MAGNACHIP SEMICONDUCTOR LTD. 8-BIT SINGLE-CHIP MICROCONTROLLERS WITH EMBEDDED FLASH HMS99C51S HMS99C52S HMS99C54S HMS99C56S HMS99C58S User’s Manual (Ver. 1.01) Revision History Ver 1.01 (Sep, 10, 2004) this book The company name, Hynix Semiconductor Inc. changed to MagnaChip Semiconductor Ltd. Ver 1.0 (Dec, 01, 2003) The first released document. Version 1.01 Published by MCU Application Team 2004 MagnaChip Semiconductor Ltd. All right reserved. Additional information of this manual may be served by MagnaChip semiconductor offices in Korea or Distributors and Representatives listed at address directory. MagnaChip semiconductor reserves the right to make changes to any information here in at any time without notice. The information, diagrams and other data in this manual are correct and reliable; however, MagnaChip semiconductor is in no way responsible for any violations of patents or other rights of the third party generated by the use of this manual. HMS99C51S/52S/54S/56S/58S CONTENTS DEVICE NAMING STRUCTURE ...........................................................................1 HMS99C51S/52S/54S/56S/58S SELECTION GUIDE ..........................................1 FEATURE ..............................................................................................................2 PIN CONFIGURATION .........................................................................................4 PIN DEFINITIONS AND FUNCTIONS ..................................................................8 FUNCTIONAL DESCRIPTION ............................................................................11 CPU .....................................................................................................................12 SPECIAL FUNCTION REGISTERS ....................................................................13 X2 MODE ............................................................................................................19 TIMER / COUNTER 0 AND 1 ..............................................................................21 TIMER 2 ..............................................................................................................22 SERIAL INTERFACE (UART) .............................................................................23 INTERRUPT SYSTEM ........................................................................................24 POWER SAVING MODES ..................................................................................26 ELECTRICAL CHARACTERISTICS ...................................................................27 OSCILLATOR CIRCUIT ......................................................................................39 FLASH MEMORY ................................................................................................43 IN-SYSTEM PROGRAMMING (ISP) ...................................................................55 ISP METHOD FOR PC (MAGNACHIP WINISP) .................................................66 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S DEVICE NAMING STRUCTURE FLASH version MagnaChip semiconductor MCU HMS99C5XS XX Package Type Blank: 40PDIP PL: 44PLCC Q: 44MQFP ROM size 1: 4k bytes 2: 8k bytes 4: 16k bytes 6: 24k bytes 8: 32k bytes Operating Voltage C: 4.5~5.5V HMS99C51S/52S/54S/56S/58S SELECTION GUIDE Operating Voltage (V) 4.5~5.5 Sep. 2004 Ver 1.01 ROM size (bytes) FLASH 4K 8K 16K 24K 32K RAM size (bytes) 256 Device Name HMS99C51S HMS99C52S HMS99C54S HMS99C56S HMS99C58S Operating Frequency (MHz) 40 1 HMS99C51S/52S/54S/56S/58S FEATURE • Fully compatible to standard MCS-51 microcontroller • Wide operating frequency up to 40MHz (for more detail, See “HMS99C51S/52S/54S/56S/58S SELECTION GUIDE” on page 1) • X2 Speed Improvement capability (X2 Mode : 6 clocks/machine cycle) 20MHz @5V (Equivalent to 40MHz @5V) • ISP(In-System Programming) using Standard VCC Power Supply • Boot ROM Contains Low Level FLASH Programming Routines and a Default Serial Loader • 4K/8K/16K/24K/32K bytes FLASH user program memory - Byte Write and Block(2K, 8K Bytes) Erase • 2K bytes FLASH boot loader • 1 byte Hardware Security Byte (HSB) • 256 bytes RAM • 64K bytes external program memory space • 64K bytes external data memory space • Four 8-bit ports • Three 16-bit Timers / Counters (Timer2 with up/down counter feature) • UART • One clock output port • Programmable ALE pin enable / disable (Low EMI) • Six interrupt sources, two priority levels • Power saving Idle and power down mode • P-DIP-40, P-LCC-44, P-MQFP-44 package • Temperature Ranges : -40°C ~ 85°C Description The Flash memory increases EPROM and ROM functionality with in-circuit electrical erasure and programming. It contains 4K, 8K, 16K, 24K or 32K bytes of program memory. This memory is both parallel and serial In-System Programmable(ISP). The ISP allows devices to alter their own program memory in the actual end product under software control through UART ports. A default serial loader(bootloader) program supports ISP of the Flash memory. The programming does not require external 12V programming voltage. The necessary high programming voltage is generated on-chip using the standard VCC pins of the microcontroller. 2 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Block Diagram RAM 256 × 8 T0 CPU T2 8-BIT UART T1 Boot ROM 2K × 8 Sep. 2004 Ver 1.01 HSB 1x8 FLASH ROM 4K/8K/16K/24K/ 32K x 8 PORT 0 I/O PORT 1 I/O PORT 2 I/O PORT 3 I/O 3 HMS99C51S/52S/54S/56S/58S PIN CONFIGURATION P0.1 / AD1 P0.2 / AD2 P0.3 / AD3 41 40 N.C.* 42 P1.0 / T2 1 VCC P1.1 / T2EX 2 P0.0 / AD0 P1.2 3 43 P1.3 4 44 P1.4 5 INDEX CORNER 6 44-PLCC Pin Configuration (top view) PSEN INT1 / P3.3 15 31 P2.7 / A15 T0 / P3.4 16 30 P2.6 / A14 T1 / P3.5 17 29 P2.5 / A13 28 32 P2.4 / A12 14 27 ALE / PROG INT0 / P3.2 26 33 P2.2 / A10 13 P2.3 / A11 N.C.* TxD / P3.1 25 34 P2.1 / A9 12 24 EA / VPP N.C.* P2.0 / A8 35 23 11 N.C.* P0.7 / AD7 RxD / P3.0 22 36 VSS 10 21 P0.6 / AD6 RESET XTAL1 37 20 9 XTAL2 P0.5 / AD5 P1.7 19 P0.4 / AD4 38 18 39 8 RD / P3.7 7 P1.6 WR / P3.6 P1.5 N.C.: No connection 4 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S 40-PDIP Pin Configuration (top view) Sep. 2004 Ver 1.01 T2 / P1.0 1 40 VCC T2EX / P1.1 2 39 P0.0 / AD0 P1.2 3 38 P0.1 / AD1 P1.3 4 37 P0.2 / AD2 P1.4 5 36 P0.3 / AD3 P1.5 6 35 P0.4 / AD4 P1.6 7 34 P0.5 / AD5 P1.7 8 33 P0.6 / AD6 RESET 9 32 P0.7 / AD7 RxD / P3.0 10 31 EA / VPP TxD / P3.1 11 30 ALE / PROG INT0 / P3.2 12 29 PSEN INT1 / P3.3 13 28 P2.7 / A15 T0 / P3.4 14 27 P2.6 / A14 T1 / P3.5 15 26 P2.5 / A13 WR / P3.6 16 25 P2.4 / A12 RD / P3.7 17 24 P2.3 / A11 XTAL2 18 23 P2.2 / A10 XTAL1 19 22 P2.1 / A9 VSS 20 21 P2.0 / A8 5 HMS99C51S/52S/54S/56S/58S P1.4 P1.3 P1.2 P1.1 / T2EX P1.0 / T2 N.C.* VCC P0.0 / AD0 P0.1 / AD1 P0.2 / AD2 P0.3 / AD3 44 43 42 41 40 39 38 37 36 35 34 44-MQFP Pin Configuration (top view) PSEN INT1 / P3.3 9 25 P2.7 / A15 T0 / P3.4 10 24 P2.6 / A14 T1 / P3.5 11 23 P2.5 / A13 22 26 P2.4 / A12 8 21 ALE / PROG INT0 / P3.2 P2.3 / A11 27 20 7 P2.2 / A10 N.C.* TxD / P3.1 19 28 P2.1 / A9 6 18 EA / VPP N.C.* P2.0 / A8 29 17 5 N.C.* P0.7 / AD7 RxD / P3.0 16 30 VSS 4 15 P0.6 / AD6 RESET XTAL1 31 14 3 XTAL2 P0.5 / AD5 P1.7 13 P0.4 / AD4 32 12 33 2 RD / P3.7 1 P1.6 WR / P3.6 P1.5 N.C.: No connection 6 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Logic Symbol VCC XTAL1 XTAL2 RESET VSS Port 0 8-bit Digital I/O Port 1 8-bit Digital I/O Port 2 8-bit Digital I/O EA/VPP ALE/PROG PSEN Sep. 2004 Ver 1.01 Port 3 8-bit Digital I/O 7 HMS99C51S/52S/54S/56S/58S PIN DEFINITIONS AND FUNCTIONS Pin Number Symbol P1.0-P1.7 P3.0-P3.7 XTAL2 8 PLCC44 PDIP40 MQFP44 2-9 1-8 40-44, 1-3 Input/ Output I/O Function Port1 Port 1 is an 8-bit bidirectional I/O port with internal pull-ups. Port 1 pins that have 1s written to them are pulled high by the internal pull-up resistors and can be used as inputs. As inputs, port 1 pins that are externally pulled low will source current because of the pulls-ups (IIL, in the DC characteristics). Port1 also serves alternate functions of Timer 2 as follows. P1.0 / T2, Clock Out : Timer/counter 2 external count input, Clock Out P1.1 / T2EX :Timer/counter 2 trigger input 2 1 40 3 2 41 11, 13-19 10-17 5, 7-13 11 10 5 P3.0 / RxD 13 11 7 P3.1 / TxD 14 15 16 17 18 12 13 14 15 16 8 9 10 11 12 P3.2 /INT0 P3.3 / INT1 P3.4 /T0 P3.5 /T1 P3.6 / WR 19 17 13 P3.7 /RD 20 18 14 Port1 receives the low-order address bytes during Flash programming and verifying. I/O O Port 3 Port 3 is an 8-bit bidirectional I/O port with internal pull-ups. Port 3 pins that have 1s written to them are pulled high by the internal pull-up resistors and can be used as inputs. As inputs, port 3 pins that are externally pulled low will source current because of the pulls-ups (IIL, in the DC characteristics). Port 3 also serves the special features of the 80C51 family, as listed below. receiver data input (asynchronous) or data input/output(synchronous) of serial interface 0 transmitter data output (asynchronous) or clock output (synchronous) of the serial interface 0 interrupt 0 input/timer 0 gate control interrupt 1 input/timer 1 gate control counter 0 input counter 1 input the write control signal latches the data byte from port 0 into the external data memory the read control signal enables the external data memory to port 0 XTAL2 Output of the inverting oscillator amplifier. Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Pin Number Symbol Input/ Output Function PLCC44 PDIP40 MQFP44 XTAL1 21 19 15 I XTAL1 Input to the inverting oscillator amplifier and input to the internal clock generator circuits. To drive the device from an external clock source, XTAL1 should be driven, while XTAL2 is left unconnected. There are no requirements on the duty cycle of the external clock signal, since the input to the internal clocking circuitry is divided down by a divide-by-two flip-flop. Minimum and maximum high and low times as well as rise and fall times specified in the AC characteristics must be observed. P2.0-P2.7 24-31 21-28 18-25 I/O Port 2 Port 2 is an 8-bit bidirectional I/O port with internal pull-ups. Port 2 pins that have 1s written to them are pulled high by the internal pull-up resistors and can be used as inputs. As inputs, port 2 pins that are externally pulled low will source current because of the pulls-ups (IIL, in the DC characteristics). Port 2 emits the high-order address byte during fetches from external program memory and during accesses to external data memory that use 16-bit addresses (MOVX @DPTR). In this application it uses strong internal pull-ups when outputting 1s. During accesses to external data memory that use 8-bit addresses (MOVX @Ri), port 2 emits the contents of the P2 special function register. Some Port 2 pins receive the high-order address bits during flash program, verify, and erase operations. PSEN 32 29 26 O The Program Store Enable The read strobe to external program memory when the device is executing code from the external program memory. PSEN is activated twice each machine cycle, except that two PSEN activations are skipped during each access to external data memory. PSEN is not activated during fetches from internal program memory. RESET 10 9 4 I RESET A high level on this pin for two machine cycles while the oscillator is running resets the device. The port pins will be driven to their reset condition when a minimum VIH voltage is applied whether the oscillator is running or not. An internal diffused resistor to VSS permits power-on reset using only an external capacitor to VCC. Sep. 2004 Ver 1.01 9 HMS99C51S/52S/54S/56S/58S Pin Number Symbol Input/ Output Function PLCC44 PDIP40 MQFP44 ALE / PROG 33 30 27 O The Address Latch Enable / Program pulse Output pulse for latching the low byte of the address during an access to external memory. In normal operation, ALE is emitted at a constant rate of 1/6 the oscillator frequency, and can be used for external timing or clocking. Note that one ALE pulse is skipped during each access to external data memory. This pin is also the program pulse input (PROG) during EPROM programming. If desired, ALE operation can be disabled by setting bit 0 of SFR location 8EH. With this bit set, the pin is weakly pulled high. The ALE disable feature will be terminated by reset. Setting the ALE-disable bit has no affect if the microcontroller is in external execution mode. EA / VPP 35 31 29 I External Access Enable / Program Supply Voltage EA must be externally held low to enable the device to fetch code from external program memory locations 0000H to FFFFH. If EA is held high, the device executes from internal program memory unless the program counter contains an address greater than its internal memory size. This pin also receives the 12.75V programming supply voltage (VPP) during EPROM programming. Note; however, that if any of the Lock bits are programmed, EA will be internally latched on reset. P0.0-P0.7 36-43 32-39 30-37 I/O VSS 22 20 16 - Circuit ground potential VCC 44 40 38 - Supply terminal for all operating modes N.C. 1,12 23,34 - 6,17 28,39 - No connection 10 Port 0 Port 0 is an 8-bit open-drain bidirectional I/O port. Port 0 pins that have 1s written to them float and can be used as high-impedance inputs. Port 0 is also the multiplexed low-order address and data bus during accesses to external program and data memory. In this application it uses strong internal pull-ups when emitting 1s. Port 0 also receives and outputs the code bytes during program and verification respectively in the GMS99X5X. External pull-up resistors are required during program verification. Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S FUNCTIONAL DESCRIPTION The HMS99C51S/52S/54S/56S/58S are fully compatible to the standard 8051 microcontroller family. It is compatible with the general 8051 family, while maintaining all architectural and operational characteristics of the general 8051 family. Figure 1 shows a block diagram of the HMS99C51S/52S/54S/56S/58S. RAM XTAL1 OSC & TIMING XTAL2 RESET CPU EA/VPP Timer 0 ALE/PROG 256 FLASH 4K/8K/16K/ 24K/32K Boot FLASH 2K HSB 1 Port 0 Port 0 8-bit Digit. I/O Port 1 Port 1 8-bit Digit. I/O Port 2 Port 2 8-bit Digit. I/O Port 3 Port 3 8-bit Digit. I/O Timer 1 PSEN Timer 2 Interrupt Unit Serial Channel Figure 1. Block Diagram of the HMS99C51S/52S/54S/56S/58S Sep. 2004 Ver 1.01 11 HMS99C51S/52S/54S/56S/58S CPU The HMS99C51S/52S/54S/56S/58S are efficient both as a controller and as an arithmetic processor. It has extensive facilities for binary and BCD arithmetic and excels in its bit-handling capabilities. Efficient use of program memory results from an instruction set consisting of 44% one-byte, 41% two-byte, and 15% three-byte instructions. With a 12 MHz crystal, 58% of the instructions are executed in 1.0µs (40MHz: 300ns). Special Function Register PSW Bit No. Addr. D0H LSB MSB 7 6 5 CY AC F0 4 3 2 RS1 RS0 OV Bit 1 0 F1 P Function CY Carry Flag AC Auxiliary Carry Flag (for BCD operations) F0 General Purpose Flag RS1 0 0 1 1 PSW RS0 0 1 0 1 Register Bank select control bits Bank 0 selected, data address 00H - 07H Bank 1 selected, data address 08H - 0FH Bank 2 selected, data address 10H - 17H Bank 3 selected, data address 18H - 1FH OV Overflow Flag F1 General Purpose Flag P Parity Flag Set/cleared by hardware each instruction cycle to indicate an odd/even number of "one" bits in the accumulator, i.e. even parity. Reset value of PSW is 00H. 12 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S SPECIAL FUNCTION REGISTERS All registers, except the program counter and the four general purpose register banks, reside in the special function register area. The 28 special function registers (SFR) include pointers and registers that provide an interface between the CPU and the other on-chip peripherals. There are also 128 directly addressable bits within the SFR area. All SFRs are listed in Table 1, Table 2, and Table 3. In Table 1 they are organized in numeric order of their addresses. In Table 2 they are organized in groups which refer to the functional blocks of the HMS99C51S/52S/54S/56S/58S. Table 3 illustrates the contents of the SFRs Address Register Contents after Reset Address Register Contents after Reset 80H 81H 82H 83H 84H 85H 86H 87H P0 1) SP DPL DPH reserved reserved reserved PCON FFH 07H 00H 00H XXH 2) XXH 2) XXH 2) 0XXX0000B 2) 88H 89H 8AH 8BH 8CH 8DH 8EH 8FH TCON 1) TMOD TL0 TL1 TH0 TH1 AUXR0 CKCON 00H 00H 00H 00H 00H 00H XXH 2) XXXXXXX0B 2) 90H 91H 92H 93H 94H 95H 96H 97H P1 1) reserved reserved reserved reserved reserved reserved reserved FFH 00H XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) 98H 99H 9AH 9BH 9CH 9DH 9EH 9FH SCON 1) SBUF reserved reserved reserved reserved reserved reserved 00H XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) A0H A1H A2H A3H A4H A5H A6H A7H P2 1) reserved reserved reserved reserved reserved reserved reserved FFH XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) A8H A9H AAH ABH ACH ADH AEH AFH IE 1) reserved reserved reserved reserved reserved reserved reserved 0X000000B 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) B0H B1H B2H B3H B4H B5H B6H B7H P3 1) reserved reserved reserved reserved reserved reserved reserved FFH XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) B8H B9H BAH BBH BCH BDH BEH BFH IP 1) reserved reserved reserved reserved reserved reserved reserved XX000000B 2) XXH 2) XXH 2) XXH 2) XXH 2) XX 2) XXH 2) XXH 2) Table 1. Special Function Registers in Numeric Order of their Addresses (cont’d) Sep. 2004 Ver 1.01 13 HMS99C51S/52S/54S/56S/58S Address Register Contents after Reset Address Register Contents after Reset C0H C1H C2H C3H C4H C5H C6H C7H reserved reserved reserved reserved reserved reserved reserved reserved XXH XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) C8H C9H CAH CBH CCH CDH CEH CFH T2CON 1) T2MOD RC2L 1) RC2H 1) TL2 1) TH2 1) reserved reserved 00H XXXXXX00B 2) 00H 00H 00H 00H XXH 2) XXH 2) D0H D1H D2H D3H D4H D5H D6H D7H PSW 1) FCON 3) reserved reserved reserved reserved reserved reserved FFH XXXX0000B 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) D8H D9H DAH DBH DCH DDH DEH DFH reserved reserved reserved reserved reserved reserved reserved reserved XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) E0H E1H E2H E3H E4H E5H E6H E7H ACC 1) reserved reserved reserved reserved reserved reserved reserved 00H XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) E8H E9H EAH EBH ECH EDH EEH EFH reserved reserved reserved reserved reserved reserved reserved reserved XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) F0H F1H F2H F3H F4H F5H F6H F7H B 1) reserved reserved reserved reserved reserved reserved reserved 00H XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) F8H F9H FAH FBH FCH FDH FEH FFH reserved reserved reserved reserved reserved reserved reserved reserved XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) XXH 2) Table 1. Special Function Registers in Numeric Order of their Addresses (cont’d) 1) Bit-addressable Special Function Register. 2) X means that the value is indeterminate and the location is reserved. 3) FCON access is reserved for the ISP software. 