FREESCALE AN2104

Freescale Semiconductor
Order this document
by AN2104/D
AN2104
Freescale Semiconductor, Inc...
Using Background Debug Mode for the M68HC12 Family
By Timothy J. Airaudi
Applications Engineering, Microcontroller Division
Austin, Texas
Introduction
This application note describes the basic operation of the background
debug mode (BDM) and some of its applications, as it relates to
Motorola’s M68HC12 Family of microcontrollers (MCU). Examples of incircuit programming of internal FLASH memory and in-circuit debugging,
using P&E Microcomputer Systems’ BDM interface cable and its
software, are also contained in this document.
The BDM’s main purpose is to allow debugging of the actual
microcontroller being used in the user’s target application. This takes the
place of hardware such as an in-circuit emulator, which uses external
components to attempt to duplicate operation of the MCU from outside
of the target application.
Instead of having this external hardware, and a variety of potential
problems, the debug logic is built into the MCU’s on-chip integration
module. This differs from other systems that have the debugging logic
located in the central processor unit (CPU). Not having the debugging
logic in the CPU allows for reading and writing of memory locations,
while the CPU is executing user code, with no degradation in real-time
operation. This is an example of the BDM being enabled but not active.
© Freescale Semiconductor, Inc., 2004. All rights reserved.
© Motorola, Inc., 2001
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
When the BDM is active, it takes over control of the microprocessor,
which allows for debugging, etc.
Freescale Semiconductor, Inc...
Other examples of what the BDM can be used for, besides debugging,
vary from programming EPROM, EEPROM, and FLASH (internal and
external) to performing calibration on a target application (in
manufacturing and in the field) to transferring collected and stored
information to another system.
Theory of Operation
Because software packages, such as P&E Microcomputer Systems’
Windows Development Package (PKG12), take care of the operation of
the BDM, this discussion does not go into great detail. For more in-depth
information on this subject, refer to the documents referenced in
Technical Resources at the end of this document.
The operation of the BDM system requires a host PC with software, a
BDM interface POD or BDM interface, and the user’s target application.
See Figure 1. The host PC is connected to the POD with a DB-25
parallel cable from the PC’s parallel port. The POD is then connected to
the target application via a custom 6-pin BDM connector and cable. See
Figure 2.
HOST PC
BDM INTERFACE
INTERFACE POD
PARALLEL
CABLE
CABLE12 FROM P&E
MICROCOMPUTER SYSTEMS
TARGET BOARD
BDM
CABLE
6-PIN BDM CONNECTOR
SEE FIGURE 2
Figure 1. BDM System
AN2104
2
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Theory of Operation
BKGD 1
2 GND
NC 3
4 RESET
VFP 5
6 VDD
Figure 2. BDM Tool Connector
Freescale Semiconductor, Inc...
To communicate with the BDM on the part, two pins are used: BKGD and
GND. This method of serial interface is used to both send and receive
data. A special communications protocol is used that resynchronizes at
the beginning of each bit. By doing this, a greater frequency tolerance
for synchronization is allowed.
All bits are started with a falling edge signal that is initiated by the
external host. After the MCU sees this falling edge, it waits nine E-clock
cycles and then samples the level on the BKGD pin. The data is
transferred MSB (most significant bit) first at the rate of 16 E-clock cycles
per bit. The E-clock is defined as the SYSCLK divided by two.
The two types of BDM commands are:
•
Hardware
•
Firmware
When using hardware commands, the BDM is enabled, but not active,
and the user’s code is running. See Table 1. These commands allow all
internal and external memory, which is accessible to the microcontroller,
to be read or written. This also includes on-chip I/O (input/output) and
control registers.
The control logic watches the bus for any free bus cycles that it can use
to execute the hardware command. By using the free bus cycles, the
CPU is not disturbed. If, however, a free cycle is not found within a
specified time, it will use a bus cycle, which temporarily freezes the CPU.
