SC9S12XF512J0VLMR

MC9S12XF512_1 FREESCALE | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 1306

Technical content

freescale.com MC9S12XF512 Reference Manual Covers MC9S12XF512 MC9S12XF384 MC9S12XF256 MC9S12XF128 MC9S12XF512V1RM Rev.1.19 18-May-2010

MC9S12XF - Family Reference Manual, Rev.1.19

2 Freescale Semiconductor

To provide the most up-to-date information, the revision of our documents on the World Wide Web will be the most current. Your printed copy may be an earlier revision. To verify you have the latest information available, refer to: http://freescale.com/ A full list of family members and options is included in the appendices. The following revision history table summarizes changes contained in this document. This document contains information for all constituent modules, with the exception of the S12 CPU. For S12 CPU information please refer to the CPU S12 Reference Manual.

Revision History

06-Dec-2007 1.12 Updated memory map description for family parts (1.1.4 MC9S12XF512 - Address Mapping) Updated derivative differences w.r.t. DFlash size (D.1 Memory Sizes and Package Options S12XF - Family) 12-Dec-2007 1.13 Add FTM BG (384K2/256K2) 08-Jan-2008 1.14 Remove table for Module Run Supply Currents (A-10) Remove 3.3V columns in Table A-27, 3.0V columns in Table A-28 Add FTM BG (128K2) 15-Jan-2008 1.15 Fixed typo in detailed register map (SPI1/SPI1DRH) Import updated BGs VREG, ECT, INT, DBG Fixed typo in Table 1-6 05-Mar-2008 1.16 Updated ordering info for 112 LQFP 02-Oct-2008 1.17 Updated NVM timing parameter section for brownout case Specified time delay from RESET to start of CPU code execution Added NVM patch Part IDs Enhanced ECT GPIO / timer function transitioning description CRG section updated 01-Mar-2010 1.18 Updated PIM,FTM,XGATE,MSCAN,DBG,BDM,ADC,CRG sections Corrected startup from reset min cycle count 18-May-2010 1.19 Updated ECT section (see ECT revision history table) Freescale™ and the Freescale logo are trademarks of Freescale Semiconductor, Inc. This product incorporates SuperFlash® technology licensed from SST. © Freescale Semiconductor, Inc., 2008,2009,2010. All rights reserved.

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 3 Chapter 11 Memory Mapping Control (S12XMMCV4) WITH FLEXRAY. .403 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) .901 Chapter 22 Enhanced Programmable Interrupt Timer (S12XEPIT24B8CV1) 1013

MC9S12XF - Family Reference Manual, Rev.1.19

4 Freescale Semiconductor

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 5 Chapter 1 MC9S12XF-Family Reference Manual Chapter 2 S12XE Clocks and Reset Generator (S12XECRG)

MC9S12XF - Family Reference Manual, Rev.1.19

6 Freescale Semiconductor

Voltage Regulator (S12VREGL3V3V1) 3.2.7 V

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 7 Chapter 4

384 KByte Flash Module (S12XFTM384K2V1)

Pierce Oscillator (S12OSCLCPV2) Chapter 6 Security (S12XFSECV2)

MC9S12XF - Family Reference Manual, Rev.1.19

8 Freescale Semiconductor

Chapter 7Interrupt (S12XINTV2) Chapter 8

256 KByte Flash Module (S12XFTM256K2XFV1)

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 9 Chapter 9

512 KByte Flash Module (S12XFTM512K3V1)

128 KByte Flash Module (S12XFTM128K2XFV1)

MC9S12XF - Family Reference Manual, Rev.1.19

10 Freescale Semiconductor

Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 11 Chapter 13FlexRay Communication Controller (FLEXRAY)

MC9S12XF - Family Reference Manual, Rev.1.19

12 Freescale Semiconductor

XGATE (S12XGATEV3) Chapter 15 Background Debug Module (S12XBDMV2)

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 13 Chapter 16 S12X Debug (S12XDBGV3) Module Chapter 17 Memory Protection Unit (S12XMPUV2)

MC9S12XF - Family Reference Manual, Rev.1.19

14 Freescale Semiconductor

External Bus Interface (S12XEBIV4) Chapter 19 Port Integration Module (S12XFPIMV2)

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 15

MC9S12XF - Family Reference Manual, Rev.1.19

16 Freescale Semiconductor

Pulse Width Modulator with Fault Protection (PMF15B6C) Module

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 17 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2)

MC9S12XF - Family Reference Manual, Rev.1.19

18 Freescale Semiconductor

Enhanced Programmable Interrupt Timer (S12XEPIT24B8CV1) Chapter 23 Serial Communication Interface (S12SCIV5)

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 19 Chapter 24 Analog-to-Digital Converter (ADC12B16C) Block Description Chapter 25 Serial Peripheral Interface (S12SPIV5) 25.2.3

MC9S12XF - Family Reference Manual, Rev.1.19

20 Freescale Semiconductor

Enhanced Capture Timer (ECT16B8CV3) Appendix A

Electrical Characteristics

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 21 Appendix B Package Physical Dimension Information. Appendix C PCB Layout Guidelines Appendix D Derivative Differences Appendix E Detailed Register Address Map Appendix F

Ordering Information

MC9S12XF - Family Reference Manual, Rev.1.19

22 Freescale Semiconductor

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 23 Chapter 1 MC9S12XF-Family Reference Manual

1.1 Introduction

Targeted at actuators, sensors and other distributed nodes in the FlexRay network for Chassis and Body Electronics, the MC9S12XF-Family delivers 32-bit performance with all the advantages and efficiencies of a 16-bit MCU. The design goal was to retain the low cost, power consumption, EMC and code-size efficiency advantages currently enjoyed by users of Freescale Semiconductor's other 16-bit MC9S12 MCU families. Based around an enhanced S12X core, the MC9S12XF-Family runs 16-bit wide accesses without wait states for all peripherals and memories. The MC9S12XF-Family also features a new flexible interrupt handler, which allows multilevel nested interrupts. The MC9S12XF-Family features the performance boosting enhanced XGATE co-processor. The XGATE is programmable in “C” language and runs at twice the bus frequency of the S12. It’s instruction set is optimized for data movement, logic and bit manipulation instructions. Any peripheral module can be serviced by the XGATE. The MC9S12XF-Family features a Memory Protection Unit (MPU). The MC9S12XF-Family features a FlexRay module for high speed serial communication supporting various bit rates up to 10 Mbit/s. The FlexRay internal clock can be generated from crystals ranging from 4MHz to 40MHz 1. The 64-pin LQFP allows interfacing to a single FlexRay channel. The 64-pin LQFP (10mm x 10mm) is intended for those applications challenged by the size constraint of some satellite FlexRay modules. The 112-pin LQFP offers an increase in the number of I/Os as well as 16 A/D channels. In addition to that the 144-pin LQFP provides a full 16-bit wide non-multiplexed external bus interface with the pins usable as general purpose I/O in single-chip modes. The MC9S12XF-Family features the MSCAN module with a FIFO receiver buffer arrangement, and input filters optimized for Gateway applications handling numerous message identifiers. The MC9S12XF-Family provides Flash memory sizes from 128K to 512K plus Data Flash and enhanced EEPROM functionality (EE-Emulation) with built in Error Correcting Code (ECC). The memory uses Freescale Semiconductor's industry-leading, full automotive qualified SG-Flash. The inclusion of a frequency modulated PLL circuit allows power consumption and performance to be adjusted to suit operational requirements and allows optimization of the radiated emissions (EMC). The ATD now offers 12 Bit resolution at a faster conversion rate down to 3 µs per channel. The MC9S12XF512 is available in 144-Pin LQFP, 112-Pin LQFP and 64-Pin LQFP package. 1. 8MHz - 16MHz recommended for low jitter

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

24 Freescale Semiconductor

The 144-Pin LQFP version will not be qualified for production and is intended to be used for emulation (development tools) only. See Table 1-9 for information about port and peripheral availability by package option.

1.1.1 Features

Features of the MC9S12XF-Family are listed here. Please seeTable 1-1 for memory options and Table 1- 2 for the peripheral features that are available on the different family members. The system includes these distinctive features:

• 16-Bit CPU12X — Upward compatible with MC9S12 instruction set with the exception of five Fuzzy instructions (MEM, W A V , W A VR, REV , REVW) which have been removed. — Enhanced indexed addressing — Additional (superset) instructions to improve 32-bit calculations and semaphore handling — Access large data segments independent of PPAGE
• Enhanced Interrupt Module — Eight levels of nested interrupts — Flexible assignment of interrupt sources to each interrupt level — One non-maskable high priority interrupt (XIRQ) — Wake-up Interrupt Inputs
• Memory Protection Unit (MPU) — 4 address regions definable per active program task — Address range granularity as low as 256-bytes — Protection Attributes – No write – No execute — Non-maskable interrupt on access violation
• XGATE — Programmable, high performance I/O coprocessor module – up to 100 MIPS RISC performance — Transfers data to or from all peripherals and RAM without CPU intervention or CPU wait states — Performs logical, shifts, arithmetic, and bit operations on data — Can interrupt the HCS12X CPU signalling transfer completion — Triggers from any hardware module as well as from the CPU possible — Two interrupt levels to service high priority tasks — Enables Full CAN capability when used in conjunction with MSCAN module

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 25 — Full LIN master or slave capability when used in conjunction with the integrated LIN SCI module

• System Integrity Support — Power-on reset (POR) — Illegal address detection with reset — Low-voltage detection with interrupt or reset — Computer Operating Properly (COP) watchdog – Configurable as window COP for enhanced failure detection – Can be initialized out of reset using option bits located in Flash — Clock monitor supervising the correct function of the oscillator
• Memory Options — 128K, 256k, 384K and 512K byte Flash — 2K, 4K byte Emulated EEPROM — 16K, 20K, 24K and 32K Byte RAM — Program Flash General Features – 64 data bits plus 8 syndrome ECC (Error Correction Code) bits allow single bit fault correction and double fault detection – Erase sector size 1024 bytes – Automated program and erase algorithm – Security option to prevent unauthorized access – Sense-amp margin level setting for reads — Data Flash General Features – Up to 32K bytes of D-Flash memory with 256-byte sectors for user access. – Dedicated commands to access D-Flash memory over EEE operation – Single bit fault correction and double fault detection within a word during read operations – Automated program and erase algorithm with verify and generation of ECC parity bits – Fast sector erase and word program operation – Ability to program up to four words in a burst sequence — Emulated EEPROM General Features – Automatic EEE file handling using internal Memory Controller – Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset – Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory – Ability to disable EEE operation and allow priority access to the D-Flash memory – Ability to cancel all pending EEE operations to allow priority access to the D-Flash memory
• Oscillator (OSC_LCP) — Loop Control Pierce oscillator utilizing a 4MHz to 16MHz crystal — Good noise immunity

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

26 Freescale Semiconductor

— Full-swing Pierce option utilizing a 2MHz to 40MHz crystal — Transconductance sized for optimum start-up margin for typical crystals

• Clock and Reset Generator (CRG) — Phase-locked-loop (IPLL) clock frequency multiplier — Internally filtered. No external components required — Configurable option to spread spectrum for reduced EMC radiation (frequency modulation) — Fast wake up from STOP in self clock mode for power saving and immediate program execution
• Non-Multiplexed External Bus (144 Pin package only) — 16 data bits wide — Support for external W AIT input or internal wait cycles to adapt MCU speed to peripheral speed requirements — Up to four chip select outputs to select 16K, 768K, 2M and 4MByte address spaces — Supports glue less interface to popular asynchronous RAMs and Flash devices — External address space 4MByte for Data and Program space
• FlexRay Module (FR) — FlexRay protocol implementation according to FlexRay V2.1 Protocol Implementation document — Optimized programmers model to fit small address footprint — Supports Data Rates of 2.5, 5, 8 and 10MBit/s — The FlexRay clock can be derived from crystals ranging from 4MHz to 40MHz for cost and EMC optimization — FlexRay clocking independent from the CPU and XGATE bus frequency. Clock is generated by a “dedicated” IPLL. — Up to two channels for fault tolerant systems (see Table 1-2 Peripheral Feature Summary of MC9S12XF-Family Members) — Single channel operation on channel A, configurable to run FlexRay channel A or channel B protocol — 32 configurable message buffers — Message buffers can be configured as Receive, single buffered Transmit or double buffered Transmit message buffer — Message buffer header, status and payload data stored in System RAM — 2 independent message buffer segments — Size of message buffer payload data section configurable from 0 up to 254 bytes — 2 independent receive FIFOs, 1 per channel — Six separate interrupt channels for Receive, receive FIFO channel A, receive FIFO channel B, Transmit, Error and Wake-up — Internal signals can be routed to I/O pins to ease debugging
• Analog-to-Digital Converter (ATD)

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 27 — 8/10/12 Bit resolution — Multiplexer for 16 analog input channels —3 µs, 12-bit single conversion time — Left or right justified result data — External and internal conversion trigger capability — Internal oscillator for conversion in Stop Modes — Wake-up from low power modes on analog comparison > or <= match

• Enhanced Capture Timer (ECT) — 8 x 16-bit channels for input capture or output compare — 16-bit free-running counter with 8-bit precision prescaler — 16-bit modulus down counter with 8-bit precision prescaler — 4 x 8-bit or 2 x 16-bit pulse accumulators — Four channels have enhanced input capture capabilities: – Delay counter for noise immunity – 16-bit capture buffer – 8-bit pulse accumulator buffer
• Enhanced Periodic Interrupt Timer (EPIT) — Up to 8 timers with independent time-out periods — Time-out periods selectable between 1 and 224 bus clock cycles — Time-out interrupt and peripheral triggers
• Real Time Interrupt (RTI) — Real Time Interrupt for task scheduling purposes or cyclic wake-up — Can be active in Pseudo Stop mode for low power precision timing tasks
• Asynchronous Periodic Interrupt (API) — Available in all modes including Full Stop mode — Trimmable to +-5% accuracy — Time-out periods range from 0.2ms to ~13s with a 0.2ms resolution
• Pulse Width Modulator with Fault detection (PMF) — Six channel Pulse width Modulator with Fault protection (PMF) optimized for electrical motor control — Three independent 15-bit counters with synchronous mode — Complementary channel operation — Edge and center aligned PWM signals — Programmable dead time insertion — Integral reload rates from 1 to 16 — Up to four fault protection shut down input pins depending on the package option — Up to three current sense input pins depending on the package option (see Table 1-9 Port and Peripheral Availability by Package Option)

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

28 Freescale Semiconductor

• Multi-scalable Controller Area Networks (MSCAN) — CAN 2.0 A, B software compatible – Standard and extended data frames – 0 - 8 bytes data length – Programmable bit rate up to 1 Mbps — Five receive buffers with FIFO storage scheme — Three transmit buffers with internal prioritization — Flexible identifier acceptance filter programmable as: – 2 x 32-bit – 4 x 16-bit – 8 x 8-bit — Wake-up with integrated low pass filter option — Loop back for self test — Listen-only mode to monitor CAN bus — Bus-off recovery by software intervention or automatically — 16-bit time stamp of transmitted/received messages
• Serial Peripheral Interface (SPI) — Up to two SPI modules (see Table 1-2 Peripheral Feature Summary of MC9S12XF-Family Members) — Configurable 8 or 16-bit data size — Full-duplex or single-wire bidirectional — Double-buffered transmit and receive — Master or Slave mode — MSB-first or LSB-first shifting — Serial clock phase and polarity options
• Serial Communication Interfaces (SCI) — Up to two SCI modules (see Table 1-2 Peripheral Feature Summary of MC9S12XF-Family Members) — Full-duplex or single wire operation — Standard mark/space non-return-to-zero (NRZ) format — Selectable IrDA 1.4 return-to-zero-inverted (RZI) format with programmable pulse widths — 13-bit baud rate selection — Programmable character length — Programmable polarity for transmitter and receiver — Receive wakeup on active edge — Break detect and transmit collision detect supporting LIN
• Background Debug Module (BDM) — Background debug controller (BDM) with single-wire interface

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 29 – Non-intrusive memory access commands – Supports in-circuit programming of on-chip non-volatile memory – Supports security

• Debugger (DBG) — Four comparators A, B, C and D – Each can monitor CPU or XGATE busses – A and C compares 23-bit address bus and 16-bit data bus with mask register – B and D compares 23-bit address bus only – Three modes: simple address/data match, inside address range or outside address range — 64 x 64-bit circular trace buffer to capture change-of-flow addresses or address and data of every access — Tag-type or force-type hardware breakpoint requests
• Input/Output — up to 110 general-purpose input/output (I/O) pins depending on the package option and 2 input- only pins — Hysteresis and configurable pull up/pull down device on all input pins — Configurable drive strength on all output pins
• Package Options — 144-pin low-profile quad flat-pack (LQFP) — 112-pin low-profile quad flat-pack (LQFP) — 64-pin low-profile quad flat-pack (LQFP)
• On-Chip V oltage Regulator — Three parallel, linear voltage regulators with bandgap reference providing VDDPLL, 1.8V logic and 2.8V Flash supply — Low-voltage detect (LVD) with low-voltage interrupt (LVI) — Power-on reset (POR) circuit — 3.3V and 5V range operation — Low-voltage reset (LVR)
• Operating Conditions — Ambient temperature range –40 C to 85 C — Temperature Options: – –40 C to 105 C – –40 C to 125 C
• 50MHz maximum CPU bus frequency, 100MHz maximum XGATE bus frequency 1. The 144-Pin LQFP version will not be qualified for production and is intended to be used for emulation (development tools) only.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

30 Freescale Semiconductor

Table 1-1.Package and Memory Options of MC9S12XF-Family Members Device Package Flash RAM EEEPROM 9S12XF512

144 LQFP

64 LQFP

64 QFP

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 31

1.1.2 Block Diagram

Figure 1-1 shows a block diagram of the MC9S12XF-Family devices Figure 1-1. MC9S12XF-Family Block Diagram1 1. See Section 1.2, “Signal Description“ to get more information with regard to I/O muxing variants. 16K … 32K bytes RAM RESET EXTAL XTAL 2K … 4K bytes Emulated EEPROM BKGD VDDR Periodic Interrupt Clock Monitor Single-wire Background TEST Voltage Regulator Debug Module VDD1 ATD Enhanced Multilevel Interrupt Module IOC[7:0] PT[7:0] PTT PTAD0 AN[15:0] PAD[15:0] VDDPLL XGATE X 16-bit 8 channel 8/10/12-bit 16-channel Analog-Digital Converter Enhanced Capture Timer ECT EPIT PD[7:0] PTD PC[7:0] PTC DATA[15:8] DATA[7:0] PB[7:0] PTB ADDR[7:0] PA[7:0] PTA ADDR[15:8] PK[7:0] PTK ADDR[22:16] EWAIT XIRQ XCLKS/ECLKX2 IRQ ECLKPE4 PE3 PE2 PE1 PE0 PE7 PE6 PE5 PTE RW/WE LSTRB/LDS MODA/TAGLO/RE MODB/TAGHI VDDF 128K … 512K bytes Flash CPU12X Amplitude Controlled Low Power Pierce or Full drive Pierce Oscillator COP Watchdog PLL with Frequency Modulation option Debug Module 4 address breakpoints 2 data breakpoints

512 Byte Trace Buffer

Non-Multiplexed External Bus Interface Async. Periodic Int. 8ch 16-bit Timer SCI0 MISO MOSI PS3 PS0 PS1 PS2 SCK SS SPI0 PTS Asynchronous Serial IF RXD TXD SCI1 Asynchronous Serial IF RXD TXD PS7 PS4 PS5 PS6 PP3 PP0 PP1 PP2 PTP PP7 PP4 PP5 PP6 MISO MOSI SCK SS SPI1 CAN0 PM3 PM0 PM1 PM2 PTM msCAN 2.0B RXCAN TXCAN PM7 PM4 PM5 PM6 PJ3 PJ0 PJ1 PJ2 PTJ PJ7 PJ4 PJ5 PJ6 Synchronous Serial IF Synchronous PH3 PH0 PH1 PH2 PTH PH7 PH4 PH5 PH6 15-bit 6-channel Pulse Width Modulation with Fault Protection FAULT2 FAULT3 STB2 STB0 STB1 STB3 PMF4 PMF5 FAULT0 FAULT1 IS0 IS1 IS2 Serial IF PMF2 PMF0 PMF1 PMF3 TXD_A RXD_A TXE_A TXD_B RXD_B TXE_B Channel A Channel B FlexRay MPU Memory Protection

4 Regions

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

32 Freescale Semiconductor

Table 1-2. Peripheral Feature Summary of MC9S12XF-Family Members Package FlexRay ECT PIT CAN SCI SPI A/D PMF

144 LQFP 2-ch 8ch 8ch 1 2 2 16-ch

4 Fault Inputs

3 Current Sense

112 LQFP 2-ch 8ch 8ch 1 2 2 16-ch

64 LQFP 1-ch 8ch 8ch 1 1 1 8-ch

0 Fault Inputs

0 Current Sense

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 33

1.1.3 Device Memory Map

Table 1-3 shows the device register memory map. Table 1-3. Device Memory Map Address Module Size (Bytes) 0x0000 - 0x0009 PIM (Port Integration Module ) 10 0x000A - 0x000B MMC (Memory Map Control) 2 0x000C - 0x000D PIM (Port Integration Module) 2 0x000E - 0x000F EBI (External Bus Interface) 2 0x0010 - 0x0017 MMC (Memory Map Control) 10 0x0018 - 0x0019 Reserved 2 0x001A - 0x001B Device ID register 2 0x001C - 0x001F PIM (Port Integration Module) 4 0x0020 - 0x002F DBG (Debug Module) 16 0x0030 - 0x0031 Reserved 2 0x0032 - 0x0033 PIM (Port Integration Module) 2 0x0034 - 0x003F CRG (Clock and Reset Generator) 12 0x0040 - 0x007F ECT (Enhanced Capture Timer 16-bit 8 channel)s 64 0x0080 - 0x00AF ATD (Analog to Digital Converter 10-bit 16 channel) 48 0x00B0 - 0x00C7 Reserved 24 0x00C8 - 0x00CF SCI0 (Serial Communications Interface) 8 0x00D0 - 0x00D7 SCI1 (Serial Communications Interface) 8 0x00D8 - 0x00DF Serial Peripheral Interface (SPI0) 8 0x00E0 - 0x00EF Reserved 16 0x00F0 - 0x00F7 Serial Peripheral Interface (SPI1) 8 0x00F8 - 0x00FF Reserved 8 0x0100–0x0113 FTM control register 20 0x0114–0x011F MPU (memory protection unit) 12 0x0120 - 0x012F INT (Interrupt Module) 16 0x0130 - 0x013F Reserved 16 0x0140 - 0x017F CAN (Freescale Scalable Can) 64 0x0180 - 0x01FF Reserved 128 0x0200 - 0x023F PMF (Pulse With Modulator with Fault Protection) 64 0x0240 - 0x027F PIM (Port Integration Module) 64 0x0280 - 0x02EF Reserved 112 0x02F0 - 0x02F7 Voltage Regulator 8 0x02F8 - 0x02FF Reserved 8 0x0300 - 0x0307 FlexRay IPLL 8 0x0308 - 0x033F Reserved 56 0x0340 - 0x036F Enhanced Periodic Interrupt Timer 48 0x0370 - 0x037F Reserved 16 0x0380 - 0x03BF XGATE 64

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

34 Freescale Semiconductor

Reserved register space shown inTable 1-3 is not allocated to any module. This register space is reserved for future use. Writing to these locations has no effect. Read access to these locations returns zero. 0x03C0 - 0x03FF Reserved 64 0x0400 - 0x05FF FlexRay 512 0x0600 - 0x07FF Reserved 512 Table 1-3. Device Memory Map Address Module Size (Bytes)

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 35

1.1.4 MC9S12XF512 - Address Mapping

Figure 1-2 shows S12XE CPU & BDM local address translation to the global memory map. It indicates also the location of the internal resources in the memory map. EEEPROM size is presented like a fixed 256 KByte in the memory map. Table 1-4. 9S12XF512 Dependent Memory Parameters Device FLASH_LOW PPAGE (1) 1. Number of 16K pages addressable via PPAGE register RAM_LOW RPAGE (2) 2. Number of 4K pages addressing the RAM. RAM can also be mapped to 0x4000 - 0x7FFF DF_HIGH EPAGE 9S12XF512 0x78_0000 32 0x0F_8000 8 0x10_7FFF 32

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

36 Freescale Semiconductor

Figure 1-2. MC9S12XF512 Global Memory Map 0x7F_FFFF 0x00_0000 0x13_FFFF 0x0F_FFFF

256 K EEEPROM

0x00_07FF EPAGE RPAGE PPAGE 0x3F_FFFF CPU and BDM Local Memory Map Global Memory Map FLASHSIZE RAMSIZE CS3CS1CS0 0x1F_FFFF CS2 0xFFFF Reset Vectors 0xC000 0x8000 Unpaged 0x4000 0x1000 0x0000 16K FLASH window 0x0C00 0x2000 0x0800 8K RAM 4K RAM window 1K EEPROM (FF) 2K REGISTERS 1K EEPROM window 16K FLASH Unpaged 16K FLASH 2K REGISTERS Unimplemented RAM External Space RAM_LOW FLASH FLASH_LOW Unimplemented FLASH RESOURCES NOTE: On smaller derivatives the flash memory map is split into 2 ranges separated by an unimplemeted range, as depicted by the dashed lines. For more information refer to tables below and MMC section. FF FE0x13_F800 0x13_FBFF 0x13_FC00

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 37 Unimplemented RAM pages are mapped externally in expanded modes. Accessing unimplemented RAM pages in single chip modes causes an illegal address reset if the MPU is not configured to flag an MPU protection error in that range. Accessing unimplemented FLASH pages in single chip modes causes an illegal address reset if the MPU is not configured to flag an MPU protection error in that range. The range between 0x10_0000 and 0x13_FFFF is mapped to EEEPROM resources. The actual EEEPROM and dataflash block sizes are listed inTable 1-6. Within EEEPROM resource range an address range exists which is neither used by EEEPROM resources nor remapped to external resources via chip selects (see the FTM/MMC descriptions for details). The fixed 8K RAM default location in the global map is 0x0F_E000 - 0x0F_FFFF. This is subject to remapping when configuring the local address map for a larger RAM access range. Memory map Figure 1-3 shows XGATE local address translation to the global memory map. It indicates also the location of used internal resources in the memory map. Table 1-6. Derivative Dependent Memory Parameters Table 1-5. XGATE Resources (9S12XF512) Internal Resource Size /KByte $Address XGATE RAM 32K XGRAM_LOW = 0x0F_8000 FLASH 30K (1) 1. This value is calculated by the following formula: (64K - 2K - XGRAMSIZE) XGFLASH_HIGH = 0x78_8000 Device FLASH_LOW PPAGE(1) 1. Number of 16K pages addressable via PPAGE register RAM_LOW RPAGE(2) 2. Number of 4K pages addressing the RAM. RAM can also be mapped to 0x4000 - 0x7FFF EE_LOW DF_HIGH EPAGE 9S12XF512 0x78_0000 32 0x0F_8000 8 0x13_F000 0x10_7FFF 4 (3) + 32(4) 3. Number of 1K pages addressing the Cache RAM via the EPAGE register counting downwards from 0xFF 4. Number of 1K pages addressing the Data flash via the EPAGE register starting upwards from 0x00 9S12XF384 0x78_0000 (5) 5. The 384K memory map is split into a 128K block from 0x78_0000 to 0x79_FFFF and a 256K block from 0x7C_0000 to 0x7F_FFFF 24 0x0F_A000 6 0x13_F000 0x10_7FFF 4 + 32 9S12XF256 0x78_0000 (6) 6. The 256K memory map is split into a 128K block from 0x78_0000 to 0x79_FFFF and a 128K block from 0x7E_0000 to 0x7F_FFFF 16 0x0F_B000 5 0x13_F800 0x10_7FFF 2 + 32 9S12XF128 0x78_0000 (7) 7. The 128K memory map is split into a 64K block from 0x78_0000 to 0x78_FFFF and a 64K block from 0x7F_0000 to 0x7F_FFFF 8 0x0F_C000 4 0x13_F800 0x10_7FFF 2 + 32

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

38 Freescale Semiconductor

Table 1-7. Derivative Dependent Flash Block Mapping Block B1 is divided into two 128K blocks. The XGATE is always mapped to block B1S. On the 9S12XF128 the flash is divided into two 64K blocks B0 and B1S, the B1S range extending from 0x78_0000 to 0x78_FFFF, the B0 range extending from 0x7F_0000 to 0x7F_FFFF. The block B0 is a reduced size 128K block on the 256K derivative. On the larger derivatives B0 is a 256K block. The block B0 is a reduced size 64K block on the 128K derivative. Device 0x78_0000 0x7A_0000 0x7C_0000 0x7E_0000 9S12XF512 B1S B1N B0 9S12XF384 B1S — B0 9S12XF256 B1S —— B0(128K) 9S12XF128 B1S (64K) —— B0 (64K)

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 39 Figure 1-3. XGATE Global Address Mapping 0x7F_FFFF 0x00_0000 0x0F_FFFF 0xFFFF 0x0000 Registers FLASH RAM 0x0800 Registers 0x00_07FF XGATE Local Memory Map Global Memory Map FLASHSIZE XGRAMSIZE RAMSIZE 0x78_0800 FLASH RAM XGRAM_LOW XGFLASH_HIGH

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

40 Freescale Semiconductor

1.1.4.1 FlexRay Address Mapping

Memory map 1 Figure 1-4 shows FlexRay address mapping to the global memory map. It indicates also the location of the internal resources in the memory map. The FlexRay address mapping can be configured via MPU descriptors. It is possible to set-up up to 4 descriptors giving the FlexRay module access to 4 different regions of RAM with different permissions. This is not reflected in Figure 1-4 for complexity reasons. For more details refer to the MPU section. NOTE The FlexRay module can only access system ram space.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 41 Figure 1-4. FLEXRAY Global Address Mapping 0x7F_FFFF 0x00_0000 0x0F_FFFF RAM FLEXRAY Local Memory Map Global Memory Map FLXRAMSIZE RAMSIZE FLXRAMSIZE Unimplemented area RAM FLXRAMSIZE is the memory area defined by the LOW_ADDR and HIGH_ADDR settings in the corresponding MPU descriptor register (Figure 17-8. MPU Descriptor Register 0 (MPUDESC0) and following registers).

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

42 Freescale Semiconductor

1.1.5 Detailed Register Map

For the detailed register map refer to Appendix E Detailed Register Address Map.

1.1.6 Part ID Assignment

The part ID is located in two 8-bit registers PARTIDH and PARTIDL (addresses 0x001A and 0x001B). The read-only value is a unique part ID for each revision of the chip.Table 1-8 shows the assigned part ID number and Mask Set number. The Version ID is a word located in a flash information row at 0x40_00E8. The version ID number indicates a specific version of internal NVM variables used to patch NVM errata. The default is no patch (0xFFFF). Table 1-8. Part ID Assignment for MC9S12XF512 Device Mask Set Number Part ID (1) 1. The coding is as follows: Bit 15-12: Major family identifier Bit 11-8: Minor family identifier Bit 7-4: Major mask set revision number including FAB transfers Bit 3-0: Minor — non full — mask set revision Version ID MC9S12XF512 0M64J $D480 0xFFFF MC9S12XF512 1M64J $D481 0xFFFF MC9S12XF512 2M64J $D481 0x0006 (2)

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 43

1.2 Signal Description

This section describes signals that connect off chip. It includes a pinout diagram, a table of signal properties, and detailed discussion of signals. It is built from the signal description sections of the block guides of the individual IP blocks contained in the system.

1.2.1 System Pinout

Figure 1-5 is a pinout diagram of the system. The diagram must include the names of all signals that are connected by system pins. NOTE Pin

• 56 of the 144-Pin LQFP
• 46 of the 112-Pin LQFP
• 26 of the 64-Pin LQFP must not be connected to VDD, VSS or any other component. Freescale test structures are bonded to this pin. Keep this pin (according to package type) open. NOTE The VDD pins provide 1.8V derived from the internal voltage regulator. Usage of an external voltage regulator is not allowed.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

44 Freescale Semiconductor

Figure 1-5. MC9S12XF-Family Pin Assignments 144-pin LQFP Package1 1. The 144-Pin LQFP version will not be qualified for production and is intended to be used for emulation (development tools) only. MC9S12XF512 144LQFP VRH VDDA PAD15/AN15 PAD07/AN7 PAD14/AN14 PAD06/AN6 PAD13/AN13 PAD05/AN5 PAD12/AN12 PAD04/AN4 PAD11/AN11 PAD03/AN3 PAD10/AN10 PAD02/AN2 PAD09/AN9 PAD01/AN1 PAD08/AN08 PAD00/AN0 VSS2 VDD PA7/ADDR15 PA6/ADDR14 PA5/ADDR13 PA4/ADDR12 PK7/ EWAIT/ROMCTL PK6/ADDR22/ACC2 PK5/ADDR21/ACC1 PK4/ADDR20/ACC0 PK3/ADDR19/IQSTAT3 PK2/ADDR18/IQSTAT2 PK1/ADDR17/IQSTAT1 PK0/ADDR16/IQSTAT0 PH3 PH2/ TXE_A PH1/TXD_A PH0/RXD_A PP2/PMF2 PP3/PMF3 PP4/PMF4 PP5/PMF5 PP6/FAULT0 PP7/FAULT1 PD4/DATA4 PD5/DATA5 PD6/DATA6 PD7/DATA7 VDDX1 VSSX1 PM0/RXCAN0 PM1/TXCAN0 NC NC PM2/FAULT2/ CS0 PM3/FAULT3/CS1 PM4/MISO1/CS2 PM5/MOSI1 PM6/SCK1 PM7/ SS1/CS3 NC NC PS7/ SS0 PS6/SCK0 PS5/MOSI0 PS4/MISO0 PS3/TXD1 PS2/RXD1 PS1/TXD0 PS0/RXD0 NC NC VSSA VRL ADDR2/PB2 ADDR3/PB3 MODC/BKGD ECLKX2/ XCLKS/PE7 TAGHI/MODB/PE6 RE/TAGLO/MODA/PE5 ECLK/PE4 EROMCTL/LDS/LSTRB/PE3 WE/RW/PE2 RXD_B/PH4 TXD_B/PH5 TXE_B/PH6 PH7 VDDX2 VSSX2 VSS3 VDDR RESET VDDPLL (Freescale Test) VSSPLL EXTAL XTAL TEST ADDR4/PB4 ADDR5/PB5 ADDR6/PB6 ADDR7/PB7 ADDR8/PA0 ADDR9/PA1 ADDR10/PA2 ADDR11/PA3 VDDX4 VSSX4 IRQ/PE1 XIRQ/PE0 108 107 106 105 104 103 102 101 100 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 Pins shown in BOLD are not available on the 64-pin package option Pins shown in ITALICS are not available on the 112-pin and 64-pin package options NC =No internal Connection PMF1/PP1 PMF0/PP0 DATA3/PD3 DATA2/PD2 DATA1/PD1 DATA0/PD0 IOC0/PT0 IOC1/PT1 IOC2/PT2 IOC3/PT3 IS0/PJ0 IS1/PJ1 IS2/PJ2 VDDF VSS1 VSSX3 VDDX3 IOC4/PT4 IOC5/PT5 IOC6/PT6 IOC7/PT7 DATA8/PC0 DATA9/PC1 DATA10/PC2 DATA11/PC3 DATA12/PC4 DATA13/PC5 DATA14/PC6 DATA15/PC7 STB0/PJ3 STB1/PJ4 STB2/PJ5 STB3/PJ6 PJ7 UDS/ADDR0/PB0 ADDR1/PB1 NOTE The 144-Pin LQFP version will not be qualified for production and is intended to be used for emulation (development tools) only.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 45 Figure 1-6. MC9S12XF-Family Pin Assignments 112-pin LQFP Package MC9S12XF512 112LQFP VRH VDDA PAD15/AN15 PAD07/AN7 PAD14/AN14 PAD06/AN6 PAD13/AN13 PAD05/AN5 PAD12/AN12 PAD04/AN4 PAD11/AN11 PAD03/AN3 PAD10/AN10 PAD02/AN2 PAD09/AN09 PAD01/AN1 PAD08/AN08 PAD00/AN0 VSS2 VDD PA7 PA6 PA5 PA4 PH3 PH2/ TXE_A PH1/TXD_A PH0/RXD_A PP2/PMF2 PP3/PMF3 PP4/PMF4 PP5/PMF5 PP6/FAULT0 PP7/FAULT1 PD4 PD5 VDDX1 VSSX1 PM0/RXCAN0 PM1/TXCAN0 PM2/FAULT2/ CS0 PM3/FAULT3/CS1 PM4/MISO1/CS2 PM5/MOSI1 PM6/SCK1 PM7/ SS1/CS3 PS7/SS0 PS6/SCK0 PS5/MOSI0 PS4/MISO0 PS3/TXD1 PS2/RXD1 PS1/TXD0 PS0/RXD0 VSSA VRL PMF1/PP1 PMF0/PP0 PD3 PD2 PD1 PD0 IOC0/PT0 IOC1/PT1 IOC2/PT2 IOC3/PT3 IS0/PJ0 IS1/PJ1 IS2/PJ2 VDDF VSS1 VSSX3 VDDX3 OC4/PT4 IOC5/PT5 IOC6/PT6 IOC7/PT7 STB0/PJ3 STB1/PJ4 STB2/PJ5 STB3/PJ6 PJ7 UDS/ADDR0/PB0 ADDR1/PB1 MODC/BKGD ECLKX2/XCLKS/PE7 PE6 PE5 ECLK/PE4 PE3 PE2 RXD_B/PH4 TXD_B/PH5 TXE_B/PH6 PH7 VDDX2 VSSX2 VSS3 VDDR RESET VDDPLL (Freesscale Test) VSSPLL EXTAL XTAL TEST PA0 PA1 PA2 PA3 IRQ/PE1 XIRQ/PE0 112 111 110 109 108 107 106 105 104 103 102 101 100 Pins shown in BOLD are not available on the 64-pin package option NC =No internal Connection

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

46 Freescale Semiconductor

Figure 1-7. MC9S12XF-Family Pin Assignments 64-pin LQFP Package Table 1-9. Port and Peripheral Availability by Package Option Port 144 LQFP 112 LQFP 64 LQFP Port AD/ADC Channels 16/16 16/16 8/8 Port A pins 8 8 0 Port B pins 8 2 0 Port C pins 8 0 0 Port D pins 8 6 0 Port E pins inc. IRQ/XIRQ input only 8 8 4 Port H/FlexRay Channels 8/A+B 8/A+B 4/A Port J/PMF Current Sense 8/3 8/3 4/0 Port K pins 8 0 0 Port M/CAN/PMF Fault Inputs/SPI 8/1/2/1 8/1/2/1 2/1/0/0 VRH VDDA PAD07/AN7 PAD06/AN6 PAD05/AN5 PAD04/AN4 PAD03/AN3 PAD02/AN2 PAD01/AN1 PAD00/AN0 VSS2 VDD PH3 PH2/ TXE_A PH1/TXD_A PH0/RXD_A PP2/PMF2 PP3/PMF3 PP4/PMF4 PP5/PMF5 VDDX1 VSSX1 PM0/RXCAN0 PM1/TXCAN0 PS7/ SS0 PS6/SCK0 PS5/MOSI0 PS4/MISO0 PS1/TXD0 PS0/RXD0 VSSA VRL PMF1/PP1 PMF0/PP0 IOC0/PT0 IOC1/PT1 IOC2/PT2 IOC3/PT3 VDDF VSS1 IOC4/PT4 IOC5/PT5 IOC6/PT6 IOC7/PT7 STB0/PJ3 STB1/PJ4 STB2/PJ5 STB3/PJ6 MODC/BKGD XCLKS/PE7 ECLK/PE4 VDDX2 VSSX2 VSS3 VDDR RESET VDDPLL (Freescale Test) VSSPLL EXTAL XTAL TEST IRQ/PE1 XIRQ/PE0 MC9S12XF512 64LQFP NC =No internal Connection

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 47 Port P/PMF channels/PMF Fault Inputs 8/6/2 8/6/2 6/6/0 Port S/SCI/SPI 8/2/1 8/2/1 6/1/1 Port T/Timer Channels 8/8 8/8 8/8 VDDX/VSSX 4/4 3/3 2/2 Table 1-9. Port and Peripheral Availability by Package Option Port 144 LQFP 112 LQFP 64 LQFP

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

48 Freescale Semiconductor

1.2.2 Signal Properties Summary

Table 1-10. Signal Properties Pin Number Pin Name Funct. Pin Name Funct. Pin Name Funct. Pin Name Funct. Function Power Supply I/O Termination out of Reset L Q F P 144 (1) L Q F P 112 L Q F P CTRL(2) Reset(3) State 1 1 1 PP1 PMF1 — — Port P I/O, PMF Channels 0/1 VDDX (4) I/O PERP PPSP disabled 2 2 2 PP0 PMF0 — — VDDX I/O 3 3 — PD3 DATA3 — — Port D I/O, Data Bus VDDX I/O PUCR disabled 4 4 — PD2 DATA2 — — VDDX I/O 5 5 — PD1 DATA1 — — VDDX I/O 6 6 — PD0 DATA0 — — VDDX I/O 7 7 3 PT0 IOC0 — — Port T I/O, Timer channels VDDX I/O PERT PPST disabled 8 8 4 PT1 IOC1 — — VDDX I/O 9 9 5 PT2 IOC2 — — VDDX I/O 10 10 6 PT3 IOC3 — — VDDX I/O 11 11 PJ0 IS0 — — Port T I/O, Current status pins for top/bottom pulse width correction VDDX I/O PERJ PPSJ Up 12 12 PJ1 IS1 — — VDDX I/O 13 13 PJ2 IS2 — — VDDX I/O 14 14 7 VDDF (5) — — — NVM Power Supply 2.8V 15 15 8 VSS1 — — — Digital Ground Supply 1.8V 16 16 — VSSX3 — — — I/O Ground Supply 3-5V 17 17 — VDDX3 — — — I/O Power Supply 3-5V 18 18 9 PT4 IOC4 — Port T I/O, Timer channels VDDX I/O PERT PPST disabled 19 19 10 PT5 IOC5 — — VDDX I/O 20 20 11 PT6 IOC6 — — VDDX I/O 21 21 12 PT7 IOC7 — — VDDX I/O

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 49 22 — — PC0 DATA8 — — Port C I/O, Data Bus VDDX I/O PUCR disabled 23 — — PC1 DATA9 — — VDDX I/O 24 — — PC2 DATA10 — — VDDX I/O 25 — — PC3 DATA11 — — VDDX I/O 26 — — PC4 DATA12 — — VDDX I/O 27 — — PC5 DATA13 — — VDDX I/O 28 — — PC6 DATA14 — — VDDX I/O 29 — — PC7 DATA15 — — VDDX I/O 30 22 13 PJ3 STB0 — — Port J I/O, FR Strobe Signal 0 VDDX I/O PERJ PPSJ Up 31 23 14 PJ4 STB1 — — Port J I/O, FR Strobe Signal 1 VDDX I/O 32 24 15 PJ5 STB2 — — Port J I/O, FR Strobe Signal 2 VDDX I/O 33 25 16 PJ6 STB3 — — Port J I/O, FR Strobe Signal 3 VDDX I/O 34 26 — PJ7 — — — Port J I/O VDDX I/O 35 27 — PB0 ADDR0 UDS IVD0 (6) Port B I/O, Address Bus, Internal Visibility Data VDDX I/O PUCR disabled 36 28 — PB1 ADDR1 — IVD1 VDDX I/O 37 — — PB2 ADDR2 — IVD2 VDDX I/O 38 — — PB3 ADDR3 — IVD3 VDDX I/O 39 29 17 BKGD MODC — — Background Debug, VDDX I/O PUCR Up 40 30 18 PE7 XCLKS ECLKX2 — Port E I/O, Clock Select System clock output VDDX I/O PUCR Up 41 31 — PE6 MODB TAGHI — Port E I/O, System clock output, Clock Select VDDX I/O While RESET pin is low: Down 42 32 — PE5 MODA TAGLO RE Port E I/O, System clock output, Clock Select VDDX I/O While RESET pin is low: Down 43 33 19 PE4 ECLK — — Port E I/O, Bus Clock Output VDDX I/O PUCR Up Table 1-10. Signal Properties Pin Number Pin Name Funct. Pin Name Funct. Pin Name Funct. Pin Name Funct. Function Power Supply I/O Termination out of Reset L Q F P 144 (1) L Q F P 112 L Q F P CTRL(2) Reset(3) State

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

50 Freescale Semiconductor

44 34 — PE3 LSTRB LDS EROMCTL Port E I/O, Low Byte Data strobe, EROMON control VDDX I/O PUCR Up 45 35 — PE2 R W WE — Port E I/O, synchrounous Read/Write, asynchronous write VDDX I/O 46 36 — PH4 RXD_B — — Port H I/O, FR Receive Data Channel B VDDX I/O PERH PPSH disabled 47 37 — PH5 TXD_B — — Port H I/O, FR Transmit Data Channel B VDDX I/O 48 38 — PH6 TXE_B — — Port H I/O, FR Transmit Data Channel B VDDX I/O 49 39 — PH7 — — — Port H I/O VDDX I/O 50 40 20 VDDX2 — — — I/O Power Supply 3-5V 51 41 21 VSSX2 — — — I/O Ground Supply 3-5V 52 42 22 VSS3 — — — Digital Ground Supply 1.8V 53 43 23 VDDR — — — Voltage Regulator Power Supply 3-5V 54 44 24 RESET — — — External Reset VDDX I/O Up 55 45 25 VDDPLL — — — PLL & OSC Power Supply 1.8V 57 47 27 VSSPLL — — — PLL & OSC Ground Supply 1.8V 58 48 28 EXTAL — — — Oscillator Pins VDDPLL NA NA 59 49 29 XTAL — — — VDDPLL NA NA 60 50 30 TEST — — — Test Input VDDX RESET PIN Down 61 — — PB4 ADDR4 IVD4 — Port B I/O, Address Bus, Internal Visibility Data VDDX I/O PUCR disabled 62 — — PB5 ADDR5 IVD5 — VDDX I/O 63 — — PB6 ADDR6 IVD6 — VDDX I/O 64 — — PB7 ADDR7 IVD7 — VDDX I/O Table 1-10. Signal Properties Pin Number Pin Name Funct. Pin Name Funct. Pin Name Funct. Pin Name Funct. Function Power Supply I/O Termination out of Reset L Q F P 144 (1) L Q F P 112 L Q F P CTRL(2) Reset(3) State

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 51 65 51 — PA0 ADDR8 IVD8 — Port A I/O, Address Bus, Internal Visibility Data VDDX I/O PUCR disabled 66 52 — PA1 ADDR9 IVD9 — VDDX I/O 67 53 — PA2 ADDR10 IVD10 — VDDX I/O 68 54 — PA3 ADDR11 IVD11 — VDDX I/O 69 — — VDDX4 — — — I/O Power Supply 3-5V 70 — — VSSX4 — — — I/O Ground Supply 3-5V 71 55 31 PE1 IRQ — — Port E Input, Maskable Interrupt VDDX I PUCR Up 72 56 32 PE0 XIRQ — — Port E Input, Non Maskable Interrupt VDDX I 73 57 33 PH0 RXD_A — — Port H I/O, FR Receive Data Channel A VDDX I/O PERH PPSH disabled 74 58 34 PH1 TXD_A — — Port H I/O, FR Transmit Data Channel A VDDX I/O 75 59 35 PH2 TXE_A — — Port H I/O, FR Transmit Data Channel A VDDX I/O 76 60 36 PH3 — — — Port H I/O VDDX I/O 77 — — PK0 ADDR16 IQSTAT0 — Extended Address, PIPE status VDDX I/O PUCR Up 78 — — PK1 ADDR17 IQSTAT1 — VDDX I/O 79 — — PK2 ADDR18 IQSTAT2 — VDDX I/O 80 — — PK3 ADDR19 IQSTAT3 — VDDX I/O 81 — — PK4 ADDR20 ACC0 — Port K I/O, Extended Addresses,Access Source for external Access VDDX I/O 82 — — PK5 ADDR21 ACC1 — VDDX I/O 83 — — PK6 ADDR22 ACC2 — VDDX I/O 84 — — PK7 EWAIT ROMCTL — Port K I/O, EWAIT input , ROM On Control VDDX I/O 85 61 — PA4 ADDR12 IVD12 — Port A I/O, Address Bus, Internal Visibility Data VDDX I/O PUCR disabled 86 62 — PA5 ADDR13 IVD13 — VDDX I/O 87 63 — PA6 ADDR14 IVD14 — VDDX I/O 88 64 — PA7 ADDR15 IVD15 — VDDX I/O Table 1-10. Signal Properties Pin Number Pin Name Funct. Pin Name Funct. Pin Name Funct. Pin Name Funct. Function Power Supply I/O Termination out of Reset L Q F P 144 (1) L Q F P 112 L Q F P CTRL(2) Reset(3) State

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

52 Freescale Semiconductor

89 65 37 VDD — — — Digital Power Supply 1.8V 90 66 38 VSS2 — — — Digital Ground Supply 1.8V 91 67 39 PAD00 AN0 — — Port AD Inputs of ATD, Analog Inputs of ATD VDDA I/O PER0AD PER1AD disabled 92 68 — PAD08 AN8 — — VDDA I/O 93 69 40 PAD01 AN1 — — VDDA I/O 94 70 — PAD09 AN9 — — VDDA I/O 95 71 41 PAD02 AN2 — — VDDA I/O 96 72 — PAD10 AN10 — — VDDA I/O 97 73 42 PAD03 AN3 — — VDDA I/O 98 74 — PAD11 AN11 — — VDDA I/O 99 75 43 PAD04 AN4 — — VDDA I/O 100 76 — PAD12 AN12 — — VDDA I/O 101 77 44 PAD05 AN5 — — VDDA I/O 102 78 — PAD13 AN13 — — VDDA I/O 103 79 45 PAD06 AN6 — — VDDA I/O 104 80 — PAD14 AN14 — — VDDA I/O 105 81 46 PAD07 AN7 — — VDDA I/O 106 82 — PAD15 AN15 — — VDDA I/O 107 83 47 VDDA — — — Analog Power Supply 5V 108 84 48 VRH — — — 5V Reference voltages for the analog-to-digital converter. 109 85 49 VRL — — — 0V Reference voltages for the analog-to-digital converter. 110 86 50 VSSA — — — Analog Power Ground 5V Table 1-10. Signal Properties Pin Number Pin Name Funct. Pin Name Funct. Pin Name Funct. Pin Name Funct. Function Power Supply I/O Termination out of Reset L Q F P 144 (1) L Q F P 112 L Q F P CTRL(2) Reset(3) State

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 53 113 87 51 PS0 RXD0 — — Port S I/O, TXD of SCI0 VDDX I/O PERS PPSS Up 114 88 52 PS1 TXD0 — — Port S I/O, RXD of SCI0 VDDX I/O 115 89 — PS2 RXD1 — — Port S I/O, TXD of SCI1 VDDX I/O 116 90 — PS3 TXD1 — — Port S I/O, RXD of SCI1 VDDX I/O 117 91 53 PS4 MISO0 — — Port S I/O, MISO of SPI0 VDDX I/O 118 92 54 PS5 MOSI0 — — Port S I/O, MOSI of SPI0 VDDX I/O 119 93 55 PS6 SCK0 — — Port S I/O, SCK of SPI0 VDDX I/O 120 94 56 PS7 SS0 — — Port S I/O, SS of SP0 VDDX I/O 123 95 — PM7 SS1 CS3 — Port M I/O, SS of SPI1, Chip Select 3 VDDX I/O PERM PPSM disabled 124 96 — PM6 SCK1 — — Port M I/O, SCK of SPI1 VDDX I/O 125 97 — PM5 MOSI1 — — Port M I/O, MOSI of SPI1 VDDX I/O 126 98 — PM4 MISO1 CS2 — Port M I/O, MISO of SPI1, Chip Select 2 VDDX I/O 127 99 — PM3 FAULT3 CS1 — Port M I/O, PMF Fault 3, Chip Select 1 VDDX I/O 128 100 — PM2 FAULT2 CS0 — Port M I/O, PMF Fault 2, Chip Select 0 VDDX I/O 131 101 57 PM1 TXCAN0 — — Port M I/O, CAN TX VDDX I/O PERM PPSM disabled 132 102 58 PM0 RXCAN0 — — Port M I/O, CAN RX VDDX I/O 133 103 59 VSSX1 — — — I/O Ground Supply 3-5V 134 104 60 VDDX1 — — — 5V power sypply Table 1-10. Signal Properties Pin Number Pin Name Funct. Pin Name Funct. Pin Name Funct. Pin Name Funct. Function Power Supply I/O Termination out of Reset L Q F P 144 (1) L Q F P 112 L Q F P CTRL(2) Reset(3) State

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

54 Freescale Semiconductor

135 — — PD7 DATA7 —— Port D I/O, Data Bus VDDX I/O PUCR disabled 136 — — PD6 DATA6 — — VDDX I/O 137 105 — PD5 DATA5 — — VDDX I/O 138 106 — PD4 DATA4 — — VDDX I/O 139 107 — PP7 FAULT1 — — Port P I/O, PMF Fault 1 VDDX I/O PERP PPSP disabled 140 108 — PP6 FAULT0 — — Port P I/O, PMF Fault 0 VDDX I/O 141 109 61 PP5 PMF5 — — Port P I/O, PMF Channel 5 VDDX I/O 142 110 62 PP4 PMF4 — — Port P I/O, PMF Channel 4 VDDX I/O 143 111 63 PP3 PMF3 — — Port P I/O, PMF Channel 3 VDDX I/O 144 112 64 PP2 PMF2 — — Port P I/O, PMF Channel 2 VDDX I/O 1. The 144-Pin LQFP version will not be qualified for production and is intended to be used for emulation (development tools) only. 2. Register bit in the Port Integration Module which controls the behavior 3. State after reset (disabled, pull Up, pull Down) 4. VDDX = VDDX1,VDDX2,VDDX3,VDDX4 5. VDDF must not be connected to VDD 6. Internal visability is only available on the 144-LQFP Package NOTE For devices assembled in 144-pin, 112-pin and 64-pin packages all non-bonded out pins should be configured as outputs after reset in order to avoid current leakage through I/O structures of floating inputs. Refer toTable 1-10for affected pins. NOTE VDDF must not be connected to VDD. Table 1-10. Signal Properties Pin Number Pin Name Funct. Pin Name Funct. Pin Name Funct. Pin Name Funct. Function Power Supply I/O Termination out of Reset L Q F P 144 (1) L Q F P 112 L Q F P CTRL(2) Reset(3) State

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 55

1.2.3 Detailed Signal Descriptions

1.2.4 EXTAL, XTAL — Oscillator Pins

EXTAL and XTAL are the crystal driver and external clock pins. On reset all the device clocks are derived from the EXTAL input frequency. XTAL is the crystal driver output.

