Features • Protocol – CAN Used as a Physical Layer – 7 ISP CAN Identifiers – Relocatable ISP CAN Identifiers – Autobaud • In-System Programming – Read/Write Flash and EEPROM Memories – Read Device ID – Full-chip Erase – Read/Write Configuration Bytes – Security Setting from ISP Command – Remote Application Start Command • In-Application Programming/Self-Programming – Read/Write Flash and EEPROM Memories – Read Device ID – Block Erase – Read/Write Configuration Bytes – Bootloader Start CAN Microcontrollers T89C51CC01 CAN Bootloader Description This document describes the CAN bootloader functionalities as well as the CAN protocol to efficiently perform operations on the on-chip Flash (EEPROM) memories. Additional information on the T89C51CC01 product can be found in the T89C51CC01 datasheet and the T89C51CC01 Errata sheet available on the Atmel web site, www.atmel.com. The bootloader software package (source code and binary) currently used for production is available from the Atmel web site. Bootloader Revision Purpose of Modifications Date Revisions 1.0.4 and higher First release 02/12/2001 Rev. 4210D–CAN–05/06 1 Functional Description The T89C51CC01 Bootloader facilitates In-System Programming and In-Application Programming. In-System Programming Capability In-System Programming allows the user to program or reprogram a microcontroller onchip Flash memory without removing it from the system and without the need of a preprogrammed application. The CAN bootloader can manage a communication with a host through the CAN network. It can also access and perform requested operations on the on-chip Flash memory. In-Application Programming or SelfProgramming Capability In-Application Programming (IAP) allows the reprogramming of a microcontroller onchip Flash memory without removing it from the system and while the embedded application is running. The CAN bootloader contains some Application Programming Interface routines named API routines allowing IAP by using the user’s firmware. Block Diagram This section describes the different parts of the bootloader. Figure 1 shows the on-chip bootloader and IAP processes. Figure 1. Bootloader Process Description On-chip External Host via the CAN Protocol Communication User Application IAP User Call Management ISP Communication Management Flash Memory Management Flash Memory 2 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader ISP Communication Management The purpose of this process is to manage the communication and its protocol between the on-chip bootloader and an external device (host). The on-chip bootloader implements a CAN protocol (see Section “Protocol”, page 10). This process translates serial communication frames (CAN) into Flash memory accesses (read, write, erase...). User Call Management Several Application Program Interface (API) calls are available to the application program to selectively erase and program Flash pages. All calls are made through a common interface (API calls) included in the bootloader. The purpose of this process is to translate the application request into internal Flash Memory operations. Flash Memory Management This process manages low level accesses to the Flash memory (performs read and write accesses). Bootloader Configuration Configuration and Manufacturer Information The following table lists Configuration and Manufacturer byte information used by the bootloader. This information can be accessed through a set of API or ISP commands. Mnemonic Description Default Value BSB Boot Status Byte FFh SBV Software Boot Vector FCh SSB Software Security Byte FFh EB Extra Byte FFh CANBT1 CAN Bit Timing 1 FFh CANBT2 CAN Bit Timing 2 FFh CANBT3 CAN Bit Timing 3 FFh NNB Node Number Byte FFh CRIS CAN Relocatable Identifier Segment 00h Manufacturer 58h ID1: Family Code D7h ID2: Product Name BBh ID3: Product Revision FFh 3 4210D–CAN–05/06 Mapping and Default Value of Hardware Security Byte The 4 Most Significant Byte (MSB) of the Hardware Byte can be read/written by software (this area is called Fuse bits). The 4 (Least Significant Byte) LSB can only be read by software and written by hardware in parallel mode (with parallel programmer devices). Bit Position Default Value Description 7 X2B U To start in x1 mode 6 BLJB P To map the boot area in code area between F800h-FFFFh 5 Reserved U 4 Reserved U 3 Reserved U 2 LB2 P 1 LB1 U 0 LB0 U Note: Security Mnemonic To lock the chip (see datasheet) 1. U: Unprogram = 1 P: Program = 0 The bootloader has Software Security Byte (SSB) to protect itself from user access or ISP access. The Software Security Byte (SSB) protects from ISP accesses. The command ‘Program Software Security Bit’ can only write a higher priority level. There are three levels of security: • Level 0: NO_SECURITY (FFh) This is the default level. From level 0, one can write level 1 or level 2. • Level 1: WRITE_SECURITY (FEh) In this level it is impossible to