AN2104
3
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Table 1. BDM Hardware Commands
Command
Opcode
(Hex)
Data
BACKGROUND
90
None
READ_BD_BYTE
E4
16-bit address
16-bit data out
Description
Enter background mode (if firmware enabled).
Read from memory with BDM in map (may steal cycles if
external access) data for odd address on low byte,
data for even address on high byte.
Freescale Semiconductor, Inc...
FF01,
READ_BD_BYTE $FF01. Running user code. (BGND
0000 0000 (out)
instruction is not allowed.)
STATUS(1)
E4
FF01,
READ_BD_BYTE $FF01. BGND instruction is allowed.
1000 0000 (out)
FF01,
READ_BD_BYTE $FF01. Background mode active
1100 0000 (out)
(waiting for single wire serial command).
READ_BD_WORD
EC
16-bit address Read from memory with BDM in map (may steal cycles if
16-bit data out
external access) must be aligned access.
READ_BYTE
E0
16-bit address
16-bit data out
Read from memory with BDM out of map (may steal
cycles if external access) data for odd address on low
byte, data for even address on high byte.
READ_WORD
E8
16-bit address
16-bit data out
Read from memory with BDM out of map (may steal
cycles if external access) must be aligned access.
WRITE_BD_BYTE
C4
16-bit address
16-bit data in
Write to memory with BDM in map (may steal cycles if
external access) data for odd address on low byte,
data for even address on high byte.
ENABLE_
FIRMWARE(2)
C4
FF01,
1xxx xxxx (in)
Write byte $FF01, set the ENBDM bit. This allows
execution of commands which are implemented in
firmware. Typically, read STATUS, OR in the MSB,
write the result back to STATUS.
WRITE_BD_WORD
CC
16-bit address
16-bit data in
Write to memory with BDM in map (may steal cycles if
external access) must be aligned access.
WRITE_BYTE
C0
16-bit address
16-bit data in
Write to memory with BDM out of map (may steal cycles
if external access) data for odd address on low byte,
data for even address on high byte.
WRITE_WORD
C8
16-bit address
16-bit data in
Write to memory with BDM out of map (may steal cycles
if external access) must be aligned access.
1. STATUS command is a specific case of the READ_BD_BYTE command.
2. ENABLE_FIRMARE is a specific case of the WRITE_BD_BYTE command.
AN2104
4
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Theory of Operation
To execute firmware commands, the user must have the BDM enabled
and active. See Table 2. When the BDM is active, it has control of the
CPU, which executes code out of the BDM ROM.
Freescale Semiconductor, Inc...
Table 2. BDM Firmware Commands
Command
Opcode (Hex)
Data
Description
READ_NEXT
62
16-bit data out
READ_PC
63
16-bit data out Read program counter
READ_D
64
16-bit data out Read D accumulator
READ_X
65
16-bit data out Read X index register
READ_Y
66
16-bit data out Read Y index register
READ_SP
67
16-bit data out Read stack pointer
WRITE_NEXT
42
16-bit data in
X = X + 2; Write next word
pointed to by X
WRITE_PC
43
16-bit data in
Write program counter
WRITE_D
44
16-bit data in
Write D accumulator
WRITE_X
45
16-bit data in
Write X index register
WRITE_Y
46
16-bit data in
Write Y index register
WRITE_SP
47
16-bit data in
Write stack pointer
GO
08
None
Go to user program
TRACE1
10
None
Execute one user instruction
then return to BDM
TAGGO
18
None
Enable tagging and go to
user program
X = X + 2; Read next word
pointed to by X
AN2104
5
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
BDM Registers
NOTE:
Seven BDM registers are mapped into addresses $FF00–$FF06. See
Table 3.
Remember that the BDM firmware ROM and registers contain different
data than the normal memory mapped locations for these addresses.
Table 3. BDM Registers
Freescale Semiconductor, Inc...
