AN-946: Flash/EE Memory Programming via LIN—Protocol 6 (Rev. C) PDF

AN-946
APPLICATION NOTE
One Technology Way • P.O. Box 9106 • Norwood, MA 02062-9106, U.S.A. • Tel: 781.329.4700 • Fax: 781.461.3113 • www.analog.com
Flash/EE Memory Programming via LIN—Protocol 6
by Aude Richard
INTRODUCTION
RUNNING THE LIN LOADER
A key feature of the ADuC7032, ADuC7033, ADuC7039,
ADuCM330, and ADuCM331 devices is the ability of the devices
to download code to on-chip Flash/EE memory while in-circuit.
This in-circuit code download is performed via the local
interconnect network (LIN) communications bus.
Use only the LIN and power pins to download code. Table 2
shows the parameters needed to enter download.
This application note describes the download protocol implemented on the ADuC7032, ADuC7033, ADuC7039, ADuCM330,
and ADuCM331 devices using Protocol 6 to enable users to
develop their own LIN programming tools either for series
production programming or for application update.
In this application note, host refers to the host machine (microcontroller, DSP, or other machine) attempting to download data
to the ADuC7032, ADuC7033, ADuC7039, ADuCM330, or
ADuCM331. Loader refers specifically to serial download firmware
resident on these devices.
Note that this application note describes Protocol 6 only. Protocol 6
follows the general procedure defined by UDS (ISO/DIS 14229-1.2,
Road Vehicles Unified Diagnostic Services). However, due to
the limited code space available, the services are limited to the
minimum actually required.
Protocol 4 is described in the AN-881 Application Note, Flash/EE
Memory Programming via LIN—Protocol 4.
The protocol is shown on the device branding, on Line 3. A60
refers to a released version of Protocol 6 whereas A40 refers to
Protocol 4.
Table 1. Branding Example for the ADuC7033
Line
Line 1
Line 2
Line 3
Line 4
LFCSP
ADuC7033
BCPZ 8L
A60 date code
Assembly lot number
Table 2. Parameters to Enter Download
Part
ADuC7032
ADuC7033
ADuC7039
ADuCM330
ADuCM331
Download Pin
Name
Level
NTRST
L
NTRST
L
NTRST
L
P0.5
H
P0.5
H
Page 0 Check Code
Key
Address
0x27011970 0x80014
0x27011970 0x80014
0x16400000 0x801FC
0x16400000 0x7FC
0x16400000 0x7FC
Type
CS
CS
CRC
CRC
CRC
To enable a download via LIN, the ADuC7032, ADuC7033,
ADuC7039, ADuCM330, or ADuCM331 device enters loader
mode only if the download pin is at the level shown during reset
and the Page 0 check code at the address shown in Table 2 is neither
the key nor the Page 0 check code of the required type. See Figure 1
for applicable Arm 7 devices and Figure 2 for Cortex-M3 devices.
Typically, the download pin is kept as indicated and entry to
download mode is determined by the check key. The user code
must have a built-in mechanism for corrupting the Page 0 check
key and for resetting the part. This mechanism allows entry to
download mode to reprogram the part. Program the check code
last to enable reentry to download mode even in the event that
the power fails or another error occurs during programming of
the bulk of the program.
The checksum (CS) of Page 0 is simply the sum of all the half words
in Page 0, excluding the two half words of the word at the address
in Table 2. The checksum must also be stored at this address.
The cyclic redundancy check (CRC) is calculated as described in
the data sheet of the relevant devices and is the same as will be
calculated by the device using the flash sign command for Page 0.
The programming sequence can be initiated and controlled by a
diagnosis tester, which is connected to the LIN master and which
can be a controller area network (CAN). To facilitate the routing of
the diagnosis messages from CAN to LIN, the LIN protocol for
programming the module must comply with the LIN Specification
Package (Revision 2.2A, December 31, 2010).