write in the Flash memory, BSB and SBV. The Bootloader returns ID_ERROR message. From level 1, one can write only level 2. • Level 2: RD_WR_SECURITY (FCh) Level 2 forbids all read and write accesses to/from the Flash memory. The Bootloader returns ID_ERROR message. Only a full chip erase command can reset the software security bits. 4 Level 0 Level 1 Level 2 Flash/EEPROM Any access allowed Read only access allowed All access not allowed Fuse bit Any access allowed Read only access allowed All access not allowed BSB & SBV & EB Any access allowed Read only access allowed All access not allowed SSB Any access allowed Write level2 allowed Read only access allowed Manufacturer info Read only access allowed Read only access allowed All access not allowed Bootloader info Read only access allowed Read only access allowed All access not allowed Erase block Allowed Not allowed Not allowed Full chip erase Allowed Allowed Allowed Blank check Allowed Allowed Allowed T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Software Boot Vector The Software Boot Vector (SBV) forces the execution of a user bootloader starting at address [SBV]00h in the application area (FM0). The way to start this user bootloader is described in Section “Boot Process”. Figure 2. Software Boot Vector CAN Bootloader User Bootloader FM1 [SBV]00h Application FM0 FLIP Software Program FLIP is a PC software program running under Windows® 9x/2000/XP Windows NT® and LINUX® that supports all Atmel Flash microcontroller and CAN protocol communication media. Several CAN dongles are supported by FLIP (for Windows). This software program is available free of charge from the Atmel web site. 5 4210D–CAN–05/06 In-System Programming ISP allows the user to program or reprogram a microcontroller’s on-chip Flash memory through the CAN network without removing it from the system and without the need of a pre-programmed application. This section describes how to start the CAN bootloader and the higher level protocols over the CAN. Boot Process Hardware Condition The bootloader can be activated in two ways: • Hardware condition • Regular boot process The Hardware conditions (EA = 1, PSEN = 0) during the RESET falling edge force the on-chip bootloader execution. In this way the bootloader can be carried out whatever the user Flash memory content. As PSEN is an output port in normal operating mode (running user application or bootloader code) after reset, it is recommended to release PSEN after falling edge of reset signal. The hardware conditions are sampled at reset signal falling edge, thus they can be released at any time when reset input is low. 6 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Figure 3. Regular Boot Process b it E N B O O T in A U XR 1 R eg is te r is in itia lize d with B LJ B inv erte d Hardware Boot Process RESET Yes H ard wa re C o nd itio n ENBOOT = 1 P C = F 8 00 h F C O N = 0 0h No ENBOO T = 0 P C = 00 00 h Yes B LJ B = 1 No Software Boot Process F C O N = 00 h ENBOO T = 1 P C = F 80 0h FCO N = F0h Y es No S B V < 7F h No Yes S ta rt A p p lica tio n S tart U se r B o o tloa d er S tart B o o tloa de r 7 4210D–CAN–05/06 Physical Layer CAN Controller Initialization The CAN is used to transmit information has the following configuration: • Standard Frame CAN format 2.0A (identifier 11-bit) • Frame: Data Frame • Baud rate: autobaud is performed by the bootloader Two ways are possible to initialize the CAN controller: • Use the software autobaud • Use the user configuration stored in the CANBT1, CANBT2 and CANBT3 The selection between these two solutions is made with EB: • EB = FFh: the autobaud is performed. • EB not equal to FFh: the CANBT1:2:3 are used. CANBT1:3 and EB can be modified by user through a set of API or with ISP commands. The figure below describes the CAN controller flow. Figure 4. CAN Controller Initialization CAN Controller Initialization EB = FFh Yes No Read CANBT1 Value Read CANBT2 Value Read CANBT3 Value Yes CANBTx = FFh x=(1,3) No Configure the CAN Controller CAN Error Yes Set the CAN Controller in Autobaud Mode No Autobaud OK No Yes CAN Macro Initialized 8 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader CAN Autobaud The following table shows the auto baud performance for a point-to-point connection in X1 mode. 8 MHz 11.059 MHz 12 MHz 16 MHz 20 MHz 22.1184 MHz 24 MHz 25 MHz 32 MHz 40 MHz 20K 100K – 125K – – 250K 500K 1M Note: CAN Autobaud Limitation – – – ‘–’ indicates an impossible configuration. The CAN Autobaud implemented in the bootloader is efficient only in point-to-point connection. Because in a point-to-point connection, the transmit CAN message is repeated until a hardware acknowledge is done by the receiver. The bootloader can acknowledge an incoming CAN frame only if a configuration is found. This functionality is not guaranteed on a network with several CAN nodes. 