14 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Block Symbol Name Address Contents after Reset CPU ACC B DPH DPL PSW SP Accumulator B-Register Data Pointer, High Byte Data Pointer, Low Byte Program Status Word Register Stack Pointer E0H 1) F0H 1) 83H 82H D0H 1) 81H 00H 00H 00H 00H 00H 07H Interrupt System IE IP Interrupt Enable Register Interrupt Priority Register A8H 1) B8H 1) 0X000000B 2) XX000000B 2) Ports P0 P1 P2 P3 Port 0 Port 1 Port 2 Port 3 80H 1) 90H 1) A0H 1) B0H 1) FFH FFH FFH FFH Serial Channels PCON 3) SBUF SCON Power Control Register Serial Channel Buffer Reg. Serial Channel 0 Control Reg. 87H 99H 98H 1) 0XXX0000B 2) XXH 2) 00H Timer 0/ Timer 1 TCON TH0 TH1 TL0 TL1 TMOD Timer 0/1 Control Register Timer 0, High Byte Timer 1, High Byte Timer 0, Low Byte Timer 1, Low Byte Timer Mode Register 88H 1) 8CH 8DH 8AH 8BH 89H 00H 00H 00H 00H 00H 00H Timer 2 T2CON T2MOD RC2H RC2L TH2 TL2 AUXR0 Timer 2 Control Register Timer 2 Mode Register Timer 2 Reload Capture Reg., High Byte Timer 2 Reload Capture Reg., Low Byte Timer 2, High Byte Timer 2, Low Byte Aux. Register 0 C8H 1) C9H CBH CAH CDH CCH 8EH 00H 00H 00H 00H 00H 00H XXXXXXX0B 2) PCON 3) Power Control Register 87H 0XXX0000B 2) FCON 4) Flash Control Register D1H XXXX0000B 2) Power Modes FLASH Saving Table 2. Special Function Registers - Functional Blocks 1) Bit-addressable Special Function register 2) X means that the value is indeterminate and the location is reserved 3) This special function register is listed repeatedly since some bit of it also belong to other functional blocks 4) This special function register is reserved for the ISP software. Sep. 2004 Ver 1.01 15 HMS99C51S/52S/54S/56S/58S Address Register 80H P0 81H SP 82H DPL 83H DPH 87H Bit 7 6 5 4 3 2 1 0 PCON SMOD - - - GF1 GF0 PDE IDLE 88H TCON TF1 TR1 TF0 TR0 IE1 IT1 IE0 IT0 89H TMOD GATE C/T M1 MT GATE C/T M1 M0 8AH TL0 8BH TL1 8CH TH0 8DH TH1 8EH AUXR0 - - - - - - - A0 8FH CKCON - - - - - - - X2 90H P1 98H SCON SM0 SM1 SM2 REN TB8 RB8 TI RI 99H SBUF A0H P2 A8H IE EA - ET2 ES ET1 EX1 ET0 EX0 B0H P3 B8H IP - - PT2 PS PT1 PX1 PT0 PX0 Table 3. Contents of SFRs, SFRs in Numeric Order SFR bit and byte addressable SFR not bit addressable - : this bit location is reserved 16 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Address Register Bit 7 6 5 4 3 2 1 0 C8H T2CON TF2 EXF2 RCLK TCLK EXEN2 TR2 C/T2 CP/RL2 C9H T2MOD - - - - - - T2OE † DCEN CAH RC2L CBH RC2H CCH TL2 CDH TH2 D0H PSW CY AC F0 RS1 RS0 OV F1 P D1H FCON FRSEL2 FRSEL1 FRSEL0 ERASESEL ENBOOT INTROM_EN PGMSEL1 PGMSEL0 E0H ACC F0H B Table 3. Contents of SFRs, SFRs in Numeric Order (cont’d) A0 8EH A0 : ALE Signal Disable bit 0 : Enable ALE Signal (Generated ALE Signal) 1 : Disable ALE Signal (Not Generated ALE Signal) X2 8FH X2 : CPU & Peripheral Clock Select bit 0 : Select 12 clock periods per machine cycle 1 : Select 6 clock periods per machine cycle C9H T2OE T2OE : Timer2 Output Enable bit 0 : Disable Timer2 Output 1 : Enable Timer2 Output Sep. 2004 Ver 1.01 17 HMS99C51S/52S/54S/56S/58S SFR bit and byte addressable SFR not bit addressable - : this bit location is reserved 18 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S X2 MODE The HMS99C51S/52S/54S/56S/58S core needs only 6 clock periods per machine cycle in X2 mode. This feature called “X2” provides the following advantages: • Divide frequency crystals by 2 (cheaper crystals) while keeping same CPU power. • Save power consumption while keeping same CPU power (oscillator power saving). • Save power consumption by dividing dynamically operating frequency by 2 in operating and idle modes. • Increase CPU power by 2 while keeping same crystal frequency. In order to keep the original C51 compatibility, a divider by 2 is inserted between the XTAL1 signal and the main clock input of the core (phase generator). This divider may be disabled by software. X2 Mode Description The clock for the whole circuit and peripheral is first divided by two before being used by the CPU core and peripherals. This allows any cyclic ratio to be accepted on XTAL1 input. In X2 mode, as this divider is bypassed, the signals on XTAL1 must have a cyclic ratio between 40 to 60%. Figure 2. shows the clock generation block diagram. X2 bit is validated on XTAL1÷2 rising edge to avoid glitches when switching from X2 to STD mode. Figure 3. shows the mode switching waveforms: XTAL1 fOSC ÷2 0 1 State Machine: 6 clock cycles CPU control X2 CKCON Register Figure 2. Clock Generation Diagram The X2 bit in the CKCON register allows to switch from 12 clock cycles per instruction to 6 clock cycles and vice versa. At reset, the standard speed is activated (STD mode). Setting this bit activates the X2 feature(X2 mode). CAUTION In order to prevent any incorrect operation while operating in X2 mode, user must be aware that all peripherals using clock frequency as time reference (UART, timers) will have their time reference divided by two. For example a free running timer generating an interrupt every 30 ms will then generate an interrupt every 15 ms. UART with 2400 baud rate will have 4800 baud rate. Sep. 2004 Ver 1.01 19 HMS99C51S/52S/54S/56S/58S XTAL1 XTAL1:2 X2 bit CPU Clock STD Mode X2 Mode STD Mode Figure 3. Mode Switching Waveforms . 20 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S TIMER / COUNTER 0 AND 1 Timer/Counter 0 and 1 can be used in four operating modes as listed in Table 4: Mode Description TMOD Input Clock Gate C/T M1 M0 internal external (Max.) 0 8-bit timer/counter with a divide-by-32 prescaler X X 0 0 fOSC ÷(12×32) fOSC ÷(24×32) 1 16-bit timer/counter X X 0 1 fOSC ÷12 fOSC ÷24 2 8-bit timer/counter with 8-bit auto-reload X X 1 0 fOSC ÷12 fOSC ÷24 3 Timer/counter 0 used as one 8-bit timer/counter and one 8-bit timer Timer 1 stops X X 1 1 fOSC ÷12 fOSC ÷24 Table 4. Timer/Counter 0 and 1 Operating Modes In the “timer” function (C/T = “0”) the register is incremented every machine cycle. Therefore the count rate is fOSC/12. In the “counter” function the register is incremented in response to a 1-to-0 transition at its corresponding external input pin (P3.4/T0, P3.5/T1). Since it takes two machine cycles to detect a falling edge the max. count rate is fOSC/24. External inputs INT0 and INT1 (P3.2, P3.3) can be programmed to function as a gate to facilitate pulse width measurements. Figure 4 illustrates the input clock logic. ÷ 12 fOSC fOSC ÷ 12 C/T TMOD 0 Timer 0/1 Input Clock P3.4/T0 P3.5/T1 Max. fOSC/24 1 TR0 / 1 TCON Gate TMOD & =1 ≥1 P3.2 / INT0 P3.3 / INT1 Figure 4. Timer/Counter 0 and 1 Input Clock Logic Sep. 2004 Ver 1.01 21 HMS99C51S/52S/54S/56S/58S TIMER 2 Timer 2 is a 16-bit timer/Counter with an up/down count feature. It can operate either as timer or as an event counter which is selected by bit C/T2 (T2CON.1). It has three operating modes as shown in Table 5. T2M OD Mode 16-bit AutoReload 16-bit Capture Baud Rate Generator Off T2C ON RCLK or TCLK CP/ RL2 TR2 DCE N EXE N2 P1. 1/ T2 EX 0 0 1 0 0 X 0 0 1 0 1 ↓ 0 0 0 0 1 1 1 1 X X 0 1 0 1 1 X 0 X 0 1 1 X 1 ↓ 1 X 1 X 0 X 1 X 1 X 1 ↓ X X 0 X X X T2CON Input Clock Remarks internal external (P1.0/T2) reload upon overflow reload trigger (falling edge) Down counting Up counting fOSC ÷ 12 Max. fOSC ÷24 16 bit Timer/ Counter (only upcounting) capture TH2,TL2 → RC2H,RC2L fOSC ÷ 12 Max. fOSC ÷ 24 no overflow interrupt request (TF2) extra external interrupt (“Timer 2”) fOSC ÷ 12 Max. fOSC ÷ 24 - - Timer 2 stops Table 5. Timer/Counter 2 Operating Modes Note: ↓ = 22 falling edge Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S SERIAL INTERFACE (UART) The serial port is full duplex and can operate in four modes (one synchronous mode, three asynchronous modes) as illustrated in Table 6. The possible baud rates can be calculated using the formulas given in Table 7. Mode SCON Baudrate SM0 SM1 0 0 0 f OSC -----------12 1 0 1 Timer 1/2 overflow rate 2 1 0 f OSC or f OSC ----------------------64 32 3 1 1 Timer 1/2 overflow rate Description Serial data enters and exits through RxD. TxD outputs the shift clock. 8-bit are transmitted/received (LSB first) 8-bit UART 10 bits are transmitted (through TxD) or received (RxD) 9-bit UART 11 bits are transmitted (TxD) or received (RxD) 9-bit UART Like mode 2 except the variable baud rate Table 6. UART Operating Modes Baud Rate derived from Interface Mode Baudrate 0 f OSC ----------12 2 2 ------------------ × f OSC 64 1,3 2 ------------------ × ( Timer 1 overflow ) 32 1,3 SMOD f OSC 2 ------------------ × ------------------------------------------------32 12 × [ 256 – ( TH1 ) ] 1,3 f OSC --------------------------------------------------------------------------------32 × [ 65536 – ( RC2H, RC2L ) ] Oscillator Timer 1 (16-bit timer) (8-bit timer with 8-bit auto reload) Timer 2 SMOD SMOD Table 7. Formulas for Calculating Baud rates Sep. 2004 Ver 1.01 23 HMS99C51S/52S/54S/56S/58S INTERRUPT SYSTEM The HMS99C51S/52S/54S/56S/58S provide 6 (above 8K bytes ROM version) interrupt sources with two priority levels. Figure 5 gives a general overview of the interrupt sources and illustrates the request and control flags. High Priority Timer 0 Overflow TF0 TCON.5 ET0 PT0 IE.1 IP.1 ET1 PT1 IE.3 IP.3 EXF2 ET2 PT2 T2CON.6 IE.5 IP.5 Timer 1 Overflow TF1 TCON.7 Timer 2 Overflow TF2 T2CON.7 P1.1/ T2EX EXEN2 T2CON.3 UART RI SCON.0 ≥1 ≥1 TI ES PS SCON.1 IE.4 IP.4 IT0 EX0 PX0 TCON.0 IE.0 IP.0 P3.2/ INT0 Low Priority IE0 TCON.1 P3.3/ INT1 IE1 TCON.3 IT1 TCON.2 EX1 EA PX1 IE.2 IE.7 IP.2 : Low level triggered : Falling edge triggered Figure 5. Interrupt Request Sources 24 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Source (Request Flags) RESET IE0 TF0 IE1 TF1 RI + TI TF2 + EXF2 Vectors Vector Address RESET External interrupt 0 Timer 0 interrupt External interrupt 1 Timer 1 interrupt Serial port interrupt Timer 2 interrupt 0000H 0003H 000BH 0013H 001BH 0023H 002BH Table 8. Interrupt Sources and their Corresponding Interrupt Vectors A low-priority interrupt can itself be interrupted by a high-priority interrupt, but not by another low priority interrupt. A high-priority interrupt cannot be interrupted by any other interrupt source. If two requests of different priority level are received simultaneously, the request of higher priority is serviced. If requests of the same priority are received simultaneously, an internal polling sequence determines which request is serviced. Thus within each priority level there is a second priority structure determined by the polling sequence as shown in Table 9. Interrupt Source External Interrupt 0 Timer 0 Interrupt External Interrupt 1 Timer 1 Interrupt Serial Channel Timer 2 Interrupt IE0 TF0 IE1 TF1 RI + TI TF2 + EXF2 Priority High ↓ ↓ ↓ ↓ Low Table 9. Interrupt Priority-Within-Level Sep. 2004 Ver 1.01 25 HMS99C51S/52S/54S/56S/58S Power Saving Modes Two power down modes are available, the Idle Mode and Power Down Mode. The bits PDE and IDLE of the register PCON select the Power Down mode or the Idle mode, respectively. If the Power Down mode and the Idle mode are set at the same time, the Power Down mode takes precedence. Table 10 gives a general overview of the power saving modes. Mode Entering Instruction Example Idle mode ORL PCON, #01H - Enabled interrupt - Hardware Reset CPU is gated off CPU status registers maintain their data. Peripherals are active Power-Down mode ORL PCON, #02H Hardware Reset Oscillator is stopped, contents of onchip RAM and SFR’s are maintained (leaving Power Down Mode means redefinition of SFR contents). Leaving by Remarks Table 10. Power Saving Modes Overview In the Power Down mode of operation, VCC can be reduced to minimize power consumption. It must be ensured, however, that VCC is not reduced before the Power Down mode is invoked, and that VCC is restored to its normal operating level, before the Power Down mode is terminated. The reset signal that terminates the Power Down mode also restarts the oscillator. The reset should not be activated before VCC is restored to its normal operating level and must be held active long enough to allow the oscillator to restart and stabilize (similar to power-on reset). 