Rev. C | Page 1 of 9
AN-946
Application Note
TABLE OF CONTENTS
Introduction ...................................................................................... 1 Read-by-Identifier .........................................................................6 Running the LIN Loader ................................................................. 1 Erase Routine .................................................................................8 Revision History ............................................................................... 2 Request Download ........................................................................8 Frame Structure ................................................................................ 5 Transfer Data..................................................................................8 Frames Implemented in the On-Chip Loader .............................. 6 Check Routine ...............................................................................9 Assign NAD .................................................................................. 6 ECU Reset ......................................................................................9 REVISION HISTORY
7/15—Rev. B to Rev. C
Changed ADuC703x to ADuC7032, ADuC7033, and
ADuC7039 ...................................................................... Throughout
Changed ADuCM33x to ADuCM330 and
ADuCM331 ............................................................................ Throughout
Changed Running the ADuC703x Loader Section to Running
the LIN Loader Section .................................................................... 1
Changes to Introduction Section, Table 1, and Running the
LIN Loader Section .......................................................................... 1
Added Table 2; Renumbered Sequentially .................................... 1
Changes to Figure 1 .......................................................................... 3
Added Figure 2 .................................................................................. 4
Changed Packet Structure Section to Frame
Structure Section .............................................................................. 5
Changes to Frame Structure Section, Table 3, and Table 4 ......... 5
Changed Commands Implemented in the On-Chip Loader
Section to Frames Implemented in the On-Chip Loader
Section ................................................................................................ 6
Changes to Frames Implemented in the On-Chip Loader
Section, Assign NAD Section, Table 5, Table 6, Read-byIdentifier Section, Table 7, and Table 8 .......................................... 6
Changed Identifier 0x32, Identifier 0x33, and Identifier 0x34
Section to Identifier 0x30 to Identifier 0x34 ..................................7
Changes to Identifier 0x30 to Identifier 0x34 Section ..................7
Changes to Table 9 and Table 10 .....................................................7
Changes to Erase Routine Section, Table 11, Request Download
Section, Table 12, Transfer Data Section, and Table 13 ................8
Deleted Sample LIN Programming Utilities Section....................8
Added Cortex-M3 Devices Only Section.......................................9
Changes to Table 14, Request (Check Routine) Section,
Table 15, ECU Reset Section, and Table 16 ....................................9
4/13—Rev. A to Rev. B
Added ADuCM330/ADuCM331 ..................................... Universal
4/11—Rev. 0 to Rev. A
Changes to Introduction Section ....................................................1
Changes to Request Section .............................................................5
Added Table 4; Renumbered Sequentially .....................................5
5/08—Revision 0: Initial Version
Rev. C | Page 2 of 9
Application Note
AN-946
INITIALIZE ON-CHIP
PERIPHERALS TO
FACTORY CALIBRATED
STATE
SOFTWARE
RESET
N
N
Y
PIN RESET?
Y
NTRST = 1
N
Y
POR RESET?
CHECK CODE
0xFFFFFFFF
N
Y
Y
KEY
0x27011970
N
Y
WDT RESET?
N
Y
CHECKSUM
KERNEL CS
ERROR
Y
N
N
FLAG PAGE 0
ERROR
KICK WDT.
TRY TO SWITCH
OFF WDT.
KICK WDT
RUN USER CODE
LIN RECEIVED?
Y
N
N
1 HOUR
PASSED?
POWER
DOWN
Y
N
Y
USER RESET?
RESET 1 HOUR
TIMER
RESET
COMMAND?
N
Y
Figure 1. Kernel Flowchart—Arm 7 Devices
Rev. C | Page 3 of 9
07126-001
HANDLE LIN
COMMAND
AN-946
Application Note
NO
POWER
DOWN
YES
POR RESET?
PIN RESET?
NO
SOFTWARE
RESET
YES
CLEAR SRAM
TO 0
NO
WDT RESET?
NO
SRAM ECC OK?
YES
INITIALIZE AND
CALIBRATE DEVICE
DRIVE
GPIO3 HIGH
GPIO5 HIGH?
LIN
LIN
ACTIVITY?
LOW
NO
HIGH
RX
PAGE 0 OK?
YES
SWITCH TO
RX/TX PINS
NO
NO
BOOT LOADER
OK?
YES
RUN LIN
PROTOCOL 6
YES
1 HOUR
TIMEOUT?
USER CODE
RUN BOOT LOADER
RUN APPLICATION
FROM 0x00000000
NO
SOFTWARE
RESET?
YES
NO
SOFTWARE
RESET?
YES
NO
SOFTWARE
RESET?