1.2.5 RESET — External Reset Pin

The RESET pin is an active low bidirectional control signal. It acts as an input to initialize the MCU to a known start-up state, and an output when an internal MCU function causes a reset. TheRESET pin has an internal pullup device.

1.2.6 TEST — Test Pin

This input only pin is reserved for test. This pin has a pulldown device. NOTE The TEST pin must be tied to VSS in all applications.

1.2.7 BKGD / MODC — Background Debug and Mode Pin

The BKGD/MODC pin is used as a pseudo-open-drain pin for the background debug communication. It is used as a MCU operating mode select pin during reset. The state of this pin is latched to the MODC bit at the rising edge of RESET. The BKGD pin has a pullup device. NOTE An additional lower-ohm pullup is required as the on-chip pullup device is not intended to drive the debug line in the case of BDM communication.

1.2.8 Port Pins

1.2.8.1 PAD00 - PAD15 / AN00 - AN15 — Port AD I/0 Pin of ATD

PAD00 - PAD15 are general purpose inputs or outputs and analog inputs AN00 - AN15 of the analog to digital converter ATD.

1.2.8.2 PA[7:0] / ADDR[15:8] / IVD[15:8] — Port A I/O Pins

PA7-PA0 are general purpose input or output pins. In MCU expanded modes of operation, these pins are used for the external address bus. In MCU emulation modes of operation, these pins are used for external address bus and internal visibility read data.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

56 Freescale Semiconductor

1.2.8.3 PB[7:1] / ADDR[7:1] / IVD[7:1] — Port B I/O Pins

PB7-PB1 are general purpose input or output pins. In MCU expanded modes of operation, these pins are used for the external address bus. In MCU emulation modes of operation, these pins are used for external address bus and internal visibility read data.

1.2.8.4 PB0 / ADDR0 / UDS / IVD[0] — Port B I/O Pin

PB0 is a general purpose input or output pin. In MCU expanded modes of operation, this pin is used for the external address bus ADDR0 or as upper data strobe signal. In MCU emulation modes of operation, this pin is used for external address bus ADDR0 and internal visibility read data IVD0.

1.2.8.5 PC[7:0] / DATA [15:8] — Port C I/O Pins

PC7-PC0 are general purpose input or output pins. In MCU expanded modes of operation, these pins are used for the external data bus. The input voltage thresholds for PC[7:0] can be configured to reduced levels, to allow data from an external 3.3V peripheral to be read by the MCU operating at 5.0V. The input voltage thresholds for PC[7:0] are configured to reduced levels out of reset in expanded and emulation modes. The input voltage thresholds for PC[7:0] are configured to 5V levels out of reset in normal modes.

1.2.8.6 PD[7:0] / DATA [7:0] — Port D I/O Pins

PD7-PD0 are general purpose input or output pins. In MCU expanded modes of operation, these pins are used for the external data bus. The input voltage thresholds for PD[7:0] can be configured to reduced levels, to allow data from an external 3.3V peripheral to be read by the MCU operating at 5.0V. The input voltage thresholds for PD[7:0] are configured to reduced levels out of reset in expanded and emulation modes. The input voltage thresholds for PC[7:0] are configured to 5V levels out of reset in normal modes.

1.2.8.7 PE7 / ECLKX2 / XCLKS — Port E I/O

PE7 is a general-purpose input or output pin. ECLKX2 is a free running clock of twice the internal bus frequency, available by default in emulation modes and when enabled in other modes. The XCLKS is an input signal which controls whether a crystal in combination with the internal loop controlled Pierce oscillator is used or whether full swing Pierce oscillator/external clock circuitry is used (refer toOscillator Configuration ). An internal pullup is enabled during reset.

1.2.8.8 PE6 / MODB / TAGHI — Port E I/O

PE6 is a general purpose input or output pin. It is used as a MCU operating mode select pin during reset. The state of this pin is latched to the MODB bit at the rising edge of RESET. This pin is an input with a pull-down device which is only active when RESET is low. TAGHI is used to tag the high half of the instruction word being read into the instruction queue.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 57 The input voltage threshold for PE6 can be configured to reduced levels, to allow data from an external 3.3V peripheral to be read by the MCU operating at 5.0V. The input voltage threshold for PE6 is configured to reduced levels out of reset in expanded and emulation modes.

1.2.8.9 PE5 / MODA / TAGLO / RE — Port E I/O

PE5 is a general purpose input or output pin. It is used as a MCU operating mode select pin during reset. The state of this pin is latched to the MODA bit at the rising edge of RESET. This pin is shared with the Read Enable RE output. This pin is an input with a pull-down device which is only active whenRESET is low. TAGLO is used to tag the low half of the instruction word being read into the instruction queue. The input voltage threshold for PE5 can be configured to reduced levels, to allow data from an external 3.3V peripheral to be read by the MCU operating at 5.0V. The input voltage threshold for PE5 is configured to reduced levels out of reset in expanded and emulation modes.

1.2.8.10 PE4 / ECLK — Port E I/O

PE4 is a general purpose input or output pin. It can be configured to drive the internal bus clock ECLK. ECLK can be used as a timing reference.

1.2.8.11 PE3 / LSTRB / LDS / EROMCTL — Port E I/O

PE3 is a general purpose input or output pin. In MCU expanded modes of operation,LSTRB or LDS can be used for the low byte strobe function to indicate the type of bus access. At the rising edge of RESET the state of this pin is latched to the EROMON bit.

1.2.8.12 PE2 / R/ W / WE— Port E I/O

PE2 is a general purpose input or output pin. In MCU expanded modes of operations, this pin drives the read/write output signal or write enable output signal for the external bus. It indicates the direction of data on the external bus.

1.2.8.13 PE1 / IRQ — Port E Input

PE1 is a general purpose input pin and the maskable interrupt request input that provides a means of applying asynchronous interrupt requests. This will wake up the MCU from STOP or W AIT mode.

1.2.8.14 PE0 / XIRQ — Port E Input

PE0 is a general purpose input pin and the non-maskable interrupt request input that provides a means of applying asynchronous interrupt requests. This will wake up the MCU from STOP or W AIT mode.

1.2.8.15 PH7— Port H I/O

PH7 is a general purpose input or output pin.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

58 Freescale Semiconductor

1.2.8.16 PH6 / TXE_B — Port H I/O

PH6 is a general purpose input or output pin. It can be configured as FlexRay TXEN_B pin which indicates to the Bus Driver that the FlexRay module is attempting to transmit data on channel B.

1.2.8.17 PH5 / TXD_B — Port H I/O

PH5 is a general purpose input or output pin. It can be configured as FlexRay data transmit channel B.

1.2.8.18 PH4 / RXD_B — Port H I/O

PH4 is a general purpose input or output pin. It can be configured as FlexRay data receive channel B.

1.2.8.19 PH3 — Port H I/O

PH3 is a general purpose input or output pin.

1.2.8.20 PH2 / TXE_A — Port H I/O

PH6 is a general purpose input or output pin. It can be configured as FlexRay TXEN_A pin which indicates to the Bus Driver that the FlexRay module is attempting to transmit data on channel A.

1.2.8.21 PH1 / TXD_A — Port H I/O

PH1 is a general purpose input or output pin. It can be configured as FlexRay data transmit channel A.

1.2.8.22 PH0 / RXD_A — Port H I/O

PH0 is a general purpose input or output pin. It can be configured as FlexRay data receive channel A.

1.2.8.23 PJ7 — PORT J I/O

PJ7 is a general purpose input or output pin.

1.2.8.24 PJ6 / STB3 — PORT J I/O

PJ6 is a general purpose input or output pin. It can be configured as FlexRay Strobe Signal 3 (STB3).

1.2.8.25 PJ5 / STB2 — PORT J I/O

PJ5 is a general purpose input or output pin. It can be configured as FlexRay Strobe Signal 2 (STB2).

1.2.8.26 PJ4 / STB1— PORT J I/O

PJ4 is a general purpose input or output pin. It can be configured as FlexRay Strobe Signal 1 (STB1).

1.2.8.27 PJ3 / STB0 — PORT J I/O

PJ4 is a general purpose input or output pin. It can be configured as FlexRay Strobe Signal 1 (STB0).

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 59

1.2.8.28 PJ2 / IS2 — PORT J I/O

PJ2 is a general purpose input or output pin. It can be configured as PMF current status bit for top/bottom pulse width correction (IS2).

1.2.8.29 PJ1 / IS1 — PORT J I/O

PJ1 is a general purpose input or output pin. It can be configured as PMF current status bit for top/bottom pulse width correction ( IS1).

1.2.8.30 PJ0 / IS0 — PORT J I/O

PJ0 is a general purpose input or output pin. It can be configured as PMF current status bit for top/bottom pulse width correction ( IS0).

1.2.8.31 PK7 / EWAIT / ROMCTL — Port K I/O

PK7 is a general purpose input or output pin. During MCU emulation modes and normal expanded modes of operation, this pin is used to enable the Flash EEEPROM memory in the memory map (ROMCTL). At the rising edge of RESET, the state of this pin is latched to the ROMON bit. The EWAIT input signal maintains the external bus access until the external device is ready to capture data (write) or provide data (read). The input voltage threshold for PK7 can be configured to reduced levels, to allow data from an external 3.3V peripheral to be read by the MCU operating at 5.0V.

1.2.8.32 PK[6:4] / ADDR[22:20] / ACC[2:0] — Port K I/O

PK[6:4] are general purpose input or output pins. During MCU expanded modes of operation, the ACC[2:0] signals are used to indicate the access source of the bus cycle . This pins also provide the expanded addresses ADDR[22:20] for the external bus. In Emulation modes ACC[2:0] is available and is time multiplexed with the high addresses

1.2.8.33 PK[3:0] / ADDR[19:16] / IQSTAT[3:0] — Port K I/O

PK3-PK0 are general purpose input or output pins. In MCU expanded modes of operation, these pins provide the expanded address ADDR[19:16] for the external bus and carry instruction pipe information.

1.2.8.34 PM7 / SS1 / CS3 — Port M I/O

PM7 is a general purpose input or output pin. It can be configured as SS pin for SPI1 (SS1). It can be configured as Chip Select 3 ( CS3).

1.2.8.35 PM6 / SCK1 — Port M I/O

PM6 is a general purpose input or output pin. It can be configured as the serial clock pin SCK of the Serial Peripheral Interface 1 (SPI1).

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

60 Freescale Semiconductor

1.2.8.36 PM5 / MOSI1 — Port M I/O

PM5 is a general purpose input or output pin. It can be configured as master output (during master mode) or slave input pin (during slave mode) MOSI of the Serial Peripheral Interface 1 (SPI1).

1.2.8.37 PM4 / MISO1 / CS2 — Port M I/O

PM4 is a general purpose input or output pin. It can be configured as master input (during master mode) or slave output pin (during slave mode) MISO of the Serial Peripheral Interface 1 (SPI1). It can be configured as Chip Select 2 ( CS2).

1.2.8.38 PM3 / FAULT3 / CS1 — Port M I/O

PM3 is a general purpose input or output pin. It can be configured as PMF FAULT3 input pin. The FAULT inputs are used to disable selected PWM outputs. It can be configured as Chip Select 1 ( CS1).

1.2.8.39 PM2 / FAULT2 / CS0 — Port M I/O

PM2 is a general purpose input or output pin. It can be configured as PMF FAULT2 input pin. The FAULT inputs are used to disable selected PWM outputs. It can be configured as Chip Select 0 ( CS0).

1.2.8.40 PM1 / TXCAN0 — Port M I/O

PM1 is a general purpose input or output pin. It can be configured as the transmit pin TXCAN of the Freescale Scalable Controller Area Network controller (MCAN).

1.2.8.41 PM0 / RXCAN0 — Port M I/O

PM0 is a general purpose input or output pin. It can be configured as the receive pin RXCAN of the Freescale Scalable Controller Area Network controller (MSCAN).

1.2.8.42 PP7 / FAULT1 — Port P I/O

PP7 is a general purpose input or output pin. I It can be configured as PMF FAULT1 input pin. The FAULT inputs are used to disable selected PWM outputs.

1.2.8.43 PP6 / FAULT0 — Port P I/O

PP6 is a general purpose input or output pin. It can be configured as PMF FAULT0 input pin. The FAULT inputs are used to disable selected PWM outputs.

1.2.8.44 PP5 / PMF5 — Port P I/O

PP5 is a general purpose input or output pin. It can be configured to work as PWM output channel 5 of the PMF module.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 61

1.2.8.45 PP4 / PMF4 — Port P I/O

PP4 is a general purpose input or output pin. It can be configured to work as PWM output channel 4 of the PMF module.

1.2.8.46 PP3 / PMF3 — Port P I/O

PP3 is a general purpose input or output pin. It can be configured to work as PWM output channel 3 of the PMF module.

1.2.8.47 PP2 / PMF2 — Port P I/O

PP2 is a general purpose input or output pin. It can be configured to work as PWM output channel 2 of the PMF module.

1.2.8.48 PP1 / PMF1 — Port P I/O

PP1 is a general purpose input or output pin. It can be configured to work as PWM output channel 1 of the PMF module.

1.2.8.49 PP0 / PMF0 — Port P I/O

PP0 is a general purpose input or output pin. It can be configured to work as PWM output channel 0 of the PMF module.

1.2.8.50 PS7 / SS0 — Port S I/O

PS7 is a general purpose input or output pin. It can be configured as the slave select pin SS of the Serial Peripheral Interface (SPI0).

1.2.8.51 PS6 / SCK0 — Port S I/O

PS6 is a general purpose input or output pin. It can be configured as the serial clock pin SCK of the Serial Peripheral Interface 0 (SPI0).

1.2.8.52 PS5 / MOSI0 — Port S I/O

PS5 is a general purpose input or output pin. It can be configured as master output (during master mode) or slave input pin (during slave mode) MOSI of the Serial Peripheral Interface 0 (SPI0).

1.2.8.53 PS4 / MISO0 — Port S I/O

PS4 is a general purpose input or output pin. It can be configured as master input (during master mode) or slave output pin (during slave mode) MISO of the Serial Peripheral Interface 0 (SPI0).

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

62 Freescale Semiconductor

1.2.8.54 PS3 / TXD1 — Port S I/O

PS3 is a general purpose input or output pin. It can be configured as the transmit pin TXD of Serial Communication Interface 1 (SCI1).

1.2.8.55 PS2 / RXD1 — Port S I/O

PS2 is a general purpose input or output pin. It can be configured as the receive pin RXD of Serial Communication Interface 1 (SCI1).

1.2.8.56 PS1 / TXD0 — Port S I/O

PS1 is a general purpose input or output pin. It can be configured as the transmit pin TXD of Serial Communication Interface 0 (SCI0).

1.2.8.57 PS0 / RXD0 — Port S I/O

PS0 is a general purpose input or output pin. It can be configured as the receive pin RXD of Serial Communication Interface 0 (SCI0).

1.2.8.58 PT7 / IOC7 — Port T I/O

PT7 is a general purpose input or output pin. It can be configured as input capture or output compare pin IOC7 of the Enhanced Capture Timer (ECT).

1.2.8.59 PT6-PT3 / IOC6-IOC3 — Port T I/O

PT6-PT3 are general purpose input or output pins. They can be configured as input capture or output compare pins IOC6-IOC3 of the Enhanced Capture Timer (ECT).

1.2.8.60 PT2-PT0 / IOC2-IOC0 — Port T I/O

PT2-PT0 are general purpose input or output pins. They can be configured as input capture or output compare pins IOC2-IOC0 of the Enhanced Capture Timer (ECT).

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 63

1.2.9 Power Supply Pins

The power and ground pins of the MC9S12XF512 are described below. Because fast signal transitions place high, short-duration current demands on the power supply, use bypass capacitors with high-frequency characteristics and place them as close to the MCU as possible. NOTE All VSS pins must be connected together in the application.

1.2.9.1 VDDX1 - VDDX4 / VSSX1 - VSSX4 — Power & Ground Pins for I/O Drivers

External power and ground for I/O drivers. Because fast signal transitions place high, short-duration current demands on the power supply, use bypass capacitors with high-frequency characteristics and place them as close to the MCU as possible. Bypass requirements depend on how heavily the MCU pins are loaded.

1.2.9.2 VDDR — Power Pin for Internal Voltage Regulator

Input to the internal voltage regulator. Because fast signal transitions place high, short-duration current demands on the power supply, use bypass capacitors with high-frequency characteristics and place them as close to the MCU as possible. Bypass requirements depend on how heavily the MCU pins are loaded. NOTE Usage of an external voltage regulator is not allowed.

1.2.9.3 VDDF - NVM Power Pin

Power is supplied to the MCU NVM through VDDF. The voltage supply of nominally 2.8V is derived from the internal voltage regulator when enabled. Connecting additional load to this pin is not permitted when the internal regulator is enabled. NOTE VDDF must not be connected to VDD.

1.2.9.4 VDD / VSS1 - VSS2 - VSS3 — Core Power Pins

Use bypass capacitors with high-frequency characteristics because fast signal transitions place high, short- duration current demands on the power supply, and place them as close to the MCU as possible. This 1.8V supply is derived from the internal voltage regulator when enabled. Connecting additional load to this pin is not permitted when the internal regulator is enabled. NOTE VDD must not be connected to VDDF.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

64 Freescale Semiconductor

1.2.9.5 VDDA, VSSA — Power Supply Pins for ATD and VREG

VDDA, VSSA are the power supply and ground input pins for the voltage regulator and the analog to digital converters.

1.2.9.6 VRH, VRL — ATD Reference Voltage Input Pins

VRH and VRL are the reference voltage input pins for the analog to digital converter.

1.2.9.7 VDDPLL, VSSPLL — Power Supply Pins for PLL

These pins provide operating voltage and ground for the oscillator and the phased-locked loop. The voltage supply of nominally 1.8V is derived from the internal voltage regulator when enabled. This allows the supply voltage to the oscillator and PLL to be bypassed independently. This voltage is generated by the internal voltage regulator. No static external loading of these pins is permitted. NOTE Connecting additional load to this pin is not permitted when the internal regulator is enabled. Table 1-11. MC9S12XF512 Power and Ground Connection Summary Mnemonic Pin Number Nominal Voltage Description144-pin LQFP(1) 112-pin LQFP 64-pin LQFP VDDF 14 14 7 2.8 V Internal power and ground generated by internal regulator for the internal NVM. VDD 89 65 37 1.8 V Internal power and ground generated by internal regulator for the internal core.VSS1, 2, 3 15, 90, 52 15, 66, 42 8, 38, 22 0V VDDR 53 43 23 5.0 V External power supply internal voltage regulator VDDX1 134 104 60 5.0 V External power and ground, supply to pin driversVSSX1 133 103 59 0 V VDDX2 50 40 20 5.0 V External power and ground, supply to pin driversVSSX2 52 41 21 0 V VDDX3 17 17 — 5.0 V External power and ground, supply to pin driversVSSX3 16 16 — 0 V VDDX4 69 — — 5.0 V External power and ground, supply to pin driversVSSX4 70 — — 0 V VDDA 107 83 47 5.0 V Operating voltage and ground for the analog-to-digital converters and the reference for the internal voltage regulator, allows the supply voltage to the A/D to be bypassed independently. VSSA 110 86 50 0 V

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 65 VRL 109 85 49 0 V Reference voltages for the analog- to-digital converter.VRH 108 84 48 5.0 V VDDPLL 55 45 25 1.8 V Provides operating voltage and ground for the phased-locked loop. This allows the supply voltage to the PLL to be bypassed independently. Internal power and ground generated by internal regulator. VSSPLL 57 47 27 0 V 1. The 144-Pin LQFP version will not be qualified for production and is intended to be used for emulation (development tools) only. Mnemonic Pin Number Nominal Voltage Description144-pin LQFP (1) 112-pin LQFP 64-pin LQFP

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

66 Freescale Semiconductor

1.3 System Clock Description

The Clock and Reset Generator module (CRG) provides the internal clock signals for the core and all peripheral modules. shows the clock connections from the CRG to all modules. Consult the CRG Block User Guide for details on clock generation. Figure 1-8. Clock Connections 1 PLL for FlexRay protocol engine. This PLL is independent from the system PLL (CRG) and has to be configured accordingly. Refer to Chapter 12, “Clock Generation Module using IPLL (CGMIPLL) Block Description“, Chapter 13, “FlexRay Communication Controller (FLEXRAY)“ and Section 1.12, “FlexRay IPLL (CGMIPLL) Configuration“ for details how to configure the FlexRay IPLL. 2 Internal Oscillator for API (see 3.4.8 Autonomous Periodical Interrupt (API)). The system clock can be supplied in several ways enabling a range of system operating frequencies to be supported:

• The on-chip phase locked loop (PLL) SCI0 . . SCI 1 SPI0 . . SPI1 ATDCAN CRG bus clock EXTAL XTAL core clock oscillator clock RAM S12X XGATE EPIT ECT PIM FlexRay PMF CGM IPLL1 BDM FTM VREG/API2

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 67

• the PLL self clocking
• the oscillator The clock generated by the PLL or oscillator provides the main system clock frequencies core clock and bus clock. As shown in Figure 1-8, these system clocks are used throughout the MCU to drive the core, the memories, and the peripherals. The Program Flash memory and the Data Flash are supplied by the bus clock and the oscillator clock. The oscillator clock is used as a time base to derive the program and erase times for the NVM’s. The CAN modules may be configured to have their clock sources derived either from the bus clock or directly from the oscillator clock. This allows the user to select its clock based on the required jitter performance. In order to ensure the presence of the clock the MCU includes an on-chip clock monitor connected to the output of the oscillator. The clock monitor can be configured to invoke the PLL self-clocking mode or to generate a system reset if it is allowed to time out as a result of no oscillator clock being present. In addition to the clock monitor, the MCU also provides a clock quality checker which performs a more accurate check of the clock. The clock quality checker counts a predetermined number of clock edges within a defined time window to insure that the clock is running. The checker can be invoked following specific events such as on wake-up or clock monitor failure.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

68 Freescale Semiconductor

1.4 Modes of Operation

The MCU can operate in different modes associated with MCU resource mapping and bus interface configuration. These are described in 1.4.1 Chip Configuration Summary . The MCU can operate in different power modes to facilitate power saving when full system performance is not required. These are described in 1.4.2 Power Modes. Some modules feature a software programmable option to freeze the module status whilst the background debug module is active to facilitate debugging. This is described in 1.4.3 Freeze Mode. The “system state” for the XCPU is always Supervisor State (see Chapter 17 Memory Protection Unit (S12XMPUV2)).

1.4.1 Chip Configuration Summary

The MCU can operate in six different modes associated with resource configuration. The different modes, the state of ROMCTL and EROMCTL signal on rising edge ofRESET and the security state of the MCU affect the following device characteristics:

• External bus interface configuration
• Flash in memory map, or not
• Debug features enabled or disabled The operating mode out of reset is determined by the states of the MODC, MODB, and MODA signals during reset (see Table 1-12 ). The MODC, MODB, and MODA bits in the MODE register show the current operating mode and provide limited mode switching during operation. The states of the MODC, MODB, and MODA signals are latched into these bits on the rising edge of RESET. In normal expanded mode and in emulation modes the ROMON and the EROMON bits in the MISC register defines if the on chip flash memory is the memory map, or not. (See Table 1-12 .) For a detailed explanation of the ROMON and EROMON bits refer to the MMC description. The state of the ROMCTL signal is latched into the ROMON bit in the MMCCTL1 register on the rising edge of RESET. The state of the EROMCTL signal is latched into the EROMON bit in the MMCCTL1 register on the rising edge of RESET.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 69

1.4.1.1 Normal Expanded Mode

Ports K, A, and B are configured as a 23-bit address bus, ports C and D are configured as a 16-bit data bus, and port E provides bus control and status signals. This mode allows 16-bit external memory and peripheral devices to be interfaced to the system. The fastest external bus rate is one half of the internal bus rate.

1.4.1.2 Normal Single-Chip Mode

There is no external bus in this mode. The processor program is executed from internal memory. Ports A, B,C,D, K, and most pins of port E are available as general-purpose I/Os.

1.4.1.3 Special Single-Chip Mode

This mode is used for debugging single-chip operation, boot-strapping, or security related operations. The background debug module BDM is active in this mode. The CPU executes a monitor program located in an on-chip ROM. BDM firmware waits for additional serial commands through the BKGD pin. There is no external bus after reset in this mode.

1.4.1.4 Emulation of Expanded Mode

Developers use this mode for emulation systems in which the users target application is normal expanded mode. Code is executed from external memory or from internal memory depending on the state of ROMON and EROMON bit. In this mode the internal operation is visible on external bus interface. Table 1-12. Chip Modes and Data Sources Chip Modes MODC MODB MODA ROMCTL EROMCTL Data Source (1) 1. Internal means resources inside the MCU are read/written. Internal Flash means Flash resources inside the MCU are read/written. Emulation memory means resources inside the emulator are read/written (PRU registers, Flash replacement, RAM, EEEPROM, and register space are always considered internal). External application means resources residing outside the MCU are read/written. Normal single chip 1 0 0 X X Internal Special single chip 0 0 0 Emulation single chip 0 0 1 X 0 Emulation memory X 1 Internal Flash Normal expanded 1 0 1 0 X External application

1 X Internal Flash

Emulation expanded 0 1 1 0 X External application 1 0 Emulation memory 1 1 Internal Flash Special test 0 1 0 0 X External application

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

70 Freescale Semiconductor

1.4.1.5 Emulation of Single-Chip Mode

Developers use this mode for emulation systems in which the user’s target application is normal single- chip mode. Code is executed from external memory or from internal memory depending on the state of ROMON and EROMON bit. In this mode the internal operation is visible on external bus interface.

1.4.1.6 Special Test Mode

Freescale internal use only.

1.4.2 Power Modes

The MCU features two main low-power modes. Consult the respective module description for module specific behavior in system stop, system pseudo stop, and system wait mode. An important source of information about the clock system is the Clock and Reset Generator description (CRG).

1.4.2.1 System Stop Modes

The system stop modes are entered if the CPU executes the STOP instruction and the S bit in the CCR register is cleared unless either the XGATE is active or an NVM command is active. The XGATE is active if it executes a thread or the XGFACT bit in the XGMCTL register is set. Depending on the state of the PSTP bit in the CLKSEL register the MCU goes into pseudo stop mode or full stop mode. Please refer to CRG description. Asserting RESET, XIRQ, IRQ or any other interrupt that is not masked causes the system to exit the stop mode. System stop modes can be exited by XGATE or CPU activity independently, depending on the configuration of the interrupt request. If System-Stop is exited on an XGATE request then, as long as the XGATE does not set an interrupt flag on the CPU and the XGATE fake activity bit (FACT) remains cleared, once XGATE activity is completed System Stop mode will automatically be re- entered. If the CPU executes the STOP instruction whilst XGATE is active or an NVM command is being processed, then the system clocks continue running until XGATE/NVM activity is completed. If a non- masked CPU-serviced interrupt occurs within this time then the system does not effectively enter stop mode although the STOP instruction has been executed.

1.4.2.2 Full Stop Mode

The oscillator is stopped in this mode. By default all clocks are switched off and all counters and dividers remain frozen. The Autonomous Periodic Interrupt (API) and ADC module may be enabled to self wake the device. A Fast wake up mode is available to allow the device to wake from Full Stop mode immediately on the PLL internal clock without starting the oscillator clock.

1.4.2.3 Pseudo Stop Mode

In this mode the system clocks are stopped but the oscillator is still running and the real time interrupt (RTI) and watchdog (COP), API and ATD modules may be enabled. Other peripherals are turned off. This mode consumes more current than system stop mode but, as the oscillator continues to run, the full speed wake up time from this mode is significantly shorter.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 71

1.4.2.4 XGATE Fake Activity Mode

This mode is entered if the CPU executes the STOP instruction when the XGATE is not executing a thread and the XGFACT bit in the XGMCTL register is set. The oscillator remains active and any enabled peripherals continue to function.

1.4.2.5 Wait Mode

This mode is entered when the CPU executes the W AI instruction. In this mode the CPU will not execute instructions. The internal CPU clock is switched off. All peripherals and the XGATE can be active in system wait mode. For further power consumption the peripherals can individually turn off their local clocks. Asserting RESET,XIRQ, IRQ or any other interrupt that is not masked and is not routed to XGATE ends system wait mode.

1.4.2.6 Run Mode

Although this is not a low-power mode, unused peripheral modules should not be enabled in order to save power.

1.4.3 Freeze Mode

The enhanced capture timer, COP, pulse width modulator, analog-to-digital converter, and the periodic interrupt timer provide a software programmable option to freeze the module status when the background debug module is active. This is useful when debugging application software. For detailed description of the behavior of the ADC, ECT, COP and EPIT when the background debug module is active consult the corresponding Block Guides.

1.5 Security

The MCU security feature allows the protection of on chip NVM memories and RAM. For a detailed description of the security features refer to the S12X9SEC description.

1.6 Resets and Interrupts

Consult the S12XCPU manual and the S12XINT description for information on exception processing.

1.6.1 Resets

Resets are explained in detail in the Clock Reset Generator (CRG) description.

1.6.2 Vectors

Table 1-13 lists all interrupt sources and vectors in the default order of priority. The interrupt module (S12XINT) provides an interrupt vector base register (IVBR) to relocate the vectors. Associated with each I-bit maskable service request is a configuration register. It selects if the service request is enabled, the service request priority level and whether the service request is handled either by the S12X CPU or by the XGATE module. IRQ is I-bit maskable and cannot be serviced by the XGATE.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

72 Freescale Semiconductor

Table 1-13. Interrupt Vector Locations (Sheet 1 of 4) Vector Address(1) XGATE Channel ID(2) Interrupt Source CCR Mask Local Enable $FFFE — System reset or illegal access reset None None $FFFC — Clock monitor reset None PLLCTL (CME, SCME) $FFFA — COP watchdog reset None COP rate select Vector base + $F8 — Unimplemented instruction trap None None Vector base+ $F6 — SWI None None Vector base+ $F4 — XIRQ X Bit None Vector base+ $F2 — IRQ I bit IRQCR (IRQEN) Vector base+ $F0 $78 Real time interrupt I bit CRGINT (RTIE) Vector base+ $EE $77 Enhanced capture timer channel 0 I bit TIE (C0I) Vector base + $EC $76 Enhanced capture timer channel 1 I bit TIE (C1I) Vector base+ $EA $75 Enhanced capture timer channel 2 I bit TIE (C2I) Vector base+ $E8 $74 Enhanced capture timer channel 3 I bit TIE (C3I) Vector base+ $E6 $73 Enhanced capture timer channel 4 I bit TIE (C4I) Vector base+ $E4 $72 Enhanced capture timer channel 5 I bit TIE (C5I) Vector base + $E2 $71 Enhanced capture timer channel 6 I bit TIE (C6I) Vector base+ $E0 $70 Enhanced capture timer channel 7 I bit TIE (C7I) Vector base+ $DE $6F Enhanced capture timer overflow I bit TSRC2 (TOF) Vector base+ $DC $6E Pulse accumulator A overflow I bit PACTL (PAOVI) Vector base + $DA $6D Pulse accumulator input edge I bit PACTL (PAI) Vector base + $D8 $6C SPI0 I bit SPI0CR1 (SPIE, SPTIE) Vector base+ $D6 $6B SCI0 I bit SCI0CR2 (TIE, TCIE, RIE, ILIE) Vector base + $D4 $6A SCI1 I bit SCI1CR2 (TIE, TCIE, RIE, ILIE) Vector Base + $D2 Reserved Vector base + $D0 $68 ATD I bit ATDCTL2 (ASCIE) Vector Base + $CE Reserved Vector Base + $CC Reserved Vector base + $CA $65 Modulus down counter underflow I bit MCCTL (MCZI) Vector base + $C8 $64 Pulse accumulator B overflow I bit PBCTL (PBOVI) Vector base + $C6 $63 CRG PLL lock I bit CRGINT (LOCKIE) Vector base + $C4 $62 CRG self-clock mode I bit CRGINT (SCMIE) Vector base + $C2 $61 CGM IPLL change of lock I bit CGMFLG (LOCKIE Vector base + $C0 Reserved Vector base + $BE $5F SPI1 I bit SPI1CR1 (SPIE, SPTIE)

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 73 Vector base + $BC $5E Reserved Vector base + $BA $5D FLASH Fault Detect I bit FCNFG2 (FDIE) Vector base + $B8 $5C FLASH I bit FCNFG (CCIE, CBEIE) Vector base + $B6 $5B CAN wake-up I bit CANRIER (WUPIE) Vector base + $B4 $5A CAN errors I bit CANRIER (CSCIE, OVRIE) Vector base + $B2 $59 CAN receive I bit CANRIER (RXFIE) Vector base + $B0 $58 CAN transmit I bit CANTIER (TXEIE[2:0]) Vector base + $AE $57 Reserved Vector base + $AC $56 Reserved Vector base + $AA $55 Reserved Vector base + $A8 $54 Reserved Vector Base + $A6 $53 FlexRay Transmit Message Buffer Interrupt I-Bit GIFER (TBIE) Vector Base + $A4 $52 FlexRay Receive Message Buffer Interrupt I-Bit GIFER (RBIE) Vector Base + $A2 $51 FlexRay Receive FIFO channel A Not Empty Interrupt I-Bit GIFER (FNEAIE) Vector Base + $A0 $50 FlexRay Receive FIFO channel B Not Empty Interrupt I-Bit GIFER (FNEBIE) Vector Base + $9E $4F FlexRay Wakeup Interrupt I-Bit GIFER (WUPIE) Vector Base+ $9C $4E FlexRay CHI Interrupt I-Bit GIFER (CHIE) Vector Base+ $9A $4D FlexRay Protocol Interrupt I-Bit GIFER (PRIE) Vector Base + $98 $4C PMF Generator A Reload I-Bit PMFENCA (PWMRIEA) Vector Base + $96 $4B PMF Generator B Reload I-Bit PMFENCB (PWMRIEB) Vector Base + $94 $4A PMF Generator C Reload I-Bit PMFENCC (PWMRIEC) Vector Base + $92 $49 PMF Fault 0 I-Bit PMFFCTL (FIE0) Vector Base + $90 $48 PMF Fault 1 I-Bit PMFFCTL (FIE1) Vector Base + $8E $47 PMF Fault 2 I-Bit PMFFCTL (FIE2) Vector Base+ $8C $46 PMF Fault 3 I-Bit PMFFCTL (FIE3) Vector Base + $8A Reserved Vector Base + $88 Reserved Vector Base + $86 Reserved Vector Base + $84 Reserved Vector Base + $82 Reserved Vector base + $80 $40 Low-voltage interrupt (LVI) I bit VREGCTRL (LVIE) Vector base + $7E $3F Autonomous periodical interrupt (API) I bit VREGAPICTRL (APIE) Vector base + $7C Reserved Table 1-13. Interrupt Vector Locations (Sheet 2 of 4) Vector Address(1) XGATE Channel ID(2) Interrupt Source CCR Mask Local Enable

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

74 Freescale Semiconductor

Vector base + $7A $3D Periodic interrupt timer channel 0 I bit PITINTE (PINTE0) Vector base + $78 $3C Periodic interrupt timer channel 1 I bit PITINTE (PINTE1) Vector base + $76 $3B Periodic interrupt timer channel 2 I bit PITINTE (PINTE2) Vector base + $74 $3A Periodic interrupt timer channel 3 I bit PITINTE (PINTE3) Vector base + $72 $39 XGATE software trigger 0 I bit XGMCTL (XGIE) Vector base + $70 $38 XGATE software trigger 1 I bit XGMCTL (XGIE) Vector base + $6E $37 XGATE software trigger 2 I bit XGMCTL (XGIE) Vector base + $6C $36 XGATE software trigger 3 I bit XGMCTL (XGIE) Vector base + $6A $35 XGATE software trigger 4 I bit XGMCTL (XGIE) Vector base + $68 $34 XGATE software trigger 5 I bit XGMCTL (XGIE) Vector base + $66 $33 XGATE software trigger 6 I bit XGMCTL (XGIE) Vector base + $64 $32 XGATE software trigger 7 I bit XGMCTL (XGIE) Vector base + $62 Reserved Vector base + $60 Reserved Vector base + $5E $2F Periodic interrupt timer channel 4 I bit PITINTE (PINTE4) Vector base + $5C $2E Periodic interrupt timer channel 5 I bit PITINTE (PINTE5) Vector base + $5A $2D Periodic interrupt timer channel 6 I bit PITINTE (PINTE6) Vector base + $58 $2C Periodic interrupt timer channel 7 I bit PITINTE (PINTE7) Vector base + $56 $2B Input Trigger Interrupt I bit PITTRIGIE Vector base + $54 Reserved Vector base + $52 Reserved Vector base + $50 Reserved Vector base+ $4E Reserved Vector base + $4C Reserved Vector base+ $4A Reserved Vector base+ $48 Reserved Vector base+ $46 Reserved Vector base+ $44 Reserved Vector base + $42 Reserved Vector base+ $40 Reserved Vector base+ $3E Reserved Vector base + $3C $1E ATD Compare Interrupt I bit ATDCTL2 (ACMPIE) Vector base + $18 to Vector base + $3A Reserved Table 1-13. Interrupt Vector Locations (Sheet 3 of 4) Vector Address(1) XGATE Channel ID(2) Interrupt Source CCR Mask Local Enable

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 75

1.6.3 Effects of Reset

When a reset occurs, MCU registers and control bits are initialized. Refer to the respective block descriptions for register reset states. On each reset, the Flash module executes a reset sequence to load Flash configuration registers and initialize the buffer RAM EEE partition, if required.

1.6.3.1 Flash Configuration Reset Sequence Phase (Core Hold Phase)

On each reset, the Flash module will hold CPU activity while loading Flash module registers and configuration from the Flash memory. The duration of this phase is given as tRST in the device electrical parameter specification. If double faults are detected in the reset phase, Flash module protection and security may be active on leaving reset. This is explained in more detail in the Flash (FTM) module section.

1.6.3.2 EEE Reset Sequence Phase (Core Active Phase)

During this phase of the reset sequence (following on from the core hold phase) the CPU can execute instructions while the FTM initialization completes and, if configured for EEE operation, the EEE RAM is loaded with valid data from the D-Flash EEE partition. Completion of this phase is indicated by the CCIF flag in the FTM FSTAT register becoming set. If the CPU accesses any EEE RAM location before the CCIF flag is set, the CPU is stalled until the FTM reset sequence is complete and the EEE RAM data is valid. Once the CCIF flag is set, indicating the end of this phase, the EEE RAM can be accessed without impacting the CPU and FTM commands can be executed.

1.6.3.3 Reset While Flash Command Active

If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed.

1.6.3.4 I/O Pins

Refer to the PIM block description for reset configurations of all peripheral module ports. Vector base + $16 — XGATE software error interrupt None None Vector base + $14 — MPU Access Error None None Vector base + $12 — System Call Interrupt (SYS) — None Vector base + $10 — Spurious interrupt — None 1. 16 bits vector address based 2. For detailed description of XGATE channel ID refer to XGATE Block Guide Table 1-13. Interrupt Vector Locations (Sheet 4 of 4) Vector Address(1) XGATE Channel ID(2) Interrupt Source CCR Mask Local Enable

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

76 Freescale Semiconductor

1.6.3.5 Memory

The RAM arrays are not initialized out of reset with exception of the EEE buffer RAM (providing the EEE functionality is enabled).

1.6.3.6 COP Configuration

The COP timeout rate bits CR[2:0] and the WCOP bit in the COPCTL register are loaded on rising edge of RESET from the Flash register FOPT. See Table 1-14 and Table 1-15 for coding. The FOPT register is loaded from the Flash configuration field byte at global address $7FFF0E during the reset sequence. If the MCU is secured and COP is enabled, the COP timeout rate is always set to the longest period (CR[2:0] = 111) after COP reset and after any reset into Special Single Chip mode. Table 1-14. Initial COP Rate Configuration NV[2:0] in FCTL Register CR[2:0] in COPCTL Register 000 111 001 110 010 101 011 100 100 011 101 010 110 001 111 000 Table 1-15. Initial WCOP Configuration NV[3] in FCTL Register WCOP in COPCTL Register

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 77

1.7 EPIT External Trigger Input

The start of the timer channels can be aligned to an external trigger event. Four trigger event sources can be connected. The MC9S12XF Family uses two sources for external trigger events. See Table 1-16 and the EPIT block guide for more details. Table 1-16. External Trigger Input Sources External Trigger Input Connectivity EPIT Register Settings PITTRIGSRC[1:0] TRIGIN0 EPIT - Hardware Trigger 0 00 TRIGIN1 Start of PWM Cycle Channel A 01 TRIGIN2 ECT Input Capture/Output Compare Interrupt 0 10 TRIGIN3 Not Connected 11 (1) 1. No effect as external trigger input is tied.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

78 Freescale Semiconductor

1.8 ATD External Trigger Input Connection

The ATD module includes four external trigger inputs ETRIG0, ETRIG1, ETRIG2, and ETRIG3. The external trigger allows the user to synchronize ATD conversion to external trigger events.Table 1-17 shows the connection of the external trigger inputs. Consult the EPIT block description for more information about hardware trigger generation. Consult the ATD block description for information about the analog-to-digital converter module. ATD block description refererences to freeze mode are equivalent to active BDM mode.

1.9 MPU Configuration

The MPU can handle 3 bus masters (CPU + XGATE + FlexRay). The MPU covers the system ram address space. See MPU documentation for more details. NOTE

• The FlexRay module is Master 3 (MSTR3)
• CPU user state is not supported on this device. Table 1-17. ATD0 External Trigger Sources External Trigger Input Connectivity ETRIG0 Start of PWM Cycle Channel A (1) 1. Indicates start of new PWM cycle. ETRIG1 EPIT - Combined Trigger (2) 2. Selectable hardware trigger. One of eight EPIT channels can be selected. The trigger interval is started via a PMF output. ETRIG2 EPIT - Hardware Trigger 0 (3) 3. Interrupt timer hardware trigger channel 0 ETRIG3 EPIT - Hardware Trigger 1 (4) 4. Interrupt timer hardware trigger channel 1 Table 1-18. MPU Configuration Parameter Parameter Value Number of Descriptors 4 Descripter Granularity(1) 1. Number of least significant address bits to treat as constant.

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 79

1.10 VREG Configuration

The VREGEN connection of the voltage regulator is tied internally to VDDR such that the voltage regulator is always enabled with VDDR connected to a positive supply voltage. The device must be configured with the internal voltage regulator enabled. Operation in conjunction with an external voltage regulator is not supported. The autonomous periodic interrupt clock output is mapped to PortT[5]. The API trimming register APITR is loaded on rising edge of RESET from the Flash IFR option field at global address 0x40_00F0 bits[5:0] during the reset sequence. Currently factory programming of this IFR range is not supported.

1.10.1 Temperature Sensor Configuration

The VREG high temperature trimming register bits VREGHTTR[3:0] are loaded from the Flash IFR option field at global address 0x40_00F0 bits[11:8] during the reset sequence. To use the high temperature interrupt within the specified limits (T HTIA and THTID) these bits must be programmed to 0x8. Currently factory programming of this IFR range is not supported. Note that the API trimming bits are also loaded from 0x40_00F0[5:0]. The device temperature can be monitored on ADC0 channel[17]. The internal bandgap reference voltage can also be mapped to ADC0 analog input channel[17]. The voltage regulator VSEL bit when set, maps the bandgap and, when clear, maps the temperature sensor to ADC0 channel[17]. Read access to reserved VREG register space returns “0”. Write accesses have no effect. This device does not support access abort of reserved VREG register space.

1.11 BDM Configuration

The BDM alternative clock corresponds to the oscillator clock.

1.12 FlexRay IPLL (CGMIPLL) Configuration

MC9S12XF512 features a dedicated internal PLL for the FlexRay protocol engine. The IPLL hard IP and the register map for the configuration registers is identical to the system IPLL. The usage of an dedicated internal PLL allows to use cheaper crystal devices and to achieve lower radiation.

1.12.1 CGMIPLL function

The CGMIPLL module supplies the clock to the FlexRay controller. The FlexRay controller can only operate according to FlexRay specification when it is supplied with stable 80MHz clock. The CGMIPLL must be configured to provide an 80MHz clock on its output (see Chapter 12, “Clock Generation Module using IPLL (CGMIPLL) Block Description“ for more details) and the FlexRay controller must be

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

80 Freescale Semiconductor

configured to use the CGMIPLL as its clock source (bit CLKSEL in register MCR, see section 13.5.2.4, “Module Configuration Register (MCR)“ for more details). It is the responsibility of the software to ensure that a stable 80MHz clock is supplied to the FlexRay controller while it is enabled. NOTE FlexRay applications have to use the FlexRay IPLL as clock source for the FlexRay protocol engine. The option to use the crystal as clock source is only intended for test purposes. The CGMIPLL has to be configured for 80MHz to guarantee FlexRay functionality. FlexRay needs a stable clock. Make sure the PLL is locked before enabling FlexRay and make sure it remains locked while FlexRay is running. Frequency modulation should be turned off on the FlexRay IPLL.

1.12.2 Entry into and exit from low power modes

To ensure correct entry into stop mode the software should perform the following steps: 1. Shut down the FlexRay Controller (see 13.7.2 Shut Down Sequence for more details) 2. Turn off the CGMIPLL module by clearing the PLLON bit in the CGMCTL register (see section

12.3.2.4 CGMIPLL Control Register (CGMCTL) for more details)

1. Perform additional application specific tasks and enter low power mode Once the microcontroller is woken-up from the low power mode the firmware should perform the following steps: 1. Turn on the CGMIPLL module by setting the PLLON bit in the CGMCTL register 2. Wait for the CGMIPLL to achieve lock by waiting for the LOCK bit in the CGMCTL register to become set 3. Re-initialize the FlexRay controller (see 13.7.1 Initialization Sequence for more details)

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 81

1.13 Oscillator Configuration

The XCLKS is an input signal which controls whether a crystal in combination with the internal loop controlled (low power) Pierce oscillator is used or whether full swing Pierce oscillator/external clock circuitry is used. For this device XCLKS is mapped to PE7. The XCLKS signal selects the oscillator configuration during reset low phase while a clock quality check is ongoing. This is the case for:

• Power on reset or low-voltage reset
• Clock monitor reset
• Any reset while in self-clock mode or full stop mode The selected oscillator configuration is frozen with the rising edge of the RESET pin in any of these above described reset cases. Figure 1-9. Loop Controlled Pierce Oscillator Connections (XCLKS = 1) Figure 1-10. Full Swing Pierce Oscillator Connections (XCLKS = 0) Figure 1-11. External Clock Connections (XCLKS = 0) MCU EXTAL XTAL VSSPLL Crystal or Ceramic Resonator MCU EXTAL XTAL RS RB VSSPLL Crystal or Ceramic Resonator RB=1MΩ ; RS specified by crystal vendor MCU EXTAL XTAL CMOS-Compatible External Oscillator Not Connected

Chapter 1 MC9S12XF-Family Reference Manual MC9S12XF - Family Reference Manual, Rev.1.19

82 Freescale Semiconductor

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 83 Chapter 2 S12XE Clocks and Reset Generator (S12XECRG)

2.1 Introduction

This specification describes the function of the Clocks and Reset Generator (S12XECRG).

2.1.1 Features

The main features of this block are:

• Phase Locked Loop (IPLL) frequency multiplier with internal filter — Reference divider — Post divider — Configurable internal filter (no external pin) — Optional frequency modulation for defined jitter and reduced emission — Automatic frequency lock detector — Interrupt request on entry or exit from locked condition — Self Clock Mode in absence of reference clock
• System Clock Generator — Clock Quality Check — User selectable fast wake-up from Stop in Self-Clock Mode for power saving and immediate program execution — Clock switch for either Oscillator or PLL based system clocks
• Computer Operating Properly (COP) watchdog timer with time-out clear window.
• System Reset generation from the following possible sources: — Power on reset Table 2-1. Revision History Revision Number Revision Date Sections Affected Description of Changes V01.00 26 Oct. 2005 Initial release V01.01 02 Nov 2006 2.4.1.1/2-100 Table “Examples of IPLL Divider settings”: corrected $32 to $31 2.4.3.3/2-107 Corrected details V01.03 1 Sep. 2008 Table 2-14 added 100MHz example for PLL

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

84 Freescale Semiconductor

— Low voltage reset — Illegal address reset — COP reset — Loss of clock reset — External pin reset

• Real-Time Interrupt (RTI)

2.1.2 Modes of Operation

This subsection lists and briefly describes all operating modes supported by the S12XECRG.

• Run Mode All functional parts of the S12XECRG are running during normal Run Mode. If RTI or COP functionality is required the individual bits of the associated rate select registers (COPCTL, RTICTL) have to be set to a non zero value.
• Wait Mode In this mode the IPLL can be disabled automatically depending on the PLLW AI bit.
• Stop Mode Depending on the setting of the PSTP bit Stop Mode can be differentiated between Full Stop Mode (PSTP = 0) and Pseudo Stop Mode (PSTP = 1). — Full Stop Mode The oscillator is disabled and thus all system and core clocks are stopped. The COP and the RTI remain frozen. — Pseudo Stop Mode The oscillator continues to run and most of the system and core clocks are stopped. If the respective enable bits are set the COP and RTI will continue to run, else they remain frozen.
• Self Clock Mode Self Clock Mode will be entered if the Clock Monitor Enable Bit (CME) and the Self Clock Mode Enable Bit (SCME) are both asserted and the clock monitor in the oscillator block detects a loss of clock. As soon as Self Clock Mode is entered the S12XECRG starts to perform a clock quality check. Self Clock Mode remains active until the clock quality check indicates that the required quality of the incoming clock signal is met (frequency and amplitude). Self Clock Mode should be used for safety purposes only. It provides reduced functionality to the MCU in case a loss of clock is causing severe system conditions.

2.1.3 Block Diagram

Figure 2-1 shows a block diagram of the S12XECRG.

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 85 Figure 2-1. Block diagram of S12XECRG

2.2 Signal Description

This section lists and describes the signals that connect off chip.

2.2.1 V DDPLL, VSSPLL

These pins provides operating voltage (VDDPLL) and ground (VSSPLL) for the IPLL circuitry. This allows the supply voltage to the IPLL to be independently bypassed. Even if IPLL usage is not required VDDPLL and VSSPLL must be connected to properly.

2.2.2 RESET

RESET is an active low bidirectional reset pin. As an input it initializes the MCU asynchronously to a known start-up state. As an open-drain output it indicates that an system reset (internal to MCU) has been triggered. ICRG Registers COP RESET RTI IPLL VDDPLL VSSPLL EXTAL XTAL Bus Clock System Reset Oscillator Clock PLLCLK OSCCLK Core Clock CM Fail XCLKS Power on Reset Low Voltage Reset COP Timeout Real Time Interrupt PLL Lock Interrupt Self Clock Mode Interrupt S12X_MMC Illegal Address Reset Reset Generator Clock Quality Checker Clock and Reset Control Voltage Regulator Clock Monitor Oscillator

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

86 Freescale Semiconductor

2.3 Memory Map and Registers

This section provides a detailed description of all registers accessible in the S12XECRG.

2.3.1 Module Memory Map

Figure 2-2 gives an overview on all S12XECRG registers. NOTE Register Address = Base Address + Address Offset, where the Base Address is defined at the MCU level and the Address Offset is defined at the module level. Address Name Bit 7 6 5 4 3 2 1 Bit 0 0x0000 SYNR R VCOFRQ[1:0] SYNDIV[5:0] W 0x0001 REFDV R REFFRQ[1:0] REFDIV[5:0] W 0x0002 POSTDIV R0 0 0 POSTDIV[4:0] W 0x0003 CRGFLG R RTIF PORF LVRF LOCKIF LOCK ILAF SCMIF SCM W 0x0004 CRGINT R RTIE LOCKIE SCMIE W 0x0005 CLKSEL R PLLSEL PSTP XCLKS 0 PLLWAI RTIWAI COPWAI W 0x0006 PLLCTL R CME PLLON FM1 FM0 FSTWKP PRE PCE SCME W 0x0007 RTICTL R RTDEC RTR6 RTR5 RTR4 RTR3 RTR2 RTR1 RTR0 W 0x0008 COPCTL R WCOP RSBCK 00 0 CR2 CR1 CR0 W WRTMASK 0x0009 FORBYP 2 R 0 0 0 000 0 0 W 0x000A CTCTL 2 R 0 0 0 000 0 0 W 0x000B ARMCOP R 0 0 0 000 0 0 W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 2. FORBYP and CTCTL are intended for factory test purposes only. = Unimplemented or Reserved Figure 2-2. CRG Register Summary

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 87

2.3.2 Register Descriptions

This section describes in address order all the S12XECRG registers and their individual bits.

2.3.2.1 S12XECRG Synthesizer Register (SYNR)

The SYNR register controls the multiplication factor of the IPLL and selects the VCO frequency range. Read: Anytime Write: Anytime except if PLLSEL = 1 NOTE Write to this register initializes the lock detector bit. NOTE fVCO must be within the specified VCO frequency lock range. F.BUS (Bus Clock) must not exceed the specified maximum. If POSTDIV = $00 then f PLL is same as fVCO (divide by one). The VCOFRQ[1:0] bit are used to configure the VCO gain for optimal stability and lock time. For correct IPLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK frequency as shown inTable 2-2. Setting the VCOFRQ[1:0] bits wrong can result in a non functional IPLL (no locking and/or insufficient stability). Module Base + 0x0000 76543210 R VCOFRQ[1:0] SYNDIV[5:0] W Reset 0 0 0 00000 Figure 2-3. S12XECRG Synthesizer Register (SYNR) Table 2-2. VCO Clock Frequency Selection VCOCLK Frequency Ranges VCOFRQ[1:0] 32MHz <= fVCO<= 48MHz 00 48MHz < fVCO<= 80MHz 01 Reserved 10 80MHz < fVCO <= 120MHz 11 fVCO 2f OSC× SYNDIV 1+() fPLL fVCO fBUS fPLL

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

88 Freescale Semiconductor

2.3.2.2 S12XECRG Reference Divider Register (REFDV)

The REFDV register provides a finer granularity for the IPLL multiplier steps. Read: Anytime Write: Anytime except when PLLSEL = 1 NOTE Write to this register initializes the lock detector bit. The REFFRQ[1:0] bit are used to configure the internal PLL filter for optimal stability and lock time. For correct IPLL operation the REFFRQ[1:0] bits have to be selected according to the actual REFCLK frequency as shown inFigure 2-3. Setting the REFFRQ[1:0] bits wrong can result in a non functional IPLL (no locking and/or insufficient stability).

