the following terms and abbreviations are used in the document. 6.1.2 features interrupt vector base register (ivbr) one spurious interrupt vector (at address vector base 1 + 0x0010). one non-maskable system call interrupt vector request (at address vector base + 0x0012). three non-maskable access violation interrupt vector requests (at address vector base + 0x0014 ? 0x0018). 2?09 i bit maskable interrupt vector requests (at addresses vector base + 0x001a?x00f2). each i bit maskable interrupt request has a con?urable priority level and can be con?ured to be handled by either the cpu or the xgate module 2 . i bit maskable interrupts can be nested, depending on their priority levels. one x bit maskable interrupt vector request (at address vector base + 0x00f4). one non-maskable software interrupt request (swi) or background debug mode vector request (at address vector base + 0x00f6). one non-maskable unimplemented op-code trap (trap) vector (at address vector base + 0x00f8). three system reset vectors (at addresses 0xfffa?xfffe). determines the highest priority xgate and interrupt vector requests, drives the vector to the xgate module or to the bus on cpu request, respectively. wakes up the system from stop or wait mode when an appropriate interrupt request occurs or whenever xirq is asserted, even if x interrupt is masked. xgate can wake up and execute code, even with the cpu remaining in stop or wait mode. table 6-2. terminology term meaning ccr condition code register (in the s12x cpu) dma direct memory access int interrupt ipl interrupt processing level isr interrupt service routine mcu micro-controller unit xgate refers to the xgate co-processor; xgate is an optional feature irq refers to the interrupt request associated with the irq pin xirq refers to the interrupt request associated with the xirq pin 1. the vector base is a 16-bit address which is accumulated from the contents of the interrupt vector base register (ivbr, used as upper byte) and 0x00 (used as lower byte). 2. the irq interrupt can only be handled by the cpu chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 263 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.1.3 modes of operation run mode this is the basic mode of operation. wait mode in wait mode, the xint module is frozen. it is however capable of either waking up the cpu if an interrupt occurs or waking up the xgate if an xgate request occurs. please refer to section 6.5.3, ?ake up from stop or wait mode for details. stop mode in stop mode, the xint module is frozen. it is however capable of either waking up the cpu if an interrupt occurs or waking up the xgate if an xgate request occurs. please refer to section 6.5.3, ?ake up from stop or wait mode for details. freeze mode (bdm active) in freeze mode (bdm active), the interrupt vector base register is overridden internally. please refer to section 6.3.2.1, ?nterrupt vector base register (ivbr) for details. chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 264 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.1.4 block diagram figure 6-1 shows a block diagram of the xint module. figure 6-1. xint block diagram 6.2 external signal description the xint module has no external signals. wake up current rqst ivbr one set per channel xgate interrupts xgate requests interrupt requests interrupt requests cpu vector address new ipl ipl (up to 108 channels) rqst xgate request route, priolvln priority level = bits from the channel con?uration in the associated con?uration register int_xgprio = xgate interrupt priority ivbr = interrupt vector base ipl = interrupt processing level priolvl0 priolvl1 priolvl2 int_xgprio peripheral vector id to xgate module priority decoder to cpu priority decoder non i bit maskable channels wake up xgate irq channel chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 265 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.3 memory map and register de?ition this section provides a detailed description of all registers accessible in the xint module. 6.3.1 module memory map table 6-3 gives an overview over all xint module registers. table 6-3. xint memory map address use access 0x0120 reserved 0x0121 interrupt vector base register (ivbr) r/w 0x0122?x0125 reserved 0x0126 xgate interrupt priority con?uration register (int_xgprio) r/w 0x0127 interrupt request con?uration address register (int_cfaddr) r/w 0x0128 interrupt request con?uration data register 0 (int_cfdata0) r/w 0x0129 interrupt request con?uration data register 1 (int_cfdata1) r/w 0x012a interrupt request con?uration data register 2 (int_cfdata2 r/w 0x012b interrupt request con?uration data register 3 (int_cfdata3) r/w 0x012c interrupt request con?uration data register 4 (int_cfdata4) r/w 0x012d interrupt request con?uration data register 5 (int_cfdata5) r/w 0x012e interrupt request con?uration data register 6 (int_cfdata6) r/w 0x012f interrupt request con?uration data register 7 (int_cfdata7) r/w chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 266 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.3.2 register descriptions this section describes in address order all the xint module registers and their individual bits. address register name bit 7 654321 bit 0 0x0121 ivbr r ivb_addr[7:0]7 w 0x0126 int_xgprio r 00000 xilvl[2:0] w 0x0127 int_cfaddr r int_cfaddr[7:4] 0000 w 0x0128 int_cfdata0 r rqst 0000 priolvl[2:0] w 0x0129 int_cfdata1 r rqst 0000 priolvl[2:0] w 0x012a int_cfdata2 r rqst 0000 priolvl[2:0] w 0x012b int_cfdata3 r rqst 0000 priolvl[2:0] w 0x012c int_cfdata4 r rqst 0000 priolvl[2:0] w 0x012d int_cfdata5 r rqst 0000 priolvl[2:0] w 0x012e int_cfdata6 r rqst 0000 priolvl[2:0] w 0x012f int_cfdata7 r rqst 0000 priolvl[2:0] w = unimplemented or reserved figure 6-2. xint register summary chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 267 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.3.2.1 interrupt vector base register (ivbr) read: anytime write: anytime 6.3.2.2 xgate interrupt priority con?uration register (int_xgprio) read: anytime write: anytime address: 0x0121 76543210 r ivb_addr[7:0] w reset 1 1 1 11111 figure 6-3. interrupt vector base register (ivbr) table 6-4. ivbr field descriptions field description 7? ivb_addr[7:0] interrupt vector base address bits these bits represent the upper byte of all vector addresses. out of reset these bits are set to 0xff (i.e., vectors are located at 0xff10?xfffe) to ensure compatibility to previous s12 microcontrollers. note: a system reset will initialize the interrupt vector base register with ?xff before it is used to determine the reset vector address. therefore, changing the ivbr has no effect on the location of the three reset vectors (0xfffa?xfffe). note: if the bdm is active (i.e., the cpu is in the process of executing bdm ?mware code), the contents of ivbr are ignored and the upper byte of the vector address is ?ed as ?xff? address: 0x0126 76543210 r00000 xilvl[2:0] w reset 0 0 0 00001 = unimplemented or reserved figure 6-4. xgate interrupt priority con?uration register (int_xgprio) table 6-5. int_xgprio field descriptions field description 2? xilvl[2:0] xgate interrupt priority level ?the xilvl[2:0] bits configure the shared interrupt level of the xgate interrupts coming from the xgate module. out of reset the priority is set to the lowest active level (??. note: if the xgate module is not available on the device, write accesses to this register are ignored and read accesses to this register will return all 0. chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 268 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.3.2.3 interrupt request con?uration address register (int_cfaddr) read: anytime write: anytime 6.3.2.4 interrupt request con?uration data registers (int_cfdata0?) the eight register window visible at addresses int_cfdata0? contains the con?uration data for the block of eight interrupt requests (out of 128) selected by the interrupt con?uration address register (int_cfaddr) in ascending order. int_cfdata0 represents the interrupt con?uration data register of the vector with the lowest address in this block, while int_cfdata7 represents the interrupt con?uration data register of the vector with the highest address, respectively. table 6-6. xgate interrupt priority levels priority xilvl2 xilvl1 xilvl0 meaning 0 0 0 interrupt request is disabled low 0 0 1 priority level 1 0 1 0 priority level 2 0 1 1 priority level 3 1 0 0 priority level 4 1 0 1 priority level 5 1 1 0 priority level 6 high 1 1 1 priority level 7 address: 0x0127 76543210 r int_cfaddr[7:4] 0000 w reset 0 0 0 10000 = unimplemented or reserved figure 6-5. interrupt con?uration address register (int_cfaddr) table 6-7. int_cfaddr field descriptions field description 7? int_cfaddr[7:4] interrupt request con?uration data register select bits ?these bits determine which of the 128 con?uration data registers are accessible in the 8 register window at int_cfdata0?. the hexadecimal value written to this register corresponds to the upper nibble of the lower byte of the address of the interrupt vector, i.e., writing 0xe0 to this register selects the con?uration data register block for the 8 interrupt vector requests starting with vector at address (vector base + 0x00e0) to be accessible as int_cfdata0?. note: writing all 0s selects non-existing con?uration registers. in this case write accesses to int_cfdata0? will be ignored and read accesses will return all 0. chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 269 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 address: 0x0128 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-6. interrupt request con?uration data register 0 (int_cfdata0) address: 0x0129 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-7. interrupt request con?uration data register 1 (int_cfdata1) address: 0x012a 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-8. interrupt request con?uration data register 2 (int_cfdata2) address: 0x012b 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-9. interrupt request con?uration data register 3 (int_cfdata3) chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 270 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime address: 0x012c 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-10. interrupt request con?uration data register 4 (int_cfdata4) address: 0x012d 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-11. interrupt request con?uration data register 5 (int_cfdata5) address: 0x012e 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-12. interrupt request con?uration data register 6 (int_cfdata6) address: 0x012f 76543210 r rqst 0000 priolvl[2:0] w reset 0 0 0 00001 (1) 1. please refer to the notes following the priolvl[2:0] description below. = unimplemented or reserved figure 6-13. interrupt request con?uration data register 7 (int_cfdata7) chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 271 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.4 functional description the xint module processes all exception requests to be serviced by the cpu module. these exceptions include interrupt vector requests and reset vector requests. each of these exception types and their overall priority level is discussed in the subsections below. table 6-8. int_cfdata0? field descriptions field description 7 rqst xgate request enable this bit determines if the associated interrupt request is handled by the cpu or by the xgate module. 0 interrupt request is handled by the cpu 1 interrupt request is handled by the xgate module note: the irq interrupt cannot be handled by the xgate module. for this reason, the con?uration register for vector (vector base + 0x00f2) = irq vector address) does not contain a rqst bit. writing a 1 to the location of the rqst bit in this register will be ignored and a read access will return 0. note: if the xgate module is not available on the device, writing a 1 to the location of the rqst bit in this register will be ignored and a read access will return 0. 2? priolvl[2:0] interrupt request priority level bits the priolvl[2:0] bits con?ure the interrupt request priority level of the associated interrupt request. out of reset all interrupt requests are enabled at the lowest active level (?? to provide backwards compatibility with previous s12 interrupt controllers. please also refer to table 6-9 for available interrupt request priority levels. note: write accesses to con?uration data registers of unused interrupt channels will be ignored and read accesses will return all 0. for information about what interrupt channels are used in a speci? mcu, please refer to the device reference manual of that mcu. note: when vectors (vector base + 0x00f0?x00fe) are selected by writing 0xf0 to int_cfaddr, writes to int_cfdata2? (0x00f4?x00fe) will be ignored and read accesses will return all 0s. the corresponding vectors do not have con?uration data registers associated with them. note: when vectors (vector base + 0x0010?x001e) are selected by writing 0x10 to int_cfaddr, writes to int_cfdata1?nt_cfdata4 (0x0012?x0018) will be ignored and read accesses will return all 0s. the corresponding vectors do not have con?uration data registers associated with them. note: write accesses to the con?uration register for the spurious interrupt vector request (vector base + 0x0010) will be ignored and read accesses will return 0x07 (request is handled by the cpu, priolvl = 7). table 6-9. interrupt priority levels priority priolvl2 priolvl1 priolvl0 meaning 0 0 0 interrupt request is disabled low 0 0 1 priority level 1 0 1 0 priority level 2 0 1 1 priority level 3 1 0 0 priority level 4 1 0 1 priority level 5 1 1 0 priority level 6 high 1 1 1 priority level 7 chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 272 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.4.1 s12x exception requests the cpu handles both reset requests and interrupt requests. the xint module contains registers to con?ure the priority level of each i bit maskable interrupt request which can be used to implement an interrupt priority scheme. this also includes the possibility to nest interrupt requests. a priority decoder is used to evaluate the priority of a pending interrupt request. 6.4.2 interrupt prioritization after system reset all interrupt requests with a vector address lower than or equal to (vector base + 0x00f2) are enabled, are set up to be handled by the cpu and have a pre-con?ured priority level of 1. exceptions to this rule are the non-maskable interrupt requests and the spurious interrupt vector request at (vector base + 0x0010) which cannot be disabled, are always handled by the cpu and have a ?ed priority levels. a priority level of 0 effectively disables the associated i bit maskable interrupt request. if more than one interrupt request is con?ured to the same interrupt priority level the interrupt request with the higher vector address wins the prioritization. the following conditions must be met for an i bit maskable interrupt request to be processed. 1. the local interrupt enabled bit in the peripheral module must be set. 2. the setup in the con?uration register associated with the interrupt request channel must meet the following conditions: a) the xgate request enable bit must be 0 to have the cpu handle the interrupt request. b) the priority level must be set to non zero. c) the priority level must be greater than the current interrupt processing level in the condition code register (ccr) of the cpu (priolvl[2:0] > ipl[2:0]). 3. the i bit in the condition code register (ccr) of the cpu must be cleared. 4. there is no access violation interrupt request pending. 5. there is no sys, swi, bdm, trap, or xirq request pending. note all non i bit maskable interrupt requests always have higher priority than i bit maskable interrupt requests. if an i bit maskable interrupt request is interrupted by a non i bit maskable interrupt request, the currently active interrupt processing level (ipl) remains unaffected. it is possible to nest non i bit maskable interrupt requests, e.g., by nesting swi or trap calls. 6.4.2.1 interrupt priority stack the current interrupt processing level (ipl) is stored in the condition code register (ccr) of the cpu. this way the current ipl is automatically pushed to the stack by the standard interrupt stacking procedure. the new ipl is copied to the ccr from the priority level of the highest priority active interrupt request channel which is con?ured to be handled by the cpu. the copying takes place when the interrupt vector is fetched. the previous ipl is automatically restored by executing the rti instruction. chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 273 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.4.3 xgate requests if the xgate module is implemented on the device, the xint module is also used to process all exception requests to be serviced by the xgate module. the overall priority level of those exceptions is discussed in the subsections below. 6.4.3.1 xgate request prioritization an interrupt request channel is con?ured to be handled by the xgate module, if the rqst bit of the associated con?uration register is set to 1 (please refer to section 6.3.2.4, ?nterrupt request con?uration data registers (int_cfdata0?) ). the priority level con?uration (priolvl) for this channel becomes the xgate priority which will be used to determine the highest priority xgate request to be serviced next by the xgate module. additionally, xgate interrupts may be raised by the xgate module by setting one or more of the xgate channel interrupt ?gs (by using the sif instruction). this will result in an cpu interrupt with vector address vector base + (2 * channel id number), where the channel id number corresponds to the highest set channel interrupt ?g, if the xgie and channel rqst bits are set. the shared interrupt priority for the xgate interrupt requests is taken from the xgate interrupt priority con?uration register (please refer to section 6.3.2.2, ?gate interrupt priority con?uration register (int_xgprio) ). if more than one xgate interrupt request channel becomes active at the same time, the channel with the highest vector address wins the prioritization. 6.4.4 priority decoders the xint module contains priority decoders to determine the priority for all interrupt requests pending for the respective target. there are two priority decoders, one for each interrupt request target, cpu or xgate. the function of both priority decoders is basically the same with one exception: the priority decoder for the xgate module does not take the current xgate thread processing level into account. instead, xgate requests are handed to the xgate module including a 1-bit priority identi?r. the xgate module uses this additional information to decide if the new request can interrupt a currently running thread. the 1-bit priority identi?r corresponds to the most signi?ant bit of the priority level con?uration of the requesting channel. this means that xgate requests with priority levels 4, 5, 6 or 7 can interrupt running xgate threads with priority levels 1, 2 and 3. a cpu interrupt vector is not supplied until the cpu requests it. therefore, it is possible that a higher priority interrupt request could override the original exception which caused the cpu to request the vector. in this case, the cpu will receive the highest priority vector and the system will process this exception instead of the original request. if the interrupt source is unknown (for example, in the case where an interrupt request becomes inactive after the interrupt has been recognized, but prior to the vector request), the vector address supplied to the cpu will default to that of the spurious interrupt vector. chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 274 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note care must be taken to ensure that all exception requests remain active until the system begins execution of the applicable service routine; otherwise, the exception request may not get processed at all or the result may be a spurious interrupt request (vector at address (vector base + 0x0010)). 6.4.5 reset exception requests the xint module supports three system reset exception request types (for details please refer to the clock and reset generator module (crg)): 1. pin reset, power-on reset, low-voltage reset, or illegal address reset 2. clock monitor reset request 3. cop watchdog reset request 6.4.6 exception priority the priority (from highest to lowest) and address of all exception vectors issued by the xint module upon request by the cpu is shown in table 6-10 . generally, all non-maskable interrupts have higher priorities than maskable interrupts. please note that between the three software interrupts (unimplemented op-code trap request, swi/bgnd request, sys request) there is no real priority de?ed because they cannot occur simultaneously (the s12xcpu executes one instruction at a time). table 6-10. exception vector map and priority vector address (1) 1. 16 bits vector address based source 0xfffe pin reset, power-on reset, low-voltage reset, illegal address reset 0xfffc clock monitor reset 0xfffa cop watchdog reset (vector base + 0x00f8) unimplemented op-code trap (vector base + 0x00f6) software interrupt instruction (swi) or bdm vector request (vector base + 0x0012) system call interrupt instruction (sys) (vector base + 0x0018) (reserved for future use) (vector base + 0x0016) xgate access violation interrupt request (2) 2. only implemented if device features both a memory protection unit (mpu) and an xgate co-processor (vector base + 0x0014) cpu access violation interrupt request (3) 3. only implemented if device features a memory protection unit (mpu) (vector base + 0x00f4) xirq interrupt request (vector base + 0x00f2) irq interrupt request (vector base + 0x00f0?x001a) device speci? i bit maskable interrupt sources (priority determined by the associated con?uration registers, in descending order) (vector base + 0x0010) spurious interrupt chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 275 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6.5 initialization/application information 6.5.1 initialization after system reset, software should: initialize the interrupt vector base register if the interrupt vector table is not located at the default location (0xff10?xfff9). initialize the interrupt processing level con?uration data registers (int_cfaddr, int_cfdata0?) for all interrupt vector requests with the desired priority levels and the request target (cpu or xgate module). it might be a good idea to disable unused interrupt requests. if the xgate module is used, setup the xgate interrupt priority register (int_xgprio) and con?ure the xgate module (please refer the xgate block guide for details). enable i maskable interrupts by clearing the i bit in the ccr. enable the x maskable interrupt by clearing the x bit in the ccr (if required). 6.5.2 interrupt nesting the interrupt request priority level scheme makes it possible to implement priority based interrupt request nesting for the i bit maskable interrupt requests handled by the cpu. i bit maskable interrupt requests can be interrupted by an interrupt request with a higher priority, so that there can be up to seven nested i bit maskable interrupt requests at a time (refer to figure 6- 14 for an example using up to three nested interrupt requests). i bit maskable interrupt requests cannot be interrupted by other i bit maskable interrupt requests per default. in order to make an interrupt service routine (isr) interruptible, the isr must explicitly clear the i bit in the ccr (cli). after clearing the i bit, i bit maskable interrupt requests with higher priority can interrupt the current isr. an isr of an interruptible i bit maskable interrupt request could basically look like this: service interrupt, e.g., clear interrupt ?gs, copy data, etc. clear i bit in the ccr by executing the instruction cli (thus allowing interrupt requests with higher priority) process data return from interrupt by executing the instruction rti chapter 6 interrupt (s12xintv2) mc9s12xe-family reference manual , rev. 1.21 276 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 6-14. interrupt processing example 6.5.3 wake up from stop or wait mode 6.5.3.1 cpu wake up from stop or wait mode every i bit maskable interrupt request which is con?ured to be handled by the cpu is capable of waking the mcu from stop or wait mode. to determine whether an i bit maskable interrupts is quali?d to wake up the cpu or not, the same settings as in normal run mode are applied during stop or wait mode: if the i bit in the ccr is set, all i bit maskable interrupts are masked from waking up the mcu. an i bit maskable interrupt is ignored if it is con?ured to a priority level below or equal to the current ipl in ccr. i bit maskable interrupt requests which are con?ured to be handled by the xgate module are not capable of waking up the cpu. the x bit maskable interrupt request can wake up the mcu from stop or wait mode at anytime, even if the x bit in ccr is set. if the x bit maskable interrupt request is used to wake-up the mcu with the x bit in the ccr set, the associated isr is not called. the cpu then resumes program execution with the instruction following the wai or stop instruction. this features works following the same rules like any interrupt request, i.e. care must be taken that the x interrupt request used for wake-up remains active at least until the system begins execution of the instruction following the wai or stop instruction; otherwise, wake-up may not occur. 6.5.3.2 xgate wake up from stop or wait mode interrupt request channels which are con?ured to be handled by the xgate module are capable of waking up the xgate module. interrupt request channels handled by the xgate module do not affect the state of the cpu. 0 reset 4 0 7 6 5 4 3 2 1 0 l4 7 0 4 l1 (pending) l7 l3 (pending) rti 4 0 3 0 rti rti 1 0 0 rti stacked ipl processing levels ipl in ccr mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 277 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 7 background debug module (s12xbdmv2) 7.1 introduction this section describes the functionality of the background debug module (bdm) sub-block of the hcs12x core platform. the background debug module (bdm) sub-block is a single-wire, background debug system implemented in on-chip hardware for minimal cpu intervention. all interfacing with the bdm is done via the bkgd pin. the bdm has enhanced capability for maintaining synchronization between the target and host while allowing more ?xibility in clock rates. this includes a sync signal to determine the communication rate and a handshake signal to indicate when an operation is complete. the system is backwards compatible to the bdm of the s12 family with the following exceptions: taggo command no longer supported by bdm external instruction tagging feature now part of dbg module bdm register map and register content extended/modi?d global page access functionality enabled but not active out of reset in emulation modes (if modes available) clksw bit set out of reset in emulation modes (if modes available). family id readable from ?mware rom at global address 0x7fff0f (value for hcs12x devices is 0xc1) 7.1.1 features the bdm includes these distinctive features: single-wire communication with host development system enhanced capability for allowing more ?xibility in clock rates sync command to determine communication rate go_until command hardware handshake protocol to increase the performance of the serial communication table 7-1. revision history revision number revision date sections affected description of changes v02.00 07 mar 2006 - first version of s12xbdmv2 v02.01 14 may 2008 - introduced standardized revision history table chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 278 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 active out of reset in special single chip mode nine hardware commands using free cycles, if available, for minimal cpu intervention hardware commands not requiring active bdm 14 ?mware commands execute from the standard bdm ?mware lookup table software control of bdm operation during wait mode software selectable clocks global page access functionality enabled but not active out of reset in emulation modes (if modes available) clksw bit set out of reset in emulation modes (if modes available). when secured, hardware commands are allowed to access the register space in special single chip mode, if the non-volatile memory erase test fail. family id readable from ?mware rom at global address 0x7fff0f (value for hcs12x devices is 0xc1) bdm hardware commands are operational until system stop mode is entered (all bus masters are in stop mode) 7.1.2 modes of operation bdm is available in all operating modes but must be enabled before ?mware commands are executed. some systems may have a control bit that allows suspending thefunction during background debug mode. 7.1.2.1 regular run modes all of these operations refer to the part in run mode and not being secured. the bdm does not provide controls to conserve power during run mode. normal modes general operation of the bdm is available and operates the same in all normal modes. special single chip mode in special single chip mode, background operation is enabled and active out of reset. this allows programming a system with blank memory. emulation modes (if modes available) in emulation mode, background operation is enabled but not active out of reset. this allows debugging and programming a system in this mode more easily. 7.1.2.2 secure mode operation if the device is in secure mode, the operation of the bdm is reduced to a small subset of its regular run mode operation. secure operation prevents bdm and cpu accesses to non-volatile memory (flash and/or eeprom) other than allowing erasure. for more information please see section 7.4.1, ?ecurity . chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 279 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.1.2.3 low-power modes the bdm can be used until all bus masters (e.g., cpu or xgate or others depending on which masters are available on the soc) are in stop mode. when cpu is in a low power mode (wait or stop mode) all bdm ?mware commands as well as the hardware background command can not be used respectively are ignored. in this case the cpu can not enter bdm active mode, and only hardware read and write commands are available. also the cpu can not enter a low power mode during bdm active mode. if all bus masters are in stop mode, the bdm clocks are stopped as well. when bdm clocks are disabled and one of the bus masters exits from stop mode the bdm clocks will restart and bdm will have a soft reset (clearing the instruction register, any command in progress and disable the ack function). the bdm is now ready to receive a new command. 7.1.3 block diagram a block diagram of the bdm is shown in figure 7-1 . figure 7-1. bdm block diagram 7.2 external signal description a single-wire interface pin called the background debug interface (bkgd) pin is used to communicate with the bdm system. during reset, this pin is a mode select input which selects between normal and special modes of operation. after reset, this pin becomes the dedicated serial interface pin for the background debug mode. enbdm clksw bdmact trace sdv 16-bit shift register bkgd host system serial interface data control unsec register block register bdmsts instruction code and execution standard bdm firmware lookup table secured bdm firmware lookup table bus interface and control logic address data control clocks chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 280 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.3 memory map and register de?ition 7.3.1 module memory map table 7-2 shows the bdm memory map when bdm is active. 7.3.2 register descriptions a summary of the registers associated with the bdm is shown in figure 7-2 . registers are accessed by host-driven communications to the bdm hardware using read_bd and write_bd commands. table 7-2. bdm memory map global address module size (bytes) 0x7fff00?x7fff0b bdm registers 12 0x7fff0c?x7fff0e bdm ?mware rom 3 0x7fff0f family id (part of bdm ?mware rom) 1 0x7fff10?x7fffff bdm ?mware rom 240 global address register name bit 7 6 5 4 3 2 1 bit 0 0x7fff00 reserved r x x x x x x 0 0 w 0x7fff01 bdmsts r enbdm bdmact 0 sdv trace clksw unsec 0 w 0x7fff02 reserved r x x x x x x x x w 0x7fff03 reserved r x x x x x x x x w 0x7fff04 reserved r x x x x x x x x w 0x7fff05 reserved r x x x x x x x x w 0x7fff06 bdmccrl r ccr7 ccr6 ccr5 ccr4 ccr3 ccr2 ccr1 ccr0 w = unimplemented, reserved = implemented (do not alter) x = indeterminate 0 = always read zero figure 7-2. bdm register summary chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 281 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.3.2.1 bdm status register (bdmsts) figure 7-3. bdm status register ( bdmsts) 0x7fff07 bdmccrh r 0 0 0 0 0 ccr10 ccr9 ccr8 w 0x7fff08 bdmgpr r bgae bgp6 bgp5 bgp4 bgp3 bgp2 bgp1 bgp0 w 0x7fff09 reserved r 0 0 0 0 0 0 0 0 w 0x7fff0a reserved r 0 0 0 0 0 0 0 0 w 0x7fff0b reserved r 0 0 0 0 0 0 0 0 w register global address 0x7fff01 7 6 54 3 2 1 0 r enbdm bdmact 0sdv trace clksw unsec 0 w reset special single-chip mode 0 (1) 1. enbdm is read as 1 by a debugging environment in special single chip mode when the device is not secured or secured but fully erased (non-volatile memory). this is because the enbdm bit is set by the standard ?mware before a bdm command can be fully transmitted and executed. 1 00 0 0 0 (3) 3. unsec is read as 1 by a debugging environment in special single chip mode when the device is secured and fully erased, else it is 0 and can only be read if not secure (see also bit description). 0 emulation modes (if modes available) 1 0 00 0 1 (2) 2. clksw is read as 1 by a debugging environment in emulation modes when the device is not secured and read as 0 when secured if emulation modes available. 0 0 all other modes 0 0 00 0 0 0 0 = unimplemented, reserved = implemented (do not alter) 0 = always read zero global address register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented, reserved = implemented (do not alter) x = indeterminate 0 = always read zero figure 7-2. bdm register summary (continued) chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 282 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: all modes through bdm operation when not secured write: all modes through bdm operation when not secured, but subject to the following: enbdm should only be set via a bdm hardware command if the bdm ?mware commands are needed. (this does not apply in special single chip and emulation modes). bdmact can only be set by bdm hardware upon entry into bdm. it can only be cleared by the standard bdm ?mware lookup table upon exit from bdm active mode. clksw can only be written via bdm hardware write_bd commands. all other bits, while writable via bdm hardware or standard bdm ?mware write commands, should only be altered by the bdm hardware or standard ?mware lookup table as part of bdm command execution. table 7-3. bdmsts field descriptions field description 7 enbdm enable bdm ?this bit controls whether the bdm is enabled or disabled. when enabled, bdm can be made active to allow ?mware commands to be executed. when disabled, bdm cannot be made active but bdm hardware commands are still allowed. 0 bdm disabled 1 bdm enabled note: enbdm is set by the ?mware out of reset in special single chip mode. in emulation modes (if modes available) the enbdm bit is set by bdm hardware out of reset. in special single chip mode with the device secured, this bit will not be set by the ?mware until after the non-volatile memory erase verify tests are complete. in emulation modes (if modes available) with the device secured, the bdm operations are blocked. 6 bdmact bdm active status ?this bit becomes set upon entering bdm. the standard bdm ?mware lookup table is then enabled and put into the memory map. bdmact is cleared by a carefully timed store instruction in the standard bdm ?mware as part of the exit sequence to return to user code and remove the bdm memory from the map. 0 bdm not active 1 bdm active 4 sdv shift data valid this bit is set and cleared by the bdm hardware. it is set after data has been transmitted as part of a ?mware or hardware read command or after data has been received as part of a ?mware or hardware write command. it is cleared when the next bdm command has been received or bdm is exited. sdv is used by the standard bdm ?mware to control program ?w execution. 0 data phase of command not complete 1 data phase of command is complete 3 trace trace1 bdm firmware command is being executed ?this bit gets set when a bdm trace1 ?mware command is ?st recognized. it will stay set until bdm ?mware is exited by one of the following bdm commands: go or go_until. 0 trace1 command is not being executed 1 trace1 command is being executed chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 283 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 2 clksw clock switch the clksw bit controls which clock the bdm operates with. it is only writable from a hardware bdm command. a minimum delay of 150 cycles at the clock speed that is active during the data portion of the command send to change the clock source should occur before the next command can be send. the delay should be obtained no matter which bit is modi?d to effectively change the clock source (either pllsel bit or clksw bit). this guarantees that the start of the next bdm command uses the new clock for timing subsequent bdm communications. table 7-4 shows the resulting bdm clock source based on the clksw and the pllsel (pll select in the crg module, the bit is part of the clksel register) bits. note: the bdm alternate clock source can only be selected when clksw = 0 and pllsel = 1. the bdm serial interface is now fully synchronized to the alternate clock source, when enabled. this eliminates frequency restriction on the alternate clock which was required on previous versions. refer to the device speci?ation to determine which clock connects to the alternate clock source input. note: if the acknowledge function is turned on, changing the clksw bit will cause the ack to be at the new rate for the write command which changes it. note: in emulation modes (if modes available), the clksw bit will be set out of reset. 1 unsec unsecure ?if the device is secured this bit is only writable in special single chip mode from the bdm secure ?mware. it is in a zero state as secure mode is entered so that the secure bdm ?mware lookup table is enabled and put into the memory map overlapping the standard bdm ?mware lookup table. the secure bdm ?mware lookup table veri?s that the non-volatile memories (e.g. on-chip eeprom and/or flash eeprom) are erased. this being the case, the unsec bit is set and the bdm program jumps to the start of the standard bdm ?mware lookup table and the secure bdm ?mware lookup table is turned off. if the erase test fails, the unsec bit will not be asserted. 0 system is in a secured mode. 1 system is in a unsecured mode. note: when unsec is set, security is off and the user can change the state of the secure bits in the on-chip flash eeprom. note that if the user does not change the state of the bits to ?nsecured?mode, the system will be secured again when it is next taken out of reset.after reset this bit has no meaning or effect when the security byte in the flash eeprom is con?ured for unsecure mode. table 7-4. bdm clock sources pllsel clksw bdmclk 0 0 bus clock dependent on oscillator 0 1 bus clock dependent on oscillator 1 0 alternate clock (refer to the device speci?ation to determine the alternate clock source) 1 1 bus clock dependent on the pll table 7-3. bdmsts field descriptions (continued) field description chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 284 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.3.2.2 bdm ccr low holding register (bdmccrl) figure 7-4. bdm ccr low holding register (bdmccrl) read: all modes through bdm operation when not secured write: all modes through bdm operation when not secured note when bdm is made active, the cpu stores the content of its ccr l register in the bdmccrl register. however, out of special single-chip reset, the bdmccrl is set to 0xd8 and not 0xd0 which is the reset value of the ccr l register in this cpu mode. out of reset in all other modes the bdmccrl register is read zero. when entering background debug mode, the bdm ccr low holding register is used to save the low byte of the condition code register of the user s program. it is also used for temporary storage in the standard bdm ?mware mode. the bdm ccr low holding register can be written to modify the ccr value. 7.3.2.3 bdm ccr high holding register (bdmccrh) figure 7-5. bdm ccr high holding register (bdmccrh) read: all modes through bdm operation when not secured write: all modes through bdm operation when not secured when entering background debug mode, the bdm ccr high holding register is used to save the high byte of the condition code register of the user s program. the bdm ccr high holding register can be written to modify the ccr value. register global address 0x7fff06 7 6 5 4 3 2 1 0 r ccr7 ccr6 ccr5 ccr4 ccr3 ccr2 ccr1 ccr0 w reset special single-chip mode 1 1 0 0 1 0 0 0 all other modes 0 0 0 0 0 0 0 0 register global address 0x7fff07 7 6 5 4 3 2 1 0 r 0 0 0 0 0 ccr10 ccr9 ccr8 w reset 0 0 0 0 0 0 0 0 = unimplemented or reserved chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 285 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.3.2.4 bdm global page index register (bdmgpr) figure 7-6. bdm global page register (bdmgpr) read: all modes through bdm operation when not secured write: all modes through bdm operation when not secured 7.3.3 family id assignment the family id is a 8-bit value located in the ?mware rom (at global address: 0x7fff0f). the read-only value is a unique family id which is 0xc1 for s12x devices. 7.4 functional description the bdm receives and executes commands from a host via a single wire serial interface. there are two types of bdm commands: hardware and ?mware commands. hardware commands are used to read and write target system memory locations and to enter active background debug mode, see section 7.4.3, ?dm hardware commands . target system memory includes all memory that is accessible by the cpu. firmware commands are used to read and write cpu resources and to exit from active background debug mode, see section 7.4.4, ?tandard bdm firmware commands . the cpu resources referred to are the accumulator (d), x index register (x), y index register (y), stack pointer (sp), and program counter (pc). hardware commands can be executed at any time and in any mode excluding a few exceptions as highlighted (see section 7.4.3, ?dm hardware commands ) and in secure mode (see section 7.4.1, ?ecurity ). firmware commands can only be executed when the system is not secure and is in active background debug mode (bdm). register global address 0x7fff08 7 6 5 4 3 2 1 0 r bgae bgp6 bgp5 bgp4 bgp3 bgp2 bgp1 bgp0 w reset 0 0 0 0 0 0 0 0 table 7-5. bdmgpr field descriptions field description 7 bgae bdm global page access enable bit bgae enables global page access for bdm hardware and ?mware read/write instructions the bdm hardware commands used to access the bdm registers (read_bd_ and write_bd_) can not be used for global accesses even if the bgae bit is set. 0 bdm global access disabled 1 bdm global access enabled 6? bgp[6:0] bdm global page index bits 6? ?these bits de?e the extended address bits from 22 to 16. for more detailed information regarding the global page window scheme, please refer to the s12x_mmc block guide. chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 286 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.4.1 security if the user resets into special single chip mode with the system secured, a secured mode bdm ?mware lookup table is brought into the map overlapping a portion of the standard bdm ?mware lookup table. the secure bdm ?mware veri?s that the on-chip non-volatile memory (e.g. eeprom and flash eeprom) is erased. this being the case, the unsec and enbdm bit will get set. the bdm program jumps to the start of the standard bdm ?mware and the secured mode bdm ?mware is turned off and all bdm commands are allowed. if the non-volatile memory does not verify as erased, the bdm ?mware sets the enbdm bit, without asserting unsec, and the ?mware enters a loop. this causes the bdm hardware commands to become enabled, but does not enable the ?mware commands. this allows the bdm hardware to be used to erase the non-volatile memory. bdm operation is not possible in any other mode than special single chip mode when the device is secured. the device can be unsecured via bdm serial interface in special single chip mode only. for more information regarding security, please see the s12x_9sec block guide. 7.4.2 enabling and activating bdm the system must be in active bdm to execute standard bdm ?mware commands. bdm can be activated only after being enabled. bdm is enabled by setting the enbdm bit in the bdm status (bdmsts) register. the enbdm bit is set by writing to the bdm status (bdmsts) register, via the single-wire interface, using a hardware command such as write_bd_byte. after being enabled, bdm is activated by one of the following 1 : hardware background command cpu bgnd instruction external instruction tagging mechanism 2 breakpoint force or tag mechanism 2 when bdm is activated, the cpu ?ishes executing the current instruction and then begins executing the ?mware in the standard bdm ?mware lookup table. when bdm is activated by a breakpoint, the type of breakpoint used determines if bdm becomes active before or after execution of the next instruction. note if an attempt is made to activate bdm before being enabled, the cpu resumes normal instruction execution after a brief delay. if bdm is not enabled, any hardware background commands issued are ignored by the bdm and the cpu is not delayed. in active bdm, the bdm registers and standard bdm ?mware lookup table are mapped to addresses 0x7fff00 to 0x7fffff. bdm registers are mapped to addresses 0x7fff00 to 0x7fff0b. the bdm uses these registers which are readable anytime by the bdm. however, these registers are not readable by user programs. 1. bdm is enabled and active immediately out of special single-chip reset. 2. this method is provided by the s12x_dbg module. chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 287 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.4.3 bdm hardware commands hardware commands are used to read and write target system memory locations and to enter active background debug mode. target system memory includes all memory that is accessible by the cpu on the soc which can be on-chip ram, non-volatile memory (e.g. eeprom, flash eeprom), i/o and control registers, and all external memory. hardware commands are executed with minimal or no cpu intervention and do not require the system to be in active bdm for execution, although, they can still be executed in this mode. when executing a hardware command, the bdm sub-block waits for a free bus cycle so that the background access does not disturb the running application program. if a free cycle is not found within 128 clock cycles, the cpu is momentarily frozen so that the bdm can steal a cycle. when the bdm ?ds a free cycle, the operation does not intrude on normal cpu operation provided that it can be completed in a single cycle. however, if an operation requires multiple cycles the cpu is frozen until the operation is complete, even though the bdm found a free cycle. the bdm hardware commands are listed in table 7-6 . the read_bd and write_bd commands allow access to the bdm register locations. these locations are not normally in the system memory map but share addresses with the application in memory. to distinguish between physical memory locations that share the same address, bdm memory resources are enabled just for the read_bd and write_bd access cycle. this allows the bdm to access bdm locations unobtrusively, even if the addresses con?ct with the application memory map. table 7-6. hardware commands command opcode (hex) data description background 90 none enter background mode if ?mware is enabled. if enabled, an ack will be issued when the part enters active background mode. ack_enable d5 none enable handshake. issues an ack pulse after the command is executed. ack_disable d6 none disable handshake. this command does not issue an ack pulse. read_bd_byte e4 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table in map. odd address data on low byte; even address data on high byte. read_bd_word ec 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table in map. must be aligned access. read_byte e0 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table out of map. odd address data on low byte; even address data on high byte. read_word e8 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table out of map. must be aligned access. write_bd_byte c4 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table in map. odd address data on low byte; even address data on high byte. write_bd_word cc 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table in map. must be aligned access. write_byte c0 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table out of map. odd address data on low byte; even address data on high byte. chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 288 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.4.4 standard bdm firmware commands firmware commands are used to access and manipulate cpu resources. the system must be in active bdm to execute standard bdm ?mware commands, see section 7.4.2, ?nabling and activating bdm . normal instruction execution is suspended while the cpu executes the ?mware located in the standard bdm ?mware lookup table. the hardware command background is the usual way to activate bdm. as the system enters active bdm, the standard bdm ?mware lookup table and bdm registers become visible in the on-chip memory map at 0x7fff00?x7fffff, and the cpu begins executing the standard bdm ?mware. the standard bdm ?mware watches for serial commands and executes them as they are received. the ?mware commands are shown in table 7-7 . write_word c8 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table out of map. must be aligned access. note: if enabled, ack will occur when data is ready for transmission for all bdm read commands and will occur after the write is complete for all bdm write commands. table 7-6. hardware commands (continued) command opcode (hex) data description chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 289 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 7.4.5 bdm command structure hardware and ?mware bdm commands start with an 8-bit opcode followed by a 16-bit address and/or a 16-bit data word depending on the command. all the read commands return 16 bits of data despite the byte or word implication in the command name. 8-bit reads return 16-bits of data, of which, only one byte will contain valid data. if reading an even address, the valid data will appear in the msb. if reading an odd address, the valid data will appear in the lsb. table 7-7. firmware commands command (1) 1. if enabled, ack will occur when data is ready for transmission for all bdm read commands and will occur after the write is complete for all bdm write commands. opcode (hex) data description read_next (2) 2. when the ?mware command read_next or write_next is used to access the bdm address space the bdm resources are accessed rather than user code. writing bdm ?mware is not possible. 62 16-bit data out increment x index register by 2 (x = x + 2), then read word x points to. read_pc 63 16-bit data out read program counter. read_d 64 16-bit data out read d accumulator. read_x 65 16-bit data out read x index register. read_y 66 16-bit data out read y index register. read_sp 67 16-bit data out read stack pointer. write_next chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 290 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16-bit misaligned reads and writes are generally not allowed. if attempted by bdm hardware command, the bdm will ignore the least signi?ant bit of the address and will assume an even address from the remaining bits. for devices with external bus: the following cycle count information is only valid when the external wait function is not used (see wait bit of ebi sub-block). during an external wait the bdm can not steal a cycle. hence be careful with the external wait function if the bdm serial interface is much faster than the bus, because of the bdm soft-reset after time-out (see section 7.4.11, ?erial communication time out ). for hardware data read commands, the external host must wait at least 150 bus clock cycles after sending the address before attempting to obtain the read data. this is to be certain that valid data is available in the bdm shift register, ready to be shifted out. for hardware write commands, the external host must wait 150 bus clock cycles after sending the data to be written before attempting to send a new command. this is to avoid disturbing the bdm shift register before the write has been completed. the 150 bus clock cycle delay in both cases includes the maximum 128 cycle delay that can be incurred as the bdm waits for a free cycle before stealing a cycle. for ?mware read commands, the external host should wait at least 48 bus clock cycles after sending the command opcode and before attempting to obtain the read data. this includes the potential of extra cycles when the access is external and stretched (+1 to maximum +7 cycles) or to registers of the pru (port replacement unit) in emulation modes (if modes available). the 48 cycle wait allows enough time for the requested data to be made available in the bdm shift register, ready to be shifted out. note this timing has increased from previous bdm modules due to the new capability in which the bdm serial interface can potentially run faster than the bus. on previous bdm modules this extra time could be hidden within the serial time. for ?mware write commands, the external host must wait 36 bus clock cycles after sending the data to be written before attempting to send a new command. this is to avoid disturbing the bdm shift register before the write has been completed. the external host should wait at least for 76 bus clock cycles after a trace1 or go command before starting any new serial command. this is to allow the cpu to exit gracefully from the standard bdm ?mware lookup table and resume execution of the user code. disturbing the bdm shift register prematurely may adversely affect the exit from the standard bdm ?mware lookup table. note if the bus rate of the target processor is unknown or could be changing or the external wait function is used, it is recommended that the ack (acknowledge function) is used to indicate when an operation is complete. when using ack, the delay times are automated. chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 291 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 7-7 represents the bdm command structure. the command blocks illustrate a series of eight bit times starting with a falling edge. the bar across the top of the blocks indicates that the bkgd line idles in the high state. the time for an 8-bit command is 8 16 target clock cycles. 1 figure 7-7. bdm command structure 7.4.6 bdm serial interface the bdm communicates with external devices serially via the bkgd pin. during reset, this pin is a mode select input which selects between normal and special modes of operation. after reset, this pin becomes the dedicated serial interface pin for the bdm. the bdm serial interface is timed using the clock selected by the clksw bit in the status register see section 7.3.2.1, ?dm status register (bdmsts) . this clock will be referred to as the target clock in the following explanation. the bdm serial interface uses a clocking scheme in which the external host generates a falling edge on the bkgd pin to indicate the start of each bit time. this falling edge is sent for every bit whether data is transmitted or received. data is transferred most signi?ant bit (msb) ?st at 16 target clock cycles per bit. the interface times out if 512 clock cycles occur between falling edges from the host. the bkgd pin is a pseudo open-drain pin and has an weak on-chip active pull-up that is enabled at all times. it is assumed that there is an external pull-up and that drivers connected to bkgd do not typically drive the high level. since r-c rise time could be unacceptably long, the target system and host provide brief driven-high (speedup) pulses to drive bkgd to a logic 1. the source of this speedup pulse is the host for transmit cases and the target for receive cases. 1. target clock cycles are cycles measured using the target mcu s serial clock rate. see section 7.4.6, ?dm serial interface and section 7.3.2.1, ?dm status register (bdmsts) for information on how serial clock rate is selected. hardware hardware firmware firmware go, 48-bc bc = bus clock cycles command address 150-bc delay next delay 8 bits at ~ 16 tc/bit 16 bits at ~ 16 tc/bit 16 bits at ~ 16 tc/bit command address data next data read write read write trace command next command data 76-bc delay next command 150-bc delay 36-bc delay command command command command data next command tc = target clock cycles chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 292 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the timing for host-to-target is shown in figure 7-8 and that of target-to-host in figure 7-9 and figure 7-10 . all four cases begin when the host drives the bkgd pin low to generate a falling edge. since the host and target are operating from separate clocks, it can take the target system up to one full clock cycle to recognize this edge. the target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove bkgd low to start the bit up to one target clock cycle earlier. synchronization between the host and target is established in this manner at the start of every bit time. figure 7-8 shows an external host transmitting a logic 1 and transmitting a logic 0 to the bkgd pin of a target system. the host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. ten target clock cycles later, the target senses the bit level on the bkgd pin. internal glitch detect logic requires the pin be driven high no later that eight target clock cycles after the falling edge for a logic 1 transmission. since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. figure 7-8. bdm host-to-target serial bit timing the receive cases are more complicated. figure 7-9 shows the host receiving a logic 1 from the target system. since the host is asynchronous to the target, there is up to one clock-cycle delay from the host- generated falling edge on bkgd to the perceived start of the bit time in the target. the host holds the bkgd pin low long enough for the target to recognize it (at least two target clock cycles). the host must release the low drive before the target drives a brief high speedup pulse seven target clock cycles after the perceived start of the bit time. the host should sample the bit level about 10 target clock cycles after it started the bit time. target senses bit 10 cycles synchronization uncertainty bdm clock (target mcu) host transmit 1 host transmit 0 perceived start of bit time earliest start of next bit chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 293 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 7-9. bdm target-to-host serial bit timing (logic 1) high-impedance earliest start of next bit r-c rise 10 cycles 10 cycles host samples bkgd pin perceived start of bit time bkgd pin bdm clock (target mcu) host drive to bkgd pin target system speedup pulse high-impedance high-impedance chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 294 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 7-10 shows the host receiving a logic 0 from the target. since the host is asynchronous to the target, there is up to a one clock-cycle delay from the host-generated falling edge on bkgd to the start of the bit time as perceived by the target. the host initiates the bit time but the target ?ishes it. since the target wants the host to receive a logic 0, it drives the bkgd pin low for 13 target clock cycles then brie? drives it high to speed up the rising edge. the host samples the bit level about 10 target clock cycles after starting the bit time. figure 7-10. bdm target-to-host serial bit timing (logic 0) 7.4.7 serial interface hardware handshake protocol bdm commands that require cpu execution are ultimately treated at the mcu bus rate. since the bdm clock source can be asynchronously related to the bus frequency, when clksw = 0, it is very helpful to provide a handshake protocol in which the host could determine when an issued command is executed by the cpu. the alternative is to always wait the amount of time equal to the appropriate number of cycles at the slowest possible rate the clock could be running. this sub-section will describe the hardware handshake protocol. the hardware handshake protocol signals to the host controller when an issued command was successfully executed by the target. this protocol is implemented by a 16 serial clock cycle low pulse followed by a brief speedup pulse in the bkgd pin. this pulse is generated by the target mcu when a command, issued by the host, has been successfully executed (see figure 7-11 ). this pulse is referred to as the ack pulse. after the ack pulse has ?ished: the host can start the bit retrieval if the last issued command was a read command, or start a new command if the last command was a write command or a control command (background, go, go_until or trace1). the ack pulse is not issued earlier than 32 serial clock cycles after the bdm command was issued. the end of the bdm command is assumed to be the 16th tick of the last bit. this minimum delay assures enough time for the host to perceive the ack pulse. note also that, there is no upper limit for the delay between the command and the related ack pulse, since the command execution depends upon the cpu bus frequency, which in some cases could be very slow earliest start of next bit bdm clock (target mcu) host drive to bkgd pin bkgd pin perceived start of bit time 10 cycles 10 cycles host samples bkgd pin target system drive and speedup pulse speedup pulse high-impedance chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 295 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 compared to the serial communication rate. this protocol allows a great ?xibility for the pod designers, since it does not rely on any accurate time measurement or short response time to any event in the serial communication. figure 7-11. target acknowledge pulse (ack) note if the ack pulse was issued by the target, the host assumes the previous command was executed. if the cpu enters wait or stop prior to executing a hardware command, the ack pulse will not be issued meaning that the bdm command was not executed. after entering wait or stop mode, the bdm command is no longer pending. figure 7-12 shows the ack handshake protocol in a command level timing diagram. the read_byte instruction is used as an example. first, the 8-bit instruction opcode is sent by the host, followed by the address of the memory location to be read. the target bdm decodes the instruction. a bus cycle is grabbed (free or stolen) by the bdm and it executes the read_byte operation. having retrieved the data, the bdm issues an ack pulse to the host controller, indicating that the addressed byte is ready to be retrieved. after detecting the ack pulse, the host initiates the byte retrieval process. note that data is sent in the form of a word and the host needs to determine which is the appropriate byte based on whether the address was odd or even. figure 7-12. handshake protocol at command level 16 cycles bdm clock (target mcu) target transmits ack pulse high-impedance bkgd pin minimum delay from the bdm command 32 cycles earliest start of next bit speedup pulse 16th tick of the last command bit high-impedance read_byte bdm issues the bkgd pin byte address bdm executes the read_byte command host target host target bdm decodes the command ack pulse (out of scale) host target (2) bytes are retrieved new bdm command chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 296 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 differently from the normal bit transfer (where the host initiates the transmission), the serial interface ack handshake pulse is initiated by the target mcu by issuing a negative edge in the bkgd pin. the hardware handshake protocol in figure 7-11 speci?s the timing when the bkgd pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical con?ct in the bkgd pin. note the only place the bkgd pin can have an electrical con?ct is when one side is driving low and the other side is issuing a speedup pulse (high). other ?ighs are pulled rather than driven. however, at low rates the time of the speedup pulse can become lengthy and so the potential con?ct time becomes longer as well. the ack handshake protocol does not support nested ack pulses. if a bdm command is not acknowledge by an ack pulse, the host needs to abort the pending command ?st in order to be able to issue a new bdm command. when the cpu enters wait or stop while the host issues a hardware command (e.g., write_byte), the target discards the incoming command due to the wait or stop being detected. therefore, the command is not acknowledged by the target, which means that the ack pulse will not be issued in this case. after a certain time the host (not aware of stop or wait) should decide to abort any possible pending ack pulse in order to be sure a new command can be issued. therefore, the protocol provides a mechanism in which a command, and its corresponding ack, can be aborted. note the ack pulse does not provide a time out. this means for the go_until command that it can not be distinguished if a stop or wait has been executed (command discarded and ack not issued) or if the ?ntil?condition (bdm active) is just not reached yet. hence in any case where the ack pulse of a command is not issued the possible pending command should be aborted before issuing a new command. see the handshake abort procedure described in section 7.4.8, ?ardware handshake abort procedure . 7.4.8 hardware handshake abort procedure the abort procedure is based on the sync command. in order to abort a command, which had not issued the corresponding ack pulse, the host controller should generate a low pulse in the bkgd pin by driving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speedup pulse. by detecting this long low pulse in the bkgd pin, the target executes the sync protocol, see section 7.4.9, ?ync ?request timed reference pulse , and assumes that the pending command and therefore the related ack pulse, are being aborted. therefore, after the sync protocol has been completed the host is free to issue new bdm commands. for firmware read or write commands it can not be guaranteed that the pending command is aborted when issuing a sync before the corresponding ack pulse. there is a short latency time from the time the read or write access begins until it is ?ished and the corresponding ack pulse is issued. the latency time depends on the ?mware read or write command that is issued and if the serial interface is running on a different clock rate than the bus. when the sync command starts during this latency time the read or write command will not be aborted, but the corresponding ack pulse will be aborted. a pending go, trace1 or chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 297 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 go_until command can not be aborted. only the corresponding ack pulse can be aborted by the sync command. although it is not recommended, the host could abort a pending bdm command by issuing a low pulse in the bkgd pin shorter than 128 serial clock cycles, which will not be interpreted as the sync command. the ack is actually aborted when a negative edge is perceived by the target in the bkgd pin. the short abort pulse should have at least 4 clock cycles keeping the bkgd pin low, in order to allow the negative edge to be detected by the target. in this case, the target will not execute the sync protocol but the pending command will be aborted along with the ack pulse. the potential problem with this abort procedure is when there is a con?ct between the ack pulse and the short abort pulse. in this case, the target may not perceive the abort pulse. the worst case is when the pending command is a read command (i.e., read_byte). if the abort pulse is not perceived by the target the host will attempt to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. in this case, host and target will run out of synchronism. however, if the command to be aborted is not a read command the short abort pulse could be used. after a command is aborted the target assumes the next negative edge, after the abort pulse, is the ?st bit of a new bdm command. note the details about the short abort pulse are being provided only as a reference for the reader to better understand the bdm internal behavior. it is not recommended that this procedure be used in a real application. since the host knows the target serial clock frequency, the sync command (used to abort a command) does not need to consider the lower possible target frequency. in this case, the host could issue a sync very close to the 128 serial clock cycles length. providing a small overhead on the pulse length in order to assure the sync pulse will not be misinterpreted by the target. see section 7.4.9, ?ync ?request timed reference pulse . figure 7-13 shows a sync command being issued after a read_byte, which aborts the read_byte command. note that, after the command is aborted a new command could be issued by the host computer. figure 7-13. ack abort procedure at the command level note figure 7-13 does not represent the signals in a true timing scale figure 7-14 shows a con?ct between the ack pulse and the sync request pulse. this con?ct could occur if a pod device is connected to the target bkgd pin and the target is already in debug active mode. read_byte read_status bkgd pin memory address new bdm command new bdm command host target host target host target sync response from the target (out of scale) bdm decode and starts to execute the read_byte command read_byte cmd is aborted by the sync request (out of scale) chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 298 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 consider that the target cpu is executing a pending bdm command at the exact moment the pod is being connected to the bkgd pin. in this case, an ack pulse is issued along with the sync command. in this case, there is an electrical con?ct between the ack speedup pulse and the sync pulse. since this is not a probable situation, the protocol does not prevent this con?ct from happening. figure 7-14. ack pulse and sync request con?ct note this information is being provided so that the mcu integrator will be aware that such a con?ct could eventually occur. the hardware handshake protocol is enabled by the ack_enable and disabled by the ack_disable bdm commands. this provides backwards compatibility with the existing pod devices which are not able to execute the hardware handshake protocol. it also allows for new pod devices, that support the hardware handshake protocol, to freely communicate with the target device. if desired, without the need for waiting for the ack pulse. the commands are described as follows: ack_enable enables the hardware handshake protocol. the target will issue the ack pulse when a cpu command is executed by the cpu. the ack_enable command itself also has the ack pulse as a response. ack_disable disables the ack pulse protocol. in this case, the host needs to use the worst case delay time at the appropriate places in the protocol. the default state of the bdm after reset is hardware handshake protocol disabled. all the read commands will ack (if enabled) when the data bus cycle has completed and the data is then ready for reading out by the bkgd serial pin. all the write commands will ack (if enabled) after the data has been received by the bdm through the bkgd serial pin and when the data bus cycle is complete. see section 7.4.3, ?dm hardware commands and section 7.4.4, ?tandard bdm firmware commands for more information on the bdm commands. bdm clock (target mcu) target mcu drives to bkgd pin bkgd pin 16 cycles speedup pulse high-impedance host drives sync to bkgd pin ack pulse host sync request pulse at least 128 cycles electrical con?ct host and target drive to bkgd pin chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 299 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the ack_enable sends an ack pulse when the command has been completed. this feature could be used by the host to evaluate if the target supports the hardware handshake protocol. if an ack pulse is issued in response to this command, the host knows that the target supports the hardware handshake protocol. if the target does not support the hardware handshake protocol the ack pulse is not issued. in this case, the ack_enable command is ignored by the target since it is not recognized as a valid command. the background command will issue an ack pulse when the cpu changes from normal to background mode. the ack pulse related to this command could be aborted using the sync command. the go command will issue an ack pulse when the cpu exits from background mode. the ack pulse related to this command could be aborted using the sync command. the go_until command is equivalent to a go command with exception that the ack pulse, in this case, is issued when the cpu enters into background mode. this command is an alternative to the go command and should be used when the host wants to trace if a breakpoint match occurs and causes the cpu to enter active background mode. note that the ack is issued whenever the cpu enters bdm, which could be caused by a breakpoint match or by a bgnd instruction being executed. the ack pulse related to this command could be aborted using the sync command. the trace1 command has the related ack pulse issued when the cpu enters background active mode after one instruction of the application program is executed. the ack pulse related to this command could be aborted using the sync command. 7.4.9 sync ?request timed reference pulse the sync command is unlike other bdm commands because the host does not necessarily know the correct communication speed to use for bdm communications until after it has analyzed the response to the sync command. to issue a sync command, the host should perform the following steps: 1. drive the bkgd pin low for at least 128 cycles at the lowest possible bdm serial communication frequency (the lowest serial communication frequency is determined by the crystal oscillator or the clock chosen by clksw.) 2. drive bkgd high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. remove all drive to the bkgd pin so it reverts to high impedance. 4. listen to the bkgd pin for the sync response pulse. upon detecting the sync request from the host, the target performs the following steps: 1. discards any incomplete command received or bit retrieved. 2. waits for bkgd to return to a logic one. 3. delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. drives bkgd low for 128 cycles at the current bdm serial communication frequency. 5. drives a one-cycle high speedup pulse to force a fast rise time on bkgd. 6. removes all drive to the bkgd pin so it reverts to high impedance. the host measures the low time of this 128 cycle sync response pulse and determines the correct speed for subsequent bdm communications. typically, the host can determine the correct communication speed chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 300 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. as soon as the sync request is detected by the target, any partially received command or bit retrieved is discarded. this is referred to as a soft-reset, equivalent to a time-out in the serial communication. after the sync response, the target will consider the next negative edge (issued by the host) as the start of a new bdm command or the start of new sync request. another use of the sync command pulse is to abort a pending ack pulse. the behavior is exactly the same as in a regular sync command. note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. in this case, the command may not have been understood by the target and so an ack response pulse will not be issued. 7.4.10 instruction tracing when a trace1 command is issued to the bdm in active bdm, the cpu exits the standard bdm ?mware and executes a single instruction in the user code. once this has occurred, the cpu is forced to return to the standard bdm ?mware and the bdm is active and ready to receive a new command. if the trace1 command is issued again, the next user instruction will be executed. this facilitates stepping or tracing through the user code one instruction at a time. if an interrupt is pending when a trace1 command is issued, the interrupt stacking operation occurs but no user instruction is executed. once back in standard bdm ?mware execution, the program counter points to the ?st instruction in the interrupt service routine. be aware when tracing through the user code that the execution of the user code is done step by step but all peripherals are free running. hence possible timing relations between cpu code execution and occurrence of events of other peripherals no longer exist. do not trace the cpu instruction bgnd used for soft breakpoints. tracing the bgnd instruction will result in a return address pointing to bdm ?mware address space. when tracing through user code which contains stop or wait instructions the following will happen when the stop or wait instruction is traced: the cpu enters stop or wait mode and the trace1 command can not be ?ished before leaving the low power mode. this is the case because bdm active mode can not be entered after cpu executed the stop instruction. however all bdm hardware commands except the background command are operational after tracing a stop or wait instruction and still being in stop or wait mode. if system stop mode is entered (all bus masters are in stop mode) no bdm command is operational. as soon as stop or wait mode is exited the cpu enters bdm active mode and the saved pc value points to the entry of the corresponding interrupt service routine. in case the handshake feature is enabled the corresponding ack pulse of the trace1 command will be discarded when tracing a stop or wait instruction. hence there is no ack pulse when bdm active mode is entered as part of the trace1 command after cpu exited from stop or wait mode. all valid commands sent during cpu being in stop or wait mode or after cpu exited from stop or wait mode will have an ack pulse. the handshake feature becomes disabled only when system chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 301 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 stop mode has been reached. hence after a system stop mode the handshake feature must be enabled again by sending the ack_enable command. 7.4.11 serial communication time out the host initiates a host-to-target serial transmission by generating a falling edge on the bkgd pin. if bkgd is kept low for more than 128 target clock cycles, the target understands that a sync command was issued. in this case, the target will keep waiting for a rising edge on bkgd in order to answer the sync request pulse. if the rising edge is not detected, the target will keep waiting forever without any time-out limit. consider now the case where the host returns bkgd to logic one before 128 cycles. this is interpreted as a valid bit transmission, and not as a sync request. the target will keep waiting for another falling edge marking the start of a new bit. if, however, a new falling edge is not detected by the target within 512 clock cycles since the last falling edge, a time-out occurs and the current command is discarded without affecting memory or the operating mode of the mcu. this is referred to as a soft-reset. if a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset will occur causing the command to be disregarded. the data is not available for retrieval after the time-out has occurred. this is the expected behavior if the handshake protocol is not enabled. however, consider the behavior where the bdm is running in a frequency much greater than the cpu frequency. in this case, the command could time out before the data is ready to be retrieved. in order to allow the data to be retrieved even with a large clock frequency mismatch (between bdm and cpu) when the hardware handshake protocol is enabled, the time out between a read command and the data retrieval is disabled. therefore, the host could wait for more then 512 serial clock cycles and still be able to retrieve the data from an issued read command. however, once the handshake pulse (ack pulse) is issued, the time-out feature is re- activated, meaning that the target will time out after 512 clock cycles. therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ack pulse had been issued. after that period, the read command is discarded and the data is no longer available for retrieval. any negative edge in the bkgd pin after the time-out period is considered to be a new command or a sync request. note that whenever a partially issued command, or partially retrieved data, has occurred the time out in the serial communication is active. this means that if a time frame higher than 512 serial clock cycles is observed between two consecutive negative edges and the command being issued or data being retrieved is not complete, a soft-reset will occur causing the partially received command or data retrieved to be disregarded. the next negative edge in the bkgd pin, after a soft-reset has occurred, is considered by the target as the start of a new bdm command, or the start of a sync request pulse. chapter 7 background debug module (s12xbdmv2) mc9s12xe-family reference manual , rev. 1.21 302 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 303 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 8 s12x debug (s12xdbgv3) module table 8-1. revision history 8.1 introduction the s12xdbg module provides an on-chip trace buffer with ?xible triggering capability to allow non- intrusive debug of application software. the s12xdbg module is optimized for the s12x 16-bit architecture and allows debugging of cpu12xand xgate module operations. typically the s12xdbg module is used in conjunction with the s12xbdm module, whereby the user con?ures the s12xdbg module for a debugging session over the bdm interface. once con?ured the s12xdbg module is armed and the device leaves bdm mode returning control to the user program, which is then monitored by the s12xdbg module. alternatively the s12xdbg module can be con?ured over a serial interface using swi routines. 8.1.1 glossary revision number revision date sections affected description of changes v03.18 20 apr 2007 8.4.2.3/8-327 - added ?ata bus comparison ndb dependency?section - clari?d effect trig has on state sequencer. v03.19 24 apr 2007 8.4.3.5/8-329 - clari?d simultaneous arm and disarm effect. v03.20 14 apr 2007 8.3.2.7/8-315 - clari?d reserved state sequencer encodings. v03.21 23 oct 2007 8.4.2.2/8-327 8.4.2.4/8-328 - added single databyte comparison limitation information - added statement about interrupt vector fetches whilst tagging. v03.22 12 nov 2007 8.4.5.2/8-332 8.4.5.5/8-339 - removed loop1 tracing restriction note. - added pin reset effect note. v03.23 13 nov 2007 general - text readability improved, typo removed. v03.24 04 jan 2008 8.4.5.3/8-334 - corrected bit name. table 8-2. glossary of terms term de?ition cof change of flow. change in the program ?w due to a conditional branch, indexed jump or interrupt bdm background debug mode dug device user guide, describing the features of the device into which the dbg is integrated chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 304 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.1.2 overview the comparators monitor the bus activity of the cpu12x and xgate. when a match occurs the control logic can trigger the state sequencer to a new state. on a transition to the final state, bus tracing is triggered and/or a breakpoint can be generated. independent of comparator matches a transition to final state with associated tracing and breakpoint can be triggered by the external t a ghi and t a glo signals, or by an xgate module s/w breakpoint request or by writing to the trig control bit. the trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. tracing is disabled when the mcu system is secured. 8.1.3 features four comparators (a, b, c, and d) comparators a and c compare the full address bus and full 16-bit data bus comparators a and c feature a data bus mask register comparators b and d compare the full address bus only each comparator can be con?ured to monitor cpu12x or xgate buses each comparator features selection of read or write access cycles comparators b and d allow selection of byte or word access cycles comparisons can be used as triggers for the state sequencer three comparator modes simple address/data comparator match mode inside address range mode, addmin address addmax outside address range match mode, address < addmin or address > addmax two types of triggers tagged ?this triggers just before a speci? instruction begins execution force ?this triggers on the ?st instruction boundary after a match occurs. the following types of breakpoints cpu12x breakpoint entering bdm on breakpoint (bdm) cpu12x breakpoint executing swi on breakpoint (swi) xgate breakpoint word 16 bit data entity data line 64 bit data entity cpu cpu12x module tag tags can be attached to xgate or cpu opcodes as they enter the instruction pipe. if the tagged opcode reaches the execution stage a tag hit occurs. table 8-2. glossary of terms (continued) term de?ition chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 305 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 external cpu12x instruction tagging trigger independent of comparators xgate s/w breakpoint request trigger independent of comparators trig immediate software trigger independent of comparators four trace modes normal: change of ?w (cof) pc information is stored (see section 8.4.5.2.1 ) for change of ?w de?ition. loop1: same as normal but inhibits consecutive duplicate source address entries detail: address and data for all cycles except free cycles and opcode fetches are stored pure pc: all program counter addresses are stored. 4-stage state sequencer for trace buffer control tracing session trigger linked to final state of state sequencer begin, end, and mid alignment of tracing to trigger 8.1.4 modes of operation the s12xdbg module can be used in all mcu functional modes. during bdm hardware accesses and whilst the bdm module is active, cpu12x monitoring is disabled. thus breakpoints, comparators, and cpu12x bus tracing are disabled but xgate bus monitoring accessing the s12xdbg registers, including comparator registers, is still possible. while in active bdm or during hardware bdm accesses, xgate activity can still be compared, traced and can be used to generate a breakpoint to the xgate module. when the cpu12x enters active bdm mode through a background command, with the s12xdbg module armed, the s12xdbg remains armed. the s12xdbg module tracing is disabled if the mcu is secure. however, breakpoints can still be generated if the mcu is secure. table 8-3. mode dependent restriction summary bdm enable bdm active mcu secure comparator matches enabled breakpoints possible tagging possible tracing possible x x 1 yes yes yes no 0 0 0 yes only swi yes yes 0 1 0 active bdm not possible when not enabled 1 0 0 yes yes yes yes 1 1 0 xgate only xgate only xgate only xgate only chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 306 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.1.5 block diagram figure 8-1. debug module block diagram 8.2 external signal description the s12xdbg sub-module features two external tag input signals. see device user guide (dug) for the mapping of these signals to device pins. these tag pins may be used for the external tagging in emulation modes only. 8.3 memory map and registers 8.3.1 module memory map a summary of the registers associated with the s12xdbg sub-block is shown in table 8-2 . detailed descriptions of the registers and bits are given in the subsections that follow. table 8-4. external system pins associated with s12xdbg pin name pin functions description t a ghi (see dug) taghi when instruction tagging is on, tags the high half of the instruction word being read into the instruction queue. t a glo (see dug) taglo when instruction tagging is on, tags the low half of the instruction word being read into the instruction queue. t a glo (see dug) unconditional tagging enable in emulation modes, a low assertion on this pin in the 7th or 8th cycle after the end of reset enables the unconditional tagging function. cpu12x bus trace buffer bus interface trigger external taghi / taglo match0 state xgate bus comparator b comparator c comparator d comparator a state sequencer match1 match2 match3 trace read trace data (dbg read data bus) control secure breakpoint requests comparator match control xgate s/w breakpoint request trigger tag & trigger control logic tag s taghits state cpu12x & xgate chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 307 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 address name bit 7 6 54321 bit 0 0x0020 dbgc1 r arm 0 xgsbpe bdm dbgbrk comrv w trig 0x0021 dbgsr r tbf extf 0 0 0 ssf2 ssf1 ssf0 w 0x0022 dbgtcr r tsource trange trcmod talign w 0x0023 dbgc2 r0 0 0 0 cdcm abcm w 0x0024 dbgtbh r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x0025 dbgtbl r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0026 dbgcnt r 0 cnt w 0x0027 dbgscrx r0 0 0 0 sc3 sc2 sc1 sc0 w 0x0027 dbgmfr r 0 0 0 0 mc3 mc2 mc1 mc0 w 0x0028 1 dbgxctl (compa/c) r0 ndb tag brk rw rwe src compe w 0x0028 2 dbgxctl (compb/d) r sze sz tag brk rw rwe src compe w 0x0029 dbgxah r0 bit 22 21 20 19 18 17 bit 16 w 0x002a dbgxam r bit 15 14 13 12 11 10 9 bit 8 w 0x002b dbgxal r bit 7 6 54321 bit 0 w 0x002c dbgxdh r bit 15 14 13 12 11 10 9 bit 8 w 0x002d dbgxdl r bit 7 6 54321 bit 0 w 0x002e dbgxdhm r bit 15 14 13 12 11 10 9 bit 8 w 0x002f dbgxdlm r bit 7 6 54321 bit 0 w 1 this represents the contents if the comparator a or c control register is blended into this address. 2 this represents the contents if the comparator b or d control register is blended into this address figure 8-2. quick reference to s12xdbg registers chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 308 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2 register descriptions this section consists of the s12xdbg control and trace buffer register descriptions in address order. each comparator has a bank of registers that are visible through an 8-byte window between 0x0028 and 0x002f in the s12xdbg module register address map. when arm is set in dbgc1, the only bits in the s12xdbg module registers that can be written are arm, trig, and comrv[1:0] 8.3.2.1 debug control register 1 (dbgc1) read: anytime write: bits 7, 1, 0 anytime bit 6 can be written anytime but always reads back as 0. bits 5:2 anytime s12xdbg is not armed. note if a write access to dbgc1 with the arm bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the arm bit is cleared due to the hardware disarm. note when disarming the s12xdbg by clearing arm with software, the contents of bits[5:2] are not affected by the write, since up until the write operation, arm = 1 preventing these bits from being written. these bits must be cleared using a second write if required. address: 0x0020 76543210 r arm 0 xgsbpe bdm dbgbrk comrv w trig reset 0 0 0 00000 figure 8-3. debug control register (dbgc1) table 8-5. dbgc1 field descriptions field description 7 arm arm bit ?the arm bit controls whether the s12xdbg module is armed. this bit can be set and cleared by user software and is automatically cleared on completion of a tracing session, or if a breakpoint is generated with tracing not enabled. on setting this bit the state sequencer enters state1. 0 debugger disarmed 1 debugger armed 6 trig immediate trigger request bit ?this bit when written to 1 requests an immediate trigger independent of comparator or external tag signal status. when tracing is complete a forced breakpoint may be generated depending upon dbgbrk and bdm bit settings. this bit always reads back a 0. writing a 0 to this bit has no effect. if tsource are clear no tracing is carried out. if tracing has already commenced using begin- or mid trigger alignment, it continues until the end of the tracing session as de?ed by the talign bit settings, thus trig has no affect. in secure mode tracing is disabled and writing to this bit has no effect. 0 do not trigger until the state sequencer enters the final state. 1 trigger immediately . chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 309 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 5 xgsbpe xgate s/w breakpoint enable ?the xgsbpe bit controls whether an xgate s/w breakpoint request is passed to the cpu12x. the xgate s/w breakpoint request is handled by the s12xdbg module, which can request an cpu12x breakpoint depending on the state of this bit. 0 xgate s/w breakpoint request is disabled 1 xgate s/w breakpoint request is enabled 4 bdm background debug mode enable ?this bit determines if an s12x breakpoint causes the system to enter background debug mode (bdm) or initiate a software interrupt (swi). if this bit is set but the bdm is not enabled by the enbdm bit in the bdm module, then breakpoints default to swi. 0 breakpoint to software interrupt if bdm inactive. otherwise no breakpoint. 1 breakpoint to bdm, if bdm enabled. otherwise breakpoint to swi 3? dbgbrk s12xdbg breakpoint enable bits the dbgbrk bits control whether the debugger will request a breakpoint to either cpu12x or xgate or both upon reaching the state sequencer final state. if tracing is enabled, the breakpoint is generated on completion of the tracing session. if tracing is not enabled, the breakpoint is generated immediately. please refer to section 8.4.7 for further details. xgate software breakpoints are independent of the dbgbrk bits. xgate software breakpoints force a breakpoint to the cpu12x independent of the dbgbrk bit ?ld con?uration. see table 8-6 . 1? comrv comparator register visibility bits these bits determine which bank of comparator register is visible in the 8-byte window of the s12xdbg module address map, located between 0x0028 to 0x002f. furthermore these bits determine which register is visible at the address 0x0027. see table 8-7 . table 8-6. dbgbrk encoding dbgbrk resource halted by breakpoint 00 no breakpoint generated 01 xgate breakpoint generated 10 cpu12x breakpoint generated 11 breakpoints generated for cpu12x and xgate table 8-7. comrv encoding comrv visible comparator visible register at 0x0027 00 comparator a dbgscr1 01 comparator b dbgscr2 10 comparator c dbgscr3 11 comparator d dbgmfr table 8-5. dbgc1 field descriptions (continued) field description chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 310 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.2 debug status register (dbgsr) read: anytime write: never address: 0x0021 76543210 r tbf extf 0 0 0 ssf2 ssf1 ssf0 w reset por 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = unimplemented or reserved figure 8-4. debug status register (dbgsr) table 8-8. dbgsr field descriptions field description 7 tbf trace buffer full the tbf bit indicates that the trace buffer has stored 64 or more lines of data since it was last armed. if this bit is set, then all 64 lines will be valid data, regardless of the value of dbgcnt bits cnt[6:0]. the tbf bit is cleared when arm in dbgc1 is written to a one. the tbf is cleared by the power on reset initialization. other system generated resets have no affect on this bit 6 extf external tag hit flag ?the extf bit indicates if a tag hit condition from an external t a ghi/ t a glo tag was met since arming. this bit is cleared when arm in dbgc1 is written to a one. 0 external tag hit has not occurred 1 external tag hit has occurred 2? ssf[2:0] state sequencer flag bits the ssf bits indicate in which state the state sequencer is currently in. during a debug session on each transition to a new state these bits are updated. if the debug session is ended by software clearing the arm bit, then these bits retain their value to re?ct the last state of the state sequencer before disarming. if a debug session is ended by an internal trigger, then the state sequencer returns to state0 and these bits are cleared to indicate that state0 was entered during the session. on arming the module the state sequencer enters state1 and these bits are forced to ssf[2:0] = 001. see table 8-9 . table 8-9. ssf[2:0] ?state sequence flag bit encoding ssf[2:0] current state 000 state0 (disarmed) 001 state1 010 state2 011 state3 100 final state 101,110,111 reserved chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 311 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.3 debug trace control register (dbgtcr) read: anytime write: bits 7:6 only when s12xdbg is neither secure nor armed. bits 5:0 anytime the module is disarmed. address: 0x0022 76543210 r tsource trange trcmod talign w reset 0 0 0 00000 figure 8-5. debug trace control register (dbgtcr) table 8-10. dbgtcr field descriptions field description 7? tsource trace source control bits ?the tsource bits select the data source for the tracing session. if the mcu system is secured, these bits cannot be set and tracing is inhibited. see table 8-11 . 5? trange trace range bits the trange bits allow ?tering of trace information from a selected address range when tracing from the cpu12x in detail mode. the xgate tracing range cannot be narrowed using these bits. to use a comparator for range ?tering, the corresponding compe and src bits must remain cleared. if the compe bit is not clear then the comparator will also be used to generate state sequence triggers. if the corresponding src bit is set the comparator is mapped to the xgate buses, the trange bits have no effect on the valid address range, memory accesses within the whole memory map are traced. see table 8-12 . 3? trcmod trace mode bits see section 8.4.5.2 for detailed trace mode descriptions. in normal mode, change of ?w information is stored. in loop1 mode, change of ?w information is stored but redundant entries into trace memory are inhibited. in detail mode, address and data for all memory and register accesses is stored. see table 8-13 . 1? talign trigger align bits ?these bits control whether the trigger is aligned to the beginning, end or the middle of a tracing session. see table 8-14 . table 8-11. tsource ?trace source bit encoding tsource tracing source 00 no tracing requested 01 cpu12x 10 (1) 1. no range limitations are allowed. thus tracing operates as if trange = 00. xgate 11 1,(2) 2. no detail mode tracing supported. if trcmod = 10, no information is stored. both cpu12x and xgate chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 312 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.4 debug control register2 (dbgc2) read: anytime write: anytime the module is disarmed. this register con?ures the comparators for range matching. table 8-12. trange trace range encoding trange tracing range 00 trace from all addresses (no ?ter) 01 trace only in address range from $00000 to comparator d 10 trace only in address range from comparator c to $7fffff 11 trace only in range from comparator c to comparator d table 8-13. trcmod trace mode bit encoding trcmod description 00 normal 01 loop1 10 detail 11 pure pc table 8-14. talign trace alignment encoding talign description 00 trigger at end of stored data 01 trigger before storing data 10 trace buffer entries before and after trigger 11 reserved address: 0x0023 76543210 r0000 cdcm abcm w reset 0 0 0 00000 = unimplemented or reserved figure 8-6. debug control register2 (dbgc2) table 8-15. dbgc2 field descriptions field description 3? cdcm[1:0] c and d comparator match control ?these bits determine the c and d comparator match mapping as described in table 8-16 . 1? abcm[1:0] a and b comparator match control ?these bits determine the a and b comparator match mapping as described in table 8-17 . chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 313 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.5 debug trace buffer register (dbgtbh:dbgtbl) read: only when unlocked and not secured and not armed and with a tsource bit set. write: aligned word writes when disarmed unlock the trace buffer for reading but do not affect trace buffer contents. table 8-16. cdcm encoding cdcm description 00 match2 mapped to comparator c match....... match3 mapped to comparator d match. 01 match2 mapped to comparator c/d inside range....... match3 disabled. 10 match2 mapped to comparator c/d outside range....... match3 disabled. 11 reserved (1) 1. currently defaults to match2 mapped to comparator c : match3 mapped to comparator d table 8-17. abcm encoding abcm description 00 match0 mapped to comparator a match....... match1 mapped to comparator b match. 01 match 0 mapped to comparator a/b inside range....... match1 disabled. 10 match 0 mapped to comparator a/b outside range....... match1 disabled. 11 reserved (1) 1. currently defaults to match0 mapped to comparator a : match1 mapped to comparator b address: 0x0024, 0x0025 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w porxxxxxxxxxxxxxxxx other resets figure 8-7. debug trace buffer register (dbgtb) table 8-18. dbgtb field descriptions field description 15? bit[15:0] trace buffer data bits the trace buffer register is a window through which the 64-bit wide data lines of the trace buffer may be read 16 bits at a time. each valid read of dbgtb increments an internal trace buffer pointer which points to the next address to be read. when the arm bit is written to 1 the trace buffer is locked to prevent reading. the trace buffer can only be unlocked for reading by writing to dbgtb with an aligned word write when the module is disarmed. the dbgtb register can be read only as an aligned word, any byte reads or misaligned access of these registers will return 0 and will not cause the trace buffer pointer to increment to the next trace buffer address. the same is true for word reads while the debugger is armed. the por state is unde?ed other resets do not affect the trace buffer contents. . chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 314 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.6 debug count register (dbgcnt) read: anytime write: never address: 0x0026 76543210 r 0 cnt w reset por 0 0 0 0 0 0 0 0 0 = unimplemented or reserved figure 8-8. debug count register (dbgcnt) table 8-19. dbgcnt field descriptions field description 6? cnt[6:0] count value the cnt bits [6:0] indicate the number of valid data 64-bit data lines stored in the trace buffer. table 8-20 shows the correlation between the cnt bits and the number of valid data lines in the trace buffer. when the cnt rolls over to zero, the tbf bit in dbgsr is set and incrementing of cnt will continue in end- trigger or mid-trigger mode. the dbgcnt register is cleared when arm in dbgc1 is written to a one. the dbgcnt register is cleared by power-on-reset initialization but is not cleared by other system resets. thus should a reset occur during a debug session, the dbgcnt register still indicates after the reset, the number of valid trace buffer entries stored before the reset occurred. the dbgcnt register is not decremented when reading from the trace buffer. table 8-20. cnt decoding table tbf (dbgsr) cnt[6:0] description 0 0000000 no data valid 0 0000001 32 bits of one line valid (1) 1. this applies to normal/loop1/purepc modes when tracing from either cpu12x or xgate only. 0 0000010 0000100 0000110 .. 1111100 1 line valid 2 lines valid 3 lines valid .. 62 lines valid 0 1111110 63 lines valid 1 0000000 64 lines valid; if using begin trigger alignment, arm bit will be cleared and the tracing session ends. 1 0000010 .. .. 1111110 64 lines valid, oldest data has been overwritten by most recent data chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 315 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.7 debug state control registers there is a dedicated control register for each of the state sequencer states 1 to 3 that determines if transitions from that state are allowed, depending upon comparator matches or tag hits, and de?es the next state for the state sequencer following a match. the three debug state control registers are located at the same address in the register address map (0x0027). each register can be accessed using the comrv bits in dbgc1 to blend in the required register. the comrv = 11 value blends in the match ?g register (dbgmfr). 8.3.2.7.1 debug state control register 1 (dbgscr1) read: if comrv[1:0] = 00 write: if comrv[1:0] = 00 and s12xdbg is not armed. this register is visible at 0x0027 only with comrv[1:0] = 00. the state control register 1 selects the targeted next state whilst in state1. the matches refer to the match channels of the comparator match control logic as depicted in figure 8-1 and described in section 8.3.2.8.1 . comparators must be enabled by setting the comparator enable bit in the associated dbgxctl control register. table 8-21. state control register access encoding comrv visible state control register 00 dbgscr1 01 dbgscr2 10 dbgscr3 11 dbgmfr address: 0x0027 76543210 r0000 sc3 sc2 sc1 sc0 w reset 0 0 0 00000 = unimplemented or reserved figure 8-9. debug state control register 1 (dbgscr1) table 8-22. dbgscr1 field descriptions field description 3? sc[3:0] these bits select the targeted next state whilst in state1, based upon the match event. table 8-23. state1 sequencer next state selection sc[3:0] description 0000 any match triggers to state2 0001 any match triggers to state3 0010 any match triggers to final state 0011 match2 triggers to state2....... other matches have no effect chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 316 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the trigger priorities described in table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. the sc[3:0] encoding ensures that a match leading to ?al state has priority over all other matches. 8.3.2.7.2 debug state control register 2 (dbgscr2) read: if comrv[1:0] = 01 write: if comrv[1:0] = 01 and s12xdbg is not armed. this register is visible at 0x0027 only with comrv[1:0] = 01. the state control register 2 selects the targeted next state whilst in state2. the matches refer to the match channels of the comparator match control logic as depicted in figure 8-1 and described in section 8.3.2.8.1 . comparators must be enabled by setting the comparator enable bit in the associated dbgxctl control register. 0100 match2 triggers to state3....... other matches have no effect 0101 match2 triggers to final state....... other matches have no effect 0110 match0 triggers to state2....... match1 triggers to state3....... other matches have no effect 0111 match1 triggers to state3....... match0 triggers final state....... other matches have no effect 1000 match0 triggers to state2....... match2 triggers to state3....... other matches have no effect 1001 match2 triggers to state3....... match0 triggers final state....... other matches have no effect 1010 match1 triggers to state2....... match3 triggers to state3....... other matches have no effect 1011 match3 triggers to state3....... match1 triggers to final state....... other matches have no effect 1100 match3 has no effect....... all other matches (m0,m1,m2) trigger to state2 1101 reserved. (no match triggers state sequencer transition) 1110 reserved. (no match triggers state sequencer transition) 1111 reserved. (no match triggers state sequencer transition) address: 0x0027 76543210 r0000 sc3 sc2 sc1 sc0 w reset 0 0 0 00000 = unimplemented or reserved figure 8-10. debug state control register 2 (dbgscr2) table 8-24. dbgscr2 field descriptions field description 3? sc[3:0] these bits select the targeted next state whilst in state2, based upon the match event. table 8-25. state2 ?equencer next state selection sc[3:0] description 0000 any match triggers to state1 0001 any match triggers to state3 table 8-23. state1 sequencer next state selection (continued) sc[3:0] description chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 317 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the trigger priorities described in table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. the sc[3:0] encoding ensures that a match leading to ?al state has priority over all other matches. 8.3.2.7.3 debug state control register 3 (dbgscr3) read: if comrv[1:0] = 10 write: if comrv[1:0] = 10 and s12xdbg is not armed. this register is visible at 0x0027 only with comrv[1:0] = 10. the state control register three selects the targeted next state whilst in state3. the matches refer to the match channels of the comparator match control logic as depicted in figure 8-1 and described in section 8.3.2.8.1 . comparators must be enabled by setting the comparator enable bit in the associated dbgxctl control register. 0010 any match triggers to final state 0011 match3 triggers to state1....... other matches have no effect 0100 match3 triggers to state3....... other matches have no effect 0101 match3 triggers to final state....... other matches have no effect 0110 match0 triggers to state1....... match1 triggers to state3....... other matches have no effect 0111 match1 triggers to state3....... match0 triggers final state....... other matches have no effect 1000 match0 triggers to state1....... match2 triggers to state3....... other matches have no effect 1001 match2 triggers to state3....... match0 triggers final state....... other matches have no effect 1010 match1 triggers to state1....... match3 triggers to state3....... other matches have no effect 1011 match3 triggers to state3....... match1 triggers final state....... other matches have no effect 1100 match2 triggers to state1..... match3 trigger to final state 1101 match2 has no affect, all other matches (m0,m1,m3) trigger to final state 1110 reserved. (no match triggers state sequencer transition) 1111 reserved. (no match triggers state sequencer transition) address: 0x0027 76543210 r0000 sc3 sc2 sc1 sc0 w reset 0 0 0 00000 = unimplemented or reserved figure 8-11. debug state control register 3 (dbgscr3) table 8-26. dbgscr3 field descriptions field description 3? sc[3:0] these bits select the targeted next state whilst in state3, based upon the match event. table 8-25. state2 ?equencer next state selection (continued) sc[3:0] description chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 318 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the trigger priorities described in table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. the sc[3:0] encoding ensures that a match leading to final state has priority over all other matches. 8.3.2.7.4 debug match flag register (dbgmfr) read: if comrv[1:0] = 11 write: never dbgmfr is visible at 0x0027 only with comrv[1:0] = 11. it features four ?g bits each mapped directly to a channel. should a match occur on the channel during the debug session, then the corresponding ?g is set and remains set until the next time the module is armed by writing to the arm bit. thus the contents are retained after a debug session for evaluation purposes. these ?gs cannot be cleared by software, they are cleared only when arming the module. a set ?g does not inhibit the setting of other ?gs. once a ?g is set, further triggers on the same channel have no affect. table 8-27. state3 ?sequencer next state selection sc[3:0] description 0000 any match triggers to state1 0001 any match triggers to state2 0010 any match triggers to final state 0011 match0 triggers to state1....... other matches have no effect 0100 match0 triggers to state2....... other matches have no effect 0101 match0 triggers to final state.......match1 triggers to state1...other matches have no effect 0110 match1 triggers to state1....... other matches have no effect 0111 match1 triggers to state2....... other matches have no effect 1000 match1 triggers to final state....... other matches have no effect 1001 match2 triggers to state2....... match0 triggers to final state....... other matches have no effect 1010 match1 triggers to state1....... match3 triggers to state2....... other matches have no effect 1011 match3 triggers to state2....... match1 triggers to final state....... other matches have no effect 1100 match2 triggers to final state....... other matches have no effect 1101 match3 triggers to final state....... other matches have no effect 1110 reserved. (no match triggers state sequencer transition) 1111 reserved. (no match triggers state sequencer transition) address: 0x0027 76543210 r 0 0 0 0 mc3 mc2 mc1 mc0 w reset 0 0 0 00000 = unimplemented or reserved figure 8-12. debug match flag register (dbgmfr) chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 319 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.8 comparator register descriptions each comparator has a bank of registers that are visible through an 8-byte window in the s12xdbg module register address map. comparators a and c consist of 8 register bytes (3 address bus compare registers, two data bus compare registers, two data bus mask registers and a control register). comparators b and d consist of four register bytes (three address bus compare registers and a control register). each set of comparator registers is accessible in the same 8-byte window of the register address map and can be accessed using the comrv bits in the dbgc1 register. if the comparators b or d are accessed through the 8-byte window, then only the address and control bytes are visible, the 4 bytes associated with data bus and data bus masking read as zero and cannot be written. furthermore the control registers for comparators b and d differ from those of comparators a and c. 8.3.2.8.1 debug comparator control register (dbgxctl) the contents of this register bits 7 and 6 differ depending upon which comparator registers are visible in the 8-byte window of the dbg module register address map. read: anytime. see table 8-29 for visible register encoding. table 8-28. comparator register layout 0x0028 control read/write comparators a,b,c,d 0x0029 address high read/write comparators a,b,c,d 0x002a address medium read/write comparators a,b,c,d 0x002b address low read/write comparators a,b,c,d 0x002c data high comparator read/write comparator a and c only 0x002d data low comparator read/write comparator a and c only 0x002e data high mask read/write comparator a and c only 0x002f data low mask read/write comparator a and c only address: 0x0028 76543210 r0 ndb tag brk rw rwe src compe w reset 0 0 0 00000 = unimplemented or reserved figure 8-13. debug comparator control register (comparators a and c) address: 0x0028 76543210 r sze sz tag brk rw rwe src compe w reset 0 0 0 00000 figure 8-14. debug comparator control register (comparators b and d) chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 320 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 write: if dbg not armed. see table 8-29 for visible register encoding. the dbgc1_comrv bits determine which comparator control, address, data and datamask registers are visible in the 8-byte window from 0x0028 to 0x002f as shown in section table 8-29. table 8-29. comparator address register visibility comrv visible comparator 00 dbgactl, dbgaah ,dbgaam, dbgaal, dbgadh, dbgadl, dbgadhm, dbgadlm 01 dbgbctl, dbgbah, dbgbam, dbgbal 10 dbgcctl, dbgcah, dbgcam, dbgcal, dbgcdh, dbgcdl, dbgcdhm, dbgcdlm 11 dbgdctl, dbgdah, dbgdam, dbgdal table 8-30. dbgxctl field descriptions field description 7 sze (comparators b and d) size comparator enable bit ?the sze bit controls whether access size comparison is enabled for the associated comparator. this bit is ignored if the tag bit in the same register is set. 0 word/byte access size is not used in comparison 1 word/byte access size is used in comparison 6 ndb (comparators a and c not data bus the ndb bit controls whether the match occurs when the data bus matches the comparator register value or when the data bus differs from the register value. furthermore data bus bits can be individually masked using the comparator data mask registers. this bit is only available for comparators a and c. this bit is ignored if the tag bit in the same register is set. this bit position has an sz functionality for comparators b and d. 0 match on data bus equivalence to comparator register contents 1 match on data bus difference to comparator register contents 6 sz (comparators b and d) size comparator value bit ?the sz bit selects either word or byte access size in comparison for the associated comparator. this bit is ignored if the sze bit is cleared or if the tag bit in the same register is set. this bit position has ndb functionality for comparators a and c 0 word access size will be compared 1 byte access size will be compared 5 tag tag select ?this bit controls whether the comparator match will cause a trigger or tag the opcode at the matched address. tagged opcodes trigger only if they reach the execution stage of the instruction queue. 0 trigger immediately on match 1 on match, tag the opcode. if the opcode is about to be executed a trigger is generated 4 brk break ?this bit controls whether a channel match terminates a debug session immediately, independent of state sequencer state. to generate an immediate breakpoint the module breakpoints must be enabled using dbgbrk. 0 the debug session termination is dependent upon the state sequencer and trigger conditions. 1 a match on this channel terminates the debug session immediately; breakpoints if active are generated, tracing, if active, is terminated and the module disarmed. 3 rw read/write comparator value bit the rw bit controls whether read or write is used in compare for the associated comparator . the rw bit is not used if rwe = 0. 0 write cycle will be matched 1 read cycle will be matched 2 rwe read/write enable bit ?the rwe bit controls whether read or write comparison is enabled for the associated comparator. this bit is not used for tagged operations. 0 read/write is not used in comparison 1 read/write is used in comparison chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 321 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 8-31 shows the effect for rwe and rw on the comparison conditions. these bits are not useful for tagged operations since the trigger occurs based on the tagged opcode reaching the execution stage of the instruction queue. thus these bits are ignored if tagged triggering is selected. 8.3.2.8.2 debug comparator address high register (dbgxah) read: anytime. see table 8-29 for visible register encoding. write: if dbg not armed. see table 8-29 for visible register encoding. 1 src determines mapping of comparator to cpu12x or xgate 0 the comparator is mapped to cpu12x buses 1 the comparator is mapped to xgate address and data buses 0 compe determines if comparator is enabled 0 the comparator is not enabled 1 the comparator is enabled for state sequence triggers or tag generation table 8-31. read or write comparison logic table rwe bit rw bit rw signal comment 0 x 0 rw not used in comparison 0 x 1 rw not used in comparison 1 0 0 write 1 0 1 no match 1 1 0 no match 1 1 1 read address: 0x0029 76543210 r0 bit 22 bit 21 bit 20 bit 19 bit 18 bit 17 bit 16 w reset 0 0 0 00000 = unimplemented or reserved figure 8-15. debug comparator address high register (dbgxah) table 8-32. dbgxah field descriptions field description 6? bit[22:16] comparator address high compare bits the comparator address high compare bits control whether the selected comparator will compare the address bus bits [22:16] to a logic one or logic zero. this register byte is ignored for xgate compares. 0 compare corresponding address bit to a logic zero 1 compare corresponding address bit to a logic one table 8-30. dbgxctl field descriptions (continued) field description chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 322 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.8.3 debug comparator address mid register (dbgxam) read: anytime. see table 8-29 for visible register encoding. write: if dbg not armed. see table 8-29 for visible register encoding. 8.3.2.8.4 debug comparator address low register (dbgxal) read: anytime. see table 8-29 for visible register encoding. write: if dbg not armed. see table 8-29 for visible register encoding. address: 0x002a 76543210 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 0 0 0 00000 figure 8-16. debug comparator address mid register (dbgxam) table 8-33. dbgxam field descriptions field description 7? bit[15:8] comparator address mid compare bits ?the comparator address mid compare bits control whether the selected comparator will compare the address bus bits [15:8] to a logic one or logic zero. 0 compare corresponding address bit to a logic zero 1 compare corresponding address bit to a logic one address: 0x002b 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 0 0 0 00000 figure 8-17. debug comparator address low register (dbgxal) table 8-34. dbgxal field descriptions field description 7? bits[7:0] comparator address low compare bits ?the comparator address low compare bits control whether the selected comparator will compare the address bus bits [7:0] to a logic one or logic zero. 0 compare corresponding address bit to a logic zero 1 compare corresponding address bit to a logic one chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 323 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.8.5 debug comparator data high register (dbgxdh) read: anytime. see table 8-29 for visible register encoding. write: if dbg not armed. see table 8-29 for visible register encoding. 8.3.2.8.6 debug comparator data low register (dbgxdl) read: anytime. see table 8-29 for visible register encoding. write: if dbg not armed. see table 8-29 for visible register encoding. address: 0x002c 76543210 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 0 0 0 00000 figure 8-18. debug comparator data high register (dbgxdh) table 8-35. dbgxah field descriptions field description 7? bits[15:8] comparator data high compare bits the comparator data high compare bits control whether the selected comparator compares the data bus bits [15:8] to a logic one or logic zero. the comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. this register is available only for comparators a and c. 0 compare corresponding data bit to a logic zero 1 compare corresponding data bit to a logic one address: 0x002d 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 0 0 0 00000 figure 8-19. debug comparator data low register (dbgxdl) table 8-36. dbgxdl field descriptions field description 7? bits[7:0] comparator data low compare bits the comparator data low compare bits control whether the selected comparator compares the data bus bits [7:0] to a logic one or logic zero. the comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. this register is available only for comparators a and c. 0 compare corresponding data bit to a logic zero 1 compare corresponding data bit to a logic one chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 324 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.3.2.8.7 debug comparator data high mask register (dbgxdhm) read: anytime. see table 8-29 for visible register encoding. write: if dbg not armed. see table 8-29 for visible register encoding. 8.3.2.8.8 debug comparator data low mask register (dbgxdlm) read: anytime. see table 8-29 for visible register encoding. write: if dbg not armed. see table 8-29 for visible register encoding. 8.4 functional description this section provides a complete functional description of the s12xdbg module. if the part is in secure mode, the s12xdbg module can generate breakpoints but tracing is not possible. address: 0x002e 76543210 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 0 0 0 00000 figure 8-20. debug comparator data high mask register (dbgxdhm) table 8-37. dbgxdhm field descriptions field description 7? bits[15:8] comparator data high mask bits ?the comparator data high mask bits control whether the selected comparator compares the data bus bits [15:8] to the corresponding comparator data compare bits. this register is available only for comparators a and c. 0 do not compare corresponding data bit 1 compare corresponding data bit address: 0x002f 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 0 0 0 00000 figure 8-21. debug comparator data low mask register (dbgxdlm) table 8-38. dbgxdlm field descriptions field description 7? bits[7:0] comparator data low mask bits ?the comparator data low mask bits control whether the selected comparator compares the data bus bits [7:0] to the corresponding comparator data compare bits. this register is available only for comparators a and c. 0 do not compare corresponding data bit 1 compare corresponding data bit chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 325 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.1 s12xdbg operation arming the s12xdbg module by setting arm in dbgc1 allows triggering, and storing of data in the trace buffer and can be used to cause breakpoints to the cpu12x or the xgate module. the dbg module is made up of four main blocks, the comparators, control logic, the state sequencer, and the trace buffer. the comparators monitor the bus activity of the cpu12x and xgate. comparators can be con?ured to monitor address and databus. comparators can also be con?ured to mask out individual data bus bits during a compare and to use r/w and word/byte access quali?ation in the comparison. when a match with a comparator register value occurs the associated control logic can trigger the state sequencer to another state (see figure 8-22 ). either forced or tagged triggers are possible. using a forced trigger, the trigger is generated immediately on a comparator match. using a tagged trigger, at a comparator match, the instruction opcode is tagged and only if the instruction reaches the execution stage of the instruction queue is a trigger generated. in the case of a transition to final state, bus tracing is triggered and/or a breakpoint can be generated. tracing of both cpu12x and/or xgate bus activity is possible. independent of the state sequencer, a breakpoint can be triggered by the external t a ghi / t a glo signals or by an xgate s/w breakpoint request or by writing to the trig bit in the dbgc1 control register. the trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. 8.4.2 comparator modes the s12xdbg contains four comparators, a, b, c, and d. each comparator can be con?ured to monitor cpu12x or xgate buses. each comparator compares the selected address bus with the address stored in dbgxah, dbgxam, and dbgxal. furthermore, comparators a and c also compare the data buses to the data stored in dbgxdh, dbgxdl and allow masking of individual data bus bits. s12x comparator matches are disabled in bdm and during bdm accesses. the comparator match control logic con?ures comparators to monitor the buses for an exact address or an address range. the comparator con?uration is controlled by the control register contents and the range control by the dbgc2 contents. on a match a trigger can initiate a transition to another state sequencer state (see section 8.4.3 ). the comparator control register also allows the type of access to be included in the comparison through the use of the rwe, rw, sze, and sz bits. the rwe bit controls whether read or write comparison is enabled for the associated comparator and the rw bit selects either a read or write access for a valid match. similarly the sze and sz bits allows the size of access (word or byte) to be considered in the compare. only comparators b and d feature sze and sz. the tag bit in each comparator control register is used to determine the triggering condition. by setting tag, the comparator will qualify a match with the output of opcode tracking logic and a trigger occurs before the tagged instruction executes (tagged-type trigger). whilst tagging, the rw, rwe, sze, and sz bits are ignored and the comparator register must be loaded with the exact opcode address. if the tag bit is clear (forced type trigger) a comparator match is generated when the selected address appears on the system address bus. if the selected address is an opcode address, the match is generated chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 326 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 when the opcode is fetched from the memory. this precedes the instruction execution by an inde?ite number of cycles due to instruction pipe lining. for a comparator match of an opcode at an odd address when tag = 0, the corresponding even address must be contained in the comparator register. thus for an opcode at odd address (n), the comparator register must contain address (n?). once a successful comparator match has occurred, the condition that caused the original match is not veri?d again on subsequent matches. thus if a particular data value is veri?d at a given address, this address may not still contain that data value when a subsequent match occurs. comparators c and d can also be used to select an address range to trace from. this is determined by the trange bits in the dbgtcr register. the trange encoding is shown in table 8-12 . if the trange bits select a range de?ition using comparator d, then comparator d is con?ured for trace range de?ition and cannot be used for address bus comparisons. similarly if the trange bits select a range de?ition using comparator c, then comparator c is con?ured for trace range de?ition and cannot be used for address bus comparisons. match[0, 1, 2, 3] map directly to comparators[a, b, c, d] respectively, except in range modes (see section 8.3.2.4 ). comparator priority rules are described in the trigger priority section ( section 8.4.3.6? . 8.4.2.1 exact address comparator match (comparators a and c) with range comparisons disabled, the match condition is an exact equivalence of address/data bus with the value stored in the comparator address/data registers. further quali?ation of the type of access (r/w, word/byte) is possible. comparators a and c do not feature sze or sz control bits, thus the access size is not compared. table 8- 40 lists access considerations without data bus compare. table 8-39 lists access considerations with data bus comparison. to compare byte accesses dbgxdh must be loaded with the data byte, the low byte must be masked out using the dbgxdlm mask register. on word accesses the data byte of the lower address is mapped to dbgxdh. code may contain various access forms of the same address, i.e. a word access of addr[n] or byte access of addr[n+1] both access n+1. at a word access of addr[n], address addr[n+1] does not appear on the address bus and so cannot cause a comparator match if the comparator contains addr[n]. thus it is not possible to monitor all data accesses of addr[n+1] with one comparator. to detect an access of addr[n+1] through a word access of addr[n] the comparator can be configured to addr[n], dbgxdl is loaded with the data pattern and dbgxdhm is cleared so only the data[n+1] is compared on accesses of addr[n]. table 8-39. comparator a and c data bus considerations access address dbgxdh dbgxdl dbgxdhm dbgxdlm example valid match word addr[n] data[n] data[n+1] $ff $ff movw #$word addr[n] con?1 byte addr[n] data[n] x $ff $00 movb #$byte addr[n] con?2 word addr[n] data[n] x $ff $00 movw #$word addr[n] con?2 word addr[n] x data[n+1] $00 $ff movw #$word addr[n] con?3 chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 327 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note using this configuration, a byte access of addr[n] can cause a comparator match if the databus low byte by chance contains the same value as addr[n+1] because the databus comparator does not feature access size comparison and uses the mask as a ?on? care?function. thus masked bits do not prevent a match. comparators a and c feature an ndb control bit to determine if a match occurs when the data bus differs to comparator register contents or when the data bus is equivalent to the comparator register contents. 8.4.2.2 exact address comparator match (comparators b and d) comparators b and d feature sz and sze control bits. if sze is clear, then the comparator address match quali?ation functions the same as for comparators a and c. if the sze bit is set the access size (word or byte) is compared with the sz bit value such that only the speci?d type of access causes a match. thus if con?ured for a byte access of a particular address, a word access covering the same address does not lead to match. 8.4.2.3 data bus comparison ndb dependency comparators a and c each feature an ndb control bit, which allows data bus comparators to be con?ured to either trigger on equivalence or trigger on difference. this allows monitoring of a difference in the contents of an address location from an expected value. when matching on an equivalence (ndb=0), each individual data bus bit position can be masked out by clearing the corresponding mask bit (dbgxdhm/dbgxdlm), so that it is ignored in the comparison. a match occurs when all data bus bits with corresponding mask bits set are equivalent. if all mask register bits are clear, then a match is based on the address bus only, the data bus is ignored. when matching on a difference, mask bits can be cleared to ignore bit positions. a match occurs when any data bus bit with corresponding mask bit set is different. clearing all mask bits, causes all bits to be ignored and prevents a match because no difference can be detected. in this case address bus equivalence does not cause a match. table 8-40. comparator access size considerations comparator address sze sz8 condition for valid match comparators a and c addr[n] word and byte accesses of addr[n] (1) movb #$byte addr[n] movw #$word addr[n] 1. a word access of addr[n-1] also accesses addr[n] but does not generate a match. the comparator address register must contain the exact address used in the code. comparators b and d addr[n] 0 x word and byte accesses of addr[n] 1 movb #$byte addr[n] movw #$word addr[n] comparators b and d addr[n] 1 0 word accesses of addr[n] 1 movw #$word addr[n] comparators b and d addr[n] 1 1 byte accesses of addr[n] movb #$byte addr[n] chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 328 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.2.4 range comparisons when using the ab comparator pair for a range comparison, the data bus can also be used for quali?ation by using the comparator a data and data mask registers. furthermore the dbgactl rw and rwe bits can be used to qualify the range comparison on either a read or a write access. the corresponding dbgbctl bits are ignored. similarly when using the cd comparator pair for a range comparison, the data bus can also be used for quali?ation by using the comparator c data and data mask registers. furthermore the dbgcctl rw and rwe bits can be used to qualify the range comparison on either a read or a write access if tagging is not selected. the corresponding dbgdctl bits are ignored. the sze and sz control bits are ignored in range mode. the comparator a and c tag bits are used to tag range comparisons for the ab and cd ranges respectively. the comparator b and d tag bits are ignored in range modes. in order for a range comparison using comparators a and b, both compea and compeb must be set; to disable range comparisons both must be cleared. similarly for a range cd comparison, both compec and comped must be set. if a range mode is selected srca and srcc select the source (s12x or xgate), srcb and srcd are ignored. the comparator a and c brk bits are used for the ab and cd ranges respectively, the comparator b and d brk bits are ignored in range mode. when con?ured for range comparisons and tagging, the ranges are accurate only to word boundaries. 8.4.2.4.1 inside range (compac_addr address compbd_addr) in the inside range comparator mode, either comparator pair a and b or comparator pair c and d can be con?ured for range comparisons by the control register (dbgc2). the match condition requires that a valid match for both comparators happens on the same bus cycle. a match condition on only one comparator is not valid. an aligned word access which straddles the range boundary will cause a trigger only if the aligned address is inside the range. 8.4.2.4.2 outside range (address < compac_addr or address > compbd_addr) in the outside range comparator mode, either comparator pair a and b or comparator pair c and d can be con?ured for range comparisons. a single match condition on either of the comparators is recognized as valid. an aligned word access which straddles the range boundary will cause a trigger only if the aligned address is outside the range. outside range mode in combination with tagged triggers can be used to detect if the opcode fetches are from an unexpected range. in forced trigger modes the outside range trigger would typically be activated at any interrupt vector fetch or register access. this can be avoided by setting the upper or lower range limit to $7fffff or $000000 respectively. interrupt vector fetches do not cause taghits table 8-41. ndb and mask bit dependency ndb dbgxdhm[n] / dbgxdlm[n] comment 0 0 do not compare data bus bit. 0 1 compare data bus bit. match on equivalence. 1 0 do not compare data bus bit. 1 1 compare data bus bit. match on difference. chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 329 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 when comparing the xgate address bus in outside range mode, the initial vector fetch as determined by the vector contained in the xgate xgvbr register should be taken into consideration. the xgvbr register and hence vector address can be modi?d. 8.4.3 trigger modes trigger modes are used as quali?rs for a state sequencer change of state. the control logic determines the trigger mode and provides a trigger to the state sequencer. the individual trigger modes are described in the following sections. 8.4.3.1 forced trigger on comparator match if a forced trigger comparator match occurs, the trigger immediately initiates a transition to the next state sequencer state whereby the corresponding ?gs in dbgsr are set. the state control register for the current state determines the next state for each trigger. forced triggers are generated as soon as the matching address appears on the address bus, which in the case of opcode fetches occurs several cycles before the opcode execution. for this reason a forced trigger at an opcode address precedes a tagged trigger at the same address by several cycles. 8.4.3.2 trigger on comparator related taghit if a cpu12x or xgate taghit occurs, a transition to another state sequencer state is initiated and the corresponding dbgsr ?gs are set. for a comparator related taghit to occur, the s12xdbg must ?st generate tags based on comparator matches. when the tagged instruction reaches the execution stage of the instruction queue a taghit is generated by the cpu12x/xgate. the state control register for the current state determines the next state for each trigger. 8.4.3.3 external tagging trigger the t a glo and t a ghi pins (mapped to device pins) can be used to tag an instruction. this function can be used as another breakpoint source. when the tagged opcode reaches the execution stage of the instruction queue a transition to the disarmed state0 occurs, ending the debug session and generating a breakpoint, if breakpoints are enabled. external tagging is only possible in device emulation modes. 8.4.3.4 trigger on xgate s/w breakpoint request the xgate s/w breakpoint request issues a forced breakpoint request to the cpu12x immediately and triggers the state sequencer into the disarmed state. active tracing sessions are terminated immediately, thus if tracing has not yet begun, no trace information is stored. xgate generated breakpoints are independent of the dbgbrk bits. the xgsbpe bit in dbgc1 determines if the xgate s/w breakpoint function is enabled. the bdm bit in dbgc1 determines if the xgate requested breakpoint causes the system to enter bdm mode or initiate a software interrupt (swi). 8.4.3.5 trig immediate trigger independent of comparator matches or external tag signals it is possible to initiate a tracing session and/or breakpoint by writing the trig bit in dbgc1 to a logic ?? if con?ured for begin or mid aligned tracing, chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 330 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 this triggers the state sequencer into the final state, if con?ured for end alignment, setting the trig bit disarms the module, ending the session. if breakpoints are enabled, a forced breakpoint request is issued immediately (end alignment) or when tracing has completed (begin or mid alignment). 8.4.3.6 trigger priorities in case of simultaneous triggers, the priority is resolved according to table 8-42 . the lower priority trigger is suppressed. it is thus possible to miss a lower priority trigger if it occurs simultaneously with a trigger of a higher priority. the trigger priorities described in table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. the sc[3:0] encoding ensures that a match leading to ?al state has priority over all other matches in each state sequencer state. when con?ured for range modes a simultaneous match of comparators a and c generates an active match0 whilst match2 is suppressed. if a write access to dbgc1 with the arm bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the arm bit is cleared due to the hardware disarm. 8.4.4 state sequence control figure 8-22. state sequencer diagram the state sequencer allows a de?ed sequence of events to provide a trigger point for tracing of data in the trace buffer. once the s12xdbg module has been armed by setting the arm bit in the dbgc1 register, table 8-42. trigger priorities priority source action highest xgate bkp immediate forced breakpoint......(tracing terminated immediately). trig trigger immediately to ?al state (begin or mid aligned tracing enabled) trigger immediately to state 0 (end aligned or no tracing enabled) external taghi/taglo enter state0 match0 (force or tag hit) trigger to next state as de?ed by state control registers match1 (force or tag hit) trigger to next state as de?ed by state control registers match2 (force or tag hit) trigger to next state as de?ed by state control registers lowest match3 (force or tag hit) trigger to next state as de?ed by state control registers state1 final state state3 arm = 1 session complete (disarm) state2 state 0 (disarmed) arm = 0 arm = 0 arm = 0 chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 331 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 then state1 of the state sequencer is entered. further transitions between the states are then controlled by the state control registers and depend upon a selected trigger mode condition being met. from final state the only permitted transition is back to the disarmed state0. transition between any of the states 1 to 3 is not restricted. each transition updates the ssf[2:0] ?gs in dbgsr accordingly to indicate the current state. alternatively by setting the trig bit in dbgsc1, the state machine can be triggered to state0 or final state depending on tracing alignment. a tag hit through t a ghi/ t a glo brings the state sequencer immediately into state0, causes a breakpoint, if breakpoints are enabled, and ends tracing immediately independent of the trigger alignment bits talign[1:0]. independent of the state sequencer, each comparator channel can be individually con?ured to generate an immediate breakpoint when a match occurs through the use of the brk bits in the dbgxctl registers. thus it is possible to generate an immediate breakpoint on selected channels, whilst a state sequencer transition can be initiated by a match on other channels. if a debug session is ended by a trigger on a channel with brk = 1, the state sequencer transitions through final state for a clock cycle to state0. this is independent of tracing and breakpoint activity, thus with tracing and breakpoints disabled, the state sequencer enters state0 and the debug module is disarmed. an xgate s/w breakpoint request, if enabled causes a transition to the state0 and generates a breakpoint request to the cpu12x immediately 8.4.4.1 final state on entering final state a trigger may be issued to the trace buffer according to the trace position control as de?ed by the talign ?ld (see section 8.3.2.3 ). if tsource in the trace control register dbgtcr are cleared then the trace buffer is disabled and the transition to final state can only generate a breakpoint request. in this case or upon completion of a tracing session when tracing is enabled, the arm bit in the dbgc1 register is cleared, returning the module to the disarmed state0. if tracing is enabled, a breakpoint request can occur at the end of the tracing session. if neither tracing nor breakpoints are enabled then when the ?al state is reached it returns automatically to state0 and the debug module is disarmed. 8.4.5 trace buffer operation the trace buffer is a 64 lines deep by 64-bits wide ram array. the s12xdbg module stores trace information in the ram array in a circular buffer format. the ram array can be accessed through a register window (dbgtbh:dbgtbl) using 16-bit wide word accesses. after each complete 64-bit trace buffer line is read, an internal pointer into the ram is incremented so that the next read will receive fresh information. data is stored in the format shown in table 8-43 . after each store the counter register bits dbgcnt[6:0] are incremented. tracing of cpu12x activity is disabled when the bdm is active but tracing of xgate activity is still possible. reading the trace buffer whilst the dbg is armed returns invalid data and the trace buffer pointer is not incremented. chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 332 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.5.1 trace trigger alignment using the talign bits (see section 8.3.2.3 ) it is possible to align the trigger with the end, the middle, or the beginning of a tracing session. if end or mid tracing is selected, tracing begins when the arm bit in dbgc1 is set and state1 is entered. the transition to final state if end is selected signals the end of the tracing session. the transition to final state if mid is selected signals that another 32 lines will be traced before ending the tracing session. tracing with begin-trigger starts at the opcode of the trigger. 8.4.5.1.1 storing with begin-trigger storing with begin-trigger, data is not stored in the trace buffer until the final state is entered. once the trigger condition is met the s12xdbg module will remain armed until 64 lines are stored in the trace buffer. if the trigger is at the address of the change-of-?w instruction the change of ?w associated with the trigger will be stored in the trace buffer. using begin-trigger together with tagging, if the tagged instruction is about to be executed then the trace is started. upon completion of the tracing session the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 8.4.5.1.2 storing with mid-trigger storing with mid-trigger, data is stored in the trace buffer as soon as the s12xdbg module is armed. when the trigger condition is met, another 32 lines will be traced before ending the tracing session, irrespective of the number of lines stored before the trigger occurred, then the s12xdbg module is disarmed and no more data is stored. using mid-trigger with tagging, if the tagged instruction is about to be executed then the trace is continued for another 32 lines. upon tracing completion the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 8.4.5.1.3 storing with end-trigger storing with end-trigger, data is stored in the trace buffer until the final state is entered, at which point the s12xdbg module will become disarmed and no more data will be stored. if the trigger is at the address of a change of ?w instruction the trigger event will not be stored in the trace buffer. 8.4.5.2 trace modes the s12xdbg module can operate in four trace modes. the mode is selected using the trcmod bits in the dbgtcr register. in each mode tracing of xgate or cpu12x information is possible. the source for the trace is selected using the tsource bits in the dbgtcr register. the modes are described in the following subsections. the trace buffer organization is shown in table 8-43 . 8.4.5.2.1 normal mode in normal mode, change of ?w (cof) program counter (pc) addresses will be stored. cof addresses are de?ed as follows for the cpu12x: source address of taken conditional branches (long, short, bit-conditional, and loop primitives) destination address of indexed jmp, jsr, and call instruction chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 333 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 destination address of rti, rts, and rtc instructions. vector address of interrupts, except for swi and bdm vectors lbra, bra, bsr, bgnd as well as non-indexed jmp, jsr, and call instructions are not classi?d as change of ?w and are not stored in the trace buffer. cof addresses are de?ed as follows for the xgate: source address of taken conditional branches destination address of indexed jal instructions. first xgate code address in a thread change-of-?w addresses stored include the full 23-bit address bus of cpu12x, the 16-bit address bus for the xgate module and an information byte, which contains a source/destination bit to indicate whether the stored address was a source address or destination address. note when an cpu12x cof instruction with destination address is executed, the destination address is stored to the trace buffer on instruction completion, indicating the cof has taken place. if an interrupt occurs simultaneously then the next instruction carried out is actually from the interrupt service routine. the instruction at the destination address of the original program ?w gets exectuted after the interrupt service routine. in the following example an irq interrupt occurs during execution of the indexed jmp at address mark1. the brn at the destination (sub_1) is not executed until after the irq service routine but the destination address is entered into the trace buffer to indicate that the indexed jmp cof has taken place. ldx #sub_1 mark1 jmp 0,x ; irq interrupt occurs during execution of this mark2 nop ; sub_1 brn * ; jmp destination address trace buffer entry 1 ; rti destination address trace buffer entry 3 nop ; addr1 dbne a,part5 ; source address trace buffer entry 4 irq_isr ldab #$f0 ; irq vector $fff2 = trace buffer entry 2 stab var_c1 rti ; the execution ?w taking into account the irq is as follows ldx #sub_1 mark1 jmp 0,x ; irq_isr ldab #$f0 ; stab var_c1 rti ; sub_1 brn * nop ; addr1 dbne a,part5 ; chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 334 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.5.2.2 loop1 mode loop1 mode, similarly to normal mode also stores only cof address information to the trace buffer, it however allows the ?tering out of redundant information. the intent of loop1 mode is to prevent the trace buffer from being ?led entirely with duplicate information from a looping construct such as delays using the dbne instruction or polling loops using brset/brclr instructions. immediately after address information is placed in the trace buffer, the s12xdbg module writes this value into a background register. this prevents consecutive duplicate address entries in the trace buffer resulting from repeated branches. loop1 mode only inhibits consecutive duplicate source address entries that would typically be stored in most tight looping constructs. it does not inhibit repeated entries of destination addresses or vector addresses, since repeated entries of these would most likely indicate a bug in the user s code that the s12xdbg module is designed to help ?d. 8.4.5.2.3 detail mode in detail mode, address and data for all memory and register accesses is stored in the trace buffer. in the case of xgate tracing this means that initialization of the r1 register during a vector fetch is not traced. this mode also features information byte entries to the trace buffer, for each address byte entry. the information byte indicates the size of access (word or byte) and the type of access (read or write). when tracing cpu12x activity in detail mode, all cycles are traced except those when the cpu12x is either in a free or opcode fetch cycle. in this mode the xgate program counter is also traced to provide a snapshot of the xgate activity. cxinf information byte bits indicate the type of xgate activity occurring at the time of the trace buffer entry. when tracing cpu12x activity alone in detail mode, the address range can be limited to a range speci?d by the trange bits in dbgtcr. this function uses comparators c and d to de?e an address range inside which cpu12x activity should be traced (see table 8-43 ). thus the traced cpu12x activity can be restricted to particular register range accesses. when tracing xgate activity in detail mode, all load and store cycles are traced. additionally the cpu12x program counter is stored at the time of the xgate trace buffer entry to provide a snapshot of cpu12x activity. 8.4.5.2.4 pure pc mode in pure pc mode, tracing from the cpu the pc addresses of all executed opcodes, including illegal opcodes, are stored. in pure pc mode, tracing from the xgate the pc addresses of all executed opcodes are stored. 8.4.5.3 trace buffer organization referring to table 8-43 . an x pre? denotes information from the xgate module, a c pre? denotes information from the cpu12x. adrh, adrm, adrl denote address high, middle and low byte respectively. inf bytes contain control information (r/w, s/d etc.). the numerical suf? indicates which tracing step. the information format for loop1 mode and purepc mode is the same as that of normal mode. whilst tracing from xgate or cpu12x only, in normal or loop1 modes each array line contains chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 335 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 2 data entries, thus in this case the dbgcnt[0] is incremented after each separate entry. in detail mode dbgcnt[0] remains cleared whilst the other dbgcnt bits are incremented on each trace buffer entry. xgate and cpu12x cofs occur independently of each other and the pro?e of cofs for the two sources is totally different. when both sources are being traced in normal or loop1 mode, for each cof from one source, there may be many cofs from the other source, depending on user code. cof events could occur far from each other in the time domain, on consecutive cycles or simultaneously. when a cof occurs in either source (s12x or xgate) a trace buffer entry is made and the corresponding cdv or xdv bit is set. the current pc of the other source is simultaneously stored to the trace buffer even if no cof has occurred, in which case cdv/xdv remains cleared indicating the address is not associated with a cof, but is simply a snapshot of the pc contents at the time of the cof from the other source. single byte data accesses in detail mode are always stored to the low byte of the trace buffer (cdatal or xdatal) and the high byte is cleared. when tracing word accesses, the byte at the lower address is always stored to trace buffer byte3 and the byte at the higher address is stored to byte2 table 8-43. trace buffer organization mode 8-byte wide word buffer 76543210 xgate detail cxinf1 cadrh1 cadrm1 cadrl1 xdatah1 xdatal1 xadrm1 xadrl1 cxinf2 cadrh2 cadrm2 cadrl2 xdatah2 xdatal2 xadrm2 xadrl2 cpu12x detail cxinf1 cadrh1 cadrm1 cadrl1 cdatah1 cdatal1 xadrm1 xadrl1 cxinf2 cadrh2 cadrm2 cadrl2 cdatah2 cdatal2 xadrm2 xadrl2 both other modes xinf0 xpcm0 xpcl0 cinf0 cpch0 cpcm0 cpcl0 xinf1 xpcm1 xpcl1 cinf1 cpch1 cpcm1 cpcl1 xgate other modes xinf1 xpcm1 xpcl1 xinf0 xpcm0 xpcl0 xinf3 xpcm3 xpcl3 xinf2 xpcm2 xpcl2 cpu12x other modes cinf1 cpch1 cpcm1 cpcl1 cinf0 cpch0 cpcm0 cpcl0 cinf3 cpch3 cpcm3 cpcl3 cinf2 cpch2 cpcm2 cpcl2 chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 336 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.5.3.1 information byte organization the format of the control information byte is dependent upon the active trace mode as described below. in normal, loop1, or pure pc modes tracing of xgate activity, xinf is used to store control information. in normal, loop1, or pure pc modes tracing of cpu12x activity, cinf is used to store control information. in detail mode, cxinf contains the control information xgate information byte xgate info bit setting figure 8-24. xgate info bit setting figure 8-24 indicates the xgate information bit setting when switching between threads, the initial thread starting at sot1 and continuing at cot1 after the higher priority thread2 has ended. bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 xsd xsot xcot xdv 0 0 0 0 figure 8-23. xgate information byte xinf table 8-44. xinf field descriptions field description 7 xsd source destination indicator this bit indicates if the corresponding stored address is a source or destination address. this is only used in normal and loop1 mode tracing. 0 source address 1 destination address or start of thread or continuation of thread 6 xsot start of thread indicator ?this bit indicates that the corresponding stored address is a start of thread address. this is only used in normal and loop1 mode tracing. note. this bit only has effect on devices where the xgate module supports multiple interrupt levels . 0 stored address not from a start of thread 1 stored address from a start of thread 5 xcot continuation of thread indicator ?this bit indicates that the corresponding stored address is the ?st address following a return from a higher priority thread. this is only used in normal and loop1 mode tracing. note. this bit only has effect on devices where the xgate module supports multiple interrupt levels. 0 stored address not from a continuation of thread 1 stored address from a continuation of thread 4 xdv data invalid indicator ?this bit indicates if the trace buffer entry is invalid. it is only used when tracing from both sources in normal, loop1 and pure pc modes, to indicate that the xgate trace buffer entry is valid. 0 trace buffer entry is invalid 1 trace buffer entry is valid xgate flow xsot jal xsd sot1 sot2 rts cot1 rts xcot chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 337 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 cpu12x information byte cxinf information byte this describes the format of the information byte used only when tracing in detail mode. when tracing from the cpu12x in detail mode, information is stored to the trace buffer on all cycles except opcode fetch and free cycles. the xgate entry stored on the same line is a snapshot of the xgate program counter. in this case the csz and crw bits indicate the type of access being made by the cpu12x, whilst the xack and xocf bits indicate if the simultaneous xgate cycle is a free cycle (no bus acknowledge) or opcode fetch cycle. similarly when tracing from the xgate in detail mode, information is stored to the trace buffer on all cycles except opcode fetch and free cycles. the cpu12x entry stored on the same line is a snapshot of the cpu12x program counter. in this case the xsz and xrw bits indicate the type of access being made by the xgate, whilst the cfree and cocf bits indicate if the simultaneous cpu12x cycle is a free cycle or opcode fetch cycle. bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 csd cva 0 cdv 0 0 0 0 figure 8-25. cpu12x information byte cinf table 8-45. cinf field descriptions field description 7 csd source destination indicator this bit indicates if the corresponding stored address is a source or destination address. this is only used in normal and loop1 mode tracing. 0 source address 1 destination address 6 cva vector indicator this bit indicates if the corresponding stored address is a vector address.. vector addresses are destination addresses, thus if cva is set, then the corresponding csd is also set. this is only used in normal and loop1 mode tracing. this bit has no meaning in pure pc mode. 0 indexed jump destination address 1 vector destination address 4 cdv data invalid indicator ?this bit indicates if the trace buffer entry is invalid. it is only used when tracing from both sources in normal, loop1 and pure pc modes, to indicate that the cpu12x trace buffer entry is valid. 0 trace buffer entry is invalid 1 trace buffer entry is valid bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 cfree csz crw cocf xack xsz xrw xocf figure 8-26. information byte cxinf table 8-46. cxinf field descriptions field description 7 cfree cpu12x free cycle indicato r this bit indicates if the stored cpu12x address corresponds to a free cycle. this bit only contains valid information when tracing the xgate accesses in detail mode. 0 stored information corresponds to free cycle 1 stored information does not correspond to free cycle chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 338 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.5.4 reading data from trace buffer the data stored in the trace buffer can be read using either the background debug module (bdm) module, the xgate or the cpu12x provided the s12xdbg module is not armed, is con?ured for tracing and the system not secured. when the arm bit is written to 1 the trace buffer is locked to prevent reading. the trace buffer can only be unlocked for reading by an aligned word write to dbgtb when the module is disarmed. the trace buffer can only be read through the dbgtb register using aligned word reads, any byte or misaligned reads return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. the trace buffer data is read out ?st-in ?st-out. by reading cnt in dbgcnt the number of valid 64-bit lines can be determined. dbgcnt will not decrement as data is read. whilst reading an internal pointer is used to determine the next line to be read. after a tracing session, the pointer points to the oldest data entry, thus if no over?w has occurred, the pointer points to line0, otherwise it points to the line with the oldest entry. the pointer is initialized by each aligned write to dbgtbh to point to the oldest data again. this enables an interrupted trace buffer read sequence to be easily restarted from the oldest data entry. 6 csz access type indicator this bit indicates if the access was a byte or word size access.this bit only contains valid information when tracing cpu12x activity in detail mode. 0 word access 1 byte access 5 crw read write indicator ?this bit indicates if the corresponding stored address corresponds to a read or write access. this bit only contains valid information when tracing cpu12x activity in detail mode. 0 write access 1 read access 4 cocf cpu12x opcode fetch indicator ?this bit indicates if the stored address corresponds to an opcode fetch cycle. this bit only contains valid information when tracing the xgate accesses in detail mode. 0 stored information does not correspond to opcode fetch cycle 1 stored information corresponds to opcode fetch cycle 3 xack xgate access indicator this bit indicates if the stored xgate address corresponds to a free cycle. this bit only contains valid information when tracing the cpu12x accesses in detail mode. 0 stored information corresponds to free cycle 1 stored information does not correspond to free cycle 2 xsz access type indicator this bit indicates if the access was a byte or word size access. this bit only contains valid information when tracing xgate activity in detail mode. 0 word access 1 byte access 1 xrw read write indicator ?this bit indicates if the corresponding stored address corresponds to a read or write access. this bit only contains valid information when tracing xgate activity in detail mode. 0 write access 1 read access 0 xocf xgate opcode fetch indicator ?this bit indicates if the stored address corresponds to an opcode fetch cycle.this bit only contains valid information when tracing the cpu12x accesses in detail mode. 0 stored information does not correspond to opcode fetch cycle 1 stored information corresponds to opcode fetch cycle table 8-46. cxinf field descriptions (continued) field description chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 339 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the least signi?ant word of each 64-bit wide array line is read out ?st. this corresponds to the bytes 1 and 0 of table 8-43 . the bytes containing invalid information (shaded in table 8-43 ) are also read out. reading the trace buffer while the s12xdbg module is armed will return invalid data and no shifting of the ram pointer will occur. 8.4.5.5 trace buffer reset state the trace buffer contents are not initialized by a system reset. thus should a system reset occur, the trace session information from immediately before the reset occurred can be read out. the dbgcnt bits are not cleared by a system reset. thus should a reset occur, the number of valid lines in the trace buffer is indicated by dbgcnt. the internal pointer to the current trace buffer address is initialized by unlocking the trace buffer thus points to the oldest valid data even if a reset occurred during the tracing session. generally debugging occurrences of system resets is best handled using mid or end trigger alignment since the reset may occur before the trace trigger, which in the begin trigger alignment case means no information would be stored in the trace buffer. note an external pin reset that occurs simultaneous to a trace buffer entry can, in very seldom cases, lead to either that entry being corrupted or the ?st entry of the session being corrupted. in such cases the other contents of the trace buffer still contain valid tracing information. the case occurs when the reset assertion coincides with the trace buffer entry clock edge. 8.4.6 tagging a tag follows program information as it advances through the instruction queue. when a tagged instruction reaches the head of the queue a tag hit occurs and triggers the state sequencer. each comparator control register features a tag bit, which controls whether the comparator match will cause a trigger immediately or tag the opcode at the matched address. if a comparator is enabled for tagged comparisons, the address stored in the comparator match address registers must be an opcode address for the trigger to occur. both cpu12x and xgate opcodes can be tagged with the comparator register tag bits. using begin trigger together with tagging, if the tagged instruction is about to be executed then the transition to the next state sequencer state occurs. if the transition is to the final state, tracing is started. only upon completion of the tracing session can a breakpoint be generated. similarly using mid trigger with tagging, if the tagged instruction is about to be executed then the trace is continued for another 32 lines. upon tracing completion the breakpoint is generated. using end trigger, when the tagged instruction is about to be executed and the next transition is to final state then a breakpoint is generated immediately, before the tagged instruction is carried out. read/write (r/w), access size (sz) monitoring and data bus monitoring is not useful if tagged triggering is selected, since the tag is attached to the opcode at the matched address and is not dependent on the data bus nor on the type of access. thus these bits are ignored if tagged triggering is selected. when con?ured for range comparisons and tagging, the ranges are accurate only to word boundaries. chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 340 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 s12x tagging is disabled when the bdm becomes active. xgate tagging is possible when the bdm is active. 8.4.6.1 external tagging using t a ghi and t a glo external tagging using the external t a ghi and t a glo pins can only be used to tag cpu12x opcodes; tagging of xgate code using these pins is not possible. an external tag triggers the state sequencer into state0 when the tagged opcode reaches the execution stage of the instruction queue. the pins operate independently, thus the state of one pin does not affect the function of the other. external tagging is possible in emulation modes only. the presence of logic level 0 on either pin at the rising edge of the external clock (eclk) performs the function indicated in the table 8-47 . it is possible to tag both bytes of an instruction word. if a taghit occurs, a breakpoint can be generated as de?ed by the dbgbrk and bdm bits in dbgc1. each time t a ghi or t a glo are low on the rising edge of eclk, the old tag is replaced by a new one. 8.4.6.2 unconditional tagging function in emulation modes a low assertion of pe5/ t a glo/moda in the 7th or 8th bus cycle after reset enables the unconditional tagging function, allowing immediate tagging via t a ghi/ t a glo with breakpoint to bdm independent of the arm, bdm and dbgbrk bits. conversely these bits are not affected by unconditional tagging. the unconditional tagging function remains enabled until the next reset. this function allows an immediate entry to bdm in emulation modes before user code execution. the t a glo assertion must be in the 7th or 8th bus cycle following the end of reset, whereby the prior reset pin assertion lasts the full 192 bus cycles. 8.4.7 breakpoints breakpoints can be generated as follows. through xgate software breakpoint requests. from comparator channel triggers to ?al state. using software to write to the trig bit in the dbgc1 register. from taghits generated using the external t a ghi and t a glo pins. breakpoints generated by the xgate module or via the bdm background command have no affect on the cpu12x in stop or wait mode. table 8-47. tag pin function t a ghi t a glo tag 1 1 no tag 1 0 low byte 0 1 high byte 0 0 both bytes chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 341 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.7.1 xgate software breakpoints the xgate software breakpoint instruction brk can request a cpu12x breakpoint, via the s12xdbg module. in this case, if the xgsbpe bit is set, the s12xdbg module immediately generates a forced breakpoint request to the cpu12x, the state sequencer is returned to state0 and tracing, if active, is terminated. if con?ured for begin trigger and tracing has not yet been triggered from another source, the trace buffer contains no information. breakpoint requests from the xgate module do not depend upon the state of the dbgbrk or arm bits in dbgc1. they depend solely on the state of the xgsbpe and bdm bits. thus it is not necessary to arm the dbg module to use xgate software breakpoints to generate breakpoints in the cpu12x program ?w, but it is necessary to set xgsbpe. furthermore, if a breakpoint to bdm is required, the bdm bit must also be set. when the xgate requests an cpu12x breakpoint, the xgate program ?w stops by default, independent of the s12xdbg module. 8.4.7.2 breakpoints from internal comparator channel final state triggers breakpoints can be generated when internal comparator channels trigger the state sequencer to the final state. if con?ured for tagging, then the breakpoint is generated when the tagged opcode reaches the execution stage of the instruction queue. if a tracing session is selected by tsource, breakpoints are requested when the tracing session has completed, thus if begin or mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see table 8-48 ). if no tracing session is selected, breakpoints are requested immediately. if the brk bit is set on the triggering channel, then the breakpoint is generated immediately independent of tracing trigger alignment. table 8-48. breakpoint setup for both xgate and cpu12x breakpoints brk talign dbgbrk[n] breakpoint alignment 0 00 0 fill trace buffer until trigger (no breakpoints ?keep running) 0 00 1 fill trace buffer until trigger, then breakpoint request occurs 0 01 0 start trace buffer at trigger (no breakpoints ?keep running) 0 01 1 start trace buffer at trigger a breakpoint request occurs when trace buffer is full 0 10 0 store a further 32 trace buffer line entries after trigger (no breakpoints ?keep running) 0 10 1 store a further 32 trace buffer line entries after trigger request breakpoint after the 32 further trace buffer entries 1 00,01,10 1 terminate tracing and generate breakpoint immediately on trigger 1 00,01,10 0 terminate tracing immediately on trigger x 11 x reserved chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 342 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8.4.7.3 breakpoints generated via the trig bit if a trig triggers occur, the final state is entered. if a tracing session is selected by tsource, breakpoints are requested when the tracing session has completed, thus if begin or mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see table 8-48 ). if no tracing session is selected, breakpoints are requested immediately. trig breakpoints are possible even if the s12xdbg module is disarmed. 8.4.7.4 breakpoints via taghi or taglo pin taghits tagging using the external t a ghi/ t a glo pins always ends the session immediately at the tag hit. it is always end aligned, independent of internal channel trigger alignment con?uration. 8.4.7.5 s12xdbg breakpoint priorities xgate software breakpoints have the highest priority. active tracing sessions are terminated immediately. if a trig trigger occurs after begin or mid aligned tracing has already been triggered by a comparator instigated transition to final state, then trig no longer has an effect. when the associated tracing session is complete, the breakpoint occurs. similarly if a trig is followed by a subsequent trigger from a comparator channel, it has no effect, since tracing has already started. if a comparator tag hit occurs simultaneously with an external t a ghi/ t a glo hit, the state sequencer enters state0. taghi/taglo triggers are always end aligned, to end tracing immediately, independent of the tracing trigger alignment bits talign[1:0]. 8.4.7.5.1 s12xdbg breakpoint priorities and bdm interfacing breakpoint operation is dependent on the state of the s12xbdm module. if the s12xbdm module is active, the cpu12x is executing out of bdm ?mware and s12x breakpoints are disabled. in addition, while executing a bdm trace command, tagging into bdm is disabled. if bdm is not active, the breakpoint will give priority to bdm requests over swi requests if the breakpoint coincides with a swi instruction in the user s code. on returning from bdm, the swi from user code gets executed. bdm cannot be entered from a breakpoint unless the enable bit is set in the bdm. if entry to bdm via a bgnd instruction is attempted and the enable bit in the bdm is cleared, the cpu12x actually table 8-49. breakpoint mapping summary dbgbrk[1] (dbgc1[3]) bdm bit (dbgc1[4]) bdm enabled bdm active s12x breakpoint mapping 0 x x x no breakpoint 1 0 x 0 breakpoint to swi 1 0 x 1 no breakpoint 1 1 0 x breakpoint to swi 1 1 1 0 breakpoint to bdm 1 1 1 1 no breakpoint chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 343 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 executes the bdm ?mware code. it checks the enable and returns if enable is not set. if not serviced by the monitor then the breakpoint is re-asserted when the bdm returns to normal cpu12x ?w. if the comparator register contents coincide with the swi/bdm vector address then an swi in user code and dbg breakpoint could occur simultaneously. the cpu12x ensures that bdm requests have a higher priority than swi requests. returning from the bdm/swi service routine care must be taken to avoid re triggering a breakpoint. note when program control returns from a tagged breakpoint using an rti or bdm go command without program counter modi?ation it will return to the instruction whose tag generated the breakpoint. to avoid re triggering a breakpoint at the same location recon?ure the s12xdbg module in the swi routine, if con?ured for an swi breakpoint, or over the bdm interface by executing a trace command before the go to increment the program ?w past the tagged instruction. an xgate software breakpoint is forced immediately, the tracing session terminated and the xgate module execution stops. the user can thus determine if an xgate breakpoint has occurred by reading out the xgate program counter over the bdm interface. chapter 8 s12x debug (s12xdbgv3) module mc9s12xe-family reference manual , rev. 1.21 344 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 345 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 9 security (s12xe9secv2) 9.1 introduction this speci?ation describes the function of the security mechanism in the s12xe chip family (9sec). note no security feature is absolutely secure. however, freescale s strategy is to make reading or copying the flash and/or eeprom dif?ult for unauthorized users. 9.1.1 features the user must be reminded that part of the security must lie with the application code. an extreme example would be application code that dumps the contents of the internal memory. this would defeat the purpose of security. at the same time, the user may also wish to put a backdoor in the application program. an example of this is the user downloads a security key through the sci, which allows access to a programming routine that updates parameters stored in another section of the flash memory. the security features of the s12xe chip family (in secure mode) are: protect the content of non-volatile memories (flash, eeprom) execution of nvm commands is restricted disable access to internal memory via background debug module (bdm) disable access to internal flash/eeprom in expanded modes disable debugging features for the cpu and xgate table 9-1. revision history revision number revision date sections affected description of changes v02.00 27 aug 2004 - reviewed and updated for s12xd architecture v02.01 21 feb 2007 - added s12xe, s12xf and s12xs architectures v02.02 19 apr 2007 - corrected statement about backdoor key access via bdm on xe, xf, xs chapter 9 security (s12xe9secv2) mc9s12xe-family reference manual , rev. 1.21 346 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 9.1.2 modes of operation table 9-2 gives an overview over availability of security relevant features in unsecure and secure modes. 9.1.3 securing the microcontroller once the user has programmed the flash and eeprom, the chip can be secured by programming the security bits located in the options/security byte in the flash memory array. these non-volatile bits will keep the device secured through reset and power-down. the options/security byte is located at address 0xff0f (= global address 0x7f_ff0f) in the flash memory array. this byte can be erased and programmed like any other flash location. two bits of this byte are used for security (sec[1:0]). on devices which have a memory page window, the flash options/security byte is also available at address 0xbf0f by selecting page 0x3f with the ppage register. the contents of this byte are copied into the flash security register (fsec) during a reset sequence. the meaning of the bits keyen[1:0] is shown in table 9-3 . please refer to section 9.1.5.1, ?nsecuring the mcu using the backdoor key access for more information. table 9-2. feature availability in unsecure and secure modes on s12xe unsecure mode secure mode ns ss nx es ex st ns ss nx es ex st flash array access ??? (1) 1. availability of flash arrays in the memory map depends on romctl/eromctl pins and/or the state of the romon/eromon bits in the mmcctl1 register. please refer to the s12x_mmc block guide for detailed information. ? 1 ? 1 ? 1 ?? eeprom array access ???????? nvm commands ? (2) 2. restricted nvm command set only. please refer to the nvm wrapper block guides for detailed information. ?? 2 ? 2 ? 2 ?? 2 ? 2 ? 2 ? 2 ? 2 ? 2 bdm ?????? ? (3) 3. bdm hardware commands restricted to peripheral registers only. dbg module trace ?????? xgate debugging ?????? external bus interface ???? ???? internal status visible multiplexed on external bus ?? ?? internal accesses visible on external bus ? ? 76543210 0xff0f keyen1 keyen0 nv5 nv4 nv3 nv2 sec1 sec0 figure 9-1. flash options/security byte chapter 9 security (s12xe9secv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 347 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the meaning of the security bits sec[1:0] is shown in table 9-4 . for security reasons, the state of device security is controlled by two bits. to put the device in unsecured mode, these bits must be programmed to sec[1:0] = ?0? all other combinations put the device in a secured mode. the recommended value to put the device in secured state is the inverse of the unsecured state, i.e. sec[1:0] = ?1? note please refer to the flash block guide for actual security con?uration (in section ?lash module security?. 9.1.4 operation of the secured microcontroller by securing the device, unauthorized access to the eeprom and flash memory contents can be prevented. however, it must be understood that the security of the eeprom and flash memory contents also depends on the design of the application program. for example, if the application has the capability of downloading code through a serial port and then executing that code (e.g. an application containing bootloader code), then this capability could potentially be used to read the eeprom and flash memory contents even when the microcontroller is in the secure state. in this example, the security of the application could be enhanced by requiring a challenge/response authentication before any code can be downloaded. secured operation has the following effects on the microcontroller: 9.1.4.1 normal single chip mode (ns) background debug module (bdm) operation is completely disabled. execution of flash and eeprom commands is restricted. please refer to the nvm block guide for details. tracing code execution using the dbg module is disabled. debugging xgate code (breakpoints, single-stepping) is disabled. table 9-3. backdoor key access enable bits keyen[1:0] backdoor key access enabled 00 0 (disabled) 01 0 (disabled) 10 1 (enabled) 11 0 (disabled) table 9-4. security bits sec[1:0] security state 00 1 (secured) 01 1 (secured) 10 0 (unsecured) 11 1 (secured) chapter 9 security (s12xe9secv2) mc9s12xe-family reference manual , rev. 1.21 348 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 9.1.4.2 special single chip mode (ss) bdm ?mware commands are disabled. bdm hardware commands are restricted to the register space. execution of flash and eeprom commands is restricted. please refer to the nvm block guide for details. tracing code execution using the dbg module is disabled. debugging xgate code (breakpoints, single-stepping) is disabled. special single chip mode means bdm is active after reset. the availability of bdm ?mware commands depends on the security state of the device. the bdm secure ?mware ?st performs a blank check of both the flash memory and the eeprom. if the blank check succeeds, security will be temporarily turned off and the state of the security bits in the appropriate flash memory location can be changed if the blank check fails, security will remain active, only the bdm hardware commands will be enabled, and the accessible memory space is restricted to the peripheral register area. this will allow the bdm to be used to erase the eeprom and flash memory without giving access to their contents. after erasing both flash memory and eeprom, another reset into special single chip mode will cause the blank check to succeed and the options/security byte can be programmed to ?nsecured?state via bdm. while the bdm is executing the blank check, the bdm interface is completely blocked, which means that all bdm commands are temporarily blocked. 9.1.4.3 expanded modes (nx, es, ex, and st) bdm operation is completely disabled. internal flash memory and eeprom are disabled. execution of flash and eeprom commands is restricted. please refer to the ftm block guide for details. tracing code execution using the dbg module is disabled. debugging xgate code (breakpoints, single-stepping) is disabled 9.1.5 unsecuring the microcontroller unsecuring the microcontroller can be done by three different methods: 1. backdoor key access 2. reprogramming the security bits 3. complete memory erase (special modes) 9.1.5.1 unsecuring the mcu using the backdoor key access in normal modes (single chip and expanded), security can be temporarily disabled using the backdoor key access method. this method requires that: the backdoor key at 0xff00?xff07 (= global addresses 0x7f_ff00?x7f_ff07) has been programmed to a valid value. chapter 9 security (s12xe9secv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 349 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the keyen[1:0] bits within the flash options/security byte select ?nabled? in single chip mode, the application program programmed into the microcontroller must be designed to have the capability to write to the backdoor key locations. the backdoor key values themselves would not normally be stored within the application data, which means the application program would have to be designed to receive the backdoor key values from an external source (e.g. through a serial port). the backdoor key access method allows debugging of a secured microcontroller without having to erase the flash. this is particularly useful for failure analysis. note no word of the backdoor key is allowed to have the value 0x0000 or 0xffff. 9.1.6 reprogramming the security bits in normal single chip mode (ns), security can also be disabled by erasing and reprogramming the security bits within flash options/security byte to the unsecured value. because the erase operation will erase the entire sector from 0xfe00?xffff (0x7f_fe00?x7f_ffff), the backdoor key and the interrupt vectors will also be erased; this method is not recommended for normal single chip mode. the application software can only erase and program the flash options/security byte if the flash sector containing the flash options/security byte is not protected (see flash protection). thus flash protection is a useful means of preventing this method. the microcontroller will enter the unsecured state after the next reset following the programming of the security bits to the unsecured value. this method requires that: the application software previously programmed into the microcontroller has been designed to have the capability to erase and program the flash options/security byte, or security is ?st disabled using the backdoor key method, allowing bdm to be used to issue commands to erase and program the flash options/security byte. the flash sector containing the flash options/security byte is not protected. 9.1.7 complete memory erase (special modes) the microcontroller can be unsecured in special modes by erasing the entire eeprom and flash memory contents. when a secure microcontroller is reset into special single chip mode (ss), the bdm ?mware veri?s whether the eeprom and flash memory are erased. if any eeprom or flash memory address is not erased, only bdm hardware commands are enabled. bdm hardware commands can then be used to write to the eeprom and flash registers to mass erase the eeprom and all flash memory blocks. when next reset into special single chip mode, the bdm ?mware will again verify whether all eeprom and flash memory are erased, and this being the case, will enable all bdm commands, allowing the flash options/security byte to be programmed to the unsecured value. the security bits sec[1:0] in the flash security register will indicate the unsecure state following the next reset. chapter 9 security (s12xe9secv2) mc9s12xe-family reference manual , rev. 1.21 350 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 351 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 10 xgate (s12xgatev3) 10.1 introduction the xgate module is a peripheral co-processor that allows autonomous data transfers between the mcu s peripherals and the internal memories. it has a built in risc core that is able to pre-process the transferred data and perform complex communication protocols. the xgate module is intended to increase the mcu s data throughput by lowering the s12x_cpu s interrupt load. figure 10-1 gives an overview on the xgate architecture. this document describes the functionality of the xgate module, including: xgate registers ( section 10.3, ?emory map and register de?ition ) xgate risc core ( section 10.4.1, ?gate risc core ) hardware semaphores ( section 10.4.4, ?emaphores ) interrupt handling ( section 10.5, ?nterrupts ) debug features ( section 10.6, ?ebug mode ) security ( section 10.7, ?ecurity ) instruction set ( section 10.8, ?nstruction set ) 10.1.1 glossary of terms xgate request a service request from a peripheral module which is directed to the xgate by the s12x_int module (see figure 10-1 ). each xgate request attempts to activate a xgate channel at a certain priority level. xgate channel the resources in the xgate module (i.e. channel id number, priority level, service request vector, interrupt flag) which are associated with a particular xgate request. table 10-1. revision history revision number revision date sections affected description of changes v03.22 06 oct 2005 - internal updates v03.23 14 dec 2005 10.9.2/10-461 - updated code example v03.24 17 jan 2006 - internal updates chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 352 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 xgate channel id a 7-bit identi?r associated with an xgate channel. in s12xe designs valid channel ids range from $0d to $78. xgate priority level a priority ranging from 1 to 7 which is associated with an xgate channel. the priority level of an xgate channel is selected in the s12x_int module. xgate register bank a register bank consists of registers r1-r7, ccr and the pc. each interrupt level is associated with one register bank. xgate channel interrupt an s12x_cpu interrupt that is triggered by a code sequence running on the xgate module. xgate software channel special xgate channel that is not associated with any peripheral service request. a software channel is triggered by its software trigger bit which is implemented in the xgate module. xgate semaphore a set of hardware ?p-?ps that can be exclusively set by either the s12x_cpu or the xgate. (see section 10.4.4, ?emaphores ? xgate thread a code sequence which is executed by the xgate s risc core after receiving an xgate request. xgate debug mode a special mode in which the xgate s risc core is halted for debug purposes. this mode enables the xgate s debug features (see section 10.6, ?ebug mode ). xgate software error the xgate is able to detect a number of error conditions caused by erratic software (see section 10.4.5, ?oftware error detection ). these error conditions will cause the xgate to seize program execution and ?g an interrupt to the s12x_cpu. word a 16 bit entity. byte an 8 bit entity. 10.1.2 features the xgate module includes these features: data movement between various targets (i.e. flash, ram, and peripheral modules) data manipulation through built in risc core chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 353 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 provides up to 108 xgate channels, including 8 software triggered channels interruptible thread execution two register banks to support fast context switching between threads hardware semaphores which are shared between the s12x_cpu and the xgate module able to trigger s12x_cpu interrupts upon completion of an xgate transfer software error detection to catch erratic application code 10.1.3 modes of operation there are four run modes on s12xe devices. run mode, wait mode, stop mode the xgate is able to operate in all of these three system modes. clock activity will be automatically stopped when the xgate module is idle. freeze mode (bdm active) in freeze mode all clocks of the xgate module may be stopped, depending on the module configuration (see section 10.3.1.1, ?gate control register (xgmctl) ). 10.1.4 block diagram figure 10-1 shows a block diagram of the xgate. figure 10-1. xgate block diagram interrupts xgate requests s12x_mmc xgate peripherals semaphores software triggers peripheral interrupts s12x_dbg data/code software triggers xgate s12x_int swe interrupt risc core software error logic interrupt flags (xgif) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 354 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.2 external signal description the xgate module has no external pins. 10.3 memory map and register de?ition this section provides a detailed description of address space and registers used by the xgate module. the memory map for the xgate module is given below in figure 10-2 .the address listed for each register is the sum of a base address and an address offset. the base address is de?ed at the soc level and the address offset is de?ed at the module level. reserved registers read zero. write accesses to the reserved registers have no effect. 10.3.1 register descriptions this section consists of register descriptions in address order. each description includes a standard register diagram with an associated ?ure number. details of register bits and ?ld functions follow the register diagrams, in bit order. register name 1514131211109876543210 0x0000 xgmctl r00000000 xge xgfrz xgdbg xgss xg fact 0 xg swef xgie w xgem xg frzm xg dbgm xgssm xg factm xg swefm xgiem 0x0002 xgchid r 0 xgchid[6:0] w 0x0003 xgchpl r 00000 xgchpl[2:0] w 0x0004 reserved r w 0x0005 xgispsel r 000000 xgispsel[1:0] w 0x0006 xgisp74 r xgisp74[15:1] 0 w 0x0006 xgisp31 r xgisp31[15:1] 0 w 0x0006 xgvbr r xgvbr[15:1] 0 w = unimplemented or reserved figure 10-2. xgate register summary (sheet 1 of 3) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 355 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 0x0008 xgif r0000000 xgif_78 xgf_77 xgif_76 xgif_75 xgif_74 xgif_73 xgif_72 xgif_71 xgif_70 w 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 0x000a xgif r xgif_6f xgif_6e xgif_6d xgif_6c xgif_6b xgif_6a xgif_69 xgif_68 xgf_67 xgif_66 xgif_65 xgif_64 xgif_63 xgif_62 xgif_61 xgif_60 w 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 0x000c xgif r xgif_5f xgif_5e xgif_5d xgif_5c xgif_5b xgif_5a xgif_59 xgif_58 xgf_57 xgif_56 xgif_55 xgif_54 xgif_53 xgif_52 xgif_51 xgif_50 w 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 0x000e xgif r xgif_4f xgif_4e xgif_4d xgif_4c xgif_4b xgif_4a xgif_49 xgif_48 xgf _47 xgif_46 xgif_45 xgif_44 xgif_43 xgif_42 xgif_41 xgif_40 w 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 0x0010 xgif r xgif_3f xgif_3e xgif_3d xgif_3c xgif_3b xgif_3a xgif_39 xgif_38 xgf _37 xgif_36 xgif_35 xgif_34 xgif_33 xgif_32 xgif_31 xgif_30 w 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 0x0012 xgif r xgif_2f xgif_2e xgif_2d xgif_2c xgif_2b xgif_2a xgif_29 xgif_28 xgf _27 xgif_26 xgif_25 xgif_24 xgif_23 xgif_22 xgif_21 xgif_20 w 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 0x0014 xgif r xgif_1f xgif_1e xgif_1d xgif_1c xgif_1b xgif_1a xgif_19 xgif_18 xgf _17 xgif_16 xgif_15 xgif_14 xgif_13 xgif_12 xgif_11 xgif_10 w 1514131211109876543210 0x0016 xgif r xgif_0f xgif_0e xgif_0d 0 0 0 0 0 0 0 0 0 0 0 0 0 w = unimplemented or reserved figure 10-2. xgate register summary (sheet 2 of 3) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 356 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 1514131211109876543210 0x0018 xgswtm r00000000 xgswt[7:0] w xgswtm[7:0] 0x001a xgsemm r00000000 xgsem[7:0] w xgsemm[7:0] 0x001c reserved r w 0x001d xgccr r 0000 xgn xgz xgv xgc w 0x001e xgpc r xgpc w 0x0020 reserved r w 0x0021 reserved r w 0x0022 xgr1 r xgr1 w 0x0024 xgr2 r xgr2 w 0x0026 xgr3 r xgr3 w 0x0028 xgr4 r xgr4 w 0x002a xgr5 r xgr5 w 0x002c xgr6 r xgr6 w 0x002e xgr7 r xgr7 w = unimplemented or reserved figure 10-2. xgate register summary (sheet 3 of 3) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 357 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.1 xgate control register (xgmctl) all module level switches and ?gs are located in the xgate module control register figure 10-3 . read: anytime write: anytime module base +0x00000 1514131211109876543210 r00000000 xge xgfrz xgdbg xgss xgfact 0 xg swef xgie w xgem xg frzm xg dbgm xg ssm xg factm xg swefm xgiem reset 0000000000000000 = unimplemented or reserved figure 10-3. xgate control register (xgmctl) table 10-2. xgmctl field descriptions (sheet 1 of 3) field description 15 xgem xge mask this bit controls the write access to the xge bit. the xge bit can only be set or cleared if a "1" is written to the xgem bit in the same register access. read: this bit will always read "0". write: 0 disable write access to the xge in the same bus cycle 1 enable write access to the xge in the same bus cycle 14 xgfrzm xgfrz mask this bit controls the write access to the xgfrz bit. the xgfrz bit can only be set or cleared if a "1" is written to the xgfrzm bit in the same register access. read: this bit will always read "0". write: 0 disable write access to the xgfrz in the same bus cycle 1 enable write access to the xgfrz in the same bus cycle 13 xgdbgm xgdbg mask this bit controls the write access to the xgdbg bit. the xgdbg bit can only be set or cleared if a "1" is written to the xgdbgm bit in the same register access. read: this bit will always read "0". write: 0 disable write access to the xgdbg in the same bus cycle 1 enable write access to the xgdbg in the same bus cycle 12 xgssm xgss mask this bit controls the write access to the xgss bit. the xgss bit can only be set or cleared if a "1" is written to the xgssm bit in the same register access. read: this bit will always read "0". write: 0 disable write access to the xgss in the same bus cycle 1 enable write access to the xgss in the same bus cycle chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 358 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11 xgfactm xgfact mask ?this bit controls the write access to the xgfact bit. the xgfact bit can only be set or cleared if a "1" is written to the xgfactm bit in the same register access. read: this bit will always read "0". write: 0 disable write access to the xgfact in the same bus cycle 1 enable write access to the xgfact in the same bus cycle 9 xgswefm xgswef mask this bit controls the write access to the xgswef bit. the xgswef bit can only be cleared if a "1" is written to the xgswefm bit in the same register access. read: this bit will always read "0". write: 0 disable write access to the xgswef in the same bus cycle 1 enable write access to the xgswef in the same bus cycle 8 xgiem xgie mask this bit controls the write access to the xgie bit. the xgie bit can only be set or cleared if a "1" is written to the xgiem bit in the same register access. read: this bit will always read "0". write: 0 disable write access to the xgie in the same bus cycle 1 enable write access to the xgie in the same bus cycle 7 xge xgate module enable (request enable) ?this bit enables incoming xgate requests from the s12x_int module. if the xge bit is cleared, pending xgate requests will be ignored. the thread that is executed by the risc core while the xge bit is cleared will continue to run. read: 0 incoming requests are disabled 1 incoming requests are enabled write: 0 disable incoming requests 1 enable incoming requests 6 xgfrz halt xgate in freeze mode ?the xgfrz bit controls the xgate operation in freeze mode (bdm active). read: 0 risc core operates normally in freeze (bdm active) 1 risc core stops in freeze mode (bdm active) write: 0 don? stop risc core in freeze mode (bdm active) 1 stop risc core in freeze mode (bdm active) 5 xgdbg xgate debug mode this bit indicates that the xgate is in debug mode (see section 10.6, ?ebug mode ). debug mode can be entered by software breakpoints (brk instruction), tagged or forced breakpoints (see s12x_dbg section ), or by writing a "1" to this bit. read: 0 risc core is not in debug mode 1 risc core is in debug mode write: 0 leave debug mode 1 enter debug mode note: freeze mode and software error interrupts have no effect on the xgdbg bit. table 10-2. xgmctl field descriptions (sheet 2 of 3) field description chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 359 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.2 xgate channel id register (xgchid) the xgate channel id register ( figure 10-4 ) shows the identi?r of the xgate channel that is currently active. this register will read ?00?if the xgate module is idle. in debug mode this register can be used to start and terminate threads. refer to section 10.6.1, ?ebug features for further information. 4 xgss xgate single step ?this bit forces the execution of a single instruction. (1) read: 0 no single step in progress 1 single step in progress write 0 no effect 1 execute a single risc instruction note: invoking a single step will cause the xgate to temporarily leave debug mode until the instruction has been executed. 