26 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S ELECTRICAL CHARACTERISTICS Absolute Maximum Ratings Ambient temperature under bias (TA)...................................................................................... -40 to + 85 °C Storage temperature (TST)...................................................................................................... -65 to + 150 °C Voltage on VCC pins with respect to ground (VSS) ................................................................. -0.5V to 6.5V Voltage on any pin with respect to ground (VSS) ..........................................................-0.5V to VCC + 0.5V Input current on any pin during overload condition............................................................-10mA to +10mA Absolute sum of all input currents during overload condition...........................................................|100mA| Power dissipation ............................................................................................................................... 200mW Note: Stresses above those listed under “Absolute Maximum Ratings” may cause permanent damage of the device. This is a stress rating only and functional operation of the device at these or any other conditions above those indicated in the operational sections of this specification is not implied. Exposure to absolute maximum rating conditions for longer periods may affect device reliability. During overload conditions (VIN > VCC or VIN < VSS) the Voltage on VCC pins with respect to ground (VSS) must not exceed the values defined by the absolute maximum ratings. Sep. 2004 Ver 1.01 27 HMS99C51S/52S/54S/56S/58S DC Characteristics DC Characteristics for HMS99C51S/52S/54S/56S/58S VCC= 5V + 10%, -15%, VSS=0V, TA= -40°C to 85 °C Parameter Symbol Limit Values Min. Max. Un it Test Conditions Input low voltage (except EA, RESET) VIL -0.5 0.2VCC - 0.1 V VCC= 5.5V Input low voltage (EA) VIL1 -0.5 0.2VCC - 0.1 V VCC= 5.5V Input low voltage (RESET) VIL2 -0.5 0.2VCC + 0.1 V VCC= 5.5V Input high voltage (except XTAL1, EA, RESET) VIH 0.2VCC + 0.9 VCC + 0.5 V VCC= 4.5V Input high voltage to XTAL1 VIH1 0.7VCC VCC + 0.5 V VCC= 4.5V Input high voltage to EA, RESET VIH2 0.6VCC VCC + 0.5 V VCC= 4.5V Output low voltage (ports 1, 2, 3) VOL - 0.45 V VCC= 5.5V, IOL= 1.6mA 1) Output low voltage (port 0, ALE, PSEN) VOL1 - 0.45 V VCC= 5.5V, IOL= 3.2mA 1) Output high voltage (ports 1, 2, 3) VOH 2.4 0.9VCC - V VCC= 4.5V, IOH= -80µA VCC= 4.5V, IOH= -10µA Output high voltage (port 0 in external bus mode, ALE, PSEN) VOH1 2.4 0.9VCC - V VCC= 4.5V, IOH= -800µA 2) VCC= 4.5V, IOH= -80µA 2) Logic 0 input current (ports 1, 2, 3) IIL -10 -65 µA VIN= 0.45V Logical 1-to-0 transition current (ports 1, 2, 3) ITL -65 -650 µA VIN= 2.0V Input leakage current (port 0, EA) ILI - ±1 µA 0.45 < VIN < VCC CIO - 10 pF fC= 1MHz TA= 25°C Pin capacitance Power supply current: Active mode, 4MHz 3) Idle mode, 4MHz 4) Active mode, 24 MHz 4) Idle mode, 24MHz 4) Active mode, 40 MHz 4) Idle mode, 40 MHz 4) Power Down Mode 4) 28 ICC ICC ICC ICC ICC ICC IPD - 8 4 25 10 30 15 50 mA mA mA mA mA mA uA VCC= 5V 4) VCC= 5V 5) VCC= 5V 4) VCC= 5V 5) VCC= 5V 4) VCC= 5V 5) VCC= 5V 6) Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S 1) Capacitive loading on ports 0 and 2 may cause spurious noise pulses to be superimposed on the VOL of ALE and port 3. The noise is due to external bus capacitance discharging into the port 0 and port 2 pins when these pins make 1-to-0 transitions during bus operation. In the worst case(capacitive loading: > 50pF at 3.3V, > 100pF at 5V), the noise pulse on ALE line may exceed 0.8V. In such cases it may be desirable to qualify ALE with a schmitt-trigger, or use an address latch with a schmitt-trigger strobe input. 2) Capacitive loading on ports 0 and 2 may cause the VOH on ALE and PSEN to momentarily fall below the 0.9VCC specification when the address lines are stabilizing. 3) ICC Max. at other frequencies is given by: active mode: ICC = 1.27 × fOSC + 5.73 idle mode: ICC = 0.28 × fOSC + 1.45 (except OTP devices) where fOSC is the oscillator frequency in MHz. ICC values are given in mA and measured at VCC = 5V. 4) ICC (active mode) is measured with: XTAL1 driven with tCLCH, tCHCL = 5ns, VIL = VSS + 0.5V, VIH = VCC - 0.5V; XTAL2 = N.C.; EA = Port0 = RESET = VCC; all other pins are disconnected. ICC would be slightly higher if a crystal oscillator is used (appr. 1mA). 5) ICC (Idle mode) is measured with all output pins disconnected and with all peripherals disabled; XTAL1 driven with tCLCH, tCHCL = 5ns, VIL = VSS + 0.5V, VIH = VCC - 0.5V; XTAL2 = N.C.; RESET = EA = VSS; Port0 = VCC; all other pins are disconnected; 6) IPD (Power Down Mode) is measured under following conditions: EA = Port0 = VCC; RESET = VSS; XTAL2 = N.C.; XTAL1 = VSS; all other pins are disconnected. Sep. 2004 Ver 1.01 29 HMS99C51S/52S/54S/56S/58S AC Characteristics Explanation of the AC Symbols Each timing symbol has 5 characters. The first character is always a ‘t’ (stand for time). The other characters, depending on their positions, stand for the name of a signal or the logical status of that signal. The following is a list of all the characters and what they stand for. A: Address C: Clock D: Input Data H: Logic level HIGH I: Instruction (program memory contents) L: Logic level LOW, or ALE P: PSEN Q: Output Data R: RD signal T: Time V: Valid W: WR signal X: No longer a valid logic level Z: Float For example, tAVLL = Time from Address Valid to ALE Low tLLPL = Time from ALE Low to PSEN Low AC Characteristics for HMS99C51S/52S/54S/56S/58S (12MHz version) VCC= 5V : VCC= 5V + 10%, − 15%, VSS= 0V, TA= -40°C to 85°C (CL for port 0, ALE and PSEN outputs = 100pF, CL for all other outputs = 80pF) Variable clock : Vcc = 5V : 1/tCLCL = 3.5 MHz to 12 MHz External Program Memory Characteristics Parameter Symbol 12 MHz Oscillator Variable Oscillator 1/tCLCL = 3.5 to 12MHz Min. Max. Min. Max. Unit ALE pulse width tLHLL 127 - 2tCLCL-40 - ns Address setup to ALE tAVLL 43 - tCLCL-40 - ns Address hold after ALE tLLAX 30 - tCLCL-53 - ns ALE low to valid instruction in tLLIV - 233 - 4tCLCL-100 ns ALE to PSEN tLLPL 58 - tCLCL-25 - ns PSEN pulse width tPLPH 215 - 3tCLCL-35 - ns PSEN to valid instruction in tPLIV - 150 - 3tCLCL-100 ns Input instruction hold after PSEN tPXIX 0 - 0 - ns Input instruction float after PSEN tPXIZ † - 63 - tCLCL-20 ns 75 - tCLCL-8 - ns † Address valid after PSEN tPXAV Address to valid instruction in tAVIV - 302 - 5tCLCL-115 ns Address float to PSEN tAZPL 0 - 0 - ns † Interfacing the HMS99C51S/52S/54S/56S/58S to devices with float times up to 75 ns is permissible. This limited bus conten- tion will not cause any damage to port 0 Drivers. 30 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S AC Characteristics for HMS99C51S/52S/54S/56S/58S (12MHz) External Data Memory Characteristics Parameter Symbol 12 MHz Oscillator Variable Oscillator 1/tCLCL = 3.5 to 12MHz Min. Max. Min. Max. Unit RD pulse width tRLRH 400 - 6tCLCL-100 - ns WR pulse width tWLWH 400 - 6tCLCL-100 - ns Address hold after ALE tLLAX2 53 - tCLCL-30 - ns RD to valid data in tRLDV - 252 - 5tCLCL-165 ns Data hold after RD tRHDX 0 - 0 - ns Data float after RD tRHDZ - 97 - 2tCLCL-70 ns ALE to valid data in tLLDV - 517 - 8tCLCL-150 ns Address to valid data in tAVDV - 585 - 9tCLCL-165 ns ALE to WR or RD tLLWL 200 300 3tCLCL-50 3tCLCL+50 ns Address valid to WR or RD tAVWL 203 - 4tCLCL-130 - ns WR or RD high to ALE high tWHLH 43 123 tCLCL-40 tCLCL+40 ns Data valid to WR transition tQVWX 33 - tCLCL-50 - ns Data setup before WR tQVWH 433 - 7tCLCL-150 - ns Data hold after WR tWHQX 33 - tCLCL-50 - ns Address float after RD tRLAZ - 0 - 0 ns Advance Information (12MHz) External Clock Drive Parameter Symbol Variable Oscillator (Freq. = 3.5 to 12MHz) Min. Max. Unit Oscillator period (VCC=5V) tCLCL 83.3 285.7 ns High time tCHCX 20 tCLCL - tCLCX ns Low time tCLCX 20 tCLCL - tCHCX ns Rise time tCLCH - 20 ns Fall time tCHCL - 20 ns Sep. 2004 Ver 1.01 31 HMS99C51S/52S/54S/56S/58S AC Characteristics for HMS99C51S/52S/54S/56S/58S (24MHz version) VCC= 5V + 10%, −15%, VSS= 0V, TA= -40°C to 85°C (CL for port 0. ALE and PSEN outputs = 100pF; CL for all other outputs = 80pF) External Program Memory Characteristics Parameter Symbol 24 MHz Oscillator Variable Oscillator 1/tCLCL = 3.5 to 24MHz Min. Max. Min. Max. Unit ALE pulse width tLHLL 43 - 2tCLCL-40 - ns Address setup to ALE tAVLL 17 - tCLCL-25 - ns Address hold after ALE tLLAX 17 - tCLCL-25 - ns ALE low to valid instruction in tLLIV - 80 - 4tCLCL-87 ns ALE to PSEN tLLPL 22 - tCLCL-20 - ns PSEN pulse width tPLPH 95 - 3tCLCL-30 - ns PSEN to valid instruction in tPLIV - 60 - 3tCLCL-65 ns Input instruction hold after PSEN tPXIX 0 - 0 - ns - 32 - tCLCL-10 ns 37 - tCLCL-5 - ns † Input instruction float after PSEN tPXIZ Address valid after PSEN tPXAV † Address to valid instruction in tAVIV - 148 - 5tCLCL-60 ns Address float to PSEN tAZPL 0 - 0 - ns † Interfacing the HMS99C51S/52S/54S/56S/58S to devices with float times up to 35 ns is permissible. This limited bus conten- tion will not cause any damage to port 0 Drivers. 