Address
Register
Mnemonic
$FF00
BDM instruction register
$FF01
BDM status register
STATUS
$FF02–$FF03
BDM shift register
SHIFTER
$FF04–$FF05
BDM address register
ADDRESS
$FF06
INSTRUCTION
BDM CCR holding register
CCRSAV
Only two registers are discussed here:
•
BDM status register (STATUS)
•
BDM CCR (condition code register) holding register (CCRSAV)
The BDM status register can be read at any time, but must not be written
to during BDM operation. See Figure 3 for a description of the bits.
Address: $FF01
Bit 7
6
5
4
3
2
1
Bit 0
ENBDM
EDMACT
ENTAG
SDV
TRACE
0
0
0
Reset:
0
0
0
0
0
0
0
0
Single-Chip
Peripheral:
1
0
0
0
0
0
0
0
Read:
Write:
Figure 3. BDM Status Register (STATUS)
This register can be read or written by BDM commands or firmware.
ENBDM — Enable BDM Bit (permit active background debug mode)
0 = BDM cannot be made active (hardware commands still
allowed).
1 = BDM can be made active to allow firmware commands.
AN2104
6
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Theory of Operation
BDMACT — Background Mode Active Status Bit
0 = BDM not active
1 = BDM active and waiting for serial commands
ENTAG — Instruction Tagging Enable Bit
Set by the TAGGO instruction and cleared when BDM is entered
0 = Tagging not enabled or BDM active
1 = Tagging active (BDM cannot process serial commands while
tagging is active.)
Freescale Semiconductor, Inc...
SDV — Shifter Data Valid Bit
Shows that valid data is in the serial interface shift register. Used by
firmware-based instructions.
0 = No valid data
1 = Valid data
TRACE
Asserted by the TRACE1 instruction
The second register of interest is the BDM CCR holding register. This
register contains the value of the CPU’s condition code register (CCR)
from the user’s program upon entering the BDM. See Figure 4.
Address: $FF06
Bit 7
6
5
4
3
2
1
Bit 0
CCR7
CCR6
CCR5
CCR4
CCR3
CCR2
CCR1
CCR0
0
0
0
0
0
0
0
0
Read:
Write:
Reset:
Figure 4. BDM CCR Holding Register (CCRSAV)
Operation
of Active BDM
Here is a brief description of what transpires when going into the active
BDM:
•
When the CPU gets the command to go into the BDM, the user’s
return address is stored in a temporary register.
•
Next, the BDM ROM is turned on and the CPU fetches a vector
that points to the beginning of the BDM firmware program.
AN2104
7
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Freescale Semiconductor, Inc...
Application Note
•
Next the BDM firmware saves the contents of the user’s D register
in another temporary register and then saves the user’s CCR
register in the CCRSAV register.
•
The BDM firmware then checks the ENBDM bit in the STATUS
register to see if it will be allowed to go into the active BDM. If it is,
the BDM firmware enters a software loop and waits for a valid
firmware command in which to execute. The user’s program
counter (PC), stack pointer (SP), and X and Y registers are not
changed by the BDM firmware, so the user doesn’t need to save
or stack these values.
During exit from the BDM, the user’s register values are restored and a
value is stored in the BDM STATUS register. Then a jump command is
executed to resume execution of the user’s program.
M68HC12 Operating Modes
The two basic modes of operation (see Table 4) for the M68HC12
Family are:
•
Normal modes — Provide protection for control registers from
being accidentally modified
•
Special modes — Allow access to these control registers for
system development and special testing
If any of the normal operating modes are entered (BKGD high), the BDM
is available, but must be enabled and/or made active.
If the special single-chip mode is selected (BKGD, MODA, and MODB
all low), the BDM comes up enabled and active.
Table 4 also shows that the states of the BKGD, MODA, and MODB pins
determine a specific mode where the port A and port B pins are
configured for different functions.
AN2104
8
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
M68HC12 Operating Modes
Freescale Semiconductor, Inc...