3 xgfact fake xgate activity this bit forces the xgate to ?g activity to the mcu even when it is idle. when it is set the mcu will never enter system stop mode which assures that peripheral modules will be clocked during xgate idle periods read: 0 xgate will only ?g activity if it is not idle or in debug mode. 1 xgate will always signal activity to the mcu. write: 0 only ?g activity if not idle or in debug mode. 1 always signal xgate activity. 1 xgswef xgate software error flag ?this bit signals a software error. it is set whenever the risc core detects an error condition (2) . the risc core is stopped while this bit is set. clearing this bit will terminate the current thread and cause the xgate to become idle. read: 0 no software error detected 1 software error detected write: 0 no effect 1 clears the xgswef bit 0 xgie xgate interrupt enable ?this bit acts as a global interrupt enable for the xgate module read: 0 all outgoing xgate interrupts disabled (except software error interrupts) 1 all outgoing xgate interrupts enabled write: 0 disable all outgoing xgate interrupts (except software error interrupts) 1 enable all outgoing xgate interrupts 1. refer to section 10.6.1, ?ebug features 2. refer to section 10.4.5, ?oftware error detection table 10-2. xgmctl field descriptions (sheet 3 of 3) field description chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 360 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: in debug mode 1 10.3.1.3 xgate channel priority level (xgchpl) the xgate channel priority level register ( figure 10-5 ) shows the priority level of the current thread. in debug mode this register can be used to select a priority level when launching a thread (see section 10.6.1, ?ebug features ). read: anytime write: in debug mode 1 10.3.1.4 xgate initial stack pointer select register (xgispsel) the xgate initial stack pointer select register ( figure 10-6 ) determines the register which is mapped to address ?odule base +0x0006? a value of zero selects the vector base register (xgvbr). setting module base +0x0002 76543210 r 0 xgchid[6:0] w reset 00000000 = unimplemented or reserved figure 10-4. xgate channel id register (xgchid) table 10-3. xgchid field descriptions field description 6? xgchid[6:0] request identi?r ?id of the currently active channel 1. refer to section 10.6.1, ?ebug features module base +0x0003 76543210 r00000 xgchpl[2:0] w reset 00000000 = unimplemented or reserved figure 10-5. xgate channel priority level register (xgchpl) table 10-4. xgchpl field descriptions field description 2-0 xgchpl[2:0] priority level ?priority level of the currently active channel chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 361 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 this register to a channel priority level (non-zero value) selects the corresponding initial stack pointer registers xgisp74 or xgisp31 (see table 10-6 ). read: anytime write: anytime 10.3.1.5 xgate initial stack pointer for interrupt priorities 7 to 4 (xgisp74) the xgisp74 register is intended to point to the stack region that is used by xgate channels of priority 7 to 4. every time a thread of such priority is started, risc core register r7 will be initialized with the content of xgisp74. read: anytime write: only if xgate requests are disabled (xge = 0) and idle (xgchid = $00)) module base +0x0005 76543210 r000000 xgispsel[1:0] w reset 00000000 = unimplemented or reserved figure 10-6. xgate initial stack pointer select register (xgispsel) table 10-5. xgispsel field descriptions field description 1-0 xgispsel[1:0] register select determines whether xgisp74, xgisp31, or xgvbr is mapped to ?odule base +0x0006? see table 10-6 . table 10-6. xgisp74, xgisp31, xgvbr mapping xgispsel[1:0] register mapped to ?odule base +0x0006 3 reserved 2 xgisp74 1 xgisp31 0 xgvbr module base +0x0006 1514131211109876543210 r xgisp74[15:1] 0 w reset 0000000000000000 = unimplemented or reserved figure 10-7. xgate initial stack pointer for interrupt priorities 7 to 4 (xgisp74) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 362 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.6 xgate initial stack pointer for interrupt priorities 3 to 1 (xgisp31) the xgisp31 register is intended to point to the stack region that is used by xgate channels of priority 3 to 1. every time a thread of such priority is started, risc core register r7 will be initialized with the content of xgisp31. read: anytime write: only if xgate requests are disabled (xge = 0) and idle (xgchid = $00)) 10.3.1.7 xgate vector base address register (xgvbr) the vector base address register ( figure 10-9 ) determines the location of the xgate vector block (see section figure 10-23., ?gate vector block ). read: anytime write: only if xgate requests are disabled (xge = 0) and idle (xgchid = $00)) table 10-7. xgisp74 field descriptions field description 15? xbisp74[15:1] initial stack pointer ?the xgisp74 register holds the initial value of risc core register r7, for threads of priority 7 to 4. module base +0x0006 1514131211109876543210 r xgisp31[15:1] 0 w reset 0000000000000000 = unimplemented or reserved figure 10-8. xgate initial stack pointer for interrupt priorities 3 to 1 (xgisp31) table 10-8. xgisp31 field descriptions field description 15? xbisp31[15:1] initial stack pointer ?the xgisp31 register holds the initial value of risc core register r7, for threads of priority 3 to 1. module base +0x0006 1514131211109876543210 r xgvbr[15:1] 0 w reset 1111111000000000 = unimplemented or reserved figure 10-9. xgate vector base address register (xgvbr) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 363 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.8 xgate channel interrupt flag vector (xgif) the xgate channel interrupt flag vector ( figure 10-10 ) provides access to the interrupt ?gs of all channels. each ?g may be cleared by writing a "1" to its bit location. refer to section 10.5.2, ?utgoing interrupt requests for further information. table 10-9. xgvbr field descriptions field description 15? xbvbr[15:1] vector base address ?the xgvbr register holds the start address of the vector block in the xgate memory map. module base +0x0008 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 r0000000 xgif_78 xgf_77 xgif_76 xgif_75 xgif_74 xgif_73 xgif_72 xgif_71 xgif_70 w reset 0000000000000000 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 r xgif_6f xgif_6e xgif_6d xgif_6c xgif_6b xgif_6a xgif_69 xgif_68 xgf_67 xgif_66 xgif_65 xgif_64 xgif_63 xgif_62 xgif_61 xgif_60 w reset 0000000000000000 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 r xgif_5f xgif_5e xgif_5d xgif_5c xgif_5b xgif_5a xgif_59 xgif_58 xgf_57 xgif_56 xgif_55 xgif_54 xgif_53 xgif_52 xgif_51 xgif_50 w reset 0000000000000000 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 r xgif_4f xgif_4e xgif_4d xgif_4c xgif_4b xgif_4a xgif_49 xgif_48 xgf _47 xgif_46 xgif_45 xgif_44 xgif_43 xgif_42 xgif_41 xgif_40 w reset 0000000000000000 figure 10-10. xgate channel interrupt flag vector (xgif) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 364 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 r xgif_3f xgif_3e xgif_3d xgif_3c xgif_3b xgif_3a xgif_39 xgif_38 xgf _37 xgif_36 xgif_35 xgif_34 xgif_33 xgif_32 xgif_31 xgif_30 w reset 0 000000000000000 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 r xgif_2f xgif_2e xgif_2d xgif_2c xgif_2b xgif_2a xgif_29 xgif_28 xgf _27 xgif_26 xgif_25 xgif_24 xgif_23 xgif_22 xgif_21 xgif_20 w reset 0000000000000000 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 r xgif_1f xgif_1e xgif_1d xgif_1c xgif_1b xgif_1a xgif_19 xgif_18 xgf _17 xgif_16 xgif_15 xgif_14 xgif_13 xgif_12 xgif_11 xgif_10 w reset 0000000000000000 1514131211109876543210 r xgif_0f xgif_0e xgif_0d 0 0 0 0 0 0 0 0 0 0 0 0 0 w reset 0000000000000000 = unimplemented or reserved table 10-10. xgiv field descriptions field description 127? xgif[78:9] channel interrupt flags ?these bits signal pending channel interrupts. they can only be set by the risc core (see sif instruction on page 10-447 ). each ?g can be cleared by writing a "1" to its bit location. unimplemented interrupt ?gs will always read "0". section ?nterrupts?of the device overview for a list of implemented interrupts. read: 0 channel interrupt is not pending 1 channel interrupt is pending if xgie is set write: 0 no effect 1 clears the interrupt ?g figure 10-10. xgate channel interrupt flag vector (xgif) (continued) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 365 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note suggested mnemonics for accessing the interrupt ?g vector on a word basis are: xgif_7f_70 (xgif[127:112]), xgif_6f_60 (xgif[111:96]), xgif_5f_50 (xgif[95:80]), xgif_4f_40 (xgif[79:64]), xgif_3f_30 (xgif[63:48]), xgif_2f_20 (xgif[47:32]), xgif_1f_10 (xgif[31:16]), xgif_0f_00 (xgif[15:0]) 10.3.1.9 xgate software trigger register (xgswt) the eight software triggers of the xgate module can be set and cleared through the xgate software trigger register ( figure 10-11 ). the upper byte of this register, the software trigger mask, controls the write access to the lower byte, the software trigger bits. these bits can be set or cleared if a "1" is written to the associated mask in the same bus cycle. refer to section 10.5.2, ?utgoing interrupt requests for further information. read: anytime write: anytime module base +0x00018 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r00000000 xgswt[7:0] w xgswtm[7:0] reset 0000000000000000 figure 10-11. xgate software trigger register (xgswt) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 366 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note the xgate channel ids that are associated with the eight software triggers are determined on chip integration level. (see section ?nterrupts?of the device overview ) xgate software triggers work like any peripheral interrupt. they can be used as xgate requests as well as s12x_cpu interrupts. the target of the software trigger must be selected in the s12x_int module. 10.3.1.10 xgate semaphore register (xgsem) the xgate provides a set of eight hardware semaphores that can be shared between the s12x_cpu and the xgate risc core. each semaphore can either be unlocked, locked by the s12x_cpu or locked by the risc core. the risc core is able to lock and unlock a semaphore through its ssem and csem instructions. the s12x_cpu has access to the semaphores through the xgate semaphore register ( figure 10-12 ). refer to section section 10.4.4, ?emaphores for details. read: anytime write: anytime (see section 10.4.4, ?emaphores ) table 10-11. xgswt field descriptions field description 15? xgswtm[7:0] software trigger mask these bits control the write access to the xgswt bits. each xgswt bit can only be written if a "1" is written to the corresponding xgswtm bit in the same access. read: these bits will always read "0". write: 0 disable write access to the xgswt in the same bus cycle 1 enable write access to the corresponding xgswt bit in the same bus cycle 7? xgswt[7:0] software trigger bits ?these bits act as interrupt ?gs that are able to trigger xgate software channels. they can only be set and cleared by software. read: 0 no software trigger pending 1 software trigger pending if the xgie bit is set write: 0 clear software trigger 1 set software trigger module base +0x0001a 1514131211109876543210 r00000000 xgsem[7:0] w xgsemm[7:0] reset 0000000000000000 figure 10-12. xgate semaphore register (xgsem) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 367 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.11 xgate condition code register (xgccr) the xgccr register ( figure 10-13 ) provides access to the risc core s condition code register. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) table 10-12. xgsem field descriptions field description 15? xgsemm[7:0] semaphore mask ?these bits control the write access to the xgsem bits. read: these bits will always read "0". write: 0 disable write access to the xgsem in the same bus cycle 1 enable write access to the xgsem in the same bus cycle 7? xgsem[7:0] semaphore bits these bits indicate whether a semaphore is locked by the s12x_cpu. a semaphore can be attempted to be set by writing a "1" to the xgsem bit and to the corresponding xgsemm bit in the same write access. only unlocked semaphores can be set. a semaphore can be cleared by writing a "0" to the xgsem bit and a "1" to the corresponding xgsemm bit in the same write access. read: 0 semaphore is unlocked or locked by the risc core 1 semaphore is locked by the s12x_cpu write: 0 clear semaphore if it was locked by the s12x_cpu 1 attempt to lock semaphore by the s12x_cpu module base +0x001d 76543210 r0000 xgn xgz xgv xgc w reset 00000000 = unimplemented or reserved figure 10-13. xgate condition code register (xgccr) table 10-13. xgccr field descriptions field description 3 xgn sign flag ?the risc core s sign ?g 2 xgz zero flag ?the risc core s zero ?g 1 xgv over?w flag ?the risc core s over?w ?g 0 xgc carry flag ?the risc core s carry ?g chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 368 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.12 xgate program counter register (xgpc) the xgpc register ( figure 10-14 ) provides access to the risc core s program counter. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) 10.3.1.13 xgate register 1 (xgr1) the xgr1 register ( figure 10-15 ) provides access to the risc core s register 1. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) module base +0x0001e 1514131211109876543210 r xgpc w reset 0000000000000000 figure 10-14. xgate program counter register (xgpc) table 10-14. xgpc field descriptions field description 15? xgpc[15:0] program counter ?the risc core s program counter module base +0x00022 1514131211109876543210 r xgr1 w reset 0000000000000000 figure 10-15. xgate register 1 (xgr1) table 10-15. xgr1 field descriptions field description 15? xgr1[15:0] xgate register 1 ?the risc core s register 1 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 369 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.14 xgate register 2 (xgr2) the xgr2 register ( figure 10-16 ) provides access to the risc core s register 2. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) 10.3.1.15 xgate register 3 (xgr3) the xgr3 register ( figure 10-17 ) provides access to the risc core s register 3. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) module base +0x00024 1514131211109876543210 r xgr2 w reset 0000000000000000 figure 10-16. xgate register 2 (xgr2) table 10-16. xgr2 field descriptions field description 15? xgr2[15:0] xgate register 2 ?the risc core s register 2 module base +0x00026 1514131211109876543210 r xgr3 w reset 0000000000000000 figure 10-17. xgate register 3 (xgr3) table 10-17. xgr3 field descriptions field description 15? xgr3[15:0] xgate register 3 ?the risc core s register 3 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 370 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.16 xgate register 4 (xgr4) the xgr4 register ( figure 10-18 ) provides access to the risc core s register 4. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) 10.3.1.17 xgate register 5 (xgr5) the xgr5 register ( figure 10-19 ) provides access to the risc core s register 5. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) module base +0x00028 1514131211109876543210 r xgr4 w reset 0000000000000000 figure 10-18. xgate register 4 (xgr4) table 10-18. xgr4 field descriptions field description 15? xgr4[15:0] xgate register 4 ?the risc core s register 4 module base +0x0002a 1514131211109876543210 r xgr5 w reset 0000000000000000 figure 10-19. xgate register 5 (xgr5) table 10-19. xgr5 field descriptions field description 15? xgr5[15:0] xgate register 5 ?the risc core s register 5 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 371 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.3.1.18 xgate register 6 (xgr6) the xgr6 register ( figure 10-20 ) provides access to the risc core s register 6. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) 10.3.1.19 xgate register 7 (xgr7) the xgr7 register ( figure 10-21 ) provides access to the risc core s register 7. read: in debug mode if unsecured and not idle (xgchid 0x00) write: in debug mode if unsecured and not idle (xgchid 0x00) 10.4 functional description the core of the xgate module is a risc processor which is able to access the mcu s internal memories and peripherals (see figure 10-1 ). the risc processor always remains in an idle state until it is triggered by an xgate request. then it executes a code sequence (thread) that is associated with the requested xgate channel. each thread can run on a priority level ranging from 1 to 7. refer to the s12x_int module base +0x0002c 1514131211109876543210 r xgr6 w reset 0000000000000000 figure 10-20. xgate register 6 (xgr6) table 10-20. xgr6 field descriptions field description 15? xgr6[15:0] xgate register 6 ?the risc core s register 6 module base +0x0002e 1514131211109876543210 r xgr7 w reset 0000000000000000 figure 10-21. xgate register 7 (xgr7) table 10-21. xgr7 field descriptions field description 15? xgr7[15:0] xgate register 7 ?the risc core s register 7 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 372 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 section for information on how to select priority levels for xgate threads. low priority threads (interrupt levels 1 to 3) can be interrupted by high priority threads (interrupt levels 4 to 7). high priority threads are not interruptible. the register content of an interrupted thread is maintained and restored by the xgate hardware. to signal the completion of a task the xgate is able to send interrupts to the s12x_cpu. each xgate channel has its own interrupt vector. refer to the s12x_int section for detailed information. the xgate module also provides a set of hardware semaphores which are necessary to ensure data consistency whenever ram locations or peripherals are shared with the s12x_cpu. the following sections describe the components of the xgate module in further detail. 10.4.1 xgate risc core the risc core is a 16 bit processor with an instruction set that is well suited for data transfers, bit manipulations, and simple arithmetic operations (see section 10.8, ?nstruction set ). it is able to access the mcu s internal memories and peripherals without blocking these resources from the s12x_cpu 1 . whenever the s12x_cpu and the risc core access the same resource, the risc core will be stalled until the resource becomes available again. 1 the xgate offers a high access rate to the mcu s internal ram. depending on the bus load, the risc core can perform up to two ram accesses per s12x_cpu bus cycle. bus accesses to peripheral registers or ?sh are slower. a transfer rate of one bus access per s12x_cpu cycle can not be exceeded. the xgate module is intended to execute short interrupt service routines that are triggered by peripheral modules or by software. 10.4.2 programmer s model figure 10-22. programmer s model 1. with the exception of prr registers (see section ?12x_mmc?. r7 r6 r5 r4 r3 r2 r1 r0 = 0 vc register block program counter condition code register 15 15 15 15 15 15 15 15 0 0 0 0 0 0 0 0 1 0 (data pointer) pc 15 0 nz 3 2 (stack pointer) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 373 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the programmer s model of the xgate risc core is shown in figure 10-22 . the processor offers a set of seven general purpose registers (r1 - r7), which serve as accumulators and index registers. an additional eighth register (r0) is tied to the value ?0000? registers r1 and r7 have additional functionality. r1 is preloaded with the initial data pointer of the channel s service request vector (see figure 10-23 ). r7 is either preloaded with the content of xgisp74 if the interrupt priority of the current channel is in the range 7 to 4, or it is with preloaded the content of xgisp31 if the interrupt priority of the current channel is in the range 3 to 1. the remaining general purpose registers will be reset to an unspeci?d value at the beginning of each thread. the 16 bit program counter allows the addressing of a 64 kbyte address space. the condition code register contains four bits: the sign bit (s), the zero ?g (z), the over?w ?g (v), and the carry bit (c). the initial content of the condition code register is unde?ed. 10.4.3 memory map the xgate s risc core is able to access an address space of 64k bytes. the allocation of memory blocks within this address space is determined on chip level. refer to the s12x_mmc section for a detailed information. the xgate vector block assigns a start address and a data pointer to each xgate channel. its position in the xgate memory map can be adjusted through the xgvbr register (see section 10.3.1.7, ?gate vector base address register (xgvbr) ). figure 10-23 shows the layout of the vector block. each vector consists of two 16 bit words. the ?st contains the start address of the service routine. this value will be loaded into the program counter before a service routine is executed. the second word is a pointer to the service routine s data space. this value will be loaded into register r1 before a service routine is executed. chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 374 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 10-23. xgate vector block 10.4.4 semaphores the xgate module offers a set of eight hardware semaphores. these semaphores provide a mechanism to protect system resources that are shared between two concurrent threads of program execution; one thread running on the s12x_cpu and one running on the xgate risc core. each semaphore can only be in one of the three states: ?nlocked? ?ocked by s12x_cpu? and ?ocked by xgate? the s12x_cpu can check and change a semaphore s state through the xgate semaphore register (xgsem, see section 10.3.1.10, ?gate semaphore register (xgsem) ). the risc core does this through its ssem and csem instructions. i figure 10-24 illustrates the valid state transitions. +$0000 unused +$0024 +$0028 +$002c +$0030 +$01e0 code data code data xgvbr channel $0a initial program counter channel $0a initial data pointer channel $09 initial program counter channel $09 initial data pointer channel $0b initial program counter channel $0b initial data pointer channel $0c initial program counter channel $0c initial data pointer channel $78 initial program counter channel $78 initial data pointer chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 375 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 10-24. semaphore state transitions figure 10-25 gives an example of the typical usage of the xgate hardware semaphores. two concurrent threads are running on the system. one is running on the s12x_cpu and the other is running on the risc core. they both have a critical section of code that accesses the same system resource. to guarantee that the system resource is only accessed by one thread at a time, the critical code sequence must be embedded in a semaphore lock/release sequence as shown. unlocked locked by s12x_cpu locked by xgate set_xgsem : 1 is written to xgsem[ n ] (and 1 is written to xgsemm[ n ]) clr_xgsem : 0 is written to xgsem[ n ] (and 1 is written to xgsemm[ n ]) ssem : executing ssem instruction (on semaphore n ) csem : executing csem instruction (on semaphore n ) clr_xgsem csem ssem & set_xgsem clr_xgsem ssem & set_xgsem csem ssem chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 376 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 10-25. algorithm for locking and releasing semaphores 10.4.5 software error detection upon detecting an error condition caused by erratic application code, the xgate module will immediately terminate program execution and trigger a non-maskable interrupt to the s12x_cpu. there are three error conditions: execution of an illegal opcode illegal opcode fetches illegal load or store accesses all opcodes which are not listed in section section 10.8, ?nstruction set are illegal opcodes. illegal opcode fetches as well as illegal load and store accesses are de?ed on chip level. refer to the s12x_mmc section for a detailed information. note when executing a branch (bcc, bcs,...), a jump (jal) or an rts instruction, the xgate prefetches and discards the opcode of the following instruction. the xgate will perform its software error handling actions (see above) if this opcode fetch is illegal. ssem 0 ? xgsem[ n ] bcc? 1 ? xgsem[ n ] csem ......... ......... ......... ......... critical code sequence critical code sequence s12x_cpu xgate xgsem[ n ] 1? chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 377 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.5 interrupts 10.5.1 incoming interrupt requests xgate threads are triggered by interrupt requests which are routed to the xgate module (see s12x_int section). only a subset of the mcu s interrupt requests can be routed to the xgate. which speci? interrupt requests these are and which channel id they are assigned to is documented in section ?nterrupts?of the device overview . 10.5.2 outgoing interrupt requests there are three types of interrupt requests which can be triggered by the xgate module: 4. channel interrupts for each xgate channel there is an associated interrupt ?g in the xgate interrupt ?g vector (xgif, see section 10.3.1.8, ?gate channel interrupt flag vector (xgif) ). these ?gs can be set through the "sif" instruction by the risc core. they are typically used to ?g an interrupt to the s12x_cpu when the xgate has completed one of its task. 5. software triggers software triggers are interrupt ?gs, which can be set and cleared by software (see section 10.3.1.9, ?gate software trigger register (xgswt) ). they are typically used to trigger xgate tasks by the s12x_cpu software. however these interrupts can also be routed to the s12x_cpu (see s12x_int section ) and triggered by the xgate software. 6. software error interrupt the software error interrupt signals to the s12x_cpu the detection of an error condition in the xgate application code (see section 10.4.5, ?oftware error detection ). this is a non-maskable interrupt. executing the interrupt service routine will automatically reset the interrupt line. all outgoing xgate interrupts, except software error interrupts, can be disabled by the xgie bit in the xgate module control register (xgmctl, see section 10.3.1.1, ?gate control register (xgmctl) ). 10.6 debug mode the xgate debug mode is a feature to allow debugging of application code. 10.6.1 debug features in debug mode the risc core will be halted and the following debug features will be enabled: read and write accesses to risc core registers (xgccr, xgpc, xgr1?gr7) 1 all risc core registers can be modified. leaving debug mode will cause the risc core to continue program execution with the modified register values. 1. only possible if mcu is unsecured chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 378 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 single stepping writing a "1" to the xgss bit will call the risc core to execute a single instruction. all risc core registers will be updated accordingly. write accesses to the xgchid register and the xgchpl register xgate threads can be initiated and terminated through a 16 write access to the xgchid and the xgchpl register or through a 8 bit write access to the xgchid register. detailed operation is shown in table 10-22 . once a thread has been initiated it? code can be either single stepped or it can be executed by leaving debug mode. note even though zero is not a valid interrupt priority level of the s12x_int module, a thread of priority level 0 can be initiated in debug mode. the xgate handles requests of priority level 0 in the same way as it handles requests of priority levels 1 to 3. note all channels 1 to 127 can be initiated by writing to the xgchid register, even if they are not assigned to any peripheral module. note in debug mode the xgate will ignore all requests from peripheral modules. 10.6.1.0.1 entering debug mode debug mode can be entered in four ways: 1. setting xgdbg to "1" table 10-22. initiating and terminating threads in debug mode register content single cycle write access to... action xgchid xgchpl xgchid xgchpl 0 0 1..127 - (1) 1. 8 bit write access to xgchid set new xgchid set xgchpl to 0x01 initiate new thread 0 0 1..127 0..7 set new xgchid set new xgchpl initiate new thread 1..127 0..3 1..127 4..7 interrupt current thread set new xgchid set new xgchpl initiate new thread 1..127 0..7 0 0..7 terminate current thread. resume interrupted thread or become idle if no interrupted thread is pending - 1 all other combinations no action chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 379 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 writing a "1" to xgdbg and xgdbgm in the same write access causes the xgate to enter debug mode upon completion of the current instruction. note after writing to the xgdbg bit the xgate will not immediately enter debug mode. depending on the instruction that is executed at this time there may be a delay of several clock cycles. the xgdbg will read "0" until debug mode is entered. 2. software breakpoints xgate programs which are stored in the internal ram allow the use of software breakpoints. a software breakpoint is set by replacing an instruction of the program code with the "brk" instruction. as soon as the program execution reaches the "brk" instruction, the xgate enters debug mode. additionally a software breakpoint request is sent to the s12x_dbg module (see section 4.9 of the s12x_dbg section ). upon entering debug mode, the program counter will point to the "brk" instruction. the other risc core registers will hold the result of the previous instruction. to resume program execution, the "brk" instruction must be replaced by the original instruction before leaving debug mode. 3. tagged breakpoints the s12x_dbg module is able to place tags on fetched opcodes. the xgate is able to enter debug mode right before a tagged opcode is executed (see section 4.9 of the s12x_dbg section ). upon entering debug mode, the program counter will point to the tagged instruction. the other risc core registers will hold the result of the previous instruction. 4. forced breakpoints forced breakpoints are triggered by the s12x_dbg module (see section 4.9 of the s12x_dbg section ). when a forced breakpoint occurs, the xgate will enter debug mode upon completion of the current instruction. 10.6.2 leaving debug mode debug mode can only be left by setting the xgdbg bit to "0". if a thread is active (xgchid has not been cleared in debug mode), program execution will resume at the value of xgpc. 10.7 security in order to protect xgate application code on secured s12x devices, a few restrictions in the debug features have been made. these are: registers xgccr, xgpc, and xgr1?gr7 will read zero on a secured device registers xgccr, xgpc, and xgr1?gr7 can not be written on a secured device single stepping is not possible on a secured device chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 380 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8 instruction set 10.8.1 addressing modes for the ease of implementation the architecture is a strict load/store risc machine, which means all operations must have one of the eight general purpose registers r0 ?r7 as their source as well their destination. all word accesses must work with a word aligned address, that is a[0] = 0! 10.8.1.1 naming conventions rd destination register, allowed range is r0?7 rd.l low byte of the destination register, bits [7:0] rd.h high byte of the destination register, bits [15:8] rs, rs1, rs2 source register, allowed range is r0?7 rs.l, rs1.l, rs2.l low byte of the source register, bits [7:0] rs.h, rs1.h, rs2.h high byte of the source register, bits[15:8] rb base register for indexed addressing modes, allowed range is r0?7 ri offset register for indexed addressing modes with register offset, allowed range is r0?7 ri+ offset register for indexed addressing modes with register offset and post-increment, allowed range is r0?7 (r0+ is equivalent to r0) ?i offset register for indexed addressing modes with register offset and pre-decrement, allowed range is r0?7 (?0 is equivalent to r0) note even though register r1 is intended to be used as a pointer to the data segment, it may be used as a general purpose data register as well. selecting r0 as destination register will discard the result of the instruction. only the condition code register will be updated 10.8.1.2 inherent addressing mode (inh) instructions that use this addressing mode either have no operands or all operands are in internal xgate registers. examples: brk rts chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 381 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8.1.3 immediate 3-bit wide (imm3) operands for immediate mode instructions are included in the instruction stream and are fetched into the instruction queue along with the rest of the 16 bit instruction. the ??symbol is used to indicate an immediate addressing mode operand. this address mode is used for semaphore instructions. examples: csem #1 ; unlock semaphore 1 ssem #3 ; lock semaphore 3 10.8.1.4 immediate 4 bit wide (imm4) the 4 bit wide immediate addressing mode is supported by all shift instructions. rd = rd ? imm4 examples: lsl r4,#1 ; r4 = r4 << 1; shift register r4 by 1 bit to the left lsr r4,#3 ; r4 = r4 >> 3; shift register r4 by 3 bits to the right 10.8.1.5 immediate 8 bit wide (imm8) the 8 bit wide immediate addressing mode is supported by four major commands (add, sub, ld, cmp). rd = rd ? imm8 examples: addl r1,#1 ; adds an 8 bit value to register r1 subl r2,#2 ; subtracts an 8 bit value from register r2 ldh r3,#3 ; loads an 8 bit immediate into the high byte of register r3 cmpl r4,#4 ; compares the low byte of register r4 with an immediate value 10.8.1.6 immediate 16 bit wide (imm16) the 16 bit wide immediate addressing mode is a construct to simplify assembler code. instructions which offer this mode are translated into two opcodes using the eight bit wide immediate addressing mode. rd = rd ? imm16 examples: ldw r4,#$1234 ; translated to ldl r4,#$34; ldh r4,#$12 add r4,#$5678 ; translated to addl r4,#$78; addh r4,#$56 10.8.1.7 monadic addressing (mon) in this addressing mode only one operand is explicitly given. this operand can either be the source ( f (rd)), the target (rd = f ()), or both source and target of the operation (rd = f (rd)). examples: jal r1 ; pc = r1, r1 = pc+2 sif r2 ; trigger irq associated with the channel number in r2.l chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 382 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8.1.8 dyadic addressing (dya) in this mode the result of an operation between two registers is stored in one of the registers used as operands. rd = rd ? rs is the general register to register format, with register rd being the ?st operand and rs the second. rd and rs can be any of the 8 general purpose registers r0 ?r7. if r0 is used as the destination register, only the condition code ?gs are updated. this addressing mode is used only for shift operations with a variable shift value examples: lsl r4,r5 ; r4 = r4 << r5 lsr r4,r5 ; r4 = r4 >> r5 10.8.1.9 triadic addressing (tri) in this mode the result of an operation between two or three registers is stored into a third one. rd = rs1 ? rs2 is the general format used in the order rd, rs1, rs1. rd, rs1, rs2 can be any of the 8 general purpose registers r0 r7. if r0 is used as the destination register rd, only the condition code ?gs are updated. this addressing mode is used for all arithmetic and logical operations. examples: adc r5,r6,r7 ; r5 = r6 + r7 + carry sub r5,r6,r7 ; r5 = r6 - r7 10.8.1.10 relative addressing 9-bit wide (rel9) a 9-bit signed word address offset is included in the instruction word. this addressing mode is used for conditional branch instructions. examples: bcc rel9 ; pc = pc + 2 + (rel9 << 1) beq rel9 ; pc = pc + 2 + (rel9 << 1) 10.8.1.11 relative addressing 10-bit wide (rel10) an 10-bit signed word address offset is included in the instruction word. this addressing mode is used for the unconditional branch instruction. examples: bra rel10 ; pc = pc + 2 + (rel10 << 1) 10.8.1.12 index register plus immediate offset (ido5) (rs, #offs5) provides an unsigned offset from the base register. examples: ldb r4,(r1,#offs5) ; loads a byte from (r1+offs5) into r4 stw r4,(r1,#offs5) ; stores r4 as a word to (r1+offs5) chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 383 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8.1.13 index register plus register offset (idr) for load and store instructions (rs, ri) provides a variable offset in a register. examples: ldb r4,(r1,r2) ; loads a byte from (r1+r2) into r4 stw r4,(r1,r2) ; stores r4 as a word to (r1+r2) 10.8.1.14 index register plus register offset with post-increment (idr+) [rs, ri+] provides a variable offset in a register, which is incremented after accessing the memory. in case of a byte access the index register will be incremented by one. in case of a word access it will be incremented by two. examples: ldb r4,(r1,r2+) ; loads a byte from (r1+r2) into r4, r2+=1 stw r4,(r1,r2+) ; stores r4 as a word to (r1+r2), r2+=2 10.8.1.15 index register plus register offset with pre-decrement (?dr) [rs, -ri] provides a variable offset in a register, which is decremented before accessing the memory. in case of a byte access the index register will be decremented by one. in case of a word access it will be decremented by two. examples: ldb r4,(r1,-r2) ; r2 -=1, loads a byte from (r1+r2) into r4 stw r4,(r1,-r2) ; r2 -=2, stores r4 as a word to (r1+r2) 10.8.2 instruction summary and usage 10.8.2.1 load & store instructions any register can be loaded either with an immediate or from the address space using indexed addressing modes. ldl rd,#imm8 ; loads an immediate 8 bit value to the lower byte of rd ldw rd,(rb,ri) ; loads data using rb+ri as effective address ldb rd,(rb, ri+) ; loads data using rb+ri as effective address ; followed by an increment of ri depending on ; the size of the operation the same set of modes is available for the store instructions stb rs,(rb, ri) ; stores data using rb+ri as effective address stw rs,(rb, ri+) ; stores data using rb+ri as effective address ; followed by an increment of ri depending on ; the size of the operation. chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 384 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8.2.2 logic and arithmetic instructions all logic and arithmetic instructions support the 8 bit immediate addressing mode (imm8: rd = rd ? #imm8) and the triadic addressing mode (tri: rd = rs1 ? rs2). all arithmetic is considered as signed, sign, over?w, zero and carry ?g will be updated. the carry will not be affected for logical operations. addl r2,#1 ; increment r2 andh r4,#$fe ; r4.h = r4.h & $fe, clear lower bit of higher byte add r3,r4,r5 ; r3 = r4 + r5 sub r3,r4,r5 ; r3 = r4 - r5 and r3,r4,r5 ; r3 = r4 & r5 logical and on the whole word or r3,r4,r5 ; r3 = r4 | r5 10.8.2.3 register ?register transfers this group comprises transfers from and to some special registers tfr r3,ccr ; transfers the condition code register to the low byte of ; register r3 branch instructions the branch offset is +255 words or -256 words counted from the beginning of the next instruction. since instructions have a xed 16 bit width, the branch offsets are word aligned by shifting the offset value by 2. beq label ; if z flag = 1 branch to label an unconditional branch allows a +511 words or -512 words branch distance. bra label 10.8.2.4 shift instructions shift operations allow the use of a 4 bit wide immediate value to identify a shift width within a 16 bit word. for shift operations a value of 0 does not shift at all, while a value of 15 shifts the register rd by 15 bits. in a second form the shift value is contained in the bits 3:0 of the register rs. examples: lsl r4,#1 ; r4 = r4 << 1; shift register r4 by 1 bit to the left lsr r4,#3 ; r4 = r4 >> 3; shift register r4 by 3 bits to the right asr r4,r2 ; r4 = r4 >> r2;arithmetic shift register r4 right by the amount ; of bits contained in r2[3:0]. chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 385 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8.2.5 bit field operations this addressing mode is used to identify the position and size of a bit ?ld for insertion or extraction. the width and offset are coded in the lower byte of the source register 2, rs2. the content of the upper byte is ignored. an offset of 0 denotes the right most position and a width of 0 denotes 1 bit. these instructions are very useful to extract, insert, clear, set or toggle portions of a 16 bit word figure 10-26. bit field addressing bfext r3,r4,r5 ; r5: w4+1 bits with offset o4, will be extracted from r4 into r3 10.8.2.6 special instructions for dma usage the xgate offers a number of additional instructions for ?g manipulation, program ?w control and debugging: 1. sif: set a channel interrupt flag 2. ssem: test and set a hardware semaphore 3. csem: clear a hardware semaphore 4. brk: software breakpoint 5. nop: no operation 6. rts: terminate the current thread 10.8.3 cycle notation table 10-23 show the xgate access detail notation. each code letter equals one xgate cycle. each letter implies additional wait cycles if memories or peripherals are not accessible. memories or peripherals are not accessible if they are blocked by the s12x_cpu. in addition to this peripherals are only accessible every other xgate cycle. uppercase letters denote 16 bit operations. lowercase letters denote 8 bit operations. the xgate is able to perform two bus or wait cycles per s12x_cpu cycle. w4 o4 15 0 2 5 w4=3, o4=2 15 0 3 bit field extract bit field insert rs2 rs1 rd 0 3 4 7 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 386 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8.4 thread execution when the risc core is triggered by an interrupt request (see figure 10-1 ) it ?st executes a vector fetch sequence which performs three bus accesses: 1. a v -cycle to fetch the initial content of the program counter. 2. a v -cycle to fetch the initial content of the data segment pointer (r1). 3. a p -cycle to load the initial opcode. afterwards a sequence of instructions (thread) is executed which is terminated by an "rts" instruction. if further interrupt requests are pending after a thread has been terminated, a new vector fetch will be performed. otherwise the risc core will either resume a previous thread (beginning with a p -cycle to refetch the interrupted opcode) or it will become idle until a new interrupt request is received. a thread can only be interrupted by an interrupt request of higher priority. 10.8.5 instruction glossary this section describes the xgate instruction set in alphabetical order. table 10-23. access detail notation v vector fetch: always an aligned word read, lasts for at least one risc core cycle p program word fetch: always an aligned word read, lasts for at least one risc core cycle r 8 bit data read: lasts for at least one risc core cycle r 16 bit data read: lasts for at least one risc core cycle w 8 bit data write: lasts for at least one risc core cycle w 16 bit data write: lasts for at least one risc core cycle a alignment cycle: no read or write, lasts for zero or one risc core cycles f free cycle: no read or write, lasts for one risc core cycles special cases pp/p branch: pp if branch taken, p if not chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 387 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 + rs2 + c ? rd adds the content of register rs1, the content of register rs2 and the value of the carry bit using binary addition and stores the result in the destination register rd. the zero flag is also carried forward from the previous operation allowing 32 and more bit additions. example: add r6,r2,r2 adc r7,r3,r3 ; r7:r6 = r5:r4 + r3:r2 bcc ; conditional branch on 32 bit addition ccr effects code and cpu cycles adc add with carry adc nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000 and z was set before this operation; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs1[15] & rs2[15] & rd[15] new | rs1[15] & rs2[15] & rd[15] new c: set if there is a carry from bit 15 of the result; cleared otherwise. rs1[15] & rs2[15] | rs1[15] & rd[15] new | rs2[15] & rd[15] new source form address mode machine code cycles adc rd, rs1, rs2 tri 0 0 0 1 1 rd rs1 rs2 1 1 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 388 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 + rs2 ? rd rd + imm16 ? rd (translates to addl rd, #imm16[7:0]; addh rd, #imm16[15:8]) performs a 16 bit addition and stores the result in the destination register rd. note when using immediate addressing mode (add rd, #imm16), the v-?g and the c-flag of the ?st instruction (addl rd, #imm16[7:0]) are not considered by the second instruction (addh rd, #imm16[15:8]). ? don t rely on the v-flag if rd + imm16[7:0] 2 15 . ? don t rely on the c-flag if rd + imm16[7:0] 2 16 . ccr effects code and cpu cycles add add without carry add nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs1[15] & rs2[15] & rd[15] new | rs1[15] & rs2[15] & rd[15] new refer to addh instruction for #imm16 operations. c: set if there is a carry from bit 15 of the result; cleared otherwise. rs1[15] & rs2[15] | rs1[15] & rd[15] new | rs2[15] & rd[15] new refer to addh instruction for #imm16 operations. source form address mode machine code cycles add rd, rs1, rs2 tri 0 0 0 1 1 rd rs1 rs2 1 0 p add rd, #imm16 imm8 1 1 1 0 0 rd imm16[7:0] p imm8 1 1 1 0 1 rd imm16[15:8] p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 389 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd + imm8:$00 ? rd adds the content of high byte of register rd and a signed immediate 8 bit constant using binary addition and stores the result in the high byte of the destination register rd. this instruction can be used after an addl for a 16 bit immediate addition. example: addl r2,#lowbyte addh r2,#highbyte ; r2 = r2 + 16 bit immediate ccr effects code and cpu cycles addh add immediate 8 bit constant (high byte) addh nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rd[15] old & imm8[7] & rd[15] new | rd[15] old & imm8[7] & rd[15] new c: set if there is a carry from the bit 15 of the result; cleared otherwise. rd[15] old & imm8[7] | rd[15] old & rd[15] new | imm8[7] & rd[15] new source form address mode machine code cycles addh rd, #imm8 imm8 1 1 1 0 1 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 390 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd + $00:imm8 ? rd adds the content of register rd and an unsigned immediate 8 bit constant using binary addition and stores the result in the destination register rd. this instruction must be used ?st for a 16 bit immediate addition in conjunction with the addh instruction. ccr effects code and cpu cycles addl add immediate 8 bit constant (low byte) addl nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the 8 bit operation; cleared otherwise. rd[15] old & rd[15] new c: set if there is a carry from the bit 15 of the result; cleared otherwise. rd[15] old & rd[15] new source form address mode machine code cycles addl rd, #imm8 imm8 1 1 1 0 0 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 391 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 & rs2 ? rd rd & imm16 ? rd (translates to andl rd, #imm16[7:0]; andh rd, #imm16[15:8]) performs a bit wise logical and of two 16 bit values and stores the result in the destination register rd. note when using immediate addressing mode (and rd, #imm16), the z-?g of the ?st instruction (andl rd, #imm16[7:0]) is not considered by the second instruction (andh rd, #imm16[15:8]). ? don t rely on the z-flag. ccr effects code and cpu cycles and logical and and nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. refer to andh instruction for #imm16 operations. v: 0; cleared. c: not affected. source form address mode machine code cycles and rd, rs1, rs2 tri 0 0 0 1 0 rd rs1 rs2 0 0 p and rd, #imm16 imm8 1 0 0 0 0 rd imm16[7:0] p imm8 1 0 0 0 1 rd imm16[15:8] p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 392 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd.h & imm8 ? rd.h performs a bit wise logical and between the high byte of register rd and an immediate 8 bit constant and stores the result in the destination register rd.h. the low byte of rd is not affected. ccr effects code and cpu cycles andh logical and immediate 8 bit constant (high byte) andh nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles andh rd, #imm8 imm8 1 0 0 0 1 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 393 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd.l & imm8 ? rd.l performs a bit wise logical and between the low byte of register rd and an immediate 8 bit constant and stores the result in the destination register rd.l. the high byte of rd is not affected. ccr effects code and cpu cycles andl logical and immediate 8 bit constant (low byte) andl nzvc ?? 0 n: set if bit 7 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles andl rd, #imm8 imm8 1 0 0 0 0 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 394 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation n = rs or imm4 shifts the bits in register rd n positions to the right. the higher n bits of the register rd become ?led with the sign bit (rd[15]). the carry ?g will be updated to the bit contained in rd[n-1] before the shift for n > 0. n can range from 0 to 16. in immediate address mode, n is determined by the operand imm4. n is considered to be 16 if imm4 is equal to 0. in dyadic address mode, n is determined by the content of rs. n is considered to be 16 if the content of rs is greater than 15. ccr effects code and cpu cycles asr arithmetic shift right asr nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rd[15] old ^ rd[15] new c: set if n > 0 and rd[n-1] = 1; if n = 0 unaffected. source form address mode machine code cycles asr rd, #imm4 imm4 0 0 0 0 1 rd imm4 1 0 0 1 p asr rd, rs dya 0 0 0 0 1 rd rs 1 0 0 0 1 p b15 rd c n chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 395 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if c = 0, then pc + $0002 + (rel9 << 1) ? pc tests the carry ?g and branches if c = 0. ccr effects code and cpu cycles bcc branch if carry cleared (same as bhs) bcc nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bcc rel9 rel9 0 0 1 0 0 0 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 396 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if c = 1, then pc + $0002 + (rel9 << 1) ? pc tests the carry ?g and branches if c = 1. ccr effects code and cpu cycles bcs branch if carry set (same as blo) bcs nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bcs rel9 rel9 0 0 1 0 0 0 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 397 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if z = 1, then pc + $0002 + (rel9 << 1) ? pc tests the zero ?g and branches if z = 1. ccr effect code and cpu cycles beq branch if equal beq nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles beq rel9 rel9 0 0 1 0 0 1 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 398 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1[( o + w ): o ] ? rd[ w :0]; 0 ? rd[15:( w +1)] w = (rs2[7:4]) o = (rs2[3:0]) extracts w+1 bits from register rs1 starting at position o and writes them right aligned into register rd. the remaining bits in rd will be cleared. if (o+w) > 15 only bits [15:o] get extracted. ccr effects code and cpu cycles bfext bit field extract bfext nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles bfext rd, rs1, rs2 tri 0 1 1 0 0 rd rs1 rs2 1 1 p w4 o4 15 0 2 5 w4=3, o4=2 15 0 3 bit field extract rs2 rs1 rd 0 15 0 3 74 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 399 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation firstone(rs) ? rd; searches the ?st ??in register rs (from msb to lsb) and writes the bit position into the destination register rd. the upper bits of rd are cleared. in case the content of rs is equal to $0000, rd will be cleared and the carry ?g will be set. this is used to distinguish a ??in position 0 versus no ??in the whole rs register at all. ccr effects code and cpu cycles bffo bit field find first one bffo nzvc 0 ? 0 ? n: 0; cleared. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: set if rs = $0000 (1) ; cleared otherwise. 1. before executing the instruction source form address mode machine code cycles bffo rd, rs dya 0 0 0 0 1 rd rs 1 0 0 0 0 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 400 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1[ w : 0 ] ? rd[( w+o ):o]; w = (rs2[7:4]) o = (rs2[3:0]) extracts w+1 bits from register rs1 starting at position 0 and writes them into register rd starting at position o . the remaining bits in rd are not affected. if (o+w) > 15 the upper bits are ignored. using r0 as a rs1, this command can be used to clear bits. ccr effects code and cpu cycles bfins bit field insert bfins nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles bfins rd, rs1, rs2 tri 0 1 1 0 1 rd rs1 rs2 1 1 p w4 o4 15 0 2 5 w4=3, o4=2 15 0 3 bit field insert rs2 rd rs1 15 0 3 74 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 401 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation !rs1[ w : 0 ] ? rd[ w +o:o]; w = (rs2[7:4]) o = (rs2[3:0]) extracts w+1 bits from register rs1 starting at position 0, inverts them and writes into register rd starting at position o . the remaining bits in rd are not affected. if (o+w) > 15 the upper bits are ignored. using r0 as a rs1, this command can be used to set bits. ccr effects code and cpu cycles bfinsi bit field insert and invert bfinsi nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles bfinsi rd, rs1, rs2 tri 0 1 1 1 0 rd rs1 rs2 1 1 p w4 o4 15 0 2 5 w4=3, o4=2 15 0 3 inverted bit field insert rs2 rd rs1 15 0 3 74 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 402 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation !(rs1[ w : 0 ] ^ rd[w+o:o]) ? rd[ w +o:o]; w = (rs2[7:4]) o = (rs2[3:0]) extracts w+1 bits from register rs1 starting at position 0, performs an xnor with rd[w+o:o] and writes the bits back to rd. the remaining bits in rd are not affected. if (o+w) > 15 the upper bits are ignored. using r0 as a rs1, this command can be used to toggle bits. ccr effects code and cpu cycles bfinsx bit field insert and xnor bfinsx nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles bfinsx rd, rs1, rs2 tri 0 1 1 1 1 rd rs1 rs2 1 1 p w4 o4 15 0 2 5 w4=3, o4=2 15 0 3 bit field insert xnor rs2 rd rs1 15 0 3 74 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 403 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if n ^ v = 0, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare signed numbers. branch if rs1 rs2: sub r0,rs1,rs2 bge rel9 ccr effects code and cpu cycles bge branch if greater than or equal to zero bge nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bge rel9 rel9 0 0 1 1 0 1 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 404 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if z | (n ^ v) = 0, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare signed numbers. branch if rs1 > rs2: sub r0,rs1,rs2 bgt rel9 ccr effects code and cpu cycles bgt branch if greater than zero bgt nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bgt rel9 rel9 0 0 1 1 1 0 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 405 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if c | z = 0, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare unsigned numbers. branch if rs1 > rs2: sub r0,rs1,rs2 bhi rel9 ccr effects code and cpu cycles bhi branch if higher bhi nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bhi rel9 rel9 0 0 1 1 0 0 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 406 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if c = 0, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare unsigned numbers. branch if rs1 rs2: sub r0,rs1,rs2 bhs rel9 ccr effects code and cpu cycles bhs branch if higher or same (same as bcc) bhs nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bhs rel9 rel9 0 0 1 0 0 0 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 407 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd.h & imm8 ? none performs a bit wise logical and between the high byte of register rd and an immediate 8 bit constant. only the condition code ?gs get updated, but no result is written back . ccr effects code and cpu cycles bith bit test immediate 8 bit constant (high byte) bith nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles bith rd, #imm8 imm8 1 0 0 1 1 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 408 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd.l & imm8 ? none performs a bit wise logical and between the low byte of register rd and an immediate 8 bit constant. only the condition code ?gs get updated, but no result is written back . ccr effects code and cpu cycles bitl bit test immediate 8 bit constant (low byte) bitl nzvc ?? 0 n: set if bit 7 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles bitl rd, #imm8 imm8 1 0 0 1 0 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 409 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if z | (n ^ v) = 1, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare signed numbers. branch if rs1 rs2: sub r0,rs1,rs2 ble rel9 ccr effects code and cpu cycles ble branch if less or equal to zero ble nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles ble rel9 rel9 0 0 1 1 1 0 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 410 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if c = 1, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare unsigned numbers. branch if rs1 < rs2: sub r0,rs1,rs2 blo rel9 ccr effects code and cpu cycles blo branch if carry set (same as bcs) blo nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles blo rel9 rel9 0 0 1 0 0 0 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 411 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if c | z = 1, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare unsigned numbers. branch if rs1 rs2: sub r0,rs1,rs2 bls rel9 ccr effects code and cpu cycles bls branch if lower or same bls nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bls rel9 rel9 0 0 1 1 0 0 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 412 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if n ^ v = 1, then pc + $0002 + (rel9 << 1) ? pc branch instruction to compare signed numbers. branch if rs1 < rs2: sub r0,rs1,rs2 blt rel9 ccr effects code and cpu cycles blt branch if lower than zero blt nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles blt rel9 rel9 0 0 1 1 0 1 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 413 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if n = 1, then pc + $0002 + (rel9 << 1) ? pc tests the sign ?g and branches if n = 1. ccr effects code and cpu cycles bmi branch if minus bmi nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bmi rel9 rel9 0 0 1 0 1 0 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 414 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if z = 0, then pc + $0002 + (rel9 << 1) ? pc tests the zero ?g and branches if z = 0. ccr effects code and cpu cycles bne branch if not equal bne nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bne rel9 rel9 0 0 1 0 0 1 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 415 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if n = 0, then pc + $0002 + (rel9 << 1) ? pc tests the sign ?g and branches if n = 0. ccr effects code and cpu cycles bpl branch if plus bpl nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bpl rel9 rel9 0 0 1 0 1 0 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 416 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation pc + $0002 + (rel10 << 1) ? pc branches always . ccr effects code and cpu cycles bra branch always bra nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bra rel10 rel10 0 0 1 1 1 1 rel10 pp chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 417 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation put xgate into debug mode (see section 10.6.1.0.1, ?ntering debug mode ) and signals a software breakpoint to the s12x_dbg module (see section 4.9 of the s12x_dbg section ). note it is not possible to single step over a brk instruction. this instruction does not advance the program counter. ccr effects code and cpu cycles brk break brk nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles brk inh 0000000000000000 paff chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 418 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if v = 0, then pc + $0002 + (rel9 << 1) ? pc tests the over?w ?g and branches if v = 0. ccr effects code and cpu cycles bvc branch if overflow cleared bvc nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bvc rel9 rel9 0 0 1 0 1 1 0 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 419 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation if v = 1, then pc + $0002 + (rel9 << 1) ? pc tests the over?w ?g and branches if v = 1. ccr effects code and cpu cycles bvs branch if overflow set bvs nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles bvs rel9 rel9 0 0 1 0 1 1 1 rel9 pp/p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 420 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 ?rs2 ? none (translates to sub r0, rs1, rs2) rd imm16 ? none (translates to cmpl rd, #imm16[7:0]; cpch rd, #imm16[15:8]) subtracts two 16 bit values and discards the result. ccr effects code and cpu cycles cmp compare cmp nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs1[15] & rs2[15] & result[15] | rs1[15] & rs2[15] & result[15] rd[15] & imm16[15] & result[15] | rd[15] & imm16[15] & result[15] c: set if there is a carry from the bit 15 of the result; cleared otherwise. rs1[15] & rs2[15] | rs1[15] & result[15] | rs2[15] & result[15] rd[15] & imm16[15] | rd[15] & result[15] | imm16[15] & result[15] source form address mode machine code cycles cmp rs1, rs2 tri 0 0 0 1 1 0 0 0 rs1 rs2 0 0 p cmp rs, #imm16 imm8 1 1 0 1 0 rs imm16[7:0] p imm8 1 1 0 1 1 rs imm16[15:8] p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 421 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs.l ?imm8 ? none, only condition code ?gs get updated subtracts the 8 bit constant imm8 contained in the instruction code from the low byte of the source register rs.l using binary subtraction and updates the condition code register accordingly. remark: there is no equivalent operation using triadic addressing. comparing the values of two registers can be performed by using the subtract instruction with r0 as destination register. ccr effects code and cpu cycles cmpl compare immediate 8 bit constant (low byte) cmpl nzvc ???? n: set if bit 7 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: set if a two s complement over?w resulted from the 8 bit operation; cleared otherwise. rs[7] & imm8[7] & result[7] | rs[7] & imm8[7] & result[7] c: set if there is a carry from the bit 7 to bit 8 of the result; cleared otherwise. rs[7] & imm8[7] | rs[7] & result[7] | imm8[7] & result[7] source form address mode machine code cycles cmpl rs, #imm8 imm8 1 1 0 1 0 rs imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 422 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation ~rs ? rd (translates to xnor rd, r0, rs) ~rd ? rd (translates to xnor rd, r0, rd) performs a one s complement on a general purpose register. ccr effects code and cpu cycles com one? complement com nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles com rd, rs tri 0 0 0 1 0 rd 0 0 0 rs 1 1 p com rd tri 0 0 0 1 0 rd 0 0 0 rd 1 1 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 423 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 ?rs2 - c ? none (translates to sbc r0, rs1, rs2) subtracts the carry bit and the content of register rs2 from the content of register rs1 using binary subtraction and discards the result. ccr effects code and cpu cycles cpc compare with carry cpc nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs1[15] & rs2[15] & result[15] | rs1[15] & rs2[15] & result[15] c: set if there is a carry from the bit 15 of the result; cleared otherwise. rs1[15] & rs2[15] | rs1[15] & result[15] | rs2[15] & result[15] source form address mode machine code cycles cpc rs1, rs2 tri 0 0 0 1 1 0 0 0 rs1 rs2 0 1 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 424 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs.h - imm8 - c ? none, only condition code ?gs get updated subtracts the carry bit and the 8 bit constant imm8 contained in the instruction code from the high byte of the source register rd using binary subtraction and updates the condition code register accordingly. the carry bit and zero bits are taken into account to allow a 16 bit compare in the form of cmpl r2,#lowbyte cpch r2,#highbyte bcc ; branch condition remark: there is no equivalent operation using triadic addressing. comparing the values of two registers can be performed by using the subtract instruction with r0 as destination register. ccr effects code and cpu cycles cpch compare immediate 8 bit constant with carry (high byte) cpch nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $00 and z was set before this operation; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs[15] & imm8[7] & result[15] | rs[15] & imm8[7] & result[15] c: set if there is a carry from the bit 15 of the result; cleared otherwise. rs[15] & imm8[7] | rs[15] & result[15] | imm8[7] & result[15] source form address mode machine code cycles cpch rd, #imm8 imm8 1 1 0 1 1 rs imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 425 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation unlocks a semaphore that was locked by the risc core. in monadic address mode, bits rs[2:0] select the semaphore to be cleared. ccr effects code and cpu cycles csem clear semaphore csem nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles csem #imm3 imm3 00000 imm3 1 1110000 pa csem rs mon 00000 rs 11110001 pa chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 426 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation n = rs or imm4 shifts the bits in register rd n positions to the left. the lower n bits of the register rd become ?led with the carry ?g. the carry ?g will be updated to the bit contained in rd[16-n] before the shift for n > 0. n can range from 0 to 16. in immediate address mode, n is determined by the operand imm4. n is considered to be 16 if imm4 is equal to 0. in dyadic address mode, n is determined by the content of rs. n is considered to be 16 if the content of rs is greater than 15. ccr effects code and cpu cycles csl logical shift left with carry csl nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rd[15] old ^ rd[15] new c: set if n > 0 and rd[16-n] = 1; if n = 0 unaffected. source form address mode machine code cycles csl rd, #imm4 imm4 0 0 0 0 1 rd imm4 1 0 1 0 p csl rd, rs dya 0 0 0 0 1 rd rs 1 0 0 1 0 p c rd c c c n bits c n chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 427 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation n = rs or imm4 shifts the bits in register rd n positions to the right. the higher n bits of the register rd become ?led with the carry ?g. the carry ?g will be updated to the bit contained in rd[n-1] before the shift for n >0. n can range from 0 to 16. in immediate address mode, n is determined by the operand imm4. n is considered to be 16 if imm4 is equal to 0. in dyadic address mode, n is determined by the content of rs. n is considered to be 16 if the content of rs is greater than 15. ccr effects code and cpu cycles csr logical shift right with carry csr nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rd[15] old ^ rd[15] new c: set if n > 0 and rd[n-1] = 1; if n = 0 unaffected. source form address mode machine code cycles csr rd, #imm4 imm4 0 0 0 0 1 rd imm4 1 0 1 1 p csr rd, rs dya 0 0 0 0 1 rd rs 1 0 0 1 1 p c c rd c c n bits c n chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 428 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation pc + $0002 ? rd; rd ? pc jumps to the address stored in rd and saves the return address in rd. ccr effects code and cpu cycles jal jump and link jal nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles jal rd mon 00000 rd 11110110 pp chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 429 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation m[rb, #offs5] ? rd.l; $00 ? rd.h m[rb, ri ]? rd.l; $00 ? rd.h m[rb, ri] ? rd.l; $00 ? rd.h; ri+1 ? ri; 1 ri-1 ? ri; m[rs, ri] ? rd.l; $00 ? rd.h loads a byte from memory into the low byte of register rd. the high byte is cleared. ccr effects code and cpu cycles ldb load byte from memory (low byte) ldb 1. if the same general purpose register is used as index (ri) and destination register (rd), the content of the register will not be incremented after the data move: m[rb, ri] ? rd.l; $00 ? rd.h nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles ldb rd, (rb, #offs5) ido5 0 1 0 0 0 rd rb offs5 pr ldb rd, (rs, ri) idr 0 1 1 0 0 rd rb ri 0 0 pr ldb rd, (rs, ri+) idr+ 0 1 1 0 0 rd rb ri 0 1 pr ldb rd, (rs, -ri) -idr 0 1 1 0 0 rd rb ri 1 0 pr chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 430 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation imm8 ? rd.h; loads an 8 bit immediate constant into the high byte of register rd. the low byte is not affected. ccr effects code and cpu cycles ldh load immediate 8 bit constant (high byte) ldh nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles ldh rd, #imm8 imm8 1 1 1 1 1 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 431 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation imm8 ? rd.l; $00 ? rd.h loads an 8 bit immediate constant into the low byte of register rd. the high byte is cleared. ccr effects code and cpu cycles ldl load immediate 8 bit constant (low byte) ldl nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles ldl rd, #imm8 imm8 1 1 1 1 0 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 432 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation m[rb, #offs5 ]? rd m[rb, ri ]? rd m[rb, ri] ? rd; ri+2 ? ri 1 ri-2 ? ri; m[rs, ri] ? rd imm16 ? rd (translates to ldl rd, #imm16[7:0]; ldh rd, #imm16[15:8]) loads a 16 bit value into the register rd. ccr effects code and cpu cycles ldw load word from memory ldw 1. if the same general purpose register is used as index (ri) and destination register (rd), the content of the register will not be incremented after the data move: m[rb, ri] ? rd nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles ldw rd, (rb, #offs5) ido5 0 1 0 0 1 rd rb offs5 pr ldw rd, (rb, ri) idr 0 1 1 0 1 rd rb ri 0 0 pr ldw rd, (rb, ri+) idr+ 0 1 1 0 1 rd rb ri 0 1 pr ldw rd, (rb, -ri) -idr 0 1 1 0 1 rd rb ri 1 0 pr ldw rd, #imm16 imm8 1 1 1 1 0 rd imm16[7:0] p imm8 1 1 1 1 1 rd imm16[15:8] p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 433 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation n = rs or imm4 shifts the bits in register rd n positions to the left. the lower n bits of the register rd become ?led with zeros. the carry ?g will be updated to the bit contained in rd[16-n] before the shift for n > 0. n can range from 0 to 16. in immediate address mode, n is determined by the operand imm4. n is considered to be 16 in imm4 is equal to 0. in dyadic address mode, n is determined by the content of rs. n is considered to be 16 if the content of rs is greater than 15. ccr effects code and cpu cycles lsl logical shift left lsl nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rd[15] old ^ rd[15] new c: set if n > 0 and rd[16-n] = 1; if n = 0 unaffected. source form address mode machine code cycles lsl rd, #imm4 imm4 0 0 0 0 1 rd imm4 1 1 0 0 p lsl rd, rs dya 0 0 0 0 1 rd rs 1 0 1 0 0 p 0 rd 0 0 0 n bits c n chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 434 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation n = rs or imm4 shifts the bits in register rd n positions to the right. the higher n bits of the register rd become ?led with zeros. the carry ?g will be updated to the bit contained in rd[n-1] before the shift for n > 0. n can range from 0 to 16. in immediate address mode, n is determined by the operand imm4. n is considered to be 16 in imm4 is equal to 0. in dyadic address mode, n is determined by the content of rs. n is considered to be 16 if the content of rs is greater than 15. ccr effects code and cpu cycles lsr logical shift right lsr nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rd[15] old ^ rd[15] new c: set if n > 0 and rd[n-1] = 1; if n = 0 unaffected. source form address mode machine code cycles lsr rd, #imm4 imm4 0 0 0 0 1 rd imm4 1 1 0 1 p lsr rd, rs dya 0 0 0 0 1 rd rs 1 0 1 0 1 p 0 rd 0 0 0 n bits c n chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 435 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs ? rd (translates to or rd, r0, rs) copies the content of rs to rd. ccr effects code and cpu cycles mov move register content mov nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles mov rd, rs tri 0 0 0 1 0 rd 0 0 0 rs 1 0 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 436 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation ?s ? rd (translates to sub rd, r0, rs) ?d ? rd (translates to sub rd, r0, rd) performs a two s complement on a general purpose register. ccr effects code and cpu cycles neg two? complement neg nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs[15] & rd[15] new c: set if there is a carry from the bit 15 of the result; cleared otherwise rs[15] | rd[15] new source form address mode machine code cycles neg rd, rs tri 0 0 0 1 1 rd 0 0 0 rs 0 0 p neg rd tri 0 0 0 1 1 rd 0 0 0 rd 0 0 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 437 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation no operation for one cycle. ccr effects code and cpu cycles nop no operation nop nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles nop inh 0000000100000000 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 438 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 | rs2 ? rd rd | imm16 ? rd (translates to orl rd, #imm16[7:0]; orh rd, #imm16[15:8] performs a bit wise logical or between two 16 bit values and stores the result in the destination register rd. note when using immediate addressing mode (or rd, #imm16), the z-?g of the ?st instruction (orl rd, #imm16[7:0]) is not considered by the second instruction (orh rd, #imm16[15:8]). ? don t rely on the z-flag. ccr effects code and cpu cycles or logical or or nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. refer to orh instruction for #imm16 operations. v: 0; cleared. c: not affected. source form address mode machine code cycles or rd, rs1, rs2 tri 0 0 0 1 0 rd rs1 rs2 1 0 p or rd, #imm16 imm8 1 0 1 0 0 rd imm16[7:0] p imm8 1 0 1 0 1 rd imm16[15:8] p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 439 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd.h | imm8 ? rd.h performs a bit wise logical or between the high byte of register rd and an immediate 8 bit constant and stores the result in the destination register rd.h. the low byte of rd is not affected. ccr effects code and cpu cycles orh logical or immediate 8 bit constant (high byte) orh nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles orh rd, #imm8 imm8 1 0 1 0 1 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 440 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd.l | imm8 ? rd.l performs a bit wise logical or between the low byte of register rd and an immediate 8 bit constant and stores the result in the destination register rd.l. the high byte of rd is not affected. ccr effects code and cpu cycles orl logical or immediate 8 bit constant (low byte) orl nzvc ?? 0 n: set if bit 7 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles orl rd, #imm8 imm8 1 0 1 0 0 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 441 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation calculates the number of ones in the register rd. the carry ?g will be set if the number is odd, otherwise it will be cleared. ccr effects code and cpu cycles pa r calculate parity par nzvc 0 ? 0 ? n: 0; cleared. z: set if rd is $0000; cleared otherwise. v: 0; cleared. c: set if the number of ones in the register rd is odd; cleared otherwise. source form address mode machine code cycles par, rd mon 0 0 0 0 0 rd 1 1 1 1 0 1 0 1 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 442 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation n = rs or imm4 rotates the bits in register rd n positions to the left. the lower n bits of the register rd are ?led with the upper n bits. two source forms are available. in the ?st form, the parameter n is contained in the instruction code as an immediate operand. in the second form, the parameter is contained in the lower bits of the source register rs[3:0]. all other bits in rs are ignored. if n is zero, no shift will take place and the register rd will be unaffected; however, the condition code ?gs will be updated. ccr effects code and cpu cycles rol rotate left rol nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles rol rd, #imm4 imm4 0 0 0 0 1 rd imm4 1 1 1 0 p rol rd, rs dya 0 0 0 0 1 rd rs 1 0 1 1 0 p rd n bits chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 443 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation n = rs or imm4 rotates the bits in register rd n positions to the right. the upper n bits of the register rd are ?led with the lower n bits. two source forms are available. in the ?st form, the parameter n is contained in the instruction code as an immediate operand. in the second form, the parameter is contained in the lower bits of the source register rs[3:0]. all other bits in rs are ignored. if n is zero no shift will take place and the register rd will be unaffected; however, the condition code ?gs will be updated. ccr effects code and cpu cycles ror rotate right ror nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles ror rd, #imm4 imm4 0 0 0 0 1 rd imm4 1 1 1 1 p ror rd, rs dya 0 0 0 0 1 rd rs 1 0 1 1 1 p rd n bits chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 444 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation terminates the current thread of program execution. ccr effects code and cpu cycles rts return to scheduler rts nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles rts inh 0000001000000000 pa chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 445 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 - rs2 - c ? rd subtracts the content of register rs2 and the value of the carry bit from the content of register rs1 using binary subtraction and stores the result in the destination register rd. also the zero ?g is carried forward from the previous operation allowing 32 and more bit subtractions. example: sub r6,r4,r2 sbc r7,r5,r3 ; r7:r6 = r5:r4 - r3:r2 bcc ; conditional branch on 32 bit subtraction ccr effects code and cpu cycles sbc subtract with carry sbc nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000 and z was set before this operation; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs1[15] & rs2[15] & rd[15] new | rs1[15] & rs2[15] & rd[15] new c: set if there is a carry from bit 15 of the result; cleared otherwise. rs1[15] & rs2[15] | rs1[15] & rd[15] new | rs2[15] & rd[15] new source form address mode machine code cycles sbc rd, rs1, rs2 tri 0 0 0 1 1 rd rs1 rs2 0 1 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 446 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation the result in rd is the 16 bit sign extended representation of the original two s complement number in the low byte of rd.l. ccr effects code and cpu cycles sex sign extend byte to word sex nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles sex rd mon 0 0 0 0 0 rd 1 1 1 1 0 1 0 0 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 447 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation sets the interrupt ?g of an xgate channel (xgif). this instruction supports two source forms. if inherent address mode is used, then the interrupt flag of the current channel (xgchid) will be set. if the monadic address form is used, the interrupt ?g associated with the channel id number contained in rs[6:0] is set. the content of rs[15:7] is ignored. note interrupt ?gs of reserved channels (see device user guide) can t be set. ccr effects code and cpu cycles sif set interrupt flag sif nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles sif inh 0000001100000000 pa sif rs mon 0 0 0 0 0 rs 1 1 1 1 0 1 1 1 pa chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 448 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation attempts to set a semaphore. the state of the semaphore will be stored in the carry-flag: 1 = semaphore is locked by the risc core 0 = semaphore is locked by the s12x_cpu in monadic address mode, bits rs[2:0] select the semaphore to be set. ccr effects code and cpu cycles ssem set semaphore ssem nzvc ? n: not affected. z: not affected. v: not affected. c: set if semaphore is locked by the risc core; cleared otherwise. source form address mode machine code cycles ssem #imm3 imm3 0 0 0 0 0 imm3 1 1 1 1 0 0 1 0 pa ssem rs mon 0 0 0 0 0 rs 1 1 1 1 0 0 1 1 pa chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 449 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs.l ? m[rb, #offs5 ] rs.l ? m[rb, ri ] rs.l ? m[rb, ri]; ri+1 ? ri; ri? ? ri; rs.l ? m[rb, ri] 1 stores the low byte of register rs to memory. ccr effects code and cpu cycles stb store byte to memory (low byte) stb 1. if the same general purpose register is used as index (ri) and source register (rs), the unmodi?d content of the source register is written to the memory: rs.l ? m[rb, rs-1]; rs-1 ? rs nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles stb rs, (rb, #offs5), ido5 0 1 0 1 0 rs rb offs5 pw stb rs, (rb, ri) idr 0 1 1 1 0 rs rb ri 0 0 pw stb rs, (rb, ri+) idr+ 0 1 1 1 0 rs rb ri 0 1 pw stb rs, (rb, -ri) -idr 0 1 1 1 0 rs rb ri 1 0 pw chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 450 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs ? m[rb, #offs5 ] rs ? m[rb, ri ] rs ? m[rb, ri]; ri+2 ? ri; ri? ? ri; rs ? m[rb, ri] 1 stores the content of register rs to memory. ccr effects code and cpu cycles stw store word to memory stw 1. if the same general purpose register is used as index (ri) and source register (rs), the unmodi?d content of the source register is written to the memory: rs ? m[rb, rs?]; rs? ? rs nzvc n: not affected. z: not affected. v: not affected. c: not affected. source form address mode machine code cycles stw rs, (rb, #offs5) ido5 0 1 0 1 1 rs rb offs5 pw stw rs, (rb, ri) idr 0 1 1 1 1 rs rb ri 0 0 pw stw rs, (rb, ri+) idr+ 0 1 1 1 1 rs rb ri 0 1 pw stw rs, (rb, -ri) -idr 0 1 1 1 1 rs rb ri 1 0 pw chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 451 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs1 ?rs2 ? rd rd ? imm16 ? rd (translates to subl rd, #imm16[7:0]; subh rd, #imm16{15:8]) subtracts two 16 bit values and stores the result in the destination register rd. note when using immediate addressing mode (sub rd, #imm16), the v-?g and the c-flag of the ?st instruction (subl rd, #imm16[7:0]) are not considered by the second instruction (subh rd, #imm16[15:8]). ? don t rely on the v-flag if rd - imm16[7:0] < ? 2 15 . ? don t rely on the c-flag if rd < imm16[7:0]. ccr effects code and cpu cycles sub subtract without carry sub nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs1[15] & rs2[15] & rd[15] new | rs1[15] & rs2[15] & rd[15] new refer to subh instruction for #imm16 operations. c: set if there is a carry from the bit 15 of the result; cleared otherwise. rs1[15] & rs2[15] | rs1[15] & rd[15] new | rs2[15] & rd[15] new refer to subh instruction for #imm16 operations. source form address mode machine code cycles sub rd, rs1, rs2 tri 0 0 0 1 1 rd rs1 rs2 0 0 p sub rd, #imm16 imm8 1 1 0 0 0 rd imm16[7:0] p imm8 1 1 0 0 1 rd imm16[15:8] p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 452 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd ?imm8:$00 ? rd subtracts a signed immediate 8 bit constant from the content of high byte of register rd and using binary subtraction and stores the result in the high byte of destination register rd. this instruction can be used after an subl for a 16 bit immediate subtraction. example: subl r2,#lowbyte subh r2,#highbyte ; r2 = r2 - 16 bit immediate ccr effects code and cpu cycles subh subtract immediate 8 bit constant (high byte) subh nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rd[15] old & imm8[7] & rd[15] new | rd[15] old & imm8[7] & rd[15] new c: set if there is a carry from the bit 15 of the result; cleared otherwise. rd[15] old & imm8[7] | rd[15] old & rd[15] new | imm8[7] & rd[15] new source form address mode machine code cycles subh rd, #imm8 imm8 1 1 0 0 1 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 453 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rd ?$00:imm8 ? rd subtracts an immediate 8 bit constant from the content of register rd using binary subtraction and stores the result in the destination register rd. ccr effects code and cpu cycles subl subtract immediate 8 bit constant (low byte) subl nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the 8 bit operation; cleared otherwise. rd[15] old & rd[15] new c: set if there is a carry from the bit 15 of the result; cleared otherwise. rd[15] old & rd[15] new source form address mode machine code cycles subl rd, #imm8 imm8 1 1 0 0 0 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 454 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation tfr rd,ccr: ccr ? rd[3:0]; 0 ? rd[15:4] tfr ccr,rd: rd[3:0] ? ccr tfr rd,pc: pc+4 ? rd transfers the content of one risc core register to another. the tfr rd,pc instruction can be used to implement relative subroutine calls. example: tfr r7,pc ;return address (retaddr) is stored in r7 bra subr ;relative branch to subroutine (subr) retaddr ... subr ... jal r7 ;jump to return address (retaddr) ccr effects code and cpu cycles tfr transfer from and to special registers tfr source form address mode machine code cycles tfr rd,ccr ccr ? rd mon 00000 rd 11111000 p tfr ccr,rs rs ? ccr mon 00000 rs 11111001 p tfr rd,pcpc+4 ? rd mon 00000 rd 11111010 p tfr rd,ccr, tfr rd,pc: tfr ccr,rs: nzvc n: not affected. z: not affected. v: not affected. c: not affected. nzvc ???? n: rs[3]. z: rs[2]. v: rs[1]. c: rs[0]. chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 455 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation rs ?0 ? none (translates to sub r0, rs, r0) subtracts zero from the content of register rs using binary subtraction and discards the result. ccr effects code and cpu cycles tst test register tst nzvc ???? n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. v: set if a two s complement over?w resulted from the operation; cleared otherwise. rs[15] & result[15] c: set if there is a carry from the bit 15 of the result; cleared otherwise. rs1[15] & result[15] source form address mode machine code cycles tst rs tri 0 0 0 1 1 0 0 0 rs1 0 0 0 0 0 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 456 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation ~(rs1 ^ rs2) ? rd ~(rd ^ imm16) ? rd (translates to xnor rd, #imm16{15:8]; xnor rd, #imm16[7:0]) performs a bit wise logical exclusive nor between two 16 bit values and stores the result in the destination register rd. remark: using r0 as a source registers will calculate the one s complement of the other source register. using r0 as both source operands will ?l rd with $ffff. note when using immediate addressing mode (xnor rd, #imm16), the z-?g of the ?st instruction (xnorl rd, #imm16[7:0]) is not considered by the second instruction (xnorh rd, #imm16[15:8]). ? don t rely on the z-flag. ccr effects code and cpu cycles xnor logical exclusive nor xnor nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the result is $0000; cleared otherwise. refer to xnorh instruction for #imm16 operations. v: 0; cleared. c: not affected. source form address mode machine code cycles xnor rd, rs1, rs2 tri 0 0 0 1 0 rd rs1 rs2 1 1 p xnor rd, #imm16 imm8 1 0 1 1 0 rd imm16[7:0] p imm8 1 0 1 1 1 rd imm16[15:8] p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 457 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation ~(rd.h ^ imm8) ? rd.h performs a bit wise logical exclusive nor between the high byte of register rd and an immediate 8 bit constant and stores the result in the destination register rd.h. the low byte of rd is not affected. ccr effects code and cpu cycles xnorh logical exclusive nor immediate 8 bit constant (high byte) xnorh nzvc ?? 0 n: set if bit 15 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles xnorh rd, #imm8 imm8 1 0 1 1 1 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 458 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 operation ~(rd.l ^ imm8) ? rd.l performs a bit wise logical exclusive nor between the low byte of register rd and an immediate 8 bit constant and stores the result in the destination register rd.l. the high byte of rd is not affected. ccr effects code and cpu cycles xnorl logical exclusive nor immediate 8 bit constant (low byte) xnorl nzvc ?? 0 n: set if bit 7 of the result is set; cleared otherwise. z: set if the 8 bit result is $00; cleared otherwise. v: 0; cleared. c: not affected. source form address mode machine code cycles xnorl rd, #imm8 imm8 1 0 1 1 0 rd imm8 p chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 459 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.8.6 instruction coding table 10-24 summarizes all xgate instructions in the order of their machine coding. table 10-24. instruction set summary (sheet 1 of 3) functionality 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 return to scheduler and others brk 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 nop 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 rts 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 sif 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 semaphore instructions csem imm3 0 0 0 0 0 imm3 11110000 csem rs 0 0 0 0 0 rs 11110001 ssem imm3 0 0 0 0 0 imm3 11110010 ssem rs 0 0 0 0 0 rs 11110011 single register instructions sex rd 0 0 0 0 0 rd 11110100 par rd 0 0 0 0 0 rd 11110101 jal rd 0 0 0 0 0 rd 11110110 sif rs 0 0 0 0 0 rs 11110111 special move instructions tfr rd,ccr 0 0 0 0 0 rd 11111000 tfr ccr,rs 0 0 0 0 0 rs 11111001 tfr rd,pc 0 0 0 0 0 rd 11111010 shift instructions dyadic bffo rd, rs 0 0 0 0 1 rd rs 1 0 0 0 0 asr rd, rs 0 0 0 0 1 rd rs 1 0 0 0 1 csl rd, rs 0 0 0 0 1 rd rs 1 0 0 1 0 csr rd, rs 0 0 0 0 1 rd rs 1 0 0 1 1 lsl rd, rs 0 0 0 0 1 rd rs 1 0 1 0 0 lsr rd, rs 0 0 0 0 1 rd rs 1 0 1 0 1 rol rd, rs 0 0 0 0 1 rd rs 1 0 1 1 0 ror rd, rs 0 0 0 0 1 rd rs 1 0 1 1 1 shift instructions immediate asr rd, #imm4 0 0 0 0 1 rd imm4 1 0 0 1 csl rd, #imm4 0 0 0 0 1 rd imm4 1 0 1 0 csr rd, #imm4 0 0 0 0 1 rd imm4 1 0 1 1 lsl rd, #imm4 0 0 0 0 1 rd imm4 1 1 0 0 lsr rd, #imm4 0 0 0 0 1 rd imm4 1 1 0 1 rol rd, #imm4 0 0 0 0 1 rd imm4 1 1 1 0 ror rd, #imm4 0 0 0 0 1 rd imm4 1 1 1 1 logical triadic and rd, rs1, rs2 00010 rd rs1 rs2 00 or rd, rs1, rs2 00010 rd rs1 rs2 10 xnor rd, rs1, rs2 00010 rd rs1 rs2 11 arithmetic triadic for compare use sub r0,rs1,rs2 sub rd, rs1, rs2 0 0 0 1 1 rd rs1 rs2 0 0 sbc rd, rs1, rs2 0 0 0 1 1 rd rs1 rs2 0 1 add rd, rs1, rs2 0 0 0 1 1 rd rs1 rs2 1 0 adc rd, rs1, rs2 0 0 0 1 1 rd rs1 rs2 1 1 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 460 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 branches bcc rel9 0 0 1 0 0 0 0 rel9 bcs rel9 0 0 1 0 0 0 1 rel9 bne rel9 0 0 1 0 0 1 0 rel9 beq rel9 0 0 1 0 0 1 1 rel9 bpl rel9 0 0 1 0 1 0 0 rel9 bmi rel9 0 0 1 0 1 0 1 rel9 bvc rel9 0 0 1 0 1 1 0 rel9 bvs rel9 0 0 1 0 1 1 1 rel9 bhi rel9 0 0 1 1 0 0 0 rel9 bls rel9 0 0 1 1 0 0 1 rel9 bge rel9 0 0 1 1 0 1 0 rel9 blt rel9 0 0 1 1 0 1 1 rel9 bgt rel9 0 0 1 1 1 0 0 rel9 ble rel9 0 0 1 1 1 0 1 rel9 bra rel10 0 0 1 1 1 1 rel10 load and store instructions ldb rd, (rb, #offs5) 0 1 0 0 0 rd rb offs5 ldw rd, (rb, #offs5) 0 1 0 0 1 rd rb offs5 stb rs, (rb, #offs5) 0 1 0 1 0 rs rb offs5 stw rs, (rb, #offs5) 0 1 0 1 1 rs rb offs5 ldb rd, (rb, ri) 0 1 1 0 0 rd rb ri 0 0 ldw rd, (rb, ri) 0 1 1 0 1 rd rb ri 0 0 stb rs, (rb, ri) 0 1 1 1 0 rs rb ri 0 0 stw rs, (rb, ri) 0 1 1 1 1 rs rb ri 0 0 ldb rd, (rb, ri+) 0 1 1 0 0 rd rb ri 0 1 ldw rd, (rb, ri+) 0 1 1 0 1 rd rb ri 0 1 stb rs, (rb, ri+) 0 1 1 1 0 rs rb ri 0 1 stw rs, (rb, ri+) 0 1 1 1 1 rs rb ri 0 1 ldb rd, (rb, ?i) 0 1 1 0 0 rd rb ri 1 0 ldw rd, (rb, ?i) 0 1 1 0 1 rd rb ri 1 0 stb rs, (rb, ?i) 0 1 1 1 0 rs rb ri 1 0 stw rs, (rb, ?i) 0 1 1 1 1 rs rb ri 1 0 bit field instructions bfext rd, rs1, rs2 0 1 1 0 0 rd rs1 rs2 1 1 bfins rd, rs1, rs2 0 1 1 0 1 rd rs1 rs2 1 1 bfinsi rd, rs1, rs2 0 1 1 1 0 rd rs1 rs2 1 1 bfinsx rd, rs1, rs2 0 1 1 1 1 rd rs1 rs2 1 1 logic immediate instructions andl rd, #imm8 1 0 0 0 0 rd imm8 andh rd, #imm8 1 0 0 0 1 rd imm8 bitl rd, #imm8 1 0 0 1 0 rd imm8 bith rd, #imm8 1 0 0 1 1 rd imm8 orl rd, #imm8 1 0 1 0 0 rd imm8 orh rd, #imm8 1 0 1 0 1 rd imm8 xnorl rd, #imm8 1 0 1 1 0 rd imm8 xnorh rd, #imm8 1 0 1 1 1 rd imm8 table 10-24. instruction set summary (sheet 2 of 3) functionality 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 461 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 10.9 initialization and application information 10.9.1 initialization the recommended initialization of the xgate is as follows: 1. clear the xge bit to suppress any incoming service requests. 2. make sure that no thread is running on the xgate. this can be done in several ways: a) poll the xgchid register until it reads $00. also poll xgdbg and xgswef to make sure that the xgate has not been stopped. b) enter debug mode by setting the xgdbg bit. clear the xgchid register. clear the xgdbg bit. the recommended method is a). 3. set the xgvbr register to the lowest address of the xgate vector space. 4. clear all channel id ?gs. 5. copy xgate vectors and code into the ram. 6. initialize the s12x_int module. 7. enable the xgate by setting the xge bit. the following code example implements the xgate initialization sequence. 10.9.2 code example (transmit "hello world!" on sci) cpu s12x ;########################################### ;# symbols # ;########################################### sci_regs equ $00c8 ;sci register space scibdh equ sci_regs+$00; ;sci baud rate register scibdl equ sci_regs+$00 ;sci baud rate register scicr2 equ sci_regs+$03 ;sci control register 2 scisr1 equ sci_regs+$04 ;sci status register 1 scidrl equ sci_regs+$07 ;sci control register 2 tie equ $80 ;tie bit mask te equ $08 ;te bit mask re equ $04 ;re bit mask arithmetic immediate instructions subl rd, #imm8 1 1 0 0 0 rd imm8 subh rd, #imm8 1 1 0 0 1 rd imm8 cmpl rs, #imm8 1 1 0 1 0 rs imm8 cpch rs, #imm8 1 1 0 1 1 rs imm8 addl rd, #imm8 1 1 1 0 0 rd imm8 addh rd, #imm8 1 1 1 0 1 rd imm8 ldl rd, #imm8 1 1 1 1 0 rd imm8 ldh rd, #imm8 1 1 1 1 1 rd imm8 table 10-24. instruction set summary (sheet 3 of 3) functionality 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 462 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 sci_vec equ $d6 ;sci vector number int_regs equ $0120 ;s12x_int register space int_cfaddr equ int_regs+$07 ;interrupt configuration address register int_cfdata equ int_regs+$08 ;interrupt configuration data registers rqst equ $80 ;rqst bit mask xgate_regs equ $0380 ;xgate register space xgmctl equ xgate_regs+$00 ;xgate module control register xgmctl_clear equ $fa02 ;clear all xgmctl bits xgmctl_enable equ $8282 ;enable xgate xgchid equ xgate_regs+$02 ;xgate channel id register xgispsel equ xgate_regs+$05 ;xgate channel id register xgvbr equ xgate_regs+$06 ;xgate isp select register xgif equ xgate_regs+$08 ;xgate interrupt flag vector xgswt equ xgate_regs+$18 ;xgate software trigger register xgsem equ xgate_regs+$1a ;xgate semaphore register rpage equ $0016 ram_size equ 32*$400 ;32k ram ram_start equ $1000 ram_start_xg equ $10000-ram_size ram_start_glob equ $100000-ram_size xgate_vectors equ ram_start xgate_vectors_xg equ ram_start_xg xgate_data equ ram_start+(4*128) xgate_data_xg equ ram_start_xg+(4*128) xgate_code equ xgate_data+(xgate_code_flash-xgate_data_flash) xgate_code_xg equ xgate_data_xg+(xgate_code_flash-xgate_data_flash) bus_freq_hz equ 40000000 ;########################################### ;# s12xe vector table # ;########################################### org $ff10 ;non-maskable interrupts dw dummy_isr dummy_isr dummy_isr dummy_isr org $fff4 ;non-maskable interrupts dw dummy_isr dummy_isr dummy_isr org $fffa ;resets dw start_of_code start_of_code start_of_code ;########################################### ;# disable cop # ;########################################### org $ff0e dw $fffe org $c000 start_of_code chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 463 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 ;########################################### ;# initialize s12xe core # ;########################################### sei movb #(ram_start_glob>>12), rpage ;set ram page ;########################################### ;# initialize sci # ;########################################### init_sci movw #(bus_freq_hz/(16*9600)), scibdh;set baud rate movb #(tie|te), scicr2;enable tx buffer empty interrupt ;########################################### ;# initialize s12x_int # ;########################################### init_int movb #(sci_vec&$f0), int_cfaddr ;switch sci interrupts to xgate movb #rqst|$01, int_cfdata+((sci_vec&$0f)>>1) ;########################################### ;# initialize xgate # ;########################################### init_xgate movw #xgmctl_clear, xgmctl ;clear all xgmctl bits init_xgate_busy_loop tst xgchid ;wait until current thread is finished bne init_xgate_busy_loop ldx #xgif ;clear all channel interrupt flags ldd #$ffff std 2,x+ std 2,x+ std 2,x+ std 2,x+ std 2,x+ std 2,x+ std 2,x+ std 2,x+ clr xgispsel ;set vector base register movw #xgate_vectors_xg, xgvbr movw #$ff00, xgswt ;clear all software triggers ;########################################### ;# initialize xgate vector table # ;########################################### ldaa #128 ;build xgate vector table ldy #xgate_vectors init_xgate_vectab_loop movw #xgate_dummy_isr_xg, 4,y+ dbne a, init_xgate_vectab_loop movw #xgate_code_xg, ram_start+(2*sci_vec) movw #xgate_data_xg, ram_start+(2*sci_vec)+2 ;########################################### ;# copy xgate code # ;########################################### copy_xgate_code ldx #xgate_data_flash copy_xgate_code_loop movw 2,x+, 2,y+ chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 464 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 movw 2,x+, 2,y+ movw 2,x+, 2,y+ movw 2,x+, 2,y+ cpx #xgate_code_flash_end bls copy_xgate_code_loop ;########################################### ;# start xgate # ;########################################### start_xgate movw #xgmctl_enable, xgmctl ;enable xgate bra * ;########################################### ;# dummy interrupt service routine # ;########################################### dummy_isr rti cpu xgate ;########################################### ;# xgate data # ;########################################### align 1 xgate_data_flash equ * xgate_data_sci equ *-xgate_data_flash dw sci_regs ;pointer to sci register space xgate_data_idx equ *-xgate_data_flash db xgate_data_msg ;string pointer xgate_data_msg equ *-xgate_data_flash fcc "hello world! ;ascii string db $0d ;cr ;########################################### ;# xgate code # ;########################################### align 1 xgate_code_flash ldw r2,(r1,#xgate_data_sci) ;sci -> r2 ldb r3,(r1,#xgate_data_idx) ;msg -> r3 ldb r4,(r1,r3+) ;curr. char -> r4 stb r3,(r1,#xgate_data_idx) ;r3 -> idx ldb r0,(r2,#(scisr1-sci_regs)) ;initiate sci transmit stb r4,(r2,#(scidrl-sci_regs)) ;initiate sci transmit cmpl r4,#$0d beq xgate_code_done rts xgate_code_done ldl r4,#$00 ;disable sci interrupts stb r4,(r2,#(scicr2-sci_regs)) ldl r3,#xgate_data_msg;reset r3 stb r3,(r1,#xgate_data_idx) xgate_code_flash_end rts xgate_dummy_isr_xg equ (xgate_code_flash_end-xgate_code_flash)+xgate_code_xg 10.9.3 stack support to simplify the implementation of a program stack the xgate can be con?ured to set risc core register r7 to the beginning of a stack region before executing a thread. two separate stack regions can be de?ed: one for threads of priority level 7 to 4 (refer to section 10.3.1.5, ?gate initial stack pointer for chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 465 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 interrupt priorities 7 to 4 (xgisp74) ) and one for threads of priority level 3 to 1 (refer to section 10.3.1.6, ?gate initial stack pointer for interrupt priorities 3 to 1 (xgisp31) ). chapter 10 xgate (s12xgatev3) mc9s12xe-family reference manual , rev. 1.21 466 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 467 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 11 s12xe clocks and reset generator (s12xecrgv1) 11.1 introduction this speci?ation describes the function of the clocks and reset generator (s12xecrg). 11.1.1 features the main features of this block are: phase locked loop (ipll) frequency multiplier with internal ?ter reference divider post divider con?urable internal ?ter (no external pin) optional frequency modulation for de?ed jitter and reduced emission automatic frequency lock detector interrupt request on entry or exit from locked condition self clock mode in absence of reference clock system clock generator clock quality check user selectable fast wake-up from stop in self-clock mode for power saving and immediate program execution clock switch for either oscillator or pll based system clocks computer operating properly (cop) watchdog timer with time-out clear window. system reset generation from the following possible sources: power on reset low voltage reset table 11-1. revision history revision number revision date sections affected description of changes v01.00 26 oct. 2005 initial release v01.01 02 nov 2006 11.4.1.1/11-484 table ?xamples of ipll divider settings? corrected $32 to $31 v01.02 4 mar. 2008 11.4.1.4/11-487 11.4.3.3/11-491 corrected details v01.03 1 sep. 2008 table 11-14 added 100mhz example for pll v01.04 20 nov. 2008 11.3.2.4/11-473 s12xecrg flags register: corrected address to module base + 0x0003 chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 468 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 illegal address reset cop reset loss of clock reset external pin reset real-time interrupt (rti) 11.1.2 modes of operation this subsection lists and brie? describes all operating modes supported by the s12xecrg. run mode all functional parts of the s12xecrg are running during normal run mode. if rti or cop functionality is required the individual bits of the associated rate select registers (copctl, rtictl) have to be set to a non zero value. wait mode in this mode the ipll can be disabled automatically depending on the pllwai bit. stop mode depending on the setting of the pstp bit stop mode can be differentiated between full stop mode (pstp = 0) and pseudo stop mode (pstp = 1). full stop mode the oscillator is disabled and thus all system and core clocks are stopped. the cop and the rti remain frozen. pseudo stop mode the oscillator continues to run and most of the system and core clocks are stopped. if the respective enable bits are set the cop and rti will continue to run, else they remain frozen. self clock mode self clock mode will be entered if the clock monitor enable bit (cme) and the self clock mode enable bit (scme) are both asserted and the clock monitor in the oscillator block detects a loss of clock. as soon as self clock mode is entered the s12xecrg starts to perform a clock quality check. self clock mode remains active until the clock quality check indicates that the required quality of the incoming clock signal is met (frequency and amplitude). self clock mode should be used for safety purposes only. it provides reduced functionality to the mcu in case a loss of clock is causing severe system conditions. 11.1.3 block diagram figure 11-1 shows a block diagram of the s12xecrg. chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 469 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 11-1. block diagram of s12xecrg 11.2 signal description this section lists and describes the signals that connect off chip. 11.2.1 v ddpll , v sspll these pins provides operating voltage (v ddpll ) and ground (v sspll ) for the ipll circuitry. this allows the supply voltage to the ipll to be independently bypassed. even if ipll usage is not required v ddpll and v sspll must be connected to properly. 11.2.2 reset reset is an active low bidirectional reset pin. as an input it initializes the mcu asynchronously to a known start-up state. as an open-drain output it indicates that an system reset (internal to mcu) has been triggered. icrg registers cop reset rti ipll v ddpll v sspll extal xtal bus clock system reset oscillator clock pllclk oscclk core clock cm fail xclks power on reset low voltage reset cop timeout real time interrupt pll lock interrupt self clock mode interrupt s12x_mmc illegal address reset reset generator clock quality checker clock and reset control voltage regulator clock monitor oscillator chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 470 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3 memory map and registers this section provides a detailed description of all registers accessible in the s12xecrg. 11.3.1 module memory map figure 11-2 gives an overview on all s12xecrg registers. note register address = base address + address offset, where the base address is de?ed at the mcu level and the address offset is de?ed at the module level. address name bit 7 6 5 4 3 2 1 bit 0 0x0000 synr r vcofrq[1:0] syndiv[5:0] w 0x0001 refdv r reffrq[1:0] refdiv[5:0] w 0x0002 postdiv r0 0 0 postdiv[4:0] w 0x0003 crgflg r rtif porf lvrf lockif lock ilaf scmif scm w 0x0004 crgint r rtie 00 lockie 00 scmie 0 w 0x0005 clksel r pllsel pstp xclks 0 pllwai 0 rtiwai copwai w 0x0006 pllctl r cme pllon fm1 fm0 fstwkp pre pce scme w 0x0007 rtictl r rtdec rtr6 rtr5 rtr4 rtr3 rtr2 rtr1 rtr0 w 0x0008 copctl r wcop rsbck 000 cr2 cr1 cr0 w wrtmask 0x0009 forbyp 2 r0 0 0 000 0 0 w 0x000a ctctl 2 r0 0 0 000 0 0 w 0x000b armcop r0 0 0 000 0 0 w bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 2. forbyp and ctctl are intended for factory test purposes only. = unimplemented or reserved figure 11-2. crg register summary chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 471 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3.2 register descriptions this section describes in address order all the s12xecrg registers and their individual bits. 11.3.2.1 s12xecrg synthesizer register (synr) the synr register controls the multiplication factor of the ipll and selects the vco frequency range. read: anytime write: anytime except if pllsel = 1 note write to this register initializes the lock detector bit. note f vco must be within the speci?d vco frequency lock range. f. bus (bus clock) must not exceed the speci?d maximum. if postdiv = $00 then f pll is same as f vco (divide by one). the vcofrq[1:0] bit are used to con?ure the vco gain for optimal stability and lock time. for correct ipll operation the vcofrq[1:0] bits have to be selected according to the actual target vcoclk frequency as shown in table 11-2 . setting the vcofrq[1:0] bits wrong can result in a non functional ipll (no locking and/or insuf?ient stability). module base + 0x0000 76543210 r vcofrq[1:0] syndiv[5:0] w reset 0 0 0 00000 figure 11-3. s12xecrg synthesizer register (synr) table 11-2. vco clock frequency selection vcoclk frequency ranges vcofrq[1:0] 32mhz <= f vco <= 48mhz 00 48mhz < f vco <= 80mhz 01 reserved 10 80mhz < f vco <= 120mhz 11 f vco 2f osc syndiv 1 + () refdiv 1 + () ------------------------------------- = f pll f vco 2 postdiv ----------------------------------- - = f bus f pll 2 ------------ - = chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 472 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3.2.2 s12xecrg reference divider register (refdv) the refdv register provides a ?er granularity for the ipll multiplier steps. read: anytime write: anytime except when pllsel = 1 note write to this register initializes the lock detector bit. the reffrq[1:0] bit are used to con?ure the internal pll ?ter for optimal stability and lock time. for correct ipll operation the reffrq[1:0] bits have to be selected according to the actual refclk frequency as shown in figure 11-3 . setting the reffrq[1:0] bits wrong can result in a non functional ipll (no locking and/or insuf?ient stability). 11.3.2.3 s12xecrg post divider register (postdiv) the postdiv register controls the frequency ratio between the vcoclk and pllclk. the count in the ?al divider divides vcoclk frequency by 1 or 2*postdiv. note that if postdiv = $00 f pll =f vco (divide by one). module base + 0x0001 76543210 r reffrq[1:0] refdiv[5:0] w reset 0 0 0 00000 figure 11-4. s12xecrg reference divider register (refdv) table 11-3. reference clock frequency selection refclk frequency ranges reffrq[1:0] 1mhz <= f ref <= 2mhz 00 2mhz < f ref <= 6mhz 01 6mhz < f ref <= 12mhz 10 f ref >12mhz 11 f ref f osc refdiv 1 + () ------------------------------------ = chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 473 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime except if pllsel = 1 note if postdiv = $00 then f pll is identical to f vco (divide by one). 11.3.2.4 s12xecrg flags register (crgflg) this register provides s12xecrg status bits and ?gs. read: anytime write: refer to each bit for individual write conditions module base + 0x0002 76543210 r000 postdiv[4:0] w reset 0 0 0 00000 = unimplemented or reserved figure 11-5. s12xecrg post divider register (postdiv) module base + 0x0003 76543210 r rtif porf lvrf lockif lock ilaf scmif scm w reset 0 note 1 note 2 note 3 0000 1. porf is set to 1 when a power on reset occurs. unaffected by system reset. 2. lvrf is set to 1 when a low voltage reset occurs. unaffected by system reset. 3. ilaf is set to 1 when an illegal address reset occurs. unaffected by system reset. cleared by power on or low voltage reset. = unimplemented or reserved figure 11-6. s12xecrg flags register (crgflg) f pll f vco 2xpostdiv () -------------------------------------- = chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 474 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3.2.5 s12xecrg interrupt enable register (crgint) this register enables s12xecrg interrupt requests. table 11-4. crgflg field descriptions field description 7 rtif real time interrupt flag rtif is set to 1 at the end of the rti period. this ?g can only be cleared by writing a 1. writing a 0 has no effect. if enabled (rtie=1), rtif causes an interrupt request. 0 rti time-out has not yet occurred. 1 rti time-out has occurred. 6 porf power on reset flag porf is set to 1 when a power on reset occurs. this ?g can only be cleared by writing a 1. writing a 0 has no effect. 0 power on reset has not occurred. 1 power on reset has occurred. 5 lvrf low voltage reset flag lvrf is set to 1 when a low voltage reset occurs. this ?g can only be cleared by writing a 1. writing a 0 has no effect. 0 low voltage reset has not occurred. 1 low voltage reset has occurred. 4 lockif ipll lock interrupt flag lockif is set to 1 when lock status bit changes. this ?g can only be cleared by writing a 1. writing a 0 has no effect.if enabled (lockie=1), lockif causes an interrupt request. 0 no change in lock bit. 1 lock bit has changed. 3 lock lock status bit lock re?cts the current state of ipll lock condition. this bit is cleared in self clock mode. writes have no effect. 0 vcoclk is not within the desired tolerance of the target frequency. 1 vcoclk is within the desired tolerance of the target frequency. 2 ilaf illegal address reset flag ilaf is set to 1 when an illegal address reset occurs. refer to s12xmmc block guide for details. this ?g can only be cleared by writing a 1. writing a 0 has no effect. 0 illegal address reset has not occurred. 1 illegal address reset has occurred. 1 scmif self clock mode interrupt flag ?scmif is set to 1 when scm status bit changes. this ?g can only be cleared by writing a 1. writing a 0 has no effect. if enabled (scmie=1), scmif causes an interrupt request. 0 no change in scm bit. 1 scm bit has changed. 0 scm self clock mode status bit ?scm re?cts the current clocking mode. writes have no effect. 0 mcu is operating normally with oscclk available. 1 mcu is operating in self clock mode with oscclk in an unknown state. all clocks are derived from pllclk running at its minimum frequency f scm . module base + 0x0004 76543210 r rtie 00 lockie 00 scmie 0 w reset 0 0 0 00000 = unimplemented or reserved figure 11-7. s12xecrg interrupt enable register (crgint) chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 475 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime 11.3.2.6 s12xecrg clock select register (clksel) this register controls s12xecrg clock selection. refer to figure 11-16 for more details on the effect of each bit. read: anytime write: refer to each bit for individual write conditions table 11-5. crgint field descriptions field description 7 rtie real time interrupt enable bit 0 interrupt requests from rti are disabled. 1 interrupt will be requested whenever rtif is set. 4 lockie lock interrupt enable bit 0 lock interrupt requests are disabled. 1 interrupt will be requested whenever lockif is set. 1 scmie self clock mode interrupt enable bit 0 scm interrupt requests are disabled. 1 interrupt will be requested whenever scmif is set. module base + 0x0005 76543210 r pllsel pstp xclks 0 pllwai 0 rtiwai copwai w reset 0 0 0 00000 = unimplemented or reserved figure 11-8. s12xecrg clock select register (clksel) chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 476 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3.2.7 s12xecrg ipll control register (pllctl) this register controls the ipll functionality. table 11-6. clksel field descriptions field description 7 pllsel pll select bit write: anytime. writing a one when lock=0 has no effect. this prevents the selection of an unstable pllclk as sysclk. pllsel bit is cleared when the mcu enters self clock mode, stop mode or wait mode with pllwai bit set. it is recommended to read back the pllsel bit to make sure pllclk has really been selected as sysclk, as lock status bit could theoretically change at the very moment writing the pllsel bit. 0 system clocks are derived from oscclk (f bus = f osc / 2). 1 system clocks are derived from pllclk (f bus = f pll / 2). 6 pstp pseudo stop bit write: anytime this bit controls the functionality of the oscillator during stop mode. 0 oscillator is disabled in stop mode. 1 oscillator continues to run in stop mode (pseudo stop). note: pseudo stop mode allows for faster stop recovery and reduces the mechanical stress and aging of the resonator in case of frequent stop conditions at the expense of a slightly increased power consumption. 5 xclks oscillator con?uration status bit ?this read-only bit shows the oscillator con?uration status. 0 loop controlled pierce oscillator is selected. 1 external clock / full swing pierce oscillator is selected. 3 pllwai pll stops in wait mode bit write: anytime if pllwai is set, the s12xecrg will clear the pllsel bit before entering wait mode. the pllon bit remains set during wait mode but the ipll is powered down. upon exiting wait mode, the pllsel bit has to be set manually if pll clock is required. 0 ipll keeps running in wait mode. 1 ipll stops in wait mode. 1 rtiwai rti stops in wait mode bit write: anytime 0 rti keeps running in wait mode. 1 rti stops and initializes the rti dividers whenever the part goes into wait mode. 0 copwai cop stops in wait mode bit normal modes: write once special modes: write anytime 0 cop keeps running in wait mode. 1 cop stops and initializes the cop counter whenever the part goes into wait mode. module base + 0x0006 76543210 r cme pllon fm1 fm0 fstwkp pre pce scme w reset 1 1 0 00001 figure 11-9. s12xecrg ipll control register (pllctl) chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 477 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: refer to each bit for individual write conditions table 11-7. pllctl field descriptions field description 7 cme clock monitor enable bit ?cme enables the clock monitor. write anytime except when scm = 1. 0 clock monitor is disabled. 1 clock monitor is enabled. slow or stopped clocks will cause a clock monitor reset sequence or self clock mode. note: operating with cme=0 will not detect any loss of clock. in case of poor clock quality this could cause unpredictable operation of the mcu! in stop mode (pstp=0) the clock monitor is disabled independently of the cme bit setting and any loss of external clock will not be detected. also after wake-up from stop mode (pstp = 0) with fast wake-up enabled (fstwkp = 1) the clock monitor is disabled independently of the cme bit setting and any loss of external clock will not be detected. 6 pllon phase lock loop on bit pllon turns on the ipll circuitry. in self clock mode, the ipll is turned on, but the pllon bit reads the last written value. write anytime except when pllsel = 1. 0 ipll is turned off. 1 ipll is turned on. 5, 4 fm1, fm0 ipll frequency modulation enable bit ?fm1 and fm0 enable additional frequency modulation on the vcoclk. this is to reduce noise emission. the modulation frequency is f ref divided by 16. write anytime except when pllsel = 1. see table 11-8 for coding. 3 fstwkp fast wake-up from full stop bit fstwkp enables fast wake-up from full stop mode. write anytime. if self- clock mode is disabled (scme = 0) this bit has no effect. 0 fast wake-up from full stop mode is disabled. 1 fast wake-up from full stop mode is enabled. when waking up from full stop mode the system will immediately resume operation in self-clock mode (see section 11.4.1.4, ?lock quality checker ). the scmif ?g will not be set. the system will remain in self-clock mode with oscillator and clock monitor disabled until fstwkp bit is cleared. the clearing of fstwkp will start the oscillator, the clock monitor and the clock quality check. if the clock quality check is successful, the s12xecrg will switch all system clocks to oscclk. the scmif ?g will be set. see application examples in figure 11-19 and figure 11-20 . 2 pre rti enable during pseudo stop bit ?pre enables the rti during pseudo stop mode. write anytime. 0 rti stops running during pseudo stop mode. 1 rti continues running during pseudo stop mode. note: if the pre bit is cleared the rti dividers will go static while pseudo stop mode is active. the rti dividers will not initialize like in wait mode with rtiwai bit set. 1 pce cop enable during pseudo stop bit ?pce enables the cop during pseudo stop mode. write anytime. 0 cop stops running during pseudo stop mode 1 cop continues running during pseudo stop mode note: if the pce bit is cleared the cop dividers will go static while pseudo stop mode is active. the cop dividers will not initialize like in wait mode with copwai bit set. 0 scme self clock mode enable bit normal modes: write once special modes: write anytime scme can not be cleared while operating in self clock mode (scm = 1). 0 detection of crystal clock failure causes clock monitor reset (see section 11.5.1.1, ?lock monitor reset ). 1 detection of crystal clock failure forces the mcu in self clock mode (see section 11.4.2.2, ?elf clock mode ). chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 478 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3.2.8 s12xecrg rti control register (rtictl) this register selects the timeout period for the real time interrupt. read: anytime write: anytime note a write to this register initializes the rti counter. table 11-8. fm amplitude selection fm1 fm0 fm amplitude / f vco variation 0 0 fm off 01 1% 10 2% 11 4% module base + 0x0007 76543210 r rtdec rtr6 rtr5 rtr4 rtr3 rtr2 rtr1 rtr0 w reset 0 0 0 00000 figure 11-10. s12xecrg rti control register (rtictl) table 11-9. rtictl field descriptions field description 7 rtdec decimal or binary divider select bit ?rtdec selects decimal or binary based prescaler values. 0 binary based divider value. see table 11-10 1 decimal based divider value. see table 11-11 6? rtr[6:4] real time interrupt prescale rate select bits these bits select the prescale rate for the rti. see table 11- 10 and table 11-11 . 3? rtr[3:0] real time interrupt modulus counter select bits ?these bits select the modulus counter target value to provide additional granularity. table 11-10 and table 11-11 show all possible divide values selectable by the rtictl register. the source clock for the rti is oscclk. table 11-10. rti frequency divide rates for rtdec = 0 rtr[3:0] rtr[6:4] = 000 (off) 001 (2 10 ) 010 (2 11 ) 011 (2 12 ) 100 (2 13 ) 101 (2 14 ) 110 (2 15 ) 111 (2 16 ) 0000 ( 1) off (1) 2 10 2 11 2 12 2 13 2 14 2 15 2 16 chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 479 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0001 ( 2) off 2x2 10 2x2 11 2x2 12 2x2 13 2x2 14 2x2 15 2x2 16 0010 ( 3) off 3x2 10 3x2 11 3x2 12 3x2 13 3x2 14 3x2 15 3x2 16 0011 ( 4) off 4x2 10 4x2 11 4x2 12 4x2 13 4x2 14 4x2 15 4x2 16 0100 ( 5) off 5x2 10 5x2 11 5x2 12 5x2 13 5x2 14 5x2 15 5x2 16 0101 ( 6) off 6x2 10 6x2 11 6x2 12 6x2 13 6x2 14 6x2 15 6x2 16 0110 ( 7) off 7x2 10 7x2 11 7x2 12 7x2 13 7x2 14 7x2 15 7x2 16 0111 ( 8) off 8x2 10 8x2 11 8x2 12 8x2 13 8x2 14 8x2 15 8x2 16 1000 ( 9) off 9x2 10 9x2 11 9x2 12 9x2 13 9x2 14 9x2 15 9x2 16 1001 ( 10) off 10x2 10 10x2 11 10x2 12 10x2 13 10x2 14 10x2 15 10x2 16 1010 ( 11) off 11x2 10 11x2 11 11x2 12 11x2 13 11x2 14 11x2 15 11x2 16 1011 ( 12) off 12x2 10 12x2 11 12x2 12 12x2 13 12x2 14 12x2 15 12x2 16 1100 ( 13) off 13x2 10 13x2 11 13x2 12 13x2 13 13x2 14 13x2 15 13x2 16 1101 ( 14) off 14x2 10 14x2 11 14x2 12 14x2 13 14x2 14 14x2 15 14x2 16 1110 ( 15) off 15x2 10 15x2 11 15x2 12 15x2 13 15x2 14 15x2 15 15x2 16 1111 ( 16) off 16x2 10 16x2 11 16x2 12 16x2 13 16x2 14 16x2 15 16x2 16 1. denotes the default value out of reset.this value should be used to disable the rti to ensure future backwards compatibility . table 11-11. rti frequency divide rates for rtdec=1 rtr[3:0] rtr[6:4] = 000 (1x10 3 ) 001 (2x10 3 ) 010 (5x10 3 ) 011 (10x10 3 ) 100 (20x10 3 ) 101 (50x10 3 ) 110 (100x10 3 ) 111 (200x10 3 ) 0000 ( 1) 1x10 3 2x10 3 5x10 3 10x10 3 20x10 3 50x10 3 100x10 3 200x10 3 0001 ( 2) 2x10 3 4x10 3 10x10 3 20x10 3 40x10 3 100x10 3 200x10 3 400x10 3 0010 ( 3) 3x10 3 6x10 3 15x10 3 30x10 3 60x10 3 150x10 3 300x10 3 600x10 3 0011 ( 4) 4x10 3 8x10 3 20x10 3 40x10 3 80x10 3 200x10 3 400x10 3 800x10 3 0100 ( 5) 5x10 3 10x10 3 25x10 3 50x10 3 100x10 3 250x10 3 500x10 3 1x10 6 0101 ( 6) 6x10 3 12x10 3 30x10 3 60x10 3 120x10 3 300x10 3 600x10 3 1.2x10 6 table 11-10. rti frequency divide rates for rtdec = 0 rtr[3:0] rtr[6:4] = 000 (off) 001 (2 10 ) 010 (2 11 ) 011 (2 12 ) 100 (2 13 ) 101 (2 14 ) 110 (2 15 ) 111 (2 16 ) chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 480 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3.2.9 s12xecrg cop control register (copctl) this register controls the cop (computer operating properly) watchdog. read: anytime write: 1. rsbck: anytime in special modes; write to ??but not to ??in all other modes 2. wcop, cr2, cr1, cr0: anytime in special modes write once in all other modes writing cr[2:0] to ?00?has no effect, but counts for the ?rite once?condition. writing wcop to ??has no effect, but counts for the ?rite once?condition. 0110 ( 7) 7x10 3 14x10 3 35x10 3 70x10 3 140x10 3 350x10 3 700x10 3 1.4x10 6 0111 ( 8) 8x10 3 16x10 3 40x10 3 80x10 3 160x10 3 400x10 3 800x10 3 1.6x10 6 1000 ( 9) 9x10 3 18x10 3 45x10 3 90x10 3 180x10 3 450x10 3 900x10 3 1.8x10 6 1001 ( 10) 10 x10 3 20x10 3 50x10 3 100x10 3 200x10 3 500x10 3 1x10 6 2x10 6 1010 ( 11) 11 x10 3 22x10 3 55x10 3 110x10 3 220x10 3 550x10 3 1.1x10 6 2.2x10 6 1011 ( 12) 12x10 3 24x10 3 60x10 3 120x10 3 240x10 3 600x10 3 1.2x10 6 2.4x10 6 1100 ( 13) 13x10 3 26x10 3 65x10 3 130x10 3 260x10 3 650x10 3 1.3x10 6 2.6x10 6 1101 ( 14) 14x10 3 28x10 3 70x10 3 140x10 3 280x10 3 700x10 3 1.4x10 6 2.8x10 6 1110 ( 15) 15x10 3 30x10 3 75x10 3 150x10 3 300x10 3 750x10 3 1.5x10 6 3x10 6 1111 ( 16) 16x10 3 32x10 3 80x10 3 160x10 3 320x10 3 800x10 3 1.6x10 6 3.2x10 6 module base + 0x0008 76543210 r wcop rsbck 000 cr2 cr1 cr0 w wrtmask reset 1 00000000 1. refer to device user guide (section: s12xecrg) for reset values of wcop, cr2, cr1 and cr0. = unimplemented or reserved figure 11-11. s12xecrg cop control register (copctl) table 11-11. rti frequency divide rates for rtdec=1 rtr[3:0] rtr[6:4] = 000 (1x10 3 ) 001 (2x10 3 ) 010 (5x10 3 ) 011 (10x10 3 ) 100 (20x10 3 ) 101 (50x10 3 ) 110 (100x10 3 ) 111 (200x10 3 ) chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 481 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the cop time-out period is restarted if one these two conditions is true: 1. writing a non zero value to cr[2:0] (anytime in special modes, once in all other modes) with wrtmask = 0. or 2. changing rsbck bit from ??to ?? table 11-12. copctl field descriptions field description 7 wcop window cop mode bit when set, a write to the armcop register must occur in the last 25% of the selected period. a write during the ?st 75% of the selected period will reset the part. as long as all writes occur during this window, $55 can be written as often as desired. once $aa is written after the $55, the time-out logic restarts and the user must wait until the next window before writing to armcop. table 11-13 shows the duration of this window for the seven available cop rates. 0 normal cop operation 1 window cop operation 6 rsbck cop and rti stop in active bdm mode bit 0 allows the cop and rti to keep running in active bdm mode. 1 stops the cop and rti counters whenever the part is in active bdm mode. 5 wrtmask write mask for wcop and cr[2:0] bit this write-only bit serves as a mask for the wcop and cr[2:0] bits while writing the copctl register. it is intended for bdm writing the rsbck without touching the contents of wcop and cr[2:0]. 0 write of wcop and cr[2:0] has an effect with this write of copctl 1 write of wcop and cr[2:0] has no effect with this write of copctl. (does not count for ?rite once?) 2? cr[2:0] cop watchdog timer rate select ?these bits select the cop time-out rate (see table 11-13 ). writing a nonzero value to cr[2:0] enables the cop counter and starts the time-out period. a cop counter time-out causes a system reset. this can be avoided by periodically (before time-out) reinitialize the cop counter via the armcop register. while all of the following four conditions are true the cr[2:0], wcop bits are ignored and the cop operates at highest time-out period ( 2 24 cycles) in normal cop mode (window cop mode disabled): 1) cop is enabled (cr[2:0] is not 000) 2) bdm mode active 3) rsbck = 0 4) operation in emulation or special modes table 11-13. cop watchdog rates (1) cr2 cr1 cr0 oscclk cycles to timeout 0 0 0 cop disabled 001 2 14 010 2 16 011 2 18 100 2 20 101 2 22 110 2 23 chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 482 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.3.2.10 reserved register (forbyp) note this reserved register is designed for factory test purposes only, and is not intended for general user access. writing to this register when in special modes can alter the s12xecrg s functionality. read: always read $00 except in special modes write: only in special modes 11.3.2.11 reserved register (ctctl) note this reserved register is designed for factory test purposes only, and is not intended for general user access. writing to this register when in special test modes can alter the s12xecrg s functionality. read: always read $00 except in special modes 111 2 24 1. oscclk cycles are referenced from the previous cop time-out reset (writing $55/$aa to the armcop register) module base + 0x0009 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 11-12. reserved register (forbyp) module base + 0x000a 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 11-13. reserved register (ctctl) table 11-13. cop watchdog rates (1) cr2 cr1 cr0 oscclk cycles to timeout chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 483 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 write: only in special modes 11.3.2.12 s12xecrg cop timer arm/reset register (armcop) this register is used to restart the cop time-out period. read: always reads $00 write: anytime when the cop is disabled (cr[2:0] = ?00? writing to this register has no effect. when the cop is enabled by setting cr[2:0] nonzero, the following applies: writing any value other than $55 or $aa causes a cop reset. to restart the cop time-out period you must write $55 followed by a write of $aa. other instructions may be executed between these writes but the sequence ($55, $aa) must be completed prior to cop end of time-out period to avoid a cop reset. sequences of $55 writes or sequences of $aa writes are allowed. when the wcop bit is set, $55 and $aa writes must be done in the last 25% of the selected time-out period; writing any value in the ?st 75% of the selected period will cause a cop reset. module base + 0x000b 76543210 r00000000 w bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 reset 0 0 0 00000 figure 11-14. s12xecrg armcop register diagram chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 484 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.4 functional description 11.4.1 functional blocks 11.4.1.1 phase locked loop with internal filter (ipll) the ipll is used to run the mcu from a different time base than the incoming oscclk. figure 11-15 shows a block diagram of the ipll. figure 11-15. ipll functional diagram for increased ?xibility, oscclk can be divided in a range of 1 to 64 to generate the reference frequency refclk using the refdiv[5:0] bits. this offers a ?er multiplication granularity. based on the syndiv[5:0] bits the ipll generates the vcoclk by multiplying the reference clock by a multiple of 2, 4, 6,... 126, 128. based on the postdiv[4:0] bits the vcoclk can be divided in a range of 1,2,4,6,8,... to 62 to generate the pllclk. . note although it is possible to set the dividers to command a very high clock frequency, do not exceed the speci?d bus frequency limit for the mcu. if (pllsel = 1) then f bus = f pll / 2. if postdiv = $00 the f pll is identical to f vco (divide by one) several examples of ipll divider settings are shown in table 11-14 . shaded rows indicated that these settings are not recommended. the following rules help to achieve optimum stability and shortest lock time: use lowest possible f vco / f ref ratio (syndiv value). use highest possible refclk frequency f ref . reduced consumption oscillator extal xtal oscclk pllclk reference programmable divider pdet phase detector refdiv[5:0] loop programmable divider syndiv[5:0] vco lock up down lock detector refclk fbclk v ddpll /v sspll clock monitor v ddpll /v sspll v dd /v ss supplied by: cpump and filter post programmable divider postdiv[4:0] vcoclk f pll 2f osc syndiv 1 + refdiv 1 + [] 2 postdiv [] ------------------------------------------------------------------------------ = chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 485 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.4.1.1.1 ipll operation the oscillator output clock signal (oscclk) is fed through the reference programmable divider and is divided in a range of 1 to 64 (refdiv+1) to output the refclk. the vco output clock, (vcoclk) is fed back through the programmable loop divider and is divided in a range of 2 to 128 in increments of [2 x (syndiv +1)] to output the fbclk. the vcoclk is fed to the ?al programmable divider and is divided in a range of 1,2,4,6,8,... to 62 (2*postdiv) to output the pllclk. see figure 11-15 . the phase detector then compares the fbclk, with the refclk. correction pulses are generated based on the phase difference between the two signals. the loop ?ter then slightly alters the dc voltage on the internal ?ter capacitor, based on the width and direction of the correction pulse. the user must select the range of the refclk frequency and the range of the vcoclk frequency to ensure that the correct ipll loop bandwidth is set. the lock detector compares the frequencies of the fbclk, and the refclk. therefore, the speed of the lock detector is directly proportional to the reference clock frequency. the circuit determines the lock condition based on this comparison. if ipll lock interrupt requests are enabled, the software can wait for an interrupt request and then check the lock bit. if interrupt requests are disabled, software can poll the lock bit continuously (during ipll start-up, usually) or at periodic intervals. in either case, only when the lock bit is set, the pllclk can be selected as the source for the system and core clocks. if the ipll is selected as the source for the system and core clocks and the lock bit is clear, the ipll has suffered a severe noise hit and the software must take appropriate action, depending on the application. the lock bit is a read-only indicator of the locked state of the ipll. the lock bit is set when the vco frequency is within a certain tolerance, ? lock , and is cleared when the vco frequency is out of a certain tolerance, ? unl . interrupt requests can occur if enabled (lockie = 1) when the lock condition changes, toggling the lock bit. table 11-14. examples of ipll divider settings f osc refdiv[5:0] f ref reffrq[1:0] syndiv[5:0] f vco vcofrq[1:0] postdiv[4:0] f pll f bus 4mhz $01 2mhz 01 $18 100mhz 11 $00 100mhz 50 mhz 8mhz $03 2mhz 01 $18 100mhz 11 $00 100mhz 50 mhz 4mhz $00 4mhz 01 $09 80mhz 01 $00 80mhz 40mhz 8mhz $00 8mhz 10 $04 80mhz 01 $00 80mhz 40mhz 4mhz $00 4mhz 01 $03 32mhz 00 $01 16mhz 8mhz 4mhz $01 2mhz 01 $18 100mhz 11 $01 50mhz 25mhz 4mhz $03 1mhz 00 $18 50mhz 01 $00 50mhz 25mhz 4mhz $03 1mhz 00 $31 100mhz 11 $01 50mhz 25mhz chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 486 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.4.1.2 system clocks generator figure 11-16. system clocks generator the clock generator creates the clocks used in the mcu (see figure 11-16 ). the gating condition placed on top of the individual clock gates indicates the dependencies of different modes (stop, wait) and the setting of the respective con?uration bits. the peripheral modules use the bus clock. some peripheral modules also use the oscillator clock. if the mcu enters self clock mode (see section 11.4.2.2, ?elf clock mode ) oscillator clock source is switched to pllclk running at its minimum frequency f scm . the bus clock is used to generate the clock visible at the eclk pin. the core clock signal is the clock for the cpu. the core clock is twice the bus clock. but note that a cpu cycle corresponds to one bus clock. ipll clock mode is selected with pllsel bit in the clksel register. when selected, the ipll output clock drives sysclk for the main system including the cpu and peripherals. the ipll cannot be turned off by clearing the pllon bit, if the ipll clock is selected. when pllsel is changed, it takes a maximum of 4 oscclk plus 4 pllclk cycles to make the transition. during the transition, all clocks freeze and cpu activity ceases. oscillator phase lock loop (iipll) extal xtal sysclk rti oscclk pllclk clock phase generator bus clock clock monitor 1 0 pllsel or scm 2 core clock cop oscillator = clock gate gating condition wait(rtiwai), stop( pstp, pre), rti enable wait(copwai), stop( pstp, pce), cop enable stop 1 0 scm clock stop chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 487 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.4.1.3 clock monitor (cm) if no oscclk edges are detected within a certain time, the clock monitor within the oscillator block generates a clock monitor fail event. the s12xecrg then asserts self clock mode or generates a system reset depending on the state of scme bit. if the clock monitor is disabled or the presence of clocks is detected no failure is indicated by the oscillator block.the clock monitor function is enabled/disabled by the cme control bit. 11.4.1.4 clock quality checker the clock monitor performs a coarse check on the incoming clock signal. the clock quality checker provides a more accurate check in addition to the clock monitor. a clock quality check is triggered by any of the following events: power on reset ( por ) low voltage reset ( lvr ) wake-up from full stop mode ( exit full stop ) clock monitor fail indication ( cm fail ) a time window of 50000 pllclk cycles 1 is called check window . a number greater equal than 4096 rising oscclk edges within a check window is called osc ok . note that osc ok immediately terminates the current check window . see figure 11-17 as an example. figure 11-17. check window example 1. ipll is running at self clock mode frequency f scm . 12 49999 50000 pllclk check window 12345 4095 4096 3 oscclk osc ok chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 488 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the sequence for clock quality check is shown in figure 11-18 . figure 11-18. sequence for clock quality check note remember that in parallel to additional actions caused by self clock mode or clock monitor reset 1 handling the clock quality checker continues to check the oscclk signal. note the clock quality checker enables the ipll and the voltage regulator (vreg) anytime a clock check has to be performed. an ongoing clock quality check could also cause a running ipll (f scm ) and an active vreg during pseudo stop mode. 1. a clock monitor reset will always set the scme bit to logical?? check window osc ok ? scm active? switch to oscclk exit scm clock ok num = 50 num > 0 ? num = num-1 yes no yes scme = 1 ? no enter scm scm active? yes clock monitor reset no yes no num = 0 yes no por exit full stop cm fail lvr scme=1 & ? fstwkp=1 yes no ? fstwkp = 0 no num = 0 enter scm yes chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 489 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.4.1.5 computer operating properly watchdog (cop) the cop (free running watchdog timer) enables the user to check that a program is running and sequencing properly. when the cop is being used, software is responsible for keeping the cop from timing out. if the cop times out it is an indication that the software is no longer being executed in the intended sequence; thus a system reset is initiated (see section 11.4.1.5, ?omputer operating properly watchdog (cop) ). the cop runs with a gated oscclk. three control bits in the copctl register allow selection of seven cop time-out periods. when cop is enabled, the program must write $55 and $aa (in this order) to the armcop register during the selected time-out period. once this is done, the cop time-out period is restarted. if the program fails to do this and the cop times out, the part will reset. also, if any value other than $55 or $aa is written, the part is immediately reset. windowed cop operation is enabled by setting wcop in the copctl register. in this mode, writes to the armcop register to clear the cop timer must occur in the last 25% of the selected time-out period. a premature write will immediately reset the part. if pce bit is set, the cop will continue to run in pseudo stop mode. 11.4.1.6 real time interrupt (rti) the rti can be used to generate a hardware interrupt at a ?ed periodic rate. if enabled (by setting rtie=1), this interrupt will occur at the rate selected by the rtictl register. the rti runs with a gated oscclk. at the end of the rti time-out period the rtif ?g is set to one and a new rti time-out period starts immediately. a write to the rtictl register restarts the rti time-out period. if the pre bit is set, the rti will continue to run in pseudo stop mode. 11.4.2 operation modes 11.4.2.1 normal mode the s12xecrg block behaves as described within this speci?ation in all normal modes. 11.4.2.2 self clock mode if the external clock frequency is not available due to a failure or due to long crystal start-up time, the bus clock and the core clock are derived from the pllclk running at self clock mode frequency f scm ; this mode of operation is called self clock mode. this requires cme = 1 and scme = 1, which is the default after reset. if the mcu was clocked by the pllclk prior to entering self clock mode, the pllsel bit will be cleared. if the external clock signal has stabilized again, the s12xecrg will automatically select oscclk to be the system clock and return to normal mode. see section 11.4.1.4, ?lock quality checker for more information on entering and leaving self clock mode. chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 490 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note in order to detect a potential clock loss the cme bit should always be enabled (cme = 1). if cme bit is disabled and the mcu is con?ured to run on pllclk, a loss of external clock (oscclk) will not be detected and will cause the system clock to drift towards lower frequencies. as soon as the external clock is available again the system clock ramps up to its ipll target frequency. if the mcu is running on external clock any loss of clock will cause the system to go static. 11.4.3 low power options this section summarizes the low power options available in the s12xecrg. 11.4.3.1 run mode this is the default mode after reset. the rti can be stopped by setting the associated rate select bits to zero. the cop can be stopped by setting the associated rate select bits to zero. 11.4.3.2 wait mode the wai instruction puts the mcu in a low power consumption stand-by mode depending on setting of the individual bits in the clksel register. all individual wait mode con?uration bits can be superposed. this provides enhanced granularity in reducing the level of power consumption during wait mode. table 11-15 lists the individual con?uration bits and the parts of the mcu that are affected in wait mode. after executing the wai instruction the core requests the s12xecrg to switch mcu into wait mode. the s12xecrg then checks whether the pllwai bit is asserted. depending on the con?uration the s12xecrg switches the system and core clocks to oscclk by clearing the pllsel bit and disables the ipll. there are two ways to restart the mcu from wait mode: 1. any reset 2. any interrupt table 11-15. mcu con?uration during wait mode pllwai rtiwai copwai ipll stopped rti stopped cop stopped chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 491 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.4.3.3 stop mode all clocks are stopped in stop mode, dependent of the setting of the pce, pre and pstp bit. the oscillator is disabled in stop mode unless the pstp bit is set. if the pre or pce bits are set, the rti or cop continues to run in pseudo stop mode. in addition to disabling system and core clocks the s12xecrg requests other functional units of the mcu (e.g. voltage-regulator) to enter their individual power saving modes (if available). if the pllsel bit is still set when entering stop mode, the s12xecrg will switch the system and core clocks to oscclk by clearing the pllsel bit. then the s12xecrg disables the ipll, disables the core clock and ?ally disables the remaining system clocks. if pseudo stop mode is entered from self-clock mode the s12xecrg will continue to check the clock quality until clock check is successful. in this case the ipll and the voltage regulator (vreg) will remain enabled. if full stop mode (pstp = 0) is entered from self-clock mode the ongoing clock quality check will be stopped. a complete timeout window check will be started when stop mode is left again. there are two ways to restart the mcu from stop mode: 1. any reset 2. any interrupt if the mcu is woken-up from full stop mode by an interrupt and the fast wake-up feature is enabled (fstwkp=1 and scme=1), the system will immediately (no clock quality check) resume operation in self-clock mode (see section 11.4.1.4, ?lock quality checker ). the scmif ?g will not be set for this special case. the system will remain in self-clock mode with oscillator disabled until fstwkp bit is cleared. the clearing of fstwkp will start the oscillator and the clock quality check. if the clock quality check is successful, the s12xecrg will switch all system clocks to oscillator clock. the scmif ?g will be set. see application examples in figure 11-19 and figure 11-20 . because the ipll has been powered-down during stop mode the pllsel bit is cleared and the mcu runs on oscclk after leaving stop-mode. the software must manually set the pllsel bit again, in order to switch system and core clocks to the pllclk. note in full stop mode or self-clock mode caused by the fast wake-up feature the clock monitor and the oscillator are disabled. chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 492 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 11-19. fast wake-up from full stop mode: example 1 . figure 11-20. fast wake-up from full stop mode: example 2 11.5 resets all reset sources are listed in table 11-16 . refer to mcu speci?ation for related vector addresses and priorities. table 11-16. reset summary reset source local enable power on reset none low voltage reset none external reset none illegal address reset none clock monitor reset pllctl (cme=1, scme=0) oscillator clock pll clock core clock instruction stop irq service fstwkp=1 irq service stop stop irq service oscillator disabled power saving self-clock mode scme=1 cpu resumes program execution immediately interrupt interrupt interrupt oscillator clock pll clock core clock instruction clock quality check stop irq service fstwkp=1 irq interrupt fstwkp=0 scmie=1 osc startup oscillator disabled cpu resumes program execution immediately self-clock mode scme=1 frequent uncritical instructions frequent critical instructions possible scm interrupt chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 493 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.5.1 description of reset operation the reset sequence is initiated by any of the following events: low level is detected at the reset pin (external reset). power on is detected. low voltage is detected. illegal address reset is detected (see s12xmmc block guide for details). cop watchdog times out. clock monitor failure is detected and self-clock mode was disabled (scme=0). upon detection of any reset event, an internal circuit drives the reset pin low for 128 sysclk cycles (see figure 11-21 ). since entry into reset is asynchronous it does not require a running sysclk. however, the internal reset circuit of the s12xecrg cannot sequence out of current reset condition without a running sysclk. the number of 128 sysclk cycles might be increased by n = 3 to 6 additional sysclk cycles depending on the internal synchronization latency. after 128+n sysclk cycles the reset pin is released. the reset generator of the s12xecrg waits for additional 64 sysclk cycles and then samples the reset pin to determine the originating source. table 11-17 shows which vector will be fetched. note external circuitry connected to the reset pin should not include a large capacitance that would interfere with the ability of this signal to rise to a valid logic one within 64 sysclk cycles after the low drive is released. cop watchdog reset copctl (cr[2:0] nonzero) table 11-17. reset vector selection sampled reset pin (64 cycles after release) clock monitor reset pending cop reset pending vector fetch 1 0 0 por / lvr / illegal address reset/ external reset 1 1 x clock monitor reset 1 0 1 cop reset 0 x x por / lvr / illegal address reset/ external reset with rise of reset pin table 11-16. reset summary reset source local enable chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 494 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the internal reset of the mcu remains asserted while the reset generator completes the 192 sysclk long reset sequence. in case the reset pin is externally driven low for more than these 192 sysclk cycles (external reset), the internal reset remains asserted longer. figure 11-21. reset timing 11.5.1.1 clock monitor reset the s12xecrg generates a clock monitor reset in case all of the following conditions are true: clock monitor is enabled (cme = 1) loss of clock is detected self-clock mode is disabled (scme = 0). the reset event asynchronously forces the con?uration registers to their default settings. in detail the cme and the scme are reset to logical ? (which changes the state of the scme bit. as a consequence the s12xecrg immediately enters self clock mode and starts its internal reset sequence. in parallel the clock quality check starts. as soon as clock quality check indicates a valid oscillator clock the s12xecrg switches to oscclk and leaves self clock mode. since the clock quality checker is running in parallel to the reset generator, the s12xecrg may leave self clock mode while still completing the internal reset sequence. 11.5.1.2 computer operating properly watchdog (cop) reset when cop is enabled, the s12xecrg expects sequential write of $55 and $aa (in this order) to the armcop register during the selected time-out period. once this is done, the cop time-out period restarts. if the program fails to do this the s12xecrg will generate a reset. 11.5.1.3 power on reset, low voltage reset the on-chip voltage regulator detects when v dd to the mcu has reached a certain level and asserts power on reset or low voltage reset or both. as soon as a power on reset or low voltage reset is triggered the ) ( ) ( ) ( ) sysclk 128+ n cycles 64 cycles with n being min 3 / max 6 cycles depending on internal synchronization delay icrg drives reset pin low possibly sysclk not running possibly reset driven low externally ) ( ( reset reset pin released chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 495 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 s12xecrg performs a quality check on the incoming clock signal. as soon as clock quality check indicates a valid oscillator clock signal the reset sequence starts using the oscillator clock. if after 50 check windows the clock quality check indicated a non-valid oscillator clock the reset sequence starts using self-clock mode. figure 11-22 and figure 11-23 show the power-up sequence for cases when the reset pin is tied to v dd and when the reset pin is held low. figure 11-22. reset pin tied to v dd (by a pull-up resistor) figure 11-23. reset pin held low externally 11.6 interrupts the interrupts/reset vectors requested by the s12xecrg are listed in table 11-18 . refer to mcu speci?ation for related vector addresses and priorities. table 11-18. s12xecrg interrupt vectors interrupt source ccr mask local enable real time interrupt i bit crgint (rtie) lock interrupt i bit crgint (lockie) scm interrupt i bit crgint (scmie) reset internal por 128 sysclk 64 sysclk internal reset clock quality check (no self-clock mode) ) ( ) ( ) ( clock quality check reset internal por internal reset 128 sysclk 64 sysclk (no self clock mode) ) ( ) ( ) ( chapter 11 s12xe clocks and reset generator (s12xecrgv1) mc9s12xe-family reference manual , rev. 1.21 496 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 11.6.1 description of interrupt operation 11.6.1.1 real time interrupt the s12xecrg generates a real time interrupt when the selected interrupt time period elapses. rti interrupts are locally disabled by setting the rtie bit to zero. the real time interrupt ?g (rtif) is set to1 when a timeout occurs, and is cleared to 0 by writing a 1 to the rtif bit. the rti continues to run during pseudo stop mode if the pre bit is set to 1. this feature can be used for periodic wakeup from pseudo stop if the rti interrupt is enabled. 11.6.1.2 ipll lock interrupt the s12xecrg generates a ipll lock interrupt when the lock condition of the ipll has changed, either from a locked state to an unlocked state or vice versa. lock interrupts are locally disabled by setting the lockie bit to zero. the ipll lock interrupt ?g (lockif) is set to1 when the lock condition has changed, and is cleared to 0 by writing a 1 to the lockif bit. 11.6.1.3 self clock mode interrupt the s12xecrg generates a self clock mode interrupt when the scm condition of the system has changed, either entered or exited self clock mode. scm conditions are caused by a failing clock quality check after power on reset (por) or low voltage reset (lvr) or recovery from full stop mode (pstp = 0) or clock monitor failure. for details on the clock quality check refer to section 11.4.1.4, ?lock quality checker . if the clock monitor is enabled (cme = 1) a loss of external clock will also cause a scm condition (scme = 1). scm interrupts are locally disabled by setting the scmie bit to zero. the scm interrupt ?g (scmif) is set to1 when the scm condition has changed, and is cleared to 0 by writing a 1 to the scmif bit. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 497 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 12 pierce oscillator (s12xosclcpv2) 12.1 introduction the pierce oscillator (xosc) module provides a robust, low-noise and low-power clock source. the module will be operated from the v ddpll supply rail (1.8 v nominal) and require the minimum number of external components. it is designed for optimal start-up margin with typical crystal oscillators. 12.1.1 features the xosc will contain circuitry to dynamically control current gain in the output amplitude. this ensures a signal with low harmonic distortion, low power and good noise immunity. high noise immunity due to input hysteresis low rf emissions with peak-to-peak swing limited dynamically transconductance (gm) sized for optimum start-up margin for typical oscillators dynamic gain control eliminates the need for external current limiting resistor integrated resistor eliminates the need for external bias resistor in loop controlled pierce mode. low power consumption: operates from 1.8 v (nominal) supply amplitude control limits power clock monitor 12.1.2 modes of operation two modes of operation exist: 1. loop controlled pierce (lcp) oscillator 2. external square wave mode featuring also full swing pierce (fsp) without internal bias resistor the oscillator mode selection is described in the device overview section, subsection oscillator con?uration. table 12-1. revision history revision number revision date sections affected description of changes v01.05 19 jul 2006 - all xclks info was removed v02.00 04 aug 2006 - incremented revision to match the design system spec revision chapter 12 pierce oscillator (s12xosclcpv2) mc9s12xe-family reference manual , rev. 1.21 498 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 12.1.3 block diagram figure 12-1 shows a block diagram of the xosc. figure 12-1. xosc block diagram 12.2 external signal description this section lists and describes the signals that connect off chip 12.2.1 vddpll and vsspll ?operating and ground voltage pins theses pins provides operating voltage (v ddpll ) and ground (v sspll ) for the xosc circuitry. this allows the supply voltage to the xosc to use an independent bypass capacitor. 12.2.2 extal and xtal ?input and output pins these pins provide the interface for either a crystal or a 1.8v cmos compatible clock to control the internal clock generator circuitry. extal is the external clock input or the input to the crystal oscillator ampli?r. xtal is the output of the crystal oscillator ampli?r. the mcu internal system clock is derived extal xtal gain control v ddpll = 1.8 v rf oscclk monitor_failure clock monitor peak detector chapter 12 pierce oscillator (s12xosclcpv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 499 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 from the extal input frequency. in full stop mode (pstp = 0), the extal pin is pulled down by an internal resistor of typical 200 k ? . note freescale recommends an evaluation of the application board and chosen resonator or crystal by the resonator or crystal supplier. loop controlled circuit is not suited for overtone resonators and crystals. figure 12-2. loop controlled pierce oscillator connections (lcp mode selected) note full swing pierce circuit is not suited for overtone resonators and crystals without a careful component selection. figure 12-3. full swing pierce oscillator connections (fsp mode selected) figure 12-4. external clock connections (fsp mode selected) mcu extal xtal v sspll crystal or ceramic resonator c2 c1 * r s can be zero (shorted) when use with higher frequency crystals. refer to manufacturer? data. mcu extal xtal rs* rb v sspll crystal or ceramic resonator c2 c1 mcu extal xtal not connected cmos compatible external oscillator (v ddpll level) chapter 12 pierce oscillator (s12xosclcpv2) mc9s12xe-family reference manual , rev. 1.21 500 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 12.3 memory map and register de?ition the crg contains the registers and associated bits for controlling and monitoring the oscillator module. 12.4 functional description the xosc module has control circuitry to maintain the crystal oscillator circuit voltage level to an optimal level which is determined by the amount of hysteresis being used and the maximum oscillation range. the oscillator block has two external pins, extal and xtal. the oscillator input pin, extal, is intended to be connected to either a crystal or an external clock source. the xtal pin is an output signal that provides crystal circuit feedback. a buffered extal signal becomes the internal clock. to improve noise immunity, the oscillator is powered by the vddpll and vsspll power supply pins. 12.4.1 gain control in lcp mode a closed loop control system will be utilized whereby the ampli?r is modulated to keep the output waveform sinusoidal and to limit the oscillation amplitude. the output peak to peak voltage will be kept above twice the maximum hysteresis level of the input buffer. electrical speci?ation details are provided in the electrical characteristics appendix. 12.4.2 clock monitor the clock monitor circuit is based on an internal rc time delay so that it can operate without any mcu clocks. if no oscclk edges are detected within this rc time delay, the clock monitor indicates failure which asserts self-clock mode or generates a system reset depending on the state of scme bit. if the clock monitor is disabled or the presence of clocks is detected no failure is indicated.the clock monitor function is enabled/disabled by the cme control bit, described in the crg block description chapter. 12.4.3 wait mode operation during wait mode, xosc is not impacted. 12.4.4 stop mode operation xosc is placed in a static state when the part is in stop mode except when pseudo-stop mode is enabled. during pseudo-stop mode, xosc is not impacted. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 501 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 13 analog-to-digital converter (adc12b16cv1) table 13-1. revision history 13.1 introduction the adc12b16c is a 16-channel, 12-bit, multiplexed input successive approximation analog-to-digital converter. refer to device electrical speci?ations for atd accuracy. 13.1.1 features 8-, 10-, or 12-bit resolution. conversion in stop mode using internally generated clock automatic return to low power after conversion sequence automatic compare with interrupt for higher than or less/equal than programmable value programmable sample time. left/right justi?d result data. external trigger control. sequence complete interrupt. analog input multiplexer for 16 analog input channels. special conversions for v rh , v rl , (v rl +v rh )/2. 1-to-16 conversion sequence lengths. continuous conversion mode. multiple channel scans. con?urable external trigger functionality on any ad channel or any of four additional trigger inputs. the four additional trigger inputs can be chip external or internal. refer to device speci?ation for availability and connectivity. con?urable location for channel wrap around (when converting multiple channels in a sequence). revision number revision date sections affected description of changes v01.00 13 oct. 2005 - initial version v01.01 04 mar. 2008 corrected reference to djm bit chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 502 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.1.2 modes of operation 13.1.2.1 conversion modes there is software programmable selection between performing single or continuous conversion on a single channel or multiple channels . 13.1.2.2 mcu operating modes stop mode iclkstp=0 (in atdctl2 register) entering stop mode aborts any conversion sequence in progress and if a sequence was aborted restarts it after exiting stop mode. this has the same effect/consequences as starting a conversion sequence with write to atdctl5. so after exiting from stop mode with a previously aborted sequence all ?gs are cleared etc. iclkstp=1 (in atdctl2 register) a/d conversion sequence seamless continues in stop mode based on the internally generated clock iclk as atd clock. for conversions during transition from run to stop mode or vice versa the result is not written to the results register, no ccf ?g is set and no compare is done. when converting in stop mode (iclkstp=1) an atd stop recovery time t atdstprcv is required to switch back to bus clock based atdclk when leaving stop mode. do not access atd registers during this time . wait mode adc12b16c behaves same in run and wait mode. for reduced power consumption continuos conversions should be aborted before entering wait mode. freeze mode in freeze mode the adc12b16c will either continue or ?ish or stop converting according to the frz1 and frz0 bits. this is useful for debugging and emulation. chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 503 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.1.3 block diagram figure 13-1. adc12b16c block diagram v ssa an8 atd_12b16c analog mux mode and successive approximation register (sar) results atd 0 atd 1 atd 2 atd 3 atd 4 atd 5 atd 6 atd 7 and dac sample & hold v dda v rl v rh sequence complete + - comparator clock prescaler bus clock atd clock atd 8 atd 9 atd 10 atd 11 atd 12 atd 13 atd 14 atd 15 an7 an6 an5 an4 an3 an2 an1 an0 an9 an10 an11 an12 an13 an14 an15 etrig0 (see device speci? cation for availability etrig1 etrig2 etrig3 and connectivity) timing control atddien atdctl1 trigger mux internal clock interrupt compare interrupt iclk chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 504 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.2 signal description this section lists all inputs to the adc12b16c block. 13.2.1 detailed signal descriptions 13.2.1.1 an x ( x = 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) this pin serves as the analog input channel x . it can also be con?ured as digital port or external trigger for the atd conversion. 13.2.1.2 etrig3, etrig2, etrig1, etrig0 these inputs can be con?ured to serve as an external trigger for the atd conversion. refer to device speci?ation for availability and connection of these inputs! 13.2.1.3 v rh , v rl v rh is the high reference voltage, v rl is the low reference voltage for atd conversion. 13.2.1.4 v dda , v ssa these pins are the power supplies for the analog circuitry of the adc12b16c block. 13.3 memory map and register de?ition this section provides a detailed description of all registers accessible in the adc12b16c. 13.3.1 module memory map figure 13-2 gives an overview on all adc12b16c registers. note register address = base address + address offset, where the base address is de?ed at the mcu level and the address offset is de?ed at the module level. address name bit 7 6 5 4 3 2 1 bit 0 0x0000 atdctl0 r reserved 000 wrap3 wrap2 wrap1 wrap0 w 0x0001 atdctl1 r etrigsel sres1 sres0 smp_dis etrigch3 etrigch2 etrigch1 etrigch0 w 0x0002 atdctl2 r0 affc iclkstp etrigle etrigp etrige ascie acmpie w = unimplemented or reserved figure 13-2. adc12b16c register summary (sheet 1 of 3) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 505 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0003 atdctl3 r djm s8c s4c s2c s1c fifo frz1 frz0 w 0x0004 atdctl4 r smp2 smp1 smp0 prs[4:0] w 0x0005 atdctl5 r0 sc scan mult cd cc cb ca w 0x0006 atdstat0 r scf 0 etorf fifor cc3 cc2 cc1 cc0 w 0x0007 unimple- mented r0 000 0 0 0 0 w 0x0008 atdcmpeh r cmpe[15:8] w 0x0009 atdcmpel r cmpe[7:0] w 0x000a atdstat2h r ccf[15:8] w 0x000b atdstat2l r ccf[7:0] w 0x000c atddienh r ien[15:8] w 0x000d atddienl r ien[7:0] w 0x000e atdcmphth r cmpht[15:8] w 0x000f atdcmphtl r cmpht[7:0] w 0x0010 atddr0 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0012 atddr1 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0014 atddr2 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0016 atddr3 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0018 atddr4 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x001a atddr5 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x001c atddr6 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x001e atddr7 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0020 atddr8 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0022 atddr9 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w address name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 13-2. adc12b16c register summary (sheet 2 of 3) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 506 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2 register descriptions this section describes in address order all the adc12b16c registers and their individual bits. 13.3.2.1 atd control register 0 (atdctl0) writes to this register will abort current conversion sequence. read: anytime write: anytime, in special modes always write 0 to reserved bit 7. 0x0024 atddr10 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0026 atddr11 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x0028 atddr12 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x002a atddr13 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x002c atddr14 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w 0x002e atddr15 r see section 13.3.2.12.1, ?eft justi?d result data (djm=0) and section 13.3.2.12.2, ?ight justi?d result data (djm=1) w module base + 0x0000 76543210 r reserved 000 wrap3 wrap2 wrap1 wrap0 w reset 0 0 0 01111 = unimplemented or reserved figure 13-3. atd control register 0 (atdctl0) table 13-2. atdctl0 field descriptions field description 3-0 wrap[3-0] wrap around channel select bits ?these bits determine the channel for wrap around when doing multi- channel conversions. the coding is summarized in table 13-3 . table 13-3. multi-channel wrap around coding wrap3 wrap2 wrap1 wrap0 multiple channel conversions (mult = 1) wraparound to an0 after converting 0000 reserved (1) address name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 13-2. adc12b16c register summary (sheet 3 of 3) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 507 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.2 atd control register 1 (atdctl1) writes to this register will abort current conversion sequence. read: anytime write: anytime 0001 an1 0010 an2 0011 an3 0100 an4 0101 an5 0110 an6 0111 an7 1000 an8 1001 an9 1010 an10 1011 an11 1100 an12 1101 an13 1110 an14 1111 an15 1. if only an0 should be converted use mult=0. module base + 0x0001 76543210 r etrigsel sres1 sres0 smp_dis etrigch3 etrigch2 etrigch1 etrigch0 w reset 0 0 1 01111 figure 13-4. atd control register 1 (atdctl1) table 13-4. atdctl1 field descriptions field description 7 etrigsel external trigger source select ?this bit selects the external trigger source to be either one of the ad channels or one of the etrig3-0 inputs. see device speci?ation for availability and connectivity of etrig3- 0 inputs. if a particular etrig3-0 input option is not available, writing a 1 to etrisel only sets the bit but has not effect, this means that one of the ad channels (selected by etrigch3-0) is con?ured as the source for external trigger. the coding is summarized in table 13-6 . 6? sres[1:0] a/d resolution select ?these bits select the resolution of a/d conversion results. see table 13-5 for coding. table 13-3. multi-channel wrap around coding wrap3 wrap2 wrap1 wrap0 multiple channel conversions (mult = 1) wraparound to an0 after converting chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 508 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 4 smp_dis discharge before sampling bit 0 no discharge before sampling. 1 the internal sample capacitor is discharged before sampling the channel. this adds 2 atd clock cycles to the sampling time. this can help to detect an open circuit instead of measuring the previous sampled channel. 3? etrigch[3:0] external trigger channel select these bits select one of the ad channels or one of the etrig3-0 inputs as source for the external trigger. the coding is summarized in table 13-6 . table 13-5. a/d resolution coding sres1 sres0 a/d resolution 0 0 8-bit data 0 1 10-bit data 1 0 12-bit data 1 1 reserved table 13-6. external trigger channel select coding etrigsel etrigch3 etrigch2 etrigch1 etrigch0 external trigger source is 0 0 0 0 0 an0 0 0 0 0 1 an1 0 0 0 1 0 an2 0 0 0 1 1 an3 0 0 1 0 0 an4 0 0 1 0 1 an5 0 0 1 1 0 an6 0 0 1 1 1 an7 0 1 0 0 0 an8 0 1 0 0 1 an9 0 1 0 1 0 an10 0 1 0 1 1 an11 0 1 1 0 0 an12 0 1 1 0 1 an13 0 1 1 1 0 an14 0 1 1 1 1 an15 1 0 0 0 0 etrig0 (1) 1. only if etrig3-0 input option is available (see device speci?ation), else etrisel is ignored, that means external trigger source is still on one of the ad channels selected by etrigch3-0 1 0 0 0 1 etrig1 1 1 0 0 1 0 etrig2 1 1 0 0 1 1 etrig3 1 1 0 1 x x reserved 1 1 x x x reserved table 13-4. atdctl1 field descriptions (continued) field description chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 509 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.3 atd control register 2 (atdctl2) writes to this register will abort current conversion sequence. read: anytime write: anytime module base + 0x0002 76543210 r0 affc iclkstp etrigle etrigp etrige ascie acmpie w reset 0 0 0 00000 = unimplemented or reserved figure 13-5. atd control register 2 (atdctl2) table 13-7. atdctl2 field descriptions field description 6 affc atd fast flag clear all 0 atd ?g clearing done by write 1 to respective ccf[ n ] ?g. 1 changes all atd conversion complete ?gs to a fast clear sequence. for compare disabled (cmpe[ n ]=0) a read access to the result register will cause the associated ccf[ n ] ?g to clear automatically. for compare enabled (cmpe[ n ]=1) a write access to the result register will cause the associated ccf[ n ] ?g to clear automatically. 5 iclkstp internal clock in stop mode bit this bit enables a/d conversions in stop mode. when going into stop mode and iclkstp=1 the atd conversion clock is automatically switched to the internally generated clock iclk. current conversion sequence will seamless continue. conversion speed will change from prescaled bus frequency to the iclk frequency (see atd electrical characteristics in device description). the prescaler bits prs4-0 in atdctl4 have no effect on the iclk frequency. for conversions during stop mode the automatic compare interrupt or the sequence complete interrupt can be used to inform software handler about changing a/d values. external trigger will not work while converting in stop mode. for conversions during transition from run to stop mode or vice versa the result is not written to the results register, no ccf ?g is set and no compare is done. when converting in stop mode (iclkstp=1) an atd stop recovery time t atdstprcv is required to switch back to bus clock based atdclk when leaving stop mode. do not access atd registers during this time. 0 if a/d conversion sequence is ongoing when going into stop mode, the actual conversion sequence will be aborted and automatically restarted when exiting stop mode. 1 a/d continues to convert in stop mode using internally generated clock (iclk) 4 etrigle external trigger level/edge control ?this bit controls the sensitivity of the external trigger signal. see table 13-8 for details. 3 etrigp external trigger polarity this bit controls the polarity of the external trigger signal. see table 13-8 for details. 2 etrige external trigger mode enable this bit enables the external trigger on one of the ad channels or one of the etrig3-0 inputs as described in table 13-6 . if external trigger source is one of the ad channels, the digital input buffer of this channel is enabled. the external trigger allows to synchronize the start of conversion with external events. external trigger will not work while converting in stop mode. 0 disable external trigger 1 enable external trigger chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 510 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.4 atd control register 3 (atdctl3) writes to this register will abort current conversion sequence. read: anytime write: anytime 1 ascie atd sequence complete interrupt enable 0 atd sequence complete interrupt requests are disabled. 1 atd sequence complete interrupt will be requested whenever scf=1 is set. 0 acmpie atd compare interrupt enable if automatic compare is enabled for conversion n (cmpe[ n ]=1 in atdcmpe register) this bit enables the compare interrupt. if the ccf[ n ] ?g is set (showing a successful compare for conversion n ), the compare interrupt is triggered. 0 atd compare interrupt requests are disabled. 1 for the conversions in a sequence for which automatic compare is enabled (cmpe[ n ]=1), atd compare interrupt will be requested whenever any of the respective ccf ?gs is set. table 13-8. external trigger con?urations etrigle etrigp external trigger sensitivity 0 0 falling edge 0 1 rising edge 1 0 low level 1 1 high level module base + 0x0003 76543210 r djm s8c s4c s2c s1c fifo frz1 frz0 w reset 0 0 1 00000 = unimplemented or reserved figure 13-6. atd control register 3 (atdctl3) field description 7 djm result register data justi?ation ?result data format is always unsigned. this bit controls justi?ation of conversion data in the result registers. 0 left justi?d data in the result registers. 1 right justi?d data in the result registers. table 13-10 gives examples atd results for an input signal range between 0 and 5.12 volts. table 13-9. atdctl3 field descriptions table 13-7. atdctl2 field descriptions (continued) field description chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 511 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 6? s8c, s4c, s2c, s1c conversion sequence length ?these bits control the number of conversions per sequence. table 13-11 shows all combinations. at reset, s4c is set to 1 (sequence length is 4). this is to maintain software continuity to hc12 family. 2 fifo result register fifo mode if this bit is zero (non-fifo mode), the a/d conversion results map into the result registers based on the conversion sequence; the result of the ?st conversion appears in the ?st result register (atddr0), the second result in the second result register (atddr1), and so on. if this bit is one (fifo mode) the conversion counter is not reset at the beginning or ending of a conversion sequence; sequential conversion results are placed in consecutive result registers. in a continuously scanning conversion sequence, the result register counter will wrap around when it reaches the end of the result register ?e. the conversion counter value (cc3-0 in atdstat0) can be used to determine where in the result register ?e, the current conversion result will be placed. aborting a conversion or starting a new conversion clears the conversion counter even if fifo=1. so the ?st result of a new conversion sequence, started by writing to atdctl5, will always be place in the ?st result register (atdddr0). intended usage of fifo mode is continuos conversion (scan=1) or triggered conversion (etrig=1). which result registers hold valid data can be tracked using the conversion complete ?gs. fast ?g clear mode may or may not be useful in a particular application to track valid data. if this bit is one, automatic compare of result registers is always disabled, that is adc12b16c will behave as if acmpie and all cpme[ n ] were zero. 0 conversion results are placed in the corresponding result register up to the selected sequence length. 1 conversion results are placed in consecutive result registers (wrap around at end). 1? frz[1:0] background debug freeze enable ?when debugging an application, it is useful in many cases to have the atd pause when a breakpoint (freeze mode) is encountered. these 2 bits determine how the atd will respond to a breakpoint as shown in table 13-12 . leakage onto the storage node and comparator reference capacitors may compromise the accuracy of an immediately frozen conversion depending on the length of the freeze period. table 13-10. examples of ideal decimal atd results input signal v rl = 0 volts v rh = 5.12 volts 8-bit codes (resolution=20mv) 10-bit codes (resolution=5mv) 12-bit codes (transfer curve has 1.25mv offset) (resolution=1.25mv) 5.120 volts ... 0.022 0.020 0.018 0.016 0.014 0.012 0.010 0.008 0.006 0.004 0.003 0.002 0.000 255 ... 1 1 1 1 1 1 1 0 0 0 0 0 0 1023 ... 4 4 4 3 3 2 2 2 1 1 0 0 0 4095 ... 17 16 14 12 11 9 8 6 4 3 2 1 0 field description table 13-9. atdctl3 field descriptions (continued) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 512 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.5 atd control register 4 (atdctl4) writes to this register will abort current conversion sequence. read: anytime write: anytime table 13-11. conversion sequence length coding s8c s4c s2c s1c number of conversions per sequence 00 0 0 16 00 0 1 1 00 1 0 2 00 1 1 3 01 0 0 4 01 0 1 5 01 1 0 6 01 1 1 7 10 0 0 8 10 0 1 9 10 1 0 10 10 1 1 11 11 0 0 12 11 0 1 13 11 1 0 14 11 1 1 15 table 13-12. atd behavior in freeze mode (breakpoint) frz1 frz0 behavior in freeze mode 0 0 continue conversion 0 1 reserved 1 0 finish current conversion, then freeze 1 1 freeze immediately module base + 0x0004 76543210 r smp2 smp1 smp0 prs[4:0] w reset 0 0 0 00101 figure 13-7. atd control register 4 (atdctl4) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 513 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.6 atd control register 5 (atdctl5) writes to this register will abort current conversion sequence and start a new conversion sequence. if external trigger is enabled (etrige=1) an initial write to atdctl5 is required to allow starting of a conversion sequence which will then occur on each trigger event. start of conversion means the beginning of the sampling phase. read: anytime write: anytime table 13-13. atdctl4 field descriptions field description 7? smp[2:0] sample time select ?these three bits select the length of the sample time in units of atd conversion clock cycles. note that the atd conversion clock period is itself a function of the prescaler value (bits prs4-0). table 13-14 lists the available sample time lengths. 4? prs[4:0] atd clock prescaler these 5 bits are the binary prescaler value prs. the atd conversion clock frequency is calculated as follows: refer to device speci?ation for allowed frequency range of f atdclk . table 13-14. sample time select smp2 smp1 smp0 sample time in number of atd clock cycles 000 4 001 6 010 8 011 10 100 12 101 16 110 20 111 24 module base + 0x0005 76543210 r0 sc scan mult cd cc cb ca w reset 0 0 0 00000 figure 13-8. atd control register 5 (atdctl5) f atdclk f bus 2 prs 1 + () ------------------------------------- = chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 514 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 13-15. atdctl5 field descriptions field description 6 sc special channel conversion bit if this bit is set, then special channel conversion can be selected using cd, cc, cb and ca of atdctl5. table 13-16 lists the coding. 0 special channel conversions disabled 1 special channel conversions enabled 5 scan continuous conversion sequence mode ?this bit selects whether conversion sequences are performed continuously or only once. if external trigger is enabled (etrige=1) setting this bit has no effect, that means external trigger always starts a single conversion sequence. 0 single conversion sequence 1 continuous conversion sequences (scan mode) 4 mult multi-channel sample mode when mult is 0, the atd sequence controller samples only from the speci?d analog input channel for an entire conversion sequence. the analog channel is selected by channel selection code (control bits cd/cc/cb/ca located in atdctl5). when mult is 1, the atd sequence controller samples across channels. the number of channels sampled is determined by the sequence length value (s8c, s4c, s2c, s1c). the ?st analog channel examined is determined by channel selection code (cd, cc, cb, ca control bits); subsequent channels sampled in the sequence are determined by incrementing the channel selection code or wrapping around to an0 (channel 0). 0 sample only one channel 1 sample across several channels 3? cd, cc, cb, ca analog input channel select code ?these bits select the analog input channel(s) whose signals are sampled and converted to digital codes. table 13-16 lists the coding used to select the various analog input channels. in the case of single channel conversions (mult=0), this selection code speci?s the channel to be examined. in the case of multiple channel conversions (mult=1), this selection code speci?s the ?st channel to be examined in the conversion sequence. subsequent channels are determined by incrementing the channel selection code or wrapping around to an0 (after converting the channel de?ed by the wrap around channel select bits wrap3-0 in atdctl0). in case of starting with a channel number higher than the one de?ed by wrap3-0 the ?st wrap around will be an15 to an0. chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 515 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.7 atd status register 0 (atdstat0) this register contains the sequence complete flag, overrun ?gs for external trigger and fifo mode, and the conversion counter. read: anytime table 13-16. analog input channel select coding sc cd cc cb ca analog input channel 00000 an0 0001 an1 0010 an2 0011 an3 0100 an4 0101 an5 0110 an6 0111 an7 1000 an8 1001 an9 1 0 1 0 an10 1 0 1 1 an11 1 1 0 0 an12 1 1 0 1 an13 1 1 1 0 an14 1 1 1 1 an15 1 0 0 0 0 reserved 0 0 0 1 reserved 0 0 1 x reserved 0100 v rh 0101 v rl 0110 (v rh +v rl ) / 2 0 1 1 1 reserved 1 x x x reserved module base + 0x0006 76543210 r scf 0 etorf fifor cc3 cc2 cc1 cc0 w reset 0 0 0 00000 = unimplemented or reserved figure 13-9. atd status register 0 (atdstat0) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 516 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 write: anytime (no effect on (cc3, cc2, cc1, cc0)) 13.3.2.8 atd compare enable register (atdcmpe) writes to this register will abort current conversion sequence. read: anytime write: anytime table 13-17. atdstat0 field descriptions field description 7 scf sequence complete flag ?this ?g is set upon completion of a conversion sequence. if conversion sequences are continuously performed (scan=1), the ?g is set after each one is completed. this ?g is cleared when one of the following occurs: a) write ??to scf b) write to atdctl5 (a new conversion sequence is started) c) if affc=1 and read of a result register 0 conversion sequence not completed 1 conversion sequence has completed 5 etorf external trigger overrun flag ?while in edge trigger mode (etrigle=0), if additional active edges are detected while a conversion sequence is in process the overrun ?g is set. this ?g is cleared when one of the following occurs: a) write ??to etorf b) write to atdctl0,1,2,3,4, atdcmpe or atdcmpht (a conversion sequence is aborted) c) write to atdctl5 (a new conversion sequence is started) 0 no external trigger over run error has occurred 1 external trigger over run error has occurred 4 fifor result register over run flag ?this bit indicates that a result register has been written to before its associated conversion complete ?g (ccf) has been cleared. this ?g is most useful when using the fifo mode because the ?g potentially indicates that result registers are out of sync with the input channels. however, it is also practical for non-fifo modes, and indicates that a result register has been over written before it has been read (i.e. the old data has been lost). this ?g is cleared when one of the following occurs: a) write ??to fifor b) write to atdctl0,1,2,3,4, atdcmpe or atdcmpht (a conversion sequence is aborted) c) write to atdctl5 (a new conversion sequence is started) 0 no over run has occurred 1 overrun condition exists (result register has been written while associated ccfx ?g was still set) 3? cc[3:0] conversion counter these 4 read-only bits are the binary value of the conversion counter. the conversion counter points to the result register that will receive the result of the current conversion. e.g. cc3=0, cc2=1, cc1=1, cc0=0 indicates that the result of the current conversion will be in atd result register 6. if in non-fifo mode (fifo=0) the conversion counter is initialized to zero at the begin and end of the conversion sequence. if in fifo mode (fifo=1) the register counter is not initialized. the conversion counters wraps around when its maximum value is reached. aborting a conversion or starting a new conversion clears the conversion counter even if fifo=1. chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 517 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 module base + 0x0008 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r cmpe[15:0] w reset 0 0 0 0 0 0 0 0 0 0000000 figure 13-10. atd compare enable register (atdcmpe) table 13-18. atdcmpe field descriptions field description 15? cmpe[15:0] compare enable for conversion number n ( n = 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) of a sequence ?these bits enable automatic compare of conversion results individually for conversions of a sequence. the sense of each comparison is determined by the cmpht[ n ] bit in the atdcmpht register. for each conversion number with cmpe[ n ]=1 do the following: 1) write compare value to atddr n result register 2) write compare operator with cmpht[ n ] in atdcpmht register ccf[ n ] in atdstat2 register will ?g individual success of any comparison. 0 no automatic compare 1 automatic compare of results for conversion n of a sequence is enabled. chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 518 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.9 atd status register 2 (atdstat2) this read-only register contains the conversion complete flags ccf[15:0]. read: anytime write: anytime, no effect module base + 0x000a 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r ccf[15:0] w reset 0 0 0 0 0 0 0 0 0 0000000 = unimplemented or reserved figure 13-11. atd status register 2 (atdstat2) table 13-19. atdstat2 field descriptions field description 15? ccf[15:0] conversion complete flag n ( n = 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) ?a conversion complete ?g is set at the end of each conversion in a sequence. the ?gs are associated with the conversion position in a sequence (and also the result register number). therefore in non-?o mode, ccf[8] is set when the ninth conversion in a sequence is complete and the result is available in result register atddr8; ccf[9] is set when the tenth conversion in a sequence is complete and the result is available in atddr9, and so forth. if automatic compare of conversion results is enabled (cmpe[ n ]=1 in atdcmpe), the conversion complete ?g is only set if comparison with atddr n is true and if acmpie=1 a compare interrupt will be requested. in this case, as the atddr n result register is used to hold the compare value, the result will not be stored there at the end of the conversion but is lost. a ?g ccf[ n ] is cleared when one of the following occurs: a) write to atdctl5 (a new conversion sequence is started) b) if affc=0, write ??to ccf[ n ] c) if affc=1 and cmpe[ n ]=0, read of result register atddr n d) if affc=1 and cmpe[ n ]=1, write to result register atddr n in case of a concurrent set and clear on ccf[ n ]: the clearing by method a) will overwrite the set. the clearing by methods b) or c) or d) will be overwritten by the set. 0 conversion number n not completed or successfully compared 1 if (cmpe[ n ]=0): conversion number n has completed. result is ready in atddr n . if (cmpe[ n ]=1): compare for conversion result number n with compare value in atddr n , using compare operator cmpgt[ n ] is true. (no result available in atddr n ) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 519 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.10 atd input enable register (atddien) read: anytime write: anytime 13.3.2.11 atd compare higher than register (atdcmpht) writes to this register will abort current conversion sequence. read: anytime write: anytime module base + 0x000c 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r ien[15:0] w reset 0 0 0 0 0 0 0 0 0 0000000 figure 13-12. atd input enable register (atddien) table 13-20. atddien field descriptions field description 15? ien[15:0] atd digital input enable on channel x ( x = 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) this bit controls the digital input buffer from the analog input pin (an x ) to the digital data register. 0 disable digital input buffer to an x pin 1 enable digital input buffer on an x pin. note: setting this bit will enable the corresponding digital input buffer continuously. if this bit is set while simultaneously using it as an analog port, there is potentially increased power consumption because the digital input buffer maybe in the linear region. module base + 0x000e 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r cmpht[15:0] w reset 0 0 0 0 0 0 0 0 0 0000000 figure 13-13. atd compare higher than register (atdcmpht) table 13-21. atdcmpht field descriptions field description 15? cmpht[15:0] compare operation higher than enable for conversion number n ( n = 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) of a sequence ?this bit selects the operator for comparison of conversion results. 0 if result of conversion n is lower or same than compare value in atddr n , this is ?gged in atdstat2 1 if result of conversion n is higher than compare value in atddr n , this is ?gged in atdstat2 chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 520 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.3.2.12 atd conversion result registers (atddr n ) the a/d conversion results are stored in 16 result registers. results are always in unsigned data representation. left and right justi?ation is selected using the djm control bit in atdctl3. if automatic compare of conversions results is enabled (cmpe[ n ]=1 in atdcmpe), these registers must be written with the compare values in left or right justi?d format depending on the actual value of the djm bit. in this case, as the atddr n register is used to hold the compare value, the result will not be stored there at the end of the conversion but is lost. read: anytime write: anytime note for conversions not using automatic compare, results are stored in the result registers after each conversion. in this case avoid writing to atddrn except for initial values, because an a/d result might be overwritten. 13.3.2.12.1 left justi?d result data (djm=0) 13.3.2.12.2 right justi?d result data (djm=1) table 13-16 shows how depending on the a/d resolution the conversion result is transferred to the atd result registers. compare is always done using all 12 bits of both the conversion result and the compare value in atddrn. module base + 0x0010 = atddr0, 0x0012 = atddr1, 0x0014 = atddr2, 0x0016 = atddr3 0x0018 = atddr4, 0x001a = atddr5, 0x001c = atddr6, 0x001e = atddr7 0x0020 = atddr8, 0x0022 = atddr9, 0x0024 = atddr10, 0x0026 = atddr11 0x0028 = atddr12, 0x002a = atddr13, 0x002c = atddr14, 0x002e = atddr15 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r bit 11 bit 10 bit 9 bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0 000 w reset 0 0 0 0 0 0 0 0 0 0000000 figure 13-14. left justi?d atd conversion result register (atddr n ) module base + 0x0010 = atddr0, 0x0012 = atddr1, 0x0014 = atddr2, 0x0016 = atddr3 0x0018 = atddr4, 0x001a = atddr5, 0x001c = atddr6, 0x001e = atddr7 0x0020 = atddr8, 0x0022 = atddr9, 0x0024 = atddr10, 0x0026 = atddr11 0x0028 = atddr12, 0x002a = atddr13, 0x002c = atddr14, 0x002e = atddr15 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r 0 000 bit 11 bit 10 bit 9 bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bi1 1 bit 0 w reset 0 0 0 0 0 0 0 0 0 0000000 figure 13-15. right justi?d atd conversion result register (atddr n ) chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 521 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.4 functional description the adc12b16c is structured into an analog sub-block and a digital sub-block. 13.4.1 analog sub-block the analog sub-block contains all analog electronics required to perform a single conversion. separate power supplies v dda and v ssa allow to isolate noise of other mcu circuitry from the analog sub-block. 13.4.1.1 sample and hold machine the sample and hold (s/h) machine accepts analog signals from the external world and stores them as capacitor charge on a storage node. during the sample process the analog input connects directly to the storage node. the input analog signals are unipolar and must fall within the potential range of v ssa to v dda . during the hold process the analog input is disconnected from the storage node. 13.4.1.2 analog input multiplexer the analog input multiplexer connects one of the 16 external analog input channels to the sample and hold machine. 13.4.1.3 analog-to-digital (a/d) machine the a/d machine performs analog to digital conversions. the resolution is program selectable at either 8 or 10 or 12 bits. the a/d machine uses a successive approximation architecture. it functions by comparing the stored analog sample potential with a series of digitally generated analog potentials. by following a binary search algorithm, the a/d machine locates the approximating potential that is nearest to the sampled potential. when not converting the a/d machine is automatically powered down. table 13-22. conversion result mapping to atddrn a/d resolution djm conversion result mapping to atddr n 8-bit data 0 bit[11:4] = result, bit[3:0]=0000 8-bit data 1 bit[7:0] = result, bit[11:8]=0000 10-bit data 0 bit[11:2] = result, bit[1:0]=00 10-bit data 1 bit[9:0] = result, bit[11:10]=00 12-bit data x bit[11:0] = result chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 522 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 only analog input signals within the potential range of v rl to v rh (a/d reference potentials) will result in a non-railed digital output code. 13.4.2 digital sub-block this subsection explains some of the digital features in more detail. see section 13.3.2, ?egister descriptions for all details. 13.4.2.1 external trigger input the external trigger feature allows the user to synchronize atd conversions to the external environment events rather than relying on software to signal the atd module when atd conversions are to take place. the external trigger signal (out of reset atd channel 15, con?urable in atdctl1) is programmable to be edge or level sensitive with polarity control. table 13-23 gives a brief description of the different combinations of control bits and their effect on the external trigger function. during a conversion, if additional active edges are detected the overrun error ?g etorf is set. in either level or edge triggered modes, the ?st conversion begins when the trigger is received. once etrige is enabled, conversions cannot be started by a write to atdctl5, but rather must be triggered externally. if the level mode is active and the external trigger both de-asserts and re-asserts itself during a conversion sequence, this does not constitute an overrun. therefore, the ?g is not set. if the trigger is left asserted in level mode while a sequence is completing, another sequence will be triggered immediately. table 13-23. external trigger control bits etrigle etrigp etrige scan description x x 0 0 ignores external trigger. performs one conversion sequence and stops. x x 0 1 ignores external trigger. performs continuous conversion sequences. 0 0 1 x falling edge triggered. performs one conversion sequence per trigger. 0 1 1 x rising edge triggered. performs one conversion sequence per trigger. 1 0 1 x trigger active low. performs continuous conversions while trigger is active. 1 1 1 x trigger active high. performs continuous conversions while trigger is active. chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 523 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13.4.2.2 general-purpose digital port operation the input channel pins can be multiplexed between analog and digital data. as analog inputs, they are multiplexed and sampled as analog channels to the a/d converter. the analog/digital multiplex operation is performed in the input pads. the input pad is always connected to the analog input channels of the adc12b16c. the input pad signal is buffered to the digital port registers. this buffer can be turned on or off with the atddien register. this is important so that the buffer does not draw excess current when analog potentials are presented at its input. 13.5 resets at reset the adc12b16c is in a power down state. the reset state of each individual bit is listed within the register description section (see section 13.3.2, ?egister descriptions ) which details the registers and their bit-?ld. 13.6 interrupts the interrupts requested by the adc12b16c are listed in table 13-24 . refer to mcu speci?ation for related vector address and priority. see section 13.3.2, ?egister descriptions for further details. table 13-24. atd interrupt vectors interrupt source ccr mask local enable sequence complete interrupt i bit ascie in atdctl2 compare interrupt i bit acmpie in atdctl2 chapter 13 analog-to-digital converter (adc12b16cv1) mc9s12xe-family reference manual , rev. 1.21 524 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 525 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 14 enhanced capture timer (ect16b8cv3) 14.1 introduction the hcs12 enhanced capture timer module has the features of the hcs12 standard timer module enhanced by additional features in order to enlarge the ?ld of applications, in particular for automotive abs applications. this design speci?ation describes the standard timer as well as the additional features. the basic timer consists of a 16-bit, software-programmable counter driven by a prescaler. this timer can be used for many purposes, including input waveform measurements while simultaneously generating an output waveform. pulse widths can vary from microseconds to many seconds. a full access for the counter registers or the input capture/output compare registers will take place in one clock cycle. accessing high byte and low byte separately for all of these registers will not yield the same result as accessing them in one word. table 14-1. revision history revision number revision date sections affected description of changes v03.02 03 apr 2007 14.3.1/14-528 - removed redundant memory map table, corrected mccnt[9] to mccnt[0] in register summary sheet (5 of 6), removed memory map table (since the information is redundant) in register summary ?ure. v03.03 14 sep 2007 14.4.1.2/14-572 - corrected typo opcd -> ocpd v03.04 08 may 2008 14.4.1.3/14-572 - enhanced pulse accumulator b description. v03.05 09 sep 2008 14.4.1.2/14-572 fixed a typo and re?ed a statement pertaining to switch between i/o and timer functionlality. v03.06 05 aug 2009 14.3.2.15/14-54 5 14.3.2.16/14-54 7 14.3.2.24/14-55 4 14.3.2.29/14-55 8 14.4.1.1.2/14-57 0 update register pactl bit4 pedge pt7 to ic7 update register paflg bit0 paif pt7 to ic7,update bit1 paovf pt3 to ic3 update register icsys bit3 tfmod ptx to icx update register pbflg bit1 pbovf pt1 to ic1 update ic queue mode description. v03.07 26 aug 2009 14.3.2.2/14-534 14.3.2.3/14-534 14.3.2.4/14-535 - add description, ?a counter over?w when ttov[7] is set?, to be the condition of channel 7 override event. - phrase the description of oc7m to make it more explicit chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 526 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.1.1 features 16-bit buffer register for four input capture (ic) channels. four 8-bit pulse accumulators with 8-bit buffer registers associated with the four buffered ic channels. con?urable also as two 16-bit pulse accumulators. 16-bit modulus down-counter with 8-bit prescaler. four user-selectable delay counters for input noise immunity increase. 14.1.2 modes of operation stop ?timer and modulus counter are off since clocks are stopped. freeze timer and modulus counter keep on running, unless the tsfrz bit in the tscr1 register is set to one. wait ?counters keep on running, unless the tswai bit in the tscr1 register is set to one. normal timer and modulus counter keep on running, unless the ten bit in the tscr1 register or the mcen bit in the mcctl register are cleared. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 527 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.1.3 block diagram figure 14-1. ect block diagram 14.2 external signal description the ect module has a total of eight external pins. 14.2.1 ioc7 ?input capture and output compare channel 7 this pin serves as input capture or output compare for channel 7. 