Flash & EEPROM Module NVM

System Memory HCS12 CPU Internal Bus PLL PIT SCI 1 SCI 1 ATD 1 ATD 12K 12K SRAM 256K FLASH EEPROM Internal Bus SPI 2 or PWM CH 4-7 SPI 1 or PWM CH 0-3 SPI 0 BKP INT MMI PWM 8 CHAN HCS12 CPU SIM CM BDM MEBI PLL PIT msCAN 4 or IIC msCAN 3 msCAN 2 msCAN 1 BDLC or msCAN ECT 8 CHAN 4K BYTES EEPROM

FLASH EEPROM • 256K bytes of Flash made of four 64K byte blocks Single supply program and erase. Automated program and erase algorithm. Interrupt on command completion. All four flash blocks can be programmed and erased in parallel. Read-While-Write into different block. Fast sector erase and word program operation. Flexible protection scheme against accidental program or erase. Security feature to prevent intrusive access.

Memory Map & Flash Control $0100 $010F $0000 $0400 $1000 $4000 $8000 $C000 $FF00 $FFFF Registers Flash Control Registers 4K EEPROM $30 - $3F Denotes contents of PPAGE Register Page $3F 12K RAM Page $3E Flash Protect Low Area .5K, 1K, 2K, 4K 16K Flash (Fixed) Page $3E Page $31 Page $30 16Kx16 Flash Pages (Windowed) Flash 0 Protection/Security Fields Address Description $FF00 -$FFF7 Backdoor comparison key $FF08-$FF09 Reserved $FF0A Flash block 3 protection $FF0B Flash block 2 protection $FF0C Flash block 1 protection $FF0D Flash block 0 protection $FF0E Reserved $FF0F Security Byte Page $3F 16K Flash (Fixed) Flash Protect High Area 2K, 4K, 8K, 16K Vectors Flash Protect High Area

Flash Control Registers • All four Flash Blocks Occupy 16 Bytes In The I/O Register Area. Registers Are Divided Into Banked and Unbanked Banked Registers Are Selected With BLKSEL1: BLKSEL0 In FCNFG Unbanked Registers Control State Machine Clock, Security, Interrupts Banked Registers Control Erasure, Programming, Protection Banked Registers Allow Erasure and Programming All Four Blocks in Parallel

Flash Clock Divider Register FLCKDIV - Flash Clock Divider Register Address Offset $0000 FDIVLD — Flash Clock Divider Loaded This bit is set when the FCLKDIV register is written to. An attempt to program or erase the flash without having written to this register previously will result in an access error and the command will not be executed. 1 = Register has been written to since the last reset. 0 = Register has not been written to. PRDIV8 — Enable Prescaler by 8 1 = Enables a prescaler by 8 before feeding into the FCLKDIV divider. 0 = OSCCLK is directly fed into the FCLKDIV divider FDIV[5:0] — Flash Clock Divider The combination of FDIV8 and FDIV[5:0] is used to divide the oscillator clock down to a frequency of 150KHz - 200KHz. This resulting clock, FCLK, is used to drive the program and erase state machines for the flash. For frequencies of OSCCLK > 12.8MHz the Prescaler bit PRDIV8 must be set on. FCLKDIV Settings

Flash Security Memory Security Mechanism Prevents Unauthorized Access To Flash and EEPROM. Prevents Access via BDM or Expanded Bus Unless Flash and EEPROM Are Erased. Security Is Controlled By The Two LSBs of The FSEC Register. These Bits Are Loaded From Flash Location $FF0F. Two Bits of Opposite Polarity Are Used To Prevent Security Mechanism From Being ‘Tricked’. Security Mechanism Can Be Temporarily Disabled, But It Requires Firmware Support In The Target Application. 64-bit Access Key Ensures That Security Mechanism Can Not Be Easily Disabled By A Hacker.

Flash Security Control FSEC - Flash Security Register Address Offset $x001 This register is loaded from flash address $FF0F during the reset sequence, indicated by “F” in the reset row of the register description. KEYEN — Enable backdoor key to security 1 = Backdoor to flash read via BDM or external bus interface is enabled 0 = Backdoor to flash read via BDM or external bus interface is disabled. When KEYEN is set, the user can then bypass the security by: 1. Setting the KEYACC bit in the configuration (FCNFG) register. 2. Writing the correct four 16 bit words to the flash using the backdoor comparison keys addresses. 3. Clear the KEYACC bit. 4. If all four 16bit words match the flash content, the MCU is unsecured by forcing the bits SEC[1:0] to the unsecured state. 5. If any of the four 16bit words does not match the flash content the MCU remains secured and a security violation signal is sent to the CPU. NV[6:2] = Non-Volatile Flags These Non-Volatile Flags are available to the user