9 4210D–CAN–05/06 Protocol Generic CAN Frame Description Identifier Control Data 11-bit 1 byte 8 bytes max • Identifier: Identifies the frame (or message). Only the standard mode (11-bit) is used. • Control: Contains the DLC information (number of data in Data field) 4-bit. • Data: Data field consists of zero to eight bytes. The interpretation within the frame depends on the Identifier field. The CAN Protocol manages directly using hardware a checksum and an acknowledge. Note: Command Description To describe the ISP CAN Protocol, we use Symbolic name for Identifier, but default values are given. This protocol allows to: • Initiate the communication • Program the Flash or EEPROM Data • Read the Flash or EEPROM Data • Program Configuration Information • Read Configuration and Manufacturer Information • Erase the Flash • Start the application Overview of the protocol is detailed in Appendix-A. Several CAN message identifiers are defined to manage this protocol. Identifier Command Effect Value ID_SELECT_NODE Open/Close a communication with a node [CRIS]0h ID_PROG_START Start a Flash/EEPROM programming [CRIS]1h ID_PROG_DATA Data for Flash/EEPROM programming [CRIS]2h ID_DISPLAY_DATA Display data [CRIS]3h ID_WRITE_COMMAND Write in XAF, or Hardware Byte [CRIS]4h ID_READ_COMMAND Read from XAF or Hardware Byte and special data [CRIS]5h ID_ERROR Error message from bootloader only [CRIS]6h It is possible to allocate a new value for CAN ISP identifiers by writing the byte CRIS with the base value for the group of identifier. The maximum value for CRIS is 7Fh and the default CRIS value is 00h. 10 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Figure 5. Identifier Remapping CAN Identifiers 7FFh CAN ISP Identifiers ID_ERROR ID_READ_COMMAND ID_WRITE_COMMAND ID_DISPLAY_DATA ID_PROG_DATA ID_PROG_START ID_SELECT_NODE Group of 7CAN Messages Used for Managing CAN ISP [CRIS]0h 000h Communication Initialization The communication with a device (CAN node) must be opened prior to initiate any ISP communication. To open communication with the device, the Host sends a “connecting” CAN message (ID_SELECT_NODE) with the node number (NNB) passed in parameter. If the node number passed is equal to FFh then the CAN bootloader accepts the communication (Figure 6). Otherwise the node number passed in parameter must be equal to the local Node Number (Figure 7). Figure 6. First Connection Interface Board between PC NNB = FFh (Default Value) and CAN Network Host Node 1 Figure 7. On Network Connection NNB = 00h Node 0 Interface Board Between PC and CAN Network Host NNB = 01h Node 1 NNB = 03h Node 3 NNB = n Node n 11 4210D–CAN–05/06 Before opening a new communication with another device, the current device communication must be closed with its connecting CAN message (ID_SELECT_NODE). Request From Host Note: Identifier Length Data[0] ID_SELECT_NODE 1 num_node num_node is the NNB (Node Number Byte) to which the Host wants to talk to. Answers From Bootloader Identifier Length Data[0] ID_SELECT_NODE 2 boot_version Note: Data[1] Comment 00h Communication close 01h Communication open Data[0] contains the bootloader version. If the communication is closed then all the others messages won’t be managed by bootloader. ID_SELECT_NODE Flow Description Bootloader Host Send Select Node Message with Node Number in Parameter ID_SELECT_NODE Message Wait Select Node OR node select = FFh node select = local node number Time-out 10 ms state com = com open COMMAND ABORTED State com = com open State com = com closed Read Bootloader Version Wait Select Node ID_SELECT_NODE Message Send Bootloader Version and State of Communication COMMAND FINISHED COMMAND FINISHED Example identifier HOST BOOTLOADER 12 Id_select_node Id_select_node length 01 02 data FF 01 01 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Programming the Flash or EEPROM Data The ID_PROG_START flow described below shows how to program data in the Flash memory or in the EEPROM data memory. This operation can be executed only with a device previously opened in communication. 1. The first step is to indicate which memory area (Flash or EEPROM data) is selected and the range address to program. 2. The second step is to transmit the data. The bootloader programs on a page of 128 bytes basis when it is possible. The host must take care of the following: • The data to program transmitted within a CAN frame are in the same page. • To transmit 8 data bytes in CAN message when it is possible 3. To start the programming operation, the Host sends a “start programming” CAN message (ID_PROG_START) with the area memory selected in data[0], the start address and the end address passed in parameter. Requests from Host Identifier Length ID_PROG_START 5 Data[0] Data[1] Data[2] Data[3] Data[4] 00h address_start address_end 01h Notes: Answers from Bootloader 1. Data[0] chooses the area to program: - 00h: Flash - 01h: EEPROM data 2. Address_start gives the start address of the programming command. 