14.2.2 ioc6 ?input capture and output compare channel 6 this pin serves as input capture or output compare for channel 6. prescaler 16-bit counter 16-bit pulse accumulator b ioc0 ioc2 ioc1 ioc5 ioc3 ioc4 ioc6 ioc7 pa input interrupt pa overflow interrupt timer overflow interrupt timer channel 0 interrupt timer channel 7 interrupt registers bus clock channel 0 channel 1 channel 2 channel 3 channel 4 channel 5 channel 6 channel 7 16-bit pulse accumulator a pb overflow interrupt modulus counter interrupt 16-bit modulus counter input capture output compare input capture input capture input capture input capture input capture input capture input capture output compare output compare output compare output compare output compare output compare output compare chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 528 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.2.3 ioc5 ?input capture and output compare channel 5 this pin serves as input capture or output compare for channel 5. 14.2.4 ioc4 ?input capture and output compare channel 4 this pin serves as input capture or output compare for channel 4. 14.2.5 ioc3 ?input capture and output compare channel 3 this pin serves as input capture or output compare for channel 3. 14.2.6 ioc2 ?input capture and output compare channel 2 this pin serves as input capture or output compare for channel 2. 14.2.7 ioc1 ?input capture and output compare channel 1 this pin serves as input capture or output compare for channel 1. 14.2.8 ioc0 ?input capture and output compare channel 0 this pin serves as input capture or output compare for channel 0. note for the description of interrupts see section 14.4.3, ?nterrupts? 14.3 memory map and register de?ition this section provides a detailed description of all memory and registers. 14.3.1 module memory map the memory map for the ect module is given below in the table 14-2 . the address listed for each register is the address offset. the total address for each register is the sum of the base address for the ect module and the address offset for each register. 14.3.2 register descriptions this section consists of register descriptions in address order. each description includes a standard register diagram with an associated ?ure number. details of register bit and ?ld function follow the register diagrams, in bit order. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 529 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 register name bit 7 654321 bit 0 0x0000 tios r ios7 ios6 ios5 ios4 ios3 ios2 ios1 ios0 w 0x0001 cforc r00000000 w foc7 foc6 foc5 foc4 foc3 foc2 foc1 foc0 0x0002 oc7m r oc7m7 oc7m6 oc7m5 oc7m4 oc7m3 oc7m2 oc7m1 oc7m0 w 0x0003 oc7d r oc7d7 oc7d6 oc7d5 oc7d4 oc7d3 oc7d2 oc7d1 oc7d0 w 0x0004 tcnt (high) r tcnt15 tcnt14 tcnt13 tcnt12 tcnt11 tcnt10 tcnt9 tcnt8 w 0x0005 tcnt (low) r tcnt7 tcnt6 tcnt5 tcnt4 tcnt3 tcnt2 tcnt1 tcnt0 w 0x0006 tscr1 r ten tswai tsfrz tffca prnt 000 w 0x0007 ttof r tov7 tov6 tov5 tov4 tov3 tov2 tov1 tov0 w 0x0008 tctl1 r om7 ol7 om6 ol6 om5 ol5 om4 ol4 w 0x0009 tctl2 r om3 ol3 om2 ol2 om1 ol1 om0 ol0 w 0x000a tctl3 r edg7b edg7a edg6b edg6a edg5b edg5a edg4b edg4a w 0x000b tctl4 r edg3b edg3a edg2b edg2a edg1b edg1a edg0b edg0a w 0x000c tie r c7i c6i c5i c4i c3i c2i c1i c0i w = unimplemented or reserved figure 14-2. ect register summary (sheet 1 of 5) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 530 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x000d tscr2 r toi 000 tcre pr2 pr1 pr0 w 0x000e tflg1 r c7f c6f c5f c4f c3f c2f c1f c0f w 0x000f tflg2 r tof 0000000 w 0x0010 tc0 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x0011 tc0 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0012 tc1 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x0013 tc1 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0014 tc2 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x0015 tc2 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0016 tc3 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x0017 tc3 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0018 tc4 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x0019 tc4 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x001a tc5 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x001b tc5 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w register name bit 7 654321 bit 0 = unimplemented or reserved figure 14-2. ect register summary (sheet 2 of 5) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 531 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x001c tc6 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x001d tc6 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x001e tc7 (high) r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x001f tc7 (low) r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0020 pactl r0 paen pamod pedge clk1 clk0 pa0vi pai w 0x0021 paflg r000000 pa0vf paif w 0x0022 pacn3 r pacnt7(15) pacnt6(14) pacnt5(13) pacnt4(12) pacnt3(11) pacnt2(10) pacnt1(9) pacnt0(8) w 0x0023 pacn2 r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w 0x0024 pacn1 r pacnt7(15) pacnt6(14) pacnt5(13) pacnt4(12) pacnt3(11) pacnt2(10) pacnt1(9) pacnt0(8) w 0x0025 pacn0 r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w 0x0026 mcctl r mczi modmc rdmcl 00 mcen mcpr1 mcpr0 w iclat flmc 0x0027 mcflg r mczf 0 0 0 polf3 polf2 polf1 polf0 w 0x0028 icpar r0000 pa3en pa2en pa1en pa0en w 0x0029 dlyct r dly7 dly6 dly5 dly4 dly3 dly2 dly1 dly0 w 0x002a icovw r novw7 novw6 novw5 novw4 novw3 novw2 novw1 novw0 w register name bit 7 654321 bit 0 = unimplemented or reserved figure 14-2. ect register summary (sheet 3 of 5) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 532 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x002b icsys r sh37 sh26 sh15 sh04 tfmod pacmx bufen latq w 0x002c ocpd r ocpd7 ocpd6 ocpd5 ocpd4 ocpd3 ocpd2 ocpd1 ocpd0 w 0x002d timtst r timer test register w 0x002e ptpsr r ptps7 ptps6 ptps5 ptps4 ptps3 ptps2 ptps1 ptps0 w 0x002f ptmcpsr r ptmps7 ptmps6 ptmps5 ptmps4 ptmps3 ptmps2 ptmps1 ptmps0 w 0x0030 pbctl r0 pben 0000 pbovi 0 w 0x0031 pbflg r000000 pbovf 0 w 0x0032 pa3h r pa3h7 pa3h6 pa3h5 pa3h4 pa3h3 pa3h2 pa3h1 pa3h0 w 0x0033 pa2h r pa2h7 pa2h6 pa2h5 pa2h4 pa2h3 pa2h2 pa2h1 pa2h0 w 0x0034 pa1h r pa1h7 pa1h6 pa1h5 pa1h4 pa1h3 pa1h2 pa1h1 pa1h0 w 0x0035 pa0h r pa0h7 pa0h6 pa0h5 pa0h4 pa0h3 pa0h2 pa0h1 pa0h0 w 0x0036 mccnt (high) r mccnt15 mccnt14 mccnt13 mccnt12 mccnt11 mccnt10 mccnt9 mccnt8 w 0x0037 mccnt (low) r mccnt7 mccnt6 mccnt5 mccnt4 mccnt3 mccnt2 mccnt1 mccnt0 w 0x0038 tc0h (high) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x0039 tc0h (low) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 register name bit 7 654321 bit 0 = unimplemented or reserved figure 14-2. ect register summary (sheet 4 of 5) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 533 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.1 timer input capture/output compare select register (tios) read or write: anytime all bits reset to zero. 0x003a tc1h (high) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x003b tc1h (low) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w 0x003c tc2h (high) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x003d tc2h (low) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w 0x003e tc3h (high) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x003f tc3h (low) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w module base + 0x0000 76543210 r ios7 ios6 ios5 ios4 ios3 ios2 ios1 ios0 w reset 00000000 figure 14-3. timer input capture/output compare register (tios) table 14-2. tios field descriptions field description 7:0 ios[7:0] input capture or output compare channel con?uration 0 the corresponding channel acts as an input capture. 1 the corresponding channel acts as an output compare. register name bit 7 654321 bit 0 = unimplemented or reserved figure 14-2. ect register summary (sheet 5 of 5) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 534 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.2 timer compare force register (cforc) read or write: anytime but reads will always return 0x0000 (1 state is transient). all bits reset to zero. 14.3.2.3 output compare 7 mask register (oc7m) read or write: anytime all bits reset to zero. module base + 0x0001 76543210 r00000000 w foc7 foc6 foc5 foc4 foc3 foc2 foc1 foc0 reset 00000000 figure 14-4. timer compare force register (cforc) table 14-3. cforc field descriptions field description 7:0 foc[7:0] force output compare action for channel 7:0 a write to this register with the corresponding data bit(s) set causes the action which is programmed for output compare ??to occur immediately. the action taken is the same as if a successful comparison had just taken place with the tcx register except the interrupt ?g does not get set. note: a channel 7 event, which can be a counter over?w when ttov[7] is set or a successful channel 7 output compare overrides any channel 6:0 compares. if a forced output compare on any channel occurs at the same time as the successful output compare, then the forced output compare action will take precedence and the interrupt ?g will not get set. module base + 0x0002 76543210 r oc7m7 oc7m6 oc7m5 oc7m4 oc7m3 oc7m2 oc7m1 oc7m0 w reset 00000000 figure 14-5. output compare 7 mask register (oc7m) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 535 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.4 output compare 7 data register (oc7d) read or write: anytime all bits reset to zero. 14.3.2.5 timer count register (tcnt) table 14-4. oc7m field descriptions field description 7:0 oc7m[7:0] output compare mask action for channel 7:0 a channel 7 event, which can be a counter over?w when ttov[7] is set or a successful output compare on channel 7, overrides any channel 6:0 compares. for each oc7m bit that is set,the output compare action re?cts the corresponding oc7d bit. 0 the corresponding oc7dx bit in the output compare 7 data register will not be transferred to the timer port on a channel 7 event, even if the corresponding pin is setup for output compare. 1 the corresponding oc7dx bit in the output compare 7 data register will be transferred to the timer port on a channel 7 event. note: the corresponding channel must also be setup for output compare (iosx = 1 andocpdx = 0) for data to be transferred from the output compare 7 data register to the timer port. module base + 0x0003 76543210 r oc7d7 oc7d6 oc7d5 oc7d4 oc7d3 oc7d2 oc7d1 oc7d0 w reset 00000000 figure 14-6. output compare 7 data register (oc7d) table 14-5. oc7d field descriptions field description 7:0 oc7d[7:0] output compare 7 data bits a channel 7 event, which can be a counter over?w when ttov[7] is set or a channel 7 output compare can cause bits in the output compare 7 data register to transfer to the timer port data register depending on the output compare 7 mask register. module base + 0x0004 15 14 13 12 11 10 9 8 r tcnt15 tcnt14 tcnt13 tcnt12 tcnt11 tcnt10 tcnt9 tcnt8 w reset 00000000 figure 14-7. timer count register high (tcnt) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 536 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: writable in special modes. all bits reset to zero. 14.3.2.6 timer system control register 1 (tscr1) read or write: anytime except prnt bit is write once all bits reset to zero. module base + 0x0005 76543210 r tcnt7 tcnt6 tcnt5 tcnt4 tcnt3 tcnt2 tcnt1 tcnt0 w reset 00000000 figure 14-8. timer count register low (tcnt) table 14-6. tcnt field descriptions field description 15:0 tcnt[15:0] timer counter bits the 16-bit main timer is an up counter. a read to this register will return the current value of the counter. access to the counter register will take place in one clock cycle. note: a separate read/write for high byte and low byte in test mode will give a different result than accessing them as a word. the period of the ?st count after a write to the tcnt registers may be a different size because the write is not synchronized with the prescaler clock. module base + 0x0006 76543210 r ten tswai tsfrz tffca prnt 000 w reset 00000000 = unimplemented or reserved figure 14-9. timer system control register 1 (tscr1) table 14-7. tscr1 field descriptions field description 7 ten timer enable 0 disables the main timer, including the counter. can be used for reducing power consumption. 1 allows the timer to function normally. note: if for any reason the timer is not active, there is no 64 clock for the pulse accumulator since the 64 is generated by the timer prescaler. 6 tswai timer module stops while in wait 0 allows the timer module to continue running during wait. 1 disables the timer counter, pulse accumulators and modulus down counter when the mcu is in wait mode. timer interrupts cannot be used to get the mcu out of wait. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 537 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.7 timer toggle on over?w register 1 (ttov) read or write: anytime all bits reset to zero. 5 tsfrz timer and modulus counter stop while in freeze mode 0 allows the timer and modulus counter to continue running while in freeze mode. 1 disables the timer and modulus counter whenever the mcu is in freeze mode. this is useful for emulation. the pulse accumulators do not stop in freeze mode. 4 tffca timer fast flag clear all 0 allows the timer ?g clearing to function normally. 1 a read from an input capture or a write to the output compare channel registers causes the corresponding channel ?g, cxf, to be cleared in the tflg1 register. any access to the tcnt register clears the tof ?g in the tflg2 register. any access to the pacn3 and pacn2 registers clears the paovf and paif ?gs in the paflg register. any access to the pacn1 and pacn0 registers clears the pbovf ?g in the pbflg register. any access to the mccnt register clears the mczf ?g in the mcflg register. this has the advantage of eliminating software overhead in a separate clear sequence. extra care is required to avoid accidental ?g clearing due to unintended accesses. note: the ?gs cannot be cleared via the normal ?g clearing mechanism (writing a one to the ?g) when tffca = 1. 3 prnt precision timer 0 enables legacy timer. only bits dly0 and dly1 of the dlyct register are used for the delay selection of the delay counter. pr0, pr1, and pr2 bits of the tscr2 register are used for timer counter prescaler selection. mcpr0 and mcpr1 bits of the mcctl register are used for modulus down counter prescaler selection. 1 enables precision timer. all bits in the dlyct register are used for the delay selection, all bits of the ptpsr register are used for precision timer prescaler selection, and all bits of ptmcpsr register are used for the prescaler precision timer modulus counter prescaler selection. module base + 0x0007 76543210 r tov7 tov6 tov5 tov4 tov3 tov2 tov1 tov0 w reset 00000000 figure 14-10. timer toggle on over?w register 1 (ttov) table 14-8. ttov field descriptions field description 7:0 tov[7:0] toggle on over?w bits tov97:0] toggles output compare pin on timer counter over?w. this feature only takes effect when in output compare mode. when set, it takes precedence over forced output compare but not channel 7 override events. 0 toggle output compare pin on over?w feature disabled. 1 toggle output compare pin on over?w feature enabled. table 14-7. tscr1 field descriptions (continued) field description chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 538 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.8 timer control register 1/timer control register 2 (tctl1/tctl2) read or write: anytime all bits reset to zero. note to enable output action by omx and olx bits on timer port, the corresponding bit in oc7m should be cleared. module base + 0x0008 76543210 r om7 ol7 om6 ol6 om5 ol5 om4 ol4 w reset 00000000 figure 14-11. timer control register 1 (tctl1) module base + 0x0009 76543210 r om3 ol3 om2 ol2 om1 ol1 om0 ol0 w reset 00000000 figure 14-12. timer control register 2 (tctl2) table 14-9. tctl1/tctl2 field descriptions field description om[7:0] 7, 5, 3, 1 omx ?output mode olx ?output level these eight pairs of control bits are encoded to specify the output action to be taken as a result of a successful ocx compare. when either omx or olx is one, the pin associated with ocx becomes an output tied to ocx. see table 14-10 . ol[7:0] 6, 4, 2, 0 table 14-10. compare result output action omx olx action 0 0 no output compare action on the timer output signal 0 1 toggle ocx output line 1 0 clear ocx output line to zero 1 1 set ocx output line to one chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 539 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.9 timer control register 3/timer control register 4 (tctl3/tctl4) read or write: anytime all bits reset to zero. 14.3.2.10 timer interrupt enable register (tie) module base + 0x000a 76543210 r edg7b edg7a edg6b edg6a edg5b edg5a edg4b edg4a w reset 00000000 figure 14-13. timer control register 3 (tctl3) module base + 0x000b 76543210 r edg3b edg3a edg2b edg2a edg1b edg1a edg0b edg0a w reset 00000000 figure 14-14. timer control register 4 (tctl4) table 14-11. tctl3/tctl4 field descriptions field description edg[7:0]b 7, 5, 3, 1 input capture edge control ?these eight pairs of control bits con?ure the input capture edge detector circuits for each input capture channel. the four pairs of control bits in tctl4 also con?ure the input capture edge control for the four 8-bit pulse accumulators pac0?ac3.edg0b and edg0a in tctl4 also determine the active edge for the 16-bit pulse accumulator pacb. see table 14-12 . edg[7:0]a 6, 4, 2, 0 table 14-12. edge detector circuit con?uration edgxb edgxa con?uration 0 0 capture disabled 0 1 capture on rising edges only 1 0 capture on falling edges only 1 1 capture on any edge (rising or falling) module base + 0x000c 76543210 r c7i c6i c5i c4i c3i c2i c1i c0i w reset 00000000 figure 14-15. timer interrupt enable register (tie) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 540 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read or write: anytime all bits reset to zero. the bits c7i?0i correspond bit-for-bit with the ?gs in the tflg1 status register. 14.3.2.11 timer system control register 2 (tscr2) read or write: anytime all bits reset to zero. table 14-13. tie field descriptions field description 7:0 c[7:0]i input capture/output compare ??interrupt enable 0 the corresponding ?g is disabled from causing a hardware interrupt. 1 the corresponding ?g is enabled to cause an interrupt. module base + 0x000d 76543210 r toi 000 tcre pr2 pr1 pr0 w reset 00000000 = unimplemented or reserved figure 14-16. timer system control register 2 (tscr2) table 14-14. tscr2 field descriptions field description 7 toi timer over?w interrupt enable 0 timer over?w interrupt disabled. 1 hardware interrupt requested when tof ?g set. 3 tcre timer counter reset enable this bit allows the timer counter to be reset by a successful channel 7 output compare. this mode of operation is similar to an up-counting modulus counter. 0 counter reset disabled and counter free runs. 1 counter reset by a successful output compare on channel 7. note: if register tc7 = 0x0000 and tcre = 1, then the tcnt register will stay at 0x0000 continuously. if register tc7 = 0xffff and tcre = 1, the tof ?g will never be set when tcnt is reset from 0xffff to 0x0000. 2:0 pr[2:0] timer prescaler select these three bits specify the division rate of the main timer prescaler when the prnt bit of register tscr1 is set to 0. the newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. see table 14-15 . table 14-15. prescaler selection pr2 pr1 pr0 prescale factor 000 1 001 2 010 4 chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 541 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.12 main timer interrupt flag 1 (tflg1) read: anytime write used in the ?g clearing mechanism. writing a one to the ?g clears the ?g. writing a zero will not affect the current status of the bit. note when tffca = 1, the ?gs cannot be cleared via the normal ?g clearing mechanism (writing a one to the ?g). reference section 14.3.2.6, ?imer system control register 1 (tscr1) . all bits reset to zero. tflg1 indicates when interrupt conditions have occurred. the ?gs can be cleared via the normal ?g clearing mechanism (writing a one to the ?g) or via the fast ?g clearing mechanism (reference tffca bit in section 14.3.2.6, ?imer system control register 1 (tscr1) ). use of the tfmod bit in the icsys register in conjunction with the use of the icovw register allows a timer interrupt to be generated after capturing two values in the capture and holding registers, instead of generating an interrupt for every capture. 011 8 100 16 101 32 110 64 1 1 1 128 module base + 0x000e 76543210 r c7f c6f c5f c4f c3f c2f c1f c0f w reset 00000000 figure 14-17. main timer interrupt flag 1 (tflg1) table 14-16. tflg1 field descriptions field description 7:0 c[7:0]f input capture/output compare channel ? flag a cxf ?g is set when a corresponding input capture or output compare is detected. c0f can also be set by 16-bit pulse accumulator b (pacb). c3f?0f can also be set by 8-bit pulse accumulators pac3?ac0. if the delay counter is enabled, the cxf ?g will not be set until after the delay. table 14-15. prescaler selection (continued) pr2 pr1 pr0 prescale factor chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 542 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.13 main timer interrupt flag 2 (tflg2) read: anytime write used in the ?g clearing mechanism. writing a one to the ?g clears the ?g. writing a zero will not affect the current status of the bit. note when tffca = 1, the ?g cannot be cleared via the normal ?g clearing mechanism (writing a one to the ?g). reference section 14.3.2.6, ?imer system control register 1 (tscr1) . all bits reset to zero. tflg2 indicates when interrupt conditions have occurred. the ?g can be cleared via the normal ?g clearing mechanism (writing a one to the ?g) or via the fast ?g clearing mechanism (reference tffca bit in section 14.3.2.6, ?imer system control register 1 (tscr1) ). 14.3.2.14 timer input capture/output compare registers 0? module base + 0x000f 76543210 r tof 0000000 w reset 00000000 = unimplemented or reserved figure 14-18. main timer interrupt flag 2 (tflg2) table 14-17. tflg2 field descriptions field description 7 tof timer over?w flag ?set when 16-bit free-running timer over?ws from 0xffff to 0x0000. module base + 0x0010 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-19. timer input capture/output compare register 0 high (tc0) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 543 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 module base + 0x0011 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-20. timer input capture/output compare register 0 low (tc0) module base + 0x0012 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-21. timer input capture/output compare register 1 high (tc1) module base + 0x0013 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-22. timer input capture/output compare register 1 low (tc1) module base + 0x0014 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-23. timer input capture/output compare register 2 high (tc2) module base + 0x0015 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-24. timer input capture/output compare register 2 low (tc2) module base + 0x0016 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-25. timer input capture/output compare register 3 high (tc3) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 544 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 module base + 0x0017 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-26. timer input capture/output compare register 3 low (tc3) module base + 0x0018 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-27. timer input capture/output compare register 4 high (tc4) module base + 0x0019 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-28. timer input capture/output compare register 4 low (tc4) module base + 0x001a 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-29. timer input capture/output compare register 5 high (tc5) module base + 0x001b 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-30. timer input capture/output compare register 5 low (tc5) module base + 0x001c 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-31. timer input capture/output compare register 6 high (tc6) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 545 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write anytime for output compare function. writes to these registers have no meaning or effect during input capture. all bits reset to zero. depending on the tios bit for the corresponding channel, these registers are used to latch the value of the free-running counter when a de?ed transition is sensed by the corresponding input capture edge detector or to trigger an output action for output compare. 14.3.2.15 16-bit pulse accumulator a control register (pactl) read: anytime write: anytime module base + 0x001d 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-32. timer input capture/output compare register 6 low (tc6) module base + 0x001e 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 14-33. timer input capture/output compare register 7 high (tc7) module base + 0x001f 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 14-34. timer input capture/output compare register 7 low (tc7) module base + 0x0020 76543210 r0 paen pamod pedge clk1 clk0 paovi pai w reset 00000000 = unimplemented or reserved figure 14-35. 16-bit pulse accumulator control register (pactl) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 546 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 all bits reset to zero. . table 14-18. pactl field descriptions field description 6 paen pulse accumulator a system enable ?paen is independent from ten. with timer disabled, the pulse accumulator can still function unless pulse accumulator is disabled. 0 16-bit pulse accumulator a system disabled. 8-bit pac3 and pac2 can be enabled when their related enable bits in icpar are set. pulse accumulator input edge flag (paif) function is disabled. 1 16-bit pulse accumulator a system enabled. the two 8-bit pulse accumulators pac3 and pac2 are cascaded to form the paca 16-bit pulse accumulator. when paca in enabled, the pacn3 and pacn2 registers contents are respectively the high and low byte of the paca. pa3en and pa2en control bits in icpar have no effect. pulse accumulator input edge flag (paif) function is enabled. the paca shares the input pin with ic7. 5 pamod pulse accumulator mode ?this bit is active only when the pulse accumulator a is enabled (paen = 1). 0 event counter mode 1 gated time accumulation mode 4 pedge pulse accumulator edge control ?this bit is active only when the pulse accumulator a is enabled (paen = 1). refer to table 14-19 . for pamod bit = 0 (event counter mode). 0 falling edges on ic7 pin cause the count to be incremented 1 rising edges on ic7 pin cause the count to be incremented for pamod bit = 1 (gated time accumulation mode). 0 ic7 input pin high enables bus clock divided by 64 to pulse accumulator and the trailing falling edge on ic7 sets the paif ?g. 1 ic7 input pin low enables bus clock divided by 64 to pulse accumulator and the trailing rising edge on ic7 sets the paif ?g. if the timer is not active (ten = 0 in tscr1), there is no divide-by-64 since the 64 clock is generated by the timer prescaler. 3:2 clk[1:0] clock select bits ?for the description of paclk please refer to figure 14-71 . if the pulse accumulator is disabled (paen = 0), the prescaler clock from the timer is always used as an input clock to the timer counter. the change from one selected clock to the other happens immediately after these bits are written. refer to table 14-20 . 2 paov i pulse accumulator a over?w interrupt enable 0 interrupt inhibited 1 interrupt requested if paovf is set 0 pa i pulse accumulator input interrupt enable 0 interrupt inhibited 1 interrupt requested if paif is set table 14-19. pin action pamod pedge pin action 0 0 falling edge 0 1 rising edge 1 0 divide by 64 clock enabled with pin high level 1 1 divide by 64 clock enabled with pin low level chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 547 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.16 pulse accumulator a flag register (paflg) read: anytime write used in the ?g clearing mechanism. writing a one to the ?g clears the ?g. writing a zero will not affect the current status of the bit. note when tffca = 1, the ?gs cannot be cleared via the normal ?g clearing mechanism (writing a one to the ?g). reference section 14.3.2.6, ?imer system control register 1 (tscr1) . all bits reset to zero. paflg indicates when interrupt conditions have occurred. the ?gs can be cleared via the normal ?g clearing mechanism (writing a one to the ?g) or via the fast ?g clearing mechanism (reference tffca bit in section 14.3.2.6, ?imer system control register 1 (tscr1) ). table 14-20. clock selection clk1 clk0 clock source 0 0 use timer prescaler clock as timer counter clock 0 1 use paclk as input to timer counter clock 1 0 use paclk/256 as timer counter clock frequency 1 1 use paclk/65536 as timer counter clock frequency module base + 0x0021 76543210 r000000 paovf paif w reset 00000000 = unimplemented or reserved figure 14-36. pulse accumulator a flag register (paflg) table 14-21. paflg field descriptions field description 1 paov f pulse accumulator a over?w flag ?set when the 16-bit pulse accumulator a over?ws from 0xffff to 0x0000, or when 8-bit pulse accumulator 3 (pac3) over?ws from 0x00ff to 0x0000. when pacmx = 1, paovf bit can also be set if 8-bit pulse accumulator 3 (pac3) reaches 0x00ff followed by an active edge on ic3. 0 paif pulse accumulator input edge flag ?set when the selected edge is detected at the ic7 input pin. in event mode the event edge triggers paif and in gated time accumulation mode the trailing edge of the gate signal at the ic7 input pin triggers paif. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 548 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.17 pulse accumulators count registers (pacn3 and pacn2) read: anytime write: anytime all bits reset to zero. the two 8-bit pulse accumulators pac3 and pac2 are cascaded to form the paca 16-bit pulse accumulator. when paca in enabled (paen = 1 in pactl), the pacn3 and pacn2 registers contents are respectively the high and low byte of the paca. when pacn3 over?ws from 0x00ff to 0x0000, the interrupt ?g paovf in paflg is set. full count register access will take place in one clock cycle. note a separate read/write for high byte and low byte will give a different result than accessing them as a word. when clocking pulse and write to the registers occurs simultaneously, write takes priority and the register is not incremented. 14.3.2.18 pulse accumulators count registers (pacn1 and pacn0) module base + 0x0022 76543210 r pacnt7(15) pacnt6(14) pacnt5(13) pacnt4(12) pacnt3(11) pacnt2(10) pacnt1(9) pacnt0(8) w reset 00000000 figure 14-37. pulse accumulators count register 3 (pacn3) module base + 0x0023 76543210 r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w reset 00000000 figure 14-38. pulse accumulators count register 2 (pacn2) module base + 0x0024 76543210 r pacnt7(15) pacnt6(14) pacnt5(13) pacnt4(12) pacnt3(11) pacnt2(10) pacnt1(9) pacnt0(8) w reset 00000000 figure 14-39. pulse accumulators count register 1 (pacn1) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 549 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime all bits reset to zero. the two 8-bit pulse accumulators pac1 and pac0 are cascaded to form the pacb 16-bit pulse accumulator. when pacb in enabled, (pben = 1 in pbctl) the pacn1 and pacn0 registers contents are respectively the high and low byte of the pacb. when pacn1 over?ws from 0x00ff to 0x0000, the interrupt ?g pbovf in pbflg is set. full count register access will take place in one clock cycle. note a separate read/write for high byte and low byte will give a different result than accessing them as a word. when clocking pulse and write to the registers occurs simultaneously, write takes priority and the register is not incremented. 14.3.2.19 16-bit modulus down-counter control register (mcctl) read: anytime write: anytime all bits reset to zero. module base + 0x0025 76543210 r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w reset 00000000 figure 14-40. pulse accumulators count register 0 (pacn0) module base + 0x0026 76543210 r mczi modmc rdmcl 00 mcen mcpr1 mcpr0 w iclat flmc reset 00000000 figure 14-41. 16-bit modulus down-counter control register (mcctl) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 550 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 14-22. mcctl field descriptions field description 7 mczi modulus counter under?w interrupt enable 0 modulus counter interrupt is disabled. 1 modulus counter interrupt is enabled. 6 modmc modulus mode enable 0 the modulus counter counts down from the value written to it and will stop at 0x0000. 1 modulus mode is enabled. when the modulus counter reaches 0x0000, the counter is loaded with the latest value written to the modulus count register. note: for proper operation, the mcen bit should be cleared before modifying the modmc bit in order to reset the modulus counter to 0xffff. 5 rdmcl read modulus down-counter load 0 reads of the modulus count register (mccnt) will return the present value of the count register. 1 reads of the modulus count register (mccnt) will return the contents of the load register. 4 iclat input capture force latch action ?when input capture latch mode is enabled (latq and bufen bit in icsys are set), a write one to this bit immediately forces the contents of the input capture registers tc0 to tc3 and their corresponding 8-bit pulse accumulators to be latched into the associated holding registers. the pulse accumulators will be automatically cleared when the latch action occurs. writing zero to this bit has no effect. read of this bit will always return zero. 3 flmc force load register into the modulus counter count register ?this bit is active only when the modulus down-counter is enabled (mcen = 1). a write one into this bit loads the load register into the modulus counter count register (mccnt). this also resets the modulus counter prescaler. write zero to this bit has no effect. read of this bit will return always zero. 2 mcen modulus down-counter enable 0 modulus counter disabled. the modulus counter (mccnt) is preset to 0xffff. this will prevent an early interrupt ?g when the modulus down-counter is enabled. 1 modulus counter is enabled. 1:0 mcpr[1:0] modulus counter prescaler select these two bits specify the division rate of the modulus counter prescaler when prnt of tscr1 is set to 0. the newly selected prescaler division rate will not be effective until a load of the load register into the modulus counter count register occurs. table 14-23. modulus counter prescaler select mcpr1 mcpr0 prescaler division 00 1 01 4 10 8 11 16 chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 551 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.20 16-bit modulus down-counter flag register (mcflg) read: anytime write only used in the ?g clearing mechanism for bit 7. writing a one to bit 7 clears the ?g. writing a zero will not affect the current status of the bit. note when tffca = 1, the ?g cannot be cleared via the normal ?g clearing mechanism (writing a one to the ?g). reference section 14.3.2.6, ?imer system control register 1 (tscr1) . all bits reset to zero. 14.3.2.21 icpar ?input control pulse accumulators register (icpar) read: anytime module base + 0x0027 76543210 r mczf 0 0 0 polf3 polf2 polf1 polf0 w reset 00000000 = unimplemented or reserved figure 14-42. 16-bit modulus down-counter flag register (mcflg) table 14-24. mcflg field descriptions field description 7 mczf modulus counter under?w flag ?the ?g is set when the modulus down-counter reaches 0x0000. the ?g indicates when interrupt conditions have occurred. the ?g can be cleared via the normal ?g clearing mechanism (writing a one to the ?g) or via the fast ?g clearing mechanism (reference tffca bit in section 14.3.2.6, ?imer system control register 1 (tscr1) ). 3:0 polf[3:0] first input capture polarity status ?these are read only bits. writes to these bits have no effect. each status bit gives the polarity of the ?st edge which has caused an input capture to occur after capture latch has been read. each polfx corresponds to a timer portx input. 0 the ?st input capture has been caused by a falling edge. 1 the ?st input capture has been caused by a rising edge. module base + 0x0028 76543210 r0000 pa3en pa2en pa1en pa0en w reset 00000000 = unimplemented or reserved figure 14-43. input control pulse accumulators register (icpar) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 552 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 write: anytime. all bits reset to zero. the 8-bit pulse accumulators pac3 and pac2 can be enabled only if paen in pactl is cleared. if paen is set, pa3en and pa2en have no effect. the 8-bit pulse accumulators pac1 and pac0 can be enabled only if pben in pbctl is cleared. if pben is set, pa1en and pa0en have no effect. 14.3.2.22 delay counter control register (dlyct) read: anytime write: anytime all bits reset to zero. table 14-25. icpar field descriptions field description 3:0 pa[3:0]en 8-bit pulse accumulator ??enable 0 8-bit pulse accumulator is disabled. 1 8-bit pulse accumulator is enabled. module base + 0x0029 76543210 r dly7 dly6 dly5 dly4 dly3 dly2 dly1 dly0 w reset 00000000 figure 14-44. delay counter control register (dlyct) table 14-26. dlyct field descriptions field description 7:0 dly[7:0] delay counter select ?when the prnt bit of tscr1 register is set to 0, only bits dly0, dly1 are used to calculate the delay. table 14-27 shows the delay settings in this case. when the prnt bit of tscr1 register is set to 1, all bits are used to set a more precise delay. table 14-28 shows the delay settings in this case. after detection of a valid edge on an input capture pin, the delay counter counts the pre-selected number of [(dly_cnt + 1)*4]bus clock cycles, then it will generate a pulse on its output if the level of input signal, after the preset delay, is the opposite of the level before the transition.this will avoid reaction to narrow input pulses. delay between two active edges of the input signal period should be longer than the selected counter delay. note: it is recommended to not write to this register while the timer is enabled, that is when ten is set in register tscr1. table 14-27. delay counter select when prnt = 0 dly1 dly0 delay 0 0 disabled chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 553 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.23 input control overwrite register (icovw) read: anytime write: anytime all bits reset to zero. 0 1 256 bus clock cycles 1 0 512 bus clock cycles 1 1 1024 bus clock cycles table 14-28. delay counter select examples when prnt = 1 dly7 dly6 dly5 dly4 dly3 dly2 dly1 dly0 delay 00000000 disabled (bypassed) 00000001 8 bus clock cycles 0000001012 bus clock cycles 0000001116 bus clock cycles 0000010020 bus clock cycles 0000010124 bus clock cycles 0000011028 bus clock cycles 0000011132 bus clock cycles 0000111164 bus clock cycles 00011111 128 bus clock cycles 00111111 256 bus clock cycles 01111111 512 bus clock cycles 11111111 1024 bus clock cycles module base + 0x002a 76543210 r novw7 novw6 novw5 novw4 novw3 novw2 novw1 novw0 w reset 00000000 figure 14-45. input control overwrite register (icovw) table 14-27. delay counter select when prnt = 0 (continued) dly1 dly0 delay chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 554 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.24 input control system control register (icsys) read: anytime write: once in normal modes all bits reset to zero. table 14-29. icovw field descriptions field description 7:0 novw[7:0] no input capture overwrite 0 the contents of the related capture register or holding register can be overwritten when a new input capture or latch occurs. 1 the related capture register or holding register cannot be written by an event unless they are empty (see section 14.4.1.1, ?c channels ). this will prevent the captured value being overwritten until it is read or latched in the holding register. module base + 0x002b 76543210 r sh37 sh26 sh15 sh04 tfmod pacmx bufen latq w reset 00000000 figure 14-46. input control system register (icsys) table 14-30. icsys field descriptions field description 7:4 shxy share input action of input capture channels x and y 0 normal operation 1 the channel input ? causes the same action on the channel ?? the port pin ? and the corresponding edge detector is used to be active on the channel ?? 3 tfmod timer flag setting mode use of the tfmod bit in conjunction with the use of the icovw register allows a timer interrupt to be generated after capturing two values in the capture and holding registers instead of generating an interrupt for every capture. by setting tfmod in queue mode, when novwx bit is set and the corresponding capture and holding registers are emptied, an input capture event will ?st update the related input capture register with the main timer contents. at the next event, the tcx data is transferred to the tcxh register, the tcx is updated and the cxf interrupt ?g is set. in all other input capture cases the interrupt ?g is set by a valid external event on icx. 0 the timer ?gs c3f?0f in tflg1 are set when a valid input capture transition on the corresponding port pin occurs. 1 if in queue mode (bufen = 1 and latq = 0), the timer ?gs c3f?0f in tflg1 are set only when a latch on the corresponding holding register occurs. if the queue mode is not engaged, the timer ?gs c3f?0f are set the same way as for tfmod = 0. 2 pacmx 8-bit pulse accumulators maximum count 0 normal operation. when the 8-bit pulse accumulator has reached the value 0x00ff, with the next active edge, it will be incremented to 0x0000. 1 when the 8-bit pulse accumulator has reached the value 0x00ff, it will not be incremented further. the value 0x00ff indicates a count of 255 or more. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 555 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.25 output compare pin disconnect register (ocpd) read: anytime write: anytime all bits reset to zero. 1 buffen ic buffer enable 0 input capture and pulse accumulator holding registers are disabled. 1 input capture and pulse accumulator holding registers are enabled. the latching mode is de?ed by latq control bit. 0 latq input control latch or queue mode enable the bufen control bit should be set in order to enable the ic and pulse accumulators holding registers. otherwise latq latching modes are disabled. write one into iclat bit in mcctl, when latq and bufen are set will produce latching of input capture and pulse accumulators registers into their holding registers. 0 queue mode of input capture is enabled. the main timer value is memorized in the ic register by a valid input pin transition. with a new occurrence of a capture, the value of the ic register will be transferred to its holding register and the ic register memorizes the new timer value. 1 latch mode is enabled. latching function occurs when modulus down-counter reaches zero or a zero is written into the count register mccnt (see section 14.4.1.1.2, ?uffered ic channels ). with a latching event the contents of ic registers and 8-bit pulse accumulators are transferred to their holding registers. 8-bit pulse accumulators are cleared. module base + 0x002c 76543210 r ocpd7 ocpd6 ocpd5 ocpd4 ocpd3 ocpd2 ocpd1 ocpd0 w reset 00000000 figure 14-47. output compare pin disconnect register (ocpd) table 14-31. ocpd field descriptions field description 7:0 ocpd[7:0] output compare pin disconnect bits 0 enables the timer channel io port. output compare actions will occur on the channel pin. these bits do not affect the input capture or pulse accumulator functions. 1 disables the timer channel io port. output compare actions will not affect on the channel pin; the output compare flag will still be set on an output compare event. table 14-30. icsys field descriptions (continued) field description chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 556 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.26 precision timer prescaler select register (ptpsr) read: anytime write: anytime all bits reset to zero. module base + 0x002e 76543210 r ptps7 ptps6 ptps5 ptps4 ptps3 ptps2 ptps1 ptps0 w reset 00000000 figure 14-48. precision timer prescaler select register (ptpsr) table 14-32. ptpsr field descriptions field description 7:0 ptps[7:0] precision timer prescaler select bits these eight bits specify the division rate of the main timer prescaler. these are effective only when the prnt bit of tscr1 is set to 1. table 14-33 shows some selection examples in this case. the newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. table 14-33. precision timer prescaler selection examples when prnt = 1 ptps7 ptps6 ptps5 ptps4 ptps3 ptps2 ptps1 ptps0 prescale factor 00000000 1 00000001 2 00000010 3 00000011 4 00000100 5 00000101 6 00000110 7 00000111 8 00001111 16 00011111 32 00111111 64 01111111 128 11111111 256 chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 557 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.27 precision timer modulus counter prescaler select register (ptmcpsr) read: anytime write: anytime all bits reset to zero. module base + 0x002f 76543210 r ptmps7 ptmps6 ptmps5 ptmps4 ptmps3 ptmps2 ptmps1 ptmps0 w reset 00000000 figure 14-49. precision timer modulus counter prescaler select register (ptmcpsr) table 14-34. ptmcpsr field descriptions field description 7:0 ptmps[7:0] precision timer modulus counter prescaler select bits ?these eight bits specify the division rate of the modulus counter prescaler. these are effective only when the prnt bit of tscr1 is set to 1. table 14-35 shows some possible division rates. the newly selected prescaler division rate will not be effective until a load of the load register into the modulus counter count register occurs. table 14-35. precision timer modulus counter prescaler select examples when prnt = 1 ptmps7 ptmps6 ptmps5 ptmps4 ptmps3 ptmps2 ptmps1 ptmps0 prescaler division rate 000000001 000000012 000000103 000000114 000001005 000001016 000001107 000001118 0000111116 0001111132 0011111164 01111111128 11111111256 chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 558 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.3.2.28 16-bit pulse accumulator b control register (pbctl) read: anytime write: anytime all bits reset to zero. 14.3.2.29 pulse accumulator b flag register (pbflg) read: anytime write used in the ?g clearing mechanism. writing a one to the ?g clears the ?g. writing a zero will not affect the current status of the bit. module base + 0x0030 76543210 r0 pben 0000 pbovi 0 w reset 00000000 = unimplemented or reserved figure 14-50. 16-bit pulse accumulator b control register (pbctl) table 14-36. pbctl field descriptions field description 6 pben pulse accumulator b system enable ?pben is independent from ten. with timer disabled, the pulse accumulator can still function unless pulse accumulator is disabled. 0 16-bit pulse accumulator system disabled. 8-bit pac1 and pac0 can be enabled when their related enable bits in icpar are set. 1 pulse accumulator b system enabled. the two 8-bit pulse accumulators pac1 and pac0 are cascaded to form the pacb 16-bit pulse accumulator b. when pacb is enabled, the pacn1 and pacn0 registers contents are respectively the high and low byte of the pacb. pa1en and pa0en control bits in icpar have no effect. the pacb shares the input pin with ic0. 1 pbovi pulse accumulator b over?w interrupt enable 0 interrupt inhibited 1 interrupt requested if pbovf is set module base + 0x0031 76543210 r000000 pbovf 0 w reset 00000000 = unimplemented or reserved figure 14-51. pulse accumulator b flag register (pbflg) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 559 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note when tffca = 1, the ?g cannot be cleared via the normal ?g clearing mechanism (writing a one to the ?g). reference section 14.3.2.6, ?imer system control register 1 (tscr1) . all bits reset to zero. pbflg indicates when interrupt conditions have occurred. the ?g can be cleared via the normal ?g clearing mechanism (writing a one to the ?g) or via the fast ?g clearing mechanism (reference tffca bit in section 14.3.2.6, ?imer system control register 1 (tscr1) ). 14.3.2.30 8-bit pulse accumulators holding registers (pa3h?a0h) table 14-37. pbflg field descriptions field description 1 pbovf pulse accumulator b over?w flag ?this bit is set when the 16-bit pulse accumulator b over?ws from 0xffff to 0x0000, or when 8-bit pulse accumulator 1 (pac1) over?ws from 0x00ff to 0x0000. when pacmx = 1, pbovf bit can also be set if 8-bit pulse accumulator 1 (pac1) reaches 0x00ff and an active edge follows on ic1. module base + 0x0032 76543210 r pa3h7 pa3h6 pa3h5 pa3h4 pa3h3 pa3h2 pa3h1 pa3h0 w reset 00000000 = unimplemented or reserved figure 14-52. 8-bit pulse accumulators holding register 3 (pa3h) module base + 0x0033 76543210 r pa2h7 pa2h6 pa2h5 pa2h4 pa2h3 pa2h2 pa2h1 pa2h0 w reset 00000000 = unimplemented or reserved figure 14-53. 8-bit pulse accumulators holding register 2 (pa2h) module base + 0x0034 76543210 r pa1h7 pa1h6 pa1h5 pa1h4 pa1h3 pa1h2 pa1h1 pa1h0 w reset 00000000 = unimplemented or reserved figure 14-54. 8-bit pulse accumulators holding register 1 (pa1h) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 560 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime. write: has no effect. all bits reset to zero. these registers are used to latch the value of the corresponding pulse accumulator when the related bits in register icpar are enabled (see section 14.4.1.3, ?ulse accumulators ). 14.3.2.31 modulus down-counter count register (mccnt) read: anytime write: anytime. all bits reset to one. a full access for the counter register will take place in one clock cycle. note a separate read/write for high byte and low byte will give different results than accessing them as a word. if the rdmcl bit in mcctl register is cleared, reads of the mccnt register will return the present value of the count register. if the rdmcl bit is set, reads of the mccnt will return the contents of the load register. module base + 0x0035 76543210 r pa0h7 pa0h6 pa0h5 pa0h4 pa0h3 pa0h2 pa0h1 pa0h0 w reset 00000000 = unimplemented or reserved figure 14-55. 8-bit pulse accumulators holding register 0 (pa0h) module base + 0x0036 15 14 13 12 11 10 9 8 r mccnt15 mccnt14 mccnt13 mccnt12 mccnt11 mccnt10 mccnt9 mccnt8 w reset 11111111 figure 14-56. modulus down-counter count register high (mccnt) module base + 0x0037 76543210 r mccnt7 mccnt6 mccnt5 mccnt4 mccnt3 mccnt2 mccnt1 mccnt0 w reset 11111111 figure 14-57. modulus down-counter count register low (mccnt) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 561 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 if a 0x0000 is written into mccnt when latq and bufen in icsys register are set, the input capture and pulse accumulator registers will be latched. with a 0x0000 write to the mccnt, the modulus counter will stay at zero and does not set the mczf ?g in mcflg register. if the modulus down counter is enabled (mcen = 1) and modulus mode is enabled (modmc = 1), a write to mccnt will update the load register with the value written to it. the count register will not be updated with the new value until the next counter under?w. if modulus mode is not enabled (modmc = 0), a write to mccnt will clear the modulus prescaler and will immediately update the counter register with the value written to it and down-counts to 0x0000 and stops. the flmc bit in mcctl can be used to immediately update the count register with the new value if an immediate load is desired. 14.3.2.32 timer input capture holding registers 0? (tcxh) module base + 0x0038 15 14 13 12 11 10 9 8 r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w reset 00000000 = unimplemented or reserved figure 14-58. timer input capture holding register 0 high (tc0h) module base + 0x0039 76543210 r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w reset 00000000 = unimplemented or reserved figure 14-59. timer input capture holding register 0 low (tc0h) module base + 0x003a 15 14 13 12 11 10 9 8 r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w reset 00000000 = unimplemented or reserved figure 14-60. timer input capture holding register 1 high (tc1h) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 562 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: has no effect. module base + 0x003b 76543210 r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w reset 00000000 = unimplemented or reserved figure 14-61. timer input capture holding register 1 low (tc1h) module base + 0x003c 15 14 13 12 11 10 9 8 r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w reset 00000000 = unimplemented or reserved figure 14-62. timer input capture holding register 2 high (tc2h) module base + 0x003d 76543210 r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w reset 00000000 = unimplemented or reserved figure 14-63. timer input capture holding register 2 low (tc2h) module base + 0x003e 15 14 13 12 11 10 9 8 r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w reset 00000000 = unimplemented or reserved figure 14-64. timer input capture holding register 3 high (tc3h) module base + 0x003f 76543210 r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w reset 00000000 = unimplemented or reserved figure 14-65. timer input capture holding register 3 low (tc3h) chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 563 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 all bits reset to zero. these registers are used to latch the value of the input capture registers tc0?c3. the corresponding iosx bits in tios should be cleared (see section 14.4.1.1, ?c channels ). 14.4 functional description this section provides a complete functional description of the ect block, detailing the operation of the design from the end user perspective in a number of subsections. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 564 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 14-66. detailed timer block diagram in latch mode when prnt = 0 16 bit main timer p1 comparator tc0h hold reg. p0 p3 p2 p4 p5 p6 p7 edg0 edg1 edg2 edg3 mux modulus prescaler bus clock 16-bit load register 16-bit modulus 0 reset edg0 edg1 edg2 edg4 edg5 edg3 edg6 edg7 1, 4, 8, 16 16-bit free-running latch under?w main timer timer prescaler tc0 capture/compare reg. comparator tc1 capture/compare reg. comparator tc2 capture/compare reg. comparator tc3 capture/compare reg. comparator tc4 capture/compare reg. comparator tc5 capture/compare reg. comparator tc6 capture/compare reg. comparator tc7 capture/compare reg. pin logic pin logic pin logic pin logic pin logic pin logic pin logic pin logic delay tc1h hold reg. tc2h hold reg. tc3h hold reg. mux mux mux pa0h hold reg. pac 0 0 reset pa1h hold reg. pac 1 0 reset pa2h hold reg. pac 2 0 reset pa3h hold reg. pac 3 write 0x0000 to modulus counter iclat, latq, bufen (force latch) latq (mdc latch enable) down counter sh04 sh15 sh26 sh37 bus clock 1, 2, ..., 128 counter delay counter delay counter delay counter chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 565 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 14-67. detailed timer block diagram in latch mode when prnt = 1 16 bit main timer p1 comparator tc0h hold reg. p0 p3 p2 p4 p5 p6 p7 edg0 edg1 edg2 edg3 mux modulus prescaler bus clock 16-bit load register 16-bit modulus 0 reset edg0 edg1 edg2 edg4 edg5 edg3 edg6 edg7 1, 2,3, ..., 256 16-bit free-running latch under?w main timer timer prescaler tc0 capture/compare reg. comparator tc1 capture/compare reg. comparator tc2 capture/compare reg. comparator tc3 capture/compare reg. comparator tc4 capture/compare reg. comparator tc5 capture/compare reg. comparator tc6 capture/compare reg. comparator tc7 capture/compare reg. pin logic pin logic pin logic pin logic pin logic pin logic pin logic pin logic delay tc1h hold reg. tc2h hold reg. tc3h hold reg. mux mux mux pa0h hold reg. pac 0 0 reset pa1h hold reg. pac 1 0 reset pa2h hold reg. pac 2 0 reset pa3h hold reg. pac 3 write 0x0000 to modulus counter iclat, latq, bufen (force latch) latq (mdc latch enable) down counter sh04 sh15 sh26 sh37 bus clock 1, 2,3, ..., 256 counter delay counter delay counter delay counter 8, 12, 16, ..., 1024 8, 12, 16, ..., 1024 8, 12, 16, ..., 1024 8, 12, 16, ..., 1024 chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 566 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 14-68. detailed timer block diagram in queue mode when prnt = 0 16 bit main timer p1 tc0h hold reg. p0 p3 p2 p4 p5 p6 p7 edg0 edg1 edg2 edg3 mux bus clock 16-bit load register 16-bit modulus 0 reset edg0 edg1 edg2 edg4 edg5 edg3 edg6 edg7 1, 2, ..., 128 1, 4, 8, 16 latch0 pin logic pin logic pin logic pin logic pin logic pin logic pin logic pin logic bus clock tc1h hold reg. tc2h hold reg. tc3h hold reg. mux mux mux pa0h hold reg. pac 0 0 reset pa1h hold reg. pac 1 0 reset pa2h hold reg. pac 2 0 reset pa3h hold reg. pac 3 latch1 latch3 latch2 latq, bufen (queue mode) read tc3h hold reg. read tc2h hold reg. read tc1h hold reg. read tc0h hold reg. down counter sh04 sh15 sh26 sh37 timer prescaler 16-bit free-running main timer delay counter delay counter delay counter delay counter modulus prescaler comparator tc0 capture/compare reg. comparator tc1 capture/compare reg. comparator tc2 capture/compare reg. comparator tc3 capture/compare reg. comparator tc4 capture/compare reg. comparator tc5 capture/compare reg. comparator tc6 capture/compare reg. comparator tc7 capture/compare reg. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 567 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 14-69. detailed timer block diagram in queue mode when prnt = 1 16 bit main timer p1 tc0h hold reg. p0 p3 p2 p4 p5 p6 p7 edg0 edg1 edg2 edg3 mux bus clock 16-bit load register 16-bit modulus 0 reset edg0 edg1 edg2 edg4 edg5 edg3 edg6 edg7 1, 2, 3, ... 256 1, 2, 3, ... 256 latch0 pin logic pin logic pin logic pin logic pin logic pin logic pin logic pin logic bus clock tc1h hold reg. tc2h hold reg. tc3h hold reg. mux mux mux pa0h hold reg. pac 0 0 reset pa1h hold reg. pac 1 0 reset pa2h hold reg. pac 2 0 reset pa3h hold reg. pac 3 latch1 latch3 latch2 latq, bufen (queue mode) read tc3h hold reg. read tc2h hold reg. read tc1h hold reg. read tc0h hold reg. down counter sh04 sh15 sh26 sh37 timer prescaler 16-bit free-running main timer delay counter delay counter delay counter delay counter modulus prescaler comparator tc0 capture/compare reg. comparator tc1 capture/compare reg. comparator tc2 capture/compare reg. comparator tc3 capture/compare reg. comparator tc4 capture/compare reg. comparator tc5 capture/compare reg. comparator tc6 capture/compare reg. comparator tc7 capture/compare reg. 8, 12, 16, ... 1024 8, 12, 16, ... 1024 8, 12, 16, ... 1024 8, 12, 16, ... 1024 chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 568 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 14-70. 8-bit pulse accumulators block diagram p0 load holding register and reset pulse accumulator 0 0 edg3 edg2 edg1 edg0 edge detector delay counter interrupt interrupt p1 edge detector delay counter p2 edge detector delay counter p3 edge detector delay counter pa0h holding 0 8-bit pac1 (pacn1) 0 8-bit pac2 (pacn2) pa2h holding 0 8-bit pac3 (pacn3) pa3h holding 8-bit pac0 (pacn0) 8, 12,16, ..., 1024 8, 12,16, ..., 1024 8, 12,16, ..., 1024 8, 12,16, ..., 1024 register pa1h holding register register register chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 569 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 14-71. 16-bit pulse accumulators block diagram figure 14-72. block diagram for port 7 with output compare/pulse accumulator a edge detector p7 p0 bus clock divide by 64 clock select clk0 clk1 4:1 mux timclk (timer clock) paclk paclk / 256 paclk / 65536 prescaled clock (pclk) interrupt mux (pamod) edge detector pac a delay counter interrupt pac b 8-bit pac3 (pacn3) 8-bit pac2 (pacn2) 8-bit pac1 (pacn1) 8-bit pac0 (pacn0) px edge delay 16-bit main timer tcx input tcxh i.c. bufen ? la tq ? tfmod set cxf detector counter capture register holding register interrupt chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 570 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.4.1 enhanced capture timer modes of operation the enhanced capture timer has 8 input capture, output compare (ic/oc) channels, same as on the hc12 standard timer (timer channels tc0 to tc7). when channels are selected as input capture by selecting the iosx bit in tios register, they are called input capture (ic) channels. four ic channels (channels 7?) are the same as on the standard timer with one capture register each that memorizes the timer value captured by an action on the associated input pin. four other ic channels (channels 3?), in addition to the capture register, also have one buffer each called a holding register. this allows two different timer values to be saved without generating any interrupts. four 8-bit pulse accumulators are associated with the four buffered ic channels (channels 3?). each pulse accumulator has a holding register to memorize their value by an action on its external input. each pair of pulse accumulators can be used as a 16-bit pulse accumulator. the 16-bit modulus down-counter can control the transfer of the ic registers and the pulse accumulators contents to the respective holding registers for a given period, every time the count reaches zero. the modulus down-counter can also be used as a stand-alone time base with periodic interrupt capability. 14.4.1.1 ic channels the ic channels are composed of four standard ic registers and four buffered ic channels. an ic register is empty when it has been read or latched into the holding register. a holding register is empty when it has been read. 14.4.1.1.1 non-buffered ic channels the main timer value is memorized in the ic register by a valid input pin transition. if the corresponding novwx bit of the icovw register is cleared, with a new occurrence of a capture, the contents of ic register are overwritten by the new value. if the corresponding novwx bit of the icovw register is set, the capture register cannot be written unless it is empty. this will prevent the captured value from being overwritten until it is read. 14.4.1.1.2 buffered ic channels there are two modes of operations for the buffered ic channels: 1. ic latch mode (latq = 1) the main timer value is memorized in the ic register by a valid input pin transition (see figure 14-66 and figure 14-67 ). the value of the buffered ic register is latched to its holding register by the modulus counter for a given period when the count reaches zero, by a write 0x0000 to the modulus counter or by a write to iclat in the mcctl register. if the corresponding novwx bit of the icovw register is cleared, with a new occurrence of a capture, the contents of ic register are overwritten by the new value. in case of latching, the contents of its holding register are overwritten. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 571 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 if the corresponding novwx bit of the icovw register is set, the capture register or its holding register cannot be written by an event unless they are empty (see section 14.4.1.1, ?c channels ). this will prevent the captured value from being overwritten until it is read or latched in the holding register. 2. ic queue mode (latq = 0) the main timer value is memorized in the ic register by a valid input pin transition (see figure 14-68 and figure 14-69 ). if the corresponding novwx bit of the icovw register is cleared, with a new occurrence of a capture, the value of the ic register will be transferred to its holding register and the ic register memorizes the new timer value. if the corresponding novwx bit of the icovw register is set, the capture register or its holding register cannot be written by an event unless they are empty (see section 14.4.1.1, ?c channels ). if the tfmod bit of the icsys register is set,the timer ?gs c3f--c0f in tflg register are set only when a latch on the corresponding holding register occurs,after c3f--c0f are set,user should clear ?g c3f--c0f,then read tcx and tcxh to make tcx and tcxh be empty. in queue mode, reads of the holding register will latch the corresponding pulse accumulator value to its holding register. 14.4.1.1.3 delayed ic channels there are four delay counters in this module associated with ic channels 0?. the use of this feature is explained in the diagram and notes below. figure 14-73. channel input validity with delay counter feature in figure 14-73 a delay counter value of 256 bus cycles is considered. 1. input pulses with a duration of (dly_cnt ?1) cycles or shorter are rejected. 2. input pulses with a duration between (dly_cnt ?1) and dly_cnt cycles may be rejected or accepted, depending on their relative alignment with the sample points. 1 2 3 253 254 255 256 bus clock dly_cnt input on ch0? rejected accepted input on ch0? input on ch0? accepted input on ch0? rejected 0 255 cycles 255.5 cycles 255.5 cycles 256 cycles chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 572 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3. input pulses with a duration between (dly_cnt ?1) and dly_cnt cycles may be rejected or accepted, depending on their relative alignment with the sample points. 4. input pulses with a duration of dly_cnt or longer are accepted. 14.4.1.2 oc channel initialization an internal compare channel whose output drives ocx may be programmed before the timer drives the output compare state (ocx). the required output of the compare logic can be disconnected from the pin, leaving it driven by the gp io port, by setting the appropriate ocpdx bit before enabling the output compare channel (by default the ocpd bits are cleared which would enable the output compare logic to drive the pin as soon as the timer output compare channel is enabled). the desired initial state can then be con?ured in the internal output compare logic by forcing a compare action with the logic disconnected from the io (by writing a one to cforcx bit with tiosx, ocpdx and ten bits set to one). clearing the output compare disconnect bit (ocpdx) will then allow the internal compare logic to drive the programmed state to ocx. this allows a glitch free switching between general purpose i/o and timer output functionality. 14.4.1.3 pulse accumulators there are four 8-bit pulse accumulators with four 8-bit holding registers associated with the four ic buffered channels 3?. a pulse accumulator counts the number of active edges at the input of its channel. the minimum pulse width for the pai input is greater than two bus clocks.the maximum input frequency on the pulse accumulator channel is one half the bus frequency or eclk. the user can prevent the 8-bit pulse accumulators from counting further than 0x00ff by utilizing the pacmx control bit in the icsys register. in this case, a value of 0x00ff means that 255 counts or more have occurred. each pair of pulse accumulators can be used as a 16-bit pulse accumulator (see figure 14-71 ). pulse accumulator b operates only as an event counter, it does not feature gated time accumulation mode. the edge control for pulse accumulator b as a 16-bit pulse accumulator is de?ed by tctl4[1:0]. to operate the 16-bit pulse accumulators a and b (paca and pacb) independently of input capture or output compare 7 and 0 respectively, the user must set the corresponding bits: iosx = 1, omx = 0, and olx = 0. oc7m7 or oc7m0 in the oc7m register must also be cleared. there are two modes of operation for the pulse accumulators: pulse accumulator latch mode the value of the pulse accumulator is transferred to its holding register when the modulus down-counter reaches zero, a write 0x0000 to the modulus counter or when the force latch control bit iclat is written. at the same time the pulse accumulator is cleared. pulse accumulator queue mode when queue mode is enabled, reads of an input capture holding register will transfer the contents of the associated pulse accumulator to its holding register. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 573 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 at the same time the pulse accumulator is cleared. 14.4.1.4 modulus down-counter the modulus down-counter can be used as a time base to generate a periodic interrupt. it can also be used to latch the values of the ic registers and the pulse accumulators to their holding registers. the action of latching can be programmed to be periodic or only once. 14.4.1.5 precision timer by enabling the prnt bit of the tscr1 register, the performance of the timer can be enhanced. in this case, it is possible to set additional prescaler settings for the main timer counter and modulus down counter and enhance delay counter settings compared to the settings in the present ect timer. 14.4.1.6 flag clearing mechanisms the ?gs in the ect can be cleared one of two ways: 1. normal ?g clearing mechanism (tffca = 0) any of the ect ?gs can be cleared by writing a one to the ?g. 2. fast ?g clearing mechanism (tffca = 1) with the timer fast ?g clear all (tffca) enabled, the ect ?gs can only be cleared by accessing the various registers associated with the ect modes of operation as described below. the ?gs cannot be cleared via the normal ?g clearing mechanism . this fast ?g clearing mechanism has the advantage of eliminating the software overhead required by a separate clear sequence. extra care must be taken to avoid accidental ?g clearing due to unintended accesses. input capture a read from an input capture channel register causes the corresponding channel ?g, cxf, to be cleared in the tflg1 register. output compare a write to the output compare channel register causes the corresponding channel flag, cxf, to be cleared in the tflg1 register. timer counter any access to the tcnt register clears the tof flag in the tflg2 register. pulse accumulator a any access to the pacn3 and pacn2 registers clears the paovf and paif flags in the paflg register. pulse accumulator b any access to the pacn1 and pacn0 registers clears the pbovf flag in the pbflg register. modulus down counter any access to the mccnt register clears the mczf flag in the mcflg register. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 574 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.4.2 reset the reset state of each individual bit is listed within the register description section ( section 14.3, ?emory map and register de?ition ) which details the registers and their bit-?lds. chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 575 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.4.3 interrupts this section describes interrupts originated by the ect block. the mcu must service the interrupt requests. table 14-38 lists the interrupts generated by the ect to communicate with the mcu. table 14-38. ect interrupts the ect only originates interrupt requests. the following is a description of how the module makes a request and how the mcu should acknowledge that request. the interrupt vector offset and interrupt number are chip dependent. 14.4.3.1 channel [7:0] interrupt this active high output will be asserted by the module to request a timer channel 7? interrupt to be serviced by the system controller. 14.4.3.2 modulus counter interrupt this active high output will be asserted by the module to request a modulus counter under?w interrupt to be serviced by the system controller. 14.4.3.3 pulse accumulator b over?w interrupt this active high output will be asserted by the module to request a timer pulse accumulator b over?w interrupt to be serviced by the system controller. 14.4.3.4 pulse accumulator a input interrupt this active high output will be asserted by the module to request a timer pulse accumulator a input interrupt to be serviced by the system controller. 14.4.3.5 pulse accumulator a over?w interrupt this active high output will be asserted by the module to request a timer pulse accumulator a over?w interrupt to be serviced by the system controller. interrupt source description timer channel 7? active high timer channel interrupts 7? modulus counter under?w active high modulus counter interrupt pulse accumulator b over?w active high pulse accumulator b interrupt pulse accumulator a input active high pulse accumulator a input interrupt pulse accumulator a over?w pulse accumulator over?w interrupt timer over?w timer 0ver?w interrupt chapter 14 enhanced capture timer (ect16b8cv3) mc9s12xe-family reference manual , rev. 1.21 576 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 14.4.3.6 timer over?w interrupt this active high output will be asserted by the module to request a timer over?w interrupt to be serviced by the system controller. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 577 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 15 inter-integrated circuit (iicv3) block description 15.1 introduction the inter-ic bus (iic) is a two-wire, bidirectional serial bus that provides a simple, ef?ient method of data exchange between devices. being a two-wire device, the iic bus minimizes the need for large numbers of connections between devices, and eliminates the need for an address decoder. this bus is suitable for applications requiring occasional communications over a short distance between a number of devices. it also provides ?xibility, allowing additional devices to be connected to the bus for further expansion and system development. the interface is designed to operate up to 100 kbps with maximum bus loading and timing. the device is capable of operating at higher baud rates, up to a maximum of clock/20, with reduced bus loading. the maximum communication length and the number of devices that can be connected are limited by a maximum bus capacitance of 400 pf. 15.1.1 features the iic module has the following key features: compatible with i2c bus standard multi-master operation software programmable for one of 256 different serial clock frequencies software selectable acknowledge bit interrupt driven byte-by-byte data transfer arbitration lost interrupt with automatic mode switching from master to slave calling address identi?ation interrupt start and stop signal generation/detection repeated start signal generation acknowledge bit generation/detection bus busy detection table 15-1. revision history revision number revision date sections affected description of changes v01.03 28 jul 2006 15.7.1.7/15-599 - update ?w-chart of interrupt routine for 10-bit address v01.04 17 nov 2006 15.3.1.2/15-580 - revise table1-5 v01.05 14 aug 2007 15.3.1.1/15-579 - backward compatible for ibad bit name chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 578 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 general call address detection compliant to ten-bit address 15.1.2 modes of operation the iic functions the same in normal, special, and emulation modes. it has two low power modes: wait and stop modes. 15.1.3 block diagram the block diagram of the iic module is shown in figure 15-1 . figure 15-1. iic block diagram 15.2 external signal description the iicv3 module has two external pins. 15.2.1 iic_scl ?serial clock line pin this is the bidirectional serial clock line (scl) of the module, compatible to the iic bus speci?ation. 15.2.2 iic_sda ?serial data line pin this is the bidirectional serial data line (sda) of the module, compatible to the iic bus speci?ation. in/out data shift register address compare sda interrupt clock control start stop arbitration control scl bus_clock iic registers chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 579 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.3 memory map and register de?ition this section provides a detailed description of all memory and registers for the iic module. 15.3.1 register descriptions this section consists of register descriptions in address order. each description includes a standard register diagram with an associated ?ure number. details of register bit and ?ld function follow the register diagrams, in bit order. 15.3.1.1 iic address register (ibad) read and write anytime register name bit 7 654321 bit 0 0x0000 ibad r adr7 adr6 adr5 adr4 adr3 adr2 adr1 0 w 0x0001 ibfd r ibc7 ibc6 ibc5 ibc4 ibc3 ibc2 ibc1 ibc0 w 0x0002 ibcr r iben ibie ms/ sl tx/ rx txak 00 ibswai w rsta 0x0003 ibsr r tcf iaas ibb ibal 0srw ibif rxak w 0x0004 ibdr r d7 d6 d5 d4 d3 d2 d1 d0 w 0x0005 ibcr2 r gcen adtype 000 adr10 adr9 adr8 w = unimplemented or reserved figure 15-2. iic register summary module base +0x0000 76543210 r adr7 adr6 adr5 adr4 adr3 adr2 adr1 0 w reset 0 0 0 00000 = unimplemented or reserved figure 15-3. iic bus address register (ibad) chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 580 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 this register contains the address the iic bus will respond to when addressed as a slave; note that it is not the address sent on the bus during the address transfer. 15.3.1.2 iic frequency divider register (ibfd) read and write anytime table 15-2. ibad field descriptions field description 7:1 adr[7:1] slave address bit 1 to bit 7 contain the speci? slave address to be used by the iic bus module.the default mode of iic bus is slave mode for an address match on the bus. 0 reserved reserved ?bit 0 of the ibad is reserved for future compatibility. this bit will always read 0. module base + 0x0001 76543210 r ibc7 ibc6 ibc5 ibc4 ibc3 ibc2 ibc1 ibc0 w reset 0 0 0 00000 = unimplemented or reserved figure 15-4. iic bus frequency divider register (ibfd) table 15-3. ibfd field descriptions field description 7:0 ibc[7:0] i bus clock rate 7:0 ?this ?ld is used to prescale the clock for bit rate selection. the bit clock generator is implemented as a prescale divider ibc7:6, prescaled shift register ibc5:3 select the prescaler divider and ibc2-0 select the shift register tap point. the ibc bits are decoded to give the tap and prescale values as shown in table 15-4 . table 15-4. i-bus tap and prescale values ibc2-0 (bin) scl tap (clocks) sda tap (clocks) 000 5 1 001 6 1 010 7 2 011 8 2 100 9 3 101 10 3 110 12 4 111 15 4 chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 581 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the number of clocks from the falling edge of scl to the ?st tap (tap[1]) is de?ed by the values shown in the scl2tap column of table 15-4 , all subsequent tap points are separated by 2 ibc5-3 as shown in the tap2tap column in table 15-4 . the scl tap is used to generated the scl period and the sda tap is used to determine the delay from the falling edge of scl to sda changing, the sda hold time. ibc7? de?es the multiplier factor mul. the values of mul are shown in the table 15-6 . table 15-5. prescale divider encoding ibc5-3 (bin) scl2start (clocks) scl2stop (clocks) scl2tap (clocks) tap2tap (clocks) 0002741 0012742 0102964 0116968 100 14 17 14 16 101 30 33 30 32 110 62 65 62 64 111 126 129 126 128 table 15-6. multiplier factor ibc7-6 mul 00 01 01 02 10 04 11 reserved scl divider sda hold scl sda chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 582 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 15-5. scl divider and sda hold the equation used to generate the divider values from the ibfd bits is: scl divider = mul x {2 x (scl2tap + [(scl_tap -1) x tap2tap] + 2)} the sda hold delay is equal to the cpu clock period multiplied by the sda hold value shown in table 15-7 . the equation used to generate the sda hold value from the ibfd bits is: sda hold = mul x {scl2tap + [(sda_tap - 1) x tap2tap] + 3} the equation for scl hold values to generate the start and stop conditions from the ibfd bits is: scl hold(start) = mul x [scl2start + (scl_tap - 1) x tap2tap] scl hold(stop) = mul x [scl2stop + (scl_tap - 1) x tap2tap] note a master scl divider period can be prolonged at higher internal bus frequencies. this happens when the internal bus cycle length becomes equal to a pad delay. the scl input is used for clock arbitration of multiple masters. thus after each scl edge is internally driven an extra bus period is counted before the pad level is attained, allowing the next toggle. this has the effect of extending the scl divider values in table 15-7 for mul=1 and ibc[7:0] = 0x00 to 0x0f. table 15-7. iic divider and hold values (sheet 1 of 6) ibc[7:0] (hex) scl divider (clocks) sda hold (clocks) scl hold (start) scl hold (stop) mul=1 00 20 7 6 11 01 22 7 7 12 02 24 8 8 13 03 26 8 9 14 04 28 9 10 15 05 30 9 11 16 sda scl start condition stop condition scl hold(start) scl hold(stop) chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 583 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 06 34 10 13 18 07 40 10 16 21 08 28 7 10 15 09 32 7 12 17 0a 36 9 14 19 0b 40 9 16 21 0c 44 11 18 23 0d 48 11 20 25 0e 56 13 24 29 0f 68 13 30 35 10 48 9 18 25 11 56 9 22 29 12 64 13 26 33 13 72 13 30 37 14 80 17 34 41 15 88 17 38 45 16 104 21 46 53 17 128 21 58 65 18 80 9 38 41 19 96 9 46 49 1a 112 17 54 57 1b 128 17 62 65 1c 144 25 70 73 1d 160 25 78 81 1e 192 33 94 97 1f 240 33 118 121 20 160 17 78 81 21 192 17 94 97 22 224 33 110 113 23 256 33 126 129 24 288 49 142 145 25 320 49 158 161 26 384 65 190 193 27 480 65 238 241 28 320 33 158 161 29 384 33 190 193 2a 448 65 222 225 2b 512 65 254 257 2c 576 97 286 289 2d 640 97 318 321 2e 768 129 382 385 2f 960 129 478 481 table 15-7. iic divider and hold values (sheet 2 of 6) ibc[7:0] (hex) scl divider (clocks) sda hold (clocks) scl hold (start) scl hold (stop) chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 584 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 30 640 65 318 321 31 768 65 382 385 32 896 129 446 449 33 1024 129 510 513 34 1152 193 574 577 35 1280 193 638 641 36 1536 257 766 769 37 1920 257 958 961 38 1280 129 638 641 39 1536 129 766 769 3a 1792 257 894 897 3b 2048 257 1022 1025 3c 2304 385 1150 1153 3d 2560 385 1278 1281 3e 3072 513 1534 1537 3f 3840 513 1918 1921 mul=2 40 40 14 12 22 41 44 14 14 24 42 48 16 16 26 43 52 16 18 28 44 56 18 20 30 45 60 18 22 32 46 68 20 26 36 47 80 20 32 42 48 56 14 20 30 49 64 14 24 34 4a 72 18 28 38 4b 80 18 32 42 4c 88 22 36 46 4d 96 22 40 50 4e 112 26 48 58 4f 136 26 60 70 50 96 18 36 50 51 112 18 44 58 52 128 26 52 66 53 144 26 60 74 54 160 34 68 82 55 176 34 76 90 56 208 42 92 106 57 256 42 116 130 58 160 18 76 82 table 15-7. iic divider and hold values (sheet 3 of 6) ibc[7:0] (hex) scl divider (clocks) sda hold (clocks) scl hold (start) scl hold (stop) chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 585 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 59 192 18 92 98 5a 224 34 108 114 5b 256 34 124 130 5c 288 50 140 146 5d 320 50 156 162 5e 384 66 188 194 5f 480 66 236 242 60 320 34 156 162 61 384 34 188 194 62 448 66 220 226 63 512 66 252 258 64 576 98 284 290 65 640 98 316 322 66 768 130 380 386 67 960 130 476 482 68 640 66 316 322 69 768 66 380 386 6a 896 130 444 450 6b 1024 130 508 514 6c 1152 194 572 578 6d 1280 194 636 642 6e 1536 258 764 770 6f 1920 258 956 962 70 1280 130 636 642 71 1536 130 764 770 72 1792 258 892 898 73 2048 258 1020 1026 74 2304 386 1148 1154 75 2560 386 1276 1282 76 3072 514 1532 1538 77 3840 514 1916 1922 78 2560 258 1276 1282 79 3072 258 1532 1538 7a 3584 514 1788 1794 7b 4096 514 2044 2050 7c 4608 770 2300 2306 7d 5120 770 2556 2562 7e 6144 1026 3068 3074 7f 7680 1026 3836 3842 mul=4 80 72 28 24 44 81 80 28 28 48 table 15-7. iic divider and hold values (sheet 4 of 6) ibc[7:0] (hex) scl divider (clocks) sda hold (clocks) scl hold (start) scl hold (stop) chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 586 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 82 88 32 32 52 83 96 32 36 56 84 104 36 40 60 85 112 36 44 64 86 128 40 52 72 87 152 40 64 84 88 112 28 40 60 89 128 28 48 68 8a 144 36 56 76 8b 160 36 64 84 8c 176 44 72 92 8d 192 44 80 100 8e 224 52 96 116 8f 272 52 120 140 90 192 36 72 100 91 224 36 88 116 92 256 52 104 132 93 288 52 120 148 94 320 68 136 164 95 352 68 152 180 96 416 84 184 212 97 512 84 232 260 98 320 36 152 164 99 384 36 184 196 9a 448 68 216 228 9b 512 68 248 260 9c 576 100 280 292 9d 640 100 312 324 9e 768 132 376 388 9f 960 132 472 484 a0 640 68 312 324 a1 768 68 376 388 a2 896 132 440 452 a3 1024 132 504 516 a4 1152 196 568 580 a5 1280 196 632 644 a6 1536 260 760 772 a7 1920 260 952 964 a8 1280 132 632 644 a9 1536 132 760 772 aa 1792 260 888 900 ab 2048 260 1016 1028 table 15-7. iic divider and hold values (sheet 5 of 6) ibc[7:0] (hex) scl divider (clocks) sda hold (clocks) scl hold (start) scl hold (stop) chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 587 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.3.1.3 iic control register (ibcr) read and write anytime ac 2304 388 1144 1156 ad 2560 388 1272 1284 ae 3072 516 1528 1540 af 3840 516 1912 1924 b0 2560 260 1272 1284 b1 3072 260 1528 1540 b2 3584 516 1784 1796 b3 4096 516 2040 2052 b4 4608 772 2296 2308 b5 5120 772 2552 2564 b6 6144 1028 3064 3076 b7 7680 1028 3832 3844 b8 5120 516 2552 2564 b9 6144 516 3064 3076 ba 7168 1028 3576 3588 bb 8192 1028 4088 4100 bc 9216 1540 4600 4612 bd 10240 1540 5112 5124 be 12288 2052 6136 6148 bf 15360 2052 7672 7684 module base + 0x0002 76543210 r iben ibie ms/sl tx/rx txak 00 ibswai w rsta reset 0 0 0 00000 = unimplemented or reserved figure 15-6. iic bus control register (ibcr) table 15-7. iic divider and hold values (sheet 6 of 6) ibc[7:0] (hex) scl divider (clocks) sda hold (clocks) scl hold (start) scl hold (stop) chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 588 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 wait mode is entered via execution of a cpu wai instruction. in the event that the ibswai bit is set, all clocks internal to the iic will be stopped and any transmission currently in progress will halt.if the cpu were woken up by a source other than the iic module, then clocks would restart and the iic would resume from where was during the previous transmission. it is not possible for the iic to wake up the cpu when its internal clocks are stopped. table 15-8. ibcr field descriptions field description 7 iben i-bus enable ?this bit controls the software reset of the entire iic bus module. 0 the module is reset and disabled. this is the power-on reset situation. when low the interface is held in reset but registers can be accessed 1 the iic bus module is enabled.this bit must be set before any other ibcr bits have any effect if the iic bus module is enabled in the middle of a byte transfer the interface behaves as follows: slave mode ignores the current transfer on the bus and starts operating whenever a subsequent start condition is detected. master mode will not be aware that the bus is busy, hence if a start cycle is initiated then the current bus cycle may become corrupt. this would ultimately result in either the current bus master or the iic bus module losing arbitration, after which bus operation would return to normal. 6 ibie i-bus interrupt enable 0 interrupts from the iic bus module are disabled. note that this does not clear any currently pending interrupt condition 1 interrupts from the iic bus module are enabled. an iic bus interrupt occurs provided the ibif bit in the status register is also set. 5 ms/sl master/slave mode select bit upon reset, this bit is cleared. when this bit is changed from 0 to 1, a start signal is generated on the bus, and the master mode is selected. when this bit is changed from 1 to 0, a stop signal is generated and the operation mode changes from master to slave.a stop signal should only be generated if the ibif ?g is set. ms/ sl is cleared without generating a stop signal when the master loses arbitration. 0 slave mode 1 master mode 4 tx/rx transmit/receive mode select bit ?this bit selects the direction of master and slave transfers. when addressed as a slave this bit should be set by software according to the srw bit in the status register. in master mode this bit should be set according to the type of transfer required. therefore, for address cycles, this bit will always be high. 0 receive 1 transmit 3 txak transmit acknowledge enable this bit speci?s the value driven onto sda during data acknowledge cycles for both master and slave receivers. the iic module will always acknowledge address matches, provided it is enabled, regardless of the value of txak. note that values written to this bit are only used when the iic bus is a receiver, not a transmitter. 0 an acknowledge signal will be sent out to the bus at the 9th clock bit after receiving one byte data 1 no acknowledge signal response is sent (i.e., acknowledge bit = 1) 2 rsta repeat start ?writing a 1 to this bit will generate a repeated start condition on the bus, provided it is the current bus master. this bit will always be read as a low. attempting a repeated start at the wrong time, if the bus is owned by another master, will result in loss of arbitration. 1 generate repeat start cycle 1 reserved reserved ?bit 1 of the ibcr is reserved for future compatibility. this bit will always read 0. 0 ibswai i bus interface stop in wait mode 0 iic bus module clock operates normally 1 halt iic bus module clock generation in wait mode chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 589 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 if it were the case that the ibswai bit was cleared when the wai instruction was executed, the iic internal clocks and interface would remain alive, continuing the operation which was currently underway. it is also possible to con?ure the iic such that it will wake up the cpu via an interrupt at the conclusion of the current operation. see the discussion on the ibif and ibie bits in the ibsr and ibcr, respectively. 15.3.1.4 iic status register (ibsr) this status register is read-only with exception of bit 1 (ibif) and bit 4 (ibal), which are software clearable. module base + 0x0003 76543210 r tcf iaas ibb ibal 0srw ibif rxak w reset 1 0 0 00000 = unimplemented or reserved figure 15-7. iic bus status register (ibsr) table 15-9. ibsr field descriptions field description 7 tcf data transferring bit ?while one byte of data is being transferred, this bit is cleared. it is set by the falling edge of the 9th clock of a byte transfer. note that this bit is only valid during or immediately following a transfer to the iic module or from the iic module. 0 transfer in progress 1 transfer complete 6 iaas addressed as a slave bit when its own speci? address (i-bus address register) is matched with the calling address or it receives the general call address with gcen== 1,this bit is set.the cpu is interrupted provided the ibie is set.then the cpu needs to check the srw bit and set its tx/ rx mode accordingly.writing to the i-bus control register clears this bit. 0 not addressed 1 addressed as a slave 5 ibb bus busy bit 0 this bit indicates the status of the bus. when a start signal is detected, the ibb is set. if a stop signal is detected, ibb is cleared and the bus enters idle state. 1 bus is busy 4 ibal arbitration lost ?the arbitration lost bit (ibal) is set by hardware when the arbitration procedure is lost. arbitration is lost in the following circumstances: 1. sda sampled low when the master drives a high during an address or data transmit cycle. 2. sda sampled low when the master drives a high during the acknowledge bit of a data receive cycle. 3. a start cycle is attempted when the bus is busy. 4. a repeated start cycle is requested in slave mode. 5. a stop condition is detected when the master did not request it. this bit must be cleared by software, by writing a one to it. a write of 0 has no effect on this bit. 3 reserved reserved ?bit 3 of ibsr is reserved for future use. a read operation on this bit will return 0. chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 590 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.3.1.5 iic data i/o register (ibdr) in master transmit mode, when data is written to the ibdr a data transfer is initiated. the most signi?ant bit is sent ?st. in master receive mode, reading this register initiates next byte data receiving. in slave mode, the same functions are available after an address match has occurred.note that the tx/rx bit in the ibcr must correctly re?ct the desired direction of transfer in master and slave modes for the transmission to begin. for instance, if the iic is con?ured for master transmit but a master receive is desired, then reading the ibdr will not initiate the receive. reading the ibdr will return the last byte received while the iic is con?ured in either master receive or slave receive modes. the ibdr does not re?ct every byte that is transmitted on the iic bus, nor can software verify that a byte has been written to the ibdr correctly by reading it back. in master transmit mode, the ?st byte of data written to ibdr following assertion of ms/ sl is used for the address transfer and should com.prise of the calling address (in position d7:d1) concatenated with the required r/ w bit (in position d0). 2 srw slave read/write when iaas is set this bit indicates the value of the r/w command bit of the calling address sent from the master this bit is only valid when the i-bus is in slave mode, a complete address transfer has occurred with an address match and no other transfers have been initiated. checking this bit, the cpu can select slave transmit/receive mode according to the command of the master. 0 slave receive, master writing to slave 1 slave transmit, master reading from slave 1 ibif i-bus interrupt ?the ibif bit is set when one of the following conditions occurs: ?arbitration lost (ibal bit set) ?data transfer complete (tcf bit set) ?addressed as slave (iaas bit set) it will cause a processor interrupt request if the ibie bit is set. this bit must be cleared by software, writing a one to it. a write of 0 has no effect on this bit. 0 rxak received acknowledge ?the value of sda during the acknowledge bit of a bus cycle. if the received acknowledge bit (rxak) is low, it indicates an acknowledge signal has been received after the completion of 8 bits data transmission on the bus. if rxak is high, it means no acknowledge signal is detected at the 9th clock. 0 acknowledge received 1 no acknowledge received module base + 0x0004 76543210 r d7 d6 d5 d4 d3 d2 d1 d0 w reset 0 0 0 00000 figure 15-8. iic bus data i/o register (ibdr) table 15-9. ibsr field descriptions (continued) field description chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 591 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.3.1.6 iic control register 2(ibcr2) this register contains the variables used in general call and in ten-bit address. read and write anytime 15.4 functional description this section provides a complete functional description of the iicv3. 15.4.1 i-bus protocol the iic bus system uses a serial data line (sda) and a serial clock line (scl) for data transfer. all devices connected to it must have open drain or open collector outputs. logic and function is exercised on both lines with external pull-up resistors. the value of these resistors is system dependent. normally, a standard communication is composed of four parts: start signal, slave address transmission, data transfer and stop signal. they are described brie? in the following sections and illustrated in figure 15-10 . module base + 0x0005 76543210 r gcen adtype 000 adr10 adr9 adr8 w reset 0 0 0 00000 figure 15-9. iic bus control register 2(ibcr2) table 15-10. ibcr2 field descriptions field description 7 gcen general call enable . 0 general call is disabled. the module dont receive any general call data and address. 1 enable general call. it indicates that the module can receive address and any data. 6 adtype address type this bit selects the address length. the variable must be con?ured correctly before iic enters slave mode. 0 7-bit address 1 10-bit address 5,4,3 reserved reserved ?bit 5,4 and 3 of the ibcr2 are reserved for future compatibility. these bits will always read 0. 2:0 adr[10:8] slave address [10:8] ?hese 3 bits represent the msb of the 10-bit address when address type is asserted (adtype = 1). chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 592 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 15-10. iic-bus transmission signals 15.4.1.1 start signal when the bus is free, i.e. no master device is engaging the bus (both scl and sda lines are at logical high), a master may initiate communication by sending a start signal.as shown in figure 15-10 , a start signal is de?ed as a high-to-low transition of sda while scl is high. this signal denotes the beginning of a new data transfer (each data transfer may contain several bytes of data) and brings all slaves out of their idle states. figure 15-11. start and stop conditions c l d a start signal ack bit 12345678 msb lsb 1 2 34 5 6 78 msb lsb no c l d a 1234567 8 msb lsb 12 5 678 msb lsb repeated 34 99 adr7 adr6 adr5 adr4adr3 adr2 adr1r/w xxx d7 d6 d5 d4 d3 d2 d1 d0 calling address read/ data byte adr7 adr6 adr5 adr4 adr3 adr2 adr1r/w adr7 adr6 adr5 adr4 adr3 adr2 adr1r/w new calling address 99 xx ack bit write start signal start signal ack bit calling address read/ write no ack bit read/ write sda scl start condition stop condition chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 593 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.4.1.2 slave address transmission the ?st byte of data transfer immediately after the start signal is the slave address transmitted by the master. this is a seven-bit calling address followed by a r/w bit. the r/w bit tells the slave the desired direction of data transfer. 1 = read transfer, the slave transmits data to the master. 0 = write transfer, the master transmits data to the slave. if the calling address is 10-bit, another byte is followed by the ?st byte.only the slave with a calling address that matches the one transmitted by the master will respond by sending back an acknowledge bit. this is done by pulling the sda low at the 9th clock (see figure 15-10 ). no two slaves in the system may have the same address. if the iic bus is master, it must not transmit an address that is equal to its own slave address. the iic bus cannot be master and slave at the same time.however, if arbitration is lost during an address cycle the iic bus will revert to slave mode and operate correctly even if it is being addressed by another master. 15.4.1.3 data transfer as soon as successful slave addressing is achieved, the data transfer can proceed byte-by-byte in a direction speci?d by the r/w bit sent by the calling master all transfers that come after an address cycle are referred to as data transfers, even if they carry sub-address information for the slave device. each data byte is 8 bits long. data may be changed only while scl is low and must be held stable while scl is high as shown in figure 15-10 . there is one clock pulse on scl for each data bit, the msb being transferred ?st. each data byte has to be followed by an acknowledge bit, which is signalled from the receiving device by pulling the sda low at the ninth clock. so one complete data byte transfer needs nine clock pulses. if the slave receiver does not acknowledge the master, the sda line must be left high by the slave. the master can then generate a stop signal to abort the data transfer or a start signal (repeated start) to commence a new calling. if the master receiver does not acknowledge the slave transmitter after a byte transmission, it means 'end of data' to the slave, so the slave releases the sda line for the master to generate stop or start signal.note in order to release the bus correctly,after no-acknowledge to the master,the slave must be immediately switched to receiver and a following dummy reading of the ibdr is necessary. 15.4.1.4 stop signal the master can terminate the communication by generating a stop signal to free the bus. however, the master may generate a start signal followed by a calling command without generating a stop signal ?st. this is called repeated start. a stop signal is de?ed as a low-to-high transition of sda while scl at logical 1 (see figure 15-10 ). the master can generate a stop even if the slave has generated an acknowledge at which point the slave must release the bus. chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 594 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.4.1.5 repeated start signal as shown in figure 15-10 , a repeated start signal is a start signal generated without ?st generating a stop signal to terminate the communication. this is used by the master to communicate with another slave or with the same slave in different mode (transmit/receive mode) without releasing the bus. 15.4.1.6 arbitration procedure the inter-ic bus is a true multi-master bus that allows more than one master to be connected on it. if two or more masters try to control the bus at the same time, a clock synchronization procedure determines the bus clock, for which the low period is equal to the longest clock low period and the high is equal to the shortest one among the masters. the relative priority of the contending masters is determined by a data arbitration procedure, a bus master loses arbitration if it transmits logic 1 while another master transmits logic 0. the losing masters immediately switch over to slave receive mode and stop driving sda output. in this case the transition from master to slave mode does not generate a stop condition. meanwhile, a status bit is set by hardware to indicate loss of arbitration. 15.4.1.7 clock synchronization because wire-and logic is performed on scl line, a high-to-low transition on scl line affects all the devices connected on the bus. the devices start counting their low period and as soon as a device's clock has gone low, it holds the scl line low until the clock high state is reached.however, the change of low to high in this device clock may not change the state of the scl line if another device clock is within its low period. therefore, synchronized clock scl is held low by the device with the longest low period. devices with shorter low periods enter a high wait state during this time (see figure 15-11 ). when all devices concerned have counted off their low period, the synchronized clock scl line is released and pulled high. there is then no difference between the device clocks and the state of the scl line and all the devices start counting their high periods.the ?st device to complete its high period pulls the scl line low again. figure 15-12. iic-bus clock synchronization scl1 scl2 scl internal counter reset wait start counting high period chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 595 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.4.1.8 handshaking the clock synchronization mechanism can be used as a handshake in data transfer. slave devices may hold the scl low after completion of one byte transfer (9 bits). in such case, it halts the bus clock and forces the master clock into wait states until the slave releases the scl line. 15.4.1.9 clock stretching the clock synchronization mechanism can be used by slaves to slow down the bit rate of a transfer. after the master has driven scl low the slave can drive scl low for the required period and then release it.if the slave scl low period is greater than the master scl low period then the resulting scl bus signal low period is stretched. 15.4.1.10 ten-bit address a ten-bit address is indicated if the ?st 5 bits of the ?st address byte are 0x11110. the following rules apply to the ?st address byte. the address type is identi?d by adtype. when adtype is 0, 7-bit address is applied. reversely, the address is 10-bit address.generally, there are two cases of 10-bit address.see the fig.1-14 and 1-15. in the ?ure 1-15,the ?st two bytes are the similar to ?ure1-14.after the repeated start(sr),the ?st slave address is transmitted again, but the r/w is 1, meaning that the slave is acted as a transmitter. 15.4.1.11 general call address to broadcast using a general call, a device must ?st generate the general call address($00), then after receiving acknowledge, it must transmit data. in communication, as a slave device, provided the gcen is asserted, a device acknowledges the broadcast and receives data until the gcen is disabled or the master device releases the bus or generates a new table 15-11. de?ition of bits in the first byte slave address r/w bit description 0000000 0 general call address 0000010 x reserved for different bus format 0000011 x reserved for future purposes 11111xx x reserved for future purposes 11110xx x 10-bit slave addressing s slave add1st 7bits 11110+adr10+adr9 r/w 0 a1 slave add 2nd byte adr[8:1] a2 data a3 figure 15-13. a master-transmitter addresses a slave-receiver with a 10-bit address s slave add1st 7bits 11110+adr10+adr9 r/w 0 a1 slave add 2nd byte adr[8:1] a2 sr slave add 1st 7bits 11110+adr10+adr9 r/w 1 a3 data a4 figure 15-14. a master-receiver addresses a slave-transmitter with a 10-bit address chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 596 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 transfer. in the broadcast, slaves always act as receivers. in general call, iaas is also used to indicate the address match. in order to distinguish whether the address match is the normal address match or the general call address match, ibdr should be read after the address byte has been received. if the data is $00, the match is general call address match. the meaning of the general call address is always speci?d in the ?st data byte and must be dealt with by s/w, the iic hardware does not decode and process the ?st data byte. when one byte transfer is done, the received data can be read from ibdr. the user can control the procedure by enabling or disabling gcen. 15.4.2 operation in run mode this is the basic mode of operation. 15.4.3 operation in wait mode iic operation in wait mode can be con?ured. depending on the state of internal bits, the iic can operate normally when the cpu is in wait mode or the iic clock generation can be turned off and the iic module enters a power conservation state during wait mode. in the later case, any transmission or reception in progress stops at wait mode entry. 15.4.4 operation in stop mode the iic is inactive in stop mode for reduced power consumption. the stop instruction does not affect iic register states. 15.5 resets the reset state of each individual bit is listed in section 15.3, ?emory map and register de?ition , which details the registers and their bit-?lds. 15.6 interrupts iicv3 uses only one interrupt vector. internally there are three types of interrupts in iic. the interrupt service routine can determine the interrupt type by reading the status register. iic interrupt can be generated on 1. arbitration lost condition (ibal bit set) table 15-12. interrupt summary interrupt offset vector priority source description iic interrupt ibal, tcf, iaas bits in ibsr register when either of ibal, tcf or iaas bits is set may cause an interrupt based on arbitration lost, transfer complete or address detect conditions chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 597 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 2. byte transfer condition (tcf bit set) 3. address detect condition (iaas bit set) the iic interrupt is enabled by the ibie bit in the iic control register. it must be cleared by writing 0 to the ibf bit in the interrupt service routine. 15.7 application information 15.7.1 iic programming examples 15.7.1.1 initialization sequence reset will put the iic bus control register to its default status. before the interface can be used to transfer serial data, an initialization procedure must be carried out, as follows: 1. update the frequency divider register (ibfd) and select the required division ratio to obtain scl frequency from system clock. 2. update the adtype of ibcr2 to de?e the address length, 7 bits or 10 bits. 3. update the iic bus address register (ibad) to de?e its slave address. if 10-bit address is applied ibcr2 should be updated to de?e the rest bits of address. 4. set the iben bit of the iic bus control register (ibcr) to enable the iic interface system. 5. modify the bits of the iic bus control register (ibcr) to select master/slave mode, transmit/receive mode and interrupt enable or not. 6. if supported general call, the gcen in ibcr2 should be asserted. 15.7.1.2 generation of start after completion of the initialization procedure, serial data can be transmitted by selecting the 'master transmitter' mode. if the device is connected to a multi-master bus system, the state of the iic bus busy bit (ibb) must be tested to check whether the serial bus is free. if the bus is free (ibb=0), the start condition and the ?st byte (the slave address) can be sent. the data written to the data register comprises the slave calling address and the lsb set to indicate the direction of transfer required from the slave. the bus free time (i.e., the time between a stop condition and the following start condition) is built into the hardware that generates the start cycle. depending on the relative frequencies of the system clock and the scl period it may be necessary to wait until the iic is busy after writing the calling address to the ibdr before proceeding with the following instructions. this is illustrated in the following example. an example of a program which generates the start signal and transmits the ?st byte of data (slave address) is shown below: chflag brset ibsr,#$20,* ;wait for ibb flag to clear txstart bset ibcr,#$30 ;set transmit and master mode;i.e. generate start condition ibfree brclr ibsr,#$20,* ;wait for ibb flag to set chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 598 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 15.7.1.3 post-transfer software response transmission or reception of a byte will set the data transferring bit (tcf) to 1, which indicates one byte communication is ?ished. the iic bus interrupt bit (ibif) is set also; an interrupt will be generated if the interrupt function is enabled during initialization by setting the ibie bit. software must clear the ibif bit in the interrupt routine ?st. the tcf bit will be cleared by reading from the iic bus data i/o register (ibdr) in receive mode or writing to ibdr in transmit mode. software may service the iic i/o in the main program by monitoring the ibif bit if the interrupt function is disabled. note that polling should monitor the ibif bit rather than the tcf bit because their operation is different when arbitration is lost. note that when an interrupt occurs at the end of the address cycle the master will always be in transmit mode, i.e. the address is transmitted. if master receive mode is required, indicated by r/w bit in ibdr, then the tx/rx bit should be toggled at this stage. during slave mode address cycles (iaas=1), the srw bit in the status register is read to determine the direction of the subsequent transfer and the tx/rx bit is programmed accordingly.for slave mode data cycles (iaas=0) the srw bit is not valid, the tx/rx bit in the control register should be read to determine the direction of the current transfer. the following is an example of a software response by a 'master transmitter' in the interrupt routine. 15.7.1.4 generation of stop a data transfer ends with a stop signal generated by the 'master' device. a master transmitter can simply generate a stop signal after all the data has been transmitted. the following is an example showing how a stop condition is generated by a master transmitter. if a master receiver wants to terminate a data transfer, it must inform the slave transmitter by not acknowledging the last byte of data which can be done by setting the transmit acknowledge bit (txak) movb calling,ibdr ;transmit the calling address, d0=r/w isr bclr ibsr,#$02 ;clear the ibif flag brclr ibcr,#$20,slave ;branch if in slave mode brclr ibcr,#$10,receive ;branch if in receive mode brset ibsr,#$01,end ;if no ack, end of transmission transmit movb databuf,ibdr ;transmit next byte of data mastx tst txcnt ;get value from the transmiting counter beq end ;end if no more data brset ibsr,#$01,end ;end if no ack movb databuf,ibdr ;transmit next byte of data dec txcnt ;decrease the txcnt bra emastx ;exit end bclr ibcr,#$20 ;generate a stop condition emastx rti ;return from interrupt ibfree brclr ibsr,#$20,* ;wait for ibb flag to set chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 599 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 before reading the 2nd last byte of data. before reading the last byte of data, a stop signal must be generated ?st. the following is an example showing how a stop signal is generated by a master receiver. 15.7.1.5 generation of repeated start at the end of data transfer, if the master continues to want to communicate on the bus, it can generate another start signal followed by another slave address without ?st generating a stop signal. a program example is as shown. 15.7.1.6 slave mode in the slave interrupt service routine, the module addressed as slave bit (iaas) should be tested to check if a calling of its own address has just been received. if iaas is set, software should set the transmit/receive mode select bit (tx/rx bit of ibcr) according to the r/w command bit (srw). writing to the ibcr clears the iaas automatically. note that the only time iaas is read as set is from the interrupt at the end of the address cycle where an address match occurred, interrupts resulting from subsequent data transfers will have iaas cleared. a data transfer may now be initiated by writing information to ibdr, for slave transmits, or dummy reading from ibdr, in slave receive mode. the slave will drive scl low in-between byte transfers, scl is released when the ibdr is accessed in the required mode. in slave transmitter routine, the received acknowledge bit (rxak) must be tested before transmitting the next byte of data. setting rxak means an 'end of data' signal from the master receiver, after which it must be switched from transmitter mode to receiver mode by software. a dummy read then releases the scl line so that the master can generate a stop signal. 15.7.1.7 arbitration lost if several masters try to engage the bus simultaneously, only one master wins and the others lose arbitration. the devices which lost arbitration are immediately switched to slave receive mode by the hardware. their data output to the sda line is stopped, but scl continues to be generated until the end of the byte during which arbitration was lost. an interrupt occurs at the falling edge of the ninth clock of this transfer with ibal=1 and ms/sl=0. if one master attempts to start transmission while the bus is being engaged by another master, the hardware will inhibit the transmission; switch the ms/sl bit from 1 to 0 without generating stop condition; generate an interrupt to cpu and set the ibal to indicate that the masr dec rxcnt ;decrease the rxcnt beq enmasr ;last byte to be read movb rxcnt,d1 ;check second last byte dec d1 ;to be read bne nxmar ;not last or second last lamar bset ibcr,#$08 ;second last, disable ack ;transmitting bra nxmar enmasr bclr ibcr,#$20 ;last one, generate ?top?signal nxmar movb ibdr,rxbuf ;read data and store rti restart bset ibcr,#$04 ;another start (restart) movb calling,ibdr ;transmit the calling address;d0=r/w chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 600 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 attempt to engage the bus is failed. when considering these cases, the slave service routine should test the ibal ?st and the software should clear the ibal bit if it is set. figure 15-15. flow-chart of typical iic interrupt routine clear master mode ? tx/rx ? last byte transmitted ? rxak=0 ? end of addr cycle (master rx) ? write next byte to ibdr switch to rx mode dummy read from ibdr generate stop signal read data from ibdr and store set txak =1 generate stop signal 2nd last byte to be read ? last byte to be read ? arbitration lost ? clear ibal iaas=1 ? iaas=1 ? srw=1 ? tx/rx ? set tx mode write data to ibdr set rx mode dummy read from ibdr ack from receiver ? tx next byte read data from ibdr and store switch to rx mode dummy read from ibdr rti yn y y y y y y y n n n n n n n n y tx rx rx tx (write) (read) n ibif data transfer y y 10-bit address? n n 7-bit address transfer y 10-bit address transfer mode set rx dummy read from ibdr n set tx mode write data to ibdr y ibdr== 11110xx1? chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 601 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 caution when iic is con?ured as 10-bit address,the point of the data array in interrupt routine must be reset after it s addressed. chapter 15 inter-integrated circuit (iicv3) block description mc9s12xe-family reference manual , rev. 1.21 602 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 603 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 16 freescale s scalable controller area network (s12mscanv3) 16.1 introduction freescale s scalable controller area network (s12mscanv3) de?ition is based on the mscan12 de?ition, which is the speci? implementation of the mscan concept targeted for the m68hc12 microcontroller family. the module is a communication controller implementing the can 2.0a/b protocol as de?ed in the bosch speci?ation dated september 1991. for users to fully understand the mscan speci?ation, it is recommended that the bosch speci?ation be read ?st to familiarize the reader with the terms and concepts contained within this document. though not exclusively intended for automotive applications, can protocol is designed to meet the speci? requirements of a vehicle serial data bus: real-time processing, reliable operation in the emi environment of a vehicle, cost-effectiveness, and required bandwidth. mscan uses an advanced buffer arrangement resulting in predictable real-time behavior and simpli?d application software. table 16-1. revision history revision number revision date sections affected description of changes v03.09 04 may 2007 16.3.2.11/16- 621 - corrected mnemonics of code example in cantbsel register description v03.10 19 aug 2008 16.4.7.4/16-655 16.4.4.5/16-649 16.2/16-606 - corrected wake-up description - relocated initialization section - added note to external pin descriptions for use with integrated physical layer - minor corrections v03.11 31 mar 2009 - orthographic corrections chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 604 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.1.1 glossary 16.1.2 block diagram figure 16-1. mscan block diagram table 16-2. terminology ack acknowledge of can message can controller area network crc cyclic redundancy code eof end of frame fifo first-in-first-out memory ifs inter-frame sequence sof start of frame cpu bus cpu related read/write data bus can bus can protocol related serial bus oscillator clock direct clock from external oscillator bus clock cpu bus related clock can clock can protocol related clock rxcan txcan receive/ transmit engine message filtering and buffering control and status wake-up interrupt req. errors interrupt req. receive interrupt req. transmit interrupt req. canclk bus clock con?uration oscillator clock mux presc. tq clk mscan low pass filter wake-up registers chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 605 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.1.3 features the basic features of the mscan are as follows: implementation of the can protocol ?version 2.0a/b standard and extended data frames zero to eight bytes data length programmable bit rate up to 1 mbps 1 support for remote frames five receive buffers with fifo storage scheme three transmit buffers with internal prioritization using a ?ocal priority?concept flexible maskable identi?r ?ter supports two full-size (32-bit) extended identi?r ?ters, or four 16-bit ?ters, or eight 8-bit ?ters programmable wake-up functionality with integrated low-pass ?ter programmable loopback mode supports self-test operation programmable listen-only mode for monitoring of can bus programmable bus-off recovery functionality separate signalling and interrupt capabilities for all can receiver and transmitter error states (warning, error passive, bus-off) programmable mscan clock source either bus clock or oscillator clock internal timer for time-stamping of received and transmitted messages three low-power modes: sleep, power down, and mscan enable global initialization of con?uration registers 16.1.4 modes of operation for a description of the speci? mscan modes and the module operation related to the system operating modes refer to section 16.4.4, ?odes of operation ? 1. depending on the actual bit timing and the clock jitter of the pll. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 606 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.2 external signal description the mscan uses two external pins. note on mcus with an integrated can physical interface (transceiver) the mscan interface is connected internally to the transceiver interface. in these cases the external availability of signals txcan and rxcan is optional. 16.2.1 rxcan ?can receiver input pin rxcan is the mscan receiver input pin. 16.2.2 txcan ?can transmitter output pin txcan is the mscan transmitter output pin. the txcan output pin represents the logic level on the can bus: 0 = dominant state 1 = recessive state 16.2.3 can system a typical can system with mscan is shown in figure 16-2 . each can station is connected physically to the can bus lines through a transceiver device. the transceiver is capable of driving the large current needed for the can bus and has current protection against defective can or defective stations. figure 16-2. can system can bus can controller (mscan) transceiver can node 1 can node 2 can node n canl canh mcu txcan rxcan chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 607 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3 memory map and register de?ition this section provides a detailed description of all registers accessible in the mscan. 16.3.1 module memory map figure 16-3 gives an overview on all registers and their individual bits in the mscan memory map. the register address results from the addition of base address and address offset . the base address is determined at the mcu level and can be found in the mcu memory map description. the address offset is de?ed at the module level. the mscan occupies 64 bytes in the memory space. the base address of the mscan module is determined at the mcu level when the mcu is de?ed. the register decode map is ?ed and begins at the ?st address of the module address offset. the detailed register descriptions follow in the order they appear in the register map. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 608 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 register name bit 7 6 5 4 3 2 1 bit 0 0x0000 canctl0 r rxfrm rxact cswai synch time wupe slprq initrq w 0x0001 canctl1 r cane clksrc loopb listen borm wupm slpak initak w 0x0002 canbtr0 r sjw1 sjw0 brp5 brp4 brp3 brp2 brp1 brp0 w 0x0003 canbtr1 r samp tseg22 tseg21 tseg20 tseg13 tseg12 tseg11 tseg10 w 0x0004 canrflg r wupif cscif rstat1 rstat0 tstat1 tstat0 ovrif rxf w 0x0005 canrier r wupie cscie rstate1 rstate0 tstate1 tstate0 ovrie rxfie w 0x0006 cantflg r0 0 0 00 txe2 txe1 txe0 w 0x0007 cantier r00000 txeie2 txeie1 txeie0 w 0x0008 cantarq r00000 abtrq2 abtrq1 abtrq0 w 0x0009 cantaak r00000 abtak2 abtak1 abtak0 w 0x000a cantbsel r00000 tx2 tx1 tx0 w 0x000b canidac r0 0 idam1 idam0 0 idhit2 idhit1 idhit0 w 0x000c reserved r00000000 w 0x000d canmisc r0000000 bohold w 0x000e canrxerr r rxerr7 rxerr6 rxerr5 rxerr4 rxerr3 rxerr2 rxerr1 rxerr0 w = unimplemented or reserved figure 16-3. mscan register summary chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 609 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2 register descriptions this section describes in detail all the registers and register bits in the mscan module. each description includes a standard register diagram with an associated ?ure number. details of register bit and ?ld function follow the register diagrams, in bit order. all bits of all registers in this module are completely synchronous to internal clocks during a register read. 16.3.2.1 mscan control register 0 (canctl0) the canctl0 register provides various control bits of the mscan module as described below. 0x000f cantxerr r txerr7 txerr6 txerr5 txerr4 txerr3 txerr2 txerr1 txerr0 w 0x0010?x0013 canidar0? r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0014?x0017 canidmrx r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0018?x001b canidar4? r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x001c?x001f canidmr4? r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0020?x002f canrxfg r see section 16.3.3, ?rogrammer s model of message storage w 0x0030?x003f cantxfg r see section 16.3.3, ?rogrammer s model of message storage w module base + 0x0000 access: user read/write (1) 76543210 r rxfrm rxact cswai synch time wupe slprq initrq w reset: 00000001 = unimplemented figure 16-4. mscan control register 0 (canctl0) register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 16-3. mscan register summary (continued) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 610 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note the canctl0 register, except wupe, initrq, and slprq, is held in the reset state when the initialization mode is active (initrq = 1 and initak = 1). this register is writable again as soon as the initialization mode is exited (initrq = 0 and initak = 0). 1. read: anytime write: anytime when out of initialization mode; exceptions are read-only rxact and synch, rxfrm (which is set by the module only), and initrq (which is also writable in initialization mode) table 16-3. canctl0 register field descriptions field description 7 rxfrm (1) received frame flag this bit is read and clear only. it is set when a receiver has received a valid message correctly, independently of the ?ter con?uration. after it is set, it remains set until cleared by software or reset. clearing is done by writing a 1. writing a 0 is ignored. this bit is not valid in loopback mode. 0 no valid message was received since last clearing this ?g 1 a valid message was received since last clearing of this ?g 6 rxact receiver active status ?this read-only ?g indicates the mscan is receiving a message. the ?g is controlled by the receiver front end. this bit is not valid in loopback mode. 0 mscan is transmitting or idle 2 1 mscan is receiving a message (including when arbitration is lost) (2) 5 cswai (3) can stops in wait mode enabling this bit allows for lower power consumption in wait mode by disabling all the clocks at the cpu bus interface to the mscan module. 0 the module is not affected during wait mode 1 the module ceases to be clocked during wait mode 4 synch synchronized status this read-only ?g indicates whether the mscan is synchronized to the can bus and able to participate in the communication process. it is set and cleared by the mscan. 0 mscan is not synchronized to the can bus 1 mscan is synchronized to the can bus 3 time timer enable this bit activates an internal 16-bit wide free running timer which is clocked by the bit clock rate. if the timer is enabled, a 16-bit time stamp will be assigned to each transmitted/received message within the active tx/rx buffer. right after the eof of a valid message on the can bus, the time stamp is written to the highest bytes (0x000e, 0x000f) in the appropriate buffer (see section 16.3.3, ?rogrammer s model of message storage ?. the internal timer is reset (all bits set to 0) when disabled. this bit is held low in initialization mode. 0 disable internal mscan timer 1 enable internal mscan timer 2 wupe (4) wake-up enable ?this con?uration bit allows the mscan to restart from sleep mode or from power down mode (entered from sleep) when traf? on can is detected (see section 16.4.5.5, ?scan sleep mode ?. this bit must be con?ured before sleep mode entry for the selected function to take effect. 0 wake-up disabled ?the mscan ignores traf? on can 1 wake-up enabled ?the mscan is able to restart chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 611 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.2 mscan control register 1 (canctl1) the canctl1 register provides various control bits and handshake status information of the mscan module as described below. 1 slprq (5) sleep mode request ?this bit requests the mscan to enter sleep mode, which is an internal power saving mode (see section 16.4.5.5, ?scan sleep mode ?. the sleep mode request is serviced when the can bus is idle, i.e., the module is not receiving a message and all transmit buffers are empty. the module indicates entry to sleep mode by setting slpak = 1 (see section 16.3.2.2, ?scan control register 1 (canctl1) ?. slprq cannot be set while the wupif ?g is set (see section 16.3.2.5, ?scan receiver flag register (canrflg) ?. sleep mode will be active until slprq is cleared by the cpu or, depending on the setting of wupe, the mscan detects activity on the can bus and clears slprq itself. 0 running ?the mscan functions normally 1 sleep mode request ?the mscan enters sleep mode when can bus idle 0 initrq (6),(7) initialization mode request ?when this bit is set by the cpu, the mscan skips to initialization mode (see section 16.4.4.5, ?scan initialization mode ?. any ongoing transmission or reception is aborted and synchronization to the can bus is lost. the module indicates entry to initialization mode by setting initak = 1 ( section 16.3.2.2, ?scan control register 1 (canctl1) ?. the following registers enter their hard reset state and restore their default values: canctl0 (8) , canrflg (9) , canrier (10) , cantflg, cantier, cantarq, cantaak, and cantbsel. the registers canctl1, canbtr0, canbtr1, canidac, canidar0-7, and canidmr0-7 can only be written by the cpu when the mscan is in initialization mode (initrq = 1 and initak = 1). the values of the error counters are not affected by initialization mode. when this bit is cleared by the cpu, the mscan restarts and then tries to synchronize to the can bus. if the mscan is not in bus-off state, it synchronizes after 11 consecutive recessive bits on the can bus; if the mscan is in bus-off state, it continues to wait for 128 occurrences of 11 consecutive recessive bits. writing to other bits in canctl0, canrflg, canrier, cantflg, or cantier must be done only after initialization mode is exited, which is initrq = 0 and initak = 0. 0 normal operation 1 mscan in initialization mode 1. the mscan must be in normal mode for this bit to become set. 2. see the bosch can 2.0a/b speci?ation for a detailed de?ition of transmitter and receiver states. 3. in order to protect from accidentally violating the can protocol, txcan is immediately forced to a recessive state when the cpu enters wait (cswai = 1) or stop mode (see section 16.4.5.2, ?peration in wait mode and section 16.4.5.3, ?peration in stop mode ? . 4. the cpu has to make sure that the wupe register and the wupie wake-up interrupt enable register (see section 16.3.2.6, ?scan receiver interrupt enable register (canrier) ) is enabled, if the recovery mechanism from stop or wait is required. 5. the cpu cannot clear slprq before the mscan has entered sleep mode (slprq = 1 and slpak = 1). 6. the cpu cannot clear initrq before the mscan has entered initialization mode (initrq = 1 and initak = 1). 7. in order to protect from accidentally violating the can protocol, txcan is immediately forced to a recessive state when the initialization mode is requested by the cpu. thus, the recommended procedure is to bring the mscan into sleep mode (slprq = 1 and slpak = 1) before requesting initialization mode. 8. not including wupe, initrq, and slprq. 9. tstat1 and tstat0 are not affected by initialization mode. 10. rstat1 and rstat0 are not affected by initialization mode. table 16-3. canctl0 register field descriptions (continued) field description chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 612 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 module base + 0x0001 access: user read/write (1) 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1); cane is write once 76543210 r cane clksrc loopb listen borm wupm slpak initak w reset: 00010001 = unimplemented figure 16-5. mscan control register 1 (canctl1) table 16-4. canctl1 register field descriptions field description 7 cane mscan enable 0 mscan module is disabled 1 mscan module is enabled 6 clksrc mscan clock source this bit de?es the clock source for the mscan module (only for systems with a clock generation module; section 16.4.3.2, ?lock system , and section figure 16-43., ?scan clocking scheme ,?. 0 mscan clock source is the oscillator clock 1 mscan clock source is the bus clock 5 loopb loopback self test mode when this bit is set, the mscan performs an internal loopback which can be used for self test operation. the bit stream output of the transmitter is fed back to the receiver internally. the rxcan input is ignored and the txcan output goes to the recessive state (logic 1). the mscan behaves as it does normally when transmitting and treats its own transmitted message as a message received from a remote node. in this state, the mscan ignores the bit sent during the ack slot in the can frame acknowledge ?ld to ensure proper reception of its own message. both transmit and receive interrupts are generated. 0 loopback self test disabled 1 loopback self test enabled 4 listen listen only mode this bit con?ures the mscan as a can bus monitor. when listen is set, all valid can messages with matching id are received, but no acknowledgement or error frames are sent out (see section 16.4.4.4, ?isten-only mode ?. in addition, the error counters are frozen. listen only mode supports applications which require ?ot plugging?or throughput analysis. the mscan is unable to transmit any messages when listen only mode is active. 0 normal operation 1 listen only mode activated 3 borm bus-off recovery mode ?this bit con?ures the bus-off state recovery mode of the mscan. refer to section 16.5.2, ?us-off recovery , for details. 0 automatic bus-off recovery (see bosch can 2.0a/b protocol speci?ation) 1 bus-off recovery upon user request 2 wupm wake-up mode ?if wupe in canctl0 is enabled, this bit de?es whether the integrated low-pass ?ter is applied to protect the mscan from spurious wake-up (see section 16.4.5.5, ?scan sleep mode ?. 0 mscan wakes up on any dominant level on the can bus 1 mscan wakes up only in case of a dominant pulse on the can bus that has a length of t wup chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 613 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.3 mscan bus timing register 0 (canbtr0) the canbtr0 register con?ures various can bus timing parameters of the mscan module. 1 slpak sleep mode acknowledge ?this ?g indicates whether the mscan module has entered sleep mode (see section 16.4.5.5, ?scan sleep mode ?. it is used as a handshake ?g for the slprq sleep mode request. sleep mode is active when slprq = 1 and slpak = 1. depending on the setting of wupe, the mscan will clear the ?g if it detects activity on the can bus while in sleep mode. 0 running ?the mscan operates normally 1 sleep mode active ?the mscan has entered sleep mode 0 initak initialization mode acknowledge ?this ?g indicates whether the mscan module is in initialization mode (see section 16.4.4.5, ?scan initialization mode ?. it is used as a handshake ?g for the initrq initialization mode request. initialization mode is active when initrq = 1 and initak = 1. the registers canctl1, canbtr0, canbtr1, canidac, canidar0?anidar7, and canidmr0?anidmr7 can be written only by the cpu when the mscan is in initialization mode. 0 running ?the mscan operates normally 1 initialization mode active ?the mscan has entered initialization mode module base + 0x0002 access: user read/write (1) 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1) 76543210 r sjw1 sjw0 brp5 brp4 brp3 brp2 brp1 brp0 w reset: 00000000 figure 16-6. mscan bus timing register 0 (canbtr 0 ) table 16-5. canbtr 0 register field descriptions field description 7-6 sjw[1:0] synchronization jump width the synchronization jump width de?es the maximum number of time quanta (tq) clock cycles a bit can be shortened or lengthened to achieve resynchronization to data transitions on the can bus (see table 16-6 ). 5-0 brp[5:0] baud rate prescaler these bits determine the time quanta (tq) clock which is used to build up the bit timing (see table 16-7 ). table 16-6. synchronization jump width sjw1 sjw0 synchronization jump width 0 0 1 tq clock cycle 0 1 2 tq clock cycles 1 0 3 tq clock cycles 1 1 4 tq clock cycles table 16-4. canctl1 register field descriptions (continued) field description chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 614 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.4 mscan bus timing register 1 (canbtr1) the canbtr1 register con?ures various can bus timing parameters of the mscan module. table 16-7. baud rate prescaler brp5 brp4 brp3 brp2 brp1 brp0 prescaler value (p) 000000 1 000001 2 000010 3 000011 4 :::::: : 111111 64 module base + 0x0003 access: user read/write (1) 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1) 76543210 r samp tseg22 tseg21 tseg20 tseg13 tseg12 tseg11 tseg10 w reset: 00000000 figure 16-7. mscan bus timing register 1 (canbtr1) table 16-8. canbtr1 register field descriptions field description 7 samp sampling ?this bit determines the number of can bus samples taken per bit time. 0 one sample per bit. 1 three samples per bit (1) . if samp = 0, the resulting bit value is equal to the value of the single bit positioned at the sample point. if samp = 1, the resulting bit value is determined by using majority rule on the three total samples. for higher bit rates, it is recommended that only one sample is taken per bit time (samp = 0). 1. in this case, phase_seg1 must be at least 2 time quanta (tq). 6-4 tseg2[2:0] time segment 2 time segments within the bit time ? the number of clock cycles per bit time and the location of the sample point (see figure 16-44 ). time segment 2 (tseg2) values are programmable as shown in table 16-9 . 3-0 tseg1[3:0] time segment 1 time segments within the bit time ? the number of clock cycles per bit time and the location of the sample point (see figure 16-44 ). time segment 1 (tseg1) values are programmable as shown in table 16-10 . chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 615 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the bit time is determined by the oscillator frequency, the baud rate prescaler, and the number of time quanta (tq) clock cycles per bit (as shown in table 16-9 and table 16-10 ). eqn. 16-1 16.3.2.5 mscan receiver flag register (canrflg) a ?g can be cleared only by software (writing a 1 to the corresponding bit position) when the condition which caused the setting is no longer valid. every ?g has an associated interrupt enable bit in the canrier register. table 16-9. time segment 2 values tseg22 tseg21 tseg20 time segment 2 0 0 0 1 tq clock cycle (1) 1. this setting is not valid. please refer to table 16-37 for valid settings. 0 0 1 2 tq clock cycles ::: : 1 1 0 7 tq clock cycles 1 1 1 8 tq clock cycles table 16-10. time segment 1 values tseg13 tseg12 tseg11 tseg10 time segment 1 0 0 0 0 1 tq clock cycle (1) 1. this setting is not valid. please refer to table 16-37 for valid settings. 0 0 0 1 2 tq clock cycles 1 0 0 1 0 3 tq clock cycles 1 0 0 1 1 4 tq clock cycles :::: : 1 1 1 0 15 tq clock cycles 1 1 1 1 16 tq clock cycles module base + 0x0004 access: user read/write (1) 76543210 r wupif cscif rstat1 rstat0 tstat1 tstat0 ovrif rxf w reset: 00000000 = unimplemented figure 16-8. mscan receiver flag register (canrflg) bit time prescaler value () f canclk ----------------------------------------------------- - 1 timesegment1 timesegment2 ++ () ? = chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 616 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note the canrflg register is held in the reset state 1 when the initialization mode is active (initrq = 1 and initak = 1). this register is writable again as soon as the initialization mode is exited (initrq = 0 and initak = 0). 1. read: anytime write: anytime when not in initialization mode, except rstat[1:0] and tstat[1:0] ?gs which are read-only; write of 1 clears ?g; write of 0 is ignored 1. the rstat[1:0], tstat[1:0] bits are not affected by initialization mode. table 16-11. canrflg register field descriptions field description 7 wupif wake-up interrupt flag if the mscan detects can bus activity while in sleep mode (see section 16.4.5.5, ?scan sleep mode ,? and wupe = 1 in cantctl0 (see section 16.3.2.1, ?scan control register 0 (canctl0) ?, the module will set wupif. if not masked, a wake-up interrupt is pending while this ?g is set. 0 no wake-up activity observed while in sleep mode 1 mscan detected activity on the can bus and requested wake-up 6 cscif can status change interrupt flag ?this ?g is set when the mscan changes its current can bus status due to the actual value of the transmit error counter (tec) and the receive error counter (rec). an additional 4- bit (rstat[1:0], tstat[1:0]) status register, which is split into separate sections for tec/rec, informs the system on the actual can bus status (see section 16.3.2.6, ?scan receiver interrupt enable register (canrier) ?. if not masked, an error interrupt is pending while this ?g is set. cscif provides a blocking interrupt. that guarantees that the receiver/transmitter status bits (rstat/tstat) are only updated when no can status change interrupt is pending. if the tecs/recs change their current value after the cscif is asserted, which would cause an additional state change in the rstat/tstat bits, these bits keep their status until the current cscif interrupt is cleared again. 0 no change in can bus status occurred since last interrupt 1 mscan changed current can bus status 5-4 rstat[1:0] receiver status bits the values of the error counters control the actual can bus status of the mscan. as soon as the status change interrupt ?g (cscif) is set, these bits indicate the appropriate receiver related can bus status of the mscan. the coding for the bits rstat1, rstat0 is: 00 rxok: 0 receive error counter 96 01 rxwrn: 96 < receive error counter 127 10 rxerr: 127 < receive error counter 11 bus-off (1) : transmit error counter > 255 3-2 tstat[1:0] transmitter status bits the values of the error counters control the actual can bus status of the mscan. as soon as the status change interrupt ?g (cscif) is set, these bits indicate the appropriate transmitter related can bus status of the mscan. the coding for the bits tstat1, tstat0 is: 00 txok: 0 transmit error counter 96 01 txwrn: 96 < transmit error counter 127 10 txerr: 127 < transmit error counter 255 11 bus-off: transmit error counter > 255 chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 617 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.6 mscan receiver interrupt enable register (canrier) this register contains the interrupt enable bits for the interrupt ?gs described in the canrflg register. note the canrier register is held in the reset state when the initialization mode is active (initrq=1 and initak=1). this register is writable when not in initialization mode (initrq=0 and initak=0). the rstate[1:0], tstate[1:0] bits are not affected by initialization mode. 1 ovrif overrun interrupt flag this ?g is set when a data overrun condition occurs. if not masked, an error interrupt is pending while this ?g is set. 0 no data overrun condition 1 a data overrun detected 0 rxf (2) receive buffer full flag ?rxf is set by the mscan when a new message is shifted in the receiver fifo. this ?g indicates whether the shifted buffer is loaded with a correctly received message (matching identi?r, matching cyclic redundancy code (crc) and no other errors detected). after the cpu has read that message from the rxfg buffer in the receiver fifo, the rxf ?g must be cleared to release the buffer. a set rxf ?g prohibits the shifting of the next fifo entry into the foreground buffer (rxfg). if not masked, a receive interrupt is pending while this ?g is set. 0 no new message available within the rxfg 1 the receiver fifo is not empty. a new message is available in the rxfg 1. redundant information for the most critical can bus status which is ?us-off? this only occurs if the tx error counter exceeds a number of 255 errors. bus-off affects the receiver state. as soon as the transmitter leaves its bus-off state the receiver state skips to rxok too. refer also to tstat[1:0] coding in this register. 2. to ensure data integrity, do not read the receive buffer registers while the rxf ?g is cleared. for mcus with dual cpus, reading the receive buffer registers while the rxf ?g is cleared may result in a cpu fault condition. module base + 0x0005 access: user read/write (1) 1. read: anytime write: anytime when not in initialization mode 76543210 r wupie cscie rstate1 rstate0 tstate1 tstate0 ovrie rxfie w reset: 00000000 figure 16-9. mscan receiver interrupt enable register (canrier) table 16-11. canrflg register field descriptions (continued) field description chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 618 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.7 mscan transmitter flag register (cantflg) the transmit buffer empty ?gs each have an associated interrupt enable bit in the cantier register. table 16-12. canrier register field descriptions field description 7 wupie (1) 1. wupie and wupe (see section 16.3.2.1, ?scan control register 0 (canctl0) ? must both be enabled if the recovery mechanism from stop or wait is required. wake-up interrupt enable 0 no interrupt request is generated from this event. 1 a wake-up event causes a wake-up interrupt request. 6 cscie can status change interrupt enable 0 no interrupt request is generated from this event. 1 a can status change event causes an error interrupt request. 5-4 rstate[1:0] receiver status change enable these rstat enable bits control the sensitivity level in which receiver state changes are causing cscif interrupts. independent of the chosen sensitivity level the rstat ?gs continue to indicate the actual receiver state and are only updated if no cscif interrupt is pending. 00 do not generate any cscif interrupt caused by receiver state changes. 01 generate cscif interrupt only if the receiver enters or leaves ?us-off?state. discard other receiver state changes for generating cscif interrupt. 10 generate cscif interrupt only if the receiver enters or leaves ?xerr?or ?us-off (2) state. discard other receiver state changes for generating cscif interrupt. 11 generate cscif interrupt on all state changes. 2. bus-off state is only de?ed for transmitters by the can standard (see bosch can 2.0a/b protocol speci?ation). because the only possible state change for the transmitter from bus-off to txok also forces the receiver to skip its current state to rxok, the coding of the rxstat[1:0] ?gs de?e an additional bus-off state for the receiver (see section 16.3.2.5, ?scan receiver flag register (canrflg) ?. 3-2 tstate[1:0] transmitter status change enable these tstat enable bits control the sensitivity level in which transmitter state changes are causing cscif interrupts. independent of the chosen sensitivity level, the tstat ?gs continue to indicate the actual transmitter state and are only updated if no cscif interrupt is pending. 00 do not generate any cscif interrupt caused by transmitter state changes. 01 generate cscif interrupt only if the transmitter enters or leaves ?us-off?state. discard other transmitter state changes for generating cscif interrupt. 10 generate cscif interrupt only if the transmitter enters or leaves ?xerr?or ?us-off?state. discard other transmitter state changes for generating cscif interrupt. 11 generate cscif interrupt on all state changes. 1 ovrie overrun interrupt enable 0 no interrupt request is generated from this event. 1 an overrun event causes an error interrupt request. 0 rxfie receiver full interrupt enable 0 no interrupt request is generated from this event. 1 a receive buffer full (successful message reception) event causes a receiver interrupt request. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 619 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note the cantflg register is held in the reset state when the initialization mode is active (initrq = 1 and initak = 1). this register is writable when not in initialization mode (initrq = 0 and initak = 0). 16.3.2.8 mscan transmitter interrupt enable register (cantier) this register contains the interrupt enable bits for the transmit buffer empty interrupt ?gs. module base + 0x0006 access: user read/write (1) 1. read: anytime write: anytime when not in initialization mode; write of 1 clears ?g, write of 0 is ignored 76543210 r0 0 0 00 txe2 txe1 txe0 w reset: 00000111 = unimplemented figure 16-10. mscan transmitter flag register (cantflg) table 16-13. cantflg register field descriptions field description 2-0 txe[2:0] transmitter buffer empty this ?g indicates that the associated transmit message buffer is empty, and thus not scheduled for transmission. the cpu must clear the ?g after a message is set up in the transmit buffer and is due for transmission. the mscan sets the ?g after the message is sent successfully. the ?g is also set by the mscan when the transmission request is successfully aborted due to a pending abort request (see section 16.3.2.9, ?scan transmitter message abort request register (cantarq) ?. if not masked, a transmit interrupt is pending while this ?g is set. clearing a txex ?g also clears the corresponding abtakx (see section 16.3.2.10, ?scan transmitter message abort acknowledge register (cantaak) ?. when a txex ?g is set, the corresponding abtrqx bit is cleared (see section 16.3.2.9, ?scan transmitter message abort request register (cantarq) ?. when listen-mode is active (see section 16.3.2.2, ?scan control register 1 (canctl1) ? the txex ?gs cannot be cleared and no transmission is started. read and write accesses to the transmit buffer will be blocked, if the corresponding txex bit is cleared (txex = 0) and the buffer is scheduled for transmission. 0 the associated message buffer is full (loaded with a message due for transmission) 1 the associated message buffer is empty (not scheduled) module base + 0x0007 access: user read/write (1) 76543210 r00000 txeie2 txeie1 txeie0 w reset: 00000000 = unimplemented figure 16-11. mscan transmitter interrupt enable register (cantier) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 620 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note the cantier register is held in the reset state when the initialization mode is active (initrq = 1 and initak = 1). this register is writable when not in initialization mode (initrq = 0 and initak = 0). 16.3.2.9 mscan transmitter message abort request register (cantarq) the cantarq register allows abort request of queued messages as described below. note the cantarq register is held in the reset state when the initialization mode is active (initrq = 1 and initak = 1). this register is writable when not in initialization mode (initrq = 0 and initak = 0). 1. read: anytime write: anytime when not in initialization mode table 16-14. cantier register field descriptions field description 2-0 txeie[2:0] transmitter empty interrupt enable 0 no interrupt request is generated from this event. 1 a transmitter empty (transmit buffer available for transmission) event causes a transmitter empty interrupt request. module base + 0x0008 access: user read/write (1) 1. read: anytime write: anytime when not in initialization mode 76543210 r00000 abtrq2 abtrq1 abtrq0 w reset: 00000000 = unimplemented figure 16-12. mscan transmitter message abort request register (cantarq) table 16-15. cantarq register field descriptions field description 2-0 abtrq[2:0] abort request ?the cpu sets the abtrqx bit to request that a scheduled message buffer (txex = 0) be aborted. the mscan grants the request if the message has not already started transmission, or if the transmission is not successful (lost arbitration or error). when a message is aborted, the associated txe (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ? and abort acknowledge ?gs (abtak, see section 16.3.2.10, ?scan transmitter message abort acknowledge register (cantaak) ? are set and a transmit interrupt occurs if enabled. the cpu cannot reset abtrqx. abtrqx is reset whenever the associated txe ?g is set. 0 no abort request 1 abort request pending chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 621 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.10 mscan transmitter message abort acknowledge register (cantaak) the cantaak register indicates the successful abort of a queued message, if requested by the appropriate bits in the cantarq register. note the cantaak register is held in the reset state when the initialization mode is active (initrq = 1 and initak = 1). 16.3.2.11 mscan transmit buffer selection register (cantbsel) the cantbsel register allows the selection of the actual transmit message buffer, which then will be accessible in the cantxfg register space. module base + 0x0009 access: user read/write (1) 1. read: anytime write: unimplemented 76543210 r00000 abtak2 abtak1 abtak0 w reset: 00000000 = unimplemented figure 16-13. mscan transmitter message abort acknowledge register (cantaak) table 16-16. cantaak register field descriptions field description 2-0 abtak[2:0] abort acknowledge ?this ?g acknowledges that a message was aborted due to a pending abort request from the cpu. after a particular message buffer is ?gged empty, this ?g can be used by the application software to identify whether the message was aborted successfully or was sent anyway. the abtakx ?g is cleared whenever the corresponding txe ?g is cleared. 0 the message was not aborted. 1 the message was aborted. module base + 0x000a access: user read/write (1) 1. read: find the lowest ordered bit set to 1, all other bits will be read as 0 write: anytime when not in initialization mode 76543210 r00000 tx2 tx1 tx0 w reset: 00000000 = unimplemented figure 16-14. mscan transmit buffer selection register (cantbsel) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 622 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note the cantbsel register is held in the reset state when the initialization mode is active (initrq = 1 and initak=1). this register is writable when not in initialization mode (initrq = 0 and initak = 0). the following gives a short programming example of the usage of the cantbsel register: to get the next available transmit buffer, application software must read the cantflg register and write this value back into the cantbsel register. in this example tx buffers tx1 and tx2 are available. the value read from cantflg is therefore 0b0000_0110. when writing this value back to cantbsel, the tx buffer tx1 is selected in the cantxfg because the lowest numbered bit set to 1 is at bit position 1. reading back this value out of cantbsel results in 0b0000_0010, because only the lowest numbered bit position set to 1 is presented. this mechanism eases the application software s selection of the next available tx buffer. ldaa cantflg; value read is 0b0000_0110 staa cantbsel; value written is 0b0000_0110 ldaa cantbsel; value read is 0b0000_0010 if all transmit message buffers are deselected, no accesses are allowed to the cantxfg registers. 16.3.2.12 mscan identi?r acceptance control register (canidac) the canidac register is used for identi?r acceptance control as described below. table 16-17. cantbsel register field descriptions field description 2-0 tx[2:0] transmit buffer select ?the lowest numbered bit places the respective transmit buffer in the cantxfg register space (e.g., tx1 = 1 and tx0 = 1 selects transmit buffer tx0; tx1 = 1 and tx0 = 0 selects transmit buffer tx1). read and write accesses to the selected transmit buffer will be blocked, if the corresponding txex bit is cleared and the buffer is scheduled for transmission (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ?. 0 the associated message buffer is deselected 1 the associated message buffer is selected, if lowest numbered bit module base + 0x000b access: user read/write (1) 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1), except bits idhitx, which are read-only 76543210 r0 0 idam1 idam0 0 idhit2 idhit1 idhit0 w reset: 00000000 = unimplemented figure 16-15. mscan identi?r acceptance control register (canidac) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 623 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the idhitx indicators are always related to the message in the foreground buffer (rxfg). when a message gets shifted into the foreground buffer of the receiver fifo the indicators are updated as well. 16.3.2.13 mscan reserved register this register is reserved for factory testing of the mscan module and is not available in normal system operating modes. table 16-18. canidac register field descriptions field description 5-4 idam[1:0] identi?r acceptance mode the cpu sets these ?gs to de?e the identi?r acceptance ?ter organization (see section 16.4.3, ?denti?r acceptance filter ?. table 16-19 summarizes the different settings. in ?ter closed mode, no message is accepted such that the foreground buffer is never reloaded. 2-0 idhit[2:0] identi?r acceptance hit indicator ?the mscan sets these ?gs to indicate an identi?r acceptance hit (see section 16.4.3, ?denti?r acceptance filter ?. table 16-20 summarizes the different settings. table 16-19. identi?r acceptance mode settings idam1 idam0 identi?r acceptance mode 0 0 two 32-bit acceptance ?ters 0 1 four 16-bit acceptance ?ters 1 0 eight 8-bit acceptance ?ters 1 1 filter closed table 16-20. identi?r acceptance hit indication idhit2 idhit1 idhit0 identi?r acceptance hit 0 0 0 filter 0 hit 0 0 1 filter 1 hit 0 1 0 filter 2 hit 0 1 1 filter 3 hit 1 0 0 filter 4 hit 1 0 1 filter 5 hit 1 1 0 filter 6 hit 1 1 1 filter 7 hit chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 624 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note writing to this register when in special system operating modes can alter the mscan functionality. 16.3.2.14 mscan miscellaneous register (canmisc) this register provides additional features. 16.3.2.15 mscan receive error counter (canrxerr) this register re?cts the status of the mscan receive error counter. module base + 0x000c to module base + 0x000d access: user read/write (1) 1. read: always reads zero in normal system operation modes write: unimplemented in normal system operation modes 76543210 r00000000 w reset: 00000000 = unimplemented figure 16-16. mscan reserved register module base + 0x000d access: user read/write (1) 1. read: anytime write: anytime; write of ??clears ?g; write of ??ignored 76543210 r0000000 bohold w reset: 00000000 = unimplemented figure 16-17. mscan miscellaneous register (canmisc) table 16-21. canmisc register field descriptions field description 0 bohold bus-off state hold until user request ?if borm is set in mscan control register 1 (canctl1) , this bit indicates whether the module has entered the bus-off state. clearing this bit requests the recovery from bus-off. refer to section 16.5.2, ?us-off recovery , for details. 0 module is not bus-off or recovery has been requested by user in bus-off state 1 module is bus-off and holds this state until user request chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 625 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note reading this register when in any other mode other than sleep or initialization mode may return an incorrect value. for mcus with dual cpus, this may result in a cpu fault condition. writing to this register when in special modes can alter the mscan functionality. 16.3.2.16 mscan transmit error counter (cantxerr) this register re?cts the status of the mscan transmit error counter. note reading this register when in any other mode other than sleep or initialization mode, may return an incorrect value. for mcus with dual cpus, this may result in a cpu fault condition. writing to this register when in special modes can alter the mscan functionality. module base + 0x000e access: user read/write (1) 1. read: only when in sleep mode (slprq = 1 and slpak = 1) or initialization mode (initrq = 1 and initak = 1) write: unimplemented 76543210 r rxerr7 rxerr6 rxerr5 rxerr4 rxerr3 rxerr2 rxerr1 rxerr0 w reset: 00000000 = unimplemented figure 16-18. mscan receive error counter (canrxerr) module base + 0x000f access: user read/write (1) 1. read: only when in sleep mode (slprq = 1 and slpak = 1) or initialization mode (initrq = 1 and initak = 1) write: unimplemented 76543210 r txerr7 txerr6 txerr5 txerr4 txerr3 txerr2 txerr1 txerr0 w reset: 00000000 = unimplemented figure 16-19. mscan transmit error counter (cantxerr) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 626 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.17 mscan identi?r acceptance registers (canidar0-7) on reception, each message is written into the background receive buffer. the cpu is only signalled to read the message if it passes the criteria in the identi?r acceptance and identi?r mask registers (accepted); otherwise, the message is overwritten by the next message (dropped). the acceptance registers of the mscan are applied on the idr0?dr3 registers (see section 16.3.3.1, ?denti?r registers (idr0?dr3) ? of incoming messages in a bit by bit manner (see section 16.4.3, ?denti?r acceptance filter ?. for extended identi?rs, all four acceptance and mask registers are applied. for standard identi?rs, only the ?st two (canidar0/1, canidmr0/1) are applied. module base + 0x0010 to module base + 0x0013 access: user read/write (1) 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1) 76543210 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w reset 00000000 figure 16-20. mscan identi?r acceptance registers (first bank) ?canidar0?anidar3 table 16-22. canidar0?anidar3 register field descriptions field description 7-0 ac[7:0] acceptance code bits ac[7:0] comprise a user-de?ed sequence of bits with which the corresponding bits of the related identi?r register (idrn) of the receive message buffer are compared. the result of this comparison is then masked with the corresponding identi?r mask register. module base + 0x0018 to module base + 0x001b access: user read/write (1) 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1) 76543210 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w reset 00000000 figure 16-21. mscan identi?r acceptance registers (second bank) ?canidar4?anidar7 chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 627 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.2.18 mscan identi?r mask registers (canidmr0?anidmr7) the identi?r mask register speci?s which of the corresponding bits in the identi?r acceptance register are relevant for acceptance ?tering. to receive standard identi?rs in 32 bit ?ter mode, it is required to program the last three bits (am[2:0]) in the mask registers canidmr1 and canidmr5 to ?on t care. to receive standard identi?rs in 16 bit ?ter mode, it is required to program the last three bits (am[2:0]) in the mask registers canidmr1, canidmr3, canidmr5, and canidmr7 to ?on t care. table 16-23. canidar4?anidar7 register field descriptions field description 7-0 ac[7:0] acceptance code bits ac[7:0] comprise a user-de?ed sequence of bits with which the corresponding bits of the related identi?r register (idrn) of the receive message buffer are compared. the result of this comparison is then masked with the corresponding identi?r mask register. module base + 0x0014 to module base + 0x0017 access: user read/write (1) 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1) 76543210 r am7 am6 am5 am4 am3 am2 am1 am0 w reset 00000000 figure 16-22. mscan identi?r mask registers (first bank) ?canidmr0?anidmr3 table 16-24. canidmr0?anidmr3 register field descriptions field description 7-0 am[7:0] acceptance mask bits if a particular bit in this register is cleared, this indicates that the corresponding bit in the identi?r acceptance register must be the same as its identi?r bit before a match is detected. the message is accepted if all such bits match. if a bit is set, it indicates that the state of the corresponding bit in the identi?r acceptance register does not affect whether or not the message is accepted. 0 match corresponding acceptance code register and identi?r bits 1 ignore corresponding acceptance code register bit module base + 0x001c to module base + 0x001f access: user read/write (1) 76543210 r am7 am6 am5 am4 am3 am2 am1 am0 w reset 00000000 figure 16-23. mscan identi?r mask registers (second bank) ?canidmr4?anidmr7 chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 628 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.3 programmer s model of message storage the following section details the organization of the receive and transmit message buffers and the associated control registers. to simplify the programmer interface, the receive and transmit message buffers have the same outline. each message buffer allocates 16 bytes in the memory map containing a 13 byte data structure. an additional transmit buffer priority register (tbpr) is de?ed for the transmit buffers. within the last two bytes of this memory map, the mscan stores a special 16-bit time stamp, which is sampled from an internal timer after successful transmission or reception of a message. this feature is only available for transmit and receiver buffers, if the time bit is set (see section 16.3.2.1, ?scan control register 0 (canctl0) ?. the time stamp register is written by the mscan. the cpu can only read these registers. 1. read: anytime write: anytime in initialization mode (initrq = 1 and initak = 1) table 16-25. canidmr4?anidmr7 register field descriptions field description 7-0 am[7:0] acceptance mask bits if a particular bit in this register is cleared, this indicates that the corresponding bit in the identi?r acceptance register must be the same as its identi?r bit before a match is detected. the message is accepted if all such bits match. if a bit is set, it indicates that the state of the corresponding bit in the identi?r acceptance register does not affect whether or not the message is accepted. 0 match corresponding acceptance code register and identi?r bits 1 ignore corresponding acceptance code register bit chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 629 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 16-24 shows the common 13-byte data structure of receive and transmit buffers for extended identi?rs. the mapping of standard identi?rs into the idr registers is shown in figure 16-25 . all bits of the receive and transmit buffers are ??out of reset because of ram-based implementation 1 . all reserved or unused bits of the receive and transmit buffers always read ?? table 16-26. message buffer organization offset address register access 0x00x0 identi?r register 0 r/w 0x00x1 identi?r register 1 r/w 0x00x2 identi?r register 2 r/w 0x00x3 identi?r register 3 r/w 0x00x4 data segment register 0 r/w 0x00x5 data segment register 1 r/w 0x00x6 data segment register 2 r/w 0x00x7 data segment register 3 r/w 0x00x8 data segment register 4 r/w 0x00x9 data segment register 5 r/w 0x00xa data segment register 6 r/w 0x00xb data segment register 7 r/w 0x00xc data length register r/w 0x00xd transmit buffer priority register (1) 1. not applicable for receive buffers r/w 0x00xe time stamp register (high byte) r 0x00xf time stamp register (low byte) r 1. exception: the transmit buffer priority registers are 0 out of reset. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 630 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 16-24. receive/transmit message buffer ?extended identi?r mapping register name bit 7 654321 bit0 0x00x0 idr0 r id28 id27 id26 id25 id24 id23 id22 id21 w 0x00x1 idr1 r id20 id19 id18 srr (=1) ide (=1) id17 id16 id15 w 0x00x2 idr2 r id14 id13 id12 id11 id10 id9 id8 id7 w 0x00x3 idr3 r id6 id5 id4 id3 id2 id1 id0 rtr w 0x00x4 dsr0 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00x5 dsr1 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00x6 dsr2 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00x7 dsr3 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00x8 dsr4 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00x9 dsr5 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00xa dsr6 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00xb dsr7 r db7 db6 db5 db4 db3 db2 db1 db0 w 0x00xc dlr r dlc3 dlc2 dlc1 dlc0 w chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 631 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: for transmit buffers, anytime when txex ?g is set (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ? and the corresponding transmit buffer is selected in cantbsel (see section 16.3.2.11, ?scan transmit buffer selection register (cantbsel) ?. for receive buffers, only when rxf ?g is set (see section 16.3.2.5, ?scan receiver flag register (canrflg) ?. write: for transmit buffers, anytime when txex ?g is set (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ? and the corresponding transmit buffer is selected in cantbsel (see section 16.3.2.11, ?scan transmit buffer selection register (cantbsel) ?. unimplemented for receive buffers. reset: unde?ed because of ram-based implementation 16.3.3.1 identi?r registers (idr0?dr3) the identi?r registers for an extended format identi?r consist of a total of 32 bits: id[28:0], srr, ide, and rtr. the identi?r registers for a standard format identi?r consist of a total of 13 bits: id[10:0], rtr, and ide. = unused, always read ? figure 16-25. receive/transmit message buffer ?standard identi?r mapping register name bit 7 654321 bit 0 idr0 0x00x0 r id10 id9 id8 id7 id6 id5 id4 id3 w idr1 0x00x1 r id2 id1 id0 rtr ide (=0) w idr2 0x00x2 r w idr3 0x00x3 r w = unused, always read ? figure 16-24. receive/transmit message buffer ?extended identi?r mapping (continued) register name bit 7 654321 bit0 chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 632 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.3.1.1 idr0?dr3 for extended identi?r mapping module base + 0x00x0 76543210 r id28 id27 id26 id25 id24 id23 id22 id21 w reset: xxxxxxxx figure 16-26. identi?r register 0 (idr0) ?extended identi?r mapping table 16-27. idr0 register field descriptions ?extended field description 7-0 id[28:21] extended format identi?r the identi?rs consist of 29 bits (id[28:0]) for the extended format. id28 is the most signi?ant bit and is transmitted ?st on the can bus during the arbitration procedure. the priority of an identi?r is de?ed to be highest for the smallest binary number. module base + 0x00x1 76543210 r id20 id19 id18 srr (=1) ide (=1) id17 id16 id15 w reset: xxxxxxxx figure 16-27. identi?r register 1 (idr1) ?extended identi?r mapping table 16-28. idr1 register field descriptions ?extended field description 7-5 id[20:18] extended format identi?r the identi?rs consist of 29 bits (id[28:0]) for the extended format. id28 is the most signi?ant bit and is transmitted ?st on the can bus during the arbitration procedure. the priority of an identi?r is de?ed to be highest for the smallest binary number. 4 srr substitute remote request ?this ?ed recessive bit is used only in extended format. it must be set to 1 by the user for transmission buffers and is stored as received on the can bus for receive buffers. 3 ide id extended this ?g indicates whether the extended or standard identi?r format is applied in this buffer. in the case of a receive buffer, the ?g is set as received and indicates to the cpu how to process the buffer identi?r registers. in the case of a transmit buffer, the ?g indicates to the mscan what type of identi?r to send. 0 standard format (11 bit) 1 extended format (29 bit) 2-0 id[17:15] extended format identi?r the identi?rs consist of 29 bits (id[28:0]) for the extended format. id28 is the most signi?ant bit and is transmitted ?st on the can bus during the arbitration procedure. the priority of an identi?r is de?ed to be highest for the smallest binary number. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 633 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 module base + 0x00x2 76543210 r id14 id13 id12 id11 id10 id9 id8 id7 w reset: xxxxxxxx figure 16-28. identi?r register 2 (idr2) ?extended identi?r mapping table 16-29. idr2 register field descriptions ?extended field description 7-0 id[14:7] extended format identi?r the identi?rs consist of 29 bits (id[28:0]) for the extended format. id28 is the most signi?ant bit and is transmitted ?st on the can bus during the arbitration procedure. the priority of an identi?r is de?ed to be highest for the smallest binary number. module base + 0x00x3 76543210 r id6 id5 id4 id3 id2 id1 id0 rtr w reset: xxxxxxxx figure 16-29. identi?r register 3 (idr3) ?extended identi?r mapping table 16-30. idr3 register field descriptions ?extended field description 7-1 id[6:0] extended format identi?r the identi?rs consist of 29 bits (id[28:0]) for the extended format. id28 is the most signi?ant bit and is transmitted ?st on the can bus during the arbitration procedure. the priority of an identi?r is de?ed to be highest for the smallest binary number. 0 rtr remote transmission request ?this ?g re?cts the status of the remote transmission request bit in the can frame. in the case of a receive buffer, it indicates the status of the received frame and supports the transmission of an answering frame in software. in the case of a transmit buffer, this ?g de?es the setting of the rtr bit to be sent. 0 data frame 1 remote frame chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 634 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.3.1.2 idr0?dr3 for standard identi?r mapping module base + 0x00x0 76543210 r id10 id9 id8 id7 id6 id5 id4 id3 w reset: xxxxxxxx figure 16-30. identi?r register 0 ?standard mapping table 16-31. idr0 register field descriptions ?standard field description 7-0 id[10:3] standard format identi?r the identi?rs consist of 11 bits (id[10:0]) for the standard format. id10 is the most signi?ant bit and is transmitted ?st on the can bus during the arbitration procedure. the priority of an identi?r is de?ed to be highest for the smallest binary number. see also id bits in table 16-32 . module base + 0x00x1 76543210 r id2 id1 id0 rtr ide (=0) w reset: xxxxxxxx = unused; always read ? figure 16-31. identi?r register 1 ?standard mapping table 16-32. idr1 register field descriptions field description 7-5 id[2:0] standard format identi?r the identi?rs consist of 11 bits (id[10:0]) for the standard format. id10 is the most signi?ant bit and is transmitted ?st on the can bus during the arbitration procedure. the priority of an identi?r is de?ed to be highest for the smallest binary number. see also id bits in table 16-31 . 4 rtr remote transmission request this ?g re?cts the status of the remote transmission request bit in the can frame. in the case of a receive buffer, it indicates the status of the received frame and supports the transmission of an answering frame in software. in the case of a transmit buffer, this ?g de?es the setting of the rtr bit to be sent. 0 data frame 1 remote frame 3 ide id extended this ?g indicates whether the extended or standard identi?r format is applied in this buffer. in the case of a receive buffer, the ?g is set as received and indicates to the cpu how to process the buffer identi?r registers. in the case of a transmit buffer, the ?g indicates to the mscan what type of identi?r to send. 0 standard format (11 bit) 1 extended format (29 bit) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 635 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.3.2 data segment registers (dsr0-7) the eight data segment registers, each with bits db[7:0], contain the data to be transmitted or received. the number of bytes to be transmitted or received is determined by the data length code in the corresponding dlr register. module base + 0x00x2 76543210 r w reset: xxxxxxxx = unused; always read ? figure 16-32. identi?r register 2 ?standard mapping module base + 0x00x3 76543210 r w reset: xxxxxxxx = unused; always read ? figure 16-33. identi?r register 3 ?standard mapping module base + 0x00x4 to module base + 0x00xb 76543210 r db7 db6 db5 db4 db3 db2 db1 db0 w reset: xxxxxxxx figure 16-34. data segment registers (dsr0?sr7) ?extended identi?r mapping table 16-33. dsr0?sr7 register field descriptions field description 7-0 db[7:0] data bits 7-0 chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 636 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.3.3.3 data length register (dlr) this register keeps the data length ?ld of the can frame. 16.3.3.4 transmit buffer priority register (tbpr) this register de?es the local priority of the associated message buffer. the local priority is used for the internal prioritization process of the mscan and is de?ed to be highest for the smallest binary number. the mscan implements the following internal prioritization mechanisms: all transmission buffers with a cleared txex ?g participate in the prioritization immediately before the sof (start of frame) is sent. module base + 0x00xc 76543210 r dlc3 dlc2 dlc1 dlc0 w reset: xxxxxxxx = unused; always read ? figure 16-35. data length register (dlr) ?extended identi?r mapping table 16-34. dlr register field descriptions field description 3-0 dlc[3:0] data length code bits the data length code contains the number of bytes (data byte count) of the respective message. during the transmission of a remote frame, the data length code is transmitted as programmed while the number of transmitted data bytes is always 0. the data byte count ranges from 0 to 8 for a data frame. table 16-35 shows the effect of setting the dlc bits. table 16-35. data length codes data length code data byte count dlc3 dlc2 dlc1 dlc0 00000 00011 00102 00113 01004 01015 01106 01117 10008 chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 637 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the transmission buffer with the lowest local priority ?ld wins the prioritization. in cases of more than one buffer having the same lowest priority, the message buffer with the lower index number wins. 16.3.3.5 time stamp register (tsrh?srl) if the time bit is enabled, the mscan will write a time stamp to the respective registers in the active transmit or receive buffer right after the eof of a valid message on the can bus (see section 16.3.2.1, ?scan control register 0 (canctl0) ?. in case of a transmission, the cpu can only read the time stamp after the respective transmit buffer has been ?gged empty. the timer value, which is used for stamping, is taken from a free running internal can bit clock. a timer overrun is not indicated by the mscan. the timer is reset (all bits set to 0) during initialization mode. the cpu can only read the time stamp registers. module base + 0x00xd access: user read/write (1) 1. read: anytime when txex ?g is set (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ? and the corresponding transmit buffer is selected in cantbsel (see section 16.3.2.11, ?scan transmit buffer selection register (cantbsel) ? write: anytime when txex ?g is set (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ? and the corresponding transmit buffer is selected in cantbsel (see section 16.3.2.11, ?scan transmit buffer selection register (cantbsel) ? 76543210 r prio7 prio6 prio5 prio4 prio3 prio2 prio1 prio0 w reset: 00000000 figure 16-36. transmit buffer priority register (tbpr) module base + 0x00xe access: user read/write (1) 1. read: anytime when txex ?g is set (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ? and the corresponding transmit buffer is selected in cantbsel (see section 16.3.2.11, ?scan transmit buffer selection register (cantbsel) ? write: unimplemented 76543210 r tsr15 tsr14 tsr13 tsr12 tsr11 tsr10 tsr9 tsr8 w reset: xxxxxxxx figure 16-37. time stamp register ?high byte (tsrh) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 638 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 module base + 0x00xf access: user read/write (1) 1. read: anytime when txex ?g is set (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ? and the corresponding transmit buffer is selected in cantbsel (see section 16.3.2.11, ?scan transmit buffer selection register (cantbsel) ? write: unimplemented 76543210 r tsr7 tsr6 tsr5 tsr4 tsr3 tsr2 tsr1 tsr0 w reset: xxxxxxxx figure 16-38. time stamp register ?low byte (tsrl) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 639 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.4 functional description 16.4.1 general this section provides a complete functional description of the mscan. 16.4.2 message storage figure 16-39. user model for message buffer organization mscan rx0 rx1 can receive / transmit engine memory mapped i/o cpu bus mscan tx2 txe2 prio receiver transmitter rxbg txbg tx0 txe0 prio txbg tx1 prio txe1 txfg cpu bus rx2 rx3 rx4 rxf rxfg chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 640 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the mscan facilitates a sophisticated message storage system which addresses the requirements of a broad range of network applications. 16.4.2.1 message transmit background modern application layer software is built upon two fundamental assumptions: any can node is able to send out a stream of scheduled messages without releasing the can bus between the two messages. such nodes arbitrate for the can bus immediately after sending the previous message and only release the can bus in case of lost arbitration. the internal message queue within any can node is organized such that the highest priority message is sent out ?st, if more than one message is ready to be sent. the behavior described in the bullets above cannot be achieved with a single transmit buffer. that buffer must be reloaded immediately after the previous message is sent. this loading process lasts a ?ite amount of time and must be completed within the inter-frame sequence (ifs) to be able to send an uninterrupted stream of messages. even if this is feasible for limited can bus speeds, it requires that the cpu reacts with short latencies to the transmit interrupt. a double buffer scheme de-couples the reloading of the transmit buffer from the actual message sending and, therefore, reduces the reactiveness requirements of the cpu. problems can arise if the sending of a message is ?ished while the cpu re-loads the second buffer. no buffer would then be ready for transmission, and the can bus would be released. at least three transmit buffers are required to meet the ?st of the above requirements under all circumstances. the mscan has three transmit buffers. the second requirement calls for some sort of internal prioritization which the mscan implements with the ?ocal priority?concept described in section 16.4.2.2, ?ransmit structures . 16.4.2.2 transmit structures the mscan triple transmit buffer scheme optimizes real-time performance by allowing multiple messages to be set up in advance. the three buffers are arranged as shown in figure 16-39 . all three buffers have a 13-byte data structure similar to the outline of the receive buffers (see section 16.3.3, ?rogrammer s model of message storage ?. an additional transmit buffer priority register (tbpr) contains an 8-bit local priority ?ld (prio) (see section 16.3.3.4, ?ransmit buffer priority register (tbpr) ?. the remaining two bytes are used for time stamping of a message, if required (see section 16.3.3.5, ?ime stamp register (tsrh?srl) ?. to transmit a message, the cpu must identify an available transmit buffer, which is indicated by a set transmitter buffer empty (txex) ?g (see section 16.3.2.7, ?scan transmitter flag register (cantflg) ?. if a transmit buffer is available, the cpu must set a pointer to this buffer by writing to the cantbsel register (see section 16.3.2.11, ?scan transmit buffer selection register (cantbsel) ?. this makes the respective buffer accessible within the cantxfg address space (see section 16.3.3, ?rogrammer s model of message storage ?. the algorithmic feature associated with the cantbsel register simpli?s the transmit buffer selection. in addition, this scheme makes the handler chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 641 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 software simpler because only one address area is applicable for the transmit process, and the required address space is minimized. the cpu then stores the identi?r, the control bits, and the data content into one of the transmit buffers. finally, the buffer is ?gged as ready for transmission by clearing the associated txe ?g. the mscan then schedules the message for transmission and signals the successful transmission of the buffer by setting the associated txe ?g. a transmit interrupt (see section 16.4.7.2, ?ransmit interrupt ? is generated 1 when txex is set and can be used to drive the application software to re-load the buffer. if more than one buffer is scheduled for transmission when the can bus becomes available for arbitration, the mscan uses the local priority setting of the three buffers to determine the prioritization. for this purpose, every transmit buffer has an 8-bit local priority ?ld (prio). the application software programs this ?ld when the message is set up. the local priority re?cts the priority of this particular message relative to the set of messages being transmitted from this node. the lowest binary value of the prio ?ld is de?ed to be the highest priority. the internal scheduling process takes place whenever the mscan arbitrates for the can bus. this is also the case after the occurrence of a transmission error. when a high priority message is scheduled by the application software, it may become necessary to abort a lower priority message in one of the three transmit buffers. because messages that are already in transmission cannot be aborted, the user must request the abort by setting the corresponding abort request bit (abtrq) (see section 16.3.2.9, ?scan transmitter message abort request register (cantarq) ?) the mscan then grants the request, if possible, by: 1. setting the corresponding abort acknowledge ?g (abtak) in the cantaak register. 2. setting the associated txe ?g to release the buffer. 3. generating a transmit interrupt. the transmit interrupt handler software can determine from the setting of the abtak ?g whether the message was aborted (abtak = 1) or sent (abtak = 0). 16.4.2.3 receive structures the received messages are stored in a ve stage input fifo. the ve message buffers are alternately mapped into a single memory area (see figure 16-39 ). the background receive buffer (rxbg) is exclusively associated with the mscan, but the foreground receive buffer (rxfg) is addressable by the cpu (see figure 16-39 ). this scheme simpli?s the handler software because only one address area is applicable for the receive process. all receive buffers have a size of 15 bytes to store the can control bits, the identi?r (standard or extended), the data contents, and a time stamp, if enabled (see section 16.3.3, ?rogrammer s model of message storage ?. the receiver full ?g (rxf) (see section 16.3.2.5, ?scan receiver flag register (canrflg) ? signals the status of the foreground receive buffer. when the buffer contains a correctly received message with a matching identi?r, this ?g is set. on reception, each message is checked to see whether it passes the ?ter (see section 16.4.3, ?denti?r acceptance filter ? and simultaneously is written into the active rxbg. after successful reception of a valid message, the mscan shifts the content of rxbg into the receiver fifo, sets the rxf ?g, and 1. the transmit interrupt occurs only if not masked. a polling scheme can be applied on txex also. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 642 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 generates a receive interrupt 1 (see section 16.4.7.3, ?eceive interrupt ? to the cpu. the user s receive handler must read the received message from the rxfg and then reset the rxf ?g to acknowledge the interrupt and to release the foreground buffer. a new message, which can follow immediately after the ifs ?ld of the can frame, is received into the next available rxbg. if the mscan receives an invalid message in its rxbg (wrong identi?r, transmission errors, etc.) the actual contents of the buffer will be over-written by the next message. the buffer will then not be shifted into the fifo. when the mscan module is transmitting, the mscan receives its own transmitted messages into the background receive buffer, rxbg, but does not shift it into the receiver fifo, generate a receive interrupt, or acknowledge its own messages on the can bus. the exception to this rule is in loopback mode (see section 16.3.2.2, ?scan control register 1 (canctl1) ? where the mscan treats its own messages exactly like all other incoming messages. the mscan receives its own transmitted messages in the event that it loses arbitration. if arbitration is lost, the mscan must be prepared to become a receiver. an overrun condition occurs when all receive message buffers in the fifo are ?led with correctly received messages with accepted identi?rs and another message is correctly received from the can bus with an accepted identi?r. the latter message is discarded and an error interrupt with overrun indication is generated if enabled (see section 16.4.7.5, ?rror interrupt ?. the mscan remains able to transmit messages while the receiver fifo is being ?led, but all incoming messages are discarded. as soon as a receive buffer in the fifo is available again, new valid messages will be accepted. 16.4.3 identi?r acceptance filter the mscan identi?r acceptance registers (see section 16.3.2.12, ?scan identi?r acceptance control register (canidac) ? de?e the acceptable patterns of the standard or extended identi?r (id[10:0] or id[28:0]). any of these bits can be marked ?on t care?in the mscan identi?r mask registers (see section 16.3.2.18, ?scan identi?r mask registers (canidmr0?anidmr7) ?. a ?ter hit is indicated to the application software by a set receive buffer full ?g (rxf = 1) and three bits in the canidac register (see section 16.3.2.12, ?scan identi?r acceptance control register (canidac) ?. these identi?r hit ?gs (idhit[2:0]) clearly identify the ?ter section that caused the acceptance. they simplify the application software s task to identify the cause of the receiver interrupt. if more than one hit occurs (two or more ?ters match), the lower hit has priority. a very ?xible programmable generic identi?r acceptance ?ter has been introduced to reduce the cpu interrupt loading. the ?ter is programmable to operate in four different modes: two identi?r acceptance ?ters, each to be applied to: the full 29 bits of the extended identi?r and to the following bits of the can 2.0b frame: remote transmission request (rtr) identi?r extension (ide) substitute remote request (srr) the 11 bits of the standard identi?r plus the rtr and ide bits of the can 2.0a/b messages. this mode implements two ?ters for a full length can 2.0b compliant extended identi?r. although this mode can be used for standard identi?rs, it is recommended to use the four or eight identi?r acceptance ?ters. 1. the receive interrupt occurs only if not masked. a polling scheme can be applied on rxf also. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 643 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 16-40 shows how the ?st 32-bit ?ter bank (canidar0?anidar3, canidmr0?anidmr3) produces a ?ter 0 hit. similarly, the second ?ter bank (canidar4?anidar7, canidmr4?anidmr7) produces a ?ter 1 hit. four identi?r acceptance ?ters, each to be applied to: the 14 most signi?ant bits of the extended identi?r plus the srr and ide bits of can 2.0b messages. the 11 bits of the standard identi?r, the rtr and ide bits of can 2.0a/b messages. figure 16-41 shows how the ?st 32-bit ?ter bank (canidar0?anida3, canidmr0?canidmr) produces ?ter 0 and 1 hits. similarly, the second ?ter bank (canidar4?anidar7, canidmr4?anidmr7) produces ?ter 2 and 3 hits. eight identi?r acceptance ?ters, each to be applied to the ?st 8 bits of the identi?r. this mode implements eight independent ?ters for the ?st 8 bits of a can 2.0a/b compliant standard identi?r or a can 2.0b compliant extended identi?r. figure 16-42 shows how the ?st 32-bit ?ter bank (canidar0?anidar3, canidmr0?anidmr3) produces ?ter 0 to 3 hits. similarly, the second ?ter bank (canidar4?anidar7, canidmr4?anidmr7) produces ?ter 4 to 7 hits. closed ?ter. no can message is copied into the foreground buffer rxfg, and the rxf ?g is never set. figure 16-40. 32-bit maskable identi?r acceptance filter id28 id21 idr0 id10 id3 idr0 id20 id15 idr1 id2 ide idr1 id14 id7 idr2 id10 id3 idr2 id6 rtr idr3 id10 id3 idr3 ac7 ac0 canidar0 am7 am0 canidmr0 ac7 ac0 canidar1 am7 am0 canidmr1 ac7 ac0 canidar2 am7 am0 canidmr2 ac7 ac0 canidar3 am7 am0 canidmr3 id accepted (filter 0 hit) can 2.0b extended identi?r can 2.0a/b standard identi?r chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 644 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 16-41. 16-bit maskable identi?r acceptance filters id28 id21 idr0 id10 id3 idr0 id20 id15 idr1 id2 ide idr1 id14 id7 idr2 id10 id3 idr2 id6 rtr idr3 id10 id3 idr3 ac7 ac0 canidar0 am7 am0 canidmr0 ac7 ac0 canidar1 am7 am0 canidmr1 id accepted (filter 0 hit) ac7 ac0 canidar2 am7 am0 canidmr2 ac7 ac0 canidar3 am7 am0 canidmr3 id accepted (filter 1 hit) can 2.0b extended identi?r can 2.0a/b standard identi?r chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 645 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 16-42. 8-bit maskable identi?r acceptance filters can 2.0b extended identi?r can 2.0a/b standard identi?r ac7 ac0 cidar3 am7 am0 cidmr3 id accepted (filter 3 hit) ac7 ac0 cidar2 am7 am0 cidmr2 id accepted (filter 2 hit) ac7 ac0 cidar1 am7 am0 cidmr1 id accepted (filter 1 hit) id28 id21 idr0 id10 id3 idr0 id20 id15 idr1 id2 ide idr1 id14 id7 idr2 id10 id3 idr2 id6 rtr idr3 id10 id3 idr3 ac7 ac0 cidar0 am7 am0 cidmr0 id accepted (filter 0 hit) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 646 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.4.3.1 protocol violation protection the mscan protects the user from accidentally violating the can protocol through programming errors. the protection logic implements the following features: the receive and transmit error counters cannot be written or otherwise manipulated. all registers which control the con?uration of the mscan cannot be modi?d while the mscan is on-line. the mscan has to be in initialization mode. the corresponding initrq/initak handshake bits in the canctl0/canctl1 registers (see section 16.3.2.1, ?scan control register 0 (canctl0) ? serve as a lock to protect the following registers: mscan control 1 register (canctl1) mscan bus timing registers 0 and 1 (canbtr0, canbtr1) mscan identi?r acceptance control register (canidac) mscan identi?r acceptance registers (canidar0?anidar7) mscan identi?r mask registers (canidmr0?anidmr7) the txcan is immediately forced to a recessive state when the mscan goes into the power down mode or initialization mode (see section 16.4.5.6, ?scan power down mode , and section 16.4.4.5, ?scan initialization mode ?. the mscan enable bit (cane) is writable only once in normal system operation modes, which provides further protection against inadvertently disabling the mscan. 16.4.3.2 clock system figure 16-43 shows the structure of the mscan clock generation circuitry. figure 16-43. mscan clocking scheme the clock source bit (clksrc) in the canctl1 register ( 16.3.2.2/16-611 ) de?es whether the internal canclk is connected to the output of a crystal oscillator (oscillator clock) or to the bus clock. the clock source has to be chosen such that the tight oscillator tolerance requirements (up to 0.4%) of the can protocol are met. additionally, for high can bus rates (1 mbps), a 45% to 55% duty cycle of the clock is required. if the bus clock is generated from a pll, it is recommended to select the oscillator clock rather than the bus clock due to jitter considerations, especially at the faster can bus rates. bus clock oscillator clock mscan canclk clksrc clksrc prescaler (1 .. 64) time quanta clock (tq) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 647 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 for microcontrollers without a clock and reset generator (crg), canclk is driven from the crystal oscillator (oscillator clock). a programmable prescaler generates the time quanta (tq) clock from canclk. a time quantum is the atomic unit of time handled by the mscan. eqn. 16-2 a bit time is subdivided into three segments as described in the bosch can speci?ation. (see figure 16- 44 ): sync_seg: this segment has a ?ed length of one time quantum. signal edges are expected to happen within this section. time segment 1: this segment includes the prop_seg and the phase_seg1 of the can standard. it can be programmed by setting the parameter tseg1 to consist of 4 to 16 time quanta. time segment 2: this segment represents the phase_seg2 of the can standard. it can be programmed by setting the tseg2 parameter to be 2 to 8 time quanta long. eqn. 16-3 figure 16-44. segments within the bit time tq f canclk prescaler value ( ) ---------------------------------------------------- -- = bit rate f tq number of time quanta () -------------------------------------------------------------------------------- - = sync_seg time segment 1 time segment 2 1 4 ... 16 2 ... 8 8 ... 25 time quanta = 1 bit time nrz signal sample point (single or triple sampling) (prop_seg + phase_seg1) (phase_seg2) transmit point chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 648 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the synchronization jump width (see the bosch can speci?ation for details) can be programmed in a range of 1 to 4 time quanta by setting the sjw parameter. the sync_seg, tseg1, tseg2, and sjw parameters are set by programming the mscan bus timing registers (canbtr0, canbtr1) (see section 16.3.2.3, ?scan bus timing register 0 (canbtr0) and section 16.3.2.4, ?scan bus timing register 1 (canbtr1) ?. table 16-37 gives an overview of the can compliant segment settings and the related parameter values. note it is the user s responsibility to ensure the bit time settings are in compliance with the can standard. 16.4.4 modes of operation 16.4.4.1 normal system operating modes the mscan module behaves as described within this speci?ation in all normal system operating modes. write restrictions exist for some registers. table 16-36. time segment syntax syntax description sync_seg system expects transitions to occur on the can bus during this period. transmit point a node in transmit mode transfers a new value to the can bus at this point. sample point a node in receive mode samples the can bus at this point. if the three samples per bit option is selected, then this point marks the position of the third sample. table 16-37. can standard compliant bit time segment settings time segment 1 tseg1 time segment 2 tseg2 synchronization jump width sjw 5 .. 10 4 .. 9 2 1 1 .. 2 0 .. 1 4 .. 11 3 .. 10 3 2 1 .. 3 0 .. 2 5 .. 12 4 .. 11 4 3 1 .. 4 0 .. 3 6 .. 13 5 .. 12 5 4 1 .. 4 0 .. 3 7 .. 14 6 .. 13 6 5 1 .. 4 0 .. 3 8 .. 15 7 .. 14 7 6 1 .. 4 0 .. 3 9 .. 16 8 .. 15 8 7 1 .. 4 0 .. 3 chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 649 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.4.4.2 special system operating modes the mscan module behaves as described within this speci?ation in all special system operating modes. write restrictions which exist on speci? registers in normal modes are lifted for test purposes in special modes. 16.4.4.3 emulation modes in all emulation modes, the mscan module behaves just like in normal system operating modes as described within this speci?ation. 16.4.4.4 listen-only mode in an optional can bus monitoring mode (listen-only), the can node is able to receive valid data frames and valid remote frames, but it sends only ?ecessive?bits on the can bus. in addition, it cannot start a transmission. if the mac sub-layer is required to send a ?ominant bit (ack bit, overload ?g, or active error ?g), the bit is rerouted internally so that the mac sub-layer monitors this ?ominant?bit, although the can bus may remain in recessive state externally. 16.4.4.5 mscan initialization mode the mscan enters initialization mode when it is enabled (cane=1). when entering initialization mode during operation, any on-going transmission or reception is immediately aborted and synchronization to the can bus is lost, potentially causing can protocol violations. to protect the can bus system from fatal consequences of violations, the mscan immediately drives txcan into a recessive state. note the user is responsible for ensuring that the mscan is not active when initialization mode is entered. the recommended procedure is to bring the mscan into sleep mode (slprq = 1 and slpak = 1) before setting the initrq bit in the canctl0 register. otherwise, the abort of an on-going message can cause an error condition and can impact other can bus devices. in initialization mode, the mscan is stopped. however, interface registers remain accessible. this mode is used to reset the canctl0, canrflg, canrier, cantflg, cantier, cantarq, cantaak, and cantbsel registers to their default values. in addition, the mscan enables the con?uration of the canbtr0, canbtr1 bit timing registers; canidac; and the canidar, canidmr message ?ters. see section 16.3.2.1, ?scan control register 0 (canctl0) , for a detailed description of the initialization mode. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 650 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 16-45. initialization request/acknowledge cycle due to independent clock domains within the mscan, initrq must be synchronized to all domains by using a special handshake mechanism. this handshake causes additional synchronization delay (see figure 16-45 ). if there is no message transfer ongoing on the can bus, the minimum delay will be two additional bus clocks and three additional can clocks. when all parts of the mscan are in initialization mode, the initak ?g is set. the application software must use initak as a handshake indication for the request (initrq) to go into initialization mode. note the cpu cannot clear initrq before initialization mode (initrq = 1 and initak = 1) is active. 16.4.5 low-power options if the mscan is disabled (cane = 0), the mscan clocks are stopped for power saving. if the mscan is enabled (cane = 1), the mscan has two additional modes with reduced power consumption, compared to normal mode: sleep and power down mode. in sleep mode, power consumption is reduced by stopping all clocks except those to access the registers from the cpu side. in power down mode, all clocks are stopped and no power is consumed. table 16-38 summarizes the combinations of mscan and cpu modes. a particular combination of modes is entered by the given settings on the cswai and slprq/slpak bits. sync sync bus cloc k domain can cloc k domain cpu init request init flag initak flag initrq sync. initak sync. initrq initak chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 651 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.4.5.1 operation in run mode as shown in table 16-38 , only mscan sleep mode is available as low power option when the cpu is in run mode. 16.4.5.2 operation in wait mode the wai instruction puts the mcu in a low power consumption stand-by mode. if the cswai bit is set, additional power can be saved in power down mode because the cpu clocks are stopped. after leaving this power down mode, the mscan restarts and enters normal mode again. while the cpu is in wait mode, the mscan can be operated in normal mode and generate interrupts (registers can be accessed via background debug mode). 16.4.5.3 operation in stop mode the stop instruction puts the mcu in a low power consumption stand-by mode. in stop mode, the mscan is set in power down mode regardless of the value of the slprq/slpak and cswai bits ( table 16-38 ). 16.4.5.4 mscan normal mode this is a non-power-saving mode. enabling the mscan puts the module from disabled mode into normal mode. in this mode the module can either be in initialization mode or out of initialization mode. see section 16.4.4.5, ?scan initialization mode ? table 16-38. cpu vs. mscan operating modes cpu mode mscan mode normal reduced power consumption sleep power down disabled (cane=0) run cswai = x (1) slprq = 0 slpak = 0 1. ??means don? care. cswai = x slprq = 1 slpak = 1 cswai = x slprq = x slpak = x wait cswai = 0 slprq = 0 slpak = 0 cswai = 0 slprq = 1 slpak = 1 cswai = 1 slprq = x slpak = x cswai = x slprq = x slpak = x stop cswai = x slprq = x slpak = x cswai = x slprq = x slpak = x chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 652 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.4.5.5 mscan sleep mode the cpu can request the mscan to enter this low power mode by asserting the slprq bit in the canctl0 register. the time when the mscan enters sleep mode depends on a ?ed synchronization delay and its current activity: if there are one or more message buffers scheduled for transmission (txex = 0), the mscan will continue to transmit until all transmit message buffers are empty (txex = 1, transmitted successfully or aborted) and then goes into sleep mode. if the mscan is receiving, it continues to receive and goes into sleep mode as soon as the can bus next becomes idle. if the mscan is neither transmitting nor receiving, it immediately goes into sleep mode. figure 16-46. sleep request / acknowledge cycle note the application software must avoid setting up a transmission (by clearing one or more txex ?g(s)) and immediately request sleep mode (by setting slprq). whether the mscan starts transmitting or goes into sleep mode directly depends on the exact sequence of operations. if sleep mode is active, the slprq and slpak bits are set ( figure 16-46 ). the application software must use slpak as a handshake indication for the request (slprq) to go into sleep mode. when in sleep mode (slprq = 1 and slpak = 1), the mscan stops its internal clocks. however, clocks that allow register accesses from the cpu side continue to run. if the mscan is in bus-off state, it stops counting the 128 occurrences of 11 consecutive recessive bits due to the stopped clocks. txcan remains in a recessive state. if rxf = 1, the message can be read and rxf can be cleared. shifting a new message into the foreground buffer of the receiver fifo (rxfg) does not take place while in sleep mode. it is possible to access the transmit buffers and to clear the associated txe ?gs. no message abort takes place while in sleep mode. sync sync bus cloc k domain can cloc k domain mscan in sleep mode cpu sleep request slprq flag slpak flag slprq sync. slpak sync. slprq slpak chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 653 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 if the wupe bit in canctl0 is not asserted, the mscan will mask any activity it detects on can. rxcan is therefore held internally in a recessive state. this locks the mscan in sleep mode. wupe must be set before entering sleep mode to take effect. the mscan is able to leave sleep mode (wake up) only when: can bus activity occurs and wupe = 1 or the cpu clears the slprq bit note the cpu cannot clear the slprq bit before sleep mode (slprq = 1 and slpak = 1) is active. after wake-up, the mscan waits for 11 consecutive recessive bits to synchronize to the can bus. as a consequence, if the mscan is woken-up by a can frame, this frame is not received. the receive message buffers (rxfg and rxbg) contain messages if they were received before sleep mode was entered. all pending actions will be executed upon wake-up; copying of rxbg into rxfg, message aborts and message transmissions. if the mscan remains in bus-off state after sleep mode was exited, it continues counting the 128 occurrences of 11 consecutive recessive bits. 16.4.5.6 mscan power down mode the mscan is in power down mode ( table 16-38 ) when cpu is in stop mode or cpu is in wait mode and the cswai bit is set when entering the power down mode, the mscan immediately stops all ongoing transmissions and receptions, potentially causing can protocol violations. to protect the can bus system from fatal consequences of violations to the above rule, the mscan immediately drives txcan into a recessive state. note the user is responsible for ensuring that the mscan is not active when power down mode is entered. the recommended procedure is to bring the mscan into sleep mode before the stop or wai instruction (if cswai is set) is executed. otherwise, the abort of an ongoing message can cause an error condition and impact other can bus devices. in power down mode, all clocks are stopped and no registers can be accessed. if the mscan was not in sleep mode before power down mode became active, the module performs an internal recovery cycle after powering up. this causes some ?ed delay before the module enters normal mode again. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 654 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.4.5.7 disabled mode the mscan is in disabled mode out of reset (cane=0). all module clocks are stopped for power saving, however the register map can still be accessed as speci?d. 16.4.5.8 programmable wake-up function the mscan can be programmed to wake up from sleep or power down mode as soon as can bus activity is detected (see control bit wupe in mscan control register 0 (canctl0). the sensitivity to existing can bus action can be modi?d by applying a low-pass ?ter function to the rxcan input line (see control bit wupm in section 16.3.2.2, ?scan control register 1 (canctl1) ?. this feature can be used to protect the mscan from wake-up due to short glitches on the can bus lines. such glitches can result from?or example?lectromagnetic interference within noisy environments. 16.4.6 reset initialization the reset state of each individual bit is listed in section 16.3.2, ?egister descriptions , which details all the registers and their bit-?lds. 16.4.7 interrupts this section describes all interrupts originated by the mscan. it documents the enable bits and generated ?gs. each interrupt is listed and described separately. 16.4.7.1 description of interrupt operation the mscan supports four interrupt vectors (see table 16-39 ), any of which can be individually masked (for details see section 16.3.2.6, ?scan receiver interrupt enable register (canrier) ?to section 16.3.2.8, ?scan transmitter interrupt enable register (cantier) ?. refer to the device overview section to determine the dedicated interrupt vector addresses. 16.4.7.2 transmit interrupt at least one of the three transmit buffers is empty (not scheduled) and can be loaded to schedule a message for transmission. the txex ?g of the empty message buffer is set. table 16-39. interrupt vectors interrupt source ccr mask local enable wake-up interrupt (wupif) i bit canrier (wupie) error interrupts interrupt (cscif, ovrif) i bit canrier (cscie, ovrie) receive interrupt (rxf) i bit canrier (rxfie) transmit interrupts (txe[2:0]) i bit cantier (txeie[2:0]) chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 655 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.4.7.3 receive interrupt a message is successfully received and shifted into the foreground buffer (rxfg) of the receiver fifo. this interrupt is generated immediately after receiving the eof symbol. the rxf ?g is set. if there are multiple messages in the receiver fifo, the rxf ?g is set as soon as the next message is shifted to the foreground buffer. 16.4.7.4 wake-up interrupt a wake-up interrupt is generated if activity on the can bus occurs during mscan sleep or power-down mode. note this interrupt can only occur if the mscan was in sleep mode (slprq = 1 and slpak = 1) before entering power down mode, the wake-up option is enabled (wupe = 1), and the wake-up interrupt is enabled (wupie = 1). 16.4.7.5 error interrupt an error interrupt is generated if an overrun of the receiver fifo, error, warning, or bus-off condition occurrs. mscan receiver flag register (canrflg) indicates one of the following conditions: overrun an overrun condition of the receiver fifo as described in section 16.4.2.3, ?eceive structures , occurred. can status change ?the actual value of the transmit and receive error counters control the can bus state of the mscan. as soon as the error counters skip into a critical range (tx/rx- warning, tx/rx-error, bus-off) the mscan ?gs an error condition. the status change, which caused the error condition, is indicated by the tstat and rstat ?gs (see section 16.3.2.5, ?scan receiver flag register (canrflg) ?and section 16.3.2.6, ?scan receiver interrupt enable register (canrier) ?. 16.4.7.6 interrupt acknowledge interrupts are directly associated with one or more status ?gs in either the mscan receiver flag register (canrflg) or the mscan transmitter flag register (cantflg). interrupts are pending as long as one of the corresponding ?gs is set. the ?gs in canrflg and cantflg must be reset within the interrupt handler to handshake the interrupt. the ?gs are reset by writing a 1 to the corresponding bit position. a ?g cannot be cleared if the respective condition prevails. note it must be guaranteed that the cpu clears only the bit causing the current interrupt. for this reason, bit manipulation instructions (bset) must not be used to clear interrupt ?gs. these instructions may cause accidental clearing of interrupt ?gs which are set after entering the current interrupt service routine. chapter 16 freescale s scalable controller area network (s12mscanv3) mc9s12xe-family reference manual , rev. 1.21 656 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16.5 initialization/application information 16.5.1 mscan initialization the procedure to initially start up the mscan module out of reset is as follows: 1. assert cane 2. write to the con?uration registers in initialization mode 3. clear initrq to leave initialization mode if the con?uration of registers which are only writable in initialization mode shall be changed: 1. bring the module into sleep mode by setting slprq and awaiting slpak to assert after the can bus becomes idle. 2. enter initialization mode: assert initrq and await initak 3. write to the con?uration registers in initialization mode 4. clear initrq to leave initialization mode and continue 16.5.2 bus-off recovery the bus-off recovery is user con?urable. the bus-off state can either be left automatically or on user request. for reasons of backwards compatibility, the mscan defaults to automatic recovery after reset. in this case, the mscan will become error active again after counting 128 occurrences of 11 consecutive recessive bits on the can bus (see the bosch can speci?ation for details). if the mscan is con?ured for user request (borm set in mscan control register 1 (canctl1)), the recovery from bus-off starts after both independent events have become true: 128 occurrences of 11 consecutive recessive bits on the can bus have been monitored bohold in mscan miscellaneous register (canmisc) has been cleared by the user these two events may occur in any order. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 657 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 17 periodic interrupt timer (s12pit24b8cv2) 17.1 introduction the period interrupt timer (pit) is an array of 24-bit timers that can be used to trigger peripheral modules or raise periodic interrupts. refer to figure 17-1 for a simpli?d block diagram. 17.1.1 glossary 17.1.2 features the pit includes these features: eight timers implemented as modulus down-counters with independent time-out periods. time-out periods selectable between 1 and 2 24 bus clock cycles. time-out equals m*n bus clock cycles with 1 <= m <= 256 and 1 <= n <= 65536. timers that can be enabled individually. eight time-out interrupts. eight time-out trigger output signals available to trigger peripheral modules. start of timer channels can be aligned to each other. 17.1.3 modes of operation refer to the device overview for a detailed explanation of the chip modes. table 17-1. revision history revision number revisiondate sections affected description of changes v01.00 28 apr 2005 - initial release. v01.01 05 jul 2005 17.6/17-672 - added application section. - removed table 1-1. acronyms and abbreviations pit periodic interrupt timer isr interrupt service routine ccr condition code register soc system on chip micro time bases clock periods of the 16-bit timer modulus down-counters, which are generated by the 8-bit modulus down-counters. chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 658 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 run mode this is the basic mode of operation. wait mode pit operation in wait mode is controlled by the pitswai bit located in the pitcflmt register. in wait mode, if the bus clock is globally enabled and if the pitswai bit is clear, the pit operates like in run mode. in wait mode, if the pitswai bit is set, the pit module is stalled. stop mode in full stop mode or pseudo stop mode, the pit module is stalled. freeze mode pit operation in freeze mode is controlled by the pitfrz bit located in the pitcflmt register. in freeze mode, if the pitfrz bit is clear, the pit operates like in run mode. in freeze mode, if the pitfrz bit is set, the pit module is stalled. 17.1.4 block diagram figure 17-1 shows a block diagram of the pit module. figure 17-1. pit24b8c block diagram 17.2 external signal description the pit module has no external pins. time-out 0 time-out 1 time-out 2 time-out 3 16-bit timer 1 16-bit timer 3 16-bit timer 0 16-bit timer 2 bus clock micro time base 0 micro time base 1 interrupt 0 trigger 0 interface interrupt 1 trigger 1 interface interrupt 2 trigger 2 interface interrupt 3 trigger 3 interface 8-bit micro timer 0 8-bit micro timer 1 time-out 4 time-out 5 time-out 6 time-out 7 16-bit timer 5 16-bit timer 7 16-bit timer 4 16-bit timer 6 interrupt 4 trigger 4 interface interrupt 5 trigger 5 interface interrupt 6 trigger 6 interface interrupt 7 trigger 7 interface chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 659 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.3 register de?ition this section consists of register descriptions in address order of the pit. each description includes a standard register diagram with an associated ?ure number. details of register bit and ?ld function follow the register diagrams, in bit order. register name bit 7 6 5 4 3 2 1 bit 0 0x0000 pitcflmt r pite pitswai pitfrz 00000 w pflmt1 pflmt0 0x0001 pitflt r00000000 w pflt7 pflt6 pflt5 pflt4 pflt3 pflt2 pflt1 pflt0 0x0002 pitce r pce7 pce6 pce5 pce4 pce3 pce2 pce1 pce0 w 0x0003 pitmux r pmux7 pmux6 pmux5 pmux4 pmux3 pmux2 pmux1 pmux0 w 0x0004 pitinte r pinte7 pinte6 pinte5 pinte4 pinte3 pinte2 pinte1 pinte0 w 0x0005 pittf r ptf7 ptf6 ptf5 ptf4 ptf3 ptf2 ptf1 ptf0 w 0x0006 pitmtld0 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w 0x0007 pitmtld1 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w 0x0008 pitld0 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0009 pitld0 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x000a pitcnt0 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x000b pitcnt0 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x000c pitld1 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w = unimplemented or reserved figure 17-2. pit register summary (sheet 1 of 3) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 660 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x000d pitld1 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x000e pitcnt1 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x000f pitcnt1 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0010 pitld2 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0011 pitld2 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0012 pitcnt2 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0013 pitcnt2 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0014 pitld3 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0015 pitld3 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0016 pitcnt3 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0017 pitcnt3 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0018 pitld4 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0019 pitld4 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x001a pitcnt4 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x001b pitcnt4 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 17-2. pit register summary (sheet 2 of 3) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 661 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x001c pitld5 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x001d pitld5 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x001e pitcnt5 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x001f pitcnt5 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0020 pitld6 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0021 pitld6 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0022 pitcnt6 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0023 pitcnt6 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0024 pitld7 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0025 pitld7 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0026 pitcnt7 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0027 pitcnt7 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 17-2. pit register summary (sheet 3 of 3) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 662 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.3.0.1 pit control and force load micro timer register (pitcflmt) read: anytime write: anytime; writes to the reserved bits have no effect 17.3.0.2 pit force load timer register (pitflt) read: anytime write: anytime module base + 0x0000 76543210 r pite pitswai pitfrz 00000 w pflmt1 pflmt0 reset 0 0 0 00000 = unimplemented or reserved figure 17-3. pit control and force load micro timer register (pitcflmt) table 17-2. pitcflmt field descriptions field description 7 pite pit module enable bit ?this bit enables the pit module. if pite is cleared, the pit module is disabled and ?g bits in the pittf register are cleared. when pite is set, individually enabled timers (pce set) start down- counting with the corresponding load register values. 0 pit disabled (lower power consumption). 1 pit is enabled. 6 pitswai pit stop in wait mode bit ?this bit is used for power conservation while in wait mode. 0 pit operates normally in wait mode 1 pit clock generation stops and freezes the pit module when in wait mode 5 pitfrz pit counter freeze while in freeze mode bit ?when during debugging a breakpoint (freeze mode) is encountered it is useful in many cases to freeze the pit counters to avoid e.g. interrupt generation. the pitfrz bit controls the pit operation while in freeze mode. 0 pit operates normally in freeze mode 1 pit counters are stalled when in freeze mode 1:0 pflmt[1:0] pit force load bits for micro timer 1:0 these bits have only an effect if the corresponding micro timer is active and if the pit module is enabled (pite set). writing a one into a pflmt bit loads the corresponding 8-bit micro timer load register into the 8-bit micro timer down-counter. writing a zero has no effect. reading these bits will always return zero. note: a micro timer force load affects all timer channels that use the corresponding micro time base. module base + 0x0001 76543210 r00000000 w pflt7 pflt6 pflt5 pflt4 pflt3 pflt2 pflt1 pflt0 reset 0 0 0 00000 figure 17-4. pit force load timer register (pitflt) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 663 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.3.0.3 pit channel enable register (pitce) read: anytime write: anytime 17.3.0.4 pit multiplex register (pitmux) read: anytime write: anytime table 17-3. pitflt field descriptions field description 7:0 pflt[7:0] pit force load bits for timer 7-0 ?these bits have only an effect if the corresponding timer channel (pce set) is enabled and if the pit module is enabled (pite set). writing a one into a pflt bit loads the corresponding 16-bit timer load register into the 16-bit timer down-counter. writing a zero has no effect. reading these bits will always return zero. module base + 0x0002 76543210 r pce7 pce6 pce5 pce4 pce3 pce2 pce1 pce0 w reset 0 0 0 00000 figure 17-5. pit channel enable register (pitce) table 17-4. pitce field descriptions field description 7:0 pce[7:0] pit enable bits for timer channel 7:0 ?these bits enable the pit channels 7-0. if pce is cleared, the pit channel is disabled and the corresponding ?g bit in the pittf register is cleared. when pce is set, and if the pit module is enabled (pite = 1) the 16-bit timer counter is loaded with the start count value and starts down- counting. 0 the corresponding pit channel is disabled. 1 the corresponding pit channel is enabled. module base + 0x0003 76543210 r pmux7 pmux6 pmux5 pmux4 pmux3 pmux2 pmux1 pmux0 w reset 0 0 0 00000 figure 17-6. pit multiplex register (pitmux) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 664 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.3.0.5 pit interrupt enable register (pitinte) read: anytime write: anytime 17.3.0.6 pit time-out flag register (pittf) read: anytime write: anytime (write to clear) table 17-5. pitmux field descriptions field description 7:0 pmux[7:0] pit multiplex bits for timer channel 7:0 these bits select if the corresponding 16-bit timer is connected to micro time base 1 or 0. if pmux is modi?d, the corresponding 16-bit timer is immediately switched to the other micro time base. 0 the corresponding 16-bit timer counts with micro time base 0. 1 the corresponding 16-bit timer counts with micro time base 1. module base + 0x0004 76543210 r pinte7 pinte6 pinte5 pinte4 pinte3 pinte2 pinte1 pinte0 w reset 0 0 0 00000 figure 17-7. pit interrupt enable register (pitinte) table 17-6. pitinte field descriptions field description 7:0 pinte[7:0] pit time-out interrupt enable bits for timer channel 7:0 ?these bits enable an interrupt service request whenever the time-out ?g ptf of the corresponding pit channel is set. when an interrupt is pending (ptf set) enabling the interrupt will immediately cause an interrupt. to avoid this, the corresponding ptf ?g has to be cleared ?st. 0 interrupt of the corresponding pit channel is disabled. 1 interrupt of the corresponding pit channel is enabled. module base + 0x0005 76543210 r ptf7 ptf6 ptf5 ptf4 ptf3 ptf2 ptf1 ptf0 w reset 0 0 0 00000 figure 17-8. pit time-out flag register (pittf) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 665 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.3.0.7 pit micro timer load register 0 to 1 (pitmtld0?) read: anytime write: anytime 17.3.0.8 pit load register 0 to 7 (pitld0?) table 17-7. pittf field descriptions field description 7:0 ptf[7:0] pit time-out flag bits for timer channel 7:0 ?ptf is set when the corresponding 16-bit timer modulus down-counter and the selected 8-bit micro timer modulus down-counter have counted to zero. the ?g can be cleared by writing a one to the ?g bit. writing a zero has no effect. if ?g clearing by writing a one and ?g setting happen in the same bus clock cycle, the ?g remains set. the ?g bits are cleared if the pit module is disabled or if the corresponding timer channel is disabled. 0 time-out of the corresponding pit channel has not yet occurred. 1 time-out of the corresponding pit channel has occurred. module base + 0x0006 76543210 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w reset 0 0 0 00000 figure 17-9. pit micro timer load register 0 (pitmtld0) module base + 0x0007 76543210 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w reset 0 0 0 00000 figure 17-10. pit micro timer load register 1 (pitmtld1) table 17-8. pitmtld0? field descriptions field description 7:0 pmtld[7:0] pit micro timer load bits 7:0 these bits set the 8-bit modulus down-counter load value of the micro timers. writing a new value into the pitmtld register will not restart the timer. when the micro timer has counted down to zero, the pmtld register value will be loaded. the pflmt bits in the pitcflmt register can be used to immediately update the count register with the new value if an immediate load is desired. module base + 0x0008, 0x0009 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-11. pit load register 0 (pitld0) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 666 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 module base + 0x000c, 0x000d 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-12. pit load register 1 (pitld1) module base + 0x0010, 0x0011 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-13. pit load register 2 (pitld2) module base + 0x0014, 0x0015 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-14. pit load register 3 (pitld3) module base + 0x0018, 0x0019 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-15. pit load register 4 (pitld4) module base + 0x001c, 0x001d 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-16. pit load register 5 (pitld5) module base + 0x0020, 0x0021 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-17. pit load register 6 (pitld6) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 667 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime 17.3.0.9 pit count register 0 to 7 (pitcnt0?) module base + 0x0024, 0x0025 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 17-18. pit load register 7 (pitld7) table 17-9. pitld0? field descriptions field description 15:0 pld[15:0] pit load bits 15:0 these bits set the 16-bit modulus down-counter load value. writing a new value into the pitld register must be a 16-bit access, to ensure data consistency. it will not restart the timer. when the timer has counted down to zero the ptf time-out ?g will be set and the register value will be loaded. the pflt bits in the pitflt register can be used to immediately update the count register with the new value if an immediate load is desired. module base + 0x000a, 0x000b 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-19. pit count register 0 (pitcnt0) module base + 0x000e, 0x000f 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-20. pit count register 1 (pitcnt1) module base + 0x0012, 0x0013 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-21. pit count register 2 (pitcnt2) chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 668 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: has no meaning or effect module base + 0x0016, 0x0017 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-22. pit count register 3 (pitcnt3) module base + 0x001a, 0x001b 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-23. pit count register 4 (pitcnt4) module base + 0x001e, 0x001f 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-24. pit count register 5 (pitcnt5) module base + 0x0022, 0x0023 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-25. pit count register 6 (pitcnt6) module base + 0x0026, 0x0027 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 17-26. pit count register 7 (pitcnt7) table 17-10. pitcnt0? field descriptions field description 15:0 pcnt[15:0] pit count bits 15-0 ?these bits represent the current 16-bit modulus down-counter value. the read access for the count register must take place in one clock cycle as a 16-bit access. chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 669 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.4 functional description figure 17-27 shows a detailed block diagram of the pit module. the main parts of the pit are status, control and data registers, two 8-bit down-counters, eight 16-bit down-counters and an interrupt/trigger interface. figure 17-27. pit24b8c detailed block diagram pitmld0 register 8-bit micro timer 0 pitcflmt register pitld0 register pitmld1 register 8-bit micro timer 1 pitmux register pitcnt0 register timer 0 pmux0 pflt0 8 8 pittf register pitinte register interrupt / hardware trigger 8 interrupt request 8 pitld1 register pitcnt1 register timer 1 [1] pflt1 pitld2 register pitcnt2 register timer 2 [2] pflt2 pitld3 register pitcnt3 register timer 3 pflt3 time-out 0 pflmt [1] [0] pmux trigger interface bus clock pit24b8c [3] pitld4 register pitcnt4 register timer 4 pflt4 time- [4] pitld5 register pitcnt5 register timer 5 pflt5 time-out 5 [5] pitld6 register pitcnt6 register timer 6 pflt6 time-out 6 [6] pitld7 register pitcnt7 register timer 7 pflt7 time-out 7 [7] pmux7 out 4 time- out 3 time-out 2 time-out 1 pitflt register chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 670 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.4.1 timer as shown in figure 17-1 and figure 17-27 , the 24-bit timers are built in a two-stage architecture with eight 16-bit modulus down-counters and two 8-bit modulus down-counters. the 16-bit timers are clocked with two selectable micro time bases which are generated with 8-bit modulus down-counters. each 16-bit timer is connected to micro time base 0 or 1 via the pmux[7:0] bit setting in the pit multiplex (pitmux) register. a timer channel is enabled if the module enable bit pite in the pit control and force load micro timer (pitcflmt) register is set and if the corresponding pce bit in the pit channel enable (pitce) register is set. two 8-bit modulus down-counters are used to generate two micro time bases. as soon as a micro time base is selected for an enabled timer channel, the corresponding micro timer modulus down-counter will load its start value as speci?d in the pitmtld0 or pitmtld1 register and will start down-counting. whenever the micro timer down-counter has counted to zero the pitmtld register is reloaded and the connected 16-bit modulus down-counters count one cycle. whenever a 16-bit timer counter and the connected 8-bit micro timer counter have counted to zero, the pitld register is reloaded and the corresponding time-out ?g ptf in the pit time-out ?g (pittf) register is set, as shown in figure 17-28 . the time-out period is a function of the timer load (pitld) and micro timer load (pitmtld) registers and the bus clock f bus : time-out period = (pitmtld + 1) * (pitld + 1) / f bus . for example, for a 40 mhz bus clock, the maximum time-out period equals: 256 * 65536 * 25 ns = 419.43 ms. the current 16-bit modulus down-counter value can be read via the pitcnt register. the micro timer down-counter values cannot be read. the 8-bit micro timers can individually be restarted by writing a one to the corresponding force load micro timer pflmt bits in the pit control and force load micro timer (pitcflmt) register. the 16-bit timers can individually be restarted by writing a one to the corresponding force load timer pflt bits in the pit forceload timer (pitflt) register. if desired, any group of timers and micro timers can be restarted at the same time by using one 16-bit write to the adjacent pitcflmt and pitflt registers with the relevant bits set, as shown in figure 17-28 . chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 671 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 17-28. pit trigger and flag signal timing 17.4.2 interrupt interface each time-out event can be used to trigger an interrupt service request. for each timer channel, an individual bit pinte in the pit interrupt enable (pitinte) register exists to enable this feature. if pinte is set, an interrupt service is requested whenever the corresponding time-out ?g ptf in the pit time-out ?g (pittf) register is set. the ?g can be cleared by writing a one to the ?g bit. note be careful when resetting the pite, pinte or pitce bits in case of pending pit interrupt requests, to avoid spurious interrupt requests. 17.4.3 hardware trigger the pit module contains eight hardware trigger signal lines pittrig[7:0], one for each timer channel. these signals can be connected on soc level to peripheral modules enabling e.g. periodic atd conversion (please refer to the device overview for the mapping of pittrig[7:0] signals to peripheral modules). whenever a timer channel time-out is reached, the corresponding ptf ?g is set and the corresponding trigger signal pittrig triggers a rising edge. the trigger feature requires a minimum time-out period of two bus clock cycles because the trigger is asserted high for at least one bus clock cycle. for load register values pitld = 0x0001 and pitmtld = 0x0002 the ?g setting, trigger timing and a restart with force load is shown in figure 17-28 . bus clock 02 1 0 8-bit micro 2 1 0 2 1 0 2 1 2 1 0 pitcnt register 0001 0000 00 0001 0000 8-bit force load 2 1 0 2 1 0 ptf flag 1 pittrig 16-bit force load 0001 0000 0001 2 time-out period time-out period after restart timer counter note 1. the ptf ?g clearing depends on the software chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 672 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 17.5 initialization 17.5.1 startup set the con?uration registers before the pite bit in the pitcflmt register is set. before pite is set, the con?uration registers can be written in arbitrary order. 17.5.2 shutdown when the pitce register bits, the pitinte register bits or the pite bit in the pitcflmt register are cleared, the corresponding pit interrupt ?gs are cleared. in case of a pending pit interrupt request, a spurious interrupt can be generated. two strategies, which avoid spurious interrupts, are recommended: 1. reset the pit interrupt ?gs only in an isr. when entering the isr, the i mask bit in the ccr is set automatically. the i mask bit must not be cleared before the pit interrupt ?gs are cleared. 2. after setting the i mask bit with the sei instruction, the pit interrupt ?gs can be cleared. then clear the i mask bit with the cli instruction to re-enable interrupts. 17.5.3 flag clearing a ?g is cleared by writing a one to the ?g bit. always use store or move instructions to write a one in certain bit positions. do not use the bset instructions. do not use any c-constructs that compile to bset instructions. ?set ?g_register, #mask?must not be used for ?g clearing because bset is a read- modify-write instruction which writes back the ?it-wise or?of the ?g_register and the mask into the ?g_register. bset would clear all ?g bits that were set, independent from the mask. for example, to clear ?g bit 0 use: movb #$01,pittf. 17.6 application information to get started quickly with the pit24b8c module this section provides a small code example how to use the block. please note that the example provided is only one speci? case out of the possible con?urations and implementations. functionality: generate an pit interrupt on channel 0 every 500 pit clock cycles. org codestart ; place the program into speci? ; range (to be selected) lds ramend ; load stack pointer to top of ram movw #ch0_isr,vec_pit_ch0 ; change value of channel 0 isr adr ; ******************** start pit initialization ******************************************************* clr pitcflmt ; disable pit movb #$01,pitce ; enable timer channel 0 clr pitmux ; ch0 connected to micro timer 0 movb #$63,pitmtld0 ; micro time base 0 equals 100 clock cycles movw #$0004,pitld0 ; time base 0 eq. 5 micro time bases 0 =5*100 = 500 chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 673 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 movb #$01,pitinte ; enable interupt channel 0 movb #$80,pitcflmt ; enable pit cli ; clear interupt disable mask bit ;******************** main program ************************************************************* main: bra * ; loop until interrupt ;******************** channel 0 interupt routine *************************************************** ch0_isr: ldaa pittf ; 8 bit read of pit time out ?gs movb #$01,pittf ; clear pit channel 0 time out ?g rti ; return to main chapter 17 periodic interrupt timer (s12pit24b8cv2) mc9s12xe-family reference manual , rev. 1.21 674 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 675 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 18 periodic interrupt timer (s12pit24b4cv2) 18.1 introduction the period interrupt timer (pit) is an array of 24-bit timers that can be used to trigger peripheral modules or raise periodic interrupts. refer to figure 18-1 for a simpli?d block diagram. 18.1.1 glossary 18.1.2 features the pit includes these features: four timers implemented as modulus down-counters with independent time-out periods. time-out periods selectable between 1 and 2 24 bus clock cycles. time-out equals m*n bus clock cycles with 1 <= m <= 256 and 1 <= n <= 65536. timers that can be enabled individually. four time-out interrupts. four time-out trigger output signals available to trigger peripheral modules. start of timer channels can be aligned to each other. 18.1.3 modes of operation refer to the device overview for a detailed explanation of the chip modes. table 18-1. revision history revision number revision date sections affected description of changes v01.00 28 apr 2005 - initial release v01.01 05 jul 2005 18.6/18-688 - added application section. - removed table 1-1 acronyms and abbreviations pit periodic interrupt timer isr interrupt service routine ccr condition code register soc system on chip micro time bases clock periods of the 16-bit timer modulus down-counters, which are generated by the 8-bit modulus down-counters. chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual , rev. 1.21 676 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 run mode this is the basic mode of operation. wait mode pit operation in wait mode is controlled by the pitswai bit located in the pitcflmt register. in wait mode, if the bus clock is globally enabled and if the pitswai bit is clear, the pit operates like in run mode. in wait mode, if the pitswai bit is set, the pit module is stalled. stop mode in full stop mode or pseudo stop mode, the pit module is stalled. freeze mode pit operation in freeze mode is controlled by the pitfrz bit located in the pitcflmt register. in freeze mode, if the pitfrz bit is clear, the pit operates like in run mode. in freeze mode, if the pitfrz bit is set, the pit module is stalled. 18.1.4 block diagram figure 18-1 shows a block diagram of the pit module. figure 18-1. pit24b4c block diagram 18.2 external signal description the pit module has no external pins. 18.3 register de?ition this section consists of register descriptions in address order of the pit. each description includes a standard register diagram with an associated ?ure number. details of register bit and ?ld function follow the register diagrams, in bit order. time-out 0 time-out 1 time-out 2 time-out 3 16-bit timer 1 16-bit timer 3 16-bit timer 0 16-bit timer 2 bus clock micro time base 0 micro time base 1 interrupt 0 trigger 0 interface interrupt 1 trigger 1 interface interrupt 2 trigger 2 interface interrupt 3 trigger 3 interface 8-bit micro timer 0 8-bit micro timer 1 chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 677 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 register name bit 7 6 5 4 3 2 1 bit 0 0x0000 pitcflmt r pite pitswai pitfrz 00000 w pflmt1 pflmt0 0x0001 pitflt r00000000 w pflt3 pflt2 pflt1 pflt0 0x0002 pitce r0000 pce3 pce2 pce1 pce0 w 0x0003 pitmux r0000 pmux3 pmux2 pmux1 pmux0 w 0x0004 pitinte r0000 pinte3 pinte2 pinte1 pinte0 w 0x0005 pittf r0000 ptf3 ptf2 ptf1 ptf0 w 0x0006 pitmtld0 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w 0x0007 pitmtld1 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w 0x0008 pitld0 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0009 pitld0 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x000a pitcnt0 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x000b pitcnt0 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x000c pitld1 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x000d pitld1 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x000e pitcnt1 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w = unimplemented or reserved figure 18-2. pit register summary (sheet 1 of 2) chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual , rev. 1.21 678 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.3.0.1 pit control and force load micro timer register (pitcflmt) read: anytime write: anytime; writes to the reserved bits have no effect 0x000f pitcnt1 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0010 pitld2 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0011 pitld2 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0012 pitcnt2 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0013 pitcnt2 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0014 pitld3 (high) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0015 pitld3 (low) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0016 pitcnt3 (high) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0017 pitcnt3 (low) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0018 ? 0x0027 reserved r00000000 w module base + 0x0000 76543210 r pite pitswai pitfrz 00000 w pflmt1 pflmt0 reset 0 0 0 00000 = unimplemented or reserved figure 18-3. pit control and force load micro timer register (pitcflmt) register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 18-2. pit register summary (sheet 2 of 2) chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 679 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.3.0.2 pit force load timer register (pitflt) read: anytime write: anytime table 18-2. pitcflmt field descriptions field description 7 pite pit module enable bit ?this bit enables the pit module. if pite is cleared, the pit module is disabled and ?g bits in the pittf register are cleared. when pite is set, individually enabled timers (pce set) start down- counting with the corresponding load register values. 0 pit disabled (lower power consumption). 1 pit is enabled. 6 pitswai pit stop in wait mode bit ?this bit is used for power conservation while in wait mode. 0 pit operates normally in wait mode 1 pit clock generation stops and freezes the pit module when in wait mode 5 pitfrz pit counter freeze while in freeze mode bit ?when during debugging a breakpoint (freeze mode) is encountered it is useful in many cases to freeze the pit counters to avoid e.g. interrupt generation. the pitfrz bit controls the pit operation while in freeze mode. 0 pit operates normally in freeze mode 1 pit counters are stalled when in freeze mode 1:0 pflmt[1:0] pit force load bits for micro timer 1:0 these bits have only an effect if the corresponding micro timer is active and if the pit module is enabled (pite set). writing a one into a pflmt bit loads the corresponding 8-bit micro timer load register into the 8-bit micro timer down-counter. writing a zero has no effect. reading these bits will always return zero. note: a micro timer force load affects all timer channels that use the corresponding micro time base. module base + 0x0001 76543210 r00000000 w pflt3 pflt2 pflt1 pflt0 reset 0 0 0 00000 figure 18-4. pit force load timer register (pitflt) table 18-3. pitflt field descriptions field description 3:0 pflt[3:0] pit force load bits for timer 3-0 ?these bits have only an effect if the corresponding timer channel (pce set) is enabled and if the pit module is enabled (pite set). writing a one into a pflt bit loads the corresponding 16-bit timer load register into the 16-bit timer down-counter. writing a zero has no effect. reading these bits will always return zero. chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual , rev. 1.21 680 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.3.0.3 pit channel enable register (pitce) read: anytime write: anytime module base + 0x0002 76543210 r0000 pce3 pce2 pce1 pce0 w reset 0 0 0 00000 figure 18-5. pit channel enable register (pitce) table 18-4. pitce field descriptions field description 3:0 pce[3:0] pit enable bits for timer channel 3:0 ?these bits enable the pit channels 3-0. if pce is cleared, the pit channel is disabled and the corresponding ?g bit in the pittf register is cleared. when pce is set, and if the pit module is enabled (pite = 1) the 16-bit timer counter is loaded with the start count value and starts down- counting. 0 the corresponding pit channel is disabled. 1 the corresponding pit channel is enabled. chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 681 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.3.0.4 pit multiplex register (pitmux) read: anytime write: anytime 18.3.0.5 pit interrupt enable register (pitinte) read: anytime write: anytime module base + 0x0003 76543210 r0000 pmux3 pmux2 pmux1 pmux0 w reset 0 0 0 00000 figure 18-6. pit multiplex register (pitmux) table 18-5. pitmux field descriptions field description 3:0 pmux[3:0] pit multiplex bits for timer channel 3:0 these bits select if the corresponding 16-bit timer is connected to micro time base 1 or 0. if pmux is modi?d, the corresponding 16-bit timer is switched to the other micro time base immediately. 0 the corresponding 16-bit timer counts with micro time base 0. 1 the corresponding 16-bit timer counts with micro time base 1. module base + 0x0004 76543210 r0000 pinte3 pinte2 pinte1 pinte0 w reset 0 0 0 00000 figure 18-7. pit interrupt enable register (pitinte) table 18-6. pitinte field descriptions field description 3:0 pinte[3:0] pit time-out interrupt enable bits for timer channel 3:0 ?these bits enable an interrupt service request whenever the time-out ?g ptf of the corresponding pit channel is set. when an interrupt is pending (ptf set) enabling the interrupt will immediately cause an interrupt. to avoid this, the corresponding ptf ?g has to be cleared ?st. 0 interrupt of the corresponding pit channel is disabled. 1 interrupt of the corresponding pit channel is enabled. chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual , rev. 1.21 682 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.3.0.6 pit time-out flag register (pittf) read: anytime write: anytime (write to clear) 18.3.0.7 pit micro timer load register 0 to 1 (pitmtld0?) read: anytime write: anytime module base + 0x0005 76543210 r0000 ptf3 ptf2 ptf1 ptf0 w reset 0 0 0 00000 figure 18-8. pit time-out flag register (pittf) table 18-7. pittf field descriptions field description 3:0 ptf[3:0] pit time-out flag bits for timer channel 3:0 ?ptf is set when the corresponding 16-bit timer modulus down-counter and the selected 8-bit micro timer modulus down-counter have counted to zero. the ?g can be cleared by writing a one to the ?g bit. writing a zero has no effect. if ?g clearing by writing a one and ?g setting happen in the same bus clock cycle, the ?g remains set. the ?g bits are cleared if the pit module is disabled or if the corresponding timer channel is disabled. 0 time-out of the corresponding pit channel has not yet occurred. 1 time-out of the corresponding pit channel has occurred. module base + 0x0006 76543210 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w reset 0 0 0 00000 figure 18-9. pit micro timer load register 0 (pitmtld0) module base + 0x0007 76543210 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w reset 0 0 0 00000 figure 18-10. pit micro timer load register 1 (pitmtld1) chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 683 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.3.0.8 pit load register 0 to 3 (pitld0?) read: anytime write: anytime table 18-8. pitmtld0? field descriptions field description 7:0 pmtld[7:0] pit micro timer load bits 7:0 these bits set the 8-bit modulus down-counter load value of the micro timers. writing a new value into the pitmtld register will not restart the timer. when the micro timer has counted down to zero, the pmtld register value will be loaded. the pflmt bits in the pitcflmt register can be used to immediately update the count register with the new value if an immediate load is desired. module base + 0x0008, 0x0009 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 18-11. pit load register 0 (pitld0) module base + 0x000c, 0x000d 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 18-12. pit load register 1 (pitld1) module base + 0x0010, 0x0011 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 18-13. pit load register 2 (pitld2) module base + 0x0014, 0x0015 15 14 13 12 11 10 9876543210 r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w reset 000000 0000000000 figure 18-14. pit load register 3 (pitld3) chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual , rev. 1.21 684 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.3.0.9 pit count register 0 to 3 (pitcnt0?) read: anytime write: has no meaning or effect table 18-9. pitld0? field descriptions field description 15:0 pld[15:0] pit load bits 15:0 these bits set the 16-bit modulus down-counter load value. writing a new value into the pitld register must be a 16-bit access, to ensure data consistency. it will not restart the timer. when the timer has counted down to zero the ptf time-out ?g will be set and the register value will be loaded. the pflt bits in the pitflt register can be used to immediately update the count register with the new value if an immediate load is desired. module base + 0x000a, 0x000b 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 18-15. pit count register 0 (pitcnt0) module base + 0x000e, 0x000f 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 18-16. pit count register 1 (pitcnt1) module base + 0x0012, 0x0013 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 18-17. pit count register 2 (pitcnt2) module base + 0x0016, 0x0017 15 14 13 12 11 10 9876543210 r pcnt 15 pcnt 14 pcnt 13 pcnt 12 pcnt 11 pcnt 10 pcn t9 pcn t8 pcn t7 pcn t6 pcn t5 pcn t4 pcn t3 pcn t2 pcn t1 pcn t0 w reset 000000 0000000000 figure 18-18. pit count register 3 (pitcnt3) chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 685 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.4 functional description figure 18-19 shows a detailed block diagram of the pit module. the main parts of the pit are status, control and data registers, two 8-bit down-counters, four 16-bit down-counters and an interrupt/trigger interface. figure 18-19. pit24b4c detailed block diagram 18.4.1 timer as shown in figure 18-1 and figure 18-19 , the 24-bit timers are built in a two-stage architecture with four 16-bit modulus down-counters and two 8-bit modulus down-counters. the 16-bit timers are clocked with two selectable micro time bases which are generated with 8-bit modulus down-counters. each 16-bit timer is connected to micro time base 0 or 1 via the pmux[3:0] bit setting in the pit multiplex (pitmux) register. a timer channel is enabled if the module enable bit pite in the pit control and force load micro timer (pitcflmt) register is set and if the corresponding pce bit in the pit channel enable (pitce) register is set. two 8-bit modulus down-counters are used to generate two micro time bases. as soon as a micro time base is selected for an enabled timer channel, the corresponding micro timer modulus down-counter will load its start value as speci?d in the pitmtld0 or pitmtld1 register and will start down-counting. table 18-10. pitcnt0? field descriptions field description 15:0 pcnt[15:0] pit count bits 15-0 ?these bits represent the current 16-bit modulus down-counter value. the read access for the count register must take place in one clock cycle as a 16-bit access. pitmld0 register 8-bit micro timer 0 pitcflmt register pitld0 register pitmld1 register 8-bit micro timer 1 pitmux register pitcnt0 register timer 0 pmux0 pflt0 4 4 pittf register pitinte register interrupt / hardware trigger 4 interrupt request 4 pitld1 register pitcnt1 register timer 1 [1] pflt1 pitld2 register pitcnt2 register timer 2 [2] pflt2 pitld3 register pitcnt3 register timer 3 pflt3 time-out 0 pflmt [1] [0] pmux trigger interface bus clock pit24b4c [3] time- out 3 time-out 1 pitflt register time- out 3 chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual , rev. 1.21 686 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 whenever the micro timer down-counter has counted to zero the pitmtld register is reloaded and the connected 16-bit modulus down-counters count one cycle. whenever a 16-bit timer counter and the connected 8-bit micro timer counter have counted to zero, the pitld register is reloaded and the corresponding time-out ?g ptf in the pit time-out ?g (pittf) register is set, as shown in figure 18-20 . the time-out period is a function of the timer load (pitld) and micro timer load (pitmtld) registers and the bus clock f bus : time-out period = (pitmtld + 1) * (pitld + 1) / f bus . for example, for a 40 mhz bus clock, the maximum time-out period equals: 256 * 65536 * 25 ns = 419.43 ms. the current 16-bit modulus down-counter value can be read via the pitcnt register. the micro timer down-counter values cannot be read. the 8-bit micro timers can individually be restarted by writing a one to the corresponding force load micro timer pflmt bits in the pit control and force load micro timer (pitcflmt) register. the 16-bit timers can individually be restarted by writing a one to the corresponding force load timer pflt bits in the pit forceload timer (pitflt) register. if desired, any group of timers and micro timers can be restarted at the same time by using one 16-bit write to the adjacent pitcflmt and pitflt registers with the relevant bits set, as shown in figure 18-20 . figure 18-20. pit trigger and flag signal timing bus clock 02 1 0 8-bit micro 2 1 0 2 1 0 2 1 2 1 0 pitcnt register 0001 0000 00 0001 0000 8-bit force load 2 1 0 2 1 0 ptf flag 1 pittrig 16-bit force load 0001 0000 0001 2 time-out period time-out period after restart timer counter note 1. the ptf ?g clearing depends on the software chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 687 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 18.4.2 interrupt interface each time-out event can be used to trigger an interrupt service request. for each timer channel, an individual bit pinte in the pit interrupt enable (pitinte) register exists to enable this feature. if pinte is set, an interrupt service is requested whenever the corresponding time-out ?g ptf in the pit time-out ?g (pittf) register is set. the ?g can be cleared by writing a one to the ?g bit. note be careful when resetting the pite, pinte or pitce bits in case of pending pit interrupt requests, to avoid spurious interrupt requests. 18.4.3 hardware trigger the pit module contains four hardware trigger signal lines pittrig[3:0], one for each timer channel. these signals can be connected on soc level to peripheral modules enabling e.g. periodic atd conversion (please refer to the device overview for the mapping of pittrig[3:0] signals to peripheral modules). whenever a timer channel time-out is reached, the corresponding ptf ?g is set and the corresponding trigger signal pittrig triggers a rising edge. the trigger feature requires a minimum time-out period of two bus clock cycles because the trigger is asserted high for at least one bus clock cycle. for load register values pitld = 0x0001 and pitmtld = 0x0002 the ?g setting, trigger timing and a restart with force load is shown in figure 18-20 . 18.5 initialization 18.5.1 startup set the con?uration registers before the pite bit in the pitcflmt register is set. before pite is set, the con?uration registers can be written in arbitrary order. 18.5.2 shutdown when the pitce register bits, the pitinte register bits or the pite bit in the pitcflmt register are cleared, the corresponding pit interrupt ?gs are cleared. in case of a pending pit interrupt request, a spurious interrupt can be generated. two strategies, which avoid spurious interrupts, are recommended: 1. reset the pit interrupt ?gs only in an isr. when entering the isr, the i mask bit in the ccr is set automatically. the i mask bit must not be cleared before the pit interrupt ?gs are cleared. 2. after setting the i mask bit with the sei instruction, the pit interrupt ?gs can be cleared. then clear the i mask bit with the cli instruction to re-enable interrupts. 18.5.3 flag clearing a ?g is cleared by writing a one to the ?g bit. always use store or move instructions to write a one in certain bit positions. do not use the bset instructions. do not use any c-constructs that compile to bset instructions. ?set ?g_register, #mask?must not be used for ?g clearing because bset is a read- chapter 18 periodic interrupt timer (s12pit24b4cv2) mc9s12xe-family reference manual , rev. 1.21 688 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 modify-write instruction which writes back the ?it-wise or?of the ?g_register and the mask into the ?g_register. bset would clear all ?g bits that were set, independent from the mask. for example, to clear ?g bit 0 use: movb #$01,pittf. 18.6 application information to get started quickly with the pit24b4c module this section provides a small code example how to use the block. please note that the example provided is only one speci? case out of the possible con?urations and implementations. functionality: generate an pit interrupt on channel 0 every 500 pit clock cycles. org codestart ; place the program into speci? ; range (to be selected) lds ramend ; load stack pointer to top of ram movw #ch0_isr,vec_pit_ch0 ; change value of channel 0 isr adr ; ******************** start pit initialization ******************************************************* clr pitcflmt ; disable pit movb #$01,pitce ; enable timer channel 0 clr pitmux ; ch0 connected to micro timer 0 movb #$63,pitmtld0 ; micro time base 0 equals 100 clock cycles movw #$0004,pitld0 ; time base 0 eq. 5 micro time bases 0 =5*100 = 500 movb #$01,pitinte ; enable interupt channel 0 movb #$80,pitcflmt ; enable pit cli ; clear interupt disable mask bit ;******************** main program ************************************************************* main: bra * ; loop until interrupt ;******************** channel 0 interupt routine *************************************************** ch0_isr: ldaa pittf ; 8 bit read of pit time out ?gs movb #$01,pittf ; clear pit channel 0 time out ?g rti ; return to main mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 689 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 19 pulse-width modulator (s12pwm8b8cv1) 19.1 introduction the pwm de?ition is based on the hc12 pwm de?itions. it contains the basic features from the hc11 with some of the enhancements incorporated on the hc12: center aligned output mode and four available clock sources.the pwm module has eight channels with independent control of left and center aligned outputs on each channel. each of the eight channels has a programmable period and duty cycle as well as a dedicated counter. a ?xible clock select scheme allows a total of four different clock sources to be used with the counters. each of the modulators can create independent continuous waveforms with software-selectable duty rates from 0% to 100%. the pwm outputs can be programmed as left aligned outputs or center aligned outputs. 19.1.1 features the pwm block includes these distinctive features: eight independent pwm channels with programmable period and duty cycle dedicated counter for each pwm channel programmable pwm enable/disable for each channel software selection of pwm duty pulse polarity for each channel period and duty cycle are double buffered. change takes effect when the end of the effective period is reached (pwm counter reaches zero) or when the channel is disabled. programmable center or left aligned outputs on individual channels eight 8-bit channel or four 16-bit channel pwm resolution four clock sources (a, b, sa, and sb) provide for a wide range of frequencies programmable clock select logic emergency shutdown table 19-1. revision history revision number revision date sections affected description of changes v01.17 08-01-2004 19.6/19-719 19.3.2.15/19- 706 - added clari?ation of pwmif operation in stop and wait mode. - added notes on minimum pulse width of emergency shutdown signal. chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 690 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.1.2 modes of operation there is a software programmable option for low power consumption in wait mode that disables the input clock to the prescaler. in freeze mode there is a software programmable option to disable the input clock to the prescaler. this is useful for emulation. 19.1.3 block diagram figure 19-1 shows the block diagram for the 8-bit 8-channel pwm block. figure 19-1. pwm block diagram 19.2 external signal description the pwm module has a total of 8 external pins. period and duty counter channel 6 clock select pwm clock period and duty counter channel 5 period and duty counter channel 4 period and duty counter channel 3 period and duty counter channel 2 period and duty counter channel 1 alignment polarity control pwm8b8c pwm6 pwm5 pwm4 pwm3 pwm2 pwm1 enable pwm channels period and duty counter channel 7 period and duty counter channel 0 pwm0 pwm7 bus clock chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 691 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.2.1 pwm7 ?pwm channel 7 this pin serves as waveform output of pwm channel 7 and as an input for the emergency shutdown feature. 19.2.2 pwm6 ?pwm channel 6 this pin serves as waveform output of pwm channel 6. 19.2.3 pwm5 ?pwm channel 5 this pin serves as waveform output of pwm channel 5. 19.2.4 pwm4 ?pwm channel 4 this pin serves as waveform output of pwm channel 4. 19.2.5 pwm3 ?pwm channel 3 this pin serves as waveform output of pwm channel 3. 19.2.6 pwm3 ?pwm channel 2 this pin serves as waveform output of pwm channel 2. 19.2.7 pwm3 ?pwm channel 1 this pin serves as waveform output of pwm channel 1. 19.2.8 pwm3 ?pwm channel 0 this pin serves as waveform output of pwm channel 0. 19.3 memory map and register de?ition this section describes in detail all the registers and register bits in the pwm module. the special-purpose registers and register bit functions that are not normally available to device end users, such as factory test control registers and reserved registers, are clearly identi?d by means of shading the appropriate portions of address maps and register diagrams. notes explaining the reasons for restricting access to the registers and functions are also explained in the individual register descriptions. 19.3.1 module memory map this section describes the content of the registers in the pwm module. the base address of the pwm module is determined at the mcu level when the mcu is de?ed. the register decode map is ?ed and begins at the ?st address of the module address offset. the ?ure below shows the registers associated chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 692 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 with the pwm and their relative offset from the base address. the register detail description follows the order they appear in the register map. reserved bits within a register will always read as 0 and the write will be unimplemented. unimplemented functions are indicated by shading the bit. . note register address = base address + address offset, where the base address is de?ed at the mcu level and the address offset is de?ed at the module level. 19.3.2 register descriptions this section describes in detail all the registers and register bits in the pwm module. register name bit 7 6 5 4 3 2 1 bit 0 0x0000 pwme r pwme7 pwme6 pwme5 pwme4 pwme3 pwme2 pwme1 pwme0 w 0x0001 pwmpol r ppol7 ppol6 ppol5 ppol4 ppol3 ppol2 ppol1 ppol0 w 0x0002 pwmclk r pclk7 pclkl6 pclk5 pclk4 pclk3 pclk2 pclk1 pclk0 w 0x0003 pwmprclk r0 pckb2 pckb1 pckb0 0 pcka2 pcka1 pcka0 w 0x0004 pwmcae r cae7 cae6 cae5 cae4 cae3 cae2 cae1 cae0 w 0x0005 pwmctl r con67 con45 con23 con01 pswai pfrz 00 w 0x0006 pwmtst (1) r00 0 00000 w 0x0007 pwmprsc 1 r00 0 00000 w 0x0008 pwmscla r bit 7 6 5 4 3 2 1 bit 0 w 0x0009 pwmsclb r bit 7 6 5 4 3 2 1 bit 0 w = unimplemented or reserved figure 19-2. pwm register summary (sheet 1 of 3) chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 693 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x000a pwmscnta 1 r00 0 00000 w 0x000b pwmscntb 1 r00 0 00000 w 0x000c pwmcnt0 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x000d pwmcnt1 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x000e pwmcnt2 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x000f pwmcnt3 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x0010 pwmcnt4 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x0011 pwmcnt5 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x0012 pwmcnt6 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x0013 pwmcnt7 r bit 7 6 5 4 3 2 1 bit 0 w00 0 00000 0x0014 pwmper0 r bit 7 6 5 4 3 2 1 bit 0 w 0x0015 pwmper1 r bit 7 6 5 4 3 2 1 bit 0 w 0x0016 pwmper2 r bit 7 6 5 4 3 2 1 bit 0 w 0x0017 pwmper3 r bit 7 6 5 4 3 2 1 bit 0 w register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 19-2. pwm register summary (sheet 2 of 3) chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 694 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.3.2.1 pwm enable register (pwme) each pwm channel has an enable bit (pwmex) to start its waveform output. when any of the pwmex bits are set (pwmex = 1), the associated pwm output is enabled immediately. however, the actual pwm 0x0018 pwmper4 r bit 7 6 5 4 3 2 1 bit 0 w 0x0019 pwmper5 r bit 7 6 5 4 3 2 1 bit 0 w 0x001a pwmper6 r bit 7 6 5 4 3 2 1 bit 0 w 0x001b pwmper7 r bit 7 6 5 4 3 2 1 bit 0 w 0x001c pwmdty0 r bit 7 6 5 4 3 2 1 bit 0 w 0x001d pwmdty1 r bit 7 6 5 4 3 2 1 bit 0 w 0x001e pwmdty2 r bit 7 6 5 4 3 2 1 bit 0 w 0x001f pwmdty3 r bit 7 6 5 4 3 2 1 bit 0 w 0x0010 pwmdty4 r bit 7 6 5 4 3 2 1 bit 0 w 0x0021 pwmdty5 r bit 7 6 5 4 3 2 1 bit 0 w 0x0022 pwmdty6 r bit 7 6 5 4 3 2 1 bit 0 w 0x0023 pwmdty7 r bit 7 6 5 4 3 2 1 bit 0 w 0x0024 pwmsdn r pwmif pwmie 0 pwmlvl 0 pwm7in pwm7inl pwm7ena w pwmrstrt 1. intended for factory test purposes only. register name bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 19-2. pwm register summary (sheet 3 of 3) chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 695 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 waveform is not available on the associated pwm output until its clock source begins its next cycle due to the synchronization of pwmex and the clock source. note the ?st pwm cycle after enabling the channel can be irregular. an exception to this is when channels are concatenated. once concatenated mode is enabled (conxx bits set in pwmctl register), enabling/disabling the corresponding 16-bit pwm channel is controlled by the low order pwmex bit.in this case, the high order bytes pwmex bits have no effect and their corresponding pwm output lines are disabled. while in run mode, if all eight pwm channels are disabled (pwme7? = 0), the prescaler counter shuts off for power savings. read: anytime write: anytime module base + 0x0000 76543210 r pwme7 pwme6 pwme5 pwme4 pwme3 pwme2 pwme1 pwme0 w reset 0 0 0 00000 figure 19-3. pwm enable register (pwme) field description 7 pwme7 pulse width channel 7 enable 0 pulse width channel 7 is disabled. 1 pulse width channel 7 is enabled. the pulse modulated signal becomes available at pwm output bit 7 when its clock source begins its next cycle. 6 pwme6 pulse width channel 6 enable 0 pulse width channel 6 is disabled. 1 pulse width channel 6 is enabled. the pulse modulated signal becomes available at pwm output bit6 when its clock source begins its next cycle. if con67=1, then bit has no effect and pwm output line 6 is disabled. 5 pwme5 pulse width channel 5 enable 0 pulse width channel 5 is disabled. 1 pulse width channel 5 is enabled. the pulse modulated signal becomes available at pwm output bit 5 when its clock source begins its next cycle. 4 pwme4 pulse width channel 4 enable 0 pulse width channel 4 is disabled. 1 pulse width channel 4 is enabled. the pulse modulated signal becomes available at pwm, output bit 4 when its clock source begins its next cycle. if con45 = 1, then bit has no effect and pwm output bit4 is disabled. 3 pwme3 pulse width channel 3 enable 0 pulse width channel 3 is disabled. 1 pulse width channel 3 is enabled. the pulse modulated signal becomes available at pwm, output bit 3 when its clock source begins its next cycle. chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 696 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.3.2.2 pwm polarity register (pwmpol) the starting polarity of each pwm channel waveform is determined by the associated ppolx bit in the pwmpol register. if the polarity bit is one, the pwm channel output is high at the beginning of the cycle and then goes low when the duty count is reached. conversely, if the polarity bit is zero, the output starts low and then goes high when the duty count is reached. read: anytime write: anytime note ppolx register bits can be written anytime. if the polarity is changed while a pwm signal is being generated, a truncated or stretched pulse can occur during the transition 2 pwme2 pulse width channel 2 enable 0 pulse width channel 2 is disabled. 1 pulse width channel 2 is enabled. the pulse modulated signal becomes available at pwm, output bit 2 when its clock source begins its next cycle. if con23 = 1, then bit has no effect and pwm output bit2 is disabled. 1 pwme1 pulse width channel 1 enable 0 pulse width channel 1 is disabled. 1 pulse width channel 1 is enabled. the pulse modulated signal becomes available at pwm, output bit 1 when its clock source begins its next cycle. 0 pwme0 pulse width channel 0 enable 0 pulse width channel 0 is disabled. 1 pulse width channel 0 is enabled. the pulse modulated signal becomes available at pwm, output bit 0 when its clock source begins its next cycle. if con01 = 1, then bit has no effect and pwm output line0 is disabled. module base + 0x0001 76543210 r ppol7 ppol6 ppol5 ppol4 ppol3 ppol2 ppol1 ppol0 w reset 0 0 0 00000 figure 19-4. pwm polarity register (pwmpol) field description 7? ppol[7:0] p ulse width channel 7? polarity bits 0 pwm channel 7? outputs are low at the beginning of the period, then go high when the duty count is reached. 1 pwm channel 7? outputs are high at the beginning of the period, then go low when the duty count is reached. field description chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 697 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.3.2.3 pwm clock select register (pwmclk) each pwm channel has a choice of two clocks to use as the clock source for that channel as described below. read: anytime write: anytime note register bits pclk0 to pclk7 can be written anytime. if a clock select is changed while a pwm signal is being generated, a truncated or stretched pulse can occur during the transition. module base + 0x0002 76543210 r pclk7 pclkl6 pclk5 pclk4 pclk3 pclk2 pclk1 pclk0 w reset 0 0 0 00000 figure 19-5. pwm clock select register (pwmclk) field description 7 pclk7 pulse width channel 7 clock select 0 clock b is the clock source for pwm channel 7. 1 clock sb is the clock source for pwm channel 7. 6 pclk6 pulse width channel 6 clock select 0 clock b is the clock source for pwm channel 6. 1 clock sb is the clock source for pwm channel 6. 5 pclk5 pulse width channel 5 clock select 0 clock a is the clock source for pwm channel 5. 1 clock sa is the clock source for pwm channel 5. 4 pclk4 pulse width channel 4 clock select 0 clock a is the clock source for pwm channel 4. 1 clock sa is the clock source for pwm channel 4. 3 pclk3 pulse width channel 3 clock select 0 clock b is the clock source for pwm channel 3. 1 clock sb is the clock source for pwm channel 3. 2 pclk2 pulse width channel 2 clock select 0 clock b is the clock source for pwm channel 2. 1 clock sb is the clock source for pwm channel 2. 1 pclk1 pulse width channel 1 clock select 0 clock a is the clock source for pwm channel 1. 1 clock sa is the clock source for pwm channel 1. 0 pclk0 pulse width channel 0 clock select 0 clock a is the clock source for pwm channel 0. 1 clock sa is the clock source for pwm channel 0. chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 698 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.3.2.4 pwm prescale clock select register (pwmprclk) this register selects the prescale clock source for clocks a and b independently. read: anytime write: anytime note pckb2? and pcka2? register bits can be written anytime. if the clock pre-scale is changed while a pwm signal is being generated, a truncated or stretched pulse can occur during the transition. s module base + 0x0003 76543210 r0 pckb2 pckb1 pckb0 0 pcka2 pcka1 pcka0 w reset 0 0 0 00000 = unimplemented or reserved figure 19-6. pwm prescale clock select register (pwmprclk) field description 6? pckb[2:0] prescaler select for clock b clock b is one of two clock sources which can be used for channels 2, 3, 6, or 7. these three bits determine the rate of clock b, as shown in table 19-2 . 2? pcka[2:0] prescaler select for clock a clock a is one of two clock sources which can be used for channels 0, 1, 4 or 5. these three bits determine the rate of clock a, as shown in table 19-3 . table 19-2. clock b prescaler selects pckb2 pckb1 pckb0 value of clock b 0 0 0 bus clock 0 0 1 bus clock / 2 0 1 0 bus clock / 4 0 1 1 bus clock / 8 1 0 0 bus clock / 16 1 0 1 bus clock / 32 1 1 0 bus clock / 64 1 1 1 bus clock / 128 table 19-3. clock a prescaler selects pcka2 pcka1 pcka0 value of clock a 0 0 0 bus clock 0 0 1 bus clock / 2 0 1 0 bus clock / 4 0 1 1 bus clock / 8 1 0 0 bus clock / 16 1 0 1 bus clock / 32 1 1 0 bus clock / 64 chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 699 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.3.2.5 pwm center align enable register (pwmcae) the pwmcae register contains eight control bits for the selection of center aligned outputs or left aligned outputs for each pwm channel. if the caex bit is set to a one, the corresponding pwm output will be center aligned. if the caex bit is cleared, the corresponding pwm output will be left aligned. see section 19.4.2.5, ?eft aligned outputs and section 19.4.2.6, ?enter aligned outputs for a more detailed description of the pwm output modes. read: anytime write: anytime note write these bits only when the corresponding channel is disabled. 19.3.2.6 pwm control register (pwmctl) the pwmctl register provides for various control of the pwm module. read: anytime write: anytime 1 1 1 bus clock / 128 module base + 0x0004 76543210 r cae7 cae6 cae5 cae4 cae3 cae2 cae1 cae0 w reset 0 0 0 00000 figure 19-7. pwm center align enable register (pwmcae) field description 7? cae[7:0] center aligned output modes on channels 7? 0 channels 7? operate in left aligned output mode. 1 channels 7? operate in center aligned output mode. module base + 0x0005 76543210 r con67 con45 con23 con01 pswai pfrz 00 w reset 0 0 0 00000 = unimplemented or reserved figure 19-8. pwm control register (pwmctl) table 19-3. clock a prescaler selects (continued) pcka2 pcka1 pcka0 value of clock a chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 700 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 there are three control bits for concatenation, each of which is used to concatenate a pair of pwm channels into one 16-bit channel. when channels 6 and 7are concatenated, channel 6 registers become the high order bytes of the double byte channel. when channels 4 and 5 are concatenated, channel 4 registers become the high order bytes of the double byte channel. when channels 2 and 3 are concatenated, channel 2 registers become the high order bytes of the double byte channel. when channels 0 and 1 are concatenated, channel 0 registers become the high order bytes of the double byte channel. see section 19.4.2.7, ?wm 16-bit functions for a more detailed description of the concatenation pwm function. note change these bits only when both corresponding channels are disabled. field description 7 con67 concatenate channels 6 and 7 0 channels 6 and 7 are separate 8-bit pwms. 1 channels 6 and 7 are concatenated to create one 16-bit pwm channel. channel 6 becomes the high order byte and channel 7 becomes the low order byte. channel 7 output pin is used as the output for this 16-bit pwm (bit 7 of port pwmp). channel 7 clock select control-bit determines the clock source, channel 7 polarity bit determines the polarity, channel 7 enable bit enables the output and channel 7 center aligned enable bit determines the output mode. 6 con45 concatenate channels 4 and 5 0 channels 4 and 5 are separate 8-bit pwms. 1 channels 4 and 5 are concatenated to create one 16-bit pwm channel. channel 4 becomes the high order byte and channel 5 becomes the low order byte. channel 5 output pin is used as the output for this 16-bit pwm (bit 5 of port pwmp). channel 5 clock select control-bit determines the clock source, channel 5 polarity bit determines the polarity, channel 5 enable bit enables the output and channel 5 center aligned enable bit determines the output mode. 5 con23 concatenate channels 2 and 3 0 channels 2 and 3 are separate 8-bit pwms. 1 channels 2 and 3 are concatenated to create one 16-bit pwm channel. channel 2 becomes the high order byte and channel 3 becomes the low order byte. channel 3 output pin is used as the output for this 16-bit pwm (bit 3 of port pwmp). channel 3 clock select control-bit determines the clock source, channel 3 polarity bit determines the polarity, channel 3 enable bit enables the output and channel 3 center aligned enable bit determines the output mode. 4 con01 concatenate channels 0 and 1 0 channels 0 and 1 are separate 8-bit pwms. 1 channels 0 and 1 are concatenated to create one 16-bit pwm channel. channel 0 becomes the high order byte and channel 1 becomes the low order byte. channel 1 output pin is used as the output for this 16-bit pwm (bit 1 of port pwmp). channel 1 clock select control-bit determines the clock source, channel 1 polarity bit determines the polarity, channel 1 enable bit enables the output and channel 1 center aligned enable bit determines the output mode. chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 701 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.3.2.7 reserved register (pwmtst) this register is reserved for factory testing of the pwm module and is not available in normal modes. read: always read $00 in normal modes write: unimplemented in normal modes note writing to this register when in special modes can alter the pwm functionality. 19.3.2.8 reserved register (pwmprsc) this register is reserved for factory testing of the pwm module and is not available in normal modes. read: always read $00 in normal modes 3 pswai pwm stops in wait mode enabling this bit allows for lower power consumption in wait mode by disabling the input clock to the prescaler. 0 allow the clock to the prescaler to continue while in wait mode. 1 stop the input clock to the prescaler whenever the mcu is in wait mode. 2 pfrez pwm counters stop in freeze mode ?in freeze mode, there is an option to disable the input clock to the prescaler by setting the pfrz bit in the pwmctl register. if this bit is set, whenever the mcu is in freeze mode, the input clock to the prescaler is disabled. this feature is useful during emulation as it allows the pwm function to be suspended. in this way, the counters of the pwm can be stopped while in freeze mode so that once normal program ow is continued, the counters are re-enabled to simulate real-time operations. since the registers can still be accessed in this mode, to re-enable the prescaler clock, either disable the pfrz bit or exit freeze mode. 0 allow pwm to continue while in freeze mode. 1 disable pwm input clock to the prescaler whenever the part is in freeze mode. this is useful for emulation. module base + 0x0006 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 19-9. reserved register (pwmtst) module base + 0x0007 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 19-10. reserved register (pwmprsc) field description chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 702 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 write: unimplemented in normal modes note writing to this register when in special modes can alter the pwm functionality. 19.3.2.9 pwm scale a register (pwmscla) pwmscla is the programmable scale value used in scaling clock a to generate clock sa. clock sa is generated by taking clock a, dividing it by the value in the pwmscla register and dividing that by two. clock sa = clock a / (2 * pwmscla) note when pwmscla = $00, pwmscla value is considered a full scale value of 256. clock a is thus divided by 512. any value written to this register will cause the scale counter to load the new scale value (pwmscla). read: anytime write: anytime (causes the scale counter to load the pwmscla value) 19.3.2.10 pwm scale b register (pwmsclb) pwmsclb is the programmable scale value used in scaling clock b to generate clock sb. clock sb is generated by taking clock b, dividing it by the value in the pwmsclb register and dividing that by two. clock sb = clock b / (2 * pwmsclb) note when pwmsclb = $00, pwmsclb value is considered a full scale value of 256. clock b is thus divided by 512. any value written to this register will cause the scale counter to load the new scale value (pwmsclb). module base + 0x0008 76543210 r bit 7 6 5 4 3 2 1 bit 0 w reset 0 0 0 00000 figure 19-11. pwm scale a register (pwmscla) module base + 0x0009 76543210 r bit 7 6 5 4 3 2 1 bit 0 w reset 0 0 0 00000 figure 19-12. pwm scale b register (pwmsclb) chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 703 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime (causes the scale counter to load the pwmsclb value). 19.3.2.11 reserved registers (pwmscntx) the registers pwmscnta and pwmscntb are reserved for factory testing of the pwm module and are not available in normal modes. read: always read $00 in normal modes write: unimplemented in normal modes note writing to these registers when in special modes can alter the pwm functionality. 19.3.2.12 pwm channel counter registers (pwmcntx) each channel has a dedicated 8-bit up/down counter which runs at the rate of the selected clock source. the counter can be read at any time without affecting the count or the operation of the pwm channel. in left aligned output mode, the counter counts from 0 to the value in the period register - 1. in center aligned output mode, the counter counts from 0 up to the value in the period register and then back down to 0. any value written to the counter causes the counter to reset to $00, the counter direction to be set to up, the immediate load of both duty and period registers with values from the buffers, and the output to change according to the polarity bit. the counter is also cleared at the end of the effective period (see section 19.4.2.5, ?eft aligned outputs and section 19.4.2.6, ?enter aligned outputs for more details). when the channel is disabled (pwmex = 0), the pwmcntx register does not count. when a channel becomes enabled (pwmex = 1), the associated pwm counter starts at the count in the pwmcntx register. for more detailed information on the operation of the counters, see section 19.4.2.4, ?wm timer counters . in concatenated mode, writes to the 16-bit counter by using a 16-bit access or writes to either the low or high order byte of the counter will reset the 16-bit counter. reads of the 16-bit counter must be made by 16-bit access to maintain data coherency. module base + 0x000a, 0x000b 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 19-13. reserved registers (pwmscntx) chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 704 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note writing to the counter while the channel is enabled can cause an irregular pwm cycle to occur. read: anytime write: anytime (any value written causes pwm counter to be reset to $00). 19.3.2.13 pwm channel period registers (pwmperx) there is a dedicated period register for each channel. the value in this register determines the period of the associated pwm channel. the period registers for each channel are double buffered so that if they change while the channel is enabled, the change will not take effect until one of the following occurs: the effective period ends the counter is written (counter resets to $00) the channel is disabled in this way, the output of the pwm will always be either the old waveform or the new waveform, not some variation in between. if the channel is not enabled, then writes to the period register will go directly to the latches as well as the buffer. note reads of this register return the most recent value written. reads do not necessarily return the value of the currently active period due to the double buffering scheme. see section 19.4.2.3, ?wm period and duty for more information. to calculate the output period, take the selected clock source period for the channel of interest (a, b, sa, or sb) and multiply it by the value in the period register for that channel: left aligned output (caex = 0) pwmx period = channel clock period * pwmperx center aligned output (caex = 1) pwmx period = channel clock period * (2 * pwmperx) for boundary case programming values, please refer to section 19.4.2.8, ?wm boundary cases . module base + 0x000c = pwmcnt0, 0x000d = pwmcnt1, 0x000e = pwmcnt2, 0x000f = pwmcnt3 module base + 0x0010 = pwmcnt4, 0x0011 = pwmcnt5, 0x0012 = pwmcnt6, 0x0013 = pwmcnt7 76543210 r bit 7 6 5 4 3 2 1 bit 0 w00000000 reset 0 0 0 00000 figure 19-14. pwm channel counter registers (pwmcntx) chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 705 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime write: anytime 19.3.2.14 pwm channel duty registers (pwmdtyx) there is a dedicated duty register for each channel. the value in this register determines the duty of the associated pwm channel. the duty value is compared to the counter and if it is equal to the counter value a match occurs and the output changes state. the duty registers for each channel are double buffered so that if they change while the channel is enabled, the change will not take effect until one of the following occurs: the effective period ends the counter is written (counter resets to $00) the channel is disabled in this way, the output of the pwm will always be either the old duty waveform or the new duty waveform, not some variation in between. if the channel is not enabled, then writes to the duty register will go directly to the latches as well as the buffer. note reads of this register return the most recent value written. reads do not necessarily return the value of the currently active duty due to the double buffering scheme. see section 19.4.2.3, ?wm period and duty for more information. note depending on the polarity bit, the duty registers will contain the count of either the high time or the low time. if the polarity bit is one, the output starts high and then goes low when the duty count is reached, so the duty registers contain a count of the high time. if the polarity bit is zero, the output starts low and then goes high when the duty count is reached, so the duty registers contain a count of the low time. to calculate the output duty cycle (high time as a% of period) for a particular channel: polarity = 0 (ppol x =0) duty cycle = [(pwmperx-pwmdtyx)/pwmperx] * 100% polarity = 1 (ppolx = 1) module base + 0x0014 = pwmper0, 0x0015 = pwmper1, 0x0016 = pwmper2, 0x0017 = pwmper3 module base + 0x0018 = pwmper4, 0x0019 = pwmper5, 0x001a = pwmper6, 0x001b = pwmper7 76543210 r bit 7 6 5 4 3 2 1 bit 0 w reset 1 1 1 11111 figure 19-15. pwm channel period registers (pwmperx) chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 706 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 duty cycle = [pwmdtyx / pwmperx] * 100% for boundary case programming values, please refer to section 19.4.2.8, ?wm boundary cases . read: anytime write: anytime 19.3.2.15 pwm shutdown register (pwmsdn) the pwmsdn register provides for the shutdown functionality of the pwm module in the emergency cases. for proper operation, channel 7 must be driven to the active level for a minimum of two bus clocks. read: anytime write: anytime module base + 0x001c = pwmdty0, 0x001d = pwmdty1, 0x001e = pwmdty2, 0x001f = pwmdty3 module base + 0x0020 = pwmdty4, 0x0021 = pwmdty5, 0x0022 = pwmdty6, 0x0023 = pwmdty7 76543210 r bit 7 6 5 4 3 2 1 bit 0 w reset 1 1 1 11111 figure 19-16. pwm channel duty registers (pwmdtyx) module base + 0x0024 76543210 r pwmif pwmie 0 pwmlvl 0 pwm7in pwm7inl pwm7ena w pwmrstrt reset 0 0 0 00000 = unimplemented or reserved figure 19-17. pwm shutdown register (pwmsdn) field description 7 pwmif pwm interrupt flag ?any change from passive to asserted (active) state or from active to passive state will be ?gged by setting the pwmif ?g = 1. the ?g is cleared by writing a logic 1 to it. writing a 0 has no effect. 0 no change on pwm7in input. 1 change on pwm7in input 6 pwmie pwm interrupt enable ?if interrupt is enabled an interrupt to the cpu is asserted. 0 pwm interrupt is disabled. 1 pwm interrupt is enabled. 5 pwmrstrt pwm restart the pwm can only be restarted if the pwm channel input 7 is de-asserted. after writing a logic 1 to the pwmrstrt bit (trigger event) the pwm channels start running after the corresponding counter passes next ?ounter == 0?phase. also, if the pwm7ena bit is reset to 0, the pwm do not start before the counter passes $00. the bit is always read as ?? chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 707 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.4 functional description 19.4.1 pwm clock select there are four available clocks: clock a, clock b, clock sa (scaled a), and clock sb (scaled b). these four clocks are based on the bus clock. clock a and b can be software selected to be 1, 1/2, 1/4, 1/8,..., 1/64, 1/128 times the bus clock. clock sa uses clock a as an input and divides it further with a reloadable counter. similarly, clock sb uses clock b as an input and divides it further with a reloadable counter. the rates available for clock sa are software selectable to be clock a divided by 2, 4, 6, 8,..., or 512 in increments of divide by 2. similar rates are available for clock sb. each pwm channel has the capability of selecting one of two clocks, either the pre-scaled clock (clock a or b) or the scaled clock (clock sa or sb). the block diagram in figure 19-18 shows the four different clocks and how the scaled clocks are created. 19.4.1.1 prescale the input clock to the pwm prescaler is the bus clock. it can be disabled whenever the part is in freeze mode by setting the pfrz bit in the pwmctl register. if this bit is set, whenever the mcu is in freeze mode (freeze mode signal active) the input clock to the prescaler is disabled. this is useful for emulation in order to freeze the pwm. the input clock can also be disabled when all eight pwm channels are disabled (pwme7-0 = 0). this is useful for reducing power by disabling the prescale counter. clock a and clock b are scaled values of the input clock. the value is software selectable for both clock a and clock b and has options of 1, 1/2, 1/4, 1/8, 1/16, 1/32, 1/64, or 1/128 times the bus clock. the value selected for clock a is determined by the pcka2, pcka1, pcka0 bits in the pwmprclk register. the value selected for clock b is determined by the pckb2, pckb1, pckb0 bits also in the pwmprclk register. 4 pwmlvl pwm shutdown output level if active level as de?ed by the pwm7in input, gets asserted all enabled pwm channels are immediately driven to the level de?ed by pwmlvl. 0 pwm outputs are forced to 0 1 outputs are forced to 1. 2 pwm7in pwm channel 7 input status ?this re?cts the current status of the pwm7 pin. 1 pwm7inl pwm shutdown active input level for channel 7 ?if the emergency shutdown feature is enabled (pwm7ena = 1), this bit determines the active level of the pwm7channel. 0 active level is low 1 active level is high 0 pwm7ena pwm emergency shutdown enable if this bit is logic 1, the pin associated with channel 7 is forced to input and the emergency shutdown feature is enabled. all the other bits in this register are meaningful only if pwm7ena = 1. 0 pwm emergency feature disabled. 1 pwm emergency feature is enabled. field description chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 708 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.4.1.2 clock scale the scaled a clock uses clock a as an input and divides it further with a user programmable value and then divides this by 2. the scaled b clock uses clock b as an input and divides it further with a user programmable value and then divides this by 2. the rates available for clock sa are software selectable to be clock a divided by 2, 4, 6, 8,..., or 512 in increments of divide by 2. similar rates are available for clock sb. chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 709 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 19-18. pwm clock select block diagram clock a is used as an input to an 8-bit down counter. this down counter loads a user programmable scale value from the scale register (pwmscla). when the down counter reaches one, a pulse is output and the 128 2 4 8 16 32 64 pckb2 pckb1 pckb0 m u x clock a clock b clock sa clock a/2, a/4, a/6,....a/512 prescale scale divide by pfrz freeze mode signal bus clock clock select m u x pclk0 clock to pwm ch 0 m u x pclk2 clock to pwm ch 2 m u x pclk1 clock to pwm ch 1 m u x pclk4 clock to pwm ch 4 m u x pclk5 clock to pwm ch 5 m u x pclk6 clock to pwm ch 6 m u x pclk7 clock to pwm ch 7 m u x pclk3 clock to pwm ch 3 load div 2 pwmsclb clock sb clock b/2, b/4, b/6,....b/512 m u x pcka2 pcka1 pcka0 pwme7-0 count = 1 load div 2 pwmscla count = 1 8-bit down counter 8-bit down counter prescaler taps: chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 710 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 8-bit counter is re-loaded. the output signal from this circuit is further divided by two. this gives a greater range with only a slight reduction in granularity. clock sa equals clock a divided by two times the value in the pwmscla register. note clock sa = clock a / (2 * pwmscla) when pwmscla = $00, pwmscla value is considered a full scale value of 256. clock a is thus divided by 512. similarly, clock b is used as an input to an 8-bit down counter followed by a divide by two producing clock sb. thus, clock sb equals clock b divided by two times the value in the pwmsclb register. note clock sb = clock b / (2 * pwmsclb) when pwmsclb = $00, pwmsclb value is considered a full scale value of 256. clock b is thus divided by 512. as an example, consider the case in which the user writes $ff into the pwmscla register. clock a for this case will be e divided by 4. a pulse will occur at a rate of once every 255x4 e cycles. passing this through the divide by two circuit produces a clock signal at an e divided by 2040 rate. similarly, a value of $01 in the pwmscla register when clock a is e divided by 4 will produce a clock at an e divided by 8 rate. writing to pwmscla or pwmsclb causes the associated 8-bit down counter to be re-loaded. otherwise, when changing rates the counter would have to count down to $01 before counting at the proper rate. forcing the associated counter to re-load the scale register value every time pwmscla or pwmsclb is written prevents this. note writing to the scale registers while channels are operating can cause irregularities in the pwm outputs. 19.4.1.3 clock select each pwm channel has the capability of selecting one of two clocks. for channels 0, 1, 4, and 5 the clock choices are clock a or clock sa. for channels 2, 3, 6, and 7 the choices are clock b or clock sb. the clock selection is done with the pclkx control bits in the pwmclk register. note changing clock control bits while channels are operating can cause irregularities in the pwm outputs. 19.4.2 pwm channel timers the main part of the pwm module are the actual timers. each of the timer channels has a counter, a period register and a duty register (each are 8-bit). the waveform output period is controlled by a match between the period register and the value in the counter. the duty is controlled by a match between the duty register chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 711 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 and the counter value and causes the state of the output to change during the period. the starting polarity of the output is also selectable on a per channel basis. shown below in figure 19-19 is the block diagram for the pwm timer. figure 19-19. pwm timer channel block diagram 19.4.2.1 pwm enable each pwm channel has an enable bit (pwmex) to start its waveform output. when any of the pwmex bits are set (pwmex = 1), the associated pwm output signal is enabled immediately. however, the actual pwm waveform is not available on the associated pwm output until its clock source begins its next cycle due to the synchronization of pwmex and the clock source. an exception to this is when channels are concatenated. refer to section 19.4.2.7, ?wm 16-bit functions for more detail. note the ?st pwm cycle after enabling the channel can be irregular. on the front end of the pwm timer, the clock is enabled to the pwm circuit by the pwmex bit being high. there is an edge-synchronizing circuit to guarantee that the clock will only be enabled or disabled at an edge. when the channel is disabled (pwmex = 0), the counter for the channel does not count. clock source t r q q ppolx from port pwmp data register pwmex to pin driver gate 8-bit compare = pwmdtyx 8-bit compare = pwmperx caex t r q q 8-bit counter pwmcntx m u x m u x (clock edge sync) up/down reset chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 712 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.4.2.2 pwm polarity each channel has a polarity bit to allow starting a waveform cycle with a high or low signal. this is shown on the block diagram as a mux select of either the q output or the q output of the pwm output ?p ?p. when one of the bits in the pwmpol register is set, the associated pwm channel output is high at the beginning of the waveform, then goes low when the duty count is reached. conversely, if the polarity bit is zero, the output starts low and then goes high when the duty count is reached. 19.4.2.3 pwm period and duty dedicated period and duty registers exist for each channel and are double buffered so that if they change while the channel is enabled, the change will not take effect until one of the following occurs: the effective period ends the counter is written (counter resets to $00) the channel is disabled in this way, the output of the pwm will always be either the old waveform or the new waveform, not some variation in between. if the channel is not enabled, then writes to the period and duty registers will go directly to the latches as well as the buffer. a change in duty or period can be forced into effect ?mmediately?by writing the new value to the duty and/or period registers and then writing to the counter. this forces the counter to reset and the new duty and/or period values to be latched. in addition, since the counter is readable, it is possible to know where the count is with respect to the duty value and software can be used to make adjustments note when forcing a new period or duty into effect immediately, an irregular pwm cycle can occur. depending on the polarity bit, the duty registers will contain the count of either the high time or the low time. 19.4.2.4 pwm timer counters each channel has a dedicated 8-bit up/down counter which runs at the rate of the selected clock source (see section 19.4.1, ?wm clock select for the available clock sources and rates). the counter compares to two registers, a duty register and a period register as shown in figure 19-19 . when the pwm counter matches the duty register, the output ?p-?p changes state, causing the pwm waveform to also change state. a match between the pwm counter and the period register behaves differently depending on what output mode is selected as shown in figure 19-19 and described in section 19.4.2.5, ?eft aligned outputs and section 19.4.2.6, ?enter aligned outputs . each channel counter can be read at anytime without affecting the count or the operation of the pwm channel. any value written to the counter causes the counter to reset to $00, the counter direction to be set to up, the immediate load of both duty and period registers with values from the buffers, and the output to change according to the polarity bit. when the channel is disabled (pwmex = 0), the counter stops. when a chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 713 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 channel becomes enabled (pwmex = 1), the associated pwm counter continues from the count in the pwmcntx register. this allows the waveform to continue where it left off when the channel is re- enabled. when the channel is disabled, writing ? to the period register will cause the counter to reset on the next selected clock. note if the user wants to start a new ?lean?pwm waveform without any ?istory?from the old waveform, the user must write to channel counter (pwmcntx) prior to enabling the pwm channel (pwmex = 1). generally, writes to the counter are done prior to enabling a channel in order to start from a known state. however, writing a counter can also be done while the pwm channel is enabled (counting). the effect is similar to writing the counter when the channel is disabled, except that the new period is started immediately with the output set according to the polarity bit. note writing to the counter while the channel is enabled can cause an irregular pwm cycle to occur. the counter is cleared at the end of the effective period (see section 19.4.2.5, ?eft aligned outputs and section 19.4.2.6, ?enter aligned outputs for more details). 19.4.2.5 left aligned outputs the pwm timer provides the choice of two types of outputs, left aligned or center aligned. they are selected with the caex bits in the pwmcae register. if the caex bit is cleared (caex = 0), the corresponding pwm output will be left aligned. in left aligned output mode, the 8-bit counter is con?ured as an up counter only. it compares to two registers, a duty register and a period register as shown in the block diagram in figure 19-19 . when the pwm counter matches the duty register the output ?p-?p changes state causing the pwm waveform to also change state. a match between the pwm counter and the period register resets the counter and the output ?p-?p, as shown in figure 19-19 , as well as performing a load from the double buffer period and duty register to the associated registers, as described in section 19.4.2.3, ?wm period and duty . the counter counts from 0 to the value in the period register ?1. note changing the pwm output mode from left aligned to center aligned output (or vice versa) while channels are operating can cause irregularities in the pwm output. it is recommended to program the output mode before enabling the pwm channel. table 19-4. pwm timer counter conditions counter clears ($00) counter counts counter stops when pwmcntx register written to any value when pwm channel is enabled (pwmex = 1). counts from last value in pwmcntx. when pwm channel is disabled (pwmex = 0) effective period ends chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 714 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 19-20. pwm left aligned output waveform to calculate the output frequency in left aligned output mode for a particular channel, take the selected clock source frequency for the channel (a, b, sa, or sb) and divide it by the value in the period register for that channel. pwmx frequency = clock (a, b, sa, or sb) / pwmperx pwmx duty cycle (high time as a% of period): polarity = 0 (ppolx = 0) duty cycle = [(pwmperx-pwmdtyx)/pwmperx] * 100% polarity = 1 (ppolx = 1) duty cycle = [pwmdtyx / pwmperx] * 100% as an example of a left aligned output, consider the following case: clock source = e, where e = 10 mhz (100 ns period) ppolx = 0 pwmperx = 4 pwmdtyx = 1 pwmx frequency = 10 mhz/4 = 2.5 mhz pwmx period = 400 ns pwmx duty cycle = 3/4 *100% = 75% the output waveform generated is shown in figure 19-21 . figure 19-21. pwm left aligned output example waveform 19.4.2.6 center aligned outputs for center aligned output mode selection, set the caex bit (caex = 1) in the pwmcae register and the corresponding pwm output will be center aligned. pwmdtyx period = pwmperx ppolx = 0 ppolx = 1 period = 400 ns e = 100 ns duty cycle = 75% chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 715 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the 8-bit counter operates as an up/down counter in this mode and is set to up whenever the counter is equal to $00. the counter compares to two registers, a duty register and a period register as shown in the block diagram in figure 19-19 . when the pwm counter matches the duty register, the output ?p-?p changes state, causing the pwm waveform to also change state. a match between the pwm counter and the period register changes the counter direction from an up-count to a down-count. when the pwm counter decrements and matches the duty register again, the output ?p-?p changes state causing the pwm output to also change state. when the pwm counter decrements and reaches zero, the counter direction changes from a down-count back to an up-count and a load from the double buffer period and duty registers to the associated registers is performed, as described in section 19.4.2.3, ?wm period and duty . the counter counts from 0 up to the value in the period register and then back down to 0. thus the effective period is pwmperx*2. note changing the pwm output mode from left aligned to center aligned output (or vice versa) while channels are operating can cause irregularities in the pwm output. it is recommended to program the output mode before enabling the pwm channel. figure 19-22. pwm center aligned output waveform to calculate the output frequency in center aligned output mode for a particular channel, take the selected clock source frequency for the channel (a, b, sa, or sb) and divide it by twice the value in the period register for that channel. pwmx frequency = clock (a, b, sa, or sb) / (2*pwmperx) pwmx duty cycle (high time as a% of period): polarity = 0 (ppolx = 0) duty cycle = [(pwmperx-pwmdtyx)/pwmperx] * 100% polarity = 1 (ppolx = 1) duty cycle = [pwmdtyx / pwmperx] * 100% ppolx = 0 ppolx = 1 pwmdtyx pwmdtyx period = pwmperx*2 pwmperx pwmperx chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 716 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 as an example of a center aligned output, consider the following case: clock source = e, where e = 10 mhz (100 ns period) ppolx = 0 pwmperx = 4 pwmdtyx = 1 pwmx frequency = 10 mhz/8 = 1.25 mhz pwmx period = 800 ns pwmx duty cycle = 3/4 *100% = 75% shown in figure 19-23 is the output waveform generated. figure 19-23. pwm center aligned output example waveform 19.4.2.7 pwm 16-bit functions the pwm timer also has the option of generating 8-channels of 8-bits or 4-channels of 16-bits for greater pwm resolution. this 16-bit channel option is achieved through the concatenation of two 8-bit channels. the pwmctl register contains four control bits, each of which is used to concatenate a pair of pwm channels into one 16-bit channel. channels 6 and 7 are concatenated with the con67 bit, channels 4 and 5 are concatenated with the con45 bit, channels 2 and 3 are concatenated with the con23 bit, and channels 0 and 1 are concatenated with the con01 bit. note change these bits only when both corresponding channels are disabled. when channels 6 and 7 are concatenated, channel 6 registers become the high order bytes of the double byte channel, as shown in figure 19-24 . similarly, when channels 4 and 5 are concatenated, channel 4 registers become the high order bytes of the double byte channel. when channels 2 and 3 are concatenated, channel 2 registers become the high order bytes of the double byte channel. when channels 0 and 1 are concatenated, channel 0 registers become the high order bytes of the double byte channel. when using the 16-bit concatenated mode, the clock source is determined by the low order 8-bit channel clock select control bits. that is channel 7 when channels 6 and 7 are concatenated, channel 5 when channels 4 and 5 are concatenated, channel 3 when channels 2 and 3 are concatenated, and channel 1 when channels 0 and 1 are concatenated. the resulting pwm is output to the pins of the corresponding low order 8-bit channel as also shown in figure 19-24 . the polarity of the resulting pwm output is controlled by the ppolx bit of the corresponding low order 8-bit channel as well. e = 100 ns duty cycle = 75% e = 100 ns period = 800 ns chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 717 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 19-24. pwm 16-bit mode once concatenated mode is enabled (conxx bits set in pwmctl register), enabling/disabling the corresponding 16-bit pwm channel is controlled by the low order pwmex bit. in this case, the high order bytes pwmex bits have no effect and their corresponding pwm output is disabled. in concatenated mode, writes to the 16-bit counter by using a 16-bit access or writes to either the low or high order byte of the counter will reset the 16-bit counter. reads of the 16-bit counter must be made by 16-bit access to maintain data coherency. pwmcnt6 pwcnt7 pwm7 clock source 7 high low period/duty compare pwmcnt4 pwcnt5 pwm5 clock source 5 high low period/duty compare pwmcnt2 pwcnt3 pwm3 clock source 3 high low period/duty compare pwmcnt0 pwcnt1 pwm1 clock source 1 high low period/duty compare chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 718 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 either left aligned or center aligned output mode can be used in concatenated mode and is controlled by the low order caex bit. the high order caex bit has no effect. table 19-5 is used to summarize which channels are used to set the various control bits when in 16-bit mode. 19.4.2.8 pwm boundary cases table 19-6 summarizes the boundary conditions for the pwm regardless of the output mode (left aligned or center aligned) and 8-bit (normal) or 16-bit (concatenation). 19.5 resets the reset state of each individual bit is listed within the section 19.3.2, ?egister descriptions which details the registers and their bit-?lds. all special functions or modes which are initialized during or just following reset are described within this section. the 8-bit up/down counter is con?ured as an up counter out of reset. all the channels are disabled and all the counters do not count. table 19-5. 16-bit concatenation mode summary conxx pwmex ppolx pclkx caex pwmx output con67 pwme7 ppol7 pclk7 cae7 pwm7 con45 pwme5 ppol5 pclk5 cae5 pwm5 con23 pwme3 ppol3 pclk3 cae3 pwm3 con01 pwme1 ppol1 pclk1 cae1 pwm1 table 19-6. pwm boundary cases pwmdtyx pwmperx ppolx pwmx output $00 (indicates no duty) >$00 1 always low $00 (indicates no duty) >$00 0 always high xx $00 (1) (indicates no period) 1. counter = $00 and does not count. 1 always high xx $00 1 (indicates no period) 0 always low >= pwmperx xx 1 always high >= pwmperx xx 0 always low chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 719 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 19.6 interrupts the pwm module has only one interrupt which is generated at the time of emergency shutdown, if the corresponding enable bit (pwmie) is set. this bit is the enable for the interrupt. the interrupt ?g pwmif is set whenever the input level of the pwm7 channel changes while pwm7ena = 1 or when pwmena is being asserted while the level at pwm7 is active. in stop mode or wait mode (with the pswai bit set), the emergency shutdown feature will drive the pwm outputs to their shutdown output levels but the pwmif ?g will not be set. a description of the registers involved and affected due to this interrupt is explained in section 19.3.2.15, ?wm shutdown register (pwmsdn) . the pwm block only generates the interrupt and does not service it. the interrupt signal name is pwm interrupt signal. chapter 19 pulse-width modulator (s12pwm8b8cv1) mc9s12xe-family reference manual , rev. 1.21 720 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 721 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 20 serial communication interface (s12sciv5) 20.1 introduction this block guide provides an overview of the serial communication interface (sci) module. the sci allows asynchronous serial communications with peripheral devices and other cpus. 20.1.1 glossary ir: infrared irda: infrared design associate irq: interrupt request lin: local interconnect network lsb: least signi?ant bit msb: most signi?ant bit nrz: non-return-to-zero rzi: return-to-zero-inverted rxd: receive pin sci : serial communication interface txd: transmit pin table 20-1. revision history version number revision date effective date author description of changes 05.01 04/16/2004 update or and pf flag description; correct baud rate tolerance in 4.7.5.1 and 4.7.5.2; clean up classification and nda message banners 05.02 10/14/2005 correct alternative registers address; remove unavailable baud rate in table1-16 05.03 12/25/2008 remove redundancy comments in figure1-2 05.04 08/05/2009 fix typo, scibdl reset value be 0x04, not 0x00 chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 722 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.1.2 features the sci includes these distinctive features: full-duplex or single-wire operation standard mark/space non-return-to-zero (nrz) format selectable irda 1.4 return-to-zero-inverted (rzi) format with programmable pulse widths 13-bit baud rate selection programmable 8-bit or 9-bit data format separately enabled transmitter and receiver programmable polarity for transmitter and receiver programmable transmitter output parity two receiver wakeup methods: idle line wakeup address mark wakeup interrupt-driven operation with eight flags: transmitter empty transmission complete receiver full idle receiver input receiver overrun noise error framing error parity error receive wakeup on active edge transmit collision detect supporting lin break detect supporting lin receiver framing error detection hardware parity checking 1/16 bit-time noise detection 20.1.3 modes of operation the sci functions the same in normal, special, and emulation modes. it has two low power modes, wait and stop modes. run mode wait mode stop mode chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 723 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.1.4 block diagram figure 20-1 is a high level block diagram of the sci module, showing the interaction of various function blocks. figure 20-1. sci block diagram sci data register rxd data in data out txd receive shift register infrared decoder receive & wakeup control data format control transmit control baud rate generator bus clock 1/16 transmit shift register sci data register receive interrupt generation transmit interrupt generation infrared encoder idle rdrf/or tc tdre brkd berr rxedg sci interrupt request chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 724 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.2 external signal description the sci module has a total of two external pins. 20.2.1 txd ?transmit pin the txd pin transmits sci (standard or infrared) data. it will idle high in either mode and is high impedance anytime the transmitter is disabled. 20.2.2 rxd ?receive pin the rxd pin receives sci (standard or infrared) data. an idle line is detected as a line high. this input is ignored when the receiver is disabled and should be terminated to a known voltage. 20.3 memory map and register de?ition this section provides a detailed description of all the sci registers. 20.3.1 module memory map and register de?ition the memory map for the sci module is given below in figure 20-2 . the address listed for each register is the address offset. the total address for each register is the sum of the base address for the sci module and the address offset for each register. chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 725 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2 register descriptions this section consists of register descriptions in address order. each description includes a standard register diagram with an associated ?ure number. writes to a reserved register locations do not have any effect and reads of these locations return a zero. details of register bit and ?ld function follow the register diagrams, in bit order. register name bit 7 6 5 4 3 2 1 bit 0 0x0000 scibdh 1 r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x0001 scibdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x0002 scicr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x0000 sciasr1 2 r rxedgif 0000 berrv berrif bkdif w 0x0001 sciacr1 2 r rxedgie 00000 berrie bkdie w 0x0002 sciacr2 2 r00000 berrm1 berrm0 bkdfe w 0x0003 scicr2 r tie tcie rie ilie te re rwu sbk w 0x0004 scisr1 r tdre tc rdrf idle or nf fe pf w 0x0005 scisr2 r amap 00 txpol rxpol brk13 txdir raf w 0x0006 scidrh rr8 t8 000000 w 0x0007 scidrl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 1.these registers are accessible if the amap bit in the scisr2 register is set to zero. 2,these registers are accessible if the amap bit in the scisr2 register is set to one. = unimplemented or reserved figure 20-2. sci register summary chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 726 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.1 sci baud rate registers (scibdh, scibdl) read: anytime, if amap = 0. if only scibdh is written to, a read will not return the correct data until scibdl is written to as well, following a write to scibdh. write: anytime, if amap = 0. note those two registers are only visible in the memory map if amap = 0 (reset condition). the sci baud rate register is used by to determine the baud rate of the sci, and to control the infrared modulation/demodulation submodule. module base + 0x0000 76543210 r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w reset 0 0 0 00000 figure 20-3. sci baud rate register (scibdh) module base + 0x0001 76543210 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w reset 0 0 0 00100 figure 20-4. sci baud rate register (scibdl) table 20-2. scibdh and scibdl field descriptions field description 7 iren infrared enable bit ?this bit enables/disables the infrared modulation/demodulation submodule. 0 ir disabled 1 ir enabled 6:5 tnp[1:0] transmitter narrow pulse bits these bits enable whether the sci transmits a 1/16, 3/16, 1/32 or 1/4 narrow pulse. see table 20-3 . 4:0 7:0 sbr[12:0] sci baud rate bits ?the baud rate for the sci is determined by the bits in this register. the baud rate is calculated two different ways depending on the state of the iren bit. the formulas for calculating the baud rate are: when iren = 0 then, sci baud rate = sci bus clock / (16 x sbr[12:0]) when iren = 1 then, sci baud rate = sci bus clock / (32 x sbr[12:1]) note: the baud rate generator is disabled after reset and not started until the te bit or the re bit is set for the ?st time. the baud rate generator is disabled when (sbr[12:0] = 0 and iren = 0) or (sbr[12:1] = 0 and iren = 1). note: writing to scibdh has no effect without writing to scibdl, because writing to scibdh puts the data in a temporary location until scibdl is written to. chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 727 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.2 sci control register 1 (scicr1) read: anytime, if amap = 0. write: anytime, if amap = 0. note this register is only visible in the memory map if amap = 0 (reset condition). table 20-3. irsci transmit pulse width tnp[1:0] narrow pulse width 11 1/4 10 1/32 01 1/16 00 3/16 module base + 0x0002 76543210 r loops sciswai rsrc m wake ilt pe pt w reset 0 0 0 00000 figure 20-5. sci control register 1 (scicr1) table 20-4. scicr1 field descriptions field description 7 loops loop select bit loops enables loop operation. in loop operation, the rxd pin is disconnected from the sci and the transmitter output is internally connected to the receiver input. both the transmitter and the receiver must be enabled to use the loop function. 0 normal operation enabled 1 loop operation enabled the receiver input is determined by the rsrc bit. 6 sciswai sci stop in wait mode bit ?sciswai disables the sci in wait mode. 0 sci enabled in wait mode 1 sci disabled in wait mode 5 rsrc receiver source bit ?when loops = 1, the rsrc bit determines the source for the receiver shift register input. see table 20-5 . 0 receiver input internally connected to transmitter output 1 receiver input connected externally to transmitter 4 m data format mode bit ?mode determines whether data characters are eight or nine bits long. 0 one start bit, eight data bits, one stop bit 1 one start bit, nine data bits, one stop bit 3 wake wakeup condition bit wake determines which condition wakes up the sci: a logic 1 (address mark) in the most signi?ant bit position of a received data character or an idle condition on the rxd pin. 0 idle line wakeup 1 address mark wakeup chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 728 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 2 ilt idle line type bit ?ilt determines when the receiver starts counting logic 1s as idle character bits. the counting begins either after the start bit or after the stop bit. if the count begins after the start bit, then a string of logic 1s preceding the stop bit may cause false recognition of an idle character. beginning the count after the stop bit avoids false idle character recognition, but requires properly synchronized transmissions. 0 idle character bit count begins after start bit 1 idle character bit count begins after stop bit 1 pe parity enable bit pe enables the parity function. when enabled, the parity function inserts a parity bit in the most signi?ant bit position. 0 parity function disabled 1 parity function enabled 0 pt parity type bit pt determines whether the sci generates and checks for even parity or odd parity. with even parity, an even number of 1s clears the parity bit and an odd number of 1s sets the parity bit. with odd parity, an odd number of 1s clears the parity bit and an even number of 1s sets the parity bit. 1 even parity 1 odd parity table 20-5. loop functions loops rsrc function 0 x normal operation 1 0 loop mode with transmitter output internally connected to receiver input 1 1 single-wire mode with txd pin connected to receiver input table 20-4. scicr1 field descriptions (continued) field description chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 729 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.3 sci alternative status register 1 (sciasr1) read: anytime, if amap = 1 write: anytime, if amap = 1 module base + 0x0000 76543210 r rxedgif 0 0 0 0 berrv berrif bkdif w reset 0 0 0 00000 = unimplemented or reserved figure 20-6. sci alternative status register 1 (sciasr1) table 20-6. sciasr1 field descriptions field description 7 rxedgif receive input active edge interrupt flag ?rxedgif is asserted, if an active edge (falling if rxpol = 0, rising if rxpol = 1) on the rxd input occurs. rxedgif bit is cleared by writing a ??to it. 0 no active receive on the receive input has occurred 1 an active edge on the receive input has occurred 2 berrv bit error value berrv re?cts the state of the rxd input when the bit error detect circuitry is enabled and a mismatch to the expected value happened. the value is only meaningful, if berrif = 1. 0 a low input was sampled, when a high was expected 1 a high input reassembled, when a low was expected 1 berrif bit error interrupt flag ?berrif is asserted, when the bit error detect circuitry is enabled and if the value sampled at the rxd input does not match the transmitted value. if the berrie interrupt enable bit is set an interrupt will be generated. the berrif bit is cleared by writing a ??to it. 0 no mismatch detected 1 a mismatch has occurred 0 bkdif break detect interrupt flag bkdif is asserted, if the break detect circuitry is enabled and a break signal is received. if the bkdie interrupt enable bit is set an interrupt will be generated. the bkdif bit is cleared by writing a ??to it. 0 no break signal was received 1 a break signal was received chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 730 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.4 sci alternative control register 1 (sciacr1) read: anytime, if amap = 1 write: anytime, if amap = 1 module base + 0x0001 76543210 r rxedgie 00000 berrie bkdie w reset 0 0 0 00000 = unimplemented or reserved figure 20-7. sci alternative control register 1 (sciacr1) table 20-7. sciacr1 field descriptions field description 7 rsedgie receive input active edge interrupt enable rxedgie enables the receive input active edge interrupt ?g, rxedgif, to generate interrupt requests. 0 rxedgif interrupt requests disabled 1 rxedgif interrupt requests enabled 1 berrie bit error interrupt enable ?berrie enables the bit error interrupt ?g, berrif, to generate interrupt requests. 0 berrif interrupt requests disabled 1 berrif interrupt requests enabled 0 bkdie break detect interrupt enable ?bkdie enables the break detect interrupt ?g, bkdif, to generate interrupt requests. 0 bkdif interrupt requests disabled 1 bkdif interrupt requests enabled chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 731 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.5 sci alternative control register 2 (sciacr2) read: anytime, if amap = 1 write: anytime, if amap = 1 module base + 0x0002 76543210 r00000 berrm1 berrm0 bkdfe w reset 0 0 0 00000 = unimplemented or reserved figure 20-8. sci alternative control register 2 (sciacr2) table 20-8. sciacr2 field descriptions field description 2:1 berrm[1:0] bit error mode ?those two bits determines the functionality of the bit error detect feature. see table 20-9 . 0 bkdfe break detect feature enable ?bkdfe enables the break detect circuitry. 0 break detect circuit disabled 1 break detect circuit enabled table 20-9. bit error mode coding berrm1 berrm0 function 0 0 bit error detect circuit is disabled 0 1 receive input sampling occurs during the 9th time tick of a transmitted bit (refer to figure 20-19 ) 1 0 receive input sampling occurs during the 13th time tick of a transmitted bit (refer to figure 20-19 ) 1 1 reserved chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 732 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.6 sci control register 2 (scicr2) read: anytime write: anytime module base + 0x0003 76543210 r tie tcie rie ilie te re rwu sbk w reset 0 0 0 00000 figure 20-9. sci control register 2 (scicr2) table 20-10. scicr2 field descriptions field description 7 tie transmitter interrupt enable bit ?tie enables the transmit data register empty ?g, tdre, to generate interrupt requests. 0 tdre interrupt requests disabled 1 tdre interrupt requests enabled 6 tcie transmission complete interrupt enable bit tcie enables the transmission complete ?g, tc, to generate interrupt requests. 0 tc interrupt requests disabled 1 tc interrupt requests enabled 5 rie receiver full interrupt enable bit rie enables the receive data register full ?g, rdrf, or the overrun ?g, or, to generate interrupt requests. 0 rdrf and or interrupt requests disabled 1 rdrf and or interrupt requests enabled 4 ilie idle line interrupt enable bit ?ilie enables the idle line ?g, idle, to generate interrupt requests. 0 idle interrupt requests disabled 1 idle interrupt requests enabled 3 te transmitter enable bit ?te enables the sci transmitter and con?ures the txd pin as being controlled by the sci. the te bit can be used to queue an idle preamble. 0 transmitter disabled 1 transmitter enabled 2 re receiver enable bit ?re enables the sci receiver. 0 receiver disabled 1 receiver enabled 1 rwu receiver wakeup bit ?standby state 0 normal operation. 1 rwu enables the wakeup function and inhibits further receiver interrupt requests. normally, hardware wakes the receiver by automatically clearing rwu. 0 sbk send break bit ?toggling sbk sends one break character (10 or 11 logic 0s, respectively 13 or 14 logics 0s if brk13 is set). toggling implies clearing the sbk bit before the break character has ?ished transmitting. as long as sbk is set, the transmitter continues to send complete break characters (10 or 11 bits, respectively 13 or 14 bits). 0 no break characters 1 transmit break characters chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 733 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.7 sci status register 1 (scisr1) the scisr1 and scisr2 registers provides inputs to the mcu for generation of sci interrupts. also, these registers can be polled by the mcu to check the status of these bits. the ?g-clearing procedures require that the status register be read followed by a read or write to the sci data register.it is permissible to execute other instructions between the two steps as long as it does not compromise the handling of i/o, but the order of operations is important for ?g clearing. read: anytime write: has no meaning or effect module base + 0x0004 76543210 r tdre tc rdrf idle or nf fe pf w reset 1 1 0 00000 = unimplemented or reserved figure 20-10. sci status register 1 (scisr1) table 20-11. scisr1 field descriptions field description 7 tdre transmit data register empty flag ?tdre is set when the transmit shift register receives a byte from the sci data register. when tdre is 1, the transmit data register (scidrh/l) is empty and can receive a new value to transmit.clear tdre by reading sci status register 1 (scisr1), with tdre set and then writing to sci data register low (scidrl). 0 no byte transferred to transmit shift register 1 byte transferred to transmit shift register; transmit data register empty 6 tc transmit complete flag tc is set low when there is a transmission in progress or when a preamble or break character is loaded. tc is set high when the tdre ?g is set and no data, preamble, or break character is being transmitted.when tc is set, the txd pin becomes idle (logic 1). clear tc by reading sci status register 1 (scisr1) with tc set and then writing to sci data register low (scidrl). tc is cleared automatically when data, preamble, or break is queued and ready to be sent. tc is cleared in the event of a simultaneous set and clear of the tc ?g (transmission not complete). 0 transmission in progress 1 no transmission in progress 5 rdrf receive data register full flag rdrf is set when the data in the receive shift register transfers to the sci data register. clear rdrf by reading sci status register 1 (scisr1) with rdrf set and then reading sci data register low (scidrl). 0 data not available in sci data register 1 received data available in sci data register 4 idle idle line flag idle is set when 10 consecutive logic 1s (if m = 0) or 11 consecutive logic 1s (if m =1) appear on the receiver input. once the idle ?g is cleared, a valid frame must again set the rdrf ?g before an idle condition can set the idle ?g.clear idle by reading sci status register 1 (scisr1) with idle set and then reading sci data register low (scidrl). 0 receiver input is either active now or has never become active since the idle ?g was last cleared 1 receiver input has become idle note: when the receiver wakeup bit (rwu) is set, an idle line condition does not set the idle ?g. chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 734 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3 or overrun flag ?or is set when software fails to read the sci data register before the receive shift register receives the next frame. the or bit is set immediately after the stop bit has been completely received for the second frame. the data in the shift register is lost, but the data already in the sci data registers is not affected. clear or by reading sci status register 1 (scisr1) with or set and then reading sci data register low (scidrl). 0 no overrun 1 overrun note: or ?g may read back as set when rdrf ?g is clear. this may happen if the following sequence of events occurs: 1. after the ?st frame is received, read status register scisr1 (returns rdrf set and or ?g clear); 2. receive second frame without reading the ?st frame in the data register (the second frame is not received and or ?g is set); 3. read data register scidrl (returns ?st frame and clears rdrf ?g in the status register); 4. read status register scisr1 (returns rdrf clear and or set). event 3 may be at exactly the same time as event 2 or any time after. when this happens, a dummy scidrl read following event 4 will be required to clear the or ?g if further frames are to be received. 2 nf noise flag nf is set when the sci detects noise on the receiver input. nf bit is set during the same cycle as the rdrf ?g but does not get set in the case of an overrun. clear nf by reading sci status register 1(scisr1), and then reading sci data register low (scidrl). 0 no noise 1 noise 1 fe framing error flag fe is set when a logic 0 is accepted as the stop bit. fe bit is set during the same cycle as the rdrf ?g but does not get set in the case of an overrun. fe inhibits further data reception until it is cleared. clear fe by reading sci status register 1 (scisr1) with fe set and then reading the sci data register low (scidrl). 0 no framing error 1 framing error 0 pf parity error flag pf is set when the parity enable bit (pe) is set and the parity of the received data does not match the parity type bit (pt). pf bit is set during the same cycle as the rdrf ?g but does not get set in the case of an overrun. clear pf by reading sci status register 1 (scisr1), and then reading sci data register low (scidrl). 0 no parity error 1 parity error table 20-11. scisr1 field descriptions (continued) field description chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 735 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.8 sci status register 2 (scisr2) read: anytime write: anytime module base + 0x0005 76543210 r amap 00 txpol rxpol brk13 txdir raf w reset 0 0 0 00000 = unimplemented or reserved figure 20-11. sci status register 2 (scisr2) table 20-12. scisr2 field descriptions field description 7 amap alternative map this bit controls which registers sharing the same address space are accessible. in the reset condition the sci behaves as previous versions. setting amap=1 allows the access to another set of control and status registers and hides the baud rate and sci control register 1. 0 the registers labelled scibdh (0x0000),scibdl (0x0001), scicr1 (0x0002) are accessible 1 the registers labelled sciasr1 (0x0000),sciacr1 (0x0001), sciacr2 (0x00002) are accessible 4 txpol transmit polarity this bit control the polarity of the transmitted data. in nrz format, a one is represented by a mark and a zero is represented by a space for normal polarity, and the opposite for inverted polarity. in irda format, a zero is represented by short high pulse in the middle of a bit time remaining idle low for a one for normal polarity, and a zero is represented by short low pulse in the middle of a bit time remaining idle high for a one for inverted polarity. 0 normal polarity 1 inverted polarity 3 rxpol receive polarity ?this bit control the polarity of the received data. in nrz format, a one is represented by a mark and a zero is represented by a space for normal polarity, and the opposite for inverted polarity. in irda format, a zero is represented by short high pulse in the middle of a bit time remaining idle low for a one for normal polarity, and a zero is represented by short low pulse in the middle of a bit time remaining idle high for a one for inverted polarity. 0 normal polarity 1 inverted polarity 2 brk13 break transmit character length this bit determines whether the transmit break character is 10 or 11 bit respectively 13 or 14 bits long. the detection of a framing error is not affected by this bit. 0 break character is 10 or 11 bit long 1 break character is 13 or 14 bit long 1 txdir transmitter pin data direction in single-wire mode ?this bit determines whether the txd pin is going to be used as an input or output, in the single-wire mode of operation. this bit is only relevant in the single-wire mode of operation. 0 txd pin to be used as an input in single-wire mode 1 txd pin to be used as an output in single-wire mode 0 raf receiver active flag raf is set when the receiver detects a logic 0 during the rt1 time period of the start bit search. raf is cleared when the receiver detects an idle character. 0 no reception in progress 1 reception in progress chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 736 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.3.2.9 sci data registers (scidrh, scidrl) read: anytime; reading accesses sci receive data register write: anytime; writing accesses sci transmit data register; writing to r8 has no effect note if the value of t8 is the same as in the previous transmission, t8 does not have to be rewritten.the same value is transmitted until t8 is rewritten in 8-bit data format, only sci data register low (scidrl) needs to be accessed. when transmitting in 9-bit data format and using 8-bit write instructions, write ?st to sci data register high (scidrh), then scidrl. module base + 0x0006 76543210 rr8 t8 000000 w reset 0 0 0 00000 = unimplemented or reserved figure 20-12. sci data registers (scidrh) module base + 0x0007 76543210 rr7r6r5r4r3r2r1r0 w t7 t6 t5 t4 t3 t2 t1 t0 reset 0 0 0 00000 figure 20-13. sci data registers (scidrl) table 20-13. scidrh and scidrl field descriptions field description scidrh 7 r8 received bit 8 ?r8 is the ninth data bit received when the sci is con?ured for 9-bit data format (m = 1). scidrh 6 t8 transmit bit 8 ?t8 is the ninth data bit transmitted when the sci is con?ured for 9-bit data format (m = 1). scidrl 7:0 r[7:0] t[7:0] r7:r0 ?received bits seven through zero for 9-bit or 8-bit data formats t7:t0 ?transmit bits seven through zero for 9-bit or 8-bit formats chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 737 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4 functional description this section provides a complete functional description of the sci block, detailing the operation of the design from the end user perspective in a number of subsections. figure 20-14 shows the structure of the sci module. the sci allows full duplex, asynchronous, serial communication between the cpu and remote devices, including other cpus. the sci transmitter and receiver operate independently, although they use the same baud rate generator. the cpu monitors the status of the sci, writes the data to be transmitted, and processes received data. figure 20-14. detailed sci block diagram sci data receive shift register sci data register transmit shift register register baud rate generator sbr12:sbr0 bus transmit control 16 receive and wakeup data format control control t8 pf fe nf rdrf idle tie or tcie tdre tc r8 raf loops rwu re pe ilt pt wake m clock ilie rie rxd rsrc sbk loops te rsrc iren r16xclk ir_rxd txd ir_txd r16xclk r32xclk tnp[1:0] iren transmit encoder receive decoder scrxd sctxd infrared infrared tc tdre rdrf/or idle active edge detect break detect rxd bkdfe berrm[1:0] bkdie bkdif rxedgie rxedgif berrie berrif sci interrupt request lin transmit collision detect chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 738 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.1 infrared interface submodule this module provides the capability of transmitting narrow pulses to an ir led and receiving narrow pulses and transforming them to serial bits, which are sent to the sci. the irda physical layer speci?ation de?es a half-duplex infrared communication link for exchange data. the full standard includes data rates up to 16 mbits/s. this design covers only data rates between 2.4 kbits/s and 115.2 kbits/s. the infrared submodule consists of two major blocks: the transmit encoder and the receive decoder. the sci transmits serial bits of data which are encoded by the infrared submodule to transmit a narrow pulse for every zero bit. no pulse is transmitted for every one bit. when receiving data, the ir pulses should be detected using an ir photo diode and transformed to cmos levels by the ir receive decoder (external from the mcu). the narrow pulses are then stretched by the infrared submodule to get back to a serial bit stream to be received by the sci.the polarity of transmitted pulses and expected receive pulses can be inverted so that a direct connection can be made to external irda transceiver modules that uses active low pulses. the infrared submodule receives its clock sources from the sci. one of these two clocks are selected in the infrared submodule in order to generate either 3/16, 1/16, 1/32 or 1/4 narrow pulses during transmission. the infrared block receives two clock sources from the sci, r16xclk and r32xclk, which are con?ured to generate the narrow pulse width during transmission. the r16xclk and r32xclk are internal clocks with frequencies 16 and 32 times the baud rate respectively. both r16xclk and r32xclk clocks are used for transmitting data. the receive decoder uses only the r16xclk clock. 20.4.1.1 infrared transmit encoder the infrared transmit encoder converts serial bits of data from transmit shift register to the txd pin. a narrow pulse is transmitted for a zero bit and no pulse for a one bit. the narrow pulse is sent in the middle of the bit with a duration of 1/32, 1/16, 3/16 or 1/4 of a bit time. a narrow high pulse is transmitted for a zero bit when txpol is cleared, while a narrow low pulse is transmitted for a zero bit when txpol is set. 20.4.1.2 infrared receive decoder the infrared receive block converts data from the rxd pin to the receive shift register. a narrow pulse is expected for each zero received and no pulse is expected for each one received. a narrow high pulse is expected for a zero bit when rxpol is cleared, while a narrow low pulse is expected for a zero bit when rxpol is set. this receive decoder meets the edge jitter requirement as de?ed by the irda serial infrared physical layer speci?ation. 20.4.2 lin support this module provides some basic support for the lin protocol. at ?st this is a break detect circuitry making it easier for the lin software to distinguish a break character from an incoming data stream. as a further addition is supports a collision detection at the bit level as well as cancelling pending transmissions. chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 739 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.3 data format the sci uses the standard nrz mark/space data format. when infrared is enabled, the sci uses rzi data format where zeroes are represented by light pulses and ones remain low. see figure 20-15 below. figure 20-15. sci data formats each data character is contained in a frame that includes a start bit, eight or nine data bits, and a stop bit. clearing the m bit in sci control register 1 con?ures the sci for 8-bit data characters. a frame with eight data bits has a total of 10 bits. setting the m bit con?ures the sci for nine-bit data characters. a frame with nine data bits has a total of 11 bits. when the sci is con?ured for 9-bit data characters, the ninth data bit is the t8 bit in sci data register high (scidrh). it remains unchanged after transmission and can be used repeatedly without rewriting it. a frame with nine data bits has a total of 11 bits. table 20-14. example of 8-bit data formats start bit data bits address bits parity bits stop bit 18001 17011 17 1 1 1 the address bit identi?s the frame as an address character. see section 20.4.6.6, ?eceiver wakeup . 01 table 20-15. example of 9-bit data formats start bit data bits address bits parity bits stop bit 19001 18011 18 1 1 01 bit 5 start bit bit 0 bit 1 next stop bit start bit 8-bit data format (bit m in scicr1 clear) start bit bit 0 next stop bit start bit 9-bit data format (bit m in scicr1 set) bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 bit 8 bit 2 bit 3 bit 4 bit 6 bit 7 possible parity bit possible parity bit standard sci data infrared sci data standard sci data infrared sci data chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 740 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.4 baud rate generation a 13-bit modulus counter in the baud rate generator derives the baud rate for both the receiver and the transmitter. the value from 0 to 8191 written to the sbr12:sbr0 bits determines the bus clock divisor. the sbr bits are in the sci baud rate registers (scibdh and scibdl). the baud rate clock is synchronized with the bus clock and drives the receiver. the baud rate clock divided by 16 drives the transmitter. the receiver has an acquisition rate of 16 samples per bit time. baud rate generation is subject to one source of error: integer division of the bus clock may not give the exact target frequency. table 20-16 lists some examples of achieving target baud rates with a bus clock frequency of 25 mhz. when iren = 0 then, sci baud rate = sci bus clock / (16 * scibr[12:0]) 1 the address bit identi?s the frame as an address character. see section 20.4.6.6, ?eceiver wakeup . table 20-16. baud rates (example: bus clock = 25 mhz) bits sbr[12:0] receiver clock (hz) transmitter clock (hz) target baud rate error (%) 41 609,756.1 38,109.8 38,400 .76 81 308,642.0 19,290.1 19,200 .47 163 153,374.2 9585.9 9,600 .16 326 76,687.1 4792.9 4,800 .15 651 38,402.5 2400.2 2,400 .01 1302 19,201.2 1200.1 1,200 .01 2604 9600.6 600.0 600 .00 5208 4800.0 300.0 300 .00 chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 741 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.5 transmitter figure 20-16. transmitter block diagram 20.4.5.1 transmitter character length the sci transmitter can accommodate either 8-bit or 9-bit data characters. the state of the m bit in sci control register 1 (scicr1) determines the length of data characters. when transmitting 9-bit data, bit t8 in sci data register high (scidrh) is the ninth bit (bit 8). 20.4.5.2 character transmission to transmit data, the mcu writes the data bits to the sci data registers (scidrh/scidrl), which in turn are transferred to the transmitter shift register. the transmit shift register then shifts a frame out through the txd pin, after it has prefaced them with a start bit and appended them with a stop bit. the sci data registers (scidrh and scidrl) are the write-only buffers between the internal data bus and the transmit shift register. pe pt h876543210l 11-bit transmit register stop start t8 tie tdre tcie sbk tc parity generation msb sci data registers load from scidr shift enable preamble (all 1s) break (all 0s) transmitter control m internal bus sbr12:sbr0 baud divider 16 bus clock te sctxd txpol loops loop rsrc control to receiver transmit collision detect tdre irq tc irq sctxd scrxd (from receiver) tcie berrif ber irq berrm[1:0] chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 742 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the sci also sets a ?g, the transmit data register empty ?g (tdre), every time it transfers data from the buffer (scidrh/l) to the transmitter shift register.the transmit driver routine may respond to this ?g by writing another byte to the transmitter buffer (scidrh/scidrl), while the shift register is still shifting out the ?st byte. to initiate an sci transmission: 1. con?ure the sci: a) select a baud rate. write this value to the sci baud registers (scibdh/l) to begin the baud rate generator. remember that the baud rate generator is disabled when the baud rate is zero. writing to the scibdh has no effect without also writing to scibdl. b) write to scicr1 to con?ure word length, parity, and other con?uration bits (loops,rsrc,m,wake,ilt,pe,pt). c) enable the transmitter, interrupts, receive, and wake up as required, by writing to the scicr2 register bits (tie,tcie,rie,ilie,te,re,rwu,sbk). a preamble or idle character will now be shifted out of the transmitter shift register. 2. transmit procedure for each byte: a) poll the tdre ?g by reading the scisr1 or responding to the tdre interrupt. keep in mind that the tdre bit resets to one. b) if the tdre ?g is set, write the data to be transmitted to scidrh/l, where the ninth bit is written to the t8 bit in scidrh if the sci is in 9-bit data format. a new transmission will not result until the tdre ?g has been cleared. 3. repeat step 2 for each subsequent transmission. note the tdre ?g is set when the shift register is loaded with the next data to be transmitted from scidrh/l, which happens, generally speaking, a little over half-way through the stop bit of the previous frame. speci?ally, this transfer occurs 9/16ths of a bit time after the start of the stop bit of the previous frame. writing the te bit from 0 to a 1 automatically loads the transmit shift register with a preamble of 10 logic 1s (if m = 0) or 11 logic 1s (if m = 1). after the preamble shifts out, control logic transfers the data from the sci data register into the transmit shift register. a logic 0 start bit automatically goes into the least signi?ant bit position of the transmit shift register. a logic 1 stop bit goes into the most signi?ant bit position. hardware supports odd or even parity. when parity is enabled, the most signi?ant bit (msb) of the data character is the parity bit. the transmit data register empty ?g, tdre, in sci status register 1 (scisr1) becomes set when the sci data register transfers a byte to the transmit shift register. the tdre ?g indicates that the sci data register can accept new data from the internal data bus. if the transmit interrupt enable bit, tie, in sci control register 2 (scicr2) is also set, the tdre ?g generates a transmitter interrupt request. chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 743 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 when the transmit shift register is not transmitting a frame, the txd pin goes to the idle condition, logic 1. if at any time software clears the te bit in sci control register 2 (scicr2), the transmitter enable signal goes low and the transmit signal goes idle. if software clears te while a transmission is in progress (tc = 0), the frame in the transmit shift register continues to shift out. to avoid accidentally cutting off the last frame in a message, always wait for tdre to go high after the last frame before clearing te. to separate messages with preambles with minimum idle line time, use this sequence between messages: 1. write the last byte of the ?st message to scidrh/l. 2. wait for the tdre ?g to go high, indicating the transfer of the last frame to the transmit shift register. 3. queue a preamble by clearing and then setting the te bit. 4. write the ?st byte of the second message to scidrh/l. 20.4.5.3 break characters writing a logic 1 to the send break bit, sbk, in sci control register 2 (scicr2) loads the transmit shift register with a break character. a break character contains all logic 0s and has no start, stop, or parity bit. break character length depends on the m bit in sci control register 1 (scicr1). as long as sbk is at logic 1, transmitter logic continuously loads break characters into the transmit shift register. after software clears the sbk bit, the shift register ?ishes transmitting the last break character and then transmits at least one logic 1. the automatic logic 1 at the end of a break character guarantees the recognition of the start bit of the next frame. the sci recognizes a break character when there are 10 or 11(m = 0 or m = 1) consecutive zero received. depending if the break detect feature is enabled or not receiving a break character has these effects on sci registers. if the break detect feature is disabled (bkdfe = 0): sets the framing error flag, fe sets the receive data register full flag, rdrf clears the sci data registers (scidrh/l) may set the overrun flag, or, noise flag, nf, parity error flag, pe, or the receiver active flag, raf (see 3.4.4 and 3.4.5 sci status register 1 and 2) if the break detect feature is enabled (bkdfe = 1) there are two scenarios 1 the break is detected right from a start bit or is detected during a byte reception. sets the break detect interrupt flag, bldif does not change the data register full flag, rdrf or overrun flag or does not change the framing error flag fe, parity error flag pe. does not clear the sci data registers (scidrh/l) may set noise flag nf, or receiver active flag raf. 1. a break character in this context are either 10 or 11 consecutive zero received bits chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 744 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 20-17 shows two cases of break detect. in trace rxd_1 the break symbol starts with the start bit, while in rxd_2 the break starts in the middle of a transmission. if brkdfe = 1, in rxd_1 case there will be no byte transferred to the receive buffer and the rdrf ?g will not be modi?d. also no framing error or parity error will be ?gged from this transfer. in rxd_2 case, however the break signal starts later during the transmission. at the expected stop bit position the byte received so far will be transferred to the receive buffer, the receive data register full ?g will be set, a framing error and if enabled and appropriate a parity error will be set. once the break is detected the brkdif ?g will be set. figure 20-17. break detection if brkdfe = 1 (m = 0) 20.4.5.4 idle characters an idle character (or preamble) contains all logic 1s and has no start, stop, or parity bit. idle character length depends on the m bit in sci control register 1 (scicr1). the preamble is a synchronizing idle character that begins the ?st transmission initiated after writing the te bit from 0 to 1. if the te bit is cleared during a transmission, the txd pin becomes idle after completion of the transmission in progress. clearing and then setting the te bit during a transmission queues an idle character to be sent after the frame currently being transmitted. note when queueing an idle character, return the te bit to logic 1 before the stop bit of the current frame shifts out through the txd pin. setting te after the stop bit appears on txd causes data previously written to the sci data register to be lost. toggle the te bit for a queued idle character while the tdre ?g is set and immediately before writing the next byte to the sci data register. if the te bit is clear and the transmission is complete, the sci is not the master of the txd pin start bit position stop bit position brkdif = 1 fe = 1 brkdif = 1 rxd_1 rxd_2 1 23 4567 8 910 1 23 4567 8 910 zero bit counter zero bit counter . . . . . . chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 745 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.5.5 lin transmit collision detection this module allows to check for collisions on the lin bus. figure 20-18. collision detect principle if the bit error circuit is enabled (berrm[1:0] = 0:1 or = 1:0]), the error detect circuit will compare the transmitted and the received data stream at a point in time and ?g any mismatch. the timing checks run when transmitter is active (not idle). as soon as a mismatch between the transmitted data and the received data is detected the following happens: the next bit transmitted will have a high level (txpol = 0) or low level (txpol = 1) the transmission is aborted and the byte in transmit buffer is discarded. the transmit data register empty and the transmission complete flag will be set the bit error interrupt flag, berrif, will be set. no further transmissions will take place until the berrif is cleared. figure 20-19. timing diagram bit error detection if the bit error detect feature is disabled, the bit error interrupt ?g is cleared. note the rxpol and txpol bit should be set the same when transmission collision detect feature is enabled, otherwise the bit error interrupt ?g may be set incorrectly. txd pin rxd pin lin physical interface synchronizer stage bus clock receive shift register transmit shift register lin bus compare sample bit error point output transmit shift register 01234567891011121314150 input receive shift register berrm[1:0] = 0:1 berrm[1:0] = 1:1 compare sample points sampling begin sampling begin sampling end sampling end chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 746 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.6 receiver figure 20-20. sci receiver block diagram 20.4.6.1 receiver character length the sci receiver can accommodate either 8-bit or 9-bit data characters. the state of the m bit in sci control register 1 (scicr1) determines the length of data characters. when receiving 9-bit data, bit r8 in sci data register high (scidrh) is the ninth bit (bit 8). 20.4.6.2 character reception during an sci reception, the receive shift register shifts a frame in from the rxd pin. the sci data register is the read-only buffer between the internal data bus and the receive shift register. after a complete frame shifts into the receive shift register, the data portion of the frame transfers to the sci data register. the receive data register full ?g, rdrf, in sci status register 1 (scisr1) becomes set, all 1s m wake ilt pe pt re h876543210l 11-bit receive shift register stop start data wakeup parity checking msb sci data register r8 ilie rwu rdrf or nf fe pe internal bus bus sbr12:sbr0 baud divider clock idle raf recovery logic rxpol loops loop rsrc control scrxd from txd pin or transmitter idle irq rdrf/or irq break detect logic active edge detect logic brkdfe brkdie brkdif rxedgie rxedgif break irq rx active edge irq rie chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 747 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 indicating that the received byte can be read. if the receive interrupt enable bit, rie, in sci control register 2 (scicr2) is also set, the rdrf ?g generates an rdrf interrupt request. 20.4.6.3 data sampling the rt clock rate. the rt clock is an internal signal with a frequency 16 times the baud rate. to adjust for baud rate mismatch, the rt clock (see figure 20-21 ) is re-synchronized: after every start bit after the receiver detects a data bit change from logic 1 to logic 0 (after the majority of data bit samples at rt8, rt9, and rt10 returns a valid logic 1 and the majority of the next rt8, rt9, and rt10 samples returns a valid logic 0) to locate the start bit, data recovery logic does an asynchronous search for a logic 0 preceded by three logic 1s.when the falling edge of a possible start bit occurs, the rt clock begins to count to 16. figure 20-21. receiver data sampling to verify the start bit and to detect noise, data recovery logic takes samples at rt3, rt5, and rt7. figure 20-17 summarizes the results of the start bit veri?ation samples. if start bit veri?ation is not successful, the rt clock is reset and a new search for a start bit begins. table 20-17. start bit veri?ation rt3, rt5, and rt7 samples start bit veri?ation noise flag 000 yes 0 001 yes 1 010 yes 1 011 no 0 100 yes 1 101 no 0 110 no 0 111 no 0 reset rt clock rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt2 rt3 rt4 rt5 rt8 rt7 rt6 rt11 rt10 rt9 rt15 rt14 rt13 rt12 rt16 rt1 rt2 rt3 rt4 samples rt clock rt clock count start bit rxd start bit quali?ation start bit data sampling 11 1 1 1 1 110000 0 00 lsb veri?ation chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 748 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 to determine the value of a data bit and to detect noise, recovery logic takes samples at rt8, rt9, and rt10. table 20-18 summarizes the results of the data bit samples. note the rt8, rt9, and rt10 samples do not affect start bit veri?ation. if any or all of the rt8, rt9, and rt10 start bit samples are logic 1s following a successful start bit veri?ation, the noise ?g (nf) is set and the receiver assumes that the bit is a start bit (logic 0). to verify a stop bit and to detect noise, recovery logic takes samples at rt8, rt9, and rt10. table 20-19 summarizes the results of the stop bit samples. table 20-18. data bit recovery rt8, rt9, and rt10 samples data bit determination noise flag 000 0 0 001 0 1 010 0 1 011 1 1 100 0 1 101 1 1 110 1 1 111 1 0 table 20-19. stop bit recovery rt8, rt9, and rt10 samples framing error flag noise flag 000 1 0 001 1 1 010 1 1 011 0 1 100 1 1 101 0 1 110 0 1 111 0 0 chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 749 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 in figure 20-22 the veri?ation samples rt3 and rt5 determine that the ?st low detected was noise and not the beginning of a start bit. the rt clock is reset and the start bit search begins again. the noise ?g is not set because the noise occurred before the start bit was found. figure 20-22. start bit search example 1 in figure 20-23 , veri?ation sample at rt3 is high. the rt3 sample sets the noise ?g. although the perceived bit time is misaligned, the data samples rt8, rt9, and rt10 are within the bit time and data recovery is successful. figure 20-23. start bit search example 2 reset rt clock rt1 rt1 rt1 rt1 rt2 rt3 rt4 rt5 rt1 rt1 rt2 rt3 rt4 rt7 rt6 rt5 rt10 rt9 rt8 rt14 rt13 rt12 rt11 rt15 rt16 rt1 rt2 rt3 samples rt clock rt clock count start bit rxd 11 0 1 111000 00 lsb 0 0 reset rt clock rt1 rt1 rt1 rt1 rt1 rt1 rt2 rt3 rt4 rt5 rt6 rt7 rt8 rt11 rt10 rt9 rt14 rt13 rt12 rt2 rt1 rt16 rt15 rt3 rt4 rt5 rt6 rt7 samples rt clock rt clock count actual start bit rxd 11 1 1 11000 0 lsb 0 0 perceived start bit chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 750 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 in figure 20-24 , a large burst of noise is perceived as the beginning of a start bit, although the test sample at rt5 is high. the rt5 sample sets the noise ?g. although this is a worst-case misalignment of perceived bit time, the data samples rt8, rt9, and rt10 are within the bit time and data recovery is successful. figure 20-24. start bit search example 3 figure 20-25 shows the effect of noise early in the start bit time. although this noise does not affect proper synchronization with the start bit time, it does set the noise ?g. figure 20-25. start bit search example 4 reset rt clock rt1 rt1 rt1 rt1 rt2 rt3 rt4 rt5 rt6 rt7 rt8 rt9 rt10 rt13 rt12 rt11 rt16 rt15 rt14 rt4 rt3 rt2 rt1 rt5 rt6 rt7 rt8 rt9 samples rt clock rt clock count actual start bit rxd 10 1 11000 0 lsb 0 perceived start bit reset rt clock rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt2 rt3 rt4 rt7 rt6 rt5 rt10 rt9 rt8 rt14 rt13 rt12 rt11 rt15 rt16 rt1 rt2 rt3 samples rt clock rt clock count perceived and actual start bit rxd 11 1 1100 1 lsb 1 1 1 1 chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 751 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 20-26 shows a burst of noise near the beginning of the start bit that resets the rt clock. the sample after the reset is low but is not preceded by three high samples that would qualify as a falling edge. depending on the timing of the start bit search and on the data, the frame may be missed entirely or it may set the framing error ?g. figure 20-26. start bit search example 5 in figure 20-27 , a noise burst makes the majority of data samples rt8, rt9, and rt10 high. this sets the noise ?g but does not reset the rt clock. in start bits only, the rt8, rt9, and rt10 data samples are ignored. figure 20-27. start bit search example 6 20.4.6.4 framing errors if the data recovery logic does not detect a logic 1 where the stop bit should be in an incoming frame, it sets the framing error ?g, fe, in sci status register 1 (scisr1). a break character also sets the fe ?g because a break character has no stop bit. the fe ?g is set at the same time that the rdrf ?g is set. reset rt clock rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt2 rt3 rt4 rt7 rt6 rt5 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 samples rt clock rt clock count start bit rxd 11 1 1101 0 lsb 1 1 1 1 1 00 0 00 0 0 0 no start bit found reset rt clock rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt1 rt2 rt3 rt4 rt7 rt6 rt5 rt10 rt9 rt8 rt14 rt13 rt12 rt11 rt15 rt16 rt1 rt2 rt3 samples rt clock rt clock count start bit rxd 11 1 1100 0 lsb 1 1 1 1 0 11 0 chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 752 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.6.5 baud rate tolerance a transmitting device may be operating at a baud rate below or above the receiver baud rate. accumulated bit time misalignment can cause one of the three stop bit data samples (rt8, rt9, and rt10) to fall outside the actual stop bit. a noise error will occur if the rt8, rt9, and rt10 samples are not all the same logical values. a framing error will occur if the receiver clock is misaligned in such a way that the majority of the rt8, rt9, and rt10 stop bit samples are a logic zero. as the receiver samples an incoming frame, it re-synchronizes the rt clock on any valid falling edge within the frame. re synchronization within frames will correct a misalignment between transmitter bit times and receiver bit times. 20.4.6.5.1 slow data tolerance figure 20-28 shows how much a slow received frame can be misaligned without causing a noise error or a framing error. the slow stop bit begins at rt8 instead of rt1 but arrives in time for the stop bit data samples at rt8, rt9, and rt10. figure 20-28. slow data let s take rtr as receiver rt clock and rtt as transmitter rt clock. for an 8-bit data character, it takes the receiver 9 bit times x 16 rtr cycles +7 rtr cycles = 151 rtr cycles to start data sampling of the stop bit. with the misaligned character shown in figure 20-28 , the receiver counts 151 rtr cycles at the point when the count of the transmitting device is 9 bit times x 16 rtt cycles = 144 rtt cycles. the maximum percent difference between the receiver count and the transmitter count of a slow 8-bit data character with no errors is: ((151 ?144) / 151) x 100 = 4.63% for a 9-bit data character, it takes the receiver 10 bit times x 16 rtr cycles + 7 rtr cycles = 167 rtr cycles to start data sampling of the stop bit. with the misaligned character shown in figure 20-28 , the receiver counts 167 rtr cycles at the point when the count of the transmitting device is 10 bit times x 16 rtt cycles = 160 rtt cycles. the maximum percent difference between the receiver count and the transmitter count of a slow 9-bit character with no errors is: ((167 ?160) / 167) x 100 = 4.19% msb stop rt1 rt2 rt3 rt4 rt5 rt6 rt7 rt8 rt9 rt10 rt11 rt12 rt13 rt14 rt15 rt16 data samples receiver rt clock chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 753 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.6.5.2 fast data tolerance figure 20-29 shows how much a fast received frame can be misaligned. the fast stop bit ends at rt10 instead of rt16 but is still sampled at rt8, rt9, and rt10. figure 20-29. fast data for an 8-bit data character, it takes the receiver 9 bit times x 16 rtr cycles + 10 rtr cycles = 154 rtr cycles to ?ish data sampling of the stop bit. with the misaligned character shown in figure 20-29 , the receiver counts 154 rtr cycles at the point when the count of the transmitting device is 10 bit times x 16 rtt cycles = 160 rtt cycles. the maximum percent difference between the receiver count and the transmitter count of a fast 8-bit character with no errors is: ((160 ?154) / 160) x 100 = 3.75% for a 9-bit data character, it takes the receiver 10 bit times x 16 rtr cycles + 10 rtr cycles = 170 rtr cycles to ?ish data sampling of the stop bit. with the misaligned character shown in figure 20-29 , the receiver counts 170 rtr cycles at the point when the count of the transmitting device is 11 bit times x 16 rtt cycles = 176 rtt cycles. the maximum percent difference between the receiver count and the transmitter count of a fast 9-bit character with no errors is: ((176 ?170) /176) x 100 = 3.40% 20.4.6.6 receiver wakeup to enable the sci to ignore transmissions intended only for other receivers in multiple-receiver systems, the receiver can be put into a standby state. setting the receiver wakeup bit, rwu, in sci control register 2 (scicr2) puts the receiver into standby state during which receiver interrupts are disabled.the sci will still load the receive data into the scidrh/l registers, but it will not set the rdrf ?g. the transmitting device can address messages to selected receivers by including addressing information in the initial frame or frames of each message. the wake bit in sci control register 1 (scicr1) determines how the sci is brought out of the standby state to process an incoming message. the wake bit enables either idle line wakeup or address mark wakeup. idle or next frame stop rt1 rt2 rt3 rt4 rt5 rt6 rt7 rt8 rt9 rt10 rt11 rt12 rt13 rt14 rt15 rt16 data samples receiver rt clock chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 754 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.4.6.6.1 idle input line wakeup (wake = 0) in this wakeup method, an idle condition on the rxd pin clears the rwu bit and wakes up the sci. the initial frame or frames of every message contain addressing information. all receivers evaluate the addressing information, and receivers for which the message is addressed process the frames that follow. any receiver for which a message is not addressed can set its rwu bit and return to the standby state. the rwu bit remains set and the receiver remains on standby until another idle character appears on the rxd pin. idle line wakeup requires that messages be separated by at least one idle character and that no message contains idle characters. the idle character that wakes a receiver does not set the receiver idle bit, idle, or the receive data register full ?g, rdrf. the idle line type bit, ilt, determines whether the receiver begins counting logic 1s as idle character bits after the start bit or after the stop bit. ilt is in sci control register 1 (scicr1). 20.4.6.6.2 address mark wakeup (wake = 1) in this wakeup method, a logic 1 in the most signi?ant bit (msb) position of a frame clears the rwu bit and wakes up the sci. the logic 1 in the msb position marks a frame as an address frame that contains addressing information. all receivers evaluate the addressing information, and the receivers for which the message is addressed process the frames that follow.any receiver for which a message is not addressed can set its rwu bit and return to the standby state. the rwu bit remains set and the receiver remains on standby until another address frame appears on the rxd pin. the logic 1 msb of an address frame clears the receiver s rwu bit before the stop bit is received and sets the rdrf ?g. address mark wakeup allows messages to contain idle characters but requires that the msb be reserved for use in address frames. note with the wake bit clear, setting the rwu bit after the rxd pin has been idle can cause the receiver to wake up immediately. 20.4.7 single-wire operation normally, the sci uses two pins for transmitting and receiving. in single-wire operation, the rxd pin is disconnected from the sci. the sci uses the txd pin for both receiving and transmitting. figure 20-30. single-wire operation (loops = 1, rsrc = 1) rxd transmitter receiver txd chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 755 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 enable single-wire operation by setting the loops bit and the receiver source bit, rsrc, in sci control register 1 (scicr1). setting the loops bit disables the path from the rxd pin to the receiver. setting the rsrc bit connects the txd pin to the receiver. both the transmitter and receiver must be enabled (te = 1 and re = 1).the txdir bit (scisr2[1]) determines whether the txd pin is going to be used as an input (txdir = 0) or an output (txdir = 1) in this mode of operation. note in single-wire operation data from the txd pin is inverted if rxpol is set. 20.4.8 loop operation in loop operation the transmitter output goes to the receiver input. the rxd pin is disconnected from the sci. figure 20-31. loop operation (loops = 1, rsrc = 0) enable loop operation by setting the loops bit and clearing the rsrc bit in sci control register 1 (scicr1). setting the loops bit disables the path from the rxd pin to the receiver. clearing the rsrc bit connects the transmitter output to the receiver input. both the transmitter and receiver must be enabled (te = 1 and re = 1). note in loop operation data from the transmitter is not recognized by the receiver if rxpol and txpol are not the same. 20.5 initialization/application information 20.5.1 reset initialization see section 20.3.2, ?egister descriptions . 20.5.2 modes of operation 20.5.2.1 run mode normal mode of operation. to initialize a sci transmission, see section 20.4.5.2, ?haracter transmission . rxd transmitter receiver txd chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 756 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.5.2.2 wait mode sci operation in wait mode depends on the state of the sciswai bit in the sci control register 1 (scicr1). if sciswai is clear, the sci operates normally when the cpu is in wait mode. if sciswai is set, sci clock generation ceases and the sci module enters a power-conservation state when the cpu is in wait mode. setting sciswai does not affect the state of the receiver enable bit, re, or the transmitter enable bit, te. if sciswai is set, any transmission or reception in progress stops at wait mode entry. the transmission or reception resumes when either an internal or external interrupt brings the cpu out of wait mode. exiting wait mode by reset aborts any transmission or reception in progress and resets the sci. 20.5.2.3 stop mode the sci is inactive during stop mode for reduced power consumption. the stop instruction does not affect the sci register states, but the sci bus clock will be disabled. the sci operation resumes from where it left off after an external interrupt brings the cpu out of stop mode. exiting stop mode by reset aborts any transmission or reception in progress and resets the sci. the receive input active edge detect circuit is still active in stop mode. an active edge on the receive input can be used to bring the cpu out of stop mode. 20.5.3 interrupt operation this section describes the interrupt originated by the sci block.the mcu must service the interrupt requests. table 20-20 lists the eight interrupt sources of the sci. table 20-20. sci interrupt sources interrupt source local enable description tdre scisr1[7] tie active high level. indicates that a byte was transferred from scidrh/l to the transmit shift register. tc scisr1[6] tcie active high level. indicates that a transmit is complete. rdrf scisr1[5] rie active high level. the rdrf interrupt indicates that received data is available in the sci data register. or scisr1[3] active high level. this interrupt indicates that an overrun condition has occurred. idle scisr1[4] ilie active high level. indicates that receiver input has become idle. rxedgif sciasr1[7] rxedgie active high level. indicates that an active edge (falling for rxpol = 0, rising for rxpol = 1) was detected. berrif sciasr1[1] berrie active high level. indicates that a mismatch between transmitted and received data in a single wire application has happened. bkdif sciasr1[0] brkdie active high level. indicates that a break character has been received. chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 757 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.5.3.1 description of interrupt operation the sci only originates interrupt requests. the following is a description of how the sci makes a request and how the mcu should acknowledge that request. the interrupt vector offset and interrupt number are chip dependent. the sci only has a single interrupt line (sci interrupt signal, active high operation) and all the following interrupts, when generated, are ored together and issued through that port. 20.5.3.1.1 tdre description the tdre interrupt is set high by the sci when the transmit shift register receives a byte from the sci data register. a tdre interrupt indicates that the transmit data register (scidrh/l) is empty and that a new byte can be written to the scidrh/l for transmission.clear tdre by reading sci status register 1 with tdre set and then writing to sci data register low (scidrl). 20.5.3.1.2 tc description the tc interrupt is set by the sci when a transmission has been completed. transmission is completed when all bits including the stop bit (if transmitted) have been shifted out and no data is queued to be transmitted. no stop bit is transmitted when sending a break character and the tc ?g is set (providing there is no more data queued for transmission) when the break character has been shifted out. a tc interrupt indicates that there is no transmission in progress. tc is set high when the tdre ?g is set and no data, preamble, or break character is being transmitted. when tc is set, the txd pin becomes idle (logic 1). clear tc by reading sci status register 1 (scisr1) with tc set and then writing to sci data register low (scidrl).tc is cleared automatically when data, preamble, or break is queued and ready to be sent. 20.5.3.1.3 rdrf description the rdrf interrupt is set when the data in the receive shift register transfers to the sci data register. a rdrf interrupt indicates that the received data has been transferred to the sci data register and that the byte can now be read by the mcu. the rdrf interrupt is cleared by reading the sci status register one (scisr1) and then reading sci data register low (scidrl). 20.5.3.1.4 or description the or interrupt is set when software fails to read the sci data register before the receive shift register receives the next frame. the newly acquired data in the shift register will be lost in this case, but the data already in the sci data registers is not affected. the or interrupt is cleared by reading the sci status register one (scisr1) and then reading sci data register low (scidrl). 20.5.3.1.5 idle description the idle interrupt is set when 10 consecutive logic 1s (if m = 0) or 11 consecutive logic 1s (if m = 1) appear on the receiver input. once the idle is cleared, a valid frame must again set the rdrf ?g before an idle condition can set the idle ?g. clear idle by reading sci status register 1 (scisr1) with idle set and then reading sci data register low (scidrl). chapter 20 serial communication interface (s12sciv5) mc9s12xe-family reference manual , rev. 1.21 758 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 20.5.3.1.6 rxedgif description the rxedgif interrupt is set when an active edge (falling if rxpol = 0, rising if rxpol = 1) on the rxd pin is detected. clear rxedgif by writing a ??to the sciasr1 sci alternative status register 1. 20.5.3.1.7 berrif description the berrif interrupt is set when a mismatch between the transmitted and the received data in a single wire application like lin was detected. clear berrif by writing a ??to the sciasr1 sci alternative status register 1. this ?g is also cleared if the bit error detect feature is disabled. 20.5.3.1.8 bkdif description the bkdif interrupt is set when a break signal was received. clear bkdif by writing a ??to the sciasr1 sci alternative status register 1. this ?g is also cleared if break detect feature is disabled. 20.5.4 recovery from wait mode the sci interrupt request can be used to bring the cpu out of wait mode. 20.5.5 recovery from stop mode an active edge on the receive input can be used to bring the cpu out of stop mode. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 759 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 21 serial peripheral interface (s12spiv5) 21.1 introduction the spi module allows a duplex, synchronous, serial communication between the mcu and peripheral devices. software can poll the spi status ?gs or the spi operation can be interrupt driven. 21.1.1 glossary of terms 21.1.2 features the spi includes these distinctive features: master mode and slave mode selectable 8 or 16-bit transfer width bidirectional mode slave select output mode fault error ?g with cpu interrupt capability double-buffered data register serial clock with programmable polarity and phase control of spi operation during wait mode 21.1.3 modes of operation the spi functions in three modes: run, wait, and stop. table 21-1. revision history revision number revision date sections affected description of changes v05.00 24 mar 2005 21.3.2/21-763 - added 16-bit transfer width feature. spi serial peripheral interface ss slave select sck serial clock mosi master output, slave input miso master input, slave output momi master output, master input siso slave input, slave output chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 760 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 run mode this is the basic mode of operation. wait mode spi operation in wait mode is a con?urable low power mode, controlled by the spiswai bit located in the spicr2 register. in wait mode, if the spiswai bit is clear, the spi operates like in run mode. if the spiswai bit is set, the spi goes into a power conservative state, with the spi clock generation turned off. if the spi is con?ured as a master, any transmission in progress stops, but is resumed after cpu goes into run mode. if the spi is con?ured as a slave, reception and transmission of data continues, so that the slave stays synchronized to the master. stop mode the spi is inactive in stop mode for reduced power consumption. if the spi is con?ured as a master, any transmission in progress stops, but is resumed after cpu goes into run mode. if the spi is con?ured as a slave, reception and transmission of data continues, so that the slave stays synchronized to the master. for a detailed description of operating modes, please refer to section 21.4.7, ?ow power mode options . 21.1.4 block diagram figure 21-1 gives an overview on the spi architecture. the main parts of the spi are status, control and data registers, shifter logic, baud rate generator, master/slave control logic, and port control logic. chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 761 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 21-1. spi block diagram 21.2 external signal description this section lists the name and description of all ports including inputs and outputs that do, or may, connect off chip. the spi module has a total of four external pins. 21.2.1 mosi ?master out/slave in pin this pin is used to transmit data out of the spi module when it is con?ured as a master and receive data when it is con?ured as slave. 21.2.2 miso ?master in/slave out pin this pin is used to transmit data out of the spi module when it is con?ured as a slave and receive data when it is con?ured as master. spi control register 1 spi control register 2 spi baud rate register spi status register spi data register shifter port control logic mosi sck interrupt control spi msb lsb lsbfe=1 lsbfe=0 lsbfe=0 lsbfe=1 data in lsbfe=1 lsbfe=0 data out baud rate generator prescaler bus clock counter clock select sppr 3 3 spr baud rate phase + polarity control master slave sck in sck out master baud rate slave baud rate phase + polarity control control control cpol cpha 2 bidiroe spc0 2 shift sample clock clock modf spif sptef spi request interrupt ss chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 762 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 21.2.3 ss ?slave select pin this pin is used to output the select signal from the spi module to another peripheral with which a data transfer is to take place when it is con?ured as a master and it is used as an input to receive the slave select signal when the spi is con?ured as slave. 21.2.4 sck ?serial clock pin in master mode, this is the synchronous output clock. in slave mode, this is the synchronous input clock. 21.3 memory map and register de?ition this section provides a detailed description of address space and registers used by the spi. 21.3.1 module memory map the memory map for the spi is given in figure 21-2 . the address listed for each register is the sum of a base address and an address offset. the base address is de?ed at the soc level and the address offset is de?ed at the module level. reads from the reserved bits return zeros and writes to the reserved bits have no effect. register name bit 7 6 5 4 3 2 1 bit 0 0x0000 spicr1 r spie spe sptie mstr cpol cpha ssoe lsbfe w 0x0001 spicr2 r0 xfrw 0 modfen bidiroe 0 spiswai spc0 w 0x0002 spibr r0 sppr2 sppr1 sppr0 0 spr2 spr1 spr0 w 0x0003 spisr r spif 0 sptef modf 0 0 0 0 w 0x0004 spidrh r r15 r14 r13 r12 r11 r10 r9 r8 t15 t14 t13 t12 t11 t10 t9 t8 w 0x0005 spidrl rr7r6r5r4r3r2r1r0 t7 t6 t5 t4 t3 t2 t1 t0 w 0x0006 reserved r w 0x0007 reserved r w = unimplemented or reserved figure 21-2. spi register summary chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 763 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 21.3.2 register descriptions this section consists of register descriptions in address order. each description includes a standard register diagram with an associated ?ure number. details of register bit and ?ld function follow the register diagrams, in bit order. 21.3.2.1 spi control register 1 (spicr1) read: anytime write: anytime module base +0x0000 76543210 r spie spe sptie mstr cpol cpha ssoe lsbfe w reset 0 0 0 00100 figure 21-3. spi control register 1 (spicr1) table 21-2. spicr1 field descriptions field description 7 spie spi interrupt enable bit ?this bit enables spi interrupt requests, if spif or modf status ?g is set. 0 spi interrupts disabled. 1 spi interrupts enabled. 6 spe spi system enable bit ?this bit enables the spi system and dedicates the spi port pins to spi system functions. if spe is cleared, spi is disabled and forced into idle state, status bits in spisr register are reset. 0 spi disabled (lower power consumption). 1 spi enabled, port pins are dedicated to spi functions. 5 sptie spi transmit interrupt enable ?this bit enables spi interrupt requests, if sptef ?g is set. 0 sptef interrupt disabled. 1 sptef interrupt enabled. 4 mstr spi master/slave mode select bit ?this bit selects whether the spi operates in master or slave mode. switching the spi from master to slave or vice versa forces the spi system into idle state. 0 spi is in slave mode. 1 spi is in master mode. 3 cpol spi clock polarity bit this bit selects an inverted or non-inverted spi clock. to transmit data between spi modules, the spi modules must have identical cpol values. in master mode, a change of this bit will abort a transmission in progress and force the spi system into idle state. 0 active-high clocks selected. in idle state sck is low. 1 active-low clocks selected. in idle state sck is high. 2 cpha spi clock phase bit this bit is used to select the spi clock format. in master mode, a change of this bit will abort a transmission in progress and force the spi system into idle state. 0 sampling of data occurs at odd edges (1,3,5,...) of the sck clock. 1 sampling of data occurs at even edges (2,4,6,...) of the sck clock. chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 764 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 21.3.2.2 spi control register 2 (spicr2) read: anytime write: anytime; writes to the reserved bits have no effect 1 ssoe slave select output enable ?the ss output feature is enabled only in master mode, if modfen is set, by asserting the ssoe as shown in table 21-3 . in master mode, a change of this bit will abort a transmission in progress and force the spi system into idle state. 0 lsbfe lsb-first enable ?this bit does not affect the position of the msb and lsb in the data register. reads and writes of the data register always have the msb in the highest bit position. in master mode, a change of this bit will abort a transmission in progress and force the spi system into idle state. 0 data is transferred most signi?ant bit ?st. 1 data is transferred least signi?ant bit ?st. table 21-3. ss input / output selection modfen ssoe master mode slave mode 00 ss not used by spi ss input 01 ss not used by spi ss input 10 ss input with modf feature ss input 11 ss is slave select output ss input module base +0x0001 76543210 r0 xfrw 0 modfen bidiroe 0 spiswai spc0 w reset 0 0 0 00000 = unimplemented or reserved figure 21-4. spi control register 2 (spicr2) table 21-2. spicr1 field descriptions (continued) field description chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 765 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 21-4. spicr2 field descriptions field description 6 xfrw transfer width this bit is used for selecting the data transfer width. if 8-bit transfer width is selected, spidrl becomes the dedicated data register and spidrh is unused. if 16-bit transfer width is selected, spidrh and spidrl form a 16-bit data register. please refer to section 21.3.2.4, ?pi status register (spisr) for information about transmit/receive data handling and the interrupt ?g clearing mechanism. in master mode, a change of this bit will abort a transmission in progress and force the spi system into idle state. 0 8-bit transfer width (n = 8) (1) 1 16-bit transfer width (n = 16) 1 1. n is used later in this document as a placeholder for the selected transfer width. 4 modfen mode fault enable bit ?this bit allows the modf failure to be detected. if the spi is in master mode and modfen is cleared, then the ss port pin is not used by the spi. in slave mode, the ss is available only as an input regardless of the value of modfen. for an overview on the impact of the modfen bit on the ss port pin con?uration, refer to table 21-3 . in master mode, a change of this bit will abort a transmission in progress and force the spi system into idle state. 0 ss port pin is not used by the spi. 1 ss port pin with modf feature. 3 bidiroe output enable in the bidirectional mode of operation this bit controls the mosi and miso output buffer of the spi, when in bidirectional mode of operation (spc0 is set). in master mode, this bit controls the output buffer of the mosi port, in slave mode it controls the output buffer of the miso port. in master mode, with spc0 set, a change of this bit will abort a transmission in progress and force the spi into idle state. 0 output buffer disabled. 1 output buffer enabled. 1 spiswai spi stop in wait mode bit ?this bit is used for power conservation while in wait mode. 0 spi clock operates normally in wait mode. 1 stop spi clock generation when in wait mode. 0 spc0 serial pin control bit 0 ?this bit enables bidirectional pin con?urations as shown in table 21-5 . in master mode, a change of this bit will abort a transmission in progress and force the spi system into idle state. table 21-5. bidirectional pin con?urations pin mode spc0 bidiroe miso mosi master mode of operation normal 0 x master in master out bidirectional 1 0 miso not used by spi master in 1 master i/o slave mode of operation normal 0 x slave out slave in bidirectional 1 0 slave in mosi not used by spi 1 slave i/o chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 766 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 21.3.2.3 spi baud rate register (spibr) read: anytime write: anytime; writes to the reserved bits have no effect the baud rate divisor equation is as follows: baudratedivisor = (sppr + 1) ? 2 (spr + 1) eqn. 21-1 the baud rate can be calculated with the following equation: baud rate = busclock / baudratedivisor eqn. 21-2 note for maximum allowed baud rates, please refer to the spi electrical speci?ation in the electricals chapter of this data sheet. module base +0x0002 76543210 r0 sppr2 sppr1 sppr0 0 spr2 spr1 spr0 w reset 0 0 0 00000 = unimplemented or reserved figure 21-5. spi baud rate register (spibr) table 21-6. spibr field descriptions field description 6? sppr[2:0] spi baud rate preselection bits these bits specify the spi baud rates as shown in table 21-7 . in master mode, a change of these bits will abort a transmission in progress and force the spi system into idle state. 2? spr[2:0] spi baud rate selection bits these bits specify the spi baud rates as shown in table 21-7 . in master mode, a change of these bits will abort a transmission in progress and force the spi system into idle state. table 21-7. example spi baud rate selection (25 mhz bus clock) (sheet 1 of 3) sppr2 sppr1 sppr0 spr2 spr1 spr0 baud rate divisor baud rate 0 0 0 0 0 0 2 12.5 mbit/s 0 0 0 0 0 1 4 6.25 mbit/s 0 0 0 0 1 0 8 3.125 mbit/s 0 0 0 0 1 1 16 1.5625 mbit/s 0 0 0 1 0 0 32 781.25 kbit/s 0 0 0 1 0 1 64 390.63 kbit/s 0 0 0 1 1 0 128 195.31 kbit/s 0 0 0 1 1 1 256 97.66 kbit/s 0 0 1 0 0 0 4 6.25 mbit/s 0 0 1 0 0 1 8 3.125 mbit/s 0 0 1 0 1 0 16 1.5625 mbit/s 0 0 1 0 1 1 32 781.25 kbit/s chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 767 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0 0 1 1 0 0 64 390.63 kbit/s 0 0 1 1 0 1 128 195.31 kbit/s 0 0 1 1 1 0 256 97.66 kbit/s 0 0 1 1 1 1 512 48.83 kbit/s 0 1 0 0 0 0 6 4.16667 mbit/s 0 1 0 0 0 1 12 2.08333 mbit/s 0 1 0 0 1 0 24 1.04167 mbit/s 0 1 0 0 1 1 48 520.83 kbit/s 0 1 0 1 0 0 96 260.42 kbit/s 0 1 0 1 0 1 192 130.21 kbit/s 0 1 0 1 1 0 384 65.10 kbit/s 0 1 0 1 1 1 768 32.55 kbit/s 0 1 1 0 0 0 8 3.125 mbit/s 0 1 1 0 0 1 16 1.5625 mbit/s 0 1 1 0 1 0 32 781.25 kbit/s 0 1 1 0 1 1 64 390.63 kbit/s 0 1 1 1 0 0 128 195.31 kbit/s 0 1 1 1 0 1 256 97.66 kbit/s 0 1 1 1 1 0 512 48.83 kbit/s 0 1 1 1 1 1 1024 24.41 kbit/s 1 0 0 0 0 0 10 2.5 mbit/s 1 0 0 0 0 1 20 1.25 mbit/s 1 0 0 0 1 0 40 625 kbit/s 1 0 0 0 1 1 80 312.5 kbit/s 1 0 0 1 0 0 160 156.25 kbit/s 1 0 0 1 0 1 320 78.13 kbit/s 1 0 0 1 1 0 640 39.06 kbit/s 1 0 0 1 1 1 1280 19.53 kbit/s 1 0 1 0 0 0 12 2.08333 mbit/s 1 0 1 0 0 1 24 1.04167 mbit/s 1 0 1 0 1 0 48 520.83 kbit/s 1 0 1 0 1 1 96 260.42 kbit/s 1 0 1 1 0 0 192 130.21 kbit/s 1 0 1 1 0 1 384 65.10 kbit/s 1 0 1 1 1 0 768 32.55 kbit/s 1 0 1 1 1 1 1536 16.28 kbit/s 1 1 0 0 0 0 14 1.78571 mbit/s 1 1 0 0 0 1 28 892.86 kbit/s 1 1 0 0 1 0 56 446.43 kbit/s 1 1 0 0 1 1 112 223.21 kbit/s 1 1 0 1 0 0 224 111.61 kbit/s 1 1 0 1 0 1 448 55.80 kbit/s table 21-7. example spi baud rate selection (25 mhz bus clock) (sheet 2 of 3) sppr2 sppr1 sppr0 spr2 spr1 spr0 baud rate divisor baud rate chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 768 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 21.3.2.4 spi status register (spisr) read: anytime write: has no effect 1 1 0 1 1 0 896 27.90 kbit/s 1 1 0 1 1 1 1792 13.95 kbit/s 1 1 1 0 0 0 16 1.5625 mbit/s 1 1 1 0 0 1 32 781.25 kbit/s 1 1 1 0 1 0 64 390.63 kbit/s 1 1 1 0 1 1 128 195.31 kbit/s 1 1 1 1 0 0 256 97.66 kbit/s 1 1 1 1 0 1 512 48.83 kbit/s 1 1 1 1 1 0 1024 24.41 kbit/s 1 1 1 1 1 1 2048 12.21 kbit/s module base +0x0003 76543210 r spif 0 sptef modf 0000 w reset 0 0 1 00000 = unimplemented or reserved figure 21-6. spi status register (spisr) table 21-8. spisr field descriptions field description 7 spif spif interrupt flag ?this bit is set after received data has been transferred into the spi data register. for information about clearing spif flag, please refer to table 21-9 . 0 transfer not yet complete. 1 new data copied to spidr. 5 sptef spi transmit empty interrupt flag ?if set, this bit indicates that the transmit data register is empty. for information about clearing this bit and placing data into the transmit data register, please refer to table 21-10 . 0 spi data register not empty. 1 spi data register empty. 4 modf mode fault flag this bit is set if the ss input becomes low while the spi is con?ured as a master and mode fault detection is enabled, modfen bit of spicr2 register is set. refer to modfen bit description in section 21.3.2.2, ?pi control register 2 (spicr2) . the ?g is cleared automatically by a read of the spi status register (with modf set) followed by a write to the spi control register 1. 0 mode fault has not occurred. 1 mode fault has occurred. table 21-7. example spi baud rate selection (25 mhz bus clock) (sheet 3 of 3) sppr2 sppr1 sppr0 spr2 spr1 spr0 baud rate divisor baud rate chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 769 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table 21-9. spif interrupt flag clearing sequence table 21-10. sptef interrupt flag clearing sequence xfrw bit spif interrupt flag clearing sequence 0 read spisr with spif == 1 then read spidrl 1 read spisr with spif == 1 then byte read spidrl (1) 1. data in spidrh is lost in this case. or byte read spidrh (2) 2. spidrh can be read repeatedly without any effect on spif. spif flag is cleared only by the read of spidrl after reading spisr with spif == 1. byte read spidrl or word read (spidrh:spidrl) xfrw bit sptef interrupt flag clearing sequence 0 read spisr with sptef == 1 then write to spidrl (1) 1. any write to spidrh or spidrl with sptef == 0 is effectively ignored. 1 read spisr with sptef == 1 then byte write to spidrl 1(2) 2. data in spidrh is unde?ed in this case. or byte write to spidrh 1(3) 3. spidrh can be written repeatedly without any effect on sptef. sptef flag is cleared only by writing to spidrl after reading spisr with sptef == 1. byte write to spidrl 1 or word write to (spidrh:spidrl) 1 chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 770 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 21.3.2.5 spi data register (spidr = spidrh:spidrl) read: anytime; read data only valid when spif is set write: anytime the spi data register is both the input and output register for spi data. a write to this register allows data to be queued and transmitted. for an spi con?ured as a master, queued data is transmitted immediately after the previous transmission has completed. the spi transmitter empty ?g sptef in the spisr register indicates when the spi data register is ready to accept new data. received data in the spidr is valid when spif is set. if spif is cleared and data has been received, the received data is transferred from the receive shift register to the spidr and spif is set. if spif is set and not serviced, and a second data value has been received, the second received data is kept as valid data in the receive shift register until the start of another transmission. the data in the spidr does not change. if spif is set and valid data is in the receive shift register, and spif is serviced before the start of a third transmission, the data in the receive shift register is transferred into the spidr and spif remains set (see figure 21-9 ). if spif is set and valid data is in the receive shift register, and spif is serviced after the start of a third transmission, the data in the receive shift register has become invalid and is not transferred into the spidr (see figure 21-10 ). module base +0x0004 76543210 r r15 r14 r13 r12 r11 r10 r9 r8 w t15 t14 t13 t12 t11 t10 t9 t8 reset 0 0 0 00000 figure 21-7. spi data register high (spidrh) module base +0x0005 76543210 r r7 r6 r5 r4 r3 r2 r1 r0 w t7 t6 t5 t4 t3 t2 t1 t0 reset 0 0 0 00000 figure 21-8. spi data register low (spidrl) chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 771 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 21-9. reception with spif serviced in time figure 21-10. reception with spif serviced too late 21.4 functional description the spi module allows a duplex, synchronous, serial communication between the mcu and peripheral devices. software can poll the spi status ?gs or spi operation can be interrupt driven. the spi system is enabled by setting the spi enable (spe) bit in spi control register 1. while spe is set, the four associated spi port pins are dedicated to the spi function as: slave select ( ss) serial clock (sck) master out/slave in (mosi) master in/slave out (miso) receive shift register spif spi data register data a data b data a data a received data b received data c data c spif serviced data c received data b = unspeci?d = reception in progress receive shift register spif spi data register data a data b data a data a received data b received data c data c spif serviced data c received data b lost = unspeci?d = reception in progress chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 772 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the main element of the spi system is the spi data register. the n-bit 1 data register in the master and the n-bit 1 data register in the slave are linked by the mosi and miso pins to form a distributed 2n-bit 1 register. when a data transfer operation is performed, this 2n-bit 1 register is serially shifted n 1 bit positions by the s-clock from the master, so data is exchanged between the master and the slave. data written to the master spi data register becomes the output data for the slave, and data read from the master spi data register after a transfer operation is the input data from the slave. a read of spisr with sptef = 1 followed by a write to spidr puts data into the transmit data register. when a transfer is complete and spif is cleared, received data is moved into the receive data register. this data register acts as the spi receive data register for reads and as the spi transmit data register for writes. a common spi data register address is shared for reading data from the read data buffer and for writing data to the transmit data register. the clock phase control bit (cpha) and a clock polarity control bit (cpol) in the spi control register 1 (spicr1) select one of four possible clock formats to be used by the spi system. the cpol bit simply selects a non-inverted or inverted clock. the cpha bit is used to accommodate two fundamentally different protocols by sampling data on odd numbered sck edges or on even numbered sck edges (see section 21.4.3, ?ransmission formats ). the spi can be con?ured to operate as a master or as a slave. when the mstr bit in spi control register1 is set, master mode is selected, when the mstr bit is clear, slave mode is selected. note a change of cpol or mstr bit while there is a received byte pending in the receive shift register will destroy the received byte and must be avoided. 