32 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S AC Characteristics for HMS99C51S/52S/54S/56S/58S(24MHz) External Data Memory Characteristics Parameter Symbol 24 MHz Oscillator Variable Oscillator 1/tCLCL = 3.5 to 24MHz Min. Max. Min. Max. Unit RD pulse width tRLRH 180 - 6tCLCL-70 - ns WR pulse width tWLWH 180 - 6tCLCL-70 - ns Address hold after ALE tLLAX2 15 - tCLCL-27 - ns RD to valid data in tRLDV - 118 - 5tCLCL-90 ns Data hold after RD tRHDX 0 - 0 - ns Data float after RD tRHDZ - 63 - 2tCLCL-20 ns ALE to valid data in tLLDV - 200 - 8tCLCL-133 ns Address to valid data in tAVDV - 220 - 9tCLCL-155 ns ALE to WR or RD tLLWL 75 175 3tCLCL-50 3tCLCL+50 ns Address valid to WR or RD tAVWL 67 - 4tCLCL-97 - ns WR or RD high to ALE high tWHLH 17 67 tCLCL-25 tCLCL+25 ns Data valid to WR transition tQVWX 5 - tCLCL-37 - ns Data setup before WR tQVWH 170 - 7tCLCL-122 - ns Data hold after WR tWHQX 15 - tCLCL-27 - ns Address float after RD tRLAZ - 0 - 0 ns Advance Information (24MHz) External Clock Drive Parameter Symbol Variable Oscillator (Freq. = 3.5 to 24MHz) Min. Max. Unit Oscillator period tCLCL 41.7 285.7 ns High time tCHCX 12 tCLCL - tCLCX ns Low time tCLCX 12 tCLCL - tCHCX ns Rise time tCLCH - 12 ns Fall time tCHCL - 12 ns Sep. 2004 Ver 1.01 33 HMS99C51S/52S/54S/56S/58S AC Characteristics for HMS99C51S/52S/54S/56S/58S(40MHz version) VCC= 5V + 10%, − 15%, VSS= 0V, TA= -40°C to 85°C (CL for port 0, ALE and PSEN outputs = 100pF, CL for all other outputs = 80pF) External Program Memory Characteristics Parameter Symbol 40 MHz Oscillator Variable Oscillator 1/tCLCL = 3.5 to 40MHz Min. Max. Min. Max. Unit ALE pulse width tLHLL 40 - 2tCLCL−20 - ns Address setup to ALE tAVLL 10 - tCLCL−20 - ns Address hold after ALE tLLAX 10 - tCLCL−20 - ns ALE low to valid instruction in tLLIV - 56 - 4tCLCL−65 ns ALE to PSEN tLLPL 15 - tCLCL−15 - ns PSEN pulse width tPLPH 80 - 3tCLCL−20 - ns PSEN to valid instruction in tPLIV - 35 - 3tCLCL−55 ns Input instruction hold after PSEN tPXIX 0 - 0 - ns - 20 - tCLCL−10 ns 25 - tCLCL−5 - ns † Input instruction float after PSEN tPXIZ Address valid after PSEN tPXAV † Address to valid instruction in tAVIV - 91 - 5tCLCL−60 ns Address float to PSEN tAZPL 0 - 0 - ns † Interfacing the HMS99C51S/52S/54S/56S/58S to devices with float times up to 20 ns is permissible. This limited bus conten- tion will not cause any damage to port 0 Drivers. 34 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S AC Characteristics for HMS99C51S/52S/54S/56S/58S(40MHz) External Data Memory Characteristics Parameter Symbol at 40 MHz Clock Variable Clock 1/tCLCL = 3.5 to 40MHz Min. Max. Min. Max. Unit RD pulse width tRLRH 132 - 6tCLCL-50 - ns WR pulse width tWLWH 132 - 6tCLCL-50 - ns Address hold after ALE tLLAX2 10 - tCLCL-20 - ns RD to valid data in tRLDV - 81 - 5tCLCL-70 ns Data hold after RD tRHDX 0 - 0 - ns Data float after RD tRHDZ - 46 - 2tCLCL-15 ns ALE to valid data in tLLDV - 153 - 8tCLCL-90 ns Address to valid data in tAVDV - 183 - 9tCLCL-90 ns ALE to WR or RD tLLWL 71 111 3tCLCL-20 3tCLCL+20 ns Address valid to WR or RD tAVWL 66 - 4tCLCL-55 - ns WR or RD high to ALE high tWHLH 10 40 tCLCL-20 tCLCL+20 ns Data valid to WR transition tQVWX 5 - tCLCL-25 - ns Data setup before WR tQVWH 142 - 7tCLCL-70 - ns Data hold after WR tWHQX 10 - tCLCL-20 - ns Address float after RD tRLAZ - 0 - 0 ns Advance Information (40MHz) External Clock Drive Parameter Symbol Variable Oscillator (Freq. = 3.5 to 40MHz) Min. Max. Unit Oscillator period tCLCL 30.3 285.7 ns High time tCHCX 11.5 tCLCL - tCLCX ns Low time tCLCX 11.5 tCLCL - tCHCX ns Rise time tCLCH - 5 ns Fall time tCHCL - 5 ns Sep. 2004 Ver 1.01 35 HMS99C51S/52S/54S/56S/58S tLHLL ALE tLLPL tAVLL tPLPH tLLIV tPLIV PSEN tPXAV tPXIZ tPXIX tAZPL tLLAX PORT 0 INSTR. IN A0-A7 A0-A7 tAVIV PORT 2 A8-A15 A8-A15 Figure 6. External Program Memory Read Cycle 36 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S ALE tLHLL tWHLH PSEN tLLDV tLLWL tRLRH RD tAVLL tRHDZ tRLDV tLLAX2 tRHDX tRLAZ A0-A7 from RI or DPL PORT 0 DATA IN A0-A7 from PCL INSTR. IN tAVWL tAVDV PORT 2 P2.0-P2.7 or A8-A15 from DPH A8-A15 from PCH Figure 7. External Data Memory Read Cycle ALE tLHLL tWHLH PSEN tLLWL tWLWH WR tAVLL PORT 0 tQVWX tLLAX2 A0-A7 from RI or DPL tWHQX tQVWH DATA OUT A0-A7 from PCL INSTR. IN tAVWL PORT 2 P2.0-P2.7 or A8-A15 from DPH A8-A15 from PCH Figure 8. External Data Memory Write Cycle Sep. 2004 Ver 1.01 37 HMS99C51S/52S/54S/56S/58S VCC−0.5V 0.2VCC + 0.9 Test Points 0.2VCC − 0.1 0.45V AC Inputs during testing are driven at VCC−0.5V for a logic ‘1’ and 0.45V for a logic ‘0’. Timing measurements are made a VIHmin for a logic ‘1’ and VILmax for a logic ‘0’. Figure 9. AC Testing: Input, Output Waveforms VLOAD + 0.1 VOH − 0.1 Timing Reference Points VLOAD 0.2VCC − 0.1 VLOAD − 0.1 VOL + 0.1 For timing purposes a port pin is no longer floating when a 100mV change from load voltage occurs and begins to float when a 100mV change from the loaded VOH / VOL level occurs. IOL / IOH ≥ 20mA. Figure 10. Float Waveforms tCLCL VCC−0.5V 0.45V 0.7 VCC 0.2 VCC −0.1 tCHCX tCHCL tCLCX tCLCH Figure 11. External Clock Cycle 38 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S OSCILLATOR CIRCUIT CRYSTAL OSCILLATOR MODE C2 XTAL2 P-LCC-44/Pin 20 P-DIP-40/Pin 18 M-QFP-44/Pin 14 C1 XTAL1 P-LCC-44/Pin 21 P-DIP-40/Pin 19 M-QFP-44/Pin 15 DRIVING FROM EXTERNAL SOURCE N.C. External Oscillator Signal XTAL2 P-LCC-44/Pin 20 P-DIP-40/Pin 18 M-QFP-44/Pin 14 XTAL1 P-LCC-44/Pin 21 P-DIP-40/Pin 19 M-QFP-44/Pin 15 C1, C2 = 30pF ±10pF for Crystals For Ceramic Resonators, contact resonator manufacturer. Figure 12. Recommended Oscillator Circuits Oscillation circuit is designed to be used either with a ceramic resonator or crystal oscillator. Since each crystal and ceramic resonator have their own characteristics, the user should consult the crystal manufacturer for appropriate values of external components. Sep. 2004 Ver 1.01 39 HMS99C51S/52S/54S/56S/58S Plastic Package P-LCC-44 (Plastic Leaded Chip-Carrier) 44PLCC UNIT: INCH 0.695 0.685 0.012 0.0075 0.021 0.013 0.032 0.026 0.656 0.650 0.695 0.685 0.050 BSC 0.630 0.590 min. 0.020 0.656 0.650 0.120 0.090 0.180 0.165 40 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Plastic Package P-DIP-40 (Plastic Dual in-Line Package) 40DIP UNIT: INCH 0.600 BSC 0.022 0.015 Sep. 2004 Ver 1.01 0.065 0.045 0.100 BSC 0.140 0.120 min. 0.015 0.200 max. 2.075 2.045 0.550 0.530 0-15° 0.012 0.008 41 HMS99C51S/52S/54S/56S/58S Plastic Package P-MPQF-44 (Plastic Metric Quad Flat Package) 44MQFP 13.45 12.95 UNIT: MM 0-7° 0.25 0.10 SEE DETAIL "A" 2.35 max. 0.45 0.30 0.80 BSC 0.23 0.13 2.10 1.95 10.10 9.90 13.45 12.95 10.10 9.90 1.03 0.73 1.60 REF DETAIL "A" 42 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S FLASH MEMORY Overview The Flash memory increases EPROM and ROM functionality with in-circuit electrical erasure and programming. It contains 4K, 8K, 16K, 24K or 32K bytes of program memory. This memory is both parallel and serial In-System Programmable (ISP). ISP allows devices to alter their own program memory in the actual end product under software control. A default serial loader (bootloader) program allows ISP of the Flash. The programming does not require 12V external programming voltage. The necessary high programming voltage is generated onchip using the standard VCC pins of the microcontroller. Features • Flash memory internal program memory. • Default loader in Boot ROM allows programming via the serial port without the need of a user provided loader. • Up to 64K byte external program memory if the internal program memory is disabled (EA = 0). • Programming and erase voltage with standard 5V VCC supply. • Read/Programming/Erase: - Programming time per byte : 20us (TBD) - Block erase/Total Erase time : 200ms (TBD) - Typical programming time (32K bytes) is 10s at ISP mode (TBD) • Parallel programming with Atmel/Philips chip compatible hardware interface to programmer • Programmable security for the code in the Flash • Endurance : 10,000 cycles (TBD) • Data retention : 10 years (TBD) Flash Programming and Erasure There are three methods of programming the Flash memory: • First, the on-chip ISP bootloader may be invoked which will use low level routines to program. The interface used for serial downloading of Flash memory is the UART. • Second, the Flash may be programmed or erased in the end-user application by calling low level routines through a common entry point in the Boot ROM. • Third, the Flash may be programmed using the parallel method by using conventional EPROM programmer. The commercially available programmers need to have support for the HMS99C51S/ 52S/54S/56S/58S. The bootloader routines are located in the Boot ROM. Sep. 2004 Ver 1.01 43 HMS99C51S/52S/54S/56S/58S Flash Memory Architecture HMS99C51S/52S/54S/56S/58S feature two on-chip Flash memories: • Flash memory FM0: 4K/8K/16K/24K/32K bytes user program memory • Flash memory FM1: 2K bytes for bootloader. The FM0 and FM1 can be programmed by both parallel programming and Serial In-System Programming. The ISP mode is detailed in the "In-System Programming" section. FFFFH HSB (1byte) 807FH Reserved 7FFFH ISP + Flash Management F800H FM1(2K bytes): Boot Loader 4K/8K/16K/24K/32K