3. Address_end gives the last address of the programming command. The device has two possible answers: • If the chip is protected from program access an “Error” CAN message is sent (see Section “Error Message Description”, page 22). • Otherwise an acknowledge is sent. Identifier Length ID_PROG_START 0 The second step of the programming operation is to send data to program. Request from Host To send data to program, the Host sends a ‘programming data’ CAN message (ID_PROG_DATA) with up to 8 data by message and must wait for the answer of the device before sending the next data to program. Identifier Length Data[0] ... Data[7] ID_PROG_DATA up to 8 x ... x 13 4210D–CAN–05/06 Answers from Bootloader The device has two possible answers: • If the device is ready to receive new data, it sends a “programming data” CAN message (ID_PROG_DATA) with the result Command_new passed in parameter. • If the device has finished the programming, it sends a “programming data” CAN message (ID_PROG_DATA) with the result Command_ok passed in parameter. Identifier Length ID_PROG_DATA 1 Data[0] Description 00h Command OK 01h Command fail 02h Command new data ID_PROG_DATA Flow Description Bootloader Host Send prog_start message with addresses ID_PROG_START Message Wait Prog start OR SSB = Level 0 Wait ERROR COMMAND ABORTED Wait Prog Start Send prog_data message with 8 datas ID_ERROR Message Send ERROR ID_PROG_START Message Send ProgStart ID_PROG_DATA Message Wait Data prog Column Latch Full All bytes received Wait Programming All bytes received OR Wait COMMAND_N ID_PROG_DATA Message Send COMMAND_NEW_DATA ID_PROG_DATA Message Wait COMMAND_OK COMMAND FINISHED 14 Send COMMAND_OK COMMAND FINISHED T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Example Programming Data (write 55h from 0000h to 0008h in the flash) identifier control data HOST BOOTLOADER Id_prog_start Id_prog_start 05 00 00 00 HOST BOOTLOADER HOST BOOTLOADER Id_prog_data Id_prog_data Id_prog_data Id_prog_data 08 01 01 01 55 02 55 00 55 55 55 55 00 00 08 55 55 55 // command_new_data // command_ok Programming Data (write 55h from 0000h to 0008h in the flash)with SSB in write security identifier HOST BOOTLOADER control Id_prog_start Id_error Reading the Flash or EEPROM Data 04 01 data 00 00 00 08 00 // error_security The ID_DISPLAY_DATA flow described below allows the user to read data in the Flash memory or in the EEPROM data memory. A blank check command on the Flash memory is possible with this flow. This operation can be executed only with a device previously opened in communication. To start the reading operation, the Host sends a “Display Data” CAN message (Id_display_data) with the area memory selected, the start address and the end address passed in parameter. The device splits into block of 8 bytes data to transfer to the Host if the number of data to display is greater than 8 data bytes. Requests from Host Identifier Length Data[0] Data[1] Data[2] Data[3] Data[4] 00h ID_DISPLAY_DATA 5 01h address_start address_end 02h Notes: Answers from Bootloader 1. Data[0] selects the area to read and the operation - 00h: Display Flash - 01h: Blank Check on the Flash - 02h: Display EEPROM data 2. The Address_start gives the start address to read. 3. The Address_end gives the last address to read. The device has two possible answers: • If the chip is protected from read access an “Error” CAN message is sent (see Section “Error Message Description”, page 22). • Otherwise: for a display command the device starts to send the data up to 8 by frame to the host. For a blank check command, the device sends a result OK or the first address not erased. 15 4210D–CAN–05/06 Answer to a read command: Identifier Length Data[n] ID_DISPLAY_DATA n x Answer to a blank check command: Identifier Length Data[0] Data[1] Description 0 - - Blank Check OK ID_DISPLAY_DATA 2 Address_start Flow Description Bootloader Host Send Display_data Message with Addresses or Blank Check ID_DISPLAY_DATA Message Wait Display Data OR SSB = Level 2 Wait ERROR ID_ERROR Message Send ERROR COMMAND ABORTED Blank Command Read Data All Data Read nb Max by Frame OR Wait Data Display ID_DISPLAY_DATA Message Send Data Read Verify Memory All Data Read All Data Read COMMAND FINISHED COMMAND FINISHED Blank Check OR Wait COMMAND_OK ID_DISPLAY_DATA Message Send COMMAND_OK COMMAND FINISHED Wait COMMAND_OK ID_DISPLAY_DATA Message Send COMMAND_OK COMMAND FINISHED 16 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader ID_DISPLAY_DATA Example Display Data (from 0000h to 0008h) HOST BOOTLOADER BOOTLOADER identifier control Id_display_data Id_display_data Id_display_data 05 08 01 identifier control Id_display_data Id_display_data 05 00 data 00 55 55 00 55 00 00 08 55 55 55 55 55 55 Blank Check HOST BOOTLOADER Programming Configuration Information data 01 00 00 00 08 // Command ok The ID_WRITE_COMMAND flow described below allows the user to