21.4.1 master mode the spi operates in master mode when the mstr bit is set. only a master spi module can initiate transmissions. a transmission begins by writing to the master spi data register. if the shift register is empty, data immediately transfers to the shift register. data begins shifting out on the mosi pin under the control of the serial clock. serial clock the spr2, spr1, and spr0 baud rate selection bits, in conjunction with the sppr2, sppr1, and sppr0 baud rate preselection bits in the spi baud rate register, control the baud rate generator and determine the speed of the transmission. the sck pin is the spi clock output. through the sck pin, the baud rate generator of the master controls the shift register of the slave peripheral. mosi, miso pin in master mode, the function of the serial data output pin (mosi) and the serial data input pin (miso) is determined by the spc0 and bidiroe control bits. ss pin if modfen and ssoe are set, the ss pin is con?ured as slave select output. the ss output becomes low during each transmission and is high when the spi is in idle state. if modfen is set and ssoe is cleared, the ss pin is con?ured as input for detecting mode fault error. if the ss input becomes low this indicates a mode fault error where another master tries to 1. n depends on the selected transfer width, please refer to section 21.3.2.2, ?pi control register 2 (spicr2) chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 773 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 drive the mosi and sck lines. in this case, the spi immediately switches to slave mode, by clearing the mstr bit and also disables the slave output buffer miso (or siso in bidirectional mode). so the result is that all outputs are disabled and sck, mosi, and miso are inputs. if a transmission is in progress when the mode fault occurs, the transmission is aborted and the spi is forced into idle state. this mode fault error also sets the mode fault (modf) ?g in the spi status register (spisr). if the spi interrupt enable bit (spie) is set when the modf ?g becomes set, then an spi interrupt sequence is also requested. when a write to the spi data register in the master occurs, there is a half sck-cycle delay. after the delay, sck is started within the master. the rest of the transfer operation differs slightly, depending on the clock format speci?d by the spi clock phase bit, cpha, in spi control register 1 (see section 21.4.3, ?ransmission formats? . note a change of the bits cpol, cpha, ssoe, lsbfe, xfrw, modfen, spc0, or bidiroe with spc0 set, sppr2-sppr0 and spr2-spr0 in master mode will abort a transmission in progress and force the spi into idle state. the remote slave cannot detect this, therefore the master must ensure that the remote slave is returned to idle state. 21.4.2 slave mode the spi operates in slave mode when the mstr bit in spi control register 1 is clear. serial clock in slave mode, sck is the spi clock input from the master. miso, mosi pin in slave mode, the function of the serial data output pin (miso) and serial data input pin (mosi) is determined by the spc0 bit and bidiroe bit in spi control register 2. ss pin the ss pin is the slave select input. before a data transmission occurs, the ss pin of the slave spi must be low. ss must remain low until the transmission is complete. if ss goes high, the spi is forced into idle state. the ss input also controls the serial data output pin, if ss is high (not selected), the serial data output pin is high impedance, and, if ss is low, the ?st bit in the spi data register is driven out of the serial data output pin. also, if the slave is not selected ( ss is high), then the sck input is ignored and no internal shifting of the spi shift register occurs. although the spi is capable of duplex operation, some spi peripherals are capable of only receiving spi data in a slave mode. for these simpler devices, there is no serial data out pin. note when peripherals with duplex capability are used, take care not to simultaneously enable two receivers whose serial outputs drive the same system slave s serial data output line. chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 774 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 as long as no more than one slave device drives the system slave s serial data output line, it is possible for several slaves to receive the same transmission from a master, although the master would not receive return information from all of the receiving slaves. if the cpha bit in spi control register 1 is clear, odd numbered edges on the sck input cause the data at the serial data input pin to be latched. even numbered edges cause the value previously latched from the serial data input pin to shift into the lsb or msb of the spi shift register, depending on the lsbfe bit. if the cpha bit is set, even numbered edges on the sck input cause the data at the serial data input pin to be latched. odd numbered edges cause the value previously latched from the serial data input pin to shift into the lsb or msb of the spi shift register, depending on the lsbfe bit. when cpha is set, the ?st edge is used to get the ?st data bit onto the serial data output pin. when cpha is clear and the ss input is low (slave selected), the ?st bit of the spi data is driven out of the serial data output pin. after the nth 1 shift, the transfer is considered complete and the received data is transferred into the spi data register. to indicate transfer is complete, the spif ?g in the spi status register is set. note a change of the bits cpol, cpha, ssoe, lsbfe, modfen, spc0, or bidiroe with spc0 set in slave mode will corrupt a transmission in progress and must be avoided. 21.4.3 transmission formats during an spi transmission, data is transmitted (shifted out serially) and received (shifted in serially) simultaneously. the serial clock (sck) synchronizes shifting and sampling of the information on the two serial data lines. a slave select line allows selection of an individual slave spi device; slave devices that are not selected do not interfere with spi bus activities. optionally, on a master spi device, the slave select line can be used to indicate multiple-master bus contention. figure 21-11. master/slave transfer block diagram 21.4.3.1 clock phase and polarity controls using two bits in the spi control register 1, software selects one of four combinations of serial clock phase and polarity. 1. n depends on the selected transfer width, please refer to section 21.3.2.2, ?pi control register 2 (spicr2) shift register shift register baud rate generator master spi slave spi mosi mosi miso miso sck sck ss ss v dd chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 775 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the cpol clock polarity control bit speci?s an active high or low clock and has no signi?ant effect on the transmission format. the cpha clock phase control bit selects one of two fundamentally different transmission formats. clock phase and polarity should be identical for the master spi device and the communicating slave device. in some cases, the phase and polarity are changed between transmissions to allow a master device to communicate with peripheral slaves having different requirements. 21.4.3.2 cpha = 0 transfer format the ?st edge on the sck line is used to clock the ?st data bit of the slave into the master and the ?st data bit of the master into the slave. in some peripherals, the ?st bit of the slave s data is available at the slave s data out pin as soon as the slave is selected. in this format, the ?st sck edge is issued a half cycle after ss has become low. a half sck cycle later, the second edge appears on the sck line. when this second edge occurs, the value previously latched from the serial data input pin is shifted into the lsb or msb of the shift register, depending on lsbfe bit. after this second edge, the next bit of the spi master data is transmitted out of the serial data output pin of the master to the serial input pin on the slave. this process continues for a total of 16 edges on the sck line, with data being latched on odd numbered edges and shifted on even numbered edges. data reception is double buffered. data is shifted serially into the spi shift register during the transfer and is transferred to the parallel spi data register after the last bit is shifted in. after 2n 1 (last) sck edges: data that was previously in the master spi data register should now be in the slave data register and the data that was in the slave data register should be in the master. the spif ?g in the spi status register is set, indicating that the transfer is complete. figure 21-12 is a timing diagram of an spi transfer where cpha = 0. sck waveforms are shown for cpol = 0 and cpol = 1. the diagram may be interpreted as a master or slave timing diagram because the sck, miso, and mosi pins are connected directly between the master and the slave. the miso signal is the output from the slave and the mosi signal is the output from the master. the ss pin of the master must be either high or recon?ured as a general-purpose output not affecting the spi. 1. n depends on the selected transfer width, please refer to section 21.3.2.2, ?pi control register 2 (spicr2) chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 776 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 21-12. spi clock format 0 (cpha = 0), with 8-bit transfer width selected (xfrw = 0) t l begin end sck (cpol = 0) sample i change o sel ss (o) transfer sck (cpol = 1) msb ?st (lsbfe = 0): lsb ?st (lsbfe = 1): msb lsb lsb msb bit 5 bit 2 bit 6 bit 1 bit 4 bit 3 bit 3 bit 4 bit 2 bit 5 bit 1 bit 6 change o sel ss (i) mosi pin miso pin master only mosi/miso t t if next transfer begins here for t t , t l , t l minimum 1/2 sck t i t l t l = minimum leading time before the ?st sck edge t t = minimum trailing time after the last sck edge t i = minimum idling time between transfers (minimum ss high time) t l , t t , and t i are guaranteed for the master mode and required for the slave mode. 1 2 34 56 78910111213141516 sck edge number end of idle state begin of idle state chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 777 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 21-13. spi clock format 0 (cpha = 0), with 16-bit transfer width selected (xfrw = 1) in slave mode, if the ss line is not deasserted between the successive transmissions then the content of the spi data register is not transmitted; instead the last received data is transmitted. if the ss line is deasserted for at least minimum idle time (half sck cycle) between successive transmissions, then the content of the spi data register is transmitted. in master mode, with slave select output enabled the ss line is always deasserted and reasserted between successive transfers for at least minimum idle time. 21.4.3.3 cpha = 1 transfer format some peripherals require the ?st sck edge before the ?st data bit becomes available at the data out pin, the second edge clocks data into the system. in this format, the ?st sck edge is issued by setting the cpha bit at the beginning of the n 1 -cycle transfer operation. the ?st edge of sck occurs immediately after the half sck clock cycle synchronization delay. this ?st edge commands the slave to transfer its ?st data bit to the serial data input pin of the master. a half sck cycle later, the second edge appears on the sck pin. this is the latching edge for both the master and slave. 1. n depends on the selected transfer width, please refer to section 21.3.2.2, ?pi control register 2 (spicr2) t l begin end sck (cpol = 0) sample i change o sel ss (o) transfer sck (cpol = 1) msb ?st (lsbfe = 0) lsb ?st (lsbfe = 1) msb lsb lsb msb bit 13 bit 2 bit 14 bit 1 bit 12 bit 3 bit 11 bit 4 bit 5 change o sel ss (i) mosi pin miso pin master only mosi/miso t t if next transfer begins here for t t , t l , t l minimum 1/2 sck t i t l t l = minimum leading time before the ?st sck edge t t = minimum trailing time after the last sck edge t i = minimum idling time between transfers (minimum ss high time) t l , t t , and t i are guaranteed for the master mode and required for the slave mode. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 sck edge number end of idle state begin of idle state 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 bit 10 bit 9 bit 8 bit 7 bit 6 bit 4 bit 3 bit 2 bit 1 bit 6 bit 5 bit 7 bit 8 bit 9 bit 10bit 11 bit 12bit 13 bit 14 chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 778 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 when the third edge occurs, the value previously latched from the serial data input pin is shifted into the lsb or msb of the spi shift register, depending on lsbfe bit. after this edge, the next bit of the master data is coupled out of the serial data output pin of the master to the serial input pin on the slave. this process continues for a total of n 1 edges on the sck line with data being latched on even numbered edges and shifting taking place on odd numbered edges. data reception is double buffered, data is serially shifted into the spi shift register during the transfer and is transferred to the parallel spi data register after the last bit is shifted in. after 2n 1 sck edges: data that was previously in the spi data register of the master is now in the data register of the slave, and data that was in the data register of the slave is in the master. the spif ?g bit in spisr is set indicating that the transfer is complete. figure 21-14 shows two clocking variations for cpha = 1. the diagram may be interpreted as a master or slave timing diagram because the sck, miso, and mosi pins are connected directly between the master and the slave. the miso signal is the output from the slave, and the mosi signal is the output from the master. the ss line is the slave select input to the slave. the ss pin of the master must be either high or recon?ured as a general-purpose output not affecting the spi. figure 21-14. spi clock format 1 (cpha = 1), with 8-bit transfer width selected (xfrw = 0) t l t t for t t , t l , t l minimum 1/2 sck t i t l if next transfer begins here begin end sck (cpol = 0) sample i change o sel ss (o) transfer sck (cpol = 1) msb ?st (lsbfe = 0): lsb ?st (lsbfe = 1): msb lsb lsb msb bit 5 bit 2 bit 6 bit 1 bit 4 bit 3 bit 3 bit 4 bit 2 bit 5 bit 1 bit 6 change o sel ss (i) mosi pin miso pin master only mosi/miso t l = minimum leading time before the ?st sck edge, not required for back-to-back transfers t t = minimum trailing time after the last sck edge t i = minimum idling time between transfers (minimum ss high time), not required for back-to-back transfers 1 2 34 56 78910111213141516 sck edge number end of idle state begin of idle state chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 779 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 21-15. spi clock format 1 (cpha = 1), with 16-bit transfer width selected (xfrw = 1) the ss line can remain active low between successive transfers (can be tied low at all times). this format is sometimes preferred in systems having a single ?ed master and a single slave that drive the miso data line. back-to-back transfers in master mode in master mode, if a transmission has completed and new data is available in the spi data register, this data is sent out immediately without a trailing and minimum idle time. the spi interrupt request ?g (spif) is common to both the master and slave modes. spif gets set one half sck cycle after the last sck edge. 21.4.4 spi baud rate generation baud rate generation consists of a series of divider stages. six bits in the spi baud rate register (sppr2, sppr1, sppr0, spr2, spr1, and spr0) determine the divisor to the spi module clock which results in the spi baud rate. the spi clock rate is determined by the product of the value in the baud rate preselection bits (sppr2?ppr0) and the value in the baud rate selection bits (spr2?pr0). the module clock divisor equation is shown in equation 21-3 . baudratedivisor = (sppr + 1) ? 2 (spr + 1) eqn. 21-3 t l begin end sck (cpol = 0) sample i change o sel ss (o) transfer sck (cpol = 1) msb ?st (lsbfe = 0) lsb ?st (lsbfe = 1) msb lsb lsb msb bit 13 bit 2 bit 14 bit 1 bit 12 bit 3 bit 11 bit 4 bit 5 change o sel ss (i) mosi pin miso pin master only mosi/miso t t if next transfer begins here for t t , t l , t l minimum 1/2 sck t i t l t l = minimum leading time before the ?st sck edge, not required for back-to-back transfers t t = minimum trailing time after the last sck edge t i = minimum idling time between transfers (minimum ss high time), not required for back-to-back transfers 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 sck edge number end of idle state begin of idle state 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 bit 10 bit 9 bit 8 bit 7 bit 6 bit 4 bit 3 bit 2 bit 1 bit 6 bit 5 bit 7 bit 8 bit 9 bit 10bit 11 bit 12bit 13 bit 14 chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 780 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 when all bits are clear (the default condition), the spi module clock is divided by 2. when the selection bits (spr2?pr0) are 001 and the preselection bits (sppr2?ppr0) are 000, the module clock divisor becomes 4. when the selection bits are 010, the module clock divisor becomes 8, etc. when the preselection bits are 001, the divisor determined by the selection bits is multiplied by 2. when the preselection bits are 010, the divisor is multiplied by 3, etc. see table 21-7 for baud rate calculations for all bit conditions, based on a 25 mhz bus clock. the two sets of selects allows the clock to be divided by a non-power of two to achieve other baud rates such as divide by 6, divide by 10, etc. the baud rate generator is activated only when the spi is in master mode and a serial transfer is taking place. in the other cases, the divider is disabled to decrease i dd current. note for maximum allowed baud rates, please refer to the spi electrical speci?ation in the electricals chapter of this data sheet. 21.4.5 special features 21.4.5.1 ss output the ss output feature automatically drives the ss pin low during transmission to select external devices and drives it high during idle to deselect external devices. when ss output is selected, the ss output pin is connected to the ss input pin of the external device. the ss output is available only in master mode during normal spi operation by asserting ssoe and modfen bit as shown in table 21-3 . the mode fault feature is disabled while ss output is enabled. note care must be taken when using the ss output feature in a multimaster system because the mode fault feature is not available for detecting system errors between masters. 21.4.5.2 bidirectional mode (momi or siso) the bidirectional mode is selected when the spc0 bit is set in spi control register 2 (see table 21-11 ). in this mode, the spi uses only one serial data pin for the interface with external device(s). the mstr bit decides which pin to use. the mosi pin becomes the serial data i/o (momi) pin for the master mode, and the miso pin becomes serial data i/o (siso) pin for the slave mode. the miso pin in master mode and mosi pin in slave mode are not used by the spi. chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 781 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the direction of each serial i/o pin depends on the bidiroe bit. if the pin is con?ured as an output, serial data from the shift register is driven out on the pin. the same pin is also the serial input to the shift register. the sck is output for the master mode and input for the slave mode. the ss is the input or output for the master mode, and it is always the input for the slave mode. the bidirectional mode does not affect sck and ss functions. note in bidirectional master mode, with mode fault enabled, both data pins miso and mosi can be occupied by the spi, though mosi is normally used for transmissions in bidirectional mode and miso is not used by the spi. if a mode fault occurs, the spi is automatically switched to slave mode. in this case miso becomes occupied by the spi and mosi is not used. this must be considered, if the miso pin is used for another purpose. 21.4.6 error conditions the spi has one error condition: mode fault error 21.4.6.1 mode fault error if the ss input becomes low while the spi is con?ured as a master, it indicates a system error where more than one master may be trying to drive the mosi and sck lines simultaneously. this condition is not permitted in normal operation, the modf bit in the spi status register is set automatically, provided the modfen bit is set. in the special case where the spi is in master mode and modfen bit is cleared, the ss pin is not used by the spi. in this special case, the mode fault error function is inhibited and modf remains cleared. in case table 21-11. normal mode and bidirectional mode when spe = 1 master mode mstr = 1 slave mode mstr = 0 normal mode spc0 = 0 bidirectional mode spc0 = 1 spi mosi miso serial out serial in spi mosi miso serial in serial out spi momi serial out serial in bidiroe spi siso serial in serial out bidiroe chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 782 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the spi system is con?ured as a slave, the ss pin is a dedicated input pin. mode fault error doesn t occur in slave mode. if a mode fault error occurs, the spi is switched to slave mode, with the exception that the slave output buffer is disabled. so sck, miso, and mosi pins are forced to be high impedance inputs to avoid any possibility of con?ct with another output driver. a transmission in progress is aborted and the spi is forced into idle state. if the mode fault error occurs in the bidirectional mode for a spi system con?ured in master mode, output enable of the momi (mosi in bidirectional mode) is cleared if it was set. no mode fault error occurs in the bidirectional mode for spi system con?ured in slave mode. the mode fault ?g is cleared automatically by a read of the spi status register (with modf set) followed by a write to spi control register 1. if the mode fault ?g is cleared, the spi becomes a normal master or slave again. note if a mode fault error occurs and a received data byte is pending in the receive shift register, this data byte will be lost. 21.4.7 low power mode options 21.4.7.1 spi in run mode in run mode with the spi system enable (spe) bit in the spi control register clear, the spi system is in a low-power, disabled state. spi registers remain accessible, but clocks to the core of this module are disabled. 21.4.7.2 spi in wait mode spi operation in wait mode depends upon the state of the spiswai bit in spi control register 2. if spiswai is clear, the spi operates normally when the cpu is in wait mode if spiswai is set, spi clock generation ceases and the spi module enters a power conservation state when the cpu is in wait mode. if spiswai is set and the spi is configured for master, any transmission and reception in progress stops at wait mode entry. the transmission and reception resumes when the spi exits wait mode. if spiswai is set and the spi is configured as a slave, any transmission and reception in progress continues if the sck continues to be driven from the master. this keeps the slave synchronized to the master and the sck. if the master transmits several bytes while the slave is in wait mode, the slave will continue to send out bytes consistent with the operation mode at the start of wait mode (i.e., if the slave is currently sending its spidr to the master, it will continue to send the same byte. else if the slave is currently sending the last received byte from the master, it will continue to send each previous master byte). chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 783 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note care must be taken when expecting data from a master while the slave is in wait or stop mode. even though the shift register will continue to operate, the rest of the spi is shut down (i.e., a spif interrupt will not be generated until exiting stop or wait mode). also, the byte from the shift register will not be copied into the spidr register until after the slave spi has exited wait or stop mode. in slave mode, a received byte pending in the receive shift register will be lost when entering wait or stop mode. an spif ?g and spidr copy is generated only if wait mode is entered or exited during a tranmission. if the slave enters wait mode in idle mode and exits wait mode in idle mode, neither a spif nor a spidr copy will occur. 21.4.7.3 spi in stop mode stop mode is dependent on the system. the spi enters stop mode when the module clock is disabled (held high or low). if the spi is in master mode and exchanging data when the cpu enters stop mode, the transmission is frozen until the cpu exits stop mode. after stop, data to and from the external spi is exchanged correctly. in slave mode, the spi will stay synchronized with the master. the stop mode is not dependent on the spiswai bit. 21.4.7.4 reset the reset values of registers and signals are described in section 21.3, ?emory map and register de?ition , which details the registers and their bit ?lds. if a data transmission occurs in slave mode after reset without a write to spidr, it will transmit garbage, or the data last received from the master before the reset. reading from the spidr after reset will always read zeros. 21.4.7.5 interrupts the spi only originates interrupt requests when spi is enabled (spe bit in spicr1 set). the following is a description of how the spi makes a request and how the mcu should acknowledge that request. the interrupt vector offset and interrupt priority are chip dependent. the interrupt ?gs modf, spif, and sptef are logically ored to generate an interrupt request. 21.4.7.5.1 modf modf occurs when the master detects an error on the ss pin. the master spi must be con?ured for the modf feature (see table 21-3 ). after modf is set, the current transfer is aborted and the following bit is changed: mstr = 0, the master bit in spicr1 resets. the modf interrupt is re?cted in the status register modf ?g. clearing the ?g will also clear the interrupt. this interrupt will stay active while the modf ?g is set. modf has an automatic clearing process which is described in section 21.3.2.4, ?pi status register (spisr) . chapter 21 serial peripheral interface (s12spiv5) mc9s12xe-family reference manual , rev. 1.21 784 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 21.4.7.5.2 spif spif occurs when new data has been received and copied to the spi data register. after spif is set, it does not clear until it is serviced. spif has an automatic clearing process, which is described in section 21.3.2.4, ?pi status register (spisr) . 21.4.7.5.3 sptef sptef occurs when the spi data register is ready to accept new data. after sptef is set, it does not clear until it is serviced. sptef has an automatic clearing process, which is described in section 21.3.2.4, ?pi status register (spisr) . mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 785 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 22 timer module (tim16b8cv2) block description 22.1 introduction the basic timer consists of a 16-bit, software-programmable counter driven by a enhanced programmable prescaler. this timer can be used for many purposes, including input waveform measurements while simultaneously generating an output waveform. pulse widths can vary from microseconds to many seconds. this timer contains 8 complete input capture/output compare channels and one pulse accumulator. the input capture function is used to detect a selected transition edge and record the time. the output compare function is used for generating output signals or for timer software delays. the 16-bit pulse accumulator table 22-1. revision history revision number revision date sections affected description of changes v02.04 1 jul 2008 22.3.2.12/22-80 0 22.3.2.13/22-80 1 22.3.2.16/22-80 4 22.4.2/22-809 22.4.3/22-809 - revised ?g clearing procedure, whereby ten bit must be set when clearing ?gs. v02.05 9 jul 2009 22.3.2.12/22-80 0 22.3.2.13/22-80 1 22.3.2.15/22-80 3 22.3.2.16/22-80 4 22.3.2.19/22-80 6 22.4.2/22-809 22.4.3/22-809 - revised ?g clearing procedure, whereby ten or paen bit must be set when clearing ?gs. - add fomula to describe prescaler v02.06 26 aug 2009 22.1.2/22-786 22.3.2.15/22-80 3 22.3.2.2/22-792 22.3.2.3/22-793 22.3.2.4/22-794 22.4.3/22-809 - correct typo: tscr ->tscr1 - correct reference: figure 1-25 -> figure 1-31 - add description, ? counter over?w when ttov[7] is set? to be the condition of channel 7 override event. - phrase the description of oc7m to make it more explicit chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 786 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 is used to operate as a simple event counter or a gated time accumulator. the pulse accumulator shares timer channel 7 when in event mode. a full access for the counter registers or the input capture/output compare registers should take place in one clock cycle. accessing high byte and low byte separately for all of these registers may not yield the same result as accessing them in one word. 22.1.1 features the tim16b8cv2 includes these distinctive features: eight input capture/output compare channels. clock prescaling. 16-bit counter. 16-bit pulse accumulator. 22.1.2 modes of operation stop: timer is off because clocks are stopped. freeze: timer counter keep on running, unless tsfrz in tscr1 (0x0006) is set to 1. wait: counters keep on running, unless tswai in tscr1 (0x0006) is set to 1. normal: timer counter keep on running, unless ten in tscr1 (0x0006) is cleared to 0. chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 787 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.1.3 block diagrams figure 22-1. tim16b8cv2 block diagram prescaler 16-bit counter input capture output compare 16-bit pulse accumulator ioc0 ioc2 ioc1 ioc5 ioc3 ioc4 ioc6 ioc7 pa input interrupt pa overflow interrupt timer overflow interrupt timer channel 0 interrupt timer channel 7 interrupt registers bus clock input capture output compare input capture output compare input capture output compare input capture output compare input capture output compare input capture output compare input capture output compare channel 0 channel 1 channel 2 channel 3 channel 4 channel 5 channel 6 channel 7 chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 788 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 22-2. 16-bit pulse accumulator block diagram figure 22-3. interrupt flag setting edge detector intermodule bus pt7 m clock divide by 64 clock select clk0 clk1 4:1 mux timclk paclk paclk / 256 paclk / 65536 prescaled clock (pclk) (timer clock) interrupt mux (pamod) pacnt ptn edge detector 16-bit main timer tcn input capture reg. set cnf interrupt chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 789 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 22-4. channel 7 output compare/pulse accumulator logic 22.2 external signal description the tim16b8cv2 module has a total of eight external pins. 22.2.1 ioc7 ?input capture and output compare channel 7 pin this pin serves as input capture or output compare for channel 7. this can also be con?ured as pulse accumulator input. 22.2.2 ioc6 ?input capture and output compare channel 6 pin this pin serves as input capture or output compare for channel 6. 22.2.3 ioc5 ?input capture and output compare channel 5 pin this pin serves as input capture or output compare for channel 5. 22.2.4 ioc4 ?input capture and output compare channel 4 pin this pin serves as input capture or output compare for channel 4. pin 22.2.5 ioc3 ?input capture and output compare channel 3 pin this pin serves as input capture or output compare for channel 3. 22.2.6 ioc2 ?input capture and output compare channel 2 pin this pin serves as input capture or output compare for channel 2. pulse accumulator pa d ten channel 7 output compare ocpd tios7 chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 790 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.2.7 ioc1 ?input capture and output compare channel 1 pin this pin serves as input capture or output compare for channel 1. 22.2.8 ioc0 ?input capture and output compare channel 0 pin this pin serves as input capture or output compare for channel 0. note for the description of interrupts see section 22.6, ?nterrupts . 22.3 memory map and register de?ition this section provides a detailed description of all memory and registers. 22.3.1 module memory map the memory map for the tim16b8cv2 module is given below in figure 22-5 . the address listed for each register is the address offset. the total address for each register is the sum of the base address for the tim16b8cv2 module and the address offset for each register. 22.3.2 register descriptions this section consists of register descriptions in address order. each description includes a standard register diagram with an associated ?ure number. details of register bit and ?ld function follow the register diagrams, in bit order. register name bit 7 654321 bit 0 0x0000 tios r ios7 ios6 ios5 ios4 ios3 ios2 ios1 ios0 w 0x0001 cforc r00000000 w foc7 foc6 foc5 foc4 foc3 foc2 foc1 foc0 0x0002 oc7m r oc7m7 oc7m6 oc7m5 oc7m4 oc7m3 oc7m2 oc7m1 oc7m0 w 0x0003 oc7d r oc7d7 oc7d6 oc7d5 oc7d4 oc7d3 oc7d2 oc7d1 oc7d0 w 0x0004 tcnth r tcnt15 tcnt14 tcnt13 tcnt12 tcnt11 tcnt10 tcnt9 tcnt8 w 0x0005 tcntl r tcnt7 tcnt6 tcnt5 tcnt4 tcnt3 tcnt2 tcnt1 tcnt0 w = unimplemented or reserved figure 22-5. tim16b8cv2 register summary (sheet 1 of 3) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 791 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0006 tscr1 r ten tswai tsfrz tffca prnt 000 w 0x0007 ttov r tov7 tov6 tov5 tov4 tov3 tov2 tov1 tov0 w 0x0008 tctl1 r om7 ol7 om6 ol6 om5 ol5 om4 ol4 w 0x0009 tctl2 r om3 ol3 om2 ol2 om1 ol1 om0 ol0 w 0x000a tctl3 r edg7b edg7a edg6b edg6a edg5b edg5a edg4b edg4a w 0x000b tctl4 r edg3b edg3a edg2b edg2a edg1b edg1a edg0b edg0a w 0x000c tie r c7i c6i c5i c4i c3i c2i c1i c0i w 0x000d tscr2 r toi 000 tcre pr2 pr1 pr0 w 0x000e tflg1 r c7f c6f c5f c4f c3f c2f c1f c0f w 0x000f tflg2 r tof 0000000 w 0x0010?x001f tcxh?cxl r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0020 pactl r0 paen pamod pedge clk1 clk0 paovi pai w 0x0021 paflg r000000 paovf paif w 0x0022 pacnth r pacnt15 pacnt14 pacnt13 pacnt12 pacnt11 pacnt10 pacnt9 pacnt8 w 0x0023 pacntl r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w 0x0024?x002b reserved r w register name bit 7 654321 bit 0 = unimplemented or reserved figure 22-5. tim16b8cv2 register summary (sheet 2 of 3) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 792 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.1 timer input capture/output compare select (tios) read: anytime write: anytime 22.3.2.2 timer compare force register (cforc) 0x002c ocpd r ocpd7 ocpd6 ocpd5 ocpd4 ocpd3 ocpd2 ocpd1 ocpd0 w 0x002d r 0x002e ptpsr r ptps7 ptps6 ptps5 ptps4 ptps3 ptps2 ptps1 ptps0 w 0x002f reserved r w module base + 0x0000 76543210 r ios7 ios6 ios5 ios4 ios3 ios2 ios1 ios0 w reset 00000000 figure 22-6. timer input capture/output compare select (tios) table 22-2. tios field descriptions field description 7:0 ios[7:0] input capture or output compare channel con?uration 0 the corresponding channel acts as an input capture. 1 the corresponding channel acts as an output compare. module base + 0x0001 76543210 r00000000 w foc7 foc6 foc5 foc4 foc3 foc2 foc1 foc0 reset 00000000 figure 22-7. timer compare force register (cforc) register name bit 7 654321 bit 0 = unimplemented or reserved figure 22-5. tim16b8cv2 register summary (sheet 3 of 3) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 793 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 read: anytime but will always return 0x0000 (1 state is transient) write: anytime 22.3.2.3 output compare 7 mask register (oc7m) read: anytime write: anytime table 22-3. cforc field descriptions field description 7:0 foc[7:0] force output compare action for channel 7:0 a write to this register with the corresponding data bit(s) set causes the action which is programmed for output compare ??to occur immediately. the action taken is the same as if a successful comparison had just taken place with the tcx register except the interrupt ?g does not get set. note: a channel 7 event, which can be a counter over?w when ttov[7] is set or a successful output compare on channel 7, overrides any channel 6:0 compares. if forced output compare on any channel occurs at the same time as the successful output compare then forced output compare action will take precedence and interrupt ?g won? get set. module base + 0x0002 76543210 r oc7m7 oc7m6 oc7m5 oc7m4 oc7m3 oc7m2 oc7m1 oc7m0 w reset 00000000 figure 22-8. output compare 7 mask register (oc7m) table 22-4. oc7m field descriptions field description 7:0 oc7m[7:0] output compare 7 mask ?a channel 7 event, which can be a counter over?w when ttov[7] is set or a successful output compare on channel 7, overrides any channel 6:0 compares. for each oc7m bit that is set, the output compare action re?cts the corresponding oc7d bit. 0 the corresponding oc7dx bit in the output compare 7 data register will not be transferred to the timer port on a channel 7 event, even if the corresponding pin is setup for output compare. 1 the corresponding oc7dx bit in the output compare 7 data register will be transferred to the timer port on a channel 7 event. note: the corresponding channel must also be setup for output compare (iosx = 1 and ocpdx = 0) for data to be transferred from the output compare 7 data register to the timer port. chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 794 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.4 output compare 7 data register (oc7d) read: anytime write: anytime 22.3.2.5 timer count register (tcnt) the 16-bit main timer is an up counter. a full access for the counter register should take place in one clock cycle. a separate read/write for high byte and low byte will give a different result than accessing them as a word. read: anytime module base + 0x0003 76543210 r oc7d7 oc7d6 oc7d5 oc7d4 oc7d3 oc7d2 oc7d1 oc7d0 w reset 00000000 figure 22-9. output compare 7 data register (oc7d) table 22-5. oc7d field descriptions field description 7:0 oc7d[7:0] output compare 7 data a channel 7 event, which can be a counter over?w when ttov[7] is set or a successful output compare on channel 7, can cause bits in the output compare 7 data register to transfer to the timer port data register depending on the output compare 7 mask register. module base + 0x0004 15 14 13 12 11 10 9 9 r tcnt15 tcnt14 tcnt13 tcnt12 tcnt11 tcnt10 tcnt9 tcnt8 w reset 00000000 figure 22-10. timer count register high (tcnth) module base + 0x0005 76543210 r tcnt7 tcnt6 tcnt5 tcnt4 tcnt3 tcnt2 tcnt1 tcnt0 w reset 00000000 figure 22-11. timer count register low (tcntl) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 795 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 write: has no meaning or effect in the normal mode; only writable in special modes (test_mode = 1). the period of the ?st count after a write to the tcnt registers may be a different size because the write is not synchronized with the prescaler clock. 22.3.2.6 timer system control register 1 (tscr1) read: anytime write: anytime module base + 0x0006 76543210 r ten tswai tsfrz tffca prnt 000 w reset 00000000 = unimplemented or reserved figure 22-12. timer system control register 1 (tscr1) table 22-6. tscr1 field descriptions field description 7 ten timer enable 0 disables the main timer, including the counter. can be used for reducing power consumption. 1 allows the timer to function normally. if for any reason the timer is not active, there is no 64 clock for the pulse accumulator because the 64 is generated by the timer prescaler. 6 tswai timer module stops while in wait 0 allows the timer module to continue running during wait. 1 disables the timer module when the mcu is in the wait mode. timer interrupts cannot be used to get the mcu out of wait. tswai also affects pulse accumulator. 5 tsfrz timer stops while in freeze mode 0 allows the timer counter to continue running while in freeze mode. 1 disables the timer counter whenever the mcu is in freeze mode. this is useful for emulation. tsfrz does not stop the pulse accumulator. chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 796 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.7 timer toggle on over?w register 1 (ttov) read: anytime write: anytime 4 tffca timer fast flag clear all 0 allows the timer ?g clearing to function normally. 1 for tflg1(0x000e), a read from an input capture or a write to the output compare channel (0x0010?x001f) causes the corresponding channel ?g, cnf, to be cleared. for tflg2 (0x000f), any access to the tcnt register (0x0004, 0x0005) clears the tof ?g. any access to the pacnt registers (0x0022, 0x0023) clears the paovf and paif ?gs in the paflg register (0x0021). this has the advantage of eliminating software overhead in a separate clear sequence. extra care is required to avoid accidental ?g clearing due to unintended accesses. 3 prnt precision timer 0 enables legacy timer. pr0, pr1, and pr2 bits of the tscr2 register are used for timer counter prescaler selection. 1 enables precision timer. all bits of the ptpsr register are used for precision timer prescaler selection, and all bits. this bit is writable only once out of reset. module base + 0x0007 76543210 r tov7 tov6 tov5 tov4 tov3 tov2 tov1 tov0 w reset 00000000 figure 22-13. timer toggle on over?w register 1 (ttov) table 22-7. ttov field descriptions field description 7:0 tov[7:0] toggle on over?w bits tovx toggles output compare pin on over?w. this feature only takes effect when in output compare mode. when set, it takes precedence over forced output compare but not channel 7 override events. 0 toggle output compare pin on over?w feature disabled. 1 toggle output compare pin on over?w feature enabled. table 22-6. tscr1 field descriptions (continued) field description chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 797 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.8 timer control register 1/timer control register 2 (tctl1/tctl2) read: anytime write: anytime module base + 0x0008 76543210 r om7 ol7 om6 ol6 om5 ol5 om4 ol4 w reset 00000000 figure 22-14. timer control register 1 (tctl1) module base + 0x0009 76543210 r om3 ol3 om2 ol2 om1 ol1 om0 ol0 w reset 00000000 figure 22-15. timer control register 2 (tctl2) table 22-8. tctl1/tctl2 field descriptions field description 7:0 omx output mode these eight pairs of control bits are encoded to specify the output action to be taken as a result of a successful ocx compare. when either omx or olx is 1, the pin associated with ocx becomes an output tied to ocx. note: to enable output action by omx bits on timer port, the corresponding bit in oc7m should be cleared. for an output line to be driven by an ocx the ocpdx must be cleared. 7:0 olx output level these eight pairs of control bits are encoded to specify the output action to be taken as a result of a successful ocx compare. when either omx or olx is 1, the pin associated with ocx becomes an output tied to ocx. note: to enable output action by olx bits on timer port, the corresponding bit in oc7m should be cleared. for an output line to be driven by an ocx the ocpdx must be cleared. table 22-9. compare result output action omx olx action 0 0 no output compare action on the timer output signal 0 1 toggle ocx output line 1 0 clear ocx output line to zero 1 1 set ocx output line to one chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 798 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 to operate the 16-bit pulse accumulator independently of input capture or output compare 7 and 0 respectively the user must set the corresponding bits iosx = 1, omx = 0 and olx = 0. oc7m7 in the oc7m register must also be cleared. 22.3.2.9 timer control register 3/timer control register 4 (tctl3 and tctl4) read: anytime write: anytime. module base + 0x000a 76543210 r edg7b edg7a edg6b edg6a edg5b edg5a edg4b edg4a w reset 00000000 figure 22-16. timer control register 3 (tctl3) module base + 0x000b 76543210 r edg3b edg3a edg2b edg2a edg1b edg1a edg0b edg0a w reset 00000000 figure 22-17. timer control register 4 (tctl4) table 22-10. tctl3/tctl4 field descriptions field description 7:0 edgnb edgna input capture edge control ?these eight pairs of control bits con?ure the input capture edge detector circuits. table 22-11. edge detector circuit con?uration edgnb edgna con?uration 0 0 capture disabled 0 1 capture on rising edges only 1 0 capture on falling edges only 1 1 capture on any edge (rising or falling) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 799 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.10 timer interrupt enable register (tie) read: anytime write: anytime. 22.3.2.11 timer system control register 2 (tscr2) read: anytime write: anytime. module base + 0x000c 76543210 r c7i c6i c5i c4i c3i c2i c1i c0i w reset 00000000 figure 22-18. timer interrupt enable register (tie) table 22-12. tie field descriptions field description 7:0 c7i:c0i input capture/output compare ??interrupt enable the bits in tie correspond bit-for-bit with the bits in the tflg1 status register. if cleared, the corresponding ?g is disabled from causing a hardware interrupt. if set, the corresponding ?g is enabled to cause a interrupt. module base + 0x000d 76543210 r toi 000 tcre pr2 pr1 pr0 w reset 00000000 = unimplemented or reserved figure 22-19. timer system control register 2 (tscr2) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 800 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note the newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. 22.3.2.12 main timer interrupt flag 1 (tflg1) read: anytime write: used in the clearing mechanism (set bits cause corresponding bits to be cleared). writing a zero will not affect current status of the bit. table 22-13. tscr2 field descriptions field description 7 toi timer over?w interrupt enable 0 interrupt inhibited. 1 hardware interrupt requested when tof ?g set. 3 tcre timer counter reset enable this bit allows the timer counter to be reset by a successful output compare 7 event. this mode of operation is similar to an up-counting modulus counter. 0 counter reset inhibited and counter free runs. 1 counter reset by a successful output compare 7. if tc7 = 0x0000 and tcre = 1, tcnt will stay at 0x0000 continuously. if tc7 = 0xffff and tcre = 1, tof will never be set when tcnt is reset from 0xffff to 0x0000. 2 pr[2:0] timer prescaler select ?these three bits select the frequency of the timer prescaler clock derived from the bus clock as shown in table 22-14 . table 22-14. timer clock selection pr2 pr1 pr0 timer clock 0 0 0 bus clock / 1 0 0 1 bus clock / 2 0 1 0 bus clock / 4 0 1 1 bus clock / 8 1 0 0 bus clock / 16 1 0 1 bus clock / 32 1 1 0 bus clock / 64 1 1 1 bus clock / 128 module base + 0x000e 76543210 r c7f c6f c5f c4f c3f c2f c1f c0f w reset 00000000 figure 22-20. main timer interrupt flag 1 (tflg1) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 801 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.13 main timer interrupt flag 2 (tflg2) tflg2 indicates when interrupt conditions have occurred. to clear a bit in the ?g register, write the bit to one while ten bit of tscr1 or paen bit of pactl is set to one. read: anytime write: used in clearing mechanism (set bits cause corresponding bits to be cleared). any access to tcnt will clear tflg2 register if the tffca bit in tscr register is set. table 22-15. trlg1 field descriptions field description 7:0 c[7:0]f input capture/output compare channel ??flag ?these flags are set when an input capture or output compare event occurs. clearing requires writing a one to the corresponding ?g bit while ten or paen is set to one. when tffca bit in tscr register is set, a read from an input capture or a write into an output compare channel (0x0010?x001f) will cause the corresponding channel ?g cxf to be cleared. module base + 0x000f 76543210 r tof 0000000 w reset 00000000 unimplemented or reserved figure 22-21. main timer interrupt flag 2 (tflg2) table 22-16. trlg2 field descriptions field description 7 tof timer over?w flag set when 16-bit free-running timer over?ws from 0xffff to 0x0000. clearing this bit requires writing a one to bit 7 of tflg2 register while the ten bit of tscr1 or paen bit of pactl is set to one (see also tcre control bit explanation.) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 802 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.14 timer input capture/output compare registers high and low 0? (tcxh and tcxl) depending on the tios bit for the corresponding channel, these registers are used to latch the value of the free-running counter when a de?ed transition is sensed by the corresponding input capture edge detector or to trigger an output action for output compare. read: anytime write: anytime for output compare function.writes to these registers have no meaning or effect during input capture. all timer input capture/output compare registers are reset to 0x0000. note read/write access in byte mode for high byte should takes place before low byte otherwise it will give a different result. module base + 0x0010 = tc0h 0x0012 = tc1h 0x0014 = tc2h 0x0016 = tc3h 0x0018 = tc4h 0x001a = tc5h 0x001c = tc6h 0x001e = tc7h 15 14 13 12 11 10 9 0 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 00000000 figure 22-22. timer input capture/output compare register x high (tcxh) module base + 0x0011 = tc0l 0x0013 = tc1l 0x0015 = tc2l 0x0017 = tc3l 0x0019 = tc4l 0x001b = tc5l 0x001d = tc6l 0x001f = tc7l 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 00000000 figure 22-23. timer input capture/output compare register x low (tcxl) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 803 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.15 16-bit pulse accumulator control register (pactl) when paen is set, the pact is enabled.the pact shares the input pin with ioc7. read: any time write: any time module base + 0x0020 76543210 r0 paen pamod pedge clk1 clk0 paovi pai w reset 00000000 unimplemented or reserved figure 22-24. 16-bit pulse accumulator control register (pactl) table 22-17. pactl field descriptions field description 6 paen pulse accumulator system enable ?paen is independent from ten. with timer disabled, the pulse accumulator can function unless pulse accumulator is disabled. 0 16-bit pulse accumulator system disabled. 1 pulse accumulator system enabled. 5 pamod pulse accumulator mode ?this bit is active only when the pulse accumulator is enabled (paen = 1). see table 22-18 . 0 event counter mode. 1 gated time accumulation mode. 4 pedge pulse accumulator edge control this bit is active only when the pulse accumulator is enabled (paen = 1). for pamod bit = 0 (event counter mode). see table 22-18 . 0 falling edges on ioc7 pin cause the count to be incremented. 1 rising edges on ioc7 pin cause the count to be incremented. for pamod bit = 1 (gated time accumulation mode). 0 ioc7 input pin high enables m (bus clock) divided by 64 clock to pulse accumulator and the trailing falling edge on ioc7 sets the paif ?g. 1 ioc7 input pin low enables m (bus clock) divided by 64 clock to pulse accumulator and the trailing rising edge on ioc7 sets the paif ?g. 3:2 clk[1:0] clock select bits refer to table 22-19 . 1 paov i pulse accumulator over?w interrupt enable 0 interrupt inhibited. 1 interrupt requested if paovf is set. 0 pa i pulse accumulator input interrupt enable 0 interrupt inhibited. 1 interrupt requested if paif is set. chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 804 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note if the timer is not active (ten = 0 in tscr), there is no divide-by-64 because the 64 clock is generated by the timer prescaler. for the description of paclk please refer figure 22-30 . if the pulse accumulator is disabled (paen = 0), the prescaler clock from the timer is always used as an input clock to the timer counter. the change from one selected clock to the other happens immediately after these bits are written. 22.3.2.16 pulse accumulator flag register (paflg) read: anytime write: anytime when the tffca bit in the tscr register is set, any access to the pacnt register will clear all the ?gs in the paflg register. timer module or pulse accumulator must stay enabled (ten=1 or paen=1) while clearing these bits. table 22-18. pin action pamod pedge pin action 0 0 falling edge 0 1 rising edge 1 0 div. by 64 clock enabled with pin high level 1 1 div. by 64 clock enabled with pin low level table 22-19. timer clock selection clk1 clk0 timer clock 0 0 use timer prescaler clock as timer counter clock 0 1 use paclk as input to timer counter clock 1 0 use paclk/256 as timer counter clock frequency 1 1 use paclk/65536 as timer counter clock frequency module base + 0x0021 76543210 r000000 paovf paif w reset 00000000 unimplemented or reserved figure 22-25. pulse accumulator flag register (paflg) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 805 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.17 pulse accumulators count registers (pacnt) read: anytime write: anytime these registers contain the number of active input edges on its input pin since the last reset. when pacnt over?ws from 0xffff to 0x0000, the interrupt ?g paovf in paflg (0x0021) is set. full count register access should take place in one clock cycle. a separate read/write for high byte and low byte will give a different result than accessing them as a word. note reading the pulse accumulator counter registers immediately after an active edge on the pulse accumulator input pin may miss the last count because the input has to be synchronized with the bus clock ?st. table 22-20. paflg field descriptions field description 1 paov f pulse accumulator over?w flag set when the 16-bit pulse accumulator over?ws from 0xffff to 0x0000. clearing this bit requires writing a one to this bit in the paflg register while ten bit of tscr1 or paen bit of pactl register is set to one. 0 paif pulse accumulator input edge flag set when the selected edge is detected at the ioc7 input pin.in event mode the event edge triggers paif and in gated time accumulation mode the trailing edge of the gate signal at the ioc7 input pin triggers paif. clearing this bit requires writing a one to this bit in the paflg register while ten bit of tscr1 or paen bit of pactl register is set to one. any access to the pacnt register will clear all the ?gs in this register when tffca bit in register tscr(0x0006) is set. module base + 0x0022 15 14 13 12 11 10 9 0 r pacnt15 pacnt14 pacnt13 pacnt12 pacnt11 pacnt10 pacnt9 pacnt8 w reset 00000000 figure 22-26. pulse accumulator count register high (pacnth) module base + 0x0023 76543210 r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w reset 00000000 figure 22-27. pulse accumulator count register low (pacntl) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 806 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.3.2.18 output compare pin disconnect register(ocpd) read: anytime write: anytime all bits reset to zero. 22.3.2.19 precision timer prescaler select register (ptpsr) read: anytime write: anytime all bits reset to zero. module base + 0x002c 76543210 r ocpd7 ocpd6 ocpd5 ocpd4 ocpd3 ocpd2 ocpd1 ocpd0 w reset 00000000 figure 22-28. ouput compare pin disconnect register (ocpd) table 22-21. ocpd field description field description ocpd[7:0} output compare pin disconnect bits 0 enables the timer channel port. ouptut compare action will occur on the channel pin. these bits do not affect the input capture or pulse accumulator functions 1 disables the timer channel port. output compare action will not occur on the channel pin, but the output compare ?g still become set . module base + 0x002e 76543210 r ptps7 ptps6 ptps5 ptps4 ptps3 ptps2 ptps1 ptps0 w reset 00000000 figure 22-29. precision timer prescaler select register (ptpsr) chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 807 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the prescaler can be calculated as follows depending on logical value of the ptps[7:0] and prnt bit: prnt = 1 : prescaler = ptps[7:0] + 1 table 22-23. precision timer prescaler selection examples when prnt = 1 22.4 functional description this section provides a complete functional description of the timer tim16b8cv2 block. please refer to the detailed timer block diagram in figure 22-30 as necessary. table 22-22. ptpsr field descriptions field description 7:0 ptps[7:0] precision timer prescaler select bits these eight bits specify the division rate of the main timer prescaler. these are effective only when the prnt bit of tscr1 is set to 1. table 22-23 shows some selection examples in this case. the newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. ptps7 ptps6 ptps5 ptps4 ptps3 ptps2 ptps1 ptps0 prescale factor 00000000 1 00000001 2 00000010 3 00000011 4 00000100 5 00000101 6 00000110 7 00000111 8 00001111 16 00011111 32 00111111 64 01111111 128 11111111 256 chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 808 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 22-30. detailed timer block diagram 22.4.1 prescaler the prescaler divides the bus clock by 1,2,4,8,16,32,64 or 128. the prescaler select bits, pr[2:0], select the prescaler divisor. pr[2:0] are in timer system control register 2 (tscr2). prescaler channel 0 ioc0 pin 16-bit counter logic pr[2:1:0] divide-by-64 tc0 edge detect pacnt(hi):pacnt(lo) paovf pedge paovi pamod pae 16-bit comparator tcnt(hi):tcnt(lo) channel 1 tc1 16-bit comparator 16-bit counter interrupt logic tof toi c0f c1f edge detect ioc1 pin logic edge detect cxf channel7 tc7 16-bit comparator c7f ioc7 pin logic edge detect om:ol0 tov0 om:ol1 tov1 om:ol7 tov7 edg1a edg1b edg7a edg7b edg0b tcre paif clear counter paif pai interrupt logic cxi interrupt request paovf ch. 7 compare ch.7 capture ch. 1 capture mux clk[1:0] paclk paclk/256 paclk/65536 ioc1 pin ioc0 pin ioc7 pin paclk paclk/256 paclk/65536 te ch. 1 compare ch. 0compare ch. 0 capture pa input channel2 edg0a channel 7 output compare ioc0 ioc1 ioc7 bus clock bus clock paovf paovi tof c0f c1f c7f chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 809 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the prescaler divides the bus clock by a prescalar value. prescaler select bits pr[2:0] of in timer system control register 2 (tscr2) are set to de?e a prescalar value that generates a divide by 1, 2, 4, 8, 16, 32, 64 and 128 when the prnt bit in tscr1 is disabled. by enabling the prnt bit of the tscr1 register, the performance of the timer can be enhanced. in this case, it is possible to set additional prescaler settings for the main timer counter in the present timer by using ptpsr[7:0] bits of ptpsr register. 22.4.2 input capture clearing the i/o (input/output) select bit, iosx, con?ures channel x as an input capture channel. the input capture function captures the time at which an external event occurs. when an active edge occurs on the pin of an input capture channel, the timer transfers the value in the timer counter into the timer channel registers, tcx. the minimum pulse width for the input capture input is greater than two bus clocks. an input capture on channel x sets the cxf ?g. the cxi bit enables the cxf ?g to generate interrupt requests. timer module or pulse accumulator must stay enabled (ten bit of tscr1 or paen bit of pactl regsiter must be set to one) while clearing cxf (writing one to cxf). 22.4.3 output compare setting the i/o select bit, iosx, con?ures channel x as an output compare channel. the output compare function can generate a periodic pulse with a programmable polarity, duration, and frequency. when the timer counter reaches the value in the channel registers of an output compare channel, the timer can set, clear, or toggle the channel pin if the corresponding ocpdx bit is set to zero. an output compare on channel x sets the cxf ?g. the cxi bit enables the cxf ?g to generate interrupt requests. timer module or pulse accumulator must stay enabled (ten bit of tscr1 or paen bit of pactl regsiter must be set to one) while clearing cxf (writing one to cxf). the output mode and level bits, omx and olx, select set, clear, toggle on output compare. clearing both omx and olx results in no output compare action on the output compare channel pin. setting a force output compare bit, focx, causes an output compare on channel x. a forced output compare does not set the channel ?g. a channel 7 event, which can be a counter over?w when ttov[7] is set or a successful output compare on channel 7, overrides output compares on all other output compare channels. the output compare 7 mask register masks the bits in the output compare 7 data register. the timer counter reset enable bit, tcre, enables channel 7 output compares to reset the timer counter. a channel 7 output compare can reset the timer counter even if the ioc7 pin is being used as the pulse accumulator input. writing to the timer port bit of an output compare pin does not affect the pin state. the value written is stored in an internal latch. when the pin becomes available for general-purpose output, the last value written to the bit appears at the pin. chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 810 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.4.3.1 oc channel initialization internal register whose output drives ocx can be programmed before timer drives ocx. the desired state can be programmed to this internal register by writing a one to cforcx bit with tiosx, ocpdx and ten bits set to one. setting ocpdx to zero allows interal register to drive the programmed state to ocx. this allows a glitch free switch over of port from general purpose i/o to timer output once the ocpdx bit is set to zero. 22.4.4 pulse accumulator the pulse accumulator (pacnt) is a 16-bit counter that can operate in two modes: event counter mode ?counting edges of selected polarity on the pulse accumulator input pin, pai. gated time accumulation mode counting pulses from a divide-by-64 clock. the pamod bit selects the mode of operation. the minimum pulse width for the pai input is greater than two bus clocks. 22.4.5 event counter mode clearing the pamod bit con?ures the pacnt for event counter operation. an active edge on the ioc7 pin increments the pulse accumulator counter. the pedge bit selects falling edges or rising edges to increment the count. note the pacnt input and timer channel 7 use the same pin ioc7. to use the ioc7, disconnect it from the output logic by clearing the channel 7 output mode and output level bits, om7 and ol7. also clear the channel 7 output compare 7 mask bit, oc7m7. the pulse accumulator counter register re?ct the number of active input edges on the pacnt input pin since the last reset. the paovf bit is set when the accumulator rolls over from 0xffff to 0x0000. the pulse accumulator over?w interrupt enable bit, paovi, enables the paovf ?g to generate interrupt requests. note the pulse accumulator counter can operate in event counter mode even when the timer enable bit, ten, is clear. 22.4.6 gated time accumulation mode setting the pamod bit con?ures the pulse accumulator for gated time accumulation operation. an active level on the pacnt input pin enables a divided-by-64 clock to drive the pulse accumulator. the pedge bit selects low levels or high levels to enable the divided-by-64 clock. the trailing edge of the active level at the ioc7 pin sets the paif. the pai bit enables the paif ?g to generate interrupt requests. chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 811 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the pulse accumulator counter register re?ct the number of pulses from the divided-by-64 clock since the last reset. note the timer prescaler generates the divided-by-64 clock. if the timer is not active, there is no divided-by-64 clock. 22.5 resets the reset state of each individual bit is listed within section 22.3, ?emory map and register de?ition which details the registers and their bit ?lds. 22.6 interrupts this section describes interrupts originated by the tim16b8cv2 block. table 22-24 lists the interrupts generated by the tim16b8cv2 to communicate with the mcu. the tim16b8cv2 uses a total of 11 interrupt vectors. the interrupt vector offsets and interrupt numbers are chip dependent. 22.6.1 channel [7:0] interrupt (c[7:0]f) this active high outputs will be asserted by the module to request a timer channel 7 ?0 interrupt to be serviced by the system controller. 22.6.2 pulse accumulator input interrupt (paovi) this active high output will be asserted by the module to request a timer pulse accumulator input interrupt to be serviced by the system controller. 22.6.3 pulse accumulator over?w interrupt (paovf) this active high output will be asserted by the module to request a timer pulse accumulator over?w interrupt to be serviced by the system controller. table 22-24. tim16b8cv1 interrupts interrupt offset 1 1 chip dependent. vector 1 priority 1 source description c[7:0]f timer channel 7? active high timer channel interrupts 7? paovi pulse accumulator input active high pulse accumulator input interrupt paovf pulse accumulator over?w pulse accumulator over?w interrupt tof timer over?w timer over?w interrupt chapter 22 timer module (tim16b8cv2) block description mc9s12xe-family reference manual , rev. 1.21 812 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 22.6.4 timer over?w interrupt (tof) this active high output will be asserted by the module to request a timer over?w interrupt to be serviced by the system controller. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 813 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 chapter 23 voltage regulator (s12vregl3v3v1) 23.1 introduction module vreg_3v3 is a tri output voltage regulator that provides two separate 1.84v (typical) supplies differing in the amount of current that can be sourced and a 2.82v (typical) supply. the regulator input voltage range is from 3.3v up to 5v (typical). 23.1.1 features module vreg_3v3 includes these distinctive features: three parallel, linear voltage regulators with bandgap reference low-voltage detect (lvd) with low-voltage interrupt (lvi) power-on reset (por) low-voltage reset (lvr) high temperature detect (htd) with high temperature interrupt (hti) autonomous periodical interrupt (api) 23.1.2 modes of operation there are three modes vreg_3v3 can operate in: 1. full performance mode (fpm) (mcu is not in stop mode) the regulator is active, providing the nominal supply voltages with full current sourcing capability. features lvd (low-voltage detect), lvr (low-voltage reset), and por (power-on reset) and htd (high temperature detect) are available. the api is available. 2. reduced power mode (rpm) (mcu is in stop mode) the purpose is to reduce power consumption of the device. the output voltage may degrade to a lower value than in full performance mode, additionally the current sourcing capability is substantially reduced. only the por is available in this mode, lvd, lvr and htd are disabled. the api is available. table 23-1. revision history revision number revision date sections affected description of changes v01.02 09 sep 2005 23.3.2.3/23-820 - updates for api external access and lvr ?gs. v01.03 23 sep 2005 23.3.2.1/23-818 - vae reset value is 1. v01.04 08 jun 2007 23.4.6/23-825 - added temperature sensor to customer information chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 814 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 3. shutdown mode controlled by vregen (see device level speci?ation for connectivity of vregen). this mode is characterized by minimum power consumption. the regulator outputs are in a high- impedance state, only the por feature is available, lvd, lvr and htd are disabled. the api internal rc oscillator clock is not available. this mode must be used to disable the chip internal regulator vreg_3v3, i.e., to bypass the vreg_3v3 to use external supplies. 23.1.3 block diagram figure 23-1 shows the function principle of vreg_3v3 by means of a block diagram. the regulator core reg consists of three parallel subblocks, reg1, reg2 and reg3, providing three independent output voltages. chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 815 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure 23-1. vreg_3v3 block diagram lv r lv d por vddr vdd lvi por lvr ctrl vss vddpll vsspll vregen reg pin vdda reg: regulator core ctrl: regulator control lvd: low voltage detect lvr: low voltage reset por: power-on reset htd: high temperature detect c hti htd api api api: auto. periodical interrupt v bg api rate select bus clock reg2 reg1 reg3 vddf vssa vddx chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 816 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.2 external signal description due to the nature of vreg_3v3 being a voltage regulator providing the chip internal power supply voltages, most signals are power supply signals connected to pads. table 23-2 shows all signals of vreg_3v3 associated with pins. note check device level speci?ation for connectivity of the signals. 23.2.1 vddr ?regulator power input pins signal vddr is the power input of vreg_3v3. all currents sourced into the regulator loads ?w through this pin. a chip external decoupling capacitor (100 nf...220 nf, x7r ceramic) between vddr and vssr (if vssr is not available vss) can smooth ripple on vddr. for entering shutdown mode, pin vddr should also be tied to ground on devices without vregen pin. 23.2.2 vdda, vssa ?regulator reference supply pins signals vdda/vssa , which are supposed to be relatively quiet, are used to supply the analog parts of the regulator. internal precision reference circuits are supplied from these signals. a chip external decoupling capacitor (100 nf...220 nf, x7r ceramic) between vdda and vssa can further improve the quality of this supply. 23.2.3 vdd, vss ?regulator output1 (core logic) pins signals vdd/vss are the primary outputs of vreg_3v3 that provide the power supply for the core logic. these signals are connected to device pins to allow external decoupling capacitors (220 nf, x7r ceramic). in shutdown mode an external supply driving vdd/vss can replace the voltage regulator. table 23-2. signal properties name function reset state pull up vddr power input (positive supply) vdda quiet input (positive supply) vssa quiet input (ground) vddx power input (positive supply) vdd primary output (positive supply) vss primary output (ground) vddf secondary output (positive supply) vddpll tertiary output (positive supply) vsspll tertiary output (ground) vregen (optional) optional regulator enable vreg_api (optional) vreg autonomous periodical interrupt output chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 817 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.2.4 vddf ?regulator output2 (nvm logic) pins signals vddf/vss are the secondary outputs of vreg_3v3 that provide the power supply for the nvm logic. these signals are connected to device pins to allow external decoupling capacitors (220 nf, x7r ceramic). in shutdown mode an external supply driving vddf/vss can replace the voltage regulator. 23.2.5 vddpll, vsspll ?regulator output3 (pll) pins signals vddpll/vsspll are the secondary outputs of vreg_3v3 that provide the power supply for the pll and oscillator. these signals are connected to device pins to allow external decoupling capacitors (100 nf...220 nf, x7r ceramic). in shutdown mode, an external supply driving vddpll/vsspll can replace the voltage regulator. 23.2.6 vddx ?power input pin signals vddx/vss are monitored by vreg_3v3 with the lvr feature. 23.2.7 vregen optional regulator enable pin this optional signal is used to shutdown vreg_3v3. in that case, vdd/vss and vddpll/vsspll must be provided externally. shutdown mode is entered with vregen being low. if vregen is high, the vreg_3v3 is either in full performance mode or in reduced power mode. for the connectivity of vregen, see device speci?ation. note switching from fpm or rpm to shutdown of vreg_3v3 and vice versa is not supported while mcu is powered. 23.2.8 vreg_api optional autonomous periodical interrupt output pin this pin provides the signal selected via apiea if system is set accordingly. see 23.3.2.3, autonomous periodical interrupt control register (vregapicl) and 23.4.8, autonomous periodical interrupt (api) for details. for the connectivity of vreg_api, see device speci?ation. 23.3 memory map and register de?ition this section provides a detailed description of all registers accessible in vreg_3v3. if enabled in the system, the vreg_3v3 will abort all read and write accesses to reserved registers within it s memory slice. see device level speci?ation for details. chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 818 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.3.1 module memory map a summary of the registers associated with the vreg_3v3 sub-block is shown in figure 23-2 . detailed descriptions of the registers and bits are given in the subsections that follow 23.3.2 register descriptions this section describes all the vreg_3v3 registers and their individual bits. 23.3.2.1 h igh t emperature control register (vreghtcl) the vreghtcl register allows to con?ure the vreg temperature sense features. figure 23-2. register summary address name bit 7 6 54321 bit 0 0x02f0 vreghtcl r0 0 vsel vae hten htds htie htif w 0x02f1 vregctrl r00000lvds lvie lvif w 0x02f2 vregapic l r apiclk 00 apifes apiea apife apie apif w 0x02f3 vregapit r r apitr5 apitr4 apitr3 apitr2 apitr1 apitr0 00 w 0x02f4 vregapir h r apir15 apir14 apir13 apir12 apir11 apir10 apir9 apir8 w 0x02f5 vregapir l r apir7 apir6 apir5 apir4 apir3 apir2 apir1 apir0 w 0x02f6 reserved 06 r00000000 w 0x02f7 vreghttr r htoen 000 httr3 httr2 httr1 httr0 w 0x02f0 76543210 r0 0 vsel vae hten htds htie htif w reset 0 0 0 10000 = unimplemented or reserved chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 819 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.3.2.2 control register (vregctrl) the vregctrl register allows the con?uration of the vreg_3v3 low-voltage detect features. table 23-3. vreghtcl field descriptions field description 7, 6 reserved these reserved bits are used for test purposes and writable only in special modes. they must remain clear for correct temperature sensor operation. 5 vsel voltage access select bit ?if set, the bandgap reference voltage v bg can be accessed internally (i.e. multiplexed to an internal analog to digital converter channel). the internal access must be enabled by bit vae. see device level speci?ation for connectivity. 0 an internal temperature proportional voltage v ht can be accessed internally if vae is set. 1 bandgap reference voltage v bg can be accessed internally if vae is set. 4 vae voltage access enable bit ?if set, the voltage selected by bit vsel can be accessed internally (i.e. multiplexed to an internal analog to digital converter channel). see device level speci?ation for connectivity. 0 voltage selected by vsel can not be accessed internally (i.e. external analog input is connected to analog to digital converter channel). 1 voltage selected by vsel can be accessed internally. 3 hten high temperature enable bit ?if set the temperature sense is enabled. 0 the temperature sense is disabled. 1 the temperature sense is enabled. 2 htds high temperature detect status bit this read-only status bit re?cts the temperature status. writes have no effect. 0 temperature t die is below level t htid or rpm or shutdown mode. 1 temperature t die is above level t htia and fpm. 1 htie high temperature interrupt enable bit 0 interrupt request is disabled. 1 interrupt will be requested whenever htif is set. 0 htif high temperature interrupt flag ?htif ?high temperature interrupt flag htif is set to 1 when htds status bit changes. this ?g can only be cleared by writing a 1. writing a 0 has no effect. if enabled (htie=1), htif causes an interrupt request. 0 no change in htds bit. 1 htds bit has changed. note: on entering the reduced power mode the htif is not cleared by the vreg. 0x02f1 76543210 r00000lvds lvie lvif w reset 0 0 0 00000 = unimplemented or reserved figure 23-3. control register (vregctrl) chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 820 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.3.2.3 autonomous periodical interrupt control register (vregapicl) the vregapicl register allows the con?uration of the vreg_3v3 autonomous periodical interrupt features. table 23-4. vregctrl field descriptions field description 2 lvds low-voltage detect status bit ?this read-only status bit re?cts the input voltage. writes have no effect. 0 input voltage v dda is above level v lvid or rpm or shutdown mode. 1 input voltage v dda is below level v lvia and fpm. 1 lvie low-voltage interrupt enable bit 0 interrupt request is disabled. 1 interrupt will be requested whenever lvif is set. 0 lvif low-voltage interrupt flag lvif is set to 1 when lvds status bit changes. this ?g can only be cleared by writing a 1. writing a 0 has no effect. if enabled (lvie = 1), lvif causes an interrupt request. 0 no change in lvds bit. 1 lvds bit has changed. note: on entering the reduced power mode the lvif is not cleared by the vreg_3v3. 0x02f2 76543210 r apiclk 00 apies apiea apife apie apif w reset 0 0 0 00000 = unimplemented or reserved figure 23-4. autonomous periodical interrupt control register (vregapicl) table 23-5. vregapicl field descriptions field description 7 apiclk autonomous periodical interrupt clock select bit ?selects the clock source for the api. writable only if apife = 0; apiclk cannot be changed if apife is set by the same write operation. 0 autonomous periodical interrupt clock used as source. 1 bus clock used as source. 4 apies autonomous periodical interrupt external select bit selects the waveform at the external pin.if set, at the external pin a clock is visible with 2 times the selected api period ( table 23-9 ). if not set, at the external pin will be a high pulse at the end of every selected period with the size of half of the min period ( table 23-9 ). see device level speci?ation for connectivity. 0 at the external periodic high pulses are visible, if apiea and apife is set. 1 at the external pin a clock is visible, if apiea and apife is set. 3 apiea autonomous periodical interrupt external access enable bit if set, the waveform selected by bit apies can be accessed externally. see device level speci?ation for connectivity. 0 waveform selected by apies can not be accessed externally. 1 waveform selected by apies can be accessed externally, if apife is set. 2 apife autonomous periodical interrupt feature enable bit ?enables the api feature and starts the api timer when set. 0 autonomous periodical interrupt is disabled. 1 autonomous periodical interrupt is enabled and timer starts running. chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 821 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.3.2.4 autonomous periodical interrupt trimming register (vregapitr) the vregapitr register allows to trim the api timeout period. 23.3.2.5 autonomous periodical interrupt rate high and low register (vregapirh / vregapirl) the vregapirh and vregapirl register allows the con?uration of the vreg_3v3 autonomous periodical interrupt rate. 1 apie autonomous periodical interrupt enable bit 0 api interrupt request is disabled. 1 api interrupt will be requested whenever apif is set. 0 apif autonomous periodical interrupt flag ?apif is set to 1 when the in the api con?ured time has elapsed. this ?g can only be cleared by writing a 1 to it. clearing of the ?g has precedence over setting. writing a 0 has no effect. if enabled (apie = 1), apif causes an interrupt request. 0 api timeout has not yet occurred. 1 api timeout has occurred. 0x02f3 76543210 r apitr5 apitr4 apitr3 apitr2 apitr1 apitr0 00 w reset 0 1 0 1 0 1 0 1 0 1 0 1 00 1. reset value is either 0 or preset by factory. see section 1 (device overview) for details. = unimplemented or reserved figure 23-5. autonomous periodical interrupt trimming register (vregapitr) table 23-6. vregapitr field descriptions field description 7? apitr[5:0] autonomous periodical interrupt period trimming bits ?see table 23-7 for trimming effects. table 23-7. trimming effect of apit bit trimming effect apitr[5] increases period apitr[4] decreases period less than apitr[5] increased it apitr[3] decreases period less than apitr[4] apitr[2] decreases period less than apitr[3] apitr[1] decreases period less than apitr[2] apitr[0] decreases period less than apitr[1] table 23-5. vregapicl field descriptions (continued) field description chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 822 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x02f4 76543210 r apir15 apir14 apir13 apir12 apir11 apir10 apir9 apir8 w reset 0 0 0 00000 = unimplemented or reserved figure 23-6. autonomous periodical interrupt rate high register (vregapirh) 0x02f5 76543210 r apir7 apir6 apir5 apir4 apir3 apir2 apir1 apir0 w reset 0 0 0 00000 figure 23-7. autonomous periodical interrupt rate low register (vregapirl) table 23-8. vregapirh / vregapirl field descriptions field description 15-0 apir[15:0] autonomous periodical interrupt rate bits these bits de?e the timeout period of the api. see table 23- 9 for details of the effect of the autonomous periodical interrupt rate bits. writable only if apife = 0 of vregapicl register. table 23-9. selectable autonomous periodical interrupt periods apiclk apir[15:0] selected period 0 0000 0.2 ms (1) 0 0001 0.4 ms 1 0 0002 0.6 ms 1 0 0003 0.8 ms 1 0 0004 1.0 ms 1 0 0005 1.2 ms 1 0 ..... ..... 0 fffd 13106.8 ms 1 0 fffe 13107.0 ms 1 0 ffff 13107.2 ms 1 1 0000 2 * bus clock period 1 0001 4 * bus clock period 1 0002 6 * bus clock period 1 0003 8 * bus clock period 1 0004 10 * bus clock period 1 0005 12 * bus clock period 1 ..... ..... 1 fffd 131068 * bus clock period 1 fffe 131070 * bus clock period chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 823 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the period can be calculated as follows depending of apiclk: period = 2*(apir[15:0] + 1) * 0.1 ms or period = 2*(apir[15:0] + 1) * bus clock period 23.3.2.6 reserved 06 the reserved 06 is reserved for test purposes. 23.3.2.7 high temperature trimming register (vreghttr) the vreghttr register allows to trim the vreg temperature sense. fiption 1 ffff 131072 * bus clock period 1. when trimmed within speci?d accuracy. see electrical speci?ations for details. 0x02f6 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 23-8. reserved 06 0x02f7 76543210 r htoen 000 httr3 httr2 httr1 httr0 w reset 0 0 0 0 0 1 0 1 0 1 0 1 1. reset value is either 0 or preset by factory. see section 1 (device overview) for details. = unimplemented or reserved figure 23-9. vreghttr table 23-10. vreghttr ?ld descriptions field description 7 htoen high temperature offset enable bit ?if set the temperature sense offset is enabled 0 the temperature sense offset is disabled 1 the temperature sense offset is enabled 3? httr[3:0] high temperature trimming bits ?see table 23-11 for trimming effects. table 23-11. trimming effect bit trimming effect httr[3] increases v ht twice of httr[2] table 23-9. selectable autonomous periodical interrupt periods (continued) apiclk apir[15:0] selected period chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 824 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.4 functional description 23.4.1 general module vreg_3v3 is a voltage regulator, as depicted in figure 23-1 . the regulator functional elements are the regulator core (reg), a low-voltage detect module (lvd), a control block (ctrl), a power-on reset module (por), and a low-voltage reset module (lvr)and a high temperature sensor (htd). 23.4.2 regulator core (reg) respectively its regulator core has three parallel, independent regulation loops (reg1,reg2 and reg3). reg1 and reg3 differ only in the amount of current that can be delivered. the regulators are linear regulator with a bandgap reference when operated in full performance mode. they act as a voltage clamp in reduced power mode. all load currents ?w from input vddr to vss or vsspll. the reference circuits are supplied by vdda and vssa. 23.4.2.1 full performance mode in full performance mode, the output voltage is compared with a reference voltage by an operational ampli?r. the ampli?d input voltage difference drives the gate of an output transistor. 23.4.2.2 reduced power mode in reduced power mode, the gate of the output transistor is connected directly to a reference voltage to reduce power consumption. mode switching from reduced power to full performance requires a transition time of t vup , if the voltage regulator is enabled. 23.4.3 low-voltage detect (lvd) subblock lvd is responsible for generating the low-voltage interrupt (lvi). lvd monitors the input voltage (v dda ? ssa ) and continuously updates the status ?g lvds. interrupt ?g lvif is set whenever status ?g lvds changes its value. the lvd is available in fpm and is inactive in reduced power mode or shutdown mode. httr[2] increases v ht twice of httr[1] httr[1] increases v ht twice of httr[0] httr[0] increases v ht (to compensate temperature offset) table 23-11. trimming effect (continued) bit trimming effect chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 825 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.4.4 power-on reset (por) this functional block monitors vdd. if v dd is below v pord , por is asserted; if v dd exceeds v pord , the por is deasserted. por asserted forces the mcu into reset. por deasserted will trigger the power- on sequence. 23.4.5 low-voltage reset (lvr) block lvr monitors the supplies vdd, vddx and vddf. if one (or more) drops below it s corresponding assertion level, signal lvr asserts; if all vdd,vddx and vddf supplies are above their corresponding deassertion levels, signal lvr deasserts. the lvr function is available only in full performance mode. 23.4.6 htd - high temperature detect subblock htd is responsible for generating the high temperature interrupt (hti). htd monitors the die temperature t die and continuously updates the status ?g htds. interrupt ?g htif is set whenever status ?g htds changes its value. the htd is available in fpm and is inactive in reduced power mode and shutdown mode. the ht trimming bits httr[3:0] can be set so that the temperature offset is zero, if accurate temperature measurement is desired. see table 23-11 for the trimming effect of apitr. 23.4.7 regulator control (ctrl) this part contains the register block of vreg_3v3 and further digital functionality needed to control the operating modes. ctrl also represents the interface to the digital core logic. 23.4.8 autonomous periodical interrupt (api) subblock api can generate periodical interrupts independent of the clock source of the mcu. to enable the timer, the bit apife needs to be set. the api timer is either clocked by a trimmable internal rc oscillator or the bus clock. timer operation will freeze when mcu clock source is selected and bus clock is turned off. see crg speci?ation for details. the clock source can be selected with bit apiclk. apiclk can only be written when apife is not set. the apir[15:0] bits determine the interrupt period. apir[15:0] can only be written when apife is cleared. as soon as apife is set, the timer starts running for the period selected by apir[15:0] bits. when the con?ured time has elapsed, the ?g apif is set. an interrupt, indicated by ?g apif = 1, is triggered if interrupt enable bit apie = 1. the timer is started automatically again after it has set apif. the procedure to change apiclk or apir[15:0] is ?st to clear apife, then write to apiclk or apir[15:0], and afterwards set apife. chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 826 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the api trimming bits apitr[5:0] must be set so the minimum period equals 0.2 ms if stable frequency is desired. see table 23-7 for the trimming effect of apitr. note the ?st period after enabling the counter by apife might be reduced by api start up delay t sdel . the api internal rc oscillator clock is not available if vreg_3v3 is in shutdown mode. it is possible to generate with the api a waveform at an external pin by enabling the api by setting apife and enabling the external access with setting apiea. by setting apies the waveform can be selected. if apies is set, then at the external pin a clock is visible with 2 times the selected api period ( table 23-9 ). if apies is not set, then at the external pin will be a high pulse at the end of every selected period with the size of half of the min period ( table 23-9 ). see device level speci?ation for connectivity. 23.4.9 resets this section describes how vreg_3v3 controls the reset of the mcu.the reset values of registers and signals are provided in section 23.3, ?emory map and register de?ition . possible reset sources are listed in table 23-12 . 23.4.10 description of reset operation 23.4.10.1 power-on reset (por) during chip power-up the digital core may not work if its supply voltage v dd is below the por deassertion level (v pord ). therefore, signal por, which forces the other blocks of the device into reset, is kept high until v dd exceeds v pord . the mcu will run the start-up sequence after por deassertion. the power-on reset is active in all operation modes of vreg_3v3. 23.4.10.2 low-voltage reset (lvr) for details on low-voltage reset, see section 23.4.5, ?ow-voltage reset (lvr) . 23.4.11 interrupts this section describes all interrupts originated by vreg_3v3. the interrupt vectors requested by vreg_3v3 are listed in table 23-13 . vector addresses and interrupt priorities are de?ed at mcu level. table 23-12. reset sources reset source local enable power-on reset always active low-voltage reset available only in full performance mode chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 827 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 23.4.11.1 low-voltage interrupt (lvi) in fpm, vreg_3v3 monitors the input voltage v dda . whenever v dda drops below level v lvia, the status bit lvds is set to 1. on the other hand, lvds is reset to 0 when v dda rises above level v lvid .an interrupt, indicated by ?g lvif = 1, is triggered by any change of the status bit lvds if interrupt enable bit lvie = 1. note on entering the reduced power mode, the lvif is not cleared by the vreg_3v3. 23.4.11.2 hti - high temperature interrupt in fpm vreg monitors the die temperature t die . whenever t die exceeds level t htia the status bit htds is set to 1. vice versa, htds is reset to 0 when t die get below level t htid . an interrupt, indicated by ?g htif=1, is triggered by any change of the status bit htds if interrupt enable bit htie=1. note on entering the reduced power mode the htif is not cleared by the vreg. 23.4.11.3 autonomous periodical interrupt (api) as soon as the con?ured timeout period of the api has elapsed, the apif bit is set. an interrupt, indicated by ?g apif = 1, is triggered if interrupt enable bit apie = 1. table 23-13. interrupt vectors interrupt source local enable low-voltage interrupt (lvi) lvie = 1; available only in full performance mode high temperature interrupt (hti) htie=1; available only in full performance mode autonomous periodical interrupt (api) apie = 1 chapter 23 voltage regulator (s12vregl3v3v1) mc9s12xe-family reference manual , rev. 1.21 828 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 829 chapter 24 128 kbyte flash module (s12xftm128k2v1) table 24-1. revision history revision number revision date sections affected description of changes v01.10 30 nov 2007 24.1.3/24-832 - correction to table 24-6 v01.11 19 dec 2007 24.4.2/24-865 24.4.2/24-865 24.4.2/24-865 24.4.2/24-865 24.3.1/24-834 24.1.3/24-832 24.3.1/24-834 24.1.2.2/24-831 24.3.1/24-834 - removed load data field command 0x05 - updated command error handling tables based on parent-child relationship with ftm256k2 - corrected error handling table for full partition d-flash, partition d-flash, and eeprom emulation query commands - corrected maximum allowed erpart for full partition d-flash and partition d-flash commands - corrected p-flash ifr accessibility table - corrected buffer ram size in feature list - corrected eee resource memory map - changed d-flash size from 16kbytes to 32kbytes - corrected p-flash memory map v01.12 25 sep 2009 24.1/24-829 24.3.2.1/24-841 24.4.2.4/24-868 24.4.2.6/24-869 24.4.2.11/24- 873 24.4.2.11/24- 873 24.4.2.11/24- 873 24.4.2.19/24- 882 24.3.2/24-839 24.3.2.1/24-841 24.4.1.2/24-860 24.6/24-888 - change references for d-flash from 16 kbytes to 32 kbytes - clarify single bit fault correction for p-flash phrase - expand fdiv vs oscclk frequency table - add statement concerning code runaway when executing read once command from flash block containing associated ?lds - add statement concerning code runaway when executing program once command from flash block containing associated ?lds - add statement concerning code runaway when executing verify backdoor access key command from flash block containing associated ?lds - relate key 0 to associated backdoor comparison key address - change ?ower down reset?to ?eset - add accerr condition for disable eeprom emulation command the following changes were made to clarify module behavior related to flash register access during reset sequence and while flash commands are active: - add caution concerning register writes while command is active - writes to fclkdiv are allowed during reset sequence while ccif is clear - add caution concerning register writes while command is active - writes to fccobix, fccobhi, fccoblo registers are ignored during reset sequence mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 830 24.1 introduction the ftm128k2 module implements the following: 128 kbytes of p-flash (program flash) memory, consisting of 2 physical flash blocks, intended primarily for nonvolatile code storage 32 kbytes of d-flash (data flash) memory, consisting of 1 physical flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated eeprom, as basic flash memory primarily intended for nonvolatile data storage, or as a combination of both 2 kbytes of buffer ram, consisting of 1 physical ram block, that can be used as emulated eeprom using a built-in hardware scheme, as basic ram, or as a combination of both the flash memory is ideal for single-supply applications allowing for ?ld reprogramming without requiring external high voltage sources for program or erase operations. the flash module includes a memory controller that executes commands to modify flash memory contents or con?ure module resources for emulated eeprom operation. the user interface to the memory controller consists of the indexed flash common command object (fccob) register which is written to with the command, global address, data, and any required command parameters. the memory controller must complete the execution of a command before the fccob register can be written to with a new command. caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. the ram and flash memory may be read as bytes, aligned words, or misaligned words. read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. for flash memory, an erased bit reads 1 and a programmed bit reads 0. it is not possible to read from a flash block while any command is executing on that speci? flash block. it is possible to read from a flash block while a command is executing on a different flash block. both p-flash and d-flash memories are implemented with error correction codes (ecc) that can resolve single bit faults and detect double bit faults. for p-flash memory, the ecc implementation requires that programming be done on an aligned 8 byte basis (a flash phrase). since p-flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 24.1.1 glossary buffer ram the buffer ram constitutes the volatile memory store required for eee. memory space in the buffer ram not required for eee can be partitioned to provide volatile memory space for applications. chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 831 command write sequence ?an mcu instruction sequence to execute built-in algorithms (including program and erase) on the flash memory. d-flash memory ?the d-flash memory constitutes the nonvolatile memory store required for eee. memory space in the d-flash memory not required for eee can be partitioned to provide nonvolatile memory space for applications. d-flash sector the d-flash sector is the smallest portion of the d-flash memory that can be erased. the d-flash sector consists of four 64 byte rows for a total of 256 bytes. eee (emulated eeprom) ?a method to emulate the small sector size features and endurance characteristics associated with an eeprom. eee ifr nonvolatile information register located in the d-flash block that contains data required to partition the d-flash memory and buffer ram for eee. the eee ifr is visible in the global memory map by setting the eeeifron bit in the mmcctl1 register. nvm command mode an nvm mode using the cpu to setup the fccob register to pass parameters required for flash command execution. phrase an aligned group of four 16-bit words within the p-flash memory. each phrase includes eight ecc bits for single bit fault correction and double bit fault detection within the phrase. p-flash memory the p-flash memory constitutes the main nonvolatile memory store for applications. p-flash sector ?the p-flash sector is the smallest portion of the p-flash memory that can be erased. each p-flash sector contains 1024 bytes. program ifr ?nonvolatile information register located in the p-flash block that contains the device id, version id, and the program once ?ld. the program ifr is visible in the global memory map by setting the pgmifron bit in the mmcctl1 register. 24.1.2 features 24.1.2.1 p-flash features 128 kbytes of p-flash memory composed of two 64 kbyte flash blocks. the 64 kbyte flash blocks are each divided into 64 sectors of 1024 bytes. single bit fault correction and double bit fault detection within a 64-bit phrase during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and phrase program operation ability to program up to one phrase in each p-flash block simultaneously flexible protection scheme to prevent accidental program or erase of p-flash memory 24.1.2.2 d-flash features up to 32 kbytes of d-flash memory with 256 byte sectors for user access dedicated commands to control access to the d-flash memory over eee operation chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 832 freescale semiconductor single bit fault correction and double bit fault detection within a word during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and word program operation ability to program up to four words in a burst sequence 24.1.2.3 emulated eeprom features up to 2 kbytes of emulated eeprom (eee) accessible as 2 kbytes of ram flexible protection scheme to prevent accidental program or erase of data automatic eee ?e handling using an internal memory controller automatic transfer of valid eee data from d-flash memory to buffer ram on reset ability to monitor the number of outstanding eee related buffer ram words left to be programmed into d-flash memory ability to disable eee operation and allow priority access to the d-flash memory ability to cancel all pending eee operations and allow priority access to the d-flash memory 24.1.2.4 user buffer ram features up to 2 kbytes of ram for user access 24.1.2.5 other flash module features no external high-voltage power supply required for flash memory program and erase operations interrupt generation on flash command completion and flash error detection security mechanism to prevent unauthorized access to the flash memory 24.1.3 block diagram the block diagram of the flash module is shown in figure 24-1 . chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 833 figure 24-1. ftm128k2 block diagram 24.2 external signal description the flash module contains no signals that connect off-chip. oscillator clock divider clock (xtal) command interrupt request fclk protection security registers flash interface p-flash sector 0 sector 1 sector 63 8kx72 16bit internal bus block 1 xgate p-flash sector 0 sector 1 sector 63 8kx72 block 0 error interrupt request memory cpu controller d-flash 16kx22 buffer ram tag ram 64x16 1kx16 sector 0 sector 1 sector 127 scratch ram 512x16 chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 834 freescale semiconductor 24.3 memory map and registers this section describes the memory map and registers for the flash module. read data from unimplemented memory space in the flash module is unde?ed. write access to unimplemented or reserved memory space in the flash module will be ignored by the flash module. 24.3.1 module memory map the s12x architecture places the p-flash memory between global addresses 0x78_0000 and 0x7f_ffff as shown in table 24-2 . the p-flash memory map is shown in figure 24-2 . the fprot register, described in section 24.3.2.9 , can be set to protect regions in the flash memory from accidental program or erase. three separate memory regions, one growing upward from global address 0x7f_8000 in the flash memory (called the lower region), one growing downward from global address 0x7f_ffff in the flash memory (called the higher region), and the remaining addresses in the flash memory, can be activated for protection. the flash memory addresses covered by these protectable regions are shown in the p-flash memory map. the higher address region is mainly targeted to hold the boot loader code since it covers the vector space. default protection settings as well as security information that allows the mcu to restrict access to the flash module are stored in the flash con?uration ?ld as described in table 24-3 . table 24-2. p-flash memory addressing global address size (bytes) description 0x7f_0000 ?0x7f_ffff 64 k p-flash block 0 contains flash con?uration field (see table 24-3 ) 0x79_0000 ?0x7e_ffff 384 k no p-flash memory 0x78_0000 ?0x78_ffff 64 k p-flash block 1 table 24-3. flash con?uration field (1) global address size (bytes) description 0x7f_ff00 ?0x7f_ff07 8 backdoor comparison key refer to section 24.4.2.11, ?erify backdoor access key command , and section 24.5.1, ?nsecuring the mcu using backdoor key access 0x7f_ff08 0x7f_ff0b (2) 4 reserved 0x7f_ff0c 2 1 p-flash protection byte . refer to section 24.3.2.9, ?-flash protection register (fprot) 0x7f_ff0d 2 1 eee protection byte refer to section 24.3.2.10, ?ee protection register (eprot) 0x7f_ff0e 2 1 flash nonvolatile byte refer to section 24.3.2.14, ?lash option register (fopt) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 835 0x7f_ff0f 2 1 flash security byte refer to section 24.3.2.2, ?lash security register (fsec) 1. older versions may have swapped protection byte addresses 2. 0x7ff08 - 0x7f_ff0f form a flash phrase and must be programmed in a single command write sequence. each byte in the 0x7f_ff08 - 0x7f_ff0b reserved ?ld should be programmed to 0xff. table 24-3. flash con?uration field (1) global address size (bytes) description chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 836 freescale semiconductor figure 24-2. p-flash memory map flash con?uration field 0x7f_c000 flash protected/unprotected lower region 1, 2, 4, 8 kbytes 0x7f_8000 0x7f_9000 0x7f_8400 0x7f_8800 0x7f_a000 p-flash end = 0x7f_ffff 0x7f_f800 0x7f_f000 0x7f_e000 flash protected/unprotected higher region 2, 4, 8, 16 kbytes flash protected/unprotected region 8 kbytes (up to 29 kbytes) 16 bytes (0x7f_ff00 - 0x7f_ff0f) flash protected/unprotected region 96 kbytes p-flash start = 0x78_0000 0x78_ffff 0x7f_0000 chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 837 table 24-4. program ifr fields global address (pgmifron) size (bytes) field description 0x40_0000 ?0x40_0007 8 device id 0x40_0008 ?0x40_00e7 224 reserved 0x40_00e8 ?0x40_00e9 2 version id 0x40_00ea ?0x40_00ff 22 reserved 0x40_0100 ?0x40_013f 64 program once field refer to section 24.4.2.6, ?rogram once command 0x40_0140 ?0x40_01ff 192 reserved table 24-5. p-flash ifr accessibility global address (pgmifron) size (bytes) accessed from 0x40_0000 ?0x40_01ff 512 xbus0 (pblk0) (1) 1. refer to table 24-4 for more details. 0x40_0200 ?0x40_03ff 512 unimplemented 0x40_0400 ?0x40_05ff 512 unimplemented 0x40_0600 ?0x40_07ff 512 xbus1 (pblk1) table 24-6. eee resource fields global address size (bytes) description 0x10_0000 ?0x10_7fff 32,768 d-flash memory (user and eee) 0x10_8000 ?0x11_ffff 98,304 reserved 0x12_0000 ?0x12_007f 128 eee nonvolatile information register (eeeifron (1) = 1) 1. mmcctl1 register bit 0x12_0080 ?0x12_0fff 3,968 reserved 0x12_1000 ?0x12_1f7f 3,968 reserved 0x12_1f80 ?0x12_1fff 128 eee tag ram (tmgramon 1 = 1) 0x12_2000 ?0x12_3bff 7,168 reserved 0x12_3c00 ?0x12_3fff 1,024 memory controller scratch ram (tmgramon 1 = 1) 0x12_4000 ?0x12_dfff 40,960 reserved 0x12_e000 ?0x12_ffff 8,192 reserved 0x13_0000 ?0x13_f7ff 63,488 reserved 0x13_f800 ?0x13_ffff 2,048 buffer ram (user and eee) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 838 freescale semiconductor figure 24-3. eee resource memory map buffer ram start = 0x13_f800 buffer ram end = 0x13_ffff 0x13_ffc0 0x13_ff80 protectable region (eee only) 64, 128, 192, 256, 320, 384, 448, 512 bytes buffer ram 2 kbyte 0x13_ff40 0x13_ff00 0x13_fec0 0x13_fe80 0x13_fe40 0x13_fe00 0x12_ffff 0x12_4000 0x12_1000 memory controller scratch ram (tmgramon) 1024 bytes eee tag ram (tmgramon) 128 bytes eee nonvolatile information register (eeeifron) 128 bytes d-flash memory 32 kbytes d-flash start = 0x10_0000 d-flash user partition d-flash eee partition 0x12_0000 0x12_2000 0x12_e000 d-flash end = 0x10_7fff buffer ram user partition buffer ram eee partition chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 839 the full partition d-flash command (see section 24.4.2.14 ) is used to program the eee nonvolatile information register ?lds where address 0x12_0000 de?es the d-flash partition for user access and address 0x12_0004 de?es the buffer ram partition for eee operations. 24.3.2 register descriptions the flash module contains a set of 20 control and status registers located between flash module base + 0x0000 and 0x0013. a summary of the flash module registers is given in figure 24-4 with detailed descriptions in the following subsections. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. table 24-7. eee nonvolatile information register fields global address (eeeifron) size (bytes) description 0x12_0000 ?0x12_0001 2 d-flash user partition (dfpart) refer to section 24.4.2.14, ?ull partition d-flash command 0x12_0002 ?0x12_0003 2 d-flash user partition (duplicate (1) ) 1. duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 ?0x12_0005 2 buffer ram eee partition (erpart) refer to section 24.4.2.14, ?ull partition d-flash command 0x12_0006 ?0x12_0007 2 buffer ram eee partition (duplicate 1 ) 0x12_0008 ?0x12_007f 120 reserved address & name 76543210 0x0000 fclkdiv r fdivld fdiv6 fdiv5 fdiv4 fdiv3 fdiv2 fdiv1 fdiv0 w 0x0001 fsec r keyen1 keyen0 rnv5 rnv4 rnv3 rnv2 sec1 sec0 w 0x0002 fccobix r0 0 0 0 0 ccobix2 ccobix1 ccobix0 w 0x0003 feccrix r0 0 0 0 0 eccrix2 eccrix1 eccrix0 w 0x0004 fcnfg r ccie 00 ignsf 00 fdfd fsfd w figure 24-4. ftm128k2 register summary chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 840 freescale semiconductor 0x0005 fercnfg r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w 0x0006 fstat r ccif 0 accerr fpviol mgbusy rsvd mgstat1 mgstat0 w 0x0007 ferstat r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w 0x0008 fprot r fpopen rnv6 fphdis fphs1 fphs0 fpldis fpls1 fpls0 w 0x0009 eprot r epopen rnv6 rnv5 rnv4 epdis eps2 eps1 eps0 w 0x000a fccobhi r ccob15 ccob14 ccob13 ccob12 ccob11 ccob10 ccob9 ccob8 w 0x000b fccoblo r ccob7 ccob6 ccob5 ccob4 ccob3 ccob2 ccob1 ccob0 w 0x000c etaghi r etag15 etag14 etag13 etag12 etag11 etag10 etag9 etag8 w 0x000d etaglo r etag7 etag6 etag5 etag4 etag3 etag2 etag1 etag0 w 0x000e feccrhi r eccr15 eccr14 eccr13 eccr12 eccr11 eccr10 eccr9 eccr8 w 0x000f feccrlo r eccr7 eccr6 eccr5 eccr4 eccr3 eccr2 eccr1 eccr0 w 0x0010 fopt r nv7 nv6 nv5 nv4 nv3 nv2 nv1 nv0 w 0x0011 frsv0 r00000000 w 0x0012 frsv1 r00000000 w address & name 76543210 figure 24-4. ftm128k2 register summary (continued) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 841 24.3.2.1 flash clock divider register (fclkdiv) the fclkdiv register is used to control timed events in program and erase algorithms. all bits in the fclkdiv register are readable, bits 6? are write once and bit 7 is not writable. caution the fclkdiv register should never be written while a flash command is executing (ccif=0). the fclkdiv register is writable during the flash reset sequence even though ccif is clear. 0x0013 frsv2 r00000000 w = unimplemented or reserved offset module base + 0x0000 76543210 r fdivld fdiv[6:0] w reset 00000000 = unimplemented or reserved figure 24-5. flash clock divider register (fclkdiv) table 24-8. fclkdiv field descriptions field description 7 fdivld clock divider loaded 0 fclkdiv register has not been written 1 fclkdiv register has been written since the last reset 6? fdiv[6:0] clock divider bits ?fdiv[6:0] must be set to effectively divide oscclk down to generate an internal flash clock, fclk, with a target frequency of 1 mhz for use by the flash module to control timed events during program and erase algorithms. table 24-9 shows recommended values for fdiv[6:0] based on oscclk frequency. please refer to section 24.4.1, ?lash command operations , for more information. address & name 76543210 figure 24-4. ftm128k2 register summary (continued) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 842 freescale semiconductor table 24-9. fdiv vs oscclk frequency oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] min (1) 1. fdiv shown generates an fclk frequency of >0.8 mhz max (2) min 1 max 2 min 1 max 2 33.60 34.65 0x20 67.20 68.25 0x40 1.60 2.10 0x01 34.65 35.70 0x21 68.25 69.30 0x41 2.40 3.15 0x02 35.70 36.75 0x22 69.30 70.35 0x42 3.20 4.20 0x03 36.75 37.80 0x23 70.35 71.40 0x43 4.20 5.25 0x04 37.80 38.85 0x24 71.40 72.45 0x44 5.25 6.30 0x05 38.85 39.90 0x25 72.45 73.50 0x45 6.30 7.35 0x06 39.90 40.95 0x26 73.50 74.55 0x46 7.35 8.40 0x07 40.95 42.00 0x27 74.55 75.60 0x47 8.40 9.45 0x08 42.00 43.05 0x28 75.60 76.65 0x48 9.45 10.50 0x09 43.05 44.10 0x29 76.65 77.70 0x49 10.50 11.55 0x0a 44.10 45.15 0x2a 77.70 78.75 0x4a 11.55 12.60 0x0b 45.15 46.20 0x2b 78.75 79.80 0x4b 12.60 13.65 0x0c 46.20 47.25 0x2c 79.80 80.85 0x4c 13.65 14.70 0x0d 47.25 48.30 0x2d 80.85 81.90 0x4d 14.70 15.75 0x0e 48.30 49.35 0x2e 81.90 82.95 0x4e 15.75 16.80 0x0f 49.35 50.40 0x2f 82.95 84.00 0x4f 16.80 17.85 0x10 50.40 51.45 0x30 84.00 85.05 0x50 17.85 18.90 0x11 51.45 52.50 0x31 85.05 86.10 0x51 18.90 19.95 0x12 52.50 53.55 0x32 86.10 87.15 0x52 19.95 21.00 0x13 53.55 54.60 0x33 87.15 88.20 0x53 21.00 22.05 0x14 54.60 55.65 0x34 88.20 89.25 0x54 22.05 23.10 0x15 55.65 56.70 0x35 89.25 90.30 0x55 23.10 24.15 0x16 56.70 57.75 0x36 90.30 91.35 0x56 24.15 25.20 0x17 57.75 58.80 0x37 91.35 92.40 0x57 25.20 26.25 0x18 58.80 59.85 0x38 92.40 93.45 0x58 26.25 27.30 0x19 59.85 60.90 0x39 93.45 94.50 0x59 27.30 28.35 0x1a 60.90 61.95 0x3a 94.50 95.55 0x5a 28.35 29.40 0x1b 61.95 63.00 0x3b 95.55 96.60 0x5b 29.40 30.45 0x1c 63.00 64.05 0x3c 96.60 97.65 0x5c 30.45 31.50 0x1d 64.05 65.10 0x3d 97.65 98.70 0x5d 31.50 32.55 0x1e 65.10 66.15 0x3e 98.70 99.75 0x5e 32.55 33.60 0x1f 66.15 67.20 0x3f 99.75 100.80 0x5f chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 843 24.3.2.2 flash security register (fsec) the fsec register holds all bits associated with the security of the mcu and flash module. all bits in the fsec register are readable but not writable. during the reset sequence, the fsec register is loaded with the contents of the flash security byte in the flash configuration field at global address 0x7f_ff0f located in p-flash memory (see table 24-3 ) as indicated by reset condition f in figure 24-6 . if a double bit fault is detected while reading the p-flash phrase containing the flash security byte during the reset sequence, all bits in the fsec register will be set to leave the flash module in a secured state with backdoor key access disabled. 2. fdiv shown generates an fclk frequency of 1.05 mhz offset module base + 0x0001 76543210 r keyen[1:0] rnv[5:2] sec[1:0] w reset f f ffffff = unimplemented or reserved figure 24-6. flash security register (fsec) table 24-10. fsec field descriptions field description 7? keyen[1:0] backdoor key security enable bits the keyen[1:0] bits de?e the enabling of backdoor key access to the flash module as shown in table 24-11 . 5? rnv[5:2} reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements. 1? sec[1:0] flash security bits ?the sec[1:0] bits de?e the security state of the mcu as shown in table 24-12 . if the flash module is unsecured using backdoor key access, the sec bits are forced to 10. table 24-11. flash keyen states keyen[1:0] status of backdoor key access 00 disabled 01 disabled (1) 1. preferred keyen state to disable backdoor key access. 10 enabled 11 disabled chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 844 freescale semiconductor the security function in the flash module is described in section 24.5 . 24.3.2.3 flash ccob index register (fccobix) the fccobix register is used to index the fccob register for flash memory operations. ccobix bits are readable and writable while remaining bits read 0 and are not writable. 24.3.2.4 flash eccr index register (feccrix) the feccrix register is used to index the feccr register for ecc fault reporting. eccrix bits are readable and writable while remaining bits read 0 and are not writable. table 24-12. flash security states sec[1:0] status of security 00 secured 01 secured (1) 1. preferred sec state to set mcu to secured state. 10 unsecured 11 secured offset module base + 0x0002 76543210 r00000 ccobix[2:0] w reset 00000000 = unimplemented or reserved figure 24-7. fccob index register (fccobix) table 24-13. fccobix field descriptions field description 2? ccobix[1:0] common command register index the ccobix bits are used to select which word of the fccob register array is being read or written to. see section 24.3.2.11, ?lash common command object register (fccob) , for more details. offset module base + 0x0003 76543210 r00000 eccrix[2:0] w reset 00000000 = unimplemented or reserved figure 24-8. feccr index register (feccrix) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 845 24.3.2.5 flash con?uration register (fcnfg) the fcnfg register enables the flash command complete interrupt and forces ecc faults on flash array read access from the cpu or xgate. ccie, ignsf, fdfd, and fsfd bits are readable and writable while remaining bits read 0 and are not writable. table 24-14. feccrix field descriptions field description 2-0 eccrix[2:0] ecc error register index ?the eccrix bits are used to select which word of the feccr register array is being read. see section 24.3.2.13, ?lash ecc error results register (feccr) , for more details. offset module base + 0x0004 76543210 r ccie 00 ignsf 00 fdfd fsfd w reset 00000000 = unimplemented or reserved figure 24-9. flash con?uration register (fcnfg) table 24-15. fcnfg field descriptions field description 7 ccie command complete interrupt enable ?the ccie bit controls interrupt generation when a flash command has completed. 0 command complete interrupt disabled 1 an interrupt will be requested whenever the ccif ?g in the fstat register is set (see section 24.3.2.7 ) 4 ignsf ignore single bit fault ?the ignsf controls single bit fault reporting in the ferstat register (see section 24.3.2.8 ). 0 all single bit faults detected during array reads are reported 1 single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 846 freescale semiconductor 24.3.2.6 flash error con?uration register (fercnfg) the fercnfg register enables the flash error interrupts for the ferstat flags. all assigned bits in the fercnfg register are readable and writable. 1 fdfd force double bit fault detect the fdfd bit allows the user to simulate a double bit fault during flash array read operations and check the associated interrupt routine. the fdfd bit is cleared by writing a 0 to fdfd. the feccr registers will not be updated during the flash array read operation with fdfd set unless an actual double bit fault is detected. 0 flash array read operations will set the dfdif ?g in the ferstat register only if a double bit fault is detected 1 any flash array read operation will force the dfdif ?g in the ferstat register to be set (see section 24.3.2.7 ) and an interrupt will be generated as long as the dfdie interrupt enable in the fercnfg register is set (see section 24.3.2.6 ) 0 fsfd force single bit fault detect the fsfd bit allows the user to simulate a single bit fault during flash array read operations and check the associated interrupt routine. the fsfd bit is cleared by writing a 0 to fsfd. the feccr registers will not be updated during the flash array read operation with fsfd set unless an actual single bit fault is detected. 0 flash array read operations will set the sfdif ?g in the ferstat register only if a single bit fault is detected 1 flash array read operation will force the sfdif ?g in the ferstat register to be set (see section 24.3.2.7 ) and an interrupt will be generated as long as the sfdie interrupt enable in the fercnfg register is set (see section 24.3.2.6 ) offset module base + 0x0005 76543210 r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w reset 00000000 = unimplemented or reserved figure 24-10. flash error con?uration register (fercnfg) table 24-16. fercnfg field descriptions field description 7 erserie eee erase error interrupt enable the erserie bit controls interrupt generation when a failure is detected during an eee erase operation. 0 erserif interrupt disabled 1 an interrupt will be requested whenever the erserif ?g is set (see section 24.3.2.8 ) 6 pgmerie eee program error interrupt enable ?the pgmerie bit controls interrupt generation when a failure is detected during an eee program operation. 0 pgmerif interrupt disabled 1 an interrupt will be requested whenever the pgmerif ?g is set (see section 24.3.2.8 ) 4 epviolie eee protection violation interrupt enable ?the epviolie bit controls interrupt generation when a protection violation is detected during a write to the buffer ram eee partition. 0 epviolif interrupt disabled 1 an interrupt will be requested whenever the epviolif ?g is set (see section 24.3.2.8 ) table 24-15. fcnfg field descriptions (continued) field description chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 847 24.3.2.7 flash status register (fstat) the fstat register reports the operational status of the flash module. ccif, accerr, and fpviol bits are readable and writable, mgbusy and mgstat bits are readable but not writable, while remaining bits read 0 and are not writable. 3 ersvie1 eee error type 1 interrupt enable the ersvie1 bit controls interrupt generation when a change state error is detected during an eee operation. 0 ersvif1 interrupt disabled 1 an interrupt will be requested whenever the ersvif1 ?g is set (see section 24.3.2.8 ) 2 ersvie0 eee error type 0 interrupt enable the ersvie0 bit controls interrupt generation when a sector format error is detected during an eee operation. 0 ersvif0 interrupt disabled 1 an interrupt will be requested whenever the ersvif0 ?g is set (see section 24.3.2.8 ) 1 dfdie double bit fault detect interrupt enable the dfdie bit controls interrupt generation when a double bit fault is detected during a flash block read operation. 0 dfdif interrupt disabled 1 an interrupt will be requested whenever the dfdif ?g is set (see section 24.3.2.8 ) 0 sfdie single bit fault detect interrupt enable the sfdie bit controls interrupt generation when a single bit fault is detected during a flash block read operation. 0 sfdif interrupt disabled whenever the sfdif ?g is set (see section 24.3.2.8 ) 1 an interrupt will be requested whenever the sfdif ?g is set (see section 24.3.2.8 ) offset module base + 0x0006 76543210 r ccif 0 accerr fpviol mgbusy rsvd mgstat[1:0] w reset 1000000 (1) 1. reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see section 24.6 ). 0 1 = unimplemented or reserved figure 24-11. flash status register (fstat) table 24-16. fercnfg field descriptions (continued) field description chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 848 freescale semiconductor 24.3.2.8 flash error status register (ferstat) the ferstat register re?cts the error status of internal flash operations. all ?gs in the ferstat register are readable and only writable to clear the ?g. table 24-17. fstat field descriptions field description 7 ccif command complete interrupt flag ?the ccif ?g indicates that a flash command has completed. the ccif ?g is cleared by writing a 1 to ccif to launch a command and ccif will stay low until command completion or command violation. 0 flash command in progress 1 flash command has completed 5 accerr flash access error flag ?the accerr bit indicates an illegal access has occurred to the flash memory caused by either a violation of the command write sequence (see section 24.4.1.2 ) or issuing an illegal flash command or when errors are encountered while initializing the eee buffer ram during the reset sequence. while accerr is set, the ccif ?g cannot be cleared to launch a command. the accerr bit is cleared by writing a 1 to accerr. writing a 0 to the accerr bit has no effect on accerr. 0 no access error detected 1 access error detected 4 fpviol flash protection violation flag ?he fpviol bit indicates an attempt was made to program or erase an address in a protected area of p-flash memory during a command write sequence. the fpviol bit is cleared by writing a 1 to fpviol. writing a 0 to the fpviol bit has no effect on fpviol. while fpviol is set, it is not possible to launch a command or start a command write sequence. 0 no protection violation detected 1 protection violation detected 3 mgbusy memory controller busy flag ?the mgbusy ?g re?cts the active state of the memory controller . 0 memory controller is idle 1 memory controller is busy executing a flash command (ccif = 0) or is handling internal eee operations 2 rsvd reserved bit ?this bit is reserved and always reads 0 . 1? mgstat[1:0] memory controller command completion status flag one or more mgstat ?g bits are set if an error is detected during execution of a flash command or during the flash reset sequence. see section 24.4.2, ?lash command description , and section 24.6, ?nitialization ?for details. offset module base + 0x0007 76543210 r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w reset 00000000 = unimplemented or reserved figure 24-12. flash error status register (ferstat) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 849 24.3.2.9 p-flash protection register (fprot) the fprot register defines which p-flash sectors are protected against program and erase operations. table 24-18. ferstat field descriptions field description 7 erserif eee erase error interrupt flag ?the setting of the erserif ?g occurs due to an error in a flash erase command that resulted in the erase operation not being successful during eee operations. the erserif ?g is cleared by writing a 1 to erserif. writing a 0 to the erserif ?g has no effect on erserif. while erserif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 erase command successfully completed on the d-flash eee partition 1 erase command failed on the d-flash eee partition 6 pgmerif eee program error interrupt flag ?the setting of the pgmerif ?g occurs due to an error in a flash program command that resulted in the program operation not being successful during eee operations. the pgmerif ?g is cleared by writing a 1 to pgmerif. writing a 0 to the pgmerif ?g has no effect on pgmerif. while pgmerif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 program command successfully completed on the d-flash eee partition 1 program command failed on the d-flash eee partition 4 epviolif eee protection violation interrupt flag ?he setting of the epviolif ?g indicates an attempt was made to write to a protected area of the buffer ram eee partition. the epviolif ?g is cleared by writing a 1 to epviolif. writing a 0 to the epviolif ?g has no effect on epviolif. while epviolif is set, it is possible to write to the buffer ram eee partition as long as the address written to is not in a protected area. 0 no eee protection violation 1 eee protection violation detected 3 ersvif1 eee error interrupt 1 flag ?he setting of the ersvif1 ?g indicates that the memory controller was unable to change the state of a d-flash eee sector. the ersvif1 ?g is cleared by writing a 1 to ersvif1. writing a 0 to the ersvif1 ?g has no effect on ersvif1. while ersvif1 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector state change error detected 1 eee sector state change error detected 2 ersvif0 eee error interrupt 0 flag ?he setting of the ersvif0 ?g indicates that the memory controller was unable to format a d-flash eee sector for eee use. the ersvif0 ?g is cleared by writing a 1 to ersvif0. writing a 0 to the ersvif0 ?g has no effect on ersvif0. while ersvif0 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector format error detected 1 eee sector format error detected 1 dfdif double bit fault detect interrupt flag ?the setting of the dfdif ?g indicates that a double bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the dfdif ?g is cleared by writing a 1 to dfdif. writing a 0 to dfdif has no effect on dfdif. 0 no double bit fault detected 1 double bit fault detected or an invalid flash array read operation attempted 0 sfdif single bit fault detect interrupt flag ?with the ignsf bit in the fcnfg register clear, the sfdif ?g indicates that a single bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the sfdif ?g is cleared by writing a 1 to sfdif. writing a 0 to sfdif has no effect on sfdif. 0 no single bit fault detected 1 single bit fault detected and corrected or an invalid flash array read operation attempted chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 850 freescale semiconductor the (unreserved) bits of the fprot register are writable with the restriction that the size of the protected region can only be increased (see section 24.3.2.9.1, ?-flash protection restrictions , and table 24-23 ). during the reset sequence, the fprot register is loaded with the contents of the p-flash protection byte in the flash configuration field at global address 0x7f_ff0c located in p-flash memory (see table 24-3 ) as indicated by reset condition ??in figure 24-13 . to change the p-flash protection that will be loaded during the reset sequence, the upper sector of the p-flash memory must be unprotected, then the p-flash protection byte must be reprogrammed. if a double bit fault is detected while reading the p-flash phrase containing the p-flash protection byte during the reset sequence, the fpopen bit will be cleared and remaining bits in the fprot register will be set to leave the p-flash memory fully protected. trying to alter data in any protected area in the p-flash memory will result in a protection violation error and the fpviol bit will be set in the fstat register. the block erase of a p-flash block is not possible if any of the p-flash sectors contained in the same p-flash block are protected. offset module base + 0x0008 76543210 r fpopen rnv6 fphdis fphs[1:0] fpldis fpls[1:0] w reset f f ffffff = unimplemented or reserved figure 24-13. flash protection register (fprot) table 24-19. fprot field descriptions field description 7 fpopen flash protection operation enable ?the fpopen bit determines the protection function for program or erase operations as shown in table 24-20 for the p-flash block. 0 when fpopen is clear, the fphdis and fpldis bits de?e unprotected address ranges as speci?d by the corresponding fphs and fpls bits 1 when fpopen is set, the fphdis and fpldis bits enable protection for the address range speci?d by the corresponding fphs and fpls bits 6 rnv[6] reserved nonvolatile bit ?the rnv bit should remain in the erased state for future enhancements. 5 fphdis flash protection higher address range disable ?the fphdis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory ending with global address 0x7f_ffff. 0 protection/unprotection enabled 1 protection/unprotection disabled 4? fphs[1:0] flash protection higher address size the fphs bits determine the size of the protected/unprotected area in p-flash memory as shown in table 24-21 . the fphs bits can only be written to while the fphdis bit is set. 2 fpldis flash protection lower address range disable ?the fpldis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory beginning with global address 0x7f_8000. 0 protection/unprotection enabled 1 protection/unprotection disabled 1? fpls[1:0] flash protection lower address size the fpls bits determine the size of the protected/unprotected area in p-flash memory as shown in table 24-22 . the fpls bits can only be written to while the fpldis bit is set. chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 851 all possible p-flash protection scenarios are shown in figure 24-14 . although the protection scheme is loaded from the flash memory at global address 0x7f_ff0c during the reset sequence, it can be changed by the user. the p-flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. table 24-20. p-flash protection function fpopen fphdis fpldis function (1) 1. for range sizes, refer to table 24-21 and table 24-22 . 1 1 1 no p-flash protection 1 1 0 protected low range 1 0 1 protected high range 1 0 0 protected high and low ranges 0 1 1 full p-flash memory protected 0 1 0 unprotected low range 0 0 1 unprotected high range 0 0 0 unprotected high and low ranges table 24-21. p-flash protection higher address range fphs[1:0] global address range protected size 00 0x7f_f800?x7f_ffff 2 kbytes 01 0x7f_f000?x7f_ffff 4 kbytes 10 0x7f_e000?x7f_ffff 8 kbytes 11 0x7f_c000?x7f_ffff 16 kbytes table 24-22. p-flash protection lower address range fpls[1:0] global address range protected size 00 0x7f_8000?x7f_83ff 1 kbyte 01 0x7f_8000?x7f_87ff 2 kbytes 10 0x7f_8000?x7f_8fff 4 kbytes 11 0x7f_8000?x7f_9fff 8 kbytes chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 852 freescale semiconductor figure 24-14. p-flash protection scenarios 7 6 5 4 fphs[1:0] fpls[1:0] 3 2 1 0 fphs[1:0] fpls[1:0] fphdis = 1 fpldis = 1 fphdis = 1 fpldis = 0 fphdis = 0 fpldis = 1 fphdis = 0 fpldis = 0 scenario scenario unprotected region protected region with size protected region protected region with size defined by fpls defined by fphs not defined by fpls, fphs 0x7f_8000 0x7f_ffff 0x7f_8000 0x7f_ffff flash start flash start fpopen = 1 fpopen = 0 chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 853 24.3.2.9.1 p-flash protection restrictions the general guideline is that p-flash protection can only be added and not removed. table 24-23 specifies all valid transitions between p-flash protection scenarios. any attempt to write an invalid scenario to the fprot register will be ignored. the contents of the fprot register reflect the active protection scenario. see the fphs and fpls bit descriptions for additional restrictions. 24.3.2.10 eee protection register (eprot) the eprot register de?es which buffer ram eee partition areas are protected against writes. all bits in the eprot register are readable and writable except for rnv[6:4] which are only readable. the epopen and epdis bits can only be written to the protected state. the eps bits can be written anytime until the epdis bit is cleared. if the epopen bit is cleared, the state of the epdis and eps bits is irrelevant. during the reset sequence, the eprot register is loaded from the eee protection byte in the flash configuration field at global address 0x7f_ff0d located in p-flash memory (see table 24-3 ) as indicated by reset condition f in figure 24-15 . to change the eee protection that will be loaded during the reset sequence, the p-flash sector containing the eee protection byte must be unprotected, then the eee protection byte must be programmed. if a double bit fault is detected while reading the p-flash phrase table 24-23. p-flash protection scenario transitions from protection scenario to protection scenario (1) 1. allowed transitions marked with x, see figure 24-14 for a de?ition of the scenarios. 01234567 0 xxxx 1 xx 2 xx 3 x 4 xx 5 xxxx 6 xxxx 7 xxxxxxxx offset module base + 0x0009 76543210 r epopen rnv[6:4] epdis eps[2:0] w reset f f ffffff = unimplemented or reserved figure 24-15. eee protection register (eprot) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 854 freescale semiconductor containing the eee protection byte during the reset sequence, the epopen bit will be cleared and remaining bits in the eprot register will be set to leave the buffer ram eee partition fully protected. trying to write data to any protected area in the buffer ram eee partition will result in a protection violation error and the epviolif ?g will be set in the ferstat register. trying to write data to any protected area in the buffer ram partitioned for user access will not be prevented and the epviolif ?g in the ferstat register will not set. 24.3.2.11 flash common command object register (fccob) the fccob is an array of six words addressed via the ccobix index found in the fccobix register. byte wide reads and writes are allowed to the fccob register. table 24-24. eprot field descriptions field description 7 epopen enables writes to the buffer ram partitioned for eee 0 the entire buffer ram eee partition is protected from writes 1 unprotected buffer ram eee partition areas are enabled for writes 6? rnv[6:4] reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements 3 epdis buffer ram protection address range disable ?the epdis bit determines whether there is a protected area in a speci? region of the buffer ram eee partition. 0 protection enabled 1 protection disabled 2? eps[2:0] buffer ram protection size ?the eps[2:0] bits determine the size of the protected area in the buffer ram eee partition as shown in table 24-21 . the eps bits can only be written to while the epdis bit is set. table 24-25. buffer ram eee partition protection address range eps[2:0] global address range protected size 000 0x13_ffc0 ?0x13_ffff 64 bytes 001 0x13_ff80 ?0x13_ffff 128 bytes 010 0x13_ff40 ?0x13_ffff 192 bytes 011 0x13_ff00 ?0x13_ffff 256 bytes 100 0x13_fec0 ?0x13_ffff 320 bytes 101 0x13_fe80 ?0x13_ffff 384 bytes 110 0x13_fe40 ?0x13_ffff 448 bytes 111 0x13_fe00 ?0x13_ffff 512 bytes chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 855 24.3.2.11.1 fccob - nvm command mode nvm command mode uses the indexed fccob register to provide a command code and its relevant parameters to the memory controller. the user first sets up all required fccob fields and then initiates the command? execution by writing a 1 to the ccif bit in the fstat register (a 1 written by the user clears the ccif command completion flag to 0). when the user clears the ccif bit in the fstat register all fccob parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the memory controller returning ccif to 1). some commands return information to the fccob register array. the generic format for the fccob parameter fields in nvm command mode is shown in table 24-26 . the return values are available for reading after the ccif flag in the fstat register has been returned to 1 by the memory controller. writes to the unimplemented parameter fields (ccobix = 110 and ccobix = 111) are ignored with reads from these fields returning 0x0000. table 24-26 shows the generic flash command format. the high byte of the first word in the ccob array contains the command code, followed by the parameters for this specific flash command. for details on the fccob settings required by each command, see the flash command descriptions in section 24.4.2 . offset module base + 0x000a 76543210 r ccob[15:8] w reset 00000000 figure 24-16. flash common command object high register (fccobhi) offset module base + 0x000b 76543210 r ccob[7:0] w reset 00000000 figure 24-17. flash common command object low register (fccoblo) table 24-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) 000 hi fcmd[7:0] de?ing flash command lo 0, global address [22:16] 001 hi global address [15:8] lo global address [7:0] 010 hi data 0 [15:8] lo data 0 [7:0] chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 856 freescale semiconductor 24.3.2.12 eee tag counter register (etag) the etag register contains the number of outstanding words in the buffer ram eee partition that need to be programmed into the d-flash eee partition. the etag register is decremented prior to the related tagged word being programmed into the d-flash eee partition. all tagged words have been programmed into the d-flash eee partition once all bits in the etag register read 0 and the mgbusy flag in the fstat register reads 0. all etag bits are readable but not writable and are cleared by the memory controller. 24.3.2.13 flash ecc error results register (feccr) the feccr registers contain the result of a detected ecc fault for both single bit and double bit faults. the feccr register provides access to several ecc related fields as defined by the eccrix index bits in the feccrix register (see section 24.3.2.4 ). once ecc fault information has been stored, no other 011 hi data 1 [15:8] lo data 1 [7:0] 100 hi data 2 [15:8] lo data 2 [7:0] 101 hi data 3 [15:8] lo data 3 [7:0] offset module base + 0x000c 76543210 r etag[15:8] w reset 0 0 000000 = unimplemented or reserved figure 24-18. eee tag counter high register (etaghi) offset module base + 0x000d 76543210 r etag[7:0] w reset 00000000 = unimplemented or reserved figure 24-19. eee tag counter low register (etaglo) table 24-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 857 fault information will be recorded until the specific ecc fault flag has been cleared. in the event of simultaneous ecc faults, the priority for fault recording is: 1. double bit fault over single bit fault 2. cpu over xgate all feccr bits are readable but not writable. offset module base + 0x000e 76543210 r eccr[15:8] w reset 00000000 = unimplemented or reserved figure 24-20. flash ecc error results high register (feccrhi) offset module base + 0x000f 76543210 r eccr[7:0] w reset 00000000 = unimplemented or reserved figure 24-21. flash ecc error results low register (feccrlo) table 24-27. feccr index settings eccrix[2:0] feccr register content bits [15:8] bit[7] bits[6:0] 000 parity bits read from flash block cpu or xgate source identity global address [22:16] 001 global address [15:0] 010 data 0 [15:0] 011 data 1 [15:0] (p-flash only) 100 data 2 [15:0] (p-flash only) 101 data 3 [15:0] (p-flash only) 110 not used, returns 0x0000 when read 111 not used, returns 0x0000 when read chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 858 freescale semiconductor the p-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the following four words addressed by eccrix = 010 to 101 contain the 64-bit wide data phrase. the four data words and the parity byte are the uncorrected data read from the p-flash block. the d-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the uncorrected 16-bit data word is addressed by eccrix = 010. 24.3.2.14 flash option register (fopt) the fopt register is the flash option register. all bits in the fopt register are readable but are not writable. during the reset sequence, the fopt register is loaded from the flash nonvolatile byte in the flash configuration field at global address 0x7f_ff0e located in p-flash memory (see table 24-3 ) as indicated by reset condition f in figure 24-22 . if a double bit fault is detected while reading the p-flash phrase containing the flash nonvolatile byte during the reset sequence, all bits in the fopt register will be set. 24.3.2.15 flash reserved0 register (frsv0) this flash register is reserved for factory testing. table 24-28. feccr index=000 bit descriptions field description 15:8 par[7:0] ecc parity bits ?contains the 8 parity bits from the 72 bit wide p-flash data word or the 6 parity bits, allocated to par[5:0], from the 22 bit wide d-flash word with par[7:6]=00. 7 xbus01 bus source identi?r the xbus01 bit determines whether the ecc error was caused by a read access from the cpu or xgate. 0 ecc error happened on the cpu access 1 ecc error happened on the xgate access 6? gaddr[22:16] global address ?the gaddr[22:16] ?ld contains the upper seven bits of the global address having caused the error. offset module base + 0x0010 76543210 r nv[7:0] w reset f f ffffff = unimplemented or reserved figure 24-22. flash option register (fopt) table 24-29. fopt field descriptions field description 7? nv[7:0] nonvolatile bits the nv[7:0] bits are available as nonvolatile bits. refer to the device user guide for proper use of the nv bits. chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 859 all bits in the frsv0 register read 0 and are not writable. 24.3.2.16 flash reserved1 register (frsv1) this flash register is reserved for factory testing. all bits in the frsv1 register read 0 and are not writable. 24.3.2.17 flash reserved2 register (frsv2) this flash register is reserved for factory testing. all bits in the frsv2 register read 0 and are not writable. offset module base + 0x0011 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 24-23. flash reserved0 register (frsv0) offset module base + 0x0012 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 24-24. flash reserved1 register (frsv1) offset module base + 0x0013 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 24-25. flash reserved2 register (frsv2) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 860 freescale semiconductor 24.4 functional description 24.4.1 flash command operations flash command operations are used to modify flash memory contents or con?ure module resources for eee operation. the next sections describe: how to write the fclkdiv register that is used to generate a time base (fclk) derived from oscclk for flash program and erase command operations the command write sequence used to set flash command parameters and launch execution valid flash commands available for execution 24.4.1.1 writing the fclkdiv register prior to issuing any flash program or erase command after a reset, the user is required to write the fclkdiv register to divide oscclk down to a target fclk of 1 mhz. table 24-9 shows recommended values for the fdiv ?ld based on oscclk frequency. note programming or erasing the flash memory cannot be performed if the bus clock runs at less than 1 mhz. setting fdiv too high can destroy the flash memory due to overstress. setting fdiv too low can result in incomplete programming or erasure of the flash memory cells. when the fclkdiv register is written, the fdivld bit is set automatically. if the fdivld bit is 0, the fclkdiv register has not been written since the last reset. if the fclkdiv register has not been written, any flash program or erase command loaded during a command write sequence will not execute and the accerr bit in the fstat register will set. 24.4.1.2 command write sequence the memory controller will launch all valid flash commands entered using a command write sequence. before launching a command, the accerr and fpviol bits in the fstat register must be clear (see section 24.3.2.7 ) and the ccif flag should be tested to determine the status of the current command write sequence. if ccif is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the fccob register are ignored. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 861 24.4.1.2.1 de?e fccob contents the fccob parameter ?lds must be loaded with all required parameters for the flash command being executed. access to the fccob parameter ?lds is controlled via the ccobix bits in the fccobix register (see section 24.3.2.3 ). the contents of the fccob parameter ?lds are transferred to the memory controller when the user clears the ccif command completion ?g in the fstat register (writing 1 clears the ccif to 0). the ccif ?g will remain clear until the flash command has completed. upon completion, the memory controller will return ccif to 1 and the fccob register will be used to communicate any results. the ?w for a generic command write sequence is shown in figure 24-26 . chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 862 freescale semiconductor figure 24-26. generic flash command write sequence flowchart write to fccobix register write: fstat register (to launch command) clear ccif 0x80 clear accerr/fpviol 0x30 write: fstat register yes no access error and protection violation read: fstat register read: fstat register no start yes check ccif set? fccob accerr/ fpviol set? exit write: fclkdiv register read: fclkdiv register yes no clock register written check fdivld set? no bit polling for command completion check yes ccif set? to identify speci? command parameter to load. write to fccob register to load required command parameter. yes no more parameters? availability check results from previous command note: fclkdiv must be set after each reset chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 863 24.4.1.3 valid flash module commands table 24-30. flash commands by mode fcmd command unsecured secured ns (1) 1. unsecured normal single chip mode. nx (2) 2. unsecured normal expanded mode. ss (3) 3. unsecured special single chip mode. st (4) 4. unsecured special mode. ns (5) 5. secured normal single chip mode. nx (6) 6. secured normal expanded mode. ss (7) 7. secured special single chip mode. st (8) 8. secured special mode. 0x01 erase verify all blocks ???????? 0x02 erase verify block ???????? 0x03 erase verify p-flash section ????? 0x04 read once ????? 0x05 reserved ????? 0x06 program p-flash ????? 0x07 program once ????? 0x08 erase all blocks ?? ?? 0x09 erase p-flash block ????? 0x0a erase p-flash sector ????? 0x0b unsecure flash ?? ?? 0x0c verify backdoor access key ?? 0x0d set user margin level ????? 0x0e set field margin level ?? 0x0f full partition d-flash ?? 0x10 erase verify d-flash section ????? 0x11 program d-flash ????? 0x12 erase d-flash sector ????? 0x13 enable eeprom emulation ???????? 0x14 disable eeprom emulation ???????? 0x15 eeprom emulation query ???????? 0x20 partition d-flash ???????? chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 864 freescale semiconductor 24.4.1.4 p-flash commands table 24-31 summarizes the valid p-flash commands along with the effects of the commands on the p- flash block and other resources within the flash module. 24.4.1.5 d-flash and eee commands table 24-32 summarizes the valid d-flash and eee commands along with the effects of the commands on the d-flash block and eee operation. table 24-31. p-flash commands fcmd command function on p-flash memory 0x01 erase verify all blocks verify that all p-flash (and d-flash) blocks are erased. 0x02 erase verify block verify that a p-flash block is erased. 0x03 erase verify p- flash section verify that a given number of words starting at the address provided are erased. 0x04 read once read a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that was previously programmed using the program once command. 0x06 program p-flash program a phrase in a p-flash block. 0x07 program once program a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that is allowed to be programmed only once. 0x08 erase all blocks erase all p-flash (and d-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x09 erase p-flash block erase a single p-flash block. an erase of the full p-flash block is only possible when fpldis, fphdis and fpopen bits in the fprot register are set prior to launching the command. 0x0a erase p-flash sector erase all bytes in a p-flash sector. 0x0b unsecure flash supports a method of releasing mcu security by erasing all p-flash (and d-flash) blocks and verifying that all p-flash (and d-flash) blocks are erased. 0x0c verify backdoor access key supports a method of releasing mcu security by verifying a set of security keys. 0x0d set user margin level speci?s a user margin read level for all p-flash blocks. 0x0e set field margin level speci?s a ?ld margin read level for all p-flash blocks (special modes only). table 24-32. d-flash commands fcmd command function on d-flash memory 0x01 erase verify all blocks verify that all d-flash (and p-flash) blocks are erased. 0x02 erase verify block verify that the d-flash block is erased. 0x08 erase all blocks erase all d-flash (and p-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 865 24.4.2 flash command description this section provides details of all available flash commands launched by a command write sequence. the accerr bit in the fstat register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the memory controller: starting any command write sequence that programs or erases flash memory before initializing the fclkdiv register writing an invalid command as part of the command write sequence for additional possible errors, refer to the error handling table provided for each command if a flash block is read during execution of an algorithm (ccif = 0) on that same block, the read operation will return invalid data. if the sfdif or dfdif flags were not previously set when the invalid read operation occurred, both the sfdif and dfdif flags will be set and the feccr registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. if the accerr or fpviol bits are set in the fstat register, the user must clear these bits before starting any command write sequence (see section 24.3.2.7 ). caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. 0x0b unsecure flash supports a method of releasing mcu security by erasing all d-flash (and p-flash) blocks and verifying that all d-flash (and p-flash) blocks are erased. 0x0d set user margin level speci?s a user margin read level for the d-flash block. 0x0e set field margin level speci?s a ?ld margin read level for the d-flash block (special modes only). 0x0f full partition d- flash erase the d-flash block and partition an area of the d-flash block for user access. 0x10 erase verify d- flash section verify that a given number of words starting at the address provided are erased. 0x11 program d-flash program up to four words in the d-flash block. 0x12 erase d-flash sector erase all bytes in a sector of the d-flash block. 0x13 enable eeprom emulation enable eeprom emulation where writes to the buffer ram eee partition will be copied to the d-flash eee partition. 0x14 disable eeprom emulation suspend all current erase and program activity related to eeprom emulation but leave current eee tags set. 0x15 eeprom emulation query returns eee partition and status variables. 0x20 partition d-flash partition an area of the d-flash block for user access. table 24-32. d-flash commands fcmd command function on d-flash memory chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 866 freescale semiconductor 24.4.2.1 erase verify all blocks command the erase verify all blocks command will verify that all p-flash and d-flash blocks have been erased. upon clearing ccif to launch the erase verify all blocks command, the memory controller will verify that the entire flash memory space is erased. the ccif ?g will set after the erase verify all blocks operation has completed. 24.4.2.2 erase verify block command the erase verify block command allows the user to verify that an entire p-flash or d-flash block has been erased. the fccob upper global address bits determine which block must be veri?d. upon clearing ccif to launch the erase verify block command, the memory controller will verify that the selected p-flash or d-flash block is erased. the ccif ?g will set after the erase verify block operation has completed. table 24-33. erase verify all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x01 not required table 24-34. erase verify all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch fpviol none mgstat1 set if any errors have been encountered during the read (1) 1. as found in the memory map for ftm256k2. mgstat0 set if any non-correctable errors have been encountered during the read 1 ferstat epviolif none table 24-35. erase verify block command fccob requirements ccobix[2:0] fccob parameters 000 0x02 global address [22:16] of the flash block to be veri?d . chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 867 24.4.2.3 erase verify p-flash section command the erase verify p-flash section command will verify that a section of code in the p-flash memory is erased. the erase verify p-flash section command defines the starting point of the code to be verified and the number of phrases.128 upon clearing ccif to launch the erase verify p-flash section command, the memory controller will verify the selected section of flash memory is erased. the ccif ?g will set after the erase verify p-flash section operation has completed. table 24-36. erase verify block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm256k2. fpviol none mgstat1 set if any errors have been encountered during the read (2) 2. as found in the memory map for ftm256k2. mgstat0 set if any non-correctable errors have been encountered during the read 2 ferstat epviolif none table 24-37. erase verify p-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x03 global address [22:16] of a p-flash block 001 global address [15:0] of the ?st phrase to be veri?d 010 number of phrases to be veri?d table 24-38. erase verify p-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:0] is supplied (1) set if a misaligned phrase address is supplied (global address [2:0] != 000) set if the requested section crosses a 128 kbyte boundary fpviol none mgstat1 set if any errors have been encountered during the read (2) mgstat0 set if any non-correctable errors have been encountered during the read 2 ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 868 freescale semiconductor 24.4.2.4 read once command the read once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of p-flash block 0. the read once field is programmed using the program once command described in section 24.4.2.6 . the read once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the read once command, a read once phrase is fetched and stored in the fccob indexed register. the ccif ?g will set after the read once operation has completed. valid phrase index values for the read once command range from 0x0000 to 0x0007. during execution of the read once command, any attempt to read addresses within p-flash block 0 will return invalid data. 128 24.4.2.5 program p-flash command the program p-flash operation will program a previously erased phrase in the p-flash memory using an embedded algorithm. 1. as de?ed by the memory map for ftm256k2. 2. as found in the memory map for ftm256k2. table 24-39. read once command fccob requirements ccobix[2:0] fccob parameters 000 0x04 not required 001 read once phrase index (0x0000 - 0x0007) 010 read once word 0 value 011 read once word 1 value 100 read once word 2 value 101 read once word 3 value table 24-40. read once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid phrase index is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 869 caution a p-flash phrase must be in the erased state before being programmed. cumulative programming of bits within a flash phrase is not allowed. upon clearing ccif to launch the program p-flash command, the memory controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. the ccif ?g will set after the program p-flash operation has completed. 24.4.2.6 program once command the program once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in p-flash block 0. the program once reserved field can be read using the read once command as described in section 24.4.2.4 . the program once command must only be issued once since the nonvolatile information register in p-flash block 0 cannot be erased. the program table 24-41. program p-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x06 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 program value 011 word 1 program value 100 word 2 program value 101 word 3 program value table 24-42. program p-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:0] is supplied (1) 1. as de?ed by the memory map for ftm256k2. set if a misaligned phrase address is supplied (global address [2:0] != 000) fpviol set if the global address [22:0] points to a protected area mgstat1 set if any errors have been encountered during the verify operation (2) 2. as found in the memory map for ftm256k2. mgstat0 set if any non-correctable errors have been encountered during the verify operation 2 ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 870 freescale semiconductor once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the program once command, the memory controller ?st veri?s that the selected phrase is erased. if erased, then the selected phrase will be programmed and then veri?d with read back. the ccif ?g will remain clear, setting only after the program once operation has completed. the reserved nonvolatile information register accessed by the program once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. valid phrase index values for the program once command range from 0x0000 to 0x0007. during execution of the program once command, any attempt to read addresses within p-flash block 0 will return invalid data. 24.4.2.7 erase all blocks command the erase all blocks operation will erase the entire p-flash and d-flash memory space including the eee nonvolatile information register. table 24-43. program once command fccob requirements ccobix[2:0] fccob parameters 000 0x07 not required 001 program once phrase index (0x0000 - 0x0007) 010 program once word 0 value 011 program once word 1 value 100 program once word 2 value 101 program once word 3 value table 24-44. program once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid phrase index is supplied set if the requested phrase has already been programmed (1) 1. if a program once phrase is initially programmed to 0xffff_ffff_ffff_ffff, the program once command will be allowed to execute again on that same phrase. fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 871 upon clearing ccif to launch the erase all blocks command, the memory controller will erase the entire flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g will set after the erase all blocks operation has completed. 24.4.2.8 erase p-flash block command the erase p-flash block operation will erase all addresses in a p-flash block. upon clearing ccif to launch the erase p-flash block command, the memory controller will erase the selected p-flash block and verify that it is erased. the ccif ?g will set after the erase p-flash block operation has completed. table 24-45. erase all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x08 not required table 24-46. erase all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if command not available in current mode (see table 24-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation (1) 1. as found in the memory map for ftm256k2. mgstat0 set if any non-correctable errors have been encountered during the verify operation 1 ferstat epviolif set if any area of the buffer ram eee partition is protected table 24-47. erase p-flash block command fccob requirements ccobix[2:0] fccob parameters 000 0x09 global address [22:16] to identify p-flash block 001 global address [15:0] in p-flash block to be erased chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 872 freescale semiconductor 24.4.2.9 erase p-flash sector command the erase p-flash sector operation will erase all addresses in a p-flash sector. upon clearing ccif to launch the erase p-flash sector command, the memory controller will erase the selected flash sector and then verify that it is erased. the ccif ?g will be set after the erase p-flash sector operation has completed. table 24-48. erase p-flash block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm256k2. fpviol set if an area of the selected p-flash block is protected mgstat1 set if any errors have been encountered during the verify operation (2) 2. as found in the memory map for ftm256k2. mgstat0 set if any non-correctable errors have been encountered during the verify operation 2 ferstat epviolif none table 24-49. erase p-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x0a global address [22:16] to identify p-flash block to be erased 001 global address [15:0] anywhere within the sector to be erased. refer to section 24.1.2.1 for the p-flash sector size. table 24-50. erase p-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm256k2. set if a misaligned phrase address is supplied (global address [2:0] != 000) fpviol set if the selected p-flash sector is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 873 24.4.2.10 unsecure flash command the unsecure flash command will erase the entire p-flash and d-flash memory space and, if the erase is successful, will release security. upon clearing ccif to launch the unsecure flash command, the memory controller will erase the entire p-flash and d-flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. if the erase verify is not successful, the unsecure flash operation sets mgstat1 and terminates without changing the security state. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g is set after the unsecure flash operation has completed. 24.4.2.11 verify backdoor access key command the verify backdoor access key command will only execute if it is enabled by the keyen bits in the fsec register (see table 24-11 ). the verify backdoor access key command releases security if user- supplied keys match those stored in the flash security bytes of the flash configuration field (see table 24- 3 ). the verify backdoor access key command must not be executed from the flash block containing the backdoor comparison key to avoid code runaway. table 24-51. unsecure flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0b not required table 24-52. unsecure flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if command not available in current mode (see table 24-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation (1) 1. as found in the memory map for ftm256k2. mgstat0 set if any non-correctable errors have been encountered during the verify operation 1 ferstat epviolif set if any area of the buffer ram eee partition is protected table 24-53. verify backdoor access key command fccob requirements ccobix[2:0] fccob parameters 000 0x0c not required 001 key 0 010 key 1 chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 874 freescale semiconductor upon clearing ccif to launch the verify backdoor access key command, the memory controller will check the fsec keyen bits to verify that this command is enabled. if not enabled, the memory controller sets the accerr bit in the fstat register and terminates. if the command is enabled, the memory controller compares the key provided in fccob to the backdoor comparison key in the flash con?uration ?ld with key 0 compared to 0x7f_ff00, etc. if the backdoor keys match, security will be released. if the backdoor keys do not match, security is not released and all future attempts to execute the verify backdoor access key command are aborted (set accerr) until a reset occurs. the ccif flag is set after the verify backdoor access key operation has completed. 24.4.2.12 set user margin level command the set user margin level command causes the memory controller to set the margin level for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set user margin level command, the memory controller will set the user margin level for the targeted block and then set the ccif ?g. 011 key 2 100 key 3 table 24-54. verify backdoor access key command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 100 at command launch set if an incorrect backdoor key is supplied set if backdoor key access has not been enabled (keyen[1:0] != 10, see section 24.3.2.2 ) set if the backdoor key has mismatched since the last reset fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 24-55. set user margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0d global address [22:16] to identify the flash block 001 margin level setting table 24-53. verify backdoor access key command fccob requirements ccobix[2:0] fccob parameters chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 875 valid margin level settings for the set user margin level command are de?ed in table 24-56 . note user margin levels can be used to check that flash memory contents have adequate margin for normal level read operations. if unexpected results are encountered when checking flash memory contents at user margin levels, a potential loss of information has been detected. 24.4.2.13 set field margin level command the set field margin level command, valid in special modes only, causes the memory controller to set the margin level specified for future read operations of a specific p-flash or d-flash block. table 24-56. valid set user margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) 1. read margin to the erased state 0x0002 user margin-0 level (2) 2. read margin to the programmed state table 24-57. set user margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm256k2. set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 24-58. set field margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0e global address [22:16] to identify the flash block 001 margin level setting chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 876 freescale semiconductor upon clearing ccif to launch the set field margin level command, the memory controller will set the ?ld margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set field margin level command are de?ed in table 24-59 . caution field margin levels must only be used during verify of the initial factory programming. note field margin levels can be used to check that flash memory contents have adequate margin for data retention at the normal level setting. if unexpected results are encountered when checking flash memory contents at ?ld margin levels, the flash memory contents should be erased and reprogrammed. table 24-59. valid set field margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) 1. read margin to the erased state 0x0002 user margin-0 level (2) 2. read margin to the programmed state 0x0003 field margin-1 level 1 0x0004 field margin-0 level 2 table 24-60. set field margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm256k2. set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 877 24.4.2.14 full partition d-flash command the full partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. upon clearing ccif to launch the full partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 8 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 24-7 ) program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 24-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 24-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 24-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the full partition d-flash operation has completed, the ccif ?g will set. running the full partition d-flash command a second time will result in the previous partition values and the entire d-flash memory being erased. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 24-61. full partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0f not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 878 freescale semiconductor 24.4.2.15 erase verify d-flash section command the erase verify d-flash section command will verify that a section of code in the d-flash user partition is erased. the erase verify d-flash section command defines the starting point of the data to be verified and the number of words. upon clearing ccif to launch the erase verify d-flash section command, the memory controller will verify the selected section of d-flash memory is erased. the ccif ?g will set after the erase verify d- flash section operation has completed. table 24-62. full partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid dfpart or erpart selection is supplied (1) 1. as de?ed by the maximum erpart for ftm256k2. fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 24-63. erase verify d-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x10 global address [22:16] to identify the d-flash block 001 global address [15:0] of the ?st word to be veri?d 010 number of words to be veri?d chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 879 24.4.2.16 program d-flash command the program d-flash operation programs one to four previously erased words in the d-flash user partition. the program d-flash operation will confirm that the targeted location(s) were successfully programmed upon completion. caution a flash word must be in the erased state before being programmed. cumulative programming of bits within a flash word is not allowed. upon clearing ccif to launch the program d-flash command, the user-supplied words will be transferred to the memory controller and be programmed. the ccobix index value at program d-flash command launch determines how many words will be programmed in the d-flash block. no protection checks are made in the program d-flash operation on the d-flash block, only access error checks. the ccif ?g is set when the operation has completed. table 24-64. erase verify d-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area of the d-flash eee partition set if the requested section breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 24-65. program d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x11 global address [22:16] to identify the d-flash block 001 global address [15:0] of word to be programmed 010 word 0 program value 011 word 1 program value, if desired 100 word 2 program value, if desired 101 word 3 program value, if desired chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 880 freescale semiconductor 24.4.2.17 erase d-flash sector command the erase d-flash sector operation will erase all addresses in a sector of the d-flash user partition. upon clearing ccif to launch the erase d-flash sector command, the memory controller will erase the selected flash sector and verify that it is erased. the ccif ?g will set after the erase d-flash sector operation has completed. table 24-66. program d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] < 010 at command launch set if ccobix[2:0] > 101 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area in the d-flash eee partition set if the requested group of words breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 24-67. erase d-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x12 global address [22:16] to identify d-flash block 001 global address [15:0] anywhere within the sector to be erased. see section 24.1.2.2 for d-flash sector size. chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 881 24.4.2.18 enable eeprom emulation command the enable eeprom emulation command causes the memory controller to enable eee activity. eee activity is disabled after any reset. upon clearing ccif to launch the enable eeprom emulation command, the ccif ?g will set after the memory controller enables eee operations using the contents of the eee tag ram and tag counter. the full partition d-flash or the partition d-flash command must be run prior to launching the enable eeprom emulation command. table 24-68. erase d-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if command not available in current mode (see table 24-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 24-69. enable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x13 not required table 24-70. enable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 882 freescale semiconductor 24.4.2.19 disable eeprom emulation command the disable eeprom emulation command causes the memory controller to suspend current eee activity. upon clearing ccif to launch the disable eeprom emulation command, the memory controller will halt eee operations at the next convenient point without clearing the eee tag ram or tag counter before setting the ccif ?g. 24.4.2.20 eeprom emulation query command the eeprom emulation query command returns eee partition and status variables. upon clearing ccif to launch the eeprom emulation query command, the ccif ?g will set after the eee partition and status variables are stored in the fccobix register.if the emulation query command is executed prior to partitioning (partition d-flash command section 24.4.2.14 ), the following reset values are returned: dfpart = 0x_ffff, erpart = 0x_ffff, ecount = 0x_ffff, dead sector count = 0x_00, ready sector count = 0x_00. table 24-71. disable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x14 not required table 24-72. disable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 24-73. eeprom emulation query command fccob requirements ccobix[2:0] fccob parameters 000 0x15 not required 001 return dfpart 010 return erpart 011 return ecount (1) 1. indicates sector erase count 100 return dead sector count return ready sector count chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 883 24.4.2.21 partition d-flash command the partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 32 sectors with 256 bytes per sector. the erase all blocks command must be run prior to launching the partition d-flash command. upon clearing ccif to launch the partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 8 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase verify the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 24-7 ) program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 24-7 ) table 24-74. eeprom emulation query command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if command not available in current mode (see table 24-30 ) fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 24-75. partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x20 not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 884 freescale semiconductor program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 24-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 24-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the partition d-flash operation has completed, the ccif ?g will set. running the partition d-flash command a second time will result in the accerr bit within the fstat register being set. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 24-76. partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if command not available in current mode (see table 24-30 ) set if partitions have already been de?ed set if an invalid dfpart or erpart selection is supplied (1) 1. as de?ed by the maximum erpart for ftm256k2. fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 885 24.4.3 interrupts the flash module can generate an interrupt when a flash command operation has completed or when a flash command operation has detected an eee error or an ecc fault. note vector addresses and their relative interrupt priority are determined at the mcu level. 24.4.3.1 description of flash interrupt operation the flash module uses the ccif ?g in combination with the ccie interrupt enable bit to generate the flash command interrupt request. the flash module uses the erseif, pgmeif, epviolif, ersvif1, ersvif0, dfdif and sfdif ?gs in combination with the erseie, pgmeie, epviolie, ersvie1, ersvie0, dfdie and sfdie interrupt enable bits to generate the flash error interrupt request. for a detailed description of the register bits involved, refer to section 24.3.2.5, ?lash configuration register (fcnfg) ? section 24.3.2.6, ?lash error configuration register (fercnfg) ? section 24.3.2.7, ?lash status register (fstat) ? and section 24.3.2.8, ?lash error status register (ferstat) ? the logic used for generating the flash module interrupts is shown in figure 24-27 . table 24-77. flash interrupt sources interrupt source interrupt flag local enable global (ccr) mask flash command complete ccif (fstat register) ccie (fcnfg register) i bit flash eee erase error erserif (ferstat register) erserie (fercnfg register) i bit flash eee program error pgmerif (ferstat register) pgmerie (fercnfg register) i bit flash eee protection violation epviolif (ferstat register) epviolie (fercnfg register) i bit flash eee error type 1 violation ersvif1 (ferstat register) ersvie1 (fercnfg register) i bit flash eee error type 0 violation ersvif0 (ferstat register) ersvie0 (fercnfg register) i bit ecc double bit fault on flash read dfdif (ferstat register) dfdie (fercnfg register) i bit ecc single bit fault on flash read sfdif (ferstat register) sfdie (fercnfg register) i bit chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 886 freescale semiconductor figure 24-27. flash module interrupts implementation 24.4.4 wait mode the flash module is not affected if the mcu enters wait mode. the flash module can recover the mcu from wait via the ccif interrupt (see section 24.4.3, ?nterrupts ). 24.4.5 stop mode if a flash command is active (ccif = 0) or an ee-emulation operation is pending when the mcu requests stop mode, the current flash operation will be completed before the cpu is allowed to enter stop mode. 24.5 security the flash module provides security information to the mcu. the flash security state is de?ed by the sec bits of the fsec register (see table 24-12 ). during reset, the flash module initializes the fsec register using data read from the security byte of the flash con?uration ?ld at global address 0x7f_ff0f. flash error interrupt request ccif ccie epviolif epviolie ersvif1 ersvie1 ersvif0 ersvie0 pgmerif pgmerie erserif erserie flash command interrupt request dfdif dfdie sfdif sfdie chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 887 the security state out of reset can be permanently changed by programming the security byte of the flash con?uration ?ld. this assumes that you are starting from a mode where the necessary p-flash erase and program commands are available and that the upper region of the p-flash is unprotected. if the flash security byte is successfully programmed, its new value will take affect after the next mcu reset. the following subsections describe these security-related subjects: unsecuring the mcu using backdoor key access unsecuring the mcu in special single chip mode using bdm mode and security effects on flash command availability 24.5.1 unsecuring the mcu using backdoor key access the mcu may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7f_ff00?x7f_ff07). if the keyen[1:0] bits are in the enabled state (see section 24.3.2.2 ), the verify backdoor access key command (see section 24.4.2.11 ) allows the user to present four prospective keys for comparison to the keys stored in the flash memory via the memory controller. if the keys presented in the verify backdoor access key command match the backdoor keys stored in the flash memory, the sec bits in the fsec register (see table 24-12 ) will be changed to unsecure the mcu. key values of 0x0000 and 0xffff are not permitted as backdoor keys. while the verify backdoor access key command is active, p-flash block 0 will not be available for read access and will return invalid data. the user code stored in the p-flash memory must have a method of receiving the backdoor keys from an external stimulus. this external stimulus would typically be through one of the on-chip serial ports. if the keyen[1:0] bits are in the enabled state (see section 24.3.2.2 ), the mcu can be unsecured by the backdoor key access sequence described below: 1. follow the command sequence for the verify backdoor access key command as explained in section 24.4.2.11 2. if the verify backdoor access key command is successful, the mcu is unsecured and the sec[1:0] bits in the fsec register are forced to the unsecure state of 10 the verify backdoor access key command is monitored by the memory controller and an illegal key will prohibit future use of the verify backdoor access key command. a reset of the mcu is the only method to re-enable the verify backdoor access key command. after the backdoor keys have been correctly matched, the mcu will be unsecured. after the mcu is unsecured, the sector containing the flash security byte can be erased and the flash security byte can be reprogrammed to the unsecure state, if desired. in the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7f_ff00?x7f_ff07 in the flash con?uration ?ld. the security as de?ed in the flash security byte (0x7f_ff0f) is not changed by using the verify backdoor access key command sequence. the backdoor keys stored in addresses 0x7f_ff00?x7f_ff07 are unaffected by the verify backdoor access key command sequence. after the next reset of the mcu, the security state of the flash module is determined by the flash security byte chapter 24 128 kbyte flash module (s12xftm128k2v1) mc9s12xe-family reference manual , rev. 1.21 888 freescale semiconductor (0x7f_ff0f). the verify backdoor access key command sequence has no effect on the program and erase protections de?ed in the flash protection register, fprot. 24.5.2 unsecuring the mcu in special single chip mode using bdm the mcu can be unsecured in special single chip mode by erasing the p-flash and d-flash memory by one of the following methods: reset the mcu into special single chip mode, delay while the erase test is performed by the bdm, send bdm commands to disable protection in the p-flash and d-flash memory, and execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. reset the mcu into special expanded wide mode, disable protection in the p-flash and d-flash memory and run code from external memory to execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. after the ccif ?g sets to indicate that the erase all blocks operation has completed, reset the mcu into special single chip mode. the bdm will execute the erase verify all blocks command write sequence to verify that the p-flash and d-flash memory is erased. if the p-flash and d-flash memory are verified as erased the mcu will be unsecured. all bdm commands will be enabled and the flash security byte may be programmed to the unsecure state by the following method: send bdm commands to execute a ?rogram p-flash?command sequence to program the flash security byte to the unsecured state and reset the mcu. 24.5.3 mode and security effects on flash command availability the availability of flash module commands depends on the mcu operating mode and security state as shown in table 24-30 . 24.6 initialization on each system reset the flash module executes a reset sequence which establishes initial values for the flash block configuration parameters, the fprot and dfprot protection registers, and the fopt and fsec registers. the flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. if a double bit fault is detected during the reset sequence, both mgstat bits in the fstat register will be set. the accerr bit in the fstat register is set if errors are encountered while initializing the eee buffer ram during the reset sequence. ccif remains clear throughout the reset sequence. the flash module holds off all cpu access for the initial portion of the reset sequence. while flash reads are possible when the hold is removed, writes to the fccobix, fccobhi, and fccoblo registers are ignored to prevent command activity while the memory controller remains busy. completion of the reset sequence is marked by setting ccif high which enables writes to the fccobix, fccobhi, and fccoblo registers to launch any available flash command. if a reset occurs while any flash command is in progress, that command will be immediately aborted. the state of the word being programmed or the sector/block being erased is not guaranteed. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 889 chapter 25 256 kbyte flash module (s12xftm256k2v1) 25.1 introduction the ftm256k2 module implements the following: 256 kbytes of p-flash (program flash) memory, consisting of 2 physical flash blocks, intended primarily for nonvolatile code storage table 25-1. revision history revision number revision date sections affected description of changes v01.08 14 nov 2007 25.5.2/25-949 25.4.2/25-925 25.4.2.8/25-931 - changed terminology from ?ord program to ?rogram p-flash in the bdm unsecuring description, section 25.5.2 - added requirement that user not write any flash module register during execution of commands ?rase all blocks? section 25.4.2.8 , and ?nsecure flash? section 25.4.2.11 - added statement that security is released upon successful completion of command ?rase all blocks? section 25.4.2.8 v01.09 19 dec 2007 25.4.2.5/25-928 25.4.2/25-925 25.3.1/25-894 - corrected error handling table for load data field command - corrected error handling table for full partition d-flash, partition d-flash, and eeprom emulation query commands - corrected p-flash ifr accessibility table v01.10 25 sep 2009 25.1/25-889 25.3.2.1/25-901 25.4.2.4/25-928 25.4.2.7/25-930 25.4.2.12/25- 934 25.4.2.12/25- 934 25.4.2.12/25- 934 25.4.2.20/25- 943 25.3.2/25-899 25.3.2.1/25-901 25.4.1.2/25-920 25.6/25-949 - clarify single bit fault correction for p-flash phrase - expand fdiv vs oscclk frequency table - add statement concerning code runaway when executing read once command from flash block containing associated ?lds - add statement concerning code runaway when executing program once command from flash block containing associated ?lds - add statement concerning code runaway when executing verify backdoor access key command from flash block containing associated ?lds - relate key 0 to associated backdoor comparison key address - change ?ower down reset?to ?eset - add accerr condition for disable eeprom emulation command the following changes were made to clarify module behavior related to flash register access during reset sequence and while flash commands are active: - add caution concerning register writes while command is active - writes to fclkdiv are allowed during reset sequence while ccif is clear - add caution concerning register writes while command is active - writes to fccobix, fccobhi, fccoblo registers are ignored during reset sequence mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 890 32 kbytes of d-flash (data flash) memory, consisting of 1 physical flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated eeprom, as basic flash memory primarily intended for nonvolatile data storage, or as a combination of both 4 kbytes of buffer ram, consisting of 1 physical ram block, that can be used as emulated eeprom using a built-in hardware scheme, as basic ram, or as a combination of both the flash memory is ideal for single-supply applications allowing for ?ld reprogramming without requiring external high voltage sources for program or erase operations. the flash module includes a memory controller that executes commands to modify flash memory contents or con?ure module resources for emulated eeprom operation. the user interface to the memory controller consists of the indexed flash common command object (fccob) register which is written to with the command, global address, data, and any required command parameters. the memory controller must complete the execution of a command before the fccob register can be written to with a new command. caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. the ram and flash memory may be read as bytes, aligned words, or misaligned words. read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. for flash memory, an erased bit reads 1 and a programmed bit reads 0. it is not possible to read from a flash block while any command is executing on that speci? flash block. it is possible to read from a flash block while a command is executing on a different flash block. both p-flash and d-flash memories are implemented with error correction codes (ecc) that can resolve single bit faults and detect double bit faults. for p-flash memory, the ecc implementation requires that programming be done on an aligned 8 byte basis (a flash phrase). since p-flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 25.1.1 glossary buffer ram the buffer ram constitutes the volatile memory store required for eee. memory space in the buffer ram not required for eee can be partitioned to provide volatile memory space for applications. command write sequence ?an mcu instruction sequence to execute built-in algorithms (including program and erase) on the flash memory. d-flash memory ?the d-flash memory constitutes the nonvolatile memory store required for eee. memory space in the d-flash memory not required for eee can be partitioned to provide nonvolatile memory space for applications. chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 891 d-flash sector the d-flash sector is the smallest portion of the d-flash memory that can be erased. the d-flash sector consists of four 64 byte rows for a total of 256 bytes. eee (emulated eeprom) ?a method to emulate the small sector size features and endurance characteristics associated with an eeprom. eee ifr nonvolatile information register located in the d-flash block that contains data required to partition the d-flash memory and buffer ram for eee. the eee ifr is visible in the global memory map by setting the eeeifron bit in the mmcctl1 register. nvm command mode an nvm mode using the cpu to setup the fccob register to pass parameters required for flash command execution. phrase an aligned group of four 16-bit words within the p-flash memory. each phrase includes eight ecc bits for single bit fault correction and double bit fault detection within the phrase. p-flash memory the p-flash memory constitutes the main nonvolatile memory store for applications. p-flash sector ?the p-flash sector is the smallest portion of the p-flash memory that can be erased. each p-flash sector contains 1024 bytes. program ifr ?nonvolatile information register located in the p-flash block that contains the device id, version id, and the program once ?ld. the program ifr is visible in the global memory map by setting the pgmifron bit in the mmcctl1 register. 25.1.2 features 25.1.2.1 p-flash features 256 kbytes of p-flash memory composed of two 128 kbyte flash blocks. the 128 kbyte flash blocks are each divided into 128 sectors of 1024 bytes. single bit fault correction and double bit fault detection within a 64-bit phrase during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and phrase program operation ability to program up to one phrase in each p-flash block simultaneously flexible protection scheme to prevent accidental program or erase of p-flash memory 25.1.2.2 d-flash features up to 32 kbytes of d-flash memory with 256 byte sectors for user access dedicated commands to control access to the d-flash memory over eee operation single bit fault correction and double bit fault detection within a word during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and word program operation ability to program up to four words in a burst sequence chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 892 freescale semiconductor 25.1.2.3 emulated eeprom features up to 4 kbytes of emulated eeprom (eee) accessible as 4 kbytes of ram flexible protection scheme to prevent accidental program or erase of data automatic eee ?e handling using an internal memory controller automatic transfer of valid eee data from d-flash memory to buffer ram on reset ability to monitor the number of outstanding eee related buffer ram words left to be programmed into d-flash memory ability to disable eee operation and allow priority access to the d-flash memory ability to cancel all pending eee operations and allow priority access to the d-flash memory 25.1.2.4 user buffer ram features up to 4 kbytes of ram for user access 25.1.2.5 other flash module features no external high-voltage power supply required for flash memory program and erase operations interrupt generation on flash command completion and flash error detection security mechanism to prevent unauthorized access to the flash memory 25.1.3 block diagram the block diagram of the flash module is shown in figure 25-1 . chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 893 figure 25-1. ftm256k2 block diagram 25.2 external signal description the flash module contains no signals that connect off-chip. oscillator clock divider clock (xtal) command interrupt request fclk protection security registers flash interface p-flash sector 0 sector 1 sector 127 16kx72 16bit internal bus block 1 xgate p-flash sector 0 sector 1 sector 127 16kx72 block 0 error interrupt request memory cpu controller d-flash 16kx22 buffer ram tag ram 128x16 2kx16 sector 0 sector 1 sector 127 scratch ram 512x16 chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 894 freescale semiconductor 25.3 memory map and registers this section describes the memory map and registers for the flash module. read data from unimplemented memory space in the flash module is unde?ed. write access to unimplemented or reserved memory space in the flash module will be ignored by the flash module. 25.3.1 module memory map the s12x architecture places the p-flash memory between global addresses 0x78_0000 and 0x7f_ffff as shown in table 25-2 . the p-flash memory map is shown in figure 25-2 . the fprot register, described in section 25.3.2.9 , can be set to protect regions in the flash memory from accidental program or erase. three separate memory regions, one growing upward from global address 0x7f_8000 in the flash memory (called the lower region), one growing downward from global address 0x7f_ffff in the flash memory (called the higher region), and the remaining addresses in the flash memory, can be activated for protection. the flash memory addresses covered by these protectable regions are shown in the p-flash memory map. the higher address region is mainly targeted to hold the boot loader code since it covers the vector space. default protection settings as well as security information that allows the mcu to restrict access to the flash module are stored in the flash con?uration ?ld as described in table 25-3 . table 25-2. p-flash memory addressing global address size (bytes) description 0x7e_0000 ?0x7f_ffff 128 k p-flash block 0 contains flash con?uration field (see table 25-3 ) 0x7a_0000 ?0x7d_ffff 256 k no p-flash memory 0x78_0000 ?0x79_ffff 128 k p-flash block 1 table 25-3. flash con?uration field (1) global address size (bytes) description 0x7f_ff00 ?0x7f_ff07 8 backdoor comparison key refer to section 25.4.2.12, ?erify backdoor access key command , and section 25.5.1, ?nsecuring the mcu using backdoor key access 0x7f_ff08 0x7f_ff0b (2) 4 reserved 0x7f_ff0c 2 1 p-flash protection byte . refer to section 25.3.2.9, ?-flash protection register (fprot) 0x7f_ff0d 2 1 eee protection byte refer to section 25.3.2.10, ?ee protection register (eprot) 0x7f_ff0e 2 1 flash nonvolatile byte refer to section 25.3.2.14, ?lash option register (fopt) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 895 0x7f_ff0f 2 1 flash security byte refer to section 25.3.2.2, ?lash security register (fsec) 1. older versions may have swapped protection byte addresses 2. 0x7ff08 - 0x7f_ff0f form a flash phrase and must be programmed in a single command write sequence. each byte in the 0x7f_ff08 - 0x7f_ff0b reserved ?ld should be programmed to 0xff. table 25-3. flash con?uration field (1) global address size (bytes) description chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 896 freescale semiconductor figure 25-2. p-flash memory map flash con?uration field 0x7f_c000 flash protected/unprotected lower region 1, 2, 4, 8 kbytes 0x7f_8000 0x7f_9000 0x7f_8400 0x7f_8800 0x7f_a000 p-flash end = 0x7f_ffff 0x7f_f800 0x7f_f000 0x7f_e000 flash protected/unprotected higher region 2, 4, 8, 16 kbytes flash protected/unprotected region 8 kbytes (up to 29 kbytes) 16 bytes (0x7f_ff00 - 0x7f_ff0f) flash protected/unprotected region 224 kbytes p-flash start = 0x78_0000 0x79_ffff 0x7e_0000 chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 897 table 25-4. program ifr fields global address (pgmifron) size (bytes) field description 0x40_0000 ?0x40_0007 8 device id 0x40_0008 ?0x40_00e7 224 reserved 0x40_00e8 ?0x40_00e9 2 version id 0x40_00ea ?0x40_00ff 22 reserved 0x40_0100 ?0x40_013f 64 program once field refer to section 25.4.2.7, ?rogram once command 0x40_0140 ?0x40_01ff 192 reserved table 25-5. p-flash ifr accessibility global address (pgmifron) size (bytes) accessed from 0x40_0000 ?0x40_01ff 512 xbus0 (pblk0) (1) 1. refer to table 25-4 for more details. 0x40_0200 ?0x40_03ff 512 unimplemented 0x40_0400 ?0x40_05ff 512 unimplemented 0x40_0600 ?0x40_07ff 512 xbus1 (pblk1) table 25-6. eee resource fields global address size (bytes) description 0x10_0000 ?0x10_7fff 32,768 d-flash memory (user and eee) 0x10_8000 ?0x11_ffff 98,304 reserved 0x12_0000 ?0x12_007f 128 eee nonvolatile information register (eeeifron (1) = 1) 1. mmcctl1 register bit 0x12_0080 ?0x12_0fff 3,968 reserved 0x12_1000 ?0x12_1eff 3,840 reserved 0x12_1f00 ?0x12_1fff 256 eee tag ram (tmgramon 1 = 1) 0x12_2000 ?0x12_3bff 7,168 reserved 0x12_3c00 ?0x12_3fff 1,024 memory controller scratch ram (tmgramon 1 = 1) 0x12_4000 ?0x12_dfff 40,960 reserved 0x12_e000 ?0x12_ffff 8,192 reserved 0x13_0000 ?0x13_efff 61,440 reserved 0x13_f000 ?0x13_ffff 4,096 buffer ram (user and eee) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 898 freescale semiconductor figure 25-3. eee resource memory map the full partition d-flash command (see section 25.4.2.15 ) is used to program the eee nonvolatile information register ?lds where address 0x12_0000 de?es the d-flash partition for user access and address 0x12_0004 de?es the buffer ram partition for eee operations. buffer ram start = 0x13_f000 buffer ram end = 0x13_ffff 0x13_ffc0 0x13_ff80 protectable region (eee only) 64, 128, 192, 256, 320, 384, 448, 512 bytes buffer ram 4 kbytes 0x13_ff40 0x13_ff00 0x13_fec0 0x13_fe80 0x13_fe40 0x13_fe00 0x12_ffff 0x12_4000 0x12_1000 memory controller scratch ram (tmgramon) 1024 bytes eee tag ram (tmgramon) 256 bytes eee nonvolatile information register (eeeifron) 128 bytes d-flash memory 32 kbytes d-flash start = 0x10_0000 d-flash user partition d-flash eee partition 0x12_0000 0x12_2000 0x12_e000 d-flash end = 0x10_7fff buffer ram user partition buffer ram eee partition chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 899 25.3.2 register descriptions the flash module contains a set of 20 control and status registers located between flash module base + 0x0000 and 0x0013. a summary of the flash module registers is given in figure 25-4 with detailed descriptions in the following subsections. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. table 25-7. eee nonvolatile information register fields global address (eeeifron) size (bytes) description 0x12_0000 ?0x12_0001 2 d-flash user partition (dfpart) refer to section 25.4.2.15, ?ull partition d-flash command 0x12_0002 ?0x12_0003 2 d-flash user partition (duplicate (1) ) 1. duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 ?0x12_0005 2 buffer ram eee partition (erpart) refer to section 25.4.2.15, ?ull partition d-flash command 0x12_0006 ?0x12_0007 2 buffer ram eee partition (duplicate 1 ) 0x12_0008 ?0x12_007f 120 reserved address & name 76543210 0x0000 fclkdiv r fdivld fdiv6 fdiv5 fdiv4 fdiv3 fdiv2 fdiv1 fdiv0 w 0x0001 fsec r keyen1 keyen0 rnv5 rnv4 rnv3 rnv2 sec1 sec0 w 0x0002 fccobix r0 0 0 0 0 ccobix2 ccobix1 ccobix0 w 0x0003 feccrix r0 0 0 0 0 eccrix2 eccrix1 eccrix0 w 0x0004 fcnfg r ccie 00 ignsf 00 fdfd fsfd w 0x0005 fercnfg r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w figure 25-4. ftm256k2 register summary chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 900 freescale semiconductor 0x0006 fstat r ccif 0 accerr fpviol mgbusy rsvd mgstat1 mgstat0 w 0x0007 ferstat r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w 0x0008 fprot r fpopen rnv6 fphdis fphs1 fphs0 fpldis fpls1 fpls0 w 0x0009 eprot r epopen rnv6 rnv5 rnv4 epdis eps2 eps1 eps0 w 0x000a fccobhi r ccob15 ccob14 ccob13 ccob12 ccob11 ccob10 ccob9 ccob8 w 0x000b fccoblo r ccob7 ccob6 ccob5 ccob4 ccob3 ccob2 ccob1 ccob0 w 0x000c etaghi r etag15 etag14 etag13 etag12 etag11 etag10 etag9 etag8 w 0x000d etaglo r etag7 etag6 etag5 etag4 etag3 etag2 etag1 etag0 w 0x000e feccrhi r eccr15 eccr14 eccr13 eccr12 eccr11 eccr10 eccr9 eccr8 w 0x000f feccrlo r eccr7 eccr6 eccr5 eccr4 eccr3 eccr2 eccr1 eccr0 w 0x0010 fopt r nv7 nv6 nv5 nv4 nv3 nv2 nv1 nv0 w 0x0011 frsv0 r00000000 w 0x0012 frsv1 r00000000 w 0x0013 frsv2 r00000000 w address & name 76543210 figure 25-4. ftm256k2 register summary (continued) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 901 25.3.2.1 flash clock divider register (fclkdiv) the fclkdiv register is used to control timed events in program and erase algorithms. all bits in the fclkdiv register are readable, bits 6? are write once and bit 7 is not writable. caution the fclkdiv register should never be written while a flash command is executing (ccif=0). the fclkdiv register is writable during the flash reset sequence even though ccif is clear. = unimplemented or reserved offset module base + 0x0000 76543210 r fdivld fdiv[6:0] w reset 00000000 = unimplemented or reserved figure 25-5. flash clock divider register (fclkdiv) table 25-8. fclkdiv field descriptions field description 7 fdivld clock divider loaded 0 fclkdiv register has not been written 1 fclkdiv register has been written since the last reset 6? fdiv[6:0] clock divider bits ?fdiv[6:0] must be set to effectively divide oscclk down to generate an internal flash clock, fclk, with a target frequency of 1 mhz for use by the flash module to control timed events during program and erase algorithms. table 25-9 shows recommended values for fdiv[6:0] based on oscclk frequency. please refer to section 25.4.1, ?lash command operations , for more information. address & name 76543210 figure 25-4. ftm256k2 register summary (continued) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 902 freescale semiconductor table 25-9. fdiv vs oscclk frequency oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] min (1) 1. fdiv shown generates an fclk frequency of >0.8 mhz max (2) min 1 max 2 min 1 max 2 33.60 34.65 0x20 67.20 68.25 0x40 1.60 2.10 0x01 34.65 35.70 0x21 68.25 69.30 0x41 2.40 3.15 0x02 35.70 36.75 0x22 69.30 70.35 0x42 3.20 4.20 0x03 36.75 37.80 0x23 70.35 71.40 0x43 4.20 5.25 0x04 37.80 38.85 0x24 71.40 72.45 0x44 5.25 6.30 0x05 38.85 39.90 0x25 72.45 73.50 0x45 6.30 7.35 0x06 39.90 40.95 0x26 73.50 74.55 0x46 7.35 8.40 0x07 40.95 42.00 0x27 74.55 75.60 0x47 8.40 9.45 0x08 42.00 43.05 0x28 75.60 76.65 0x48 9.45 10.50 0x09 43.05 44.10 0x29 76.65 77.70 0x49 10.50 11.55 0x0a 44.10 45.15 0x2a 77.70 78.75 0x4a 11.55 12.60 0x0b 45.15 46.20 0x2b 78.75 79.80 0x4b 12.60 13.65 0x0c 46.20 47.25 0x2c 79.80 80.85 0x4c 13.65 14.70 0x0d 47.25 48.30 0x2d 80.85 81.90 0x4d 14.70 15.75 0x0e 48.30 49.35 0x2e 81.90 82.95 0x4e 15.75 16.80 0x0f 49.35 50.40 0x2f 82.95 84.00 0x4f 16.80 17.85 0x10 50.40 51.45 0x30 84.00 85.05 0x50 17.85 18.90 0x11 51.45 52.50 0x31 85.05 86.10 0x51 18.90 19.95 0x12 52.50 53.55 0x32 86.10 87.15 0x52 19.95 21.00 0x13 53.55 54.60 0x33 87.15 88.20 0x53 21.00 22.05 0x14 54.60 55.65 0x34 88.20 89.25 0x54 22.05 23.10 0x15 55.65 56.70 0x35 89.25 90.30 0x55 23.10 24.15 0x16 56.70 57.75 0x36 90.30 91.35 0x56 24.15 25.20 0x17 57.75 58.80 0x37 91.35 92.40 0x57 25.20 26.25 0x18 58.80 59.85 0x38 92.40 93.45 0x58 26.25 27.30 0x19 59.85 60.90 0x39 93.45 94.50 0x59 27.30 28.35 0x1a 60.90 61.95 0x3a 94.50 95.55 0x5a 28.35 29.40 0x1b 61.95 63.00 0x3b 95.55 96.60 0x5b 29.40 30.45 0x1c 63.00 64.05 0x3c 96.60 97.65 0x5c 30.45 31.50 0x1d 64.05 65.10 0x3d 97.65 98.70 0x5d 31.50 32.55 0x1e 65.10 66.15 0x3e 98.70 99.75 0x5e 32.55 33.60 0x1f 66.15 67.20 0x3f 99.75 100.80 0x5f chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 903 25.3.2.2 flash security register (fsec) the fsec register holds all bits associated with the security of the mcu and flash module. all bits in the fsec register are readable but not writable. during the reset sequence, the fsec register is loaded with the contents of the flash security byte in the flash configuration field at global address 0x7f_ff0f located in p-flash memory (see table 25-3 ) as indicated by reset condition f in figure 25-6 . if a double bit fault is detected while reading the p-flash phrase containing the flash security byte during the reset sequence, all bits in the fsec register will be set to leave the flash module in a secured state with backdoor key access disabled. 2. fdiv shown generates an fclk frequency of 1.05 mhz offset module base + 0x0001 76543210 r keyen[1:0] rnv[5:2] sec[1:0] w reset f f ffffff = unimplemented or reserved figure 25-6. flash security register (fsec) table 25-10. fsec field descriptions field description 7? keyen[1:0] backdoor key security enable bits the keyen[1:0] bits de?e the enabling of backdoor key access to the flash module as shown in table 25-11 . 5? rnv[5:2} reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements. 1? sec[1:0] flash security bits ?the sec[1:0] bits de?e the security state of the mcu as shown in table 25-12 . if the flash module is unsecured using backdoor key access, the sec bits are forced to 10. table 25-11. flash keyen states keyen[1:0] status of backdoor key access 00 disabled 01 disabled (1) 1. preferred keyen state to disable backdoor key access. 10 enabled 11 disabled chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 904 freescale semiconductor the security function in the flash module is described in section 25.5 . 25.3.2.3 flash ccob index register (fccobix) the fccobix register is used to index the fccob register for flash memory operations. ccobix bits are readable and writable while remaining bits read 0 and are not writable. 25.3.2.4 flash eccr index register (feccrix) the feccrix register is used to index the feccr register for ecc fault reporting. eccrix bits are readable and writable while remaining bits read 0 and are not writable. table 25-12. flash security states sec[1:0] status of security 00 secured 01 secured (1) 1. preferred sec state to set mcu to secured state. 10 unsecured 11 secured offset module base + 0x0002 76543210 r00000 ccobix[2:0] w reset 00000000 = unimplemented or reserved figure 25-7. fccob index register (fccobix) table 25-13. fccobix field descriptions field description 2? ccobix[1:0] common command register index the ccobix bits are used to select which word of the fccob register array is being read or written to. see section 25.3.2.11, ?lash common command object register (fccob) , for more details. offset module base + 0x0003 76543210 r00000 eccrix[2:0] w reset 00000000 = unimplemented or reserved figure 25-8. feccr index register (feccrix) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 905 25.3.2.5 flash con?uration register (fcnfg) the fcnfg register enables the flash command complete interrupt and forces ecc faults on flash array read access from the cpu or xgate. ccie, ignsf, fdfd, and fsfd bits are readable and writable while remaining bits read 0 and are not writable. table 25-14. feccrix field descriptions field description 2-0 eccrix[2:0] ecc error register index ?the eccrix bits are used to select which word of the feccr register array is being read. see section 25.3.2.13, ?lash ecc error results register (feccr) , for more details. offset module base + 0x0004 76543210 r ccie 00 ignsf 00 fdfd fsfd w reset 00000000 = unimplemented or reserved figure 25-9. flash con?uration register (fcnfg) table 25-15. fcnfg field descriptions field description 7 ccie command complete interrupt enable ?the ccie bit controls interrupt generation when a flash command has completed. 0 command complete interrupt disabled 1 an interrupt will be requested whenever the ccif ?g in the fstat register is set (see section 25.3.2.7 ) 4 ignsf ignore single bit fault ?the ignsf controls single bit fault reporting in the ferstat register (see section 25.3.2.8 ). 0 all single bit faults detected during array reads are reported 1 single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 906 freescale semiconductor 25.3.2.6 flash error con?uration register (fercnfg) the fercnfg register enables the flash error interrupts for the ferstat flags. all assigned bits in the fercnfg register are readable and writable. 1 fdfd force double bit fault detect the fdfd bit allows the user to simulate a double bit fault during flash array read operations and check the associated interrupt routine. the fdfd bit is cleared by writing a 0 to fdfd. the feccr registers will not be updated during the flash array read operation with fdfd set unless an actual double bit fault is detected. 0 flash array read operations will set the dfdif ?g in the ferstat register only if a double bit fault is detected 1 any flash array read operation will force the dfdif ?g in the ferstat register to be set (see section 25.3.2.7 ) and an interrupt will be generated as long as the dfdie interrupt enable in the fercnfg register is set (see section 25.3.2.6 ) 0 fsfd force single bit fault detect the fsfd bit allows the user to simulate a single bit fault during flash array read operations and check the associated interrupt routine. the fsfd bit is cleared by writing a 0 to fsfd. the feccr registers will not be updated during the flash array read operation with fsfd set unless an actual single bit fault is detected. 0 flash array read operations will set the sfdif ?g in the ferstat register only if a single bit fault is detected 1 flash array read operation will force the sfdif ?g in the ferstat register to be set (see section 25.3.2.7 ) and an interrupt will be generated as long as the sfdie interrupt enable in the fercnfg register is set (see section 25.3.2.6 ) offset module base + 0x0005 76543210 r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w reset 00000000 = unimplemented or reserved figure 25-10. flash error con?uration register (fercnfg) table 25-16. fercnfg field descriptions field description 7 erserie eee erase error interrupt enable the erserie bit controls interrupt generation when a failure is detected during an eee erase operation. 0 erserif interrupt disabled 1 an interrupt will be requested whenever the erserif ?g is set (see section 25.3.2.8 ) 6 pgmerie eee program error interrupt enable ?the pgmerie bit controls interrupt generation when a failure is detected during an eee program operation. 0 pgmerif interrupt disabled 1 an interrupt will be requested whenever the pgmerif ?g is set (see section 25.3.2.8 ) 4 epviolie eee protection violation interrupt enable ?the epviolie bit controls interrupt generation when a protection violation is detected during a write to the buffer ram eee partition. 0 epviolif interrupt disabled 1 an interrupt will be requested whenever the epviolif ?g is set (see section 25.3.2.8 ) table 25-15. fcnfg field descriptions (continued) field description chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 907 25.3.2.7 flash status register (fstat) the fstat register reports the operational status of the flash module. ccif, accerr, and fpviol bits are readable and writable, mgbusy and mgstat bits are readable but not writable, while remaining bits read 0 and are not writable. 3 ersvie1 eee error type 1 interrupt enable the ersvie1 bit controls interrupt generation when a change state error is detected during an eee operation. 0 ersvif1 interrupt disabled 1 an interrupt will be requested whenever the ersvif1 ?g is set (see section 25.3.2.8 ) 2 ersvie0 eee error type 0 interrupt enable the ersvie0 bit controls interrupt generation when a sector format error is detected during an eee operation. 0 ersvif0 interrupt disabled 1 an interrupt will be requested whenever the ersvif0 ?g is set (see section 25.3.2.8 ) 1 dfdie double bit fault detect interrupt enable the dfdie bit controls interrupt generation when a double bit fault is detected during a flash block read operation. 0 dfdif interrupt disabled 1 an interrupt will be requested whenever the dfdif ?g is set (see section 25.3.2.8 ) 0 sfdie single bit fault detect interrupt enable the sfdie bit controls interrupt generation when a single bit fault is detected during a flash block read operation. 0 sfdif interrupt disabled whenever the sfdif ?g is set (see section 25.3.2.8 ) 1 an interrupt will be requested whenever the sfdif ?g is set (see section 25.3.2.8 ) offset module base + 0x0006 76543210 r ccif 0 accerr fpviol mgbusy rsvd mgstat[1:0] w reset 1000000 (1) 1. reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see section 25.6 ). 0 1 = unimplemented or reserved figure 25-11. flash status register (fstat) table 25-16. fercnfg field descriptions (continued) field description chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 908 freescale semiconductor 25.3.2.8 flash error status register (ferstat) the ferstat register re?cts the error status of internal flash operations. all ?gs in the ferstat register are readable and only writable to clear the ?g. table 25-17. fstat field descriptions field description 7 ccif command complete interrupt flag ?the ccif ?g indicates that a flash command has completed. the ccif ?g is cleared by writing a 1 to ccif to launch a command and ccif will stay low until command completion or command violation. 0 flash command in progress 1 flash command has completed 5 accerr flash access error flag ?the accerr bit indicates an illegal access has occurred to the flash memory caused by either a violation of the command write sequence (see section 25.4.1.2 ) or issuing an illegal flash command or when errors are encountered while initializing the eee buffer ram during the reset sequence. while accerr is set, the ccif ?g cannot be cleared to launch a command. the accerr bit is cleared by writing a 1 to accerr. writing a 0 to the accerr bit has no effect on accerr. 0 no access error detected 1 access error detected 4 fpviol flash protection violation flag ?he fpviol bit indicates an attempt was made to program or erase an address in a protected area of p-flash memory during a command write sequence. the fpviol bit is cleared by writing a 1 to fpviol. writing a 0 to the fpviol bit has no effect on fpviol. while fpviol is set, it is not possible to launch a command or start a command write sequence. 0 no protection violation detected 1 protection violation detected 3 mgbusy memory controller busy flag ?the mgbusy ?g re?cts the active state of the memory controller . 0 memory controller is idle 1 memory controller is busy executing a flash command (ccif = 0) or is handling internal eee operations 2 rsvd reserved bit ?this bit is reserved and always reads 0 . 1? mgstat[1:0] memory controller command completion status flag one or more mgstat ?g bits are set if an error is detected during execution of a flash command or during the flash reset sequence. see section 25.4.2, ?lash command description , and section 25.6, ?nitialization ?for details. offset module base + 0x0007 76543210 r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w reset 00000000 = unimplemented or reserved figure 25-12. flash error status register (ferstat) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 909 25.3.2.9 p-flash protection register (fprot) the fprot register defines which p-flash sectors are protected against program and erase operations. table 25-18. ferstat field descriptions field description 7 erserif eee erase error interrupt flag ?the setting of the erserif ?g occurs due to an error in a flash erase command that resulted in the erase operation not being successful during eee operations. the erserif ?g is cleared by writing a 1 to erserif. writing a 0 to the erserif ?g has no effect on erserif. while erserif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 erase command successfully completed on the d-flash eee partition 1 erase command failed on the d-flash eee partition 6 pgmerif eee program error interrupt flag ?the setting of the pgmerif ?g occurs due to an error in a flash program command that resulted in the program operation not being successful during eee operations. the pgmerif ?g is cleared by writing a 1 to pgmerif. writing a 0 to the pgmerif ?g has no effect on pgmerif. while pgmerif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 program command successfully completed on the d-flash eee partition 1 program command failed on the d-flash eee partition 4 epviolif eee protection violation interrupt flag ?he setting of the epviolif ?g indicates an attempt was made to write to a protected area of the buffer ram eee partition. the epviolif ?g is cleared by writing a 1 to epviolif. writing a 0 to the epviolif ?g has no effect on epviolif. while epviolif is set, it is possible to write to the buffer ram eee partition as long as the address written to is not in a protected area. 0 no eee protection violation 1 eee protection violation detected 3 ersvif1 eee error interrupt 1 flag ?he setting of the ersvif1 ?g indicates that the memory controller was unable to change the state of a d-flash eee sector. the ersvif1 ?g is cleared by writing a 1 to ersvif1. writing a 0 to the ersvif1 ?g has no effect on ersvif1. while ersvif1 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector state change error detected 1 eee sector state change error detected 2 ersvif0 eee error interrupt 0 flag ?he setting of the ersvif0 ?g indicates that the memory controller was unable to format a d-flash eee sector for eee use. the ersvif0 ?g is cleared by writing a 1 to ersvif0. writing a 0 to the ersvif0 ?g has no effect on ersvif0. while ersvif0 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector format error detected 1 eee sector format error detected 1 dfdif double bit fault detect interrupt flag ?the setting of the dfdif ?g indicates that a double bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the dfdif ?g is cleared by writing a 1 to dfdif. writing a 0 to dfdif has no effect on dfdif. 0 no double bit fault detected 1 double bit fault detected or an invalid flash array read operation attempted 0 sfdif single bit fault detect interrupt flag ?with the ignsf bit in the fcnfg register clear, the sfdif ?g indicates that a single bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the sfdif ?g is cleared by writing a 1 to sfdif. writing a 0 to sfdif has no effect on sfdif. 0 no single bit fault detected 1 single bit fault detected and corrected or an invalid flash array read operation attempted chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 910 freescale semiconductor the (unreserved) bits of the fprot register are writable with the restriction that the size of the protected region can only be increased (see section 25.3.2.9.1, ?-flash protection restrictions , and table 25-23 ). during the reset sequence, the fprot register is loaded with the contents of the p-flash protection byte in the flash configuration field at global address 0x7f_ff0c located in p-flash memory (see table 25-3 ) as indicated by reset condition ??in figure 25-13 . to change the p-flash protection that will be loaded during the reset sequence, the upper sector of the p-flash memory must be unprotected, then the p-flash protection byte must be reprogrammed. if a double bit fault is detected while reading the p-flash phrase containing the p-flash protection byte during the reset sequence, the fpopen bit will be cleared and remaining bits in the fprot register will be set to leave the p-flash memory fully protected. trying to alter data in any protected area in the p-flash memory will result in a protection violation error and the fpviol bit will be set in the fstat register. the block erase of a p-flash block is not possible if any of the p-flash sectors contained in the same p-flash block are protected. offset module base + 0x0008 76543210 r fpopen rnv6 fphdis fphs[1:0] fpldis fpls[1:0] w reset f f ffffff = unimplemented or reserved figure 25-13. flash protection register (fprot) table 25-19. fprot field descriptions field description 7 fpopen flash protection operation enable ?the fpopen bit determines the protection function for program or erase operations as shown in table 25-20 for the p-flash block. 0 when fpopen is clear, the fphdis and fpldis bits de?e unprotected address ranges as speci?d by the corresponding fphs and fpls bits 1 when fpopen is set, the fphdis and fpldis bits enable protection for the address range speci?d by the corresponding fphs and fpls bits 6 rnv[6] reserved nonvolatile bit ?the rnv bit should remain in the erased state for future enhancements. 5 fphdis flash protection higher address range disable ?the fphdis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory ending with global address 0x7f_ffff. 0 protection/unprotection enabled 1 protection/unprotection disabled 4? fphs[1:0] flash protection higher address size the fphs bits determine the size of the protected/unprotected area in p-flash memory as shown in table 25-21 . the fphs bits can only be written to while the fphdis bit is set. 2 fpldis flash protection lower address range disable ?the fpldis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory beginning with global address 0x7f_8000. 0 protection/unprotection enabled 1 protection/unprotection disabled 1? fpls[1:0] flash protection lower address size the fpls bits determine the size of the protected/unprotected area in p-flash memory as shown in table 25-22 . the fpls bits can only be written to while the fpldis bit is set. chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 911 all possible p-flash protection scenarios are shown in figure 25-14 . although the protection scheme is loaded from the flash memory at global address 0x7f_ff0c during the reset sequence, it can be changed by the user. the p-flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. table 25-20. p-flash protection function fpopen fphdis fpldis function (1) 1. for range sizes, refer to table 25-21 and table 25-22 . 1 1 1 no p-flash protection 1 1 0 protected low range 1 0 1 protected high range 1 0 0 protected high and low ranges 0 1 1 full p-flash memory protected 0 1 0 unprotected low range 0 0 1 unprotected high range 0 0 0 unprotected high and low ranges table 25-21. p-flash protection higher address range fphs[1:0] global address range protected size 00 0x7f_f800?x7f_ffff 2 kbytes 01 0x7f_f000?x7f_ffff 4 kbytes 10 0x7f_e000?x7f_ffff 8 kbytes 11 0x7f_c000?x7f_ffff 16 kbytes table 25-22. p-flash protection lower address range fpls[1:0] global address range protected size 00 0x7f_8000?x7f_83ff 1 kbyte 01 0x7f_8000?x7f_87ff 2 kbytes 10 0x7f_8000?x7f_8fff 4 kbytes 11 0x7f_8000?x7f_9fff 8 kbytes chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 912 freescale semiconductor figure 25-14. p-flash protection scenarios 7 6 5 4 fphs[1:0] fpls[1:0] 3 2 1 0 fphs[1:0] fpls[1:0] fphdis = 1 fpldis = 1 fphdis = 1 fpldis = 0 fphdis = 0 fpldis = 1 fphdis = 0 fpldis = 0 scenario scenario unprotected region protected region with size protected region protected region with size defined by fpls defined by fphs not defined by fpls, fphs 0x7f_8000 0x7f_ffff 0x7f_8000 0x7f_ffff flash start flash start fpopen = 1 fpopen = 0 chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 913 25.3.2.9.1 p-flash protection restrictions the general guideline is that p-flash protection can only be added and not removed. table 25-23 specifies all valid transitions between p-flash protection scenarios. any attempt to write an invalid scenario to the fprot register will be ignored. the contents of the fprot register reflect the active protection scenario. see the fphs and fpls bit descriptions for additional restrictions. 25.3.2.10 eee protection register (eprot) the eprot register de?es which buffer ram eee partition areas are protected against writes. all bits in the eprot register are readable and writable except for rnv[6:4] which are only readable. the epopen and epdis bits can only be written to the protected state. the eps bits can be written anytime until the epdis bit is cleared. if the epopen bit is cleared, the state of the epdis and eps bits is irrelevant. during the reset sequence, the eprot register is loaded from the eee protection byte in the flash configuration field at global address 0x7f_ff0d located in p-flash memory (see table 25-3 ) as indicated by reset condition f in figure 25-15 . to change the eee protection that will be loaded during the reset sequence, the p-flash sector containing the eee protection byte must be unprotected, then the eee protection byte must be programmed. if a double bit fault is detected while reading the p-flash phrase table 25-23. p-flash protection scenario transitions from protection scenario to protection scenario (1) 1. allowed transitions marked with x, see figure 25-14 for a de?ition of the scenarios. 01234567 0 xxxx 1 xx 2 xx 3 x 4 xx 5 xxxx 6 xxxx 7 xxxxxxxx offset module base + 0x0009 76543210 r epopen rnv[6:4] epdis eps[2:0] w reset f f ffffff = unimplemented or reserved figure 25-15. eee protection register (eprot) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 914 freescale semiconductor containing the eee protection byte during the reset sequence, the epopen bit will be cleared and remaining bits in the eprot register will be set to leave the buffer ram eee partition fully protected. trying to write data to any protected area in the buffer ram eee partition will result in a protection violation error and the epviolif ?g will be set in the ferstat register. trying to write data to any protected area in the buffer ram partitioned for user access will not be prevented and the epviolif ?g in the ferstat register will not set. 25.3.2.11 flash common command object register (fccob) the fccob is an array of six words addressed via the ccobix index found in the fccobix register. byte wide reads and writes are allowed to the fccob register. table 25-24. eprot field descriptions field description 7 epopen enables writes to the buffer ram partitioned for eee 0 the entire buffer ram eee partition is protected from writes 1 unprotected buffer ram eee partition areas are enabled for writes 6? rnv[6:4] reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements 3 epdis buffer ram protection address range disable ?the epdis bit determines whether there is a protected area in a speci? region of the buffer ram eee partition. 0 protection enabled 1 protection disabled 2? eps[2:0] buffer ram protection size ?the eps[2:0] bits determine the size of the protected area in the buffer ram eee partition as shown in table 25-21 . the eps bits can only be written to while the epdis bit is set. table 25-25. buffer ram eee partition protection address range eps[2:0] global address range protected size 000 0x13_ffc0 ?0x13_ffff 64 bytes 001 0x13_ff80 ?0x13_ffff 128 bytes 010 0x13_ff40 ?0x13_ffff 192 bytes 011 0x13_ff00 ?0x13_ffff 256 bytes 100 0x13_fec0 ?0x13_ffff 320 bytes 101 0x13_fe80 ?0x13_ffff 384 bytes 110 0x13_fe40 ?0x13_ffff 448 bytes 111 0x13_fe00 ?0x13_ffff 512 bytes chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 915 25.3.2.11.1 fccob - nvm command mode nvm command mode uses the indexed fccob register to provide a command code and its relevant parameters to the memory controller. the user first sets up all required fccob fields and then initiates the command? execution by writing a 1 to the ccif bit in the fstat register (a 1 written by the user clears the ccif command completion flag to 0). when the user clears the ccif bit in the fstat register all fccob parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the memory controller returning ccif to 1). some commands return information to the fccob register array. the generic format for the fccob parameter fields in nvm command mode is shown in table 25-26 . the return values are available for reading after the ccif flag in the fstat register has been returned to 1 by the memory controller. writes to the unimplemented parameter fields (ccobix = 110 and ccobix = 111) are ignored with reads from these fields returning 0x0000. table 25-26 shows the generic flash command format. the high byte of the first word in the ccob array contains the command code, followed by the parameters for this specific flash command. for details on the fccob settings required by each command, see the flash command descriptions in section 25.4.2 . offset module base + 0x000a 76543210 r ccob[15:8] w reset 00000000 figure 25-16. flash common command object high register (fccobhi) offset module base + 0x000b 76543210 r ccob[7:0] w reset 00000000 figure 25-17. flash common command object low register (fccoblo) table 25-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) 000 hi fcmd[7:0] de?ing flash command lo 0, global address [22:16] 001 hi global address [15:8] lo global address [7:0] 010 hi data 0 [15:8] lo data 0 [7:0] chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 916 freescale semiconductor 25.3.2.12 eee tag counter register (etag) the etag register contains the number of outstanding words in the buffer ram eee partition that need to be programmed into the d-flash eee partition. the etag register is decremented prior to the related tagged word being programmed into the d-flash eee partition. all tagged words have been programmed into the d-flash eee partition once all bits in the etag register read 0 and the mgbusy flag in the fstat register reads 0. all etag bits are readable but not writable and are cleared by the memory controller. 25.3.2.13 flash ecc error results register (feccr) the feccr registers contain the result of a detected ecc fault for both single bit and double bit faults. the feccr register provides access to several ecc related fields as defined by the eccrix index bits in the feccrix register (see section 25.3.2.4 ). once ecc fault information has been stored, no other 011 hi data 1 [15:8] lo data 1 [7:0] 100 hi data 2 [15:8] lo data 2 [7:0] 101 hi data 3 [15:8] lo data 3 [7:0] offset module base + 0x000c 76543210 r etag[15:8] w reset 0 0 000000 = unimplemented or reserved figure 25-18. eee tag counter high register (etaghi) offset module base + 0x000d 76543210 r etag[7:0] w reset 00000000 = unimplemented or reserved figure 25-19. eee tag counter low register (etaglo) table 25-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 917 fault information will be recorded until the specific ecc fault flag has been cleared. in the event of simultaneous ecc faults, the priority for fault recording is: 1. double bit fault over single bit fault 2. cpu over xgate all feccr bits are readable but not writable. offset module base + 0x000e 76543210 r eccr[15:8] w reset 00000000 = unimplemented or reserved figure 25-20. flash ecc error results high register (feccrhi) offset module base + 0x000f 76543210 r eccr[7:0] w reset 00000000 = unimplemented or reserved figure 25-21. flash ecc error results low register (feccrlo) table 25-27. feccr index settings eccrix[2:0] feccr register content bits [15:8] bit[7] bits[6:0] 000 parity bits read from flash block cpu or xgate source identity global address [22:16] 001 global address [15:0] 010 data 0 [15:0] 011 data 1 [15:0] (p-flash only) 100 data 2 [15:0] (p-flash only) 101 data 3 [15:0] (p-flash only) 110 not used, returns 0x0000 when read 111 not used, returns 0x0000 when read chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 918 freescale semiconductor the p-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the following four words addressed by eccrix = 010 to 101 contain the 64-bit wide data phrase. the four data words and the parity byte are the uncorrected data read from the p-flash block. the d-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the uncorrected 16-bit data word is addressed by eccrix = 010. 25.3.2.14 flash option register (fopt) the fopt register is the flash option register. all bits in the fopt register are readable but are not writable. during the reset sequence, the fopt register is loaded from the flash nonvolatile byte in the flash configuration field at global address 0x7f_ff0e located in p-flash memory (see table 25-3 ) as indicated by reset condition f in figure 25-22 . if a double bit fault is detected while reading the p-flash phrase containing the flash nonvolatile byte during the reset sequence, all bits in the fopt register will be set. 25.3.2.15 flash reserved0 register (frsv0) this flash register is reserved for factory testing. table 25-28. feccr index=000 bit descriptions field description 15:8 par[7:0] ecc parity bits ?contains the 8 parity bits from the 72 bit wide p-flash data word or the 6 parity bits, allocated to par[5:0], from the 22 bit wide d-flash word with par[7:6]=00. 7 xbus01 bus source identi?r the xbus01 bit determines whether the ecc error was caused by a read access from the cpu or xgate. 0 ecc error happened on the cpu access 1 ecc error happened on the xgate access 6? gaddr[22:16] global address ?the gaddr[22:16] ?ld contains the upper seven bits of the global address having caused the error. offset module base + 0x0010 76543210 r nv[7:0] w reset f f ffffff = unimplemented or reserved figure 25-22. flash option register (fopt) table 25-29. fopt field descriptions field description 7? nv[7:0] nonvolatile bits the nv[7:0] bits are available as nonvolatile bits. refer to the device user guide for proper use of the nv bits. chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 919 all bits in the frsv0 register read 0 and are not writable. 25.3.2.16 flash reserved1 register (frsv1) this flash register is reserved for factory testing. all bits in the frsv1 register read 0 and are not writable. 25.3.2.17 flash reserved2 register (frsv2) this flash register is reserved for factory testing. all bits in the frsv2 register read 0 and are not writable. offset module base + 0x0011 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 25-23. flash reserved0 register (frsv0) offset module base + 0x0012 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 25-24. flash reserved1 register (frsv1) offset module base + 0x0013 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 25-25. flash reserved2 register (frsv2) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 920 freescale semiconductor 25.4 functional description 25.4.1 flash command operations flash command operations are used to modify flash memory contents or con?ure module resources for eee operation. the next sections describe: how to write the fclkdiv register that is used to generate a time base (fclk) derived from oscclk for flash program and erase command operations the command write sequence used to set flash command parameters and launch execution valid flash commands available for execution 25.4.1.1 writing the fclkdiv register prior to issuing any flash program or erase command after a reset, the user is required to write the fclkdiv register to divide oscclk down to a target fclk of 1 mhz. table 25-9 shows recommended values for the fdiv ?ld based on oscclk frequency. note programming or erasing the flash memory cannot be performed if the bus clock runs at less than 1 mhz. setting fdiv too high can destroy the flash memory due to overstress. setting fdiv too low can result in incomplete programming or erasure of the flash memory cells. when the fclkdiv register is written, the fdivld bit is set automatically. if the fdivld bit is 0, the fclkdiv register has not been written since the last reset. if the fclkdiv register has not been written, any flash program or erase command loaded during a command write sequence will not execute and the accerr bit in the fstat register will set. 25.4.1.2 command write sequence the memory controller will launch all valid flash commands entered using a command write sequence. before launching a command, the accerr and fpviol bits in the fstat register must be clear (see section 25.3.2.7 ) and the ccif flag should be tested to determine the status of the current command write sequence. if ccif is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the fccob register are ignored. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 921 25.4.1.2.1 de?e fccob contents the fccob parameter ?lds must be loaded with all required parameters for the flash command being executed. access to the fccob parameter ?lds is controlled via the ccobix bits in the fccobix register (see section 25.3.2.3 ). the contents of the fccob parameter ?lds are transferred to the memory controller when the user clears the ccif command completion ?g in the fstat register (writing 1 clears the ccif to 0). the ccif ?g will remain clear until the flash command has completed. upon completion, the memory controller will return ccif to 1 and the fccob register will be used to communicate any results. the ?w for a generic command write sequence is shown in figure 25-26 . chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 922 freescale semiconductor figure 25-26. generic flash command write sequence flowchart write to fccobix register write: fstat register (to launch command) clear ccif 0x80 clear accerr/fpviol 0x30 write: fstat register yes no access error and protection violation read: fstat register read: fstat register no start yes check ccif set? fccob accerr/ fpviol set? exit write: fclkdiv register read: fclkdiv register yes no clock register written check fdivld set? no bit polling for command completion check yes ccif set? to identify speci? command parameter to load. write to fccob register to load required command parameter. yes no more parameters? availability check results from previous command note: fclkdiv must be set after each reset chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 923 25.4.1.3 valid flash module commands table 25-30. flash commands by mode fcmd command unsecured secured ns (1) 1. unsecured normal single chip mode. nx (2) 2. unsecured normal expanded mode. ss (3) 3. unsecured special single chip mode. st (4) 4. unsecured special mode. ns (5) 5. secured normal single chip mode. nx (6) 6. secured normal expanded mode. ss (7) 7. secured special single chip mode. st (8) 8. secured special mode. 0x01 erase verify all blocks ???????? 0x02 erase verify block ???????? 0x03 erase verify p-flash section ????? 0x04 read once ????? 0x05 load data field ????? 0x06 program p-flash ????? 0x07 program once ????? 0x08 erase all blocks ?? ?? 0x09 erase p-flash block ????? 0x0a erase p-flash sector ????? 0x0b unsecure flash ?? ?? 0x0c verify backdoor access key ?? 0x0d set user margin level ????? 0x0e set field margin level ?? 0x0f full partition d-flash ?? 0x10 erase verify d-flash section ????? 0x11 program d-flash ????? 0x12 erase d-flash sector ????? 0x13 enable eeprom emulation ???????? 0x14 disable eeprom emulation ???????? 0x15 eeprom emulation query ???????? 0x20 partition d-flash ???????? chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 924 freescale semiconductor 25.4.1.4 p-flash commands table 25-31 summarizes the valid p-flash commands along with the effects of the commands on the p- flash block and other resources within the flash module. 25.4.1.5 d-flash and eee commands table 25-32 summarizes the valid d-flash and eee commands along with the effects of the commands on the d-flash block and eee operation. table 25-31. p-flash commands fcmd command function on p-flash memory 0x01 erase verify all blocks verify that all p-flash (and d-flash) blocks are erased. 0x02 erase verify block verify that a p-flash block is erased. 0x03 erase verify p- flash section verify that a given number of words starting at the address provided are erased. 0x04 read once read a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that was previously programmed using the program once command. 0x05 load data field load data for simultaneous multiple p-flash block operations. 0x06 program p-flash program a phrase in a p-flash block and any previously loaded phrases for any other p- flash block (see load data field command). 0x07 program once program a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that is allowed to be programmed only once. 0x08 erase all blocks erase all p-flash (and d-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x09 erase p-flash block erase a single p-flash block. an erase of the full p-flash block is only possible when fpldis, fphdis and fpopen bits in the fprot register are set prior to launching the command. 0x0a erase p-flash sector erase all bytes in a p-flash sector. 0x0b unsecure flash supports a method of releasing mcu security by erasing all p-flash (and d-flash) blocks and verifying that all p-flash (and d-flash) blocks are erased. 0x0c verify backdoor access key supports a method of releasing mcu security by verifying a set of security keys. 0x0d set user margin level speci?s a user margin read level for all p-flash blocks. 0x0e set field margin level speci?s a ?ld margin read level for all p-flash blocks (special modes only). table 25-32. d-flash commands fcmd command function on d-flash memory 0x01 erase verify all blocks verify that all d-flash (and p-flash) blocks are erased. 0x02 erase verify block verify that the d-flash block is erased. chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 925 25.4.2 flash command description this section provides details of all available flash commands launched by a command write sequence. the accerr bit in the fstat register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the memory controller: starting any command write sequence that programs or erases flash memory before initializing the fclkdiv register writing an invalid command as part of the command write sequence for additional possible errors, refer to the error handling table provided for each command if a flash block is read during execution of an algorithm (ccif = 0) on that same block, the read operation will return invalid data. if the sfdif or dfdif flags were not previously set when the invalid read operation occurred, both the sfdif and dfdif flags will be set and the feccr registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. if the accerr or fpviol bits are set in the fstat register, the user must clear these bits before starting any command write sequence (see section 25.3.2.7 ). 0x08 erase all blocks erase all d-flash (and p-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x0b unsecure flash supports a method of releasing mcu security by erasing all d-flash (and p-flash) blocks and verifying that all d-flash (and p-flash) blocks are erased. 0x0d set user margin level speci?s a user margin read level for the d-flash block. 0x0e set field margin level speci?s a ?ld margin read level for the d-flash block (special modes only). 0x0f full partition d- flash erase the d-flash block and partition an area of the d-flash block for user access. 0x10 erase verify d- flash section verify that a given number of words starting at the address provided are erased. 0x11 program d-flash program up to four words in the d-flash block. 0x12 erase d-flash sector erase all bytes in a sector of the d-flash block. 0x13 enable eeprom emulation enable eeprom emulation where writes to the buffer ram eee partition will be copied to the d-flash eee partition. 0x14 disable eeprom emulation suspend all current erase and program activity related to eeprom emulation but leave current eee tags set. 0x15 eeprom emulation query returns eee partition and status variables. 0x20 partition d-flash partition an area of the d-flash block for user access. table 25-32. d-flash commands fcmd command function on d-flash memory chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 926 freescale semiconductor caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. 25.4.2.1 erase verify all blocks command the erase verify all blocks command will verify that all p-flash and d-flash blocks have been erased. upon clearing ccif to launch the erase verify all blocks command, the memory controller will verify that the entire flash memory space is erased. the ccif ?g will set after the erase verify all blocks operation has completed. 25.4.2.2 erase verify block command the erase verify block command allows the user to verify that an entire p-flash or d-flash block has been erased. the fccob upper global address bits determine which block must be veri?d. upon clearing ccif to launch the erase verify block command, the memory controller will verify that the selected p-flash or d-flash block is erased. the ccif ?g will set after the erase verify block operation has completed. table 25-33. erase verify all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x01 not required table 25-34. erase verify all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 25-35. erase verify block command fccob requirements ccobix[2:0] fccob parameters 000 0x02 global address [22:16] of the flash block to be veri?d . chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 927 25.4.2.3 erase verify p-flash section command the erase verify p-flash section command will verify that a section of code in the p-flash memory is erased. the erase verify p-flash section command defines the starting point of the code to be verified and the number of phrases. the section to be verified cannot cross a 128 kbyte boundary in the p-flash memory space. upon clearing ccif to launch the erase verify p-flash section command, the memory controller will verify the selected section of flash memory is erased. the ccif ?g will set after the erase verify p-flash section operation has completed. table 25-36. erase verify block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if an invalid global address [22:16] is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 25-37. erase verify p-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x03 global address [22:16] of a p-flash block 001 global address [15:0] of the ?st phrase to be veri?d 010 number of phrases to be veri?d table 25-38. erase verify p-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if the requested section crosses a 128 kbyte boundary fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 928 freescale semiconductor 25.4.2.4 read once command the read once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of p-flash block 0. the read once field is programmed using the program once command described in section 25.4.2.7 . the read once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the read once command, a read once phrase is fetched and stored in the fccob indexed register. the ccif ?g will set after the read once operation has completed. valid phrase index values for the read once command range from 0x0000 to 0x0007. during execution of the read once command, any attempt to read addresses within p-flash block 0 will return invalid data. 128 25.4.2.5 load data field command the load data field command is executed to provide fccob parameters for multiple p-flash blocks for a future simultaneous program operation in the p-flash memory space. ferstat epviolif none table 25-39. read once command fccob requirements ccobix[2:0] fccob parameters 000 0x04 not required 001 read once phrase index (0x0000 - 0x0007) 010 read once word 0 value 011 read once word 1 value 100 read once word 2 value 101 read once word 3 value table 25-40. read once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid phrase index is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 25-38. erase verify p-flash section command error handling register error bit error condition chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 929 upon clearing ccif to launch the load data field command, the fccob registers will be transferred to the memory controller and be programmed in the block speci?d at the global address given with a future program p-flash command launched on a p-flash block. the ccif ?g will set after the load data field operation has completed. note that once a load data field command sequence has been initiated, the load data field command sequence will be cancelled if any command other than load data field or the future program p-flash is launched. similarly, if an error occurs after launching a load data field or program p-flash command, the associated load data field command sequence will be cancelled. 25.4.2.6 program p-flash command the program p-flash operation will program a previously erased phrase in the p-flash memory using an embedded algorithm. table 25-41. load data field command fccob requirements ccobix[2:0] fccob parameters 000 0x05 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 011 word 1 100 word 2 101 word 3 table 25-42. load data field command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [16:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 none mgstat0 none ferstat epviolif none chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 930 freescale semiconductor caution a p-flash phrase must be in the erased state before being programmed. cumulative programming of bits within a flash phrase is not allowed. upon clearing ccif to launch the program p-flash command, the memory controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. the ccif ?g will set after the program p-flash operation has completed. 25.4.2.7 program once command the program once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in p-flash block 0. the program once reserved field can be read using the read once command as described in section 25.4.2.4 . the program once command must only be issued once since the nonvolatile information register in p-flash block 0 cannot be erased. the program table 25-43. program p-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x06 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 program value 011 word 1 program value 100 word 2 program value 101 word 3 program value table 25-44. program p-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 931 once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the program once command, the memory controller ?st veri?s that the selected phrase is erased. if erased, then the selected phrase will be programmed and then veri?d with read back. the ccif ?g will remain clear, setting only after the program once operation has completed. the reserved nonvolatile information register accessed by the program once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. valid phrase index values for the program once command range from 0x0000 to 0x0007. during execution of the program once command, any attempt to read addresses within p-flash block 0 will return invalid data. 25.4.2.8 erase all blocks command the erase all blocks operation will erase the entire p-flash and d-flash memory space including the eee nonvolatile information register. table 25-45. program once command fccob requirements ccobix[2:0] fccob parameters 000 0x07 not required 001 program once phrase index (0x0000 - 0x0007) 010 program once word 0 value 011 program once word 1 value 100 program once word 2 value 101 program once word 3 value table 25-46. program once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid phrase index is supplied set if the requested phrase has already been programmed (1) 1. if a program once phrase is initially programmed to 0xffff_ffff_ffff_ffff, the program once command will be allowed to execute again on that same phrase. fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 932 freescale semiconductor upon clearing ccif to launch the erase all blocks command, the memory controller will erase the entire flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g will set after the erase all blocks operation has completed. 25.4.2.9 erase p-flash block command the erase p-flash block operation will erase all addresses in a p-flash block. upon clearing ccif to launch the erase p-flash block command, the memory controller will erase the selected p-flash block and verify that it is erased. the ccif ?g will set after the erase p-flash block operation has completed. table 25-47. erase all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x08 not required table 25-48. erase all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif set if any area of the buffer ram eee partition is protected table 25-49. erase p-flash block command fccob requirements ccobix[2:0] fccob parameters 000 0x09 global address [22:16] to identify p-flash block 001 global address [15:0] in p-flash block to be erased chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 933 25.4.2.10 erase p-flash sector command the erase p-flash sector operation will erase all addresses in a p-flash sector. upon clearing ccif to launch the erase p-flash sector command, the memory controller will erase the selected flash sector and then verify that it is erased. the ccif ?g will be set after the erase p-flash sector operation has completed. table 25-50. erase p-flash block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:16] is supplied fpviol set if an area of the selected p-flash block is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 25-51. erase p-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x0a global address [22:16] to identify p-flash block to be erased 001 global address [15:0] anywhere within the sector to be erased. refer to section 25.1.2.1 for the p-flash sector size. table 25-52. erase p-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:16] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) fpviol set if the selected p-flash sector is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 934 freescale semiconductor 25.4.2.11 unsecure flash command the unsecure flash command will erase the entire p-flash and d-flash memory space and, if the erase is successful, will release security. upon clearing ccif to launch the unsecure flash command, the memory controller will erase the entire p-flash and d-flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. if the erase verify is not successful, the unsecure flash operation sets mgstat1 and terminates without changing the security state. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g is set after the unsecure flash operation has completed. 25.4.2.12 verify backdoor access key command the verify backdoor access key command will only execute if it is enabled by the keyen bits in the fsec register (see table 25-11 ). the verify backdoor access key command releases security if user- supplied keys match those stored in the flash security bytes of the flash configuration field (see table 25- 3 ). the verify backdoor access key command must not be executed from the flash block containing the backdoor comparison key to avoid code runaway. table 25-53. unsecure flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0b not required table 25-54. unsecure flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif set if any area of the buffer ram eee partition is protected table 25-55. verify backdoor access key command fccob requirements ccobix[2:0] fccob parameters 000 0x0c not required 001 key 0 010 key 1 011 key 2 100 key 3 chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 935 upon clearing ccif to launch the verify backdoor access key command, the memory controller will check the fsec keyen bits to verify that this command is enabled. if not enabled, the memory controller sets the accerr bit in the fstat register and terminates. if the command is enabled, the memory controller compares the key provided in fccob to the backdoor comparison key in the flash con?uration ?ld with key 0 compared to 0x7f_ff00, etc. if the backdoor keys match, security will be released. if the backdoor keys do not match, security is not released and all future attempts to execute the verify backdoor access key command are aborted (set accerr) until a reset occurs. the ccif flag is set after the verify backdoor access key operation has completed. 25.4.2.13 set user margin level command the set user margin level command causes the memory controller to set the margin level for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set user margin level command, the memory controller will set the user margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set user margin level command are de?ed in table 25-58 . table 25-56. verify backdoor access key command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 100 at command launch set if a load data field command sequence is currently active set if an incorrect backdoor key is supplied set if backdoor key access has not been enabled (keyen[1:0] != 10, see section 25.3.2.2 ) set if the backdoor key has mismatched since the last reset fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 25-57. set user margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0d global address [22:16] to identify the flash block 001 margin level setting table 25-58. valid set user margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 936 freescale semiconductor note user margin levels can be used to check that flash memory contents have adequate margin for normal level read operations. if unexpected results are encountered when checking flash memory contents at user margin levels, a potential loss of information has been detected. 25.4.2.14 set field margin level command the set field margin level command, valid in special modes only, causes the memory controller to set the margin level specified for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set field margin level command, the memory controller will set the ?ld margin level for the targeted block and then set the ccif ?g. 0x0002 user margin-0 level (2) 1. read margin to the erased state 2. read margin to the programmed state table 25-59. set user margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:16] is supplied set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 25-60. set field margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0e global address [22:16] to identify the flash block 001 margin level setting table 25-58. valid set user margin level settings ccob (ccobix=001) level description chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 937 valid margin level settings for the set field margin level command are de?ed in table 25-61 . caution field margin levels must only be used during verify of the initial factory programming. note field margin levels can be used to check that flash memory contents have adequate margin for data retention at the normal level setting. if unexpected results are encountered when checking flash memory contents at ?ld margin levels, the flash memory contents should be erased and reprogrammed. 25.4.2.15 full partition d-flash command the full partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. table 25-61. valid set field margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) 1. read margin to the erased state 0x0002 user margin-0 level (2) 2. read margin to the programmed state 0x0003 field margin-1 level 1 0x0004 field margin-0 level 2 table 25-62. set field margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:16] is supplied set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 938 freescale semiconductor upon clearing ccif to launch the full partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 25-7 ) program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 25-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 25-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 25-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the full partition d-flash operation has completed, the ccif ?g will set. running the full partition d-flash command a second time will result in the previous partition values and the entire d-flash memory being erased. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 25-63. full partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0f not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 939 25.4.2.16 erase verify d-flash section command the erase verify d-flash section command will verify that a section of code in the d-flash user partition is erased. the erase verify d-flash section command defines the starting point of the data to be verified and the number of words. upon clearing ccif to launch the erase verify d-flash section command, the memory controller will verify the selected section of d-flash memory is erased. the ccif ?g will set after the erase verify d- flash section operation has completed. table 25-64. full partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 25-65. erase verify d-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x10 global address [22:16] to identify the d-flash block 001 global address [15:0] of the ?st word to be veri?d 010 number of words to be veri?d chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 940 freescale semiconductor 25.4.2.17 program d-flash command the program d-flash operation programs one to four previously erased words in the d-flash user partition. the program d-flash operation will confirm that the targeted location(s) were successfully programmed upon completion. caution a flash word must be in the erased state before being programmed. cumulative programming of bits within a flash word is not allowed. upon clearing ccif to launch the program d-flash command, the user-supplied words will be transferred to the memory controller and be programmed. the ccobix index value at program d-flash command launch determines how many words will be programmed in the d-flash block. no protection checks are made in the program d-flash operation on the d-flash block, only access error checks. the ccif ?g is set when the operation has completed. table 25-66. erase verify d-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area of the d-flash eee partition set if the requested section breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 25-67. program d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x11 global address [22:16] to identify the d-flash block 001 global address [15:0] of word to be programmed 010 word 0 program value 011 word 1 program value, if desired 100 word 2 program value, if desired 101 word 3 program value, if desired chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 941 25.4.2.18 erase d-flash sector command the erase d-flash sector operation will erase all addresses in a sector of the d-flash user partition. upon clearing ccif to launch the erase d-flash sector command, the memory controller will erase the selected flash sector and verify that it is erased. the ccif ?g will set after the erase d-flash sector operation has completed. table 25-68. program d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] < 010 at command launch set if ccobix[2:0] > 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area in the d-flash eee partition set if the requested group of words breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 25-69. erase d-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x12 global address [22:16] to identify d-flash block 001 global address [15:0] anywhere within the sector to be erased. see section 25.1.2.2 for d-flash sector size. chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 942 freescale semiconductor 25.4.2.19 enable eeprom emulation command the enable eeprom emulation command causes the memory controller to enable eee activity. eee activity is disabled after any reset. upon clearing ccif to launch the enable eeprom emulation command, the ccif ?g will set after the memory controller enables eee operations using the contents of the eee tag ram and tag counter. the full partition d-flash or the partition d-flash command must be run prior to launching the enable eeprom emulation command. table 25-70. erase d-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 25-71. enable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x13 not required table 25-72. enable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 943 25.4.2.20 disable eeprom emulation command the disable eeprom emulation command causes the memory controller to suspend current eee activity. upon clearing ccif to launch the disable eeprom emulation command, the memory controller will halt eee operations at the next convenient point without clearing the eee tag ram or tag counter before setting the ccif ?g. 25.4.2.21 eeprom emulation query command the eeprom emulation query command returns eee partition and status variables. upon clearing ccif to launch the eeprom emulation query command, the ccif ?g will set after the eee partition and status variables are stored in the fccobix register.if the emulation query command is executed prior to partitioning (partition d-flash command section 25.4.2.15 ), the following reset values are returned: dfpart = 0x_ffff, erpart = 0x_ffff, ecount = 0x_ffff, dead sector count = 0x_00, ready sector count = 0x_00. table 25-73. disable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x14 not required table 25-74. disable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 25-75. eeprom emulation query command fccob requirements ccobix[2:0] fccob parameters 000 0x15 not required 001 return dfpart 010 return erpart 011 return ecount (1) 1. indicates sector erase count 100 return dead sector count return ready sector count chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 944 freescale semiconductor 25.4.2.22 partition d-flash command the partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 64 sectors with 256 bytes per sector. the erase all blocks command must be run prior to launching the partition d-flash command. upon clearing ccif to launch the partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase verify the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 25-7 ) table 25-76. eeprom emulation query command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 25-77. partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x20 not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 945 program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 25-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 25-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 25-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the partition d-flash operation has completed, the ccif ?g will set. running the partition d-flash command a second time will result in the accerr bit within the fstat register being set. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 25-78. partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 25-30 ) set if partitions have already been de?ed set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 946 freescale semiconductor 25.4.3 interrupts the flash module can generate an interrupt when a flash command operation has completed or when a flash command operation has detected an eee error or an ecc fault. note vector addresses and their relative interrupt priority are determined at the mcu level. 25.4.3.1 description of flash interrupt operation the flash module uses the ccif ?g in combination with the ccie interrupt enable bit to generate the flash command interrupt request. the flash module uses the erseif, pgmeif, epviolif, ersvif1, ersvif0, dfdif and sfdif ?gs in combination with the erseie, pgmeie, epviolie, ersvie1, ersvie0, dfdie and sfdie interrupt enable bits to generate the flash error interrupt request. for a detailed description of the register bits involved, refer to section 25.3.2.5, ?lash configuration register (fcnfg) ? section 25.3.2.6, ?lash error configuration register (fercnfg) ? section 25.3.2.7, ?lash status register (fstat) ? and section 25.3.2.8, ?lash error status register (ferstat) ? the logic used for generating the flash module interrupts is shown in figure 25-27 . table 25-79. flash interrupt sources interrupt source interrupt flag local enable global (ccr) mask flash command complete ccif (fstat register) ccie (fcnfg register) i bit flash eee erase error erserif (ferstat register) erserie (fercnfg register) i bit flash eee program error pgmerif (ferstat register) pgmerie (fercnfg register) i bit flash eee protection violation epviolif (ferstat register) epviolie (fercnfg register) i bit flash eee error type 1 violation ersvif1 (ferstat register) ersvie1 (fercnfg register) i bit flash eee error type 0 violation ersvif0 (ferstat register) ersvie0 (fercnfg register) i bit ecc double bit fault on flash read dfdif (ferstat register) dfdie (fercnfg register) i bit ecc single bit fault on flash read sfdif (ferstat register) sfdie (fercnfg register) i bit chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 947 figure 25-27. flash module interrupts implementation 25.4.4 wait mode the flash module is not affected if the mcu enters wait mode. the flash module can recover the mcu from wait via the ccif interrupt (see section 25.4.3, ?nterrupts ). 25.4.5 stop mode if a flash command is active (ccif = 0) or an ee-emulation operation is pending when the mcu requests stop mode, the current flash operation will be completed before the cpu is allowed to enter stop mode. 25.5 security the flash module provides security information to the mcu. the flash security state is de?ed by the sec bits of the fsec register (see table 25-12 ). during reset, the flash module initializes the fsec register using data read from the security byte of the flash con?uration ?ld at global address 0x7f_ff0f. flash error interrupt request ccif ccie epviolif epviolie ersvif1 ersvie1 ersvif0 ersvie0 pgmerif pgmerie erserif erserie flash command interrupt request dfdif dfdie sfdif sfdie chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 948 freescale semiconductor the security state out of reset can be permanently changed by programming the security byte of the flash con?uration ?ld. this assumes that you are starting from a mode where the necessary p-flash erase and program commands are available and that the upper region of the p-flash is unprotected. if the flash security byte is successfully programmed, its new value will take affect after the next mcu reset. the following subsections describe these security-related subjects: unsecuring the mcu using backdoor key access unsecuring the mcu in special single chip mode using bdm mode and security effects on flash command availability 25.5.1 unsecuring the mcu using backdoor key access the mcu may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7f_ff00?x7f_ff07). if the keyen[1:0] bits are in the enabled state (see section 25.3.2.2 ), the verify backdoor access key command (see section 25.4.2.12 ) allows the user to present four prospective keys for comparison to the keys stored in the flash memory via the memory controller. if the keys presented in the verify backdoor access key command match the backdoor keys stored in the flash memory, the sec bits in the fsec register (see table 25-12 ) will be changed to unsecure the mcu. key values of 0x0000 and 0xffff are not permitted as backdoor keys. while the verify backdoor access key command is active, p-flash block 0 will not be available for read access and will return invalid data. the user code stored in the p-flash memory must have a method of receiving the backdoor keys from an external stimulus. this external stimulus would typically be through one of the on-chip serial ports. if the keyen[1:0] bits are in the enabled state (see section 25.3.2.2 ), the mcu can be unsecured by the backdoor key access sequence described below: 1. follow the command sequence for the verify backdoor access key command as explained in section 25.4.2.12 2. if the verify backdoor access key command is successful, the mcu is unsecured and the sec[1:0] bits in the fsec register are forced to the unsecure state of 10 the verify backdoor access key command is monitored by the memory controller and an illegal key will prohibit future use of the verify backdoor access key command. a reset of the mcu is the only method to re-enable the verify backdoor access key command. after the backdoor keys have been correctly matched, the mcu will be unsecured. after the mcu is unsecured, the sector containing the flash security byte can be erased and the flash security byte can be reprogrammed to the unsecure state, if desired. in the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7f_ff00?x7f_ff07 in the flash con?uration ?ld. the security as de?ed in the flash security byte (0x7f_ff0f) is not changed by using the verify backdoor access key command sequence. the backdoor keys stored in addresses 0x7f_ff00?x7f_ff07 are unaffected by the verify backdoor access key command sequence. after the next reset of the mcu, the security state of the flash module is determined by the flash security byte chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 949 (0x7f_ff0f). the verify backdoor access key command sequence has no effect on the program and erase protections de?ed in the flash protection register, fprot. 25.5.2 unsecuring the mcu in special single chip mode using bdm the mcu can be unsecured in special single chip mode by erasing the p-flash and d-flash memory by one of the following methods: reset the mcu into special single chip mode, delay while the erase test is performed by the bdm, send bdm commands to disable protection in the p-flash and d-flash memory, and execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. reset the mcu into special expanded wide mode, disable protection in the p-flash and d-flash memory and run code from external memory to execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. after the ccif ?g sets to indicate that the erase all blocks operation has completed, reset the mcu into special single chip mode. the bdm will execute the erase verify all blocks command write sequence to verify that the p-flash and d-flash memory is erased. if the p-flash and d-flash memory are verified as erased the mcu will be unsecured. all bdm commands will be enabled and the flash security byte may be programmed to the unsecure state by the following method: send bdm commands to execute a ?rogram p-flash?command sequence to program the flash security byte to the unsecured state and reset the mcu. 25.5.3 mode and security effects on flash command availability the availability of flash module commands depends on the mcu operating mode and security state as shown in table 25-30 . 25.6 initialization on each system reset the flash module executes a reset sequence which establishes initial values for the flash block configuration parameters, the fprot and dfprot protection registers, and the fopt and fsec registers. the flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. if a double bit fault is detected during the reset sequence, both mgstat bits in the fstat register will be set. the accerr bit in the fstat register is set if errors are encountered while initializing the eee buffer ram during the reset sequence. ccif remains clear throughout the reset sequence. the flash module holds off all cpu access for the initial portion of the reset sequence. while flash reads are possible when the hold is removed, writes to the fccobix, fccobhi, and fccoblo registers are ignored to prevent command activity while the memory controller remains busy. completion of the reset sequence is marked by setting ccif high which enables writes to the fccobix, fccobhi, and fccoblo registers to launch any available flash command. if a reset occurs while any flash command is in progress, that command will be immediately aborted. the state of the word being programmed or the sector/block being erased is not guaranteed. chapter 25 256 kbyte flash module (s12xftm256k2v1) mc9s12xe-family reference manual , rev. 1.21 950 freescale semiconductor mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 951 chapter 26 384 kbyte flash module (s12xftm384k2v1) 26.1 introduction the ftm384k2 module implements the following: 384 kbytes of p-flash (program flash) memory, consisting of 2 physical flash blocks, intended primarily for nonvolatile code storage 32 kbytes of d-flash (data flash) memory, consisting of 1 physical flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated eeprom, as basic flash memory primarily intended for nonvolatile data storage, or as a combination of both table 26-1. revision history revision number revision date sections affected description of changes v01.10 29 nov 2007 - cleanup v01.11 19 dec 2007 26.4.2/26-987 26.4.2/26-987 26.3.1/26-956 - updated command error handling tables based on parent-child relationship with ftm512k3 - corrected error handling table for full partition d-flash, partition d-flash, and eeprom emulation query commands - corrected p-flash ifr accessibility table v01.12 25 sep 2009 26.1/26-951 26.3.2.1/26-963 26.4.2.4/26-990 26.4.2.7/26-993 26.4.2.12/26- 997 26.4.2.12/26- 997 26.4.2.12/26- 997 26.4.2.20/26- 1006 26.3.2/26-961 26.3.2.1/26-963 26.4.1.2/26-982 26.6/26-1012 - clarify single bit fault correction for p-flash phrase - expand fdiv vs oscclk frequency table - add statement concerning code runaway when executing read once command from flash block containing associated ?lds - add statement concerning code runaway when executing program once command from flash block containing associated ?lds - add statement concerning code runaway when executing verify backdoor access key command from flash block containing associated ?lds - relate key 0 to associated backdoor comparison key address - change ?ower down reset?to ?eset - add accerr condition for disable eeprom emulation command the following changes were made to clarify module behavior related to flash register access during reset sequence and while flash commands are active: - add caution concerning register writes while command is active - writes to fclkdiv are allowed during reset sequence while ccif is clear - add caution concerning register writes while command is active - writes to fccobix, fccobhi, fccoblo registers are ignored during reset sequence mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 952 4 kbytes of buffer ram, consisting of 1 physical ram block, that can be used as emulated eeprom using a built-in hardware scheme, as basic ram, or as a combination of both the flash memory is ideal for single-supply applications allowing for ?ld reprogramming without requiring external high voltage sources for program or erase operations. the flash module includes a memory controller that executes commands to modify flash memory contents or con?ure module resources for emulated eeprom operation. the user interface to the memory controller consists of the indexed flash common command object (fccob) register which is written to with the command, global address, data, and any required command parameters. the memory controller must complete the execution of a command before the fccob register can be written to with a new command. caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. the ram and flash memory may be read as bytes, aligned words, or misaligned words. read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. for flash memory, an erased bit reads 1 and a programmed bit reads 0. it is not possible to read from a flash block while any command is executing on that speci? flash block. it is possible to read from a flash block while a command is executing on a different flash block. both p-flash and d-flash memories are implemented with error correction codes (ecc) that can resolve single bit faults and detect double bit faults. for p-flash memory, the ecc implementation requires that programming be done on an aligned 8 byte basis (a flash phrase). since p-flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 26.1.1 glossary buffer ram the buffer ram constitutes the volatile memory store required for eee. memory space in the buffer ram not required for eee can be partitioned to provide volatile memory space for applications. command write sequence ?an mcu instruction sequence to execute built-in algorithms (including program and erase) on the flash memory. d-flash memory ?the d-flash memory constitutes the nonvolatile memory store required for eee. memory space in the d-flash memory not required for eee can be partitioned to provide nonvolatile memory space for applications. d-flash sector the d-flash sector is the smallest portion of the d-flash memory that can be erased. the d-flash sector consists of four 64 byte rows for a total of 256 bytes. chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 953 eee (emulated eeprom) ?a method to emulate the small sector size features and endurance characteristics associated with an eeprom. eee ifr nonvolatile information register located in the d-flash block that contains data required to partition the d-flash memory and buffer ram for eee. the eee ifr is visible in the global memory map by setting the eeeifron bit in the mmcctl1 register. nvm command mode an nvm mode using the cpu to setup the fccob register to pass parameters required for flash command execution. phrase an aligned group of four 16-bit words within the p-flash memory. each phrase includes eight ecc bits for single bit fault correction and double bit fault detection within the phrase. p-flash memory the p-flash memory constitutes the main nonvolatile memory store for applications. p-flash sector ?the p-flash sector is the smallest portion of the p-flash memory that can be erased. each p-flash sector contains 1024 bytes. program ifr ?nonvolatile information register located in the p-flash block that contains the device id, version id, and the program once ?ld. the program ifr is visible in the global memory map by setting the pgmifron bit in the mmcctl1 register. 26.1.2 features 26.1.2.1 p-flash features 384 kbytes of p-flash memory composed of one 256 kbyte flash block and one 128 kbyte flash block. the 256 kbyte flash block consists of two 128 kbyte sections each divided into 128 sectors of 1024 bytes. the 128 kbyte flash block is divided into 128 sectors of 1024 bytes. single bit fault correction and double bit fault detection within a 64-bit phrase during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and phrase program operation ability to program up to one phrase in each p-flash block simultaneously flexible protection scheme to prevent accidental program or erase of p-flash memory 26.1.2.2 d-flash features up to 32 kbytes of d-flash memory with 256 byte sectors for user access dedicated commands to control access to the d-flash memory over eee operation single bit fault correction and double bit fault detection within a word during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and word program operation ability to program up to four words in a burst sequence chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 954 freescale semiconductor 26.1.2.3 emulated eeprom features up to 4 kbytes of emulated eeprom (eee) accessible as 4 kbytes of ram flexible protection scheme to prevent accidental program or erase of data automatic eee ?e handling using an internal memory controller automatic transfer of valid eee data from d-flash memory to buffer ram on reset ability to monitor the number of outstanding eee related buffer ram words left to be programmed into d-flash memory ability to disable eee operation and allow priority access to the d-flash memory ability to cancel all pending eee operations and allow priority access to the d-flash memory 26.1.2.4 user buffer ram features up to 4 kbytes of ram for user access 26.1.2.5 other flash module features no external high-voltage power supply required for flash memory program and erase operations interrupt generation on flash command completion and flash error detection security mechanism to prevent unauthorized access to the flash memory 26.1.3 block diagram the block diagram of the flash module is shown in figure 26-1 . chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 955 figure 26-1. ftm384k2 block diagram 26.2 external signal description the flash module contains no signals that connect off-chip. oscillator clock divider clock (xtal) command interrupt request fclk protection security registers flash interface p-flash block 0 32kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 p-flash sector 0 sector 1 sector 127 16kx72 16bit internal bus block 1 xgate 16kx72 16kx72 error interrupt request cpu memory controller d-flash 16kx22 buffer ram tag ram 128x16 2kx16 sector 0 sector 1 sector 127 scratch ram 512x16 chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 956 freescale semiconductor 26.3 memory map and registers this section describes the memory map and registers for the flash module. read data from unimplemented memory space in the flash module is unde?ed. write access to unimplemented or reserved memory space in the flash module will be ignored by the flash module. 26.3.1 module memory map the s12x architecture places the p-flash memory between global addresses 0x78_0000 and 0x7f_ffff as shown in table 26-2 . the p-flash memory map is shown in figure 26-2 . the fprot register, described in section 26.3.2.9 , can be set to protect regions in the flash memory from accidental program or erase. three separate memory regions, one growing upward from global address 0x7f_8000 in the flash memory (called the lower region), one growing downward from global address 0x7f_ffff in the flash memory (called the higher region), and the remaining addresses in the flash memory, can be activated for protection. the flash memory addresses covered by these protectable regions are shown in the p-flash memory map. the higher address region is mainly targeted to hold the boot loader code since it covers the vector space. default protection settings as well as security information that allows the mcu to restrict access to the flash module are stored in the flash con?uration ?ld as described in table 26-3 . table 26-2. p-flash memory addressing global address size (bytes) description 0x7c_0000 ?0x7f_ffff 256 k p-flash block 0 contains flash con?uration field (see table 26-3 ) 0x7a_0000 ?0x7b_ffff 128 k no p-flash memory 0x78_0000 ?0x79_ffff 128 k p-flash block 1 table 26-3. flash con?uration field (1) global address size (bytes) description 0x7f_ff00 ?0x7f_ff07 8 backdoor comparison key refer to section 26.4.2.12, ?erify backdoor access key command , and section 26.5.1, ?nsecuring the mcu using backdoor key access 0x7f_ff08 0x7f_ff0b (2) 4 reserved 0x7f_ff0c 2 1 p-flash protection byte . refer to section 26.3.2.9, ?-flash protection register (fprot) 0x7f_ff0d 2 1 eee protection byte refer to section 26.3.2.10, ?ee protection register (eprot) 0x7f_ff0e 2 1 flash nonvolatile byte refer to section 26.3.2.14, ?lash option register (fopt) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 957 0x7f_ff0f 2 1 flash security byte refer to section 26.3.2.2, ?lash security register (fsec) 1. older versions may have swapped protection byte addresses 2. 0x7ff08 - 0x7f_ff0f form a flash phrase and must be programmed in a single command write sequence. each byte in the 0x7f_ff08 - 0x7f_ff0b reserved ?ld should be programmed to 0xff. table 26-3. flash con?uration field (1) global address size (bytes) description chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 958 freescale semiconductor figure 26-2. p-flash memory map flash con?uration field 0x7f_c000 flash protected/unprotected lower region 1, 2, 4, 8 kbytes 0x7f_8000 0x7f_9000 0x7f_8400 0x7f_8800 0x7f_a000 p-flash end = 0x7f_ffff 0x7f_f800 0x7f_f000 0x7f_e000 flash protected/unprotected higher region 2, 4, 8, 16 kbytes flash protected/unprotected region 8 kbytes (up to 29 kbytes) 16 bytes (0x7f_ff00 - 0x7f_ff0f) flash protected/unprotected region 352 kbytes p-flash start = 0x78_0000 0x79_ffff 0x7c_0000 chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 959 table 26-4. program ifr fields global address (pgmifron) size (bytes) field description 0x40_0000 ?0x40_0007 8 device id 0x40_0008 ?0x40_00e7 224 reserved 0x40_00e8 ?0x40_00e9 2 version id 0x40_00ea ?0x40_00ff 22 reserved 0x40_0100 ?0x40_013f 64 program once field refer to section 26.4.2.7, ?rogram once command 0x40_0140 ?0x40_01ff 192 reserved table 26-5. p-flash ifr accessibility global address (pgmifron) size (bytes) accessed from 0x40_0000 ?0x40_01ff 512 xbus0 (pblk0) (1) 1. refer to table 26-4 for more details. 0x40_0200 ?0x40_03ff 512 unimplemented 0x40_0400 ?0x40_05ff 512 unimplemented 0x40_0600 ?0x40_07ff 512 xbus1 (pblk1) table 26-6. eee resource fields global address size (bytes) description 0x10_0000 ?0x10_7fff 32,768 d-flash memory (user and eee) 0x10_8000 ?0x11_ffff 98,304 reserved 0x12_0000 ?0x12_007f 128 eee nonvolatile information register (eeeifron (1) = 1) 1. mmcctl1 register bit 0x12_0080 ?0x12_0fff 3,968 reserved 0x12_1000 ?0x12_1eff 3,840 reserved 0x12_1f00 ?0x12_1fff 256 eee tag ram (tmgramon 1 = 1) 0x12_2000 ?0x12_3bff 7,168 reserved 0x12_3c00 ?0x12_3fff 1,024 memory controller scratch ram (tmgramon 1 = 1) 0x12_4000 ?0x12_dfff 40,960 reserved 0x12_e000 ?0x12_ffff 8,192 reserved 0x13_0000 ?0x13_efff 61,440 reserved 0x13_f000 ?0x13_ffff 4,096 buffer ram (user and eee) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 960 freescale semiconductor figure 26-3. eee resource memory map the full partition d-flash command (see section 26.4.2.15 ) is used to program the eee nonvolatile information register ?lds where address 0x12_0000 de?es the d-flash partition for user access and address 0x12_0004 de?es the buffer ram partition for eee operations. buffer ram start = 0x13_f000 buffer ram end = 0x13_ffff 0x13_ffc0 0x13_ff80 protectable region (eee only) 64, 128, 192, 256, 320, 384, 448, 512 bytes buffer ram 4 kbytes 0x13_ff40 0x13_ff00 0x13_fec0 0x13_fe80 0x13_fe40 0x13_fe00 0x12_ffff 0x12_4000 0x12_1000 memory controller scratch ram (tmgramon) 1024 bytes eee tag ram (tmgramon) 256 bytes eee nonvolatile information register (eeeifron) 128 bytes d-flash memory 32 kbytes d-flash start = 0x10_0000 d-flash user partition d-flash eee partition 0x12_0000 0x12_2000 0x12_e000 d-flash end = 0x10_7fff buffer ram user partition buffer ram eee partition chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 961 26.3.2 register descriptions the flash module contains a set of 20 control and status registers located between flash module base + 0x0000 and 0x0013. a summary of the flash module registers is given in figure 26-4 with detailed descriptions in the following subsections. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. table 26-7. eee nonvolatile information register fields global address (eeeifron) size (bytes) description 0x12_0000 ?0x12_0001 2 d-flash user partition (dfpart) refer to section 26.4.2.15, ?ull partition d-flash command 0x12_0002 ?0x12_0003 2 d-flash user partition (duplicate (1) ) 1. duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 ?0x12_0005 2 buffer ram eee partition (erpart) refer to section 26.4.2.15, ?ull partition d-flash command 0x12_0006 ?0x12_0007 2 buffer ram eee partition (duplicate 1 ) 0x12_0008 ?0x12_007f 120 reserved address & name 76543210 0x0000 fclkdiv r fdivld fdiv6 fdiv5 fdiv4 fdiv3 fdiv2 fdiv1 fdiv0 w 0x0001 fsec r keyen1 keyen0 rnv5 rnv4 rnv3 rnv2 sec1 sec0 w 0x0002 fccobix r0 0 0 0 0 ccobix2 ccobix1 ccobix0 w 0x0003 feccrix r0 0 0 0 0 eccrix2 eccrix1 eccrix0 w 0x0004 fcnfg r ccie 00 ignsf 00 fdfd fsfd w 0x0005 fercnfg r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w figure 26-4. ftm384k2 register summary chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 962 freescale semiconductor 0x0006 fstat r ccif 0 accerr fpviol mgbusy rsvd mgstat1 mgstat0 w 0x0007 ferstat r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w 0x0008 fprot r fpopen rnv6 fphdis fphs1 fphs0 fpldis fpls1 fpls0 w 0x0009 eprot r epopen rnv6 rnv5 rnv4 epdis eps2 eps1 eps0 w 0x000a fccobhi r ccob15 ccob14 ccob13 ccob12 ccob11 ccob10 ccob9 ccob8 w 0x000b fccoblo r ccob7 ccob6 ccob5 ccob4 ccob3 ccob2 ccob1 ccob0 w 0x000c etaghi r etag15 etag14 etag13 etag12 etag11 etag10 etag9 etag8 w 0x000d etaglo r etag7 etag6 etag5 etag4 etag3 etag2 etag1 etag0 w 0x000e feccrhi r eccr15 eccr14 eccr13 eccr12 eccr11 eccr10 eccr9 eccr8 w 0x000f feccrlo r eccr7 eccr6 eccr5 eccr4 eccr3 eccr2 eccr1 eccr0 w 0x0010 fopt r nv7 nv6 nv5 nv4 nv3 nv2 nv1 nv0 w 0x0011 frsv0 r00000000 w 0x0012 frsv1 r00000000 w 0x0013 frsv2 r00000000 w address & name 76543210 figure 26-4. ftm384k2 register summary (continued) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 963 26.3.2.1 flash clock divider register (fclkdiv) the fclkdiv register is used to control timed events in program and erase algorithms. all bits in the fclkdiv register are readable, bits 6? are write once and bit 7 is not writable. caution the fclkdiv register should never be written while a flash command is executing (ccif=0). the fclkdiv register is writable during the flash reset sequence even though ccif is clear. = unimplemented or reserved offset module base + 0x0000 76543210 r fdivld fdiv[6:0] w reset 00000000 = unimplemented or reserved figure 26-5. flash clock divider register (fclkdiv) table 26-8. fclkdiv field descriptions field description 7 fdivld clock divider loaded 0 fclkdiv register has not been written 1 fclkdiv register has been written since the last reset 6? fdiv[6:0] clock divider bits ?fdiv[6:0] must be set to effectively divide oscclk down to generate an internal flash clock, fclk, with a target frequency of 1 mhz for use by the flash module to control timed events during program and erase algorithms. table 26-9 shows recommended values for fdiv[6:0] based on oscclk frequency. please refer to section 26.4.1, ?lash command operations , for more information. address & name 76543210 figure 26-4. ftm384k2 register summary (continued) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 964 freescale semiconductor table 26-9. fdiv vs oscclk frequency oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] min (1) 1. fdiv shown generates an fclk frequency of >0.8 mhz max (2) min 1 max 2 min 1 max 2 33.60 34.65 0x20 67.20 68.25 0x40 1.60 2.10 0x01 34.65 35.70 0x21 68.25 69.30 0x41 2.40 3.15 0x02 35.70 36.75 0x22 69.30 70.35 0x42 3.20 4.20 0x03 36.75 37.80 0x23 70.35 71.40 0x43 4.20 5.25 0x04 37.80 38.85 0x24 71.40 72.45 0x44 5.25 6.30 0x05 38.85 39.90 0x25 72.45 73.50 0x45 6.30 7.35 0x06 39.90 40.95 0x26 73.50 74.55 0x46 7.35 8.40 0x07 40.95 42.00 0x27 74.55 75.60 0x47 8.40 9.45 0x08 42.00 43.05 0x28 75.60 76.65 0x48 9.45 10.50 0x09 43.05 44.10 0x29 76.65 77.70 0x49 10.50 11.55 0x0a 44.10 45.15 0x2a 77.70 78.75 0x4a 11.55 12.60 0x0b 45.15 46.20 0x2b 78.75 79.80 0x4b 12.60 13.65 0x0c 46.20 47.25 0x2c 79.80 80.85 0x4c 13.65 14.70 0x0d 47.25 48.30 0x2d 80.85 81.90 0x4d 14.70 15.75 0x0e 48.30 49.35 0x2e 81.90 82.95 0x4e 15.75 16.80 0x0f 49.35 50.40 0x2f 82.95 84.00 0x4f 16.80 17.85 0x10 50.40 51.45 0x30 84.00 85.05 0x50 17.85 18.90 0x11 51.45 52.50 0x31 85.05 86.10 0x51 18.90 19.95 0x12 52.50 53.55 0x32 86.10 87.15 0x52 19.95 21.00 0x13 53.55 54.60 0x33 87.15 88.20 0x53 21.00 22.05 0x14 54.60 55.65 0x34 88.20 89.25 0x54 22.05 23.10 0x15 55.65 56.70 0x35 89.25 90.30 0x55 23.10 24.15 0x16 56.70 57.75 0x36 90.30 91.35 0x56 24.15 25.20 0x17 57.75 58.80 0x37 91.35 92.40 0x57 25.20 26.25 0x18 58.80 59.85 0x38 92.40 93.45 0x58 26.25 27.30 0x19 59.85 60.90 0x39 93.45 94.50 0x59 27.30 28.35 0x1a 60.90 61.95 0x3a 94.50 95.55 0x5a 28.35 29.40 0x1b 61.95 63.00 0x3b 95.55 96.60 0x5b 29.40 30.45 0x1c 63.00 64.05 0x3c 96.60 97.65 0x5c 30.45 31.50 0x1d 64.05 65.10 0x3d 97.65 98.70 0x5d 31.50 32.55 0x1e 65.10 66.15 0x3e 98.70 99.75 0x5e 32.55 33.60 0x1f 66.15 67.20 0x3f 99.75 100.80 0x5f chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 965 26.3.2.2 flash security register (fsec) the fsec register holds all bits associated with the security of the mcu and flash module. all bits in the fsec register are readable but not writable. during the reset sequence, the fsec register is loaded with the contents of the flash security byte in the flash configuration field at global address 0x7f_ff0f located in p-flash memory (see table 26-3 ) as indicated by reset condition f in figure 26-6 . if a double bit fault is detected while reading the p-flash phrase containing the flash security byte during the reset sequence, all bits in the fsec register will be set to leave the flash module in a secured state with backdoor key access disabled. 2. fdiv shown generates an fclk frequency of 1.05 mhz offset module base + 0x0001 76543210 r keyen[1:0] rnv[5:2] sec[1:0] w reset f f ffffff = unimplemented or reserved figure 26-6. flash security register (fsec) table 26-10. fsec field descriptions field description 7? keyen[1:0] backdoor key security enable bits the keyen[1:0] bits de?e the enabling of backdoor key access to the flash module as shown in table 26-11 . 5? rnv[5:2} reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements. 1? sec[1:0] flash security bits ?the sec[1:0] bits de?e the security state of the mcu as shown in table 26-12 . if the flash module is unsecured using backdoor key access, the sec bits are forced to 10. table 26-11. flash keyen states keyen[1:0] status of backdoor key access 00 disabled 01 disabled (1) 1. preferred keyen state to disable backdoor key access. 10 enabled 11 disabled chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 966 freescale semiconductor the security function in the flash module is described in section 26.5 . 26.3.2.3 flash ccob index register (fccobix) the fccobix register is used to index the fccob register for flash memory operations. ccobix bits are readable and writable while remaining bits read 0 and are not writable. 26.3.2.4 flash eccr index register (feccrix) the feccrix register is used to index the feccr register for ecc fault reporting. eccrix bits are readable and writable while remaining bits read 0 and are not writable. table 26-12. flash security states sec[1:0] status of security 00 secured 01 secured (1) 1. preferred sec state to set mcu to secured state. 10 unsecured 11 secured offset module base + 0x0002 76543210 r00000 ccobix[2:0] w reset 00000000 = unimplemented or reserved figure 26-7. fccob index register (fccobix) table 26-13. fccobix field descriptions field description 2? ccobix[1:0] common command register index the ccobix bits are used to select which word of the fccob register array is being read or written to. see section 26.3.2.11, ?lash common command object register (fccob) , for more details. offset module base + 0x0003 76543210 r00000 eccrix[2:0] w reset 00000000 = unimplemented or reserved figure 26-8. feccr index register (feccrix) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 967 26.3.2.5 flash con?uration register (fcnfg) the fcnfg register enables the flash command complete interrupt and forces ecc faults on flash array read access from the cpu or xgate. ccie, ignsf, fdfd, and fsfd bits are readable and writable while remaining bits read 0 and are not writable. table 26-14. feccrix field descriptions field description 2-0 eccrix[2:0] ecc error register index ?the eccrix bits are used to select which word of the feccr register array is being read. see section 26.3.2.13, ?lash ecc error results register (feccr) , for more details. offset module base + 0x0004 76543210 r ccie 00 ignsf 00 fdfd fsfd w reset 00000000 = unimplemented or reserved figure 26-9. flash con?uration register (fcnfg) table 26-15. fcnfg field descriptions field description 7 ccie command complete interrupt enable ?the ccie bit controls interrupt generation when a flash command has completed. 0 command complete interrupt disabled 1 an interrupt will be requested whenever the ccif ?g in the fstat register is set (see section 26.3.2.7 ) 4 ignsf ignore single bit fault ?the ignsf controls single bit fault reporting in the ferstat register (see section 26.3.2.8 ). 0 all single bit faults detected during array reads are reported 1 single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 968 freescale semiconductor 26.3.2.6 flash error con?uration register (fercnfg) the fercnfg register enables the flash error interrupts for the ferstat flags. all assigned bits in the fercnfg register are readable and writable. 1 fdfd force double bit fault detect the fdfd bit allows the user to simulate a double bit fault during flash array read operations and check the associated interrupt routine. the fdfd bit is cleared by writing a 0 to fdfd. the feccr registers will not be updated during the flash array read operation with fdfd set unless an actual double bit fault is detected. 0 flash array read operations will set the dfdif ?g in the ferstat register only if a double bit fault is detected 1 any flash array read operation will force the dfdif ?g in the ferstat register to be set (see section 26.3.2.7 ) and an interrupt will be generated as long as the dfdie interrupt enable in the fercnfg register is set (see section 26.3.2.6 ) 0 fsfd force single bit fault detect the fsfd bit allows the user to simulate a single bit fault during flash array read operations and check the associated interrupt routine. the fsfd bit is cleared by writing a 0 to fsfd. the feccr registers will not be updated during the flash array read operation with fsfd set unless an actual single bit fault is detected. 0 flash array read operations will set the sfdif ?g in the ferstat register only if a single bit fault is detected 1 flash array read operation will force the sfdif ?g in the ferstat register to be set (see section 26.3.2.7 ) and an interrupt will be generated as long as the sfdie interrupt enable in the fercnfg register is set (see section 26.3.2.6 ) offset module base + 0x0005 76543210 r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w reset 00000000 = unimplemented or reserved figure 26-10. flash error con?uration register (fercnfg) table 26-16. fercnfg field descriptions field description 7 erserie eee erase error interrupt enable the erserie bit controls interrupt generation when a failure is detected during an eee erase operation. 0 erserif interrupt disabled 1 an interrupt will be requested whenever the erserif ?g is set (see section 26.3.2.8 ) 6 pgmerie eee program error interrupt enable ?the pgmerie bit controls interrupt generation when a failure is detected during an eee program operation. 0 pgmerif interrupt disabled 1 an interrupt will be requested whenever the pgmerif ?g is set (see section 26.3.2.8 ) 4 epviolie eee protection violation interrupt enable ?the epviolie bit controls interrupt generation when a protection violation is detected during a write to the buffer ram eee partition. 0 epviolif interrupt disabled 1 an interrupt will be requested whenever the epviolif ?g is set (see section 26.3.2.8 ) table 26-15. fcnfg field descriptions (continued) field description chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 969 26.3.2.7 flash status register (fstat) the fstat register reports the operational status of the flash module. ccif, accerr, and fpviol bits are readable and writable, mgbusy and mgstat bits are readable but not writable, while remaining bits read 0 and are not writable. 3 ersvie1 eee error type 1 interrupt enable the ersvie1 bit controls interrupt generation when a change state error is detected during an eee operation. 0 ersvif1 interrupt disabled 1 an interrupt will be requested whenever the ersvif1 ?g is set (see section 26.3.2.8 ) 2 ersvie0 eee error type 0 interrupt enable the ersvie0 bit controls interrupt generation when a sector format error is detected during an eee operation. 0 ersvif0 interrupt disabled 1 an interrupt will be requested whenever the ersvif0 ?g is set (see section 26.3.2.8 ) 1 dfdie double bit fault detect interrupt enable the dfdie bit controls interrupt generation when a double bit fault is detected during a flash block read operation. 0 dfdif interrupt disabled 1 an interrupt will be requested whenever the dfdif ?g is set (see section 26.3.2.8 ) 0 sfdie single bit fault detect interrupt enable the sfdie bit controls interrupt generation when a single bit fault is detected during a flash block read operation. 0 sfdif interrupt disabled whenever the sfdif ?g is set (see section 26.3.2.8 ) 1 an interrupt will be requested whenever the sfdif ?g is set (see section 26.3.2.8 ) offset module base + 0x0006 76543210 r ccif 0 accerr fpviol mgbusy rsvd mgstat[1:0] w reset 1000000 (1) 1. reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see section 26.6 ). 0 1 = unimplemented or reserved figure 26-11. flash status register (fstat) table 26-16. fercnfg field descriptions (continued) field description chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 970 freescale semiconductor 26.3.2.8 flash error status register (ferstat) the ferstat register re?cts the error status of internal flash operations. all ?gs in the ferstat register are readable and only writable to clear the ?g. table 26-17. fstat field descriptions field description 7 ccif command complete interrupt flag ?the ccif ?g indicates that a flash command has completed. the ccif ?g is cleared by writing a 1 to ccif to launch a command and ccif will stay low until command completion or command violation. 0 flash command in progress 1 flash command has completed 5 accerr flash access error flag ?the accerr bit indicates an illegal access has occurred to the flash memory caused by either a violation of the command write sequence (see section 26.4.1.2 ) or issuing an illegal flash command or when errors are encountered while initializing the eee buffer ram during the reset sequence. while accerr is set, the ccif ?g cannot be cleared to launch a command. the accerr bit is cleared by writing a 1 to accerr. writing a 0 to the accerr bit has no effect on accerr. 0 no access error detected 1 access error detected 4 fpviol flash protection violation flag ?he fpviol bit indicates an attempt was made to program or erase an address in a protected area of p-flash memory during a command write sequence. the fpviol bit is cleared by writing a 1 to fpviol. writing a 0 to the fpviol bit has no effect on fpviol. while fpviol is set, it is not possible to launch a command or start a command write sequence. 0 no protection violation detected 1 protection violation detected 3 mgbusy memory controller busy flag ?the mgbusy ?g re?cts the active state of the memory controller . 0 memory controller is idle 1 memory controller is busy executing a flash command (ccif = 0) or is handling internal eee operations 2 rsvd reserved bit ?this bit is reserved and always reads 0 . 1? mgstat[1:0] memory controller command completion status flag one or more mgstat ?g bits are set if an error is detected during execution of a flash command or during the flash reset sequence. see section 26.4.2, ?lash command description , and section 26.6, ?nitialization ?for details. offset module base + 0x0007 76543210 r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w reset 00000000 = unimplemented or reserved figure 26-12. flash error status register (ferstat) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 971 26.3.2.9 p-flash protection register (fprot) the fprot register defines which p-flash sectors are protected against program and erase operations. table 26-18. ferstat field descriptions field description 7 erserif eee erase error interrupt flag ?the setting of the erserif ?g occurs due to an error in a flash erase command that resulted in the erase operation not being successful during eee operations. the erserif ?g is cleared by writing a 1 to erserif. writing a 0 to the erserif ?g has no effect on erserif. while erserif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 erase command successfully completed on the d-flash eee partition 1 erase command failed on the d-flash eee partition 6 pgmerif eee program error interrupt flag ?the setting of the pgmerif ?g occurs due to an error in a flash program command that resulted in the program operation not being successful during eee operations. the pgmerif ?g is cleared by writing a 1 to pgmerif. writing a 0 to the pgmerif ?g has no effect on pgmerif. while pgmerif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 program command successfully completed on the d-flash eee partition 1 program command failed on the d-flash eee partition 4 epviolif eee protection violation interrupt flag ?he setting of the epviolif ?g indicates an attempt was made to write to a protected area of the buffer ram eee partition. the epviolif ?g is cleared by writing a 1 to epviolif. writing a 0 to the epviolif ?g has no effect on epviolif. while epviolif is set, it is possible to write to the buffer ram eee partition as long as the address written to is not in a protected area. 0 no eee protection violation 1 eee protection violation detected 3 ersvif1 eee error interrupt 1 flag ?he setting of the ersvif1 ?g indicates that the memory controller was unable to change the state of a d-flash eee sector. the ersvif1 ?g is cleared by writing a 1 to ersvif1. writing a 0 to the ersvif1 ?g has no effect on ersvif1. while ersvif1 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector state change error detected 1 eee sector state change error detected 2 ersvif0 eee error interrupt 0 flag ?he setting of the ersvif0 ?g indicates that the memory controller was unable to format a d-flash eee sector for eee use. the ersvif0 ?g is cleared by writing a 1 to ersvif0. writing a 0 to the ersvif0 ?g has no effect on ersvif0. while ersvif0 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector format error detected 1 eee sector format error detected 1 dfdif double bit fault detect interrupt flag ?the setting of the dfdif ?g indicates that a double bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the dfdif ?g is cleared by writing a 1 to dfdif. writing a 0 to dfdif has no effect on dfdif. 0 no double bit fault detected 1 double bit fault detected or an invalid flash array read operation attempted 0 sfdif single bit fault detect interrupt flag ?with the ignsf bit in the fcnfg register clear, the sfdif ?g indicates that a single bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the sfdif ?g is cleared by writing a 1 to sfdif. writing a 0 to sfdif has no effect on sfdif. 0 no single bit fault detected 1 single bit fault detected and corrected or an invalid flash array read operation attempted chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 972 freescale semiconductor the (unreserved) bits of the fprot register are writable with the restriction that the size of the protected region can only be increased (see section 26.3.2.9.1, ?-flash protection restrictions , and table 26-23 ). during the reset sequence, the fprot register is loaded with the contents of the p-flash protection byte in the flash configuration field at global address 0x7f_ff0c located in p-flash memory (see table 26-3 ) as indicated by reset condition ??in figure 26-13 . to change the p-flash protection that will be loaded during the reset sequence, the upper sector of the p-flash memory must be unprotected, then the p-flash protection byte must be reprogrammed. if a double bit fault is detected while reading the p-flash phrase containing the p-flash protection byte during the reset sequence, the fpopen bit will be cleared and remaining bits in the fprot register will be set to leave the p-flash memory fully protected. trying to alter data in any protected area in the p-flash memory will result in a protection violation error and the fpviol bit will be set in the fstat register. the block erase of a p-flash block is not possible if any of the p-flash sectors contained in the same p-flash block are protected. offset module base + 0x0008 76543210 r fpopen rnv6 fphdis fphs[1:0] fpldis fpls[1:0] w reset f f ffffff = unimplemented or reserved figure 26-13. flash protection register (fprot) table 26-19. fprot field descriptions field description 7 fpopen flash protection operation enable ?the fpopen bit determines the protection function for program or erase operations as shown in table 26-20 for the p-flash block. 0 when fpopen is clear, the fphdis and fpldis bits de?e unprotected address ranges as speci?d by the corresponding fphs and fpls bits 1 when fpopen is set, the fphdis and fpldis bits enable protection for the address range speci?d by the corresponding fphs and fpls bits 6 rnv[6] reserved nonvolatile bit ?the rnv bit should remain in the erased state for future enhancements. 5 fphdis flash protection higher address range disable ?the fphdis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory ending with global address 0x7f_ffff. 0 protection/unprotection enabled 1 protection/unprotection disabled 4? fphs[1:0] flash protection higher address size the fphs bits determine the size of the protected/unprotected area in p-flash memory as shown in table 26-21 . the fphs bits can only be written to while the fphdis bit is set. 2 fpldis flash protection lower address range disable ?the fpldis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory beginning with global address 0x7f_8000. 0 protection/unprotection enabled 1 protection/unprotection disabled 1? fpls[1:0] flash protection lower address size the fpls bits determine the size of the protected/unprotected area in p-flash memory as shown in table 26-22 . the fpls bits can only be written to while the fpldis bit is set. chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 973 all possible p-flash protection scenarios are shown in figure 26-14 . although the protection scheme is loaded from the flash memory at global address 0x7f_ff0c during the reset sequence, it can be changed by the user. the p-flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. table 26-20. p-flash protection function fpopen fphdis fpldis function (1) 1. for range sizes, refer to table 26-21 and table 26-22 . 1 1 1 no p-flash protection 1 1 0 protected low range 1 0 1 protected high range 1 0 0 protected high and low ranges 0 1 1 full p-flash memory protected 0 1 0 unprotected low range 0 0 1 unprotected high range 0 0 0 unprotected high and low ranges table 26-21. p-flash protection higher address range fphs[1:0] global address range protected size 00 0x7f_f800?x7f_ffff 2 kbytes 01 0x7f_f000?x7f_ffff 4 kbytes 10 0x7f_e000?x7f_ffff 8 kbytes 11 0x7f_c000?x7f_ffff 16 kbytes table 26-22. p-flash protection lower address range fpls[1:0] global address range protected size 00 0x7f_8000?x7f_83ff 1 kbyte 01 0x7f_8000?x7f_87ff 2 kbytes 10 0x7f_8000?x7f_8fff 4 kbytes 11 0x7f_8000?x7f_9fff 8 kbytes chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 974 freescale semiconductor figure 26-14. p-flash protection scenarios 7 6 5 4 fphs[1:0] fpls[1:0] 3 2 1 0 fphs[1:0] fpls[1:0] fphdis = 1 fpldis = 1 fphdis = 1 fpldis = 0 fphdis = 0 fpldis = 1 fphdis = 0 fpldis = 0 scenario scenario unprotected region protected region with size protected region protected region with size defined by fpls defined by fphs not defined by fpls, fphs 0x7f_8000 0x7f_ffff 0x7f_8000 0x7f_ffff flash start flash start fpopen = 1 fpopen = 0 chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 975 26.3.2.9.1 p-flash protection restrictions the general guideline is that p-flash protection can only be added and not removed. table 26-23 specifies all valid transitions between p-flash protection scenarios. any attempt to write an invalid scenario to the fprot register will be ignored. the contents of the fprot register reflect the active protection scenario. see the fphs and fpls bit descriptions for additional restrictions. 26.3.2.10 eee protection register (eprot) the eprot register de?es which buffer ram eee partition areas are protected against writes. all bits in the eprot register are readable and writable except for rnv[6:4] which are only readable. the epopen and epdis bits can only be written to the protected state. the eps bits can be written anytime until the epdis bit is cleared. if the epopen bit is cleared, the state of the epdis and eps bits is irrelevant. during the reset sequence, the eprot register is loaded from the eee protection byte in the flash configuration field at global address 0x7f_ff0d located in p-flash memory (see table 26-3 ) as indicated by reset condition f in figure 26-15 . to change the eee protection that will be loaded during the reset sequence, the p-flash sector containing the eee protection byte must be unprotected, then the eee protection byte must be programmed. if a double bit fault is detected while reading the p-flash phrase table 26-23. p-flash protection scenario transitions from protection scenario to protection scenario (1) 1. allowed transitions marked with x, see figure 26-14 for a de?ition of the scenarios. 01234567 0 xxxx 1 xx 2 xx 3 x 4 xx 5 xxxx 6 xxxx 7 xxxxxxxx offset module base + 0x0009 76543210 r epopen rnv[6:4] epdis eps[2:0] w reset f f ffffff = unimplemented or reserved figure 26-15. eee protection register (eprot) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 976 freescale semiconductor containing the eee protection byte during the reset sequence, the epopen bit will be cleared and remaining bits in the eprot register will be set to leave the buffer ram eee partition fully protected. trying to write data to any protected area in the buffer ram eee partition will result in a protection violation error and the epviolif ?g will be set in the ferstat register. trying to write data to any protected area in the buffer ram partitioned for user access will not be prevented and the epviolif ?g in the ferstat register will not set. 26.3.2.11 flash common command object register (fccob) the fccob is an array of six words addressed via the ccobix index found in the fccobix register. byte wide reads and writes are allowed to the fccob register. table 26-24. eprot field descriptions field description 7 epopen enables writes to the buffer ram partitioned for eee 0 the entire buffer ram eee partition is protected from writes 1 unprotected buffer ram eee partition areas are enabled for writes 6? rnv[6:4] reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements 3 epdis buffer ram protection address range disable ?the epdis bit determines whether there is a protected area in a speci? region of the buffer ram eee partition. 0 protection enabled 1 protection disabled 2? eps[2:0] buffer ram protection size ?the eps[2:0] bits determine the size of the protected area in the buffer ram eee partition as shown in table 26-21 . the eps bits can only be written to while the epdis bit is set. table 26-25. buffer ram eee partition protection address range eps[2:0] global address range protected size 000 0x13_ffc0 ?0x13_ffff 64 bytes 001 0x13_ff80 ?0x13_ffff 128 bytes 010 0x13_ff40 ?0x13_ffff 192 bytes 011 0x13_ff00 ?0x13_ffff 256 bytes 100 0x13_fec0 ?0x13_ffff 320 bytes 101 0x13_fe80 ?0x13_ffff 384 bytes 110 0x13_fe40 ?0x13_ffff 448 bytes 111 0x13_fe00 ?0x13_ffff 512 bytes chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 977 26.3.2.11.1 fccob - nvm command mode nvm command mode uses the indexed fccob register to provide a command code and its relevant parameters to the memory controller. the user first sets up all required fccob fields and then initiates the command? execution by writing a 1 to the ccif bit in the fstat register (a 1 written by the user clears the ccif command completion flag to 0). when the user clears the ccif bit in the fstat register all fccob parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the memory controller returning ccif to 1). some commands return information to the fccob register array. the generic format for the fccob parameter fields in nvm command mode is shown in table 26-26 . the return values are available for reading after the ccif flag in the fstat register has been returned to 1 by the memory controller. writes to the unimplemented parameter fields (ccobix = 110 and ccobix = 111) are ignored with reads from these fields returning 0x0000. table 26-26 shows the generic flash command format. the high byte of the first word in the ccob array contains the command code, followed by the parameters for this specific flash command. for details on the fccob settings required by each command, see the flash command descriptions in section 26.4.2 . offset module base + 0x000a 76543210 r ccob[15:8] w reset 00000000 figure 26-16. flash common command object high register (fccobhi) offset module base + 0x000b 76543210 r ccob[7:0] w reset 00000000 figure 26-17. flash common command object low register (fccoblo) table 26-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) 000 hi fcmd[7:0] de?ing flash command lo 0, global address [22:16] 001 hi global address [15:8] lo global address [7:0] 010 hi data 0 [15:8] lo data 0 [7:0] chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 978 freescale semiconductor 26.3.2.12 eee tag counter register (etag) the etag register contains the number of outstanding words in the buffer ram eee partition that need to be programmed into the d-flash eee partition. the etag register is decremented prior to the related tagged word being programmed into the d-flash eee partition. all tagged words have been programmed into the d-flash eee partition once all bits in the etag register read 0 and the mgbusy flag in the fstat register reads 0. all etag bits are readable but not writable and are cleared by the memory controller. 26.3.2.13 flash ecc error results register (feccr) the feccr registers contain the result of a detected ecc fault for both single bit and double bit faults. the feccr register provides access to several ecc related fields as defined by the eccrix index bits in the feccrix register (see section 26.3.2.4 ). once ecc fault information has been stored, no other 011 hi data 1 [15:8] lo data 1 [7:0] 100 hi data 2 [15:8] lo data 2 [7:0] 101 hi data 3 [15:8] lo data 3 [7:0] offset module base + 0x000c 76543210 r etag[15:8] w reset 0 0 000000 = unimplemented or reserved figure 26-18. eee tag counter high register (etaghi) offset module base + 0x000d 76543210 r etag[7:0] w reset 00000000 = unimplemented or reserved figure 26-19. eee tag counter low register (etaglo) table 26-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 979 fault information will be recorded until the specific ecc fault flag has been cleared. in the event of simultaneous ecc faults, the priority for fault recording is: 1. double bit fault over single bit fault 2. cpu over xgate all feccr bits are readable but not writable. offset module base + 0x000e 76543210 r eccr[15:8] w reset 00000000 = unimplemented or reserved figure 26-20. flash ecc error results high register (feccrhi) offset module base + 0x000f 76543210 r eccr[7:0] w reset 00000000 = unimplemented or reserved figure 26-21. flash ecc error results low register (feccrlo) table 26-27. feccr index settings eccrix[2:0] feccr register content bits [15:8] bit[7] bits[6:0] 000 parity bits read from flash block cpu or xgate source identity global address [22:16] 001 global address [15:0] 010 data 0 [15:0] 011 data 1 [15:0] (p-flash only) 100 data 2 [15:0] (p-flash only) 101 data 3 [15:0] (p-flash only) 110 not used, returns 0x0000 when read 111 not used, returns 0x0000 when read chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 980 freescale semiconductor the p-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the following four words addressed by eccrix = 010 to 101 contain the 64-bit wide data phrase. the four data words and the parity byte are the uncorrected data read from the p-flash block. the d-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the uncorrected 16-bit data word is addressed by eccrix = 010. 26.3.2.14 flash option register (fopt) the fopt register is the flash option register. all bits in the fopt register are readable but are not writable. during the reset sequence, the fopt register is loaded from the flash nonvolatile byte in the flash configuration field at global address 0x7f_ff0e located in p-flash memory (see table 26-3 ) as indicated by reset condition f in figure 26-22 . if a double bit fault is detected while reading the p-flash phrase containing the flash nonvolatile byte during the reset sequence, all bits in the fopt register will be set. 26.3.2.15 flash reserved0 register (frsv0) this flash register is reserved for factory testing. table 26-28. feccr index=000 bit descriptions field description 15:8 par[7:0] ecc parity bits ?contains the 8 parity bits from the 72 bit wide p-flash data word or the 6 parity bits, allocated to par[5:0], from the 22 bit wide d-flash word with par[7:6]=00. 7 xbus01 bus source identi?r the xbus01 bit determines whether the ecc error was caused by a read access from the cpu or xgate. 0 ecc error happened on the cpu access 1 ecc error happened on the xgate access 6? gaddr[22:16] global address ?the gaddr[22:16] ?ld contains the upper seven bits of the global address having caused the error. offset module base + 0x0010 76543210 r nv[7:0] w reset f f ffffff = unimplemented or reserved figure 26-22. flash option register (fopt) table 26-29. fopt field descriptions field description 7? nv[7:0] nonvolatile bits the nv[7:0] bits are available as nonvolatile bits. refer to the device user guide for proper use of the nv bits. chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 981 all bits in the frsv0 register read 0 and are not writable. 26.3.2.16 flash reserved1 register (frsv1) this flash register is reserved for factory testing. all bits in the frsv1 register read 0 and are not writable. 26.3.2.17 flash reserved2 register (frsv2) this flash register is reserved for factory testing. all bits in the frsv2 register read 0 and are not writable. offset module base + 0x0011 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 26-23. flash reserved0 register (frsv0) offset module base + 0x0012 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 26-24. flash reserved1 register (frsv1) offset module base + 0x0013 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 26-25. flash reserved2 register (frsv2) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 982 freescale semiconductor 26.4 functional description 26.4.1 flash command operations flash command operations are used to modify flash memory contents or con?ure module resources for eee operation. the next sections describe: how to write the fclkdiv register that is used to generate a time base (fclk) derived from oscclk for flash program and erase command operations the command write sequence used to set flash command parameters and launch execution valid flash commands available for execution 26.4.1.1 writing the fclkdiv register prior to issuing any flash program or erase command after a reset, the user is required to write the fclkdiv register to divide oscclk down to a target fclk of 1 mhz. table 26-9 shows recommended values for the fdiv ?ld based on oscclk frequency. note programming or erasing the flash memory cannot be performed if the bus clock runs at less than 1 mhz. setting fdiv too high can destroy the flash memory due to overstress. setting fdiv too low can result in incomplete programming or erasure of the flash memory cells. when the fclkdiv register is written, the fdivld bit is set automatically. if the fdivld bit is 0, the fclkdiv register has not been written since the last reset. if the fclkdiv register has not been written, any flash program or erase command loaded during a command write sequence will not execute and the accerr bit in the fstat register will set. 26.4.1.2 command write sequence the memory controller will launch all valid flash commands entered using a command write sequence. before launching a command, the accerr and fpviol bits in the fstat register must be clear (see section 26.3.2.7 ) and the ccif flag should be tested to determine the status of the current command write sequence. if ccif is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the fccob register are ignored. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 983 26.4.1.2.1 de?e fccob contents the fccob parameter ?lds must be loaded with all required parameters for the flash command being executed. access to the fccob parameter ?lds is controlled via the ccobix bits in the fccobix register (see section 26.3.2.3 ). the contents of the fccob parameter ?lds are transferred to the memory controller when the user clears the ccif command completion ?g in the fstat register (writing 1 clears the ccif to 0). the ccif ?g will remain clear until the flash command has completed. upon completion, the memory controller will return ccif to 1 and the fccob register will be used to communicate any results. the ?w for a generic command write sequence is shown in figure 26-26 . chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 984 freescale semiconductor figure 26-26. generic flash command write sequence flowchart write to fccobix register write: fstat register (to launch command) clear ccif 0x80 clear accerr/fpviol 0x30 write: fstat register yes no access error and protection violation read: fstat register read: fstat register no start yes check ccif set? fccob accerr/ fpviol set? exit write: fclkdiv register read: fclkdiv register yes no clock register written check fdivld set? no bit polling for command completion check yes ccif set? to identify speci? command parameter to load. write to fccob register to load required command parameter. yes no more parameters? availability check results from previous command note: fclkdiv must be set after each reset chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 985 26.4.1.3 valid flash module commands table 26-30. flash commands by mode fcmd command unsecured secured ns (1) 1. unsecured normal single chip mode. nx (2) 2. unsecured normal expanded mode. ss (3) 3. unsecured special single chip mode. st (4) 4. unsecured special mode. ns (5) 5. secured normal single chip mode. nx (6) 6. secured normal expanded mode. ss (7) 7. secured special single chip mode. st (8) 8. secured special mode. 0x01 erase verify all blocks ???????? 0x02 erase verify block ???????? 0x03 erase verify p-flash section ????? 0x04 read once ????? 0x05 load data field ????? 0x06 program p-flash ????? 0x07 program once ????? 0x08 erase all blocks ?? ?? 0x09 erase p-flash block ????? 0x0a erase p-flash sector ????? 0x0b unsecure flash ?? ?? 0x0c verify backdoor access key ?? 0x0d set user margin level ????? 0x0e set field margin level ?? 0x0f full partition d-flash ?? 0x10 erase verify d-flash section ????? 0x11 program d-flash ????? 0x12 erase d-flash sector ????? 0x13 enable eeprom emulation ???????? 0x14 disable eeprom emulation ???????? 0x15 eeprom emulation query ???????? 0x20 partition d-flash ???????? chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 986 freescale semiconductor 26.4.1.4 p-flash commands table 26-31 summarizes the valid p-flash commands along with the effects of the commands on the p- flash block and other resources within the flash module. 26.4.1.5 d-flash and eee commands table 26-32 summarizes the valid d-flash and eee commands along with the effects of the commands on the d-flash block and eee operation. table 26-31. p-flash commands fcmd command function on p-flash memory 0x01 erase verify all blocks verify that all p-flash (and d-flash) blocks are erased. 0x02 erase verify block verify that a p-flash block is erased. 0x03 erase verify p- flash section verify that a given number of words starting at the address provided are erased. 0x04 read once read a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that was previously programmed using the program once command. 0x05 load data field load data for simultaneous multiple p-flash block operations. 0x06 program p-flash program a phrase in a p-flash block and any previously loaded phrases for any other p- flash block (see load data field command). 0x07 program once program a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that is allowed to be programmed only once. 0x08 erase all blocks erase all p-flash (and d-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x09 erase p-flash block erase a single p-flash block. an erase of the full p-flash block is only possible when fpldis, fphdis and fpopen bits in the fprot register are set prior to launching the command. 0x0a erase p-flash sector erase all bytes in a p-flash sector. 0x0b unsecure flash supports a method of releasing mcu security by erasing all p-flash (and d-flash) blocks and verifying that all p-flash (and d-flash) blocks are erased. 0x0c verify backdoor access key supports a method of releasing mcu security by verifying a set of security keys. 0x0d set user margin level speci?s a user margin read level for all p-flash blocks. 0x0e set field margin level speci?s a ?ld margin read level for all p-flash blocks (special modes only). table 26-32. d-flash commands fcmd command function on d-flash memory 0x01 erase verify all blocks verify that all d-flash (and p-flash) blocks are erased. 0x02 erase verify block verify that the d-flash block is erased. chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 987 26.4.2 flash command description this section provides details of all available flash commands launched by a command write sequence. the accerr bit in the fstat register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the memory controller: starting any command write sequence that programs or erases flash memory before initializing the fclkdiv register writing an invalid command as part of the command write sequence for additional possible errors, refer to the error handling table provided for each command if a flash block is read during execution of an algorithm (ccif = 0) on that same block, the read operation will return invalid data. if the sfdif or dfdif flags were not previously set when the invalid read operation occurred, both the sfdif and dfdif flags will be set and the feccr registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. if the accerr or fpviol bits are set in the fstat register, the user must clear these bits before starting any command write sequence (see section 26.3.2.7 ). 0x08 erase all blocks erase all d-flash (and p-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x0b unsecure flash supports a method of releasing mcu security by erasing all d-flash (and p-flash) blocks and verifying that all d-flash (and p-flash) blocks are erased. 0x0d set user margin level speci?s a user margin read level for the d-flash block. 0x0e set field margin level speci?s a ?ld margin read level for the d-flash block (special modes only). 0x0f full partition d- flash erase the d-flash block and partition an area of the d-flash block for user access. 0x10 erase verify d- flash section verify that a given number of words starting at the address provided are erased. 0x11 program d-flash program up to four words in the d-flash block. 0x12 erase d-flash sector erase all bytes in a sector of the d-flash block. 0x13 enable eeprom emulation enable eeprom emulation where writes to the buffer ram eee partition will be copied to the d-flash eee partition. 0x14 disable eeprom emulation suspend all current erase and program activity related to eeprom emulation but leave current eee tags set. 0x15 eeprom emulation query returns eee partition and status variables. 0x20 partition d-flash partition an area of the d-flash block for user access. table 26-32. d-flash commands fcmd command function on d-flash memory chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 988 freescale semiconductor caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. 26.4.2.1 erase verify all blocks command the erase verify all blocks command will verify that all p-flash and d-flash blocks have been erased. upon clearing ccif to launch the erase verify all blocks command, the memory controller will verify that the entire flash memory space is erased. the ccif ?g will set after the erase verify all blocks operation has completed. 26.4.2.2 erase verify block command the erase verify block command allows the user to verify that an entire p-flash or d-flash block has been erased. the fccob upper global address bits determine which block must be veri?d. upon clearing ccif to launch the erase verify block command, the memory controller will verify that the selected p-flash or d-flash block is erased. the ccif ?g will set after the erase verify block operation has completed. table 26-33. erase verify all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x01 not required table 26-34. erase verify all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active fpviol none mgstat1 set if any errors have been encountered during the read (1) 1. as found in the memory map for ftm512k3. mgstat0 set if any non-correctable errors have been encountered during the read 1 ferstat epviolif none table 26-35. erase verify block command fccob requirements ccobix[2:0] fccob parameters 000 0x02 global address [22:16] of the flash block to be veri?d . chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 989 26.4.2.3 erase verify p-flash section command the erase verify p-flash section command will verify that a section of code in the p-flash memory is erased. the erase verify p-flash section command defines the starting point of the code to be verified and the number of phrases. the section to be verified cannot cross a 256 kbyte boundary in the p-flash memory space. upon clearing ccif to launch the erase verify p-flash section command, the memory controller will verify the selected section of flash memory is erased. the ccif ?g will set after the erase verify p-flash section operation has completed. table 26-36. erase verify block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm512k3. fpviol none mgstat1 set if any errors have been encountered during the read (2) 2. as found in the memory map for ftm512k3. mgstat0 set if any non-correctable errors have been encountered during the read 2 ferstat epviolif none table 26-37. erase verify p-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x03 global address [22:16] of a p-flash block 001 global address [15:0] of the ?st phrase to be veri?d 010 number of phrases to be veri?d chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 990 freescale semiconductor 26.4.2.4 read once command the read once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of p-flash block 0. the read once field is programmed using the program once command described in section 26.4.2.7 . the read once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the read once command, a read once phrase is fetched and stored in the fccob indexed register. the ccif ?g will set after the read once operation has completed. valid phrase index values for the read once command range from 0x0000 to 0x0007. during execution of the read once command, any attempt to read addresses within p-flash block 0 will return invalid data. 128 table 26-38. erase verify p-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:0] is supplied (1) 1. as de?ed by the memory map for ftm512k3. set if a misaligned phrase address is supplied (global address [2:0] != 000) set if the requested section crosses a 256 kbyte boundary fpviol none mgstat1 set if any errors have been encountered during the read (2) 2. as found in the memory map for ftm512k3. mgstat0 set if any non-correctable errors have been encountered during the read 2 ferstat epviolif none table 26-39. read once command fccob requirements ccobix[2:0] fccob parameters 000 0x04 not required 001 read once phrase index (0x0000 - 0x0007) 010 read once word 0 value 011 read once word 1 value 100 read once word 2 value 101 read once word 3 value chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 991 26.4.2.5 load data field command the load data field command is executed to provide fccob parameters for multiple p-flash blocks for a future simultaneous program operation in the p-flash memory space. upon clearing ccif to launch the load data field command, the fccob registers will be transferred to the memory controller and be programmed in the block speci?d at the global address given with a future program p-flash command launched on a p-flash block. the ccif ?g will set after the load data field operation has completed. note that once a load data field command sequence has been initiated, the load data field command sequence will be cancelled if any command other than load data field or the future program p-flash is launched. similarly, if an error occurs after launching a load data field or program p-flash command, the associated load data field command sequence will be cancelled. table 26-40. read once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid phrase index is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 26-41. load data field command fccob requirements ccobix[2:0] fccob parameters 000 0x05 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 011 word 1 100 word 2 101 word 3 chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 992 freescale semiconductor 26.4.2.6 program p-flash command the program p-flash operation will program a previously erased phrase in the p-flash memory using an embedded algorithm. caution a p-flash phrase must be in the erased state before being programmed. cumulative programming of bits within a flash phrase is not allowed. upon clearing ccif to launch the program p-flash command, the memory controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. the ccif ?g will set after the program p-flash operation has completed. table 26-42. load data field command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:0] is supplied (1) 1. as de?ed by the memory map for ftm512k3. set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 none mgstat0 none ferstat epviolif none table 26-43. program p-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x06 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 program value 011 word 1 program value 100 word 2 program value 101 word 3 program value chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 993 26.4.2.7 program once command the program once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in p-flash block 0. the program once reserved field can be read using the read once command as described in section 26.4.2.4 . the program once command must only be issued once since the nonvolatile information register in p-flash block 0 cannot be erased. the program once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the program once command, the memory controller ?st veri?s that the selected phrase is erased. if erased, then the selected phrase will be programmed and then veri?d with read back. the ccif ?g will remain clear, setting only after the program once operation has completed. the reserved nonvolatile information register accessed by the program once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. valid phrase index table 26-44. program p-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:0] is supplied (1) 1. as de?ed by the memory map for ftm512k3. set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 26-45. program once command fccob requirements ccobix[2:0] fccob parameters 000 0x07 not required 001 program once phrase index (0x0000 - 0x0007) 010 program once word 0 value 011 program once word 1 value 100 program once word 2 value 101 program once word 3 value chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 994 freescale semiconductor values for the program once command range from 0x0000 to 0x0007. during execution of the program once command, any attempt to read addresses within p-flash block 0 will return invalid data. 26.4.2.8 erase all blocks command the erase all blocks operation will erase the entire p-flash and d-flash memory space including the eee nonvolatile information register. upon clearing ccif to launch the erase all blocks command, the memory controller will erase the entire flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g will set after the erase all blocks operation has completed. table 26-46. program once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid phrase index is supplied set if the requested phrase has already been programmed (1) 1. if a program once phrase is initially programmed to 0xffff_ffff_ffff_ffff, the program once command will be allowed to execute again on that same phrase. fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 26-47. erase all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x08 not required chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 995 26.4.2.9 erase p-flash block command the erase p-flash block operation will erase all addresses in a p-flash block. upon clearing ccif to launch the erase p-flash block command, the memory controller will erase the selected p-flash block and verify that it is erased. the ccif ?g will set after the erase p-flash block operation has completed. table 26-48. erase all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation (1) 1. as found in the memory map for ftm512k3. mgstat0 set if any non-correctable errors have been encountered during the verify operation 1 ferstat epviolif set if any area of the buffer ram eee partition is protected table 26-49. erase p-flash block command fccob requirements ccobix[2:0] fccob parameters 000 0x09 global address [22:16] to identify p-flash block 001 global address [15:0] in p-flash block to be erased table 26-50. erase p-flash block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm512k3. fpviol set if an area of the selected p-flash block is protected mgstat1 set if any errors have been encountered during the verify operation (2) 2. as found in the memory map for ftm512k3. mgstat0 set if any non-correctable errors have been encountered during the verify operation 2 ferstat epviolif none chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 996 freescale semiconductor 26.4.2.10 erase p-flash sector command the erase p-flash sector operation will erase all addresses in a p-flash sector. upon clearing ccif to launch the erase p-flash sector command, the memory controller will erase the selected flash sector and then verify that it is erased. the ccif ?g will be set after the erase p-flash sector operation has completed. 26.4.2.11 unsecure flash command the unsecure flash command will erase the entire p-flash and d-flash memory space and, if the erase is successful, will release security. upon clearing ccif to launch the unsecure flash command, the memory controller will erase the entire p-flash and d-flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. if the erase verify is not successful, the unsecure flash operation sets mgstat1 and terminates without changing the security table 26-51. erase p-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x0a global address [22:16] to identify p-flash block to be erased 001 global address [15:0] anywhere within the sector to be erased. refer to section 26.1.2.1 for the p-flash sector size. table 26-52. erase p-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm512k3. set if a misaligned phrase address is supplied (global address [2:0] != 000) fpviol set if the selected p-flash sector is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 26-53. unsecure flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0b not required chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 997 state. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g is set after the unsecure flash operation has completed. 26.4.2.12 verify backdoor access key command the verify backdoor access key command will only execute if it is enabled by the keyen bits in the fsec register (see table 26-11 ). the verify backdoor access key command releases security if user- supplied keys match those stored in the flash security bytes of the flash configuration field (see table 26- 3 ). the verify backdoor access key command must not be executed from the flash block containing the backdoor comparison key to avoid code runaway. upon clearing ccif to launch the verify backdoor access key command, the memory controller will check the fsec keyen bits to verify that this command is enabled. if not enabled, the memory controller sets the accerr bit in the fstat register and terminates. if the command is enabled, the memory controller compares the key provided in fccob to the backdoor comparison key in the flash con?uration ?ld with key 0 compared to 0x7f_ff00, etc. if the backdoor keys match, security will be released. if the backdoor keys do not match, security is not released and all future attempts to execute the verify backdoor access key command are aborted (set accerr) until a reset occurs. the ccif flag is set after the verify backdoor access key operation has completed. table 26-54. unsecure flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation (1) 1. as found in the memory map for ftm512k3. mgstat0 set if any non-correctable errors have been encountered during the verify operation 1 ferstat epviolif set if any area of the buffer ram eee partition is protected table 26-55. verify backdoor access key command fccob requirements ccobix[2:0] fccob parameters 000 0x0c not required 001 key 0 010 key 1 011 key 2 100 key 3 chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 998 freescale semiconductor 26.4.2.13 set user margin level command the set user margin level command causes the memory controller to set the margin level for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set user margin level command, the memory controller will set the user margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set user margin level command are de?ed in table 26-58 . table 26-56. verify backdoor access key command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 100 at command launch set if a load data field command sequence is currently active set if an incorrect backdoor key is supplied set if backdoor key access has not been enabled (keyen[1:0] != 10, see section 26.3.2.2 ) set if the backdoor key has mismatched since the last reset fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 26-57. set user margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0d global address [22:16] to identify the flash block 001 margin level setting table 26-58. valid set user margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) 1. read margin to the erased state 0x0002 user margin-0 level (2) 2. read margin to the programmed state chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 999 note user margin levels can be used to check that flash memory contents have adequate margin for normal level read operations. if unexpected results are encountered when checking flash memory contents at user margin levels, a potential loss of information has been detected. 26.4.2.14 set field margin level command the set field margin level command, valid in special modes only, causes the memory controller to set the margin level specified for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set field margin level command, the memory controller will set the ?ld margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set field margin level command are de?ed in table 26-61 . table 26-59. set user margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm512k3. set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 26-60. set field margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0e global address [22:16] to identify the flash block 001 margin level setting table 26-61. valid set field margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 1000 freescale semiconductor caution field margin levels must only be used during verify of the initial factory programming. note field margin levels can be used to check that flash memory contents have adequate margin for data retention at the normal level setting. if unexpected results are encountered when checking flash memory contents at ?ld margin levels, the flash memory contents should be erased and reprogrammed. 26.4.2.15 full partition d-flash command the full partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. 0x0002 user margin-0 level (2) 0x0003 field margin-1 level 1 0x0004 field margin-0 level 2 1. read margin to the erased state 2. read margin to the programmed state table 26-62. set field margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm512k3. set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 26-61. valid set field margin level settings ccob (ccobix=001) level description chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1001 upon clearing ccif to launch the full partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 26-7 ) program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 26-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 26-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 26-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the full partition d-flash operation has completed, the ccif ?g will set. running the full partition d-flash command a second time will result in the previous partition values and the entire d-flash memory being erased. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 26-63. full partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0f not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 1002 freescale semiconductor 26.4.2.16 erase verify d-flash section command the erase verify d-flash section command will verify that a section of code in the d-flash user partition is erased. the erase verify d-flash section command defines the starting point of the data to be verified and the number of words. upon clearing ccif to launch the erase verify d-flash section command, the memory controller will verify the selected section of d-flash memory is erased. the ccif ?g will set after the erase verify d- flash section operation has completed. table 26-64. full partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 26-65. erase verify d-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x10 global address [22:16] to identify the d-flash block 001 global address [15:0] of the ?st word to be veri?d 010 number of words to be veri?d chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1003 26.4.2.17 program d-flash command the program d-flash operation programs one to four previously erased words in the d-flash user partition. the program d-flash operation will confirm that the targeted location(s) were successfully programmed upon completion. caution a flash word must be in the erased state before being programmed. cumulative programming of bits within a flash word is not allowed. upon clearing ccif to launch the program d-flash command, the user-supplied words will be transferred to the memory controller and be programmed. the ccobix index value at program d-flash command launch determines how many words will be programmed in the d-flash block. no protection checks are made in the program d-flash operation on the d-flash block, only access error checks. the ccif ?g is set when the operation has completed. table 26-66. erase verify d-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area of the d-flash eee partition set if the requested section breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 26-67. program d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x11 global address [22:16] to identify the d-flash block 001 global address [15:0] of word to be programmed 010 word 0 program value 011 word 1 program value, if desired 100 word 2 program value, if desired 101 word 3 program value, if desired chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 1004 freescale semiconductor 26.4.2.18 erase d-flash sector command the erase d-flash sector operation will erase all addresses in a sector of the d-flash user partition. upon clearing ccif to launch the erase d-flash sector command, the memory controller will erase the selected flash sector and verify that it is erased. the ccif ?g will set after the erase d-flash sector operation has completed. table 26-68. program d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] < 010 at command launch set if ccobix[2:0] > 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area in the d-flash eee partition set if the requested group of words breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 26-69. erase d-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x12 global address [22:16] to identify d-flash block 001 global address [15:0] anywhere within the sector to be erased. see section 26.1.2.2 for d-flash sector size. chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1005 26.4.2.19 enable eeprom emulation command the enable eeprom emulation command causes the memory controller to enable eee activity. eee activity is disabled after any reset. upon clearing ccif to launch the enable eeprom emulation command, the ccif ?g will set after the memory controller enables eee operations using the contents of the eee tag ram and tag counter. the full partition d-flash or the partition d-flash command must be run prior to launching the enable eeprom emulation command. table 26-70. erase d-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 26-71. enable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x13 not required table 26-72. enable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 1006 freescale semiconductor 26.4.2.20 disable eeprom emulation command the disable eeprom emulation command causes the memory controller to suspend current eee activity. upon clearing ccif to launch the disable eeprom emulation command, the memory controller will halt eee operations at the next convenient point without clearing the eee tag ram or tag counter before setting the ccif ?g. 26.4.2.21 eeprom emulation query command the eeprom emulation query command returns eee partition and status variables. upon clearing ccif to launch the eeprom emulation query command, the ccif ?g will set after the eee partition and status variables are stored in the fccobix register.if the emulation query command is executed prior to partitioning (partition d-flash command section 26.4.2.15 ), the following reset values are returned: dfpart = 0x_ffff, erpart = 0x_ffff, ecount = 0x_ffff, dead sector count = 0x_00, ready sector count = 0x_00. table 26-73. disable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x14 not required table 26-74. disable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 26-75. eeprom emulation query command fccob requirements ccobix[2:0] fccob parameters 000 0x15 not required 001 return dfpart 010 return erpart 011 return ecount (1) 1. indicates sector erase count 100 return dead sector count return ready sector count chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1007 26.4.2.22 partition d-flash command the partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. the erase all blocks command must be run prior to launching the partition d-flash command. upon clearing ccif to launch the partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase verify the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 26-7 ) table 26-76. eeprom emulation query command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 26-77. partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x20 not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 1008 freescale semiconductor program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 26-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 26-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 26-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the partition d-flash operation has completed, the ccif ?g will set. running the partition d-flash command a second time will result in the accerr bit within the fstat register being set. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 26-78. partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 26-30 ) set if partitions have already been de?ed set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1009 26.4.3 interrupts the flash module can generate an interrupt when a flash command operation has completed or when a flash command operation has detected an eee error or an ecc fault. note vector addresses and their relative interrupt priority are determined at the mcu level. 26.4.3.1 description of flash interrupt operation the flash module uses the ccif ?g in combination with the ccie interrupt enable bit to generate the flash command interrupt request. the flash module uses the erseif, pgmeif, epviolif, ersvif1, ersvif0, dfdif and sfdif ?gs in combination with the erseie, pgmeie, epviolie, ersvie1, ersvie0, dfdie and sfdie interrupt enable bits to generate the flash error interrupt request. for a detailed description of the register bits involved, refer to section 26.3.2.5, ?lash configuration register (fcnfg) ? section 26.3.2.6, ?lash error configuration register (fercnfg) ? section 26.3.2.7, ?lash status register (fstat) ? and section 26.3.2.8, ?lash error status register (ferstat) ? the logic used for generating the flash module interrupts is shown in figure 26-27 . table 26-79. flash interrupt sources interrupt source interrupt flag local enable global (ccr) mask flash command complete ccif (fstat register) ccie (fcnfg register) i bit flash eee erase error erserif (ferstat register) erserie (fercnfg register) i bit flash eee program error pgmerif (ferstat register) pgmerie (fercnfg register) i bit flash eee protection violation epviolif (ferstat register) epviolie (fercnfg register) i bit flash eee error type 1 violation ersvif1 (ferstat register) ersvie1 (fercnfg register) i bit flash eee error type 0 violation ersvif0 (ferstat register) ersvie0 (fercnfg register) i bit ecc double bit fault on flash read dfdif (ferstat register) dfdie (fercnfg register) i bit ecc single bit fault on flash read sfdif (ferstat register) sfdie (fercnfg register) i bit chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 1010 freescale semiconductor figure 26-27. flash module interrupts implementation 26.4.4 wait mode the flash module is not affected if the mcu enters wait mode. the flash module can recover the mcu from wait via the ccif interrupt (see section 26.4.3, ?nterrupts ). 26.4.5 stop mode if a flash command is active (ccif = 0) or an ee-emulation operation is pending when the mcu requests stop mode, the current flash operation will be completed before the cpu is allowed to enter stop mode. 26.5 security the flash module provides security information to the mcu. the flash security state is de?ed by the sec bits of the fsec register (see table 26-12 ). during reset, the flash module initializes the fsec register using data read from the security byte of the flash con?uration ?ld at global address 0x7f_ff0f. flash error interrupt request ccif ccie epviolif epviolie ersvif1 ersvie1 ersvif0 ersvie0 pgmerif pgmerie erserif erserie flash command interrupt request dfdif dfdie sfdif sfdie chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1011 the security state out of reset can be permanently changed by programming the security byte of the flash con?uration ?ld. this assumes that you are starting from a mode where the necessary p-flash erase and program commands are available and that the upper region of the p-flash is unprotected. if the flash security byte is successfully programmed, its new value will take affect after the next mcu reset. the following subsections describe these security-related subjects: unsecuring the mcu using backdoor key access unsecuring the mcu in special single chip mode using bdm mode and security effects on flash command availability 26.5.1 unsecuring the mcu using backdoor key access the mcu may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7f_ff00?x7f_ff07). if the keyen[1:0] bits are in the enabled state (see section 26.3.2.2 ), the verify backdoor access key command (see section 26.4.2.12 ) allows the user to present four prospective keys for comparison to the keys stored in the flash memory via the memory controller. if the keys presented in the verify backdoor access key command match the backdoor keys stored in the flash memory, the sec bits in the fsec register (see table 26-12 ) will be changed to unsecure the mcu. key values of 0x0000 and 0xffff are not permitted as backdoor keys. while the verify backdoor access key command is active, p-flash block 0 will not be available for read access and will return invalid data. the user code stored in the p-flash memory must have a method of receiving the backdoor keys from an external stimulus. this external stimulus would typically be through one of the on-chip serial ports. if the keyen[1:0] bits are in the enabled state (see section 26.3.2.2 ), the mcu can be unsecured by the backdoor key access sequence described below: 1. follow the command sequence for the verify backdoor access key command as explained in section 26.4.2.12 2. if the verify backdoor access key command is successful, the mcu is unsecured and the sec[1:0] bits in the fsec register are forced to the unsecure state of 10 the verify backdoor access key command is monitored by the memory controller and an illegal key will prohibit future use of the verify backdoor access key command. a reset of the mcu is the only method to re-enable the verify backdoor access key command. after the backdoor keys have been correctly matched, the mcu will be unsecured. after the mcu is unsecured, the sector containing the flash security byte can be erased and the flash security byte can be reprogrammed to the unsecure state, if desired. in the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7f_ff00?x7f_ff07 in the flash con?uration ?ld. the security as de?ed in the flash security byte (0x7f_ff0f) is not changed by using the verify backdoor access key command sequence. the backdoor keys stored in addresses 0x7f_ff00?x7f_ff07 are unaffected by the verify backdoor access key command sequence. after the next reset of the mcu, the security state of the flash module is determined by the flash security byte chapter 26 384 kbyte flash module (s12xftm384k2v1) mc9s12xe-family reference manual , rev. 1.21 1012 freescale semiconductor (0x7f_ff0f). the verify backdoor access key command sequence has no effect on the program and erase protections de?ed in the flash protection register, fprot. 26.5.2 unsecuring the mcu in special single chip mode using bdm the mcu can be unsecured in special single chip mode by erasing the p-flash and d-flash memory by one of the following methods: reset the mcu into special single chip mode, delay while the erase test is performed by the bdm, send bdm commands to disable protection in the p-flash and d-flash memory, and execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. reset the mcu into special expanded wide mode, disable protection in the p-flash and d-flash memory and run code from external memory to execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. after the ccif ?g sets to indicate that the erase all blocks operation has completed, reset the mcu into special single chip mode. the bdm will execute the erase verify all blocks command write sequence to verify that the p-flash and d-flash memory is erased. if the p-flash and d-flash memory are verified as erased the mcu will be unsecured. all bdm commands will be enabled and the flash security byte may be programmed to the unsecure state by the following method: send bdm commands to execute a ?rogram p-flash?command sequence to program the flash security byte to the unsecured state and reset the mcu. 26.5.3 mode and security effects on flash command availability the availability of flash module commands depends on the mcu operating mode and security state as shown in table 26-30 . 26.6 initialization on each system reset the flash module executes a reset sequence which establishes initial values for the flash block configuration parameters, the fprot and dfprot protection registers, and the fopt and fsec registers. the flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. if a double bit fault is detected during the reset sequence, both mgstat bits in the fstat register will be set. the accerr bit in the fstat register is set if errors are encountered while initializing the eee buffer ram during the reset sequence. ccif remains clear throughout the reset sequence. the flash module holds off all cpu access for the initial portion of the reset sequence. while flash reads are possible when the hold is removed, writes to the fccobix, fccobhi, and fccoblo registers are ignored to prevent command activity while the memory controller remains busy. completion of the reset sequence is marked by setting ccif high which enables writes to the fccobix, fccobhi, and fccoblo registers to launch any available flash command. if a reset occurs while any flash command is in progress, that command will be immediately aborted. the state of the word being programmed or the sector/block being erased is not guaranteed. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1013 chapter 27 512 kbyte flash module (s12xftm512k3v1) table 27-1. revision history revision number revision date sections affected description of changes v01.09 14 nov 2007 27.5.2/27-1073 27.4.2/27-1049 27.4.2.8/27- 1055 - changed terminology from ?ord program to ?rogram p-flash in the bdm unsecuring description, section 27.5.2 - added requirement that user not write any flash module register during execution of commands ?rase all blocks? section 27.4.2.8 , and ?nsecure flash? section 27.4.2.11 - added statement that security is released upon successful completion of command ?rase all blocks? section 27.4.2.8 v01.10 19 dec 2007 27.4.2/27-1049 - corrected error handling table for full partition d-flash, partition d-flash, and eeprom emulation query commands v01.11 25 sep 2009 27.1/27-1014 27.3.2.1/27- 1025 27.4.2.4/27- 1052 27.4.2.7/27- 1054 27.4.2.12/27- 1058 27.4.2.12/27- 1058 27.4.2.12/27- 1058 27.4.2.20/27- 1067 27.3.2/27-1023 27.3.2.1/27- 1025 27.4.1.2/27- 1044 27.6/27-1073 - clarify single bit fault correction for p-flash phrase - expand fdiv vs oscclk frequency table - add statement concerning code runaway when executing read once command from flash block containing associated ?lds - add statement concerning code runaway when executing program once command from flash block containing associated ?lds - add statement concerning code runaway when executing verify backdoor access key command from flash block containing associated ?lds - relate key 0 to associated backdoor comparison key address - change ?ower down reset?to ?eset - add accerr condition for disable eeprom emulation command the following changes were made to clarify module behavior related to flash register access during reset sequence and while flash commands are active: - add caution concerning register writes while command is active - writes to fclkdiv are allowed during reset sequence while ccif is clear - add caution concerning register writes while command is active - writes to fccobix, fccobhi, fccoblo registers are ignored during reset sequence mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1014 27.1 introduction the ftm512k3 module implements the following: 512 kbytes of p-flash (program flash) memory, consisting of 3 physical flash blocks, intended primarily for nonvolatile code storage 32 kbytes of d-flash (data flash) memory, consisting of 1 physical flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated eeprom, as basic flash memory primarily intended for nonvolatile data storage, or as a combination of both 4 kbytes of buffer ram, consisting of 1 physical ram block, that can be used as emulated eeprom using a built-in hardware scheme, as basic ram, or as a combination of both the flash memory is ideal for single-supply applications allowing for ?ld reprogramming without requiring external high voltage sources for program or erase operations. the flash module includes a memory controller that executes commands to modify flash memory contents or con?ure module resources for emulated eeprom operation. the user interface to the memory controller consists of the indexed flash common command object (fccob) register which is written to with the command, global address, data, and any required command parameters. the memory controller must complete the execution of a command before the fccob register can be written to with a new command. caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. the ram and flash memory may be read as bytes, aligned words, or misaligned words. read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. for flash memory, an erased bit reads 1 and a programmed bit reads 0. it is not possible to read from a flash block while any command is executing on that speci? flash block. it is possible to read from a flash block while a command is executing on a different flash block. both p-flash and d-flash memories are implemented with error correction codes (ecc) that can resolve single bit faults and detect double bit faults. for p-flash memory, the ecc implementation requires that programming be done on an aligned 8 byte basis (a flash phrase). since p-flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 27.1.1 glossary buffer ram the buffer ram constitutes the volatile memory store required for eee. memory space in the buffer ram not required for eee can be partitioned to provide volatile memory space for applications. chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1015 command write sequence ?an mcu instruction sequence to execute built-in algorithms (including program and erase) on the flash memory. d-flash memory ?the d-flash memory constitutes the nonvolatile memory store required for eee. memory space in the d-flash memory not required for eee can be partitioned to provide nonvolatile memory space for applications. d-flash sector the d-flash sector is the smallest portion of the d-flash memory that can be erased. the d-flash sector consists of four 64 byte rows for a total of 256 bytes. eee (emulated eeprom) ?a method to emulate the small sector size features and endurance characteristics associated with an eeprom. eee ifr nonvolatile information register located in the d-flash block that contains data required to partition the d-flash memory and buffer ram for eee. the eee ifr is visible in the global memory map by setting the eeeifron bit in the mmcctl1 register. nvm command mode an nvm mode using the cpu to setup the fccob register to pass parameters required for flash command execution. phrase an aligned group of four 16-bit words within the p-flash memory. each phrase includes eight ecc bits for single bit fault correction and double bit fault detection within the phrase. p-flash memory the p-flash memory constitutes the main nonvolatile memory store for applications. p-flash sector ?the p-flash sector is the smallest portion of the p-flash memory that can be erased. each p-flash sector contains 1024 bytes. program ifr ?nonvolatile information register located in the p-flash block that contains the device id, version id, and the program once ?ld. the program ifr is visible in the global memory map by setting the pgmifron bit in the mmcctl1 register. 27.1.2 features 27.1.2.1 p-flash features 512 kbytes of p-flash memory composed of one 256 kbyte flash block and two 128 kbyte flash blocks. the 256 kbyte flash block consists of two 128 kbyte sections each divided into 128 sectors of 1024 bytes. the 128 kbyte flash blocks are each divided into 128 sectors of 1024 bytes. single bit fault correction and double bit fault detection within a 64-bit phrase during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and phrase program operation ability to program up to one phrase in each p-flash block simultaneously flexible protection scheme to prevent accidental program or erase of p-flash memory chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1016 freescale semiconductor 27.1.2.2 d-flash features up to 32 kbytes of d-flash memory with 256 byte sectors for user access dedicated commands to control access to the d-flash memory over eee operation single bit fault correction and double bit fault detection within a word during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and word program operation ability to program up to four words in a burst sequence 27.1.2.3 emulated eeprom features up to 4 kbytes of emulated eeprom (eee) accessible as 4 kbytes of ram flexible protection scheme to prevent accidental program or erase of data automatic eee ?e handling using an internal memory controller automatic transfer of valid eee data from d-flash memory to buffer ram on reset ability to monitor the number of outstanding eee related buffer ram words left to be programmed into d-flash memory ability to disable eee operation and allow priority access to the d-flash memory ability to cancel all pending eee operations and allow priority access to the d-flash memory 27.1.2.4 user buffer ram features up to 4 kbytes of ram for user access 27.1.2.5 other flash module features no external high-voltage power supply required for flash memory program and erase operations interrupt generation on flash command completion and flash error detection security mechanism to prevent unauthorized access to the flash memory 27.1.3 block diagram the block diagram of the flash module is shown in figure 27-1 . chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1017 figure 27-1. ftm512k3 block diagram 27.2 external signal description the flash module contains no signals that connect off-chip. oscillator clock divider clock (xtal) command interrupt request fclk protection security registers flash interface p-flash block 0 32kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 p-flash sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 16kx72 16kx72 16bit internal bus p-flash block 1s block 1n xgate 16kx72 16kx72 error interrupt request cpu memory controller d-flash 16kx22 buffer ram tag ram 128x16 2kx16 sector 0 sector 1 sector 127 scratch ram 512x16 chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1018 freescale semiconductor 27.3 memory map and registers this section describes the memory map and registers for the flash module. read data from unimplemented memory space in the flash module is unde?ed. write access to unimplemented or reserved memory space in the flash module will be ignored by the flash module. 27.3.1 module memory map the s12x architecture places the p-flash memory between global addresses 0x78_0000 and 0x7f_ffff as shown in table 27-2 . the p-flash memory map is shown in figure 27-2 . the fprot register, described in section 27.3.2.9 , can be set to protect regions in the flash memory from accidental program or erase. three separate memory regions, one growing upward from global address 0x7f_8000 in the flash memory (called the lower region), one growing downward from global address 0x7f_ffff in the flash memory (called the higher region), and the remaining addresses in the flash memory, can be activated for protection. the flash memory addresses covered by these protectable regions are shown in the p-flash memory map. the higher address region is mainly targeted to hold the boot loader code since it covers the vector space. default protection settings as well as security information that allows the mcu to restrict access to the flash module are stored in the flash con?uration ?ld as described in table 27-3 . table 27-2. p-flash memory addressing global address size (bytes) description 0x7c_0000 ?0x7f_ffff 256 k p-flash block 0 contains flash con?uration field (see table 27-3 ) 0x7a_0000 ?0x7b_ffff 128 k p-flash block 1n 0x78_0000 ?0x79_ffff 128 k p-flash block 1s table 27-3. flash con?uration field (1) global address size (bytes) description 0x7f_ff00 ?0x7f_ff07 8 backdoor comparison key refer to section 27.4.2.12, ?erify backdoor access key command , and section 27.5.1, ?nsecuring the mcu using backdoor key access 0x7f_ff08 0x7f_ff0b (2) 4 reserved 0x7f_ff0c 2 1 p-flash protection byte . refer to section 27.3.2.9, ?-flash protection register (fprot) 0x7f_ff0d 2 1 eee protection byte refer to section 27.3.2.10, ?ee protection register (eprot) 0x7f_ff0e 2 1 flash nonvolatile byte refer to section 27.3.2.14, ?lash option register (fopt) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1019 0x7f_ff0f 2 1 flash security byte refer to section 27.3.2.2, ?lash security register (fsec) 1. older versions may have swapped protection byte addresses 2. 0x7ff08 - 0x7f_ff0f form a flash phrase and must be programmed in a single command write sequence. each byte in the 0x7f_ff08 - 0x7f_ff0b reserved ?ld should be programmed to 0xff. table 27-3. flash con?uration field (1) global address size (bytes) description chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1020 freescale semiconductor figure 27-2. p-flash memory map flash con?uration field 0x7f_c000 flash protected/unprotected lower region 1, 2, 4, 8 kbytes 0x7f_8000 0x7f_9000 0x7f_8400 0x7f_8800 0x7f_a000 p-flash end = 0x7f_ffff 0x7f_f800 0x7f_f000 0x7f_e000 flash protected/unprotected higher region 2, 4, 8, 16 kbytes flash protected/unprotected region 8 kbytes (up to 29 kbytes) 16 bytes (0x7f_ff00 - 0x7f_ff0f) flash protected/unprotected region 480 kbytes p-flash start = 0x78_0000 chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1021 table 27-4. program ifr fields global address (pgmifron) size (bytes) field description 0x40_0000 ?0x40_0007 8 device id 0x40_0008 ?0x40_00e7 224 reserved 0x40_00e8 ?0x40_00e9 2 version id 0x40_00ea ?0x40_00ff 22 reserved 0x40_0100 ?0x40_013f 64 program once field refer to section 27.4.2.7, ?rogram once command 0x40_0140 ?0x40_01ff 192 reserved table 27-5. p-flash ifr accessibility global address (pgmifron) size (bytes) accessed from 0x40_0000 ?0x40_01ff 512 xbus0 (pblk0s) (1) 1. refer to table 27-4 for more details. 0x40_0200 ?0x40_03ff 512 unimplemented 0x40_0400 ?0x40_05ff 512 xbus0 (pblk1n) 0x40_0600 ?0x40_07ff 512 xbus1 (pblk1s) table 27-6. eee resource fields global address size (bytes) description 0x10_0000 ?0x10_7fff 32,768 d-flash memory (user and eee) 0x10_8000 ?0x11_ffff 98,304 reserved 0x12_0000 ?0x12_007f 128 eee nonvolatile information register (eeeifron (1) = 1) 1. mmcctl1 register bit 0x12_0080 ?0x12_0fff 3,968 reserved 0x12_1000 ?0x12_1eff 3,840 reserved 0x12_1f00 ?0x12_1fff 256 eee tag ram (tmgramon 1 = 1) 0x12_2000 ?0x12_3bff 7,168 reserved 0x12_3c00 ?0x12_3fff 1,024 memory controller scratch ram (tmgramon 1 = 1) 0x12_4000 ?0x12_dfff 40,960 reserved 0x12_e000 ?0x12_ffff 8,192 reserved 0x13_0000 ?0x13_efff 61,440 reserved 0x13_f000 ?0x13_ffff 4,096 buffer ram (user and eee) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1022 freescale semiconductor figure 27-3. eee resource memory map the full partition d-flash command (see section 27.4.2.15 ) is used to program the eee nonvolatile information register ?lds where address 0x12_0000 de?es the d-flash partition for user access and address 0x12_0004 de?es the buffer ram partition for eee operations. buffer ram start = 0x13_f000 buffer ram end = 0x13_ffff 0x13_ffc0 0x13_ff80 protectable region (eee only) 64, 128, 192, 256, 320, 384, 448, 512 bytes buffer ram 4 kbytes 0x13_ff40 0x13_ff00 0x13_fec0 0x13_fe80 0x13_fe40 0x13_fe00 0x12_ffff 0x12_4000 0x12_1000 memory controller scratch ram (tmgramon) 1024 bytes eee tag ram (tmgramon) 256 bytes eee nonvolatile information register (eeeifron) 128 bytes d-flash memory 32 kbytes d-flash start = 0x10_0000 d-flash user partition d-flash eee partition 0x12_0000 0x12_2000 0x12_e000 d-flash end = 0x10_7fff buffer ram user partition buffer ram eee partition chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1023 27.3.2 register descriptions the flash module contains a set of 20 control and status registers located between flash module base + 0x0000 and 0x0013. a summary of the flash module registers is given in figure 27-4 with detailed descriptions in the following subsections. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. table 27-7. eee nonvolatile information register fields global address (eeeifron) size (bytes) description 0x12_0000 ?0x12_0001 2 d-flash user partition (dfpart) refer to section 27.4.2.15, ?ull partition d-flash command 0x12_0002 ?0x12_0003 2 d-flash user partition (duplicate (1) ) 1. duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 ?0x12_0005 2 buffer ram eee partition (erpart) refer to section 27.4.2.15, ?ull partition d-flash command 0x12_0006 ?0x12_0007 2 buffer ram eee partition (duplicate 1 ) 0x12_0008 ?0x12_007f 120 reserved address & name 76543210 0x0000 fclkdiv r fdivld fdiv6 fdiv5 fdiv4 fdiv3 fdiv2 fdiv1 fdiv0 w 0x0001 fsec r keyen1 keyen0 rnv5 rnv4 rnv3 rnv2 sec1 sec0 w 0x0002 fccobix r0 0 0 0 0 ccobix2 ccobix1 ccobix0 w 0x0003 feccrix r0 0 0 0 0 eccrix2 eccrix1 eccrix0 w 0x0004 fcnfg r ccie 00 ignsf 00 fdfd fsfd w 0x0005 fercnfg r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w figure 27-4. ftm512k3 register summary chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1024 freescale semiconductor 0x0006 fstat r ccif 0 accerr fpviol mgbusy rsvd mgstat1 mgstat0 w 0x0007 ferstat r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w 0x0008 fprot r fpopen rnv6 fphdis fphs1 fphs0 fpldis fpls1 fpls0 w 0x0009 eprot r epopen rnv6 rnv5 rnv4 epdis eps2 eps1 eps0 w 0x000a fccobhi r ccob15 ccob14 ccob13 ccob12 ccob11 ccob10 ccob9 ccob8 w 0x000b fccoblo r ccob7 ccob6 ccob5 ccob4 ccob3 ccob2 ccob1 ccob0 w 0x000c etaghi r etag15 etag14 etag13 etag12 etag11 etag10 etag9 etag8 w 0x000d etaglo r etag7 etag6 etag5 etag4 etag3 etag2 etag1 etag0 w 0x000e feccrhi r eccr15 eccr14 eccr13 eccr12 eccr11 eccr10 eccr9 eccr8 w 0x000f feccrlo r eccr7 eccr6 eccr5 eccr4 eccr3 eccr2 eccr1 eccr0 w 0x0010 fopt r nv7 nv6 nv5 nv4 nv3 nv2 nv1 nv0 w 0x0011 frsv0 r00000000 w 0x0012 frsv1 r00000000 w 0x0013 frsv2 r00000000 w address & name 76543210 figure 27-4. ftm512k3 register summary (continued) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1025 27.3.2.1 flash clock divider register (fclkdiv) the fclkdiv register is used to control timed events in program and erase algorithms. all bits in the fclkdiv register are readable, bits 6? are write once and bit 7 is not writable. caution the fclkdiv register should never be written while a flash command is executing (ccif=0). the fclkdiv register is writable during the flash reset sequence even though ccif is clear. = unimplemented or reserved offset module base + 0x0000 76543210 r fdivld fdiv[6:0] w reset 00000000 = unimplemented or reserved figure 27-5. flash clock divider register (fclkdiv) table 27-8. fclkdiv field descriptions field description 7 fdivld clock divider loaded 0 fclkdiv register has not been written 1 fclkdiv register has been written since the last reset 6? fdiv[6:0] clock divider bits ?fdiv[6:0] must be set to effectively divide oscclk down to generate an internal flash clock, fclk, with a target frequency of 1 mhz for use by the flash module to control timed events during program and erase algorithms. table 27-9 shows recommended values for fdiv[6:0] based on oscclk frequency. please refer to section 27.4.1, ?lash command operations , for more information. address & name 76543210 figure 27-4. ftm512k3 register summary (continued) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1026 freescale semiconductor table 27-9. fdiv vs oscclk frequency oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] min (1) 1. fdiv shown generates an fclk frequency of >0.8 mhz max (2) min 1 max 2 min 1 max 2 33.60 34.65 0x20 67.20 68.25 0x40 1.60 2.10 0x01 34.65 35.70 0x21 68.25 69.30 0x41 2.40 3.15 0x02 35.70 36.75 0x22 69.30 70.35 0x42 3.20 4.20 0x03 36.75 37.80 0x23 70.35 71.40 0x43 4.20 5.25 0x04 37.80 38.85 0x24 71.40 72.45 0x44 5.25 6.30 0x05 38.85 39.90 0x25 72.45 73.50 0x45 6.30 7.35 0x06 39.90 40.95 0x26 73.50 74.55 0x46 7.35 8.40 0x07 40.95 42.00 0x27 74.55 75.60 0x47 8.40 9.45 0x08 42.00 43.05 0x28 75.60 76.65 0x48 9.45 10.50 0x09 43.05 44.10 0x29 76.65 77.70 0x49 10.50 11.55 0x0a 44.10 45.15 0x2a 77.70 78.75 0x4a 11.55 12.60 0x0b 45.15 46.20 0x2b 78.75 79.80 0x4b 12.60 13.65 0x0c 46.20 47.25 0x2c 79.80 80.85 0x4c 13.65 14.70 0x0d 47.25 48.30 0x2d 80.85 81.90 0x4d 14.70 15.75 0x0e 48.30 49.35 0x2e 81.90 82.95 0x4e 15.75 16.80 0x0f 49.35 50.40 0x2f 82.95 84.00 0x4f 16.80 17.85 0x10 50.40 51.45 0x30 84.00 85.05 0x50 17.85 18.90 0x11 51.45 52.50 0x31 85.05 86.10 0x51 18.90 19.95 0x12 52.50 53.55 0x32 86.10 87.15 0x52 19.95 21.00 0x13 53.55 54.60 0x33 87.15 88.20 0x53 21.00 22.05 0x14 54.60 55.65 0x34 88.20 89.25 0x54 22.05 23.10 0x15 55.65 56.70 0x35 89.25 90.30 0x55 23.10 24.15 0x16 56.70 57.75 0x36 90.30 91.35 0x56 24.15 25.20 0x17 57.75 58.80 0x37 91.35 92.40 0x57 25.20 26.25 0x18 58.80 59.85 0x38 92.40 93.45 0x58 26.25 27.30 0x19 59.85 60.90 0x39 93.45 94.50 0x59 27.30 28.35 0x1a 60.90 61.95 0x3a 94.50 95.55 0x5a 28.35 29.40 0x1b 61.95 63.00 0x3b 95.55 96.60 0x5b 29.40 30.45 0x1c 63.00 64.05 0x3c 96.60 97.65 0x5c 30.45 31.50 0x1d 64.05 65.10 0x3d 97.65 98.70 0x5d 31.50 32.55 0x1e 65.10 66.15 0x3e 98.70 99.75 0x5e 32.55 33.60 0x1f 66.15 67.20 0x3f 99.75 100.80 0x5f chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1027 27.3.2.2 flash security register (fsec) the fsec register holds all bits associated with the security of the mcu and flash module. all bits in the fsec register are readable but not writable. during the reset sequence, the fsec register is loaded with the contents of the flash security byte in the flash configuration field at global address 0x7f_ff0f located in p-flash memory (see table 27-3 ) as indicated by reset condition f in figure 27-6 . if a double bit fault is detected while reading the p-flash phrase containing the flash security byte during the reset sequence, all bits in the fsec register will be set to leave the flash module in a secured state with backdoor key access disabled. 2. fdiv shown generates an fclk frequency of 1.05 mhz offset module base + 0x0001 76543210 r keyen[1:0] rnv[5:2] sec[1:0] w reset f f ffffff = unimplemented or reserved figure 27-6. flash security register (fsec) table 27-10. fsec field descriptions field description 7? keyen[1:0] backdoor key security enable bits the keyen[1:0] bits de?e the enabling of backdoor key access to the flash module as shown in table 27-11 . 5? rnv[5:2} reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements. 1? sec[1:0] flash security bits ?the sec[1:0] bits de?e the security state of the mcu as shown in table 27-12 . if the flash module is unsecured using backdoor key access, the sec bits are forced to 10. table 27-11. flash keyen states keyen[1:0] status of backdoor key access 00 disabled 01 disabled (1) 1. preferred keyen state to disable backdoor key access. 10 enabled 11 disabled chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1028 freescale semiconductor the security function in the flash module is described in section 27.5 . 27.3.2.3 flash ccob index register (fccobix) the fccobix register is used to index the fccob register for flash memory operations. ccobix bits are readable and writable while remaining bits read 0 and are not writable. 27.3.2.4 flash eccr index register (feccrix) the feccrix register is used to index the feccr register for ecc fault reporting. eccrix bits are readable and writable while remaining bits read 0 and are not writable. table 27-12. flash security states sec[1:0] status of security 00 secured 01 secured (1) 1. preferred sec state to set mcu to secured state. 10 unsecured 11 secured offset module base + 0x0002 76543210 r00000 ccobix[2:0] w reset 00000000 = unimplemented or reserved figure 27-7. fccob index register (fccobix) table 27-13. fccobix field descriptions field description 2? ccobix[1:0] common command register index the ccobix bits are used to select which word of the fccob register array is being read or written to. see section 27.3.2.11, ?lash common command object register (fccob) , for more details. offset module base + 0x0003 76543210 r00000 eccrix[2:0] w reset 00000000 = unimplemented or reserved figure 27-8. feccr index register (feccrix) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1029 27.3.2.5 flash con?uration register (fcnfg) the fcnfg register enables the flash command complete interrupt and forces ecc faults on flash array read access from the cpu or xgate. ccie, ignsf, fdfd, and fsfd bits are readable and writable while remaining bits read 0 and are not writable. table 27-14. feccrix field descriptions field description 2-0 eccrix[2:0] ecc error register index ?the eccrix bits are used to select which word of the feccr register array is being read. see section 27.3.2.13, ?lash ecc error results register (feccr) , for more details. offset module base + 0x0004 76543210 r ccie 00 ignsf 00 fdfd fsfd w reset 00000000 = unimplemented or reserved figure 27-9. flash con?uration register (fcnfg) table 27-15. fcnfg field descriptions field description 7 ccie command complete interrupt enable ?the ccie bit controls interrupt generation when a flash command has completed. 0 command complete interrupt disabled 1 an interrupt will be requested whenever the ccif ?g in the fstat register is set (see section 27.3.2.7 ) 4 ignsf ignore single bit fault ?the ignsf controls single bit fault reporting in the ferstat register (see section 27.3.2.8 ). 0 all single bit faults detected during array reads are reported 1 single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1030 freescale semiconductor 27.3.2.6 flash error con?uration register (fercnfg) the fercnfg register enables the flash error interrupts for the ferstat flags. all assigned bits in the fercnfg register are readable and writable. 1 fdfd force double bit fault detect the fdfd bit allows the user to simulate a double bit fault during flash array read operations and check the associated interrupt routine. the fdfd bit is cleared by writing a 0 to fdfd. the feccr registers will not be updated during the flash array read operation with fdfd set unless an actual double bit fault is detected. 0 flash array read operations will set the dfdif ?g in the ferstat register only if a double bit fault is detected 1 any flash array read operation will force the dfdif ?g in the ferstat register to be set (see section 27.3.2.7 ) and an interrupt will be generated as long as the dfdie interrupt enable in the fercnfg register is set (see section 27.3.2.6 ) 0 fsfd force single bit fault detect the fsfd bit allows the user to simulate a single bit fault during flash array read operations and check the associated interrupt routine. the fsfd bit is cleared by writing a 0 to fsfd. the feccr registers will not be updated during the flash array read operation with fsfd set unless an actual single bit fault is detected. 0 flash array read operations will set the sfdif ?g in the ferstat register only if a single bit fault is detected 1 flash array read operation will force the sfdif ?g in the ferstat register to be set (see section 27.3.2.7 ) and an interrupt will be generated as long as the sfdie interrupt enable in the fercnfg register is set (see section 27.3.2.6 ) offset module base + 0x0005 76543210 r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w reset 00000000 = unimplemented or reserved figure 27-10. flash error con?uration register (fercnfg) table 27-16. fercnfg field descriptions field description 7 erserie eee erase error interrupt enable the erserie bit controls interrupt generation when a failure is detected during an eee erase operation. 0 erserif interrupt disabled 1 an interrupt will be requested whenever the erserif ?g is set (see section 27.3.2.8 ) 6 pgmerie eee program error interrupt enable ?the pgmerie bit controls interrupt generation when a failure is detected during an eee program operation. 0 pgmerif interrupt disabled 1 an interrupt will be requested whenever the pgmerif ?g is set (see section 27.3.2.8 ) 4 epviolie eee protection violation interrupt enable ?the epviolie bit controls interrupt generation when a protection violation is detected during a write to the buffer ram eee partition. 0 epviolif interrupt disabled 1 an interrupt will be requested whenever the epviolif ?g is set (see section 27.3.2.8 ) table 27-15. fcnfg field descriptions (continued) field description chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1031 27.3.2.7 flash status register (fstat) the fstat register reports the operational status of the flash module. ccif, accerr, and fpviol bits are readable and writable, mgbusy and mgstat bits are readable but not writable, while remaining bits read 0 and are not writable. 3 ersvie1 eee error type 1 interrupt enable the ersvie1 bit controls interrupt generation when a change state error is detected during an eee operation. 0 ersvif1 interrupt disabled 1 an interrupt will be requested whenever the ersvif1 ?g is set (see section 27.3.2.8 ) 2 ersvie0 eee error type 0 interrupt enable the ersvie0 bit controls interrupt generation when a sector format error is detected during an eee operation. 0 ersvif0 interrupt disabled 1 an interrupt will be requested whenever the ersvif0 ?g is set (see section 27.3.2.8 ) 1 dfdie double bit fault detect interrupt enable the dfdie bit controls interrupt generation when a double bit fault is detected during a flash block read operation. 0 dfdif interrupt disabled 1 an interrupt will be requested whenever the dfdif ?g is set (see section 27.3.2.8 ) 0 sfdie single bit fault detect interrupt enable the sfdie bit controls interrupt generation when a single bit fault is detected during a flash block read operation. 0 sfdif interrupt disabled whenever the sfdif ?g is set (see section 27.3.2.8 ) 1 an interrupt will be requested whenever the sfdif ?g is set (see section 27.3.2.8 ) offset module base + 0x0006 76543210 r ccif 0 accerr fpviol mgbusy rsvd mgstat[1:0] w reset 1000000 (1) 1. reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see section 27.6 ). 0 1 = unimplemented or reserved figure 27-11. flash status register (fstat) table 27-16. fercnfg field descriptions (continued) field description chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1032 freescale semiconductor 27.3.2.8 flash error status register (ferstat) the ferstat register re?cts the error status of internal flash operations. all ?gs in the ferstat register are readable and only writable to clear the ?g. table 27-17. fstat field descriptions field description 7 ccif command complete interrupt flag ?the ccif ?g indicates that a flash command has completed. the ccif ?g is cleared by writing a 1 to ccif to launch a command and ccif will stay low until command completion or command violation. 0 flash command in progress 1 flash command has completed 5 accerr flash access error flag ?the accerr bit indicates an illegal access has occurred to the flash memory caused by either a violation of the command write sequence (see section 27.4.1.2 ) or issuing an illegal flash command or when errors are encountered while initializing the eee buffer ram during the reset sequence. while accerr is set, the ccif ?g cannot be cleared to launch a command. the accerr bit is cleared by writing a 1 to accerr. writing a 0 to the accerr bit has no effect on accerr. 0 no access error detected 1 access error detected 4 fpviol flash protection violation flag ?he fpviol bit indicates an attempt was made to program or erase an address in a protected area of p-flash memory during a command write sequence. the fpviol bit is cleared by writing a 1 to fpviol. writing a 0 to the fpviol bit has no effect on fpviol. while fpviol is set, it is not possible to launch a command or start a command write sequence. 0 no protection violation detected 1 protection violation detected 3 mgbusy memory controller busy flag ?the mgbusy ?g re?cts the active state of the memory controller . 0 memory controller is idle 1 memory controller is busy executing a flash command (ccif = 0) or is handling internal eee operations 2 rsvd reserved bit ?this bit is reserved and always reads 0 . 1? mgstat[1:0] memory controller command completion status flag one or more mgstat ?g bits are set if an error is detected during execution of a flash command or during the flash reset sequence. see section 27.4.2, ?lash command description , and section 27.6, ?nitialization ?for details. offset module base + 0x0007 76543210 r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w reset 00000000 = unimplemented or reserved figure 27-12. flash error status register (ferstat) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1033 27.3.2.9 p-flash protection register (fprot) the fprot register defines which p-flash sectors are protected against program and erase operations. table 27-18. ferstat field descriptions field description 7 erserif eee erase error interrupt flag ?the setting of the erserif ?g occurs due to an error in a flash erase command that resulted in the erase operation not being successful during eee operations. the erserif ?g is cleared by writing a 1 to erserif. writing a 0 to the erserif ?g has no effect on erserif. while erserif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 erase command successfully completed on the d-flash eee partition 1 erase command failed on the d-flash eee partition 6 pgmerif eee program error interrupt flag ?the setting of the pgmerif ?g occurs due to an error in a flash program command that resulted in the program operation not being successful during eee operations. the pgmerif ?g is cleared by writing a 1 to pgmerif. writing a 0 to the pgmerif ?g has no effect on pgmerif. while pgmerif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 program command successfully completed on the d-flash eee partition 1 program command failed on the d-flash eee partition 4 epviolif eee protection violation interrupt flag ?he setting of the epviolif ?g indicates an attempt was made to write to a protected area of the buffer ram eee partition. the epviolif ?g is cleared by writing a 1 to epviolif. writing a 0 to the epviolif ?g has no effect on epviolif. while epviolif is set, it is possible to write to the buffer ram eee partition as long as the address written to is not in a protected area. 0 no eee protection violation 1 eee protection violation detected 3 ersvif1 eee error interrupt 1 flag ?he setting of the ersvif1 ?g indicates that the memory controller was unable to change the state of a d-flash eee sector. the ersvif1 ?g is cleared by writing a 1 to ersvif1. writing a 0 to the ersvif1 ?g has no effect on ersvif1. while ersvif1 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector state change error detected 1 eee sector state change error detected 2 ersvif0 eee error interrupt 0 flag ?he setting of the ersvif0 ?g indicates that the memory controller was unable to format a d-flash eee sector for eee use. the ersvif0 ?g is cleared by writing a 1 to ersvif0. writing a 0 to the ersvif0 ?g has no effect on ersvif0. while ersvif0 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector format error detected 1 eee sector format error detected 1 dfdif double bit fault detect interrupt flag ?the setting of the dfdif ?g indicates that a double bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the dfdif ?g is cleared by writing a 1 to dfdif. writing a 0 to dfdif has no effect on dfdif. 