Table 4. Mode Selection
BKGD
MODB
MODA
Mode
Port A
Port B
0
0
0
Special single chip
Generalpurpose I/O
Generalpurpose I/O
0
0
1
Special expanded narrow
ADDR[15:8]
DATA[7:0]
ADDR[7:0]
0
1
0
Special peripheral
ADDR
DATA
ADDR
DATA
0
1
1
Special expanded wide
ADDR
DATA
ADDR
DATA
1
0
0
Normal single chip
Generalpurpose I/O
Generalpurpose I/O
1
0
1
Normal expanded narrow
ADDR[15:8]
DATA[7:0]
ADDR[7:0]
1
1
0
Reserved
(forced to peripheral)
—
—
1
1
1
Normal expanded wide
ADDR
DATA
ADDR
DATA
These examples deal with the levels on the BKGD, MODA, and MODB
pins during a reset to determine which mode the part will come up in. The
user can also change the mode of operation by writing to the mode
register after the part is powered up. See Figure 5.
The MODE register can be read at any time. However, writing to this
register presents some restrictions. First, if the part comes up in the
normal mode, it can be changed only to another normal mode. This
change can be done only once.
The special mode does not have this limitation, since the values of the
MODA and MODB pins can be changed as many times as desired as
long as the part remains in special mode.
Next, coming up in the special mode, the part can change to the normal
mode, but must write to the SMODN bit in this register two times, as the
first write is ignored.
AN2104
9
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Address:
$000B
Bit 7
6
5
4
3
2
1
Bit 0
SMODN
MODB
MODA
ESTR
IVIS
EBSWAI
0
EME
Normal expanded narrow:
1
0
1
1
0
0
0
0
Normal expanded wide:
1
1
1
1
0
0
0
0
Special expanded narrow:
0
0
1
1
1
0
0
1
Special expanded wide:
0
1
1
1
1
0
0
1
Peripheral:
0
1
0
1
1
0
0
1
Normal single-chip:
1
0
0
1
0
0
0
0
Special single-chip:
0
0
0
1
1
0
0
1
Read:
Write:
Freescale Semiconductor, Inc...
Reset states:
Figure 5. Mode Register (MODE)
Operating Mode and Background Debug Mode Hints
These hints will help steer the user away from the most commonly made
mistakes.
•
The states of the MODA and MODB pins, upon power-up,
determine how the port A and port B pins will be configured (see
Table 4).
•
The BKGD pin is used for two purposes:
– It determines, upon reset, which operating mode the part will
enter, normal or special (see Table 4).
– Then it is used as the serial communication pin for the BDM.
•
Once the part is operating in a mode, the mode can be changed
by writing to the mode register. The limitations to this are listed in
Figure 5.
•
When in normal operating mode, special modes cannot be
accessed.
AN2104
10
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Freescale Semiconductor, Inc...
Application Note
Background Debug Mode Application Examples
•
When in normal operating mode, another normal operating mode
can be accessed, but this can be done only once.
•
To change to the normal operating mode, when the part is in
special operating mode, a 1 (one) must be written twice to the
SMODN bit in the mode register.
•
When the part comes up in special single-chip mode, the BDM is
enabled and active.
•
When the part comes up in special single-chip mode, it accesses
the BDM ROM, not the normal memory mapped locations at
$FF00–$FFFF.
•
To perform hardware commands, the BDM does not need to be
active (see Table 1).
•
To perform firmware commands, the BDM must be enabled and
active (see Table 2).
•
The BDM does not operate in stop mode.
Background Debug Mode Application Examples
Two BDM application examples are given here in a step-by-step format.
In-Circuit
Programming
of Internal FLASH
This application example of the BDM explains how to perform in-circuit
programming of the internal FLASH memory of an MC68HC912B32
using P&E Microcomputer Systems’ Cable12 POD and software (see
Figure 1). The target board for this example is the M68EVB912B32
evaluation board.