program Configuration Information regarding the bootloader functionality. This operation can be executed only with a device previously opened in communication. The Configuration Information can be divided in two groups: • • Boot Process Configuration: – BSB – SBV – Fuse bits (BLJB and X2 bits) (see Section “Mapping and Default Value of Hardware Security Byte”, page 4) CAN Protocol Configuration: – BTC_1, BTC_2, BTC_3 – SSB – EB – NNB – CRIS Note: The CAN protocol configuration bytes are taken into account only after the next reset. To start the programming operation, the Host sends a “write” CAN message (ID_WRITE_COMMAND) with the area selected, the value passed in parameter. Take care that the Program Fuse bit command programs the 4 Fuse bits at the same time. 17 4210D–CAN–05/06 Requests from Host Identifier Length Data[0] 3 Data[1] Data[2] 00h write value in BSB 01h write value in SBV 05h write value in SSB 06h write value in EB 1Ch 01h Description value write value in BTC_1 ID_WRITE_COMMAND 3 Answers from Bootloader 02h 1Dh write value in BTC_2 1Eh write value in BTC_3 1Fh write value in NNB 20h write value in CRIS 00h value write value in Fuse bits The device has two possible answers: • If the chip is protected from program access an “Error” CAN message is sent (see Section “Error Message Description”, page 22). • Otherwise an acknowledge “Command OK“ is sent. Identifier Length Data[0] Description ID_WRITE_COMMAND 1 00h Command OK ID_WRITE_COMMAND Flow Description Bootloader Host Send Write_Command ID_WRITE_COMMAND Message OR Wait ERROR_SECURITY Wait Write_Command NO_SECURITY ID_ERROR Message Send ERROR_SECURITY COMMAND ABORTED Write Data Wait COMMAND_OK ID_WRITE_COMMAND Message COMMAND FINISHED 18 Send COMMAND_OK COMMAND FINISHED T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Example Write BSB at 88h identifier HOST Id_write_command 03 01 00 BOOTLOADER Id_write_command 01 00 // command_ok Write Fuse bit at Fxh identifier Reading Configuration Information or Manufacturer Information data control 88 data control HOST Id_write_command 02 02 F0 BOOTLOADER Id_write_command 01 00 // command_ok The ID_READ_COMMAND flow described below allows the user to read the configuration or manufacturer information. This operation can be executed only with a device previously opened in communication. To start the reading operation, the Host sends a “Read Command” CAN message (ID_READ_COMMAND) with the information selected passed in data field. Requests from Host Identifier Length 2 Data[0] 00h ID_READ_COMMAND 2 2 01h 02h Data[1] Description 00h Read Bootloader version 01h Read Device ID1 02h Read Device ID2 00h Read BSB 01h Read SBV 05h Read SSB 06h Read EB 1Ch Read BTC_1 1Dh Read BTC_2 1Eh Read BTC_3 1Fh Read NNB 20h Read CRIS 30h Read Manufacturer Code 31h Read Family Code 60h Read Product Name 61h Read Product Revision 00h Read HSB (Fuse bits) 19 4210D–CAN–05/06 Answers from Bootloader The device has two possible answers: • If the chip is protected from read access an “Error” CAN message is sent (see Section “Error Message Description”). • Otherwise: the device answers with a Read Answer CAN message (ID_READ_COMMAND). Identifier Length Data[n] ID_READ_COMMAND 1 value Flow Description Bootloader Host ID_READ_COMMAND Message Send READ_COM Message Wait Read_Com OR RD_WR_SECURITY Wait ERROR_SECURITY ID_ERROR Message Send ERROR_SECURITY COMMAND ABORTED Read Data ID_READ_COMMAND Message Wait Value of Data Send Data Read COMMAND FINISHED COMMAND FINISHED Example Read Bootloader Version identifier control data Id_read_command Id_read_command 02 01 identifier control HOST Id_read_command 02 01 01 BOOTLOADER Id_read_command 01 F5 // SBV = F5h identifier control HOST Id_read_command 01 02 BOOTLOADER Id_read_command 01 F0 HOST BOOTLOADER 00 55 00 // Bootloader version 55h Read SBV data Read Fuse bit 20 data // Fuse bit = F0h T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Erasing the Flash The ID_WRITE_COMMAND flow described below allows the user to erase the Flash memory. This operation can be executed only with a device previously opened in communication. Two modes of Flash erasing are possible: • Full Chip erase • Block erase The Full Chip erase command erases the whole Flash (32 Kbytes) and sets some Configuration Bytes to their default values: • BSB = FFh • SBV = FFh • SSB = FFh (NO_SECURITY) The Block erase command erases only a part of the Flash. Three Blocks are defined in the T89C51CC01: • block0 (from 0000h to 1FFFh) • block1 (from 2000h to 3FFFh) • block2 (from 4000h to 7FFFh) To start t he erasing operation, the Host sends a “write” CA N mes sage (ID_WRITE_COMMAND). Requests from Host Identifier ID_WRITE_COMMAND Answers from Bootloader Length Data[0] 2 Data[1] Description 00h Erase block0 (0K to 8K) 20h Erase block1 (8K to 16K) 40h Erase block2 (16K to 32K) FFh Full chip erase 00h As the Program Configuration Information