0 no double bit fault detected 1 double bit fault detected or an invalid flash array read operation attempted 0 sfdif single bit fault detect interrupt flag ?with the ignsf bit in the fcnfg register clear, the sfdif ?g indicates that a single bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the sfdif ?g is cleared by writing a 1 to sfdif. writing a 0 to sfdif has no effect on sfdif. 0 no single bit fault detected 1 single bit fault detected and corrected or an invalid flash array read operation attempted chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1034 freescale semiconductor the (unreserved) bits of the fprot register are writable with the restriction that the size of the protected region can only be increased (see section 27.3.2.9.1, ?-flash protection restrictions , and table 27-23 ). during the reset sequence, the fprot register is loaded with the contents of the p-flash protection byte in the flash configuration field at global address 0x7f_ff0c located in p-flash memory (see table 27-3 ) as indicated by reset condition ??in figure 27-13 . to change the p-flash protection that will be loaded during the reset sequence, the upper sector of the p-flash memory must be unprotected, then the p-flash protection byte must be reprogrammed. if a double bit fault is detected while reading the p-flash phrase containing the p-flash protection byte during the reset sequence, the fpopen bit will be cleared and remaining bits in the fprot register will be set to leave the p-flash memory fully protected. trying to alter data in any protected area in the p-flash memory will result in a protection violation error and the fpviol bit will be set in the fstat register. the block erase of a p-flash block is not possible if any of the p-flash sectors contained in the same p-flash block are protected. offset module base + 0x0008 76543210 r fpopen rnv6 fphdis fphs[1:0] fpldis fpls[1:0] w reset f f ffffff = unimplemented or reserved figure 27-13. flash protection register (fprot) table 27-19. fprot field descriptions field description 7 fpopen flash protection operation enable ?the fpopen bit determines the protection function for program or erase operations as shown in table 27-20 for the p-flash block. 0 when fpopen is clear, the fphdis and fpldis bits de?e unprotected address ranges as speci?d by the corresponding fphs and fpls bits 1 when fpopen is set, the fphdis and fpldis bits enable protection for the address range speci?d by the corresponding fphs and fpls bits 6 rnv[6] reserved nonvolatile bit ?the rnv bit should remain in the erased state for future enhancements. 5 fphdis flash protection higher address range disable ?the fphdis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory ending with global address 0x7f_ffff. 0 protection/unprotection enabled 1 protection/unprotection disabled 4? fphs[1:0] flash protection higher address size the fphs bits determine the size of the protected/unprotected area in p-flash memory as shown in table 27-21 . the fphs bits can only be written to while the fphdis bit is set. 2 fpldis flash protection lower address range disable ?the fpldis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory beginning with global address 0x7f_8000. 0 protection/unprotection enabled 1 protection/unprotection disabled 1? fpls[1:0] flash protection lower address size the fpls bits determine the size of the protected/unprotected area in p-flash memory as shown in table 27-22 . the fpls bits can only be written to while the fpldis bit is set. chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1035 all possible p-flash protection scenarios are shown in figure 27-14 . although the protection scheme is loaded from the flash memory at global address 0x7f_ff0c during the reset sequence, it can be changed by the user. the p-flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. table 27-20. p-flash protection function fpopen fphdis fpldis function (1) 1. for range sizes, refer to table 27-21 and table 27-22 . 1 1 1 no p-flash protection 1 1 0 protected low range 1 0 1 protected high range 1 0 0 protected high and low ranges 0 1 1 full p-flash memory protected 0 1 0 unprotected low range 0 0 1 unprotected high range 0 0 0 unprotected high and low ranges table 27-21. p-flash protection higher address range fphs[1:0] global address range protected size 00 0x7f_f800?x7f_ffff 2 kbytes 01 0x7f_f000?x7f_ffff 4 kbytes 10 0x7f_e000?x7f_ffff 8 kbytes 11 0x7f_c000?x7f_ffff 16 kbytes table 27-22. p-flash protection lower address range fpls[1:0] global address range protected size 00 0x7f_8000?x7f_83ff 1 kbyte 01 0x7f_8000?x7f_87ff 2 kbytes 10 0x7f_8000?x7f_8fff 4 kbytes 11 0x7f_8000?x7f_9fff 8 kbytes chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1036 freescale semiconductor figure 27-14. p-flash protection scenarios 7 6 5 4 fphs[1:0] fpls[1:0] 3 2 1 0 fphs[1:0] fpls[1:0] fphdis = 1 fpldis = 1 fphdis = 1 fpldis = 0 fphdis = 0 fpldis = 1 fphdis = 0 fpldis = 0 scenario scenario unprotected region protected region with size protected region protected region with size defined by fpls defined by fphs not defined by fpls, fphs 0x7f_8000 0x7f_ffff 0x7f_8000 0x7f_ffff flash start flash start fpopen = 1 fpopen = 0 chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1037 27.3.2.9.1 p-flash protection restrictions the general guideline is that p-flash protection can only be added and not removed. table 27-23 specifies all valid transitions between p-flash protection scenarios. any attempt to write an invalid scenario to the fprot register will be ignored. the contents of the fprot register reflect the active protection scenario. see the fphs and fpls bit descriptions for additional restrictions. 27.3.2.10 eee protection register (eprot) the eprot register de?es which buffer ram eee partition areas are protected against writes. all bits in the eprot register are readable and writable except for rnv[6:4] which are only readable. the epopen and epdis bits can only be written to the protected state. the eps bits can be written anytime until the epdis bit is cleared. if the epopen bit is cleared, the state of the epdis and eps bits is irrelevant. during the reset sequence, the eprot register is loaded from the eee protection byte in the flash configuration field at global address 0x7f_ff0d located in p-flash memory (see table 27-3 ) as indicated by reset condition f in figure 27-15 . to change the eee protection that will be loaded during the reset sequence, the p-flash sector containing the eee protection byte must be unprotected, then the eee protection byte must be programmed. if a double bit fault is detected while reading the p-flash phrase table 27-23. p-flash protection scenario transitions from protection scenario to protection scenario (1) 1. allowed transitions marked with x, see figure 27-14 for a de?ition of the scenarios. 01234567 0 xxxx 1 xx 2 xx 3 x 4 xx 5 xxxx 6 xxxx 7 xxxxxxxx offset module base + 0x0009 76543210 r epopen rnv[6:4] epdis eps[2:0] w reset f f ffffff = unimplemented or reserved figure 27-15. eee protection register (eprot) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1038 freescale semiconductor containing the eee protection byte during the reset sequence, the epopen bit will be cleared and remaining bits in the eprot register will be set to leave the buffer ram eee partition fully protected. trying to write data to any protected area in the buffer ram eee partition will result in a protection violation error and the epviolif ?g will be set in the ferstat register. trying to write data to any protected area in the buffer ram partitioned for user access will not be prevented and the epviolif ?g in the ferstat register will not set. 27.3.2.11 flash common command object register (fccob) the fccob is an array of six words addressed via the ccobix index found in the fccobix register. byte wide reads and writes are allowed to the fccob register. table 27-24. eprot field descriptions field description 7 epopen enables writes to the buffer ram partitioned for eee 0 the entire buffer ram eee partition is protected from writes 1 unprotected buffer ram eee partition areas are enabled for writes 6? rnv[6:4] reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements 3 epdis buffer ram protection address range disable ?the epdis bit determines whether there is a protected area in a speci? region of the buffer ram eee partition. 0 protection enabled 1 protection disabled 2? eps[2:0] buffer ram protection size ?the eps[2:0] bits determine the size of the protected area in the buffer ram eee partition as shown in table 27-21 . the eps bits can only be written to while the epdis bit is set. table 27-25. buffer ram eee partition protection address range eps[2:0] global address range protected size 000 0x13_ffc0 ?0x13_ffff 64 bytes 001 0x13_ff80 ?0x13_ffff 128 bytes 010 0x13_ff40 ?0x13_ffff 192 bytes 011 0x13_ff00 ?0x13_ffff 256 bytes 100 0x13_fec0 ?0x13_ffff 320 bytes 101 0x13_fe80 ?0x13_ffff 384 bytes 110 0x13_fe40 ?0x13_ffff 448 bytes 111 0x13_fe00 ?0x13_ffff 512 bytes chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1039 27.3.2.11.1 fccob - nvm command mode nvm command mode uses the indexed fccob register to provide a command code and its relevant parameters to the memory controller. the user first sets up all required fccob fields and then initiates the command? execution by writing a 1 to the ccif bit in the fstat register (a 1 written by the user clears the ccif command completion flag to 0). when the user clears the ccif bit in the fstat register all fccob parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the memory controller returning ccif to 1). some commands return information to the fccob register array. the generic format for the fccob parameter fields in nvm command mode is shown in table 27-26 . the return values are available for reading after the ccif flag in the fstat register has been returned to 1 by the memory controller. writes to the unimplemented parameter fields (ccobix = 110 and ccobix = 111) are ignored with reads from these fields returning 0x0000. table 27-26 shows the generic flash command format. the high byte of the first word in the ccob array contains the command code, followed by the parameters for this specific flash command. for details on the fccob settings required by each command, see the flash command descriptions in section 27.4.2 . offset module base + 0x000a 76543210 r ccob[15:8] w reset 00000000 figure 27-16. flash common command object high register (fccobhi) offset module base + 0x000b 76543210 r ccob[7:0] w reset 00000000 figure 27-17. flash common command object low register (fccoblo) table 27-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) 000 hi fcmd[7:0] de?ing flash command lo 0, global address [22:16] 001 hi global address [15:8] lo global address [7:0] 010 hi data 0 [15:8] lo data 0 [7:0] chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1040 freescale semiconductor 27.3.2.12 eee tag counter register (etag) the etag register contains the number of outstanding words in the buffer ram eee partition that need to be programmed into the d-flash eee partition. the etag register is decremented prior to the related tagged word being programmed into the d-flash eee partition. all tagged words have been programmed into the d-flash eee partition once all bits in the etag register read 0 and the mgbusy flag in the fstat register reads 0. all etag bits are readable but not writable and are cleared by the memory controller. 27.3.2.13 flash ecc error results register (feccr) the feccr registers contain the result of a detected ecc fault for both single bit and double bit faults. the feccr register provides access to several ecc related fields as defined by the eccrix index bits in the feccrix register (see section 27.3.2.4 ). once ecc fault information has been stored, no other 011 hi data 1 [15:8] lo data 1 [7:0] 100 hi data 2 [15:8] lo data 2 [7:0] 101 hi data 3 [15:8] lo data 3 [7:0] offset module base + 0x000c 76543210 r etag[15:8] w reset 0 0 000000 = unimplemented or reserved figure 27-18. eee tag counter high register (etaghi) offset module base + 0x000d 76543210 r etag[7:0] w reset 00000000 = unimplemented or reserved figure 27-19. eee tag counter low register (etaglo) table 27-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1041 fault information will be recorded until the specific ecc fault flag has been cleared. in the event of simultaneous ecc faults, the priority for fault recording is: 1. double bit fault over single bit fault 2. cpu over xgate all feccr bits are readable but not writable. offset module base + 0x000e 76543210 r eccr[15:8] w reset 00000000 = unimplemented or reserved figure 27-20. flash ecc error results high register (feccrhi) offset module base + 0x000f 76543210 r eccr[7:0] w reset 00000000 = unimplemented or reserved figure 27-21. flash ecc error results low register (feccrlo) table 27-27. feccr index settings eccrix[2:0] feccr register content bits [15:8] bit[7] bits[6:0] 000 parity bits read from flash block cpu or xgate source identity global address [22:16] 001 global address [15:0] 010 data 0 [15:0] 011 data 1 [15:0] (p-flash only) 100 data 2 [15:0] (p-flash only) 101 data 3 [15:0] (p-flash only) 110 not used, returns 0x0000 when read 111 not used, returns 0x0000 when read chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1042 freescale semiconductor the p-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the following four words addressed by eccrix = 010 to 101 contain the 64-bit wide data phrase. the four data words and the parity byte are the uncorrected data read from the p-flash block. the d-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the uncorrected 16-bit data word is addressed by eccrix = 010. 27.3.2.14 flash option register (fopt) the fopt register is the flash option register. all bits in the fopt register are readable but are not writable. during the reset sequence, the fopt register is loaded from the flash nonvolatile byte in the flash configuration field at global address 0x7f_ff0e located in p-flash memory (see table 27-3 ) as indicated by reset condition f in figure 27-22 . if a double bit fault is detected while reading the p-flash phrase containing the flash nonvolatile byte during the reset sequence, all bits in the fopt register will be set. 27.3.2.15 flash reserved0 register (frsv0) this flash register is reserved for factory testing. table 27-28. feccr index=000 bit descriptions field description 15:8 par[7:0] ecc parity bits ?contains the 8 parity bits from the 72 bit wide p-flash data word or the 6 parity bits, allocated to par[5:0], from the 22 bit wide d-flash word with par[7:6]=00. 7 xbus01 bus source identi?r the xbus01 bit determines whether the ecc error was caused by a read access from the cpu or xgate. 0 ecc error happened on the cpu access 1 ecc error happened on the xgate access 6? gaddr[22:16] global address ?the gaddr[22:16] ?ld contains the upper seven bits of the global address having caused the error. offset module base + 0x0010 76543210 r nv[7:0] w reset f f ffffff = unimplemented or reserved figure 27-22. flash option register (fopt) table 27-29. fopt field descriptions field description 7? nv[7:0] nonvolatile bits the nv[7:0] bits are available as nonvolatile bits. refer to the device user guide for proper use of the nv bits. chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1043 all bits in the frsv0 register read 0 and are not writable. 27.3.2.16 flash reserved1 register (frsv1) this flash register is reserved for factory testing. all bits in the frsv1 register read 0 and are not writable. 27.3.2.17 flash reserved2 register (frsv2) this flash register is reserved for factory testing. all bits in the frsv2 register read 0 and are not writable. offset module base + 0x0011 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 27-23. flash reserved0 register (frsv0) offset module base + 0x0012 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 27-24. flash reserved1 register (frsv1) offset module base + 0x0013 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 27-25. flash reserved2 register (frsv2) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1044 freescale semiconductor 27.4 functional description 27.4.1 flash command operations flash command operations are used to modify flash memory contents or con?ure module resources for eee operation. the next sections describe: how to write the fclkdiv register that is used to generate a time base (fclk) derived from oscclk for flash program and erase command operations the command write sequence used to set flash command parameters and launch execution valid flash commands available for execution 27.4.1.1 writing the fclkdiv register prior to issuing any flash program or erase command after a reset, the user is required to write the fclkdiv register to divide oscclk down to a target fclk of 1 mhz. table 27-9 shows recommended values for the fdiv ?ld based on oscclk frequency. note programming or erasing the flash memory cannot be performed if the bus clock runs at less than 1 mhz. setting fdiv too high can destroy the flash memory due to overstress. setting fdiv too low can result in incomplete programming or erasure of the flash memory cells. when the fclkdiv register is written, the fdivld bit is set automatically. if the fdivld bit is 0, the fclkdiv register has not been written since the last reset. if the fclkdiv register has not been written, any flash program or erase command loaded during a command write sequence will not execute and the accerr bit in the fstat register will set. 27.4.1.2 command write sequence the memory controller will launch all valid flash commands entered using a command write sequence. before launching a command, the accerr and fpviol bits in the fstat register must be clear (see section 27.3.2.7 ) and the ccif flag should be tested to determine the status of the current command write sequence. if ccif is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the fccob register are ignored. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1045 27.4.1.2.1 de?e fccob contents the fccob parameter ?lds must be loaded with all required parameters for the flash command being executed. access to the fccob parameter ?lds is controlled via the ccobix bits in the fccobix register (see section 27.3.2.3 ). the contents of the fccob parameter ?lds are transferred to the memory controller when the user clears the ccif command completion ?g in the fstat register (writing 1 clears the ccif to 0). the ccif ?g will remain clear until the flash command has completed. upon completion, the memory controller will return ccif to 1 and the fccob register will be used to communicate any results. the ?w for a generic command write sequence is shown in figure 27-26 . chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1046 freescale semiconductor figure 27-26. generic flash command write sequence flowchart write to fccobix register write: fstat register (to launch command) clear ccif 0x80 clear accerr/fpviol 0x30 write: fstat register yes no access error and protection violation read: fstat register read: fstat register no start yes check ccif set? fccob accerr/ fpviol set? exit write: fclkdiv register read: fclkdiv register yes no clock register written check fdivld set? no bit polling for command completion check yes ccif set? to identify speci? command parameter to load. write to fccob register to load required command parameter. yes no more parameters? availability check results from previous command note: fclkdiv must be set after each reset chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1047 27.4.1.3 valid flash module commands table 27-30. flash commands by mode fcmd command unsecured secured ns (1) 1. unsecured normal single chip mode. nx (2) 2. unsecured normal expanded mode. ss (3) 3. unsecured special single chip mode. st (4) 4. unsecured special mode. ns (5) 5. secured normal single chip mode. nx (6) 6. secured normal expanded mode. ss (7) 7. secured special single chip mode. st (8) 8. secured special mode. 0x01 erase verify all blocks ???????? 0x02 erase verify block ???????? 0x03 erase verify p-flash section ????? 0x04 read once ????? 0x05 load data field ????? 0x06 program p-flash ????? 0x07 program once ????? 0x08 erase all blocks ?? ?? 0x09 erase p-flash block ????? 0x0a erase p-flash sector ????? 0x0b unsecure flash ?? ?? 0x0c verify backdoor access key ?? 0x0d set user margin level ????? 0x0e set field margin level ?? 0x0f full partition d-flash ?? 0x10 erase verify d-flash section ????? 0x11 program d-flash ????? 0x12 erase d-flash sector ????? 0x13 enable eeprom emulation ???????? 0x14 disable eeprom emulation ???????? 0x15 eeprom emulation query ???????? 0x20 partition d-flash ???????? chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1048 freescale semiconductor 27.4.1.4 p-flash commands table 27-31 summarizes the valid p-flash commands along with the effects of the commands on the p- flash block and other resources within the flash module. 27.4.1.5 d-flash and eee commands table 27-32 summarizes the valid d-flash and eee commands along with the effects of the commands on the d-flash block and eee operation. table 27-31. p-flash commands fcmd command function on p-flash memory 0x01 erase verify all blocks verify that all p-flash (and d-flash) blocks are erased. 0x02 erase verify block verify that a p-flash block is erased. 0x03 erase verify p- flash section verify that a given number of words starting at the address provided are erased. 0x04 read once read a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that was previously programmed using the program once command. 0x05 load data field load data for simultaneous multiple p-flash block operations. 0x06 program p-flash program a phrase in a p-flash block and any previously loaded phrases for any other p- flash block (see load data field command). 0x07 program once program a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that is allowed to be programmed only once. 0x08 erase all blocks erase all p-flash (and d-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x09 erase p-flash block erase a single p-flash block. an erase of the full p-flash block is only possible when fpldis, fphdis and fpopen bits in the fprot register are set prior to launching the command. 0x0a erase p-flash sector erase all bytes in a p-flash sector. 0x0b unsecure flash supports a method of releasing mcu security by erasing all p-flash (and d-flash) blocks and verifying that all p-flash (and d-flash) blocks are erased. 0x0c verify backdoor access key supports a method of releasing mcu security by verifying a set of security keys. 0x0d set user margin level speci?s a user margin read level for all p-flash blocks. 0x0e set field margin level speci?s a ?ld margin read level for all p-flash blocks (special modes only). table 27-32. d-flash commands fcmd command function on d-flash memory 0x01 erase verify all blocks verify that all d-flash (and p-flash) blocks are erased. 0x02 erase verify block verify that the d-flash block is erased. chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1049 27.4.2 flash command description this section provides details of all available flash commands launched by a command write sequence. the accerr bit in the fstat register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the memory controller: starting any command write sequence that programs or erases flash memory before initializing the fclkdiv register writing an invalid command as part of the command write sequence for additional possible errors, refer to the error handling table provided for each command if a flash block is read during execution of an algorithm (ccif = 0) on that same block, the read operation will return invalid data. if the sfdif or dfdif flags were not previously set when the invalid read operation occurred, both the sfdif and dfdif flags will be set and the feccr registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. if the accerr or fpviol bits are set in the fstat register, the user must clear these bits before starting any command write sequence (see section 27.3.2.7 ). 0x08 erase all blocks erase all d-flash (and p-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x0b unsecure flash supports a method of releasing mcu security by erasing all d-flash (and p-flash) blocks and verifying that all d-flash (and p-flash) blocks are erased. 0x0d set user margin level speci?s a user margin read level for the d-flash block. 0x0e set field margin level speci?s a ?ld margin read level for the d-flash block (special modes only). 0x0f full partition d- flash erase the d-flash block and partition an area of the d-flash block for user access. 0x10 erase verify d- flash section verify that a given number of words starting at the address provided are erased. 0x11 program d-flash program up to four words in the d-flash block. 0x12 erase d-flash sector erase all bytes in a sector of the d-flash block. 0x13 enable eeprom emulation enable eeprom emulation where writes to the buffer ram eee partition will be copied to the d-flash eee partition. 0x14 disable eeprom emulation suspend all current erase and program activity related to eeprom emulation but leave current eee tags set. 0x15 eeprom emulation query returns eee partition and status variables. 0x20 partition d-flash partition an area of the d-flash block for user access. table 27-32. d-flash commands fcmd command function on d-flash memory chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1050 freescale semiconductor caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. 27.4.2.1 erase verify all blocks command the erase verify all blocks command will verify that all p-flash and d-flash blocks have been erased. upon clearing ccif to launch the erase verify all blocks command, the memory controller will verify that the entire flash memory space is erased. the ccif ?g will set after the erase verify all blocks operation has completed. 27.4.2.2 erase verify block command the erase verify block command allows the user to verify that an entire p-flash or d-flash block has been erased. the fccob upper global address bits determine which block must be veri?d. upon clearing ccif to launch the erase verify block command, the memory controller will verify that the selected p-flash or d-flash block is erased. the ccif ?g will set after the erase verify block operation has completed. table 27-33. erase verify all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x01 not required table 27-34. erase verify all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 27-35. erase verify block command fccob requirements ccobix[2:0] fccob parameters 000 0x02 global address [22:16] of the flash block to be veri?d . chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1051 27.4.2.3 erase verify p-flash section command the erase verify p-flash section command will verify that a section of code in the p-flash memory is erased. the erase verify p-flash section command defines the starting point of the code to be verified and the number of phrases. the section to be verified cannot cross a 256 kbyte boundary in the p-flash memory space. upon clearing ccif to launch the erase verify p-flash section command, the memory controller will verify the selected section of flash memory is erased. the ccif ?g will set after the erase verify p-flash section operation has completed. table 27-36. erase verify block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if an invalid global address [22:16] is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 27-37. erase verify p-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x03 global address [22:16] of a p-flash block 001 global address [15:0] of the ?st phrase to be veri?d 010 number of phrases to be veri?d table 27-38. erase verify p-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if the requested section crosses a 256 kbyte boundary fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1052 freescale semiconductor 27.4.2.4 read once command the read once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of p-flash block 0. the read once field is programmed using the program once command described in section 27.4.2.7 . the read once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the read once command, a read once phrase is fetched and stored in the fccob indexed register. the ccif ?g will set after the read once operation has completed. valid phrase index values for the read once command range from 0x0000 to 0x0007. during execution of the read once command, any attempt to read addresses within p-flash block 0 will return invalid data. 128 27.4.2.5 load data field command the load data field command is executed to provide fccob parameters for multiple p-flash blocks for a future simultaneous program operation in the p-flash memory space. ferstat epviolif none table 27-39. read once command fccob requirements ccobix[2:0] fccob parameters 000 0x04 not required 001 read once phrase index (0x0000 - 0x0007) 010 read once word 0 value 011 read once word 1 value 100 read once word 2 value 101 read once word 3 value table 27-40. read once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid phrase index is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 27-38. erase verify p-flash section command error handling register error bit error condition chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1053 upon clearing ccif to launch the load data field command, the fccob registers will be transferred to the memory controller and be programmed in the block speci?d at the global address given with a future program p-flash command launched on a p-flash block. the ccif ?g will set after the load data field operation has completed. note that once a load data field command sequence has been initiated, the load data field command sequence will be cancelled if any command other than load data field or the future program p-flash is launched. similarly, if an error occurs after launching a load data field or program p-flash command, the associated load data field command sequence will be cancelled. 27.4.2.6 program p-flash command the program p-flash operation will program a previously erased phrase in the p-flash memory using an embedded algorithm. table 27-41. load data field command fccob requirements ccobix[2:0] fccob parameters 000 0x05 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 011 word 1 100 word 2 101 word 3 table 27-42. load data field command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 none mgstat0 none ferstat epviolif none chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1054 freescale semiconductor caution a p-flash phrase must be in the erased state before being programmed. cumulative programming of bits within a flash phrase is not allowed. upon clearing ccif to launch the program p-flash command, the memory controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. the ccif ?g will set after the program p-flash operation has completed. 27.4.2.7 program once command the program once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in p-flash block 0. the program once reserved field can be read using the read once command as described in section 27.4.2.4 . the program once command must only be issued once since the nonvolatile information register in p-flash block 0 cannot be erased. the program table 27-43. program p-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x06 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 program value 011 word 1 program value 100 word 2 program value 101 word 3 program value table 27-44. program p-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1055 once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the program once command, the memory controller ?st veri?s that the selected phrase is erased. if erased, then the selected phrase will be programmed and then veri?d with read back. the ccif ?g will remain clear, setting only after the program once operation has completed. the reserved nonvolatile information register accessed by the program once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. valid phrase index values for the program once command range from 0x0000 to 0x0007. during execution of the program once command, any attempt to read addresses within p-flash block 0 will return invalid data. 27.4.2.8 erase all blocks command the erase all blocks operation will erase the entire p-flash and d-flash memory space including the eee nonvolatile information register. table 27-45. program once command fccob requirements ccobix[2:0] fccob parameters 000 0x07 not required 001 program once phrase index (0x0000 - 0x0007) 010 program once word 0 value 011 program once word 1 value 100 program once word 2 value 101 program once word 3 value table 27-46. program once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid phrase index is supplied set if the requested phrase has already been programmed (1) 1. if a program once phrase is initially programmed to 0xffff_ffff_ffff_ffff, the program once command will be allowed to execute again on that same phrase. fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1056 freescale semiconductor upon clearing ccif to launch the erase all blocks command, the memory controller will erase the entire flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g will set after the erase all blocks operation has completed. 27.4.2.9 erase p-flash block command the erase p-flash block operation will erase all addresses in a p-flash block. upon clearing ccif to launch the erase p-flash block command, the memory controller will erase the selected p-flash block and verify that it is erased. the ccif ?g will set after the erase p-flash block operation has completed. table 27-47. erase all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x08 not required table 27-48. erase all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif set if any area of the buffer ram eee partition is protected table 27-49. erase p-flash block command fccob requirements ccobix[2:0] fccob parameters 000 0x09 global address [22:16] to identify p-flash block 001 global address [15:0] in p-flash block to be erased chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1057 27.4.2.10 erase p-flash sector command the erase p-flash sector operation will erase all addresses in a p-flash sector. upon clearing ccif to launch the erase p-flash sector command, the memory controller will erase the selected flash sector and then verify that it is erased. the ccif ?g will be set after the erase p-flash sector operation has completed. table 27-50. erase p-flash block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:16] is supplied fpviol set if an area of the selected p-flash block is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 27-51. erase p-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x0a global address [22:16] to identify p-flash block to be erased 001 global address [15:0] anywhere within the sector to be erased. refer to section 27.1.2.1 for the p-flash sector size. table 27-52. erase p-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:16] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) fpviol set if the selected p-flash sector is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1058 freescale semiconductor 27.4.2.11 unsecure flash command the unsecure flash command will erase the entire p-flash and d-flash memory space and, if the erase is successful, will release security. upon clearing ccif to launch the unsecure flash command, the memory controller will erase the entire p-flash and d-flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. if the erase verify is not successful, the unsecure flash operation sets mgstat1 and terminates without changing the security state. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g is set after the unsecure flash operation has completed. 27.4.2.12 verify backdoor access key command the verify backdoor access key command will only execute if it is enabled by the keyen bits in the fsec register (see table 27-11 ). the verify backdoor access key command releases security if user- supplied keys match those stored in the flash security bytes of the flash configuration field (see table 27- 3 ). the verify backdoor access key command must not be executed from the flash block containing the backdoor comparison key to avoid code runaway. table 27-53. unsecure flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0b not required table 27-54. unsecure flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif set if any area of the buffer ram eee partition is protected table 27-55. verify backdoor access key command fccob requirements ccobix[2:0] fccob parameters 000 0x0c not required 001 key 0 010 key 1 011 key 2 100 key 3 chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1059 upon clearing ccif to launch the verify backdoor access key command, the memory controller will check the fsec keyen bits to verify that this command is enabled. if not enabled, the memory controller sets the accerr bit in the fstat register and terminates. if the command is enabled, the memory controller compares the key provided in fccob to the backdoor comparison key in the flash con?uration ?ld with key 0 compared to 0x7f_ff00, etc. if the backdoor keys match, security will be released. if the backdoor keys do not match, security is not released and all future attempts to execute the verify backdoor access key command are aborted (set accerr) until a reset occurs. the ccif flag is set after the verify backdoor access key operation has completed. 27.4.2.13 set user margin level command the set user margin level command causes the memory controller to set the margin level for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set user margin level command, the memory controller will set the user margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set user margin level command are de?ed in table 27-58 . table 27-56. verify backdoor access key command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 100 at command launch set if a load data field command sequence is currently active set if an incorrect backdoor key is supplied set if backdoor key access has not been enabled (keyen[1:0] != 10, see section 27.3.2.2 ) set if the backdoor key has mismatched since the last reset fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 27-57. set user margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0d global address [22:16] to identify the flash block 001 margin level setting table 27-58. valid set user margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1060 freescale semiconductor note user margin levels can be used to check that flash memory contents have adequate margin for normal level read operations. if unexpected results are encountered when checking flash memory contents at user margin levels, a potential loss of information has been detected. 27.4.2.14 set field margin level command the set field margin level command, valid in special modes only, causes the memory controller to set the margin level specified for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set field margin level command, the memory controller will set the ?ld margin level for the targeted block and then set the ccif ?g. 0x0002 user margin-0 level (2) 1. read margin to the erased state 2. read margin to the programmed state table 27-59. set user margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:16] is supplied set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 27-60. set field margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0e global address [22:16] to identify the flash block 001 margin level setting table 27-58. valid set user margin level settings ccob (ccobix=001) level description chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1061 valid margin level settings for the set field margin level command are de?ed in table 27-61 . caution field margin levels must only be used during verify of the initial factory programming. note field margin levels can be used to check that flash memory contents have adequate margin for data retention at the normal level setting. if unexpected results are encountered when checking flash memory contents at ?ld margin levels, the flash memory contents should be erased and reprogrammed. 27.4.2.15 full partition d-flash command the full partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. table 27-61. valid set field margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) 1. read margin to the erased state 0x0002 user margin-0 level (2) 2. read margin to the programmed state 0x0003 field margin-1 level 1 0x0004 field margin-0 level 2 table 27-62. set field margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:16] is supplied set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1062 freescale semiconductor upon clearing ccif to launch the full partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 27-7 ) program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 27-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 27-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 27-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the full partition d-flash operation has completed, the ccif ?g will set. running the full partition d-flash command a second time will result in the previous partition values and the entire d-flash memory being erased. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 27-63. full partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0f not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1063 27.4.2.16 erase verify d-flash section command the erase verify d-flash section command will verify that a section of code in the d-flash user partition is erased. the erase verify d-flash section command defines the starting point of the data to be verified and the number of words. upon clearing ccif to launch the erase verify d-flash section command, the memory controller will verify the selected section of d-flash memory is erased. the ccif ?g will set after the erase verify d- flash section operation has completed. table 27-64. full partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 27-65. erase verify d-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x10 global address [22:16] to identify the d-flash block 001 global address [15:0] of the ?st word to be veri?d 010 number of words to be veri?d chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1064 freescale semiconductor 27.4.2.17 program d-flash command the program d-flash operation programs one to four previously erased words in the d-flash user partition. the program d-flash operation will confirm that the targeted location(s) were successfully programmed upon completion. caution a flash word must be in the erased state before being programmed. cumulative programming of bits within a flash word is not allowed. upon clearing ccif to launch the program d-flash command, the user-supplied words will be transferred to the memory controller and be programmed. the ccobix index value at program d-flash command launch determines how many words will be programmed in the d-flash block. no protection checks are made in the program d-flash operation on the d-flash block, only access error checks. the ccif ?g is set when the operation has completed. table 27-66. erase verify d-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area of the d-flash eee partition set if the requested section breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 27-67. program d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x11 global address [22:16] to identify the d-flash block 001 global address [15:0] of word to be programmed 010 word 0 program value 011 word 1 program value, if desired 100 word 2 program value, if desired 101 word 3 program value, if desired chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1065 27.4.2.18 erase d-flash sector command the erase d-flash sector operation will erase all addresses in a sector of the d-flash user partition. upon clearing ccif to launch the erase d-flash sector command, the memory controller will erase the selected flash sector and verify that it is erased. the ccif ?g will set after the erase d-flash sector operation has completed. table 27-68. program d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] < 010 at command launch set if ccobix[2:0] > 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area in the d-flash eee partition set if the requested group of words breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 27-69. erase d-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x12 global address [22:16] to identify d-flash block 001 global address [15:0] anywhere within the sector to be erased. see section 27.1.2.2 for d-flash sector size. chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1066 freescale semiconductor 27.4.2.19 enable eeprom emulation command the enable eeprom emulation command causes the memory controller to enable eee activity. eee activity is disabled after any reset. upon clearing ccif to launch the enable eeprom emulation command, the ccif ?g will set after the memory controller enables eee operations using the contents of the eee tag ram and tag counter. the full partition d-flash or the partition d-flash command must be run prior to launching the enable eeprom emulation command. table 27-70. erase d-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 27-71. enable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x13 not required table 27-72. enable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1067 27.4.2.20 disable eeprom emulation command the disable eeprom emulation command causes the memory controller to suspend current eee activity. upon clearing ccif to launch the disable eeprom emulation command, the memory controller will halt eee operations at the next convenient point without clearing the eee tag ram or tag counter before setting the ccif ?g. 27.4.2.21 eeprom emulation query command the eeprom emulation query command returns eee partition and status variables. upon clearing ccif to launch the eeprom emulation query command, the ccif ?g will set after the eee partition and status variables are stored in the fccobix register.if the emulation query command is executed prior to partitioning (partition d-flash command section 27.4.2.15 ), the following reset values are returned: dfpart = 0x_ffff, erpart = 0x_ffff, ecount = 0x_ffff, dead sector count = 0x_00, ready sector count = 0x_00. table 27-73. disable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x14 not required table 27-74. disable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 27-75. eeprom emulation query command fccob requirements ccobix[2:0] fccob parameters 000 0x15 not required 001 return dfpart 010 return erpart 011 return ecount (1) 1. indicates sector erase count 100 return dead sector count return ready sector count chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1068 freescale semiconductor 27.4.2.22 partition d-flash command the partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. the erase all blocks command must be run prior to launching the partition d-flash command. upon clearing ccif to launch the partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase verify the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 27-7 ) table 27-76. eeprom emulation query command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 27-77. partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x20 not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1069 program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 27-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 27-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 27-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the partition d-flash operation has completed, the ccif ?g will set. running the partition d-flash command a second time will result in the accerr bit within the fstat register being set. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 27-78. partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 27-30 ) set if partitions have already been de?ed set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1070 freescale semiconductor 27.4.3 interrupts the flash module can generate an interrupt when a flash command operation has completed or when a flash command operation has detected an eee error or an ecc fault. note vector addresses and their relative interrupt priority are determined at the mcu level. 27.4.3.1 description of flash interrupt operation the flash module uses the ccif ?g in combination with the ccie interrupt enable bit to generate the flash command interrupt request. the flash module uses the erseif, pgmeif, epviolif, ersvif1, ersvif0, dfdif and sfdif ?gs in combination with the erseie, pgmeie, epviolie, ersvie1, ersvie0, dfdie and sfdie interrupt enable bits to generate the flash error interrupt request. for a detailed description of the register bits involved, refer to section 27.3.2.5, ?lash configuration register (fcnfg) ? section 27.3.2.6, ?lash error configuration register (fercnfg) ? section 27.3.2.7, ?lash status register (fstat) ? and section 27.3.2.8, ?lash error status register (ferstat) ? the logic used for generating the flash module interrupts is shown in figure 27-27 . table 27-79. flash interrupt sources interrupt source interrupt flag local enable global (ccr) mask flash command complete ccif (fstat register) ccie (fcnfg register) i bit flash eee erase error erserif (ferstat register) erserie (fercnfg register) i bit flash eee program error pgmerif (ferstat register) pgmerie (fercnfg register) i bit flash eee protection violation epviolif (ferstat register) epviolie (fercnfg register) i bit flash eee error type 1 violation ersvif1 (ferstat register) ersvie1 (fercnfg register) i bit flash eee error type 0 violation ersvif0 (ferstat register) ersvie0 (fercnfg register) i bit ecc double bit fault on flash read dfdif (ferstat register) dfdie (fercnfg register) i bit ecc single bit fault on flash read sfdif (ferstat register) sfdie (fercnfg register) i bit chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1071 figure 27-27. flash module interrupts implementation 27.4.4 wait mode the flash module is not affected if the mcu enters wait mode. the flash module can recover the mcu from wait via the ccif interrupt (see section 27.4.3, ?nterrupts ). 27.4.5 stop mode if a flash command is active (ccif = 0) or an ee-emulation operation is pending when the mcu requests stop mode, the current flash operation will be completed before the cpu is allowed to enter stop mode. 27.5 security the flash module provides security information to the mcu. the flash security state is de?ed by the sec bits of the fsec register (see table 27-12 ). during reset, the flash module initializes the fsec register using data read from the security byte of the flash con?uration ?ld at global address 0x7f_ff0f. flash error interrupt request ccif ccie epviolif epviolie ersvif1 ersvie1 ersvif0 ersvie0 pgmerif pgmerie erserif erserie flash command interrupt request dfdif dfdie sfdif sfdie chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1072 freescale semiconductor the security state out of reset can be permanently changed by programming the security byte of the flash con?uration ?ld. this assumes that you are starting from a mode where the necessary p-flash erase and program commands are available and that the upper region of the p-flash is unprotected. if the flash security byte is successfully programmed, its new value will take affect after the next mcu reset. the following subsections describe these security-related subjects: unsecuring the mcu using backdoor key access unsecuring the mcu in special single chip mode using bdm mode and security effects on flash command availability 27.5.1 unsecuring the mcu using backdoor key access the mcu may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7f_ff00?x7f_ff07). if the keyen[1:0] bits are in the enabled state (see section 27.3.2.2 ), the verify backdoor access key command (see section 27.4.2.12 ) allows the user to present four prospective keys for comparison to the keys stored in the flash memory via the memory controller. if the keys presented in the verify backdoor access key command match the backdoor keys stored in the flash memory, the sec bits in the fsec register (see table 27-12 ) will be changed to unsecure the mcu. key values of 0x0000 and 0xffff are not permitted as backdoor keys. while the verify backdoor access key command is active, p-flash block 0 will not be available for read access and will return invalid data. the user code stored in the p-flash memory must have a method of receiving the backdoor keys from an external stimulus. this external stimulus would typically be through one of the on-chip serial ports. if the keyen[1:0] bits are in the enabled state (see section 27.3.2.2 ), the mcu can be unsecured by the backdoor key access sequence described below: 1. follow the command sequence for the verify backdoor access key command as explained in section 27.4.2.12 2. if the verify backdoor access key command is successful, the mcu is unsecured and the sec[1:0] bits in the fsec register are forced to the unsecure state of 10 the verify backdoor access key command is monitored by the memory controller and an illegal key will prohibit future use of the verify backdoor access key command. a reset of the mcu is the only method to re-enable the verify backdoor access key command. after the backdoor keys have been correctly matched, the mcu will be unsecured. after the mcu is unsecured, the sector containing the flash security byte can be erased and the flash security byte can be reprogrammed to the unsecure state, if desired. in the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7f_ff00?x7f_ff07 in the flash con?uration ?ld. the security as de?ed in the flash security byte (0x7f_ff0f) is not changed by using the verify backdoor access key command sequence. the backdoor keys stored in addresses 0x7f_ff00?x7f_ff07 are unaffected by the verify backdoor access key command sequence. after the next reset of the mcu, the security state of the flash module is determined by the flash security byte chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1073 (0x7f_ff0f). the verify backdoor access key command sequence has no effect on the program and erase protections de?ed in the flash protection register, fprot. 27.5.2 unsecuring the mcu in special single chip mode using bdm the mcu can be unsecured in special single chip mode by erasing the p-flash and d-flash memory by one of the following methods: reset the mcu into special single chip mode, delay while the erase test is performed by the bdm, send bdm commands to disable protection in the p-flash and d-flash memory, and execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. reset the mcu into special expanded wide mode, disable protection in the p-flash and d-flash memory and run code from external memory to execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. after the ccif ?g sets to indicate that the erase all blocks operation has completed, reset the mcu into special single chip mode. the bdm will execute the erase verify all blocks command write sequence to verify that the p-flash and d-flash memory is erased. if the p-flash and d-flash memory are verified as erased the mcu will be unsecured. all bdm commands will be enabled and the flash security byte may be programmed to the unsecure state by the following method: send bdm commands to execute a ?rogram p-flash?command sequence to program the flash security byte to the unsecured state and reset the mcu. 27.5.3 mode and security effects on flash command availability the availability of flash module commands depends on the mcu operating mode and security state as shown in table 27-30 . 27.6 initialization on each system reset the flash module executes a reset sequence which establishes initial values for the flash block configuration parameters, the fprot and dfprot protection registers, and the fopt and fsec registers. the flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. if a double bit fault is detected during the reset sequence, both mgstat bits in the fstat register will be set. the accerr bit in the fstat register is set if errors are encountered while initializing the eee buffer ram during the reset sequence. ccif remains clear throughout the reset sequence. the flash module holds off all cpu access for the initial portion of the reset sequence. while flash reads are possible when the hold is removed, writes to the fccobix, fccobhi, and fccoblo registers are ignored to prevent command activity while the memory controller remains busy. completion of the reset sequence is marked by setting ccif high which enables writes to the fccobix, fccobhi, and fccoblo registers to launch any available flash command. if a reset occurs while any flash command is in progress, that command will be immediately aborted. the state of the word being programmed or the sector/block being erased is not guaranteed. chapter 27 512 kbyte flash module (s12xftm512k3v1) mc9s12xe-family reference manual , rev. 1.21 1074 freescale semiconductor mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1075 chapter 28 768 kbyte flash module (s12xftm768k4v2) 28.1 introduction the ftm768k4 module implements the following: 768 kbytes of p-flash (program flash) memory, consisting of 4 physical flash blocks, intended primarily for nonvolatile code storage 32 kbytes of d-flash (data flash) memory, consisting of 1 physical flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated eeprom, as basic flash memory primarily intended for nonvolatile data storage, or as a combination of both 4 kbytes of buffer ram, consisting of 1 physical ram block, that can be used as emulated eeprom using a built-in hardware scheme, as basic ram, or as a combination of both table 28-1. revision history revision number revision date sections affected description of changes v02.09 29 nov 2007 - cleanup v02.10 19 dec 2007 1.4.2/1-37 1.4.2/1-37 1.3.1/1-6 - updated command error handling tables based on parent-child relationship with ftm1024k5 - corrected error handling table for full partition d-flash, partition d-flash, and eeprom emulation query commands - corrected p-flash memory addressing table v02.11 25 sep 2009 1.1/1-1 1.3.2.1/1-13 1.4.2.4/1-40 1.4.2.7/1-43 1.4.2.12/1-47 1.4.2.12/1-47 1.4.2.12/1-47 1.4.2.20/1-56 1.3.2/1-11 1.3.2.1/1-13 1.4.1.2/1-32 1.6/1-62 - clarify single bit fault correction for p-flash phrase - expand fdiv vs oscclk frequency table - add statement concerning code runaway when executing read once command from flash block containing associated ?lds - add statement concerning code runaway when executing program once command from flash block containing associated ?lds - add statement concerning code runaway when executing verify backdoor access key command from flash block containing associated ?lds - relate key 0 to associated backdoor comparison key address - change ?ower down reset?to ?eset - add accerr condition for disable eeprom emulation command the following changes were made to clarify module behavior related to flash register access during reset sequence and while flash commands are active: - add caution concerning register writes while command is active - writes to fclkdiv are allowed during reset sequence while ccif is clear - add caution concerning register writes while command is active - writes to fccobix, fccobhi, fccoblo registers are ignored during reset sequence mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1076 the flash memory is ideal for single-supply applications allowing for ?ld reprogramming without requiring external high voltage sources for program or erase operations. the flash module includes a memory controller that executes commands to modify flash memory contents or con?ure module resources for emulated eeprom operation. the user interface to the memory controller consists of the indexed flash common command object (fccob) register which is written to with the command, global address, data, and any required command parameters. the memory controller must complete the execution of a command before the fccob register can be written to with a new command. caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. the ram and flash memory may be read as bytes, aligned words, or misaligned words. read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. for flash memory, an erased bit reads 1 and a programmed bit reads 0. it is not possible to read from a flash block while any command is executing on that speci? flash block. it is possible to read from a flash block while a command is executing on a different flash block. both p-flash and d-flash memories are implemented with error correction codes (ecc) that can resolve single bit faults and detect double bit faults. for p-flash memory, the ecc implementation requires that programming be done on an aligned 8 byte basis (a flash phrase). since p-flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 28.1.1 glossary buffer ram the buffer ram constitutes the volatile memory store required for eee. memory space in the buffer ram not required for eee can be partitioned to provide volatile memory space for applications. command write sequence ?an mcu instruction sequence to execute built-in algorithms (including program and erase) on the flash memory. d-flash memory ?the d-flash memory constitutes the nonvolatile memory store required for eee. memory space in the d-flash memory not required for eee can be partitioned to provide nonvolatile memory space for applications. d-flash sector the d-flash sector is the smallest portion of the d-flash memory that can be erased. the d-flash sector consists of four 64 byte rows for a total of 256 bytes. eee (emulated eeprom) ?a method to emulate the small sector size features and endurance characteristics associated with an eeprom. chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1077 eee ifr nonvolatile information register located in the d-flash block that contains data required to partition the d-flash memory and buffer ram for eee. the eee ifr is visible in the global memory map by setting the eeeifron bit in the mmcctl1 register. nvm command mode an nvm mode using the cpu to setup the fccob register to pass parameters required for flash command execution. phrase an aligned group of four 16-bit words within the p-flash memory. each phrase includes eight ecc bits for single bit fault correction and double bit fault detection within the phrase. p-flash memory the p-flash memory constitutes the main nonvolatile memory store for applications. p-flash sector ?the p-flash sector is the smallest portion of the p-flash memory that can be erased. each p-flash sector contains 1024 bytes. program ifr ?nonvolatile information register located in the p-flash block that contains the device id, version id, and the program once ?ld. the program ifr is visible in the global memory map by setting the pgmifron bit in the mmcctl1 register. 28.1.2 features 28.1.2.1 p-flash features 768 kbytes of p-flash memory composed of two 256 kbyte flash blocks and two 128 kbyte flash blocks. the 256 kbyte flash block consists of two 128 kbyte sections each divided into 128 sectors of 1024 bytes. the 128 kbyte flash blocks are each divided into 128 sectors of 1024 bytes. single bit fault correction and double bit fault detection within a 64-bit phrase during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and phrase program operation ability to program up to one phrase in each p-flash block simultaneously flexible protection scheme to prevent accidental program or erase of p-flash memory 28.1.2.2 d-flash features up to 32 kbytes of d-flash memory with 256 byte sectors for user access dedicated commands to control access to the d-flash memory over eee operation single bit fault correction and double bit fault detection within a word during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and word program operation ability to program up to four words in a burst sequence 28.1.2.3 emulated eeprom features up to 4 kbytes of emulated eeprom (eee) accessible as 4 kbytes of ram chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1078 freescale semiconductor flexible protection scheme to prevent accidental program or erase of data automatic eee ?e handling using an internal memory controller automatic transfer of valid eee data from d-flash memory to buffer ram on reset ability to monitor the number of outstanding eee related buffer ram words left to be programmed into d-flash memory ability to disable eee operation and allow priority access to the d-flash memory ability to cancel all pending eee operations and allow priority access to the d-flash memory 28.1.2.4 user buffer ram features up to 4 kbytes of ram for user access 28.1.2.5 other flash module features no external high-voltage power supply required for flash memory program and erase operations interrupt generation on flash command completion and flash error detection security mechanism to prevent unauthorized access to the flash memory 28.1.3 block diagram the block diagram of the flash module is shown in figure 1-1 . chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1079 figure 28-1. ftm768k4 block diagram 28.2 external signal description the flash module contains no signals that connect off-chip. oscillator clock divider clock (xtal) command interrupt request fclk protection security registers flash interface p-flash block 0 32kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 p-flash sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 16kx72 16kx72 16bit internal bus p-flash block 1s block 1n xgate 16kx72 16kx72 16kx72 16kx72 p-flash block 2 32kx72 error interrupt request memory cpu controller d-flash 16kx22 buffer ram tag ram 128x16 2kx16 sector 0 sector 1 sector 127 scratch ram 512x16 chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1080 freescale semiconductor 28.3 memory map and registers this section describes the memory map and registers for the flash module. read data from unimplemented memory space in the flash module is unde?ed. write access to unimplemented or reserved memory space in the flash module will be ignored by the flash module. 28.3.1 module memory map the s12x architecture places the p-flash memory between global addresses 0x74_0000 and 0x7f_ffff as shown in table 1-2 . the p-flash memory map is shown in figure 1-2 . the fprot register, described in section 1.3.2.9 , can be set to protect regions in the flash memory from accidental program or erase. three separate memory regions, one growing upward from global address 0x7f_8000 in the flash memory (called the lower region), one growing downward from global address 0x7f_ffff in the flash memory (called the higher region), and the remaining addresses in the flash memory, can be activated for protection. the flash memory addresses covered by these protectable regions are shown in the p-flash memory map. the higher address region is mainly targeted to hold the boot loader code since it covers the vector space. default protection settings as well as security information that allows the mcu to restrict access to the flash module are stored in the flash con?uration ?ld as described in table 1-3 . table 28-2. p-flash memory addressing global address size (bytes) description 0x7c_0000 ?0x7f_ffff 256 k p-flash block 0 contains flash con?uration field (see table 1-3 ) 0x7a_0000 ?0x7b_ffff 128 k p-flash block 1n 0x78_0000 ?0x79_ffff 128 k p-flash block 1s 0x74_0000 ?0x77_ffff 256 k p-flash block 2 0x70_0000 ?0x73_ffff 256 k no p-flash memory table 28-3. flash con?uration field (1) global address size (bytes) description 0x7f_ff00 ?0x7f_ff07 8 backdoor comparison key refer to section 1.4.2.12, ?erify backdoor access key command , and section 1.5.1, ?nsecuring the mcu using backdoor key access 0x7f_ff08 0x7f_ff0b (2) 4 reserved 0x7f_ff0c 2 1 p-flash protection byte . refer to section 1.3.2.9, ?-flash protection register (fprot) 0x7f_ff0d 2 1 eee protection byte refer to section 1.3.2.10, ?ee protection register (eprot) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1081 0x7f_ff0e 2 1 flash nonvolatile byte refer to section 1.3.2.14, ?lash option register (fopt) 0x7f_ff0f 2 1 flash security byte refer to section 1.3.2.2, ?lash security register (fsec) 1. older versions may have swapped protection byte addresses 2. 0x7ff08 - 0x7f_ff0f form a flash phrase and must be programmed in a single command write sequence. each byte in the 0x7f_ff08 - 0x7f_ff0b reserved ?ld should be programmed to 0xff. table 28-3. flash con?uration field (1) global address size (bytes) description chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1082 freescale semiconductor figure 28-2. p-flash memory map flash con?uration field 0x7f_c000 flash protected/unprotected lower region 1, 2, 4, 8 kbytes 0x7f_8000 0x7f_9000 0x7f_8400 0x7f_8800 0x7f_a000 p-flash end = 0x7f_ffff 0x7f_f800 0x7f_f000 0x7f_e000 flash protected/unprotected higher region 2, 4, 8, 16 kbytes flash protected/unprotected region 8 kbytes (up to 29 kbytes) 16 bytes (0x7f_ff00 - 0x7f_ff0f) flash protected/unprotected region 736 kbytes p-flash start = 0x74_0000 chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1083 table 28-4. program ifr fields global address (pgmifron) size (bytes) field description 0x40_0000 ?0x40_0007 8 device id 0x40_0008 ?0x40_00e7 224 reserved 0x40_00e8 ?0x40_00e9 2 version id 0x40_00ea ?0x40_00ff 22 reserved 0x40_0100 ?0x40_013f 64 program once field refer to section 1.4.2.7, ?rogram once command 0x40_0140 ?0x40_01ff 192 reserved table 28-5. p-flash ifr accessibility global address (pgmifron) size (bytes) accessed from 0x40_0000 ?0x40_01ff 512 xbus0 (pblk0s) (1) 1. refer to table 1-4 for more details. 0x40_0200 ?0x40_03ff 512 unimplemented 0x40_0400 ?0x40_05ff 512 xbus0 (pblk1n) 0x40_0600 ?0x40_07ff 512 xbus1 (pblk1s) 0x40_0800 ?0x40_09ff 512 xbus0 (pblk2s) 0x40_0a00 ?0x40_0bff 512 unimplemented table 28-6. eee resource fields global address size (bytes) description 0x10_0000 ?0x10_7fff 32,768 d-flash memory (user and eee) 0x10_8000 ?0x11_ffff 98,304 reserved 0x12_0000 ?0x12_007f 128 eee nonvolatile information register (eeeifron (1) = 1) 0x12_0080 ?0x12_0fff 3,968 reserved 0x12_1000 ?0x12_1eff 3,840 reserved 0x12_1f00 ?0x12_1fff 256 eee tag ram (tmgramon 1 = 1) 0x12_2000 ?0x12_3bff 7,168 reserved 0x12_3c00 ?0x12_3fff 1,024 memory controller scratch ram (tmgramon 1 = 1) 0x12_4000 ?0x12_dfff 40,960 reserved 0x12_e000 ?0x12_ffff 8,192 reserved 0x13_0000 ?0x13_efff 61,440 reserved 0x13_f000 ?0x13_ffff 4,096 buffer ram (user and eee) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1084 freescale semiconductor figure 28-3. eee resource memory map 1. mmcctl1 register bit buffer ram start = 0x13_f000 buffer ram end = 0x13_ffff 0x13_ffc0 0x13_ff80 protectable region (eee only) 64, 128, 192, 256, 320, 384, 448, 512 bytes buffer ram 4 kbytes 0x13_ff40 0x13_ff00 0x13_fec0 0x13_fe80 0x13_fe40 0x13_fe00 0x12_ffff 0x12_4000 0x12_1000 memory controller scratch ram (tmgramon) 1024 bytes eee tag ram (tmgramon) 256 bytes eee nonvolatile information register (eeeifron) 128 bytes d-flash memory 32 kbytes d-flash start = 0x10_0000 d-flash user partition d-flash eee partition 0x12_0000 0x12_2000 0x12_e000 d-flash end = 0x10_7fff buffer ram user partition buffer ram eee partition chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1085 the full partition d-flash command (see section 1.4.2.15 ) is used to program the eee nonvolatile information register ?lds where address 0x12_0000 de?es the d-flash partition for user access and address 0x12_0004 de?es the buffer ram partition for eee operations. 28.3.2 register descriptions the flash module contains a set of 20 control and status registers located between flash module base + 0x0000 and 0x0013. a summary of the flash module registers is given in figure 1-4 with detailed descriptions in the following subsections. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. table 28-7. eee nonvolatile information register fields global address (eeeifron) size (bytes) description 0x12_0000 ?0x12_0001 2 d-flash user partition (dfpart) refer to section 1.4.2.15, ?ull partition d-flash command 0x12_0002 ?0x12_0003 2 d-flash user partition (duplicate (1) ) 1. duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 ?0x12_0005 2 buffer ram eee partition (erpart) refer to section 1.4.2.15, ?ull partition d-flash command 0x12_0006 ?0x12_0007 2 buffer ram eee partition (duplicate 1 ) 0x12_0008 ?0x12_007f 120 reserved address & name 76543210 0x0000 fclkdiv r fdivld fdiv6 fdiv5 fdiv4 fdiv3 fdiv2 fdiv1 fdiv0 w 0x0001 fsec r keyen1 keyen0 rnv5 rnv4 rnv3 rnv2 sec1 sec0 w 0x0002 fccobix r0 0 0 0 0 ccobix2 ccobix1 ccobix0 w 0x0003 feccrix r0 0 0 0 0 eccrix2 eccrix1 eccrix0 w 0x0004 fcnfg r ccie 00 ignsf 00 fdfd fsfd w figure 28-4. ftm768k4 register summary chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1086 freescale semiconductor 0x0005 fercnfg r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w 0x0006 fstat r ccif 0 accerr fpviol mgbusy rsvd mgstat1 mgstat0 w 0x0007 ferstat r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w 0x0008 fprot r fpopen rnv6 fphdis fphs1 fphs0 fpldis fpls1 fpls0 w 0x0009 eprot r epopen rnv6 rnv5 rnv4 epdis eps2 eps1 eps0 w 0x000a fccobhi r ccob15 ccob14 ccob13 ccob12 ccob11 ccob10 ccob9 ccob8 w 0x000b fccoblo r ccob7 ccob6 ccob5 ccob4 ccob3 ccob2 ccob1 ccob0 w 0x000c etaghi r etag15 etag14 etag13 etag12 etag11 etag10 etag9 etag8 w 0x000d etaglo r etag7 etag6 etag5 etag4 etag3 etag2 etag1 etag0 w 0x000e feccrhi r eccr15 eccr14 eccr13 eccr12 eccr11 eccr10 eccr9 eccr8 w 0x000f feccrlo r eccr7 eccr6 eccr5 eccr4 eccr3 eccr2 eccr1 eccr0 w 0x0010 fopt r nv7 nv6 nv5 nv4 nv3 nv2 nv1 nv0 w 0x0011 frsv0 r00000000 w 0x0012 frsv1 r00000000 w address & name 76543210 figure 28-4. ftm768k4 register summary (continued) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1087 28.3.2.1 flash clock divider register (fclkdiv) the fclkdiv register is used to control timed events in program and erase algorithms. all bits in the fclkdiv register are readable, bits 6? are write once and bit 7 is not writable. caution the fclkdiv register should never be written while a flash command is executing (ccif=0). the fclkdiv register is writable during the flash reset sequence even though ccif is clear. 0x0013 frsv2 r00000000 w = unimplemented or reserved offset module base + 0x0000 76543210 r fdivld fdiv[6:0] w reset 00000000 = unimplemented or reserved figure 28-5. flash clock divider register (fclkdiv) table 28-8. fclkdiv field descriptions field description 7 fdivld clock divider loaded 0 fclkdiv register has not been written 1 fclkdiv register has been written since the last reset 6? fdiv[6:0] clock divider bits ?fdiv[6:0] must be set to effectively divide oscclk down to generate an internal flash clock, fclk, with a target frequency of 1 mhz for use by the flash module to control timed events during program and erase algorithms. table 1-9 shows recommended values for fdiv[6:0] based on oscclk frequency. please refer to section 1.4.1, ?lash command operations , for more information. address & name 76543210 figure 28-4. ftm768k4 register summary (continued) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1088 freescale semiconductor table 28-9. fdiv vs oscclk frequency oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] min (1) 1. fdiv shown generates an fclk frequency of >0.8 mhz max (2) min 1 max 2 min 1 max 2 33.60 34.65 0x20 67.20 68.25 0x40 1.60 2.10 0x01 34.65 35.70 0x21 68.25 69.30 0x41 2.40 3.15 0x02 35.70 36.75 0x22 69.30 70.35 0x42 3.20 4.20 0x03 36.75 37.80 0x23 70.35 71.40 0x43 4.20 5.25 0x04 37.80 38.85 0x24 71.40 72.45 0x44 5.25 6.30 0x05 38.85 39.90 0x25 72.45 73.50 0x45 6.30 7.35 0x06 39.90 40.95 0x26 73.50 74.55 0x46 7.35 8.40 0x07 40.95 42.00 0x27 74.55 75.60 0x47 8.40 9.45 0x08 42.00 43.05 0x28 75.60 76.65 0x48 9.45 10.50 0x09 43.05 44.10 0x29 76.65 77.70 0x49 10.50 11.55 0x0a 44.10 45.15 0x2a 77.70 78.75 0x4a 11.55 12.60 0x0b 45.15 46.20 0x2b 78.75 79.80 0x4b 12.60 13.65 0x0c 46.20 47.25 0x2c 79.80 80.85 0x4c 13.65 14.70 0x0d 47.25 48.30 0x2d 80.85 81.90 0x4d 14.70 15.75 0x0e 48.30 49.35 0x2e 81.90 82.95 0x4e 15.75 16.80 0x0f 49.35 50.40 0x2f 82.95 84.00 0x4f 16.80 17.85 0x10 50.40 51.45 0x30 84.00 85.05 0x50 17.85 18.90 0x11 51.45 52.50 0x31 85.05 86.10 0x51 18.90 19.95 0x12 52.50 53.55 0x32 86.10 87.15 0x52 19.95 21.00 0x13 53.55 54.60 0x33 87.15 88.20 0x53 21.00 22.05 0x14 54.60 55.65 0x34 88.20 89.25 0x54 22.05 23.10 0x15 55.65 56.70 0x35 89.25 90.30 0x55 23.10 24.15 0x16 56.70 57.75 0x36 90.30 91.35 0x56 24.15 25.20 0x17 57.75 58.80 0x37 91.35 92.40 0x57 25.20 26.25 0x18 58.80 59.85 0x38 92.40 93.45 0x58 26.25 27.30 0x19 59.85 60.90 0x39 93.45 94.50 0x59 27.30 28.35 0x1a 60.90 61.95 0x3a 94.50 95.55 0x5a 28.35 29.40 0x1b 61.95 63.00 0x3b 95.55 96.60 0x5b 29.40 30.45 0x1c 63.00 64.05 0x3c 96.60 97.65 0x5c 30.45 31.50 0x1d 64.05 65.10 0x3d 97.65 98.70 0x5d 31.50 32.55 0x1e 65.10 66.15 0x3e 98.70 99.75 0x5e 32.55 33.60 0x1f 66.15 67.20 0x3f 99.75 100.80 0x5f chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1089 28.3.2.2 flash security register (fsec) the fsec register holds all bits associated with the security of the mcu and flash module. all bits in the fsec register are readable but not writable. during the reset sequence, the fsec register is loaded with the contents of the flash security byte in the flash configuration field at global address 0x7f_ff0f located in p-flash memory (see table 1-3 ) as indicated by reset condition f in figure 1-6 . if a double bit fault is detected while reading the p-flash phrase containing the flash security byte during the reset sequence, all bits in the fsec register will be set to leave the flash module in a secured state with backdoor key access disabled. 2. fdiv shown generates an fclk frequency of 1.05 mhz offset module base + 0x0001 76543210 r keyen[1:0] rnv[5:2] sec[1:0] w reset f f ffffff = unimplemented or reserved figure 28-6. flash security register (fsec) table 28-10. fsec field descriptions field description 7? keyen[1:0] backdoor key security enable bits the keyen[1:0] bits de?e the enabling of backdoor key access to the flash module as shown in table 1-11 . 5? rnv[5:2} reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements. 1? sec[1:0] flash security bits ?the sec[1:0] bits de?e the security state of the mcu as shown in table 1-12 . if the flash module is unsecured using backdoor key access, the sec bits are forced to 10. table 28-11. flash keyen states keyen[1:0] status of backdoor key access 00 disabled 01 disabled (1) 1. preferred keyen state to disable backdoor key access. 10 enabled 11 disabled chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1090 freescale semiconductor the security function in the flash module is described in section 1.5 . 28.3.2.3 flash ccob index register (fccobix) the fccobix register is used to index the fccob register for flash memory operations. ccobix bits are readable and writable while remaining bits read 0 and are not writable. 28.3.2.4 flash eccr index register (feccrix) the feccrix register is used to index the feccr register for ecc fault reporting. eccrix bits are readable and writable while remaining bits read 0 and are not writable. table 28-12. flash security states sec[1:0] status of security 00 secured 01 secured (1) 1. preferred sec state to set mcu to secured state. 10 unsecured 11 secured offset module base + 0x0002 76543210 r00000 ccobix[2:0] w reset 00000000 = unimplemented or reserved figure 28-7. fccob index register (fccobix) table 28-13. fccobix field descriptions field description 2? ccobix[1:0] common command register index the ccobix bits are used to select which word of the fccob register array is being read or written to. see section 1.3.2.11, ?lash common command object register (fccob) , for more details. offset module base + 0x0003 76543210 r00000 eccrix[2:0] w reset 00000000 = unimplemented or reserved figure 28-8. feccr index register (feccrix) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1091 28.3.2.5 flash con?uration register (fcnfg) the fcnfg register enables the flash command complete interrupt and forces ecc faults on flash array read access from the cpu or xgate. ccie, ignsf, fdfd, and fsfd bits are readable and writable while remaining bits read 0 and are not writable. table 28-14. feccrix field descriptions field description 2-0 eccrix[2:0] ecc error register index ?the eccrix bits are used to select which word of the feccr register array is being read. see section 1.3.2.13, ?lash ecc error results register (feccr) , for more details. offset module base + 0x0004 76543210 r ccie 00 ignsf 00 fdfd fsfd w reset 00000000 = unimplemented or reserved figure 28-9. flash con?uration register (fcnfg) table 28-15. fcnfg field descriptions field description 7 ccie command complete interrupt enable ?the ccie bit controls interrupt generation when a flash command has completed. 0 command complete interrupt disabled 1 an interrupt will be requested whenever the ccif ?g in the fstat register is set (see section 1.3.2.7 ) 4 ignsf ignore single bit fault ?the ignsf controls single bit fault reporting in the ferstat register (see section 1.3.2.8 ). 0 all single bit faults detected during array reads are reported 1 single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1092 freescale semiconductor 28.3.2.6 flash error con?uration register (fercnfg) the fercnfg register enables the flash error interrupts for the ferstat flags. all assigned bits in the fercnfg register are readable and writable. 1 fdfd force double bit fault detect the fdfd bit allows the user to simulate a double bit fault during flash array read operations and check the associated interrupt routine. the fdfd bit is cleared by writing a 0 to fdfd. the feccr registers will not be updated during the flash array read operation with fdfd set unless an actual double bit fault is detected. 0 flash array read operations will set the dfdif ?g in the ferstat register only if a double bit fault is detected 1 any flash array read operation will force the dfdif ?g in the ferstat register to be set (see section 1.3.2.7 ) and an interrupt will be generated as long as the dfdie interrupt enable in the fercnfg register is set (see section 1.3.2.6 ) 0 fsfd force single bit fault detect the fsfd bit allows the user to simulate a single bit fault during flash array read operations and check the associated interrupt routine. the fsfd bit is cleared by writing a 0 to fsfd. the feccr registers will not be updated during the flash array read operation with fsfd set unless an actual single bit fault is detected. 0 flash array read operations will set the sfdif ?g in the ferstat register only if a single bit fault is detected 1 flash array read operation will force the sfdif ?g in the ferstat register to be set (see section 1.3.2.7 ) and an interrupt will be generated as long as the sfdie interrupt enable in the fercnfg register is set (see section 1.3.2.6 ) offset module base + 0x0005 76543210 r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w reset 00000000 = unimplemented or reserved figure 28-10. flash error con?uration register (fercnfg) table 28-16. fercnfg field descriptions field description 7 erserie eee erase error interrupt enable the erserie bit controls interrupt generation when a failure is detected during an eee erase operation. 0 erserif interrupt disabled 1 an interrupt will be requested whenever the erserif ?g is set (see section 1.3.2.8 ) 6 pgmerie eee program error interrupt enable ?the pgmerie bit controls interrupt generation when a failure is detected during an eee program operation. 0 pgmerif interrupt disabled 1 an interrupt will be requested whenever the pgmerif ?g is set (see section 1.3.2.8 ) 4 epviolie eee protection violation interrupt enable ?the epviolie bit controls interrupt generation when a protection violation is detected during a write to the buffer ram eee partition. 0 epviolif interrupt disabled 1 an interrupt will be requested whenever the epviolif ?g is set (see section 1.3.2.8 ) table 28-15. fcnfg field descriptions (continued) field description chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1093 28.3.2.7 flash status register (fstat) the fstat register reports the operational status of the flash module. ccif, accerr, and fpviol bits are readable and writable, mgbusy and mgstat bits are readable but not writable, while remaining bits read 0 and are not writable. 3 ersvie1 eee error type 1 interrupt enable the ersvie1 bit controls interrupt generation when a change state error is detected during an eee operation. 0 ersvif1 interrupt disabled 1 an interrupt will be requested whenever the ersvif1 ?g is set (see section 1.3.2.8 ) 2 ersvie0 eee error type 0 interrupt enable the ersvie0 bit controls interrupt generation when a sector format error is detected during an eee operation. 0 ersvif0 interrupt disabled 1 an interrupt will be requested whenever the ersvif0 ?g is set (see section 1.3.2.8 ) 1 dfdie double bit fault detect interrupt enable the dfdie bit controls interrupt generation when a double bit fault is detected during a flash block read operation. 0 dfdif interrupt disabled 1 an interrupt will be requested whenever the dfdif ?g is set (see section 1.3.2.8 ) 0 sfdie single bit fault detect interrupt enable the sfdie bit controls interrupt generation when a single bit fault is detected during a flash block read operation. 0 sfdif interrupt disabled whenever the sfdif ?g is set (see section 1.3.2.8 ) 1 an interrupt will be requested whenever the sfdif ?g is set (see section 1.3.2.8 ) offset module base + 0x0006 76543210 r ccif 0 accerr fpviol mgbusy rsvd mgstat[1:0] w reset 1000000 (1) 1. reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see section 1.6 ). 0 1 = unimplemented or reserved figure 28-11. flash status register (fstat) table 28-16. fercnfg field descriptions (continued) field description chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1094 freescale semiconductor 28.3.2.8 flash error status register (ferstat) the ferstat register re?cts the error status of internal flash operations. all ?gs in the ferstat register are readable and only writable to clear the ?g. table 28-17. fstat field descriptions field description 7 ccif command complete interrupt flag ?the ccif ?g indicates that a flash command has completed. the ccif ?g is cleared by writing a 1 to ccif to launch a command and ccif will stay low until command completion or command violation. 0 flash command in progress 1 flash command has completed 5 accerr flash access error flag ?the accerr bit indicates an illegal access has occurred to the flash memory caused by either a violation of the command write sequence (see section 1.4.1.2 ) or issuing an illegal flash command or when errors are encountered while initializing the eee buffer ram during the reset sequence. while accerr is set, the ccif ?g cannot be cleared to launch a command. the accerr bit is cleared by writing a 1 to accerr. writing a 0 to the accerr bit has no effect on accerr. 0 no access error detected 1 access error detected 4 fpviol flash protection violation flag ?he fpviol bit indicates an attempt was made to program or erase an address in a protected area of p-flash memory during a command write sequence. the fpviol bit is cleared by writing a 1 to fpviol. writing a 0 to the fpviol bit has no effect on fpviol. while fpviol is set, it is not possible to launch a command or start a command write sequence. 0 no protection violation detected 1 protection violation detected 3 mgbusy memory controller busy flag ?the mgbusy ?g re?cts the active state of the memory controller . 0 memory controller is idle 1 memory controller is busy executing a flash command (ccif = 0) or is handling internal eee operations 2 rsvd reserved bit ?this bit is reserved and always reads 0 . 1? mgstat[1:0] memory controller command completion status flag one or more mgstat ?g bits are set if an error is detected during execution of a flash command or during the flash reset sequence. see section 1.4.2, ?lash command description , and section 1.6, ?nitialization ?for details. offset module base + 0x0007 76543210 r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w reset 00000000 = unimplemented or reserved figure 28-12. flash error status register (ferstat) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1095 28.3.2.9 p-flash protection register (fprot) the fprot register defines which p-flash sectors are protected against program and erase operations. table 28-18. ferstat field descriptions field description 7 erserif eee erase error interrupt flag ?the setting of the erserif ?g occurs due to an error in a flash erase command that resulted in the erase operation not being successful during eee operations. the erserif ?g is cleared by writing a 1 to erserif. writing a 0 to the erserif ?g has no effect on erserif. while erserif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 erase command successfully completed on the d-flash eee partition 1 erase command failed on the d-flash eee partition 6 pgmerif eee program error interrupt flag ?the setting of the pgmerif ?g occurs due to an error in a flash program command that resulted in the program operation not being successful during eee operations. the pgmerif ?g is cleared by writing a 1 to pgmerif. writing a 0 to the pgmerif ?g has no effect on pgmerif. while pgmerif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 program command successfully completed on the d-flash eee partition 1 program command failed on the d-flash eee partition 4 epviolif eee protection violation interrupt flag ?he setting of the epviolif ?g indicates an attempt was made to write to a protected area of the buffer ram eee partition. the epviolif ?g is cleared by writing a 1 to epviolif. writing a 0 to the epviolif ?g has no effect on epviolif. while epviolif is set, it is possible to write to the buffer ram eee partition as long as the address written to is not in a protected area. 0 no eee protection violation 1 eee protection violation detected 3 ersvif1 eee error interrupt 1 flag ?he setting of the ersvif1 ?g indicates that the memory controller was unable to change the state of a d-flash eee sector. the ersvif1 ?g is cleared by writing a 1 to ersvif1. writing a 0 to the ersvif1 ?g has no effect on ersvif1. while ersvif1 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector state change error detected 1 eee sector state change error detected 2 ersvif0 eee error interrupt 0 flag ?he setting of the ersvif0 ?g indicates that the memory controller was unable to format a d-flash eee sector for eee use. the ersvif0 ?g is cleared by writing a 1 to ersvif0. writing a 0 to the ersvif0 ?g has no effect on ersvif0. while ersvif0 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector format error detected 1 eee sector format error detected 1 dfdif double bit fault detect interrupt flag ?the setting of the dfdif ?g indicates that a double bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the dfdif ?g is cleared by writing a 1 to dfdif. writing a 0 to dfdif has no effect on dfdif. 0 no double bit fault detected 1 double bit fault detected or an invalid flash array read operation attempted 0 sfdif single bit fault detect interrupt flag ?with the ignsf bit in the fcnfg register clear, the sfdif ?g indicates that a single bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the sfdif ?g is cleared by writing a 1 to sfdif. writing a 0 to sfdif has no effect on sfdif. 0 no single bit fault detected 1 single bit fault detected and corrected or an invalid flash array read operation attempted chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1096 freescale semiconductor the (unreserved) bits of the fprot register are writable with the restriction that the size of the protected region can only be increased (see section 1.3.2.9.1, ?-flash protection restrictions , ?and table 1-23 ). during the reset sequence, the fprot register is loaded with the contents of the p-flash protection byte in the flash configuration field at global address 0x7f_ff0c located in p-flash memory (see table 1-3 ) as indicated by reset condition ??in figure 1-13 . to change the p-flash protection that will be loaded during the reset sequence, the upper sector of the p-flash memory must be unprotected, then the p-flash protection byte must be reprogrammed. if a double bit fault is detected while reading the p-flash phrase containing the p-flash protection byte during the reset sequence, the fpopen bit will be cleared and remaining bits in the fprot register will be set to leave the p-flash memory fully protected. trying to alter data in any protected area in the p-flash memory will result in a protection violation error and the fpviol bit will be set in the fstat register. the block erase of a p-flash block is not possible if any of the p-flash sectors contained in the same p-flash block are protected. offset module base + 0x0008 76543210 r fpopen rnv6 fphdis fphs[1:0] fpldis fpls[1:0] w reset f f ffffff = unimplemented or reserved figure 28-13. flash protection register (fprot) table 28-19. fprot field descriptions field description 7 fpopen flash protection operation enable ?the fpopen bit determines the protection function for program or erase operations as shown in table 1-20 for the p-flash block. 0 when fpopen is clear, the fphdis and fpldis bits de?e unprotected address ranges as speci?d by the corresponding fphs and fpls bits 1 when fpopen is set, the fphdis and fpldis bits enable protection for the address range speci?d by the corresponding fphs and fpls bits 6 rnv[6] reserved nonvolatile bit ?the rnv bit should remain in the erased state for future enhancements. 5 fphdis flash protection higher address range disable ?the fphdis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory ending with global address 0x7f_ffff. 0 protection/unprotection enabled 1 protection/unprotection disabled 4? fphs[1:0] flash protection higher address size the fphs bits determine the size of the protected/unprotected area in p-flash memory as shown in table 1-21 . the fphs bits can only be written to while the fphdis bit is set. 2 fpldis flash protection lower address range disable ?the fpldis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory beginning with global address 0x7f_8000. 0 protection/unprotection enabled 1 protection/unprotection disabled 1? fpls[1:0] flash protection lower address size the fpls bits determine the size of the protected/unprotected area in p-flash memory as shown in table 1-22 . the fpls bits can only be written to while the fpldis bit is set. chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1097 all possible p-flash protection scenarios are shown in figure 1-14 . although the protection scheme is loaded from the flash memory at global address 0x7f_ff0c during the reset sequence, it can be changed by the user. the p-flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. table 28-20. p-flash protection function fpopen fphdis fpldis function (1) 1. for range sizes, refer to table 1-21 and table 1-22 . 1 1 1 no p-flash protection 1 1 0 protected low range 1 0 1 protected high range 1 0 0 protected high and low ranges 0 1 1 full p-flash memory protected 0 1 0 unprotected low range 0 0 1 unprotected high range 0 0 0 unprotected high and low ranges table 28-21. p-flash protection higher address range fphs[1:0] global address range protected size 00 0x7f_f800?x7f_ffff 2 kbytes 01 0x7f_f000?x7f_ffff 4 kbytes 10 0x7f_e000?x7f_ffff 8 kbytes 11 0x7f_c000?x7f_ffff 16 kbytes table 28-22. p-flash protection lower address range fpls[1:0] global address range protected size 00 0x7f_8000?x7f_83ff 1 kbyte 01 0x7f_8000?x7f_87ff 2 kbytes 10 0x7f_8000?x7f_8fff 4 kbytes 11 0x7f_8000?x7f_9fff 8 kbytes chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1098 freescale semiconductor figure 28-14. p-flash protection scenarios 7 6 5 4 fphs[1:0] fpls[1:0] 3 2 1 0 fphs[1:0] fpls[1:0] fphdis = 1 fpldis = 1 fphdis = 1 fpldis = 0 fphdis = 0 fpldis = 1 fphdis = 0 fpldis = 0 scenario scenario unprotected region protected region with size protected region protected region with size defined by fpls defined by fphs not defined by fpls, fphs 0x7f_8000 0x7f_ffff 0x7f_8000 0x7f_ffff flash start flash start fpopen = 1 fpopen = 0 chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1099 28.3.2.9.1 p-flash protection restrictions the general guideline is that p-flash protection can only be added and not removed. table 1-23 specifies all valid transitions between p-flash protection scenarios. any attempt to write an invalid scenario to the fprot register will be ignored. the contents of the fprot register reflect the active protection scenario. see the fphs and fpls bit descriptions for additional restrictions. 28.3.2.10 eee protection register (eprot) the eprot register de?es which buffer ram eee partition areas are protected against writes. all bits in the eprot register are readable and writable except for rnv[6:4] which are only readable. the epopen and epdis bits can only be written to the protected state. the eps bits can be written anytime until the epdis bit is cleared. if the epopen bit is cleared, the state of the epdis and eps bits is irrelevant. during the reset sequence, the eprot register is loaded from the eee protection byte in the flash configuration field at global address 0x7f_ff0d located in p-flash memory (see table 1-3 ) as indicated by reset condition f in figure 1-15 . to change the eee protection that will be loaded during the reset sequence, the p-flash sector containing the eee protection byte must be unprotected, then the eee protection byte must be programmed. if a double bit fault is detected while reading the p-flash phrase table 28-23. p-flash protection scenario transitions from protection scenario to protection scenario (1) 1. allowed transitions marked with x, see figure 1-14 for a de?ition of the scenarios. 01234567 0 xxxx 1 xx 2 xx 3 x 4 xx 5 xxxx 6 xxxx 7 xxxxxxxx offset module base + 0x0009 76543210 r epopen rnv[6:4] epdis eps[2:0] w reset f f ffffff = unimplemented or reserved figure 28-15. eee protection register (eprot) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1100 freescale semiconductor containing the eee protection byte during the reset sequence, the epopen bit will be cleared and remaining bits in the eprot register will be set to leave the buffer ram eee partition fully protected. trying to write data to any protected area in the buffer ram eee partition will result in a protection violation error and the epviolif ?g will be set in the ferstat register. trying to write data to any protected area in the buffer ram partitioned for user access will not be prevented and the epviolif ?g in the ferstat register will not set. 28.3.2.11 flash common command object register (fccob) the fccob is an array of six words addressed via the ccobix index found in the fccobix register. byte wide reads and writes are allowed to the fccob register. table 28-24. eprot field descriptions field description 7 epopen enables writes to the buffer ram partitioned for eee 0 the entire buffer ram eee partition is protected from writes 1 unprotected buffer ram eee partition areas are enabled for writes 6? rnv[6:4] reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements 3 epdis buffer ram protection address range disable ?the epdis bit determines whether there is a protected area in a speci? region of the buffer ram eee partition. 0 protection enabled 1 protection disabled 2? eps[2:0] buffer ram protection size ?the eps[2:0] bits determine the size of the protected area in the buffer ram eee partition as shown in table 1-21 . the eps bits can only be written to while the epdis bit is set. table 28-25. buffer ram eee partition protection address range eps[2:0] global address range protected size 000 0x13_ffc0 ?0x13_ffff 64 bytes 001 0x13_ff80 ?0x13_ffff 128 bytes 010 0x13_ff40 ?0x13_ffff 192 bytes 011 0x13_ff00 ?0x13_ffff 256 bytes 100 0x13_fec0 ?0x13_ffff 320 bytes 101 0x13_fe80 ?0x13_ffff 384 bytes 110 0x13_fe40 ?0x13_ffff 448 bytes 111 0x13_fe00 ?0x13_ffff 512 bytes chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1101 28.3.2.11.1 fccob - nvm command mode nvm command mode uses the indexed fccob register to provide a command code and its relevant parameters to the memory controller. the user first sets up all required fccob fields and then initiates the command? execution by writing a 1 to the ccif bit in the fstat register (a 1 written by the user clears the ccif command completion flag to 0). when the user clears the ccif bit in the fstat register all fccob parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the memory controller returning ccif to 1). some commands return information to the fccob register array. the generic format for the fccob parameter fields in nvm command mode is shown in table 1-26 . the return values are available for reading after the ccif flag in the fstat register has been returned to 1 by the memory controller. writes to the unimplemented parameter fields (ccobix = 110 and ccobix = 111) are ignored with reads from these fields returning 0x0000. table 1-26 shows the generic flash command format. the high byte of the first word in the ccob array contains the command code, followed by the parameters for this specific flash command. for details on the fccob settings required by each command, see the flash command descriptions in section 1.4.2 . offset module base + 0x000a 76543210 r ccob[15:8] w reset 00000000 figure 28-16. flash common command object high register (fccobhi) offset module base + 0x000b 76543210 r ccob[7:0] w reset 00000000 figure 28-17. flash common command object low register (fccoblo) table 28-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) 000 hi fcmd[7:0] de?ing flash command lo 0, global address [22:16] 001 hi global address [15:8] lo global address [7:0] 010 hi data 0 [15:8] lo data 0 [7:0] chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1102 freescale semiconductor 28.3.2.12 eee tag counter register (etag) the etag register contains the number of outstanding words in the buffer ram eee partition that need to be programmed into the d-flash eee partition. the etag register is decremented prior to the related tagged word being programmed into the d-flash eee partition. all tagged words have been programmed into the d-flash eee partition once all bits in the etag register read 0 and the mgbusy flag in the fstat register reads 0. all etag bits are readable but not writable and are cleared by the memory controller. 28.3.2.13 flash ecc error results register (feccr) the feccr registers contain the result of a detected ecc fault for both single bit and double bit faults. the feccr register provides access to several ecc related fields as defined by the eccrix index bits in the feccrix register (see section 1.3.2.4 ). once ecc fault information has been stored, no other fault 011 hi data 1 [15:8] lo data 1 [7:0] 100 hi data 2 [15:8] lo data 2 [7:0] 101 hi data 3 [15:8] lo data 3 [7:0] offset module base + 0x000c 76543210 r etag[15:8] w reset 0 0 000000 = unimplemented or reserved figure 28-18. eee tag counter high register (etaghi) offset module base + 0x000d 76543210 r etag[7:0] w reset 00000000 = unimplemented or reserved figure 28-19. eee tag counter low register (etaglo) table 28-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1103 information will be recorded until the specific ecc fault flag has been cleared. in the event of simultaneous ecc faults, the priority for fault recording is: 1. double bit fault over single bit fault 2. cpu over xgate all feccr bits are readable but not writable. offset module base + 0x000e 76543210 r eccr[15:8] w reset 00000000 = unimplemented or reserved figure 28-20. flash ecc error results high register (feccrhi) offset module base + 0x000f 76543210 r eccr[7:0] w reset 00000000 = unimplemented or reserved figure 28-21. flash ecc error results low register (feccrlo) table 28-27. feccr index settings eccrix[2:0] feccr register content bits [15:8] bit[7] bits[6:0] 000 parity bits read from flash block cpu or xgate source identity global address [22:16] 001 global address [15:0] 010 data 0 [15:0] 011 data 1 [15:0] (p-flash only) 100 data 2 [15:0] (p-flash only) 101 data 3 [15:0] (p-flash only) 110 not used, returns 0x0000 when read 111 not used, returns 0x0000 when read chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1104 freescale semiconductor the p-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the following four words addressed by eccrix = 010 to 101 contain the 64-bit wide data phrase. the four data words and the parity byte are the uncorrected data read from the p-flash block. the d-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the uncorrected 16-bit data word is addressed by eccrix = 010. 28.3.2.14 flash option register (fopt) the fopt register is the flash option register. all bits in the fopt register are readable but are not writable. during the reset sequence, the fopt register is loaded from the flash nonvolatile byte in the flash configuration field at global address 0x7f_ff0e located in p-flash memory (see table 1-3 ) as indicated by reset condition f in figure 1-22 . if a double bit fault is detected while reading the p-flash phrase containing the flash nonvolatile byte during the reset sequence, all bits in the fopt register will be set. 28.3.2.15 flash reserved0 register (frsv0) this flash register is reserved for factory testing. table 28-28. feccr index=000 bit descriptions field description 15:8 par[7:0] ecc parity bits ?contains the 8 parity bits from the 72 bit wide p-flash data word or the 6 parity bits, allocated to par[5:0], from the 22 bit wide d-flash word with par[7:6]=00. 7 xbus01 bus source identi?r the xbus01 bit determines whether the ecc error was caused by a read access from the cpu or xgate. 0 ecc error happened on the cpu access 1 ecc error happened on the xgate access 6? gaddr[22:16] global address ?the gaddr[22:16] ?ld contains the upper seven bits of the global address having caused the error. offset module base + 0x0010 76543210 r nv[7:0] w reset f f ffffff = unimplemented or reserved figure 28-22. flash option register (fopt) table 28-29. fopt field descriptions field description 7? nv[7:0] nonvolatile bits the nv[7:0] bits are available as nonvolatile bits. refer to the device user guide for proper use of the nv bits. chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1105 all bits in the frsv0 register read 0 and are not writable. 28.3.2.16 flash reserved1 register (frsv1) this flash register is reserved for factory testing. all bits in the frsv1 register read 0 and are not writable. 28.3.2.17 flash reserved2 register (frsv2) this flash register is reserved for factory testing. all bits in the frsv2 register read 0 and are not writable. offset module base + 0x0011 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 28-23. flash reserved0 register (frsv0) offset module base + 0x0012 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 28-24. flash reserved1 register (frsv1) offset module base + 0x0013 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 28-25. flash reserved2 register (frsv2) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1106 freescale semiconductor 28.4 functional description 28.4.1 flash command operations flash command operations are used to modify flash memory contents or con?ure module resources for eee operation. the next sections describe: how to write the fclkdiv register that is used to generate a time base (fclk) derived from oscclk for flash program and erase command operations the command write sequence used to set flash command parameters and launch execution valid flash commands available for execution 28.4.1.1 writing the fclkdiv register prior to issuing any flash program or erase command after a reset, the user is required to write the fclkdiv register to divide oscclk down to a target fclk of 1 mhz. table 1-9 shows recommended values for the fdiv ?ld based on oscclk frequency. note programming or erasing the flash memory cannot be performed if the bus clock runs at less than 1 mhz. setting fdiv too high can destroy the flash memory due to overstress. setting fdiv too low can result in incomplete programming or erasure of the flash memory cells. when the fclkdiv register is written, the fdivld bit is set automatically. if the fdivld bit is 0, the fclkdiv register has not been written since the last reset. if the fclkdiv register has not been written, any flash program or erase command loaded during a command write sequence will not execute and the accerr bit in the fstat register will set. 28.4.1.2 command write sequence the memory controller will launch all valid flash commands entered using a command write sequence. before launching a command, the accerr and fpviol bits in the fstat register must be clear (see section 1.3.2.7 ) and the ccif flag should be tested to determine the status of the current command write sequence. if ccif is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the fccob register are ignored. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1107 28.4.1.2.1 de?e fccob contents the fccob parameter ?lds must be loaded with all required parameters for the flash command being executed. access to the fccob parameter ?lds is controlled via the ccobix bits in the fccobix register (see section 1.3.2.3 ). the contents of the fccob parameter ?lds are transferred to the memory controller when the user clears the ccif command completion ?g in the fstat register (writing 1 clears the ccif to 0). the ccif ?g will remain clear until the flash command has completed. upon completion, the memory controller will return ccif to 1 and the fccob register will be used to communicate any results. the ?w for a generic command write sequence is shown in figure 1-26 . chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1108 freescale semiconductor figure 28-26. generic flash command write sequence flowchart write to fccobix register write: fstat register (to launch command) clear ccif 0x80 clear accerr/fpviol 0x30 write: fstat register yes no access error and protection violation read: fstat register read: fstat register no start yes check ccif set? fccob accerr/ fpviol set? exit write: fclkdiv register read: fclkdiv register yes no clock register written check fdivld set? no bit polling for command completion check yes ccif set? to identify speci? command parameter to load. write to fccob register to load required command parameter. yes no more parameters? availability check results from previous command note: fclkdiv must be set after each reset chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1109 28.4.1.3 valid flash module commands table 28-30. flash commands by mode fcmd command unsecured secured ns (1) 1. unsecured normal single chip mode. nx (2) 2. unsecured normal expanded mode. ss (3) 3. unsecured special single chip mode. st (4) 4. unsecured special mode. ns (5) 5. secured normal single chip mode. nx (6) 6. secured normal expanded mode. ss (7) 7. secured special single chip mode. st (8) 8. secured special mode. 0x01 erase verify all blocks ???????? 0x02 erase verify block ???????? 0x03 erase verify p-flash section ????? 0x04 read once ????? 0x05 load data field ????? 0x06 program p-flash ????? 0x07 program once ????? 0x08 erase all blocks ?? ?? 0x09 erase p-flash block ????? 0x0a erase p-flash sector ????? 0x0b unsecure flash ?? ?? 0x0c verify backdoor access key ?? 0x0d set user margin level ????? 0x0e set field margin level ?? 0x0f full partition d-flash ?? 0x10 erase verify d-flash section ????? 0x11 program d-flash ????? 0x12 erase d-flash sector ????? 0x13 enable eeprom emulation ???????? 0x14 disable eeprom emulation ???????? 0x15 eeprom emulation query ???????? 0x20 partition d-flash ???????? chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1110 freescale semiconductor 28.4.1.4 p-flash commands table 1-31 summarizes the valid p-flash commands along with the effects of the commands on the p- flash block and other resources within the flash module. 28.4.1.5 d-flash and eee commands table 1-32 summarizes the valid d-flash and eee commands along with the effects of the commands on the d-flash block and eee operation. table 28-31. p-flash commands fcmd command function on p-flash memory 0x01 erase verify all blocks verify that all p-flash (and d-flash) blocks are erased. 0x02 erase verify block verify that a p-flash block is erased. 0x03 erase verify p- flash section verify that a given number of words starting at the address provided are erased. 0x04 read once read a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that was previously programmed using the program once command. 0x05 load data field load data for simultaneous multiple p-flash block operations. 0x06 program p-flash program a phrase in a p-flash block and any previously loaded phrases for any other p- flash block (see load data field command). 0x07 program once program a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that is allowed to be programmed only once. 0x08 erase all blocks erase all p-flash (and d-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x09 erase p-flash block erase a single p-flash block. an erase of the full p-flash block is only possible when fpldis, fphdis and fpopen bits in the fprot register are set prior to launching the command. 0x0a erase p-flash sector erase all bytes in a p-flash sector. 0x0b unsecure flash supports a method of releasing mcu security by erasing all p-flash (and d-flash) blocks and verifying that all p-flash (and d-flash) blocks are erased. 0x0c verify backdoor access key supports a method of releasing mcu security by verifying a set of security keys. 0x0d set user margin level speci?s a user margin read level for all p-flash blocks. 0x0e set field margin level speci?s a ?ld margin read level for all p-flash blocks (special modes only). table 28-32. d-flash commands fcmd command function on d-flash memory 0x01 erase verify all blocks verify that all d-flash (and p-flash) blocks are erased. 0x02 erase verify block verify that the d-flash block is erased. chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1111 28.4.2 flash command description this section provides details of all available flash commands launched by a command write sequence. the accerr bit in the fstat register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the memory controller: starting any command write sequence that programs or erases flash memory before initializing the fclkdiv register writing an invalid command as part of the command write sequence for additional possible errors, refer to the error handling table provided for each command if a flash block is read during execution of an algorithm (ccif = 0) on that same block, the read operation will return invalid data. if the sfdif or dfdif flags were not previously set when the invalid read operation occurred, both the sfdif and dfdif flags will be set and the feccr registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. if the accerr or fpviol bits are set in the fstat register, the user must clear these bits before starting any command write sequence (see section 1.3.2.7 ). 0x08 erase all blocks erase all d-flash (and p-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x0b unsecure flash supports a method of releasing mcu security by erasing all d-flash (and p-flash) blocks and verifying that all d-flash (and p-flash) blocks are erased. 0x0d set user margin level speci?s a user margin read level for the d-flash block. 0x0e set field margin level speci?s a ?ld margin read level for the d-flash block (special modes only). 0x0f full partition d- flash erase the d-flash block and partition an area of the d-flash block for user access. 0x10 erase verify d- flash section verify that a given number of words starting at the address provided are erased. 0x11 program d-flash program up to four words in the d-flash block. 0x12 erase d-flash sector erase all bytes in a sector of the d-flash block. 0x13 enable eeprom emulation enable eeprom emulation where writes to the buffer ram eee partition will be copied to the d-flash eee partition. 0x14 disable eeprom emulation suspend all current erase and program activity related to eeprom emulation but leave current eee tags set. 0x15 eeprom emulation query returns eee partition and status variables. 0x20 partition d-flash partition an area of the d-flash block for user access. table 28-32. d-flash commands fcmd command function on d-flash memory chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1112 freescale semiconductor caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. 28.4.2.1 erase verify all blocks command the erase verify all blocks command will verify that all p-flash and d-flash blocks have been erased. upon clearing ccif to launch the erase verify all blocks command, the memory controller will verify that the entire flash memory space is erased. the ccif ?g will set after the erase verify all blocks operation has completed. 28.4.2.2 erase verify block command the erase verify block command allows the user to verify that an entire p-flash or d-flash block has been erased. the fccob upper global address bits determine which block must be veri?d. upon clearing ccif to launch the erase verify block command, the memory controller will verify that the selected p-flash or d-flash block is erased. the ccif ?g will set after the erase verify block operation has completed. table 28-33. erase verify all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x01 not required table 28-34. erase verify all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active fpviol none mgstat1 set if any errors have been encountered during the read (1) 1. as found in the memory map for ftm1024k5. mgstat0 set if any non-correctable errors have been encountered during the read 1 ferstat epviolif none table 28-35. erase verify block command fccob requirements ccobix[2:0] fccob parameters 000 0x02 global address [22:16] of the flash block to be veri?d . chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1113 28.4.2.3 erase verify p-flash section command the erase verify p-flash section command will verify that a section of code in the p-flash memory is erased. the erase verify p-flash section command defines the starting point of the code to be verified and the number of phrases. the section to be verified cannot cross a 256 kbyte boundary in the p-flash memory space. upon clearing ccif to launch the erase verify p-flash section command, the memory controller will verify the selected section of flash memory is erased. the ccif ?g will set after the erase verify p-flash section operation has completed. table 28-36. erase verify block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. fpviol none mgstat1 set if any errors have been encountered during the read (2) 2. as found in the memory map for ftm1024k5. mgstat0 set if any non-correctable errors have been encountered during the read 2 ferstat epviolif none table 28-37. erase verify p-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x03 global address [22:16] of a p-flash block 001 global address [15:0] of the ?st phrase to be veri?d 010 number of phrases to be veri?d chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1114 freescale semiconductor 28.4.2.4 read once command the read once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of p-flash block 0. the read once field is programmed using the program once command described in section 1.4.2.7 . the read once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the read once command, a read once phrase is fetched and stored in the fccob indexed register. the ccif ?g will set after the read once operation has completed. valid phrase index values for the read once command range from 0x0000 to 0x0007. during execution of the read once command, any attempt to read addresses within p-flash block 0 will return invalid data. 128 table 28-38. erase verify p-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:0] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. set if a misaligned phrase address is supplied (global address [2:0] != 000) set if the requested section crosses a 256 kbyte boundary fpviol none mgstat1 set if any errors have been encountered during the read (2) 2. as found in the memory map for ftm1024k5. mgstat0 set if any non-correctable errors have been encountered during the read 2 ferstat epviolif none table 28-39. read once command fccob requirements ccobix[2:0] fccob parameters 000 0x04 not required 001 read once phrase index (0x0000 - 0x0007) 010 read once word 0 value 011 read once word 1 value 100 read once word 2 value 101 read once word 3 value chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1115 28.4.2.5 load data field command the load data field command is executed to provide fccob parameters for multiple p-flash blocks for a future simultaneous program operation in the p-flash memory space. upon clearing ccif to launch the load data field command, the fccob registers will be transferred to the memory controller and be programmed in the block speci?d at the global address given with a future program p-flash command launched on a p-flash block. the ccif ?g will set after the load data field operation has completed. note that once a load data field command sequence has been initiated, the load data field command sequence will be cancelled if any command other than load data field or the future program p-flash is launched. similarly, if an error occurs after launching a load data field or program p-flash command, the associated load data field command sequence will be cancelled. table 28-40. read once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid phrase index is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 28-41. load data field command fccob requirements ccobix[2:0] fccob parameters 000 0x05 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 011 word 1 100 word 2 101 word 3 chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1116 freescale semiconductor 28.4.2.6 program p-flash command the program p-flash operation will program a previously erased phrase in the p-flash memory using an embedded algorithm. caution a p-flash phrase must be in the erased state before being programmed. cumulative programming of bits within a flash phrase is not allowed. upon clearing ccif to launch the program p-flash command, the memory controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. the ccif ?g will set after the program p-flash operation has completed. table 28-42. load data field command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:0] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 none mgstat0 none ferstat epviolif none table 28-43. program p-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x06 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 program value 011 word 1 program value 100 word 2 program value 101 word 3 program value chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1117 28.4.2.7 program once command the program once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in p-flash block 0. the program once reserved field can be read using the read once command as described in section 1.4.2.4 . the program once command must only be issued once since the nonvolatile information register in p-flash block 0 cannot be erased. the program once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the program once command, the memory controller ?st veri?s that the selected phrase is erased. if erased, then the selected phrase will be programmed and then veri?d with read back. the ccif ?g will remain clear, setting only after the program once operation has completed. the reserved nonvolatile information register accessed by the program once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. valid phrase index table 28-44. program p-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:0] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 28-45. program once command fccob requirements ccobix[2:0] fccob parameters 000 0x07 not required 001 program once phrase index (0x0000 - 0x0007) 010 program once word 0 value 011 program once word 1 value 100 program once word 2 value 101 program once word 3 value chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1118 freescale semiconductor values for the program once command range from 0x0000 to 0x0007. during execution of the program once command, any attempt to read addresses within p-flash block 0 will return invalid data. 28.4.2.8 erase all blocks command the erase all blocks operation will erase the entire p-flash and d-flash memory space including the eee nonvolatile information register. upon clearing ccif to launch the erase all blocks command, the memory controller will erase the entire flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g will set after the erase all blocks operation has completed. table 28-46. program once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid phrase index is supplied set if the requested phrase has already been programmed (1) 1. if a program once phrase is initially programmed to 0xffff_ffff_ffff_ffff, the program once command will be allowed to execute again on that same phrase. fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 28-47. erase all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x08 not required chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1119 28.4.2.9 erase p-flash block command the erase p-flash block operation will erase all addresses in a p-flash block. upon clearing ccif to launch the erase p-flash block command, the memory controller will erase the selected p-flash block and verify that it is erased. the ccif ?g will set after the erase p-flash block operation has completed. table 28-48. erase all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation (1) 1. as found in the memory map for ftm1024k5. mgstat0 set if any non-correctable errors have been encountered during the verify operation 1 ferstat epviolif set if any area of the buffer ram eee partition is protected table 28-49. erase p-flash block command fccob requirements ccobix[2:0] fccob parameters 000 0x09 global address [22:16] to identify p-flash block 001 global address [15:0] in p-flash block to be erased table 28-50. erase p-flash block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. fpviol set if an area of the selected p-flash block is protected mgstat1 set if any errors have been encountered during the verify operation (2) 2. as found in the memory map for ftm1024k5. mgstat0 set if any non-correctable errors have been encountered during the verify operation 2 ferstat epviolif none chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1120 freescale semiconductor 28.4.2.10 erase p-flash sector command the erase p-flash sector operation will erase all addresses in a p-flash sector. upon clearing ccif to launch the erase p-flash sector command, the memory controller will erase the selected flash sector and then verify that it is erased. the ccif ?g will be set after the erase p-flash sector operation has completed. 28.4.2.11 unsecure flash command the unsecure flash command will erase the entire p-flash and d-flash memory space and, if the erase is successful, will release security. upon clearing ccif to launch the unsecure flash command, the memory controller will erase the entire p-flash and d-flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. if the erase verify is not successful, the unsecure flash operation sets mgstat1 and terminates without changing the security table 28-51. erase p-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x0a global address [22:16] to identify p-flash block to be erased 001 global address [15:0] anywhere within the sector to be erased. refer to section 1.1.2.1 for the p-flash sector size. table 28-52. erase p-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. set if a misaligned phrase address is supplied (global address [2:0] != 000) fpviol set if the selected p-flash sector is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 28-53. unsecure flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0b not required chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1121 state. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g is set after the unsecure flash operation has completed. 28.4.2.12 verify backdoor access key command the verify backdoor access key command will only execute if it is enabled by the keyen bits in the fsec register (see table 1-11 ). the verify backdoor access key command releases security if user- supplied keys match those stored in the flash security bytes of the flash configuration field (see table 1- 3 ). the verify backdoor access key command must not be executed from the flash block containing the backdoor comparison key to avoid code runaway. upon clearing ccif to launch the verify backdoor access key command, the memory controller will check the fsec keyen bits to verify that this command is enabled. if not enabled, the memory controller sets the accerr bit in the fstat register and terminates. if the command is enabled, the memory controller compares the key provided in fccob to the backdoor comparison key in the flash con?uration ?ld with key 0 compared to 0x7f_ff00, etc. if the backdoor keys match, security will be released. if the backdoor keys do not match, security is not released and all future attempts to execute the verify backdoor access key command are aborted (set accerr) until a reset occurs. the ccif flag is set after the verify backdoor access key operation has completed. table 28-54. unsecure flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation (1) 1. as found in the memory map for ftm1024k5. mgstat0 set if any non-correctable errors have been encountered during the verify operation 1 ferstat epviolif set if any area of the buffer ram eee partition is protected table 28-55. verify backdoor access key command fccob requirements ccobix[2:0] fccob parameters 000 0x0c not required 001 key 0 010 key 1 011 key 2 100 key 3 chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1122 freescale semiconductor 28.4.2.13 set user margin level command the set user margin level command causes the memory controller to set the margin level for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set user margin level command, the memory controller will set the user margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set user margin level command are de?ed in table 1-58 . table 28-56. verify backdoor access key command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 100 at command launch set if a load data field command sequence is currently active set if an incorrect backdoor key is supplied set if backdoor key access has not been enabled (keyen[1:0] != 10, see section 1.3.2.2 ) set if the backdoor key has mismatched since the last reset fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 28-57. set user margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0d global address [22:16] to identify the flash block 001 margin level setting table 28-58. valid set user margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) 1. read margin to the erased state 0x0002 user margin-0 level (2) 2. read margin to the programmed state chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1123 note user margin levels can be used to check that flash memory contents have adequate margin for normal level read operations. if unexpected results are encountered when checking flash memory contents at user margin levels, a potential loss of information has been detected. 28.4.2.14 set field margin level command the set field margin level command, valid in special modes only, causes the memory controller to set the margin level specified for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set field margin level command, the memory controller will set the ?ld margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set field margin level command are de?ed in table 1-61 . table 28-59. set user margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 28-60. set field margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0e global address [22:16] to identify the flash block 001 margin level setting table 28-61. valid set field margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1124 freescale semiconductor caution field margin levels must only be used during verify of the initial factory programming. note field margin levels can be used to check that flash memory contents have adequate margin for data retention at the normal level setting. if unexpected results are encountered when checking flash memory contents at ?ld margin levels, the flash memory contents should be erased and reprogrammed. 28.4.2.15 full partition d-flash command the full partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. 0x0002 user margin-0 level (2) 0x0003 field margin-1 level 1 0x0004 field margin-0 level 2 1. read margin to the erased state 2. read margin to the programmed state table 28-62. set field margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:16] is supplied (1) 1. as de?ed by the memory map for ftm1024k5. set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 28-61. valid set field margin level settings ccob (ccobix=001) level description chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1125 upon clearing ccif to launch the full partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 1-7 ) program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 1-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 1-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 1-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the full partition d-flash operation has completed, the ccif ?g will set. running the full partition d-flash command a second time will result in the previous partition values and the entire d-flash memory being erased. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 28-63. full partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0f not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1126 freescale semiconductor 28.4.2.16 erase verify d-flash section command the erase verify d-flash section command will verify that a section of code in the d-flash user partition is erased. the erase verify d-flash section command defines the starting point of the data to be verified and the number of words. upon clearing ccif to launch the erase verify d-flash section command, the memory controller will verify the selected section of d-flash memory is erased. the ccif ?g will set after the erase verify d- flash section operation has completed. table 28-64. full partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 28-65. erase verify d-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x10 global address [22:16] to identify the d-flash block 001 global address [15:0] of the ?st word to be veri?d 010 number of words to be veri?d chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1127 28.4.2.17 program d-flash command the program d-flash operation programs one to four previously erased words in the d-flash user partition. the program d-flash operation will confirm that the targeted location(s) were successfully programmed upon completion. caution a flash word must be in the erased state before being programmed. cumulative programming of bits within a flash word is not allowed. upon clearing ccif to launch the program d-flash command, the user-supplied words will be transferred to the memory controller and be programmed. the ccobix index value at program d-flash command launch determines how many words will be programmed in the d-flash block. no protection checks are made in the program d-flash operation on the d-flash block, only access error checks. the ccif ?g is set when the operation has completed. table 28-66. erase verify d-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area of the d-flash eee partition set if the requested section breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 28-67. program d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x11 global address [22:16] to identify the d-flash block 001 global address [15:0] of word to be programmed 010 word 0 program value 011 word 1 program value, if desired 100 word 2 program value, if desired 101 word 3 program value, if desired chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1128 freescale semiconductor 28.4.2.18 erase d-flash sector command the erase d-flash sector operation will erase all addresses in a sector of the d-flash user partition. upon clearing ccif to launch the erase d-flash sector command, the memory controller will erase the selected flash sector and verify that it is erased. the ccif ?g will set after the erase d-flash sector operation has completed. table 28-68. program d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] < 010 at command launch set if ccobix[2:0] > 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area in the d-flash eee partition set if the requested group of words breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 28-69. erase d-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x12 global address [22:16] to identify d-flash block 001 global address [15:0] anywhere within the sector to be erased. see section 1.1.2.2 for d-flash sector size. chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1129 28.4.2.19 enable eeprom emulation command the enable eeprom emulation command causes the memory controller to enable eee activity. eee activity is disabled after any reset. upon clearing ccif to launch the enable eeprom emulation command, the ccif ?g will set after the memory controller enables eee operations using the contents of the eee tag ram and tag counter. the full partition d-flash or the partition d-flash command must be run prior to launching the enable eeprom emulation command. table 28-70. erase d-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 28-71. enable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x13 not required table 28-72. enable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1130 freescale semiconductor 28.4.2.20 disable eeprom emulation command the disable eeprom emulation command causes the memory controller to suspend current eee activity. upon clearing ccif to launch the disable eeprom emulation command, the memory controller will halt eee operations at the next convenient point without clearing the eee tag ram or tag counter before setting the ccif ?g. 28.4.2.21 eeprom emulation query command the eeprom emulation query command returns eee partition and status variables. upon clearing ccif to launch the eeprom emulation query command, the ccif ?g will set after the eee partition and status variables are stored in the fccobix register.if the emulation query command is executed prior to partitioning (partition d-flash command section 1.4.2.15 ), the following reset values are returned: dfpart = 0x_ffff, erpart = 0x_ffff, ecount = 0x_ffff, dead sector count = 0x_00, ready sector count = 0x_00. table 28-73. disable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x14 not required table 28-74. disable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 28-75. eeprom emulation query command fccob requirements ccobix[2:0] fccob parameters 000 0x15 not required 001 return dfpart 010 return erpart 011 return ecount (1) 1. indicates sector erase count 100 return dead sector count return ready sector count chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1131 28.4.2.22 partition d-flash command the partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. the erase all blocks command must be run prior to launching the partition d-flash command. upon clearing ccif to launch the partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase verify the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 1-7 ) table 28-76. eeprom emulation query command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 28-77. partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x20 not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1132 freescale semiconductor program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 1-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 1-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 1-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the partition d-flash operation has completed, the ccif ?g will set. running the partition d-flash command a second time will result in the accerr bit within the fstat register being set. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 28-78. partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 1-30 ) set if partitions have already been de?ed set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1133 28.4.3 interrupts the flash module can generate an interrupt when a flash command operation has completed or when a flash command operation has detected an eee error or an ecc fault. note vector addresses and their relative interrupt priority are determined at the mcu level. 28.4.3.1 description of flash interrupt operation the flash module uses the ccif ?g in combination with the ccie interrupt enable bit to generate the flash command interrupt request. the flash module uses the erseif, pgmeif, epviolif, ersvif1, ersvif0, dfdif and sfdif ?gs in combination with the erseie, pgmeie, epviolie, ersvie1, ersvie0, dfdie and sfdie interrupt enable bits to generate the flash error interrupt request. for a detailed description of the register bits involved, refer to section 1.3.2.5, ?lash configuration register (fcnfg) ? section 1.3.2.6, ?lash error configuration register (fercnfg) ? section 1.3.2.7, ?lash status register (fstat) ? and section 1.3.2.8, ?lash error status register (ferstat) ? the logic used for generating the flash module interrupts is shown in figure 1-27 . table 28-79. flash interrupt sources interrupt source interrupt flag local enable global (ccr) mask flash command complete ccif (fstat register) ccie (fcnfg register) i bit flash eee erase error erserif (ferstat register) erserie (fercnfg register) i bit flash eee program error pgmerif (ferstat register) pgmerie (fercnfg register) i bit flash eee protection violation epviolif (ferstat register) epviolie (fercnfg register) i bit flash eee error type 1 violation ersvif1 (ferstat register) ersvie1 (fercnfg register) i bit flash eee error type 0 violation ersvif0 (ferstat register) ersvie0 (fercnfg register) i bit ecc double bit fault on flash read dfdif (ferstat register) dfdie (fercnfg register) i bit ecc single bit fault on flash read sfdif (ferstat register) sfdie (fercnfg register) i bit chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1134 freescale semiconductor figure 28-27. flash module interrupts implementation 28.4.4 wait mode the flash module is not affected if the mcu enters wait mode. the flash module can recover the mcu from wait via the ccif interrupt (see section 1.4.3, ?nterrupts ). 28.4.5 stop mode if a flash command is active (ccif = 0) or an ee-emulation operation is pending when the mcu requests stop mode, the current flash operation will be completed before the cpu is allowed to enter stop mode. 28.5 security the flash module provides security information to the mcu. the flash security state is de?ed by the sec bits of the fsec register (see table 1-12 ). during reset, the flash module initializes the fsec register using data read from the security byte of the flash con?uration ?ld at global address 0x7f_ff0f. flash error interrupt request ccif ccie epviolif epviolie ersvif1 ersvie1 ersvif0 ersvie0 pgmerif pgmerie erserif erserie flash command interrupt request dfdif dfdie sfdif sfdie chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1135 the security state out of reset can be permanently changed by programming the security byte of the flash con?uration ?ld. this assumes that you are starting from a mode where the necessary p-flash erase and program commands are available and that the upper region of the p-flash is unprotected. if the flash security byte is successfully programmed, its new value will take affect after the next mcu reset. the following subsections describe these security-related subjects: unsecuring the mcu using backdoor key access unsecuring the mcu in special single chip mode using bdm mode and security effects on flash command availability 28.5.1 unsecuring the mcu using backdoor key access the mcu may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7f_ff00?x7f_ff07). if the keyen[1:0] bits are in the enabled state (see section 1.3.2.2 ), the verify backdoor access key command (see section 1.4.2.12 ) allows the user to present four prospective keys for comparison to the keys stored in the flash memory via the memory controller. if the keys presented in the verify backdoor access key command match the backdoor keys stored in the flash memory, the sec bits in the fsec register (see table 1-12 ) will be changed to unsecure the mcu. key values of 0x0000 and 0xffff are not permitted as backdoor keys. while the verify backdoor access key command is active, p-flash block 0 will not be available for read access and will return invalid data. the user code stored in the p-flash memory must have a method of receiving the backdoor keys from an external stimulus. this external stimulus would typically be through one of the on-chip serial ports. if the keyen[1:0] bits are in the enabled state (see section 1.3.2.2 ), the mcu can be unsecured by the backdoor key access sequence described below: 1. follow the command sequence for the verify backdoor access key command as explained in section 1.4.2.12 2. if the verify backdoor access key command is successful, the mcu is unsecured and the sec[1:0] bits in the fsec register are forced to the unsecure state of 10 the verify backdoor access key command is monitored by the memory controller and an illegal key will prohibit future use of the verify backdoor access key command. a reset of the mcu is the only method to re-enable the verify backdoor access key command. after the backdoor keys have been correctly matched, the mcu will be unsecured. after the mcu is unsecured, the sector containing the flash security byte can be erased and the flash security byte can be reprogrammed to the unsecure state, if desired. in the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7f_ff00?x7f_ff07 in the flash con?uration ?ld. the security as de?ed in the flash security byte (0x7f_ff0f) is not changed by using the verify backdoor access key command sequence. the backdoor keys stored in addresses 0x7f_ff00?x7f_ff07 are unaffected by the verify backdoor access key command sequence. after the next reset of the mcu, the security state of the flash module is determined by the flash security byte chapter 28 768 kbyte flash module (s12xftm768k4v2) mc9s12xe-family reference manual , rev. 1.21 1136 freescale semiconductor (0x7f_ff0f). the verify backdoor access key command sequence has no effect on the program and erase protections de?ed in the flash protection register, fprot. 28.5.2 unsecuring the mcu in special single chip mode using bdm the mcu can be unsecured in special single chip mode by erasing the p-flash and d-flash memory by one of the following methods: reset the mcu into special single chip mode, delay while the erase test is performed by the bdm, send bdm commands to disable protection in the p-flash and d-flash memory, and execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. reset the mcu into special expanded wide mode, disable protection in the p-flash and d-flash memory and run code from external memory to execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. after the ccif ?g sets to indicate that the erase all blocks operation has completed, reset the mcu into special single chip mode. the bdm will execute the erase verify all blocks command write sequence to verify that the p-flash and d-flash memory is erased. if the p-flash and d-flash memory are verified as erased the mcu will be unsecured. all bdm commands will be enabled and the flash security byte may be programmed to the unsecure state by the following method: send bdm commands to execute a ?rogram p-flash?command sequence to program the flash security byte to the unsecured state and reset the mcu. 28.5.3 mode and security effects on flash command availability the availability of flash module commands depends on the mcu operating mode and security state as shown in table 1-30 . 28.6 initialization on each system reset the flash module executes a reset sequence which establishes initial values for the flash block configuration parameters, the fprot and dfprot protection registers, and the fopt and fsec registers. the flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. if a double bit fault is detected during the reset sequence, both mgstat bits in the fstat register will be set. the accerr bit in the fstat register is set if errors are encountered while initializing the eee buffer ram during the reset sequence. ccif remains clear throughout the reset sequence. the flash module holds off all cpu access for the initial portion of the reset sequence. while flash reads are possible when the hold is removed, writes to the fccobix, fccobhi, and fccoblo registers are ignored to prevent command activity while the memory controller remains busy. completion of the reset sequence is marked by setting ccif high which enables writes to the fccobix, fccobhi, and fccoblo registers to launch any available flash command. if a reset occurs while any flash command is in progress, that command will be immediately aborted. the state of the word being programmed or the sector/block being erased is not guaranteed. mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1137 chapter 29 1024 kbyte flash module (s12xftm1024k5v2) table 29-1. revision history revision number revision date sections affected description of changes v02.08 14 nov 2007 29.5.2/29-1198 29.4.2/29-1174 29.4.2.8/29- 1180 - changed terminology from ?ord program to ?rogram p-flash in the bdm unsecuring description, section 29.5.2 - added requirement that user not write any flash module register during execution of commands ?rase all blocks? section 29.4.2.8 , and ?nsecure flash? section 29.4.2.11 - added statement that security is released upon successful completion of command ?rase all blocks? section 29.4.2.8 v02.09 19 dec 2007 29.4.2/29-1174 - corrected error handling table for full partition d-flash, partition d-flash, and eeprom emulation query commands v02.10 25 sep 2009 29.1/29-1138 29.3.2.1/29- 1150 29.4.2.4/29- 1177 29.4.2.7/29- 1179 29.4.2.12/29- 1183 29.4.2.12/29- 1183 29.4.2.12/29- 1183 29.4.2.20/29- 1192 29.3.2/29-1148 29.3.2.1/29- 1150 29.4.1.2/29- 1169 29.6/29-1198 - clarify single bit fault correction for p-flash phrase - expand fdiv vs oscclk frequency table - add statement concerning code runaway when executing read once command from flash block containing associated ?lds - add statement concerning code runaway when executing program once command from flash block containing associated ?lds - add statement concerning code runaway when executing verify backdoor access key command from flash block containing associated ?lds - relate key 0 to associated backdoor comparison key address - change ?ower down reset?to ?eset - add accerr condition for disable eeprom emulation command the following changes were made to clarify module behavior related to flash register access during reset sequence and while flash commands are active: - add caution concerning register writes while command is active - writes to fclkdiv are allowed during reset sequence while ccif is clear - add caution concerning register writes while command is active - writes to fccobix, fccobhi, fccoblo registers are ignored during reset sequence mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1138 29.1 introduction the ftm1024k5 module implements the following: 1024 kbytes of p-flash (program flash) memory, consisting of 5 physical flash blocks, intended primarily for nonvolatile code storage 32 kbytes of d-flash (data flash) memory, consisting of 1 physical flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated eeprom, as basic flash memory primarily intended for nonvolatile data storage, or as a combination of both 4 kbytes of buffer ram, consisting of 1 physical ram block, that can be used as emulated eeprom using a built-in hardware scheme, as basic ram, or as a combination of both the flash memory is ideal for single-supply applications allowing for ?ld reprogramming without requiring external high voltage sources for program or erase operations. the flash module includes a memory controller that executes commands to modify flash memory contents or con?ure module resources for emulated eeprom operation. the user interface to the memory controller consists of the indexed flash common command object (fccob) register which is written to with the command, global address, data, and any required command parameters. the memory controller must complete the execution of a command before the fccob register can be written to with a new command. caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. the ram and flash memory may be read as bytes, aligned words, or misaligned words. read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. for flash memory, an erased bit reads 1 and a programmed bit reads 0. it is not possible to read from a flash block while any command is executing on that speci? flash block. it is possible to read from a flash block while a command is executing on a different flash block. both p-flash and d-flash memories are implemented with error correction codes (ecc) that can resolve single bit faults and detect double bit faults. for p-flash memory, the ecc implementation requires that programming be done on an aligned 8 byte basis (a flash phrase). since p-flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 29.1.1 glossary buffer ram the buffer ram constitutes the volatile memory store required for eee. memory space in the buffer ram not required for eee can be partitioned to provide volatile memory space for applications. chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1139 command write sequence ?an mcu instruction sequence to execute built-in algorithms (including program and erase) on the flash memory. d-flash memory ?the d-flash memory constitutes the nonvolatile memory store required for eee. memory space in the d-flash memory not required for eee can be partitioned to provide nonvolatile memory space for applications. d-flash sector the d-flash sector is the smallest portion of the d-flash memory that can be erased. the d-flash sector consists of four 64 byte rows for a total of 256 bytes. eee (emulated eeprom) ?a method to emulate the small sector size features and endurance characteristics associated with an eeprom. eee ifr nonvolatile information register located in the d-flash block that contains data required to partition the d-flash memory and buffer ram for eee. the eee ifr is visible in the global memory map by setting the eeeifron bit in the mmcctl1 register. nvm command mode an nvm mode using the cpu to setup the fccob register to pass parameters required for flash command execution. phrase an aligned group of four 16-bit words within the p-flash memory. each phrase includes eight ecc bits for single bit fault correction and double bit fault detection within the phrase. p-flash memory the p-flash memory constitutes the main nonvolatile memory store for applications. p-flash sector ?the p-flash sector is the smallest portion of the p-flash memory that can be erased. each p-flash sector contains 1024 bytes. program ifr ?nonvolatile information register located in the p-flash block that contains the device id, version id, and the program once ?ld. the program ifr is visible in the global memory map by setting the pgmifron bit in the mmcctl1 register. 29.1.2 features 29.1.2.1 p-flash features 1024 kbytes of p-flash memory composed of three 256 kbyte flash blocks and two 128 kbyte flash blocks. the 256 kbyte flash block consists of two 128 kbyte sections each divided into 128 sectors of 1024 bytes. the 128 kbyte flash blocks are each divided into 128 sectors of 1024 bytes. single bit fault correction and double bit fault detection within a 64-bit phrase during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and phrase program operation ability to program up to one phrase in each p-flash block simultaneously flexible protection scheme to prevent accidental program or erase of p-flash memory chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1140 freescale semiconductor 29.1.2.2 d-flash features up to 32 kbytes of d-flash memory with 256 byte sectors for user access dedicated commands to control access to the d-flash memory over eee operation single bit fault correction and double bit fault detection within a word during read operations automated program and erase algorithm with verify and generation of ecc parity bits fast sector erase and word program operation ability to program up to four words in a burst sequence 29.1.2.3 emulated eeprom features up to 4 kbytes of emulated eeprom (eee) accessible as 4 kbytes of ram flexible protection scheme to prevent accidental program or erase of data automatic eee ?e handling using an internal memory controller automatic transfer of valid eee data from d-flash memory to buffer ram on reset ability to monitor the number of outstanding eee related buffer ram words left to be programmed into d-flash memory ability to disable eee operation and allow priority access to the d-flash memory ability to cancel all pending eee operations and allow priority access to the d-flash memory 29.1.2.4 user buffer ram features up to 4 kbytes of ram for user access 29.1.2.5 other flash module features no external high-voltage power supply required for flash memory program and erase operations interrupt generation on flash command completion and flash error detection security mechanism to prevent unauthorized access to the flash memory 29.1.3 block diagram the block diagram of the flash module is shown in figure 29-1 . chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1141 figure 29-1. ftm1024k5 block diagram 29.2 external signal description the flash module contains no signals that connect off-chip. oscillator clock divider clock (xtal) command interrupt request fclk protection security registers flash interface d-flash 16kx22 buffer ram memory p-flash block 0 32kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 16kx72 16kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 p-flash sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 16kx72 16kx72 16bit internal bus p-flash block 1s block 1n xgate cpu 16kx72 16kx72 16kx72 16kx72 p-flash block 2 32kx72 p-flash block 3 32kx72 tag ram 128x16 error interrupt request controller 2kx16 sector 0 sector 1 sector 127 scratch ram 512x16 chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1142 freescale semiconductor 29.3 memory map and registers this section describes the memory map and registers for the flash module. read data from unimplemented memory space in the flash module is unde?ed. write access to unimplemented or reserved memory space in the flash module will be ignored by the flash module. 29.3.1 module memory map the s12x architecture places the p-flash memory between global addresses 0x70_0000 and 0x7f_ffff as shown in table 29-2 . the p-flash memory map is shown in figure 29-2 . the fprot register, described in section 29.3.2.9 , can be set to protect regions in the flash memory from accidental program or erase. three separate memory regions, one growing upward from global address 0x7f_8000 in the flash memory (called the lower region), one growing downward from global address 0x7f_ffff in the flash memory (called the higher region), and the remaining addresses in the flash memory, can be activated for protection. the flash memory addresses covered by these protectable regions are shown in the p-flash memory map. the higher address region is mainly targeted to hold the boot loader code since it covers the vector space. default protection settings as well as security information that allows the mcu to restrict access to the flash module are stored in the flash con?uration ?ld as described in table 29-3 . table 29-2. p-flash memory addressing global address size (bytes) description 0x7c_0000 ?0x7f_ffff 256 k p-flash block 0 contains flash con?uration field (see table 29-3 ) 0x7a_0000 ?0x7b_ffff 128 k p-flash block 1n 0x78_0000 ?0x79_ffff 128 k p-flash block 1s 0x74_0000 ?0x77_ffff 256 k p-flash block 2 0x70_0000 ?0x73_ffff 256 k p-flash block 3 table 29-3. flash con?uration field (1) global address size (bytes) description 0x7f_ff00 ?0x7f_ff07 8 backdoor comparison key refer to section 29.4.2.12, ?erify backdoor access key command , and section 29.5.1, ?nsecuring the mcu using backdoor key access 0x7f_ff08 0x7f_ff0b (2) 4 reserved 0x7f_ff0c 2 1 p-flash protection byte . refer to section 29.3.2.9, ?-flash protection register (fprot) 0x7f_ff0d 2 1 eee protection byte refer to section 29.3.2.10, ?ee protection register (eprot) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1143 0x7f_ff0e 2 1 flash nonvolatile byte refer to section 29.3.2.14, ?lash option register (fopt) 0x7f_ff0f 2 1 flash security byte refer to section 29.3.2.2, ?lash security register (fsec) 1. older versions may have swapped protection byte addresses 2. 0x7ff08 - 0x7f_ff0f form a flash phrase and must be programmed in a single command write sequence. each byte in the 0x7f_ff08 - 0x7f_ff0b reserved ?ld should be programmed to 0xff. table 29-3. flash con?uration field (1) global address size (bytes) description chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1144 freescale semiconductor figure 29-2. p-flash memory map flash con?uration field 0x7f_c000 flash protected/unprotected lower region 1, 2, 4, 8 kbytes 0x7f_8000 0x7f_9000 0x7f_8400 0x7f_8800 0x7f_a000 p-flash end = 0x7f_ffff 0x7f_f800 0x7f_f000 0x7f_e000 flash protected/unprotected higher region 2, 4, 8, 16 kbytes flash protected/unprotected region 8 kbytes (up to 29 kbytes) 16 bytes (0x7f_ff00 - 0x7f_ff0f) flash protected/unprotected region 992 kbytes p-flash start = 0x70_0000 chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1145 table 29-4. program ifr fields global address (pgmifron) size (bytes) field description 0x40_0000 ?0x40_0007 8 device id 0x40_0008 ?0x40_00e7 224 reserved 0x40_00e8 ?0x40_00e9 2 version id 0x40_00ea ?0x40_00ff 22 reserved 0x40_0100 ?0x40_013f 64 program once field refer to section 29.4.2.7, ?rogram once command 0x40_0140 ?0x40_01ff 192 reserved table 29-5. p-flash ifr accessibility global address (pgmifron) size (bytes) accessed from 0x40_0000 ?0x40_01ff 512 xbus0 (pblk0s) (1) 1. refer to table 29-4 for more details. 0x40_0200 ?0x40_03ff 512 unimplemented 0x40_0400 ?0x40_05ff 512 xbus0 (pblk1n) 0x40_0600 ?0x40_07ff 512 xbus1 (pblk1s) 0x40_0800 ?0x40_09ff 512 xbus0 (pblk2s) 0x40_0a00 ?0x40_0bff 512 unimplemented 0x40_0c00 ?0x40_0dff 512 xbus0 (pblk3s) 0x40_0e00 ?0x40_0fff 512 unimplemented chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1146 freescale semiconductor table 29-6. eee resource fields global address size (bytes) description 0x10_0000 ?0x10_7fff 32,768 d-flash memory (user and eee) 0x10_8000 ?0x11_ffff 98,304 reserved 0x12_0000 ?0x12_007f 128 eee nonvolatile information register (eeeifron (1) = 1) 1. mmcctl1 register bit 0x12_0080 ?0x12_0fff 3,968 reserved 0x12_1000 ?0x12_1eff 3,840 reserved 0x12_1f00 ?0x12_1fff 256 eee tag ram (tmgramon 1 = 1) 0x12_2000 ?0x12_3bff 7,168 reserved 0x12_3c00 ?0x12_3fff 1,024 memory controller scratch ram (tmgramon 1 = 1) 0x12_4000 ?0x12_dfff 40,960 reserved 0x12_e000 ?0x12_ffff 8,192 reserved 0x13_0000 ?0x13_efff 61,440 reserved 0x13_f000 ?0x13_ffff 4,096 buffer ram (user and eee) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1147 figure 29-3. eee resource memory map the full partition d-flash command (see section 29.4.2.15 ) is used to program the eee nonvolatile information register ?lds where address 0x12_0000 de?es the d-flash partition for user access and address 0x12_0004 de?es the buffer ram partition for eee operations. buffer ram start = 0x13_f000 buffer ram end = 0x13_ffff 0x13_ffc0 0x13_ff80 protectable region (eee only) 64, 128, 192, 256, 320, 384, 448, 512 bytes buffer ram 4 kbytes 0x13_ff40 0x13_ff00 0x13_fec0 0x13_fe80 0x13_fe40 0x13_fe00 0x12_ffff 0x12_4000 0x12_1000 memory controller scratch ram (tmgramon) 1024 bytes eee tag ram (tmgramon) 256 bytes eee nonvolatile information register (eeeifron) 128 bytes d-flash memory 32 kbytes d-flash start = 0x10_0000 d-flash user partition d-flash eee partition 0x12_0000 0x12_2000 0x12_e000 d-flash end = 0x10_7fff buffer ram user partition buffer ram eee partition chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1148 freescale semiconductor 29.3.2 register descriptions the flash module contains a set of 20 control and status registers located between flash module base + 0x0000 and 0x0013. a summary of the flash module registers is given in figure 29-4 with detailed descriptions in the following subsections. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. table 29-7. eee nonvolatile information register fields global address (eeeifron) size (bytes) description 0x12_0000 ?0x12_0001 2 d-flash user partition (dfpart) refer to section 29.4.2.15, ?ull partition d-flash command 0x12_0002 ?0x12_0003 2 d-flash user partition (duplicate (1) ) 1. duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 ?0x12_0005 2 buffer ram eee partition (erpart) refer to section 29.4.2.15, ?ull partition d-flash command 0x12_0006 ?0x12_0007 2 buffer ram eee partition (duplicate 1 ) 0x12_0008 ?0x12_007f 120 reserved address & name 76543210 0x0000 fclkdiv r fdivld fdiv6 fdiv5 fdiv4 fdiv3 fdiv2 fdiv1 fdiv0 w 0x0001 fsec r keyen1 keyen0 rnv5 rnv4 rnv3 rnv2 sec1 sec0 w 0x0002 fccobix r0 0 0 0 0 ccobix2 ccobix1 ccobix0 w 0x0003 feccrix r0 0 0 0 0 eccrix2 eccrix1 eccrix0 w 0x0004 fcnfg r ccie 00 ignsf 00 fdfd fsfd w 0x0005 fercnfg r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w figure 29-4. ftm1024k5 register summary chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1149 0x0006 fstat r ccif 0 accerr fpviol mgbusy rsvd mgstat1 mgstat0 w 0x0007 ferstat r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w 0x0008 fprot r fpopen rnv6 fphdis fphs1 fphs0 fpldis fpls1 fpls0 w 0x0009 eprot r epopen rnv6 rnv5 rnv4 epdis eps2 eps1 eps0 w 0x000a fccobhi r ccob15 ccob14 ccob13 ccob12 ccob11 ccob10 ccob9 ccob8 w 0x000b fccoblo r ccob7 ccob6 ccob5 ccob4 ccob3 ccob2 ccob1 ccob0 w 0x000c etaghi r etag15 etag14 etag13 etag12 etag11 etag10 etag9 etag8 w 0x000d etaglo r etag7 etag6 etag5 etag4 etag3 etag2 etag1 etag0 w 0x000e feccrhi r eccr15 eccr14 eccr13 eccr12 eccr11 eccr10 eccr9 eccr8 w 0x000f feccrlo r eccr7 eccr6 eccr5 eccr4 eccr3 eccr2 eccr1 eccr0 w 0x0010 fopt r nv7 nv6 nv5 nv4 nv3 nv2 nv1 nv0 w 0x0011 frsv0 r00000000 w 0x0012 frsv1 r00000000 w 0x0013 frsv2 r00000000 w address & name 76543210 figure 29-4. ftm1024k5 register summary (continued) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1150 freescale semiconductor 29.3.2.1 flash clock divider register (fclkdiv) the fclkdiv register is used to control timed events in program and erase algorithms. all bits in the fclkdiv register are readable, bits 6? are write once and bit 7 is not writable. caution the fclkdiv register should never be written while a flash command is executing (ccif=0). the fclkdiv register is writable during the flash reset sequence even though ccif is clear. = unimplemented or reserved offset module base + 0x0000 76543210 r fdivld fdiv[6:0] w reset 00000000 = unimplemented or reserved figure 29-5. flash clock divider register (fclkdiv) table 29-8. fclkdiv field descriptions field description 7 fdivld clock divider loaded 0 fclkdiv register has not been written 1 fclkdiv register has been written since the last reset 6? fdiv[6:0] clock divider bits ?fdiv[6:0] must be set to effectively divide oscclk down to generate an internal flash clock, fclk, with a target frequency of 1 mhz for use by the flash module to control timed events during program and erase algorithms. table 29-9 shows recommended values for fdiv[6:0] based on oscclk frequency. please refer to section 29.4.1, ?lash command operations , for more information. address & name 76543210 figure 29-4. ftm1024k5 register summary (continued) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1151 table 29-9. fdiv vs oscclk frequency oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] oscclk frequency (mhz) fdiv[6:0] min (1) 1. fdiv shown generates an fclk frequency of >0.8 mhz max (2) min 1 max 2 min 1 max 2 33.60 34.65 0x20 67.20 68.25 0x40 1.60 2.10 0x01 34.65 35.70 0x21 68.25 69.30 0x41 2.40 3.15 0x02 35.70 36.75 0x22 69.30 70.35 0x42 3.20 4.20 0x03 36.75 37.80 0x23 70.35 71.40 0x43 4.20 5.25 0x04 37.80 38.85 0x24 71.40 72.45 0x44 5.25 6.30 0x05 38.85 39.90 0x25 72.45 73.50 0x45 6.30 7.35 0x06 39.90 40.95 0x26 73.50 74.55 0x46 7.35 8.40 0x07 40.95 42.00 0x27 74.55 75.60 0x47 8.40 9.45 0x08 42.00 43.05 0x28 75.60 76.65 0x48 9.45 10.50 0x09 43.05 44.10 0x29 76.65 77.70 0x49 10.50 11.55 0x0a 44.10 45.15 0x2a 77.70 78.75 0x4a 11.55 12.60 0x0b 45.15 46.20 0x2b 78.75 79.80 0x4b 12.60 13.65 0x0c 46.20 47.25 0x2c 79.80 80.85 0x4c 13.65 14.70 0x0d 47.25 48.30 0x2d 80.85 81.90 0x4d 14.70 15.75 0x0e 48.30 49.35 0x2e 81.90 82.95 0x4e 15.75 16.80 0x0f 49.35 50.40 0x2f 82.95 84.00 0x4f 16.80 17.85 0x10 50.40 51.45 0x30 84.00 85.05 0x50 17.85 18.90 0x11 51.45 52.50 0x31 85.05 86.10 0x51 18.90 19.95 0x12 52.50 53.55 0x32 86.10 87.15 0x52 19.95 21.00 0x13 53.55 54.60 0x33 87.15 88.20 0x53 21.00 22.05 0x14 54.60 55.65 0x34 88.20 89.25 0x54 22.05 23.10 0x15 55.65 56.70 0x35 89.25 90.30 0x55 23.10 24.15 0x16 56.70 57.75 0x36 90.30 91.35 0x56 24.15 25.20 0x17 57.75 58.80 0x37 91.35 92.40 0x57 25.20 26.25 0x18 58.80 59.85 0x38 92.40 93.45 0x58 26.25 27.30 0x19 59.85 60.90 0x39 93.45 94.50 0x59 27.30 28.35 0x1a 60.90 61.95 0x3a 94.50 95.55 0x5a 28.35 29.40 0x1b 61.95 63.00 0x3b 95.55 96.60 0x5b 29.40 30.45 0x1c 63.00 64.05 0x3c 96.60 97.65 0x5c 30.45 31.50 0x1d 64.05 65.10 0x3d 97.65 98.70 0x5d 31.50 32.55 0x1e 65.10 66.15 0x3e 98.70 99.75 0x5e 32.55 33.60 0x1f 66.15 67.20 0x3f 99.75 100.80 0x5f chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1152 freescale semiconductor 29.3.2.2 flash security register (fsec) the fsec register holds all bits associated with the security of the mcu and flash module. all bits in the fsec register are readable but not writable. during the reset sequence, the fsec register is loaded with the contents of the flash security byte in the flash configuration field at global address 0x7f_ff0f located in p-flash memory (see table 29-3 ) as indicated by reset condition f in figure 29-6 . if a double bit fault is detected while reading the p-flash phrase containing the flash security byte during the reset sequence, all bits in the fsec register will be set to leave the flash module in a secured state with backdoor key access disabled. 2. fdiv shown generates an fclk frequency of 1.05 mhz offset module base + 0x0001 76543210 r keyen[1:0] rnv[5:2] sec[1:0] w reset f f ffffff = unimplemented or reserved figure 29-6. flash security register (fsec) table 29-10. fsec field descriptions field description 7? keyen[1:0] backdoor key security enable bits the keyen[1:0] bits de?e the enabling of backdoor key access to the flash module as shown in table 29-11 . 5? rnv[5:2} reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements. 1? sec[1:0] flash security bits ?the sec[1:0] bits de?e the security state of the mcu as shown in table 29-12 . if the flash module is unsecured using backdoor key access, the sec bits are forced to 10. table 29-11. flash keyen states keyen[1:0] status of backdoor key access 00 disabled 01 disabled (1) 1. preferred keyen state to disable backdoor key access. 10 enabled 11 disabled chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1153 the security function in the flash module is described in section 29.5 . 29.3.2.3 flash ccob index register (fccobix) the fccobix register is used to index the fccob register for flash memory operations. ccobix bits are readable and writable while remaining bits read 0 and are not writable. 29.3.2.4 flash eccr index register (feccrix) the feccrix register is used to index the feccr register for ecc fault reporting. eccrix bits are readable and writable while remaining bits read 0 and are not writable. table 29-12. flash security states sec[1:0] status of security 00 secured 01 secured (1) 1. preferred sec state to set mcu to secured state. 10 unsecured 11 secured offset module base + 0x0002 76543210 r00000 ccobix[2:0] w reset 00000000 = unimplemented or reserved figure 29-7. fccob index register (fccobix) table 29-13. fccobix field descriptions field description 2? ccobix[1:0] common command register index the ccobix bits are used to select which word of the fccob register array is being read or written to. see section 29.3.2.11, ?lash common command object register (fccob) , for more details. offset module base + 0x0003 76543210 r00000 eccrix[2:0] w reset 00000000 = unimplemented or reserved figure 29-8. feccr index register (feccrix) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1154 freescale semiconductor 29.3.2.5 flash con?uration register (fcnfg) the fcnfg register enables the flash command complete interrupt and forces ecc faults on flash array read access from the cpu or xgate. ccie, ignsf, fdfd, and fsfd bits are readable and writable while remaining bits read 0 and are not writable. table 29-14. feccrix field descriptions field description 2-0 eccrix[2:0] ecc error register index ?the eccrix bits are used to select which word of the feccr register array is being read. see section 29.3.2.13, ?lash ecc error results register (feccr) , for more details. offset module base + 0x0004 76543210 r ccie 00 ignsf 00 fdfd fsfd w reset 00000000 = unimplemented or reserved figure 29-9. flash con?uration register (fcnfg) table 29-15. fcnfg field descriptions field description 7 ccie command complete interrupt enable ?the ccie bit controls interrupt generation when a flash command has completed. 0 command complete interrupt disabled 1 an interrupt will be requested whenever the ccif ?g in the fstat register is set (see section 29.3.2.7 ) 4 ignsf ignore single bit fault ?the ignsf controls single bit fault reporting in the ferstat register (see section 29.3.2.8 ). 0 all single bit faults detected during array reads are reported 1 single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1155 29.3.2.6 flash error con?uration register (fercnfg) the fercnfg register enables the flash error interrupts for the ferstat flags. all assigned bits in the fercnfg register are readable and writable. 1 fdfd force double bit fault detect the fdfd bit allows the user to simulate a double bit fault during flash array read operations and check the associated interrupt routine. the fdfd bit is cleared by writing a 0 to fdfd. the feccr registers will not be updated during the flash array read operation with fdfd set unless an actual double bit fault is detected. 0 flash array read operations will set the dfdif ?g in the ferstat register only if a double bit fault is detected 1 any flash array read operation will force the dfdif ?g in the ferstat register to be set (see section 29.3.2.7 ) and an interrupt will be generated as long as the dfdie interrupt enable in the fercnfg register is set (see section 29.3.2.6 ) 0 fsfd force single bit fault detect the fsfd bit allows the user to simulate a single bit fault during flash array read operations and check the associated interrupt routine. the fsfd bit is cleared by writing a 0 to fsfd. the feccr registers will not be updated during the flash array read operation with fsfd set unless an actual single bit fault is detected. 0 flash array read operations will set the sfdif ?g in the ferstat register only if a single bit fault is detected 1 flash array read operation will force the sfdif ?g in the ferstat register to be set (see section 29.3.2.7 ) and an interrupt will be generated as long as the sfdie interrupt enable in the fercnfg register is set (see section 29.3.2.6 ) offset module base + 0x0005 76543210 r erserie pgmerie 0 epviolie ersvie1 ersvie0 dfdie sfdie w reset 00000000 = unimplemented or reserved figure 29-10. flash error con?uration register (fercnfg) table 29-16. fercnfg field descriptions field description 7 erserie eee erase error interrupt enable the erserie bit controls interrupt generation when a failure is detected during an eee erase operation. 0 erserif interrupt disabled 1 an interrupt will be requested whenever the erserif ?g is set (see section 29.3.2.8 ) 6 pgmerie eee program error interrupt enable ?the pgmerie bit controls interrupt generation when a failure is detected during an eee program operation. 0 pgmerif interrupt disabled 1 an interrupt will be requested whenever the pgmerif ?g is set (see section 29.3.2.8 ) 4 epviolie eee protection violation interrupt enable ?the epviolie bit controls interrupt generation when a protection violation is detected during a write to the buffer ram eee partition. 0 epviolif interrupt disabled 1 an interrupt will be requested whenever the epviolif ?g is set (see section 29.3.2.8 ) table 29-15. fcnfg field descriptions (continued) field description chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1156 freescale semiconductor 29.3.2.7 flash status register (fstat) the fstat register reports the operational status of the flash module. ccif, accerr, and fpviol bits are readable and writable, mgbusy and mgstat bits are readable but not writable, while remaining bits read 0 and are not writable. 3 ersvie1 eee error type 1 interrupt enable the ersvie1 bit controls interrupt generation when a change state error is detected during an eee operation. 0 ersvif1 interrupt disabled 1 an interrupt will be requested whenever the ersvif1 ?g is set (see section 29.3.2.8 ) 2 ersvie0 eee error type 0 interrupt enable the ersvie0 bit controls interrupt generation when a sector format error is detected during an eee operation. 0 ersvif0 interrupt disabled 1 an interrupt will be requested whenever the ersvif0 ?g is set (see section 29.3.2.8 ) 1 dfdie double bit fault detect interrupt enable the dfdie bit controls interrupt generation when a double bit fault is detected during a flash block read operation. 0 dfdif interrupt disabled 1 an interrupt will be requested whenever the dfdif ?g is set (see section 29.3.2.8 ) 0 sfdie single bit fault detect interrupt enable the sfdie bit controls interrupt generation when a single bit fault is detected during a flash block read operation. 0 sfdif interrupt disabled whenever the sfdif ?g is set (see section 29.3.2.8 ) 1 an interrupt will be requested whenever the sfdif ?g is set (see section 29.3.2.8 ) offset module base + 0x0006 76543210 r ccif 0 accerr fpviol mgbusy rsvd mgstat[1:0] w reset 1000000 (1) 1. reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see section 29.6 ). 0 1 = unimplemented or reserved figure 29-11. flash status register (fstat) table 29-16. fercnfg field descriptions (continued) field description chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1157 29.3.2.8 flash error status register (ferstat) the ferstat register re?cts the error status of internal flash operations. all ?gs in the ferstat register are readable and only writable to clear the ?g. table 29-17. fstat field descriptions field description 7 ccif command complete interrupt flag ?the ccif ?g indicates that a flash command has completed. the ccif ?g is cleared by writing a 1 to ccif to launch a command and ccif will stay low until command completion or command violation. 0 flash command in progress 1 flash command has completed 5 accerr flash access error flag ?the accerr bit indicates an illegal access has occurred to the flash memory caused by either a violation of the command write sequence (see section 29.4.1.2 ) or issuing an illegal flash command or when errors are encountered while initializing the eee buffer ram during the reset sequence. while accerr is set, the ccif ?g cannot be cleared to launch a command. the accerr bit is cleared by writing a 1 to accerr. writing a 0 to the accerr bit has no effect on accerr. 0 no access error detected 1 access error detected 4 fpviol flash protection violation flag ?he fpviol bit indicates an attempt was made to program or erase an address in a protected area of p-flash memory during a command write sequence. the fpviol bit is cleared by writing a 1 to fpviol. writing a 0 to the fpviol bit has no effect on fpviol. while fpviol is set, it is not possible to launch a command or start a command write sequence. 0 no protection violation detected 1 protection violation detected 3 mgbusy memory controller busy flag ?the mgbusy ?g re?cts the active state of the memory controller . 0 memory controller is idle 1 memory controller is busy executing a flash command (ccif = 0) or is handling internal eee operations 2 rsvd reserved bit ?this bit is reserved and always reads 0 . 1? mgstat[1:0] memory controller command completion status flag one or more mgstat ?g bits are set if an error is detected during execution of a flash command or during the flash reset sequence. see section 29.4.2, ?lash command description , and section 29.6, ?nitialization ?for details. offset module base + 0x0007 76543210 r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w reset 00000000 = unimplemented or reserved figure 29-12. flash error status register (ferstat) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1158 freescale semiconductor 29.3.2.9 p-flash protection register (fprot) the fprot register defines which p-flash sectors are protected against program and erase operations. table 29-18. ferstat field descriptions field description 7 erserif eee erase error interrupt flag ?the setting of the erserif ?g occurs due to an error in a flash erase command that resulted in the erase operation not being successful during eee operations. the erserif ?g is cleared by writing a 1 to erserif. writing a 0 to the erserif ?g has no effect on erserif. while erserif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 erase command successfully completed on the d-flash eee partition 1 erase command failed on the d-flash eee partition 6 pgmerif eee program error interrupt flag ?the setting of the pgmerif ?g occurs due to an error in a flash program command that resulted in the program operation not being successful during eee operations. the pgmerif ?g is cleared by writing a 1 to pgmerif. writing a 0 to the pgmerif ?g has no effect on pgmerif. while pgmerif is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 program command successfully completed on the d-flash eee partition 1 program command failed on the d-flash eee partition 4 epviolif eee protection violation interrupt flag ?he setting of the epviolif ?g indicates an attempt was made to write to a protected area of the buffer ram eee partition. the epviolif ?g is cleared by writing a 1 to epviolif. writing a 0 to the epviolif ?g has no effect on epviolif. while epviolif is set, it is possible to write to the buffer ram eee partition as long as the address written to is not in a protected area. 0 no eee protection violation 1 eee protection violation detected 3 ersvif1 eee error interrupt 1 flag ?he setting of the ersvif1 ?g indicates that the memory controller was unable to change the state of a d-flash eee sector. the ersvif1 ?g is cleared by writing a 1 to ersvif1. writing a 0 to the ersvif1 ?g has no effect on ersvif1. while ersvif1 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector state change error detected 1 eee sector state change error detected 2 ersvif0 eee error interrupt 0 flag ?he setting of the ersvif0 ?g indicates that the memory controller was unable to format a d-flash eee sector for eee use. the ersvif0 ?g is cleared by writing a 1 to ersvif0. writing a 0 to the ersvif0 ?g has no effect on ersvif0. while ersvif0 is set, it is possible to write to the buffer ram eee partition but the data written will not be transferred to the d-flash eee partition. 0 no eee sector format error detected 1 eee sector format error detected 1 dfdif double bit fault detect interrupt flag ?the setting of the dfdif ?g indicates that a double bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the dfdif ?g is cleared by writing a 1 to dfdif. writing a 0 to dfdif has no effect on dfdif. 0 no double bit fault detected 1 double bit fault detected or an invalid flash array read operation attempted 0 sfdif single bit fault detect interrupt flag ?with the ignsf bit in the fcnfg register clear, the sfdif ?g indicates that a single bit fault was detected in the stored parity and data bits during a flash array read operation or that a flash array read operation was attempted on a flash block that was under a flash command operation. the sfdif ?g is cleared by writing a 1 to sfdif. writing a 0 to sfdif has no effect on sfdif. 0 no single bit fault detected 1 single bit fault detected and corrected or an invalid flash array read operation attempted chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1159 the (unreserved) bits of the fprot register are writable with the restriction that the size of the protected region can only be increased (see section 29.3.2.9.1, ?-flash protection restrictions , and table 29-23 ). during the reset sequence, the fprot register is loaded with the contents of the p-flash protection byte in the flash configuration field at global address 0x7f_ff0c located in p-flash memory (see table 29-3 ) as indicated by reset condition ??in figure 29-13 . to change the p-flash protection that will be loaded during the reset sequence, the upper sector of the p-flash memory must be unprotected, then the p-flash protection byte must be reprogrammed. if a double bit fault is detected while reading the p-flash phrase containing the p-flash protection byte during the reset sequence, the fpopen bit will be cleared and remaining bits in the fprot register will be set to leave the p-flash memory fully protected. trying to alter data in any protected area in the p-flash memory will result in a protection violation error and the fpviol bit will be set in the fstat register. the block erase of a p-flash block is not possible if any of the p-flash sectors contained in the same p-flash block are protected. offset module base + 0x0008 76543210 r fpopen rnv6 fphdis fphs[1:0] fpldis fpls[1:0] w reset f f ffffff = unimplemented or reserved figure 29-13. flash protection register (fprot) table 29-19. fprot field descriptions field description 7 fpopen flash protection operation enable ?the fpopen bit determines the protection function for program or erase operations as shown in table 29-20 for the p-flash block. 0 when fpopen is clear, the fphdis and fpldis bits de?e unprotected address ranges as speci?d by the corresponding fphs and fpls bits 1 when fpopen is set, the fphdis and fpldis bits enable protection for the address range speci?d by the corresponding fphs and fpls bits 6 rnv[6] reserved nonvolatile bit ?the rnv bit should remain in the erased state for future enhancements. 5 fphdis flash protection higher address range disable ?the fphdis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory ending with global address 0x7f_ffff. 0 protection/unprotection enabled 1 protection/unprotection disabled 4? fphs[1:0] flash protection higher address size the fphs bits determine the size of the protected/unprotected area in p-flash memory as shown in table 29-21 . the fphs bits can only be written to while the fphdis bit is set. 2 fpldis flash protection lower address range disable ?the fpldis bit determines whether there is a protected/unprotected area in a speci? region of the p-flash memory beginning with global address 0x7f_8000. 0 protection/unprotection enabled 1 protection/unprotection disabled 1? fpls[1:0] flash protection lower address size the fpls bits determine the size of the protected/unprotected area in p-flash memory as shown in table 29-22 . the fpls bits can only be written to while the fpldis bit is set. chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1160 freescale semiconductor all possible p-flash protection scenarios are shown in figure 29-14 . although the protection scheme is loaded from the flash memory at global address 0x7f_ff0c during the reset sequence, it can be changed by the user. the p-flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. table 29-20. p-flash protection function fpopen fphdis fpldis function (1) 1. for range sizes, refer to table 29-21 and table 29-22 . 1 1 1 no p-flash protection 1 1 0 protected low range 1 0 1 protected high range 1 0 0 protected high and low ranges 0 1 1 full p-flash memory protected 0 1 0 unprotected low range 0 0 1 unprotected high range 0 0 0 unprotected high and low ranges table 29-21. p-flash protection higher address range fphs[1:0] global address range protected size 00 0x7f_f800?x7f_ffff 2 kbytes 01 0x7f_f000?x7f_ffff 4 kbytes 10 0x7f_e000?x7f_ffff 8 kbytes 11 0x7f_c000?x7f_ffff 16 kbytes table 29-22. p-flash protection lower address range fpls[1:0] global address range protected size 00 0x7f_8000?x7f_83ff 1 kbyte 01 0x7f_8000?x7f_87ff 2 kbytes 10 0x7f_8000?x7f_8fff 4 kbytes 11 0x7f_8000?x7f_9fff 8 kbytes chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1161 figure 29-14. p-flash protection scenarios 7 6 5 4 fphs[1:0] fpls[1:0] 3 2 1 0 fphs[1:0] fpls[1:0] fphdis = 1 fpldis = 1 fphdis = 1 fpldis = 0 fphdis = 0 fpldis = 1 fphdis = 0 fpldis = 0 scenario scenario unprotected region protected region with size protected region protected region with size defined by fpls defined by fphs not defined by fpls, fphs 0x7f_8000 0x7f_ffff 0x7f_8000 0x7f_ffff flash start flash start fpopen = 1 fpopen = 0 chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1162 freescale semiconductor 29.3.2.9.1 p-flash protection restrictions the general guideline is that p-flash protection can only be added and not removed. table 29-23 specifies all valid transitions between p-flash protection scenarios. any attempt to write an invalid scenario to the fprot register will be ignored. the contents of the fprot register reflect the active protection scenario. see the fphs and fpls bit descriptions for additional restrictions. 29.3.2.10 eee protection register (eprot) the eprot register de?es which buffer ram eee partition areas are protected against writes. all bits in the eprot register are readable and writable except for rnv[6:4] which are only readable. the epopen and epdis bits can only be written to the protected state. the eps bits can be written anytime until the epdis bit is cleared. if the epopen bit is cleared, the state of the epdis and eps bits is irrelevant. during the reset sequence, the eprot register is loaded from the eee protection byte in the flash configuration field at global address 0x7f_ff0d located in p-flash memory (see table 29-3 ) as indicated by reset condition f in figure 29-15 . to change the eee protection that will be loaded during the reset sequence, the p-flash sector containing the eee protection byte must be unprotected, then the eee protection byte must be programmed. if a double bit fault is detected while reading the p-flash phrase table 29-23. p-flash protection scenario transitions from protection scenario to protection scenario (1) 1. allowed transitions marked with x, see figure 29-14 for a de?ition of the scenarios. 01234567 0 xxxx 1 xx 2 xx 3 x 4 xx 5 xxxx 6 xxxx 7 xxxxxxxx offset module base + 0x0009 76543210 r epopen rnv[6:4] epdis eps[2:0] w reset f f ffffff = unimplemented or reserved figure 29-15. eee protection register (eprot) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1163 containing the eee protection byte during the reset sequence, the epopen bit will be cleared and remaining bits in the eprot register will be set to leave the buffer ram eee partition fully protected. trying to write data to any protected area in the buffer ram eee partition will result in a protection violation error and the epviolif ?g will be set in the ferstat register. trying to write data to any protected area in the buffer ram partitioned for user access will not be prevented and the epviolif ?g in the ferstat register will not set. 29.3.2.11 flash common command object register (fccob) the fccob is an array of six words addressed via the ccobix index found in the fccobix register. byte wide reads and writes are allowed to the fccob register. table 29-24. eprot field descriptions field description 7 epopen enables writes to the buffer ram partitioned for eee 0 the entire buffer ram eee partition is protected from writes 1 unprotected buffer ram eee partition areas are enabled for writes 6? rnv[6:4] reserved nonvolatile bits ?the rnv bits should remain in the erased state for future enhancements 3 epdis buffer ram protection address range disable ?the epdis bit determines whether there is a protected area in a speci? region of the buffer ram eee partition. 0 protection enabled 1 protection disabled 2? eps[2:0] buffer ram protection size ?the eps[2:0] bits determine the size of the protected area in the buffer ram eee partition as shown in table 29-21 . the eps bits can only be written to while the epdis bit is set. table 29-25. buffer ram eee partition protection address range eps[2:0] global address range protected size 000 0x13_ffc0 ?0x13_ffff 64 bytes 001 0x13_ff80 ?0x13_ffff 128 bytes 010 0x13_ff40 ?0x13_ffff 192 bytes 011 0x13_ff00 ?0x13_ffff 256 bytes 100 0x13_fec0 ?0x13_ffff 320 bytes 101 0x13_fe80 ?0x13_ffff 384 bytes 110 0x13_fe40 ?0x13_ffff 448 bytes 111 0x13_fe00 ?0x13_ffff 512 bytes chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1164 freescale semiconductor 29.3.2.11.1 fccob - nvm command mode nvm command mode uses the indexed fccob register to provide a command code and its relevant parameters to the memory controller. the user first sets up all required fccob fields and then initiates the command? execution by writing a 1 to the ccif bit in the fstat register (a 1 written by the user clears the ccif command completion flag to 0). when the user clears the ccif bit in the fstat register all fccob parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the memory controller returning ccif to 1). some commands return information to the fccob register array. the generic format for the fccob parameter fields in nvm command mode is shown in table 29-26 . the return values are available for reading after the ccif flag in the fstat register has been returned to 1 by the memory controller. writes to the unimplemented parameter fields (ccobix = 110 and ccobix = 111) are ignored with reads from these fields returning 0x0000. table 29-26 shows the generic flash command format. the high byte of the first word in the ccob array contains the command code, followed by the parameters for this specific flash command. for details on the fccob settings required by each command, see the flash command descriptions in section 29.4.2 . offset module base + 0x000a 76543210 r ccob[15:8] w reset 00000000 figure 29-16. flash common command object high register (fccobhi) offset module base + 0x000b 76543210 r ccob[7:0] w reset 00000000 figure 29-17. flash common command object low register (fccoblo) table 29-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) 000 hi fcmd[7:0] de?ing flash command lo 0, global address [22:16] 001 hi global address [15:8] lo global address [7:0] 010 hi data 0 [15:8] lo data 0 [7:0] chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1165 29.3.2.12 eee tag counter register (etag) the etag register contains the number of outstanding words in the buffer ram eee partition that need to be programmed into the d-flash eee partition. the etag register is decremented prior to the related tagged word being programmed into the d-flash eee partition. all tagged words have been programmed into the d-flash eee partition once all bits in the etag register read 0 and the mgbusy flag in the fstat register reads 0. all etag bits are readable but not writable and are cleared by the memory controller. 29.3.2.13 flash ecc error results register (feccr) the feccr registers contain the result of a detected ecc fault for both single bit and double bit faults. the feccr register provides access to several ecc related fields as defined by the eccrix index bits in the feccrix register (see section 29.3.2.4 ). once ecc fault information has been stored, no other 011 hi data 1 [15:8] lo data 1 [7:0] 100 hi data 2 [15:8] lo data 2 [7:0] 101 hi data 3 [15:8] lo data 3 [7:0] offset module base + 0x000c 76543210 r etag[15:8] w reset 0 0 000000 = unimplemented or reserved figure 29-18. eee tag counter high register (etaghi) offset module base + 0x000d 76543210 r etag[7:0] w reset 00000000 = unimplemented or reserved figure 29-19. eee tag counter low register (etaglo) table 29-26. fccob - nvm command mode (typical usage) ccobix[2:0] byte fccob parameter fields (nvm command mode) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1166 freescale semiconductor fault information will be recorded until the specific ecc fault flag has been cleared. in the event of simultaneous ecc faults, the priority for fault recording is: 1. double bit fault over single bit fault 2. cpu over xgate all feccr bits are readable but not writable. offset module base + 0x000e 76543210 r eccr[15:8] w reset 00000000 = unimplemented or reserved figure 29-20. flash ecc error results high register (feccrhi) offset module base + 0x000f 76543210 r eccr[7:0] w reset 00000000 = unimplemented or reserved figure 29-21. flash ecc error results low register (feccrlo) table 29-27. feccr index settings eccrix[2:0] feccr register content bits [15:8] bit[7] bits[6:0] 000 parity bits read from flash block cpu or xgate source identity global address [22:16] 001 global address [15:0] 010 data 0 [15:0] 011 data 1 [15:0] (p-flash only) 100 data 2 [15:0] (p-flash only) 101 data 3 [15:0] (p-flash only) 110 not used, returns 0x0000 when read 111 not used, returns 0x0000 when read chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1167 the p-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the following four words addressed by eccrix = 010 to 101 contain the 64-bit wide data phrase. the four data words and the parity byte are the uncorrected data read from the p-flash block. the d-flash word addressed by eccrix = 001 contains the lower 16 bits of the global address. the uncorrected 16-bit data word is addressed by eccrix = 010. 29.3.2.14 flash option register (fopt) the fopt register is the flash option register. all bits in the fopt register are readable but are not writable. during the reset sequence, the fopt register is loaded from the flash nonvolatile byte in the flash configuration field at global address 0x7f_ff0e located in p-flash memory (see table 29-3 ) as indicated by reset condition f in figure 29-22 . if a double bit fault is detected while reading the p-flash phrase containing the flash nonvolatile byte during the reset sequence, all bits in the fopt register will be set. 29.3.2.15 flash reserved0 register (frsv0) this flash register is reserved for factory testing. table 29-28. feccr index=000 bit descriptions field description 15:8 par[7:0] ecc parity bits ?contains the 8 parity bits from the 72 bit wide p-flash data word or the 6 parity bits, allocated to par[5:0], from the 22 bit wide d-flash word with par[7:6]=00. 7 xbus01 bus source identi?r the xbus01 bit determines whether the ecc error was caused by a read access from the cpu or xgate. 0 ecc error happened on the cpu access 1 ecc error happened on the xgate access 6? gaddr[22:16] global address ?the gaddr[22:16] ?ld contains the upper seven bits of the global address having caused the error. offset module base + 0x0010 76543210 r nv[7:0] w reset f f ffffff = unimplemented or reserved figure 29-22. flash option register (fopt) table 29-29. fopt field descriptions field description 7? nv[7:0] nonvolatile bits the nv[7:0] bits are available as nonvolatile bits. refer to the device user guide for proper use of the nv bits. chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1168 freescale semiconductor all bits in the frsv0 register read 0 and are not writable. 29.3.2.16 flash reserved1 register (frsv1) this flash register is reserved for factory testing. all bits in the frsv1 register read 0 and are not writable. 