AN-946 APPLICATION NOTE One Technology Way • P.O. Box 9106 • Norwood, MA 02062-9106, U.S.A. • Tel: 781.329.4700 • Fax: 781.461.3113 • www.analog.com Flash/EE Memory Programming via LIN—Protocol 6 by Aude Richard INTRODUCTION RUNNING THE LIN LOADER A key feature of the ADuC7032, ADuC7033, ADuC7039, ADuCM330, and ADuCM331 devices is the ability of the devices to download code to on-chip Flash/EE memory while in-circuit. This in-circuit code download is performed via the local interconnect network (LIN) communications bus. Use only the LIN and power pins to download code. Table 2 shows the parameters needed to enter download. This application note describes the download protocol implemented on the ADuC7032, ADuC7033, ADuC7039, ADuCM330, and ADuCM331 devices using Protocol 6 to enable users to develop their own LIN programming tools either for series production programming or for application update. In this application note, host refers to the host machine (microcontroller, DSP, or other machine) attempting to download data to the ADuC7032, ADuC7033, ADuC7039, ADuCM330, or ADuCM331. Loader refers specifically to serial download firmware resident on these devices. Note that this application note describes Protocol 6 only. Protocol 6 follows the general procedure defined by UDS (ISO/DIS 14229-1.2, Road Vehicles Unified Diagnostic Services). However, due to the limited code space available, the services are limited to the minimum actually required. Protocol 4 is described in the AN-881 Application Note, Flash/EE Memory Programming via LIN—Protocol 4. The protocol is shown on the device branding, on Line 3. A60 refers to a released version of Protocol 6 whereas A40 refers to Protocol 4. Table 1. Branding Example for the ADuC7033 Line Line 1 Line 2 Line 3 Line 4 LFCSP ADuC7033 BCPZ 8L A60 date code Assembly lot number Table 2. Parameters to Enter Download Part ADuC7032 ADuC7033 ADuC7039 ADuCM330 ADuCM331 Download Pin Name Level NTRST L NTRST L NTRST L P0.5 H P0.5 H Page 0 Check Code Key Address 0x27011970 0x80014 0x27011970 0x80014 0x16400000 0x801FC 0x16400000 0x7FC 0x16400000 0x7FC Type CS CS CRC CRC CRC To enable a download via LIN, the ADuC7032, ADuC7033, ADuC7039, ADuCM330, or ADuCM331 device enters loader mode only if the download pin is at the level shown during reset and the Page 0 check code at the address shown in Table 2 is neither the key nor the Page 0 check code of the required type. See Figure 1 for applicable Arm 7 devices and Figure 2 for Cortex-M3 devices. Typically, the download pin is kept as indicated and entry to download mode is determined by the check key. The user code must have a built-in mechanism for corrupting the Page 0 check key and for resetting the part. This mechanism allows entry to download mode to reprogram the part. Program the check code last to enable reentry to download mode even in the event that the power fails or another error occurs during programming of the bulk of the program. The checksum (CS) of Page 0 is simply the sum of all the half words in Page 0, excluding the two half words of the word at the address in Table 2. The checksum must also be stored at this address. The cyclic redundancy check (CRC) is calculated as described in the data sheet of the relevant devices and is the same as will be calculated by the device using the flash sign command for Page 0. The programming sequence can be initiated and controlled by a diagnosis tester, which is connected to the LIN master and which can be a controller area network (CAN). To facilitate the routing of the diagnosis messages from CAN to LIN, the LIN protocol for programming the module must comply with the LIN Specification Package (Revision 2.2A, December 31, 2010). Rev. C | Page 1 of 9 AN-946 Application Note TABLE OF CONTENTS Introduction ...................................................................................... 1 Read-by-Identifier .........................................................................6 Running the LIN Loader ................................................................. 1 Erase Routine .................................................................................8 Revision History ............................................................................... 