AN2104
11
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Follow these steps in order:
1. Load P&E’s PKG12Z software.
2. Connect a parallel cable from the host PC to the Cable12 POD.
3. Connect the 6-pin BDM cable from the POD to the evaluation
board making sure that pin 1 of the cable is connected to pin 1 of
the POD and target. On the evaluation board, make sure that
jumpers W3 and W4 are in the EVB positions and jumper W7 is in
the VDD position.
Freescale Semiconductor, Inc...
4. Apply +5 Vdc to P5 of the evaluation board and +12 Vdc to W8.
5. Launch P&E’s WinIDE.
6. Open P&E’s sample code named SCI.
7. Assemble/compile this file. See Figure 6.
8. Launch the programmer. If the correction assistant window opens,
select the correct parallel port being used. Defaults should work
for the other options in this window. See Figure 7.
9. Select the 9b32_32k.12p programming algorithm.
10. Input $8000 for the base address when prompted.
11. Move jumper W7, on the evaluation board, to the VPP position.
12. Select Erase Module.
13. Ensure that the SCI.s19 file is in the S-record in the configuration
window. If not, select Specify S record and select this file.
14. Select Program Module.
15. After programming is complete, move jumper W7 to the VDD
position. Do not leave the programming voltage on the FLASH.
16. The SCI.s19 file has now been erased and programmed into the
FLASH of the MC68HC912B32 using the BDM. Select Verify
Module to verify that this programming is correct. The code also
can be viewed by selecting Show Module at address $8000.
AN2104
12
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Freescale Semiconductor, Inc...
Application Note
Background Debug Mode Application Examples
Figure 6. P&E’s WinIDE Window
AN2104
13
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Freescale Semiconductor, Inc...
Application Note
Figure 7. P&E’s Programmer Window
In-Circuit
Debugging
This application example of the BDM explains how to perform in-circuit
debugging of an MC68HC912B32 using P&E Microcomputer Systems’
Cable12 POD and software (see Figure 1). The target board for this
example will be the M68EVB912B32 evaluation board.
Follow these steps in order:
1. Load P&E’s PKG12Z software.
2. Connect a parallel cable from the host PC to the Cable12 POD.
3. Connect the 6-pin BDM cable from the POD to the evaluation
board making sure that pin 1 of the cable is connected to pin 1 of
the POD and target. On the evaluation board, make sure that
AN2104
14
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Background Debug Mode Application Examples
jumpers W3 and W4 are in the EVB positions and jumper W7 is in
the VDD position.
4. Apply +5 Vdc to P5 of the evaluation board.
5. Launch P&E’s WinIDE.
6. Open P&E’s sample code named SCI.
Freescale Semiconductor, Inc...
7. Assemble/compile this file. See Figure 6. At this point, ensure that
the FLASH is programmed as in the previous application example
in In-Circuit Programming of Internal FLASH.
8. Launch the debugger. If the correction assistant window opens,
select the correct parallel port being used. Defaults should work
for the other options in this window. See Figure 8.
9. Verify that the correct S19 is loaded in the debugger by selecting
the File drop down menu and selecting Load S19 File and the
SCI.S19 file.
10. In the Execute drop down menu, select Reset Processor.
11. From this point, the code can be debugged by selecting Single
step, Multiple step, or Go.
Breakpoints also can be set by selecting the line of code chosen for a
breakpoint, clicking the right mouse button, and selecting Toggle
Breakpoint at Cursor.
AN2104
15
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Freescale Semiconductor, Inc...
Application Note
Figure 8. P&E’s Debugger Window
Summary
This application note gives an overview of the BDM as it relates to
Motorola’s M68HC12 Family of MCUs. By providing the appropriate
connections for the BDM in the user’s application, and using a BDM
interface POD with software, it is easy to debug code, erase, or program
the FLASH in the target application.
AN2104
16
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Application Note
Technical Resources
Freescale Semiconductor, Inc...