Bytes User Application (FM0) 0000H FM0 Memory Architecture • 4K/8K/16K/24K/32K bytes User Program Memory • Hardware Security Bits (HSB) User Space This space is composed of a 4K/8K/16K/24K/32K bytes Flash memory. HMS99C51S/52S has only sectors of 2K byte unit block, and HMS99C54S/56S/58S has 4 sectors of 2K byte unit block and other sectors of 8K byte unit block. It contains the user’s application code. Hardware Security Byte The Hardware Security Byte space is a part of HSB and has a size of 1 byte. 44 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Cross Flash Memory Access Description The FM0 and FM1 memory can be programmed by parallel programming. The FM0 memory can be programmed from FM1. But, programming FM1 from FM0 or from external memory is impossible. Code Executing from FM1 memory can be programmed only by parallel programming. FM0 FM1 Action FM0 (User Flash) FM1 (Boot Flash) Read OK - Write/Erase - - Read OK OK Write/Erase OK - Table 11. Cross Flash Memory Access Overview of FM0 Operations The CPU interfaces to the Flash memory through the FCON register of SFR FCON register is used to: • Select Register for operation of Flash Access (FRSEL[2:0]) • Erase Mode Select (ERASESEL) • Enable Boot Flash (ENBOOT) • 64K Bytes Internal Rom Access (INTROM_EN) • Program Mode Select (PGMSEL) Mapping of the Memory Space By default, the user space is accessed by MOVC instruction for read only. The other memory spaces (user, BOOT, HSB) are made accessible in the code segment by programming bits INTROM_EN, ENBOOT in FCON register in advance. A MOVC instruction is then used for reading these spaces in accordance with address of Table 12. Region HSB(1 Bytes) Boot(2K Bytes) User(32K Bytes) Addr. 15 1 0 Addr. 14~11 Addr. 10~7 Addr. 6~0 0000 0111 1111 1111 Variable Variable Variable Variable Variable Table 12. FM0 Blocks Select Bits Sep. 2004 Ver 1.01 45 HMS99C51S/52S/54S/56S/58S Flash Registers and Memory Map The HMS99C51S/52S/54S/56S/58S Flash memory uses several registers for its management: • Hardware registers can only be accessed through the parallel programming modes which are handled by the parallel programmer. Hardware Register The only hardware register of the HMS99C51S/52S/54S/56S/58S is called Hardware Security Byte(HSB). - - - BLJB_EN BLJB LB2 LB1 LB0 Table 13. Hardware Security Byte(HSB) Bit No Bit Mnemonic 7~5 BLJN_EN 4 Description Reserved Enable BLJB Bit 1 : BLJB is enabled for ISP Mode 0 : BLJB is disabled. (After finishing of download, must be programmed.) 3 BLJB Boot Loader Jump Bit 1 : Start the user’s application on next reset at address 0000H 0 : Start the boot loader at address F800H(Default). 2~0 LB2~0 User Memory Lock Bits See Table 14 1 : Unprogrammed 0 : Programmed Note: HSB can be read but can not be programmed in ISP Mode and only programmable by specific tools. 46 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Flash Memory Lock Bits The three lock bits provide different levels of protection for the on-chip code and data, when programmed as shown in Table 14. Program Lock Bit Protection Description Security Level LB0 LB1 LB2 1 U U U No program lock features enabled. 2 P U U MOVC instruction executed from external program memory is disabled from fetching code bytes from internal memory, EA is sampled and latched on reset, and further parallel programming of the Flash is disabled. ISP and software programming with ISP are still allowed. 3 X P U Same as 2, also verify through parallel programming interface is disabled. 4 X X P Same as 3, also external execution is disable. Table 14. Program Lock Bits Note: U : unprogrammed or “1”, P : programmed or “0”, X: don’t care Note: Security level 2 and 3 should only be programmed after Flash and code verification. These security bits protect the code access through the parallel programming interface. They are set by default to level 1. Though at level 2, 3 and 4, the code access through the ISP is still possible. Default Values The default value of the HSB provides parts ready to be programmed with ISP • BLJB_EN: BLJB bit is enabled or disabled.(default : disabled) • BLJB: Programmed force ISP operation(Default : ISP inactivated)). • LB2-0: Security level four to protect the code from a parallel access with maximum security.(Default : Level 1) Software Security The software security provide two different levels of protection for the on-chip code and data, • Level 1 : No program lock features enabled. • Level 2 : ISP programming and verify of the Flash is disabled. Sep. 2004 Ver 1.01 47 HMS99C51S/52S/54S/56S/58S Flash Memory Status HMS99C51S/52S/54S/56S/58S themselves are delivered in standard with the ISP boot code in the Flash memory. After ISP or parallel programming, the possible contents of the Flash memory are summarized on Figure 13. 7FFFH : HMS99C58S 32KB 5FFFH : HMS99C56S 24KB 3FFFH : HMS99C54S 16KB 1FFFH : HMS99C52S 8KB 0FFFH : HMS99C51S 4KB Virgin 0000H Default Application Application After ISP After Parallel Figure 13. Flash Memory Possible Contents Memory Organization In the HMS99C51S/52S/54S/56S/58S, the lowest 4K, 8K, 16K, 24K or 32K of the 64 KB program memory address space is filled by internal Flash cells. When the EA pin is high, the processor fetches instructions from internal program Flash memory. Bus expansion for accessing program memory from 4K, 8K, 16K, 24K or 32K is upward since external instruction fetches occur automatically when the program counter exceeds 0FFFh(4K), 1FFFh(8K), 3FFFh(16K), 5FFFh(24K) or 7FFFh (32K). If the EA pin is tied low, all program memory fetches are from external memory. 48 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Flash Management Block • Flash Management Block is controlled by ISP Command • FLASH DIGITAL BLOCK P3.6,P3.7,P2.6,P2.7,EA,PSEN,PROG FLASH Parallel Mode Control Block RESET ADD Reg.[2:0] DPTR<15:0> FLASH Lock Control Block FLASH RWE Control Block DATA Reg.[7:0] ACC<7:0> CONTROL Reg.[1:0] POWER Reg.[6:0] EBR Reg.[7:0] FRSEL[2:0] FLASH Memory 32K Decoder FLASH Management Block FLASH ANALOG BLOCK FLASH ARRAY 4K/8K/16K/24K/32KB (USER AREA) 2KB (BOOTLOADER) 1B (HSB) DATA_BUS<7:0> X Decoder X Decoder HV(High Voltage) Generator(Pumps+Regulators) Y Decoder & Multiplexer Sense Amp. & IO Buffer Sep. 2004 Ver 1.01 49 HMS99C51S/52S/54S/56S/58S SFR Register for a ISP Mode FCON register exists in D1H in SFR region and defines selection of Flash register operation, R/W for a Flash Registers, BOOT Flash usage, selection of Flash Memory Space and selection of Program location. D0H FCON PCON 00000000B 00000000B - - - - D7H Table 15. SFR Register for a Flash memory FCON (Flash Control) Register : D1H Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 FRSEL2 FRSEL1 FRSEL0 ERASESEL ENBOOT INTROM_EN PGMSEL1 PGMSEL0 Bit No Bit Mnemonic 7~5 FRSEL[2:0] Select Register Operation for Flash Access This bits define register operation for Flash Memory Access See Figure 16. 4 ERASESEL ERASESEL 0 : Erase Mode is deselected 1 : Erase Mode is selected 3 ENBOOT 2 INTROM_EN Internal ROM Access Enable bit 0 : External Memory Access over 32K bytes 1 : Internal Memory Access to use Boot ROM PGMSEL[1:0] The Program Location Select 00 : Reserved 01 : 1 Byte Program 10 : 4 Byte Program 11 : 8 Byte Program 1~0 Description Enable Boot Flash Cleared to disable boot ROM Set to map the boot ROM between F800H ~ 0FFFFH. FRSEL[2:0] Operation 0 (000B) Default Verify / Read Reset CONTREG [7:0] DATA_BUS [7:0] → ACC[7:0] 4 (100B) Write Address and Data DPTR[14:0] → ADDREG[14:0] ACC[7:0] → DATAREG[7:0] 5 (101B) Write CONTREG ACC[7:0] → CONTREG[7:0] 6 (110B) Write EBR ACC[7:0] → EBR[6:0] 7 (111B) Write PWR ACC[7:0] → PWR[7:0] Table 16. Register Operation Table for Flash Access 50 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Bit Position Name Function Bit0 PGM_SET Program Power Setup Positive Gate Pump Setup Bit1 ER_SET Erase Power Setup Negative/Positive Gate Pump Setup Bit2~Bit7 - - Reserved Table 17. Control Register Bit Position Name Function Function Effect Bit7 ~ Bit6 VEEIOPT[1:0] Define VEEI (Negative Pump Output Value) 00 : VEEI → -09V 01 : VEEI → -10V 10 : VEEI → -11V Bit5 ~ Bit4 VPPIOPT[1:0] Define VPPI (Positive Gate Pump Output Value) 00 : VPPI → 09V 01 : VPPI → 10V 10 : VPPI → 11V Bit3 DNWOPT Define DNWELL Bias 0 : DNWELL Bias = VCC-VT 1 : DNWELL Bias = VPP-VT Bit2 I_ER_VFY ER_VFY 1: Down the level to check a erased cell (around 1V) 0: default(around 2V) Bit1 I_PGM_VFY PGM_VFY 1: Up the level to check a programmed cell (around 6V) 0: default(around 5V) Bit0 - Reserved For Other Test Table 18. Power Register Bit Position Name Function Function Effect Bit0 EBR0 Erase Block (0000H~07FFH) Erase 2K Bytes Bit1 EBR1 Erase Block (0800H~0FFFH) Erase 2K Bytes Bit2 EBR2 Erase Block (1000H~17FFH) Erase 2K Bytes Bit3 EBR3 Erase Block (1800H~1FFFH) Erase 2K Bytes Bit4 EBR4 Erase Block (2000H~3FFFH) Erase 8K Bytes Bit5 EBR5 Erase Block (4000H~5FFFH) Erase 8K Bytes Bit6 EBR6 Erase Block (6000H~7FFFH) Erase 8K Bytes Table 19. Erase Block Register(EBR) Sep. 2004 Ver 1.01 51 HMS99C51S/52S/54S/56S/58S Bootloader Architecture Introduction The bootloader manages a communication according to a specific defined protocol to provide the whole access and service on Flash memory. Furthermore, all accesses and routines can be called from the user application The Flash bootloader includes: • The serial communication protocol • The ISP command decoder In order to access User FLASH area at a custom bootloader, User must modify the related FLASH registers directly. This may be necessary in case of : • Another communication interface • Different protocol (other data format, encrypted data, etc.) • Flash areas protection • Flash areas checks (CRC, etc.) Access via Specific Protocol Bootloader Flash Memory Access From User Application Figure 14. Diagram Context Description 52 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Bootloader Functional