29.3.2.17 flash reserved2 register (frsv2) this flash register is reserved for factory testing. all bits in the frsv2 register read 0 and are not writable. offset module base + 0x0011 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 29-23. flash reserved0 register (frsv0) offset module base + 0x0012 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 29-24. flash reserved1 register (frsv1) offset module base + 0x0013 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 29-25. flash reserved2 register (frsv2) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1169 29.4 functional description 29.4.1 flash command operations flash command operations are used to modify flash memory contents or con?ure module resources for eee operation. the next sections describe: how to write the fclkdiv register that is used to generate a time base (fclk) derived from oscclk for flash program and erase command operations the command write sequence used to set flash command parameters and launch execution valid flash commands available for execution 29.4.1.1 writing the fclkdiv register prior to issuing any flash program or erase command after a reset, the user is required to write the fclkdiv register to divide oscclk down to a target fclk of 1 mhz. table 29-9 shows recommended values for the fdiv ?ld based on oscclk frequency. note programming or erasing the flash memory cannot be performed if the bus clock runs at less than 1 mhz. setting fdiv too high can destroy the flash memory due to overstress. setting fdiv too low can result in incomplete programming or erasure of the flash memory cells. when the fclkdiv register is written, the fdivld bit is set automatically. if the fdivld bit is 0, the fclkdiv register has not been written since the last reset. if the fclkdiv register has not been written, any flash program or erase command loaded during a command write sequence will not execute and the accerr bit in the fstat register will set. 29.4.1.2 command write sequence the memory controller will launch all valid flash commands entered using a command write sequence. before launching a command, the accerr and fpviol bits in the fstat register must be clear (see section 29.3.2.7 ) and the ccif flag should be tested to determine the status of the current command write sequence. if ccif is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the fccob register are ignored. caution writes to any flash register must be avoided while a flash command is active (ccif=0) to prevent corruption of flash register contents and memory controller behavior. chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1170 freescale semiconductor 29.4.1.2.1 de?e fccob contents the fccob parameter ?lds must be loaded with all required parameters for the flash command being executed. access to the fccob parameter ?lds is controlled via the ccobix bits in the fccobix register (see section 29.3.2.3 ). the contents of the fccob parameter ?lds are transferred to the memory controller when the user clears the ccif command completion ?g in the fstat register (writing 1 clears the ccif to 0). the ccif ?g will remain clear until the flash command has completed. upon completion, the memory controller will return ccif to 1 and the fccob register will be used to communicate any results. the ?w for a generic command write sequence is shown in figure 29-26 . chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1171 figure 29-26. generic flash command write sequence flowchart write to fccobix register write: fstat register (to launch command) clear ccif 0x80 clear accerr/fpviol 0x30 write: fstat register yes no access error and protection violation read: fstat register read: fstat register no start yes check ccif set? fccob accerr/ fpviol set? exit write: fclkdiv register read: fclkdiv register yes no clock register written check fdivld set? no bit polling for command completion check yes ccif set? to identify speci? command parameter to load. write to fccob register to load required command parameter. yes no more parameters? availability check results from previous command note: fclkdiv must be set after each reset chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1172 freescale semiconductor 29.4.1.3 valid flash module commands table 29-30. flash commands by mode fcmd command unsecured secured ns (1) 1. unsecured normal single chip mode. nx (2) 2. unsecured normal expanded mode. ss (3) 3. unsecured special single chip mode. st (4) 4. unsecured special mode. ns (5) 5. secured normal single chip mode. nx (6) 6. secured normal expanded mode. ss (7) 7. secured special single chip mode. st (8) 8. secured special mode. 0x01 erase verify all blocks ???????? 0x02 erase verify block ???????? 0x03 erase verify p-flash section ????? 0x04 read once ????? 0x05 load data field ????? 0x06 program p-flash ????? 0x07 program once ????? 0x08 erase all blocks ?? ?? 0x09 erase p-flash block ????? 0x0a erase p-flash sector ????? 0x0b unsecure flash ?? ?? 0x0c verify backdoor access key ?? 0x0d set user margin level ????? 0x0e set field margin level ?? 0x0f full partition d-flash ?? 0x10 erase verify d-flash section ????? 0x11 program d-flash ????? 0x12 erase d-flash sector ????? 0x13 enable eeprom emulation ???????? 0x14 disable eeprom emulation ???????? 0x15 eeprom emulation query ???????? 0x20 partition d-flash ???????? chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1173 29.4.1.4 p-flash commands table 29-31 summarizes the valid p-flash commands along with the effects of the commands on the p- flash block and other resources within the flash module. 29.4.1.5 d-flash and eee commands table 29-32 summarizes the valid d-flash and eee commands along with the effects of the commands on the d-flash block and eee operation. table 29-31. p-flash commands fcmd command function on p-flash memory 0x01 erase verify all blocks verify that all p-flash (and d-flash) blocks are erased. 0x02 erase verify block verify that a p-flash block is erased. 0x03 erase verify p- flash section verify that a given number of words starting at the address provided are erased. 0x04 read once read a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that was previously programmed using the program once command. 0x05 load data field load data for simultaneous multiple p-flash block operations. 0x06 program p-flash program a phrase in a p-flash block and any previously loaded phrases for any other p- flash block (see load data field command). 0x07 program once program a dedicated 64 byte ?ld in the nonvolatile information register in p-flash block 0 that is allowed to be programmed only once. 0x08 erase all blocks erase all p-flash (and d-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x09 erase p-flash block erase a single p-flash block. an erase of the full p-flash block is only possible when fpldis, fphdis and fpopen bits in the fprot register are set prior to launching the command. 0x0a erase p-flash sector erase all bytes in a p-flash sector. 0x0b unsecure flash supports a method of releasing mcu security by erasing all p-flash (and d-flash) blocks and verifying that all p-flash (and d-flash) blocks are erased. 0x0c verify backdoor access key supports a method of releasing mcu security by verifying a set of security keys. 0x0d set user margin level speci?s a user margin read level for all p-flash blocks. 0x0e set field margin level speci?s a ?ld margin read level for all p-flash blocks (special modes only). table 29-32. d-flash commands fcmd command function on d-flash memory 0x01 erase verify all blocks verify that all d-flash (and p-flash) blocks are erased. 0x02 erase verify block verify that the d-flash block is erased. chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1174 freescale semiconductor 29.4.2 flash command description this section provides details of all available flash commands launched by a command write sequence. the accerr bit in the fstat register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the memory controller: starting any command write sequence that programs or erases flash memory before initializing the fclkdiv register writing an invalid command as part of the command write sequence for additional possible errors, refer to the error handling table provided for each command if a flash block is read during execution of an algorithm (ccif = 0) on that same block, the read operation will return invalid data. if the sfdif or dfdif flags were not previously set when the invalid read operation occurred, both the sfdif and dfdif flags will be set and the feccr registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. if the accerr or fpviol bits are set in the fstat register, the user must clear these bits before starting any command write sequence (see section 29.3.2.7 ). 0x08 erase all blocks erase all d-flash (and p-flash) blocks. an erase of all flash blocks is only possible when the fpldis, fphdis, and fpopen bits in the fprot register and the epdis and epopen bits in the eprot register are set prior to launching the command. 0x0b unsecure flash supports a method of releasing mcu security by erasing all d-flash (and p-flash) blocks and verifying that all d-flash (and p-flash) blocks are erased. 0x0d set user margin level speci?s a user margin read level for the d-flash block. 0x0e set field margin level speci?s a ?ld margin read level for the d-flash block (special modes only). 0x0f full partition d- flash erase the d-flash block and partition an area of the d-flash block for user access. 0x10 erase verify d- flash section verify that a given number of words starting at the address provided are erased. 0x11 program d-flash program up to four words in the d-flash block. 0x12 erase d-flash sector erase all bytes in a sector of the d-flash block. 0x13 enable eeprom emulation enable eeprom emulation where writes to the buffer ram eee partition will be copied to the d-flash eee partition. 0x14 disable eeprom emulation suspend all current erase and program activity related to eeprom emulation but leave current eee tags set. 0x15 eeprom emulation query returns eee partition and status variables. 0x20 partition d-flash partition an area of the d-flash block for user access. table 29-32. d-flash commands fcmd command function on d-flash memory chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1175 caution a flash word or phrase must be in the erased state before being programmed. cumulative programming of bits within a flash word or phrase is not allowed. 29.4.2.1 erase verify all blocks command the erase verify all blocks command will verify that all p-flash and d-flash blocks have been erased. upon clearing ccif to launch the erase verify all blocks command, the memory controller will verify that the entire flash memory space is erased. the ccif ?g will set after the erase verify all blocks operation has completed. 29.4.2.2 erase verify block command the erase verify block command allows the user to verify that an entire p-flash or d-flash block has been erased. the fccob upper global address bits determine which block must be veri?d. upon clearing ccif to launch the erase verify block command, the memory controller will verify that the selected p-flash or d-flash block is erased. the ccif ?g will set after the erase verify block operation has completed. table 29-33. erase verify all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x01 not required table 29-34. erase verify all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 29-35. erase verify block command fccob requirements ccobix[2:0] fccob parameters 000 0x02 global address [22:16] of the flash block to be veri?d . chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1176 freescale semiconductor 29.4.2.3 erase verify p-flash section command the erase verify p-flash section command will verify that a section of code in the p-flash memory is erased. the erase verify p-flash section command defines the starting point of the code to be verified and the number of phrases. the section to be verified cannot cross a 256 kbyte boundary in the p-flash memory space. upon clearing ccif to launch the erase verify p-flash section command, the memory controller will verify the selected section of flash memory is erased. the ccif ?g will set after the erase verify p-flash section operation has completed. table 29-36. erase verify block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if an invalid global address [22:16] is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 29-37. erase verify p-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x03 global address [22:16] of a p-flash block 001 global address [15:0] of the ?st phrase to be veri?d 010 number of phrases to be veri?d table 29-38. erase verify p-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if the requested section crosses a 256 kbyte boundary fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1177 29.4.2.4 read once command the read once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of p-flash block 0. the read once field is programmed using the program once command described in section 29.4.2.7 . the read once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the read once command, a read once phrase is fetched and stored in the fccob indexed register. the ccif ?g will set after the read once operation has completed. valid phrase index values for the read once command range from 0x0000 to 0x0007. during execution of the read once command, any attempt to read addresses within p-flash block 0 will return invalid data. 128 29.4.2.5 load data field command the load data field command is executed to provide fccob parameters for multiple p-flash blocks for a future simultaneous program operation in the p-flash memory space. ferstat epviolif none table 29-39. read once command fccob requirements ccobix[2:0] fccob parameters 000 0x04 not required 001 read once phrase index (0x0000 - 0x0007) 010 read once word 0 value 011 read once word 1 value 100 read once word 2 value 101 read once word 3 value table 29-40. read once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid phrase index is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 29-38. erase verify p-flash section command error handling register error bit error condition chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1178 freescale semiconductor upon clearing ccif to launch the load data field command, the fccob registers will be transferred to the memory controller and be programmed in the block speci?d at the global address given with a future program p-flash command launched on a p-flash block. the ccif ?g will set after the load data field operation has completed. note that once a load data field command sequence has been initiated, the load data field command sequence will be cancelled if any command other than load data field or the future program p-flash is launched. similarly, if an error occurs after launching a load data field or program p-flash command, the associated load data field command sequence will be cancelled. 29.4.2.6 program p-flash command the program p-flash operation will program a previously erased phrase in the p-flash memory using an embedded algorithm. table 29-41. load data field command fccob requirements ccobix[2:0] fccob parameters 000 0x05 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 011 word 1 100 word 2 101 word 3 table 29-42. load data field command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 none mgstat0 none ferstat epviolif none chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1179 caution a p-flash phrase must be in the erased state before being programmed. cumulative programming of bits within a flash phrase is not allowed. upon clearing ccif to launch the program p-flash command, the memory controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. the ccif ?g will set after the program p-flash operation has completed. 29.4.2.7 program once command the program once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in p-flash block 0. the program once reserved field can be read using the read once command as described in section 29.4.2.4 . the program once command must only be issued once since the nonvolatile information register in p-flash block 0 cannot be erased. the program table 29-43. program p-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x06 global address [22:16] to identify p-flash block 001 global address [15:0] of phrase location to be programmed (1) 1. global address [2:0] must be 000 010 word 0 program value 011 word 1 program value 100 word 2 program value 101 word 3 program value table 29-44. program p-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:0] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) set if a load data field command sequence is currently active and the selected block has previously been selected in the same command sequence set if a load data field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence fpviol set if the global address [22:0] points to a protected area mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1180 freescale semiconductor once command must not be executed from the flash block containing the program once reserved field to avoid code runaway. upon clearing ccif to launch the program once command, the memory controller ?st veri?s that the selected phrase is erased. if erased, then the selected phrase will be programmed and then veri?d with read back. the ccif ?g will remain clear, setting only after the program once operation has completed. the reserved nonvolatile information register accessed by the program once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. valid phrase index values for the program once command range from 0x0000 to 0x0007. during execution of the program once command, any attempt to read addresses within p-flash block 0 will return invalid data. 29.4.2.8 erase all blocks command the erase all blocks operation will erase the entire p-flash and d-flash memory space including the eee nonvolatile information register. table 29-45. program once command fccob requirements ccobix[2:0] fccob parameters 000 0x07 not required 001 program once phrase index (0x0000 - 0x0007) 010 program once word 0 value 011 program once word 1 value 100 program once word 2 value 101 program once word 3 value table 29-46. program once command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid phrase index is supplied set if the requested phrase has already been programmed (1) 1. if a program once phrase is initially programmed to 0xffff_ffff_ffff_ffff, the program once command will be allowed to execute again on that same phrase. fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1181 upon clearing ccif to launch the erase all blocks command, the memory controller will erase the entire flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g will set after the erase all blocks operation has completed. 29.4.2.9 erase p-flash block command the erase p-flash block operation will erase all addresses in a p-flash block. upon clearing ccif to launch the erase p-flash block command, the memory controller will erase the selected p-flash block and verify that it is erased. the ccif ?g will set after the erase p-flash block operation has completed. table 29-47. erase all blocks command fccob requirements ccobix[2:0] fccob parameters 000 0x08 not required table 29-48. erase all blocks command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif set if any area of the buffer ram eee partition is protected table 29-49. erase p-flash block command fccob requirements ccobix[2:0] fccob parameters 000 0x09 global address [22:16] to identify p-flash block 001 global address [15:0] in p-flash block to be erased chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1182 freescale semiconductor 29.4.2.10 erase p-flash sector command the erase p-flash sector operation will erase all addresses in a p-flash sector. upon clearing ccif to launch the erase p-flash sector command, the memory controller will erase the selected flash sector and then verify that it is erased. the ccif ?g will be set after the erase p-flash sector operation has completed. table 29-50. erase p-flash block command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:16] is supplied fpviol set if an area of the selected p-flash block is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 29-51. erase p-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x0a global address [22:16] to identify p-flash block to be erased 001 global address [15:0] anywhere within the sector to be erased. refer to section 29.1.2.1 for the p-flash sector size. table 29-52. erase p-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:16] is supplied set if a misaligned phrase address is supplied (global address [2:0] != 000) fpviol set if the selected p-flash sector is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1183 29.4.2.11 unsecure flash command the unsecure flash command will erase the entire p-flash and d-flash memory space and, if the erase is successful, will release security. upon clearing ccif to launch the unsecure flash command, the memory controller will erase the entire p-flash and d-flash memory space and verify that it is erased. if the memory controller veri?s that the entire flash memory space was properly erased, security will be released. if the erase verify is not successful, the unsecure flash operation sets mgstat1 and terminates without changing the security state. during the execution of this command (ccif=0) the user must not write to any flash module register. the ccif ?g is set after the unsecure flash operation has completed. 29.4.2.12 verify backdoor access key command the verify backdoor access key command will only execute if it is enabled by the keyen bits in the fsec register (see table 29-11 ). the verify backdoor access key command releases security if user- supplied keys match those stored in the flash security bytes of the flash configuration field (see table 29- 3 ). the verify backdoor access key command must not be executed from the flash block containing the backdoor comparison key to avoid code runaway. table 29-53. unsecure flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0b not required table 29-54. unsecure flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) fpviol set if any area of the p-flash memory is protected mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif set if any area of the buffer ram eee partition is protected table 29-55. verify backdoor access key command fccob requirements ccobix[2:0] fccob parameters 000 0x0c not required 001 key 0 010 key 1 011 key 2 100 key 3 chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1184 freescale semiconductor upon clearing ccif to launch the verify backdoor access key command, the memory controller will check the fsec keyen bits to verify that this command is enabled. if not enabled, the memory controller sets the accerr bit in the fstat register and terminates. if the command is enabled, the memory controller compares the key provided in fccob to the backdoor comparison key in the flash con?uration ?ld with key 0 compared to 0x7f_ff00, etc. if the backdoor keys match, security will be released. if the backdoor keys do not match, security is not released and all future attempts to execute the verify backdoor access key command are aborted (set accerr) until a reset occurs. the ccif flag is set after the verify backdoor access key operation has completed. 29.4.2.13 set user margin level command the set user margin level command causes the memory controller to set the margin level for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set user margin level command, the memory controller will set the user margin level for the targeted block and then set the ccif ?g. valid margin level settings for the set user margin level command are de?ed in table 29-58 . table 29-56. verify backdoor access key command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 100 at command launch set if a load data field command sequence is currently active set if an incorrect backdoor key is supplied set if backdoor key access has not been enabled (keyen[1:0] != 10, see section 29.3.2.2 ) set if the backdoor key has mismatched since the last reset fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 29-57. set user margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0d global address [22:16] to identify the flash block 001 margin level setting table 29-58. valid set user margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1185 note user margin levels can be used to check that flash memory contents have adequate margin for normal level read operations. if unexpected results are encountered when checking flash memory contents at user margin levels, a potential loss of information has been detected. 29.4.2.14 set field margin level command the set field margin level command, valid in special modes only, causes the memory controller to set the margin level specified for future read operations of a specific p-flash or d-flash block. upon clearing ccif to launch the set field margin level command, the memory controller will set the ?ld margin level for the targeted block and then set the ccif ?g. 0x0002 user margin-0 level (2) 1. read margin to the erased state 2. read margin to the programmed state table 29-59. set user margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:16] is supplied set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 29-60. set field margin level command fccob requirements ccobix[2:0] fccob parameters 000 0x0e global address [22:16] to identify the flash block 001 margin level setting table 29-58. valid set user margin level settings ccob (ccobix=001) level description chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1186 freescale semiconductor valid margin level settings for the set field margin level command are de?ed in table 29-61 . caution field margin levels must only be used during verify of the initial factory programming. note field margin levels can be used to check that flash memory contents have adequate margin for data retention at the normal level setting. if unexpected results are encountered when checking flash memory contents at ?ld margin levels, the flash memory contents should be erased and reprogrammed. 29.4.2.15 full partition d-flash command the full partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. table 29-61. valid set field margin level settings ccob (ccobix=001) level description 0x0000 return to normal level 0x0001 user margin-1 level (1) 1. read margin to the erased state 0x0002 user margin-0 level (2) 2. read margin to the programmed state 0x0003 field margin-1 level 1 0x0004 field margin-0 level 2 table 29-62. set field margin level command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:16] is supplied set if an invalid margin level setting is supplied fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1187 upon clearing ccif to launch the full partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 29-7 ) program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 29-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 29-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 29-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the full partition d-flash operation has completed, the ccif ?g will set. running the full partition d-flash command a second time will result in the previous partition values and the entire d-flash memory being erased. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 29-63. full partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x0f not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1188 freescale semiconductor 29.4.2.16 erase verify d-flash section command the erase verify d-flash section command will verify that a section of code in the d-flash user partition is erased. the erase verify d-flash section command defines the starting point of the data to be verified and the number of words. upon clearing ccif to launch the erase verify d-flash section command, the memory controller will verify the selected section of d-flash memory is erased. the ccif ?g will set after the erase verify d- flash section operation has completed. table 29-64. full partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 29-65. erase verify d-flash section command fccob requirements ccobix[2:0] fccob parameters 000 0x10 global address [22:16] to identify the d-flash block 001 global address [15:0] of the ?st word to be veri?d 010 number of words to be veri?d chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1189 29.4.2.17 program d-flash command the program d-flash operation programs one to four previously erased words in the d-flash user partition. the program d-flash operation will confirm that the targeted location(s) were successfully programmed upon completion. caution a flash word must be in the erased state before being programmed. cumulative programming of bits within a flash word is not allowed. upon clearing ccif to launch the program d-flash command, the user-supplied words will be transferred to the memory controller and be programmed. the ccobix index value at program d-flash command launch determines how many words will be programmed in the d-flash block. no protection checks are made in the program d-flash operation on the d-flash block, only access error checks. the ccif ?g is set when the operation has completed. table 29-66. erase verify d-flash section command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area of the d-flash eee partition set if the requested section breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none table 29-67. program d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x11 global address [22:16] to identify the d-flash block 001 global address [15:0] of word to be programmed 010 word 0 program value 011 word 1 program value, if desired 100 word 2 program value, if desired 101 word 3 program value, if desired chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1190 freescale semiconductor 29.4.2.18 erase d-flash sector command the erase d-flash sector operation will erase all addresses in a sector of the d-flash user partition. upon clearing ccif to launch the erase d-flash sector command, the memory controller will erase the selected flash sector and verify that it is erased. the ccif ?g will set after the erase d-flash sector operation has completed. table 29-68. program d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] < 010 at command launch set if ccobix[2:0] > 101 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to an area in the d-flash eee partition set if the requested group of words breaches the end of the d-flash block or goes into the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 29-69. erase d-flash sector command fccob requirements ccobix[2:0] fccob parameters 000 0x12 global address [22:16] to identify d-flash block 001 global address [15:0] anywhere within the sector to be erased. see section 29.1.2.2 for d-flash sector size. chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1191 29.4.2.19 enable eeprom emulation command the enable eeprom emulation command causes the memory controller to enable eee activity. eee activity is disabled after any reset. upon clearing ccif to launch the enable eeprom emulation command, the ccif ?g will set after the memory controller enables eee operations using the contents of the eee tag ram and tag counter. the full partition d-flash or the partition d-flash command must be run prior to launching the enable eeprom emulation command. table 29-70. erase d-flash sector command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 001 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if an invalid global address [22:0] is supplied set if a misaligned word address is supplied (global address [0] != 0) set if the global address [22:0] points to the d-flash eee partition fpviol none mgstat1 set if any errors have been encountered during the verify operation mgstat0 set if any non-correctable errors have been encountered during the verify operation ferstat epviolif none table 29-71. enable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x13 not required table 29-72. enable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1192 freescale semiconductor 29.4.2.20 disable eeprom emulation command the disable eeprom emulation command causes the memory controller to suspend current eee activity. upon clearing ccif to launch the disable eeprom emulation command, the memory controller will halt eee operations at the next convenient point without clearing the eee tag ram or tag counter before setting the ccif ?g. 29.4.2.21 eeprom emulation query command the eeprom emulation query command returns eee partition and status variables. upon clearing ccif to launch the eeprom emulation query command, the ccif ?g will set after the eee partition and status variables are stored in the fccobix register.if the emulation query command is executed prior to partitioning (partition d-flash command section 29.4.2.15 ), the following reset values are returned: dfpart = 0x_ffff, erpart = 0x_ffff, ecount = 0x_ffff, dead sector count = 0x_00, ready sector count = 0x_00. table 29-73. disable eeprom emulation command fccob requirements ccobix[2:0] fccob parameters 000 0x14 not required table 29-74. disable eeprom emulation command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if full partition d-flash or partition d-flash command not previously run fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 29-75. eeprom emulation query command fccob requirements ccobix[2:0] fccob parameters 000 0x15 not required 001 return dfpart 010 return erpart 011 return ecount (1) 1. indicates sector erase count 100 return dead sector count return ready sector count chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1193 29.4.2.22 partition d-flash command the partition d-flash command allows the user to allocate sectors within the d-flash block for applications and a partition within the buffer ram for eeprom access. the d-flash block consists of 128 sectors with 256 bytes per sector. the erase all blocks command must be run prior to launching the partition d-flash command. upon clearing ccif to launch the partition d-flash command, the following actions are taken to de?e a partition within the d-flash block for direct access (dfpart) and a partition within the buffer ram for eee use (erpart): validate the dfpart and erpart values provided: dfpart <= 128 (maximum number of 256 byte sectors in d-flash block) erpart <= 16 (maximum number of 256 byte sectors in buffer ram) if erpart > 0, 128 - dfpart >= 12 (minimum number of 256 byte sectors in the d-flash block required to support eee) if erpart > 0, ((128-dfpart)/erpart) >= 8 (minimum ratio of d-flash eee space to buffer ram eee space to support eee) erase verify the d-flash block and the eee nonvolatile information register program dfpart to the eee nonvolatile information register at global address 0x12_0000 (see table 29-7 ) table 29-76. eeprom emulation query command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 000 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) fpviol none mgstat1 none mgstat0 none ferstat epviolif none table 29-77. partition d-flash command fccob requirements ccobix[2:0] fccob parameters 000 0x20 not required 001 number of 256 byte sectors for the d-flash user partition (dfpart) 010 number of 256 byte sectors for buffer ram eee partition (erpart) chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1194 freescale semiconductor program a duplicate dfpart to the eee nonvolatile information register at global address 0x12_0002 (see table 29-7 ) program erpart to the eee nonvolatile information register at global address 0x12_0004 (see table 29-7 ) program a duplicate erpart to the eee nonvolatile information register at global address 0x12_0006 (see table 29-7 ) the d-flash user partition will start at global address 0x10_0000. the buffer ram eee partition will end at global address 0x13_ffff. after the partition d-flash operation has completed, the ccif ?g will set. running the partition d-flash command a second time will result in the accerr bit within the fstat register being set. the data value written corresponds to the number of 256 byte sectors allocated for either direct d-flash access (dfpart) or buffer ram eee access (erpart). table 29-78. partition d-flash command error handling register error bit error condition fstat accerr set if ccobix[2:0] != 010 at command launch set if a load data field command sequence is currently active set if command not available in current mode (see table 29-30 ) set if partitions have already been de?ed set if an invalid dfpart or erpart selection is supplied fpviol none mgstat1 set if any errors have been encountered during the read mgstat0 set if any non-correctable errors have been encountered during the read ferstat epviolif none chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1195 29.4.3 interrupts the flash module can generate an interrupt when a flash command operation has completed or when a flash command operation has detected an eee error or an ecc fault. note vector addresses and their relative interrupt priority are determined at the mcu level. 29.4.3.1 description of flash interrupt operation the flash module uses the ccif ?g in combination with the ccie interrupt enable bit to generate the flash command interrupt request. the flash module uses the erseif, pgmeif, epviolif, ersvif1, ersvif0, dfdif and sfdif ?gs in combination with the erseie, pgmeie, epviolie, ersvie1, ersvie0, dfdie and sfdie interrupt enable bits to generate the flash error interrupt request. for a detailed description of the register bits involved, refer to section 29.3.2.5, ?lash configuration register (fcnfg) ? section 29.3.2.6, ?lash error configuration register (fercnfg) ? section 29.3.2.7, ?lash status register (fstat) ? and section 29.3.2.8, ?lash error status register (ferstat) ? the logic used for generating the flash module interrupts is shown in figure 29-27 . table 29-79. flash interrupt sources interrupt source interrupt flag local enable global (ccr) mask flash command complete ccif (fstat register) ccie (fcnfg register) i bit flash eee erase error erserif (ferstat register) erserie (fercnfg register) i bit flash eee program error pgmerif (ferstat register) pgmerie (fercnfg register) i bit flash eee protection violation epviolif (ferstat register) epviolie (fercnfg register) i bit flash eee error type 1 violation ersvif1 (ferstat register) ersvie1 (fercnfg register) i bit flash eee error type 0 violation ersvif0 (ferstat register) ersvie0 (fercnfg register) i bit ecc double bit fault on flash read dfdif (ferstat register) dfdie (fercnfg register) i bit ecc single bit fault on flash read sfdif (ferstat register) sfdie (fercnfg register) i bit chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1196 freescale semiconductor figure 29-27. flash module interrupts implementation 29.4.4 wait mode the flash module is not affected if the mcu enters wait mode. the flash module can recover the mcu from wait via the ccif interrupt (see section 29.4.3, ?nterrupts ). 29.4.5 stop mode if a flash command is active (ccif = 0) or an ee-emulation operation is pending when the mcu requests stop mode, the current flash operation will be completed before the cpu is allowed to enter stop mode. 29.5 security the flash module provides security information to the mcu. the flash security state is de?ed by the sec bits of the fsec register (see table 29-12 ). during reset, the flash module initializes the fsec register using data read from the security byte of the flash con?uration ?ld at global address 0x7f_ff0f. flash error interrupt request ccif ccie epviolif epviolie ersvif1 ersvie1 ersvif0 ersvie0 pgmerif pgmerie erserif erserie flash command interrupt request dfdif dfdie sfdif sfdie chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 freescale semiconductor 1197 the security state out of reset can be permanently changed by programming the security byte of the flash con?uration ?ld. this assumes that you are starting from a mode where the necessary p-flash erase and program commands are available and that the upper region of the p-flash is unprotected. if the flash security byte is successfully programmed, its new value will take affect after the next mcu reset. the following subsections describe these security-related subjects: unsecuring the mcu using backdoor key access unsecuring the mcu in special single chip mode using bdm mode and security effects on flash command availability 29.5.1 unsecuring the mcu using backdoor key access the mcu may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7f_ff00?x7f_ff07). if the keyen[1:0] bits are in the enabled state (see section 29.3.2.2 ), the verify backdoor access key command (see section 29.4.2.12 ) allows the user to present four prospective keys for comparison to the keys stored in the flash memory via the memory controller. if the keys presented in the verify backdoor access key command match the backdoor keys stored in the flash memory, the sec bits in the fsec register (see table 29-12 ) will be changed to unsecure the mcu. key values of 0x0000 and 0xffff are not permitted as backdoor keys. while the verify backdoor access key command is active, p-flash block 0 will not be available for read access and will return invalid data. the user code stored in the p-flash memory must have a method of receiving the backdoor keys from an external stimulus. this external stimulus would typically be through one of the on-chip serial ports. if the keyen[1:0] bits are in the enabled state (see section 29.3.2.2 ), the mcu can be unsecured by the backdoor key access sequence described below: 1. follow the command sequence for the verify backdoor access key command as explained in section 29.4.2.12 2. if the verify backdoor access key command is successful, the mcu is unsecured and the sec[1:0] bits in the fsec register are forced to the unsecure state of 10 the verify backdoor access key command is monitored by the memory controller and an illegal key will prohibit future use of the verify backdoor access key command. a reset of the mcu is the only method to re-enable the verify backdoor access key command. after the backdoor keys have been correctly matched, the mcu will be unsecured. after the mcu is unsecured, the sector containing the flash security byte can be erased and the flash security byte can be reprogrammed to the unsecure state, if desired. in the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7f_ff00?x7f_ff07 in the flash con?uration ?ld. the security as de?ed in the flash security byte (0x7f_ff0f) is not changed by using the verify backdoor access key command sequence. the backdoor keys stored in addresses 0x7f_ff00?x7f_ff07 are unaffected by the verify backdoor access key command sequence. after the next reset of the mcu, the security state of the flash module is determined by the flash security byte chapter 29 1024 kbyte flash module (s12xftm1024k5v2) mc9s12xe-family reference manual , rev. 1.21 1198 freescale semiconductor (0x7f_ff0f). the verify backdoor access key command sequence has no effect on the program and erase protections de?ed in the flash protection register, fprot. 29.5.2 unsecuring the mcu in special single chip mode using bdm the mcu can be unsecured in special single chip mode by erasing the p-flash and d-flash memory by one of the following methods: reset the mcu into special single chip mode, delay while the erase test is performed by the bdm, send bdm commands to disable protection in the p-flash and d-flash memory, and execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. reset the mcu into special expanded wide mode, disable protection in the p-flash and d-flash memory and run code from external memory to execute the erase all blocks command write sequence to erase the p-flash and d-flash memory. after the ccif ?g sets to indicate that the erase all blocks operation has completed, reset the mcu into special single chip mode. the bdm will execute the erase verify all blocks command write sequence to verify that the p-flash and d-flash memory is erased. if the p-flash and d-flash memory are verified as erased the mcu will be unsecured. all bdm commands will be enabled and the flash security byte may be programmed to the unsecure state by the following method: send bdm commands to execute a ?rogram p-flash?command sequence to program the flash security byte to the unsecured state and reset the mcu. 29.5.3 mode and security effects on flash command availability the availability of flash module commands depends on the mcu operating mode and security state as shown in table 29-30 . 29.6 initialization on each system reset the flash module executes a reset sequence which establishes initial values for the flash block configuration parameters, the fprot and dfprot protection registers, and the fopt and fsec registers. the flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. if a double bit fault is detected during the reset sequence, both mgstat bits in the fstat register will be set. the accerr bit in the fstat register is set if errors are encountered while initializing the eee buffer ram during the reset sequence. ccif remains clear throughout the reset sequence. the flash module holds off all cpu access for the initial portion of the reset sequence. while flash reads are possible when the hold is removed, writes to the fccobix, fccobhi, and fccoblo registers are ignored to prevent command activity while the memory controller remains busy. completion of the reset sequence is marked by setting ccif high which enables writes to the fccobix, fccobhi, and fccoblo registers to launch any available flash command. if a reset occurs while any flash command is in progress, that command will be immediately aborted. the state of the word being programmed or the sector/block being erased is not guaranteed. appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1199 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix a electrical characteristics a.1 general note the electrical characteristics given in this section should be used as a guide only. values cannot be guaranteed by freescale and are subject to change without notice. this supplement contains the most accurate electrical information for the mc9s12xe-family microcontroller available at the time of publication. this introduction is intended to give an overview on several common topics like power supply, current injection etc. a.1.1 parameter classi?ation the electrical parameters shown in this supplement are guaranteed by various methods. to give the customer a better understanding the following classi?ation is used and the parameters are tagged accordingly in the tables where appropriate. note this classi?ation is shown in the column labeled ??in the parameter tables where appropriate. p: those parameters are guaranteed during production testing on each individual device. c: those parameters are achieved by the design characterization by measuring a statistically relevant sample size across process variations. t: those parameters are achieved by design characterization on a small sample size from typical devices under typical conditions unless otherwise noted. all values shown in the typical column are within this category. d: those parameters are derived mainly from simulations. a.1.2 power supply the mc9s12xe-family utilizes several pins to supply power to the i/o ports, a/d converter, oscillator, and pll as well as the digital core. the vdda, vssa pin pairs supply the a/d converter and parts of the internal voltage regulator. the vddx, vssx pin pairs [7:1] supply the i/o pins. vddr supplies the internal voltage regulator. appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1200 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 note connecting vddr to vss disables the internal voltage regulator. the vddf , vss1 pin pair supplies the internal nvm logic. the vdd, vss2 are the supply pins for the internal digital logic. vddpll, vsspll pin pair supply the oscillator and the pll. vss1, vss2 and vss3 are internally connected by metal. vdda1, and vdda2 are internally connected by metal. all vddx pins are internally connected by metal. all vssx pins are internally connected by metal. vdda is connected to all vddx pins by diodes for esd protection such that vddx must not exceed vdda by more than a diode voltage drop. vdda can exceed vddx by more than a diode drop in order to support applications with a 5v a/d converter range and 3.3v i/o pin range. vssa and vssx are connected by anti-parallel diodes for esd protection. note in the following context v dd35 is used for either vdda, vddr, and vddx; v ss35 is used for either vssa and vssx unless otherwise noted. i dd35 denotes the sum of the currents ?wing into the vdda and vddr pins. the run mode current in the vddx domain is external load dependent. v dd is used for vdd, v ss is used for vss1, vss2 and vss3. v ddpll is used for vddpll, v sspll is used for vsspll i dd is used for the sum of the currents ?wing into vdd, vddf and vddpll. a.1.3 pins there are four groups of functional pins. a.1.3.1 i/o pins standard i/o pins have a level in the range of 3.13v to 5.5 v. this class of pins is comprised of all port i/o pins (including portad), bkgd and the reset pins.the internal structure of all those pins is identical; however, some of the functionality may be disabled. for example the bkgd pin pull up is always enabled. a.1.3.2 analog reference this group is made up by the v rh and v rl pins. appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1201 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.1.3.3 oscillator the pins extal, xtal dedicated to the oscillator have a nominal 1.8 v level. they are supplied by vddpll. a.1.3.4 test this pin is used for production testing only. a.1.4 current injection power supply must maintain regulation within operating v dd35 or v dd range during instantaneous and operating maximum current conditions. if positive injection current (v in > v dd35 ) is greater than i dd35 , the injection current may ?w out of v dd35 and could result in external power supply going out of regulation. ensure external v dd35 load will shunt current greater than maximum injection current. this will be the greatest risk when the mcu is not consuming power; e.g., if no system clock is present, or if clock rate is very low which would reduce overall power consumption. a.1.5 absolute maximum ratings absolute maximum ratings are stress ratings only. a functional operation under or outside those maxima is not guaranteed. stress beyond those limits may affect the reliability or cause permanent damage of the device. this device contains circuitry protecting against damage due to high static voltage or electrical ?lds; however, it is advised that normal precautions be taken to avoid application of any voltages higher than appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1202 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 maximum-rated voltages to this high-impedance circuit. reliability of operation is enhanced if unused inputs are tied to an appropriate logic voltage level (e.g., either v ss35 or v dd35 ). a.1.6 esd protection and latch-up immunity all esd testing is in conformity with cdf-aec-q100 stress test quali?ation for automotive grade integrated circuits. during the device quali?ation esd stresses were performed for the human body model (hbm) and the charge device model. a device will be de?ed as a failure if after exposure to esd pulses the device no longer meets the device speci?ation. complete dc parametric and functional testing is performed per the applicable device table a-1. absolute maximum ratings 1 1 beyond absolute maximum ratings device might be damaged. num rating symbol min max unit 1 i/o, regulator and analog supply voltage v dd35 ?.3 6.0 v 2 digital logic supply voltage 2 2 the device contains an internal voltage regulator to generate the logic and pll supply out of the i/o supply. the absolute maximum ratings apply when the device is powered from an external source. v dd ?.3 2.16 v 3 pll supply voltage 2 v ddpll ?.3 2.16 v 4 nvm supply voltage 2 v ddf ?.3 3.6 v 5 voltage difference v ddx to v dda ? vddx ?.0 0.3 v 6 voltage difference v ssx to v ssa ? vssx ?.3 0.3 v 7 digital i/o input voltage v in ?.3 6.0 v 8 analog reference v rh, v rl ?.3 6.0 v 9 extal, xtal v ilv ?.3 2.16 v 10 test input v test ?.3 10.0 v 11 instantaneous maximum current single pin limit for all digital i/o pins 3 3 all digital i/o pins are internally clamped to v ssx and v ddx , or v ssa and v dda . i d ?5 +25 ma 12 instantaneous maximum current single pin limit for extal, xtal 4 4 those pins are internally clamped to v sspll and v ddpll . i dl ?5 +25 ma 13 instantaneous maximum current single pin limit for test 5 5 this pin is clamped low to v sspll , but not clamped high. this pin must be tied low in applications. i dt ?.25 0 ma 14 maximum current single pin limit for power supply pins i dv ?00 +100 ma 15 storage temperature range t stg ?5 155 c appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1203 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 speci?ation at room temperature followed by hot temperature, unless speci?d otherwise in the device speci?ation. table a-2. esd and latch-up test conditions model description symbol value unit human body series resistance r1 1500 ohm storage capacitance c 100 pf number of pulse per pin positive negative 1 1 charged device number of pulse per pin positive negative 3 3 latch-up minimum input voltage limit ?.5 v maximum input voltage limit 7.5 v table a-3. esd and latch-up protection characteristics num c rating symbol min max unit 1 c human body model (hbm) v hbm 2000 v 2 c charge device model (cdm) corner pins charge device model (cdm) edge pins v cdm 750 500 v 3 c latch-up current at t a = 125 c positive negative i lat +100 ?00 ma 4 c latch-up current at t a = 27 c positive negative i lat +200 ?00 ma appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1204 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.1.7 operating conditions this section describes the operating conditions of the device. unless otherwise noted those conditions apply to all the following data. note please refer to the temperature rating of the device (c, v, m) with regards to the ambient temperature t a and the junction temperature t j . for power dissipation calculations refer to section a.1.8, ?ower dissipation and thermal characteristics . note using the internal voltage regulator, operation is guaranteed in a power down until a low voltage reset assertion. table a-4. operating conditions rating symbol min typ max unit i/o, regulator and analog supply voltage v dd35 3.13 5 5.5 v nvm logic supply voltage 1 1 the device contains an internal voltage regulator to generate the logic and pll supply out of the i/o supply. . v ddf 2.7 2.8 2.9 v voltage difference v ddx to v dda ? vddx refer to table a-15 voltage difference v ddr to v ddx ? vddr ?.1 0 0.1 v voltage difference v ssx to v ssa ? vssx refer to table a-15 voltage difference v ss1 , v ss2 , v ss3 , v sspll to v ssx ? vss ?.1 0 0.1 v digital logic supply voltage 1 v dd 1.72 1.8 1.98 v pll supply voltage v ddpll 1.72 1.8 1.98 v oscillator 2 (loop controlled pierce) (full swing pierce) 2 this refers to the oscillator base frequency. typical crystal & resonator tolerances are supported. f osc 4 2 16 40 mhz bus frequency 3 3 please refer to table a-25 for maximum bus frequency limits with frequency modulation enabled f bus 0.5 50 mhz c operating junction temperature range operating ambient temperature range 4 4 please refer to section a.1.8, ?ower dissipation and thermal characteristics for more details about the relation between ambient temperature t a and device junction temperature t j . t j t a ?0 ?0 27 110 85 c v operating junction temperature range operating ambient temperature range 2 t j t a ?0 ?0 27 130 105 c m operating junction temperature range operating ambient temperature range 2 t j t a ?0 ?0 27 150 125 c appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1205 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.1.8 power dissipation and thermal characteristics power dissipation and thermal characteristics are closely related. the user must assure that the maximum operating junction temperature is not exceeded. the average chip-junction temperature (t j ) in c can be obtained from: the total power dissipation can be calculated from: p io is the sum of all output currents on i/o ports associated with v ddx , whereby two cases with internal voltage regulator enabled and disabled must be considered: 1. internal voltage regulator disabled 2. internal voltage regulator enabled t j t a p d ja ? () + = t j junction temperature, [ c ] = t a ambient temperature, [ c ] = p d total chip power dissipation, [w] = ja package thermal resistance, [ c/w] = p d p int p io + = p int chip internal power dissipation, [w] = p io r dson i i io i 2 ? = r dson v ol i ol ------------ for outputs driven low ; = r dson v dd35 v oh i oh --------------------------------------- for outputs driven high ; = p int i dd v dd ? i ddpll v ddpll ? i dda +v dda ? + = p int i ddr v ddr ? i dda v dda ? + = appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1206 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-5. thermal package characteristics (9s12xep100) 1 1 the values for thermal resistance are achieved by package simulations for the 9s12xep100 die. num c rating symbol min typ max unit 208mapbga 1 d thermal resistance 208mapbga, single sided pcb 2 ja 53 c/w 2 d thermal resistance208mapbga, double sided pcb with 2 internal planes 3 ja 31 c/w 3 d junction to board 208mapbga 2 2 measured per jedec jesd51-8. measured on top surface of the board near the package. jb 20 c/w 4 d junction to case 208mapbga 4 jc 9 c/w 5 d junction to package top 208mapbga 5 jt 2 c/w lqfp144 6 d thermal resistance lqfp144, single sided pcb 3 ja 41 c/w 7 d thermal resistance lqfp144, double sided pcb with 2 internal planes 3 ja 32 c/w 8 d junction to board lqfp 144 jb 22 c/w 9 d junction to case lqfp 144 4 jc 7.4 c/w 10 d junction to package top lqfp144 5 jt 3 c/w lqfp112 11 d thermal resistance lqfp112, single sided pcb 3 3 junction to ambient thermal resistance, ja was simulated to be equivalent to the jedec speci?ation jesd51-2 in a horizontal con?uration in natural convection. ja 43 c/w 12 d thermal resistance lqfp112, double sided pcb with 2 internal planes 4 4 junction to ambient thermal resistance, ja was simulated to be equivalent to the jedec speci?ation jesd51-7 in a horizontal con?uration in natural convection. ja 32 c/w 13 d junction to board lqfp112 jb 22 c/w 14 d junction to case lqfp112 4 jc 7 c/w 15 d junction to package top lqfp112 5 jt 3 c/w qfp80 16 d thermal resistance qfp 80, single sided pcb 3 ja 45 c/w 17 d thermal resistance qfp 80, double sided pcb with 2 internal planes 3 ja 33 c/w 18 d junction to board qfp 80 jb 19 c/w 19 d junction to case qfp 80 5 5 junction to case thermal resistance was simulated to be equivalent to the measured values using the cold plate technique with the cold plate temperature used as the ?ase?temperature. this basic cold plate measurement technique is described by mil-std 883d, method 1012.1. this is the correct thermal metric to use to calculate thermal performance when the package is being used with a heat sink. jc 11 c/w 20 d junction to package top qfp 80 6 6 thermal characterization parameter jt is the ?esistance from junction to reference point thermocouple on top center of the case as de?ed in jesd51-2. jt is a useful value to use to estimate junction temperature in a steady state customer enviroment. jt 3 c/w appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1207 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-6. thermal package characteristics (9s12xeq512) 1 1 the values for thermal resistance are achieved by package simulations for the 9s12xeq512 die. num c rating symbol min typ max unit lqfp144 1a d thermal resistance single sided pcb, natural convection ja 49 c/w 1b d thermal resistance single sided pcb @ 200 ft/min ja 40 c/w 2a d thermal resistance double sided pcb with 2 internal planes, natural convection ja 40 c/w 2b d thermal resistance double sided pcb with 2 internal planes @ 200 ft/min ja 34 c/w 3 d junction to board lqfp 144 jb 28 c/w 4 d junction to case lqfp 144 2 jc 9 c/w 5 d junction to package top lqfp144 3 jt 2 c/w lqfp112 6a d thermal resistance single sided pcb, natural convection ja 50 c/w 6b d thermal resistance single sided pcb @ 200 ft/min ja 40 c/w 7a d thermal resistance double sided pcb with 2 internal planes, natural convection ja 40 c/w 7b d thermal resistance double sided pcb with 2 internal planes @ 200 ft/min ja 34 c/w 8 d junction to board lqfp112 jb 28 c/w 9 d junction to case lqfp112 2 jc 9 c/w 10 d junction to package top lqfp112 3 jt 2 c/w qfp80 11a d thermal resistance single sided pcb, natural convection ja 50 c/w 11b d thermal resistance single sided pcb @ 200 ft/min ja 40 c/w 12a d thermal resistance double sided pcb with 2 internal planes, natural convection ja 37 c/w 12b d thermal resistance double sided pcb with 2 internal planes @ 200 ft/min ja 31 c/w 13 d junction to board qfp 80 jb 23 c/w 14 d junction to case qfp 80 2 2 junction to case thermal resistance was simulated to be equivalent to the measured values using the cold plate technique with the cold plate temperature used as the ?ase?temperature. this basic cold plate measurement technique is described by mil-std 883d, method 1012.1. this is the correct thermal metric to use to calculate thermal performance when the package is being used with a heat sink. jc 13 c/w 15 d junction to package top qfp 80 3 3 thermal characterization parameter jt is the ?esistance from junction to reference point thermocouple on top center of the case as de?ed in jesd51-2. jt is a useful value to use to estimate junction temperature in a steady state customer enviroment. jt 3 c/w appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1208 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.1.9 i/o characteristics this section describes the characteristics of all i/o pins except extal, xtal, test and supply pins. s table a-7. 3.3-v i/o characteristics conditions are 3.13 v < v dd35 < 3.6 v temperature from ?0 c to +150 c, unless otherwise noted i/o characteristics for all i/o pins except extal, xtal,test and supply pins. num c rating symbol min typ max unit 1 p input high voltage v ih 0.65*v dd35 v t input high voltage v ih v dd35 + 0.3 v 2 p input low voltage v il 0.35*v dd35 v t input low voltage v il v ss35 ?0.3 v 3 t input hysteresis v hys 250 mv 4a p input leakage current (pins in high impedance input mode) 1 v in = v dd35 or v ss35 m temperature range -40 c to 150 c v temperature range -40 c to 130 c c temperature range -40 c to 110 c i in ? ?.75 ?.5 1 0.75 0.5 a 4b c input leakage current (pins in high impedance input mode) v in = v dd35 or v ss35 -40 c 27 c 70 c 85 c 100 c 105 c 110 c 120 c 125 c 130 c 150 c i in 1 1 8 14 26 32 40 60 74 92 240 ?a 5 c output high voltage (pins in output mode) partial drive i oh = ?.75 ma v oh v dd35 ?0.4 v 6 p output high voltage (pins in output mode) full drive i oh = ? ma v oh v dd35 ?0.4 v 7 c output low voltage (pins in output mode) partial drive i ol = +0.9 ma v ol 0.4 v 8 p output low voltage (pins in output mode) full drive i ol = +4.75 ma v ol 0.4 v 9 p internal pull up resistance v ih min > input voltage > v il max r pul 25 50 k ? 10 p internal pull down resistance v ih min > input voltage > v il max r pdh 25 50 k ? 11 d input capacitance c in ? ?f 12 t injection current 2 single pin limit total device limit, sum of all injected currents i ics i icp ?.5 ?5 2.5 25 ma appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1209 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 13 d port h, j, p interrupt input pulse ?tered (stop) 3 t pulse 3 s 14 d port h, j, p interrupt input pulse passed(stop) 3 t pulse 10 s 15 d port h, j, p interrupt input pulse ?tered ( st op) t pulse 3 tcyc 16 d port h, j, p interrupt input pulse passed( st op) t pulse 4 tcyc 17 d irq pulse width, edge-sensitive mode ( st op) pw irq 1 tcyc 18 d xirq pulse width with x-bit set (stop) pw xirq 4 tosc 1 maximum leakage current occurs at maximum operating temperature. 2 refer to section a.1.4, ?urrent injection for more details 3 parameter only applies in stop or pseudo stop mode. table a-7. 3.3-v i/o characteristics conditions are 3.13 v < v dd35 < 3.6 v temperature from ?0 c to +150 c, unless otherwise noted i/o characteristics for all i/o pins except extal, xtal,test and supply pins. appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1210 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-8. 5v i/o characteristics conditions are 4.5 v < v dd35 < 5.5 v temperature from ?0 c to +150 c, unless otherwise noted i/o characteristics for all i/o pins except extal, xtal,test and supply pins. num c rating symbol min typ max unit 1 p input high voltage v ih 0.65*v dd35 v t input high voltage v ih v dd35 + 0.3 v 2 p input low voltage v il 0.35*v dd35 v t input low voltage v il v ss35 ?0.3 v 3 t input hysteresis v hys 250 mv 4a p input leakage current (pins in high impedance input mode) 1 v in = v dd35 or v ss35 m temperature range -40 c to 150 c v temperature range -40 c to 130 c c temperature range -40 c to 110 c i in ? ?.75 ?.5 1 0.75 0.5 a 4b c input leakage current (pins in high impedance input mode) v in = v dd35 or v ss35 -40 c 27 c 70 c 85 c 100 c 105 c 110 c 120 c 125 c 130 c 150 c i in 1 1 8 14 26 32 40 60 74 92 240 ?a 5 c output high voltage (pins in output mode) partial drive i oh = ? ma v oh v dd35 ?0.8 v 6 p output high voltage (pins in output mode) full drive i oh = ?0 ma v oh v dd35 ?0.8 v 7 c output low voltage (pins in output mode) partial drive i ol = +2 ma v ol 0.8 v 8 p output low voltage (pins in output mode) full drive i ol = +10 ma v ol 0.8 v 9 p internal pull up resistance v ih min > input voltage > v il max r pul 25 50 k ? 10 p internal pull down resistance v ih min > input voltage > v il max r pdh 25 50 k ? 11 d input capacitance c in ? ?f 12 t injection current 2 single pin limit total device limit, sum of all injected currents i ics i icp ?.5 ?5 2.5 25 ma 13 p port h, j, p interrupt input pulse ?tered(stop) 3 t pulse 3 s 14 p port h, j, p interrupt input pulse passed(stop) 3 t pulse 10 s 15 d port h, j, p interrupt input pulse ?tered ( st op) t pulse 3 tcyc appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1211 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 16 d port h, j, p interrupt input pulse passed ( st op) t pulse 4 tcyc 17 d irq pulse width, edge-sensitive mode ( st op) pw irq 1 tcyc 18 d xirq pulse width with x-bit set (stop) pw xirq 4 tosc 1 maximum leakage current occurs at maximum operating temperature. 2 refer to section a.1.4, ?urrent injection for more details 3 parameter only applies in stop or pseudo stop mode. table a-8. 5v i/o characteristics conditions are 4.5 v < v dd35 < 5.5 v temperature from ?0 c to +150 c, unless otherwise noted i/o characteristics for all i/o pins except extal, xtal,test and supply pins. appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1212 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.1.10 supply currents this section describes the current consumption characteristics of the device family as well as the conditions for the measurements. a.1.10.1 typical run current measurement conditions since the current consumption of the output drivers is load dependent, all measurements are without output loads and with minimum i/o activity. the currents are measured in single chip mode, s12xcpu code is executed from flash and xgate code is executed from ram. v dd35 =5v, internal voltage regulator is enabled and the bus frequency is 50mhz using a 4-mhz oscillator in loop controlled pierce mode. furthermore in expanded modes the currents ?wing in the system are highly dependent on the load at the address, data, and control signals as well as on the duty cycle of those signals. no generally applicable numbers can be given. a very good estimate is to take the single chip currents and add the currents due to the external loads. since the dbg and bdm modules are typically not used in the end application, the supply current values for these modules is not speci?d. an overhead of current consumption exisits independent of the listed modules, due to voltage regulation and clock logic that is not dedicated to a speci? module. this is listed in the table row named ?verhead? a.1.10.2 maximum run current measurement conditions currents are measured in single chip mode, s12xcpu and xgate code is executed from ram with v dd35 =5.5v, internal voltage regulator enabled and a 50mhz bus frequency from a 4-mhz input. characterized parameters are derived using a 4mhz loop controlled pierce oscillator. production test parameters are tested with a 4mhz square wave oscillator. a.1.10.3 current conditions unbonded ports must be correctly initialized to prevent current consumption due to ?ating inputs. typical stop current is measured with v dd35 =5v, maximum stop current is measured with v dd35 =5.5v. pseudo stop currents are measured with the oscillator con?ured for 4mhz lcp mode. table a-10. shows the con?uration of the peripherals for typical run current. table a-9. characteristics of expantion bus inputs port c, d, pe5, pe6, and pe7 for reduced input voltage thresholds conditions are 4.5 v < v dd35 < 5.5 v temperature from ?0 c to +150 c, unless otherwise noted num c rating symbol min typ max unit 1 d input high voltage v ih 1.75 v 2 d input low voltage v il 0.75 v 3 t input hysteresis v hys 100 mv appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1213 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-11. module con?urations for maximum run supply current v dd35 =5.5v table a-10. module con?urations for typical run supply current v dd35 =5v peripheral con?uration s12xcpu 420 cycle loop: 384 dbne cycles plus subroutine entry to stimulate stacking (ram access) xgate xgate fetches code from ram, xgate runs in an in?ite loop, reading the status and flag registers of can s, spi s, sci s in sequence and doing some bit manipulation on the data mscan con?ured to loop-back mode using a bit rate of 500kbit/s spi con?ured to master mode, continuously transmit data (0x55 or 0xaa) at 2mbit/s sci con?ured into loop mode, continuously transmit data (0x55) at speed of 19200 baud iic operate in master mode and continuously transmit data (0x55 or 0xaa) at 100kbit/s pwm con?ured to toggle its pins at the rate of 1khz ect the peripheral shall be con?ured in output compare mode. pulse accumulator and modulus counter enabled. atd the peripheral is con?ured to operate at its maximum speci?d frequency and to continuously convert voltages on all input channels in sequence. pit pit is enabled, micro-timer register 0 and 1 loaded with $0f and timer registers 0 to 3 are loaded with $03/07/0f/1f. rti enabled with rti control register (rtictl) set to $59 overhead vreg supplying 1.8v from a 5v input voltage, core clock tree active, pll on peripheral con?uration s12xcpu 420 cycle loop: 384 dbne cycles plus subroutine entry to stimulate stacking (ram access) xgate xgate fetches code from ram, xgate runs in an in?ite loop, reading the status and flag registers of can s, spi s, sci s in sequence and doing some bit manipulation on the data mscan con?ured to loop-back mode using a bit rate of 1mbit/s spi con?ured to master mode, continuously transmit data (0x55 or 0xaa) at 4mbit/s sci con?ured into loop mode, continuously transmit data (0x55) at speed of 57600 baud iic operate in master mode and continuously transmit data (0x55 or 0xaa) at 100kbit/s pwm con?ured to toggle its pins at the rate of 40khz ect the peripheral shall be con?ured in output compare mode. pulse accumulator and modulus counter enabled. atd the peripheral is con?ured to operate at its maximum speci?d frequency and to continuously convert voltages on all input channels in sequence. overhead vreg supplying 1.8v from a 5v input voltage, pll on appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1214 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-12. module run supply currents conditions are shown in table a-10 at ambient temperature unless otherwise noted num c rating min typ max unit 1 t s12xcpu 12.76 ma 2 t xgate 24.20 3 t each mscan 1.05 4 t each spi 0.22 5 t each sci 0.28 6 t each iic 0.40 7 t pwm 0.55 8 t ect 1.16 9 t each atd 0.82 10 t pit 0.61 11 t rti 0.17 12 t overhead 35.56 appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1215 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-13. run and wait current characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit run supply current (no external load, peripheral con?uration see table a-11.) 1 p peripheral set 1 f osc =4mhz, f bus =50mhz i dd35 100 ma run supply current (no external load, peripheral con?uration see table a-10.) 2 c t t peripheral set 1 all devices except 512k, 384k options f osc =4mhz, f bus =50mhz f osc =4mhz, f bus =20mhz f osc =4mhz, f bus =8mhz 1 the following peripherals are on: atd0/atd1/ect/iic1/pwm/spi0-spi2/sci0-sci7/can0-can4/xgate i dd35 84 43 24 ma 2a t peripheral set 1 devices s12xeq512, s12xex384 f osc =4mhz, f bus =50mhz 72 ma 3 t t t peripheral set 2 f osc =4mhz, f bus =50mhz f osc =4mhz, f bus =20mhz f osc =4mhz, f bus =8mhz 2 the following peripherals are on: atd0/atd1/ect/iic1/pwm/spi0-spi2/sci0-sci7/can0-can4 63 35 21 ma 4 t t t peripheral set 3 f osc =4mhz, f bus =50mhz f osc =4mhz, f bus =20mhz f osc =4mhz, f bus =8mhz 3 the following peripherals are on: atd0/atd1/ect/iic1/pwm/spi0-spi2/sci0-sci7 62 34 21 ma 5 t t t peripheral set 4 f osc =4mhz, f bus =50mhz f osc =4mhz, f bus =20mhz f osc =4mhz, f bus =8mhz 4 the following peripherals are on: atd0/atd1/ect/iic1/pwm/spi0-spi2 60 33 20 ma 6 t t t peripheral set 5 f osc =4mhz, f bus =50mhz f osc =4mhz, f bus =20mhz f osc =4mhz, f bus =8mhz 5 the following peripherals are on: atd0/atd1/ect/iic1/pwm 59 33 20 ma 7 t t t peripheral set 6 f osc =4mhz, f bus =50mhz f osc =4mhz, f bus =20mhz f osc =4mhz, f bus =8mhz 6 the following peripherals are on: atd0/atd1/ect/iic1 57 33 20 ma wait supply current 8 c peripheral set 1 ,pll on xgate executing code from ram i ddw 85 ma 9 t t peripheral set 2 f osc =4mhz, f bus =50mhz f osc =4mhz, f bus =8mhz 50 12 10 p all modules disabled, rti enabled, pll off 10 appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1216 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-14. pseudo stop and full stop current conditions are shown in table a-4 , junction temperature, unless otherwise noted num c rating symbol min typ max unit pseudo stop current (api, rti, and cop disabled) pll off, lcp mode 10 c p c c c p p p ?0 c 27 c 70 c 85 c 105 c 110 c 130 c 150 c i ddps 175 185 255 305 455 505 805 1555 255 2155 3655 7655 a pseudo stop current (api, rti, and cop enabled) pll off, lcp mode 11 c c c c c c 27 c 70 c 85 c 105 c 125 c 150 c i ddps 205 275 325 475 810 1575 a stop current 12 c p c c c p c p p ?0 c 27 c 70 c 85 c 105 c 110 c 125 c 130 c 150 c i dds 20 30 100 150 300 350 550 650 1400 100 2000 3500 7500 a stop current (api active) 13 t t t t t ?0 c 27 c 85 c 110 c 130 c i dds 32 42 162 362 662 a stop current (one atd active) 14 t t t 27 c 85 c 125 c i dds 300 420 820 a appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1217 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.2 atd characteristics this section describes the characteristics of the analog-to-digital converter. a.2.1 atd operating characteristics the table a-15 and table a-16 show conditions under which the atd operates. the following constraints exist to obtain full-scale, full range results: v ssa v rl v in v rh v dda . this constraint exists since the sample buffer ampli?r can not drive beyond the power supply levels that it ties to. if the input level goes outside of this range it will effectively be clipped. table a-15. atd operating characteristics a.2.2 factors in?encing accuracy source resistance, source capacitance and current injection have an in?ence on the accuracy of the atd. a further factor is that portad pins that are con?ured as output drivers switching. conditions are shown in table a-4 unless otherwise noted, supply voltage 3.13v < v dda < 5.5 v num c rating symbol min typ max unit 1 d reference potential low high v rl v rh v ssa v dda /2 v dda /2 v dda v v 2 d voltage difference v ddx to v dda ? vddx ?.35 0 0.1 v 3 d voltage difference v ssx to v ssa ? vssx ?.1 0 0.1 v 4 c differential reference voltage 1 1 full accuracy is not guaranteed when differential voltage is less than 4.50 v v rh -v rl 3.13 5.0 5.5 v 5 c atd clock frequency (derived from bus clock via the prescaler) f atdclk 0.25 8.3 mhz 6 p atd clock frequency in stop mode (internal generated temperature and voltage dependent clock, iclk) 0.6 1 1.7 mhz 7 d adc conversion in stop, recovery time 2 2 when converting in stop mode (iclkstp=1) an atd stop recovery time tatdstprcv is required to switch back to bus clock based atdclk when leaving stop mode. do not access atd registers during this time. t atdstprc v 1.5 us 8d atd conversion period 3 12 bit resolution: 10 bit resolution: 8 bit resolution: 3 the minimum time assumes a sample time of 4 atd clock cycles. the maximum time assumes a sample time of 24 atd clock cycles and the discharge feature (smp_dis) enabled, which adds 2 atd clock cycles. n conv12 n conv10 n conv8 20 19 17 42 41 39 at d clock cycles appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1218 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.2.2.1 port ad output drivers switching portad output drivers switching can adversely affect the atd accuracy whilst converting the analog voltage on other portad pins because the output drivers are supplied from the vdda/vssa atd supply pins. although internal design measures are implemented to minimize the affect of output driver noise, it is recommended to con?ure portad pins as outputs only for low frequency, low load outputs. the impact on atd accuracy is load dependent and not speci?d. the values speci?d are valid under condition that no portad output drivers switch during conversion. a.2.2.2 source resistance due to the input pin leakage current as speci?d in table a-8 in conjunction with the source resistance there will be a voltage drop from the signal source to the atd input. the maximum source resistance r s speci?s results in an error (10-bit resolution) of less than 1/2 lsb (2.5 mv) at the maximum leakage current. if device or operating conditions are less than worst case or leakage-induced error is acceptable, larger values of source resistance of up to 10kohm are allowed. a.2.2.3 source capacitance when sampling an additional internal capacitor is switched to the input. this can cause a voltage drop due to charge sharing with the external and the pin capacitance. for a maximum sampling error of the input voltage 1lsb (10-bit resolution), then the external ?ter capacitor, c f 1024 * (c ins ? inn ). a.2.2.4 current injection there are two cases to consider. 1. a current is injected into the channel being converted. the channel being stressed has conversion values of $3ff (in 10-bit mode) for analog inputs greater than v rh and $000 for values less than v rl unless the current is higher than speci?d as disruptive condition. 2. current is injected into pins in the neighborhood of the channel being converted. a portion of this current is picked up by the channel (coupling ratio k), this additional current impacts the accuracy of the conversion depending on the source resistance. appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1219 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the additional input voltage error on the converted channel can be calculated as: v err = k * r s * i inj with i inj being the sum of the currents injected into the two pins adjacent to the converted channel. a.2.3 atd accuracy table a-17 and table a-18 specify the atd conversion performance excluding any errors due to current injection, input capacitance and source resistance. a.2.3.1 atd accuracy de?itions for the following de?itions see also figure a-1 . differential non-linearity (dnl) is de?ed as the difference between two adjacent switching steps. the integral non-linearity (inl) is de?ed as the sum of all dnls: table a-16. atd electrical characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit 1 c max input source resistance 1 1 refer to a.2.2.2 for further information concerning source resistance r s 1k ? 2 d total input capacitance non sampling total input capacitance sampling c inn c ins 10 16 pf 3 d input internal resistance r ina 515k ? 4 c disruptive analog input current i na ?.5 2.5 ma 5 c coupling ratio positive current injection k p 1e-4 a/a 6 c coupling ratio negative current injection k n 2e-3 a/a dnl i () v i v i1 1lsb ------------------------- - 1 = inl n () dnl i () i1 = n v n v 0 1lsb -------------------- - n == appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1220 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure a-1. atd accuracy de?itions note figure a-1 shows only de?itions, for speci?ation values refer to table a-17 and table a-18 1 5 vin mv 10 15 20 25 30 35 40 5085 5090 5095 5100 5105 5110 5115 5120 5065 5070 5075 5080 5060 0 3 2 5 4 7 6 50 $3f7 $3f9 $3f8 $3fb $3fa $3fd $3fc $3fe $3ff $3f4 $3f6 $3f5 8 9 1 2 $ff $fe $fd $3f3 10-bit resolution 8-bit resolution ideal transfer curve 10-bit transfer curve 8-bit transfer curve 5055 10-bit absolute error boundary 8-bit absolute error boundary lsb vi-1 vi dnl appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1221 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-17. atd conversion performance 5v range table a-18. atd conversion performance 3.3v range conditions are shown in table a-4. unless otherwise noted. v ref = v rh - v rl = 5.12v. f atdclk = 8.3mhz the values are tested to be valid with no portad output drivers switching simultaneous with conversions. num c rating 1 , 2 1 the 8-bit and 10-bit mode operation is structurally tested in production test. absolute values are tested in 12-bit mode. 2 better performance is possible using specially designed multi-layer pcbs or averaging techniques. symbol min typ max unit 1 p resolution 12-bit lsb 1.25 mv 2 p differential nonlinearity 12-bit dnl -4 2 4 counts 3 p integral nonlinearity 12-bit inl -5 2.5 5 counts 4p absolute error 3 3 these values include the quantization error which is inherently 1/2 count for any a/d converter. 12-bit ae -7 4 7 counts 5 c resolution 10-bit lsb 5 mv 6c differential nonlinearity 10-bit dnl -1 0.5 1 counts 7 c integral nonlinearity 10-bit inl -2 1 2 counts 8c absolute error 3 10-bit ae -3 2 3 counts 9 c resolution 8-bit lsb 20 mv 10 c differential nonlinearity 8-bit dnl -0.5 0.3 0.5 counts 11 c integral nonlinearity 8-bit inl -1 0.5 1 counts 12 c absolute error 3 8-bit ae -1.5 1 1.5 counts conditions are shown in table a-4. unless otherwise noted. v ref = v rh - v rl = 3.3v. f atdclk = 8.3mhz the values are tested to be valid with no portad output drivers switching simultaneous with conversions. num c rating 1 , 2 1 the 8-bit and 10-bit mode operation is structurally tested in production test. absolute values are tested in 12-bit mode. 2 better performance is possible using specially designed multi-layer pcbs or averaging techniques. symbol min typ max unit 1 p resolution 12-bit lsb 0.80 mv 2 p differential nonlinearity 12-bit dnl -6 3 6 counts 3 p integral nonlinearity 12-bit inl -7 3 7 counts 4p absolute error 3 12-bit ae -8 4 8 counts 5 c resolution 10-bit lsb 3.22 mv 6 c differential nonlinearity 10-bit dnl -1.5 1 1.5 counts 7 c integral nonlinearity 10-bit inl -2 1 2 counts 8c absolute error 3 10-bit ae -3 2 3 counts 9 c resolution 8-bit lsb 12.89 mv 10 c differential nonlinearity 8-bit dnl -0.5 0.3 0.5 counts 11 c integral nonlinearity 8-bit inl -1 0.5 1 counts 12 c absolute error 3 8-bit ae -1.5 1 1.5 counts appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1222 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3 nvm, flash and emulated eeprom a.3.1 timing parameters the time base for all nvm program or erase operations is derived from the oscillator. a minimum oscillator frequency f nvmosc is required for performing program or erase operations. the nvm modules do not have any means to monitor the frequency and will not prevent program or erase operation at frequencies above or below the speci?d minimum. when attempting to program or erase the nvm modules at a lower frequency, a full program or erase transition is not assured. the program and erase operations are timed using a clock derived from the oscillator using the fclkdiv register. the frequency of this clock must be set within the limits speci?d as f nvmop . the minimum program and erase times shown in table a-19 are calculated for maximum f nvmop and maximum f nvmbus unless otherwise shown. the maximum times are calculated for minimum f nvmop a.3.1.1 erase verify all blocks (blank check) (fcmd=0x01) the time it takes to perform a blank check is dependant on the location of the ?st non-blank word starting at relative address zero. it takes one bus cycle per phrase to verify plus a setup of the command. assuming that no non blank location is found, then the erase verify all blocks is given by. a.3.1.2 erase verify block (blank check) (fcmd=0x02) the time it takes to perform a blank check is dependant on the location of the ?st non-blank word starting at relative address zero. it takes one bus cycle per phrase to verify plus a setup of the command. assuming that no non blank location is found, then the erase verify time for a single 256k nvm array is given by for a 128k nvm or d-flash array the erase verify time is given by a.3.1.3 erase verify p-flash section (fcmd=0x03) the maximum time depends on the number of phrases being veri?d (n vp ) 3 these values include the quantization error which is inherently 1/2 count for any a/d converter. t check 33500 1 f nvmbus --------------------- - ? = t check 33500 1 f nvmbus --------------------- - ? = t check 17200 1 f nvmbus --------------------- - ? = t check 752 n vp + () 1 f nvmbus --------------------- - ? = appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1223 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3.1.4 read once (fcmd=0x04) the maximum read once time is given by a.3.1.5 load data field (fcmd=0x05) the maximum load data ?ld time is given by a.3.1.6 program p-flash (fcmd=0x06) the programming time for a single phrase of four p-flash words + associated eight ecc bits is dependant on the bus frequency as a well as on the frequency f nvmop and can be calculated according to the following formulas, whereby n dload is the number of extra blocks being programmed by the load data field command (dload), i.e. programming 2,3,4 blocks using dload, n dload =1,2,3 respectively. the typical phrase programming time can be calculated using the following equation the maximum phrase programming time can be calculated using the following equation a.3.1.7 p-flash program once (fcmd=0x07) the maximum p-flash program once time is given by a.3.1.8 erase all blocks (fcmd=0x08) for s12xep100, s12xep768, s12xeq512 and s12xeq384 erasing all blocks takes: for s12xet256, s12xea256 and s12xeg128 erasing all blocks takes: t 400 () 1 f nvmbus --------------------- - ? = t 450 () 1 f nvmbus --------------------- - ? = t bwpgm 128 12 n dload ? () + () 1 f nvmop ------------------------ - 1725 510 n dload ? () + () 1 f nvmbus ---------------------------- - ? + ? = t bwpgm 130 14 n dload ? () + () 1 f nvmop ------------------------ - 2125 510 n dload ? () + () 1 f nvmbus ---------------------------- - ? + ? = t bwpgm 162 1 f nvmop ------------------------ - 2400 1 f nvmbus ---------------------------- - ? + ? t mass 100100 1 f nvmop ------------------------ - 70000 1 f nvmbus ---------------------------- - ? + ? t mass 100100 1 f nvmop ------------------------ - 35000 1 f nvmbus ---------------------------- - ? + ? appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1224 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3.1.9 erase p-flash block (fcmd=0x09) erasing a 256k nvm block takes erasing a 128k nvm block takes a.3.1.10 erase p-flash sector (fcmd=0x0a) the typical time to erase a1024-byte p-flash sector can be calculated using the maximum time to erase a1024-byte p-flash sector can be calculated using a.3.1.11 unsecure flash (fcmd=0x0b) the maximum time for unsecuring the ?sh is given by a.3.1.12 verify backdoor access key (fcmd=0x0c) the maximum verify backdoor access key time is given by a.3.1.13 set user margin level (fcmd=0x0d) the maximum set user margin level time is given by a.3.1.14 set field margin level (fcmd=0x0e) the maximum set ?ld margin level time is given by t mass 100100 1 f nvmop ------------------------ - 70000 1 f nvmbus ---------------------------- - ? + ? t mass 100100 1 f nvmop ------------------------ - 35000 1 f nvmbus ---------------------------- - ? + ? t era 20020 1 f nvmop ------------------ - ? ?? ?? 700 1 f nvmbus --------------------- - ? ?? ?? + = t era 20020 1 f nvmop ------------------ - ? ?? ?? 1100 1 f nvmbus --------------------- - ? ?? ?? + = t uns 100100 1 f nvmop ------------------------ - 70000 1 f nvmbus ---------------------------- - ? + ? ?? ?? = t 400 1 f nvmbus ---------------------------- - ? = t 350 1 f nvmbus ---------------------------- - ? = appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1225 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3.1.15 full partition d-flash (fcmd=0x0f) the maximum time for partitioning the d-?sh (erpart=16, dfpart=0) is given by : a.3.1.16 erase verify d-flash section (fcmd=0x10) erase verify d-flash for a given number of words n w is given by . a.3.1.17 d-flash programming (fcmd=0x11) d-flash programming time is dependent on the number of words being programmed and their location with respect to a row boundary, because programming across a row boundary requires extra steps. the d-flash programming time is speci?d for different cases (1,2,3,4 words and 4 words across a row boundary) at a 50mhz bus frequency. the typical programming time can be calculated using the following equation, whereby n w denotes the number of words; bc=0 if no boundary is crossed and bc=1 if a boundary is crossed. the maximum programming time can be calculated using the following equation a.3.1.18 erase d-flash sector (fcmd=0x12) typical d-flash sector erase times are those expected on a new device, where no margin verify fails occur. they can be calculated using the following equation. maximum d-fash sector erase times can be calculated using the following equation. the d-flash sector erase time on a new device is ~5ms and can extend to 20ms as the ?sh is cycled. t 350 1 f nvmbus ---------------------------- - ? = t part 21800 1 f nvmop ------------------------ - 400000 1 f nvmbus ---------------------------- - t mass + ? + ? t check 840 n w + () 1 f nvmbus ---------------------------- - ? t dpgm 15 54 n w ? () 16 bc ? () ++ () 1 f nvmop ------------------ - ? ?? ?? 460 640 n w ? () 500 bc ? () ++ () 1 f nvmbus --------------------- - ? ?? ?? + = t dpgm 15 56 n w ? () 16 bc ? () ++ () 1 f nvmop ------------------ - ? ?? ?? 460 840 n w ? () 500 bc ? () ++ () 1 f nvmbus --------------------- - ? ?? ?? + = t eradf 5025 1 f nvmop ------------------------ - 700 1 f nvmbus ---------------------------- - ? + ? t eradf 20100 1 f nvmop ------------------------ - 3300 1 f nvmbus ---------------------------- - ? + ? appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1226 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3.1.19 enable eee (fcmd=0x13) the maximum time to enable eprom emulation is given by where n sec is the number of sectors of constant data. a constant sector is one in which all 63 records contain the latest active data and would need to be copied. the maximum possible is 33 (2048 eee ram words /63 =32.5) although this is a highly unlikely scenario. the impact of a worst case brownout recovery scenario is denoted by bwn = 2 for non brownout situations bwn =0. t 1100 bwn 176 1 bwn + () bwn n + sec () 32364 ? + ? () + ? () () 1 f nvmop ------------------ - ? ?? ?? 3050 1 bwn + () ? n sec bwn + () 290500 ? + () 1 f nvmbus --------------------- - ? ?? ?? + ? ? ? ? = appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1227 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3.1.20 maximum ccob latency the maximum time a ccob command has to wait to be actioned due to an eee clean up is given where bwn = 1 if a brownout has occured otherwise bwn = 0. bwn = 1 only for the ?st eneee after reset. a.3.1.21 disable eee (fcmd=0x14) maximum time to disable eprom emulation is given by a.3.1.22 eee query (fcmd=0x15) maximum time for the eee query command is given by a.3.1.23 partition d-flash (fcmd=0x20) the maximum time for partitioning the d-?sh (erpart=16, dfpart=0) is given by t 32364 1 f nvmop ------------------------ - 292600 1 f nvmbus ---------------------------- - ? + ? ?? ?? 1bwn + () bwn + 350 1 f nvmop --------------------- 1100 f nvmbus ------------------------ - + ? ?? ?? ? ? t 300 1 f nvmbus ---------------------------- - ? = t 300 1 f nvmbus ---------------------------- - ? = t 21800 1 f nvmop ------------------------ - 400000 1 f nvmbus ---------------------------- - ? + ? appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1228 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3.1.24 eee copy down the typical eee copy down time is given by the following equation the maximum eee copy down time is given by the following equation worst case for enable eeprom emulation allows for all the eee records to have to be copied which is a very low probability scenario only likely in the case that the eee is mostly full of unchanging data (the records for which are stored in consecutive d-flash sectors). table a-19. nvm timing characteristics conditions are as shown in table a-4 , with f nvmbus = 50mhz and f nvmop = 1mhz unless otherwise noted. num c rating symbol min typ max unit 1 d external oscillator clock f nvmosc 2 50 1 1 restrictions for oscillator in crystal mode apply. mhz 2 d bus frequency for programming or erase operations f nvmbus 1 50 mhz 3 d operating frequency f nvmop 800 1050 khz 4 d p-flash phrase programming t bwpgm 162 173 s 5a d p- flash phrase program time using d-load on 4 blocks t bwpgm4 231 264 s 5b d p-flash phrase program time using d-load on 3 blocks t bwpgm3 208 233 s 5c d p-flash phrase program time using d-load on 2 blocks t bwpgm2 185 202 s 6 p p-flash sector erase time t era ?021ms 7 p erase all blocks (mass erase) time t mass 101 102 ms 7a d unsecure flash t uns 101 102 ms 8 d p-flash erase verify (blank check) time 2 2 valid for both ?rase verify all?or ?rase verify block?on 256k block without failing locations t check 33500 2 t cyc 9a d d-flash word programming one word t dpgm ?895 s 9b d d-flash word programming two words t dpgm 153 165 s 9c d d-flash word programming three words t dpgm 212 230 s 9d d d-flash word programming four words t dpgm 282 316 s 9e d d-flash word programming four words crossing row boundary t dpgm 298 342 s 10 d d-flash sector erase time t eradf 5.2 3 3 this is a typical value for a new device 21 ms 11 d d-flash erase verify (blank check) time t check 17500 t cyc 12 d eee copy down (mask sets 5m48h, 3m25j, 2m53j) t dfrcd 255000 275000 4 4 maximum partitioning t cyc 12 d eee copy down (other mask sets) t dfrcd 205000 225000 5 5 maximum partitioning t cyc t dfcd 14000 316 erpart ? () 1500 124 dfpart () ? () ++ () 1 f nvmbus --------------------- - = t dfcd 34000 316 erpart ? () 1500 124 dfpart () ? () ++ () 1 f nvmbus --------------------- - = appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1229 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.3.2 nvm reliability parameters the reliability of the nvm blocks is guaranteed by stress test during quali?ation, constant process monitors and burn-in to screen early life failures. the data retention and program/erase cycling failure rates are speci?d at the operating conditions noted. the program/erase cycle count on the sector is incremented every time a sector or mass erase event is executed. the standard shipping condition for both the d-flash and p-flash memory is erased with security disabled. however it is recommended that each block or sector is erased before factory programming to ensure that the full data retention capability is achieved. data retention time is measured from the last erase operation. table a-20. nvm reliability characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit p-flash arrays 1 c data retention at an average junction temperature of t javg = 85 c 1 after up to 10,000 program/erase cycles t pnvmret 15 100 2 years 2 c data retention at an average junction temperature of t javg = 85 c 3 after less than 100 program/erase cycles t pnvmret 20 100 2 years 3 c p-flash number of program/erase cycles (-40 c tj 150 c ) n pflpe 10k 100k 3 cycles d-flash array 4 c data retention at an average junction temperature of t javg = 85 c 3 after up to 50,000 program/erase cycles t dnvmret 5 100 2 years 5 c data retention at an average junction temperature of t javg = 85 c 3 after less than 10,000 program/erase cycles t dnvmret 10 100 2 years 6 c data retention at an average junction temperature of t javg = 85 c 3 after less than 100 program/erase cycles t dnvmret 20 100 2 years 7 c d-flash number of program/erase cycles (-40 c tj 150 c ) n dflpe 50k 500k 3 cycles emulated eeprom 8 c data retention at an average junction temperature of t javg = 85 c 1 after spec. program/erase cycles t eenvmret 5 4 100 2 years 9 c data retention at an average junction temperature of t javg = 85 c 3 after less than 20% spec.program/erase cycles. (e.g. after <20,000 cycles / spec 100,000 cycles) t eenvmret 10 100 2 years 10 c data retention at an average junction temperature of t javg = 85 c 3 after less than 0.2% spec. program/erase cycles (e.g. after < 200 cycles / spec 100,000 cycles) t eenvmret 20 100 2 years 11 c eeprom number of program/erase cycles with a ratio of eee_nvm to eee_ram = 8 (-40 c tj 150 c ) n eepe 100k 4 1m 5 cycles 12 c eeprom number of program/erase cycles with a ratio of eee_nvm to eee_ram = 128 (-40 c tj 150 c ) n eepe 3m 4 30m 5 cycles 13 c eeprom number of program/erase cycles with a ratio of eee_nvm to eee_ram = 16384 6 (-40 c tj 150 c ) n eepe 325m 4 3.2g 5 cycles appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1230 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 the number of program/erase cycles for the eeprom/d-flash depends upon the partitioning of d-flash used for eeprom emulation. de?ing ram size allocated for eee as eee-ram and d-flash partition allocated to eee as eee_nvm, the minimum number of program/erase cycles is speci?d depending upon the ratio of eee_nvm/eee_ram. the minimum ratio eee_nvm/eee_ram =8. figure a-2. program/erase dependency on d-flash partitioning 1 t javg does not exceed 85 c in a typical temperature pro?e over the lifetime of a consumer, industrial or automotive application. 2 typical data retention values are based on intrinsic capability of the technology measured at high temperature and de-rated to 25 c using the arrhenius equation. for additional information on how freescale de?es typical data retention, please refer to engineering bulletin eb618 3 t javg does not exceed 85 c in a typical temperature pro?e over the lifetime of a consumer, industrial or automotive application. 4 this represents the number of writes of updated data words to the eee_ram partition. minimum speci?ation (endurance and data retention) of the emulated eeprom array is based on the minimum speci?ation of the d-flash array per item 6. 5 this represents the number of writes of updated data words to the eee_ram partition. typical endurance performance for the emulated eeprom array is based on typical endurance performance and the eee algorithm implemented on this product family. spec. table quotes typical endurance evaluated at 25 c for this product family. 6 this is equivalent to using a single byte or aligned word in the eee_ram with 32k d-flash allocated for eeeprom eee_nvm/eee_ram ratio 10 # k cycles 100 1,000 100,000 1,000,000 10 100 1000 100,000 20% spec cycles 10 year data retention 10,000 10,000 spec cycles 5 year data retention (log) (log) appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1231 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.4 voltage regulator device functionality is guaranteed on power down to the lvr assert level. a.5 output loads table a-21. voltage regulator electrical characteristics conditions are shown in table a-4 unless otherwise noted num c characteristic symbol min typical max unit 1 p input voltages v vddr,a 3.13 5.5 v 2p output voltage core full performance mode reduced power mode (mcu stop mode) shutdown mode v dd 1.72 1.84 1.6 1 1 voltage regulator disabled. high impedance output 1.98 v v v 3p output voltage flash full performance mode reduced power mode (mcu stop mode) shutdown mode v ddf 2.6 2.82 2.2 1 2.9 v v v 4p output voltage pll full performance mode reduced power mode (mcu stop mode) shutdown mode v ddpll 1.72 1.84 1.6 1 1.98 v v v 5p low voltage interrupt asser level 2 low voltage interruptdeassert level 2 monitors vdda, active only in full performance mode. indicates i/o & adc performance degradation due to low supply voltage. v lvia v lvid 4.04 4.19 4.23 4.38 4.40 4.49 v v 6a p vddx low voltage reset deassert 3 3 monitors vddx, active only in full performance mode. mcu is monitored by the por in rpm (see figure a-3 ) v lvrxd 3.13 v 6b d vddx low voltage reset assert 3 v lvrxa 3.02 v 6c p vddx low voltage reset assert 3 v lvrxa 2.97 v 7c trimmed api internal clock 4 ? f / f nominal 4 the api trimming bits must be set that the minimum period equals to 0.2 ms. df api - 5% + 5% 8d the first period after enabling the counter by apife might be reduced by api start up delay t sdel 100 us 9 t temperature sensor slope dv ts 5.05 5.25 5.45 mv/ o c 10 t high temperature interrupt assert (vreghttr=$88) 5 high temperature interrupt deassert (vreghttr=$88) 5 a hysteresis is guaranteed by design note the lvr monitors the voltages vddf and vddx. if the voltage drops on these supplies to a level which could prohibit the correct function of the microcontroller, the lvr triggers. t htia t htid 120 110 132 122 144 134 o c appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1232 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.5.1 resistive loads the voltage regulator is intended to supply the internal logic and oscillator. it allows no external dc loads. a.5.2 capacitive loads the capacitive loads are speci?d in table a-22 . ceramic capacitors with x7r dielectricum are required. a.5.3 chip power-up and voltage drops lvi (low voltage interrupt), por (power-on reset) and lvrs (low voltage reset) handle chip power-up or drops of the supply voltage. their function is shown in figure a-3 . figure a-3. mc9s12xe-family - chip power-up and voltage drops (not scaled) table a-22. - required capacitive loads num characteristic symbol min recommended max unit 1 vdd/vddf external capacitive load c ddext 176 220 264 nf 3 vddpll external capacitive load c ddpllext 80 220 264 nf v lvid v lvia v lvrxd v lvrxa v pord lvi por lvrx t v v ddx lvi enabled lvi disabled due to lvr v dd appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1233 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure a-4. mc9s12xe-family power sequencing during power sequencing v dda can be powered up before v ddr , v ddx . v ddr and v ddx must be powered up together adhering to the operating conditions differential. v rh power up must follow v dda to avoid current injection. a.6 reset, oscillator and pll this section summarizes the electrical characteristics of the various startup scenarios for oscillator and phase-locked loop (pll). a.6.1 startup table a-23 summarizes several startup characteristics explained in this section. detailed description of the startup behavior can be found in the clock and reset generator (crg) block description a.6.1.1 por the release level v porr and the assert level v pora are derived from the v dd supply. they are also valid if the device is powered externally. after releasing the por reset the oscillator and the clock quality check are started. if after a time t cqout no valid oscillation is detected, the mcu will start using the internal self clock. the fastest startup time possible is given by n uposc . table a-23. startup characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit 1 d reset input pulse width, minimum input time pw rstl 2 t osc 2 d startup from reset t rst 192 4000 1 1 this is the time between reset deassertion and start of cpu code execution. n bus 3 d wait recovery startup time t wrs 14 t cyc 4 d fast wakeup from stop 2 2 including voltage regulator startup; v dd /v ddf ?ter capacitors 220 nf, v dd35 = 5 v, t= 25 c t fws 50 100 s v ddr, v dda t v v ddx >= 0 appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1234 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.6.1.2 sram data retention provided an appropriate external reset signal is applied to the mcu, preventing the cpu from executing code when v dd35 is out of speci?ation limits, the sram contents integrity is guaranteed if after the reset the porf bit in the crg ?gs register has not been set. a.6.1.3 external reset when external reset is asserted for a time greater than pw rstl the crg module generates an internal reset, and the cpu starts fetching the reset vector without doing a clock quality check, if there was an oscillation before reset. a.6.1.4 stop recovery out of stop the controller can be woken up by an external interrupt. a clock quality check as after por is performed before releasing the clocks to the system. if the mcu is woken-up by an interrupt and the fast wake-up feature is enabled (fstwkp = 1 and scme = 1), the system will resume operation in self-clock mode after t fws . a.6.1.5 pseudo stop and wait recovery the recovery from pseudo stop and wait is essentially the same since the oscillator is not stopped in both modes. the controller can be woken up by internal or external interrupts. after t wrs the cpu starts fetching the interrupt vector. appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1235 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.6.2 oscillator table a-24. oscillator characteristics conditions are shown in table a-4. unless otherwise noted num c rating symbol min typ max unit 1a c crystal oscillator range (loop controlled pierce) f osc 4.0 16 mhz 1b c crystal oscillator range (full swing pierce) 1,2 1 depending on the crystal a damping series resistor might be necessary 2 only valid if full swing pierce oscillator/external clock mode is selected f osc 2.0 40 mhz 2 p startup current i osc 100 a 3a c oscillator start-up time (lcp, 4mhz) 3 3 these values apply for carefully designed pcb layouts with capacitors that match the crystal/resonator requirements.. t uposc 210ms 3b c oscillator start-up time (lcp, 8mhz) 3 t uposc 1.6 8 ms 3c c oscillator start-up time (lcp, 16mhz) 3 t uposc 15ms 4a c oscillator start-up time (full swing pierce, 2mhz) 3 t uposc 840ms 4b c oscillator start-up time (full swing pierce, 4mhz) 3 t uposc 420ms 4c c oscillator start-up time (full swing pierce, 8mhz) 3 t uposc 210ms 4d c oscillator start-up time (full swing pierce, 16mhz) 3 t uposc 15ms 4e c oscillator start-up time (full swing pierce, 40mhz) 3 t uposc 0.8 4 ms 5 d clock quality check time-out t cqout 0.45 2.5 s 6 p clock monitor failure assert frequency f cmfa 200 400 1000 khz 7 p external square wave input frequency f ext 2.0 50 mhz 8 d external square wave pulse width low t extl 9.5 ns 9 d external square wave pulse width high t exth 9.5 ns 10 d external square wave rise time t extr 1ns 11 d external square wave fall time t extf 1ns 12 d input capacitance (extal, xtal pins) c in 7 pf 13 p extal pin input high voltage v ih,extal 0.75*v ddpll v t extal pin input high voltage ,4 4 only applies if extal is externally driven v ih,extal v ddpll + 0.3 v 14 p extal pin input low voltage v il,extal 0.25*v ddpll v t extal pin input low voltage ,4 v il,extal v sspll - 0.3 v 15 c extal pin input hysteresis v hys,extal 180 mv 16 c extal pin oscillation amplitude (loop controlled pierce) v pp,extal 0.9 v appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1236 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.6.3 phase locked loop a.6.3.1 jitter information with each transition of the clock f cmp , the deviation from the reference clock f ref is measured and input voltage to the vco is adjusted accordingly.the adjustment is done continuously with no abrupt changes in the clock output frequency. noise, voltage, temperature and other factors cause slight variations in the control loop resulting in a clock jitter. this jitter affects the real minimum and maximum clock periods as illustrated in figure a-5 . figure a-5. jitter de?itions the relative deviation of t nom is at its maximum for one clock period, and decreases towards zero for larger number of clock periods (n). 2 3 n-1 n 1 0 t nom t max1 t min1 t maxn t minn appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1237 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 de?ing the jitter as: the following equation is a good ? for the maximum jitter: figure a-6. maximum bus clock jitter approximation jn () max 1 t max n () nt nom ? ----------------------- 1 t min n () nt nom ? ---------------------- - , ?? ?? ?? = jn () j 1 n -------- j 2 + = 1 5 10 20 n j(n) appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1238 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 this is important to note with respect to timers, serial modules where a prescaler will eliminate the effect of the jitter to a large extent. a.7 external interface timing a.7.1 mscan a.7.2 spi timing this section provides electrical parametrics and ratings for the spi. in table a-27 the measurement conditions are listed. table a-25. ipll characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit 1p self clock mode frequency 1 1 bus frequency is equivalent to f scm /2 f scm 1 4 mhz 2 c vco locking range f vco 32 120 mhz 3 c reference clock f ref 1 40 mhz 4 d lock detection |? lock | 0 1.5 % 2 2 % deviation from target frequency 5 d un-lock detection |? unl | 0.5 2.5 % 2 7 c time to lock t lock 214 150 + 256/f ref s 8c jitter ? parameter 1 3 3 f osc = 4mhz, f bus = 50mhz equivalent f pll = 100mhz: refdiv=$01, refrq=01, syndiv=$18, vcofrq=11, postdiv=$ 00. j 1 1.2 % 9c jitter ? parameter 2 3 j 2 0% 10 d bus frequency for fm1=1, fm0=1 (frequency modulation in pllctl register of s12xe_crg) f bus 48 mhz 11 d bus frequency for fm1=1, fm0=0 (frequency modulation in pllctl register of s12xe_crg) f bus 49 mhz 12 d bus frequency for fm1=0, fm0=1 (frequency modulation in pllctl register of s12xe_crg) f bus 49 mhz table a-26. mscan wake-up pulse characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit 1 p mscan wakeup dominant pulse ?tered t wup 1.5 s 2 p mscan wakeup dominant pulse pass t wup 5 s appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1239 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.7.2.1 master mode in figure a-7 the timing diagram for master mode with transmission format cpha = 0 is depicted. figure a-7. spi master timing (cpha = 0) table a-27. measurement conditions description value unit drive mode full drive mode load capacitance c load 1 , on all outputs 1 timing speci?d for equal load on all spi output pins. avoid asymmetric load. 50 pf thresholds for delay measurement points (20% / 80%) v ddx v sck (output) sck (output) miso (input) mosi (output) ss1 (output) 1 9 5 6 msb in2 bit msb-1. . . 1 lsb in msb out2 lsb out bit msb-1. . . 1 11 4 4 2 10 (cpol = 0) (cpol = 1) 3 13 13 1. if con?ured as an output. 2. lsbf = 0. for lsbf = 1, bit order is lsb, bit 1, bit 2... msb. 12 12 appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1240 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 in figure a-8 the timing diagram for master mode with transmission format cpha=1 is depicted. figure a-8. spi master timing (cpha = 1) sck (output) sck (output) miso (input) mosi (output) 1 5 6 msb in2 bit msb-1. . . 1 lsb in master msb out2 master lsb out bit msb-1. . . 1 4 4 9 12 13 11 port data (cpol = 0) (cpol = 1) port data ss1 (output) 2 12 13 3 1.if con?ured as output 2. lsbf = 0. for lsbf = 1, bit order is lsb, bit 1,bit 2... msb. appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1241 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 in table a-28 the timing characteristics for master mode are listed. figure a-9. derating of maximum f sck to f bus ratio in master mode table a-28. spi master mode timing characteristics num c characteristic symbol min typ max unit 1 d sck frequency f sck 1/2048 1 / 2 1 1 see figure a-9. f bus 1 d sck period t sck 2 1 2048 t bus 2 d enable lead time t lead 1/2 t sck 3 d enable lag time t lag 1/2 t sck 4 d clock (sck) high or low time t wsck 1/2 t sck 5 d data setup time (inputs) t su 8 ns 6 d data hold time (inputs) t hi 8 ns 9 d data valid after sck edge t vsck 15 ns 10 d data valid after ss fall (cpha = 0) t vss 15 ns 11 d data hold time (outputs) t ho 0 ns 12 d rise and fall time inputs t r 8 ns 13 d rise and fall time outputs t rfo 8 ns 1/2 1/4 f sck /f bus f bus [mhz] 10 20 30 40 15 25 35 5 appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1242 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.7.2.2 slave mode in figure a-10 the timing diagram for slave mode with transmission format cpha = 0 is depicted. figure a-10. spi slave timing (cpha = 0) in figure a-11 the timing diagram for slave mode with transmission format cpha = 1 is depicted. figure a-11. spi slave timing (cpha = 1) sck (input) sck (input) mosi (input) miso (output) ss (input) 1 9 5 6 msb in bit msb-1 . . . 1 lsb in slave msb slave lsb out bit msb-1. . . 1 11 4 4 2 7 (cpol = 0) (cpol = 1) 3 13 note: not de?ed 12 12 11 see 13 note 8 10 see note sck (input) sck (input) mosi (input) miso (output) 1 5 6 msb in bit msb-1 . . . 1 lsb in msb out slave lsb out bit msb-1 . . . 1 4 4 9 12 13 11 (cpol = 0) (cpol = 1) ss (input) 2 12 13 3 note: not de?ed slave 7 8 see note appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1243 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 in table a-29 the timing characteristics for slave mode are listed. table a-29. spi slave mode timing characteristics num c characteristic symbol min typ max unit 1 d sck frequency f sck dc 1 / 4f bus 1 d sck period t sck 4 t bus 2 d enable lead time t lead 4 t bus 3 d enable lag time t lag 4 t bus 4 d clock (sck) high or low time t wsck 4 t bus 5 d data setup time (inputs) t su 8 ns 6 d data hold time (inputs) t hi 8 ns 7 d slave access time (time to data active) t a 20 ns 8 d slave miso disable time t dis 22 ns 9 d data valid after sck edge t vsck 28 + 0.5 ? t bus 1 1 0.5 t bus added due to internal synchronization delay ns 10 d data valid after ss fall t vss 28 + 0.5 ? t bus 1 ns 11 d data hold time (outputs) t ho 20 ns 12 d rise and fall time inputs t r 8 ns 13 d rise and fall time outputs t rfo 8 ns appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1244 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.7.3 external bus timing the following conditions are assumed for all following external bus timing values: crystal input within 45% to 55% duty equal 25 pf load on all pins pad full drive (reduced drive must be off) a.7.3.1 normal expanded mode (external wait feature disabled) figure a-12. example 1a: normal expanded mode ?read followed by write csx addrx re datax addr1 addr2 (read) data1 (write) data2 we ew ait uds, lds 1 3 5 6 7 1 9 8 10 11 2 4 appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1245 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-30. example 1a: normal expanded mode timing 50 mhz bus (ewait disabled) no. characteristic symbol v dd5 =5.0v v dd5 =3.3v unit c min max c min max - frequency of internal bus f i - d.c. 50.0 - d.c. 25.0 mhz - internal cycle time t cyc -20 -40 ns - frequency of external bus f o - d.c. 25.0 - d.c. 12.5 mhz 1 external cycle time (selected by exstr) t cyce -40 -80 ns 2 address 1 valid to re fall 1 includes the following signals: addrx, uds, lds, and csx. t adre d 4 - d 13 - ns 3 pulse width, re pw re d28 - d58 - ns 4 address valid to we fall t adwe d 4 - d 15 - ns 5 pulse width, we pw we d18 - d38 - ns 6 read data setup time (if ithrs = 0) t dsr d19 - d38 - ns read data setup time (if ithrs = 1) t dsr d 23 - d n/a ns 7 read data hold time t dhr d0 - d0 - ns 8 read enable access time t accr d4 - d4 - ns 9 write data valid to we fall t wdwe d5 - d5 - ns 10 write data setup time t dsw d23 - d43 - ns 11 write data hold time t dhw d6 - d4 - ns appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1246 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.7.3.2 normal expanded mode (external wait feature enabled) figure a-13. example 1b: normal expanded mode ?stretched read access csx addrx re datax addr1 (read) data1 we ew ait uds, lds 3 6 7 1 8 2 addr2 12 13 appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1247 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure a-14. example 1b: normal expanded mode ?stretched write access table a-31. example 1b: normal expanded mode timing at 50mhz bus (ewait enabled) no. characteristic symbol v dd5 = 5.0v v dd5 = 3.3v unit c 2 stretch cycles 3 stretch cycles c 2 stretch cycles 3 stretch cycles min max min max min max min max - frequency of internal bus f i - d.c. 50.0 d.c. 50.0 - d.c. 25.0 d.c. 25.0 mhz - internal cycle time t cyc -20 20 -20 20 ns - frequency of external bus f o - d.c. 16.7 d.c. 12.5 - d.c. 8.33 d.c. 6.25 mhz csx addrx re datax (write) data1 we ew ait uds, lds 5 1 9 10 11 4 addr1 addr2 12 13 appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1248 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 - external cycle time (selected by exstr) t cyce -60 80 - 120 160 ns 1 external cycle time (exstr+1ewait) t cycew -80 100 - 160 200 ns 2 address 1 valid to re fall t adre d 4 - 4 - d 13 - 13 - ns 3 pulse width, re 2 pw re d 68 - 88 - d 138 - 178 - ns 4 address valid to we fall t adwe d 4 - 4 - d 15 - 15 - ns 5 pulse width, we pw we d 58 - 78 - d 118 - 158 - ns 6 read data setup time (if ithrs = 0) t dsr d 19 - 19 - d 38 - 38 - ns read data setup time (if ithrs = 1) t dsr d 23 - 23 - d n/a ns 7 read data hold time t dhr d0-0-d0-0-ns 8 read enable access time t accr d 49 - 69 - d 65 - 105 - ns 9 write data valid to we fall t wdwe d5-5-d5-5-ns 10 write data setup time t dsw d 63 - 93 - d 123 - 163 - ns 11 write data hold time t dhw d6-6-d4-4-ns 12 address to ew ait fall t adwf d016036d0200 -ns 13 address to ew ait rise t adwr d 30 39 50 58 d 50 61 90 101 ns 1 includes the following signals: addrx, uds, lds, and csx. 2 affected by ew ait. table a-31. example 1b: normal expanded mode timing at 50mhz bus (ewait enabled) no. characteristic symbol v dd5 = 5.0v v dd5 = 3.3v unit c 2 stretch cycles 3 stretch cycles c 2 stretch cycles 3 stretch cycles min max min max min max min max appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1249 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.7.3.3 emulation single-chip mode (without wait states) figure a-15. example 2a: emulation single-chip mode ?read followed by write eclk r/ w datax addr1 ivd0 addr2 ivd1 (read) data1 (write) data2 addr3 lstrb eclk2x 1 1 2 3 4 5 6 7 8 9 10 11 12 12 addr1 acc1 addr2 acc2 addr3 data0 addr1 addr2 addr3 iqstat0 iqstat1 addr addr [19:16]/ addr [22:20]/ [15:0]/ acc [2:0] iqstat [3:0] ivd [15:0] appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1250 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-32. example 2a: emulation single-chip mode timing 50 mhz bus, v dd5 =5.0v (ewait disabled) no. c characteristic 1 1 typical supply and silicon, room temperature only symbol min max unit - - frequency of internal bus f i d.c. 50.0 mhz 1 - cycle time t cyc 20 ns 2 d pulse width, e high pw eh 9-ns 3 d pulse width, e low pw el 9-ns 4 d address delay time t ad -5ns 5 d address hold time t ah 0-ns 6 d ivdx delay time 2 2 includes also accx, iqstatx t ivdd - 4.5 ns 7 d ivdx hold time t ivdh 0-ns 8 d read data setup time (ithrs = 1 only) t dsr 15 - ns 9 d read data hold time t dhr 0-ns 10 d write data delay time t ddw -5ns 11 d write data hold time t dhw 0-ns 12 d read/write data delay time 3 3 includes lstrb t rwd -1 5 ns appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1251 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.7.3.4 emulation expanded mode (with optional access stretching) figure a-16. example 2b: emulation expanded mode ?read with 1 stretch cycle eclk addr r/ w datax lstrb eclk2x 1 2 3 4 5 6 8 9 12 12 addr [19:16]/ (read) data1 7 data0 addr1 ? addr1 addr2 addr1 iqstat0 addr1 addr2 addr [22:20]/ addr1 acc1 addr1 000 addr2 [15:0]/ iqstat1 acc [2:0] iqstat [3:0] ivd [15:0] ivd1 appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1252 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure a-17. example 2b: emulation expanded mode ?write with 1 stretch cycle eclk r/ w datax (write) data1 lstrb eclk2x 11 10 1 2 3 4 5 6 7 12 12 addr1 ? addr1 x addr2 addr1 iqstat0 addr1 addr2 addr1 acc1 addr1 000 addr2 iqstat1 addr addr [19:16]/ addr [22:20]/ [15:0]/ acc [2:0] iqstat [3:0] ivd [15:0] appendix a electrical characteristics mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1253 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table a-33. example 2b: emulation expanded mode timing 50 mhz bus, v dd5 =5.0v (ewait disabled) no. c characteristic 1 1 typical supply and silicon, room temperature only symbol 1 stretch cycle 2 stretch cycles 3 stretch cycles unit min max min max min max - - internal cycle time t cyc 20 20 20 ns 1 - cycle time t cyce 40 60 80 ns 2 d pulse width, e high pw eh 911911911ns 3 d e falling to sampling e rising t efsr 28 32 48 52 68 72 ns 4 d address delay time t ad refer to table table a-32 refer to table table a-32 refer to table table a-32 ns 5 d address hold time t ah ns 6 d ivd delay time 2 2 includes also accx, iqstatx t ivdd ns 7 d ivd hold time t ivdh ns 8 d read data setup time t dsr ns 9 d read data hold time t dhr ns 10 d write data delay time t ddw ns 11 d write data hold time t dhw ns 12 d read/write data delay time 3 3 includes lstrb t rwd ns appendix a electrical characteristics mc9s12xe-family reference manual , rev. 1.21 1254 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 a.7.3.5 external tag trigger timing figure a-18. external trigger timing table a-34. external tag trigger timing v dd35 = 5.0 v no. c characteristic 1 1 typical supply and silicon, room temperature only symbol min max unit - d frequency of internal bus f i d.c. 50.0 mhz 1 d cycle time t cyc 20 ns 2d t a ghi/ t a glo setup time t ts 10 ns 3d t a ghi/ t a glo hold time t th 0 ns eclk r/ w datax t a ghi/ t a glo 2 3 data addr addr 1 appendix b package information mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1255 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix b package information this section provides the physical dimensions of the packages. appendix b package information mc9s12xe-family reference manual , rev. 1.21 1256 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 b.1 208 mapbga figure b-1. 208mapbga mechanical dimensions b.2 144-pin lqfp k m m e d 0.2 4x x laser mark for pin a1 identification in this area a b c d e f g h j k l m n p r t 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 15x e x s 0.3 m y xz 0.1 m z 208x b 3 metalized mark for pin a1 identification in this area 15x e s view m m view k (rotated 90 clockwise) 0.2 z 5 0.2 208x z z 4 a a1 a2 case 1159a-01 issue b date 12/12/98 dim min max millimeters a --- 2.00 a1 0.40 0.60 a2 1.00 1.30 b 0.50 0.70 d 17.00 bsc e 17.00 bsc e 1.00 bsc s 0.50 bsc notes: 1. 2. 3. 4. 5. all dimensions are in millimeters. interpret dimensions and tolerances per asme y14.5m, 1994. dimension b is measured at the maximum solder ball diameter, parallel to datum plane z. datum z (seating plane) is defined by the spherical crowns of the solder balls. parallelism measement shall exclude any effect of mark on top surface of package. appendix b package information mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1257 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure b-2. 144-pin lqfp mechanical dimensions (case no. 918-03) n 0.20 t l-m 144 gage plane 73 109 37 seating 108 1 36 72 plane 4x 4x 36 tips pin 1 ident view y b b1 v1 a1 s1 v p g a s 0.1 c 2 view ab j1 j1 140x 4x view y plating f aa j d base metal section j1-j1 (rotated 90 ) 144 pl n 0.08 m t l-m dim a min max 20.00 bsc millimeters a1 10.00 bsc b 20.00 bsc b1 10.00 bsc c 1.40 1.60 c1 0.05 0.15 c2 1.35 1.45 d 0.17 0.27 e 0.45 0.75 f 0.17 0.23 g 0.50 bsc j 0.09 0.20 k 0.50 ref p 0.25 bsc r1 0.13 0.20 r2 0.13 0.20 s 22.00 bsc s1 11.00 bsc v 22.00 bsc v1 11.00 bsc y 0.25 ref z 1.00 ref aa 0.09 0.16 0 07 11 13 1 2 notes: 1. dimensions and tolerancing per asme y14.5m, 1994. 2. dimensions in millimeters. 3. datums l, m, n to be determined at the seating plane, datum t. 4. dimensions s and v to be determined at seating plane, datum t. 5. dimensions a and b do not include mold protrusion. allowable protrusion is 0.25 per side. dimensions a and b do include mold mismatch and are determined at datum plane h. 6. dimension d does not include dambar protrusion. allowable dambar protrusion shall not cause the d dimension to exceed 0.35. 0.05 c l (z) r2 e c2 (y) r1 (k) c1 1 0.25 view ab n 0.20 t l-m m l n 2 t t 144x x appendix b package information mc9s12xe-family reference manual , rev. 1.21 1258 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 b.3 112-pin lqfp package figure b-3. 112-pin lqfp mechanical dimensions (case no. 987) dim a min max 20.000 bsc millimeters a1 10.000 bsc b 20.000 bsc b1 10.000 bsc c --- 1.600 c1 0.050 0.150 c2 1.350 1.450 d 0.270 0.370 e 0.450 0.750 f 0.270 0.330 g 0.650 bsc j 0.090 0.170 k 0.500 ref p 0.325 bsc r1 0.100 0.200 r2 0.100 0.200 s 22.000 bsc s1 11.000 bsc v 22.000 bsc v1 11.000 bsc y 0.250 ref z 1.000 ref aa 0.090 0.160 11 11 13 7 13 view y l-m 0.20 n t 4x 4x 28 tips pin 1 ident 1 112 85 84 28 57 29 56 b v v1 b1 a1 s1 a s view ab 0.10 3 c c2 2 0.050 seating plane gage plane 1 view ab c1 (z) (y) e (k) r2 r1 0.25 j1 view y j1 p g 108x 4x section j1-j1 base rotated 90 counterclockwise metal j aa f d l-m m 0.13 n t 1 2 3 c l l-m 0.20 n t l n m t t 112x x x=l, m or n r r notes: 1. dimensioning and tolerancing per asme y14.5m, 1994. 2. dimensions in millimeters. 3. datums l, m and n to be determined at seating plane, datum t. 4. dimensions s and v to be determined at seating plane, datum t. 5. dimensions a and b do not include mold protrusion. allowable protrusion is 0.25 per side. dimensions a and b include mold mismatch. 6. dimension d does not include dambar protrusion. allowable dambar protrusion shall not cause the d dimension to exceed 0.46. 8 0 0 appendix b package information mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1259 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 b.4 80-pin qfp package figure b-4. 80-pin qfp mechanical dimensions (case no. 841b) notes: 1. dimensioning and tolerancing per ansi y14.5m, 1982. 2. controlling dimension: millimeter. 3. datum plane -h- is located at bottom of lead and is coincident with the lead where the lead exits the plastic body at the bottom of the parting line. 4. datums -a-, -b- and -d- to be determined at datum plane -h-. 5. dimensions s and v to be determined at seating plane -c-. 6. dimensions a and b do not include mold protrusion. allowable protrusion is 0.25 per side. dimensions a and b do include mold mismatch and are determined at datum plane -h-. 7. dimension d does not include dambar protrusion. allowable dambar protrusion shall be 0.08 total in excess of the d dimension at maximum material condition. dambar cannot be located on the lower radius or the foot. section b-b 61 60 detail a l 41 40 80 -a- l -d- a s a-b m 0.20 d s h 0.05 a-b s 120 21 -b- b v j f n d view rotated 90 detail a b b p -a-,-b-,-d- e h g m m detail c seating plane -c- c datum plane 0.10 -h- datum plane -h- u t r q k w x detail c dim min max millimeters a 13.90 14.10 b 13.90 14.10 c 2.15 2.45 d 0.22 0.38 e 2.00 2.40 f 0.22 0.33 g 0.65 bsc h --- 0.25 j 0.13 0.23 k 0.65 0.95 l 12.35 ref m 510 n 0.13 0.17 p 0.325 bsc q 07 r 0.13 0.30 s 16.95 17.45 t 0.13 --- u 0 --- v 16.95 17.45 w 0.35 0.45 x 1.6 ref s a-b m 0.20 d s c s a-b m 0.20 d s h 0.05 d s a-b m 0.20 d s c s a-b m 0.20 d s c appendix c pcb layout guidelines mc9s12xe-family reference manual , rev. 1.21 1260 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix c pcb layout guidelines the pcb must be carefully laid out to ensure proper operation of the voltage regulator as well as of the mcu itself. the following rules must be observed: every supply pair must be decoupled by a ceramic capacitor connected as near as possible to the corresponding pins . central point of the ground star should be the vss3 pin. use low ohmic low inductance connections between vss1, vss2 and vss3. vsspll must be directly connected to vss3. keep traces of vsspll, extal, and xtal as short as possible and occupied board area for c7, c8, and q1 as small as possible. do not place other signals or supplies underneath area occupied by c7, c8, and q1 and the connection area to the mcu. central power input should be fed in at the vdda/vssa pins. example layouts are illustrated on the following pages. appendix c pcb layout guidelines mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1261 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table c-1. recommended decoupling capacitor choice component purpose type value c1 v ddf ?ter capacitor ceramic x7r 220 nf c2 v ddx4 ?ter capacitor (mapbga208, lqfp144 only x7r/tantalum >=100 nf c3 v ddx2 ?ter capacitor x7r/tantalum >=100 nf c4 v ddpll ?ter capacitor ceramic x7r 220 nf c5 osc load capacitor from crystal manufacturer c6 osc load capacitor c7 v ddr ?ter capacitor x7r/tantalum >=100 nf c8 v ddx3 ?ter capacitor (mapbga208, lqfp144 only x7r/tantalum >=100 nf c9 v dd ?ter capacitor ceramic x7r 220 nf c10 v dda1 ?ter capacitor ceramic x7r >=100 nf c11 v ddx1 ?ter capacitor x7r/tantalum >=100 nf c12 v ddx5 ?ter capacitor (mapbga208 package only) x7r/tantalum >=100 nf c13 v ddx6 ?ter capacitor (mapbga208 package only) x7r/tantalum >=100 nf c14 v ddx7 ?ter capacitor (mapbga208 package only) x7r/tantalum >=100 nf c15 v dda2 ?ter capacitor(mapbga208 package only) ceramic x7r >=100 nf q1 quartz appendix c pcb layout guidelines mc9s12xe-family reference manual , rev. 1.21 1262 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure c-1. 144-pin lqfp recommended pcb layout (loop controlled pierce oscillator) appendix c pcb layout guidelines mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1263 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure c-2. 112-pin lqfp recommended pcb layout (loop controlled pierce oscillator) appendix c pcb layout guidelines mc9s12xe-family reference manual , rev. 1.21 1264 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 figure c-3. 80-pin qfp recommended pcb layout (loop controlled pierce oscillator) appendix d derivative differences mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1265 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix d derivative differences d.1 memory sizes and package options s12xe - family table d-1. package and memory options of mc9s12xe-family device package flash ram eeprom d-flash 9s12xep100 208 mapbga 1m 64k 4k 32k 144 lqfp 112 lqfp 9s12xep768 208 mapbga 768k 48k 144 lqfp 112 lqfp 9s12xeq512 144 lqfp 512k 32k 112 lqfp 80 qfp 9s12xeq384 9s12xeg384 144 lqfp 384k 24k 112 lqfp 80 qfp 9s12xes384 144 lqfp 384k 16k 112 lqfp 80 qfp 9s12xet256 9s12xea256 1 1 the 9s12xea128/256 are a special bondouts for access to extra adc channels in 80qfp.available in 80qfp / 256k/128k memory sizes only. warning: not pin-compatible with rest of family. the 9s12xet256/9s12xeg128 use the standard 80qfp bondout, compatible with other family members. 144 lqfp 256k 16k 112 lqfp 80 qfp 9s12xeg128 9s12xea128 1 112 lqfp 128k 12k 2k 32k 80 qfp appendix d derivative differences mc9s12xe-family reference manual , rev. 1.21 1266 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 table d-2. peripheral options of mc9s12xe-family members device package xgate can sci spi iic ect tim 1 1 tim available via rerouting on ep100,ep768 devices 112/144 pinout options. tim not available on eg128,et256,ea256, eq384,eq512 devices. pit a/d i/o 9s12xep100 208 mapbga yes 5 8 3 2 8ch 8ch 8ch 2/32 152 144lqfp 5 8 3 2 8ch 8ch 8ch 2/24 119 112lqfp 5 8 3 1 8ch 8ch 8ch 2/16 2 91 9s12xep768 208 mapbga 5 8 3 2 8ch 8ch 8ch 2/32 152 144lqfp 5 8 3 2 8ch 8ch 8ch 2/24 119 112lqfp 5 8 3 1 8ch 8ch 8ch 2/16 2 2 the device features 2 16-channel atd modules, only one of which is bonded out in this package option 91 9s12xeq512 144lqfp 4 6 3 2 8ch 0 4ch 2/24 119 112lqfp 4 6 3 1 8ch 0 4ch 2/16 2 91 80qfp 4 2 3 1 8ch 0 4ch 2/8 2 59 9s12xeq384 144lqfp 4 6 3 2 8ch 0 4ch 2/24 119 112lqfp 4 6 3 1 8ch 0 4ch 2/16 2 91 80qfp 4 2 3 1 8ch 0 4ch 2/8 2 59 9s12xeg384 144lqfp 2 6 3 2 8ch 0 4ch 2/24 119 112lqfp 2 6 3 1 8ch 0 4ch 2/16 2 91 80qfp 2 2 3 1 8ch 0 4ch 2/8 2 59 9s12xes384 144lqfp no 1 2 1 2 8ch 0 4ch 2/24 119 112lqfp 1 2 1 1 8ch 0 4ch 2/16 2 91 80qfp 1 2 1 1 8ch 0 4ch 2/8 2 59 9s12xet256 144lqfp yes 3 4 3 1 8ch 0 4ch 2/24 119 112lqfp 3 4 3 1 8ch 0 4ch 2/16 2 91 80qfp 3 2 3 1 8ch 0 4ch 2/8 2 59 9s12xea256 3 3 this is a special bondout for access to extra adc channels in 80qfp. warning: not pin-compatible with rest of family. the 9s12xet256/9s12xeg128 use the standard 80qfp bondouts, compatible with other family members. 80qfp 3 2 3 1 8ch 0 4ch 2/12 2 59 9s12xeg128 112lqfp 2 2 2 1 8ch 0 2ch 1/16 91 80qfp 2 2 2 1 8ch 0 2ch 1/8 59 9s12xea128 3 80qfp 2 2 2 1 8ch 0 2ch 2/12 2 59 appendix d derivative differences mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1267 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 d.2 pinout explanations: pinout compatibility is maintained throughout the device family a/d is the number of modules/total number of a/d channels. i/o is the sum of ports capable to act as digital input or output. . for additional flexibility especially for the low pin count packages several i/o functions can be routed under software control to different pins. for details refer to the device overview section.. versions with 5 can modules will have can0, can1, can2, can3 and can4. versions with 4 can modules will have can0, can1, can2 and can4. versions with 3 can modules will have can0, can1 and can4. versions with 2 can modules will have can0 and can4. versions with 1 can module will have can0. versions with 3 spi modules will have spi0, spi1 and spi2. versions with 2 spi modules will have spi0 and spi1. versions with 1 spi modules will have spi0. versions with 8 sci modules will have sci0, sci1, sci2, sci3, sci4, sci5, sci6 and sci7. versions with 7 sci modules will have sci0, sci1, sci2, sci3, sci4, sci5, and sci6. versions with 6 sci modules will have sci0, sci1, sci2, sci3, sci4 and sci5. versions with 5 sci modules will have sci0, sci1, sci2, sci3 and sci4. versions with 4 sci modules will have sci0, sci1, sci2 and sci4. versions with 3 sci modules will have sci0, sci1 and sci2. versions with 2 sci modules will have sci0 and sci1. versions with 1 sci module will have sci0. versions with 2 iic modules will have iic0 and iic1. versions with 1 iic module will have iic0. versions with 1 atd module will have atd0. appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1268 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix e detailed register address map the following tables show the detailed register map of the s12xe-family. note smaller derivatives within the s12xe-family feature a subset of the listed modules. refer to appendix d derivative differences for more information about derivative device module subsets. 0x0000?x0009 port integration module (pim) map 1 of 6 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0000 porta r pa7 pa6 pa5 pa4 pa3 pa2 pa1 pa 0 w 0x0001 portb r pb7 pb6 pb5 pb4 pb3 pb2 pb1 pb0 w 0x0002 ddra r ddra7 ddra6 ddra5 ddra4 ddra3 ddra2 ddra1 ddra0 w 0x0003 ddrb r ddrb7 ddrb6 ddrb5 ddrb4 ddrb3 ddrb2 ddrb1 ddrb0 w 0x0004 portc r pc7 pc6 pc5 pc4 pc3 pc2 pc1 pc0 w 0x0005 portd r pd7 pd6 pd5 pd4 pd3 pd2 pd1 pd0 w 0x0006 ddrc r ddrc7 ddrc6 ddrc5 ddrc4 ddrc3 ddrc2 ddrc1 ddrc0 w 0x0007 ddrd r ddrd7 ddrd6 ddrd5 ddrd4 ddrd3 ddrd2 ddrd1 ddrd0 w 0x0008 porte r pe7 pe6 pe5 pe4 pe3 pe2 pe1 pe0 w 0x0009 ddre r ddre7 ddre6 ddre5 ddre4 ddre3 ddre2 00 w 0x000a?x000b module mapping control (s12xmmc) map 1 of 2 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x000a mmcctl0 r cs3e1 cs2e1 cs1e1 cs0e1 cs3e0 cs2e0 cs1e0 cs0e0 w 0x000b mode r modc modb moda 00000 w 0x000c?x000d port integration module (pim) map 2 of 6 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x000c pucr r pupke bkpue 0 pupee pupde pupce pupbe pupae w 0x000d rdriv r rdpk 00 rdpe rdpd rdpc rdpb rdpa w appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1269 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x000e?x000f external bus interface (s12xebi) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x000e ebictl0 r ithrs 0 hdbe asiz4 asiz3 asiz2 asiz1 asiz0 w 0x000f ebictl1 r0 exstr12 exstr11 exstr10 0 exstr02 exstr01 exstr00 w 0x0010?x0017 module mapping control (s12xmmc) map 2 of 2 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0010 gpage r0 gp6 gp5 gp4 gp3 gp2 gp1 gp0 w 0x0011 direct r dp15 dp14 dp13 dp12 dp11 dp10 dp9 dp8 w 0x0012 reserved r00000000 w 0x0013 mmcctl1 r tgmram on mgromo n eeeifro n pgmifro n ramhm eromon romhm romon w 0x0014 reserved r00000000 w 0x0015 ppage r pix7 pix6 pix5 pix4 pix3 pix2 pix1 pix0 w 0x0016 rpage r rp7 rp6 rp5 rp4 rp3 rp2 rp1 rp0 w 0x0017 epage r ep7 ep6 ep5 ep4 ep3 ep2 ep1 ep0 w 0x0018?x001b miscellaneous peripheral address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0018 reserved r00000000 w 0x0019 reserved r00000000 w 0x001a partidh 1 1 refer to part id assignments in the device description section for a full list of s12xe-familypart id values. r11001100 w 0x001b partidl 1 r10010010 w 0x001c?x001d port integration module (pim) map 3 of 6 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x001c eclkctl r neclk nclkx2 div16 ediv4 ediv3 ediv2 ediv1 ediv0 w 0x001d reserved r00000000 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1270 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x001e?x001f port integration module (pim) map 3 of 6 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x001e irqcr r irqe irqen 000000 w 0x001f reserved r00000000 w 0x0020?x0027 debug module (s12xdbg) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0020 dbgc1 r arm 0 xgsbpe bdm dbgbrk comrv w trig 0x0021 dbgsr r tbf extf 0 0 0 ssf2 ssf1 ssf0 w 0x0022 dbgtcr r tsource trange trcmod talign w 0x0023 dbgc2 r0 0 0 0 cdcm abcm w 0x0024 dbgtbh r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x0025 dbgtbl r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x0026 dbgcnt r 0 cnt w 0x0027 dbgscrx r0 0 0 0 sc3 sc2 sc1 sc0 w 0x0027 dbgmfr r 0 0 0 0 mc3 mc2 mc1 mc0 w 0x0028 1 1 this represents the contents if the comparator a or c control register is blended into this address dbgxctl (compa/c) r0 ndb tag brk rw rwe src compe w 0x0028 2 2 this represents the contents if the comparator b or d control register is blended into this address dbgxctl (compb/d) r sze sz tag brk rw rwe src compe w 0x0029 dbgxah r0 bit 22 21 20 19 18 17 bit 16 w 0x002a dbgxam r bit 15 14 13 12 11 10 9 bit 8 w 0x002b dbgxal r bit 7 6 54321 bit 0 w 0x002c dbgxdh r bit 15 14 13 12 11 10 9 bit 8 w 0x002d dbgxdl r bit 7 6 54321 bit 0 w 0x002e dbgxdhm r bit 15 14 13 12 11 10 9 bit 8 w 0x002f dbgxdlm r bit 7 6 54321 bit 0 w appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1271 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0030?x0031 reserved register space 0x0030 reserved r00000000 w 0x0031 reserved r00000000 w 0x0032?x0033 port integration module (pim) map 4 of 6 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0032 portk r pk7 pk6 pk5 pk4 pk3 pk2 pk1 pk0 w 0x0033 ddrk r ddrk7 ddrk6 ddrk5 ddrk4 ddrk3 ddrk2 ddrk1 ddrk0 w 0x0034?x003f clock and reset generator (crg) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0034 synr r vcofrq[1:0] syndiv5 syndiv4 syndiv3 syndiv2 syndiv1 syndiv0 w 0x0035 refdv r reffrq[1:0] refdiv5 refdiv4 refdiv3 refdiv2 refdiv1 refdiv0 w 0x0036 postdiv r 000 postdiv[4:0]] w 0x0037 crgflg r rtif porf lvrf lockif lock ilaf scmif scm w 0x0038 crgint r rtie 00 lockie 00 scmie 0 w 0x0039 clksel r pllsel pstp xclks 0 pllwai 0 rtiwai copwai w 0x003a pllctl r cme pllon fm1 fm0 fstwkp pre pce scme w 0x003b rtictl r rtdec rtr6 rtr5 rtr4 rtr3 rtr2 rtr1 rtr0 w 0x003c copctl r wcop rsbck 000 cr2 cr1 cr0 w wrtmask 0x003d forbyp r00000000 w reserved for factory test 0x003e ctctl r0000 000 w reserved for factory test 0x003f armcop r00000000 w bit 7 6 54321 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1272 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0040?x007f enhanced capture timer 16-bit 8-channels (ect) map (sheet 1 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0040 tios r ios7 ios6 ios5 ios4 ios3 ios2 ios1 ios0 w 0x0041 cforc r00000000 w foc7 foc6 foc5 foc4 foc3 foc2 foc1 foc0 0x0042 oc7m r oc7m7 oc7m6 oc7m5 oc7m4 oc7m3 oc7m2 oc7m1 oc7m0 w 0x0043 oc7d r oc7d7 oc7d6 oc7d5 oc7d4 oc7d3 oc7d2 oc7d1 oc7d0 w 0x0044 tcnt (high) r tcnt15 tcnt14 tcnt13 tcnt12 tcnt11 tcnt10 tcnt9 tcnt8 w 0x0045 tcnt (low) r tcnt7 tcnt6 tcnt5 tcnt4 tcnt3 tcnt2 tcnt1 tcnt0 w 0x0046 tscr1 r ten tswai tsfrz tffca prnt 000 w 0x0047 ttov r tov7 tov6 tov5 tov4 tov3 tov2 tov1 tov0 w 0x0048 tctl1 r om7 ol7 om6 ol6 om5 ol5 om4 ol4 w 0x0049 tctl2 r om3 ol3 om2 ol2 om1 ol1 om0 ol0 w 0x004a tctl3 r edg7b edg7a edg6b edg6a edg5b edg5a edg4b edg4a w 0x004b tctl4 r edg3b edg3a edg2b edg2a edg1b edg1a edg0b edg0a w 0x004c tie r c7i c6i c5i c4i c3i c2i c1i c0i w 0x004d tscr2 r toi 000 tcre pr2 pr1 pr0 w 0x004e tflg1 r c7f c6f c5f c4f c3f c2f c1f c0f w 0x004f tflg2 r tof 0000000 w 0x0050 tc0 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x0051 tc0 (lo) r bit 7 6 54321 bit 0 w 0x0052 tc1 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x0053 tc1 (lo) r bit 7 6 54321 bit 0 w 0x0054 tc2 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x0055 tc2 (lo) r bit 7 6 54321 bit 0 w appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1273 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0056 tc3 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x0057 tc3 (lo) r bit 7 6 54321 bit 0 w 0x0058 tc4 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x0059 tc4 (lo) r bit 7 6 54321 bit 0 w 0x005a tc5 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x005b tc5 (lo) r bit 7 6 54321 bit 0 w 0x005c tc6 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x005d tc6 (lo) r bit 7 6 54321 bit 0 w 0x005e tc7 (hi) r bit 15 14 13 12 11 10 9 bit 8 w 0x005f tc7 (lo) r bit 7 6 54321 bit 0 w 0x0060 pactl r0 paen pamod pedge clk1 clk0 paovi pai w 0x0061 paflg r000000 paovf paif w 0x0062 pacn3 (hi) r pacnt7 (15) pacnt6 (14) pacnt5 (13) pacnt4 (12) pacnt3 (11) pacnt2 (10) pacnt1 (9) pacnt0 (8) w 0x0063 pacn2 (lo) r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w 0x0064 pacn1 (hi) r pacnt7 (15) pacnt6 (14) pacnt5 (13) pacnt4 (12) pacnt3 (11) pacnt2 (10) pacnt1 (9) pacnt0 (8) w 0x0065 pacn0 (lo) r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w 0x0066 mcctl r mczi modmc rdmcl 00 mcen mcpr1 mcpr0 w iclat flmc 0x0067 mcflg r mczf 0 0 0 polf3 polf2 polf1 polf0 w 0x0068 icpar r0 0 0 0 pa3en pa2en pa1en pa0en w 0x0069 dlyct r dly7 dly6 dly5 dly4 dly3 dly2 dly1 dly0 w 0x006a icovw r novw7 novw6 novw5 novw4 novw3 novw2 novw1 novw0 w 0x006b icsys r sh37 sh26 sh15 sh04 tfmod pacmx bufen latq w 0x006c ocpd r ocpd7 ocpd6 ocpd5 ocpd4 ocpd3 ocpd2 ocpd1 ocpd0 w 0x0040?x007f enhanced capture timer 16-bit 8-channels (ect) map (sheet 2 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1274 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x006d timtst r00000000 w reserved for factory test 0x006e ptpsr r ptps7 ptps6 ptps5 ptps4 ptps3 ptps2 ptps1 ptps0 w 0x006f ptmcpsr r ptmps7 ptmps6 ptmps5 ptmps4 ptmps3 ptmps2 ptmps1 ptmps0 w 0x0070 pbctl r0 pben 0000 pbovi 0 w 0x0071 pbflg r000000 pbovf 0 w 0x0072 pa3h r pa3h7 pa3h6 pa3h5 pa3h4 pa3h3 pa3h2 pa3h1 pa3h0 w 0x0073 pa2h r pa2h7 pa2h6 pa2h5 pa2h4 pa2h3 pa2h2 pa2h1 pa2h0 w 0x0074 pa1h r pa1h7 pa1h6 pa1h5 pa1h4 pa1h3 pa1h2 pa1h1 pa1h 0 w 0x0075 pa0h r pa0h7 pa0h6 pa0h5 pa0h4 pa0h3 pa0h2 pa0h1 pa0h0 w 0x0076 mccnt (hi) r mccnt15 mccnt14 mccnt13 mccnt12 mccnt11 mccnt10 mccnt9 mccnt8 w 0x0077 mccnt (lo) r mccnt7 mccnt6 mccnt5 mccnt4 mccnt3 mccnt2 mccnt1 mccnt0 w 0x0078 tc0h (hi) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x0079 tc0h (lo) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w 0x007a tc1h (hi) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x007b tc1h (lo) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w 0x007c tc2h (hi) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x007d tc2h (lo) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w 0x007e tc3h (hi) r tc15 tc14 tc13 tc12 tc11 tc10 tc9 tc8 w 0x007f tc3h (lo) r tc7 tc6 tc5 tc4 tc3 tc2 tc1 tc0 w 0x0040?x007f enhanced capture timer 16-bit 8-channels (ect) map (sheet 3 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1275 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0080?x00af analog-to-digital converter 12-bit 16-channels (atd1) map (sheet 1 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0080 atd1ctl0 r0 0 0 0 wrap3 wrap2 wrap1 wrap0 w 0x0081 atd1ctl1 r etrig sel sres1 sres0 smp_dis etrig ch3 etrig ch2 etrig ch1 etrig ch0 w 0x0082 atd1ctl2 r0 affc iclkstp etrigle etrigp etrige ascie acmpie w 0x0083 atd1ctl3 r djm s8c s4c s2c s1c fifo frz1 frz0 w 0x0084 atd1ctl4 r smp2 smp1 smp0 prs4 prs3 prs2 prs1 prs0 w 0x0085 atd1ctl5 r0 sc scan mult cd cc cb ca w 0x0086 atd1stat0 r scf 0 etorf fifor cc3 cc2 cc1 cc0 w 0x0087 reserved r00000000 w 0x0088 atd1cmpeh r cmpe15 cmpe14 cmpe13 cmpe12 cmpe11 cmpe10 cmpe9 cmpe8 w 0x0089 atd1cmpel r cmpe7 cmpe6 cmpe5 cmpe4 cmpe3 cmpe2 cmpe1 cmpe0 w 0x008a atd1stat2h r ccf15 ccf14 ccf13 ccf12 ccf11 ccf10 ccf9 ccf8 w 0x008b atd1statl r ccf7 ccf6 ccf5 ccf4 ccf3 ccf2 ccf1 ccf0 w 0x008c atd1dienh r ien15 ien14 ien13 ien12 ien11 ien10 ien9 ien8 w 0x008d atd1dienl r ien7 ien6 ien5 ien4 ien3 ien2 ien1 ien0 w 0x008e atd1cmphth r cmpht15 cmpht14 cmpht13 cmpht12 cmpht11 cmpht10 cmpht9 cmpht8 w 0x008f atd1cmphtl r cmpht7 cmpht6 cmpht5 cmpht4 cmpht3 cmpht2 cmpht1 cmpht0 w 0x0090 atd1dr0h r bit15 14 13 12 11 10 9 bit8 w 0x0091 atd1dr0l r bit7 bit6 000000 w 0x0092 atd1dr1h r bit15 14 13 12 11 10 9 bit8 w 0x0093 atd1dr1l r bit7 bit6 000000 w 0x0094 atd1dr2h r bit15 14 13 12 11 10 9 bit8 w 0x0095 atd1dr2l r bit7 bit6 000000 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1276 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0096 atd1dr3h r bit15 14 13 12 11 10 9 bit8 w 0x0097 atd1dr3l r bit7 bit6 000000 w 0x0098 atd1dr4h r bit15 14 13 12 11 10 9 bit8 w 0x0099 atd1dr4l r bit7 bit6 000000 w 0x009a atd1dr5h r bit15 14 13 12 11 10 9 bit8 w 0x009b atd1dr5l r bit7 bit6 000000 w 0x009c atd1dr6h r bit15 14 13 12 11 10 9 bit8 w 0x009d atd1dr6l r bit7 bit6 000000 w 0x009e atd1dr7h r bit15 14 13 12 11 10 9 bit8 w 0x009f atd1dr7l r bit7 bit6 000000 w 0x00a0 atd1dr8h r bit15 14 13 12 11 10 9 bit8 w 0x00a1 atd1dr8l r bit7 bit6 000000 w 0x00a2 atd1dr9h r bit15 14 13 12 11 10 9 bit8 w 0x00a3 atd1dr9l r bit7 bit6 000000 w 0x00a4 atd1dr10h r bit15 14 13 12 11 10 9 bit8 w 0x00a5 atd1dr10l r bit7 bit6 000000 w 0x00a6 atd1dr11h r bit15 14 13 12 11 10 9 bit8 w 0x00a7 atd1dr11l r bit7 bit6 000000 w 0x00a8 atd1dr12h r bit15 14 13 12 11 10 9 bit8 w 0x00a9 atd1dr12l r bit7 bit6 000000 w 0x00aa atd1dr13h r bit15 14 13 12 11 10 9 bit8 w 0x00ab atd1dr13l r bit7 bit6 000000 w 0x0080?x00af analog-to-digital converter 12-bit 16-channels (atd1) map (sheet 2 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1277 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00ac atd1dr14h r bit15 14 13 12 11 10 9 bit8 w 0x00ad atd1dr14l r bit7 bit6 000000 w 0x00ae atd1dr15h r bit15 14 13 12 11 10 9 bit8 w 0x00af atd1dr15l r bit7 bit6 000000 w 0x0080?x00af analog-to-digital converter 12-bit 16-channels (atd1) map (sheet 3 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1278 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00b0?x00b7 inter ic bus (iic1) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00b0 ibad r adr7 adr6 adr5 adr4 adr3 adr2 adr1 0 w 0x00b1 ibfd r ibc7 ibc6 ibc5 ibc4 ibc3 ibc2 ibc1 ibc0 w 0x00b2 ibcr r iben ibie ms/ sl tx/ rx txak 00 ibswai w rsta 0x00b3 ibsr r tcf iaas ibb ibal 0srw ibif rxak w 0x00b4 ibdr r d7 d6 d5 d4 d3 d2 d1 d 0 w 0x00b5 ibcr2 r gcen adtype 000 adr10 adr9 adr8 w 0x00b6 reserved r00000000 w 0x00b7 reserved r00000000 w 0x00b8?x00bf asynchronous serial interface (sci2) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00b8 sci2bdh 1 1 those registers are accessible if the amap bit in the sci2sr2 register is set to zero r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x00b9 sci2bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x00ba sci2cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x00b8 sci2asr1 2 2 those registers are accessible if the amap bit in the sci2sr2 register is set to one r rxedgif 0000 berrv berrif bkdif w 0x00b9 sci2acr1 2 r rxedgie 00000 berrie bkdie w 0x00ba sci2acr2 2 r00000 berrm1 berrm0 bkdfe w 0x00bb sci2cr2 r tie tcie rie ilie te re rwu sbk w 0x00bc sci2sr1 r tdre tc rdrf idle or nf fe pf w 0x00bd sci2sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x00be sci2drh rr8 t8 000000 w 0x00bf sci2drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1279 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00c0?x00c7 asynchronous serial interface (sci3) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00c0 sci3bdh 1 1 those registers are accessible if the amap bit in the sci3sr2 register is set to zero r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x00c1 sci3bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x00c2 sci3cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x00c0 sci3asr1 2 2 those registers are accessible if the amap bit in the sci3sr2 register is set to one r rxedgif 0000 berrv berrif bkdif w 0x00c1 sci3acr1 2 r rxedgie 00000 berrie bkdie w 0x00c2 sci3acr2 2 r00000 berrm1 berrm0 bkdfe w 0x00c3 sci3cr2 r tie tcie rie ilie te re rwu sbk w 0x00c4 sci3sr1 r tdre tc rdrf idle or nf fe pf w 0x00c5 sci3sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x00c6 sci3drh rr8 t8 000000 w 0x00c7 sci3drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1280 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00c8?x00cf asynchronous serial interface (sci0) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00c8 sci0bdh 1 1 those registers are accessible if the amap bit in the sci0sr2 register is set to zero r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x00c9 sci0bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x00ca sci0cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x00c8 sci0asr1 2 2 those registers are accessible if the amap bit in the sci0sr2 register is set to one r rxedgif 0000 berrv berrif bkdif w 0x00c9 sci0acr1 2 r rxedgie 00000 berrie bkdie w 0x00ca sci0acr2 2 r00000 berrm1 berrm0 bkdfe w 0x00cb sci0cr2 r tie tcie rie ilie te re rwu sbk w 0x00cc sci0sr1 r tdre tc rdrf idle or nf fe pf w 0x00cd sci0sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x00ce sci0drh rr8 t8 000000 w 0x00cf sci0drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 0x00d0?x00d7 asynchronous serial interface (sci1) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00d0 sci1bdh 1 r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x00d1 sci1bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x00d2 sci1cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x00d0 sci1asr1 2 r rxedgif 0000 berrv berrif bkdif w 0x00d1 sci1acr1 2 r rxedgie 00000 berrie bkdie w 0x00d2 sci1acr2 2 r00000 berrm1 berrm0 bkdfe w 0x00d3 sci1cr2 r tie tcie rie ilie te re rwu sbk w 0x00d4 sci1sr1 r tdre tc rdrf idle or nf fe pf w appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1281 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00d5 sci1sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x00d6 sci1drh rr8 t8 000000 w 0x00d7 sci1drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 1 those registers are accessible if the amap bit in the sci1sr2 register is set to zero 2 those registers are accessible if the amap bit in the sci1sr2 register is set to one 0x00d8?x00df serial peripheral interface (spi0) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00d8 spi0cr1 r spie spe sptie mstr cpol cpha ssoe lsbfe w 0x00d9 spi0cr2 r0 xfrw 0 modfen bidiroe 0 spiswai spc0 w 0x00da spi0br r0 sppr2 sppr1 sppr0 0 spr2 spr1 spr0 w 0x00db spi0sr r spif 0 sptef modf 0 0 0 0 w 0x00dc spi0drh r r15 r14 r13 r12 r11 r10 r9 r8 w t15 t14 t13 t12 t11 t10 t9 t8 0x00dd spi0drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 0x00de reserved r00000000 w 0x00df reserved r00000000 w 0x00e0?x00e7 inter ic bus (iic0) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00e0 ibad r adr7 adr6 adr5 adr4 adr3 adr2 adr1 0 w 0x00e1 ibfd r ibc7 ibc6 ibc5 ibc4 ibc3 ibc2 ibc1 ibc0 w 0x00e2 ibcr r iben ibie ms/ sl tx/ rx txak 00 ibswai w rsta 0x00e3 ibsr r tcf iaas ibb ibal 0srw ibif rxak w 0x00e4 ibdr r d7 d6 d5 d4 d3 d2 d1 d 0 w 0x00d0?x00d7 asynchronous serial interface (sci1) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1282 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00e5 ibcr2 r gcen adtype 000 adr10 adr9 adr8 w 0x00e6 reserved r00000000 w 0x00e7 reserved r00000000 w 0x00e8?x00ef reserved address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00e8 reserved r00000000 w 0x00e9 reserved r00000000 w 0x00ea reserved r00000000 w 0x00eb reserved r 0 0 0 0 0 0 0 0 w 0x00ec reserved r0 0000000 w 0x00ed reserved r 0 0 0 0 0 0 0 0 w 0x00ee reserved r 0 0 0 0 0 0 0 0 w 0x00ef reserved r 0 0 0 0 0 0 0 0 w 0x00f0?x00f7 serial peripheral interface (spi1) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00f0 spi1cr1 r spie spe sptie mstr cpol cpha ssoe lsbfe w 0x00f1 spi1cr2 r0 xfrw 0 modfen bidiroe 0 spiswai spc0 w 0x00f2 spi1br r0 sppr2 sppr1 sppr0 0 spr2 spr1 spr0 w 0x00f3 spi1sr r spif 0 sptef modf 0 0 0 0 w 0x00f4 spi1drh r r15 r14 r13 r12 r11 r10 r9 r8 w t15 t14 t13 t12 t11 t10 t9 t8 0x00f5 spi1drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 0x00f6 reserved r00000000 w 0x00f7 reserved r00000000 w 0x00e0?x00e7 inter ic bus (iic0) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1283 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00f8?x00ff serial peripheral interface (spi2) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x00f8 spi2cr1 r spie spe sptie mstr cpol cpha ssoe lsbfe w 0x00f9 spi2cr2 r0 xfrw 0 modfen bidiroe 0 spiswai spc0 w 0x00fa spi2br r0 sppr2 sppr1 sppr0 0 spr2 spr1 spr0 w 0x00fb spi2sr r spif 0 sptef modf 0 0 0 0 w 0x00fc spi2drh r r15 r14 r13 r12 r11 r10 r9 r8 w t15 t14 t13 t12 t11 t10 t9 t8 0x00fd spi2drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 0x00fe reserved r00000000 w 0x00ff reserved r00000000 w 0x0100?x0113 nvm control register (ftm) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0100 fclkdiv r fdivld fdiv6 fdiv5 fdiv4 fdiv3 fdiv2 fdiv1 fdiv0 w 0x0101 fsec r keyen1 keyen0 rnv5 rnv4 rnv3 rnv2 sec1 sec0 w 0x0102 fccobix r00000 ccobix2 ccobix1 ccobix0 w 0x0103 feccrix r00000 eccrix2 eccrix1 eccrix0 w 0x0104 fcnfg r ccie 00 ignsf 00 fdfd fsfd w 0x0105 fercnfg r erserie pgmerie eacceie epviolie ersvie1 ersvie0 dfdie sfdie w 0x0106 fstat r ccif 0 accerr fpviol mgbusy rsvd mgstat1 mgstat0 w 0x0107 ferstat r erserif pgmerif 0 epviolif ersvif1 ersvif0 dfdif sfdif w 0x0108 fprot r fpopen rnv6 fphdis fphs1 fphs0 fpldis fpls1 fpls0 w 0x0109 eprot r epopen rnv6 rnv5 rnv4 epdis eps2 eps1 eps0 w 0x010a fccobhi r ccob15 ccob14 ccob13 ccob12 ccob11 ccob10 ccob9 ccob8 w 0x010b fccoblo r ccob7 ccob6 ccob5 ccob4 ccob3 ccob2 ccob1 ccob0 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1284 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x010c etaghi r etag15 etag14 etag13 etag12 etag11 etag10 etag9 etag8 w 0x010d etaglo r etag7 etag6 etag5 etag4 etag3 etag2 etag1 etag0 w 0x010e feccrhi r eccr15 eccr14 eccr13 eccr12 eccr11 eccr10 eccr9 eccr8 w 0x010f feccrlo r eccr7 eccr6 eccr5 eccr4 eccr3 eccr2 eccr1 eccr0 w 0x0110 fopt r nv7 nv6 nv5 nv4 nv3 nv2 nv1 nv0 w 0x0111 reserved r00000000 w 0x0112 reserved r00000000 w 0x0113 reserved r00000000 w 0x0100?x0113 nvm control register (ftm) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1285 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0114?x011f memory protection unit (mpu) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0114 mpuflg r aef wpf nexf 0 0 0 0 svsf w 0x0115 mpuastat0 r 0 addr[22:16] w 0x0116 mpuastat1 r addr[15:8] w 0x0117 mpuastat2 r addr[7:0] w 0x0118 reserved r00000000 w 0x0119 mpusel r svsen 0000 sel[2:0] w 0x011a mpudesc0 1 1 the module addresses 0x03c6 ? 0x03cb represent a window in the register map through which different descriptor registers are visible. r mstr0 mstr1 mstr2 mstr3 low_addr[22:19] w 0x011b mpudesc1 1 r low_addr[18:11] w 0x011c mpudesc2 1 r low_addr[10:3] w 0x011d mpudesc3 1 r wp nex 00 high_addr[22:19] w 0x011e mpudesc4 1 r high_addr[18:11] w 0x011f mpudesc5 1 r high_addr[10:3] w 0x0120?x012f interrupt module (s12xint) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0120 reserved r00000000 w 0x0121 ivbr r ivb_addr[7:0] w 0x0122 reserved r00000000 w 0x0123 reserved r00000000 w 0x0124 reserved r00000000 w 0x0125 reserved r00000000 w 0x0126 int_xgprio r00000 xilvl[2:0] w 0x0127 int_cfaddr r int_cfaddr[7:4] 0000 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1286 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0128 int_cfdata0 r rqst 0000 priolvl[2:0] w 0x0129 int_cfdata1 r rqst 0000 priolvl[2:0] w 0x012a int_cfdata2 r rqst 0000 priolvl[2:0] w 0x012b int_cfdata3 r rqst 0000 priolvl[2:0] w 0x012c int_cfdata4 r rqst 0000 priolvl[2:0] w 0x012d int_cfdata5 r rqst 0000 priolvl[2:0] w 0x012e int_cfdata6 r rqst 0000 priolvl[2:0] w 0x012f int_cfdata7 r rqst 0000 priolvl[2:0] w 0x0120?x012f interrupt module (s12xint) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1287 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00130?x0137 asynchronous serial interface (sci4) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0130 sci4bdh 1 1 those registers are accessible if the amap bit in the sci4sr2 register is set to zero r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x0131 sci4bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x0132 sci4cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x0130 sci4asr1 2 2 those registers are accessible if the amap bit in the sci4sr2 register is set to one r rxedgif 0000 berrv berrif bkdif w 0x0131 sci4acr1 2 r rxedgie 00000 berrie bkdie w 0x0132 sci4acr2 2 r00000 berrm1 berrm0 bkdfe w 0x0133 sci4cr2 r tie tcie rie ilie te re rwu sbk w 0x0134 sci4sr1 r tdre tc rdrf idle or nf fe pf w 0x0135 sci4sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x0136 sci4drh rr8 t8 000000 w 0x0137 sci4drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 0x0138?x013f asynchronous serial interface (sci5) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0138 sci5bdh 1 r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x0139 sci5bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x013a sci5cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x0138 sci5asr1 2 r rxedgif 0000 berrv berrif bkdif w 0x0139 sci5acr1 2 r rxedgie 00000 berrie bkdie w 0x013a sci5acr2 2 r00000 berrm1 berrm0 bkdfe w 0x013b sci5cr2 r tie tcie rie ilie te re rwu sbk w 0x013c sci5sr1 r tdre tc rdrf idle or nf fe pf w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1288 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x013d sci5sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x013e sci5drh rr8 t8 000000 w 0x013f sci5drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 1 those registers are accessible if the amap bit in the sci5sr2 register is set to zero 2 those registers are accessible if the amap bit in the sci5sr2 register is set to one 0x0140?x017f mscan (can0) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0140 can0ctl0 r rxfrm rxact cswai synch time wupe slprq initrq w 0x0141 can0ctl1 r cane clksrc loopb listen borm wupm slpak initak w 0x0142 can0btr0 r sjw1 sjw0 brp5 brp4 brp3 brp2 brp1 brp0 w 0x0143 can0btr1 r samp tseg22 tseg21 tseg20 tseg13 tseg12 tseg11 tseg10 w 0x0144 can0rflg r wupif cscif rstat1 rstat0 tstat1 tstat0 ovrif rxf w 0x0145 can0rier r wupie cscie rstate1 rstate0 tstate1 tstate0 ovrie rxfie w 0x0146 can0tflg r00000 txe2 txe1 txe0 w 0x0147 can0tier r00000 txeie2 txeie1 txeie0 w 0x0148 can0tarq r00000 abtrq2 abtrq1 abtrq0 w 0x0149 can0taak r 0 0 0 0 0 abtak2 abtak1 abtak0 w 0x014a can0tbsel r00000 tx2 tx1 tx0 w 0x014b can0idac r0 0 idam1 idam0 0 idhit2 idhit1 idhit0 w 0x014c reserved r00000000 w 0x014d can0misc r0000000 bohold w 0x014e can0rxerr r rxerr7 rxerr6 rxerr5 rxerr4 rxerr3 rxerr2 rxerr1 rxerr0 w 0x014f can0txerr r txerr7 txerr6 txerr5 txerr4 txerr3 txerr2 txerr1 txerr0 w 0x0150 0x0153 can0idar0 can0idar3 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0138?x013f asynchronous serial interface (sci5) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1289 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0154 0x0157 can0idmr0 can0idmr3 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0158 0x015b can0idar4 can0idar7 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x015c 0x015f can0idmr4 can0idmr7 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0160 0x016f can0rxfg r foreground receive buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x0170 0x017f can0txfg r foreground transmit buffer (see detailed mscan foreground receive and transmit buffer layout ) w detailed mscan foreground receive and transmit buffer layout address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0xxxx0 extended id r id28 id27 id26 id25 id24 id23 id22 id21 standard id r id10 id9 id8 id7 id6 id5 id4 id3 canxridr0 w 0xxxx1 extended id r id20 id19 id18 srr=1 ide=1 id17 id16 id15 standard id r id2 id1 id0 rtr ide=0 canxridr1 w 0xxxx2 extended id r id14 id13 id12 id11 id10 id9 id8 id7 standard id r canxridr2 w 0xxxx3 extended id r id6 id5 id4 id3 id2 id1 id0 rtr standard id r canxridr3 w 0xxxx4 0xxxxb canxrdsr0 canxrdsr7 r db7 db6 db5 db4 db3 db2 db1 db0 w 0xxxxc canrxdlr r dlc3 dlc2 dlc1 dlc0 w 0xxxxd reserved r w 0xxxxe canxrtsrh r tsr15 tsr14 tsr13 tsr12 tsr11 tsr10 tsr9 tsr8 w 0xxxxf canxrtsrl r tsr7 tsr6 tsr5 tsr4 tsr3 tsr2 tsr1 tsr0 w 0xxx10 extended id r id28 id27 id26 id25 id24 id23 id22 id21 canxtidr0 w standard id r id10 id9 id8 id7 id6 id5 id4 id3 w 0x0140?x017f mscan (can0) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1290 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0xxx0x xx10 extended id r id20 id19 id18 srr=1 ide=1 id17 id16 id15 canxtidr1 w standard id r id2 id1 id0 rtr ide=0 w 0xxx12 extended id r id14 id13 id12 id11 id10 id9 id8 id7 canxtidr2 w standard id r w 0xxx13 extended id r id6 id5 id4 id3 id2 id1 id0 rtr canxtidr3 w standard id r w 0xxx14 0xxx1b canxtdsr0 canxtdsr7 r db7 db6 db5 db4 db3 db2 db1 db0 w 0xxx1c canxtdlr r dlc3 dlc2 dlc1 dlc0 w 0xxx1d canxttbpr r prio7 prio6 prio5 prio4 prio3 prio2 prio1 prio0 w 0xxx1e canxttsrh r tsr15 tsr14 tsr13 tsr12 tsr11 tsr10 tsr9 tsr8 w 0xxx1f canxttsrl r tsr7 tsr6 tsr5 tsr4 tsr3 tsr2 tsr1 tsr0 w detailed mscan foreground receive and transmit buffer layout (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1291 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0180?x01bf mscan (can1) map (sheet 1 of 2) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0180 can1ctl0 r rxfrm rxact cswai synch time wupe slprq initrq w 0x0181 can1ctl1 r cane clksrc loopb listen borm wupm slpak initak w 0x0182 can1btr0 r sjw1 sjw0 brp5 brp4 brp3 brp2 brp1 brp0 w 0x0183 can1btr1 r samp tseg22 tseg21 tseg20 tseg13 tseg12 tseg11 tseg10 w 0x0184 can1rflg r wupif cscif rstat1 rstat0 tstat1 tstat0 ovrif rxf w 0x0185 can1rier r wupie cscie rstate1 rstate0 tstate1 tstate0 ovrie rxfie w 0x0186 can1tflg r00000 txe2 txe1 txe0 w 0x0187 can1tier r00000 txeie2 txeie1 txeie0 w 0x0188 can1tarq r00000 abtrq2 abtrq1 abtrq0 w 0x0189 can1taak r 0 0 0 0 0 abtak2 abtak1 abtak0 w 0x018a can1tbsel r00000 tx2 tx1 tx0 w 0x018b can1idac r0 0 idam1 idam0 0 idhit2 idhit1 idhit0 w 0x018c reserved r00000000 w 0x018d can1misc r0000000 bohold w 0x018e can1rxerr r rxerr7 rxerr6 rxerr5 rxerr4 rxerr3 rxerr2 rxerr1 rxerr0 w 0x018f can1txerr r txerr7 txerr6 txerr5 txerr4 txerr3 txerr2 txerr1 txerr0 w 0x0190 can1idar0 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0191 can1idar1 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0192 can1idar2 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0193 can1idar3 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0194 can1idmr0 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0195 can1idmr1 r am7 am6 am5 am4 am3 am2 am1 am0 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1292 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0196 can1idmr2 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0197 can1idmr3 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0198 can1idar4 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0199 can1idar5 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x019a can1idar6 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x019b can1idar7 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x019c can1idmr4 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x019d can1idmr5 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x019e can1idmr6 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x019f can1idmr7 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01a0 0x01af can1rxfg r foreground receive buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x01b0 0x01bf can1txfg r foreground transmit buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x01c0?x01ff mscan (can2) map (sheet 1 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x01c0 can2ctl0 r rxfrm rxact cswai synch time wupe slprq initrq w 0x01c1 can2ctl1 r cane clksrc loopb listen borm wupm slpak initak w 0x01c2 can2btr0 r sjw1 sjw0 brp5 brp4 brp3 brp2 brp1 brp0 w 0x01c3 can2btr1 r samp tseg22 tseg21 tseg20 tseg13 tseg12 tseg11 tseg10 w 0x01c4 can2rflg r wupif cscif rstat1 rstat0 tstat1 tstat0 ovrif rxf w 0x01c5 can2rier r wupie cscie rstate1 rstate0 tstate1 tstate0 ovrie rxfie w 0x01c6 can2tflg r00000 txe2 txe1 txe0 w 0x01c7 can2tier r00000 txeie2 txeie1 txeie0 w 0x0180?x01bf mscan (can1) map (sheet 2 of 2) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1293 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x01c8 can2tarq r00000 abtrq2 abtrq1 abtrq0 w 0x01c9 can2taak r 0 0 0 0 0 abtak2 abtak1 abtak0 w 0x01ca can2tbsel r00000 tx2 tx1 tx0 w 0x01cb can2idac r0 0 idam1 idam0 0 idhit2 idhit1 idhit0 w 0x01cc reserved r00000000 w 0x01cd can2misc r0000000 bohold w 0x01ce can2rxerr r rxerr7 rxerr6 rxerr5 rxerr4 rxerr3 rxerr2 rxerr1 rxerr0 w 0x01cf can2txerr r txerr7 txerr6 txerr5 txerr4 txerr3 txerr2 txerr1 txerr0 w 0x01d0 can2idar0 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01d1 can2idar1 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01d2 can2idar2 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01d3 can2idar3 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01d4 can2idmr0 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01d5 can2idmr1 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01d6 can2idmr2 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01d7 can2idmr3 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01d8 can2idar4 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01d9 can2idar5 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01da can2idar6 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01db can2idar7 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x01dc can2idmr4 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01dd can2idmr5 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01de can2idmr6 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01c0?x01ff mscan (can2) map (sheet 2 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1294 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x01df can2idmr7 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x01e0 0x01ef can2rxfg r foreground receive buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x01f0 0x01ff can2txfg r foreground transmit buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x01c0?x01ff mscan (can2) map (sheet 3 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1295 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0200?x023f mscan (can3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0200 can3ctl0 r rxfrm rxact cswai synch time wupe slprq initrq w 0x0201 can3ctl1 r cane clksrc loopb listen borm wupm slpak initak w 0x0202 can3btr0 r sjw1 sjw0 brp5 brp4 brp3 brp2 brp1 brp0 w 0x0203 can3btr1 r samp tseg22 tseg21 tseg20 tseg13 tseg12 tseg11 tseg10 w 0x0204 can3rflg r wupif cscif rstat1 rstat0 tstat1 tstat0 ovrif rxf w 0x0205 can3rier r wupie cscie rstate1 rstate0 tstate1 tstate0 ovrie rxfie w 0x0206 can3tflg r00000 txe2 txe1 txe0 w 0x0207 can3tier r00000 txeie2 txeie1 txeie0 w 0x0208 can3tarq r00000 abtrq2 abtrq1 abtrq0 w 0x0209 can3taak r 0 0 0 0 0 abtak2 abtak1 abtak0 w 0x020a can3tbsel r00000 tx2 tx1 tx0 w 0x020b can3idac r0 0 idam1 idam0 0 idhit2 idhit1 idhit0 w 0x020c reserved r00000000 w 0x020d can3misc r0000000 bohold w 0x020e can3rxerr r rxerr7 rxerr6 rxerr5 rxerr4 rxerr3 rxerr2 rxerr1 rxerr0 w 0x020f can3txerr r txerr7 txerr6 txerr5 txerr4 txerr3 txerr2 txerr1 txerr0 w 0x0210 can3idar0 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0211 can3idar1 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0212 can3idar2 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0213 can3idar3 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0214 can3idmr0 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0215 can3idmr1 r am7 am6 am5 am4 am3 am2 am1 am0 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1296 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0216 can3idmr2 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0217 can3idmr3 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0218 can3idar4 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0219 can3idar5 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x021a can3idar6 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x021b can3idar7 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x021c can3idmr4 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x021d can3idmr5 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x021e can3idmr6 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x021f can3idmr7 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0220 0x022f can3rxfg r foreground receive buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x0230 0x023f can3txfg r foreground transmit buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x0240?x027f port integration module (pim) map 5 of 6 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0240 ptt r ptt7 ptt6 ptt5 ptt4 ptt3 ptt2 ptt1 ptt0 w 0x0241 ptit r ptit7 ptit6 ptit5 ptit4 ptit3 ptit2 ptit1 ptit0 w 0x0242 ddrt r ddrt7 ddrt7 ddrt5 ddrt4 ddrt3 ddrt2 ddrt1 ddrt0 w 0x0243 rdrt r rdrt7 rdrt6 rdrt5 rdrt4 rdrt3 rdrt2 rdrt1 rdrt0 w 0x0244 pert r pert7 pert6 pert5 pert4 pert3 pert2 pert1 pert0 w 0x0245 ppst r ppst7 ppst6 ppst5 ppst4 ppst3 ppst2 ppst1 ppst0 w 0x0246 reserved r00000000 w 0x0247 reserved r00000000 w 0x0200?x023f mscan (can3) (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1297 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0248 pts r pts7 pts6 pts5 pts4 pts3 pts2 pts1 pts0 w 0x0249 ptis r ptis7 ptis6 ptis5 ptis4 ptis3 ptis2 ptis1 ptis0 w 0x024a ddrs r ddrs7 ddrs7 ddrs5 ddrs4 ddrs3 ddrs2 ddrs1 ddrs0 w 0x024b rdrs r rdrs7 rdrs6 rdrs5 rdrs4 rdrs3 rdrs2 rdrs1 rdrs0 w 0x024c pers r pers7 pers6 pers5 pers4 pers3 pers2 pers1 pers0 w 0x024d ppss r ppss7 ppss6 ppss5 ppss4 ppss3 ppss2 ppss1 ppss0 w 0x024e woms r woms7 woms6 woms5 woms4 woms3 woms2 woms1 woms0 w 0x024f reserved r00000000 w 0x0250 ptm r ptm7 ptm6 ptm5 ptm4 ptm3 ptm2 ptm1 ptm0 w 0x0251 ptim r ptim7 ptim6 ptim5 ptim4 ptim3 ptim2 ptim1 ptim0 w 0x0252 ddrm r ddrm7 ddrm7 ddrm5 ddrm4 ddrm3 ddrm2 ddrm1 ddrm0 w 0x0253 rdrm r rdrm7 rdrm6 rdrm5 rdrm4 rdrm3 rdrm2 rdrm1 rdrm0 w 0x0254 perm r perm7 perm6 perm5 perm4 perm3 perm2 perm1 perm0 w 0x0255 ppsm r ppsm7 ppsm6 ppsm5 ppsm4 ppsm3 ppsm2 ppsm1 ppsm0 w 0x0256 womm r womm7 womm6 womm5 womm4 womm3 womm2 womm1 womm0 w 0x0257 modrr r0 modrr6 modrr5 modrr4 modrr3 modrr2 modrr1 modrr0 w 0x0258 ptp r ptp7 ptp6 ptp5 ptp4 ptp3 ptp2 ptp1 ptp0 w 0x0259 ptip r ptip7 ptip6 ptip5 ptip4 ptip3 ptip2 ptip1 ptip0 w 0x025a ddrp r ddrp7 ddrp7 ddrp5 ddrp4 ddrp3 ddrp2 ddrp1 ddrp0 w 0x025b rdrp r rdrp7 rdrp6 rdrp5 rdrp4 rdrp3 rdrp2 rdrp1 rdrp0 w 0x025c perp r perp7 perp6 perp5 perp4 perp3 perp2 perp1 perp0 w 0x025d ppsp r ppsp7 ppsp6 ppsp5 ppsp4 ppsp3 ppsp2 ppsp1 ppss0 w 0x025e piep r piep7 piep6 piep5 piep4 piep3 piep2 piep1 piep0 w 0x025f pifp r pifp7 pifp6 pifp5 pifp4 pifp3 pifp2 pifp1 pifp0 w 0x0240?x027f port integration module (pim) map 5 of 6 (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1298 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0260 pth r pth7 pth6 pth5 pth4 pth3 pth2 pth1 pth0 w 0x0261 ptih r ptih7 ptih6 ptih5 ptih4 ptih3 ptih2 ptih1 ptih0 w 0x0262 ddrh r ddrh7 ddrh7 ddrh5 ddrh4 ddrh3 ddrh2 ddrh1 ddrh0 w 0x0263 rdrh r rdrh7 rdrh6 rdrh5 rdrh4 rdrh3 rdrh2 rdrh1 rdrh0 w 0x0264 perh r perh7 perh6 perh5 perh4 perh3 perh2 perh1 perh0 w 0x0265 ppsh r ppsh7 ppsh6 ppsh5 ppsh4 ppsh3 ppsh2 ppsh1 ppsh0 w 0x0266 pieh r pieh7 pieh6 pieh5 pieh4 pieh3 pieh2 pieh1 pieh0 w 0x0267 pifh r pifh7 pifh6 pifh5 pifh4 pifh3 pifh2 pifh1 pifh0 w 0x0268 ptj r ptj7 ptj6 ptj5 ptj4 ptj3 ptj2 ptj1 ptj0 w 0x0269 ptij r ptij7 ptij6 ptij5 ptij4 ptij3 ptij2 ptij1 ptij0 w 0x026a ddrj r ddrj7 ddrj7 ddrj5 ddrj4 ddrj3 ddrj2 ddrj1 ddrj0 w 0x026b rdrj r rdrj7 rdrj6 rdrj5 rdrj4 rdrj3 rdrj2 rdrj1 rdrj0 w 0x026c perj r perj7 perj6 perj5 perj4 perj3 perj2 perj1 perj0 w 0x026d ppsj r ppsj7 ppsj6 ppsj5 ppsj4 ppsj3 ppsj2 ppsj1 ppsj0 w 0x026e piej r piej7 piej6 piej5 piej4 piej3 piej2 piej1 piej0 w 0x026f pifj r pifj7 pifj6 pifj5 pifj4 pifj3 pifj2 pifj1 pifj0 w 0x0270 pt0ad0 r pt0ad0 7 pt0ad0 6 pt0ad0 5 pt0ad0 4 pt0ad0 3 pt0ad0 2 pt0ad0 1 pt0ad0 0 w 0x0271 pt1ad0 r pt1ad0 7 pt1ad0 6 pt1ad0 5 pt1ad0 4 pt1ad0 3 pt1ad0 2 pt1ad0 1 pt1ad0 0 w 0x0272 ddr0ad0 r ddr0ad0 7 ddr0ad0 6 ddr0ad0 5 ddr0ad0 4 ddr0ad0 3 ddr0ad0 2 ddr0ad0 1 ddr0ad0 0 w 0x0273 ddr1ad0 r ddr1ad0 7 ddr1ad0 6 ddr1ad0 5 ddr1ad0 4 ddr1ad0 3 ddr1ad0 2 ddr1ad0 1 ddr1ad0 0 w 0x0274 rdr0ad0 r rdr0ad0 7 rdr0ad0 6 rdr0ad0 5 rdr0ad0 4 rdr0ad0 3 rdr0ad0 2 rdr0ad0 1 rdr0ad0 0 w 0x0275 rdr1ad0 r rdr1ad0 7 rdr1ad0 6 rdr1ad0 5 rdr1ad0 4 rdr1ad0 3 rdr1ad0 2 rdr1ad0 1 rdr1ad0 0 w 0x0276 per0ad0 r per0ad0 7 per0ad0 6 per0ad0 5 per0ad0 4 per0ad0 3 per0ad0 2 per0ad0 1 per0ad0 0 w 0x0277 per1ad0 r per1ad0 7 per1ad0 6 per1ad0 5 per1ad0 4 per1ad0 3 per1ad0 2 per1ad0 1 per1ad0 0 w 0x0240?x027f port integration module (pim) map 5 of 6 (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1299 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0278 pt0ad1 r pt0ad1 7 pt0ad1 6 pt0ad1 5 pt0ad1 4 pt0ad1 3 pt0ad1 2 pt0ad1 1 pt0ad1 0 w 0x0279 pt1ad1 r pt1ad1 7 pt1ad1 6 pt1ad1 5 pt1ad1 4 pt1ad1 3 pt1ad1 2 pt1ad1 1 pt1ad1 0 w 0x027a ddr0ad1 r ddr0ad1 7 ddr0ad1 6 ddr0ad1 5 ddr0ad1 4 ddr0ad1 3 ddr0ad1 2 ddr0ad1 1 ddr0ad1 0 w 0x027b ddr1ad1 r ddr1ad1 7 ddr1ad1 6 ddr1ad1 5 ddr1ad1 4 ddr1ad1 3 ddr1ad1 2 ddr1ad1 1 ddr1ad1 0 w 0x027c rdr0ad1 r rdr0ad1 7 rdr0ad1 6 rdr0ad1 5 rdr0ad1 4 rdr0ad1 3 rdr0ad1 2 rdr0ad1 1 rdr0ad1 0 w 0x027d rdr1ad1 r rdr1ad1 7 rdr1ad1 6 rdr1ad1 5 rdr1ad1 4 rdr1ad1 3 rdr1ad1 2 rdr1ad1 1 rdr1ad1 0 w 0x027e per0ad1 r per0ad1 7 per0ad1 6 per0ad1 5 per0ad1 4 per0ad1 3 per0ad1 2 per0ad1 1 per0ad1 0 w 0x027f per1ad1 r per1ad1 7 per1ad1 6 per1ad1 5 per1ad1 4 per1ad1 3 per1a1d 2 per1ad1 1 per1ad1 0 w 0x0280?x02bf mscan (can4) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0280 can4ctl0 r rxfrm rxact cswai synch time wupe slprq initrq w 0x0281 can4ctl1 r cane clksrc loopb listen borm wupm slpak initak w 0x0282 can4btr0 r sjw1 sjw0 brp5 brp4 brp3 brp2 brp1 brp0 w 0x0283 can4btr1 r samp tseg22 tseg21 tseg20 tseg13 tseg12 tseg11 tseg10 w 0x0284 can4rflg r wupif cscif rstat1 rstat0 tstat1 tstat0 ovrif rxf w 0x0285 can4rier r wupie cscie rstate1 rstate0 tstate1 tstate0 ovrie rxfie w 0x0286 can4tflg r00000 txe2 txe1 txe0 w 0x0287 can4tier r00000 txeie2 txeie1 txeie0 w 0x0288 can4tarq r00000 abtrq2 abtrq1 abtrq0 w 0x0289 can4taak r 0 0 0 0 0 abtak2 abtak1 abtak0 w 0x028a can4tbsel r00000 tx2 tx1 tx0 w 0x028b can4idac r0 0 idam1 idam0 0 idhit2 idhit1 idhit0 w 0x028c reserved r00000000 w 0x0240?x027f port integration module (pim) map 5 of 6 (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1300 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x028d can4misc r0000000 bohold w 0x028e can4rxerr r rxerr7 rxerr6 rxerr5 rxerr4 rxerr3 rxerr2 rxerr1 rxerr0 w 0x028f can4txerr r txerr7 txerr6 txerr5 txerr4 txerr3 txerr2 txerr1 txerr0 w 0x0290 can4idar0 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0291 can4idar1 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0292 can4idar2 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0293 can4idar3 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0294 can4idmr0 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0295 can4idmr1 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0296 can4idmr2 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0297 can4idmr3 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x0298 can4idar4 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x0299 can4idar5 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x029a can4idar6 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x029b can4idar7 r ac7 ac6 ac5 ac4 ac3 ac2 ac1 ac0 w 0x029c can4idmr4 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x029d can4idmr5 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x029e can4idmr6 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x029f can4idmr7 r am7 am6 am5 am4 am3 am2 am1 am0 w 0x02a0 0x02af can4rxfg r foreground receive buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x02b0 0x02bf can4txfg r foreground transmit buffer (see detailed mscan foreground receive and transmit buffer layout ) w 0x0280?x02bf mscan (can4) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1301 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x02c0?x02ef analog-to-digital converter 12-bit 16-channel (atd0) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x02c0 atd0ctl0 r0 0 0 0 wrap3 wrap2 wrap1 wrap0 w 0x02c1 atd0ctl1 r etrig sel sres1 sres0 smp_dis etrig ch3 etrig ch2 etrig ch1 etrig ch0 w 0x02c2 atd0ctl2 r0 affc iclkstp etrigle etrigp etrige ascie acmpie w 0x02c3 atd0ctl3 r djm s8c s4c s2c s1c fifo frz1 frz0 w 0x02c4 atd0ctl4 r smp2 smp1 smp0 prs4 prs3 prs2 prs1 prs0 w 0x02c5 atd0ctl5 r0 sc scan mult cd cc cb ca w 0x02c6 atd0stat0 r scf 0 etorf fifor cc3 cc2 cc1 cc0 w 0x02c7 reserved r00000000 w 0x02c8 atd0cmpeh r cmpe15 cmpe14 cmpe13 cmpe12 cmpe11 cmpe10 cmpe9 cmpe8 w 0x02c9 atd0cmpel r cmpe7 cmpe6 cmpe5 cmpe4 cmpe3 cmpe2 cmpe1 cmpe0 w 0x02ca atd0stat2h r ccf15 ccf14 ccf13 ccf12 ccf11 ccf10 ccf9 ccf8 w 0x02cb atd0stat2l r ccf7 ccf6 ccf5 ccf4 ccf3 ccf2 ccf1 ccf0 w 0x02cc atd0dienh r ien15 ien14 ien13 ien12 ien11 ien10 ien9 ien8 w 0x02cd atd0dienl r ien7 ien6 ien5 ien4 ien3 ien2 ien1 ien0 w 0x02ce atd0cmphth r cmpht15 cmpht14 cmpht13 cmpht12 cmpht11 cmpht10 cmpht9 cmpht8 w 0x02cf atd0cmphtl r cmpht7 cmpht6 cmpht5 cmpht4 cmpht3 cmpht2 cmpht1 cmpht0 w 0x02d0 atd0dr0h r bit15 14 13 12 11 10 9 bit8 w 0x02d1 atd0dr0l r bit7 bit6 000000 w 0x02d2 atd0dr1h r bit15 14 13 12 11 10 9 bit8 w 0x02d3 atd0dr1l r bit7 bit6 000000 w 0x02d4 atd0dr2h r bit15 14 13 12 11 10 9 bit8 w 0x02d5 atd0dr2l r bit7 bit6 000000 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1302 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x02d6 atd0dr3h r bit15 14 13 12 11 10 9 bit8 w 0x02d7 atd0dr3l r bit7 bit6 000000 w 0x02d8 atd0dr4h r bit15 14 13 12 11 10 9 bit8 w 0x02d9 atd0dr4l r bit7 bit6 000000 w 0x02da atd0dr5h r bit15 14 13 12 11 10 9 bit8 w 0x02db atd0dr5l r bit7 bit6 000000 w 0x02dc atd0dr6h r bit15 14 13 12 11 10 9 bit8 w 0x02dd atd0dr6l r bit7 bit6 000000 w 0x02de atd0dr7h r bit15 14 13 12 11 10 9 bit8 w 0x02df atd0dr7l r bit7 bit6 000000 w 0x02e0 atd0dr8h r bit15 14 13 12 11 10 9 bit8 w 0x02e1 atd0dr8l r bit7 bit6 000000 w 0x02e2 atd0dr9h r bit15 14 13 12 11 10 9 bit8 w 0x02e3 atd0dr9l r bit7 bit6 000000 w 0x02e4 atd0dr10h r bit15 14 13 12 11 10 9 bit8 w 0x02e5 atd0dr10l r bit7 bit6 000000 w 0x02e6 atd0dr11h r bit15 14 13 12 11 10 9 bit8 w 0x02e7 atd0dr11l r bit7 bit6 000000 w 0x02e8 atd0dr12h r bit15 14 13 12 11 10 9 bit8 w 0x02e9 atd0dr12l r bit7 bit6 000000 w 0x02ea atd0dr13h r bit15 14 13 12 11 10 9 bit8 w 0x02eb atd0dr13l r bit7 bit6 000000 w 0x02ec atd0dr14h r bit15 14 13 12 11 10 9 bit8 w 0x02c0?x02ef analog-to-digital converter 12-bit 16-channel (atd0) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1303 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x02ed atd0dr14l r bit7 bit6 000000 w 0x02ee atd0dr15h r bit15 14 13 12 11 10 9 bit8 w 0x02ef atd0dr15l r bit7 bit6 000000 w 0x02c0?x02ef analog-to-digital converter 12-bit 16-channel (atd0) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1304 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x02f0?x02f7 voltage regulator (vreg_3v3) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x02f0 vreghtcl r0 0 vsel vae hten htds htie htif w 0x02f1 vregctrl r00000lvds lvie lvif w 0x02f2 vregapicl r apiclk 00 apifes apiea apife apie apif w 0x02f3 vregapitr r apitr5 apitr4 apitr3 apitr2 apitr1 apitr0 00 w 0x02f4 vregapirh r apir15 apir14 apir13 apir12 apir11 apir10 apir9 apir8 w 0x02f5 vregapirl r apir7 apir6 apir5 apir4 apir3 apir2 apir1 apir0 w 0x02f6 reserved r00000000 w 0x02f7 vreghttr r htoen 000 httr3 httr2 httr1 httr0 w 0x02f8?x02ff reserved address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x02f8 0x02ff reserved r00000000 w 0x0300?x0327 pulse width modulator 8-bit 8-channel (pwm) map (sheet 1 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0300 pwme r pwme7 pwme6 pwme5 pwme4 pwme3 pwme2 pwme1 pwme0 w 0x0301 pwmpol r ppol7 ppol6 ppol5 ppol4 ppol3 ppol2 ppol1 ppol0 w 0x0302 pwmclk r pclk7 pclk6 pclk5 pclk4 pclk3 pclk2 pclk1 pclk0 w 0x0303 pwmprclk r0 pckb2 pckb1 pckb0 0 pcka2 pcka1 pcka0 w 0x0304 pwmcae r cae7 cae6 cae5 cae4 cae3 cae2 cae1 cae0 w 0x0305 pwmctl r con67 con45 con23 con01 pswai pfrz 00 w 0x0306 pwmtst test only r00000000 w 0x0307 pwmprsc r00000000 w 0x0308 pwmscla r bit 7 6 5 4 3 2 1 bit 0 w 0x0309 pwmsclb r bit 7 6 5 4 3 2 1 bit 0 w appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1305 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x030a pwmscnta r00000000 w 0x030b pwmscntb r00000000 w 0x030c pwmcnt0 r bit 7 6 5 4 3 2 1 bit 0 w00000000 0x030d pwmcnt1 r bit 7 6 54321 bit 0 w00000000 0x030e pwmcnt2 r bit 7 6 54321 bit 0 w00000000 0x030f pwmcnt3 r bit 7 6 54321 bit 0 w00000000 0x0310 pwmcnt4 r bit 7 6 54321 bit 0 w00000000 0x0311 pwmcnt5 r bit 7 6 54321 bit 0 w00000000 0x0312 pwmcnt6 r bit 7 6 54321 bit 0 w00000000 0x0313 pwmcnt7 r bit 7 6 54321 bit 0 w00000000 0x0314 pwmper0 r bit 7 6 5 4 3 2 1 bit 0 w 0x0315 pwmper1 r bit 7 6 5 4 3 2 1 bit 0 w 0x0316 pwmper2 r bit 7 6 5 4 3 2 1 bit 0 w 0x0317 pwmper3 r bit 7 6 5 4 3 2 1 bit 0 w 0x0318 pwmper4 r bit 7 6 5 4 3 2 1 bit 0 w 0x0319 pwmper5 r bit 7 6 5 4 3 2 1 bit 0 w 0x031a pwmper6 r bit 7 6 5 4 3 2 1 bit 0 w 0x031b pwmper7 r bit 7 6 5 4 3 2 1 bit 0 w 0x031c pwmdty0 r bit 7 6 5 4 3 2 1 bit 0 w 0x031d pwmdty1 r bit 7 6 5 4 3 2 1 bit 0 w 0x031e pwmdty2 r bit 7 6 5 4 3 2 1 bit 0 w 0x031f pwmdty3 r bit 7 6 5 4 3 2 1 bit 0 w 0x0320 pwmdty4 r bit 7 6 5 4 3 2 1 bit 0 w 0x0300?x0327 pulse width modulator 8-bit 8-channel (pwm) map (sheet 2 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1306 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0321 pwmdty5 r bit 7 6 5 4 3 2 1 bit 0 w 0x0322 pwmdty6 r bit 7 6 5 4 3 2 1 bit 0 w 0x0323 pwmdty7 r bit 7 6 5 4 3 2 1 bit 0 w 0x0324 pwmsdn r pwmif pwmie 0 pwmlvl 0 pwm7in pwm7inl pwm7 ena w pwm rstrt 0x0325 reserved r00000000 w 0x0326 reserved r00000000 w 0x0327 reserved r00000000 w 0x0328?x032f reserved address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0328 0x032f reserved r00000000 w 0x00330?x0337 asynchronous serial interface (sci6) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0330 sci6bdh 1 r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x0331 sci6bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x0332 sci6cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x0330 sci6asr1 2 r rxedgif 0000 berrv berrif bkdif w 0x0331 sci6acr1 2 r rxedgie 00000 berrie bkdie w 0x0332 sci6acr2 2 r00000 berrm1 berrm0 bkdfe w 0x0333 sci6cr2 r tie tcie rie ilie te re rwu sbk w 0x0334 sci6sr1 r tdre tc rdrf idle or nf fe pf w 0x0300?x0327 pulse width modulator 8-bit 8-channel (pwm) map (sheet 3 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1307 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0335 sci6sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x0336 sci6drh rr8 t8 000000 w 0x0337 sci6drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 1 those registers are accessible if the amap bit in the sci6sr2 register is set to zero 2 those registers are accessible if the amap bit in the sci6sr2 register is set to one 0x00330?x0337 asynchronous serial interface (sci6) map (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1308 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x00338?x033f asynchronous serial interface (sci7) map address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0338 sci7bdh 1 1 those registers are accessible if the amap bit in the sci7sr2 register is set to zero r iren tnp1 tnp0 sbr12 sbr11 sbr10 sbr9 sbr8 w 0x0339 sci7bdl 1 r sbr7 sbr6 sbr5 sbr4 sbr3 sbr2 sbr1 sbr0 w 0x033a sci7cr1 1 r loops sciswai rsrc m wake ilt pe pt w 0x0338 sci7asr1 2 2 those registers are accessible if the amap bit in the sci7sr2 register is set to one r rxedgif 0000 berrv berrif bkdif w 0x0339 sci7acr1 2 r rxedgie 00000 berrie bkdie w 0x033a sci7acr2 2 r00000 berrm1 berrm0 bkdfe w 0x033b sci7cr2 r tie tcie rie ilie te re rwu sbk w 0x033c sci7sr1 r tdre tc rdrf idle or nf fe pf w 0x033d sci7sr2 r amap 00 txpol rxpol brk13 txdir raf w 0x033e sci7drh rr8 t8 000000 w 0x033f sci7drl rr7r6r5r4r3r2r1r0 wt7t6t5t4t3t2t1t0 0x00340?x0367 ?periodic interrupt timer (pit) map (sheet 1 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0340 pitcflmt r pite pitswai pitfrz 00000 w pflmt1 pflmt0 0x0341 pitflt r00000000 w pflt7 pflt6 pflt5 pflt4 pflt3 pflt2 pflt1 pflt0 0x0342 pitce r pce7 pce6 pce5 pce4 pce3 pce2 pce1 pce0 w 0x0343 pitmux r pmux7 pmux6 pmux5 pmux4 pmux3 pmux2 pmux1 pmux0 w 0x0344 pitinte r pinte7 pinte6 pinte5 pinte4 pinte3 pinte2 pinte1 pinte0 w 0x0345 pittf r ptf7 ptf6 ptf5 ptf4 ptf3 ptf2 ptf1 ptf0 w 0x0346 pitmtld0 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w 0x0347 pitmtld1 r pmtld7 pmtld6 pmtld5 pmtld4 pmtld3 pmtld2 pmtld1 pmtld0 w 0x0348 pitld0 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1309 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0349 pitld0 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x034a pitcnt0 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x034b pitcnt0 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x034c pitld1 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x034d pitld1 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x034e pitcnt1 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x034f pitcnt1 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0350 pitld2 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0351 pitld2 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0352 pitcnt2 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0353 pitcnt2 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0354 pitld3 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0355 pitld3 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0356 pitcnt3 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0357 pitcnt3 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0358 pitld4 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0359 pitld4 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x035a pitcnt4 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x035b pitcnt4 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x035c pitld5 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x035d pitld5 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x035e pitcnt5 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x035f pitcnt5 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x00340?x0367 ?periodic interrupt timer (pit) map (sheet 2 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1310 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0360 pitld6 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0361 pitld6 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0362 pitcnt6 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0363 pitcnt6 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x0364 pitld7 (hi) r pld15 pld14 pld13 pld12 pld11 pld10 pld9 pld8 w 0x0365 pitld7 (lo) r pld7 pld6 pld5 pld4 pld3 pld2 pld1 pld0 w 0x0366 pitcnt7 (hi) r pcnt15 pcnt14 pcnt13 pcnt12 pcnt11 pcnt10 pcnt9 pcnt8 w 0x0367 pitcnt7 (lo) r pcnt7 pcnt6 pcnt5 pcnt4 pcnt3 pcnt2 pcnt1 pcnt0 w 0x00340?x0367 ?periodic interrupt timer (pit) map (sheet 3 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1311 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0368?x037f port integration module (pim) map 6 of 6 address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0368 ptr r ptr7 ptr6 ptr5 ptr4 ptr3 ptr2 ptr1 ptr0 w 0x0369 ptir r ptir7 ptir6 ptir5 ptir4 ptir3 ptir2 ptir1 ptir0 w 0x036a ddrr r ddrr7 ddrr7 ddrr5 ddrr4 ddrr3 ddrr2 ddrr1 ddrr0 w 0x036b rdrr r rdrr7 rdrr6 rdrr5 rdrr4 rdrr3 rdrr2 rdrr1 rdrr0 w 0x036c perr r perr7 perr6 perr5 perr4 perr3 perr2 perr1 perr0 w 0x036d ppsr r ppsr7 ppsr6 ppsr5 ppsr4 ppsr3 ppsr2 ppsr1 ppsr0 w 0x036e reserved r00000000 w 0x036f ptrrr r ptrrr7 ptrrr6 ptrrr5 ptrrr4 ptrrr3 ptrrr2 ptrrr1 ptrrr0 w 0x0370 ptl r ptl7 ptl6 ptl5 ptl4 ptl3 ptl2 ptl1 ptl0 w 0x0371 ptil r ptil7 ptil6 ptil5 ptil4 ptil3 ptil2 ptil1 ptil0 w 0x0372 ddrl r ddrl7 ddrl7 ddrl5 ddrl4 ddrl3 ddrl2 ddrl1 ddrl0 w 0x0373 rdrl r rdrl7 rdrl6 rdrl5 rdrl4 rdrl3 rdrl2 rdrl1 rdrl0 w 0x0374 perl r perl7 perl6 perl5 perl4 perl3 perl2 perl1 perl0 w 0x0375 ppsl r ppsl7 ppsl6 ppsl5 ppsl4 ppsl3 ppsl2 ppsl1 ppsl0 w 0x0376 woml r woml7 woml6 woml5 woml4 woml3 woml2 woml1 woml0 w 0x0377 ptlrr r ptlrr7 ptlrr6 ptlrr5 ptlrr4 0000 w 0x0378 ptf r ptf7 ptf6 ptf5 ptf4 ptf3 ptf2 ptf1 ptf0 w 0x0379 ptif r ptif7 ptif6 ptif5 ptif4 ptif3 ptif2 ptif1 ptif0 w 0x037a ddrf r ddrf7 ddrf7 ddrf5 ddrf4 ddrf3 ddrf2 ddrf1 ddrf0 w 0x037b rdrf r rdrf7 rdrf6 rdrf5 rdrf4 rdrf3 rdrf2 rdrf1 rdrf0 w 0x037c perf r perf7 perf6 perf5 perf4 perf3 perf2 perf1 perf0 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1312 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x037d ppsf r ppsf7 ppsf6 ppsf5 ppsf4 ppsf3 ppsf2 ppsf1 ppsf0 w 0x037e reserved r00000000 w 0x037f ptfrr r0 0 ptfrr5 ptfrr4 ptfrr3 ptfrr2 ptfrr1 ptfrr0 w 0x0368?x037f port integration module (pim) map 6 of 6 (continued) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1313 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0380?x03bf xgate map (sheet 1 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0380 xgmctl r0000000 xgiem w xgem xgfrzm xgdbgm xgssm xgfactm xgs wefm 0x0381 xgmctl r xge xgfrz xgdbg xgss xgfact 0 xgswef xgie w 0x0382 xgchid r 0 xgchid[6:0] w 0x0383 xgchpl r 0 0 0 0 0 xgchpl 0 0 w 0x0384 reserved 0x0385 xgispsel r000000 xgispsel[1:0] w 0x0386 xgvbr r xgvbr[15:8] w 0x0387 xgvbr r xgvbr[7:1] 0 w 0x0388 xgif r0000000 xgif_78 w 0x0389 xgif r xgif_77 xgif_76 xgif_75 xgif_74 xgif_73 xgif_72 xgif_71 xgif_70 w 0x038a xgif r xgif_6f xgif_6e xgif_6d xgif_6c xgif_6b xgif_6a xgif_69 xgif_68 w 0x023b xgif r xgif_67 xgif_66 xgif_65 xgif_64 xgif_63 xgif_62 xgif_61 xgif_60 w 0x023c xgif r xgif_5f xgif_5e xgif_5d xgif_5c xgif_5b xgif_5a xgif_59 xgif_58 w 0x038d xgif r xgif_57 xgif_56 xgif_55 xgif_54 xgif_53 xgif_52 xgif_51 xgif_50 w 0x038e xgif r xgif_4f xgif_4e xgif_4d xgif_4c xgif_4b xgif_4a xgif_49 xgif_48 w 0x038f xgif r xgif_47 xgif_46 xgif_45 xgif_44 xgif_43 xgif_42 xgif_41 xgif_40 w 0x0390 xgif r xgif_3f xgif_3e xgif_3d xgif_3c xgif_3b xgif_3a xgif_39 xgif_38 w 0x0391 xgif r xgif_37 xgif_36 xgif_35 xgif_34 xgif_33 xgif_32 xgif_31 xgif_30 w 0x0392 xgif r xgif_2f xgif_2e xgif_2d xgif_2c xgif_2b xgif_2a xgif_29 xgif_28 w 0x0393 xgif r xgif_27 xgif_26 xgif_25 xgif_24 xgif_23 xgif_22 xgif_21 xgif_20 w 0x0394 xgif r xgif_1f xgif_1e xgif_1d xgif_1c xgif_1b xgif_1a xgif_19 xgif_18 w 0x0395 xgif r xgif_17 xgif_16 xgif_15 xgif_14 xgif_13 xgif_12 xgif_11 xgif_10 w appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1314 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0396 xgif r xgif_0f xgif_0e xgif_0d xgif_0c xgif_0b xgif_0a xgif_09 0 w 0x0397 xgif r00000000 w 0x0398 xgswtm r00000000 w xgswtm[7:0] 0x0399 xgswt r xgswt[7:0] w 0x039a xgsemm r00000000 w xgsemm[7:0] 0x039b xgsem r xgsem[7:0] w 0x039c reserved r00000000 w 0x039d xgccr r0000 xgn xgz xgv xgc w 0x039e xgpc (hi) r xgpc[15:8] w 0x039f xgpc (lo) r xgpc[7:0] w 0x03a0 reserved r00000000 w 0x03a1 reserved r00000000 w 0x03a2 xgr1 (hi) r xgr1[15:8] w 0x03a3 xgr1 (lo) r xgr1[7:0] w 0x03a4 xgr2 (hi) r xgr2[15:8] w 0x03a5 xgr2 (lo) r xgr2[7:0] w 0x03a6 xgr3 (hi) r xgr3[15:8] w 0x03a7 xgr3 (lo) r xgr3[7:0] w 0x03a8 xgr4 (hi) r xgr4[15:8] w 0x03a9 xgr4 (lo) r xgr4[7:0] w 0x03aa xgr5 (hi) r xgr5[15:8] w 0x03ab xgr5(lo) r xgr5[7:0] w 0x03ac xgr6 (hi) r xgr6[15:8] w 0x0380?x03bf xgate map (sheet 2 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1315 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x03ad xgr6 (lo) r xgr6[7:0] w 0x03ae xgr7 (hi) r xgr7[15:8] w 0x03af xgr7 (lo) r xgr7[7:0] w 0x03b0 0x03bf reserved r00000000 w 0x0380?x03bf xgate map (sheet 3 of 3) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1316 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x03c0?x03cf reserved address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x03c0 -0x03cf reserved r00000000 w 0x03d0?x03ff timer module (tim) map (sheet 1 of 2) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x03d0 tios r ios7 ios6 ios5 ios4 ios3 ios2 ios1 ios0 w 0x03d1 cforc r00000000 w foc7 foc6 foc5 foc4 foc3 foc2 foc1 foc0 0x03d2 oc7m r oc7m7 oc7m6 oc7m5 oc7m4 oc7m3 oc7m2 oc7m1 oc7m0 w 0x03d3 oc7d r oc7d7 oc7d6 oc7d5 oc7d4 oc7d3 oc7d2 oc7d1 oc7d0 w 0x03d4 tcnth r tcnt15 tcnt14 tcnt13 tcnt12 tcnt11 tcnt10 tcnt9 tcnt8 w 0x03d5 tcntl r tcnt7 tcnt6 tcnt5 tcnt4 tcnt3 tcnt2 tcnt1 tcnt0 w 0x03d6 tscr1 r ten tswai tsfrz tffca prnt 000 w 0x03d7 ttov r tov7 tov6 tov5 tov4 tov3 tov2 tov1 tov0 w 0x03d8 tctl1 r om7 ol7 om6 ol6 om5 ol5 om4 ol4 w 0x03d9 tctl2 r om3 ol3 om2 ol2 om1 ol1 om0 ol0 w 0x03da tctl3 r edg7b edg7a edg6b edg6a edg5b edg5a edg4b edg4a w 0x03db tctl4 r edg3b edg3a edg2b edg2a edg1b edg1a edg0b edg0a w 0x03dc tie r c7i c6i c5i c4i c3i c2i c1i c0i w 0x03dd tscr2 r toi 000 tcre pr2 pr1 pr0 w 0x03de tflg1 r c7f c6f c5f c4f c3f c2f c1f c0f w 0x03df tflg2 r tof 0000000 w 0x03e0 tc0h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03e1 tc0l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x03e2 tc1h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03e3 tc1l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w appendix e detailed register address map mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1317 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x03e4 tc2h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03e5 tc2l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x03e6 tc3h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03e7 tc3l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x03e8 tc4h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03e9 tc4l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x03ea tc5h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03eb tc5l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x03ec tc6h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03ed tc6l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x03ee tc7h r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w 0x03ef tc7l r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w 0x03f0 pactl r0 paen pamod pedge clk1 clk0 paovi pai w 0x03f1 paflg r000000 paovf paif w 0x03f2 pacnth r pacnt15 pacnt14 pacnt13 pacnt12 pacnt11 pacnt10 pacnt9 pacnt8 w 0x03f3 pacntl r pacnt7 pacnt6 pacnt5 pacnt4 pacnt3 pacnt2 pacnt1 pacnt0 w 0x03f4 0x03fb reserved r00000000 w 0x03fc ocpd r ocpd7 ocpd6 ocpd5 ocpd4 ocpd3 ocpd2 ocpd1 ocpd0 w 0x03fd reserved r w 0x03fe ptpsr r ptpsr7 ptpsr6 ptpsr5 ptpsr4 ptpsr3 ptpsr2 ptpsr1 ptpsr0 w 0x03ff reserved r w 0x03d0?x03ff timer module (tim) map (sheet 2 of 2) address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 appendix e detailed register address map mc9s12xe-family reference manual , rev. 1.21 1318 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 0x0400?x07ff reserved address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x0400 0x07ff reserved r00000000 w appendix f ordering information mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1319 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix f ordering information the following ?ure provides an ordering partnumber example for the devices covered by this data book. there are two options when ordering a device. customers must choose between ordering either the mask-speci? partnumber or the generic / mask-independent partnumber ordering the mask-speci? partnumber enables the customer to specify which particular maskset they will receive whereas ordering the generic maskset means that fsl will ship the currently preferred maskset (which may change over time). in either case, the marking on the device will always show the generic / mask-independent partnumber and the mask set number. note the mask identi?r suf? and the tape & reel suf? are always both omitted from the partnumber which is actually marked on the device. for speci? partnumbers to order, please contact your local sales of?e. the below ?ure illustrates the structure of a typical mask-speci? ordering number for the mc9s12xe-family devices figure f-1. order part number example s 9 s12x ep100 j1 c ag r package option temperature option device title controller family c = -40?c to 85?c v = -40?c to 105?c m = -40?c to 125?c aa = 80 qfp al = 112 lqfp ag = 144 lqfp vl = 208 mapbga status / partnumber type: s or sc = maskset specific partnumber mc = generic / mask-independebt partnumber p or pc = prototype status (pre qualification main memory type: 9 = flash 3 = rom (if available) maskset identifier suffix first digit references fab j=tsmc, f=atmc second digit differentiates mask rev. 1= 1 m48h (this suffix is omitted in generic partnumbers) tape & reel r = tape & reel no r = no tape & reel appendix f ordering information mc9s12xe-family reference manual , rev. 1.21 1320 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix f ordering information mc9s12xe-family reference manual rev. 1.21 freescale semiconductor 1321 because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 appendix f ordering information mc9s12xe-family reference manual , rev. 1.21 1322 freescale semiconductor because of an order from the united states international trade commission, bga-packaged product lines and partnumbers indicated here currently are not available from freescale for import or sale in the united states prior to september 2010 how to reach us: home page: www.freescale.com usa/europe or locations not listed: freescale semiconductor technical information center, ch370 1300 n. alma school road chandler, arizona 85224 1-800-521-6274 or 480-768-2130 europe, middle east, and africa: +44 1296 380 456 (english) +46 8 52200080 (english) +49 89 92103 559 (german) +33 1 69 35 48 48 (french) japan: freescale semiconductor japan ltd. technical information center 3-20-1, minami-azabu, minato-ku tokyo 106-0047, japan 0120-191014 or +81-3-3440-3569 asia/paci?: freescale semiconductor hong kong ltd. technical information center 2 dai king street tai po industrial estate tai po, n.t., hong kong 852-26668334 for literature requests only: freescale semiconductor literature distribution center p.o. box 5405 denver, colorado 80217 1-800-441-2447 or 303-675-2140 fax: 303-675-2150 freescale and the freescale logo are trademarks of freescale semiconductor, inc. all other product or service names are the property of their respective owners. ?freescale semiconductor, inc. 2005,2006,2007. all rights reserved. mc9s12xep100rmv1 rev. 1.21 04/2010 information in this document is provided solely to enable system and software implementers to use freescale semiconductor products. there are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. freescale semiconductor reserves the right to make changes without further notice to any products herein. freescale semiconductor makes no warranty, representation or guarantee regarding the suitability of its products for any particular purpose, nor does freescale semiconductor assume any liability arising out of the application or use of any product or circuit, and speci?ally disclaims any and all liability, including without limitation consequential or incidental damages. typical parameters that may be provided in freescale semiconductor data sheets and/or speci?ations can and do vary in different applications and actual performance may vary over time. all operating parameters, including ?ypicals? must be validated for each customer application by customer s technical experts. freescale semiconductor does not convey any license under its patent rights nor the rights of others. freescale semiconductor products are not designed, intended, or authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other application in which the failure of the freescale semiconductor product could create a situation where personal injury or death may occur. should buyer purchase or use freescale semiconductor products for any such unintended or unauthorized application, buyer shall indemnify and hold freescale semiconductor and its of?ers, employees, subsidiaries, af?iates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that freescale semiconductor was negligent regarding the design or manufacture of the part. |
Price & Availability of S9S12XEP100F1MAG
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |