Features • Protocol – UART Used as a Physical Layer – Based on the Intel Hex-type Records – Autobaud • In-System Programming – Read/Write Flash and EEPROM Memories – Read Device ID – Full-chip Erase – Read/Write Configuration Bytes – Security Setting From ISP Command – Remote Application Start Command • In-Application Programming/Self-Programming – Read/Write Flash and EEPROM Memories – Read Device ID – Block Erase – Read/Write Configuration Bytes – Bootloader Start 80C51 Microcontrollers Description This document describes the UART bootloader functionalities as well as the serial protocol to efficiently perform operations on the on-chip Flash memory. Additional information on the T89C5115 product can be found in the T89C5115 datasheet and the T89C5115 errata sheet available on the Atmel web site, www.atmel.com. T89C5115 UART Bootloader The bootloader software Package (source code and binary) currently used for production is available from the Atmel web site. Bootloader Revision Purpose of Modifications Date Revisions 1.0.0 First release 03/12/2001 Rev. 4225B–8051–12/03 1 Functional Description The T89C5115 Bootloader facilitates In-System Programming and In-Application Programming. In-System Programming (ISP) Capability In-System Programming allows the user to program or reprogram a microcontroller’s onchip Flash memory without removing it from the system and without the need of a preprogrammed application. The UART bootloader can manage communication with a host through the serial network. It can also access and perform requested operations on the on-chip Flash memory. In-Application Programming or Selfprogramming capability In-Application Programming (IAP) allows the reprogramming of a microcontroller’s onchip Flash memory without removing it from the system and while the embedded application is running. The UART bootloader contains some Application Programming Interface routines named API routines allowing IAP by using the user’s firmware. Block Diagram This section describes the different parts of the bootloader. Figure 1 shows the on-chip bootloader and IAP processes. Figure 1. Bootloader Process Description On chip User Application External Host via the UART Protocol Communication IAP User Call Management ISP Communication Management Flash Memory Management Flash Memory 2 T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader ISP Communication Management The purpose of this process is to manage the communication and its protocol between the on-chip bootloader and an external device (host). The on-chip bootloader implements a Serial protocol (see Section “Protocol”, page 9). This process translates serial communication frames (UART) into Flash memory accesses (read, write, erase...). User Call Management Several Application Program Interface (API) calls are available to the application program to selectively erase and program Flash pages. All calls are made through a common interface (API calls) included in the bootloader. The purpose of this process is to translate the application request into internal Flash Memory operations. Flash Memory Management This process manages low level accesses to the Flash memory (performs read and write accesses). Bootloader Configuration Configuration and Manufacturer Information The following table lists Configuration and Manufacturer byte information used by the bootloader. This information can be accessed through a set of API or ISP commands. Mnemonic Description Default Value BSB Boot Status Byte FFh SBV Software Boot Vector FCh P1_CF Port 1 Configuration FEh P3_CF Port 3 Configuration FFh P4_CF Port 4 Configuration FFh SSB Software Security Byte FFh EB Extra Byte FFh Manufacturer 58h ID1: Family code D7h ID2: Product Name BBh ID3: Product Revision FFh 3 4225B–8051–12/03 Mapping and Default Value of Hardware Security Byte The 4 Most Significant Byte (MSB) of the Hardware Byte can be read/written by software (this area is called Fuse bits). The 4 Less Significant Byte (LSB) can only be read by software and written by hardware in parallel mode (with parallel programmer devices). Bit Position Default Value Description 7 X2B U To start in x1 mode 6 BLJB P To map the boot area in code area between F800hFFFFh 5 Reserved U 4 Reserved U 3 Reserved U 2 LB2 P 1 LB1 U 0 LB0 U Note: Security Mnemonic To lock the chip (see datasheet) U: Unprogram = 1 P: Program = 0 The bootloader has Software Security Byte (SSB) to protect itself from user access or ISP access. The Software Security Byte (SSB) protects from ISP accesses. The command "Program Software Security Bit" can only write a higher priority level. There are three levels of security: • level 0: NO_SECURITY (FFh) This is the default level. From level 0, one can write level 1 or level 2. • level 1: WRITE_SECURITY (FEh) In this level it is impossible to write in the Flash memory, BSB and SBV. The Bootloader returns an error message. From level 1, one can write only level 2. • level 2: RD_WR_SECURITY (FCh) Level 2 forbids all read and write accesses to/from the Flash memory. The Bootloader returns an error message. Only a full chip erase command can reset the software security bits. 4 Level 0 Level 1 Level 2 Flash/EEPROM Any access allowed Read only access allowed All access not allowed Fuse bit Any access allowed Read only access allowed All access not allowed BSB & SBV & EB Any access allowed Read only access allowed All access not allowed SSB Any access allowed Write level2 allowed Read only access allowed Manufacturer info Read only access allowed Read only access allowed Read only access allowed Bootloader info Read only access allowed Read only access allowed Read only access allowed Erase block Allowed Not allowed Not allowed Full chip erase Allowed Allowed Allowed Blank check Allowed Allowed Allowed T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Software Boot Vector The Software Boot Vector (SBV) forces the execution of a user bootloader starting at address [SBV]00h in the application area (FM0). The way to start this user bootloader is described in the section ’Boot Process’. Figure 2. Software Boot Vector UART Bootloader FM1 User Bootloader Application [SBV]00h FM0 FLIP Software Program FLIP is a PC software program running under Windows® 9x//2000/XP, Windows NT® and LINUX® that supports all Atmel Flash microcontroller. This software program is available free of charge from the Atmel web site. 5 4225B–8051–12/03 In-System Programming The ISP allows the user to program or reprogram a microcontroller’s on-chip Flash memory through the serial line without removing it from the system and without the need of a pre-programmed application. This section describes how to start the UART bootloader and all higher level protocol over the serial line. Boot Process Hardware Condition The bootloader can be activated in two ways: • Hardware condition • Regular boot process The Hardware Condition forces the bootloader execution from reset. The default factory Hardware Condition is assigned to port P1. • P1 must be equal to FEh In order to offer the best flexibility, the user can define its own Hardware Condition on one of the following Ports: • Port1 • Port3 • Port4 (only bit0 and bit1) The Hardware Condition configuration is stored in three bytes called P1_CF, P3_CF, P4_CF. These bytes can be modified by the user through a set of API or through an ISP command. There is a priority between P1_CF, P3_CF and P4_CF (see boot process diagram). Note: 6 The BLJB must ba at 0 (programmed) to be able to restart the bootloader. If the BLJB is equal to 1 (unprogrammed) only the hardware parallel programmer can change this bit (see T89C5115 Datasheet for more detail). T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Figure 3. Regular Boot Process Bit ENBOOT in AUXR1 Register is Initialized with BLJB Inverted Hardware Boot Process RESET ENBOOT = 0 PC = 0000h Yes BLJB = 1 No No No Software Boot Process No No P3_CF = P3 Yes Yes Yes P1_CF = FFh P1_CF = P1 Yes ENBOOT = 1 PC = F800h BSB = 0 P3_CF = FFh No No Yes P4_CF = FFh Yes P4_CF = P4 Yes No SBV < 3Fh No Yes Start Application Start User Bootloader Start Bootloader 7 4225B–8051–12/03 Physical Layer Frame Description The UART used to transmit information has the following configuration: • Character: 8-bit data • Parity: none • Stop: 2 bit • Flow control: none • Baud rate: autobaud is performed by the bootloader to compute the baud rate chosen by the host. The Serial Protocol is based on the Intel Hex-type records. Intel Hex records consist of ASCII characters used to represent hexadecimal values and are summarized below. Table 1. Intel Hex Type Frame Record Mark ‘:’ Record length Load Offset Record Type Data or Info Checksum 1 byte 1 byte 2 bytes 1 bytes n byte 1 byte • Record Mark: – • Record length: – • Data/Info is a variable length field. It consists of zero or more Bytes encoded as pairs of hexadecimal digits. The meaning of data depends on the Record Type. Checksum: – 8 Record Type specifies the command type. This field is used to interpret the remaining information within the frame. Data/Info: – • Load Offset specifies the 16-bit starting load offset of the data Bytes, therefore this field is used only for Data Program Record. Record Type: – • Record length specifies the number of Bytes of information or data which follows the Record Type field of the record. Load Offset: – • Record Mark is the start of frame. This field must contain ’:’. The two’s complement of the 8-bit Bytes that result from converting each pair of ASCII hexadecimal digits to one Byte of binary, and including the Record Length field to and including the last Byte of the Data/Info field. Therefore, the sum of all the ASCII pairs in a record after converting to binary, from the Record Length field to and including the Checksum field, is zero. T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Protocol Overview An initialization step must be performed after each Reset. After a microcontroller reset, t h e b o o tl o a d e r w a it s f o r a n a u t o b a u d s e q u e n c e ( s e e S e c t io n “ A u t o b a u d Performances”). When the communication is initialized, the protocol depends on the record type issued by the host. Communication Initialization The host initiates the communication by sending a ’U’ character to help the bootloader to compute the baudrate (autobaud). Figure 4. Initialization Bootloader Host Autobaud Performances Init Communication "U" If (not received "U") Else Communication Opened "U" Performs Autobaud Sends Back ‘U’ Character The bootloader supports a wide range of baud rates. It is also adaptable to a wide range of oscillator frequencies. This is accomplished by measuring the bit-time of a single bit in a received character. This information is then used to program the baud rate in terms of timer counts based on the oscillator frequency. Table 2 shows the autobaud capabilities. Table 2. Autobaud Performances Frequency (MHz) Baudrate (kHz) 1.8432 2 2.4576 3 3.6864 4 5 6 7.3728 2400 OK OK OK OK OK OK OK OK OK 4800 OK - OK OK OK OK OK OK OK 9600 OK - OK OK OK OK OK OK OK 19200 OK - OK OK OK - - OK OK 38400 - - OK OK - OK OK OK 57600 - - - - OK - - - OK 115200 - - - - - - - - OK Baudrate (kHz) 8 10 11.0592 12 14.746 16 20 24 26.6 2400 OK OK OK OK OK OK OK OK OK 4800 OK OK OK OK OK OK OK OK OK 9600 OK OK OK OK OK OK OK OK OK 19200 OK OK OK OK OK OK OK OK OK Frequency (MHz) 9 4225B–8051–12/03 Frequency (MHz) Baudrate (kHz) 8 10 11.0592 12 14.746 16 20 24 26.6 38400 - - OK OK OK OK OK OK OK 57600 - - OK - OK OK OK OK OK 115200 - - OK - OK - - - - Command Data Stream Protocol All commands are sent using the same flow. Each frame sent by the host is echoed by the bootloader. Figure 5. Command Flow Host Sends first character of the Frame Bootloader ":" If (not received ":") ":" Else Sends echo and start reception Sends frame (made of 2 ASCII characters per Byte) Echo analysis 10 Gets frame, and sends back echo for each received Byte T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Programming the Flash or EEPROM data The flow described below shows how to program data in the Flash memory or in the EEPROM data memory. The bootloader programs on a page of 128 bytes basis when it is possible. The host must take care that: • The data to program transmitted within a frame are in the same page. Requests from Host Answers from Bootloader Command Name Record Type Load Offset Program Flash 00h Program EEPROM Data 07h Record Length Data[0] ... Data[127] start address nb of Data x ... x start address nb of Data x ... x The bootloader answers with: • ‘.’ & ‘CR’ & ’LF’ when the data are programmed • ‘X’ & ‘CR’ & ‘LF’ if the checksum is wrong • ‘P’ & ‘CR’ & ‘LF’ if the Security is set Flow Description Bootloader Host Write Command Send Write Command Wait Write Command OR Checksum error Wait Checksum Error ’X’ & CR & LF Send Checksum error COMMAND ABORTED NO_SECURITY OR Wait Security Error ’P’ & CR & LF Send Security error COMMAND ABORTED Wait Programming ’.’ & CR & LF Wait COMMAND_OK Send COMMAND_OK COMMAND FINISHED Example Programming Data (write 55h at address 0010h in the Flash) HOST : 01 0010 00 55 9A BOOT LOADER : 01 0010 00 55 9A . CR LF 11 4225B–8051–12/03 Read the Flash or EEPROM Data The flow described below allows the user to read data in the Flash memory or in the EEPROM data memory. A blank check command is possible with this flow. The device splits into blocks of 16 bytes the data to transfer to the Host if the number of data to display is greater than 16 data bytes. Requests from Host Command Name Record Type Load Offset Record Length Data[0] Data[1] Data[2] Data[3] Read Flash 00h Blank check on Flash 04h x 05h start address end Address Read EEPROM Data Note: Answers from Bootloader Data[4] 01h 02h The field ’Load offset’ is not used. The bootloader answers to a read Flash or EEPROM Data memory command: • ‘Address = data‘ & ‘CR’ & ’LF’ up to 16 data by line. • ‘X’ & ‘CR’ & ‘LF’ if the checksum is wrong • ‘L’ & ‘CR’ & ‘LF’ if the Security is set The bootloader answers to blank check command: • ‘.’ & ‘CR’ & ’LF’ when the blank check is ok • ‘First Address wrong’ ‘CR’ & ‘LF’ when the blank check is fail • ‘X’ & ‘CR’ & ‘LF’ if the checksum is wrong • ‘P’ & ‘CR’ & ‘LF’ if the Security is set Flow Description: Blank Check Command Bootloader Host Send Blank Check Command Blank Check Command Wait Blank Check Command OR Wait Checksum Error Checksum Error ’X’ & CR & LF Send Checksum Error COMMAND ABORTED Flash Blank OR Wait COMMAND_OK ’.’ & CR & LF Send COMMAND_OK COMMAND FINISHED Wait Address Not Erased address & CR & LF Send First Address Not Erased COMMAND FINISHED 12 T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Example Blank Check ok HOST : 05 0000 04 0000 7FFF 01 78 BOOT LOADER : 05 0000 04 0000 7FFF 01 78 . CR LF Blank Check ko at address xxxx HOST : 05 0000 04 0000 7FFF 01 78 BOOT LOADER : 05 0000 04 0000 7FFF 01 78 xxxx CR LF Blank Check with checksum error HOST : 05 0000 04 0000 7FFF 01 70 BOOT LOADER : 05 0000 04 0000 7FFF 01 70 X CR LF CR LF Flow Description: Read Command Bootloader Host Send Display Command Display Command Wait Display Command OR Wait Checksum Error Checksum Error ’X’ & CR & LF Send Checksum Error COMMAND ABORTED RD_WR_SECURITY OR Wait Security Error ’L’ & CR & LF Send Security Error COMMAND ABORTED Read Data All Data Read Complete Frame Wait Display Data All Data Read COMMAND FINISHED Note: "Address = " "Reading value" CR & LF Send Display Data All Data Read COMMAND FINISHED The maximum size of block is 400h. To read more than 400h Bytes, the Host must send a new command. 13 4225B–8051–12/03 Example Display data from address 0000h to 0020h HOST Program Configuration Information : 05 0000 04 0000 0020 00 D7 BOOT LOADER : 05 0000 04 0000 0020 00 D7 BOOT LOADER 0000=-----data------ CR LF (16 data) BOOT LOADER 0010=-----data------ CR LF (16 data) BOOT LOADER 0020=data CR LF ( 1 data) The flow described below allows the user to program Configuration Information regarding the bootloader functionality. The Boot Process Configuration: – BSB – SBV – P1_CF, P3_CF, P4_CF – Fuse bits (BLJB and X2 bits) (see Section “Mapping and Default Value of Hardware Security Byte”) – SSB – EB Requests from Host Command Name Record Type Load Offset Record Length Data[0] Data[1] Data[2] 02h 04h 00h - 00h - 02h 05h Program SSB level2 01h - Program BSB 00h Program SBV 01h Erase SBV & BSB Program SSB level1 Program P1_CF 03h 02h x 03h 06h value Program P3_CF 03h Program P4_CF 04h Program EB 06h Program bit BLJB 04h 03h 0Ah Program bit X2 Note: bit value 08h 1. The field ’Load Offset’ is not used. 2. To program the BLJB and X2 bit the ’bit value’ is 00h or 01h. Answers from Bootloader 14 The bootloader answers with: • ‘.’ & ‘CR’ & ’LF’ when the value is programmed • ‘X’ & ‘CR’ & ‘LF’ if the checksum is wrong • ‘P’ & ‘CR’ & ‘LF’ if the Security is set T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Flow Description Bootloader Host Write Command Send Write Command Wait Write Command OR Checksum error Wait Checksum Error ’X’ & CR & LF Send Checksum error COMMAND ABORTED NO_SECURITY OR Wait Security Error ’P’ & CR & LF Send Security error COMMAND ABORTED Wait Programming ’.’ & CR & LF Wait COMMAND_OK Send COMMAND_OK COMMAND FINISHED Example Programming Atmel function (write SSB to level 2) HOST : 02 0000 03 05 01 F5 BOOT LOADER : 02 0000 03 05 01 F5. CR LF Writing Frame (write BSB to 55h) HOST : 03 0000 03 06 00 55 9F BOOT LOADER : 03 0000 03 06 00 55 9F . CR LF 15 4225B–8051–12/03 Read Configuration Information or Manufacturer Information The flow described below allows the user to read the configuration or manufacturer information. Requests from Host Command Name Record Type Load Offset Record Length Data[0] Read Manufacturer Code Data[1] 00h Read Family Code 01h 00h Read Product Name 02h Read Product Revision 03h Read SSB 00h Read BSB 01h Read SBV 02h Read P1_CF 05h x 02h 07h 03h Read P3_CF 04h Read P4_CF 05h Read EB 06h Read HSB (Fuse bit) 0Bh Read Device ID1 00h 00h 0Eh Read Device ID2 Read Bootloader version Note: Answers from Bootloader 16 01h 0Fh 00h The field ’Load Offset’ is not used The bootloader answers with: • ‘value’ & ‘.’ & ‘CR’ & ’LF’ when the value is programmed • ‘X’ & ‘CR’ & ‘LF’ if the checksum is wrong • ‘P’ & ‘CR’ & ‘LF’ if the Security is set T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Flow Description Bootloader Host Read Command Send Read Command Wait Read Command OR Checksum error ’X’ & CR & LF Wait Checksum Error Send Checksum error COMMAND ABORTED RD_WR_SECURITY OR ’L’ & CR & LF Wait Security Error Send Security error COMMAND ABORTED Read Value ’value’ & ’.’ & CR & LF Wait Value of Data Send Data Read COMMAND FINISHED Example Read function (read SBV) HOST : 02 0000 05 07 02 F0 BOOT LOADER : 02 0000 05 07 02 F0 Value . CR LF Atmel Read function (read Bootloader version) HOST : 02 0000 01 02 00 FB BOOT LOADER : 02 0000 01 02 00 FB Value . CR LF 17 4225B–8051–12/03 Erase the Flash The flow described below allows the user to erase the Flash memory. Two modes of Flash erasing are possible: • Full-chip erase • Block erase The Full Chip erase command erases the whole Flash (16 Kbytes) and sets some Configuration Bytes to their default values: • BSB = FFh • SBV = FCh • SSB = FFh (NO_SECURITY) The full chip erase is always executed whatever the Software Security Byte value is. Note: Take care that the full chip erase execution takes few seconds (128 pages ) The Block erase command erases only a part of the Flash. Two Blocks are defined in the T89C5115: • block0 (from 0000h to 1FFFh) • block1 (from 2000h to 3FFFh) Requests from Host Command Name Record Type Load Offset Record Length Data[0] 02h 01h Erase block0 (0k to 8k) Erase block1 (8k to 16k) 00h 03h x Full chip erase Answers from Bootloader 18 Data[1] 20h 01h 07h - As the Program Configuration Information flows, the erase block command has three possible answers: • ‘.’ & ‘CR’ & ’LF’ when the data are programmed • ‘X’ & ‘CR’ & ‘LF’ if the checksum is wrong • ‘P’ & ‘CR’ & ‘LF’ if the Security is set T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Flow Description Bootloader Host Erase Command Send Erase Command Wait Erase Command OR Checksum Error Wait Checksum Error ’X’ & CR & LF Send Checksum error COMMAND ABORTED NO_SECURITY OR Wait Security Error ’P’ & CR & LF Send Security error COMMAND ABORTED Wait Erasing ’.’ & CR & LF Wait COMMAND_OK Send COMMAND_OK COMMAND FINISHED Example Full Chip Erase HOST : 01 0000 03 07 F5 BOOT LOADER : 01 0000 03 07 F5 . CR LF Erase Block1(8k to 16k) HOST : 02 0000 03 01 20 DA BOOT LOADER : 02 0000 03 01 20 DA . CR LF 19 4225B–8051–12/03 Start the Application The flow described below allows to start the application directly from the bootloader upon a specific command reception. Two options are possible: • Start the application with a reset pulse generation (using watchdog). When the device receives this command the watchdog is enabled and the bootloader enters a waiting loop until the watchdog resets the device. Take care that if an external reset chip is used, the reset pulse in output may be wrong and in this case the reset sequence is not correctly executed. • Start the application without reset A jump at the address 0000h is used to start the application without reset. Requests from Host Command Name Record Type Load Offset 03h x Start application with a reset pulse generation Data[0] 02h Start application with a jump at ’address’ Answer from Bootloader Record Length Data[1] Data[2] Data[3] 00h - - 03h 04h 01h Address No answer is returned by the device. Example Start Application with reset pulse HOST : 02 0000 03 03 00 F8 BOOT LOADER : 02 0000 03 03 00 F8 Start Application without reset at address 0000h 20 HOST : 04 0000 03 03 01 00 00 F5 BOOT LOADER : 04 0000 03 03 01 00 00 F5 T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader In-Application Programming/Selfprogramming The IAP allows to reprogram the microcontroller’s on-chip Flash memory without removing it from the system and while the embedded application is running. The user application can call some Application Programming Interface (API) routines allowing IAP. These API are executed by the bootloader. To call the corresponding API, the user must use a set of Flash_api routines which can be linked with the application. Example of Flash_api routines are available on the Atmel web site on the software application note: C Flash Drivers for the T89C5115 The Flash_api routines on the package work only with the UART bootloader. The Flash_api routines are listed in APPENDIX-2. API Call Process The application selects an API by setting R1, ACC, DPTR0 and DPTR1 registers. All calls are made through a common interface ’USER_CALL’ at the address FFF0h. The jump at the USER_CALL must be done by LCALL instruction to be able to comeback into the application. Before jump at the USER_CALL, the bit ENBOOT in AUXR1 register must be set. Constraints The interrupts are not disabled by the bootloader. Interrupts must be disabled by user prior to jump to the USER_CALL, then re-enabled when returning. Interrupts must also be disabled before accessing EEPROM Data then re-enabled after. The user must take care of hardware watchdog before launching a Flash operation. For more information regarding the Flash writing time see the T89C5115 datasheet. API Commands Read/Program Flash and EEPROM Data Memory Several types of APIs are available: • Read/Program Flash and EEPROM Data memory • Read Configuration and Manufacturer Information • Program Configuration Information • Erase Flash • Start Bootloader All routines to access EEPROM Data are managed directly from the application without using bootloader resources. To read the Flash memory the bootloader is not involved. For more details on these routines see the T89C5115 datasheet sections ’Program/Code Memory’ and ’EEPROM Data Memory’. Two routines are available to program the Flash: – __api_wr_code_byte – __api_wr_code_page 21 4225B–8051–12/03 • The application program load the column latches of the Flash then call the __api_wr_code_byte or __api_wr_code_page see data sheet in section ’Program/Code Memory’. • Parameter Settings • API_name R1 DPTR0 DPTR1 Acc __api_wr_code_byte 02h Address in Flash memory to write - Value to write __api_wr_code_page 09h Address of the first Byte to program in the Flash memory Address in XRAM of the first data to program Number of Byte to program instruction: LCALL FFF0h. Note: Read Configuration and Manufacturer Information • Parameter Settings API_name R1 DPTR0 DPTR1 Acc __api_rd_HSB 0Bh 0000h x return HSB __api_rd_BSB 07h 0001h x return BSB __api_rd_SBV 07h 0002h x return SBV __api_rd_SSB 07h 0000h x return SSB __api_rd_EB 07h 0006h x return EB __api_rd_manufacturer 00h 0000h x return manufacturer id __api_rd_device_id1 00h 0001h x return id1 __api_rd_device_id2 00h 0002h x return id2 __api_rd_device_id3 00h 0003h x return id3 __api_rd_bootloader_version 0Fh 0000h x return value • Instruction: LCALL FFF0h. • At the complete API execution by the bootloader, the value to read is in the api_value variable. Note: Program Configuration Information 22 No special resources are used by the bootloader during this operation • No special resources are used by the bootloader during this operation Parameter Settings API Name R1 DPTR0 DPTR1 Acc __api_set_X2 0Ah 0008h x 00h __api_clr_X2 0Ah 0008h x 01h __api_set_BLJB 0Ah 0004h x 00h __api_clr_BLJB 0Ah 0004h x 01h __api_wr_BSB 06h 0000h x value to write __api_wr_SBV 06h 0001h x value to write __api_wr_EB 06h 0006h x value to write __api_wr_SSB_LEVEL0 05h FFh x x __api_wr_SSB_LEVEL1 05h FEh x x T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader API Name R1 DPTR0 DPTR1 Acc __api_wr_SSB_LEVEL2 05h FCh x x • Instruction: LCALL FFF0h. Note: 1. See in the T89C5115 data sheet the time that a write operation takes. 2. No special resources are used by the bootloader during these operations Erase Flash The T89C5115 Flash memory is divided in to two blocks: Block 0: from address 0000h to 1FFFh Block 1: from address 2000h to 3FFFh These two blocks contain 64 pages. • Parameter Settings API_name R1 __api_erase_block0 DPTR0 DPTR1 Acc 0000h x x 2000h x x 01h __api_erase_block1 • Instruction: LCALL FFF0h. Note: 1. See the T89C5115 data sheet for the time that a write operation takes, this time must be multiplied by the number of pages. 2. No special resources are used by the bootloader during these operations Start Bootloader This routine allows to start at the beginning of the bootloader as after a reset. After calling this routine the regular boot process is performed and the communication must be opened before any action. • No special parameter setting • Set bit ENBOOT in AUXR1 register • instruction: LJUMP or LCALL at address F800h 23 4225B–8051–12/03 Appendix-A Table 3. Summary of Frames From Host Record Type Command Program Nb Data Byte in Flash. 00h Record Length Offset Data[0] Data[1] Data[2] Data[3] Data[4] nb of data (up to 80h) start address x x x x x 00h - - - 02h x 01h 20h - - - 00h - - - Erase block0 (0000h-1FFFh) Erase block1 (2000h-3FFFh) Start application with a reset pulse generation 02h x 03h Start application with a jump at ’address’ 04h Erase SBV & BSB x x Program SSB level 1 02h 01h 04h address - 00h - - - 00h - - - x 01h - - - x 00h value - - x 01h value - - 02h value - - x 05h Program SSB level 2 Program BSB 03h Program SBV Program P1_CF x 03h 06h Program P3_CF x 03h value - - Program P4_CF x 04h value - - Program EB x 06h value - - - - - - 04h bit value - - 08h bit value - - Full Chip Erase 01h Program bit BLJB x 07h x 03h Program bit X2 0Ah x Read Flash 00h Blank Check 04h 05h x Read EEPROM Data 24 Start Address End Address 01h 02h T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Table 3. Summary of Frames From Host (Continued) Command Record Type Record Length Offset Data[0] Data[1] Data[2] Data[3] Data[4] 00h - - - 01h - - - Read Product Name 02h - - - Read Product Revision 03h - - - Read SSB 00h - - - Read BSB 01h - - - Read SBV 02h - - - 03h - - - Read P3_CF 04h - - - Read P4_CF 05h - - - Read EB 06h - - - 00h - - - 00h - - - 01h - - - 0Fh 00h - - - x x x x x Read Manufacturer Code Read Family Code 00h Read P1_CF 05h 02h x Read Hardware Byte 07h 0Bh Read Device Boot ID1 0Eh Read Device Boot ID2 Read Bootloader Version Program Nb Data byte in EEPROM 00h nb of data (up to 80h) start address 25 4225B–8051–12/03 Appendix-B Table 4. API Summary Function Name Bootloader Execution __api_rd_code_byte no __api_wr_code_byte yes R1 DPTR0 DPTR1 Acc 02h Address in Flash memory to write - Value to write Address in XRAM of the first data to program Number of Byte to program __api_wr_code_page yes 09h Address of the first Byte to program in the Flash memory __api_erase_block0 yes 01h 0000h x x __api_erase_block1 yes 01h 2000h x x __api_rd_HSB yes 0Bh 0000h x return value __api_set_X2 yes 0Ah 0008h x 00h __api_clr_X2 yes 0Ah 0008h x 01h __api_set_BLJB yes 0Ah 0004h x 00h __api_clr_BLJB yes 0Ah 0004h x 01h __api_rd_BSB yes 07h 0001h x return value __api_wr_BSB yes 06h 0000h x value __api_rd_SBV yes 07h 0002h x return value __api_wr_SBV yes 06h 0001h x value __api_erase_SBV yes 06h 0001h x FCh __api_rd_SSB yes 07h 0000h x return value __api_wr_SSB_level0 yes 05h 00FFh x x __api_wr_SSB_level1 yes 05h 00FEh x x __api_wr_SSB_level2 yes 05h 00FCh x x __api_rd_EB yes 07h 0006h x return value __api_wr_EB yes 06h 0006h x value __api_rd_manufacturer yes 00h 0000h x return value __api_rd_device_id1 yes 00h 0001h x return value __api_rd_device_id2 yes 00h 0002h x return value __api_rd_device_id3 yes 00h 0003h x return value __api_rd_bootloader_version yes 0Fh 0000h x return value __api_eeprom_busy no __api_rd_eeprom_byte no __api_wr_eeprom_byte no __api_start_bootloader no 26 T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Datasheet Change Log Changes from 4225A 03/03 to 4225B 12/03 1. Added bit stop for the UART protocol. 