2.3.2.3 S12XECRG Post Divider Register (POSTDIV)

The POSTDIV register controls the frequency ratio between the VCOCLK and PLLCLK. The count in the final divider divides VCOCLK frequency by 1 or 2*POSTDIV. Note that if POSTDIV = $00 f PLL=f VCO (divide by one). Module Base + 0x0001 76543210 R REFFRQ[1:0] REFDIV[5:0] W Reset 0 0 0 00000 Figure 2-4. S12XECRG Reference Divider Register (REFDV) Table 2-3. Reference Clock Frequency Selection REFCLK Frequency Ranges REFFRQ[1:0] 1MHz <= fREF <= 2MHz 00 2MHz < fREF <= 6MHz 01 6MHz < fREF <= 12MHz 10 fREF >12MHz 11 fREF fOSC

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 89 Read: Anytime Write: Anytime except if PLLSEL = 1 NOTE If POSTDIV = $00 then fPLL is identical to fVCO (divide by one).

2.3.2.4 S12XECRG Flags Register (CRGFLG)

This register provides S12XECRG status bits and flags. Read: Anytime Write: Refer to each bit for individual write conditions Module Base + 0x0002 76543210 R 000 POSTDIV[4:0] W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 2-5. S12XECRG Post Divider Register (POSTDIV) Module Base + 0x0003 76543210 R RTIF PORF LVRF LOCKIF LOCK ILAF SCMIF SCM W Reset 0 Note 1 Note 2 Note 3 0000 1. PORF is set to 1 when a power on reset occurs. Unaffected by system reset. 2. LVRF is set to 1 when a low voltage reset occurs. Unaffected by system reset. 3. ILAF is set to 1 when an illegal address reset occurs. Unaffected by system reset. Cleared by power on or low voltage reset. = Unimplemented or Reserved Figure 2-6. S12XECRG Flags Register (CRGFLG) fPLL fVCO

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

90 Freescale Semiconductor

2.3.2.5 S12XECRG Interrupt Enable Register (CRGINT)

This register enables S12XECRG interrupt requests. Table 2-4. CRGFLG Field Descriptions Field Description RTIF Real Time Interrupt Flag— RTIF is set to 1 at the end of the RTI period. This flag can only be cleared by writing a 1. Writing a 0 has no effect. If enabled (RTIE=1), RTIF causes an interrupt request. 0 RTI time-out has not yet occurred. 1 RTI time-out has occurred. PORF Power on Reset Flag— PORF is set to 1 when a power on reset occurs. This flag can only be cleared by writing a 1. Writing a 0 has no effect. 0 Power on reset has not occurred. 1 Power on reset has occurred. LVRF Low Voltage Reset Flag — LVRF is set to 1 when a low voltage reset occurs. This flag can only be cleared by writing a 1. Writing a 0 has no effect. 0 Low voltage reset has not occurred. 1 Low voltage reset has occurred. LOCKIF IPLL Lock Interrupt Flag — LOCKIF is set to 1 when LOCK status bit changes. This flag can only be cleared by writing a 1. Writing a 0 has no effect.If enabled (LOCKIE=1), LOCKIF causes an interrupt request. 0 No change in LOCK bit. 1 LOCK bit has changed. LOCK Lock Status Bit— LOCK reflects the current state of IPLL lock condition. This bit is cleared in Self Clock Mode. Writes have no effect. 0 VCOCLK is not within the desired tolerance of the target frequency. 1 VCOCLK is within the desired tolerance of the target frequency. ILAF Illegal Address Reset Flag — ILAF is set to 1 when an illegal address reset occurs. Refer to S12XMMC Block Guide for details. This flag can only be cleared by writing a 1. Writing a 0 has no effect. 0 Illegal address reset has not occurred. 1 Illegal address reset has occurred. SCMIF Self Clock Mode Interrupt Flag — SCMIF is set to 1 when SCM status bit changes. This flag can only be cleared by writing a 1. Writing a 0 has no effect. If enabled (SCMIE=1), SCMIF causes an interrupt request. 0 No change in SCM bit. 1 SCM bit has changed. SCM Self Clock Mode Status Bit — SCM reflects the current clocking mode. Writes have no effect. 0 MCU is operating normally with OSCCLK available. 1 MCU is operating in Self Clock Mode with OSCCLK in an unknown state. All clocks are derived from PLLCLK running at its minimum frequency f SCM. Module Base + 0x0004 76543210 R RTIE LOCKIE SCMIE W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 2-7. S12XECRG Interrupt Enable Register (CRGINT)

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 91 Read: Anytime Write: Anytime

2.3.2.6 S12XECRG Clock Select Register (CLKSEL)

This register controls S12XECRG clock selection. Refer toFigure 2-16 for more details on the effect of each bit. Read: Anytime Write: Refer to each bit for individual write conditions Table 2-5. CRGINT Field Descriptions Field Description RTIE Real Time Interrupt Enable Bit 0 Interrupt requests from RTI are disabled. 1 Interrupt will be requested whenever RTIF is set. LOCKIE Lock Interrupt Enable Bit 0 LOCK interrupt requests are disabled. 1 Interrupt will be requested whenever LOCKIF is set. SCMIE Self Clock Mode Interrupt Enable Bit 0 SCM interrupt requests are disabled. 1 Interrupt will be requested whenever SCMIF is set. Module Base + 0x0005 76543210 R PLLSEL PSTP XCLKS 0 PLLWAI RTIWAI COPWAI W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 2-8. S12XECRG Clock Select Register (CLKSEL)

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

92 Freescale Semiconductor

2.3.2.7 S12XECRG IPLL Control Register (PLLCTL)

This register controls the IPLL functionality. Table 2-6. CLKSEL Field Descriptions Field Description PLLSEL PLL Select Bit Write: Anytime. Writing a one when LOCK=0 has no effect. This prevents the selection of an unstable PLLCLK as SYSCLK. PLLSEL bit is cleared when the MCU enters Self Clock Mode, Stop Mode or Wait Mode with PLLWAI bit set. It is recommended to read back the PLLSEL bit to make sure PLLCLK has really been selected as SYSCLK, as LOCK status bit could theoretically change at the very moment writing the PLLSEL bit.

0 System clocks are derived from OSCCLK (f

BUS = fOSC / 2). 1 System clocks are derived from PLLCLK (f BUS = fPLL / 2). PSTP Pseudo Stop Bit Write: Anytime This bit controls the functionality of the oscillator during Stop Mode. 0 Oscillator is disabled in Stop Mode. 1 Oscillator continues to run in Stop Mode (Pseudo Stop). Note: Pseudo Stop Mode allows for faster STOP recovery and reduces the mechanical stress and aging of the resonator in case of frequent STOP conditions at the expense of a slightly increased power consumption. XCLKS Oscillator Configuration Status Bit — This read-only bit shows the oscillator configuration status. 0 Loop controlled Pierce Oscillator is selected. 1 External clock / full swing Pierce Oscillator is selected. PLLWAI PLL Stops in Wait Mode Bit Write: Anytime If PLLWAI is set, the S12XECRG will clear the PLLSEL bit before entering Wait Mode. The PLLON bit remains set during Wait Mode but the IPLL is powered down. Upon exiting Wait Mode, the PLLSEL bit has to be set manually if PLL clock is required. 0 IPLL keeps running in Wait Mode. 1 IPLL stops in Wait Mode. RTIWAI RTI Stops in Wait Mode Bit Write: Anytime 0 RTI keeps running in Wait Mode. 1 RTI stops and initializes the RTI dividers whenever the part goes into Wait Mode. COPWAI COP Stops in Wait Mode Bit Normal modes: Write once Special modes: Write anytime 0 COP keeps running in Wait Mode. 1 COP stops and initializes the COP counter whenever the part goes into Wait Mode. Module Base + 0x0006 76543210 R CME PLLON FM1 FM0 FSTWKP PRE PCE SCME W Reset 1 1 0 00001 Figure 2-9. S12XECRG IPLL Control Register (PLLCTL)

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 93 Read: Anytime Write: Refer to each bit for individual write conditions Table 2-7. PLLCTL Field Descriptions Field Description CME Clock Monitor Enable Bit — CME enables the clock monitor. Write anytime except when SCM = 1. 0 Clock monitor is disabled. 1 Clock monitor is enabled. Slow or stopped clocks will cause a clock monitor reset sequence or Self Clock Mode. Note: Operating with CME=0 will not detect any loss of clock. In case of poor clock quality this could cause unpredictable operation of the MCU! In Stop Mode (PSTP=0) the clock monitor is disabled independently of the CME bit setting and any loss of external clock will not be detected. Also after wake-up from stop mode (PSTP = 0) with fast wake-up enabled (FSTWKP = 1) the clock monitor is disabled independently of the CME bit setting and any loss of external clock will not be detected. PLLON Phase Lock Loop On Bit — PLLON turns on the IPLL circuitry. In Self Clock Mode, the IPLL is turned on, but the PLLON bit reads the last written value. Write anytime except when PLLSEL = 1. 0 IPLL is turned off. 1 IPLL is turned on. 5, 4 FM1, FM0 IPLL Frequency Modulation Enable Bit — FM1 and FM0 enable additional frequency modulation on the VCOCLK. This is to reduce noise emission. The modulation frequency is f ref divided by 16. Write anytime except when PLLSEL = 1. See Table 2-8 for coding. FSTWKP Fast Wake-up from Full Stop Bit— FSTWKP enables fast wake-up from full stop mode. Write anytime. If Self- Clock Mode is disabled (SCME = 0) this bit has no effect. 0 Fast wake-up from full stop mode is disabled. 1 Fast wake-up from full stop mode is enabled. When waking up from full stop mode the system will immediately resume operation in Self-Clock Mode (seeSection 2.4.1.4, “Clock Quality Checker”). The SCMIF flag will not be set. The system will remain in Self-Clock Mode with oscillator and clock monitor disabled until FSTWKP bit is cleared. The clearing of FSTWKP will start the oscillator, the clock monitor and the clock quality check. If the clock quality check is successful, the S12XECRG will switch all system clocks to OSCCLK. The SCMIF flag will be set. See application examples in Figure 2-19 and Figure 2-20. PRE RTI Enable During Pseudo Stop Bit — PRE enables the RTI during Pseudo Stop Mode. Write anytime. 0 RTI stops running during Pseudo Stop Mode. 1 RTI continues running during Pseudo Stop Mode. Note: If the PRE bit is cleared the RTI dividers will go static while Pseudo Stop Mode is active. The RTI dividers will not initialize like in Wait Mode with RTIWAI bit set. PCE COP Enable During Pseudo Stop Bit — PCE enables the COP during Pseudo Stop Mode. Write anytime.

0 COP stops running during Pseudo Stop Mode

1 COP continues running during Pseudo Stop Mode

Note: If the PCE bit is cleared the COP dividers will go static while Pseudo Stop Mode is active. The COP dividers will not initialize like in Wait Mode with COPWAI bit set. SCME Self Clock Mode Enable Bit Normal modes: Write once Special modes: Write anytime SCME can not be cleared while operating in Self Clock Mode (SCM = 1). 0 Detection of crystal clock failure causes clock monitor reset (see Section 2.5.1.1, “Clock Monitor Reset”). 1 Detection of crystal clock failure forces the MCU in Self Clock Mode (see Section 2.4.2.2, “Self Clock Mode”).

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

94 Freescale Semiconductor

2.3.2.8 S12XECRG RTI Control Register (RTICTL)

This register selects the timeout period for the Real Time Interrupt. Read: Anytime Write: Anytime NOTE A write to this register initializes the RTI counter. Table 2-8. FM Amplitude selection FM1 FM0 FM Amplitude / fVCO Variation 0 0 FM off 01 ±1% 10 ±2% 11 ±4% Module Base + 0x0007 76543210 R RTDEC RTR6 RTR5 RTR4 RTR3 RTR2 RTR1 RTR0 W Reset 0 0 0 00000 Figure 2-10. S12XECRG RTI Control Register (RTICTL) Table 2-9. RTICTL Field Descriptions Field Description RTDEC Decimal or Binary Divider Select Bit — RTDEC selects decimal or binary based prescaler values. 0 Binary based divider value. See Table 2-10 1 Decimal based divider value. See Table 2-11 6–4 RTR[6:4] Real Time Interrupt Prescale Rate Select Bits — These bits select the prescale rate for the RTI. See Table 2- 10 and Table 2-11. 3–0 RTR[3:0] Real Time Interrupt Modulus Counter Select Bits — These bits select the modulus counter target value to provide additional granularity.Table 2-10 and Table 2-11 show all possible divide values selectable by the RTICTL register. The source clock for the RTI is OSCCLK. Table 2-10. RTI Frequency Divide Rates for RTDEC = 0 RTR[3:0] RTR[6:4] = 000 (OFF) 001 (210) 010 (211) 011 (212) 100 (213) 101 (214) 110 (215) 111 (216) 0000 (÷1) OFF(1) 210 211 212 213 214 215 216

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 95 0001 (÷2) OFF 2x2 10 2x211 2x212 2x213 2x214 2x215 2x216 0010 (÷3) OFF 3x2 10 3x211 3x212 3x213 3x214 3x215 3x216 0011 (÷4) OFF 4x2 10 4x211 4x212 4x213 4x214 4x215 4x216 0100 (÷5) OFF 5x2 10 5x211 5x212 5x213 5x214 5x215 5x216 0101 (÷6) OFF 6x2 10 6x211 6x212 6x213 6x214 6x215 6x216 0110 (÷7) OFF 7x2 10 7x211 7x212 7x213 7x214 7x215 7x216 0111 (÷8) OFF 8x2 10 8x211 8x212 8x213 8x214 8x215 8x216 1000 (÷9) OFF 9x2 10 9x211 9x212 9x213 9x214 9x215 9x216 1001 (÷10) OFF 10x2 10 10x211 10x212 10x213 10x214 10x215 10x216 1010 (÷11) OFF 11x2 10 11x211 11x212 11x213 11x214 11x215 11x216 1011 (÷12) OFF 12x2 10 12x211 12x212 12x213 12x214 12x215 12x216 1100 (÷13) OFF 13x2 10 13x211 13x212 13x213 13x214 13x215 13x216 1101 (÷14) OFF 14x2 10 14x211 14x212 14x213 14x214 14x215 14x216 1110 (÷15) OFF 15x2 10 15x211 15x212 15x213 15x214 15x215 15x216 1111 (÷16) OFF 16x2 10 16x211 16x212 16x213 16x214 16x215 16x216 1. Denotes the default value out of reset.This value should be used to disable the RTI to ensure future backwards compatibility. Table 2-11. RTI Frequency Divide Rates for RTDEC=1 RTR[3:0] RTR[6:4] = 000 (1x103) 001 (2x103) 010 (5x103) 011 (10x103) 100 (20x103) 101 (50x103) 110 (100x103) 111 (200x103) 0000 (÷1) 1x103 2x103 5x103 10x103 20x103 50x103 100x103 200x103 0001 (÷2) 2x103 4x103 10x103 20x103 40x103 100x103 200x103 400x103 0010 (÷3) 3x103 6x103 15x103 30x103 60x103 150x103 300x103 600x103 0011 (÷4) 4x103 8x103 20x103 40x103 80x103 200x103 400x103 800x103 0100 (÷5) 5x103 10x103 25x103 50x103 100x103 250x103 500x103 1x106 0101 (÷6) 6x103 12x103 30x103 60x103 120x103 300x103 600x103 1.2x106 Table 2-10. RTI Frequency Divide Rates for RTDEC = 0 RTR[3:0] RTR[6:4] = 000 (OFF) 001 (210) 010 (211) 011 (212) 100 (213) 101 (214) 110 (215) 111 (216)

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

96 Freescale Semiconductor

2.3.2.9 S12XECRG COP Control Register (COPCTL)

This register controls the COP (Computer Operating Properly) watchdog. Read: Anytime Write: 1. RSBCK: anytime in special modes; write to “1” but not to “0” in all other modes 2. WCOP, CR2, CR1, CR0: — Anytime in special modes — Write once in all other modes – Writing CR[2:0] to “000” has no effect, but counts for the “write once” condition. – Writing WCOP to “0” has no effect, but counts for the “write once” condition. 0110 (÷7) 7x103 14x103 35x103 70x103 140x103 350x103 700x103 1.4x106 0111 (÷8) 8x103 16x103 40x103 80x103 160x103 400x103 800x103 1.6x106 1000 (÷9) 9x103 18x103 45x103 90x103 180x103 450x103 900x103 1.8x106 1001 (÷10) 10 x103 20x103 50x103 100x103 200x103 500x103 1x106 2x106 1010 (÷11) 11 x103 22x103 55x103 110x103 220x103 550x103 1.1x106 2.2x106 1011 (÷12) 12x103 24x103 60x103 120x103 240x103 600x103 1.2x106 2.4x106 1100 (÷13) 13x103 26x103 65x103 130x103 260x103 650x103 1.3x106 2.6x106 1101 (÷14) 14x103 28x103 70x103 140x103 280x103 700x103 1.4x106 2.8x106 1110 (÷15) 15x103 30x103 75x103 150x103 300x103 750x103 1.5x106 3x106 1111 (÷16) 16x103 32x103 80x103 160x103 320x103 800x103 1.6x106 3.2x106 Module Base + 0x0008 76543210 R WCOP RSBCK 000 CR2 CR1 CR0 W WRTMASK Reset1 00000000 1. Refer to Device User Guide (Section: S12XECRG) for reset values of WCOP, CR2, CR1 and CR0. = Unimplemented or Reserved Figure 2-11. S12XECRG COP Control Register (COPCTL) Table 2-11. RTI Frequency Divide Rates for RTDEC=1 RTR[3:0] RTR[6:4] = 000 (1x103) 001 (2x103) 010 (5x103) 011 (10x103) 100 (20x103) 101 (50x103) 110 (100x103) 111 (200x103)

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 97 The COP time-out period is restarted if one these two conditions is true: 1. Writing a non zero value to CR[2:0] (anytime in special modes, once in all other modes) with WRTMASK = 0. or 2. Changing RSBCK bit from “0” to “1”. Table 2-12. COPCTL Field Descriptions Field Description WCOP Window COP Mode Bit— When set, a write to the ARMCOP register must occur in the last 25% of the selected period. A write during the first 75% of the selected period will reset the part. As long as all writes occur during this window, $55 can be written as often as desired. Once $AA is written after the $55, the time-out logic restarts and the user must wait until the next window before writing to ARMCOP. Table 2-13 shows the duration of this window for the seven available COP rates.

0 Normal COP operation

1 Window COP operation

COP and RTI Stop in Active BDM Mode Bit 0 Allows the COP and RTI to keep running in Active BDM mode. 1 Stops the COP and RTI counters whenever the part is in Active BDM mode. WRTMASK Write Mask for WCOP and CR[2:0] Bit— This write-only bit serves as a mask for the WCOP and CR[2:0] bits while writing the COPCTL register. It is intended for BDM writing the RSBCK without touching the contents of WCOP and CR[2:0].

0 Write of WCOP and CR[2:0] has an effect with this write of COPCTL

1 Write of WCOP and CR[2:0] has no effect with this write of COPCTL. (Does not count for “write once”.) 2–0 CR[2:0] COP Watchdog Timer Rate Select — These bits select the COP time-out rate (see Table 2-13). Writing a nonzero value to CR[2:0] enables the COP counter and starts the time-out period. A COP counter time-out causes a system reset. This can be avoided by periodically (before time-out) reinitialize the COP counter via the ARMCOP register. While all of the following four conditions are true the CR[2:0], WCOP bits are ignored and the COP operates at highest time-out period ( 2 24 cycles) in normal COP mode (Window COP mode disabled): 1) COP is enabled (CR[2:0] is not 000) 2) BDM mode active 3) RSBCK = 0 4) Operation in emulation or special modes Table 2-13. COP Watchdog Rates(1) CR2 CR1 CR0 OSCCLK Cycles to Timeout 0 0 0 COP disabled 001 2 14 010 2 16 011 2 18 100 2 20 101 2 22 110 2 23

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

98 Freescale Semiconductor

2.3.2.10 Reserved Register (FORBYP)

This reserved register is designed for factory test purposes only, and is not intended for general user access. Writing to this register when in special modes can alter the S12XECRG’s functionality. Read: Always read $00 except in special modes Write: Only in special modes

2.3.2.11 Reserved Register (CTCTL)

This reserved register is designed for factory test purposes only, and is not intended for general user access. Writing to this register when in special test modes can alter the S12XECRG’s functionality. Read: Always read $00 except in special modes 111 2 24 1. OSCCLK cycles are referenced from the previous COP time-out reset (writing $55/$AA to the ARMCOP register) Module Base + 0x0009 76543210 R 00000000 W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 2-12. Reserved Register (FORBYP) Module Base + 0x000A 76543210 R 00000000 W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 2-13. Reserved Register (CTCTL) Table 2-13. COP Watchdog Rates(1) CR2 CR1 CR0 OSCCLK Cycles to Timeout

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 99 Write: Only in special modes

2.3.2.12 S12XECRG COP Timer Arm/Reset Register (ARMCOP)

This register is used to restart the COP time-out period. Read: Always reads $00 Write: Anytime When the COP is disabled (CR[2:0] = “000”) writing to this register has no effect. When the COP is enabled by setting CR[2:0] nonzero, the following applies: Writing any value other than $55 or $AA causes a COP reset. To restart the COP time-out period you must write $55 followed by a write of $AA. Other instructions may be executed between these writes but the sequence ($55, $AA) must be completed prior to COP end of time-out period to avoid a COP reset. Sequences of $55 writes or sequences of $AA writes are allowed. When the WCOP bit is set, $55 and $AA writes must be done in the last 25% of the selected time-out period; writing any value in the first 75% of the selected period will cause a COP reset. Module Base + 0x000B 76543210 R 00000000 W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Reset 0 0 0 00000 Figure 2-14. S12XECRG ARMCOP Register Diagram

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

100 Freescale Semiconductor

2.4 Functional Description

2.4.1 Functional Blocks

2.4.1.1 Phase Locked Loop with Internal Filter (IPLL)

The IPLL is used to run the MCU from a different time base than the incoming OSCCLK. Figure 2-15 shows a block diagram of the IPLL. Figure 2-15. IPLL Functional Diagram For increased flexibility, OSCCLK can be divided in a range of 1 to 64 to generate the reference frequency REFCLK using the REFDIV[5:0] bits. This offers a finer multiplication granularity. Based on the SYNDIV[5:0] bits the IPLL generates the VCOCLK by multiplying the reference clock by a multiple of to 62 to generate the PLLCLK. NOTE Although it is possible to set the dividers to command a very high clock frequency, do not exceed the specified bus frequency limit for the MCU. If (PLLSEL = 1) then fBUS = fPLL / 2. IF POSTDIV = $00 the fPLL is identical to fVCO (divide by one) Several examples of IPLL divider settings are shown in Table 2-14. Shaded rows indicated that these settings are not recommended. The following rules help to achieve optimum stability and shortest lock time:

• Use lowest possible f VCO / fREF ratio (SYNDIV value).
• Use highest possible REFCLK frequency f REF. REDUCED CONSUMPTION OSCILLATOR EXTAL XTAL OSCCLK PLLCLK REFERENCE PROGRAMMABLE DIVIDER PDET PHASE DETECTOR REFDIV[5:0] LOOP PROGRAMMABLE DIVIDER SYNDIV[5:0] VCO LOCK UP DOWN LOCK DETECTOR REFCLK FBCLK VDDPLL/VSSPLL CLOCK MONITOR VDDPLL/VSSPLL VDD/VSS Supplied by: CPUMP AND FILTER POST PROGRAMMABLE DIVIDER POSTDIV[4:0] VCOCLK fPLL 2f OSC SYNDIV 1+

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 101

2.4.1.1.1 IPLL Operation

The oscillator output clock signal (OSCCLK) is fed through the reference programmable divider and is divided in a range of 1 to 64 (REFDIV+1) to output the REFCLK. The VCO output clock, (VCOCLK) is fed back through the programmable loop divider and is divided in a range of 2 to 128 in increments of [2 x (SYNDIV +1)] to output the FBCLK. The VCOCLK is fed to the final programmable divider and is The phase detector then compares the FBCLK, with the REFCLK. Correction pulses are generated based on the phase difference between the two signals. The loop filter then slightly alters the DC voltage on the internal filter capacitor, based on the width and direction of the correction pulse. The user must select the range of the REFCLK frequency and the range of the VCOCLK frequency to ensure that the correct IPLL loop bandwidth is set. The lock detector compares the frequencies of the FBCLK, and the REFCLK. Therefore, the speed of the lock detector is directly proportional to the reference clock frequency. The circuit determines the lock condition based on this comparison. If IPLL LOCK interrupt requests are enabled, the software can wait for an interrupt request and then check the LOCK bit. If interrupt requests are disabled, software can poll the LOCK bit continuously (during IPLL start-up, usually) or at periodic intervals. In either case, only when the LOCK bit is set, the PLLCLK can be selected as the source for the system and core clocks. If the IPLL is selected as the source for the system and core clocks and the LOCK bit is clear, the IPLL has suffered a severe noise hit and the software must take appropriate action, depending on the application.

• The LOCK bit is a read-only indicator of the locked state of the IPLL.
• The LOCK bit is set when the VCO frequency is within a certain tolerance, ∆ Lock, and is cleared when the VCO frequency is out of a certain tolerance, ∆unl.
• Interrupt requests can occur if enabled (LOCKIE = 1) when the lock condition changes, toggling the LOCK bit. Table 2-14. Examples of IPLL Divider Settings fOSC REFDIV[5:0] f REF REFFRQ[1:0] SYNDIV[5:0] f VCO VCOFRQ[1:0] POSTDIV[4:0] f PLL fBUS 4MHz $01 2MHz 01 $18 100MHz 11 $00 100MHz 50 MHz 8MHz $03 2MHz 01 $18 100MHz 11 $00 100MHz 50 MHz 4MHz $00 4MHz 01 $09 80MHz 01 $00 80MHz 40MHz 8MHz $00 8MHz 10 $04 80MHz 01 $00 80MHz 40MHz 4MHz $00 4MHz 01 $03 32MHz 00 $01 16MHz 8MHz 4MHz $01 2MHz 01 $18 100MHz 11 $01 50MHz 25MHz 4MHz $03 1MHz 00 $18 50MHz 01 $00 50MHz 25MHz 4MHz $03 1MHz 00 $31 100MHz 11 $01 50MHz 25MHz

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

102 Freescale Semiconductor

2.4.1.2 System Clocks Generator

Figure 2-16. System Clocks Generator The clock generator creates the clocks used in the MCU (seeFigure 2-16). The gating condition placed on top of the individual clock gates indicates the dependencies of different modes (STOP, W AIT) and the setting of the respective configuration bits. The peripheral modules use the Bus Clock. Some peripheral modules also use the Oscillator Clock. If the MCU enters Self Clock Mode (seeSection 2.4.2.2, “Self Clock Mode”) Oscillator clock source is switched to PLLCLK running at its minimum frequency f SCM. The Bus Clock is used to generate the clock visible at the ECLK pin. The Core Clock signal is the clock for the CPU. The Core Clock is twice the Bus Clock. But note that a CPU cycle corresponds to one Bus Clock. IPLL clock mode is selected with PLLSEL bit in the CLKSEL register. When selected, the IPLL output clock drives SYSCLK for the main system including the CPU and peripherals. The IPLL cannot be turned off by clearing the PLLON bit, if the IPLL clock is selected. When PLLSEL is changed, it takes a maximum of 4 OSCCLK plus 4 PLLCLK cycles to make the transition. During the transition, all clocks freeze and CPU activity ceases. OSCILLATOR PHASE LOCK LOOP (IIPLL) EXTAL XTAL SYSCLK RTIOSCCLK PLLCLK CLOCK PHASE GENERATOR Bus Clock Clock Monitor PLLSEL or SCM Core Clock COP Oscillator = Clock Gate Gating Condition WAIT(RTIWAI), STOP(PSTP, PRE), RTI ENABLE WAIT(COPWAI), STOP(PSTP, PCE), COP ENABLE STOP SCM Clock STOP

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 103

2.4.1.3 Clock Monitor (CM)

If no OSCCLK edges are detected within a certain time, the clock monitor within the oscillator block generates a clock monitor fail event. The S12XECRG then asserts self clock mode or generates a system reset depending on the state of SCME bit. If the clock monitor is disabled or the presence of clocks is detected no failure is indicated by the oscillator block.The clock monitor function is enabled/disabled by the CME control bit.

2.4.1.4 Clock Quality Checker

The clock monitor performs a coarse check on the incoming clock signal. The clock quality checker provides a more accurate check in addition to the clock monitor. A clock quality check is triggered by any of the following events:

• Power on reset ( POR)
• Low voltage reset ( LVR)
• Wake-up from Full Stop Mode ( exit full stop)
• Clock Monitor fail indication ( CM fail) A time window of 50000 PLLCLK cycles 1 is called check window. A number greater equal than 4096 rising OSCCLK edges within acheck windowis called osc ok. Note that osc ok immediately terminates the current check window. See Figure 2-17 as an example. Figure 2-17. Check Window Example 1. IPLL is running at self clock mode frequency fSCM. 12 49999 50000 PLLCLK CHECK WINDOW 12345 4095 4096 OSCCLK OSC OK

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

104 Freescale Semiconductor

The Sequence for clock quality check is shown in Figure 2-18. Figure 2-18. Sequence for Clock Quality Check NOTE Remember that in parallel to additional actions caused by Self Clock Mode or Clock Monitor Reset1 handling the clock quality checker continues to check the OSCCLK signal. NOTE The Clock Quality Checker enables the IPLL and the voltage regulator (VREG) anytime a clock check has to be performed. An ongoing clock quality check could also cause a running IPLL (f SCM) and an active VREG during Pseudo Stop Mode. 1. A Clock Monitor Reset will always set the SCME bit to logical’1’. CHECK WINDOW OSC OK SCM ACTIVE? SWITCH TO OSCCLK EXIT SCM CLOCK OK NUM = 50 NUM > 0 NUM = NUM-1 YES NO YES SCME = 1 NO ENTER SCM SCM ACTIVE? YES CLOCK MONITOR RESET NO YES NO NUM = 0 YES NO POR EXIT FULL STOP CM FAIL LVR SCME=1 & FSTWKP=1 YES NO FSTWKP = 0 NO NUM = 0 ENTER SCM YES

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 105

2.4.1.5 Computer Operating Properly Watchdog (COP)

The COP (free running watchdog timer) enables the user to check that a program is running and sequencing properly. When the COP is being used, software is responsible for keeping the COP from timing out. If the COP times out it is an indication that the software is no longer being executed in the intended sequence; thus a system reset is initiated (see Section 2.4.1.5, “Computer Operating Properly Watchdog (COP)”). The COP runs with a gated OSCCLK. Three control bits in the COPCTL register allow selection of seven COP time-out periods. When COP is enabled, the program must write $55 and $AA (in this order) to the ARMCOP register during the selected time-out period. Once this is done, the COP time-out period is restarted. If the program fails to do this and the COP times out, the part will reset. Also, if any value other than $55 or $AA is written, the part is immediately reset. Windowed COP operation is enabled by setting WCOP in the COPCTL register. In this mode, writes to the ARMCOP register to clear the COP timer must occur in the last 25% of the selected time-out period. A premature write will immediately reset the part. If PCE bit is set, the COP will continue to run in Pseudo Stop Mode.

2.4.1.6 Real Time Interrupt (RTI)

The RTI can be used to generate a hardware interrupt at a fixed periodic rate. If enabled (by setting RTIE=1), this interrupt will occur at the rate selected by the RTICTL register. The RTI runs with a gated OSCCLK. At the end of the RTI time-out period the RTIF flag is set to one and a new RTI time-out period starts immediately. A write to the RTICTL register restarts the RTI time-out period. If the PRE bit is set, the RTI will continue to run in Pseudo Stop Mode.

2.4.2 Operation Modes

2.4.2.1 Normal Mode

The S12XECRG block behaves as described within this specification in all normal modes.

2.4.2.2 Self Clock Mode

If the external clock frequency is not available due to a failure or due to long crystal start-up time, the Bus Clock and the Core Clock are derived from the PLLCLK running at self clock mode frequency fSCM; this mode of operation is called Self Clock Mode. This requires CME = 1 and SCME = 1, which is the default after reset. If the MCU was clocked by the PLLCLK prior to entering Self Clock Mode, the PLLSEL bit will be cleared. If the external clock signal has stabilized again, the S12XECRG will automatically select OSCCLK to be the system clock and return to normal mode. SeeSection 2.4.1.4, “Clock Quality Checker” for more information on entering and leaving Self Clock Mode.

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

106 Freescale Semiconductor

In order to detect a potential clock loss the CME bit should always be enabled (CME = 1). If CME bit is disabled and the MCU is configured to run on PLLCLK, a loss of external clock (OSCCLK) will not be detected and will cause the system clock to drift towards lower frequencies. As soon as the external clock is available again the system clock ramps up to its IPLL target frequency. If the MCU is running on external clock any loss of clock will cause the system to go static.

2.4.3 Low Power Options

This section summarizes the low power options available in the S12XECRG.

2.4.3.1 Run Mode

This is the default mode after reset. The RTI can be stopped by setting the associated rate select bits to zero. The COP can be stopped by setting the associated rate select bits to zero.

2.4.3.2 Wait Mode

The W AI instruction puts the MCU in a low power consumption stand-by mode depending on setting of the individual bits in the CLKSEL register. All individual Wait Mode configuration bits can be superposed. This provides enhanced granularity in reducing the level of power consumption during Wait Mode. Table 2-15 lists the individual configuration bits and the parts of the MCU that are affected in Wait Mode. After executing the W AI instruction the core requests the S12XECRG to switch MCU into Wait Mode. The S12XECRG then checks whether the PLLW AI bit is asserted. Depending on the configuration the S12XECRG switches the system and core clocks to OSCCLK by clearing the PLLSEL bit and disables the IPLL. There are two ways to restart the MCU from Wait Mode: 1. Any reset 2. Any interrupt Table 2-15. MCU Configuration During Wait Mode PLLWAI RTIWAI COPWAI IPLL Stopped — — RTI — Stopped — COP — — Stopped

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 107

2.4.3.3 Stop Mode

All clocks are stopped in STOP mode, dependent of the setting of the PCE, PRE and PSTP bit. The oscillator is disabled in STOP mode unless the PSTP bit is set. If the PRE or PCE bits are set, the RTI or COP continues to run in Pseudo Stop Mode. In addition to disabling system and core clocks the S12XECRG requests other functional units of the MCU (e.g. voltage-regulator) to enter their individual power saving modes (if available). If the PLLSEL bit is still set when entering Stop Mode, the S12XECRG will switch the system and core clocks to OSCCLK by clearing the PLLSEL bit. Then the S12XECRG disables the IPLL, disables the core clock and finally disables the remaining system clocks. If Pseudo Stop Mode is entered from Self-Clock Mode the S12XECRG will continue to check the clock quality until clock check is successful. In this case the IPLL and the voltage regulator (VREG) will remain enabled. If Full Stop Mode (PSTP = 0) is entered from Self-Clock Mode the ongoing clock quality check will be stopped. A complete timeout window check will be started when Stop Mode is left again. There are two ways to restart the MCU from Stop Mode: 1. Any reset 2. Any interrupt If the MCU is woken-up from Full Stop Mode by an interrupt and the fast wake-up feature is enabled (FSTWKP=1 and SCME=1), the system will immediately (no clock quality check) resume operation in Self-Clock Mode (see Section 2.4.1.4, “Clock Quality Checker”). The SCMIF flag will not be set for this special case. The system will remain in Self-Clock Mode with oscillator disabled until FSTWKP bit is cleared. The clearing of FSTWKP will start the oscillator and the clock quality check. If the clock quality check is successful, the S12XECRG will switch all system clocks to oscillator clock. The SCMIF flag will be set. See application examples in Figure 2-19 and Figure 2-20. Because the IPLL has been powered-down during Stop Mode the PLLSEL bit is cleared and the MCU runs on OSCCLK after leaving Stop-Mode. The software must manually set the PLLSEL bit again, in order to switch system and core clocks to the PLLCLK. NOTE In Full Stop Mode or Self-Clock Mode caused by the fast wake-up feature the clock monitor and the oscillator are disabled.

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

108 Freescale Semiconductor

Figure 2-19. Fast Wake-up from Full Stop Mode: Example 1 Figure 2-20. Fast Wake-up from Full Stop Mode: Example 2

2.5 Resets

All reset sources are listed in Table 2-16. Refer to MCU specification for related vector addresses and priorities. Table 2-16. Reset Summary Reset Source Local Enable Power on Reset None Low Voltage Reset None External Reset None Illegal Address Reset None Clock Monitor Reset PLLCTL (CME=1, SCME=0) Oscillator Clock PLL Clock Core Clock Instruction STOP IRQ serviceFSTWKP=1 IRQ service STOP STOP IRQ service Oscillator Disabled Power Saving Self-Clock Mode SCME=1 CPU resumes program execution immediately Interrupt Interrupt Interrupt Oscillator Clock PLL Clock Core Clock Instruction Clock Quality Check STOP IRQ Service FSTWKP=1 IRQ Interrupt FSTWKP=0 SCMIE=1 Osc StartupOscillator Disabled CPU resumes program execution immediately Self-Clock Mode SCME=1 Frequent Uncritical Instructions Frequent Critical Instructions Possible SCM Interrupt

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 109

2.5.1 Description of Reset Operation

The reset sequence is initiated by any of the following events:

• Low level is detected at the RESET pin (External Reset).
• Power on is detected.
• Low voltage is detected.
• Illegal Address Reset is detected (see S12XMMC Block Guide for details).
• COP watchdog times out.
• Clock monitor failure is detected and Self-Clock Mode was disabled (SCME=0). Upon detection of any reset event, an internal circuit drives the RESET pin low for 128 SYSCLK cycles (see Figure 2-21). Since entry into reset is asynchronous it does not require a running SYSCLK. However, the internal reset circuit of the S12XECRG cannot sequence out of current reset condition without a running SYSCLK. The number of 128 SYSCLK cycles might be increased by n = 3 to 6 additional SYSCLK cycles depending on the internal synchronization latency. After 128+n SYSCLK cycles the RESET pin is released. The reset generator of the S12XECRG waits for additional 64 SYSCLK cycles and then samples the RESET pin to determine the originating source. Table 2-17 shows which vector will be fetched. NOTE External circuitry connected to the RESET pin should be able to raise the signal to a valid logic one within 64 SYSCLK cycles after the low drive is released by the MCU. If this requirement is not adhered to the reset source will always be recognized as “External Reset” even if the reset was initially caused by an other reset source. COP Watchdog Reset COPCTL (CR[2:0] nonzero) Table 2-17. Reset Vector Selection Sampled RESET Pin (64 cycles after release) Clock Monitor Reset Pending COP Reset Pending Vector Fetch 1 0 0 POR / LVR / Illegal Address Reset/ External Reset 1 1 X Clock Monitor Reset 1 0 1 COP Reset

0 X X POR / LVR /

Illegal Address Reset/ External Reset with rise of RESET pin Table 2-16. Reset Summary Reset Source Local Enable

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

110 Freescale Semiconductor

The internal reset of the MCU remains asserted while the reset generator completes the 192 SYSCLK long reset sequence. In case the RESET pin is externally driven low for more than these 192 SYSCLK cycles (External Reset), the internal reset remains asserted longer. Figure 2-21. RESET Timing

2.5.1.1 Clock Monitor Reset

The S12XECRG generates a Clock Monitor Reset in case all of the following conditions are true:

• Clock monitor is enabled (CME = 1)
• Loss of clock is detected
• Self-Clock Mode is disabled (SCME = 0). The reset event asynchronously forces the configuration registers to their default settings. In detail the CME and the SCME are reset to logical ‘1’ (which changes the state of the SCME bit. As a consequence the S12XECRG immediately enters Self Clock Mode and starts its internal reset sequence. In parallel the clock quality check starts. As soon as clock quality check indicates a valid Oscillator Clock the S12XECRG switches to OSCCLK and leaves Self Clock Mode. Since the clock quality checker is running in parallel to the reset generator, the S12XECRG may leave Self Clock Mode while still completing the internal reset sequence.

2.5.1.2 Computer Operating Properly Watchdog (COP) Reset

When COP is enabled, the S12XECRG expects sequential write of $55 and $AA (in this order) to the ARMCOP register during the selected time-out period. Once this is done, the COP time-out period restarts. If the program fails to do this the S12XECRG will generate a reset.

2.5.1.3 Power On Reset, Low Voltage Reset

The on-chip voltage regulator detects when VDD to the MCU has reached a certain level and asserts power on reset or low voltage reset or both. As soon as a power on reset or low voltage reset is triggered the ) ( ) ( SYSCLK 128+n cycles 64 cycles with n being min 3 / max 6 cycles depending on internal synchronization delay ICRG drives RESET pin low possibly SYSCLK not running possibly RESET driven low externally RESET RESET pin released

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 111 S12XECRG performs a quality check on the incoming clock signal. As soon as clock quality check indicates a valid Oscillator Clock signal the reset sequence starts using the Oscillator clock. If after 50 check windows the clock quality check indicated a non-valid Oscillator Clock the reset sequence starts using Self-Clock Mode. Figure 2-22 and Figure 2-23 show the power-up sequence for cases when the RESET pin is tied to VDD and when the RESET pin is held low. Figure 2-22. RESET Pin Tied to VDD (by a Pull-up Resistor) Figure 2-23. RESET Pin Held Low Externally

2.6 Interrupts

The interrupts/reset vectors requested by the S12XECRG are listed in Table 2-18. Refer to MCU specification for related vector addresses and priorities. Table 2-18. S12XECRG Interrupt Vectors Interrupt Source CCR Mask Local Enable Real time interrupt I bit CRGINT (RTIE) LOCK interrupt I bit CRGINT (LOCKIE) SCM interrupt I bit CRGINT (SCMIE) RESET Internal POR

128 SYSCLK

64 SYSCLKInternal RESET

(no Self-Clock Mode) ) ( ) ( ) ( Clock Quality Check RESET Internal POR Internal RESET

64 SYSCLK

(no Self Clock Mode) ) ( ) ( ) (

Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) MC9S12XF - Family Reference Manual, Rev.1.19

112 Freescale Semiconductor

2.6.1 Description of Interrupt Operation

2.6.1.1 Real Time Interrupt

The S12XECRG generates a real time interrupt when the selected interrupt time period elapses. RTI interrupts are locally disabled by setting the RTIE bit to zero. The real time interrupt flag (RTIF) is set to1 when a timeout occurs, and is cleared to 0 by writing a 1 to the RTIF bit. The RTI continues to run during Pseudo Stop Mode if the PRE bit is set to 1. This feature can be used for periodic wakeup from Pseudo Stop if the RTI interrupt is enabled.

2.6.1.2 IPLL Lock Interrupt

The S12XECRG generates a IPLL Lock interrupt when the LOCK condition of the IPLL has changed, either from a locked state to an unlocked state or vice versa. Lock interrupts are locally disabled by setting the LOCKIE bit to zero. The IPLL Lock interrupt flag (LOCKIF) is set to1 when the LOCK condition has changed, and is cleared to 0 by writing a 1 to the LOCKIF bit.

2.6.1.3 Self Clock Mode Interrupt

The S12XECRG generates a Self Clock Mode interrupt when the SCM condition of the system has changed, either entered or exited Self Clock Mode. SCM conditions are caused by a failing clock quality check after power on reset (POR) or low voltage reset (LVR) or recovery from Full Stop Mode (PSTP = 0) or Clock Monitor failure. For details on the clock quality check refer toSection 2.4.1.4, “Clock Quality Checker”. If the clock monitor is enabled (CME = 1) a loss of external clock will also cause a SCM condition (SCME = 1). SCM interrupts are locally disabled by setting the SCMIE bit to zero. The SCM interrupt flag (SCMIF) is set to1 when the SCM condition has changed, and is cleared to 0 by writing a 1 to the SCMIF bit.

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 113 Chapter 3 Voltage Regulator (S12VREGL3V3V1) Table 3-1. Revision History Table

3.1 Introduction

Module VREG_3V3 is a tri output voltage regulator that provides two separate 1.84V (typical) supplies differing in the amount of current that can be sourced and a 2.82V (typical) supply. The regulator input voltage range is from 3.3V up to 5V (typical).

3.1.1 Features

Module VREG_3V3 includes these distinctive features:

• Three parallel, linear voltage regulators with bandgap reference
• Low-voltage detect (LVD) with low-voltage interrupt (LVI)
• Power-on reset (POR)
• Low-voltage reset (LVR)
• High Temperature Detect (HTD) with High Temperature Interrupt (HTI)
• Autonomous periodical interrupt (API)

3.1.2 Modes of Operation

There are three modes VREG_3V3 can operate in: 1. Full performance mode (FPM) (MCU is not in stop mode) The regulator is active, providing the nominal supply voltages with full current sourcing capability. Features LVD (low-voltage detect), LVR (low-voltage reset), and POR (power-on reset) and HTD (High Temperature Detect) are available. The API is available. 2. Reduced power mode (RPM) (MCU is in stop mode) The purpose is to reduce power consumption of the device. The output voltage may degrade to a lower value than in full performance mode, additionally the current sourcing capability is substantially reduced. Only the POR is available in this mode, LVD, LVR and HTD are disabled. The API is available. Rev. No. (Item No.) Date (Submitted By) Sections Affected Substantial Change(s) V01.02 09 Sep 2005 Updates for API external access and LVR flags. V01.03 23 Sep 2005 VAE reset value is 1. V01.04 08 Jun 2007 Added temperature sensor to customer information

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

114 Freescale Semiconductor

1. Shutdown mode Controlled by VREGEN (see device level specification for connectivity of VREGEN). This mode is characterized by minimum power consumption. The regulator outputs are in a high- impedance state, only the POR feature is available, LVD, LVR and HTD are disabled. The API internal RC oscillator clock is not available. This mode must be used to disable the chip internal regulator VREG_3V3, i.e., to bypass the VREG_3V3 to use external supplies.

3.1.3 Block Diagram

Figure 3-1 shows the function principle of VREG_3V3 by means of a block diagram. The regulator core REG consists of three parallel subblocks, REG1, REG2 and REG3, providing three independent output voltages.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 115 Figure 3-1. VREG_3V3 Block Diagram LVRLVD POR VDDR VDD LVI PORLVR CTRL VSS VDDPLL VSSPLL VREGEN REG PIN VDDA REG: Regulator Core CTRL: Regulator Control LVD: Low Voltage Detect LVR: Low Voltage Reset POR: Power-on Reset HTD: High Temperature Detect C HTI HTD API API API: Auto. Periodical Interrupt VBG API Rate Select Bus Clock REG2 REG1 REG3 VDDF VSSA VDDX

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

116 Freescale Semiconductor

3.2 External Signal Description

Due to the nature of VREG_3V3 being a voltage regulator providing the chip internal power supply voltages, most signals are power supply signals connected to pads. Table 3-2 shows all signals of VREG_3V3 associated with pins. NOTE Check device level specification for connectivity of the signals.

3.2.1 VDDR — Regulator Power Input Pins

Signal VDDR is the power input of VREG_3V3. All currents sourced into the regulator loads flow through this pin. A chip external decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDR and VSSR (if VSSR is not available VSS) can smooth ripple on VDDR. For entering Shutdown Mode, pin VDDR should also be tied to ground on devices without VREGEN pin.

3.2.2 VDDA, VSSA — Regulator Reference Supply Pins

Signals VDDA/VSSA, which are supposed to be relatively quiet, are used to supply the analog parts of the regulator. Internal precision reference circuits are supplied from these signals. A chip external decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDA and VSSA can further improve the quality of this supply.

3.2.3 VDD, VSS — Regulator Output1 (Core Logic) Pins

Signals VDD/VSS are the primary outputs of VREG_3V3 that provide the power supply for the core logic. These signals are connected to device pins to allow external decoupling capacitors (220 nF, X7R ceramic). Table 3-2. Signal Properties Name Function Reset State Pull Up VDDR Power input (positive supply) — — VDDA Quiet input (positive supply) — — VSSA Quiet input (ground) — — VDDX Power input (positive supply) — — VDD Primary output (positive supply) — — VSS Primary output (ground) — — VDDF Secondary output (positive supply) — — VDDPLL Tertiary output (positive supply) — — VSSPLL Tertiary output (ground) — — VREGEN (optional) Optional Regulator Enable — — VREG_API (optional) VREG Autonomous Periodical Interrupt output

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 117 In Shutdown Mode an external supply driving VDD/VSS can replace the voltage regulator.

3.2.4 VDDF — Regulator Output2 (NVM Logic) Pins

Signals VDDF/VSS are the secondary outputs of VREG_3V3 that provide the power supply for the NVM logic. These signals are connected to device pins to allow external decoupling capacitors (220 nF, X7R ceramic). In Shutdown Mode an external supply driving VDDF/VSS can replace the voltage regulator.

3.2.5 VDDPLL, VSSPLL — Regulator Output3 (PLL) Pins

Signals VDDPLL/VSSPLL are the secondary outputs of VREG_3V3 that provide the power supply for the PLL and oscillator. These signals are connected to device pins to allow external decoupling capacitors (100 nF...220 nF, X7R ceramic). In Shutdown Mode, an external supply driving VDDPLL/VSSPLL can replace the voltage regulator.

3.2.6 VDDX — Power Input Pin

Signals VDDX/VSS are monitored by VREG_3V3 with the LVR feature.

3.2.7 VREGEN — Optional Regulator Enable Pin

This optional signal is used to shutdown VREG_3V3. In that case, VDD/VSS and VDDPLL/VSSPLL must be provided externally. Shutdown mode is entered with VREGEN being low. If VREGEN is high, the VREG_3V3 is either in Full Performance Mode or in Reduced Power Mode. For the connectivity of VREGEN, see device specification. NOTE Switching from FPM or RPM to shutdown of VREG_3V3 and vice versa is not supported while MCU is powered.

3.2.8 VREG_API — Optional Autonomous Periodical Interrupt Output Pin

This pin provides the signal selected via APIEA if system is set accordingly. See 3.3.2.3, “Autonomous Periodical Interrupt Control Register (VREGAPICL) and 3.4.8, “Autonomous Periodical Interrupt (API) for details. For the connectivity of VREG_API, see device specification.

3.3 Memory Map and Register Definition

This section provides a detailed description of all registers accessible in VREG_3V3. If enabled in the system, the VREG_3V3 will abort all read and write accesses to reserved registers within it’s memory slice. See device level specification for details.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

118 Freescale Semiconductor

3.3.1 Module Memory Map

A summary of the registers associated with the VREG_3V3 sub-block is shown in Table 3-3. Detailed descriptions of the registers and bits are given in the subsections that follow Address Name Bit 7 6 54321 Bit 0 0x02F0 VREGHTCL R0 0 VSEL VAE HTEN HTDS HTIE HTIFW 0x02F1 VREGCTRL R 00000 L V D S LVIE LVIFW 0x02F2 VREGAPIC L R APICLK 00 APIFES APIEA APIFE APIE APIFW 0x02F3 VREGAPIT R R APITR5 APITR4 APITR3 APITR2 APITR1 APITR0 00 W 0x02F4 VREGAPIR H R APIR15 APIR14 APIR13 APIR12 APIR11 APIR10 APIR9 APIR8W 0x02F5 VREGAPIR L R APIR7 APIR6 APIR5 APIR4 APIR3 APIR2 APIR1 APIR0W 0x02F6 Reserved R 00000000 W 0x02F7 VREGHTTR R HTOEN 000 HTTR3 HTTR2 HTTR1 HTTR0W Table 3-3. Register Summary

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 119

3.3.2 Register Descriptions

This section describes all the VREG_3V3 registers and their individual bits.

3.3.2.1 HT Control Register (VREGHTCL)

3.3.2.2 Control Register (VREGCTRL)

The VREGCTRL register allows the configuration of the VREG_3V3 low-voltage detect features. 0x02F0 76543210 R0 0 VSEL VAE HTEN HTDS HTIE HTIFW Reset 0 0 0 10000 = Unimplemented or Reserved Table 3-4. VREGHTCL Field Descriptions Field Description 7, 6 Reserved These reserved bits are used for test purposes and writable only in special modes. They must remain clear for correct temperature sensor operation. VSEL Voltage Access Select Bit — If set, the bandgap reference voltage V BG can be accessed internally (i.e. multiplexed to an internal Analog to Digital Converter channel). . The internal access must be enabled by bit VAE. See device level specification for connectivity. 0 An internal voltage can be accessed internally if VAE is set.