flows, the erase block command has two possible answers: • If the chip is protected from program access an “Error” CAN message is sent (see Section “Error Message Description”, page 22). • Otherwise an acknowledge is sent. The full chip erase is always executed whatever the Software Security Byte value is. On a full chip erase command an acknowledge “Command OK” is sent. Identifier Length Data[0] Description ID_WRITE_COMMAND 1 00h Command OK 21 4210D–CAN–05/06 Example Full Chip Erase identifier HOST BOOTLOADER Starting the Application control 02 01 Id_write_command Id_write_command data 00 00 FF // command_ok The ID_WRITE_COMMAND flow described below allows to start the application directly from the bootloader upon a specific command reception. This operation can be executed only with a device previously opened in communication. Two options are possible: • Start the application with a reset pulse generation (using watchdog). When the device receives this command, the watchdog is enabled and the bootloader enters a waiting loop until the watchdog resets the device. Take care that if an external reset chip is used, the reset pulse in output may be wrong and in this case the reset sequence is not correctly executed. • Start the application without reset A jump at the address 0000h is used to start the application without reset. To start the ap plication , th e Host sends a “Start Ap plication ” CAN messa ge (ID_WRITE_COMMAND) with the corresponding option passed in parameter. Requests from Host Identifier Length Data[0] Data[1] Data[2] Data[3] 00h - - 2 ID_WRITE_COMMAND Start Application with a reset pulse generation 03h 4 Answer from Bootloader Description 01h Start Application with a jump at “address” address No answer is returned by the device. Example Start application identifier HOST BOOTLOADER Error Message Description 04 data 03 01 00 00 The error message is implemented to report when an action required is not possible. • 22 Id_write_command No answer control At the moment only the security error is implemented and only the device can answer this kind of CAN message (ID_ERROR). Identifier Length Data[0] Description ID_ERROR 1 00h Software Security Error T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader In-Application Programming/Selfprogramming The IAP allows to reprogram a microcontroller on-chip Flash memory without removing it from the system and while the embedded application is running. The user application can call Application Programming Interface (API) routines allowing IAP. These API are executed by the bootloader. To call the corresponding API, the user must use a set of Flash_api routines which can be linked with the application. Example of Flash_api routines are available on the Atmel web site on the software application note: C Flash Drivers for the T89C51CC01CA for Keil Compilers The Flash_api routines on the package work only with the CAN bootloader. The Flash_api routines are listed in Appendix-B. API Call Process The application selects an API by setting the 4 variables available when the Flash_api library is linked to the application. These four variables are located in RAM at fixed address: • api_command: 1Ch • api_value: 1Dh • api_dph: 1Eh • api_dpl: 1Fh All calls are made through a common interface “USER_CALL” at the address FFC0h. The jump at the USER_CALL must be done by LCALL instruction to be able to comeback in the application. Before jump at the USER_CALL, the bit ENBOOT in AUXR1 register must be set. Constraints The interrupts are not disabled by the bootloader. Interrupts must be disabled by user prior to jump to the USER_CALL, then re-enabled when returning. Interrupts must also be disabled before accessing EEPROM data then re-enabled after. The user must take care of hardware watchdog before launching a Flash operation. For more information regarding the Flash writing time see the T89C51CC01 datasheet. 23 4210D–CAN–05/06 API Commands Read/Program Flash and EEPROM Data Memory Several types of APIs are available: • Read/Program Flash and EEPROM data Memory • Read Configuration and Manufacturer Information • Program Configuration Information • Erase Flash • Start bootloader All routines to access EEPROM data are managed directly from the application without using bootloader resources. The bootloader is not used to read the Flash memory. For more details on these routines see the T89C51CC01 datasheet sections “Program/Code Memory” and “EEPROM Data Memory” Two routines are available to program the Flash: – __api_wr_code_byte – __api_wr_code_page • The application program loads the column latches of the Flash then calls the __api_wr_code_byte or __api_wr_code_page see datasheet in section “Program/Code Memory ”. • Parameter Settings API Name api_command api_dph api_dpl api_value 0Dh - - - __api_wr_code_byte __api_wr_code_page • Instruction: LCALL FFC0h. Note: Read Configuration and Manufacturer