27 4225B–8051–12/03 28 T89C5115 UART Bootloader 4225B–8051–12/03 T89C5115 UART Bootloader Table of Contents Features ................................................................................................. 1 Description ............................................................................................ 1 Functional Description......................................................................... 2 In-System Programming (ISP) Capability ............................................................. In-Application Programming or Self-programming capability................................ Block Diagram ...................................................................................................... Bootloader Configuration ...................................................................................... Security................................................................................................................. Software Boot Vector............................................................................................ FLIP Software Program ........................................................................................ 2 2 2 3 4 5 5 In-System Programming ...................................................................... 6 Boot Process ........................................................................................................ 6 Physical Layer .......................................................................................................8 Protocol..................................................................................................................9 In-Application Programming/Self-programming ............................. 21 API Call............................................................................................................... 21 API Commands................................................................................................... 21 Appendix-A.......................................................................................... 24 Appendix-B.......................................................................................... 26 Datasheet Change Log ....................................................................... 27 Changes from 4225A - 03/03 to 4225B 12/03 .................................................... 27 Table of Contents .................................................................................. i i 4225B–8051–12/03 Atmel Corporation 2325 Orchard Parkway San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 487-2600 Regional Headquarters Europe Atmel Sarl Route des Arsenaux 41 Case Postale 80 CH-1705 Fribourg Switzerland Tel: (41) 26-426-5555 Fax: (41) 26-426-5500 Asia Room 1219 Chinachem Golden Plaza 77 Mody Road Tsimshatsui East Kowloon Hong Kong Tel: (852) 2721-9778 Fax: (852) 2722-1369 Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan Tel: (81) 3-3523-3551 Fax: (81) 3-3523-7581 Atmel Operations Memory 2325 Orchard Parkway San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 RF/Automotive Theresienstrasse 2 Postfach 3535 74025 Heilbronn, Germany Tel: (49) 71-31-67-0 Fax: (49) 71-31-67-2340 Microcontrollers 2325 Orchard Parkway San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 La Chantrerie BP 70602 44306 Nantes Cedex 3, France Tel: (33) 2-40-18-18-18 Fax: (33) 2-40-18-19-60 ASIC/ASSP/Smart Cards 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906, USA Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Avenue de Rochepleine BP 123 38521 Saint-Egreve Cedex, France Tel: (33) 4-76-58-30-00 Fax: (33) 4-76-58-34-80 Zone Industrielle 13106 Rousset Cedex, France Tel: (33) 4-42-53-60-00 Fax: (33) 4-42-53-60-01 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906, USA Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland Tel: (44) 1355-803-000 Fax: (44) 1355-242-743 Literature Requests www.atmel.com/literature Disclaimer: Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company’s standard warranty which is detailed in Atmel’s Terms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life support devices or systems. © Atmel Corporation 2003. All rights reserved. Atmel® and combinations thereof are the registered trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be the trademarks of others. Printed on recycled paper. 4225B–8051–12/03 /xM