1 Bandgap reference voltage V

BG can be accessed internally if VAE is set. VAE Voltage Access Enable Bit — If set, the voltage selected by bit VSEL can be accessed internally (i.e. multiplexed to an internal Analog to Digital Converter channel). See device level specification for connectivity. 0 Voltage selected by VSEL can not be accessed internally (i.e. External analog input is connected to Analog to Digital Converter channel). 1 Voltage selected by VSEL can be accessed internally. HTEN High Temperature Enable Bit — If set the temperature sense is enabled. 0 The temperature sense is disabled. 1 The temperature sense is enabled. HTDS High Temperature Detect Status Bit —

0 Temperature T

DIE is below level THTID or RPM or Shutdown Mode. 1 Temperature T DIE is above level THTIA and FPM. HTIE High Temperature Interrupt Enable Bit 0 Interrupt request is disabled. 1 Interrupt will be requested whenever HTIF is set. HTIF High Temperature Interrupt Flag — 0 No change in HTDS bit. 1 HTDS bit has changed. Note: On entering the reduced power mode the HTIF is not cleared by the VREG.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

120 Freescale Semiconductor

W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 3-2. Control Register (VREGCTRL) Table 3-5. VREGCTRL Field Descriptions Field Description LVDS Low-Voltage Detect Status Bit — This read-only status bit reflects the input voltage. Writes have no effect. 0 Input voltage V DDA is above level VLVID or RPM or shutdown mode. 1 Input voltage V DDA is below level VLVIA and FPM. LVIE Low-Voltage Interrupt Enable Bit 0 Interrupt request is disabled. 1 Interrupt will be requested whenever LVIF is set. LVIF Low-Voltage Interrupt Flag— LVIF is set to 1 when LVDS status bit changes. This flag can only be cleared by writing a 1. Writing a 0 has no effect. If enabled (LVIE = 1), LVIF causes an interrupt request. 0 No change in LVDS bit. 1 LVDS bit has changed. Note: On entering the Reduced Power Mode the LVIF is not cleared by the VREG_3V3.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 121

3.3.2.3 Autonomous Periodical Interrupt Control Register (VREGAPICL)

The VREGAPICL register allows the configuration of the VREG_3V3 autonomous periodical interrupt features. 0x02F2 76543210 R APICLK APIES APIEA APIFE APIE APIF W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 3-3. Autonomous Periodical Interrupt Control Register (VREGAPICL) Table 3-6. VREGAPICL Field Descriptions Field Description APICLK Autonomous Periodical Interrupt Clock Select Bit — Selects the clock source for the API. Writable only if APIFE = 0; APICLK cannot be changed if APIFE is set by the same write operation. 0 Autonomous periodical interrupt clock used as source. 1 Bus clock used as source. APIES Autonomous Periodical Interrupt External Select Bit— Selects the waveform at the external pin.If set, at the external pin a clock is visible with 2 times the selected API Period (Table 3-10). If not set, at the external pin will be a high pulse at the end of every selected period with the size of half of the min period (Table 3-10). See device level specification for connectivity. 0 At the external periodic high pulses are visible, if APIEA and APIFE is set. 1 At the external pin a clock is visible, if APIEA and APIFE is set. APIEA Autonomous Periodical Interrupt External Access Enable Bit— If set, the waveform selected by bit APIES can be accessed externally. See device level specification for connectivity. 0 Waveform selected by APIES can not be accessed externally. 1 Waveform selected by APIES can be accessed externally, if APIFE is set. APIFE Autonomous Periodical Interrupt Feature Enable Bit — Enables the API feature and starts the API timer when set. 0 Autonomous periodical interrupt is disabled. 1 Autonomous periodical interrupt is enabled and timer starts running. APIE Autonomous Periodical Interrupt Enable Bit 0 API interrupt request is disabled. 1 API interrupt will be requested whenever APIF is set. APIF Autonomous Periodical Interrupt Flag — APIF is set to 1 when the in the API configured time has elapsed. This flag can only be cleared by writing a 1 to it. Clearing of the flag has precedence over setting. Writing a 0 has no effect. If enabled (APIE = 1), APIF causes an interrupt request. 0 API timeout has not yet occurred. 1 API timeout has occurred.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

122 Freescale Semiconductor

3.3.2.4 Autonomous Periodical Interrupt Trimming Register (VREGAPITR)

The VREGAPITR register allows to trim the API timeout period. 0x02F3 76543210 R APITR5 APITR4 APITR3 APITR2 APITR1 APITR0 W Reset 0 1 01 01 01 01 01 00 1. Reset value is either 0 or preset by factory. See Section 1 (Device Overview) for details. = Unimplemented or Reserved Figure 3-4. Autonomous Periodical Interrupt Trimming Register (VREGAPITR) Table 3-7. VREGAPITR Field Descriptions Field Description 7–2 APITR[5:0] Autonomous Periodical Interrupt Period Trimming Bits — See Table 3-8 for trimming effects. Table 3-8. Trimming Effect of APIT Bit Trimming Effect APITR[5] Increases period APITR[4] Decreases period less than APITR[5] increased it APITR[3] Decreases period less than APITR[4] APITR[2] Decreases period less than APITR[3] APITR[1] Decreases period less than APITR[2] APITR[0] Decreases period less than APITR[1]

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 123

3.3.2.5 Autonomous Periodical Interrupt Rate High and Low Register

(VREGAPIRH / VREGAPIRL) The VREGAPIRH and VREGAPIRL register allows the configuration of the VREG_3V3 autonomous periodical interrupt rate. 0x02F4 76543210 R APIR15 APIR14 APIR13 APIR12 APIR11 APIR10 APIR9 APIR8 W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 3-5. Autonomous Periodical Interrupt Rate High Register (VREGAPIRH) 0x02F5 76543210 R APIR7 APIR6 APIR5 APIR4 APIR3 APIR2 APIR1 APIR0 W Reset 0 0 0 00000 Figure 3-6. Autonomous Periodical Interrupt Rate Low Register (VREGAPIRL) Table 3-9. VREGAPIRH / VREGAPIRL Field Descriptions Field Description 15-0 APIR[15:0] Autonomous Periodical Interrupt Rate Bits — These bits define the timeout period of the API. See Table 3- 10 for details of the effect of the autonomous periodical interrupt rate bits. Writable only if APIFE = 0 of VREGAPICL register.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

124 Freescale Semiconductor

The period can be calculated as follows depending of APICLK: Period = 2*(APIR[15:0] + 1) * 0.1 ms or period = 2*(APIR[15:0] + 1) * bus clock period Table 3-10. Selectable Autonomous Periodical Interrupt Periods APICLK APIR[15:0] Selected Period 0 0000 0.2 ms (1) 1. When trimmed within specified accuracy. See electrical specifications for details. 0 0001 0.4 ms 1 0 0002 0.6 ms 1 0 0003 0.8 ms 1 0 0004 1.0 ms 1 0 0005 1.2 ms 1 0 FFFD 13106.8 ms 1 0 FFFE 13107.0 ms 1 0 FFFF 13107.2 ms 1 1 0000 2 * bus clock period 1 0001 4 * bus clock period 1 0002 6 * bus clock period 1 0003 8 * bus clock period 1 0004 10 * bus clock period 1 0005 12 * bus clock period

1 FFFD 131068 * bus clock period

1 FFFE 131070 * bus clock period

1 FFFF 131072 * bus clock period

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 125

3.3.2.6 Reserved 06

The Reserved 06 is reserved for test purposes.

3.3.2.7 HTTrimming Register (VREGHTTR)

The VREGHTTR register allows to trim the VREGL3V3 temperature sense. Fiption Table 3-12. Trimming Effect 0x02F6 76543210 R 00000000 W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 3-7. Reserved 06 0x02F7 76543210 R HTOEN 000 HTTR3 HTTR2 HTTR1 HTTR0 W Reset 0 0 0 0 0 1 01 01 01 1. Reset value is either 0 or preset by factory. See Section 1 (Device Overview) for details. = Unimplemented or Reserved Figure 3-8. VREGHTTR Table 3-11. VREGHTTR field descriptions Field Description HTOEN High Temperature Offeset Enable Bit — 01 3–0 HTTR[3:0] High Temperature Trimming Bits — See Table 3-12 for trimming effects. Bit Trimming Effect HTTR[3] Increases V HT twice of HTTR[2] HTTR[2] Increases V HT twice of HTTR[1] HTTR[1] Increases V HT twice of HTTR[0] HTTR[0] Increases V HT (to compensate Temperature Offset)

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

126 Freescale Semiconductor

3.4 Functional Description

3.4.1 General

Module VREG_3V3 is a voltage regulator, as depicted in Figure 3-1. The regulator functional elements are the regulator core (REG), a low-voltage detect module (LVD), a control block (CTRL), a power-on reset module (POR), and a low-voltage reset module (LVR).

3.4.2 Regulator Core (REG)

Respectively its regulator core has three parallel, independent regulation loops (REG1,REG2 and REG3). REG1 and REG3 differ only in the amount of current that can be delivered. The regulators are linear regulator with a bandgap reference when operated in Full Performance Mode. They act as a voltage clamp in Reduced Power Mode. All load currents flow from input VDDR to VSS or VSSPLL. The reference circuits are supplied by VDDA and VSSA.

3.4.2.1 Full Performance Mode

In Full Performance Mode, the output voltage is compared with a reference voltage by an operational amplifier. The amplified input voltage difference drives the gate of an output transistor.

3.4.2.2 Reduced Power Mode

In Reduced Power Mode, the gate of the output transistor is connected directly to a reference voltage to reduce power consumption. Mode switching from reduced power to full performance requires a transition time of t vup, if the voltage regulator is enabled.

3.4.3 Low-Voltage Detect (LVD)

Subblock LVD is responsible for generating the low-voltage interrupt (LVI). LVD monitors the input voltage (V DDA–VSSA) and continuously updates the status flag LVDS. Interrupt flag LVIF is set whenever status flag LVDS changes its value. The LVD is available in FPM and is inactive in Reduced Power Mode or Shutdown Mode.

3.4.4 Power-On Reset (POR)

This functional block monitors VDD. If VDD is below VPORD, POR is asserted; if VDD exceeds VPORD, the POR is deasserted. POR asserted forces the MCU into Reset. POR Deasserted will trigger the power- on sequence.

3.4.5 Low-Voltage Reset (LVR)

Block LVR monitors the supplies VDD, VDDX and VDDF. If one (or more) drops below it’s corresponding assertion level, signal LVR asserts; if all VDD,VDDX and VDDF supplies are above their

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 127 corresponding deassertion levels, signal LVR deasserts. The LVR function is available only in Full Performance Mode.

3.4.6 HTD - High Temperature Detect

Subblock HTD is responsible for generating the high temperature interrupt (HTI). HTD monitors the die temperature T DIE and continuously updates the status flag HTDS. Interrupt flag HTIF is set whenever status flag HTDS changes its value. The HTD is available in FPM and is inactive in Reduced Power Mode and Shutdown Mode. The HT Trimming bits HTTR[3:0] can be set so that the temperature offset is zero, if accurate temperature measurement is desired. See Table 22-12 for the trimming effect of APITR.

3.4.7 Regulator Control (CTRL)

This part contains the register block of VREG_3V3 and further digital functionality needed to control the operating modes. CTRL also represents the interface to the digital core logic.

3.4.8 Autonomous Periodical Interrupt (API)

Subblock API can generate periodical interrupts independent of the clock source of the MCU. To enable the timer, the bit APIFE needs to be set. The API timer is either clocked by a trimmable internal RC oscillator or the bus clock. Timer operation will freeze when MCU clock source is selected and bus clock is turned off. See CRG specification for details. The clock source can be selected with bit APICLK. APICLK can only be written when APIFE is not set. The APIR[15:0] bits determine the interrupt period. APIR[15:0] can only be written when APIFE is cleared. As soon as APIFE is set, the timer starts running for the period selected by APIR[15:0] bits. When the configured time has elapsed, the flag APIF is set. An interrupt, indicated by flag APIF = 1, is triggered if interrupt enable bit APIE = 1. The timer is started automatically again after it has set APIF. The procedure to change APICLK or APIR[15:0] is first to clear APIFE, then write to APICLK or APIR[15:0], and afterwards set APIFE. The API Trimming bits APITR[5:0] must be set so the minimum period equals 0.2 ms if stable frequency is desired. See Table 3-8 for the trimming effect of APITR. NOTE The first period after enabling the counter by APIFE might be reduced by API start up delay t sdel. The API internal RC oscillator clock is not available if VREG_3V3 is in Shutdown Mode.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

128 Freescale Semiconductor

It is possible to generate with the API a waveform at an external pin by enabling the API by setting APIFE and enabling the external access with setting APIEA. By setting APIES the waveform can be selected. If APIES is set, then at the external pin a clock is visible with 2 times the selected API Period (Table 3-10). If APIES is not set, then at the external pin will be a high pulse at the end of every selected period with the size of half of the min period (Table 3-10). See device level specification for connectivity.

3.4.9 Resets

This section describes how VREG_3V3 controls the reset of the MCU.The reset values of registers and signals are provided in Section 3.3, “Memory Map and Register Definition” . Possible reset sources are listed in Table 3-13.

3.4.10 Description of Reset Operation

3.4.10.1 Power-On Reset (POR)

During chip power-up the digital core may not work if its supply voltage VDD is below the POR deassertion level (VPORD). Therefore, signal POR, which forces the other blocks of the device into reset, is kept high until VDD exceeds VPORD. The MCU will run the start-up sequence after POR deassertion. The power-on reset is active in all operation modes of VREG_3V3.

3.4.10.2 Low-Voltage Reset (LVR)

For details on low-voltage reset, see Section 3.4.5, “Low-V oltage Reset (LVR)”.

3.4.11 Interrupts

This section describes all interrupts originated by VREG_3V3. The interrupt vectors requested by VREG_3V3 are listed in Table 3-14. Vector addresses and interrupt priorities are defined at MCU level. Table 3-13. Reset Sources Reset Source Local Enable Power-on reset Always active Low-voltage reset Available only in Full Performance Mode Table 3-14. Interrupt Vectors Interrupt Source Local Enable Low-voltage interrupt (LVI) LVIE = 1; available only in Full Performance Mode High Temperature Interrupt (HTI) HTIE=1; available only in Full Performance Mode Autonomous periodical interrupt (API) APIE = 1

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 129

3.4.11.1 Low-Voltage Interrupt (LVI)

In FPM, VREG_3V3 monitors the input voltage VDDA. Whenever VDDA drops below level VLVIA, the status bit LVDS is set to 1. On the other hand, LVDS is reset to 0 when VDDA rises above level VLVID.A n interrupt, indicated by flag LVIF = 1, is triggered by any change of the status bit LVDS if interrupt enable bit LVIE = 1. NOTE On entering the Reduced Power Mode, the LVIF is not cleared by the VREG_3V3.

3.4.11.2 HTI - High Temperature Interrupt

In FPM VREGL3V3 monitors the die temperature TDIE. Whenever TDIE exceeds level THTIA the status bit HTDS is set to 1. Vice versa, HTDS is reset to 0 when TDIE get below level THTID. An interrupt, indicated by flag HTIF=1, is triggered by any change of the status bit HTDS if interrupt enable bit HTIE=1. NOTE On entering the Reduced Power Mode the HTIF is not cleared by the VREGL3V3.

3.4.11.3 Autonomous Periodical Interrupt (API)

As soon as the configured timeout period of the API has elapsed, the APIF bit is set. An interrupt, indicated by flag APIF = 1, is triggered if interrupt enable bit APIE = 1.

Chapter 3 Voltage Regulator (S12VREGL3V3V1) MC9S12XF - Family Reference Manual, Rev.1.19

130 Freescale Semiconductor

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 131 Chapter 4

4.1 Introduction

The FTM384K2 module implements the following:

• 384 Kbytes of P-Flash (Program Flash) memory, consisting of 2 physical Flash blocks, intended primarily for nonvolatile code storage
• 32 Kbytes of D-Flash (Data Flash) memory, consisting of 1 physical Flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated EEPROM, as basic Flash memory primarily intended for nonvolatile data storage, or as a combination of both
• 4 Kbytes of buffer RAM, consisting of 1 physical RAM block, that can be used as emulated EEPROM using a built-in hardware scheme, as basic RAM, or as a combination of both Table 4-1. Revision History Revision Number Revision Date Sections Affected Description of Changes V01.10 29 Nov 2007 - Cleanup V01.11 19 Dec 2007 4.4.2/4-167 4.4.2/4-167 4.3.1/4-136 - Updated Command Error Handling tables based on parent-child relationship with FTM512K3 - Corrected Error Handling table for Full Partition D-Flash, Partition D-Flash, and EEPROM Emulation Query commands - Corrected P-Flash IFR Accessibility table V01.12 25 Sep 2009 4.1/4-131 4.3.2.1/4-143 4.4.2.4/4-170 4.4.2.7/4-173 4.4.2.12/4-177 4.4.2.12/4-177 4.4.2.12/4-177 4.4.2.20/4-186 4.3.2/4-141 4.3.2.1/4-143 4.4.1.2/4-162 4.6/4-192 - Clarify single bit fault correction for P-Flash phrase - Expand FDIV vs OSCCLK Frequency table - Add statement concerning code runaway when executing Read Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Program Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Verify Backdoor Access Key command from Flash block containing associated fields - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” - Add ACCERR condition for Disable EEPROM Emulation command The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: - Add caution concerning register writes while command is active - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during reset sequence

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 132 The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents or configure module resources for emulated EEPROM operation. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The RAM and Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that specific Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected.

4.1.1 Glossary

Buffer RAM — The buffer RAM constitutes the volatile memory store required for EEE. Memory space in the buffer RAM not required for EEE can be partitioned to provide volatile memory space for applications. Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store required for EEE. Memory space in the D-Flash memory not required for EEE can be partitioned to provide nonvolatile memory space for applications. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. EEE (Emulated EEPROM) — A method to emulate the small sector size features and endurance characteristics associated with an EEPROM.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 133 EEE IFR — Nonvolatile information register located in the D-Flash block that contains data required to partition the D-Flash memory and buffer RAM for EEE. The EEE IFR is visible in the global memory map by setting the EEEIFRON bit in the MMCCTL1 register. NVM Command Mode— An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once field. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register.

4.1.2 Features

4.1.2.1 P-Flash Features

• 384 Kbytes of P-Flash memory composed of one 256 Kbyte Flash block and one 128 Kbyte Flash block. The 256 Kbyte Flash block consists of two 128 Kbyte sections each divided into 128 sectors of 1024 bytes. The 128 Kbyte Flash block is divided into 128 sectors of 1024 bytes.
• Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and phrase program operation
• Ability to program up to one phrase in each P-Flash block simultaneously
• Flexible protection scheme to prevent accidental program or erase of P-Flash memory

4.1.2.2 D-Flash Features

• Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access
• Dedicated commands to control access to the D-Flash memory over EEE operation
• Single bit fault correction and double bit fault detection within a word during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and word program operation
• Ability to program up to four words in a burst sequence

4.1.2.3 Emulated EEPROM Features

• Up to 4 Kbytes of emulated EEPROM (EEE) accessible as 4 Kbytes of RAM
• Flexible protection scheme to prevent accidental program or erase of data

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

134 Freescale Semiconductor

• Automatic EEE file handling using an internal Memory Controller
• Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset
• Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory
• Ability to disable EEE operation and allow priority access to the D-Flash memory
• Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory

4.1.2.4 User Buffer RAM Features

• Up to 4 Kbytes of RAM for user access

4.1.2.5 Other Flash Module Features

• No external high-voltage power supply required for Flash memory program and erase operations
• Interrupt generation on Flash command completion and Flash error detection
• Security mechanism to prevent unauthorized access to the Flash memory

4.1.3 Block Diagram

The block diagram of the Flash module is shown in Figure 4-1.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 135 Figure 4-1. FTM384K2 Block Diagram

4.2 External Signal Description

The Flash module contains no signals that connect off-chip. Oscillator Clock Divider Clock (XTAL) Command Interrupt Request FCLK Protection Security Registers Flash Interface P-Flash Block 0 32Kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 P-Flash sector 0 sector 1 sector 127 16Kx72 16bit internal bus Block 1 XGATE 16Kx72 16Kx72 Error Interrupt Request CPU Memory Controller D-Flash 16Kx22 Buffer RAM Tag RAM 128x16 2Kx16 sector 0 sector 1 sector 127 Scratch RAM 512x16

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

136 Freescale Semiconductor

4.3 Memory Map and Registers

This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module.

4.3.1 Module Memory Map

The S12X architecture places the P-Flash memory between global addresses 0x78_0000 and 0x7F_FFFF as shown in Table 4-2. The P-Flash memory map is shown in Figure 4-2. The FPROT register, described inSection 4.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 4-3. Table 4-2. P-Flash Memory Addressing Global Address Size (Bytes) Description 0x7C_0000 – 0x7F_FFFF 256 K P-Flash Block 0 Contains Flash Configuration Field (see Table 4-3) 0x7A_0000 – 0x7B_FFFF 128 K No P-Flash Memory 0x78_0000 – 0x79_FFFF 128 K P-Flash Block 1 Table 4-3. Flash Configuration Field(1) Global Address Size (Bytes) Description 0x7F_FF00 – 0x7F_FF07 8 Backdoor Comparison Key Refer to Section 4.4.2.12, “Verify Backdoor Access Key Command,” and Section 4.5.1, “Unsecuring the MCU using Backdoor Key Access” 0x7F_FF08 – 0x7F_FF0B(2) 4 Reserved 0x7F_FF0C2 1 P-Flash Protection byte. Refer to Section 4.3.2.9, “P-Flash Protection Register (FPROT)” 0x7F_FF0D2 1 EEE Protection byte Refer to Section 4.3.2.10, “EEE Protection Register (EPROT)” 0x7F_FF0E2 1 Flash Nonvolatile byte Refer to Section 4.3.2.14, “Flash Option Register (FOPT)”

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 137 0x7F_FF0F2 1 Flash Security byte Refer to Section 4.3.2.2, “Flash Security Register (FSEC)” 1. Older versions may have swapped protection byte addresses 2. 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved field should be programmed to 0xFF. Table 4-3. Flash Configuration Field(1) Global Address Size (Bytes) Description

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

138 Freescale Semiconductor

Figure 4-2. P-Flash Memory Map Flash Configuration Field 0x7F_C000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_8000 0x7F_9000 0x7F_8400 0x7F_8800 0x7F_A000 P-Flash END = 0x7F_FFFF 0x7F_F800 0x7F_F000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes Flash Protected/Unprotected Region

8 Kbytes (up to 29 Kbytes)

16 bytes (0x7F_FF00 - 0x7F_FF0F) Flash Protected/Unprotected Region

352 Kbytes

P-Flash START = 0x78_0000 0x79_FFFF 0x7C_0000

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 139 Table 4-4. Program IFR Fields Global Address (PGMIFRON) Size (Bytes) Field Description 0x40_0000 – 0x40_0007 8 Device ID 0x40_0008 – 0x40_00E7 224 Reserved 0x40_00E8 – 0x40_00E9 2 Version ID 0x40_00EA – 0x40_00FF 22 Reserved 0x40_0100 – 0x40_013F 64 Program Once Field Refer to Section 4.4.2.7, “Program Once Command” 0x40_0140 – 0x40_01FF 192 Reserved Table 4-5. P-Flash IFR Accessibility Global Address (PGMIFRON) Size (Bytes) Accessed From 0x40_0000 – 0x40_01FF 512 XBUS0 (PBLK0) (1) 1. Refer to Table 4-4 for more details. 0x40_0200 – 0x40_03FF 512 Unimplemented 0x40_0400 – 0x40_05FF 512 Unimplemented 0x40_0600 – 0x40_07FF 512 XBUS1 (PBLK1) Table 4-6. EEE Resource Fields Global Address Size (Bytes) Description 0x10_0000 – 0x10_7FFF 32,768 D-Flash Memory (User and EEE) 0x10_8000 – 0x11_FFFF 98,304 Reserved 0x12_0000 – 0x12_007F 128 EEE Nonvolatile Information Register (EEEIFRON (1) = 1) 1. MMCCTL1 register bit 0x12_0080 – 0x12_0FFF 3,968 Reserved 0x12_1000 – 0x12_1EFF 3,840 Reserved 0x12_1F00 – 0x12_1FFF 256 EEE Tag RAM (TMGRAMON 1 = 1) 0x12_2000 – 0x12_3BFF 7,168 Reserved 0x12_3C00 – 0x12_3FFF 1,024 Memory Controller Scratch RAM (TMGRAMON 1 = 1) 0x12_4000 – 0x12_DFFF 40,960 Reserved 0x12_E000 – 0x12_FFFF 8,192 Reserved 0x13_0000 – 0x13_EFFF 61,440 Reserved 0x13_F000 – 0x13_FFFF 4,096 Buffer RAM (User and EEE)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

140 Freescale Semiconductor

Figure 4-3. EEE Resource Memory Map The Full Partition D-Flash command (see Section 4.4.2.15) is used to program the EEE nonvolatile information register fields where address 0x12_0000 defines the D-Flash partition for user access and address 0x12_0004 defines the buffer RAM partition for EEE operations. Buffer RAM START = 0x13_F000 Buffer RAM END = 0x13_FFFF 0x13_FFC0 0x13_FF80 Protectable Region (EEE only) 64, 128, 192, 256, 320, 384, 448, 512 bytes Buffer RAM

4 Kbytes

0x13_FF40 0x13_FF00 0x13_FEC0 0x13_FE80 0x13_FE40 0x13_FE00 0x12_FFFF 0x12_4000 0x12_1000 Memory Controller Scratch RAM (TMGRAMON) 1024 bytes EEE Tag RAM (TMGRAMON) 256 bytes EEE Nonvolatile Information Register (EEEIFRON) 128 bytes D-Flash Memory

32 Kbytes

D-Flash START = 0x10_0000 D-Flash User Partition D-Flash EEE Partition 0x12_0000 0x12_2000 0x12_E000 D-Flash END = 0x10_7FFF Buffer RAM User Partition Buffer RAM EEE Partition

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 141

4.3.2 Register Descriptions

The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 4-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Table 4-7. EEE Nonvolatile Information Register Fields Global Address (EEEIFRON) Size (Bytes) Description 0x12_0000 – 0x12_0001 2 D-Flash User Partition (DFPART) Refer to Section 4.4.2.15, “Full Partition D-Flash Command” 0x12_0002 – 0x12_0003 2 D-Flash User Partition (duplicate (1)) 1. Duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 – 0x12_0005 2 Buffer RAM EEE Partition (ERPART) Refer to Section 4.4.2.15, “Full Partition D-Flash Command” 0x12_0006 – 0x12_0007 2 Buffer RAM EEE Partition (duplicate 1) 0x12_0008 – 0x12_007F 120 Reserved Address & Name 76543210 0x0000 FCLKDIV R FDIVLD FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W 0x0001 FSEC R KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 W 0x0002 FCCOBIX R0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 W 0x0003 FECCRIX R0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 W 0x0004 FCNFG R CCIE IGNSF FDFD FSFD W 0x0005 FERCNFG R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W Figure 4-4. FTM384K2 Register Summary

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

142 Freescale Semiconductor

R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 W 0x0007 FERSTAT R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W 0x0008 FPROT R FPOPEN RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W 0x0009 EPROT R EPOPEN RNV6 RNV5 RNV4 EPDIS EPS2 EPS1 EPS0 W 0x000A FCCOBHI R CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 W 0x000B FCCOBLO R CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 W 0x000C ETAGHI R ETAG15 ETAG14 ETAG13 ETAG12 ETAG11 ETAG10 ETAG9 ETAG8 W 0x000D ETAGLO R ETAG7 ETAG6 ETAG5 ETAG4 ETAG3 ETAG2 ETAG1 ETAG0 W 0x000E FECCRHI R ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 W 0x000F FECCRLO R ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 W 0x0010 FOPT R NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 W 0x0011 FRSV0 R 00000000 W 0x0012 FRSV1 R 00000000 W 0x0013 FRSV2 R 00000000 W Address & Name 76543210 Figure 4-4. FTM384K2 Register Summary (continued)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 143

4.3.2.1 Flash Clock Divider Register (FCLKDIV)

The FCLKDIV register is used to control timed events in program and erase algorithms. All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. = Unimplemented or Reserved Offset Module Base + 0x0000 76543210 R FDIVLD FDIV[6:0] W Reset 00000000 = Unimplemented or Reserved Figure 4-5. Flash Clock Divider Register (FCLKDIV) Table 4-8. FCLKDIV Field Descriptions Field Description FDIVLD Clock Divider Loaded

0 FCLKDIV register has not been written

1 FCLKDIV register has been written since the last reset

6–0 FDIV[6:0] Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 4-9 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 4.4.1, “Flash Command Operations,” for more information. Address & Name 76543210 Figure 4-4. FTM384K2 Register Summary (continued)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

144 Freescale Semiconductor

Table 4-9. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] MIN(1) 1. FDIV shown generates an FCLK frequency of >0.8 MHz MAX(2) MIN1 MAX2 MIN1 MAX2 33.60 34.65 0x20 67.20 68.25 0x40

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 145

4.3.2.2 Flash Security Register (FSEC)

The FSEC register holds all bits associated with the security of the MCU and Flash module. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 4-3) as indicated by reset condition F in Figure 4-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. 2. FDIV shown generates an FCLK frequency of 1.05 MHz Offset Module Base + 0x0001 76543210 R KEYEN[1:0] RNV[5:2] SEC[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 4-6. Flash Security Register (FSEC) Table 4-10. FSEC Field Descriptions Field Description 7–6 KEYEN[1:0] Backdoor Key Security Enable Bits— The KEYEN[1:0] bits define the enabling of backdoor key access to the Flash module as shown in Table 4-11. 5–2 RNV[5:2} Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. 1–0 SEC[1:0] Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 4-12. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 4-11. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access

00 DISABLED

01 DISABLED (1)

1. Preferred KEYEN state to disable backdoor key access.

10 ENABLED

11 DISABLED

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

146 Freescale Semiconductor

The security function in the Flash module is described in Section 4.5.

4.3.2.3 Flash CCOB Index Register (FCCOBIX)

The FCCOBIX register is used to index the FCCOB register for Flash memory operations. CCOBIX bits are readable and writable while remaining bits read 0 and are not writable.

4.3.2.4 Flash ECCR Index Register (FECCRIX)

The FECCRIX register is used to index the FECCR register for ECC fault reporting. ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. Table 4-12. Flash Security States SEC[1:0] Status of Security

00 SECURED

01 SECURED (1)

1. Preferred SEC state to set MCU to secured state.

10 UNSECURED

11 SECURED

Offset Module Base + 0x0002 76543210 R 00000 CCOBIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 4-7. FCCOB Index Register (FCCOBIX) Table 4-13. FCCOBIX Field Descriptions Field Description 2–0 CCOBIX[1:0] Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. SeeSection 4.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. Offset Module Base + 0x0003 76543210 R 00000 ECCRIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 4-8. FECCR Index Register (FECCRIX)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 147

4.3.2.5 Flash Configuration Register (FCNFG)

The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 4-14. FECCRIX Field Descriptions Field Description 2-0 ECCRIX[2:0] ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is Offset Module Base + 0x0004 76543210 R CCIE IGNSF FDFD FSFD W Reset 00000000 = Unimplemented or Reserved Figure 4-9. Flash Configuration Register (FCNFG) Table 4-15. FCNFG Field Descriptions Field Description CCIE Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed.

0 Command complete interrupt disabled

1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 4.3.2.7) IGNSF Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 4.3.2.8).

0 All single bit faults detected during array reads are reported

1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

148 Freescale Semiconductor

4.3.2.6 Flash Error Configuration Register (FERCNFG)

The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. All assigned bits in the FERCNFG register are readable and writable. FDFD Force Double Bit Fault Detect— The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected

1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see

Section 4.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 4.3.2.6) FSFD Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 4.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 4.3.2.6) Offset Module Base + 0x0005 76543210 R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W Reset 00000000 = Unimplemented or Reserved Figure 4-10. Flash Error Configuration Register (FERCNFG) Table 4-16. FERCNFG Field Descriptions Field Description ERSERIE EEE Erase Error Interrupt Enable— The ERSERIE bit controls interrupt generation when a failure is detected during an EEE erase operation.

0 ERSERIF interrupt disabled

1 An interrupt will be requested whenever the ERSERIF flag is set (see Section 4.3.2.8) PGMERIE EEE Program Error Interrupt Enable — The PGMERIE bit controls interrupt generation when a failure is detected during an EEE program operation.

0 PGMERIF interrupt disabled

1 An interrupt will be requested whenever the PGMERIF flag is set (see Section 4.3.2.8) EPVIOLIE EEE Protection Violation Interrupt Enable — The EPVIOLIE bit controls interrupt generation when a protection violation is detected during a write to the buffer RAM EEE partition.

0 EPVIOLIF interrupt disabled

1 An interrupt will be requested whenever the EPVIOLIF flag is set (see Section 4.3.2.8) Table 4-15. FCNFG Field Descriptions (continued) Field Description

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 149

4.3.2.7 Flash Status Register (FSTAT)

The FSTAT register reports the operational status of the Flash module. CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. ERSVIE1 EEE Error Type 1 Interrupt Enable— The ERSVIE1 bit controls interrupt generation when a change state error is detected during an EEE operation.

0 ERSVIF1 interrupt disabled

1 An interrupt will be requested whenever the ERSVIF1 flag is set (see Section 4.3.2.8) ERSVIE0 EEE Error Type 0 Interrupt Enable— The ERSVIE0 bit controls interrupt generation when a sector format error is detected during an EEE operation.

0 ERSVIF0 interrupt disabled

1 An interrupt will be requested whenever the ERSVIF0 flag is set (see Section 4.3.2.8) DFDIE Double Bit Fault Detect Interrupt Enable— The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation.

0 DFDIF interrupt disabled

1 An interrupt will be requested whenever the DFDIF flag is set (see Section 4.3.2.8) SFDIE Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 4.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 4.3.2.8) Offset Module Base + 0x0006 76543210 R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT[1:0] W Reset 100000 0 (1) 1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 4.6). = Unimplemented or Reserved Figure 4-11. Flash Status Register (FSTAT) Table 4-16. FERCNFG Field Descriptions (continued) Field Description

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

150 Freescale Semiconductor

4.3.2.8 Flash Error Status Register (FERSTAT)

The FERSTAT register reflects the error status of internal Flash operations. All flags in the FERSTAT register are readable and only writable to clear the flag. Table 4-17. FSTAT Field Descriptions Field Description CCIF Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation.

0 Flash command in progress

1 Flash command has completed

Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 4.4.1.2) or issuing an illegal Flash command or when errors are encountered while initializing the EEE buffer ram during the reset sequence. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR.

0 No access error detected

1 Access error detected

Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence.

0 No protection violation detected

1 Protection violation detected

Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller

0 Memory Controller is idle

1 Memory Controller is busy executing a Flash command (CCIF = 0) or is handling internal EEE operations

Reserved Bit — This bit is reserved and always reads 0 . 1–0 MGSTAT[1:0] Memory Controller Command Completion Status Flag— One or more MGSTAT flag bits are set if an error is detected during execution of a Flash command or during the Flash reset sequence. See Section 4.4.2, “Flash Command Description,” andSection 4.6, “Initialization” for details. Offset Module Base + 0x0007 76543210 R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W Reset 00000000 = Unimplemented or Reserved Figure 4-12. Flash Error Status Register (FERSTAT)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 151

4.3.2.9 P-Flash Protection Register (FPROT)

The FPROT register defines which P-Flash sectors are protected against program and erase operations. Table 4-18. FERSTAT Field Descriptions Field Description ERSERIF EEE Erase Error Interrupt Flag — The setting of the ERSERIF flag occurs due to an error in a Flash erase command that resulted in the erase operation not being successful during EEE operations. The ERSERIF flag is cleared by writing a 1 to ERSERIF. Writing a 0 to the ERSERIF flag has no effect on ERSERIF. While ERSERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition.

0 Erase command successfully completed on the D-Flash EEE partition

1 Erase command failed on the D-Flash EEE partition

EEE Program Error Interrupt Flag — The setting of the PGMERIF flag occurs due to an error in a Flash program command that resulted in the program operation not being successful during EEE operations. The PGMERIF flag is cleared by writing a 1 to PGMERIF. Writing a 0 to the PGMERIF flag has no effect on PGMERIF. While PGMERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition.

0 Program command successfully completed on the D-Flash EEE partition

1 Program command failed on the D-Flash EEE partition

EEE Protection Violation Interrupt Flag—The setting of the EPVIOLIF flag indicates an attempt was made to write to a protected area of the buffer RAM EEE partition. The EPVIOLIF flag is cleared by writing a 1 to EPVIOLIF. Writing a 0 to the EPVIOLIF flag has no effect on EPVIOLIF. While EPVIOLIF is set, it is possible to write to the buffer RAM EEE partition as long as the address written to is not in a protected area.

0 No EEE protection violation

1 EEE protection violation detected

EEE Error Interrupt 1 Flag —The setting of the ERSVIF1 flag indicates that the memory controller was unable to change the state of a D-Flash EEE sector. The ERSVIF1 flag is cleared by writing a 1 to ERSVIF1. Writing a 0 to the ERSVIF1 flag has no effect on ERSVIF1. While ERSVIF1 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition.

0 No EEE sector state change error detected

1 EEE sector state change error detected

EEE Error Interrupt 0 Flag —The setting of the ERSVIF0 flag indicates that the memory controller was unable to format a D-Flash EEE sector for EEE use. The ERSVIF0 flag is cleared by writing a 1 to ERSVIF0. Writing a 0 to the ERSVIF0 flag has no effect on ERSVIF0. While ERSVIF0 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition.

0 No EEE sector format error detected

1 EEE sector format error detected

Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.

0 No double bit fault detected

1 Double bit fault detected or an invalid Flash array read operation attempted

Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF.

0 No single bit fault detected

1 Single bit fault detected and corrected or an invalid Flash array read operation attempted

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

152 Freescale Semiconductor

The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 4-3) as indicated by reset condition ‘F’ inFigure 4-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Offset Module Base + 0x0008 76543210 R FPOPEN RNV6 FPHDIS FPHS[1:0] FPLDIS FPLS[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 4-13. Flash Protection Register (FPROT) Table 4-19. FPROT Field Descriptions Field Description FPOPEN Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 4-20 for the P-Flash block.

0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the

corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits RNV[6] Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. FPHDIS Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x7F_FFFF.

0 Protection/Unprotection enabled

1 Protection/Unprotection disabled

4–3 FPHS[1:0] Flash Protection Higher Address Size— The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 4-21. The FPHS bits can only be written to while the FPHDIS bit is set. FPLDIS Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x7F_8000. 1–0 FPLS[1:0] Flash Protection Lower Address Size— The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 4-22. The FPLS bits can only be written to while the FPLDIS bit is set.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 153 All possible P-Flash protection scenarios are shown in Figure 4-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. Table 4-20. P-Flash Protection Function FPOPEN FPHDIS FPLDIS Function (1) 1. For range sizes, refer to Table 4-21 and Table 4-22. 1 1 1 No P-Flash Protection 1 1 0 Protected Low Range 1 0 1 Protected High Range 1 0 0 Protected High and Low Ranges 0 1 1 Full P-Flash Memory Protected 0 1 0 Unprotected Low Range 0 0 1 Unprotected High Range 0 0 0 Unprotected High and Low Ranges Table 4-21. P-Flash Protection Higher Address Range FPHS[1:0] Global Address Range Protected Size 00 0x7F_F800–0x7F_FFFF 2 Kbytes 01 0x7F_F000–0x7F_FFFF 4 Kbytes 10 0x7F_E000–0x7F_FFFF 8 Kbytes 11 0x7F_C000–0x7F_FFFF 16 Kbytes Table 4-22. P-Flash Protection Lower Address Range FPLS[1:0] Global Address Range Protected Size 00 0x7F_8000–0x7F_83FF 1 Kbyte 01 0x7F_8000–0x7F_87FF 2 Kbytes 10 0x7F_8000–0x7F_8FFF 4 Kbytes 11 0x7F_8000–0x7F_9FFF 8 Kbytes

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

154 Freescale Semiconductor

Figure 4-14. P-Flash Protection Scenarios 7 6 5 4 FPHS[1:0] FPLS[1:0]3 2 1 0 FPHS[1:0] FPLS[1:0] FPHDIS = 1 FPLDIS = 1 FPHDIS = 1 FPLDIS = 0 FPHDIS = 0 FPLDIS = 1 FPHDIS = 0 FPLDIS = 0 Scenario Scenario Unprotected region Protected region with size Protected region Protected region with size defined by FPLS defined by FPHSnot defined by FPLS, FPHS 0x7F_8000 0x7F_FFFF 0x7F_8000 0x7F_FFFF FLASH START FLASH START FPOPEN = 1FPOPEN = 0

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 155

4.3.2.9.1 P-Flash Protection Restrictions

The general guideline is that P-Flash protection can only be added and not removed.Table 4-23 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions.

4.3.2.10 EEE Protection Register (EPROT)

The EPROT register defines which buffer RAM EEE partition areas are protected against writes. All bits in the EPROT register are readable and writable except for RNV[6:4] which are only readable. The EPOPEN and EPDIS bits can only be written to the protected state. The EPS bits can be written anytime until the EPDIS bit is cleared. If the EPOPEN bit is cleared, the state of the EPDIS and EPS bits is irrelevant. During the reset sequence, the EPROT register is loaded from the EEE protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 4-3) as indicated by reset condition F in Figure 4-15. To change the EEE protection that will be loaded during the reset sequence, the P-Flash sector containing the EEE protection byte must be unprotected, then the EEE protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase Table 4-23. P-Flash Protection Scenario Transitions From Protection Scenario To Protection Scenario(1) 1. Allowed transitions marked with X, see Figure 4-14 for a definition of the scenarios. 01234567

0 XXXX

5 XXXX

6 XX XX

7 XXXXXXXX

Offset Module Base + 0x0009 76543210 R EPOPEN RNV[6:4] EPDIS EPS[2:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 4-15. EEE Protection Register (EPROT)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

156 Freescale Semiconductor

containing the EEE protection byte during the reset sequence, the EPOPEN bit will be cleared and remaining bits in the EPROT register will be set to leave the buffer RAM EEE partition fully protected. Trying to write data to any protected area in the buffer RAM EEE partition will result in a protection violation error and the EPVIOLIF flag will be set in the FERSTAT register. Trying to write data to any protected area in the buffer RAM partitioned for user access will not be prevented and the EPVIOLIF flag in the FERSTAT register will not set.

4.3.2.11 Flash Common Command Object Register (FCCOB)

The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Table 4-24. EPROT Field Descriptions Field Description EPOPEN Enables writes to the Buffer RAM partitioned for EEE

0 The entire buffer RAM EEE partition is protected from writes

1 Unprotected buffer RAM EEE partition areas are enabled for writes

6–4 RNV[6:4] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements EPDIS Buffer RAM Protection Address Range Disable — The EPDIS bit determines whether there is a protected area in a specific region of the buffer RAM EEE partition.

0 Protection enabled

1 Protection disabled

2–0 EPS[2:0] Buffer RAM Protection Size — The EPS[2:0] bits determine the size of the protected area in the buffer RAM EEE partition as shown inTable 4-21. The EPS bits can only be written to while the EPDIS bit is set. Table 4-25. Buffer RAM EEE Partition Protection Address Range EPS[2:0] Global Address Range Protected Size 000 0x13_FFC0 – 0x13_FFFF 64 bytes 001 0x13_FF80 – 0x13_FFFF 128 bytes 010 0x13_FF40 – 0x13_FFFF 192 bytes 011 0x13_FF00 – 0x13_FFFF 256 bytes 100 0x13_FEC0 – 0x13_FFFF 320 bytes 101 0x13_FE80 – 0x13_FFFF 384 bytes 110 0x13_FE40 – 0x13_FFFF 448 bytes 111 0x13_FE00 – 0x13_FFFF 512 bytes

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 157

4.3.2.11.1 FCCOB - NVM Command Mode

NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown inTable 4-26. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 4-26 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 4.4.2. Offset Module Base + 0x000A 76543210 R CCOB[15:8] W Reset 00000000 Figure 4-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 76543210 R CCOB[7:0] W Reset 00000000 Figure 4-17. Flash Common Command Object Low Register (FCCOBLO) Table 4-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) 000 HI FCMD[7:0] defining Flash command LO 0, Global address [22:16] 001 HI Global address [15:8] LO Global address [7:0] 010 HI Data 0 [15:8] LO Data 0 [7:0]

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

158 Freescale Semiconductor

4.3.2.12 EEE Tag Counter Register (ETAG)

The ETAG register contains the number of outstanding words in the buffer RAM EEE partition that need to be programmed into the D-Flash EEE partition. The ETAG register is decremented prior to the related tagged word being programmed into the D-Flash EEE partition. All tagged words have been programmed into the D-Flash EEE partition once all bits in the ETAG register read 0 and the MGBUSY flag in the FSTAT register reads 0. All ETAG bits are readable but not writable and are cleared by the Memory Controller.

4.3.2.13 Flash ECC Error Results Register (FECCR)

The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (seeSection 4.3.2.4). Once ECC fault information has been stored, no other fault 011 HI Data 1 [15:8] LO Data 1 [7:0] 100 HI Data 2 [15:8] LO Data 2 [7:0] 101 HI Data 3 [15:8] LO Data 3 [7:0] Offset Module Base + 0x000C 76543210 R ETAG[15:8] W Reset 0 0 000000 = Unimplemented or Reserved Figure 4-18. EEE Tag Counter High Register (ETAGHI) Offset Module Base + 0x000D 76543210 R ETAG[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 4-19. EEE Tag Counter Low Register (ETAGLO) Table 4-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 159 information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults, the priority for fault recording is: 1. Double bit fault over single bit fault 2. CPU over XGATE All FECCR bits are readable but not writable. Offset Module Base + 0x000E 76543210 R ECCR[15:8] W Reset 00000000 = Unimplemented or Reserved Figure 4-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 76543210 R ECCR[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 4-21. Flash ECC Error Results Low Register (FECCRLO) Table 4-27. FECCR Index Settings ECCRIX[2:0] FECCR Register Content Bits [15:8] Bit[7] Bits[6:0]

000 Parity bits read from

[22:16]

001 Global address [15:0]

010 Data 0 [15:0]

011 Data 1 [15:0] (P-Flash only)

100 Data 2 [15:0] (P-Flash only)

101 Data 3 [15:0] (P-Flash only)

110 Not used, returns 0x0000 when read

111 Not used, returns 0x0000 when read

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

160 Freescale Semiconductor

The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010.

4.3.2.14 Flash Option Register (FOPT)

The FOPT register is the Flash option register. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 4-3) as indicated by reset condition F in Figure 4-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set.

4.3.2.15 Flash Reserved0 Register (FRSV0)

This Flash register is reserved for factory testing. Table 4-28. FECCR Index=000 Bit Descriptions Field Description 15:8 PAR[7:0] ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. XBUS01 Bus Source Identifier — The XBUS01 bit determines whether the ECC error was caused by a read access from the CPU or XGATE.

0 ECC Error happened on the CPU access

1 ECC Error happened on the XGATE access

6–0 GADDR[22:16] Global Address — The GADDR[22:16] field contains the upper seven bits of the global address having caused the error. Offset Module Base + 0x0010 76543210 R NV[7:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 4-22. Flash Option Register (FOPT) Table 4-29. FOPT Field Descriptions Field Description 7–0 NV[7:0] Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 161 All bits in the FRSV0 register read 0 and are not writable.

4.3.2.16 Flash Reserved1 Register (FRSV1)

This Flash register is reserved for factory testing. All bits in the FRSV1 register read 0 and are not writable.

4.3.2.17 Flash Reserved2 Register (FRSV2)

This Flash register is reserved for factory testing. All bits in the FRSV2 register read 0 and are not writable. Offset Module Base + 0x0011 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 4-23. Flash Reserved0 Register (FRSV0) Offset Module Base + 0x0012 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 4-24. Flash Reserved1 Register (FRSV1) Offset Module Base + 0x0013 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 4-25. Flash Reserved2 Register (FRSV2)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

162 Freescale Semiconductor

4.4 Functional Description

4.4.1 Flash Command Operations

Flash command operations are used to modify Flash memory contents or configure module resources for EEE operation. The next sections describe:

• How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations
• The command write sequence used to set Flash command parameters and launch execution
• Valid Flash commands available for execution

4.4.1.1 Writing the FCLKDIV Register

Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz.Table 4-9 shows recommended values for the FDIV field based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set.

4.4.1.2 Command Write Sequence

The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 4.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 163

4.4.1.2.1 Define FCCOB Contents

The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 4.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 4-26.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

164 Freescale Semiconductor

Figure 4-26. Generic Flash Command Write Sequence Flowchart Write to FCCOBIX register Write: FSTAT register (to launch command) Clear CCIF 0x80 Clear ACCERR/FPVIOL 0x30 Write: FSTAT registeryes no Access Error and Protection Violation Read: FSTAT register Read: FSTAT register no START yes Check CCIF Set? FCCOB ACCERR/ FPVIOL Set? EXIT Write: FCLKDIV register Read: FCLKDIV register yes noClock Register Written Check FDIVLD Set? noBit Polling for Command Completion Check yes CCIF Set? to identify specific command parameter to load. Write to FCCOB register to load required command parameter. yes no More Parameters? Availability Check Results from previous Command Note: FCLKDIV must be set after each reset

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 165

4.4.1.3 Valid Flash Module Commands

Table 4-30. Flash Commands by Mode FCMD Command Unsecured Secured NS (1) 1. Unsecured Normal Single Chip mode. NX (2) 2. Unsecured Normal Expanded mode. SS(3) 3. Unsecured Special Single Chip mode. ST(4) 4. Unsecured Special Mode. NS (5) 5. Secured Normal Single Chip mode. NX (6) 6. Secured Normal Expanded mode. SS(7) 7. Secured Special Single Chip mode. ST(8) 8. Secured Special Mode. 0x03 Erase Verify P-Flash Section ∗∗∗∗∗ 0x05 Load Data Field ∗∗∗∗∗ 0x06 Program P-Flash ∗∗∗∗∗ 0x08 Erase All Blocks ∗∗ ∗∗ 0x09 Erase P-Flash Block ∗∗∗∗∗ 0x0A Erase P-Flash Sector ∗∗∗∗∗ 0x0B Unsecure Flash ∗∗ ∗∗ 0x0C Verify Backdoor Access Key ∗∗ 0x0D Set User Margin Level ∗∗∗∗∗ 0x0E Set Field Margin Level ∗∗ 0x0F Full Partition D-Flash ∗∗ 0x10 Erase Verify D-Flash Section ∗∗∗∗∗ 0x11 Program D-Flash ∗∗∗∗∗ 0x12 Erase D-Flash Sector ∗∗∗∗∗

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

166 Freescale Semiconductor

4.4.1.4 P-Flash Commands

Table 4-31 summarizes the valid P-Flash commands along with the effects of the commands on the P- Flash block and other resources within the Flash module.

4.4.1.5 D-Flash and EEE Commands

Table 4-32 summarizes the valid D-Flash and EEE commands along with the effects of the commands on the D-Flash block and EEE operation. Table 4-31. P-Flash Commands FCMD Command Function on P-Flash Memory 0x01 Erase Verify All Blocks Verify that all P-Flash (and D-Flash) blocks are erased. 0x02 Erase Verify Block Verify that a P-Flash block is erased. 0x03 Erase Verify P- Flash Section Verify that a given number of words starting at the address provided are erased. 0x04 Read Once Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. 0x05 Load Data Field Load data for simultaneous multiple P-Flash block operations. 0x06 Program P-Flash Program a phrase in a P-Flash block and any previously loaded phrases for any other P- Flash block (see Load Data Field command). 0x07 Program Once Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. 0x08 Erase All Blocks Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. 0x09 Erase P-Flash Block Erase a single P-Flash block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. 0x0A Erase P-Flash Sector Erase all bytes in a P-Flash sector. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. 0x0C Verify Backdoor Access Key Supports a method of releasing MCU security by verifying a set of security keys. 0x0D Set User Margin Level Specifies a user margin read level for all P-Flash blocks. 0x0E Set Field Margin Level Specifies a field margin read level for all P-Flash blocks (special modes only). Table 4-32. D-Flash Commands FCMD Command Function on D-Flash Memory 0x01 Erase Verify All Blocks Verify that all D-Flash (and P-Flash) blocks are erased. 0x02 Erase Verify Block Verify that the D-Flash block is erased.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 167

4.4.2 Flash Command Description

This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller:

• Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register
• Writing an invalid command as part of the command write sequence
• For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 4.3.2.7). 0x08 Erase All Blocks Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. 0x0D Set User Margin Level Specifies a user margin read level for the D-Flash block. 0x0E Set Field Margin Level Specifies a field margin read level for the D-Flash block (special modes only). 0x0F Full Partition D- Flash Erase the D-Flash block and partition an area of the D-Flash block for user access. 0x10 Erase Verify D- Flash Section Verify that a given number of words starting at the address provided are erased. 0x11 Program D-Flash Program up to four words in the D-Flash block. 0x12 Erase D-Flash Sector Erase all bytes in a sector of the D-Flash block. 0x13 Enable EEPROM Emulation Enable EEPROM emulation where writes to the buffer RAM EEE partition will be copied to the D-Flash EEE partition. 0x14 Disable EEPROM Emulation Suspend all current erase and program activity related to EEPROM emulation but leave current EEE tags set. 0x15 EEPROM Emulation Query Returns EEE partition and status variables. 0x20 Partition D-Flash Partition an area of the D-Flash block for user access. Table 4-32. D-Flash Commands FCMD Command Function on D-Flash Memory

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

168 Freescale Semiconductor

A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed.

4.4.2.1 Erase Verify All Blocks Command

The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed.

4.4.2.2 Erase Verify Block Command

The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be verified. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF flag will set after the Erase Verify Block operation has completed. Table 4-33. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x01 Not required Table 4-34. Erase Verify All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the read 1 FERSTAT EPVIOLIF None Table 4-35. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x02 Global address [22:16] of the Flash block to be verified.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 169

4.4.2.3 Erase Verify P-Flash Section Command

The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. The section to be verified cannot cross a 256 Kbyte boundary in the P-Flash memory space. Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. Table 4-36. Erase Verify Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if an invalid global address [22:16] is supplied (1) 1. As defined by the memory map for FTM512K3. FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the read 2 FERSTAT EPVIOLIF None Table 4-37. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x03 Global address [22:16] of a P-Flash block

001 Global address [15:0] of the first phrase to be verified

010 Number of phrases to be verified

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

170 Freescale Semiconductor

4.4.2.4 Read Once Command

The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 4.4.2.7. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. 128 Table 4-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:0] is supplied (1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the requested section crosses a 256 Kbyte boundary FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the read 2 FERSTAT EPVIOLIF None Table 4-39. Read Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x04 Not Required

001 Read Once phrase index (0x0000 - 0x0007)

010 Read Once word 0 value

011 Read Once word 1 value

100 Read Once word 2 value

101 Read Once word 3 value

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 171

4.4.2.5 Load Data Field Command

The Load Data Field command is executed to provide FCCOB parameters for multiple P-Flash blocks for a future simultaneous program operation in the P-Flash memory space. Upon clearing CCIF to launch the Load Data Field command, the FCCOB registers will be transferred to the Memory Controller and be programmed in the block specified at the global address given with a future Program P-Flash command launched on a P-Flash block. The CCIF flag will set after the Load Data Field operation has completed. Note that once a Load Data Field command sequence has been initiated, the Load Data Field command sequence will be cancelled if any command other than Load Data Field or the future Program P-Flash is launched. Similarly, if an error occurs after launching a Load Data Field or Program P-Flash command, the associated Load Data Field command sequence will be cancelled. Table 4-40. Read Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid phrase index is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 4-41. Load Data Field Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x05 Global address [22:16] to identify P-Flash block

001 Global address [15:0] of phrase location to be programmed (1)

1. Global address [2:0] must be 000

010 Word 0

011 Word 1

100 Word 2

101 Word 3

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

172 Freescale Semiconductor

4.4.2.6 Program P-Flash Command

The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. Table 4-42. Load Data Field Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:0] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if a Load Data Field command sequence is currently active and the selected block has previously been selected in the same command sequence Set if a Load Data Field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence FPVIOL Set if the global address [22:0] points to a protected area MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 4-43. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x06 Global address [22:16] to identify P-Flash block

1. Global address [2:0] must be 000

010 Word 0 program value

011 Word 1 program value

100 Word 2 program value

101 Word 3 program value

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 173

4.4.2.7 Program Once Command

The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 4.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index Table 4-44. Program P-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:0] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if a Load Data Field command sequence is currently active and the selected block has previously been selected in the same command sequence Set if a Load Data Field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence FPVIOL Set if the global address [22:0] points to a protected area MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 4-45. Program Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x07 Not Required

001 Program Once phrase index (0x0000 - 0x0007)

010 Program Once word 0 value

011 Program Once word 1 value

100 Program Once word 2 value

101 Program Once word 3 value

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

174 Freescale Semiconductor

values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data.

4.4.2.8 Erase All Blocks Command

The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space including the EEE nonvolatile information register. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 4-46. Program Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid phrase index is supplied Set if the requested phrase has already been programmed (1) 1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF , the Program Once command will be allowed to execute again on that same phrase. FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 4-47. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x08 Not required

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 175

4.4.2.9 Erase P-Flash Block Command

The Erase P-Flash Block operation will erase all addresses in a P-Flash block. Upon clearing CCIF to launch the Erase P-Flash Block command, the Memory Controller will erase the selected P-Flash block and verify that it is erased. The CCIF flag will set after the Erase P-Flash Block operation has completed. Table 4-48. Erase All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected Table 4-49. Erase P-Flash Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x09 Global address [22:16] to identify P-Flash block

001 Global address [15:0] in P-Flash block to be erased

Table 4-50. Erase P-Flash Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:16] is supplied (1) 1. As defined by the memory map for FTM512K3. FPVIOL Set if an area of the selected P-Flash block is protected MGSTAT1 Set if any errors have been encountered during the verify operation (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation2 FERSTAT EPVIOLIF None

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

176 Freescale Semiconductor

4.4.2.10 Erase P-Flash Sector Command

The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed.