YES
07126-002
NO
Figure 2. Kernel Flowchart—Cortex-M3 Devices
Rev. C | Page 4 of 9
Application Note
AN-946
FRAME STRUCTURE
The LIN communication with the loader must comply with the
following general requirements as per the LIN Diagnostic and
Configuration Specification, Revision 2.0, September 23, 2003:








The kernel must implement a slot for each of the two LIN
diagnostic frames: master request frame and slave response
frame.
The request from the LIN master must comply with the packet
data unit (PDU) format shown in Table 3.
The responses must comply with the PDU format shown in
Table 4.
Only the PCI type, single frame (SF) can be used. First frame
(FF) and consecutive frames (CF) are not supported.
All frames use the classic checksum.
Unrecognized frames are ignored.
Any frame with an error, such as a communication error, is
ignored. Thus, a faulty erase routine frame is ignored. A faulty
request download frame is ignored and, therefore, subsequent
transfer data frames are not recognized and no programming
occurs. Any faulty transfer data frame terminates recognition
of transfer data frames. In fact, any frame with correct NAD
and PCI ≠ 0x05 or SID ≠ 0x36 or a wrong checksum
terminates recognition of transfer data frames.
The addresses shown in the Values column in Table 6
through Table 8 and Table 10 through Table 16 in the
Frames Implemented in the On-Chip Loader section are
hard coded values and are not examples.
Table 3. Frame Identifier 0x3C
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Description
Node address (NAD)
Protocol control information (PCI)
Service identifier (SID)
Data 1
Data 2
Data 3
Data 4
Data 5
Table 4. Frame Identifier 0x3D
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Rev. C | Page 5 of 9
Description
Node address
Protocol control information
Response identifier (RSID = SID + 0x40)
Data 1
Data 2
Data 3
Data 4
Data 5
AN-946
Application Note
FRAMES IMPLEMENTED IN THE ON-CHIP LOADER
Seven request frames, described in this section, are implemented in
Protocol 6.







Assign NAD
Read-by-identifier
Erase routine
Request download
Transfer data
Check routine
ECU reset
Before starting the programming sequence, the diagnosis tester
requests an identification of the LIN slave using the read-byidentifier request to ensure the correct slave type is connected.
Request (Read-by-Identifier)
Four identifiers (Identifier 0x0, Identifier 0x32, Identifier 0x33,
and Identifier 0x34) are supported.
Table 7. Read-By-Identifier Request
Some of the request frames have corresponding response frames as
detailed after each request frame.
ASSIGN NAD
This request assigns a new NAD to the slave so that subsequent
diagnostic requests are directed to this specific slave.
Request (Assign NAD)
The LIN Consortium assigned the supplier ID, 0x003A, to
Analog Devices, Inc.. The function IDs for Protocol 6 are listed in
Table 5.
MSB
0x00
0x00
0x00
0x4D
0x4D
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
LSB
0x32
0x32
0x39
0x30
0x31
Identifier 0x0
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Table 6. Assign NAD Request
Description
Initial NAD
PCI
SID
Analog Devices supplier ID LSB
Analog Devices supplier ID MSB
Function ID LSB
Function ID MSB
New NAD
Values
User value
0x06
0xB2
0x0/0x32/0x33/0x34
0x3A
0x00
See Table 5
See Table 5
Table 8. Identifier 0x0 Data Frame Response
To guard against the loss of a slave as a result of network
corruption, the slave always recognizes an Assign NAD frame
with the broadcast NAD 0x7F. This recognition occurs regardless
of what the actual NAD of the slave is when this Assign NAD
frame is transmitted. The kernel then makes the decision whether
or not the frame is intended for this slave by checking the supplier
ID and function ID. Function ID 0x32 is used as an example
within this document.
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Description
NAD
PCI
SID
Identifier
AD supplier ID LSB
AD supplier ID MSB
Function ID LSB
Function ID MSB
The read-by-identifier request with Identifier 0x0 returns the LIN
product identification information. This information consists of
the 8-byte data frame response shown in Table 8.
Table 5. Function IDs
Device
ADuC7032
ADuC7033
ADuC7039
ADuCM330
ADuCM331
READ-BY-IDENTIFIER
Values
0x7F
0x06
0xB0
0x3A
0x00
See Table 5
See Table 5
User value
Response (Assign NAD)
The slave does not respond to this request.