Flash Configuration FCNFG - Flash Configuration Register Address Offset $0003 This unbanked register enables the interrupts, gates the security backdoor writes and selects the register bank to be operated on. CBEIE — Command Buffers Empty Interrupt Enable This bit enables the interrupts in case of empty address, data and command buffers. 1 = An interrupt will be requested whenever the CBEIF flag is set 0 = Command Buffers Empty Interrupts disabled CCIE — Command Complete Interrupt Enable This bit enables the interrupts in case of all commands being completed. 1 = An interrupt will be requested whenever the CCIF flag is set 0 = Command Complete Interrupts disabled KEYACC — Enable Security Key Writing 1 = Writes to flash module are interpreted as keys to open the backdoor. 0 = Flash writes are interpreted as the start of a program or erase sequence. BKSEL[1:0]— Register bank select These two bits are used to select which of the four register banks are addressed. The register bank associated with Flash 0 is the default out of reset. 00 = Bank 0 01 = Bank 1 10 = Bank 2 11 = Bank 3

Flash Protection FPROT - Flash Protection Register Address Offset $0004 This register determines whether a whole block or subsections of a block are protected against accidental program or erase. Each flash block can have two protected areas, one starting from relative address $8000 (called lower) towards higher addresses and the other growing downwards from $FFFF (called higher). FPOPEN — Opens the flash block or subsections of it for program or erase. 1 = The flash block or subsections are enabled to program or erase. 0 = The whole flash block is protected. FPHDIS — Flash Protection Higher address range disable This bit determines whether there is a protected area at the higher end of the flash block address map. 1 = Protection disabled 0 = Protection enabled FPHS[1:0] — Flash Protection Higher address size. These bits determine the size of the protected area. FPLDIS — Flash Protection Lower address range disable This bit determines whether there is a protected area at the lower end of the flash block address map. FPLS[1:0] — Flash Protection Lower Address size These 2 bits determine the size of the protected area. Note: “F” indicates that registers are loaded from Flash control area as follows:. $FF0D --> Block 0, $FF0C --> Block 1, $FF0B --> Block 2, $FF0A --> Block 3

Higher Address Range Protection

Lower Address Protection Range

Memory Protection

Flash Status *CBEIF — Command Buffers Empty Interrupt Flag FSTAT - Flash Status Register Address Offset $0005 *CBEIF — Command Buffers Empty Interrupt Flag Indicates that the address, data and command buffers are empty so that a new command sequence can be started. The flag is cleared by writing a “1”. By clearing the flag the command sequence is launched. Writing a “0” aborts a command sequence that has not yet been launched and sets the ACCERR flag. 1 = Buffers are ready to accept a new command. 0 = Buffers are full. *CCIF — Command Complete Interrupt Flag Indicates that there are no more commands pending. 1 = All commands are completed 0 = Command in progress *PVIOL — Protection violation Indicates an attempt was made to program or erase an address in a protected memory area. A subsequent program or erase command cannot be executed while this flag is set. The flag is also cleared by writing a new, valid command after CBEIF is cleared or when CCIF is clear. 1 = A protection violation has occurred. 0 = no failure *BLANK — Blank Verify Flag Indicates that the flash block is fully erased in response to an Erase-Verify command. 1 = Flash block fully erased. 0 = Flash block not fully erased. *These flags are cleared by writing “1” to them.

Access Errors 1. Writing to the flash address space before initializing FCLKDIV. 2. Writing to the flash address space in the range $8000–$BFFF when PPAGE does not select a 16K block in the flash selected by BKSEL[1:0]. 3. Writing to the flash address space $4000–$7FFF or $C000–$FFFF with BKSEL[1:0] not selecting Flash 0. 4. Writing a misaligned word or a byte to the flash address space. 5. Writing to the flash address space while CBEIF is not set. 6. Writing a second aligned word to the flash address space before executing a program or erase command on the previously written word. 7. Writing to any Flash register other than FCMD after writing an aligned word to the flash address space. 8. Writing a second command to the FCMD register before executing the previously written command. 9. Writing a MASS erase command to FCMD while any protection is enabled. See FPROT register description. 10. Writing a SECTOR erase command to FCMD while protection is enabled for that sector. See FPROT register description. 11. Writing to any Flash register other than FSTAT (to clear CBEIF) after writing to the command register. 12. The part enters STOP mode and a program or erase command is in progress. The command is aborted. The flag is cleared by writing a “1”. 1 = Access error has occurred. 0 = Command sequence or command execution successfully completed.