4.4.2.11 Unsecure Flash Command

The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security Table 4-51. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0A Global address [22:16] to identify P-Flash block to be erased 001 Global address [15:0] anywhere within the sector to be erased. Refer to Section 4.1.2.1 for the P-Flash sector size. Table 4-52. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:16] is supplied (1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL Set if the selected P-Flash sector is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 4-53. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0B Not required

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 177 state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed.

4.4.2.12 Verify Backdoor Access Key Command

The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 4-11). The Verify Backdoor Access Key command releases security if user- supplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 4- 3). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 4-54. Unsecure Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected Table 4-55. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0C Not required

001 Key 0

010 Key 1

011 Key 2

100 Key 3

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

178 Freescale Semiconductor

4.4.2.13 Set User Margin Level Command

The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set User Margin Level command are defined in Table 4-58. Table 4-56. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 100 at command launch Set if a Load Data Field command sequence is currently active Set if an incorrect backdoor key is supplied Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 4.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 4-57. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0D Global address [22:16] to identify the Flash block

001 Margin level setting

Table 4-58. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1) 1. Read margin to the erased state 0x0002 User Margin-0 Level (2) 2. Read margin to the programmed state

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 179 NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected.

4.4.2.14 Set Field Margin Level Command

The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set Field Margin Level command are defined in Table 4-61. Table 4-59. Set User Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:16] is supplied (1) 1. As defined by the memory map for FTM512K3. Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 4-60. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0E Global address [22:16] to identify the Flash block Table 4-61. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

180 Freescale Semiconductor

Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed.

4.4.2.15 Full Partition D-Flash Command

The Full Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. 0x0002 User Margin-0 Level (2) 0x0003 Field Margin-1 Level 1 0x0004 Field Margin-0 Level 2 1. Read margin to the erased state 2. Read margin to the programmed state Table 4-62. Set Field Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:16] is supplied (1) 1. As defined by the memory map for FTM512K3. Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 4-61. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 181 Upon clearing CCIF to launch the Full Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 16 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 4-7)
• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 4-7)
• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 4-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 4-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Full Partition D-Flash operation has completed, the CCIF flag will set. Running the Full Partition D-Flash command a second time will result in the previous partition values and the entire D-Flash memory being erased. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 4-63. Full Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0F Not required

001 Number of 256 byte sectors for the D-Flash user partition (DFPART)

010 Number of 256 byte sectors for buffer RAM EEE partition (ERPART)

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

182 Freescale Semiconductor

4.4.2.16 Erase Verify D-Flash Section Command

The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash user partition is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF flag will set after the Erase Verify D- Flash Section operation has completed. Table 4-64. Full Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid DFPART or ERPART selection is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 4-65. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x10 Global address [22:16] to identify the D-Flash block

001 Global address [15:0] of the first word to be verified

010 Number of words to be verified

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 183

4.4.2.17 Program D-Flash Command

The Program D-Flash operation programs one to four previously erased words in the D-Flash user partition. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. No protection checks are made in the Program D-Flash operation on the D-Flash block, only access error checks. The CCIF flag is set when the operation has completed. Table 4-66. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area of the D-Flash EEE partition Set if the requested section breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 4-67. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x11 Global address [22:16] to identify the D-Flash block

001 Global address [15:0] of word to be programmed

011 Word 1 program value, if desired

100 Word 2 program value, if desired

101 Word 3 program value, if desired

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

184 Freescale Semiconductor

4.4.2.18 Erase D-Flash Sector Command

The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash user partition. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase D-Flash Sector operation has completed. Table 4-68. Program D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area in the D-Flash EEE partition Set if the requested group of words breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 4-69. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x12 Global address [22:16] to identify D-Flash block 001 Global address [15:0] anywhere within the sector to be erased. See Section 4.1.2.2 for D-Flash sector size.

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 185

4.4.2.19 Enable EEPROM Emulation Command

The Enable EEPROM Emulation command causes the Memory Controller to enable EEE activity. EEE activity is disabled after any reset. Upon clearing CCIF to launch the Enable EEPROM Emulation command, the CCIF flag will set after the Memory Controller enables EEE operations using the contents of the EEE tag RAM and tag counter. The Full Partition D-Flash or the Partition D-Flash command must be run prior to launching the Enable EEPROM Emulation command. Table 4-70. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 4-71. Enable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x13 Not required Table 4-72. Enable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

186 Freescale Semiconductor

4.4.2.20 Disable EEPROM Emulation Command

The Disable EEPROM Emulation command causes the Memory Controller to suspend current EEE activity. Upon clearing CCIF to launch the Disable EEPROM Emulation command, the Memory Controller will halt EEE operations at the next convenient point without clearing the EEE tag RAM or tag counter before setting the CCIF flag.

4.4.2.21 EEPROM Emulation Query Command

The EEPROM Emulation Query command returns EEE partition and status variables. Upon clearing CCIF to launch the EEPROM Emulation Query command, the CCIF flag will set after the EEE partition and status variables are stored in the FCCOBIX register.If the Emulation Query command is executed prior to partitioning (Partition D-Flash CommandSection 4.4.2.15), the following reset values are returned: DFPART = 0x_FFFF, ERPART = 0x_FFFF, ECOUNT = 0x_FFFF, Dead Sector Count = 0x_00, Ready Sector Count = 0x_00. Table 4-73. Disable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x14 Not required Table 4-74. Disable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 4-75. EEPROM Emulation Query Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x15 Not required

001 Return DFPART

010 Return ERPART

011 Return ECOUNT

(1) 1. Indicates sector erase count

100 Return Dead Sector Count Return Ready Sector Count

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 187

4.4.2.22 Partition D-Flash Command

The Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. The Erase All Blocks command must be run prior to launching the Partition D-Flash command. Upon clearing CCIF to launch the Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 16 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase verify the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 4-7) Table 4-76. EEPROM Emulation Query Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 4-77. Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x20 Not required

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

188 Freescale Semiconductor

• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 4-7)
• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 4-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 4-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Partition D-Flash operation has completed, the CCIF flag will set. Running the Partition D-Flash command a second time will result in the ACCERR bit within the FSTAT register being set. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 4-78. Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 4-30) Set if partitions have already been defined Set if an invalid DFPART or ERPART selection is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 189

4.4.3 Interrupts

The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an EEE error or an ECC fault. NOTE Vector addresses and their relative interrupt priority are determined at the MCU level.

4.4.3.1 Description of Flash Interrupt Operation

The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the ERSEIF, PGMEIF, EPVIOLIF, ERSVIF1, ERSVIF0, DFDIF and SFDIF flags in combination with the ERSEIE, PGMEIE, EPVIOLIE, ERSVIE1, ERSVIE0, DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 4.3.2.5, “Flash Configuration Register Status Register (FSTAT)”, and Section 4.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 4-27. Table 4-79. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Command Complete CCIF (FSTAT register) CCIE (FCNFG register) I Bit Flash EEE Erase Error ERSERIF (FERSTAT register) ERSERIE (FERCNFG register) I Bit Flash EEE Program Error PGMERIF (FERSTAT register) PGMERIE (FERCNFG register) I Bit Flash EEE Protection Violation EPVIOLIF (FERSTAT register) EPVIOLIE (FERCNFG register) I Bit Flash EEE Error Type 1 Violation ERSVIF1 (FERSTAT register) ERSVIE1 (FERCNFG register) I Bit Flash EEE Error Type 0 Violation ERSVIF0 (FERSTAT register) ERSVIE0 (FERCNFG register) I Bit ECC Double Bit Fault on Flash Read DFDIF (FERSTAT register) DFDIE (FERCNFG register) I Bit ECC Single Bit Fault on Flash Read SFDIF (FERSTAT register) SFDIE (FERCNFG register) I Bit

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

190 Freescale Semiconductor

Figure 4-27. Flash Module Interrupts Implementation

4.4.4 Wait Mode

The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 4.4.3, “Interrupts”).

4.4.5 Stop Mode

If a Flash command is active (CCIF = 0) or an EE-Emulation operation is pending when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode.

4.5 Security

The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 4-12). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F. Flash Error Interrupt Request CCIF CCIE EPVIOLIF EPVIOLIE ERSVIF1 ERSVIE1 ERSVIF0 ERSVIE0 PGMERIF PGMERIE ERSERIF ERSERIE Flash Command Interrupt Request DFDIF DFDIE SFDIF SFDIE

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 191 The security state out of reset can be permanently changed by programming the security byte of the Flash configuration field. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects:

• Unsecuring the MCU using Backdoor Key Access
• Unsecuring the MCU in Special Single Chip Mode using BDM
• Mode and Security Effects on Flash Command Availability

4.5.1 Unsecuring the MCU using Backdoor Key Access

The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 4.3.2.2), the Verify Backdoor Access Key command (see Section 4.4.2.12) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 4-12) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 4.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 4.4.2.12 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field. The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte

Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) MC9S12XF - Family Reference Manual, Rev.1.19

192 Freescale Semiconductor

(0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT.

4.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM

The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods:

• Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory.
• Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method:
• Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU.

4.5.3 Mode and Security Effects on Flash Command Availability

The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 4-30.

4.6 Initialization

On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. The ACCERR bit in the FSTAT register is set if errors are encountered while initializing the EEE buffer ram during the reset sequence. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed.

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 193 Chapter 5 Pierce Oscillator (S12OSCLCPV2)

5.1 Introduction

The Pierce oscillator (XOSC) module provides a robust, low-noise and low-power clock source. The module will be operated from the VDDPLL supply rail (1.8 V nominal) and require the minimum number of external components. It is designed for optimal start-up margin with typical crystal oscillators.

5.1.1 Features

The XOSC will contain circuitry to dynamically control current gain in the output amplitude. This ensures a signal with low harmonic distortion, low power and good noise immunity.

• High noise immunity due to input hysteresis
• Low RF emissions with peak-to-peak swing limited dynamically
• Transconductance (gm) sized for optimum start-up margin for typical oscillators
• Dynamic gain control eliminates the need for external current limiting resistor
• Integrated resistor eliminates the need for external bias resistor in loop controlled Pierce mode.
• Low power consumption: — Operates from 1.8 V (nominal) supply — Amplitude control limits power
• Clock monitor

5.1.2 Modes of Operation

Two modes of operation exist: 1. Loop controlled Pierce (LCP) oscillator 2. External square wave mode featuring also full swing Pierce (FSP) without internal bias resistor The oscillator mode selection is described in the Device Overview section, subsection Oscillator Configuration. Date Author Description of Changes 01.05 19-Jul-06 All xclks info was removed 02.00 04-Aug-06 incremented revision to match the design system spec revision

Chapter 5 Pierce Oscillator (S12OSCLCPV2) MC9S12XF - Family Reference Manual, Rev.1.19

194 Freescale Semiconductor

5.1.3 Block Diagram

Figure 5-1 shows a block diagram of the XOSC. Figure 5-1. XOSC Block Diagram

5.2 External Signal Description

This section lists and describes the signals that connect off chip

5.2.1 VDDPLL and VSSPLL — Operating and Ground Voltage Pins

Theses pins provides operating voltage (VDDPLL) and ground (VSSPLL) for the XOSC circuitry. This allows the supply voltage to the XOSC to use an independent bypass capacitor.

5.2.2 EXTAL and XTAL — Input and Output Pins

These pins provide the interface for either a crystal or a 1.8V CMOS compatible clock to control the internal clock generator circuitry. EXTAL is the external clock input or the input to the crystal oscillator amplifier. XTAL is the output of the crystal oscillator amplifier. The MCU internal system clock is derived EXTAL XTAL Gain Control VDDPLL = 1.8 V Rf OSCCLK Monitor_Failure Clock Monitor Peak Detector

Chapter 5 Pierce Oscillator (S12OSCLCPV2) MC9S12XF - Family Reference Manual, Rev.1.19

196 Freescale Semiconductor

5.3 Memory Map and Register Definition

The CRG contains the registers and associated bits for controlling and monitoring the oscillator module.

5.4 Functional Description

The XOSC module has control circuitry to maintain the crystal oscillator circuit voltage level to an optimal level which is determined by the amount of hysteresis being used and the maximum oscillation range. The oscillator block has two external pins, EXTAL and XTAL. The oscillator input pin, EXTAL, is intended to be connected to either a crystal or an external clock source. The XTAL pin is an output signal that provides crystal circuit feedback. A buffered EXTAL signal becomes the internal clock. To improve noise immunity, the oscillator is powered by the VDDPLL and VSSPLL power supply pins.

5.4.1 Gain Control

In LCP mode a closed loop control system will be utilized whereby the amplifier is modulated to keep the output waveform sinusoidal and to limit the oscillation amplitude. The output peak to peak voltage will be kept above twice the maximum hysteresis level of the input buffer. Electrical specification details are provided in the Electrical Characteristics appendix.

5.4.2 Clock Monitor

The clock monitor circuit is based on an internal RC time delay so that it can operate without any MCU clocks. If no OSCCLK edges are detected within this RC time delay, the clock monitor indicates failure which asserts self-clock mode or generates a system reset depending on the state of SCME bit. If the clock monitor is disabled or the presence of clocks is detected no failure is indicated.The clock monitor function is enabled/disabled by the CME control bit, described in the CRG block description chapter.

5.4.3 Wait Mode Operation

During wait mode, XOSC is not impacted.

5.4.4 Stop Mode Operation

XOSC is placed in a static state when the part is in stop mode except when pseudo-stop mode is enabled. During pseudo-stop mode, XOSC is not impacted.

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 197 Chapter 6 Security (S12XFSECV2)

6.1 Introduction

This specification describes the function of the security mechanism in the S12XF chip family (SEC).

6.1.1 Features

The user must be reminded that part of the security must lie with the application code. An extreme example would be application code that dumps the contents of the internal memory. This would defeat the purpose of security. At the same time, the user may also wish to put a backdoor in the application program. An example of this is the user downloads a security key through the SCI, which allows access to a programming routine that updates parameters stored in another section of the Flash memory. The security features of the S12XDF chip family (in secure mode) are:

• Protect the content of non-volatile memories (Flash, EEPROM)
• Execution of NVM commands is restricted
• Disable access to internal memory via background debug module (BDM)
• Disable access to internal Flash/EEPROM in expanded modes
• Disable debugging features for the CPU and XGATE Table 6-1 gives an overview over availability of security relevant features in unsecure and secure modes. Version Number Revision Date Effective Date Author Description of Changes 01.00 26 Sep 2003

26 Sep

02.00 27 Aug 2004

08 Sep

reviewed and updated for S12XD architecture 02.01 21 Feb 2007

21 Feb

added S12XE, S12XF and S12XS architectures

Chapter 6 Security (S12XFSECV2) MC9S12XF - Family Reference Manual, Rev.1.19

198 Freescale Semiconductor

6.1.2 Modes of Operation

6.1.3 Securing the Microcontroller

Once the user has programmed the Flash and EEPROM, the chip can be secured by programming the security bits located in the options/security byte in the Flash memory array. These non-volatile bits will keep the device secured through reset and power-down. The options/security byte is located at address 0xFF0F (= global address 0x7F_FF0F) in the Flash memory array. This byte can be erased and programmed like any other Flash location. Two bits of this byte are used for security (SEC[1:0]). On devices which have a memory page window, the Flash options/security byte is also available at address 0xBF0F by selecting page 0x3F with the PPAGE register. The contents of this byte are copied into the Flash security register (FSEC) during a reset sequence. The meaning of the bits KEYEN[1:0] is shown in Table 6-2. Please refer to Section 6.1.5.1, “Unsecuring the MCU Using the Backdoor Key Access” for more information. Table 6-1. Feature Availability in Unsecure and Secure Modes on S12XF Unsecure Mode Secure Mode NS SS NX ES EX ST NS SS NX ES EX ST Flash Array Access ✔✔ ✔ (1) 1. Availability of Flash arrays in the memory map depends on ROMCTL/EROMCTL pins and/or the state of the ROMON/EROMON bits in the MMCCTL1 register. Please refer to the S12X_MMC block guide for detailed information. NVM Commands ✔(2) 2. Restricted NVM command set only. Please refer to the NVM wrapper block guides for detailed information. 3. BDM hardware commands restricted to peripheral registers only. ———— Internal status visible multiplexed on external bus Internal accesses visible on external bus 76543210 0xFF0F KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 Figure 6-1. Flash Options/Security Byte

Chapter 6 Security (S12XFSECV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 199 The meaning of the security bits SEC[1:0] is shown inTable 6-3. For security reasons, the state of device security is controlled by two bits. To put the device in unsecured mode, these bits must be programmed to SEC[1:0] = ‘10’. All other combinations put the device in a secured mode. The recommended value to put the device in secured state is the inverse of the unsecured state, i.e. SEC[1:0] = ‘01’. NOTE Please refer to the Flash block guide for actual security configuration (in section “Flash Module Security”).

6.1.4 Operation of the Secured Microcontroller

By securing the device, unauthorized access to the EEPROM and Flash memory contents can be prevented. However, it must be understood that the security of the EEPROM and Flash memory contents also depends on the design of the application program. For example, if the application has the capability of downloading code through a serial port and then executing that code (e.g. an application containing bootloader code), then this capability could potentially be used to read the EEPROM and Flash memory contents even when the microcontroller is in the secure state. In this example, the security of the application could be enhanced by requiring a challenge/response authentication before any code can be downloaded. Secured operation has the following effects on the microcontroller: Table 6-2. Backdoor Key Access Enable Bits KEYEN[1:0] Backdoor Key Access Enabled 00 0 (disabled) 01 0 (disabled) 10 1 (enabled) 11 0 (disabled) Table 6-3. Security Bits SEC[1:0] Security State 00 1 (secured) 01 1 (secured) 10 0 (unsecured) 11 1 (secured)

Chapter 6 Security (S12XFSECV2) MC9S12XF - Family Reference Manual, Rev.1.19

200 Freescale Semiconductor

6.1.4.1 Normal Single Chip Mode (NS)

• Background debug module (BDM) operation is completely disabled.
• Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details.
• Tracing code execution using the DBG module is disabled.
• Debugging XGATE code (breakpoints, single-stepping) is disabled.

6.1.4.2 Special Single Chip Mode (SS)

• BDM firmware commands are disabled.
• BDM hardware commands are restricted to the register space.
• Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details.
• Tracing code execution using the DBG module is disabled.
• Debugging XGATE code (breakpoints, single-stepping) is disabled. Special single chip mode means BDM is active after reset. The availability of BDM firmware commands depends on the security state of the device. The BDM secure firmware first performs a blank check of both the Flash memory and the EEPROM. If the blank check succeeds, security will be temporarily turned off and the state of the security bits in the appropriate Flash memory location can be changed If the blank check fails, security will remain active, only the BDM hardware commands will be enabled, and the accessible memory space is restricted to the peripheral register area. This will allow the BDM to be used to erase the EEPROM and Flash memory without giving access to their contents. After erasing both Flash memory and EEPROM, another reset into special single chip mode will cause the blank check to succeed and the options/security byte can be programmed to “unsecured” state via BDM. While the BDM is executing the blank check, the BDM interface is completely blocked, which means that all BDM commands are temporarily blocked.

6.1.4.3 Expanded Modes (NX, ES, EX, and ST)

• BDM operation is completely disabled.
• Internal Flash memory and EEPROM are disabled.
• Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details.
• Tracing code execution using the DBG module is disabled.
• Debugging XGATE code (breakpoints, single-stepping) is disabled

Chapter 6 Security (S12XFSECV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 201

6.1.5 Unsecuring the Microcontroller

Unsecuring the microcontroller can be done by three different methods: 1. Backdoor key access 2. Reprogramming the security bits 3. Complete memory erase (special modes)

6.1.5.1 Unsecuring the MCU Using the Backdoor Key Access

In normal modes (single chip and expanded), security can be temporarily disabled using the backdoor key access method. This method requires that:

• The backdoor key at 0xFF00–0xFF07 (= global addresses 0x7F_FF00–0x7F_FF07) has been programmed to a valid value.
• The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’.
• In single chip mode, the application program programmed into the microcontroller must be designed to have the capability to write to the backdoor key locations. The backdoor key values themselves would not normally be stored within the application data, which means the application program would have to be designed to receive the backdoor key values from an external source (e.g. through a serial port). It is not possible to download the backdoor keys using background debug mode. The backdoor key access method allows debugging of a secured microcontroller without having to erase the Flash. This is particularly useful for failure analysis. NOTE No word of the backdoor key is allowed to have the value 0x0000 or 0xFFFF.

6.1.6 Reprogramming the Security Bits

In normal single chip mode (NS), security can also be disabled by erasing and reprogramming the security bits within Flash options/security byte to the unsecured value. Because the erase operation will erase the entire sector from 0xFE00–0xFFFF (0x7F_FE00–0x7F_FFFF), the backdoor key and the interrupt vectors will also be erased; this method is not recommended for normal single chip mode. The application software can only erase and program the Flash options/security byte if the Flash sector containing the Flash options/security byte is not protected (see Flash protection). Thus Flash protection is a useful means of preventing this method. The microcontroller will enter the unsecured state after the next reset following the programming of the security bits to the unsecured value. This method requires that:

• The application software previously programmed into the microcontroller has been designed to have the capability to erase and program the Flash options/security byte, or security is first disabled using the backdoor key method, allowing BDM to be used to issue commands to erase and program the Flash options/security byte.
• The Flash sector containing the Flash options/security byte is not protected.

Chapter 6 Security (S12XFSECV2) MC9S12XF - Family Reference Manual, Rev.1.19

202 Freescale Semiconductor

6.1.7 Complete Memory Erase (Special Modes)

The microcontroller can be unsecured in special modes by erasing the entire EEPROM and Flash memory contents. When a secure microcontroller is reset into special single chip mode (SS), the BDM firmware verifies whether the EEPROM and Flash memory are erased. If any EEPROM or Flash memory address is not erased, only BDM hardware commands are enabled. BDM hardware commands can then be used to write to the EEPROM and Flash registers to mass erase the EEPROM and all Flash memory blocks. When next reset into special single chip mode, the BDM firmware will again verify whether all EEPROM and Flash memory are erased, and this being the case, will enable all BDM commands, allowing the Flash options/security byte to be programmed to the unsecured value. The security bits SEC[1:0] in the Flash security register will indicate the unsecure state following the next reset.

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 203 Chapter 7 Interrupt (S12XINTV2)

7.1 Introduction

The INT module decodes the priority of all system exception requests and provides the applicable vector for processing the exception to either the CPU or the XGATE module. The INT module supports:

• I bit and X bit maskable interrupt requests
• One non-maskable unimplemented op-code trap
• One non-maskable software interrupt (SWI) or background debug mode request
• One non-maskable system call interrupt (SYS)
• Three non-maskable access violation interrupt
• One spurious interrupt vector request
• Three system reset vector requests Each of the I bit maskable interrupt requests can be assigned to one of seven priority levels supporting a flexible priority scheme. For interrupt requests that are configured to be handled by the CPU, the priority scheme can be used to implement nested interrupt capability where interrupts from a lower level are automatically blocked if a higher level interrupt is being processed. Interrupt requests configured to be handled by the XGATE module can be nested one level deep. Table 7-1. Revision History Version Number Revision Date Effective Date Author Description of Changes 02.00 01 JUL 2005

01 JUL

initial V2 release, added new features: - XGATE threads can be interrupted - SYS instruction vector - access violation interrupt vectors 02.04 11 JAN 2007

11 JAN

• added Notes for devices without XGATE module 02.05 20 MAR 2007

23 MAR

• fixed priority definition for software exceptions in “1.4.6 Exception Priority” 02.06 07 JAN 2008

07 JAN

• added clarification of “Wake-up from STOP or WAIT by XIRQ with X bit set” feature

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

204 Freescale Semiconductor

The HPRIO register and functionality of the original S12 interrupt module is no longer supported, since it is superseded by the 7-level interrupt request priority scheme.

7.1.1 Glossary

The following terms and abbreviations are used in the document.

7.1.2 Features

• Interrupt vector base register (IVBR)
• One spurious interrupt vector (at address vector base 1 + 0x0010).
• One non-maskable system call interrupt vector request (at address vector base + 0x0012).
• Three non-maskable access violation interrupt vector requests (at address vector base + 0x0014 − 0x0018).
• 2–109 I bit maskable interrupt vector requests (at addresses vector base + 0x001A–0x00F2).
• Each I bit maskable interrupt request has a configurable priority level and can be configured to be handled by either the CPU or the XGATE module
• I bit maskable interrupts can be nested, depending on their priority levels.
• One X bit maskable interrupt vector request (at address vector base + 0x00F4).
• One non-maskable software interrupt request (SWI) or background debug mode vector request (at address vector base + 0x00F6).
• One non-maskable unimplemented op-code trap (TRAP) vector (at address vector base + 0x00F8).
• Three system reset vectors (at addresses 0xFFFA–0xFFFE).
• Determines the highest priority XGATE and interrupt vector requests, drives the vector to the XGATE module or to the bus on CPU request, respectively. Table 7-2. Terminology Term Meaning CCR Condition Code Register (in the S12X CPU) DMA Direct Memory Access INT Interrupt IPL Interrupt Processing Level ISR Interrupt Service Routine MCU Micro-Controller Unit XGATE refers to the XGATE co-processor; XGATE is an optional feature IRQ refers to the interrupt request associated with the IRQ pin XIRQ refers to the interrupt request associated with the XIRQ pin 1. The vector base is a 16-bit address which is accumulated from the contents of the interrupt vector base register (IVBR, used as upper byte) and 0x00 (used as lower byte). 2. The IRQ interrupt can only be handled by the CPU

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 205

• Wakes up the system from stop or wait mode when an appropriate interrupt request occurs or whenever XIRQ is asserted, even if X interrupt is masked.
• XGATE can wake up and execute code, even with the CPU remaining in stop or wait mode.

7.1.3 Modes of Operation

• Run mode This is the basic mode of operation.
• Wait mode In wait mode, the INT module is frozen. It is however capable of either waking up the CPU if an interrupt occurs or waking up the XGATE if an XGATE request occurs. Please refer to Section 7.5.3, “Wake Up from Stop or Wait Mode” for details.
• Stop Mode In stop mode, the INT module is frozen. It is however capable of either waking up the CPU if an interrupt occurs or waking up the XGATE if an XGATE request occurs. Please refer to Section 7.5.3, “Wake Up from Stop or Wait Mode” for details.
• Freeze mode (BDM active) In freeze mode (BDM active), the interrupt vector base register is overridden internally. Please refer to Section 7.3.2.1, “Interrupt Vector Base Register (IVBR)” for details.

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

206 Freescale Semiconductor

7.1.4 Block Diagram

Figure 7-1 shows a block diagram of the INT module. Figure 7-1. INT Block Diagram Wake Up CurrentRQST IVBR One Set Per Channel XGATE Interrupts XGATE Requests Interrupt Requests Interrupt Requests CPU Vector Address New IPL IPL (Up to 108 Channels) RQST XGATE Request Route, PRIOLVLn Priority Level = bits from the channel configuration in the associated configuration register INT_XGPRIO = XGATE Interrupt Priority IVBR = Interrupt Vector Base IPL = Interrupt Processing Level PRIOLVL0 PRIOLVL1 PRIOLVL2 INT_XGPRIO Peripheral Vector ID To XGATE Module Priority Decoder To CPU Priority Decoder Non I Bit Maskable Channels Wake up XGATE IRQ Channel

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 207

7.2 External Signal Description

The INT module has no external signals.

7.3 Memory Map and Register Definition

This section provides a detailed description of all registers accessible in the INT module.

7.3.1 Module Memory Map

Table 7-3 gives an overview over all INT module registers. Table 7-3. INT Memory Map Address Use Access 0x0120 RESERVED — 0x0121 Interrupt Vector Base Register (IVBR) R/W 0x0122–0x0125 RESERVED — 0x0126 XGATE Interrupt Priority Configuration Register (INT_XGPRIO) R/W 0x0127 Interrupt Request Configuration Address Register (INT_CFADDR) R/W 0x0128 Interrupt Request Configuration Data Register 0 (INT_CFDATA0) R/W 0x0129 Interrupt Request Configuration Data Register 1 (INT_CFDATA1) R/W 0x012A Interrupt Request Configuration Data Register 2 (INT_CFDATA2 R/W 0x012B Interrupt Request Configuration Data Register 3 (INT_CFDATA3) R/W 0x012C Interrupt Request Configuration Data Register 4 (INT_CFDATA4) R/W 0x012D Interrupt Request Configuration Data Register 5 (INT_CFDATA5) R/W 0x012E Interrupt Request Configuration Data Register 6 (INT_CFDATA6) R/W 0x012F Interrupt Request Configuration Data Register 7 (INT_CFDATA7) R/W

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

208 Freescale Semiconductor

7.3.2 Register Descriptions

This section describes in address order all the INT module registers and their individual bits. Address Register Name Bit 7 654321 Bit 0 0x0121 IVBR R IVB_ADDR[7:0]7 W 0x0126 INT_XGPRIO R 00000 XILVL[2:0] W 0x0127 INT_CFADDR R INT_CFADDR[7:4] 0000 W 0x0128 INT_CFDATA0 R RQST 0000 PRIOLVL[2:0] W 0x0129 INT_CFDATA1 R RQST 0000 PRIOLVL[2:0] W 0x012A INT_CFDATA2 R RQST 0000 PRIOLVL[2:0] W 0x012B INT_CFDATA3 R RQST 0000 PRIOLVL[2:0] W 0x012C INT_CFDATA4 R RQST 0000 PRIOLVL[2:0] W 0x012D INT_CFDATA5 R RQST 0000 PRIOLVL[2:0] W 0x012E INT_CFDATA6 R RQST 0000 PRIOLVL[2:0] W 0x012F INT_CFDATA7 R RQST 0000 PRIOLVL[2:0] W = Unimplemented or Reserved Figure 7-2. INT Register Summary

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 209

7.3.2.1 Interrupt Vector Base Register (IVBR)

Read: Anytime Write: Anytime

7.3.2.2 XGATE Interrupt Priority Configuration Register (INT_XGPRIO)

Read: Anytime Write: Anytime Address: 0x0121 76543210 R IVB_ADDR[7:0] W Reset 1 1 1 11111 Figure 7-3. Interrupt Vector Base Register (IVBR) Table 7-4. IVBR Field Descriptions Field Description 7–0 IVB_ADDR[7:0] Interrupt Vector Base Address Bits — These bits represent the upper byte of all vector addresses. Out of reset these bits are set to 0xFF (i.e., vectors are located at 0xFF10–0xFFFE) to ensure compatibility to previous S12 microcontrollers. Note: A system reset will initialize the interrupt vector base register with “0xFF” before it is used to determine the reset vector address. Therefore, changing the IVBR has no effect on the location of the three reset vectors (0xFFFA–0xFFFE). Note: If the BDM is active (i.e., the CPU is in the process of executing BDM firmware code), the contents of IVBR are ignored and the upper byte of the vector address is fixed as “0xFF”. Address: 0x0126 76543210 R 00000 XILVL[2:0] W Reset 0 0 0 00001 = Unimplemented or Reserved Figure 7-4. XGATE Interrupt Priority Configuration Register (INT_XGPRIO) Table 7-5. INT_XGPRIO Field Descriptions Field Description 2–0 XILVL[2:0] XGATE Interrupt Priority Level — The XILVL[2:0] bits configure the shared interrupt level of the XGATE interrupts coming from the XGATE module. Out of reset the priority is set to the lowest active level (“1”). Note: If the XGATE module is not available on the device, write accesses to this register are ignored and read accesses to this register will return all 0.

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

210 Freescale Semiconductor

7.3.2.3 Interrupt Request Configuration Address Register (INT_CFADDR)

Read: Anytime Write: Anytime

7.3.2.4 Interrupt Request Configuration Data Registers (INT_CFDATA0–7)

The eight register window visible at addresses INT_CFDATA0–7 contains the configuration data for the block of eight interrupt requests (out of 128) selected by the interrupt configuration address register (INT_CFADDR) in ascending order. INT_CFDATA0 represents the interrupt configuration data register of the vector with the lowest address in this block, while INT_CFDATA7 represents the interrupt configuration data register of the vector with the highest address, respectively. Table 7-6. XGATE Interrupt Priority Levels Priority XILVL2 XILVL1 XILVL0 Meaning 0 0 0 Interrupt request is disabled low 0 0 1 Priority level 1 0 1 0 Priority level 2 0 1 1 Priority level 3 1 0 0 Priority level 4 1 0 1 Priority level 5 1 1 0 Priority level 6 high 1 1 1 Priority level 7 Address: 0x0127 76543210 R INT_CFADDR[7:4] 0000 W Reset 0 0 0 10000 = Unimplemented or Reserved Figure 7-5. Interrupt Configuration Address Register (INT_CFADDR) Table 7-7. INT_CFADDR Field Descriptions Field Description 7–4 INT_CFADDR[7:4] Interrupt Request Configuration Data Register Select Bits — These bits determine which of the 128 configuration data registers are accessible in the 8 register window at INT_CFDATA0–7. The hexadecimal value written to this register corresponds to the upper nibble of the lower byte of the address of the interrupt vector, i.e., writing 0xE0 to this register selects the configuration data register block for the 8 interrupt vector requests starting with vector at address (vector base + 0x00E0) to be accessible as INT_CFDATA0–7. Note: Writing all 0s selects non-existing configuration registers. In this case write accesses to INT_CFDATA0–7 will be ignored and read accesses will return all 0.

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

212 Freescale Semiconductor

Read: Anytime Write: Anytime Address: 0x012D 76543210 R RQST 0000 PRIOLVL[2:0] W Reset 0 0 0 0000 1 (1) 1. Please refer to the notes following the PRIOLVL[2:0] description below. = Unimplemented or Reserved Figure 7-11. Interrupt Request Configuration Data Register 5 (INT_CFDATA5) Address: 0x012E 76543210 R RQST 0000 PRIOLVL[2:0] W Reset 0 0 0 0000 1 (1) 1. Please refer to the notes following the PRIOLVL[2:0] description below. = Unimplemented or Reserved Figure 7-12. Interrupt Request Configuration Data Register 6 (INT_CFDATA6) Address: 0x012F 76543210 R RQST 0000 PRIOLVL[2:0] W Reset 0 0 0 0000 1 (1) 1. Please refer to the notes following the PRIOLVL[2:0] description below. = Unimplemented or Reserved Figure 7-13. Interrupt Request Configuration Data Register 7 (INT_CFDATA7)

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 213

7.4 Functional Description

The INT module processes all exception requests to be serviced by the CPU module. These exceptions include interrupt vector requests and reset vector requests. Each of these exception types and their overall priority level is discussed in the subsections below. Table 7-8. INT_CFDATA0–7 Field Descriptions Field Description RQST XGATE Request Enable— This bit determines if the associated interrupt request is handled by the CPU or by the XGATE module.

0 Interrupt request is handled by the CPU

1 Interrupt request is handled by the XGATE module

Note: The IRQ interrupt cannot be handled by the XGATE module. For this reason, the configuration register for vector (vector base + 0x00F2) =IRQ vector address) does not contain a RQST bit. Writing a 1 to the location of the RQST bit in this register will be ignored and a read access will return 0. Note: If the XGATE module is not available on the device, writing a 1 to the location of the RQST bit in this register will be ignored and a read access will return 0. 2–0 PRIOLVL[2:0] Interrupt Request Priority Level Bits— The PRIOLVL[2:0] bits configure the interrupt request priority level of the associated interrupt request. Out of reset all interrupt requests are enabled at the lowest active level (“1”) to provide backwards compatibility with previous S12 interrupt controllers. Please also refer to Table 7-9 for available interrupt request priority levels. Note: Write accesses to configuration data registers of unused interrupt channels will be ignored and read accesses will return all 0. For information about what interrupt channels are used in a specific MCU, please refer to the Device Reference Manual of that MCU. Note: When vectors (vector base + 0x00F0–0x00FE) are selected by writing 0xF0 to INT_CFADDR, writes to INT_CFDATA2–7 (0x00F4–0x00FE) will be ignored and read accesses will return all 0s. The corresponding vectors do not have configuration data registers associated with them. Note: When vectors (vector base + 0x0010–0x001E) are selected by writing 0x10 to INT_CFADDR, writes to INT_CFDATA1–INT_CFDATA4 (0x0012–0x0018) will be ignored and read accesses will return all 0s. The corresponding vectors do not have configuration data registers associated with them. Note: Write accesses to the configuration register for the spurious interrupt vector request (vector base + 0x0010) will be ignored and read accesses will return 0x07 (request is handled by the CPU, PRIOLVL = 7). Table 7-9. Interrupt Priority Levels Priority PRIOLVL2 PRIOLVL1 PRIOLVL0 Meaning 0 0 0 Interrupt request is disabled low 0 0 1 Priority level 1 0 1 0 Priority level 2 0 1 1 Priority level 3 1 0 0 Priority level 4 1 0 1 Priority level 5 1 1 0 Priority level 6 high 1 1 1 Priority level 7

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

214 Freescale Semiconductor

7.4.1 S12X Exception Requests

The CPU handles both reset requests and interrupt requests. The INT module contains registers to configure the priority level of each I bit maskable interrupt request which can be used to implement an interrupt priority scheme. This also includes the possibility to nest interrupt requests. A priority decoder is used to evaluate the priority of a pending interrupt request.

7.4.2 Interrupt Prioritization

After system reset all interrupt requests with a vector address lower than or equal to (vector base + 0x00F2) are enabled, are set up to be handled by the CPU and have a pre-configured priority level of 1. Exceptions to this rule are the non-maskable interrupt requests and the spurious interrupt vector request at (vector base + 0x0010) which cannot be disabled, are always handled by the CPU and have a fixed priority levels. A priority level of 0 effectively disables the associated I bit maskable interrupt request. If more than one interrupt request is configured to the same interrupt priority level the interrupt request with the higher vector address wins the prioritization. The following conditions must be met for an I bit maskable interrupt request to be processed. 1. The local interrupt enabled bit in the peripheral module must be set. 2. The setup in the configuration register associated with the interrupt request channel must meet the following conditions: a) The XGATE request enable bit must be 0 to have the CPU handle the interrupt request. b) The priority level must be set to non zero. c) The priority level must be greater than the current interrupt processing level in the condition code register (CCR) of the CPU (PRIOLVL[2:0] > IPL[2:0]). 3. The I bit in the condition code register (CCR) of the CPU must be cleared. 4. There is no access violation interrupt request pending. 5. There is no SYS, SWI, BDM, TRAP, or XIRQ request pending. NOTE All non I bit maskable interrupt requests always have higher priority than I bit maskable interrupt requests. If an I bit maskable interrupt request is interrupted by a non I bit maskable interrupt request, the currently active interrupt processing level (IPL) remains unaffected. It is possible to nest non I bit maskable interrupt requests, e.g., by nesting SWI or TRAP calls.

7.4.2.1 Interrupt Priority Stack

The current interrupt processing level (IPL) is stored in the condition code register (CCR) of the CPU. This way the current IPL is automatically pushed to the stack by the standard interrupt stacking procedure. The new IPL is copied to the CCR from the priority level of the highest priority active interrupt request channel which is configured to be handled by the CPU. The copying takes place when the interrupt vector is fetched. The previous IPL is automatically restored by executing the RTI instruction.

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 215

7.4.3 XGATE Requests

If the XGATE module is implemented on the device, the INT module is also used to process all exception requests to be serviced by the XGATE module. The overall priority level of those exceptions is discussed in the subsections below.

7.4.3.1 XGATE Request Prioritization

An interrupt request channel is configured to be handled by the XGATE module, if the RQST bit of the associated configuration register is set to 1 (please refer to Section 7.3.2.4, “Interrupt Request Configuration Data Registers (INT_CFDATA0–7)”). The priority level configuration (PRIOLVL) for this channel becomes the XGATE priority which will be used to determine the highest priority XGATE request to be serviced next by the XGATE module. Additionally, XGATE interrupts may be raised by the XGATE module by setting one or more of the XGATE channel interrupt flags (by using the SIF instruction). This will result in an CPU interrupt with vector address vector base + (2 * channel ID number), where the channel ID number corresponds to the highest set channel interrupt flag, if the XGIE and channel RQST bits are set. The shared interrupt priority for the XGATE interrupt requests is taken from the XGATE interrupt priority configuration register (please refer to Section 7.3.2.2, “XGATE Interrupt Priority Configuration Register (INT_XGPRIO)”). If more than one XGATE interrupt request channel becomes active at the same time, the channel with the highest vector address wins the prioritization.

7.4.4 Priority Decoders

The INT module contains priority decoders to determine the priority for all interrupt requests pending for the respective target. There are two priority decoders, one for each interrupt request target, CPU or XGATE. The function of both priority decoders is basically the same with one exception: the priority decoder for the XGATE module does not take the current XGATE thread processing level into account. Instead, XGATE requests are handed to the XGATE module including a 1-bit priority identifier. The XGATE module uses this additional information to decide if the new request can interrupt a currently running thread. The 1-bit priority identifier corresponds to the most significant bit of the priority level configuration of the requesting channel. This means that XGATE requests with priority levels 4, 5, 6 or 7 can interrupt running XGATE threads with priority levels 1, 2 and 3. A CPU interrupt vector is not supplied until the CPU requests it. Therefore, it is possible that a higher priority interrupt request could override the original exception which caused the CPU to request the vector. In this case, the CPU will receive the highest priority vector and the system will process this exception instead of the original request. If the interrupt source is unknown (for example, in the case where an interrupt request becomes inactive after the interrupt has been recognized, but prior to the vector request), the vector address supplied to the CPU will default to that of the spurious interrupt vector.

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

216 Freescale Semiconductor

Care must be taken to ensure that all exception requests remain active until the system begins execution of the applicable service routine; otherwise, the exception request may not get processed at all or the result may be a spurious interrupt request (vector at address (vector base + 0x0010)).

7.4.5 Reset Exception Requests

The INT module supports three system reset exception request types (for details please refer to the Clock and Reset Generator module (CRG)): 1. Pin reset, power-on reset, low-voltage reset, or illegal address reset 2. Clock monitor reset request 3. COP watchdog reset request

7.4.6 Exception Priority

The priority (from highest to lowest) and address of all exception vectors issued by the INT module upon request by the CPU is shown in Table 7-10. Generally, all non-maskable interrupts have higher priorities than maskable interrupts. Please note that between the three software interrupts (Unimplemented op-code trap request, SWI/BGND request, SYS request) there is no real priority defined because they cannot occur simultaneously (the S12XCPU executes one instruction at a time). Table 7-10. Exception Vector Map and Priority Vector Address(1) 1. 16 bits vector address based Source 0xFFFE Pin reset, power-on reset, low-voltage reset, illegal address reset 0xFFFC Clock monitor reset 0xFFFA COP watchdog reset (Vector base + 0x00F8) Unimplemented op-code trap (Vector base + 0x00F6) Software interrupt instruction (SWI) or BDM vector request (Vector base + 0x0012) System call interrupt instruction (SYS) (Vector base + 0x0018) (reserved for future use) (Vector base + 0x0016) XGATE Access violation interrupt request (2) 2. only implemented if device features both a Memory Protection Unit (MPU) and an XGATE co-processor (Vector base + 0x0014) CPU Access violation interrupt request (3) 3. only implemented if device features a Memory Protection Unit (MPU) (Vector base + 0x00F4) XIRQ interrupt request (Vector base + 0x00F2) IRQ interrupt request (Vector base + 0x00F0–0x001A) Device specific I bit maskable interrupt sources (priority determined by the associated configuration registers, in descending order) (Vector base + 0x0010) Spurious interrupt

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 217

7.5 Initialization/Application Information

7.5.1 Initialization

After system reset, software should:

• Initialize the interrupt vector base register if the interrupt vector table is not located at the default location (0xFF10–0xFFF9).
• Initialize the interrupt processing level configuration data registers (INT_CFADDR, INT_CFDATA0–7) for all interrupt vector requests with the desired priority levels and the request target (CPU or XGATE module). It might be a good idea to disable unused interrupt requests.
• If the XGATE module is used, setup the XGATE interrupt priority register (INT_XGPRIO) and configure the XGATE module (please refer the XGATE Block Guide for details).
• Enable I maskable interrupts by clearing the I bit in the CCR.
• Enable the X maskable interrupt by clearing the X bit in the CCR (if required).

7.5.2 Interrupt Nesting

The interrupt request priority level scheme makes it possible to implement priority based interrupt request nesting for the I bit maskable interrupt requests handled by the CPU.

• I bit maskable interrupt requests can be interrupted by an interrupt request with a higher priority, so that there can be up to seven nested I bit maskable interrupt requests at a time (refer toFigure 7- 14 for an example using up to three nested interrupt requests). I bit maskable interrupt requests cannot be interrupted by other I bit maskable interrupt requests per default. In order to make an interrupt service routine (ISR) interruptible, the ISR must explicitly clear the I bit in the CCR (CLI). After clearing the I bit, I bit maskable interrupt requests with higher priority can interrupt the current ISR. An ISR of an interruptible I bit maskable interrupt request could basically look like this:
• Service interrupt, e.g., clear interrupt flags, copy data, etc.
• Clear I bit in the CCR by executing the instruction CLI (thus allowing interrupt requests with higher priority)
• Process data
• Return from interrupt by executing the instruction RTI

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

218 Freescale Semiconductor

Figure 7-14. Interrupt Processing Example

7.5.3 Wake Up from Stop or Wait Mode

7.5.3.1 CPU Wake Up from Stop or Wait Mode

Every I bit maskable interrupt request which is configured to be handled by the CPU is capable of waking the MCU from stop or wait mode. To determine whether an I bit maskable interrupts is qualified to wake up the CPU or not, the same settings as in normal run mode are applied during stop or wait mode:

• If the I bit in the CCR is set, all I bit maskable interrupts are masked from waking up the MCU.
• An I bit maskable interrupt is ignored if it is configured to a priority level below or equal to the current IPL in CCR.
• I bit maskable interrupt requests which are configured to be handled by the XGATE module are not capable of waking up the CPU. The X bit maskable interrupt request can wake up the MCU from stop or wait mode at anytime, even if the X bit in CCR is set. If the X bit maskable interrupt request is used to wake-up the MCU with the X bit in the CCR set, the associated ISR is not called. The CPU then resumes program execution with the instruction following the W AI or STOP instruction. This features works following the same rules like any interrupt request, i.e. care must be taken that the X interrupt request used for wake-up remains active at least until the system begins execution of the instruction following the W AI or STOP instruction; otherwise, wake-up may not occur. Reset L1 (Pending) L3 (Pending) RTI RTI RTI RTI Stacked IPL Processing Levels IPL in CCR

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 219

7.5.3.2 XGATE Wake Up from Stop or Wait Mode

Interrupt request channels which are configured to be handled by the XGATE module are capable of waking up the XGATE module. Interrupt request channels handled by the XGATE module do not affect the state of the CPU.

Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19

220 Freescale Semiconductor

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 221 Chapter 8

8.1 Introduction

The FTM256K2XF module implements the following:

• 256 Kbytes of P-Flash (Program Flash) memory, consisting of 2 physical Flash blocks, intended primarily for nonvolatile code storage Table 8-1. Revision History Revision Number Revision Date Sections Affected Description of Changes V01.00 12 Dec 2007 - Initial version V01.01 19 Dec 2007 8.4.2/8-257 8.4.2/8-257 8.4.2/8-257 8.4.2/8-257 8.3.1/8-226 8.1.3/8-224 8.1.2.4/8-224 8.3.1/8-226 - Removed Load Data Field command 0x05 - Updated Command Error Handling tables based on parent-child relationship with FTM512K3 - Corrected Error Handling table for Full Partition D-Flash, Partition D-Flash, and EEPROM Emulation Query commands - Corrected maximum allowed ERPART for Full Partition D-Flash and Partition D-Flash commands - Corrected P-Flash IFR Accessibility table - Corrected Tag RAM size in Block Diagram - Corrected Buffer RAM size in Feature List - Added EEE Resource Field table and Memory Map V01.02 25 Sep 2009 8.1/8-221 8.3.2.1/8-233 8.4.2.4/8-260 8.4.2.6/8-261 8.4.2.11/8-265 8.4.2.11/8-265 8.4.2.11/8-265 8.4.2.19/8-274 8.3.2/8-231 8.3.2.1/8-233 8.4.1.2/8-252 8.6/8-280 - Clarify single bit fault correction for P-Flash phrase - Expand FDIV vs OSCCLK Frequency table - Add statement concerning code runaway when executing Read Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Program Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Verify Backdoor Access Key command from Flash block containing associated fields - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” - Add ACCERR condition for Disable EEPROM Emulation command The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: - Add caution concerning register writes while command is active - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during reset sequence

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 222

• 32 Kbytes of D-Flash (Data Flash) memory, consisting of 1 physical Flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated EEPROM, as basic Flash memory primarily intended for nonvolatile data storage, or as a combination of both
• 2 Kbytes of buffer RAM, consisting of 1 physical RAM block, that can be used as emulated EEPROM using a built-in hardware scheme, as basic RAM, or as a combination of both The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents or configure module resources for emulated EEPROM operation. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The RAM and Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that specific Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected.

8.1.1 Glossary

Buffer RAM — The buffer RAM constitutes the volatile memory store required for EEE. Memory space in the buffer RAM not required for EEE can be partitioned to provide volatile memory space for applications. Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store required for EEE. Memory space in the D-Flash memory not required for EEE can be partitioned to provide nonvolatile memory space for applications.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 223 D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. EEE (Emulated EEPROM) — A method to emulate the small sector size features and endurance characteristics associated with an EEPROM. EEE IFR — Nonvolatile information register located in the D-Flash block that contains data required to partition the D-Flash memory and buffer RAM for EEE. The EEE IFR is visible in the global memory map by setting the EEEIFRON bit in the MMCCTL1 register. NVM Command Mode— An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once field. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register.

8.1.2 Features

8.1.2.1 P-Flash Features

• 256 Kbytes of P-Flash memory composed of two 128 Kbyte Flash blocks. The 128 Kbyte Flash blocks are each divided into 128 sectors of 1024 bytes.
• Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and phrase program operation
• Flexible protection scheme to prevent accidental program or erase of P-Flash memory

8.1.2.2 D-Flash Features

• Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access
• Dedicated commands to control access to the D-Flash memory over EEE operation
• Single bit fault correction and double bit fault detection within a word during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and word program operation
• Ability to program up to four words in a burst sequence

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

224 Freescale Semiconductor

8.1.2.3 Emulated EEPROM Features

• Up to 2Kbytes of emulated EEPROM (EEE) accessible as 2 Kbytes of RAM
• Flexible protection scheme to prevent accidental program or erase of data
• Automatic EEE file handling using an internal Memory Controller
• Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset
• Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory
• Ability to disable EEE operation and allow priority access to the D-Flash memory
• Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory

8.1.2.4 User Buffer RAM Features

• Up to 2 Kbytes of RAM for user access

8.1.2.5 Other Flash Module Features

• No external high-voltage power supply required for Flash memory program and erase operations
• Interrupt generation on Flash command completion and Flash error detection
• Security mechanism to prevent unauthorized access to the Flash memory

8.1.3 Block Diagram

The block diagram of the Flash module is shown in Figure 8-1.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 225 Figure 8-1. FTM256K2 Block Diagram

8.2 External Signal Description

The Flash module contains no signals that connect off-chip. Oscillator Clock Divider Clock (XTAL) Command Interrupt Request FCLK Protection Security Registers Flash Interface P-Flash sector 0 sector 1 sector 127 16Kx72 16bit internal bus Block 1 XGATE P-Flash sector 0 sector 1 sector 127 16Kx72 Block 0 Error Interrupt Request Memory CPU Controller D-Flash 16Kx22 Buffer RAM Tag RAM 64x16 1Kx16 sector 0 sector 1 sector 127 Scratch RAM 512x16

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

226 Freescale Semiconductor

8.3 Memory Map and Registers

This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module.

8.3.1 Module Memory Map

The S12X architecture places the P-Flash memory between global addresses 0x78_0000 and 0x7F_FFFF as shown in Table 8-2. The P-Flash memory map is shown in Figure 8-2. The FPROT register, described inSection 8.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 8-3. Table 8-2. P-Flash Memory Addressing Global Address Size (Bytes) Description 0x7E_0000 – 0x7F_FFFF 128 K P-Flash Block 0 Contains Flash Configuration Field (see Table 8-3) 0x7A_0000 – 0x7D_FFFF 256 K No P-Flash Memory 0x78_0000 – 0x79_FFFF 128 K P-Flash Block 1 Table 8-3. Flash Configuration Field(1) Global Address Size (Bytes) Description 0x7F_FF00 – 0x7F_FF07 8 Backdoor Comparison Key Refer to Section 8.4.2.11, “Verify Backdoor Access Key Command,” and Section 8.5.1, “Unsecuring the MCU using Backdoor Key Access” 0x7F_FF08 – 0x7F_FF0B(2) 4 Reserved 0x7F_FF0C2 1 P-Flash Protection byte. Refer to Section 8.3.2.9, “P-Flash Protection Register (FPROT)” 0x7F_FF0D2 1 EEE Protection byte Refer to Section 8.3.2.10, “EEE Protection Register (EPROT)” 0x7F_FF0E2 1 Flash Nonvolatile byte Refer to Section 8.3.2.14, “Flash Option Register (FOPT)”

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 227 0x7F_FF0F2 1 Flash Security byte Refer to Section 8.3.2.2, “Flash Security Register (FSEC)” 1. Older versions may have swapped protection byte addresses 2. 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved field should be programmed to 0xFF. Table 8-3. Flash Configuration Field(1) Global Address Size (Bytes) Description

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

228 Freescale Semiconductor

Figure 8-2. P-Flash Memory Map Flash Configuration Field 0x7F_C000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_8000 0x7F_9000 0x7F_8400 0x7F_8800 0x7F_A000 P-Flash END = 0x7F_FFFF 0x7F_F800 0x7F_F000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes Flash Protected/Unprotected Region 16 bytes (0x7F_FF00 - 0x7F_FF0F) Flash Protected/Unprotected Region

224 Kbytes

P-Flash START = 0x78_0000 0x79_FFFF 0x7E_0000

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 229 Table 8-4. Program IFR Fields Global Address (PGMIFRON) Size (Bytes) Field Description 0x40_0000 – 0x40_0007 8 Device ID 0x40_0008 – 0x40_00E7 224 Reserved 0x40_00E8 – 0x40_00E9 2 Version ID 0x40_00EA – 0x40_00FF 22 Reserved 0x40_0100 – 0x40_013F 64 Program Once Field Refer to Section 8.4.2.6, “Program Once Command” 0x40_0140 – 0x40_01FF 192 Reserved Table 8-5. P-Flash IFR Accessibility Global Address (PGMIFRON) Size (Bytes) Accessed From 0x40_0000 – 0x40_01FF 512 XBUS0 (PBLK0) (1) 1. Refer to Table 8-4 for more details. 0x40_0200 – 0x40_03FF 512 Unimplemented 0x40_0400 – 0x40_05FF 512 Unimplemented 0x40_0600 – 0x40_07FF 512 XBUS1 (PBLK1) Table 8-6. EEE Resource Fields Global Address Size (Bytes) Description 0x10_0000 – 0x10_7FFF 32,768 D-Flash Memory (User and EEE) 0x10_8000 – 0x11_FFFF 98,304 Reserved 0x12_0000 – 0x12_007F 128 EEE Nonvolatile Information Register (EEEIFRON (1) = 1) 1. MMCCTL1 register bit 0x12_0080 – 0x12_0FFF 3,968 Reserved 0x12_1000 – 0x12_1F7F 3,968 Reserved 0x12_1F80 – 0x12_1FFF 128 EEE Tag RAM (TMGRAMON 1 = 1) 0x12_2000 – 0x12_3BFF 7,168 Reserved 0x12_3C00 – 0x12_3FFF 1,024 Memory Controller Scratch RAM (TMGRAMON 1 = 1) 0x12_4000 – 0x12_DFFF 40,960 Reserved 0x12_E000 – 0x12_FFFF 8,192 Reserved 0x13_0000 – 0x13_F7FF 63,488 Reserved 0x13_F800 – 0x13_FFFF 2,048 Buffer RAM (User and EEE)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

230 Freescale Semiconductor

Figure 8-3. EEE Resource Memory Map Buffer RAM START = 0x13_F800 Buffer RAM END = 0x13_FFFF 0x13_FFC0 0x13_FF80 Protectable Region (EEE only) 64, 128, 192, 256, 320, 384, 448, 512 bytes Buffer RAM

2 Kbyte

0x13_FF40 0x13_FF00 0x13_FEC0 0x13_FE80 0x13_FE40 0x13_FE00 0x12_FFFF 0x12_4000 0x12_1000 Memory Controller Scratch RAM (TMGRAMON) 1024 bytes EEE Tag RAM (TMGRAMON) 128 bytes EEE Nonvolatile Information Register (EEEIFRON) 128 bytes D-Flash Memory D-Flash START = 0x10_0000 D-Flash User Partition D-Flash EEE Partition 0x12_0000 0x12_2000 0x12_E000 D-Flash END = 0x10_7FFF Buffer RAM User Partition Buffer RAM EEE Partition

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 231 The Full Partition D-Flash command (see Section 8.4.2.14) is used to program the EEE nonvolatile information register fields where address 0x12_0000 defines the D-Flash partition for user access and address 0x12_0004 defines the buffer RAM partition for EEE operations.

8.3.2 Register Descriptions

The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 8-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Table 8-7. EEE Nonvolatile Information Register Fields Global Address (EEEIFRON) Size (Bytes) Description 0x12_0000 – 0x12_0001 2 D-Flash User Partition (DFPART) Refer to Section 8.4.2.14, “Full Partition D-Flash Command” 0x12_0002 – 0x12_0003 2 D-Flash User Partition (duplicate (1)) 1. Duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 – 0x12_0005 2 Buffer RAM EEE Partition (ERPART) Refer to Section 8.4.2.14, “Full Partition D-Flash Command” 0x12_0006 – 0x12_0007 2 Buffer RAM EEE Partition (duplicate 1) 0x12_0008 – 0x12_007F 120 Reserved Address & Name 76543210 0x0000 FCLKDIV R FDIVLD FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W 0x0001 FSEC R KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 W 0x0002 FCCOBIX R0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 W 0x0003 FECCRIX R0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 W 0x0004 FCNFG R CCIE IGNSF FDFD FSFD W Figure 8-4. FTM256K2XF Register Summary

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

232 Freescale Semiconductor

R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W 0x0006 FSTAT R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 W 0x0007 FERSTAT R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W 0x0008 FPROT R FPOPEN RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W 0x0009 EPROT R EPOPEN RNV6 RNV5 RNV4 EPDIS EPS2 EPS1 EPS0 W 0x000A FCCOBHI R CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 W 0x000B FCCOBLO R CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 W 0x000C ETAGHI R ETAG15 ETAG14 ETAG13 ETAG12 ETAG11 ETAG10 ETAG9 ETAG8 W 0x000D ETAGLO R ETAG7 ETAG6 ETAG5 ETAG4 ETAG3 ETAG2 ETAG1 ETAG0 W 0x000E FECCRHI R ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 W 0x000F FECCRLO R ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 W 0x0010 FOPT R NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 W 0x0011 FRSV0 R 00000000 W 0x0012 FRSV1 R 00000000 W Address & Name 76543210 Figure 8-4. FTM256K2XF Register Summary (continued)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 233

8.3.2.1 Flash Clock Divider Register (FCLKDIV)

The FCLKDIV register is used to control timed events in program and erase algorithms. All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. 0x0013 FRSV2 R 00000000 W = Unimplemented or Reserved Offset Module Base + 0x0000 76543210 R FDIVLD FDIV[6:0] W Reset 00000000 = Unimplemented or Reserved Figure 8-5. Flash Clock Divider Register (FCLKDIV) Table 8-8. FCLKDIV Field Descriptions Field Description FDIVLD Clock Divider Loaded 6–0 FDIV[6:0] Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 8-9 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 8.4.1, “Flash Command Operations,” for more information. Address & Name 76543210 Figure 8-4. FTM256K2XF Register Summary (continued)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

234 Freescale Semiconductor

Table 8-9. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] MIN(1) 1. FDIV shown generates an FCLK frequency of >0.8 MHz MAX(2) MIN1 MAX2 MIN1 MAX2 33.60 34.65 0x20 67.20 68.25 0x40

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 235

8.3.2.2 Flash Security Register (FSEC)

The FSEC register holds all bits associated with the security of the MCU and Flash module. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 8-3) as indicated by reset condition F in Figure 8-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. 2. FDIV shown generates an FCLK frequency of 1.05 MHz Offset Module Base + 0x0001 76543210 R KEYEN[1:0] RNV[5:2] SEC[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 8-6. Flash Security Register (FSEC) Table 8-10. FSEC Field Descriptions Field Description 7–6 KEYEN[1:0] Backdoor Key Security Enable Bits— The KEYEN[1:0] bits define the enabling of backdoor key access to the Flash module as shown in Table 8-11. 5–2 RNV[5:2} Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. 1–0 SEC[1:0] Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 8-12. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 8-11. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access

1. Preferred KEYEN state to disable backdoor key access.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

236 Freescale Semiconductor

The security function in the Flash module is described in Section 8.5.

8.3.2.3 Flash CCOB Index Register (FCCOBIX)

The FCCOBIX register is used to index the FCCOB register for Flash memory operations. CCOBIX bits are readable and writable while remaining bits read 0 and are not writable.

8.3.2.4 Flash ECCR Index Register (FECCRIX)

The FECCRIX register is used to index the FECCR register for ECC fault reporting. ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. Table 8-12. Flash Security States SEC[1:0] Status of Security

1. Preferred SEC state to set MCU to secured state.

Offset Module Base + 0x0002 76543210 R 00000 CCOBIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 8-7. FCCOB Index Register (FCCOBIX) Table 8-13. FCCOBIX Field Descriptions Field Description 2–0 CCOBIX[1:0] Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. SeeSection 8.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. Offset Module Base + 0x0003 76543210 R 00000 ECCRIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 8-8. FECCR Index Register (FECCRIX)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 237

8.3.2.5 Flash Configuration Register (FCNFG)

The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 8-14. FECCRIX Field Descriptions Field Description 2-0 ECCRIX[2:0] ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is Offset Module Base + 0x0004 76543210 R CCIE IGNSF FDFD FSFD W Reset 00000000 = Unimplemented or Reserved Figure 8-9. Flash Configuration Register (FCNFG) Table 8-15. FCNFG Field Descriptions Field Description CCIE Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 8.3.2.7) IGNSF Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 8.3.2.8). 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

238 Freescale Semiconductor

8.3.2.6 Flash Error Configuration Register (FERCNFG)

The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. All assigned bits in the FERCNFG register are readable and writable. FDFD Force Double Bit Fault Detect— The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected Section 8.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 8.3.2.6) FSFD Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 8.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 8.3.2.6) Offset Module Base + 0x0005 76543210 R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W Reset 00000000 = Unimplemented or Reserved Figure 8-10. Flash Error Configuration Register (FERCNFG) Table 8-16. FERCNFG Field Descriptions Field Description ERSERIE EEE Erase Error Interrupt Enable— The ERSERIE bit controls interrupt generation when a failure is detected during an EEE erase operation. 1 An interrupt will be requested whenever the ERSERIF flag is set (see Section 8.3.2.8) PGMERIE EEE Program Error Interrupt Enable — The PGMERIE bit controls interrupt generation when a failure is detected during an EEE program operation. 1 An interrupt will be requested whenever the PGMERIF flag is set (see Section 8.3.2.8) EPVIOLIE EEE Protection Violation Interrupt Enable — The EPVIOLIE bit controls interrupt generation when a protection violation is detected during a write to the buffer RAM EEE partition. 1 An interrupt will be requested whenever the EPVIOLIF flag is set (see Section 8.3.2.8) Table 8-15. FCNFG Field Descriptions (continued) Field Description

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 239

8.3.2.7 Flash Status Register (FSTAT)

The FSTAT register reports the operational status of the Flash module. CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. ERSVIE1 EEE Error Type 1 Interrupt Enable— The ERSVIE1 bit controls interrupt generation when a change state error is detected during an EEE operation. 1 An interrupt will be requested whenever the ERSVIF1 flag is set (see Section 8.3.2.8) ERSVIE0 EEE Error Type 0 Interrupt Enable— The ERSVIE0 bit controls interrupt generation when a sector format error is detected during an EEE operation. 1 An interrupt will be requested whenever the ERSVIF0 flag is set (see Section 8.3.2.8) DFDIE Double Bit Fault Detect Interrupt Enable— The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 8.3.2.8) SFDIE Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 8.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 8.3.2.8) Offset Module Base + 0x0006 76543210 R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT[1:0] W Reset 100000 0 (1) 1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 8.6). = Unimplemented or Reserved Figure 8-11. Flash Status Register (FSTAT) Table 8-16. FERCNFG Field Descriptions (continued) Field Description

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

240 Freescale Semiconductor

8.3.2.8 Flash Error Status Register (FERSTAT)

The FERSTAT register reflects the error status of internal Flash operations. All flags in the FERSTAT register are readable and only writable to clear the flag. Table 8-17. FSTAT Field Descriptions Field Description CCIF Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 8.4.1.2) or issuing an illegal Flash command or when errors are encountered while initializing the EEE buffer ram during the reset sequence. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller Reserved Bit — This bit is reserved and always reads 0 . 1–0 MGSTAT[1:0] Memory Controller Command Completion Status Flag— One or more MGSTAT flag bits are set if an error is detected during execution of a Flash command or during the Flash reset sequence. See Section 8.4.2, “Flash Command Description,” andSection 8.6, “Initialization” for details. Offset Module Base + 0x0007 76543210 R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W Reset 00000000 = Unimplemented or Reserved Figure 8-12. Flash Error Status Register (FERSTAT)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 241

8.3.2.9 P-Flash Protection Register (FPROT)

The FPROT register defines which P-Flash sectors are protected against program and erase operations. Table 8-18. FERSTAT Field Descriptions Field Description ERSERIF EEE Erase Error Interrupt Flag — The setting of the ERSERIF flag occurs due to an error in a Flash erase command that resulted in the erase operation not being successful during EEE operations. The ERSERIF flag is cleared by writing a 1 to ERSERIF. Writing a 0 to the ERSERIF flag has no effect on ERSERIF. While ERSERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Program Error Interrupt Flag — The setting of the PGMERIF flag occurs due to an error in a Flash program command that resulted in the program operation not being successful during EEE operations. The PGMERIF flag is cleared by writing a 1 to PGMERIF. Writing a 0 to the PGMERIF flag has no effect on PGMERIF. While PGMERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Protection Violation Interrupt Flag—The setting of the EPVIOLIF flag indicates an attempt was made to write to a protected area of the buffer RAM EEE partition. The EPVIOLIF flag is cleared by writing a 1 to EPVIOLIF. Writing a 0 to the EPVIOLIF flag has no effect on EPVIOLIF. While EPVIOLIF is set, it is possible to write to the buffer RAM EEE partition as long as the address written to is not in a protected area. EEE Error Interrupt 1 Flag —The setting of the ERSVIF1 flag indicates that the memory controller was unable to change the state of a D-Flash EEE sector. The ERSVIF1 flag is cleared by writing a 1 to ERSVIF1. Writing a 0 to the ERSVIF1 flag has no effect on ERSVIF1. While ERSVIF1 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Error Interrupt 0 Flag —The setting of the ERSVIF0 flag indicates that the memory controller was unable to format a D-Flash EEE sector for EEE use. The ERSVIF0 flag is cleared by writing a 1 to ERSVIF0. Writing a 0 to the ERSVIF0 flag has no effect on ERSVIF0. While ERSVIF0 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

242 Freescale Semiconductor

The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 8-3) as indicated by reset condition ‘F’ inFigure 8-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Offset Module Base + 0x0008 76543210 R FPOPEN RNV6 FPHDIS FPHS[1:0] FPLDIS FPLS[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 8-13. Flash Protection Register (FPROT) Table 8-19. FPROT Field Descriptions Field Description FPOPEN Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 8-20 for the P-Flash block. corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits RNV[6] Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. FPHDIS Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x7F_FFFF. 4–3 FPHS[1:0] Flash Protection Higher Address Size— The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 8-21. The FPHS bits can only be written to while the FPHDIS bit is set. FPLDIS Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x7F_8000. 1–0 FPLS[1:0] Flash Protection Lower Address Size— The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 8-22. The FPLS bits can only be written to while the FPLDIS bit is set.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 243 All possible P-Flash protection scenarios are shown in Figure 8-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. Table 8-20. P-Flash Protection Function FPOPEN FPHDIS FPLDIS Function (1) 1. For range sizes, refer to Table 8-21 and Table 8-22. 1 1 1 No P-Flash Protection 1 1 0 Protected Low Range 1 0 1 Protected High Range 1 0 0 Protected High and Low Ranges 0 1 1 Full P-Flash Memory Protected 0 1 0 Unprotected Low Range 0 0 1 Unprotected High Range 0 0 0 Unprotected High and Low Ranges Table 8-21. P-Flash Protection Higher Address Range FPHS[1:0] Global Address Range Protected Size 00 0x7F_F800–0x7F_FFFF 2 Kbytes 01 0x7F_F000–0x7F_FFFF 4 Kbytes 10 0x7F_E000–0x7F_FFFF 8 Kbytes 11 0x7F_C000–0x7F_FFFF 16 Kbytes Table 8-22. P-Flash Protection Lower Address Range FPLS[1:0] Global Address Range Protected Size 00 0x7F_8000–0x7F_83FF 1 Kbyte 01 0x7F_8000–0x7F_87FF 2 Kbytes 10 0x7F_8000–0x7F_8FFF 4 Kbytes 11 0x7F_8000–0x7F_9FFF 8 Kbytes

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

244 Freescale Semiconductor

Figure 8-14. P-Flash Protection Scenarios 7 6 5 4 FPHS[1:0] FPLS[1:0]3 2 1 0 FPHS[1:0] FPLS[1:0] FPHDIS = 1 FPLDIS = 1 FPHDIS = 1 FPLDIS = 0 FPHDIS = 0 FPLDIS = 1 FPHDIS = 0 FPLDIS = 0 Scenario Scenario Unprotected region Protected region with size Protected region Protected region with size defined by FPLS defined by FPHSnot defined by FPLS, FPHS 0x7F_8000 0x7F_FFFF 0x7F_8000 0x7F_FFFF FLASH START FLASH START FPOPEN = 1FPOPEN = 0

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 245

8.3.2.9.1 P-Flash Protection Restrictions

The general guideline is that P-Flash protection can only be added and not removed.Table 8-23 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions.

8.3.2.10 EEE Protection Register (EPROT)

The EPROT register defines which buffer RAM EEE partition areas are protected against writes. All bits in the EPROT register are readable and writable except for RNV[6:4] which are only readable. The EPOPEN and EPDIS bits can only be written to the protected state. The EPS bits can be written anytime until the EPDIS bit is cleared. If the EPOPEN bit is cleared, the state of the EPDIS and EPS bits is irrelevant. During the reset sequence, the EPROT register is loaded from the EEE protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 8-3) as indicated by reset condition F in Figure 8-15. To change the EEE protection that will be loaded during the reset sequence, the P-Flash sector containing the EEE protection byte must be unprotected, then the EEE protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase Table 8-23. P-Flash Protection Scenario Transitions From Protection Scenario To Protection Scenario(1) 1. Allowed transitions marked with X, see Figure 8-14 for a definition of the scenarios. 01234567 Offset Module Base + 0x0009 76543210 R EPOPEN RNV[6:4] EPDIS EPS[2:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 8-15. EEE Protection Register (EPROT)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

246 Freescale Semiconductor

containing the EEE protection byte during the reset sequence, the EPOPEN bit will be cleared and remaining bits in the EPROT register will be set to leave the buffer RAM EEE partition fully protected. Trying to write data to any protected area in the buffer RAM EEE partition will result in a protection violation error and the EPVIOLIF flag will be set in the FERSTAT register. Trying to write data to any protected area in the buffer RAM partitioned for user access will not be prevented and the EPVIOLIF flag in the FERSTAT register will not set.

8.3.2.11 Flash Common Command Object Register (FCCOB)

The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Table 8-24. EPROT Field Descriptions Field Description EPOPEN Enables writes to the Buffer RAM partitioned for EEE 6–4 RNV[6:4] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements EPDIS Buffer RAM Protection Address Range Disable — The EPDIS bit determines whether there is a protected area in a specific region of the buffer RAM EEE partition. 2–0 EPS[2:0] Buffer RAM Protection Size — The EPS[2:0] bits determine the size of the protected area in the buffer RAM EEE partition as shown inTable 8-21. The EPS bits can only be written to while the EPDIS bit is set. Table 8-25. Buffer RAM EEE Partition Protection Address Range EPS[2:0] Global Address Range Protected Size 000 0x13_FFC0 – 0x13_FFFF 64 bytes 001 0x13_FF80 – 0x13_FFFF 128 bytes 010 0x13_FF40 – 0x13_FFFF 192 bytes 011 0x13_FF00 – 0x13_FFFF 256 bytes 100 0x13_FEC0 – 0x13_FFFF 320 bytes 101 0x13_FE80 – 0x13_FFFF 384 bytes 110 0x13_FE40 – 0x13_FFFF 448 bytes 111 0x13_FE00 – 0x13_FFFF 512 bytes

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 247

8.3.2.11.1 FCCOB - NVM Command Mode

NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown inTable 8-26. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 8-26 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 8.4.2. Offset Module Base + 0x000A 76543210 R CCOB[15:8] W Reset 00000000 Figure 8-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 76543210 R CCOB[7:0] W Reset 00000000 Figure 8-17. Flash Common Command Object Low Register (FCCOBLO) Table 8-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) 000 HI FCMD[7:0] defining Flash command LO 0, Global address [22:16] 001 HI Global address [15:8] LO Global address [7:0] 010 HI Data 0 [15:8] LO Data 0 [7:0]

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

248 Freescale Semiconductor

8.3.2.12 EEE Tag Counter Register (ETAG)

The ETAG register contains the number of outstanding words in the buffer RAM EEE partition that need to be programmed into the D-Flash EEE partition. The ETAG register is decremented prior to the related tagged word being programmed into the D-Flash EEE partition. All tagged words have been programmed into the D-Flash EEE partition once all bits in the ETAG register read 0 and the MGBUSY flag in the FSTAT register reads 0. All ETAG bits are readable but not writable and are cleared by the Memory Controller.

8.3.2.13 Flash ECC Error Results Register (FECCR)

The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (seeSection 8.3.2.4). Once ECC fault information has been stored, no other fault 011 HI Data 1 [15:8] LO Data 1 [7:0] 100 HI Data 2 [15:8] LO Data 2 [7:0] 101 HI Data 3 [15:8] LO Data 3 [7:0] Offset Module Base + 0x000C 76543210 R ETAG[15:8] W Reset 0 0 000000 = Unimplemented or Reserved Figure 8-18. EEE Tag Counter High Register (ETAGHI) Offset Module Base + 0x000D 76543210 R ETAG[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 8-19. EEE Tag Counter Low Register (ETAGLO) Table 8-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 249 information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults, the priority for fault recording is: 1. Double bit fault over single bit fault 2. CPU over XGATE All FECCR bits are readable but not writable. Offset Module Base + 0x000E 76543210 R ECCR[15:8] W Reset 00000000 = Unimplemented or Reserved Figure 8-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 76543210 R ECCR[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 8-21. Flash ECC Error Results Low Register (FECCRLO) Table 8-27. FECCR Index Settings ECCRIX[2:0] FECCR Register Content Bits [15:8] Bit[7] Bits[6:0] [22:16]

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

250 Freescale Semiconductor

The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010.

8.3.2.14 Flash Option Register (FOPT)

The FOPT register is the Flash option register. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 8-3) as indicated by reset condition F in Figure 8-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set.

8.3.2.15 Flash Reserved0 Register (FRSV0)

This Flash register is reserved for factory testing. Table 8-28. FECCR Index=000 Bit Descriptions Field Description 15:8 PAR[7:0] ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. XBUS01 Bus Source Identifier — The XBUS01 bit determines whether the ECC error was caused by a read access from the CPU or XGATE. 6–0 GADDR[22:16] Global Address — The GADDR[22:16] field contains the upper seven bits of the global address having caused the error. Offset Module Base + 0x0010 76543210 R NV[7:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 8-22. Flash Option Register (FOPT) Table 8-29. FOPT Field Descriptions Field Description 7–0 NV[7:0] Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 251 All bits in the FRSV0 register read 0 and are not writable.

8.3.2.16 Flash Reserved1 Register (FRSV1)

This Flash register is reserved for factory testing. All bits in the FRSV1 register read 0 and are not writable.

8.3.2.17 Flash Reserved2 Register (FRSV2)

This Flash register is reserved for factory testing. All bits in the FRSV2 register read 0 and are not writable. Offset Module Base + 0x0011 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 8-23. Flash Reserved0 Register (FRSV0) Offset Module Base + 0x0012 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 8-24. Flash Reserved1 Register (FRSV1) Offset Module Base + 0x0013 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 8-25. Flash Reserved2 Register (FRSV2)

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

252 Freescale Semiconductor

8.4 Functional Description

8.4.1 Flash Command Operations

Flash command operations are used to modify Flash memory contents or configure module resources for EEE operation. The next sections describe:

• How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations
• The command write sequence used to set Flash command parameters and launch execution
• Valid Flash commands available for execution

8.4.1.1 Writing the FCLKDIV Register

Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz.Table 8-9 shows recommended values for the FDIV field based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set.

8.4.1.2 Command Write Sequence

The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 8.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 253

8.4.1.2.1 Define FCCOB Contents

The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 8.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 8-26.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

254 Freescale Semiconductor

Figure 8-26. Generic Flash Command Write Sequence Flowchart Write to FCCOBIX register Write: FSTAT register (to launch command) Clear CCIF 0x80 Clear ACCERR/FPVIOL 0x30 Write: FSTAT registeryes no Access Error and Protection Violation Read: FSTAT register Read: FSTAT register no START yes Check CCIF Set? FCCOB ACCERR/ FPVIOL Set? EXIT Write: FCLKDIV register Read: FCLKDIV register yes noClock Register Written Check FDIVLD Set? noBit Polling for Command Completion Check yes CCIF Set? to identify specific command parameter to load. Write to FCCOB register to load required command parameter. yes no More Parameters? Availability Check Results from previous Command Note: FCLKDIV must be set after each reset

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 255

8.4.1.3 Valid Flash Module Commands

Table 8-30. Flash Commands by Mode FCMD Command Unsecured Secured NS (1) 1. Unsecured Normal Single Chip mode. NX (2) 2. Unsecured Normal Expanded mode. SS(3) 3. Unsecured Special Single Chip mode. ST(4) 4. Unsecured Special Mode. NS (5) 5. Secured Normal Single Chip mode. NX (6) 6. Secured Normal Expanded mode. SS(7) 7. Secured Special Single Chip mode. ST(8) 8. Secured Special Mode. 0x03 Erase Verify P-Flash Section ∗∗∗∗∗ 0x06 Program P-Flash ∗∗∗∗∗ 0x08 Erase All Blocks ∗∗ ∗∗ 0x09 Erase P-Flash Block ∗∗∗∗∗ 0x0A Erase P-Flash Sector ∗∗∗∗∗ 0x0B Unsecure Flash ∗∗ ∗∗ 0x0C Verify Backdoor Access Key ∗∗ 0x0D Set User Margin Level ∗∗∗∗∗ 0x0E Set Field Margin Level ∗∗ 0x0F Full Partition D-Flash ∗∗ 0x10 Erase Verify D-Flash Section ∗∗∗∗∗ 0x11 Program D-Flash ∗∗∗∗∗ 0x12 Erase D-Flash Sector ∗∗∗∗∗

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

256 Freescale Semiconductor

8.4.1.4 P-Flash Commands

Table 8-31 summarizes the valid P-Flash commands along with the effects of the commands on the P- Flash block and other resources within the Flash module.

8.4.1.5 D-Flash and EEE Commands

Table 8-32 summarizes the valid D-Flash and EEE commands along with the effects of the commands on the D-Flash block and EEE operation. Table 8-31. P-Flash Commands FCMD Command Function on P-Flash Memory 0x01 Erase Verify All Blocks Verify that all P-Flash (and D-Flash) blocks are erased. 0x02 Erase Verify Block Verify that a P-Flash block is erased. 0x03 Erase Verify P- Flash Section Verify that a given number of words starting at the address provided are erased. 0x04 Read Once Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. 0x06 Program P-Flash Program a phrase in a P-Flash block. 0x07 Program Once Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. 0x08 Erase All Blocks Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. 0x09 Erase P-Flash Block Erase a single P-Flash block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. 0x0A Erase P-Flash Sector Erase all bytes in a P-Flash sector. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. 0x0C Verify Backdoor Access Key Supports a method of releasing MCU security by verifying a set of security keys. 0x0D Set User Margin Level Specifies a user margin read level for all P-Flash blocks. 0x0E Set Field Margin Level Specifies a field margin read level for all P-Flash blocks (special modes only). Table 8-32. D-Flash Commands FCMD Command Function on D-Flash Memory 0x01 Erase Verify All Blocks Verify that all D-Flash (and P-Flash) blocks are erased. 0x02 Erase Verify Block Verify that the D-Flash block is erased. 0x08 Erase All Blocks Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 257

8.4.2 Flash Command Description

This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller:

• Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register
• Writing an invalid command as part of the command write sequence
• For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 8.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. 0x0D Set User Margin Level Specifies a user margin read level for the D-Flash block. 0x0E Set Field Margin Level Specifies a field margin read level for the D-Flash block (special modes only). 0x0F Full Partition D- Flash Erase the D-Flash block and partition an area of the D-Flash block for user access. 0x10 Erase Verify D- Flash Section Verify that a given number of words starting at the address provided are erased. 0x11 Program D-Flash Program up to four words in the D-Flash block. 0x12 Erase D-Flash Sector Erase all bytes in a sector of the D-Flash block. 0x13 Enable EEPROM Emulation Enable EEPROM emulation where writes to the buffer RAM EEE partition will be copied to the D-Flash EEE partition. 0x14 Disable EEPROM Emulation Suspend all current erase and program activity related to EEPROM emulation but leave current EEE tags set. 0x15 EEPROM Emulation Query Returns EEE partition and status variables. 0x20 Partition D-Flash Partition an area of the D-Flash block for user access. Table 8-32. D-Flash Commands FCMD Command Function on D-Flash Memory

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

258 Freescale Semiconductor

8.4.2.1 Erase Verify All Blocks Command

The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed.

8.4.2.2 Erase Verify Block Command

The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be verified. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF flag will set after the Erase Verify Block operation has completed. Table 8-33. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x01 Not required Table 8-34. Erase Verify All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the read 1 FERSTAT EPVIOLIF None Table 8-35. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x02 Global address [22:16] of the Flash block to be verified.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 259

8.4.2.3 Erase Verify P-Flash Section Command

The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. Table 8-36. Erase Verify Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the read 2 FERSTAT EPVIOLIF None Table 8-37. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x03 Global address [22:16] of a P-Flash block Table 8-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:0] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the requested section crosses a 256 Kbyte boundary FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (2) MGSTAT0 Set if any non-correctable errors have been encountered during the read 2 FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

260 Freescale Semiconductor

8.4.2.4 Read Once Command

The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 8.4.2.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. 128

8.4.2.5 Program P-Flash Command

The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. 1. As defined by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. Table 8-39. Read Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x04 Not Required Table 8-40. Read Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid phrase index is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 261 CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed.

8.4.2.6 Program Once Command

The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 8.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program Table 8-41. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x06 Global address [22:16] to identify P-Flash block

1. Global address [2:0] must be 000

Table 8-42. Program P-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:0] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL Set if the global address [22:0] points to a protected area MGSTAT1 Set if any errors have been encountered during the verify operation (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation2 FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

262 Freescale Semiconductor

Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data.

8.4.2.7 Erase All Blocks Command

The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space including the EEE nonvolatile information register. Table 8-43. Program Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x07 Not Required Table 8-44. Program Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid phrase index is supplied Set if the requested phrase has already been programmed (1) 1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF , the Program Once command will be allowed to execute again on that same phrase. FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 263 Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed.

8.4.2.8 Erase P-Flash Block Command

The Erase P-Flash Block operation will erase all addresses in a P-Flash block. Upon clearing CCIF to launch the Erase P-Flash Block command, the Memory Controller will erase the selected P-Flash block and verify that it is erased. The CCIF flag will set after the Erase P-Flash Block operation has completed. Table 8-45. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x08 Not required Table 8-46. Erase All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if command not available in current mode (see Table 8-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected Table 8-47. Erase P-Flash Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x09 Global address [22:16] to identify P-Flash block

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

264 Freescale Semiconductor

8.4.2.9 Erase P-Flash Sector Command

The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. Table 8-48. Erase P-Flash Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. FPVIOL Set if an area of the selected P-Flash block is protected MGSTAT1 Set if any errors have been encountered during the verify operation (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation2 FERSTAT EPVIOLIF None Table 8-49. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0A Global address [22:16] to identify P-Flash block to be erased 001 Global address [15:0] anywhere within the sector to be erased. Refer to Section 8.1.2.1 for the P-Flash sector size. Table 8-50. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL Set if the selected P-Flash sector is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 265

8.4.2.10 Unsecure Flash Command

The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed.

8.4.2.11 Verify Backdoor Access Key Command

The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 8-11). The Verify Backdoor Access Key command releases security if user- supplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 8- 3). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 8-51. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0B Not required Table 8-52. Unsecure Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if command not available in current mode (see Table 8-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected Table 8-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0C Not required

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

266 Freescale Semiconductor

Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed.

8.4.2.12 Set User Margin Level Command

The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. Table 8-54. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 8.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 8-55. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0D Global address [22:16] to identify the Flash block Table 8-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 267 Valid margin level settings for the Set User Margin Level command are defined in Table 8-56. NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected.

8.4.2.13 Set Field Margin Level Command

The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 8-56. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1) 1. Read margin to the erased state 0x0002 User Margin-0 Level (2) 2. Read margin to the programmed state Table 8-57. Set User Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 8-58. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0E Global address [22:16] to identify the Flash block

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

268 Freescale Semiconductor

Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set Field Margin Level command are defined in Table 8-59. CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. Table 8-59. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1) 1. Read margin to the erased state 0x0002 User Margin-0 Level (2) 2. Read margin to the programmed state 0x0003 Field Margin-1 Level 1 0x0004 Field Margin-0 Level 2 Table 8-60. Set Field Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 269

8.4.2.14 Full Partition D-Flash Command

The Full Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. Upon clearing CCIF to launch the Full Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 8 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 8-7)
• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 8-7)
• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 8-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 8-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Full Partition D-Flash operation has completed, the CCIF flag will set. Running the Full Partition D-Flash command a second time will result in the previous partition values and the entire D-Flash memory being erased. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 8-61. Full Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0F Not required

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

270 Freescale Semiconductor

8.4.2.15 Erase Verify D-Flash Section Command

The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash user partition is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF flag will set after the Erase Verify D- Flash Section operation has completed. Table 8-62. Full Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid DFPART or ERPART selection is supplied(1) 1. As defined by the maximum ERPART for FTM512K3. FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF NoneTable 8-63. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x10 Global address [22:16] to identify the D-Flash block

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 271

8.4.2.16 Program D-Flash Command

The Program D-Flash operation programs one to four previously erased words in the D-Flash user partition. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. No protection checks are made in the Program D-Flash operation on the D-Flash block, only access error checks. The CCIF flag is set when the operation has completed. Table 8-64. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area of the D-Flash EEE partition Set if the requested section breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 8-65. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x11 Global address [22:16] to identify the D-Flash block

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

272 Freescale Semiconductor

8.4.2.17 Erase D-Flash Sector Command

The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash user partition. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase D-Flash Sector operation has completed. Table 8-66. Program D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area in the D-Flash EEE partition Set if the requested group of words breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 8-67. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x12 Global address [22:16] to identify D-Flash block 001 Global address [15:0] anywhere within the sector to be erased. See Section 8.1.2.2 for D-Flash sector size.

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 273

8.4.2.18 Enable EEPROM Emulation Command

The Enable EEPROM Emulation command causes the Memory Controller to enable EEE activity. EEE activity is disabled after any reset. Upon clearing CCIF to launch the Enable EEPROM Emulation command, the CCIF flag will set after the Memory Controller enables EEE operations using the contents of the EEE tag RAM and tag counter. The Full Partition D-Flash or the Partition D-Flash command must be run prior to launching the Enable EEPROM Emulation command. Table 8-68. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 8-69. Enable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x13 Not required Table 8-70. Enable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

274 Freescale Semiconductor

8.4.2.19 Disable EEPROM Emulation Command

The Disable EEPROM Emulation command causes the Memory Controller to suspend current EEE activity. Upon clearing CCIF to launch the Disable EEPROM Emulation command, the Memory Controller will halt EEE operations at the next convenient point without clearing the EEE tag RAM or tag counter before setting the CCIF flag.

8.4.2.20 EEPROM Emulation Query Command

The EEPROM Emulation Query command returns EEE partition and status variables. Upon clearing CCIF to launch the EEPROM Emulation Query command, the CCIF flag will set after the EEE partition and status variables are stored in the FCCOBIX register.If the Emulation Query command is executed prior to partitioning (Partition D-Flash CommandSection 8.4.2.14), the following reset values are returned: DFPART = 0x_FFFF, ERPART = 0x_FFFF, ECOUNT = 0x_FFFF, Dead Sector Count = 0x_00, Ready Sector Count = 0x_00. Table 8-71. Disable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x14 Not required Table 8-72. Disable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 8-73. EEPROM Emulation Query Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x15 Not required (1) 1. Indicates sector erase count

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 275

8.4.2.21 Partition D-Flash Command

The Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 64 sectors with 256 bytes per sector. The Erase All Blocks command must be run prior to launching the Partition D-Flash command. Upon clearing CCIF to launch the Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 8 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase verify the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 8-7)
• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 8-7) Table 8-74. EEPROM Emulation Query Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if command not available in current mode (see Table 8-30) FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 8-75. Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x20 Not required

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

276 Freescale Semiconductor

• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 8-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 8-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Partition D-Flash operation has completed, the CCIF flag will set. Running the Partition D-Flash command a second time will result in the ACCERR bit within the FSTAT register being set. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 8-76. Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 8-30) Set if partitions have already been defined Set if an invalid DFPART or ERPART selection is supplied (1) 1. As defined by the maximum ERPART for FTM512K3. FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 277

8.4.3 Interrupts

The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an EEE error or an ECC fault. NOTE Vector addresses and their relative interrupt priority are determined at the MCU level.

8.4.3.1 Description of Flash Interrupt Operation

The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the ERSEIF, PGMEIF, EPVIOLIF, ERSVIF1, ERSVIF0, DFDIF and SFDIF flags in combination with the ERSEIE, PGMEIE, EPVIOLIE, ERSVIE1, ERSVIE0, DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 8.3.2.5, “Flash Configuration Register Status Register (FSTAT)”, and Section 8.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 8-27. Table 8-77. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Command Complete CCIF (FSTAT register) CCIE (FCNFG register) I Bit Flash EEE Erase Error ERSERIF (FERSTAT register) ERSERIE (FERCNFG register) I Bit Flash EEE Program Error PGMERIF (FERSTAT register) PGMERIE (FERCNFG register) I Bit Flash EEE Protection Violation EPVIOLIF (FERSTAT register) EPVIOLIE (FERCNFG register) I Bit Flash EEE Error Type 1 Violation ERSVIF1 (FERSTAT register) ERSVIE1 (FERCNFG register) I Bit Flash EEE Error Type 0 Violation ERSVIF0 (FERSTAT register) ERSVIE0 (FERCNFG register) I Bit ECC Double Bit Fault on Flash Read DFDIF (FERSTAT register) DFDIE (FERCNFG register) I Bit ECC Single Bit Fault on Flash Read SFDIF (FERSTAT register) SFDIE (FERCNFG register) I Bit

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

278 Freescale Semiconductor

Figure 8-27. Flash Module Interrupts Implementation

8.4.4 Wait Mode

The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 8.4.3, “Interrupts”).

8.4.5 Stop Mode

If a Flash command is active (CCIF = 0) or an EE-Emulation operation is pending when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode.

8.5 Security

The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 8-12). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F. Flash Error Interrupt Request CCIF CCIE EPVIOLIF EPVIOLIE ERSVIF1 ERSVIE1 ERSVIF0 ERSVIE0 PGMERIF PGMERIE ERSERIF ERSERIE Flash Command Interrupt Request DFDIF DFDIE SFDIF SFDIE

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 279 The security state out of reset can be permanently changed by programming the security byte of the Flash configuration field. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects:

• Unsecuring the MCU using Backdoor Key Access
• Unsecuring the MCU in Special Single Chip Mode using BDM
• Mode and Security Effects on Flash Command Availability

8.5.1 Unsecuring the MCU using Backdoor Key Access

The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 8.3.2.2), the Verify Backdoor Access Key command (see Section 8.4.2.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 8-12) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 8.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 8.4.2.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field. The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte

Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

280 Freescale Semiconductor

(0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT.

8.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM

The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods:

• Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory.
• Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method:
• Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU.

8.5.3 Mode and Security Effects on Flash Command Availability

The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 8-30.

8.6 Initialization

On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. The ACCERR bit in the FSTAT register is set if errors are encountered while initializing the EEE buffer ram during the reset sequence. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed.

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 281 Chapter 9

9.1 Introduction

The FTM512K3 module implements the following:

• 512 Kbytes of P-Flash (Program Flash) memory, consisting of 3 physical Flash blocks, intended primarily for nonvolatile code storage
• 32 Kbytes of D-Flash (Data Flash) memory, consisting of 1 physical Flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated EEPROM, as basic Flash memory primarily intended for nonvolatile data storage, or as a combination of both
• 4 Kbytes of buffer RAM, consisting of 1 physical RAM block, that can be used as emulated EEPROM using a built-in hardware scheme, as basic RAM, or as a combination of both Table 9-1. Revision History Revision Number Revision Date Sections Affected Description of Changes V01.09 14 Nov 2007 9.5.2/9-341 9.4.2/9-317 9.4.2.8/9-323 - Changed terminology from ‘word program’ to “Program P-Flash’ in the BDM unsecuring description, Section 9.5.2 - Added requirement that user not write any Flash module register during execution of commands ‘Erase All Blocks’,Section 9.4.2.8, and ‘Unsecure Flash’,Section 9.4.2.11 - Added statement that security is released upon successful completion of command ‘Erase All Blocks’,Section 9.4.2.8 V01.10 19 Dec 2007 9.4.2/9-317 - Corrected Error Handling table for Full Partition D-Flash, Partition D-Flash, and EEPROM Emulation Query commands V01.11 25 Sep 2009 9.1/9-281 9.3.2.1/9-293 9.4.2.4/9-320 9.4.2.7/9-322 9.4.2.12/9-326 9.4.2.12/9-326 9.4.2.12/9-326 9.4.2.20/9-335 9.3.2/9-291 9.3.2.1/9-293 9.4.1.2/9-312 9.6/9-341 - Clarify single bit fault correction for P-Flash phrase - Expand FDIV vs OSCCLK Frequency table - Add statement concerning code runaway when executing Read Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Program Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Verify Backdoor Access Key command from Flash block containing associated fields - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” - Add ACCERR condition for Disable EEPROM Emulation command The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: - Add caution concerning register writes while command is active - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during reset sequence

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 282 The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents or configure module resources for emulated EEPROM operation. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The RAM and Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that specific Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected.

9.1.1 Glossary

Buffer RAM — The buffer RAM constitutes the volatile memory store required for EEE. Memory space in the buffer RAM not required for EEE can be partitioned to provide volatile memory space for applications. Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store required for EEE. Memory space in the D-Flash memory not required for EEE can be partitioned to provide nonvolatile memory space for applications. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. EEE (Emulated EEPROM) — A method to emulate the small sector size features and endurance characteristics associated with an EEPROM.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 283 EEE IFR — Nonvolatile information register located in the D-Flash block that contains data required to partition the D-Flash memory and buffer RAM for EEE. The EEE IFR is visible in the global memory map by setting the EEEIFRON bit in the MMCCTL1 register. NVM Command Mode— An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once field. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register.

9.1.2 Features

9.1.2.1 P-Flash Features

• 512 Kbytes of P-Flash memory composed of one 256 Kbyte Flash block and two 128 Kbyte Flash blocks. The 256 Kbyte Flash block consists of two 128 Kbyte sections each divided into 128 sectors of 1024 bytes. The 128 Kbyte Flash blocks are each divided into 128 sectors of 1024 bytes.
• Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and phrase program operation
• Ability to program up to one phrase in each P-Flash block simultaneously
• Flexible protection scheme to prevent accidental program or erase of P-Flash memory

9.1.2.2 D-Flash Features

• Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access
• Dedicated commands to control access to the D-Flash memory over EEE operation
• Single bit fault correction and double bit fault detection within a word during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and word program operation
• Ability to program up to four words in a burst sequence

9.1.2.3 Emulated EEPROM Features

• Up to 4 Kbytes of emulated EEPROM (EEE) accessible as 4 Kbytes of RAM

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

284 Freescale Semiconductor

• Flexible protection scheme to prevent accidental program or erase of data
• Automatic EEE file handling using an internal Memory Controller
• Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset
• Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory
• Ability to disable EEE operation and allow priority access to the D-Flash memory
• Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory

9.1.2.4 User Buffer RAM Features

• Up to 4 Kbytes of RAM for user access

9.1.2.5 Other Flash Module Features

• No external high-voltage power supply required for Flash memory program and erase operations
• Interrupt generation on Flash command completion and Flash error detection
• Security mechanism to prevent unauthorized access to the Flash memory

9.1.3 Block Diagram

The block diagram of the Flash module is shown in Figure 9-1.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 285 Figure 9-1. FTM512K3 Block Diagram

9.2 External Signal Description

The Flash module contains no signals that connect off-chip. Oscillator Clock Divider Clock (XTAL) Command Interrupt Request FCLK Protection Security Registers Flash Interface P-Flash Block 0 32Kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 P-Flash sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 16Kx72 16Kx72 16bit internal bus P-Flash Block 1S Block 1N XGATE 16Kx72 16Kx72 Error Interrupt Request CPU Memory Controller D-Flash 16Kx22 Buffer RAM Tag RAM 128x16 2Kx16 sector 0 sector 1 sector 127 Scratch RAM 512x16

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

286 Freescale Semiconductor

9.3 Memory Map and Registers

This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module.

9.3.1 Module Memory Map

The S12X architecture places the P-Flash memory between global addresses 0x78_0000 and 0x7F_FFFF as shown in Table 9-2. The P-Flash memory map is shown in Figure 9-2. The FPROT register, described inSection 9.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 9-3. Table 9-2. P-Flash Memory Addressing Global Address Size (Bytes) Description 0x7C_0000 – 0x7F_FFFF 256 K P-Flash Block 0 Contains Flash Configuration Field (see Table 9-3) 0x7A_0000 – 0x7B_FFFF 128 K P-Flash Block 1N 0x78_0000 – 0x79_FFFF 128 K P-Flash Block 1S Table 9-3. Flash Configuration Field(1) Global Address Size (Bytes) Description 0x7F_FF00 – 0x7F_FF07 8 Backdoor Comparison Key Refer to Section 9.4.2.12, “Verify Backdoor Access Key Command,” and Section 9.5.1, “Unsecuring the MCU using Backdoor Key Access” 0x7F_FF08 – 0x7F_FF0B(2) 4 Reserved 0x7F_FF0C2 1 P-Flash Protection byte. Refer to Section 9.3.2.9, “P-Flash Protection Register (FPROT)” 0x7F_FF0D2 1 EEE Protection byte Refer to Section 9.3.2.10, “EEE Protection Register (EPROT)” 0x7F_FF0E2 1 Flash Nonvolatile byte Refer to Section 9.3.2.14, “Flash Option Register (FOPT)”

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 287 0x7F_FF0F2 1 Flash Security byte Refer to Section 9.3.2.2, “Flash Security Register (FSEC)” 1. Older versions may have swapped protection byte addresses 2. 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved field should be programmed to 0xFF. Table 9-3. Flash Configuration Field(1) Global Address Size (Bytes) Description

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

288 Freescale Semiconductor

Figure 9-2. P-Flash Memory Map Flash Configuration Field 0x7F_C000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_8000 0x7F_9000 0x7F_8400 0x7F_8800 0x7F_A000 P-Flash END = 0x7F_FFFF 0x7F_F800 0x7F_F000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes Flash Protected/Unprotected Region 16 bytes (0x7F_FF00 - 0x7F_FF0F) Flash Protected/Unprotected Region

480 Kbytes

P-Flash START = 0x78_0000

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 289 Table 9-4. Program IFR Fields Global Address (PGMIFRON) Size (Bytes) Field Description 0x40_0000 – 0x40_0007 8 Device ID 0x40_0008 – 0x40_00E7 224 Reserved 0x40_00E8 – 0x40_00E9 2 Version ID 0x40_00EA – 0x40_00FF 22 Reserved 0x40_0100 – 0x40_013F 64 Program Once Field Refer to Section 9.4.2.7, “Program Once Command” 0x40_0140 – 0x40_01FF 192 Reserved Table 9-5. P-Flash IFR Accessibility Global Address (PGMIFRON) Size (Bytes) Accessed From 0x40_0000 – 0x40_01FF 512 XBUS0 (PBLK0S) (1) 1. Refer to Table 9-4 for more details. 0x40_0200 – 0x40_03FF 512 Unimplemented 0x40_0400 – 0x40_05FF 512 XBUS0 (PBLK1N) 0x40_0600 – 0x40_07FF 512 XBUS1 (PBLK1S) Table 9-6. EEE Resource Fields Global Address Size (Bytes) Description 0x10_0000 – 0x10_7FFF 32,768 D-Flash Memory (User and EEE) 0x10_8000 – 0x11_FFFF 98,304 Reserved 0x12_0000 – 0x12_007F 128 EEE Nonvolatile Information Register (EEEIFRON (1) = 1) 1. MMCCTL1 register bit 0x12_0080 – 0x12_0FFF 3,968 Reserved 0x12_1000 – 0x12_1EFF 3,840 Reserved 0x12_1F00 – 0x12_1FFF 256 EEE Tag RAM (TMGRAMON 1 = 1) 0x12_2000 – 0x12_3BFF 7,168 Reserved 0x12_3C00 – 0x12_3FFF 1,024 Memory Controller Scratch RAM (TMGRAMON 1 = 1) 0x12_4000 – 0x12_DFFF 40,960 Reserved 0x12_E000 – 0x12_FFFF 8,192 Reserved 0x13_0000 – 0x13_EFFF 61,440 Reserved 0x13_F000 – 0x13_FFFF 4,096 Buffer RAM (User and EEE)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

290 Freescale Semiconductor

Figure 9-3. EEE Resource Memory Map The Full Partition D-Flash command (see Section 9.4.2.15) is used to program the EEE nonvolatile information register fields where address 0x12_0000 defines the D-Flash partition for user access and address 0x12_0004 defines the buffer RAM partition for EEE operations. Buffer RAM START = 0x13_F000 Buffer RAM END = 0x13_FFFF 0x13_FFC0 0x13_FF80 Protectable Region (EEE only) 64, 128, 192, 256, 320, 384, 448, 512 bytes Buffer RAM 0x13_FF40 0x13_FF00 0x13_FEC0 0x13_FE80 0x13_FE40 0x13_FE00 0x12_FFFF 0x12_4000 0x12_1000 Memory Controller Scratch RAM (TMGRAMON) 1024 bytes EEE Tag RAM (TMGRAMON) 256 bytes EEE Nonvolatile Information Register (EEEIFRON) 128 bytes D-Flash Memory D-Flash START = 0x10_0000 D-Flash User Partition D-Flash EEE Partition 0x12_0000 0x12_2000 0x12_E000 D-Flash END = 0x10_7FFF Buffer RAM User Partition Buffer RAM EEE Partition

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 291

9.3.2 Register Descriptions

The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 9-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Table 9-7. EEE Nonvolatile Information Register Fields Global Address (EEEIFRON) Size (Bytes) Description 0x12_0000 – 0x12_0001 2 D-Flash User Partition (DFPART) Refer to Section 9.4.2.15, “Full Partition D-Flash Command” 0x12_0002 – 0x12_0003 2 D-Flash User Partition (duplicate (1)) 1. Duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 – 0x12_0005 2 Buffer RAM EEE Partition (ERPART) Refer to Section 9.4.2.15, “Full Partition D-Flash Command” 0x12_0006 – 0x12_0007 2 Buffer RAM EEE Partition (duplicate 1) 0x12_0008 – 0x12_007F 120 Reserved Address & Name 76543210 0x0000 FCLKDIV R FDIVLD FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W 0x0001 FSEC R KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 W 0x0002 FCCOBIX R0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 W 0x0003 FECCRIX R0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 W 0x0004 FCNFG R CCIE IGNSF FDFD FSFD W 0x0005 FERCNFG R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W Figure 9-4. FTM512K3 Register Summary

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

292 Freescale Semiconductor

R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 W 0x0007 FERSTAT R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W 0x0008 FPROT R FPOPEN RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W 0x0009 EPROT R EPOPEN RNV6 RNV5 RNV4 EPDIS EPS2 EPS1 EPS0 W 0x000A FCCOBHI R CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 W 0x000B FCCOBLO R CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 W 0x000C ETAGHI R ETAG15 ETAG14 ETAG13 ETAG12 ETAG11 ETAG10 ETAG9 ETAG8 W 0x000D ETAGLO R ETAG7 ETAG6 ETAG5 ETAG4 ETAG3 ETAG2 ETAG1 ETAG0 W 0x000E FECCRHI R ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 W 0x000F FECCRLO R ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 W 0x0010 FOPT R NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 W 0x0011 FRSV0 R 00000000 W 0x0012 FRSV1 R 00000000 W 0x0013 FRSV2 R 00000000 W Address & Name 76543210 Figure 9-4. FTM512K3 Register Summary (continued)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 293

9.3.2.1 Flash Clock Divider Register (FCLKDIV)

The FCLKDIV register is used to control timed events in program and erase algorithms. All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. = Unimplemented or Reserved Offset Module Base + 0x0000 76543210 R FDIVLD FDIV[6:0] W Reset 00000000 = Unimplemented or Reserved Figure 9-5. Flash Clock Divider Register (FCLKDIV) Table 9-8. FCLKDIV Field Descriptions Field Description FDIVLD Clock Divider Loaded 6–0 FDIV[6:0] Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 9-9 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 9.4.1, “Flash Command Operations,” for more information. Address & Name 76543210 Figure 9-4. FTM512K3 Register Summary (continued)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

294 Freescale Semiconductor

Table 9-9. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] MIN(1) 1. FDIV shown generates an FCLK frequency of >0.8 MHz MAX(2) MIN1 MAX2 MIN1 MAX2 33.60 34.65 0x20 67.20 68.25 0x40

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 295

9.3.2.2 Flash Security Register (FSEC)

The FSEC register holds all bits associated with the security of the MCU and Flash module. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 9-3) as indicated by reset condition F in Figure 9-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. 2. FDIV shown generates an FCLK frequency of 1.05 MHz Offset Module Base + 0x0001 76543210 R KEYEN[1:0] RNV[5:2] SEC[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 9-6. Flash Security Register (FSEC) Table 9-10. FSEC Field Descriptions Field Description 7–6 KEYEN[1:0] Backdoor Key Security Enable Bits— The KEYEN[1:0] bits define the enabling of backdoor key access to the Flash module as shown in Table 9-11. 5–2 RNV[5:2} Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. 1–0 SEC[1:0] Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 9-12. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 9-11. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access

1. Preferred KEYEN state to disable backdoor key access.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

296 Freescale Semiconductor

The security function in the Flash module is described in Section 9.5.

9.3.2.3 Flash CCOB Index Register (FCCOBIX)

The FCCOBIX register is used to index the FCCOB register for Flash memory operations. CCOBIX bits are readable and writable while remaining bits read 0 and are not writable.