Rev. C | Page 6 of 9
Description
NAD
PCI
RSID
AD Supplier ID LSB
AD Supplier ID MSB
Function ID LSB
Function ID MSB
Variant
Values
User value
0x06
0xF2
0x3A
0x00
See Table 5
See Table 5
0x00
Application Note
AN-946
Identifier 0x30 to Identifier 0x34
Response (Read-by-Identifier)
The response to these identifiers return user configured data from
device memory. The loader expects the contents of the data bytes to
be located in the last page of the Flash/EE memory as shown in
Table 9.
Positive response of the LIN slave is shown in Table 10.
Table 9. Flash Locations Allocated to Other Identifiers
Address
Base + 0xE3
Base + 0xE4
Base + 0xE5
Base + 0xE6
Base + 0xE7
Base + 0xE8
Base + 0xE9
Base + 0xEA
Base + 0xFB
Base + 0xFC
Base + 0xED
Base + 0xEE
Base + 0xEF
Base + 0xF0
Base + 0xF1
Base + 0xF2
Base + 0xF3
Base + 0xF4
Base + 0xF5
Base + 0xF6
Base + 0xF7
Base + 0xF8
Base + 0xF9
Base + 0xFA
Base + 0xFB
ID
0x30
0x30
0x30
0x30
0x30
0x31
0x31
0x31
0x31
0x31
0x32
0x32
0x32
0x32
0x32
0x33
0x33
0x33
0x33
0x33
0x34
0x34
0x34
0x34
0x34
Byte
Data 1
Data 2
Data 3
Data 4
Data 5
Data 1
Data 2
Data 3
Data 4
Data 5
Data 1
Data 2
Data 3
Data 4
Data 5
Data 1
Data 2
Data 3
Data 4
Data 5
Data 1
Data 2
Data 3
Data 4
Data 5
Contents
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
User value
Table 10. Read-by-Identifier Slave Response
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
The slave does not give a negative response.
Note the following:




Description
NAD
PCI
RSID
Data 1
Data 2
Data 3
Data 4
Data 5
The last four bytes of the last page of the Flash/EE memory
are reserved for the checksum.
The ADuC7032, ADuC7033, and ADuC7039 have the base
Address 0x97700 and only Identifier 0x32 to Identifier 0x34
can be used.
The ADuCM330 has the base Address 0x17F00 and only
Identifier 0x30 to Identifier 0x32 can be used.
The ADuCM331 has the base Address 0x1FF00 and only
Identifier 0x30 to Identifier 0x32 can be used.
Rev. C | Page 7 of 9
Values
User value
0x06
0xF2
User value
User value
User value
User value
User value
AN-946
Application Note
ERASE ROUTINE
REQUEST DOWNLOAD
Overview
Refer to the Overview section.
It is possible to erase several pages at once and to request the
download and transfer of update data for several subsequent pages.
Which update strategy is chosen depends only on the diagnosis
tester. However, because 1 in 1000 LIN frames can be expected
to show a transmission error, repeating the erase, programming,
and verification cycle independently for each single page is
recommended. The following three constraints must be taken
into account:
Request (Request Download)




It is not possible to program a memory area smaller than
one Flash page of the slave.
Special consideration must be given to Page 0 programming.
It must initially be left with Check Code 0xFFFFFFFF.
In addition to the verification of the single Flash/EE memory
pages, a verification of the checksum of the entire user
Flash/EE memory area is recommended before assuming
the code is correctly downloaded.
After the last page is verified, Page 0 must be reprogrammed
(without erasing), except this time the desired check code
must be included.
Table 12. Request Download Request
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Description
NAD
PCI
SID
Index of start page, LSB P
Index of start page, MSB P
Number of pages to be programmed, N
Unused
Unused
Values
User value
0x04
0x34
User value
User value
User value
0xFF
0xFF
The request download request defines the memory area to be
programmed. The subsequent data, transmitted via the transfer
data frames, is written to N number of pages, starting with Page
P. Note that programming always starts at a page boundary and
partial programming of pages is not advised.
Response (Request Download)
The slave does not respond to this request.
Request (Erase Routine)
TRANSFER DATA
The erase routine erases the contents of N number of Flash pages,
starting with Page P. The value N = 0 is reserved for future use.