2 Request Download ........................................................................8 Frame Structure ................................................................................ 5 Transfer Data..................................................................................8 Frames Implemented in the On-Chip Loader .............................. 6 Check Routine ...............................................................................9 Assign NAD .................................................................................. 6 ECU Reset ......................................................................................9 REVISION HISTORY 7/15—Rev. B to Rev. C Changed ADuC703x to ADuC7032, ADuC7033, and ADuC7039 ...................................................................... Throughout Changed ADuCM33x to ADuCM330 and ADuCM331 ............................................................................ Throughout Changed Running the ADuC703x Loader Section to Running the LIN Loader Section .................................................................... 1 Changes to Introduction Section, Table 1, and Running the LIN Loader Section .......................................................................... 1 Added Table 2; Renumbered Sequentially .................................... 1 Changes to Figure 1 .......................................................................... 3 Added Figure 2 .................................................................................. 4 Changed Packet Structure Section to Frame Structure Section .............................................................................. 5 Changes to Frame Structure Section, Table 3, and Table 4 ......... 5 Changed Commands Implemented in the On-Chip Loader Section to Frames Implemented in the On-Chip Loader Section ................................................................................................ 6 Changes to Frames Implemented in the On-Chip Loader Section, Assign NAD Section, Table 5, Table 6, Read-byIdentifier Section, Table 7, and Table 8 .......................................... 6 Changed Identifier 0x32, Identifier 0x33, and Identifier 0x34 Section to Identifier 0x30 to Identifier 0x34 ..................................7 Changes to Identifier 0x30 to Identifier 0x34 Section ..................7 Changes to Table 9 and Table 10 .....................................................7 Changes to Erase Routine Section, Table 11, Request Download Section, Table 12, Transfer Data Section, and Table 13 ................8 Deleted Sample LIN Programming Utilities Section....................8 Added Cortex-M3 Devices Only Section.......................................9 Changes to Table 14, Request (Check Routine) Section, Table 15, ECU Reset Section, and Table 16 ....................................9 4/13—Rev. A to Rev. B Added ADuCM330/ADuCM331 ..................................... Universal 4/11—Rev. 0 to Rev. A Changes to Introduction Section ....................................................1 Changes to Request Section .............................................................5 Added Table 4; Renumbered Sequentially .....................................5 5/08—Revision 0: Initial Version Rev. C | Page 2 of 9 Application Note AN-946 INITIALIZE ON-CHIP PERIPHERALS TO FACTORY CALIBRATED STATE SOFTWARE RESET N N Y PIN RESET? Y NTRST = 1 N Y POR RESET? CHECK CODE 0xFFFFFFFF N Y Y KEY 0x27011970 N Y WDT RESET? N Y CHECKSUM KERNEL CS ERROR Y N N FLAG PAGE 0 ERROR KICK WDT. TRY TO SWITCH OFF WDT. KICK WDT RUN USER CODE LIN RECEIVED? Y N N 1 HOUR PASSED? POWER DOWN Y N Y USER RESET? RESET 1 HOUR TIMER RESET COMMAND? N Y Figure 1. Kernel Flowchart—Arm 7 Devices Rev. C | Page 3 of 9 07126-001 HANDLE LIN COMMAND AN-946 Application Note NO POWER DOWN YES POR RESET? PIN RESET? NO SOFTWARE RESET YES CLEAR SRAM TO 0 NO WDT RESET? NO SRAM ECC OK? YES INITIALIZE AND CALIBRATE DEVICE DRIVE GPIO3 HIGH GPIO5 HIGH? LIN LIN ACTIVITY? LOW NO HIGH RX PAGE 0 OK? YES SWITCH TO RX/TX PINS NO NO BOOT LOADER OK? YES RUN LIN PROTOCOL 6 YES 1 HOUR TIMEOUT? USER CODE RUN BOOT LOADER RUN APPLICATION FROM 0x00000000 NO SOFTWARE RESET? YES NO SOFTWARE RESET? YES NO SOFTWARE RESET? YES 07126-002 NO Figure 2. Kernel Flowchart—Cortex-M3 