Technical Resources
•
Software and Hardware Engineering: Motorola M68HC12 by
Fredrick M. and James M. Sibigtroth
•
CPU12 Reference Manual, document order number
CPU12RM/AD
•
M68HC12B Family Advance Information, Motorola document
order number M68HC12B/D
•
MC68HC812A4 Advance Information, Motorola document order
number MC68HC812A4/D
•
MC68HC912D60 Advance Information, Motorola document order
number MC68HC912D60/D
•
MC68HC912DG128 Advance Information, Motorola document
order number MC68HC912DG128/D
AN2104
17
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Freescale Semiconductor, Inc...
Application Note
AN2104
18
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
Freescale Semiconductor, Inc...
Application Note
Technical Resources
AN2104
19
For More Information On This Product,
Go to: www.freescale.com
Freescale Semiconductor, Inc.
N O N - D I S C L O S U R E
Freescale Semiconductor, Inc...
A G R E E M E N T
R E Q U I R E D
Application Note
How to Reach Us:
Home Page:
www.freescale.com
E-mail:
support@freescale.com
USA/Europe or Locations Not Listed:
Freescale Semiconductor
Technical Information Center, CH370
1300 N. Alma School Road
Chandler, Arizona 85224
+1-800-521-6274 or +1-480-768-2130
support@freescale.com
Europe, Middle East, and Africa:
Freescale Halbleiter Deutschland GmbH
Technical Information Center
Schatzbogen 7
81829 Muenchen, Germany
+44 1296 380 456 (English)
+46 8 52200080 (English)
+49 89 92103 559 (German)
+33 1 69 35 48 48 (French)
support@freescale.com
Japan:
Freescale Semiconductor Japan Ltd.
Headquarters
ARCO Tower 15F
1-8-1, Shimo-Meguro, Meguro-ku,
Tokyo 153-0064
Japan
0120 191014 or +81 3 5437 9125
support.japan@freescale.com
Asia/Pacific:
Freescale Semiconductor Hong Kong Ltd.
Technical Information Center
2 Dai King Street
Tai Po Industrial Estate
Tai Po, N.T., Hong Kong
+800 2666 8080
support.asia@freescale.com
For Literature Requests Only:
Freescale Semiconductor Literature Distribution Center
P.O. Box 5405
Denver, Colorado 80217
1-800-441-2447 or 303-675-2140
Fax: 303-675-2150
LDCForFreescaleSemiconductor@hibbertgroup.com
Information in this document is provided solely to enable system and software
implementers to use Freescale Semiconductor products. There are no express or
implied copyright licenses granted hereunder to design or fabricate any integrated
circuits or integrated circuits based on the information in this document.
Freescale Semiconductor reserves the right to make changes without further notice to
any products herein. Freescale Semiconductor makes no warranty, representation or
guarantee regarding the suitability of its products for any particular purpose, nor does
Freescale Semiconductor assume any liability arising out of the application or use of
any product or circuit, and specifically disclaims any and all liability, including without
limitation consequential or incidental damages. “Typical” parameters which may be
provided in Freescale Semiconductor data sheets and/or specifications can and do
vary in different applications and actual performance may vary over time. All operating
parameters, including “Typicals” must be validated for each customer application by
customer’s technical experts. Freescale Semiconductor does not convey any license
under its patent rights nor the rights of others. Freescale Semiconductor products are
not designed, intended, or authorized for use as components in systems intended for
surgical implant into the body, or other applications intended to support or sustain life,
or for any other application in which the failure of the Freescale Semiconductor product
could create a situation where personal injury or death may occur. Should Buyer
purchase or use Freescale Semiconductor products for any such unintended or
unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor
and its officers, employees, subsidiaries, affiliates, and distributors harmless against all
claims, costs, damages, and expenses, and reasonable attorney fees arising out of,
directly or indirectly, any claim of personal injury or death associated with such
unintended or unauthorized use, even if such claim alleges that Freescale
Semiconductor was negligent regarding the design or manufacture of the part.
For More Information On This Product,
Go to: www.freescale.com