Information 24 • No special resources are used by the bootloader during this operation. Parameter Settings API Name api_command api_dph api_dpl api_value __api_rd_HSB 08h - 00h return HSB __api_rd_BSB 05h - 00h return BSB __api_rd_SBV 05h - 01h return SBV __api_rd_SSB 05h - 05h return SSB __api_rd_EB 05h - 06h return EB __api_rd_CANBTC1 05h - 1Ch return CANBTC1 __api_rd_CANBTC2 05h - 1Dh return CANBTC2 __api_rd_CANBTC3 05h - 1Eh return CANBTC3 __api_rd_NNB 05h - 1Fh return NNB __api_rd_CRIS 05h - 20h return CRIS __api_rd_manufacturer 05h - 30h return manufacturer id __api_rd_device_id1 05h - 31h return id1 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader API Name api_command api_dph api_dpl api_value __api_rd_device_id2 05h - 60h return id2 __api_rd_device_id3 05h - 61h return id3 __api_rd_bootloader_version 0Eh - 00h return value • Instruction: LCALL FFC0h. • At the complete API execution by the bootloader, the value to read is in the api_value variable. Note: Program Configuration Information • No special resources are used by the bootloader during this operation. Parameter Settings API Name api_command api_dph api_dpl __api_clr_BLJB 07h - - __api_set_BLJB 07h - - __api_clr_X2 07h - - __api_set_X2 07h - - HSB & 7Fh __api_wr_BSB 04h - 00h value to write __api_wr_SBV 04h - 01h value to write __api_wr_SSB 04h - 05h value to write __api_wr_EB 04h - 06h value to write __api_wr_CANBTC1 04h - 1Ch value to write __api_wr_CANBTC2 04h - 1Dh value to write __api_wr_CANBTC3 04h - 1Eh value to write __api_wr_NNB 04h - 1Fh value to write __api_wr_CRIS 04h - 20h value to write • api_value (HSB & BFh) | 40h HSB & BFh (HSB & 7Fh) | 80h Instruction: LCALL FFC0h. Note: 1. See in the T89C51CC01 datasheet the time required for a write operation. 2. No special resources are used by the bootloader during these operations. Erasing the Flash The T89C51CC01 Flash memory is divided in three blocks of 8K Bytes: Block 0: from address 0000h to 1FFFh Block 1: from address 2000h to 3FFFh Block 2: from address 4000h to 7FFFh These three blocks contain 128 pages. • Parameter Settings API Name __api_erase_block0 api_command api_dph api_dpl api_value 00h 00h - - 25 4210D–CAN–05/06 API Name api_command api_dph api_dpl __api_erase_block1 00h 20h - __api_erase_block2 00h 40h - • api_value Instruction: LCALL FFC0h. Note: 1. See the T89C51CC01 datasheet for the time required for a write operation and this time must be multiplied by the number of pages. 2. No special resources are used by the bootloader during these operations. Starting the Bootloader There are two start bootloader routines possible: 1. This routine allows to start at the beginning of the bootloader or after a reset. After calling this routine the regular boot process is performed and the communication must be opened before any action. • No special parameter setting • Set bit ENBOOT in AUXR1 register • Instruction: LJUMP or LCALL at address F800h 2. This routine allows to start the bootloader with the CAN bit configuration of the application and start with the state "communication open". That means the bootloader will return the message “ID_SELECT_NODE” with the field com port open. • 26 No special parameter setting • Set bit ENBOOT in AUXR1 register • Instruction: LJUMP or LCALL at address FF00h T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Appendix-A Table 1. Summary of Frames from Host Identifier Id_select_node (CRIS:0h) Id_prog_start (CRIS:1h) Id_prog_data (CRIS:2h) Length Data[0] Data[1] Data[2] Data[3] Data[4] 1 num node - - - - 00h 5 (CRIS:3h) end_address 01h Init EEPROM programming n 5 data[0:8] 01h Data to program Display Flash Data start_address end_address Blank Check in Flash 02h 2 Open/Close communication Init Flash programming start_address 00h Id_display_data Description Display EEPROM Data 00h - - - Erase block0 (0K to 8K) 20h - - - Erase block1 (8K to 16K) 40h - - - Erase block2 (16K to 32K) FFh - - - Full-chip Erase 00h - - Write value in BSB 01h - - Write value in SBV 05h - - Write value in SSB 06h - - Write value in EB - - Write BTC_1 1Dh - - Write BTC_2 1Eh - - Write BTC_3 1Fh - - Write NNB 20h - - Write CRIS 00h Id_write_command (CRIS:4h) 3 3 01h 02h 2 1Ch value 00h value - - Write value in Fuse (HSB) 00h - - - Start Application with Hardware Reset - Start Application by LJMP address 03h 4 01h address 27 4210D–CAN–05/06 Table 1. Summary of Frames from Host (Continued) Identifier Length 2 Data[0] 00h Id_read_command (CRIS:5h) 2 2 01h 02h Data[1] Data[2] Data[3] Data[4] Description 00h - - - Read Bootloader Version 01h - - - Read Device ID1 02h - - - Read Device ID2 00h - - - Read BSB 01h - - - Read SBV 05h - - - Read SSB 06h - - - Read EB 30h - - - Read Manufacturer Code 31h - - - Read Family Code 60h - - - Read Product Name 61h - - - Read Product Revision 1Ch - - - Read BTC_1 1Dh - - - Read BTC_2 1Eh - - - Read BTC_3 1Fh - - - Read NNB 20h - - - Read CRIS 00h - - - Read HSB Table 2. Summary of Frames from Target (Bootloader) Identifier Id_select_node (CRIS:0h) Id_prog_start (CIRS:1h) Id_prog_data (CRIS:2h) Length Data[0] 2 Boot version 0 1 Data[1] Data[2] Data[3] Data[4] 00h - - - communication close 01h - - - communication open - - - - - Command OK 00h - - - - Command OK 01h - - - - Command fail 02h - - - - Command New Data n Id_display_data (CRIS:3h) 0 2 Id_write_command (CIRS:4h) Id_read_command (CRIS:5h) 28 n data (n = 0 to 8) - - first address not blank 1 00h 1 Value - Description Data read - - - Blank Check OK - - - Blank Check fail - - - Command OK - - - Read Value T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Table 2. Summary of Frames from Target (Bootloader) (Continued) Identifier Id_error (CRIS:6h) Length Data[0] Data[1] Data[2] Data[3] Data[4] Description 1 00h - - - - Software Security Error 29 4210D–CAN–05/06 Appendix-B Table 3. API Summary Function Name Bootloader Execution api_command api_dph api_dpl api_value __api_rd_code_byte no __api_wr_code_byte yes 0Dh - - - __api_wr_code_page yes 0Dh - - - __api_erase block0 yes 00h 00h - - __api_erase block1 yes 00h 20h - - __api_erase block2 yes 00h 40h - - __api_rd_HSB yes 08h - 00h return value __api_clr_BLJB yes 07h - - (HSB & BFh) | 40h __api_set_BLJB yes 07h - - HSB & BFh __api_clr_X2 yes 07h - - (HSB & 7Fh) | 80h __api_set_X2 yes 07h - - HSB & 7Fh __api_rd_BSB yes 05h - 00h return value __api_wr_BSB yes 04h - 00h value __api_rd_SBV yes 05h - 01h return value __api_wr_SBV yes 04h - 01h value __api_erase_SBV yes 04h - 01h FFh __api_rd_SSB yes 05h - 05h return value __api_wr_SSB yes 04h - 05h value __api_rd_EB yes 05h - 06h return value __api_wr_EB yes 04h - 06h value __api_rd_CANBTC1 yes 05h - 1Ch return value __api_wr_CANBTC1 yes 04h - 1Ch value __api_rd_CANBTC2 yes 05h - 1Dh return value __api_wr_CANBTC2 yes 04h - 1Dh value __api_rd_CANBTC3 yes 05h - 1Eh return value __api_wr_CANBTC3 yes 04h - 1Eh value __api_rd_NNB yes 05h - 1Fh return value __api_wr_NNB yes 04h - 1Fh value __api_rd_CRIS yes 05h - 20h return value __api_wr_CRIS yes 04h - 20h value __api_rd_manufacturer yes 05h - 30h return value __api_rd_device_id1 yes 05h - 31h return value 30 T89C51CC01 CAN Bootloader 4210D–CAN–05/06 T89C51CC01 CAN Bootloader Table 3. API Summary (Continued) Bootloader Execution api_command api_dph api_dpl api_value __api_rd_device_id2 yes 05h - 60h return value __api_rd_device_id3 yes 05h - 61h return value __api_rd_bootloader_version yes 0Eh - 00h return value __api_eeprom_busy no - - - - __api_rd_eeprom_byte no - - - - __api_wr_eeprom_byte no - - - - __api_start_bootloader no - - - - __api_start_isp no - - - - Function Name Document Revision History Changes from 4210C 12/03 to 4210D - 05/06 1. Changes to full chip erase command. 31 4210D–CAN–05/06 Atmel Headquarters Atmel Operations Corporate Headquarters Memory 2325 Orchard Parkway San Jose, CA 95131 TEL 1(408) 441-0311 FAX 1(408) 487-2600 Europe Atmel Sarl Route des Arsenaux 41 Case Postale 80 CH-1705 Fribourg Switzerland TEL (41) 26-426-5555 FAX (41) 26-426-5500 Asia Room 1219 Chinachem Golden Plaza 77 Mody Road Tsimhatsui East Kowloon Hong Kong TEL (852) 2721-9778 FAX (852) 2722-1369 Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan TEL (81) 3-3523-3551 FAX (81) 3-3523-7581 2325 Orchard Parkway San Jose, CA 95131 TEL 1(408) 441-0311 FAX 1(408) 436-4314 RF/Automotive Theresienstrasse 2 Postfach 3535 74025 Heilbronn, Germany TEL (49) 71-31-67-0 FAX (49) 71-31-67-2340 Microcontrollers 2325 Orchard Parkway San Jose, CA 95131 TEL 1(408) 441-0311 FAX 1(408) 436-4314 La Chantrerie BP 70602 44306 Nantes Cedex 3, France TEL (33) 2-40-18-18-18 FAX (33) 2-40-18-19-60 ASIC/ASSP/Smart Cards Zone Industrielle 13106 Rousset Cedex, France TEL (33) 4-42-53-60-00 FAX (33) 4-42-53-60-01 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 TEL 1(719) 576-3300 FAX 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Avenue de Rochepleine BP 123 38521 Saint-Egreve Cedex, France TEL (33) 4-76-58-30-00 FAX (33) 4-76-58-34-80 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 TEL 1(719) 576-3300 FAX 1(719) 540-1759 Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland TEL (44) 1355-803-000 FAX (44) 1355-242-743 e-mail [email protected] Web Site http://www.atmel.com © Atmel Corporation 2003. Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company’s standard warranty which is detailed in Atmel’s Terms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life support devices or systems. Atmel Corporation 2003. All rights reserved. Atmel, the Atmel logo, and combinations thereof are registered trademarks of Atmel Corporation or its subsidiaries. Other terms and product names in this document may be the trademarks of others. Windows ® is a registered trademark of Microsoft Corporation. Linux ® is a registered trademark of Linus Torvalds. Printed on recycled paper. 4210D–CAN–05/06 /xM