Description External Host with Specific Protocol Communication User Application External Host with Specific Protocol Communication External Host with Specific Protocol Communication External Host with Specific Protocol Communication Flash Memory (32K Bytes) Figure 15. Bootloader Functional Description On the above diagram, the on-chip bootloader processes are: • ISP Communication Management The purpose of this process is to manage the communication and its protocol between the on-chip bootloader and a external device. The on-chip boot ROM implement a serial protocol. This process translate serial communication frame (UART) into Flash memory access (read, write, erase, ...) • Flash Memory Management This process manages low level access to Flash memory (performs read, write and erase access). Sep. 2004 Ver 1.01 53 HMS99C51S/52S/54S/56S/58S Bootloader Process The bootloader can be activated by Hardware conditions. The Hardware conditions (PSEN = 0, EA = 1, ALE = 1) during the Reset falling edge force the on-chip bootloader execution. This allows an application to be built that will normally execute the end user’s code but can be manually forced into default ISP operation. As PSEN is a an output port in normal operating mode (running user application or bootloader code) after reset, it is recommended to release PSEN after falling edge of reset signal. The hardware conditions are sampled at reset signal falling edge, thus they can be released at any time when reset input is low. The on-chip bootloader boot process is shown in Figure 16. RESET Hardware Condition= ? No BLJB=1 ENBOOT=0 INTROM_EN=0 Yes Ιf BLJB = 0 then ENBOOT & INTROM_EN bit(FCON) is set Yes (PSEN=0, EA=1 and ALE=1) BLJB≠0 ? No BLJB=0 ENBOOT=1 INTROM_EN=1 User Application PC = 0000H MagnaChip Bootloader PC = F800H Figure 16. Bootloader Process by hardware • 54 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S IN-SYSTEM PROGRAMMING (ISP) The In-System Programming (ISP) is performed without removing the microcontroller from the system. The ISP facility consists of a series of internal hardware resources coupled with internal firmware to facilitate remote programming of the HMS99C51S/52S/54S/56S/58S through the serial port. The MagnaChip Microcontrollers ISP facility has made in-circuit programming in an embedded application possible with a minimum of additional expense in components and circuit board area. The ISP function through UART uses four pins: TxD, RxD, VSS, and VCC. Only a small connector needs to be available to interface the application to an external circuit in order to use this feature. Using In-System Programming (ISP) The ISP feature allows a wide range of baud rates in the user application. It is also adaptable to a wide range of oscillator frequencies. This is accomplished by measuring the bit-time of a single bit in a received character. This information is then used to program the baud rate in terms of timer counts based on the oscillator frequency. The ISP feature requires that an initial character(an uppercase U) be sent to the HMS99C51S/52S/54S/56S/58S to establish the baud rate. The ISP firmware provides auto-echo of received characters. Once baud rate initialization has been performed, the ISP firmware will only accept Intel Hex-type records. Intel Hex records consist of ASCII characters used to represent hexadecimal values and are summarized below: :NNAAAARRDD...DDCC HMS99C51S/52S/54S/56S/58S will accept up to 16(10H) data bytes. The “AAAA” string represents the address of the first byte in the record. If there are zero bytes in the record, this field is often set to “0000”. The “RR” string indicates the record type. A record type of “00” is a data record. A record type of “01” indicates the endof-file mark. In this application, additional record types will be added to indicate either commands or data for the ISP facility. The “DD” string represents the data bytes. The maximum number of data bytes in a record is limited to 16(decimal). The “CC” string represents the checksum byte. ISP commands are summarized in Table 22. As a record is received by the HMS99C51S/52S/54S/56S/58S, the information in the record is stored internally and a checksum calculation is performed and compared to “CC”. The operation indicated by the record type is not performed until the entire record has been received. Should an error occur in the checksum, the HMS99C51S/52S/54S/56S/58S will send an “X” out the serial port indicating a checksum error. If the checksum calculation is found to match the checksum in the record, then the command will be executed. In most cases, successful reception of the record will be indicated by transmitting a “.” character out the serial port(displaying the contents of the internal program memory is an exception). In the case of a Data Record(record type “00”), an additional check is made. A “.” character will NOT be sent unless the record checksum matched the calculated checksum and all of the bytes in the record were successfully programmed. For a data record, an “X” indicates that the checksum failed to match, and an “R” character indicates that one of the bytes did not properly program. MagnaChip ISP, a software utility to implement ISP programming with a PC, is available from the MagnaChip web site. The users of this ISP function should use this MagnaChip ISP software for proper flash ROM control and operation. Sep. 2004 Ver 1.01 55 HMS99C51S/52S/54S/56S/58S RECORD TYPE COMMAND/DATA FUNCTION 00 Program Data Record :nnaaaa00dd. . . . ddcc Where: nn = number of bytes(hex) in record aaaa = memory address of first byte in record dd....dd=databytes cc = checksum Example: :05008000AF5F67F060B6 01 End of File (EOF), no operation :xxxxxx01cc Where: xxxxxx = required field, but value is a “don’t care” cc = checksum Example: :00000001FF 02 Specify Erase/Write Pulse :03xxxx02wweellcc Where: xxxx = required field, but value is a “don’t care” ww = write pulse ee = erase pulse high byte ll = erase pulse low byte cc = checksum Example: :03000002789C40A7 03 Miscellaneous Write Functions :nnxxxx03ffssddcc Where: nn = number of bytes(hex) in record xxxx = required field, but value is a “don’t care” 03 = Write Function ff = subfunction code ss = selection code dd = data input(as needed) cc = checksum Subfunction Code = 01(Erase Block) ff = 01 ss = block index in bits 6:0 (block number is designated by bit position) Example: :020000030122D8 erase block 1 and 5 (position of bit 1 and 5) Subfunction Code = 05 (Program Software Security Bits) ff = 05 program software security bit (Level 2 inhibit reading/writing to Flash) Example: :0100000305F7 (program security bit) Table 20. Intel-Hex Records Used by In-system Programming 56 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S RECORD TYPE COMMAND/DATA FUNCTION 04 Display Device Data or Blank Check Record type 04 causes the contents of the entire Flash array to be sent out the serial port in a formatted display. This display consists of an address and the contents of 16 bytes starting with that address. No display of the device contents will occur if security bit 2 has been programmed. The dumping of the device data to the serial port is terminated by the reception of any character. General Format of Function 04 :05xxxx04sssseeeeffcc Where: 05 = number of bytes (hex) in record xxxx = required field, but value is a “don’t care” 04 = “Display Device Data or Blank Check” function code ssss = starting address eeee = ending address ff = subfunction 00 = display data 01 = blank check cc = checksum Example: :0500000440004FFF0069 (display 4000H ~ 4FFFH) 05 Miscellaneous Read Functions General Format of Function 05 :02xxxx05ffsscc Where: 02 = number of bytes (hex) in record xxxx = required field, but value is a “don’t care” 05= “Miscellaneous Read” function code ffss = subfunction and selection code 0001 = read copy of the signature byte - device ID (Family code) 0700 = read the software security bits 0703 = read the oscillation information cc = checksum Example: :020000050001F0 (read copy of the signature byte - device id) Table 20. Intel-Hex Records Used by In-system Programming Sep. 2004 Ver 1.01 57 HMS99C51S/52S/54S/56S/58S Command Command Name 00H Program Data 01H End Of File 02H Specify E/W Pulse 03H 04H Data[0] Data[1] Command Effect - - Program Data Byte Bootloader will accept up to 128 data bytes. - - End Of File Data[0] = write times low Data[1] = erase times high Data[2] = erase times low Block index 05H - Program Security Lockbit 07H - Erase User Memory fully(max. 32K bytes) Data[0:1] = start address Data[2:3] = end address Data[4] = 00h(Display) Data[4] = 01h(Blank check) 00H 05H Read Function* Bit 0 : Erase Blk0(0000H~07FFH) ; 2K bytes Bit 1 : Erase Blk1(0800H~0FFFH) ; 2K bytes Bit 2 : Erase Blk2(1000H~17FFH) ; 2K bytes Bit 3 : Erase Blk3(1800H~1FFFH) ; 2K bytes Bit 4 : Erase Blk4(2000H~3FFFH) ; 8K bytes Bit 5 : Erase Blk5(4000H~5FFFH) ; 8K bytes Bit 6 : Erase Blk0(6000H~7FFFH) ; 8K bytes Bit 7 : not used 01H Write function Display function Erase/Write pulse information setup 07H Display Data/Blank Check 01H Read Device id 00H Read Security Information 03H Read Oscillator Information Table 21. ISP Commands Summary 58 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Serial Protocol This application note describes the Serial Protocol used to program the Flash code memory from MagnaChip microcontrollers. Commands sent over the serial line are interpreted by the on-chip bootloader program. This applied for HMS99C51S/52S/54S/56S/58S. This protocol is a serial UART protocol. HMS99C51S/52S/54S/56S/58S HOST Bootloader Serial Protocol FLASH ROM UART Protocol Configuration 1. Physical Layer The UART used to transmit information has the following configuration: • Character: 8-bit data • Parity: none • Stop: 1 bit • Flow control: none • Baudrate: autobaud is performed by the bootloader to compute the baudrate chosen