These requests are acted on only when following a request
download request.
Table 11. Erase Routine Request
Request (Transfer Data)
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Description
NAD
PCI
SID
Subfunction ID, first byte
Subfunction ID, second byte
Index of start page, LSB P
Index of start page, MSB P
Number of pages to be erased, N
Values
User value
0x06
0x31
0xFF
0x00
User value
User value
User value
Index, in Byte 6 and Byte 7, is the page start address right shifted
to allow the page size. For example, for the ADuC7032, the start
address of Page 2 in Flash/EE memory is 0x80400. This number
right shifted by nine bits (for 0x200 bytes per page) is 0x0402.
This is represented as Byte 6 = 0x02 and Byte 7 = 0x04.
Response (Erase Routine)
The slave does not respond to this request.
The transfer data frames transmit Flash data. The slave expects
N × bytes per page of data, where N is the number of pages as
defined by the request download request. Only full 4-byte words
are allowed. With LIN scheduled at 10 ms per frame, it takes
approximately 512/4 × 10 ms = 1.28 sec to flash a single 512-byte
page.
Table 13. Data Transfer Request
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Description
NAD
PCI
SID
Data 1
Data 2
Data 3
Data 4
Unused
Response (Transfer Data)
The slave does not respond to this request.
Rev. C | Page 8 of 9
Values
User value
0x05
0x36
User value
User value
User value
User value
0xFF
Application Note
AN-946
CHECK ROUTINE
Response (Check Routine)
Request (Check Routine)
Table 15. Check Routine Response
The check routine calculates the checksum for the memory area
starting with Page P and ending with Page P + N − 1. The response,
with N = 0, is undefined. Run this check for each single page,
and also after all programming is done because errors in the
erase or download could affect pages other than the intended
pages.
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
The diagnosis tester compares the checksum received from the
LIN slave with a reference checksum provided in the Flash data
container. If the checksums differ, the programming procedure
is repeated. The checksum is the sum over all 16-bit values from
the first 16-bit half word of Page P to the last 16-bit half word of
Page P + N − 1. Checksum = (Σ 16-bit words) Modulo 32.
After the check routine request is received, the slave requires
about 1 μs per byte to calculate the checksum. Do not initiate
the response frame before sufficient time to complete the check
has elapsed. This is only relevant to multipage checks because
single page checks are always fast enough.
Analog Devices assumes an error model in which not all the half
words or bits in the checked area are programmed as required.
Such a page always shows fewer zeros and gives a higher checksum.
Alternatively, programming an unerased page consistently gives
more zeros and a lower checksum. The third possibility is single
incorrect half words or bits. The probability for detecting such
errors is the same whether one uses a cyclic redundancy check
(CRC) or the simple checksum.
Cortex-M3 Devices Only
If, in addition to the index of Start Page P, the MSB (bit 7 of byte 7)
is set, the chip calculates the CRC of the requested block instead
of the CS. This allows two methods of checking the downloaded
code for even more confidence that the download is correct.
Table 14. Check Routine Request
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Description
NAD
PCI
SID
Subfunction ID, first byte
Subfunction ID, second byte
Index of start page, LSB P
Index of start page, MSB P
Number of pages, N
Description
NAD
PCI
RSID
Checksum LSB
Checksum, second byte
Checksum, third byte
Checksum, MSB
Unused
Values
User value
0x05
0x71
User value
User value
User value
User value
0xFF
ECU RESET
Request (ECU Reset)
Table 16. ECU Reset Request
Byte
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Byte 8
Description
NAD
PCI
SID
Subfunction ID
Unused
Unused
Unused
Unused
Values
User value
0x02
0x11
0x01
0xFF
0xFF
0xFF
0xFF
The ECU reset performs a reset of the slave. The ADuC7032,
ADuC7033, ADuC7039, ADuCM330, or ADuCM331 device
restarts as shown in Figure 1. If the value check code is valid,
this results in the execution of the application software.
Response (ECU Reset)
The slave does not respond to this request.
Values
User value
0x06
0x31
0xFF
0x01
User value
User value
User value
©2008–2015 Analog Devices, Inc. All rights reserved. Trademarks and
registered trademarks are the property of their respective owners.
AN07126-0-7/15(C)
Rev. C | Page 9 of 9