Devices Rev. C | Page 4 of 9 Application Note AN-946 FRAME STRUCTURE The LIN communication with the loader must comply with the following general requirements as per the LIN Diagnostic and Configuration Specification, Revision 2.0, September 23, 2003: The kernel must implement a slot for each of the two LIN diagnostic frames: master request frame and slave response frame. The request from the LIN master must comply with the packet data unit (PDU) format shown in Table 3. The responses must comply with the PDU format shown in Table 4. Only the PCI type, single frame (SF) can be used. First frame (FF) and consecutive frames (CF) are not supported. All frames use the classic checksum. Unrecognized frames are ignored. Any frame with an error, such as a communication error, is ignored. Thus, a faulty erase routine frame is ignored. A faulty request download frame is ignored and, therefore, subsequent transfer data frames are not recognized and no programming occurs. Any faulty transfer data frame terminates recognition of transfer data frames. In fact, any frame with correct NAD and PCI ≠ 0x05 or SID ≠ 0x36 or a wrong checksum terminates recognition of transfer data frames. The addresses shown in the Values column in Table 6 through Table 8 and Table 10 through Table 16 in the Frames Implemented in the On-Chip Loader section are hard coded values and are not examples. Table 3. Frame Identifier 0x3C Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Description Node address (NAD) Protocol control information (PCI) Service identifier (SID) Data 1 Data 2 Data 3 Data 4 Data 5 Table 4. Frame Identifier 0x3D Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Rev. C | Page 5 of 9 Description Node address Protocol control information Response identifier (RSID = SID + 0x40) Data 1 Data 2 Data 3 Data 4 Data 5 AN-946 Application Note FRAMES IMPLEMENTED IN THE ON-CHIP LOADER Seven request frames, described in this section, are implemented in Protocol 6. Assign NAD Read-by-identifier Erase routine Request download Transfer data Check routine ECU reset Before starting the programming sequence, the diagnosis tester requests an identification of the LIN slave using the read-byidentifier request to ensure the correct slave type is connected. Request (Read-by-Identifier) Four identifiers (Identifier 0x0, Identifier 0x32, Identifier 0x33, and Identifier 0x34) are supported. Table 7. Read-By-Identifier Request Some of the request frames have corresponding response frames as detailed after each request frame. ASSIGN NAD This request assigns a new NAD to the slave so that subsequent diagnostic requests are directed to this specific slave. Request (Assign NAD) The LIN Consortium assigned the supplier ID, 0x003A, to Analog Devices, Inc.. The function IDs for Protocol 6 are listed in Table 5. MSB 0x00 0x00 0x00 0x4D 0x4D Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 LSB 0x32 0x32 0x39 0x30 0x31 Identifier 0x0 Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Table 6. Assign NAD Request Description Initial NAD PCI SID Analog Devices supplier ID LSB Analog Devices supplier ID MSB Function ID LSB Function ID MSB New NAD Values User value 0x06 0xB2 0x0/0x32/0x33/0x34 0x3A 0x00 See Table 5 See Table 5 Table 8. Identifier 0x0 Data Frame Response To guard against the loss of a slave as a result of network corruption, the slave always recognizes an Assign NAD frame with the broadcast NAD 0x7F. This recognition occurs regardless of what the actual NAD of the slave is when this Assign NAD frame is transmitted. The kernel then makes the decision whether or not the frame is intended for this slave by checking the supplier ID and function ID. Function ID 0x32 is used as an example within this document. Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Description NAD PCI SID Identifier AD supplier ID LSB AD supplier ID MSB Function ID LSB Function ID MSB The read-by-identifier request with Identifier 0x0 returns the LIN product identification information. This information consists of the 8-byte data frame response shown in Table 8. Table 5. Function IDs Device ADuC7032 ADuC7033 ADuC7039 ADuCM330 ADuCM331 READ-BY-IDENTIFIER Values 0x7F 0x06 0xB0 0x3A 0x00 See Table 5 See Table 5 User value Response (Assign NAD) The slave does not respond to this request. Rev. C | Page 6 of 9 Description NAD PCI RSID AD Supplier ID LSB AD Supplier ID MSB Function ID LSB Function ID MSB Variant Values User value 0x06 0xF2 0x3A 0x00 See Table 5 See Table 5 0x00 Application Note AN-946 Identifier 0x30 to Identifier 0x34 Response (Read-by-Identifier) The response to these identifiers return user configured data from device memory. The loader expects the contents of the data bytes to be located in the last page of the Flash/EE memory as shown in Table 9. Positive response of the LIN slave is shown in Table 10. Table 9. Flash Locations Allocated to Other Identifiers Address Base + 0xE3 Base + 0xE4 Base + 0xE5 Base + 0xE6 Base + 0xE7 Base + 0xE8 Base + 0xE9 Base + 0xEA Base + 0xFB Base + 0xFC Base + 0xED Base + 0xEE Base + 0xEF Base + 0xF0 Base + 0xF1 Base + 0xF2 Base + 0xF3 Base + 0xF4 Base + 0xF5 Base + 0xF6 Base + 0xF7 Base + 0xF8 Base + 0xF9 Base + 0xFA Base + 0xFB ID 0x30 0x30 0x30 0x30 0x30 0x31 0x31 0x31 0x31 0x31 0x32 0x32 0x32 0x32 0x32 0x33 0x33 0x33 0x33 0x33 0x34 0x34 0x34 0x34 0x34 Byte Data 1 Data 2 Data 3 Data 4 Data 5 Data 1 Data 2 Data 3 Data 4 Data 5 Data 1 Data 2 Data 3 Data 4 Data 5 Data 1 Data 2 Data 3 Data 4 Data 5 Data 1 Data 2 Data 3 Data 4 Data 5 Contents User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value User value Table 10. Read-by-Identifier Slave Response Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 The slave does not give a negative response. Note the following: Description NAD PCI RSID Data 1 Data 2 Data 3 Data 4 Data 5 The last four bytes of the last page of the Flash/EE memory are reserved for the checksum. The ADuC7032, ADuC7033, and ADuC7039 have the base Address 0x97700 and only Identifier 0x32 to Identifier 0x34 can be used. The ADuCM330 has the base Address 0x17F00 and only Identifier 0x30 to Identifier 0x32 can be used. The ADuCM331 has the base Address 0x1FF00 and only Identifier 0x30 to Identifier 0x32 can be used. Rev. C | Page 7 of 9 Values User value 0x06 0xF2 User value User value User value User value User value AN-946 Application Note ERASE ROUTINE REQUEST DOWNLOAD Overview Refer to the Overview section. It is possible to erase several pages at once and to request the download and transfer of update data for several subsequent pages. Which update strategy is chosen depends only on the diagnosis tester. However, because 1 in 1000 LIN frames can be expected to show a transmission error, repeating the erase, programming, and verification cycle independently for each single page is recommended. The following three constraints must be taken into account: Request (Request Download) It is not possible to program a memory area smaller than one Flash page of the slave. Special consideration must be given to Page 0 programming. It must initially be left with Check Code 0xFFFFFFFF. In addition to the verification of the single Flash/EE memory pages, a verification of the checksum of the entire user Flash/EE memory area is recommended before assuming the code is correctly downloaded. After the last page is verified, Page 0 must be reprogrammed (without erasing), except this time the desired check code must be included. Table 12. Request Download Request Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Description NAD PCI SID Index of start page, LSB P Index of start page, MSB P Number of pages to be programmed, N Unused Unused Values User value 0x04 0x34 User value User value User value 0xFF 0xFF The request download request defines the memory area to be programmed. The subsequent data, transmitted via the transfer data frames, is written to N number of pages, starting with Page P. Note that programming always starts at a page boundary and partial programming of pages is not advised. Response (Request Download) The slave does not respond to this request. Request (Erase Routine) TRANSFER DATA The erase routine erases the contents of N number of Flash pages, starting with Page P. The value N = 0 is reserved for future use. These requests are acted on only when following a request download request. Table 11. Erase Routine Request Request (Transfer Data) Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Description NAD PCI SID Subfunction ID, first byte Subfunction ID, second byte Index of