9.3.2.4 Flash ECCR Index Register (FECCRIX)

The FECCRIX register is used to index the FECCR register for ECC fault reporting. ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. Table 9-12. Flash Security States SEC[1:0] Status of Security

1. Preferred SEC state to set MCU to secured state.

Offset Module Base + 0x0002 76543210 R 00000 CCOBIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 9-7. FCCOB Index Register (FCCOBIX) Table 9-13. FCCOBIX Field Descriptions Field Description 2–0 CCOBIX[1:0] Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. SeeSection 9.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. Offset Module Base + 0x0003 76543210 R 00000 ECCRIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 9-8. FECCR Index Register (FECCRIX)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 297

9.3.2.5 Flash Configuration Register (FCNFG)

The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 9-14. FECCRIX Field Descriptions Field Description 2-0 ECCRIX[2:0] ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is Offset Module Base + 0x0004 76543210 R CCIE IGNSF FDFD FSFD W Reset 00000000 = Unimplemented or Reserved Figure 9-9. Flash Configuration Register (FCNFG) Table 9-15. FCNFG Field Descriptions Field Description CCIE Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 9.3.2.7) IGNSF Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 9.3.2.8). 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

298 Freescale Semiconductor

9.3.2.6 Flash Error Configuration Register (FERCNFG)

The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. All assigned bits in the FERCNFG register are readable and writable. FDFD Force Double Bit Fault Detect— The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected Section 9.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 9.3.2.6) FSFD Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 9.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 9.3.2.6) Offset Module Base + 0x0005 76543210 R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W Reset 00000000 = Unimplemented or Reserved Figure 9-10. Flash Error Configuration Register (FERCNFG) Table 9-16. FERCNFG Field Descriptions Field Description ERSERIE EEE Erase Error Interrupt Enable— The ERSERIE bit controls interrupt generation when a failure is detected during an EEE erase operation. 1 An interrupt will be requested whenever the ERSERIF flag is set (see Section 9.3.2.8) PGMERIE EEE Program Error Interrupt Enable — The PGMERIE bit controls interrupt generation when a failure is detected during an EEE program operation. 1 An interrupt will be requested whenever the PGMERIF flag is set (see Section 9.3.2.8) EPVIOLIE EEE Protection Violation Interrupt Enable — The EPVIOLIE bit controls interrupt generation when a protection violation is detected during a write to the buffer RAM EEE partition. 1 An interrupt will be requested whenever the EPVIOLIF flag is set (see Section 9.3.2.8) Table 9-15. FCNFG Field Descriptions (continued) Field Description

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 299

9.3.2.7 Flash Status Register (FSTAT)

The FSTAT register reports the operational status of the Flash module. CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. ERSVIE1 EEE Error Type 1 Interrupt Enable— The ERSVIE1 bit controls interrupt generation when a change state error is detected during an EEE operation. 1 An interrupt will be requested whenever the ERSVIF1 flag is set (see Section 9.3.2.8) ERSVIE0 EEE Error Type 0 Interrupt Enable— The ERSVIE0 bit controls interrupt generation when a sector format error is detected during an EEE operation. 1 An interrupt will be requested whenever the ERSVIF0 flag is set (see Section 9.3.2.8) DFDIE Double Bit Fault Detect Interrupt Enable— The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 9.3.2.8) SFDIE Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 9.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 9.3.2.8) Offset Module Base + 0x0006 76543210 R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT[1:0] W Reset 100000 0 (1) 1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 9.6). = Unimplemented or Reserved Figure 9-11. Flash Status Register (FSTAT) Table 9-16. FERCNFG Field Descriptions (continued) Field Description

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

300 Freescale Semiconductor

9.3.2.8 Flash Error Status Register (FERSTAT)

The FERSTAT register reflects the error status of internal Flash operations. All flags in the FERSTAT register are readable and only writable to clear the flag. Table 9-17. FSTAT Field Descriptions Field Description CCIF Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 9.4.1.2) or issuing an illegal Flash command or when errors are encountered while initializing the EEE buffer ram during the reset sequence. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller Reserved Bit — This bit is reserved and always reads 0 . 1–0 MGSTAT[1:0] Memory Controller Command Completion Status Flag— One or more MGSTAT flag bits are set if an error is detected during execution of a Flash command or during the Flash reset sequence. See Section 9.4.2, “Flash Command Description,” andSection 9.6, “Initialization” for details. Offset Module Base + 0x0007 76543210 R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W Reset 00000000 = Unimplemented or Reserved Figure 9-12. Flash Error Status Register (FERSTAT)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 301

9.3.2.9 P-Flash Protection Register (FPROT)

The FPROT register defines which P-Flash sectors are protected against program and erase operations. Table 9-18. FERSTAT Field Descriptions Field Description ERSERIF EEE Erase Error Interrupt Flag — The setting of the ERSERIF flag occurs due to an error in a Flash erase command that resulted in the erase operation not being successful during EEE operations. The ERSERIF flag is cleared by writing a 1 to ERSERIF. Writing a 0 to the ERSERIF flag has no effect on ERSERIF. While ERSERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Program Error Interrupt Flag — The setting of the PGMERIF flag occurs due to an error in a Flash program command that resulted in the program operation not being successful during EEE operations. The PGMERIF flag is cleared by writing a 1 to PGMERIF. Writing a 0 to the PGMERIF flag has no effect on PGMERIF. While PGMERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Protection Violation Interrupt Flag—The setting of the EPVIOLIF flag indicates an attempt was made to write to a protected area of the buffer RAM EEE partition. The EPVIOLIF flag is cleared by writing a 1 to EPVIOLIF. Writing a 0 to the EPVIOLIF flag has no effect on EPVIOLIF. While EPVIOLIF is set, it is possible to write to the buffer RAM EEE partition as long as the address written to is not in a protected area. EEE Error Interrupt 1 Flag —The setting of the ERSVIF1 flag indicates that the memory controller was unable to change the state of a D-Flash EEE sector. The ERSVIF1 flag is cleared by writing a 1 to ERSVIF1. Writing a 0 to the ERSVIF1 flag has no effect on ERSVIF1. While ERSVIF1 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Error Interrupt 0 Flag —The setting of the ERSVIF0 flag indicates that the memory controller was unable to format a D-Flash EEE sector for EEE use. The ERSVIF0 flag is cleared by writing a 1 to ERSVIF0. Writing a 0 to the ERSVIF0 flag has no effect on ERSVIF0. While ERSVIF0 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

302 Freescale Semiconductor

The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 9-3) as indicated by reset condition ‘F’ inFigure 9-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Offset Module Base + 0x0008 76543210 R FPOPEN RNV6 FPHDIS FPHS[1:0] FPLDIS FPLS[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 9-13. Flash Protection Register (FPROT) Table 9-19. FPROT Field Descriptions Field Description FPOPEN Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 9-20 for the P-Flash block. corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits RNV[6] Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. FPHDIS Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x7F_FFFF. 4–3 FPHS[1:0] Flash Protection Higher Address Size— The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 9-21. The FPHS bits can only be written to while the FPHDIS bit is set. FPLDIS Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x7F_8000. 1–0 FPLS[1:0] Flash Protection Lower Address Size— The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 9-22. The FPLS bits can only be written to while the FPLDIS bit is set.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 303 All possible P-Flash protection scenarios are shown in Figure 9-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. Table 9-20. P-Flash Protection Function FPOPEN FPHDIS FPLDIS Function (1) 1. For range sizes, refer to Table 9-21 and Table 9-22. 1 1 1 No P-Flash Protection 1 1 0 Protected Low Range 1 0 1 Protected High Range 1 0 0 Protected High and Low Ranges 0 1 1 Full P-Flash Memory Protected 0 1 0 Unprotected Low Range 0 0 1 Unprotected High Range 0 0 0 Unprotected High and Low Ranges Table 9-21. P-Flash Protection Higher Address Range FPHS[1:0] Global Address Range Protected Size 00 0x7F_F800–0x7F_FFFF 2 Kbytes 01 0x7F_F000–0x7F_FFFF 4 Kbytes 10 0x7F_E000–0x7F_FFFF 8 Kbytes 11 0x7F_C000–0x7F_FFFF 16 Kbytes Table 9-22. P-Flash Protection Lower Address Range FPLS[1:0] Global Address Range Protected Size 00 0x7F_8000–0x7F_83FF 1 Kbyte 01 0x7F_8000–0x7F_87FF 2 Kbytes 10 0x7F_8000–0x7F_8FFF 4 Kbytes 11 0x7F_8000–0x7F_9FFF 8 Kbytes

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

304 Freescale Semiconductor

Figure 9-14. P-Flash Protection Scenarios 7 6 5 4 FPHS[1:0] FPLS[1:0]3 2 1 0 FPHS[1:0] FPLS[1:0] FPHDIS = 1 FPLDIS = 1 FPHDIS = 1 FPLDIS = 0 FPHDIS = 0 FPLDIS = 1 FPHDIS = 0 FPLDIS = 0 Scenario Scenario Unprotected region Protected region with size Protected region Protected region with size defined by FPLS defined by FPHSnot defined by FPLS, FPHS 0x7F_8000 0x7F_FFFF 0x7F_8000 0x7F_FFFF FLASH START FLASH START FPOPEN = 1FPOPEN = 0

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 305

9.3.2.9.1 P-Flash Protection Restrictions

The general guideline is that P-Flash protection can only be added and not removed.Table 9-23 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions.

9.3.2.10 EEE Protection Register (EPROT)

The EPROT register defines which buffer RAM EEE partition areas are protected against writes. All bits in the EPROT register are readable and writable except for RNV[6:4] which are only readable. The EPOPEN and EPDIS bits can only be written to the protected state. The EPS bits can be written anytime until the EPDIS bit is cleared. If the EPOPEN bit is cleared, the state of the EPDIS and EPS bits is irrelevant. During the reset sequence, the EPROT register is loaded from the EEE protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 9-3) as indicated by reset condition F in Figure 9-15. To change the EEE protection that will be loaded during the reset sequence, the P-Flash sector containing the EEE protection byte must be unprotected, then the EEE protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase Table 9-23. P-Flash Protection Scenario Transitions From Protection Scenario To Protection Scenario(1) 1. Allowed transitions marked with X, see Figure 9-14 for a definition of the scenarios. 01234567 Offset Module Base + 0x0009 76543210 R EPOPEN RNV[6:4] EPDIS EPS[2:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 9-15. EEE Protection Register (EPROT)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

306 Freescale Semiconductor

containing the EEE protection byte during the reset sequence, the EPOPEN bit will be cleared and remaining bits in the EPROT register will be set to leave the buffer RAM EEE partition fully protected. Trying to write data to any protected area in the buffer RAM EEE partition will result in a protection violation error and the EPVIOLIF flag will be set in the FERSTAT register. Trying to write data to any protected area in the buffer RAM partitioned for user access will not be prevented and the EPVIOLIF flag in the FERSTAT register will not set.

9.3.2.11 Flash Common Command Object Register (FCCOB)

The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Table 9-24. EPROT Field Descriptions Field Description EPOPEN Enables writes to the Buffer RAM partitioned for EEE 6–4 RNV[6:4] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements EPDIS Buffer RAM Protection Address Range Disable — The EPDIS bit determines whether there is a protected area in a specific region of the buffer RAM EEE partition. 2–0 EPS[2:0] Buffer RAM Protection Size — The EPS[2:0] bits determine the size of the protected area in the buffer RAM EEE partition as shown inTable 9-21. The EPS bits can only be written to while the EPDIS bit is set. Table 9-25. Buffer RAM EEE Partition Protection Address Range EPS[2:0] Global Address Range Protected Size 000 0x13_FFC0 – 0x13_FFFF 64 bytes 001 0x13_FF80 – 0x13_FFFF 128 bytes 010 0x13_FF40 – 0x13_FFFF 192 bytes 011 0x13_FF00 – 0x13_FFFF 256 bytes 100 0x13_FEC0 – 0x13_FFFF 320 bytes 101 0x13_FE80 – 0x13_FFFF 384 bytes 110 0x13_FE40 – 0x13_FFFF 448 bytes 111 0x13_FE00 – 0x13_FFFF 512 bytes

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 307

9.3.2.11.1 FCCOB - NVM Command Mode

NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown inTable 9-26. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 9-26 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 9.4.2. Offset Module Base + 0x000A 76543210 R CCOB[15:8] W Reset 00000000 Figure 9-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 76543210 R CCOB[7:0] W Reset 00000000 Figure 9-17. Flash Common Command Object Low Register (FCCOBLO) Table 9-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) 000 HI FCMD[7:0] defining Flash command LO 0, Global address [22:16] 001 HI Global address [15:8] LO Global address [7:0] 010 HI Data 0 [15:8] LO Data 0 [7:0]

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

308 Freescale Semiconductor

9.3.2.12 EEE Tag Counter Register (ETAG)

The ETAG register contains the number of outstanding words in the buffer RAM EEE partition that need to be programmed into the D-Flash EEE partition. The ETAG register is decremented prior to the related tagged word being programmed into the D-Flash EEE partition. All tagged words have been programmed into the D-Flash EEE partition once all bits in the ETAG register read 0 and the MGBUSY flag in the FSTAT register reads 0. All ETAG bits are readable but not writable and are cleared by the Memory Controller.

9.3.2.13 Flash ECC Error Results Register (FECCR)

The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (seeSection 9.3.2.4). Once ECC fault information has been stored, no other fault 011 HI Data 1 [15:8] LO Data 1 [7:0] 100 HI Data 2 [15:8] LO Data 2 [7:0] 101 HI Data 3 [15:8] LO Data 3 [7:0] Offset Module Base + 0x000C 76543210 R ETAG[15:8] W Reset 0 0 000000 = Unimplemented or Reserved Figure 9-18. EEE Tag Counter High Register (ETAGHI) Offset Module Base + 0x000D 76543210 R ETAG[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 9-19. EEE Tag Counter Low Register (ETAGLO) Table 9-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 309 information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults, the priority for fault recording is: 1. Double bit fault over single bit fault 2. CPU over XGATE All FECCR bits are readable but not writable. Offset Module Base + 0x000E 76543210 R ECCR[15:8] W Reset 00000000 = Unimplemented or Reserved Figure 9-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 76543210 R ECCR[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 9-21. Flash ECC Error Results Low Register (FECCRLO) Table 9-27. FECCR Index Settings ECCRIX[2:0] FECCR Register Content Bits [15:8] Bit[7] Bits[6:0] [22:16]

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

310 Freescale Semiconductor

The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010.

9.3.2.14 Flash Option Register (FOPT)

The FOPT register is the Flash option register. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 9-3) as indicated by reset condition F in Figure 9-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set.

9.3.2.15 Flash Reserved0 Register (FRSV0)

This Flash register is reserved for factory testing. Table 9-28. FECCR Index=000 Bit Descriptions Field Description 15:8 PAR[7:0] ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. XBUS01 Bus Source Identifier — The XBUS01 bit determines whether the ECC error was caused by a read access from the CPU or XGATE. 6–0 GADDR[22:16] Global Address — The GADDR[22:16] field contains the upper seven bits of the global address having caused the error. Offset Module Base + 0x0010 76543210 R NV[7:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 9-22. Flash Option Register (FOPT) Table 9-29. FOPT Field Descriptions Field Description 7–0 NV[7:0] Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 311 All bits in the FRSV0 register read 0 and are not writable.

9.3.2.16 Flash Reserved1 Register (FRSV1)

This Flash register is reserved for factory testing. All bits in the FRSV1 register read 0 and are not writable.

9.3.2.17 Flash Reserved2 Register (FRSV2)

This Flash register is reserved for factory testing. All bits in the FRSV2 register read 0 and are not writable. Offset Module Base + 0x0011 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 9-23. Flash Reserved0 Register (FRSV0) Offset Module Base + 0x0012 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 9-24. Flash Reserved1 Register (FRSV1) Offset Module Base + 0x0013 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 9-25. Flash Reserved2 Register (FRSV2)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

312 Freescale Semiconductor

9.4 Functional Description

9.4.1 Flash Command Operations

Flash command operations are used to modify Flash memory contents or configure module resources for EEE operation. The next sections describe:

• How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations
• The command write sequence used to set Flash command parameters and launch execution
• Valid Flash commands available for execution

9.4.1.1 Writing the FCLKDIV Register

Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz.Table 9-9 shows recommended values for the FDIV field based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set.

9.4.1.2 Command Write Sequence

The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 9.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 313

9.4.1.2.1 Define FCCOB Contents

The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 9.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 9-26.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

314 Freescale Semiconductor

Figure 9-26. Generic Flash Command Write Sequence Flowchart Write to FCCOBIX register Write: FSTAT register (to launch command) Clear CCIF 0x80 Clear ACCERR/FPVIOL 0x30 Write: FSTAT registeryes no Access Error and Protection Violation Read: FSTAT register Read: FSTAT register no START yes Check CCIF Set? FCCOB ACCERR/ FPVIOL Set? EXIT Write: FCLKDIV register Read: FCLKDIV register yes noClock Register Written Check FDIVLD Set? noBit Polling for Command Completion Check yes CCIF Set? to identify specific command parameter to load. Write to FCCOB register to load required command parameter. yes no More Parameters? Availability Check Results from previous Command Note: FCLKDIV must be set after each reset

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 315

9.4.1.3 Valid Flash Module Commands

Table 9-30. Flash Commands by Mode FCMD Command Unsecured Secured NS (1) 1. Unsecured Normal Single Chip mode. NX (2) 2. Unsecured Normal Expanded mode. SS(3) 3. Unsecured Special Single Chip mode. ST(4) 4. Unsecured Special Mode. NS (5) 5. Secured Normal Single Chip mode. NX (6) 6. Secured Normal Expanded mode. SS(7) 7. Secured Special Single Chip mode. ST(8) 8. Secured Special Mode. 0x03 Erase Verify P-Flash Section ∗∗∗∗∗ 0x05 Load Data Field ∗∗∗∗∗ 0x06 Program P-Flash ∗∗∗∗∗ 0x08 Erase All Blocks ∗∗ ∗∗ 0x09 Erase P-Flash Block ∗∗∗∗∗ 0x0A Erase P-Flash Sector ∗∗∗∗∗ 0x0B Unsecure Flash ∗∗ ∗∗ 0x0C Verify Backdoor Access Key ∗∗ 0x0D Set User Margin Level ∗∗∗∗∗ 0x0E Set Field Margin Level ∗∗ 0x0F Full Partition D-Flash ∗∗ 0x10 Erase Verify D-Flash Section ∗∗∗∗∗ 0x11 Program D-Flash ∗∗∗∗∗ 0x12 Erase D-Flash Sector ∗∗∗∗∗

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

316 Freescale Semiconductor

9.4.1.4 P-Flash Commands

Table 9-31 summarizes the valid P-Flash commands along with the effects of the commands on the P- Flash block and other resources within the Flash module.

9.4.1.5 D-Flash and EEE Commands

Table 9-32 summarizes the valid D-Flash and EEE commands along with the effects of the commands on the D-Flash block and EEE operation. Table 9-31. P-Flash Commands FCMD Command Function on P-Flash Memory 0x01 Erase Verify All Blocks Verify that all P-Flash (and D-Flash) blocks are erased. 0x02 Erase Verify Block Verify that a P-Flash block is erased. 0x03 Erase Verify P- Flash Section Verify that a given number of words starting at the address provided are erased. 0x04 Read Once Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. 0x05 Load Data Field Load data for simultaneous multiple P-Flash block operations. 0x06 Program P-Flash Program a phrase in a P-Flash block and any previously loaded phrases for any other P- Flash block (see Load Data Field command). 0x07 Program Once Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. 0x08 Erase All Blocks Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. 0x09 Erase P-Flash Block Erase a single P-Flash block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. 0x0A Erase P-Flash Sector Erase all bytes in a P-Flash sector. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. 0x0C Verify Backdoor Access Key Supports a method of releasing MCU security by verifying a set of security keys. 0x0D Set User Margin Level Specifies a user margin read level for all P-Flash blocks. 0x0E Set Field Margin Level Specifies a field margin read level for all P-Flash blocks (special modes only). Table 9-32. D-Flash Commands FCMD Command Function on D-Flash Memory 0x01 Erase Verify All Blocks Verify that all D-Flash (and P-Flash) blocks are erased. 0x02 Erase Verify Block Verify that the D-Flash block is erased.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 317

9.4.2 Flash Command Description

This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller:

• Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register
• Writing an invalid command as part of the command write sequence
• For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 9.3.2.7). 0x08 Erase All Blocks Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. 0x0D Set User Margin Level Specifies a user margin read level for the D-Flash block. 0x0E Set Field Margin Level Specifies a field margin read level for the D-Flash block (special modes only). 0x0F Full Partition D- Flash Erase the D-Flash block and partition an area of the D-Flash block for user access. 0x10 Erase Verify D- Flash Section Verify that a given number of words starting at the address provided are erased. 0x11 Program D-Flash Program up to four words in the D-Flash block. 0x12 Erase D-Flash Sector Erase all bytes in a sector of the D-Flash block. 0x13 Enable EEPROM Emulation Enable EEPROM emulation where writes to the buffer RAM EEE partition will be copied to the D-Flash EEE partition. 0x14 Disable EEPROM Emulation Suspend all current erase and program activity related to EEPROM emulation but leave current EEE tags set. 0x15 EEPROM Emulation Query Returns EEE partition and status variables. 0x20 Partition D-Flash Partition an area of the D-Flash block for user access. Table 9-32. D-Flash Commands FCMD Command Function on D-Flash Memory

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

318 Freescale Semiconductor

A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed.

9.4.2.1 Erase Verify All Blocks Command

The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed.

9.4.2.2 Erase Verify Block Command

The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be verified. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF flag will set after the Erase Verify Block operation has completed. Table 9-33. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x01 Not required Table 9-34. Erase Verify All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 9-35. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x02 Global address [22:16] of the Flash block to be verified.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 319

9.4.2.3 Erase Verify P-Flash Section Command

The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. The section to be verified cannot cross a 256 Kbyte boundary in the P-Flash memory space. Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. Table 9-36. Erase Verify Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if an invalid global address [22:16] is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 9-37. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x03 Global address [22:16] of a P-Flash block Table 9-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the requested section crosses a 256 Kbyte boundary FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

320 Freescale Semiconductor

9.4.2.4 Read Once Command

The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 9.4.2.7. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. 128

9.4.2.5 Load Data Field Command

The Load Data Field command is executed to provide FCCOB parameters for multiple P-Flash blocks for a future simultaneous program operation in the P-Flash memory space. FERSTAT EPVIOLIF None Table 9-39. Read Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x04 Not Required Table 9-40. Read Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid phrase index is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 9-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 321 Upon clearing CCIF to launch the Load Data Field command, the FCCOB registers will be transferred to the Memory Controller and be programmed in the block specified at the global address given with a future Program P-Flash command launched on a P-Flash block. The CCIF flag will set after the Load Data Field operation has completed. Note that once a Load Data Field command sequence has been initiated, the Load Data Field command sequence will be cancelled if any command other than Load Data Field or the future Program P-Flash is launched. Similarly, if an error occurs after launching a Load Data Field or Program P-Flash command, the associated Load Data Field command sequence will be cancelled.

9.4.2.6 Program P-Flash Command

The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. Table 9-41. Load Data Field Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x05 Global address [22:16] to identify P-Flash block

1. Global address [2:0] must be 000

Table 9-42. Load Data Field Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if a Load Data Field command sequence is currently active and the selected block has previously been selected in the same command sequence Set if a Load Data Field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence FPVIOL Set if the global address [22:0] points to a protected area MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

322 Freescale Semiconductor

A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed.

9.4.2.7 Program Once Command

The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 9.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program Table 9-43. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x06 Global address [22:16] to identify P-Flash block

1. Global address [2:0] must be 000

Table 9-44. Program P-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if a Load Data Field command sequence is currently active and the selected block has previously been selected in the same command sequence Set if a Load Data Field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence FPVIOL Set if the global address [22:0] points to a protected area MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 323 Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data.

9.4.2.8 Erase All Blocks Command

The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space including the EEE nonvolatile information register. Table 9-45. Program Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x07 Not Required Table 9-46. Program Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid phrase index is supplied Set if the requested phrase has already been programmed (1) 1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF , the Program Once command will be allowed to execute again on that same phrase. FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

324 Freescale Semiconductor

Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed.

9.4.2.9 Erase P-Flash Block Command

The Erase P-Flash Block operation will erase all addresses in a P-Flash block. Upon clearing CCIF to launch the Erase P-Flash Block command, the Memory Controller will erase the selected P-Flash block and verify that it is erased. The CCIF flag will set after the Erase P-Flash Block operation has completed. Table 9-47. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x08 Not required Table 9-48. Erase All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected Table 9-49. Erase P-Flash Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x09 Global address [22:16] to identify P-Flash block

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 325

9.4.2.10 Erase P-Flash Sector Command

The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. Table 9-50. Erase P-Flash Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:16] is supplied FPVIOL Set if an area of the selected P-Flash block is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 9-51. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0A Global address [22:16] to identify P-Flash block to be erased 001 Global address [15:0] anywhere within the sector to be erased. Refer to Section 9.1.2.1 for the P-Flash sector size. Table 9-52. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:16] is supplied Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL Set if the selected P-Flash sector is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

326 Freescale Semiconductor

9.4.2.11 Unsecure Flash Command

The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed.

9.4.2.12 Verify Backdoor Access Key Command

The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 9-11). The Verify Backdoor Access Key command releases security if user- supplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 9- 3). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 9-53. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0B Not required Table 9-54. Unsecure Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protectedTable 9-55. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0C Not required

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 327 Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed.

9.4.2.13 Set User Margin Level Command

The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set User Margin Level command are defined in Table 9-58. Table 9-56. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 100 at command launch Set if a Load Data Field command sequence is currently active Set if an incorrect backdoor key is supplied Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 9.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 9-57. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0D Global address [22:16] to identify the Flash block Table 9-58. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1)

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

328 Freescale Semiconductor

User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected.

9.4.2.14 Set Field Margin Level Command

The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. 0x0002 User Margin-0 Level (2) 1. Read margin to the erased state 2. Read margin to the programmed state Table 9-59. Set User Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:16] is supplied Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 9-60. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0E Global address [22:16] to identify the Flash block Table 9-58. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 329 Valid margin level settings for the Set Field Margin Level command are defined in Table 9-61. CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed.

9.4.2.15 Full Partition D-Flash Command

The Full Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. Table 9-61. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1) 1. Read margin to the erased state 0x0002 User Margin-0 Level (2) 2. Read margin to the programmed state 0x0003 Field Margin-1 Level 1 0x0004 Field Margin-0 Level 2 Table 9-62. Set Field Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:16] is supplied Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

330 Freescale Semiconductor

Upon clearing CCIF to launch the Full Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 16 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 9-7)
• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 9-7)
• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 9-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 9-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Full Partition D-Flash operation has completed, the CCIF flag will set. Running the Full Partition D-Flash command a second time will result in the previous partition values and the entire D-Flash memory being erased. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 9-63. Full Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0F Not required

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 331

9.4.2.16 Erase Verify D-Flash Section Command

The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash user partition is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF flag will set after the Erase Verify D- Flash Section operation has completed. Table 9-64. Full Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid DFPART or ERPART selection is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 9-65. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x10 Global address [22:16] to identify the D-Flash block

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

332 Freescale Semiconductor

9.4.2.17 Program D-Flash Command

The Program D-Flash operation programs one to four previously erased words in the D-Flash user partition. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. No protection checks are made in the Program D-Flash operation on the D-Flash block, only access error checks. The CCIF flag is set when the operation has completed. Table 9-66. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area of the D-Flash EEE partition Set if the requested section breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 9-67. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x11 Global address [22:16] to identify the D-Flash block

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 333

9.4.2.18 Erase D-Flash Sector Command

The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash user partition. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase D-Flash Sector operation has completed. Table 9-68. Program D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area in the D-Flash EEE partition Set if the requested group of words breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 9-69. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x12 Global address [22:16] to identify D-Flash block 001 Global address [15:0] anywhere within the sector to be erased. See Section 9.1.2.2 for D-Flash sector size.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

334 Freescale Semiconductor

9.4.2.19 Enable EEPROM Emulation Command

The Enable EEPROM Emulation command causes the Memory Controller to enable EEE activity. EEE activity is disabled after any reset. Upon clearing CCIF to launch the Enable EEPROM Emulation command, the CCIF flag will set after the Memory Controller enables EEE operations using the contents of the EEE tag RAM and tag counter. The Full Partition D-Flash or the Partition D-Flash command must be run prior to launching the Enable EEPROM Emulation command. Table 9-70. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 9-71. Enable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x13 Not required Table 9-72. Enable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 335

9.4.2.20 Disable EEPROM Emulation Command

The Disable EEPROM Emulation command causes the Memory Controller to suspend current EEE activity. Upon clearing CCIF to launch the Disable EEPROM Emulation command, the Memory Controller will halt EEE operations at the next convenient point without clearing the EEE tag RAM or tag counter before setting the CCIF flag.

9.4.2.21 EEPROM Emulation Query Command

The EEPROM Emulation Query command returns EEE partition and status variables. Upon clearing CCIF to launch the EEPROM Emulation Query command, the CCIF flag will set after the EEE partition and status variables are stored in the FCCOBIX register.If the Emulation Query command is executed prior to partitioning (Partition D-Flash CommandSection 9.4.2.15), the following reset values are returned: DFPART = 0x_FFFF, ERPART = 0x_FFFF, ECOUNT = 0x_FFFF, Dead Sector Count = 0x_00, Ready Sector Count = 0x_00. Table 9-73. Disable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x14 Not required Table 9-74. Disable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 9-75. EEPROM Emulation Query Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x15 Not required (1) 1. Indicates sector erase count

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

336 Freescale Semiconductor

9.4.2.22 Partition D-Flash Command

The Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. The Erase All Blocks command must be run prior to launching the Partition D-Flash command. Upon clearing CCIF to launch the Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 16 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase verify the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 9-7) Table 9-76. EEPROM Emulation Query Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 9-77. Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x20 Not required

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 337

• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 9-7)
• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 9-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 9-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Partition D-Flash operation has completed, the CCIF flag will set. Running the Partition D-Flash command a second time will result in the ACCERR bit within the FSTAT register being set. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 9-78. Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) Set if partitions have already been defined Set if an invalid DFPART or ERPART selection is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

338 Freescale Semiconductor

9.4.3 Interrupts

The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an EEE error or an ECC fault. NOTE Vector addresses and their relative interrupt priority are determined at the MCU level.

9.4.3.1 Description of Flash Interrupt Operation

The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the ERSEIF, PGMEIF, EPVIOLIF, ERSVIF1, ERSVIF0, DFDIF and SFDIF flags in combination with the ERSEIE, PGMEIE, EPVIOLIE, ERSVIE1, ERSVIE0, DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 9.3.2.5, “Flash Configuration Register Status Register (FSTAT)”, and Section 9.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 9-27. Table 9-79. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Command Complete CCIF (FSTAT register) CCIE (FCNFG register) I Bit Flash EEE Erase Error ERSERIF (FERSTAT register) ERSERIE (FERCNFG register) I Bit Flash EEE Program Error PGMERIF (FERSTAT register) PGMERIE (FERCNFG register) I Bit Flash EEE Protection Violation EPVIOLIF (FERSTAT register) EPVIOLIE (FERCNFG register) I Bit Flash EEE Error Type 1 Violation ERSVIF1 (FERSTAT register) ERSVIE1 (FERCNFG register) I Bit Flash EEE Error Type 0 Violation ERSVIF0 (FERSTAT register) ERSVIE0 (FERCNFG register) I Bit ECC Double Bit Fault on Flash Read DFDIF (FERSTAT register) DFDIE (FERCNFG register) I Bit ECC Single Bit Fault on Flash Read SFDIF (FERSTAT register) SFDIE (FERCNFG register) I Bit

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 339 Figure 9-27. Flash Module Interrupts Implementation

9.4.4 Wait Mode

The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 9.4.3, “Interrupts”).

9.4.5 Stop Mode

If a Flash command is active (CCIF = 0) or an EE-Emulation operation is pending when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode.

9.5 Security

The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 9-12). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F. Flash Error Interrupt Request CCIF CCIE EPVIOLIF EPVIOLIE ERSVIF1 ERSVIE1 ERSVIF0 ERSVIE0 PGMERIF PGMERIE ERSERIF ERSERIE Flash Command Interrupt Request DFDIF DFDIE SFDIF SFDIE

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

340 Freescale Semiconductor

The security state out of reset can be permanently changed by programming the security byte of the Flash configuration field. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects:

• Unsecuring the MCU using Backdoor Key Access
• Unsecuring the MCU in Special Single Chip Mode using BDM
• Mode and Security Effects on Flash Command Availability

9.5.1 Unsecuring the MCU using Backdoor Key Access

The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 9.3.2.2), the Verify Backdoor Access Key command (see Section 9.4.2.12) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 9-12) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 9.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 9.4.2.12 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field. The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 341 (0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT.

9.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM

The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods:

• Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory.
• Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method:
• Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU.

9.5.3 Mode and Security Effects on Flash Command Availability

The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 9-30.

9.6 Initialization

On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. The ACCERR bit in the FSTAT register is set if errors are encountered while initializing the EEE buffer ram during the reset sequence. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed.

Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19

342 Freescale Semiconductor

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 343 Chapter 10 Table 10-1. Revision History Revision Number Revision Date Sections Affected Description of Changes V01.00 12 Dec 2007 - Initial version V01.01 19 Dec 2007 10.4.2/10-379 10.4.2/10-379 10.4.2/10-379 10.4.2/10-379 10.3.1/10-348 10.1.3/10-346 10.3.1/10-348 10.3.1/10-348 - Removed Load Data Field command 0x05 - Updated Command Error Handling tables based on parent-child relationship with FTM512K3 - Corrected Error Handling table for Full Partition D-Flash, Partition D-Flash, and EEPROM Emulation Query commands - Corrected maximum allowed ERPART for Full Partition D-Flash and Partition D-Flash commands - Corrected P-Flash IFR Accessibility table - Corrected Buffer RAM size in Feature List - Corrected EEE Resource Memory Map - Corrected P-Flash Memory Map V01.02 25 Sep 2009 10.1/10-344 10.3.2.1/10-355 10.4.2.4/10-382 10.4.2.6/10-383 10.4.2.11/10- 387 10.4.2.11/10- 387 10.4.2.11/10- 387 10.4.2.19/10- 396 10.3.2/10-353 10.3.2.1/10-355 10.4.1.2/10-374 10.6/10-402 - Change references for D-Flash from 16 Kbytes to 32 Kbytes - Clarify single bit fault correction for P-Flash phrase - Expand FDIV vs OSCCLK Frequency table - Add statement concerning code runaway when executing Read Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Program Once command from Flash block containing associated fields - Add statement concerning code runaway when executing Verify Backdoor Access Key command from Flash block containing associated fields - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” - Add ACCERR condition for Disable EEPROM Emulation command The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: - Add caution concerning register writes while command is active - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during reset sequence

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 344

10.1 Introduction

The FTM128K2XF module implements the following:

• 128 Kbytes of P-Flash (Program Flash) memory, consisting of 2 physical Flash blocks, intended primarily for nonvolatile code storage
• 32 Kbytes of D-Flash (Data Flash) memory, consisting of 1 physical Flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated EEPROM, as basic Flash memory primarily intended for nonvolatile data storage, or as a combination of both
• 2 Kbytes of buffer RAM, consisting of 1 physical RAM block, that can be used as emulated EEPROM using a built-in hardware scheme, as basic RAM, or as a combination of both The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents or configure module resources for emulated EEPROM operation. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The RAM and Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that specific Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected.

10.1.1 Glossary

Buffer RAM — The buffer RAM constitutes the volatile memory store required for EEE. Memory space in the buffer RAM not required for EEE can be partitioned to provide volatile memory space for applications.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 345 Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store required for EEE. Memory space in the D-Flash memory not required for EEE can be partitioned to provide nonvolatile memory space for applications. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. EEE (Emulated EEPROM) — A method to emulate the small sector size features and endurance characteristics associated with an EEPROM. EEE IFR — Nonvolatile information register located in the D-Flash block that contains data required to partition the D-Flash memory and buffer RAM for EEE. The EEE IFR is visible in the global memory map by setting the EEEIFRON bit in the MMCCTL1 register. NVM Command Mode— An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once field. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register.

10.1.2 Features

10.1.2.1 P-Flash Features

• 128 Kbytes of P-Flash memory composed of two 64 Kbyte Flash blocks. The 64 Kbyte Flash blocks are each divided into 64 sectors of 1024 bytes.
• Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and phrase program operation
• Ability to program up to one phrase in each P-Flash block simultaneously
• Flexible protection scheme to prevent accidental program or erase of P-Flash memory

10.1.2.2 D-Flash Features

• Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access
• Dedicated commands to control access to the D-Flash memory over EEE operation

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

346 Freescale Semiconductor

• Single bit fault correction and double bit fault detection within a word during read operations
• Automated program and erase algorithm with verify and generation of ECC parity bits
• Fast sector erase and word program operation
• Ability to program up to four words in a burst sequence

10.1.2.3 Emulated EEPROM Features

• Up to 2 Kbytes of emulated EEPROM (EEE) accessible as 2 Kbytes of RAM
• Flexible protection scheme to prevent accidental program or erase of data
• Automatic EEE file handling using an internal Memory Controller
• Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset
• Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory
• Ability to disable EEE operation and allow priority access to the D-Flash memory
• Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory

10.1.2.4 User Buffer RAM Features

• Up to 2 Kbytes of RAM for user access

10.1.2.5 Other Flash Module Features

• No external high-voltage power supply required for Flash memory program and erase operations
• Interrupt generation on Flash command completion and Flash error detection
• Security mechanism to prevent unauthorized access to the Flash memory

10.1.3 Block Diagram

The block diagram of the Flash module is shown in Figure 10-1.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 347 Figure 10-1. FTM128K2 Block Diagram

10.2 External Signal Description

The Flash module contains no signals that connect off-chip. Oscillator Clock Divider Clock (XTAL) Command Interrupt Request FCLK Protection Security Registers Flash Interface P-Flash sector 0 sector 1 sector 63 8Kx72 16bit internal bus Block 1 XGATE P-Flash sector 0 sector 1 sector 63 8Kx72 Block 0 Error Interrupt Request Memory CPU Controller D-Flash 16Kx22 Buffer RAM Tag RAM 64x16 1Kx16 sector 0 sector 1 sector 127 Scratch RAM 512x16

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

348 Freescale Semiconductor

10.3 Memory Map and Registers

This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module.

10.3.1 Module Memory Map

The S12X architecture places the P-Flash memory between global addresses 0x78_0000 and 0x7F_FFFF as shown in Table 10-2. The P-Flash memory map is shown in Figure 10-2. The FPROT register, described inSection 10.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 10-3. Table 10-2. P-Flash Memory Addressing Global Address Size (Bytes) Description 0x7F_0000 – 0x7F_FFFF 64 K P-Flash Block 0 Contains Flash Configuration Field (see Table 10-3) 0x79_0000 – 0x7E_FFFF 384 K No P-Flash Memory 0x78_0000 – 0x78_FFFF 64 K P-Flash Block 1 Table 10-3. Flash Configuration Field(1) Global Address Size (Bytes) Description 0x7F_FF00 – 0x7F_FF07 8 Backdoor Comparison Key Refer to Section 10.4.2.11, “Verify Backdoor Access Key Command,” and Section 10.5.1, “Unsecuring the MCU using Backdoor Key Access” 0x7F_FF08 – 0x7F_FF0B(2) 4 Reserved 0x7F_FF0C2 1 P-Flash Protection byte. Refer to Section 10.3.2.9, “P-Flash Protection Register (FPROT)” 0x7F_FF0D2 1 EEE Protection byte Refer to Section 10.3.2.10, “EEE Protection Register (EPROT)” 0x7F_FF0E2 1 Flash Nonvolatile byte Refer to Section 10.3.2.14, “Flash Option Register (FOPT)”

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 349 0x7F_FF0F2 1 Flash Security byte Refer to Section 10.3.2.2, “Flash Security Register (FSEC)” 1. Older versions may have swapped protection byte addresses 2. 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved field should be programmed to 0xFF. Table 10-3. Flash Configuration Field(1) Global Address Size (Bytes) Description

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

350 Freescale Semiconductor

Figure 10-2. P-Flash Memory Map Flash Configuration Field 0x7F_C000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_8000 0x7F_9000 0x7F_8400 0x7F_8800 0x7F_A000 P-Flash END = 0x7F_FFFF 0x7F_F800 0x7F_F000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes Flash Protected/Unprotected Region 16 bytes (0x7F_FF00 - 0x7F_FF0F) Flash Protected/Unprotected Region

96 Kbytes

P-Flash START = 0x78_0000 0x78_FFFF 0x7F_0000

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 351 Table 10-4. Program IFR Fields Global Address (PGMIFRON) Size (Bytes) Field Description 0x40_0000 – 0x40_0007 8 Device ID 0x40_0008 – 0x40_00E7 224 Reserved 0x40_00E8 – 0x40_00E9 2 Version ID 0x40_00EA – 0x40_00FF 22 Reserved 0x40_0100 – 0x40_013F 64 Program Once Field Refer to Section 10.4.2.6, “Program Once Command” 0x40_0140 – 0x40_01FF 192 Reserved Table 10-5. P-Flash IFR Accessibility Global Address (PGMIFRON) Size (Bytes) Accessed From 0x40_0000 – 0x40_01FF 512 XBUS0 (PBLK0) (1) 1. Refer to Table 10-4 for more details. 0x40_0200 – 0x40_03FF 512 Unimplemented 0x40_0400 – 0x40_05FF 512 Unimplemented 0x40_0600 – 0x40_07FF 512 XBUS1 (PBLK1) Table 10-6. EEE Resource Fields Global Address Size (Bytes) Description 0x10_0000 – 0x10_7FFF 32,768 D-Flash Memory (User and EEE) 0x10_8000 – 0x11_FFFF 98,304 Reserved 0x12_0000 – 0x12_007F 128 EEE Nonvolatile Information Register (EEEIFRON (1) = 1) 1. MMCCTL1 register bit 0x12_0080 – 0x12_0FFF 3,968 Reserved 0x12_1000 – 0x12_1F7F 3,968 Reserved 0x12_1F80 – 0x12_1FFF 128 EEE Tag RAM (TMGRAMON 1 = 1) 0x12_2000 – 0x12_3BFF 7,168 Reserved 0x12_3C00 – 0x12_3FFF 1,024 Memory Controller Scratch RAM (TMGRAMON 1 = 1) 0x12_4000 – 0x12_DFFF 40,960 Reserved 0x12_E000 – 0x12_FFFF 8,192 Reserved 0x13_0000 – 0x13_F7FF 63,488 Reserved 0x13_F800 – 0x13_FFFF 2,048 Buffer RAM (User and EEE)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

352 Freescale Semiconductor

Figure 10-3. EEE Resource Memory Map Buffer RAM START = 0x13_F800 Buffer RAM END = 0x13_FFFF 0x13_FFC0 0x13_FF80 Protectable Region (EEE only) 64, 128, 192, 256, 320, 384, 448, 512 bytes Buffer RAM 0x13_FF40 0x13_FF00 0x13_FEC0 0x13_FE80 0x13_FE40 0x13_FE00 0x12_FFFF 0x12_4000 0x12_1000 Memory Controller Scratch RAM (TMGRAMON) 1024 bytes EEE Tag RAM (TMGRAMON) 128 bytes EEE Nonvolatile Information Register (EEEIFRON) 128 bytes D-Flash Memory D-Flash START = 0x10_0000 D-Flash User Partition D-Flash EEE Partition 0x12_0000 0x12_2000 0x12_E000 D-Flash END = 0x10_7FFF Buffer RAM User Partition Buffer RAM EEE Partition

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 353 The Full Partition D-Flash command (see Section 10.4.2.14) is used to program the EEE nonvolatile information register fields where address 0x12_0000 defines the D-Flash partition for user access and address 0x12_0004 defines the buffer RAM partition for EEE operations.

10.3.2 Register Descriptions

The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 10-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Table 10-7. EEE Nonvolatile Information Register Fields Global Address (EEEIFRON) Size (Bytes) Description 0x12_0000 – 0x12_0001 2 D-Flash User Partition (DFPART) Refer to Section 10.4.2.14, “Full Partition D-Flash Command” 0x12_0002 – 0x12_0003 2 D-Flash User Partition (duplicate (1)) 1. Duplicate value used if primary value generates a double bit fault when read during the reset sequence. 0x12_0004 – 0x12_0005 2 Buffer RAM EEE Partition (ERPART) Refer to Section 10.4.2.14, “Full Partition D-Flash Command” 0x12_0006 – 0x12_0007 2 Buffer RAM EEE Partition (duplicate 1) 0x12_0008 – 0x12_007F 120 Reserved Address & Name 76543210 0x0000 FCLKDIV R FDIVLD FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W 0x0001 FSEC R KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 W 0x0002 FCCOBIX R0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 W 0x0003 FECCRIX R0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 W 0x0004 FCNFG R CCIE IGNSF FDFD FSFD W Figure 10-4. FTM128K2XF Register Summary

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

354 Freescale Semiconductor

R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W 0x0006 FSTAT R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 W 0x0007 FERSTAT R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W 0x0008 FPROT R FPOPEN RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W 0x0009 EPROT R EPOPEN RNV6 RNV5 RNV4 EPDIS EPS2 EPS1 EPS0 W 0x000A FCCOBHI R CCOB15 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 W 0x000B FCCOBLO R CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 W 0x000C ETAGHI R ETAG15 ETAG14 ETAG13 ETAG12 ETAG11 ETAG10 ETAG9 ETAG8 W 0x000D ETAGLO R ETAG7 ETAG6 ETAG5 ETAG4 ETAG3 ETAG2 ETAG1 ETAG0 W 0x000E FECCRHI R ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 W 0x000F FECCRLO R ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 W 0x0010 FOPT R NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 W 0x0011 FRSV0 R 00000000 W 0x0012 FRSV1 R 00000000 W Address & Name 76543210 Figure 10-4. FTM128K2XF Register Summary (continued)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 355

10.3.2.1 Flash Clock Divider Register (FCLKDIV)

The FCLKDIV register is used to control timed events in program and erase algorithms. All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. 0x0013 FRSV2 R 00000000 W = Unimplemented or Reserved Offset Module Base + 0x0000 76543210 R FDIVLD FDIV[6:0] W Reset 00000000 = Unimplemented or Reserved Figure 10-5. Flash Clock Divider Register (FCLKDIV) Table 10-8. FCLKDIV Field Descriptions Field Description FDIVLD Clock Divider Loaded 6–0 FDIV[6:0] Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 10-9 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 10.4.1, “Flash Command Operations,” for more information. Address & Name 76543210 Figure 10-4. FTM128K2XF Register Summary (continued)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

356 Freescale Semiconductor

Table 10-9. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] OSCCLK Frequency (MHz) FDIV[6:0] MIN(1) 1. FDIV shown generates an FCLK frequency of >0.8 MHz MAX(2) MIN1 MAX2 MIN1 MAX2 33.60 34.65 0x20 67.20 68.25 0x40

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 357

10.3.2.2 Flash Security Register (FSEC)

The FSEC register holds all bits associated with the security of the MCU and Flash module. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 10-3) as indicated by reset condition F in Figure 10-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. 2. FDIV shown generates an FCLK frequency of 1.05 MHz Offset Module Base + 0x0001 76543210 R KEYEN[1:0] RNV[5:2] SEC[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 10-6. Flash Security Register (FSEC) Table 10-10. FSEC Field Descriptions Field Description 7–6 KEYEN[1:0] Backdoor Key Security Enable Bits— The KEYEN[1:0] bits define the enabling of backdoor key access to the Flash module as shown in Table 10-11. 5–2 RNV[5:2} Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. 1–0 SEC[1:0] Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 10-12. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 10-11. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access

1. Preferred KEYEN state to disable backdoor key access.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

358 Freescale Semiconductor

The security function in the Flash module is described in Section 10.5.

10.3.2.3 Flash CCOB Index Register (FCCOBIX)

The FCCOBIX register is used to index the FCCOB register for Flash memory operations. CCOBIX bits are readable and writable while remaining bits read 0 and are not writable.

10.3.2.4 Flash ECCR Index Register (FECCRIX)

The FECCRIX register is used to index the FECCR register for ECC fault reporting. ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. Table 10-12. Flash Security States SEC[1:0] Status of Security

1. Preferred SEC state to set MCU to secured state.

Offset Module Base + 0x0002 76543210 R 00000 CCOBIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 10-7. FCCOB Index Register (FCCOBIX) Table 10-13. FCCOBIX Field Descriptions Field Description 2–0 CCOBIX[1:0] Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. SeeSection 10.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. Offset Module Base + 0x0003 76543210 R 00000 ECCRIX[2:0] W Reset 00000000 = Unimplemented or Reserved Figure 10-8. FECCR Index Register (FECCRIX)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 359

10.3.2.5 Flash Configuration Register (FCNFG)

The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 10-14. FECCRIX Field Descriptions Field Description 2-0 ECCRIX[2:0] ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is Offset Module Base + 0x0004 76543210 R CCIE IGNSF FDFD FSFD W Reset 00000000 = Unimplemented or Reserved Figure 10-9. Flash Configuration Register (FCNFG) Table 10-15. FCNFG Field Descriptions Field Description CCIE Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 10.3.2.7) IGNSF Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 10.3.2.8). 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

360 Freescale Semiconductor

10.3.2.6 Flash Error Configuration Register (FERCNFG)

The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. All assigned bits in the FERCNFG register are readable and writable. FDFD Force Double Bit Fault Detect— The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected Section 10.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 10.3.2.6) FSFD Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 10.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 10.3.2.6) Offset Module Base + 0x0005 76543210 R ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W Reset 00000000 = Unimplemented or Reserved Figure 10-10. Flash Error Configuration Register (FERCNFG) Table 10-16. FERCNFG Field Descriptions Field Description ERSERIE EEE Erase Error Interrupt Enable— The ERSERIE bit controls interrupt generation when a failure is detected during an EEE erase operation. 1 An interrupt will be requested whenever the ERSERIF flag is set (see Section 10.3.2.8) PGMERIE EEE Program Error Interrupt Enable — The PGMERIE bit controls interrupt generation when a failure is detected during an EEE program operation. 1 An interrupt will be requested whenever the PGMERIF flag is set (see Section 10.3.2.8) EPVIOLIE EEE Protection Violation Interrupt Enable — The EPVIOLIE bit controls interrupt generation when a protection violation is detected during a write to the buffer RAM EEE partition. 1 An interrupt will be requested whenever the EPVIOLIF flag is set (see Section 10.3.2.8) Table 10-15. FCNFG Field Descriptions (continued) Field Description

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 361

10.3.2.7 Flash Status Register (FSTAT)

The FSTAT register reports the operational status of the Flash module. CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. ERSVIE1 EEE Error Type 1 Interrupt Enable— The ERSVIE1 bit controls interrupt generation when a change state error is detected during an EEE operation. 1 An interrupt will be requested whenever the ERSVIF1 flag is set (see Section 10.3.2.8) ERSVIE0 EEE Error Type 0 Interrupt Enable— The ERSVIE0 bit controls interrupt generation when a sector format error is detected during an EEE operation. 1 An interrupt will be requested whenever the ERSVIF0 flag is set (see Section 10.3.2.8) DFDIE Double Bit Fault Detect Interrupt Enable— The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 10.3.2.8) SFDIE Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 10.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 10.3.2.8) Offset Module Base + 0x0006 76543210 R CCIF ACCERR FPVIOL MGBUSY RSVD MGSTAT[1:0] W Reset 100000 0 (1) 1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 10.6). = Unimplemented or Reserved Figure 10-11. Flash Status Register (FSTAT) Table 10-16. FERCNFG Field Descriptions (continued) Field Description

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

362 Freescale Semiconductor

10.3.2.8 Flash Error Status Register (FERSTAT)

The FERSTAT register reflects the error status of internal Flash operations. All flags in the FERSTAT register are readable and only writable to clear the flag. Table 10-17. FSTAT Field Descriptions Field Description CCIF Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (seeSection 10.4.1.2) or issuing an illegal Flash command or when errors are encountered while initializing the EEE buffer ram during the reset sequence. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller Reserved Bit — This bit is reserved and always reads 0 . 1–0 MGSTAT[1:0] Memory Controller Command Completion Status Flag— One or more MGSTAT flag bits are set if an error is detected during execution of a Flash command or during the Flash reset sequence. See Section 10.4.2, “Flash Command Description,” andSection 10.6, “Initialization” for details. Offset Module Base + 0x0007 76543210 R ERSERIF PGMERIF EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF W Reset 00000000 = Unimplemented or Reserved Figure 10-12. Flash Error Status Register (FERSTAT)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 363

10.3.2.9 P-Flash Protection Register (FPROT)

The FPROT register defines which P-Flash sectors are protected against program and erase operations. Table 10-18. FERSTAT Field Descriptions Field Description ERSERIF EEE Erase Error Interrupt Flag — The setting of the ERSERIF flag occurs due to an error in a Flash erase command that resulted in the erase operation not being successful during EEE operations. The ERSERIF flag is cleared by writing a 1 to ERSERIF. Writing a 0 to the ERSERIF flag has no effect on ERSERIF. While ERSERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Program Error Interrupt Flag — The setting of the PGMERIF flag occurs due to an error in a Flash program command that resulted in the program operation not being successful during EEE operations. The PGMERIF flag is cleared by writing a 1 to PGMERIF. Writing a 0 to the PGMERIF flag has no effect on PGMERIF. While PGMERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Protection Violation Interrupt Flag—The setting of the EPVIOLIF flag indicates an attempt was made to write to a protected area of the buffer RAM EEE partition. The EPVIOLIF flag is cleared by writing a 1 to EPVIOLIF. Writing a 0 to the EPVIOLIF flag has no effect on EPVIOLIF. While EPVIOLIF is set, it is possible to write to the buffer RAM EEE partition as long as the address written to is not in a protected area. EEE Error Interrupt 1 Flag —The setting of the ERSVIF1 flag indicates that the memory controller was unable to change the state of a D-Flash EEE sector. The ERSVIF1 flag is cleared by writing a 1 to ERSVIF1. Writing a 0 to the ERSVIF1 flag has no effect on ERSVIF1. While ERSVIF1 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. EEE Error Interrupt 0 Flag —The setting of the ERSVIF0 flag indicates that the memory controller was unable to format a D-Flash EEE sector for EEE use. The ERSVIF0 flag is cleared by writing a 1 to ERSVIF0. Writing a 0 to the ERSVIF0 flag has no effect on ERSVIF0. While ERSVIF0 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

364 Freescale Semiconductor

The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (seeTable 10-3) as indicated by reset condition ‘F’ inFigure 10-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Offset Module Base + 0x0008 76543210 R FPOPEN RNV6 FPHDIS FPHS[1:0] FPLDIS FPLS[1:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 10-13. Flash Protection Register (FPROT) Table 10-19. FPROT Field Descriptions Field Description FPOPEN Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 10-20 for the P-Flash block. corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits RNV[6] Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. FPHDIS Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x7F_FFFF. 4–3 FPHS[1:0] Flash Protection Higher Address Size— The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 10-21. The FPHS bits can only be written to while the FPHDIS bit is set. FPLDIS Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x7F_8000. 1–0 FPLS[1:0] Flash Protection Lower Address Size— The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 10-22. The FPLS bits can only be written to while the FPLDIS bit is set.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 365 All possible P-Flash protection scenarios are shown in Figure 10-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. Table 10-20. P-Flash Protection Function FPOPEN FPHDIS FPLDIS Function (1) 1. For range sizes, refer to Table 10-21 and Table 10-22. 1 1 1 No P-Flash Protection 1 1 0 Protected Low Range 1 0 1 Protected High Range 1 0 0 Protected High and Low Ranges 0 1 1 Full P-Flash Memory Protected 0 1 0 Unprotected Low Range 0 0 1 Unprotected High Range 0 0 0 Unprotected High and Low Ranges Table 10-21. P-Flash Protection Higher Address Range FPHS[1:0] Global Address Range Protected Size 00 0x7F_F800–0x7F_FFFF 2 Kbytes 01 0x7F_F000–0x7F_FFFF 4 Kbytes 10 0x7F_E000–0x7F_FFFF 8 Kbytes 11 0x7F_C000–0x7F_FFFF 16 Kbytes Table 10-22. P-Flash Protection Lower Address Range FPLS[1:0] Global Address Range Protected Size 00 0x7F_8000–0x7F_83FF 1 Kbyte 01 0x7F_8000–0x7F_87FF 2 Kbytes 10 0x7F_8000–0x7F_8FFF 4 Kbytes 11 0x7F_8000–0x7F_9FFF 8 Kbytes

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

366 Freescale Semiconductor

Figure 10-14. P-Flash Protection Scenarios 7 6 5 4 FPHS[1:0] FPLS[1:0]3 2 1 0 FPHS[1:0] FPLS[1:0] FPHDIS = 1 FPLDIS = 1 FPHDIS = 1 FPLDIS = 0 FPHDIS = 0 FPLDIS = 1 FPHDIS = 0 FPLDIS = 0 Scenario Scenario Unprotected region Protected region with size Protected region Protected region with size defined by FPLS defined by FPHSnot defined by FPLS, FPHS 0x7F_8000 0x7F_FFFF 0x7F_8000 0x7F_FFFF FLASH START FLASH START FPOPEN = 1FPOPEN = 0

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 367

10.3.2.9.1 P-Flash Protection Restrictions

The general guideline is that P-Flash protection can only be added and not removed.Table 10-23 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions.