Flash Command ERASE — Erase flash FCMD - Flash Command Buffer Register Address Offset $0006 ERASE — Erase flash Erases a flash sector (512 bytes) or the whole flash depending on the MASS bit. Trying to erase a sector located in a protected area will result in a protection violation indicated by the PVIOL bit in the FSTAT register being set. 1 = Perform a sector erase if MASS=0 or a mass erase if MASS=1. PROG — Word programming Trying to program a word located in a protected area will result in a protection error indicated by PVIOL set. ERVER - Enable Erase Verify Verifies the flash block is fully erased. A successful verification will set the BLANK bit in the FSTAT register. 1 = Perform an erase verify after mass erase. MASS - Enables Mass Erase Perform a mass erase of the selected 64K byte block. This bit works in conjunction with the ERASE bit. If any protection is active on the selected block, mass erase has no effect and the PVIOL bit in the FSTAT register is set. Write at anytime. 1 = Perform a mass erase of the whole block. 0 = Perform sector erase.

Erase Flowchart

Programming Flowchart

EEPROM 4K BYTE

EEPROM Features • 4K Non-Volatile Electrically Erasable programmable memory located @$0000 - $0FFF. Relocateable to any 4K Boundary Organized as 2048 by 16-bit Words to allow for word size Read/Write and Programming Erase Sector 4 bytes (2 words) Three-step MCU instructions sequence to program or erase the EEPROM. Single supply program and erase. Automated program and erase algorithm. Interrupt on command completion. Fast sector erase and word program operation. Flexible protection scheme against accidental program or erase. Programming voltage derived from VDD with internal charge pump Hardware Interlocks

Registers 4K EEPROM MODULE EEPROM ARRAY Command 2K x 16 Bits Interface Write & Erase performed here Command Interface EEPROM ARRAY 2K x 16 Bits Data Reads from here Command Complete Interrupt word0 Registers word1 word2 word3 Command Buffer Empty Interrupt Command Pipeline comm2 addr2 data2 comm1 addr1 data1 word2044 word2045 word2046 Clock Divider word2047 Oscillator Clock Module Clock generated here

High Speed Programming (EECLK = 200KHz) : MC9S12 0.25u EEPROM Info High Speed Programming (EECLK = 200KHz) : Very fast EEPROM Program (word) 46ms EEPROM Sector Erase (2 words) 20ms EEPROM Mass Erase (4Kbytes) 100ms Erase Cycling 100,000 Erase cycles (should always check individual data sheets) Further Reading: AN2204/D: “Fast NVM Programming for the MC9S12DP256”.

EEPROM Register Summary Three Configuration registers Clock Divider Register (ECLKDIV) Prescaler value for the EEPROM sub-system clock. MUST be configured to generate a module clock between 150KHz and 200KHz for program & erase. Configuration Register (ECNFG) Enables EEPROM interrupts Protection Register (EPROT) Controls whether the EEPROM is protected against program & erase. Configures the size of the protected block – all 4K OR 64 to 512 bytes. Loaded from the non-volatile EEPROM Protection Field on Reset. There is a flow chart in the Block User Guide for calculating the clock divider value. It’s a bit complicated because it takes into consideration the oscillator and the bus clocks. Interrupt for ‘command buffer empty’ indicates that the EEPROM pipeline is ready for another command. Interrupt for ‘command complete’ Two ‘working’ registers Command Buffer Register (ECMD) Determines what operation is to be performed on the EEPROM block. Status Register (ESTAT) - Contains EEPROM state machine Control, Status and Interrupt flags

EEPROM Module Clock Prescaler ECLKDIV - EEPROM Clock Divider Register Bit 7 6 5 4 3 2 1 EDIVLD PRDIV8 EDIV[5:0] EDIVLD — Flash Clock Divider Loaded This bit is set when the ECLKDIV register is written to. An attempt to program or erase the EEPROM without having written to this register previously will result in an access error and the command will not be executed. PRDIV8 — Enable Prescaler by 8 A pre-prescaler! Set this bit if oscillator frequency is >12.8MHz. EDIV[5:0] — Flash Clock Divider The combination of PRDIV8 and EDIV[5:0] is used to divide the oscillator clock down to a frequency of 150KHz - 200KHz. This resulting clock, EECLK, is used to drive the program and erase state machines for the EEPROM. Follow the flow chart in the specification to calculate the correct value for each application. FOR CORRECT PROGRAM AND ERASE OPERATION EECLK MUST BE WITHIN SPEC REGARDLESS OF THE SYSTEM FREQUENCY.

EEPROM Command Summary The operation executed by the EEPROM state machine is determined by the value written to the Command Buffer Register (ECMD) Command Value Operation Comments $20 Word Program Program a word. ** (2 bytes, word aligned) $40 Sector Erase Erase an EEPROM sector. (4 bytes, double word aligned) $41 Mass Erase Erase the whole EEPROM. (Only possible when EPDIS and EOPEN bits are set) $05 Erase Verify Verify the EEPROM block is fully erased. A successful verification will set the BLANK bit in the ESTAT register. $60 Sector Modify Erase the EEPROM sector containing the word and then program one word with the new data. By launching a sector modify command and then pipelining a Program command it’s possible to completely update a Sector. other illegal Any other value will generate an Access Error. ** NOTE: locations must only be programmed once following each erase.

EEPROM Configuration ECNFG - EEPROM Configuration Register Address Offset $0003 CBEIE - Command Buffers Empty Interrupt Enable This bit enables the interrupts in case of an empty address, data and command buffers. 1 = An interrupt will be requested whenever the CBEIF flag is set 0 = Command Buffers Empty Interrupts disabled CCIE - Command Complete Interrupt Enable This bit enables the interrupts in case of all commands being completed. 1 = An interrupt will be requested whenever the CCIF flag is set 0 = Command Complete Interrupts disabled

EEPROM Protection EPROT - EEPROM Configuration Register Address Offset $0004 EPOPEN — Opens the EEPROM block or a subsection of it for program or erase. 1 = The EEPROM block or subsections are enabled to program or erase. 0 = The whole EEPROM block is protected. In this case the other bits within the protect register are don’t care. EPDIS — EEPROM Protection disable This bit determines whether there is a protected area at the higher end of the EEPROM block address map. 1 = Protection disabled 0 = Protection enabled EEPROM Protection address size

EEPROM Command ERASE — Erase EEPROM ECMD - EEPROM Command Buffer Register Address Offset $0006 ERASE — Erase EEPROM Erases a EEPROM sector (4 bytes) or the whole EEPROM depending on the MASS bit. Trying to erase a sector located in a protected area will result in a protection violation indicated by the PVIOL bit in the FSTAT register being set. 1 = Perform a sector erase if MASS=0 or a mass erase if MASS=1. PROG — Word programming Trying to program a word located in a protected area will result in a protection error indicated by PVIOL set. ERVER - Enable Erase Verify Verifies the EEPROM block is fully erased. A successful verification will set the BLANK bit in the FSTAT register. 1 = Perform an erase verify after mass erase. MASS - Enables Mass Erase Perform a mass erase of the selected 64K byte block. This bit works in conjunction with the ERASE bit. If any protection is active on the selected block, mass erase has no effect and the PVIOL bit in the FSTAT register is set. Write at anytime. 1 = Perform a mass erase of the whole block. 0 = Perform sector erase.

EEPROM Status *CBEIF — Command Buffers Empty Interrupt Flag ESTAT - EEPROM Status Register Address Offset $0005 *CBEIF — Command Buffers Empty Interrupt Flag Indicates that the address, data and command buffers are empty so that a new command sequence can be started. The flag is cleared by writing a “1”. By clearing the flag the command sequence is launched. Writing a “0” aborts a command sequence that has not yet been launched and sets the ACCERR flag. 1 = Buffers are ready to accept a new command. 0 = Buffers are full. *CCIF — Command Complete Interrupt Flag Indicates that there are no more commands pending. 1 = All commands are completed 0 = Command in progress *PVIOL — Protection violation Indicates an attempt was made to program or erase an address in a protected memory area. A subsequent program or erase command cannot be executed while this flag is set. The flag is also cleared by writing a new, valid command after CBEIF is cleared or when CCIF is clear. 1 = A protection violation has occurred. 0 = no failure *BLANK — Blank Verify Flag Indicates that the EEPROM block is fully erased in response to an Erase-Verify command. 1 = EEPROM block fully erased. 0 = EEPROM block not fully erased. *These flags are cleared by writing “1” to them.

Access Errors 1. Writing to the EEPROM address space before initializing ECLKDIV. 2. Writing a misaligned word or a byte to the EEPROM address space. 3. Writing to the EEPROM address space while CBEIF is not set. 4. Writing a second aligned word to the EEPROM address space before executing a program or erase command on the previously written word. 5. Writing to any EEPROM register other than ECMD after writing an aligned word to the EEPROM address space. 6. Writing a second command to the ECMD register before executing the previously written command. 7. Writing a MASS erase command to ECMD while any protection is enabled. See EPROT register description. 8. Writing a sector erase command to ECMD while protection is enabled for that sector. See EPROT register description. 9. Writing to any EEPROM register other than ESTAT (to clear CBEIF) after writing to the command register. BLANK — Blank Verify Flag Indicates that the EEPROM block is fully erased in response to an Erase- Verify command. The flag is cleared by writing a “1”. 1 = EEPROM block fully erased. 0 = EEPROM block not fully erased.