by the host. 2. Frame Description The Serial Protocol is based on the Intel Hex-type records. Intel Hex records consist of ASCII characters used to represent hexadecimal values and are summarized below: Record Mark ‘:’ Reclen Load Offset Record Type Data or Info Checksum 1 Byte 1 Byte 2 Byte 1 Byte n Byte 1 Byte Sep. 2004 Ver 1.01 59 HMS99C51S/52S/54S/56S/58S • Record Mark: Record Mark is the start of frame. This field must contain ‘:’. • Reclen: Reclen specifies the number of bytes of information or data which follows the Record Type field of the record. • Load Offset: Load Offset specifies the 16-bit starting load offset of the data bytes, therefore this field is used only for Data Program Record(see Table 20). • Record Type: Record Type specifies the command type. This field is used to interpret the remaining information within the frame. The encoding for all the current record types is described in Table 20. • Data/Info: Data/Info is a variable length field. It consists of zero or more bytes encoded as pairs of hexadecimal digits. The meaning of data depends on the Record Type. • Checksum: The two’s complement of bytes that result from converting each pair of ASCII hexadecimal digits to one byte of binary, and including the Reclen field to and including the last byte of the Data/Info field. Therefore, the sum of all the ASCII pairs in a record after converting to binary, from the Reclen field to and including the Checksum field, is zero. Note: 1. A data byte is represented by two ASCII characters 2. When the field Load Offset is not used, it should be coded as four ASCII zero characters (‘0’). 60 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Protocol Description 1.Overview An initialization step must be performed after each Reset. After microcontroller reset, the bootloader waits for an autobaud sequence. When the communication is initialized, the protocol depends on the record type requested by the host. 2.Communication Initialization The host initializes the communication by sending a “U” character to help the bootloader to compute the baudrate (autobaud). Host U Init communication If(not received “U”) Else Communication opened Bootloader “U” “U” Performs autobaud and sends back the received byte. Initialization 3.Command Data Stream Protocol All commands are sent using the same flow. Host Sends first character of the frame “:” “:” ...... Sends frame(made of 2 ASCII characters per byte) Echo analysis Bootloader If(not received “:”) Else Sends echo and start reception Gets frame, and sends back echo for each received byte Command Flow Note: All commands sent with the echo mechanism will be represented by: Sep. 2004 Ver 1.01 61 HMS99C51S/52S/54S/56S/58S 3.1 Write / Program Commands This flow is common to the following frames: • Flash Programming Data Frame • EOF or MagnaChip Frame (only Programming MagnaChip Frame) • Erase/Write Timing Frame • Lockbit Programming Data Frame a. Description Host Send Write Command Bootloader Write Command Wait Write Command Y Wait Checksum Error ‘X’ & CR & LF Command Aborted Wait Security Error Checksum error Send checksum error N ‘P’ & CR & LF N No Security Send Security error Y Command Aborted Wait Programming Wait COMMAND_OK ‘.’ & CR & LF Send COMMAND_OK Command Finished Erase/Write Flow b. Example HOST : 01 0010 00 55 9A BOOTLOADER : 01 0010 00 55 9A . CR LF Programming Data (write 55H at address 0010H in the Flash) HOST : 02 0000 03 05 01 F5 BOOTLOADER : 02 0000 03 05 01 F5. CR LF Programming Lockbit function (write Software Security to level 2) 62 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S 3.2 Blank Check Command a. Description Host Send Blank Check Command Bootloader Blank Check Command Wait Blank Check Command Y OR Wait Checksum Error ‘X’ & CR & LF Command Aborted Wait COMMAND_OK Send checksum error Y OR ‘.’ & CR & LF Checksum error N Flash blank Send COMMAND_OK N Command Aborted Wait Address not erased ‘Address’ & CR & LF Send first Address not erased Command Finished Blank Check Flow b. Example HOST : 05 0000 04 0000 7FFF 01 78 BOOTLOADER : 05 0000 04 0000 7FFF 01 78 . CR LF Blank Check ok BOOTLOADER : 05 0000 04 0000 7FFF 01 70 X CR LF CR LF Blank Check with checksum error HOST : 05 0000 04 0000 7FFF 01 70 BOOTLOADER : 05 0000 04 0000 7FFF 01 78 xxxx CR LF Blank Check failure at address xxxx Sep. 2004 Ver 1.01 63 HMS99C51S/52S/54S/56S/58S 3.3 Display Data a. Description Host Send Display Command Bootloader Display Command Wait Display Command Y OR Wait Checksum Error ‘X’ & CR & LF Command Aborted Wait security error ‘.’ & CR & LF N Send checksum error Y OR Checksum error RD_WR_SECURITY N Send security error Command Aborted Read Data N All data read Y Complete Frame N Wait Display Data “Address=” “Reading value” ‘/’ & CR & LF Y OUT Send Display Data All data read Command Finished Display Flow Note: The maximum size of display block is equal to the Flash ROM size. b. Example HOST : 05 0000 04 0000 0020 00 D7 BOOTLOADER : 05 0000 04 0000 0020 00 D7 BOOTLOADER 0000=-----data------ / CR LF (16 data) BOOTLOADER 0010=-----data------ / CR LF (16 data) BOOTLOADER 0020=data CR LF ( 1 data) Display data from address 0000H to 0020H 64 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S 3.4. Read Function This flow is similar for the following frames: • Reading Frame • EOF Frame/ MagnaChip Frame (only reading MagnaChip Frame) a. Description Host Send Read Command Bootloader Read Command Wait Read Command Y OR Wait Checksum Error ‘X’ & CR & LF Command Aborted Wait security error Send checksum error Y OR ‘L’ & CR & LF Checksum error N RD_WR_SECURITY Send security error N Command Aborted Read Value Wait Value of Data ‘Value’ & CR & LF Send Data Read Command Finished Read Flow b. Example HOST : 02 0000 05 00 01 F8 BOOTLOADER : 02 0000 05 00 01 F8 Value . CR LF Read function (read device ID) Sep. 2004 Ver 1.01 65 HMS99C51S/52S/54S/56S/58S ISP METHOD FOR PC(MAGNACHIP WINISP) Getting Started / Installation The following section details the procedure for accomplishing the installation procedure. 1. Connect the serial(RS-232C) cable between a target board and the COM1 serial port of your PC. 2. Configure the COM1 serial port of your PC as following. • Baudrate : 115,200 • Data bit : 8 • Parity : No • Stop bit : 1 • Flow control : No 3. Turn your target B/D power switch ON. Your target B/D must be configured to enter the ISP mode. 4. Run the MagnaChip ISP software. 5. Press the Reset Button in the ISP S/W. If the status windows shows a message as "Connected", all the conditions for ISP are provided. If you press the Reset button again after connected, the status windows will show the message as "Disconnected". Please discard it because the HMS99C51S/52S/54S/56S/58S can not check the reset button after connected successfully. 66 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Basic Information Function Description Load HEX File Load the data from the selected file storage into the memory buffer. Save HEX File Save the current data in your memory buffer to a disk storage by using the Intel HEX format. Erase Erase the data in your target MCU before programming it. Blank Check Verify whether or not a device is in an erased or unprogrammed state. Program This button enables you to place new data from the memory buffer into the target device. Read Read the data in the target MCU into the buffer for examination. The checksum will be displayed on the checksum box. Verify Assures that data in the device matches data in the memory buffer. If your device is secured, a verification error is detected. Lock Secures devices so that their content can no longer be examined or modified. Table 22. ISP Function Description Sep. 2004 Ver 1.01 67 HMS99C51S/52S/54S/56S/58S Function Description Erase Option Select blocks for Erasure. AUTO Blank Check & Program & Verify Auto Lock If selected with check mark, the security locking is performed after erasure. Connect Connect a MCU in your target Board with displaying as “Connected” in the status box. Users have to press this button at least one time to initialize a target MCU for entering the ISP mode. If failed to enter the ISP mode, all the buttons are unavailable. And, after entering successfully, the Connect button will be unavailable. Edit Buffer Modify the data in the selected address in your buffer memory Fill Buffer Fill the selected area with a data. Goto Display the selected page. OSC. ______ MHz Display your target system’s oscillator value with discarding below point. Start ______ Starting address End ______ End address Checksum=8000 Display the checksum(Hexdecimal) after reading the target device. Com Port Select serial port. Baud Rate Select UART baud rate. Select Device Select target device. Page Up Key Display the previous page of your memory buffer. Page Down Key Display the higher page than the current location. Table 22. ISP Function Description 68 Sep. 2004 Ver 1.01 HMS99C51S/52S/54S/56S/58S Hardware Conditions to Enter the ISP Mode The In-System Programming (ISP) is performed without removing the microcontroller from the system. The InSystem Programming(ISP) facility consists of a series of internal hardware resources coupled with internal firmware through the serial port. The In-System Programming (ISP) facility make in-circuit programming in an embedded application possible with a minimum of additional expense in components and circuit board area. The bootloader can be executed by holding PSEN LOW, EA/VPP greater than VIH (such as +5V), and ALE/ PROG HIGH at the falling edge of RESET. The ISP function block uses four pins: TxD, RxD, VSS, and VCC. Only a small connector needs to be available to interface your application to an external circuit in order to use this feature. HMS99C58S RESET RxD / P3.0 VCC(+5V) VCC TxD / P3.1 EA / VPP VCC(+5V) : 1 ALE / PROG VCC(+5V) : 1 PSEN VSS(0V) : 0 XTAL2 XTAL1 VSS ISP Configuration Sep. 2004 Ver 1.01 69