start page, LSB P Index of start page, MSB P Number of pages to be erased, N Values User value 0x06 0x31 0xFF 0x00 User value User value User value Index, in Byte 6 and Byte 7, is the page start address right shifted to allow the page size. For example, for the ADuC7032, the start address of Page 2 in Flash/EE memory is 0x80400. This number right shifted by nine bits (for 0x200 bytes per page) is 0x0402. This is represented as Byte 6 = 0x02 and Byte 7 = 0x04. Response (Erase Routine) The slave does not respond to this request. The transfer data frames transmit Flash data. The slave expects N × bytes per page of data, where N is the number of pages as defined by the request download request. Only full 4-byte words are allowed. With LIN scheduled at 10 ms per frame, it takes approximately 512/4 × 10 ms = 1.28 sec to flash a single 512-byte page. Table 13. Data Transfer Request Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Description NAD PCI SID Data 1 Data 2 Data 3 Data 4 Unused Response (Transfer Data) The slave does not respond to this request. Rev. C | Page 8 of 9 Values User value 0x05 0x36 User value User value User value User value 0xFF Application Note AN-946 CHECK ROUTINE Response (Check Routine) Request (Check Routine) Table 15. Check Routine Response The check routine calculates the checksum for the memory area starting with Page P and ending with Page P + N − 1. The response, with N = 0, is undefined. Run this check for each single page, and also after all programming is done because errors in the erase or download could affect pages other than the intended pages. Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 The diagnosis tester compares the checksum received from the LIN slave with a reference checksum provided in the Flash data container. If the checksums differ, the programming procedure is repeated. The checksum is the sum over all 16-bit values from the first 16-bit half word of Page P to the last 16-bit half word of Page P + N − 1. Checksum = (Σ 16-bit words) Modulo 32. After the check routine request is received, the slave requires about 1 μs per byte to calculate the checksum. Do not initiate the response frame before sufficient time to complete the check has elapsed. This is only relevant to multipage checks because single page checks are always fast enough. Analog Devices assumes an error model in which not all the half words or bits in the checked area are programmed as required. Such a page always shows fewer zeros and gives a higher checksum. Alternatively, programming an unerased page consistently gives more zeros and a lower checksum. The third possibility is single incorrect half words or bits. The probability for detecting such errors is the same whether one uses a cyclic redundancy check (CRC) or the simple checksum. Cortex-M3 Devices Only If, in addition to the index of Start Page P, the MSB (bit 7 of byte 7) is set, the chip calculates the CRC of the requested block instead of the CS. This allows two methods of checking the downloaded code for even more confidence that the download is correct. Table 14. Check Routine Request Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Description NAD PCI SID Subfunction ID, first byte Subfunction ID, second byte Index of start page, LSB P Index of start page, MSB P Number of pages, N Description NAD PCI RSID Checksum LSB Checksum, second byte Checksum, third byte Checksum, MSB Unused Values User value 0x05 0x71 User value User value User value User value 0xFF ECU RESET Request (ECU Reset) Table 16. ECU Reset Request Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Description NAD PCI SID Subfunction ID Unused Unused Unused Unused Values User value 0x02 0x11 0x01 0xFF 0xFF 0xFF 0xFF The ECU reset performs a reset of the slave. The ADuC7032, ADuC7033, ADuC7039, ADuCM330, or ADuCM331 device restarts as shown in Figure 1. If the value check code is valid, this results in the execution of the application software. Response (ECU Reset) The slave does not respond to this request. Values User value 0x06 0x31 0xFF 0x01 User value User value User value ©2008–2015 Analog Devices, Inc. All rights reserved. Trademarks and registered trademarks are the property of their respective owners. AN07126-0-7/15(C) Rev. C | Page 9 of 9