10.3.2.10 EEE Protection Register (EPROT)

The EPROT register defines which buffer RAM EEE partition areas are protected against writes. All bits in the EPROT register are readable and writable except for RNV[6:4] which are only readable. The EPOPEN and EPDIS bits can only be written to the protected state. The EPS bits can be written anytime until the EPDIS bit is cleared. If the EPOPEN bit is cleared, the state of the EPDIS and EPS bits is irrelevant. During the reset sequence, the EPROT register is loaded from the EEE protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (seeTable 10-3) as indicated by reset condition F in Figure 10-15. To change the EEE protection that will be loaded during the reset sequence, the P-Flash sector containing the EEE protection byte must be unprotected, then the EEE protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase Table 10-23. P-Flash Protection Scenario Transitions From Protection Scenario To Protection Scenario(1) 1. Allowed transitions marked with X, see Figure 10-14 for a definition of the scenarios. 01234567 Offset Module Base + 0x0009 76543210 R EPOPEN RNV[6:4] EPDIS EPS[2:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 10-15. EEE Protection Register (EPROT)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

368 Freescale Semiconductor

containing the EEE protection byte during the reset sequence, the EPOPEN bit will be cleared and remaining bits in the EPROT register will be set to leave the buffer RAM EEE partition fully protected. Trying to write data to any protected area in the buffer RAM EEE partition will result in a protection violation error and the EPVIOLIF flag will be set in the FERSTAT register. Trying to write data to any protected area in the buffer RAM partitioned for user access will not be prevented and the EPVIOLIF flag in the FERSTAT register will not set.

10.3.2.11 Flash Common Command Object Register (FCCOB)

The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Table 10-24. EPROT Field Descriptions Field Description EPOPEN Enables writes to the Buffer RAM partitioned for EEE 6–4 RNV[6:4] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements EPDIS Buffer RAM Protection Address Range Disable — The EPDIS bit determines whether there is a protected area in a specific region of the buffer RAM EEE partition. 2–0 EPS[2:0] Buffer RAM Protection Size — The EPS[2:0] bits determine the size of the protected area in the buffer RAM EEE partition as shown inTable 10-21. The EPS bits can only be written to while the EPDIS bit is set. Table 10-25. Buffer RAM EEE Partition Protection Address Range EPS[2:0] Global Address Range Protected Size 000 0x13_FFC0 – 0x13_FFFF 64 bytes 001 0x13_FF80 – 0x13_FFFF 128 bytes 010 0x13_FF40 – 0x13_FFFF 192 bytes 011 0x13_FF00 – 0x13_FFFF 256 bytes 100 0x13_FEC0 – 0x13_FFFF 320 bytes 101 0x13_FE80 – 0x13_FFFF 384 bytes 110 0x13_FE40 – 0x13_FFFF 448 bytes 111 0x13_FE00 – 0x13_FFFF 512 bytes

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 369

10.3.2.11.1 FCCOB - NVM Command Mode

NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 10-26. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 10-26 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 10.4.2. Offset Module Base + 0x000A 76543210 R CCOB[15:8] W Reset 00000000 Figure 10-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 76543210 R CCOB[7:0] W Reset 00000000 Figure 10-17. Flash Common Command Object Low Register (FCCOBLO) Table 10-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode) 000 HI FCMD[7:0] defining Flash command LO 0, Global address [22:16] 001 HI Global address [15:8] LO Global address [7:0] 010 HI Data 0 [15:8] LO Data 0 [7:0]

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

370 Freescale Semiconductor

10.3.2.12 EEE Tag Counter Register (ETAG)

The ETAG register contains the number of outstanding words in the buffer RAM EEE partition that need to be programmed into the D-Flash EEE partition. The ETAG register is decremented prior to the related tagged word being programmed into the D-Flash EEE partition. All tagged words have been programmed into the D-Flash EEE partition once all bits in the ETAG register read 0 and the MGBUSY flag in the FSTAT register reads 0. All ETAG bits are readable but not writable and are cleared by the Memory Controller.

10.3.2.13 Flash ECC Error Results Register (FECCR)

The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (see Section 10.3.2.4). Once ECC fault information has been stored, no other 011 HI Data 1 [15:8] LO Data 1 [7:0] 100 HI Data 2 [15:8] LO Data 2 [7:0] 101 HI Data 3 [15:8] LO Data 3 [7:0] Offset Module Base + 0x000C 76543210 R ETAG[15:8] W Reset 0 0 000000 = Unimplemented or Reserved Figure 10-18. EEE Tag Counter High Register (ETAGHI) Offset Module Base + 0x000D 76543210 R ETAG[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 10-19. EEE Tag Counter Low Register (ETAGLO) Table 10-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] Byte FCCOB Parameter Fields (NVM Command Mode)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 371 fault information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults, the priority for fault recording is: 1. Double bit fault over single bit fault 2. CPU over XGATE All FECCR bits are readable but not writable. Offset Module Base + 0x000E 76543210 R ECCR[15:8] W Reset 00000000 = Unimplemented or Reserved Figure 10-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 76543210 R ECCR[7:0] W Reset 00000000 = Unimplemented or Reserved Figure 10-21. Flash ECC Error Results Low Register (FECCRLO) Table 10-27. FECCR Index Settings ECCRIX[2:0] FECCR Register Content Bits [15:8] Bit[7] Bits[6:0] [22:16]

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

372 Freescale Semiconductor

The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010.

10.3.2.14 Flash Option Register (FOPT)

The FOPT register is the Flash option register. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (seeTable 10-3) as indicated by reset condition F in Figure 10-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set.

10.3.2.15 Flash Reserved0 Register (FRSV0)

This Flash register is reserved for factory testing. Table 10-28. FECCR Index=000 Bit Descriptions Field Description 15:8 PAR[7:0] ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. XBUS01 Bus Source Identifier — The XBUS01 bit determines whether the ECC error was caused by a read access from the CPU or XGATE. 6–0 GADDR[22:16] Global Address — The GADDR[22:16] field contains the upper seven bits of the global address having caused the error. Offset Module Base + 0x0010 76543210 R NV[7:0] W Reset F F FFFFFF = Unimplemented or Reserved Figure 10-22. Flash Option Register (FOPT) Table 10-29. FOPT Field Descriptions Field Description 7–0 NV[7:0] Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 373 All bits in the FRSV0 register read 0 and are not writable.

10.3.2.16 Flash Reserved1 Register (FRSV1)

This Flash register is reserved for factory testing. All bits in the FRSV1 register read 0 and are not writable.

10.3.2.17 Flash Reserved2 Register (FRSV2)

This Flash register is reserved for factory testing. All bits in the FRSV2 register read 0 and are not writable. Offset Module Base + 0x0011 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 10-23. Flash Reserved0 Register (FRSV0) Offset Module Base + 0x0012 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 10-24. Flash Reserved1 Register (FRSV1) Offset Module Base + 0x0013 76543210 R 00000000 W Reset 00000000 = Unimplemented or Reserved Figure 10-25. Flash Reserved2 Register (FRSV2)

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

374 Freescale Semiconductor

10.4 Functional Description

10.4.1 Flash Command Operations

Flash command operations are used to modify Flash memory contents or configure module resources for EEE operation. The next sections describe:

• How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations
• The command write sequence used to set Flash command parameters and launch execution
• Valid Flash commands available for execution

10.4.1.1 Writing the FCLKDIV Register

Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz.Table 10-9shows recommended values for the FDIV field based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set.

10.4.1.2 Command Write Sequence

The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 10.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 375

10.4.1.2.1 Define FCCOB Contents

The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 10.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 10-26.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

376 Freescale Semiconductor

Figure 10-26. Generic Flash Command Write Sequence Flowchart Write to FCCOBIX register Write: FSTAT register (to launch command) Clear CCIF 0x80 Clear ACCERR/FPVIOL 0x30 Write: FSTAT registeryes no Access Error and Protection Violation Read: FSTAT register Read: FSTAT register no START yes Check CCIF Set? FCCOB ACCERR/ FPVIOL Set? EXIT Write: FCLKDIV register Read: FCLKDIV register yes noClock Register Written Check FDIVLD Set? noBit Polling for Command Completion Check yes CCIF Set? to identify specific command parameter to load. Write to FCCOB register to load required command parameter. yes no More Parameters? Availability Check Results from previous Command Note: FCLKDIV must be set after each reset

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 377

10.4.1.3 Valid Flash Module Commands

Table 10-30. Flash Commands by Mode FCMD Command Unsecured Secured NS (1) 1. Unsecured Normal Single Chip mode. NX (2) 2. Unsecured Normal Expanded mode. SS(3) 3. Unsecured Special Single Chip mode. ST(4) 4. Unsecured Special Mode. NS (5) 5. Secured Normal Single Chip mode. NX (6) 6. Secured Normal Expanded mode. SS(7) 7. Secured Special Single Chip mode. ST(8) 8. Secured Special Mode. 0x03 Erase Verify P-Flash Section ∗∗∗∗∗ 0x06 Program P-Flash ∗∗∗∗∗ 0x08 Erase All Blocks ∗∗ ∗∗ 0x09 Erase P-Flash Block ∗∗∗∗∗ 0x0A Erase P-Flash Sector ∗∗∗∗∗ 0x0B Unsecure Flash ∗∗ ∗∗ 0x0C Verify Backdoor Access Key ∗∗ 0x0D Set User Margin Level ∗∗∗∗∗ 0x0E Set Field Margin Level ∗∗ 0x0F Full Partition D-Flash ∗∗ 0x10 Erase Verify D-Flash Section ∗∗∗∗∗ 0x11 Program D-Flash ∗∗∗∗∗ 0x12 Erase D-Flash Sector ∗∗∗∗∗

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

378 Freescale Semiconductor

10.4.1.4 P-Flash Commands

Table 10-31 summarizes the valid P-Flash commands along with the effects of the commands on the P- Flash block and other resources within the Flash module.

10.4.1.5 D-Flash and EEE Commands

Table 10-32 summarizes the valid D-Flash and EEE commands along with the effects of the commands on the D-Flash block and EEE operation. Table 10-31. P-Flash Commands FCMD Command Function on P-Flash Memory 0x01 Erase Verify All Blocks Verify that all P-Flash (and D-Flash) blocks are erased. 0x02 Erase Verify Block Verify that a P-Flash block is erased. 0x03 Erase Verify P- Flash Section Verify that a given number of words starting at the address provided are erased. 0x04 Read Once Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. 0x06 Program P-Flash Program a phrase in a P-Flash block. 0x07 Program Once Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. 0x08 Erase All Blocks Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. 0x09 Erase P-Flash Block Erase a single P-Flash block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. 0x0A Erase P-Flash Sector Erase all bytes in a P-Flash sector. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. 0x0C Verify Backdoor Access Key Supports a method of releasing MCU security by verifying a set of security keys. 0x0D Set User Margin Level Specifies a user margin read level for all P-Flash blocks. 0x0E Set Field Margin Level Specifies a field margin read level for all P-Flash blocks (special modes only). Table 10-32. D-Flash Commands FCMD Command Function on D-Flash Memory 0x01 Erase Verify All Blocks Verify that all D-Flash (and P-Flash) blocks are erased. 0x02 Erase Verify Block Verify that the D-Flash block is erased. 0x08 Erase All Blocks Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 379

10.4.2 Flash Command Description

This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller:

• Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register
• Writing an invalid command as part of the command write sequence
• For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 10.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 0x0B Unsecure Flash Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. 0x0D Set User Margin Level Specifies a user margin read level for the D-Flash block. 0x0E Set Field Margin Level Specifies a field margin read level for the D-Flash block (special modes only). 0x0F Full Partition D- Flash Erase the D-Flash block and partition an area of the D-Flash block for user access. 0x10 Erase Verify D- Flash Section Verify that a given number of words starting at the address provided are erased. 0x11 Program D-Flash Program up to four words in the D-Flash block. 0x12 Erase D-Flash Sector Erase all bytes in a sector of the D-Flash block. 0x13 Enable EEPROM Emulation Enable EEPROM emulation where writes to the buffer RAM EEE partition will be copied to the D-Flash EEE partition. 0x14 Disable EEPROM Emulation Suspend all current erase and program activity related to EEPROM emulation but leave current EEE tags set. 0x15 EEPROM Emulation Query Returns EEE partition and status variables. 0x20 Partition D-Flash Partition an area of the D-Flash block for user access. Table 10-32. D-Flash Commands FCMD Command Function on D-Flash Memory

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

380 Freescale Semiconductor

10.4.2.1 Erase Verify All Blocks Command

The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed.

10.4.2.2 Erase Verify Block Command

The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be verified. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF flag will set after the Erase Verify Block operation has completed. Table 10-33. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x01 Not required Table 10-34. Erase Verify All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the read 1 FERSTAT EPVIOLIF None Table 10-35. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x02 Global address [22:16] of the Flash block to be verified.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 381

10.4.2.3 Erase Verify P-Flash Section Command

The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. Table 10-36. Erase Verify Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the read 2 FERSTAT EPVIOLIF None Table 10-37. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x03 Global address [22:16] of a P-Flash block Table 10-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:0] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the requested section crosses a 256 Kbyte boundary FPVIOL None MGSTAT1 Set if any errors have been encountered during the read (2) MGSTAT0 Set if any non-correctable errors have been encountered during the read 2 FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

382 Freescale Semiconductor

10.4.2.4 Read Once Command

The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 10.4.2.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. 128

10.4.2.5 Program P-Flash Command

The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. 1. As defined by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. Table 10-39. Read Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x04 Not Required Table 10-40. Read Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid phrase index is supplied FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 383 CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed.

10.4.2.6 Program Once Command

The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 10.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program Table 10-41. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x06 Global address [22:16] to identify P-Flash block

1. Global address [2:0] must be 000

Table 10-42. Program P-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:0] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL Set if the global address [22:0] points to a protected area MGSTAT1 Set if any errors have been encountered during the verify operation (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation2 FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

384 Freescale Semiconductor

Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data.

10.4.2.7 Erase All Blocks Command

The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space including the EEE nonvolatile information register. Table 10-43. Program Once Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x07 Not Required Table 10-44. Program Once Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid phrase index is supplied Set if the requested phrase has already been programmed (1) 1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF , the Program Once command will be allowed to execute again on that same phrase. FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 385 Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed.

10.4.2.8 Erase P-Flash Block Command

The Erase P-Flash Block operation will erase all addresses in a P-Flash block. Upon clearing CCIF to launch the Erase P-Flash Block command, the Memory Controller will erase the selected P-Flash block and verify that it is erased. The CCIF flag will set after the Erase P-Flash Block operation has completed. Table 10-45. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x08 Not required Table 10-46. Erase All Blocks Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if command not available in current mode (see Table 10-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected Table 10-47. Erase P-Flash Block Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x09 Global address [22:16] to identify P-Flash block

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

386 Freescale Semiconductor

10.4.2.9 Erase P-Flash Sector Command

The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. Table 10-48. Erase P-Flash Block Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. FPVIOL Set if an area of the selected P-Flash block is protected MGSTAT1 Set if any errors have been encountered during the verify operation (2) 2. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation2 FERSTAT EPVIOLIF None Table 10-49. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0A Global address [22:16] to identify P-Flash block to be erased 001 Global address [15:0] anywhere within the sector to be erased. Refer to Section 10.1.2.1 for the P-Flash sector size. Table 10-50. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL Set if the selected P-Flash sector is protected MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 387

10.4.2.10 Unsecure Flash Command

The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed.

10.4.2.11 Verify Backdoor Access Key Command

The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 10-11). The Verify Backdoor Access Key command releases security if user- supplied keys match those stored in the Flash security bytes of the Flash configuration field (seeTable 10- 3). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 10-51. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0B Not required Table 10-52. Unsecure Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if command not available in current mode (see Table 10-30) FPVIOL Set if any area of the P-Flash memory is protected MGSTAT1 Set if any errors have been encountered during the verify operation (1) 1. As found in the memory map for FTM512K3. MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation1 FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected Table 10-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0C Not required

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

388 Freescale Semiconductor

Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed.

10.4.2.12 Set User Margin Level Command

The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. Table 10-54. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 10.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 10-55. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0D Global address [22:16] to identify the Flash block Table 10-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 389 Valid margin level settings for the Set User Margin Level command are defined in Table 10-56. NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected.

10.4.2.13 Set Field Margin Level Command

The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 10-56. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1) 1. Read margin to the erased state 0x0002 User Margin-0 Level (2) 2. Read margin to the programmed state Table 10-57. Set User Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 10-58. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0E Global address [22:16] to identify the Flash block

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

390 Freescale Semiconductor

Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. Valid margin level settings for the Set Field Margin Level command are defined in Table 10-59. CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. Table 10-59. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0000 Return to Normal Level 0x0001 User Margin-1 Level (1) 1. Read margin to the erased state 0x0002 User Margin-0 Level (2) 2. Read margin to the programmed state 0x0003 Field Margin-1 Level 1 0x0004 Field Margin-0 Level 2 Table 10-60. Set Field Margin Level Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:16] is supplied(1) 1. As defined by the memory map for FTM512K3. Set if an invalid margin level setting is supplied FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 391

10.4.2.14 Full Partition D-Flash Command

The Full Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. Upon clearing CCIF to launch the Full Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 8 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 10-7)
• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 10-7)
• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 10-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 10-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Full Partition D-Flash operation has completed, the CCIF flag will set. Running the Full Partition D-Flash command a second time will result in the previous partition values and the entire D-Flash memory being erased. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 10-61. Full Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x0F Not required

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

392 Freescale Semiconductor

10.4.2.15 Erase Verify D-Flash Section Command

The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash user partition is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF flag will set after the Erase Verify D- Flash Section operation has completed. Table 10-62. Full Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid DFPART or ERPART selection is supplied(1) 1. As defined by the maximum ERPART for FTM512K3. FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF NoneTable 10-63. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x10 Global address [22:16] to identify the D-Flash block

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 393

10.4.2.16 Program D-Flash Command

The Program D-Flash operation programs one to four previously erased words in the D-Flash user partition. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. No protection checks are made in the Program D-Flash operation on the D-Flash block, only access error checks. The CCIF flag is set when the operation has completed. Table 10-64. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area of the D-Flash EEE partition Set if the requested section breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None Table 10-65. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x11 Global address [22:16] to identify the D-Flash block

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

394 Freescale Semiconductor

10.4.2.17 Erase D-Flash Sector Command

The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash user partition. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase D-Flash Sector operation has completed. Table 10-66. Program D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area in the D-Flash EEE partition Set if the requested group of words breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 10-67. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x12 Global address [22:16] to identify D-Flash block 001 Global address [15:0] anywhere within the sector to be erased. See Section 10.1.2.2 for D-Flash sector size.

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 395

10.4.2.18 Enable EEPROM Emulation Command

The Enable EEPROM Emulation command causes the Memory Controller to enable EEE activity. EEE activity is disabled after any reset. Upon clearing CCIF to launch the Enable EEPROM Emulation command, the CCIF flag will set after the Memory Controller enables EEE operations using the contents of the EEE tag RAM and tag counter. The Full Partition D-Flash or the Partition D-Flash command must be run prior to launching the Enable EEPROM Emulation command. Table 10-68. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to the D-Flash EEE partition FPVIOL None MGSTAT1 Set if any errors have been encountered during the verify operation MGSTAT0 Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None Table 10-69. Enable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x13 Not required Table 10-70. Enable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

396 Freescale Semiconductor

10.4.2.19 Disable EEPROM Emulation Command

The Disable EEPROM Emulation command causes the Memory Controller to suspend current EEE activity. Upon clearing CCIF to launch the Disable EEPROM Emulation command, the Memory Controller will halt EEE operations at the next convenient point without clearing the EEE tag RAM or tag counter before setting the CCIF flag.

10.4.2.20 EEPROM Emulation Query Command

The EEPROM Emulation Query command returns EEE partition and status variables. Upon clearing CCIF to launch the EEPROM Emulation Query command, the CCIF flag will set after the EEE partition and status variables are stored in the FCCOBIX register.If the Emulation Query command is executed prior to partitioning (Partition D-Flash Command Section 10.4.2.14), the following reset values are returned: DFPART = 0x_FFFF, ERPART = 0x_FFFF, ECOUNT = 0x_FFFF, Dead Sector Count = 0x_00, Ready Sector Count = 0x_00. Table 10-71. Disable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x14 Not required Table 10-72. Disable EEPROM Emulation Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if Full Partition D-Flash or Partition D-Flash command not previously run FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 10-73. EEPROM Emulation Query Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x15 Not required (1) 1. Indicates sector erase count

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 397

10.4.2.21 Partition D-Flash Command

The Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 64 sectors with 256 bytes per sector. The Erase All Blocks command must be run prior to launching the Partition D-Flash command. Upon clearing CCIF to launch the Partition D-Flash command, the following actions are taken to define a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART):

• Validate the DFPART and ERPART values provided: — DFPART <= 128 (maximum number of 256 byte sectors in D-Flash block) — ERPART <= 8 (maximum number of 256 byte sectors in buffer RAM) — If ERPART > 0, 128 - DFPART >= 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE)
• Erase verify the D-Flash block and the EEE nonvolatile information register
• Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 10-7)
• Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 10-7) Table 10-74. EEPROM Emulation Query Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 000 at command launch Set if command not available in current mode (see Table 10-30) FPVIOL None MGSTAT1 None MGSTAT0 None FERSTAT EPVIOLIF None Table 10-75. Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] FCCOB Parameters 000 0x20 Not required

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

398 Freescale Semiconductor

• Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 10-7)
• Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 10-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Partition D-Flash operation has completed, the CCIF flag will set. Running the Partition D-Flash command a second time will result in the ACCERR bit within the FSTAT register being set. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 10-76. Partition D-Flash Command Error Handling Register Error Bit Error Condition FSTAT ACCERR Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 10-30) Set if partitions have already been defined Set if an invalid DFPART or ERPART selection is supplied (1) 1. As defined by the maximum ERPART for FTM512K3. FPVIOL None MGSTAT1 Set if any errors have been encountered during the read MGSTAT0 Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 399

10.4.3 Interrupts

The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an EEE error or an ECC fault. NOTE Vector addresses and their relative interrupt priority are determined at the MCU level.

10.4.3.1 Description of Flash Interrupt Operation

The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the ERSEIF, PGMEIF, EPVIOLIF, ERSVIF1, ERSVIF0, DFDIF and SFDIF flags in combination with the ERSEIE, PGMEIE, EPVIOLIE, ERSVIE1, ERSVIE0, DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 10.3.2.5, “Flash Configuration Register Status Register (FSTAT)”, and Section 10.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 10-27. Table 10-77. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Command Complete CCIF (FSTAT register) CCIE (FCNFG register) I Bit Flash EEE Erase Error ERSERIF (FERSTAT register) ERSERIE (FERCNFG register) I Bit Flash EEE Program Error PGMERIF (FERSTAT register) PGMERIE (FERCNFG register) I Bit Flash EEE Protection Violation EPVIOLIF (FERSTAT register) EPVIOLIE (FERCNFG register) I Bit Flash EEE Error Type 1 Violation ERSVIF1 (FERSTAT register) ERSVIE1 (FERCNFG register) I Bit Flash EEE Error Type 0 Violation ERSVIF0 (FERSTAT register) ERSVIE0 (FERCNFG register) I Bit ECC Double Bit Fault on Flash Read DFDIF (FERSTAT register) DFDIE (FERCNFG register) I Bit ECC Single Bit Fault on Flash Read SFDIF (FERSTAT register) SFDIE (FERCNFG register) I Bit

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

400 Freescale Semiconductor

Figure 10-27. Flash Module Interrupts Implementation

10.4.4 Wait Mode

The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 10.4.3, “Interrupts”).

10.4.5 Stop Mode

If a Flash command is active (CCIF = 0) or an EE-Emulation operation is pending when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode.

10.5 Security

The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 10-12). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F. Flash Error Interrupt Request CCIF CCIE EPVIOLIF EPVIOLIE ERSVIF1 ERSVIE1 ERSVIF0 ERSVIE0 PGMERIF PGMERIE ERSERIF ERSERIE Flash Command Interrupt Request DFDIF DFDIE SFDIF SFDIE

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 401 The security state out of reset can be permanently changed by programming the security byte of the Flash configuration field. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects:

• Unsecuring the MCU using Backdoor Key Access
• Unsecuring the MCU in Special Single Chip Mode using BDM
• Mode and Security Effects on Flash Command Availability

10.5.1 Unsecuring the MCU using Backdoor Key Access

The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 10.3.2.2), the Verify Backdoor Access Key command (see Section 10.4.2.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 10-12) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 10.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 10.4.2.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field. The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte

Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) MC9S12XF - Family Reference Manual, Rev.1.19

402 Freescale Semiconductor

(0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT.

10.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM

The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods:

• Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory.
• Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method:
• Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU.

10.5.3 Mode and Security Effects on Flash Command Availability

The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 10-30.

10.6 Initialization

On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. The ACCERR bit in the FSTAT register is set if errors are encountered while initializing the EEE buffer ram during the reset sequence. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed.

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 403 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY

11.1 Introduction

This section describes the functionality of the module mapping control (MMC) sub-block of the S12X platform. The block diagram of the MMC is shown in Figure 11-1. The MMC module controls the multi-master priority accesses, the selection of internal resources and external space. Internal buses, including internal memories and peripherals, are controlled in this module. The local address space for each master is translated to a global memory space. Rev. No. (Item No.) Date (Submitted By) Sections Affected Substantial Change(s) v04.06 15-Nov-06 - Adding AUTOSAR Compliance concerning illegal CPU accesses v04.07 02-Apr-07 - Adapting the MMC context to support S12XS family v04.08 04-May-07 - Clarifying RPAGE usage for less than 12KB RAMSIZE. - Some Cleanups

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

404 Freescale Semiconductor

11.1.1 Terminology

11.1.2 Features

The main features of this block are:

• Paging capability to support a global 8MB memory address space Table 11-1. Acronyms and Abbreviations Logic level “1” Voltage that corresponds to Boolean true state Logic level “0” Voltage that corresponds to Boolean false state 0x Represents hexadecimal number x Represents logic level ’don’t care’ Byte 8-bit data word 16-bit data local address based on the 64KB Memory Space (16-bit address) global address based on the 8MB Memory Space (23-bit address) Aligned address Address on even boundary Mis-aligned address Address on odd boundary Bus Clock System Clock. Refer to CRG Block Guide. expanded modes Normal Expanded Mode Emulation Single-Chip Mode Emulation Expanded Mode Special Test Mode single-chip modes Normal Single-Chip Mode Special Single-Chip Mode emulation modes Emulation Single-Chip Mode Emulation Expanded Mode normal modes Normal Single-Chip Mode Normal Expanded Mode special modes Special Single-Chip Mode Special Test Mode NS Normal Single-Chip Mode SS Special Single-Chip Mode NX Normal Expanded Mode ES Emulation Single-Chip Mode EX Emulation Expanded Mode ST Special Test Mode Unimplemented areas Areas which are accessible by the pages (RPAGE,PPAGE,EPAGE) and not implemented External Space Area which is accessible in the global address range 14_0000 to 3F_FFFF external resource Resources (Emulator, Application) connected to the MCU via the external bus on expanded modes (Unimplemented areas and External Space) PRR Port Replacement Registers PRU Port Replacement Unit located on the emulator side MCU MicroController Unit NVM Non-volatile Memory; Flash, EEPROM or ROM IFR Information Row sector located on the top of NVM. For Test purposes. FLEXRAY FlexRay IP Integration module

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 405

• Bus arbitration between the masters CPU, BDM, FLEXRAY and XGATE
• Simultaneous accesses to different resources 1 (internal, external, and peripherals) (see Figure 11-
• Resolution of target bus access collision
• MCU operation mode control
• MCU security control
• Separate memory map schemes for each master CPU, BDM, FLEXRAY and XGATE
• ROM control bits to enable the on-chip FLASH or ROM selection
• Port replacement registers access control
• Generation of system reset when CPU accesses an unimplemented address (i.e., an address which does not belong to any of the on-chip modules) in single-chip modes

11.1.3 S12X Memory Mapping

The S12X architecture implements a number of memory mapping schemes including

• a CPU 8MB global map, defined using a global page (GPAGE) register and dedicated 23-bit address load/store instructions.
• a BDM 8MB global map, defined using a global page (BDMGPR) register and dedicated 23-bit address load/store instructions.
• a FLEXRAY 8 MByte global map.
• a (CPU or BDM) 64KB local map, defined using specific resource page (RPAGE, EPAGE and PPAGE) registers and the default instruction set. The 64KB visible at any instant can be considered as the local map accessed by the 16-bit (CPU or BDM) address.
• The XGATE 64 Kbyte local map. The MMC module performs translation of the different memory mapping schemes to the specific global (physical) memory implementation.

11.1.4 Modes of Operation

This subsection lists and briefly describes all operating modes supported by the MMC.

11.1.4.1 Power Saving Modes

• Run mode MMC is functional during normal run mode.
• Wait mode MMC is functional during wait mode.
• Stop mode MMC is inactive during stop mode. 1. Resources are also called targets.

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

406 Freescale Semiconductor

11.1.4.2 Functional Modes

• Single chip modes In normal and special single chip mode the internal memory is used. External bus is not active.
• Expanded modes Address, data, and control signals are activated in normal expanded and special test modes when accessing the external bus. Access to internal resources will not cause activity on the external bus.
• Emulation modes External bus is active to emulate, via an external tool, the normal expanded or the normal single chip mode.

11.1.5 Block Diagram

1 shows a block diagram of the MMC. Figure 11-1. MMC Block Diagram

11.2 External Signal Description

The user is advised to refer to the SoC Guide for port configuration and location of external bus signals. Some pins may not be bonded out in all implementations. Table 11-2 and Table 11-3 outline the pin names and functions. It also provides a brief description of their operation. 1. Doted blocks and lines are optional. Please refer to the SoC Guide for their availlibilities. Peripherals FLASH XGATECPUBDM Target Bus Controller DBG EEEPROM EBI MMC Address Decoder & Priority RAM FLEXRAY

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 407 Table 11-2. External Input Signals Associated with the MMC Signal I/O Description Availability MODC I Mode input Latched after RESET (active low) MODB I Mode input Latched after RESET (active low) MODA I Mode input Latched after RESET (active low) EROMCTL I EROM control input Latched after RESET (active low) ROMCTL I ROM control input Latched after RESET (active low) Table 11-3. External Output Signals Associated with the MMC Signal I/O Description Available in Modes NS SS NX ES EX ST CS0 O Chip select line 0 (see Table 11-4) CS1 O Chip select line 1 CS2 O Chip select line 2 CS3 O Chip select line 3

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

408 Freescale Semiconductor

11.3 Memory Map and Registers

11.3.1 Module Memory Map

A summary of the registers associated with the MMC block is shown inFigure 11-2. Detailed descriptions of the registers and bits are given in the subsections that follow. Address Register Name Bit 7 6 5 4 3 2 1 Bit 0 0x000A MMCCTL0 R CS3E1 CS3E0 CS2E1 CS2E0 CS1E1 CS1E0 CS0E1 CS0E0W 0x000B MODE R MODC MODB MODA 00 0 0 0 W 0x0010 GPAGE R 0 GP6 GP5 GP4 GP3 GP2 GP1 GP0W 0x0011 DIRECT R DP15 DP14 DP13 DP12 DP11 DP10 DP9 DP8W 0x0012 Reserved R 0 0 0 0 0 0 0 0 W 0x0013 MMCCTL1 R TGMRAMON EEEIFRON PGMIFRON RAMHM EROMON ROMHM ROMONW 0x0014 Reserved R 0 0 0 0 0 0 0 0 W 0x0015 PPAGE R PIX7 PIX6 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0W 0x0016 RPAGE R RP7 RP6 RP5 RP4 RP3 RP2 RP1 RP0W 0x0017 EPAGE R EP7 EP6 EP5 EP4 EP3 EP2 EP1 EP0W = Unimplemented or Reserved Figure 11-2. MMC Register Summary

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 409

11.3.2 Register Descriptions

11.3.2.1 MMC Control Register (MMCCTL0)

Read: Anytime. In emulation modes read operations will return the data from the external bus. In all other modes the data is read from this register. Write: Anytime. In emulation modes write operations will also be directed to the external bus. The MMCCTL0 register is used to control external bus functions, like:

• Availability of chip selects. (See Table 11-4 and Table 11-5)
• Control of different external stretch mechanism. For more detail refer to the S12X_EBI BlockGuide. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Address: 0x000A PRR 76543210 R CS3E1 CS3E0 CS2E1 CS2E0 CS1E1 CS1E0 CS0E1 CS0E0 W Reset 0000000 ROMON1 1. ROMON is bit[0] of the register MMCTL1 (see Figure 11-10) = Unimplemented or Reserved Figure 11-3. MMC Control Register (MMCCTL0) Table 11-4. Chip Selects Function Activity Register Bit Chip Modes NS SS NX ES EX ST CS0E[1:0], CS1E[1:0], CS2E[1:0], CS3E[1:0] Disabled(1) 1. Disabled: feature always inactive. Disabled Enabled (2) 2. Enabled: activity is controlled by the appropriate register bit value. Disabled Enabled Disabled

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

410 Freescale Semiconductor

Table 11-6 shows the address boundaries of each chip select and the relationship with the implemented resources (internal) parameters. Table 11-5. MMCCTL0 Field Descriptions Field Description 7–6 CS3E[1:0] Chip Select 3 Enables — These bits enable the external chip select CS3 output which is asserted during accesses to specific external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 3 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes.

00 Chip select 3 is disabled

01,10,11 Chip select 3 is enabled 5–4 CS2E[1:0] Chip Select 2 Enables — These bits enable the external chip select CS2 output which is asserted during accesses to specific external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 2 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes.

00 Chip select 2 is disabled

01,10,11 Chip select 2 is enabled 3–2 CS1E[1:0] Chip Select 1 Enables — These bits enable the external chip select CS1 output which is asserted during accesses to specific external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 1 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes.

00 Chip select 1 is disabled

01,10,11 Chip select 1 is enabled 1–0 CS0E[1:0] Chip Select 0 Enables — These bits enable the external chip select CS0 output which is asserted during accesses to specific external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 0 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes.

00 Chip select 0 is disabled

01,10,11 Chip select 0 is enabled Table 11-6. Global Chip Selects Memory Space Chip Selects Bottom Address Top Address CS3 0x00_0800 0x0F_FFFF minus RAMSIZE (1) 1. External RPAGE accesses in (NX, EX) CS2(2) 2. When ROMHM is set (see ROMHM in Table 11-15) the CS2 is asserted in the space occupied by this on- chip memory block. 0x14_0000 0x1F_FFFF CS1 0x20_0000 0x3F_FFFF CS0(3) 3. When the internal NVM is enabled (see ROMON inSection 11.3.2.5, “MMC Control Register (MMCCTL1)) the CS0 is not asserted in the space occupied by this on-chip memory block. 0x40_0000 0x7F_FFFF minus FLASHSIZE (4) 4. External PPAGE accesses in (NX, EX)

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 411

11.3.2.2 Mode Register (MODE)

Read: Anytime. In emulation modes read operations will return the data read from the external bus. In all other modes the data are read from this register. Write: Only if a transition is allowed (see Figure 11-5). In emulation modes write operations will be also directed to the external bus. The MODE bits of the MODE register are used to establish the MCU operating mode. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Address: 0x000B PRR 76543210 R MODC MODB MODA 00000 W Reset MODC 1 MODB1 MODA1 00000 1. External signal (see Table 11-2). = Unimplemented or Reserved Figure 11-4. Mode Register (MODE) Table 11-7. MODE Field Descriptions Field Description 7–5 MODC, MODB, MODA Mode Select Bits — These bits control the current operating mode during RESET high (inactive). The external mode pins MODC, MODB, and MODA determine the operating mode during RESET low (active). The state of the pins is latched into the respective register bits after the RESET signal goes inactive (see Figure 11-4). Write restrictions exist to disallow transitions between certain modes. Figure 11-5 illustrates all allowed mode changes. Attempting non authorized transitions will not change the MODE bits, but it will block further writes to these register bits except in special modes. Both transitions from normal single-chip mode to normal expanded mode and from emulation single-chip to emulation expanded mode are only executed by writing a value of 3’b101 (write once). Writing any other value will not change the MODE bits, but will block further writes to these register bits. Changes of operating modes are not allowed when the device is secured, but it will block further writes to these register bits except in special modes. In emulation modes reading this address returns data from the external bus which has to be driven by the emulator. It is therefore responsibility of the emulator hardware to provide the expected value (i.e. a value corresponding to normal single chip mode while the device is in emulation single-chip mode or a value corresponding to normal expanded mode while the device is in emulation expanded mode).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

412 Freescale Semiconductor

Figure 11-5. Mode Transition Diagram when MCU is Unsecured Normal Single-Chip 100 Normal Expanded 101 Emulation Expanded 011 Emulation Single-Chip 001 Special Test 010 Special Single-Chip 000 101 101 011 011 101 000 010 100 001 001 100 101 RESET (SS) 110 111 000 RESET RESET RESET RESET RESET 010 101 011001 100 (EX) (NX)(NS) (ES) (ST) RESET Transition done by external pins (MODC, MODB, MODA) Transition done by write access to the MODE register 110 111 Illegal (MODC, MODB, MODA) pin values. Do not use. (Reserved for future use).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 413

11.3.2.3 Global Page Index Register (GPAGE)

Read: Anytime Write: Anytime The global page index register is used to construct a 23 bit address in the global map format. It is only used when the CPU is executing a global instruction (GLDAA, GLDAB, GLDD, GLDS, GLDX, GLDY ,GSTAA, GSTAB, GSTD, GSTS, GSTX, GSTY) (see CPU Block Guide). The generated global address is the result of concatenation of the CPU local address [15:0] with the GPAGE register [22:16] (see Figure 11-7). CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Figure 11-7. GPAGE Address Mapping Example 11-1. This example demonstrates usage of the GPAGE register LDX #0x5000 ;Set GPAGE offset to the value of 0x5000 MOVB #0x14, GPAGE ;Initialize GPAGE register with the value of 0x14 GLDAA X ;Load Accu A from the global address 0x14_5000 Address: 0x0010 76543210 GP6 GP5 GP4 GP3 GP2 GP1 GP0 W Reset 00000000 = Unimplemented or Reserved Figure 11-6. Global Page Index Register (GPAGE) Table 11-8. GPAGE Field Descriptions Field Description 6–0 GP[6:0] Global Page Index Bits 6–0 — These page index bits are used to select which of the 128 64KB pages is to be accessed. Bit16 Bit 0Bit15Bit22 CPU Address [15:0]GPAGE Register [6:0] Global Address [22:0]

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

414 Freescale Semiconductor

11.3.2.4 Direct Page Register (DIRECT)

Read: Anytime Write: anytime in special modes, one time only in other modes. This register determines the position of the 256B direct page within the memory map.It is valid for both global and local mapping scheme. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Figure 11-9. DIRECT Address Mapping Bits [22:16] of the global address will be formed by the GPAGE[6:0] bits in case the CPU executes a global instruction in direct addressing mode or by the appropriate local address to the global address expansion Example 11-2. This example demonstrates usage of the Direct Addressing Mode MOVB #0x80,DIRECT ;Set DIRECT register to 0x80. Write once only. ;Global data accesses to the range 0xXX_80XX can be direct. ;Logical data accesses to the range 0x80XX are direct. LDY <00 ;Load the Y index register from 0x8000 (direct access). ;< operator forces direct access on some assemblers but in ;many cases assemblers are “direct page aware” and can Address: 0x0011 76543210 R DP15 DP14 DP13 DP12 DP11 DP10 DP9 DP8 W Reset 00000000 Figure 11-8. Direct Register (DIRECT) Table 11-9. DIRECT Field Descriptions Field Description 7–0 DP[15:8] Direct Page Index Bits 15–8 — These bits are used by the CPU when performing accesses using the direct addressing mode. The bits from this register form bits [15:8] of the address (see Figure 11-9). Bit15 Bit0Bit7Bit22 CPU Address [15:0] Global Address [22:0] Bit8Bit16 DP [15:8]

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 415 ;automatically select direct mode.

11.3.2.5 MMC Control Register (MMCCTL1)

Read: Anytime. In emulation modes read operations will return the data from the external bus. In all other modes the data are read from this register. Write: Refer to each bit description. In emulation modes write operations will also be directed to the external bus. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Address: 0x0013 PRR 76543210 R MGRAMON EEEIFRON PGMIFRON RAMHM EROMON ROMHM ROMON W Reset 00000 E R OMCTL 0 ROMCTL = Unimplemented or Reserved Figure 11-10. MMC Control Register (MMCCTL1) Table 11-10. MMCCTL1 Field Descriptions Field Description MGRAMON Flash Memory Controller Tag RAM and SCRATCH RAM visible in the global memory map Write: Anytime This bit is used to made the Flash Memory Controller Tag RAM and SCRATCH RAM visible in the global memory map. 0 Not visible in the global memory map. 1 Visible in the global memory map. EEEIFRON EEE Information Row (IFR) visible in the global memory map Write: Anytime This bit is used to made the IFR sector of EEE DATA FLASH visible in the global memory map. 0 Not visible in the global memory map. 1 Visible in the global memory map. PGMIFRON Program Information Row (IFR) visible in the global memory map Write: Anytime This bit is used to made the IFR sector of the Program Flash visible in the global memory map. 0 Not visible in the global memory map. 1 Visible in the global memory map. RAMHM RAM only in higher Half of the global memory map Write: Once in normal and emulation modes and anytime in special modes

0 Accesses to 0x4000–0x7FFF in the CPU/BDM local memory map will be mapped to 0x14_4000-0x14_7FFF

in the global memory space (external access).

1 Accesses to 0x4000–0x7FFF in the CPU/BDM local memory map will be mapped to 0x0F_C000-0x0F_FFFF

in the global memory space (RAM area).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

416 Freescale Semiconductor

EROMON and ROMON control the visibility of the Flash in the global memory map for CPU or BDM (not for XGATE). Both local and global memory maps are affected. EROMON Enables emulated Flash or ROM memory in the global memory map Write: Never This bit is used in some modes to define the placement of the Emulated Flash or ROM (Refer to Table 11-11) 0 Disables the emulated Flash or ROM in the global memory map. 1 Enables the emulated Flash or ROM in the global memory map. ROMHM FLASH or ROM only in higher Half of the global memory map Write: Once in normal and emulation modes and anytime in special modes 0 The fixed page of Flash or ROM can be accessed in the lower half of the memory map. Accesses to 0x4000–0x7FFF in the CPU/BDM local memory map will be mapped to 0x7F_4000-0x7F_7FFF in the global memory space. 1 Disables access to the Flash or ROM in the lower half of the memory map.These physical locations of the Flash or ROM can still be accessed through the program page window. Accesses to 0x4000–0x7FFF in the CPU/BDM local memory map will depends on the value of the RAMHM bit (Refer to Table 11-18). ROMON Enable FLASH or ROM in the global memory map Write: Once in normal and emulation modes and anytime in special modes. This bit is used in some modes to define the placement of the ROM (Refer to Table 11-11) 0 Disables the Flash or ROM from the memory map. 1 Enables the Flash or ROM in the global memory map. Table 11-10. MMCCTL1 Field Descriptions (continued) Field Description

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 417

11.3.2.6 Program Page Index Register (PPAGE)

Read: Anytime Write: Anytime These eight index bits are used to page 16KB blocks into the Flash page window located in the local (CPU or BDM) memory map from address 0x8000 to address 0xBFFF (see Figure 11-12). This supports accessing up to 4MB of Flash (in the Global map) within the 64KB Local map. The PPAGE register is effectively used to construct paged Flash addresses in the Local map format. The CPU has special access to read and write this register directly during execution of CALL and RTC instructions.. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Table 11-11. Data Sources when CPU or BDM is Accessing Flash Area Chip Modes ROMON EROMON DATA SOURCE (1) 1. Internal Flash means Flash resources inside the MCU are read/written. Emulation memory means resources inside the emulator are read/written (PRU registers, flash replacement, RAM, EEPROM and register space are always considered internal). External application means resources residing outside the MCU are read/written. Stretch (2) 2. The external access stretch mechanism is part of the EBI module (refer to EBI Block Guide for details). Normal Single Chip X X Internal Flash N Special Single Chip Emulation Single Chip X 0 Emulation Memory N X 1 Internal Flash Normal Expanded 0 X External Application Y

1 X Internal Flash N

Emulation Expanded 0 X External Application Y 1 0 Emulation Memory N 1 1 Internal Flash Special Test 0 X External Application N Address: 0x0015 76543210 R PIX7 PIX6 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 W Reset 11111110 Figure 11-11. Program Page Index Register (PPAGE)

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

418 Freescale Semiconductor

Figure 11-12. PPAGE Address Mapping NOTE Writes to this register using the special access of the CALL and RTC instructions will be complete before the end of the instruction execution. The fixed 16K page from 0x4000–0x7FFF (when ROMHM = 0) is the page number 0xFD. The reset value of 0xFE ensures that there is linear Flash space available between addresses 0x4000 and 0xFFFF out of reset. The fixed 16K page from 0xC000-0xFFFF is the page number 0xFF.

11.3.2.7 RAM Page Index Register (RPAGE)

Read: Anytime Write: Anytime These eight index bits are used to page 4KB blocks into the RAM page window located in the local (CPU or BDM) memory map from address 0x1000 to address 0x1FFF (see Figure 11-14). This supports Table 11-12. PPAGE Field Descriptions Field Description 7–0 PIX[7:0] Program Page Index Bits 7–0 — These page index bits are used to select which of the 256 FLASH or ROM array pages is to be accessed in the Program Page Window. Address: 0x0016 76543210 R RP7 RP6 RP5 RP4 RP3 RP2 RP1 RP0 W Reset 11111101 Figure 11-13. RAM Page Index Register (RPAGE) Bit14 Bit01 Address [13:0]PPAGE Register [7:0] Global Address [22:0] Bit13Bit21 Address: CPU Local Address or BDM Local Address

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 419 accessing up to 1022KB of RAM (in the Global map) within the 64KB Local map. The RAM page index register is effectively used to construct paged RAM addresses in the Local map format. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Figure 11-14. RPAGE Address Mapping NOTE Because RAM page 0 has the same global address as the register space, it is possible to write to registers through the RAM space when RPAGE = 0x00. The reset value of 0xFD ensures that there is a linear RAM space available between addresses 0x1000 and 0x3FFF out of reset. The fixed 4K page from 0x2000–0x2FFF of RAM is equivalent to page 254 (page number 0xFE). The fixed 4K page from 0x3000–0x3FFF of RAM is equivalent to page 255 (page number 0xFF). NOTE The page 0xFD (reset value) contains unimplemented area in the range not occupied by RAM if RAMSIZE is less than 12KB (Refer to Section 11.4.2.3, “Implemented Memory Map). The two fixed 4KB pages (0xFE, 0xFF) contain unimplemented area in the range not occupied by RAM if RAMSIZE is less than 8KB (Refer to Section 11.4.2.3, “Implemented Memory Map). Table 11-13. RPAGE Field Descriptions Field Description 7–0 RP[7:0] RAM Page Index Bits 7–0 — These page index bits are used to select which of the 256 RAM array pages is to be accessed in the RAM Page Window. Bit18 Bit0Bit110 Address [11:0]RPAGE Register [7:0] Global Address [22:0] Bit12Bit190 Address: CPU Local Address or BDM Local Address

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

420 Freescale Semiconductor

11.3.2.8 EEPROM Page Index Register (EPAGE)

Read: Anytime Write: Anytime These eight index bits are used to page 1KB blocks into the EEPROM page window located in the local (CPU or BDM) memory map from address 0x0800 to address 0x0BFF (see Figure 11-16). This supports accessing up to 256KB of EEPROM (in the Global map) within the 64KB Local map. The EEPROM page index register is effectively used to construct paged EEPROM addresses in the Local map format. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Figure 11-16. EPAGE Address Mapping The reset value of 0xFE ensures that there is a linear EEPROM space available between addresses 0x0800 and 0x0FFF out of reset. The fixed 1K page 0x0C00–0x0FFF of EEPROM is equivalent to page 255 (page number 0xFF). Address: 0x0017 76543210 R EP7 EP6 EP5 EP4 EP3 EP2 EP1 EP0 W Reset 11111110 Figure 11-15. EEPROM Page Index Register (EPAGE) Table 11-14. EPAGE Field Descriptions Field Description 7–0 EP[7:0] EEPROM Page Index Bits 7–0 — These page index bits are used to select which of the 256 EEPROM array pages is to be accessed in the EEPROM Page Window. Bit16 Bit0Bit9 Address [9:0]EPAGE Register [7:0] Global Address [22:0] Bit10Bit1700 100 Address: CPU Local Address or BDM Local Address

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 421

11.4 Functional Description

The MMC block performs several basic functions of the S12X sub-system operation: MCU operation modes, priority control, address mapping, select signal generation and access limitations for the system. Each aspect is described in the following subsections.

11.4.1 MCU Operating Mode

• Normal single-chip mode There is no external bus in this mode. The MCU program is executed from the internal memory and no external accesses are allowed.
• Special single-chip mode This mode is generally used for debugging single-chip operation, boot-strapping or security related operations. The active background debug mode is in control of the CPU code execution and the BDM firmware is waiting for serial commands sent through the BKGD pin. There is no external bus in this mode.
• Emulation single-chip mode Tool vendors use this mode for emulation systems in which the user’s target application is normal single-chip mode. Code is executed from external or internal memory depending on the set-up of the EROMON bit (seeSection 11.3.2.5, “MMC Control Register (MMCCTL1)). The external bus is active in both cases to allow observation of internal operations (internal visibility).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

422 Freescale Semiconductor

• Normal expanded mode The external bus interface is configured as an up to 23-bit address bus, 8 or 16-bit data bus with dedicated bus control and status signals. This mode allows 8 or 16-bit external memory and peripheral devices to be interfaced to the system. The fastest external bus rate is half of the internal bus rate. An external signal can be used in this mode to cause the external bus to wait as desired by the external logic.
• Emulation expanded mode Tool vendors use this mode for emulation systems in which the user’s target application is normal expanded mode.
• Special test mode This mode is an expanded mode for factory test.

11.4.2 Memory Map Scheme

11.4.2.1 CPU and BDM Memory Map Scheme

The BDM firmware lookup tables and BDM register memory locations share addresses with other modules; however they are not visible in the global memory map during user’s code execution. The BDM memory resources are enabled only during the READ_BD and WRITE_BD access cycles to distinguish between accesses to the BDM memory area and accesses to the other modules. (Refer to BDM Block Guide for further details). When the MCU enters active BDM mode, the BDM firmware lookup tables and the BDM registers become visible in the local memory map in the range 0xFF00-0xFFFF (global address 0x7F_FF00 - 0x7F_FFFF) and the CPU begins execution of firmware commands or the BDM begins execution of hardware commands. The resources which share memory space with the BDM module will not be visible in the global memory map during active BDM mode. Please note that after the MCU enters active BDM mode the BDM firmware lookup tables and the BDM registers will also be visible between addresses 0xBF00 and 0xBFFF if the PPAGE register contains value of 0xFF.

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 423 Figure 11-17. Expansion of the Local Address Map 0x7F_FFFF 0x00_0000 0x14_0000 0x10_0000 0x00_0800 EPAGE RPAGE PPAGE CPU and BDM Local Memory Map Global Memory Map 0xFFFF Reset Vectors 0xC000 0x8000 Unpaged 0x4000 0x1000 0x0000 16K FLASH window 0x0C00 0x2000 0x0800 8K RAM 4K RAM window 1K EEPROM 2K REGISTERS 1K EEPROM window 16K FLASH Unpaged 16K FLASH 2K REGISTERS 2K RAM 253*4K paged RAM 1K EEPROM 255*1K paged EEPROM 253 *16K paged FLASH 16K FLASH (PPAGE 0xFD) 8K RAM External Space 16K FLASH (PPAGE 0xFE) 16K FLASH (PPAGE 0xFF) 0x00_1000 0x0F_E000 0x13_FC00 0x40_0000 0x7F_4000 0x7F_8000 0x7F_C000 1M minus 2 Kilobytes256 Kilobytes4 Mbytes 2.75 Mbytes

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

424 Freescale Semiconductor

11.4.2.1.1 Expansion of the Local Address Map

Expansion of the CPU Local Address Map The program page index register in MMC allows accessing up to 4MB of FLASH or ROM in the global memory map by using the eight page index bits to page 256 16KB blocks into the program page window located from address 0x8000 to address 0xBFFF in the local CPU memory map. The page value for the program page window is stored in the PPAGE register. The value of the PPAGE register can be read or written by normal memory accesses as well as by the CALL and RTC instructions (see Section 11.5.1, “CALL and RTC Instructions). Control registers, vector space and parts of the on-chip memories are located in unpaged portions of the 64KB local CPU address space. The starting address of an interrupt service routine must be located in unpaged memory unless the user is certain that the PPAGE register will be set to the appropriate value when the service routine is called. However an interrupt service routine can call other routines that are in paged memory. The upper 16KB block of the local CPU memory space (0xC000–0xFFFF) is unpaged. It is recommended that all reset and interrupt vectors point to locations in this area or to the other unpaged sections of the local CPU memory map. Table 11-15 summarizes mapping of the address bus in Flash/External space based on the address, the PPAGE register value and value of the ROMHM bit in the MMCCTL1 register. The RAM page index register allows accessing up to 1MB minus 2KB of RAM in the global memory map by using the eight RPAGE index bits to page 4KB blocks into the RAM page window located in the local CPU memory space from address 0x1000 to address 0x1FFF. The EEPROM page index register EPAGE allows accessing up to 256KB of EEPROM in the system by using the eight EPAGE index bits to page 1KB blocks into the EEPROM page window located in the local CPU memory space from address 0x0800 to address 0x0BFF. Table 11-15. Global FLASH/ROM Allocated Local CPU Address ROMHM External Access Global Address 0x4000–0x7FFF 0 No 0x7F_4000 –0x7F_7FFF

1 Y es 0x14_4000–0x14_7FFF

0x8000–0xBFFF N/A No (1) 1. The internal or the external bus is accessed based on the size of the memory resources implemented on-chip. Please refer to Figure 1-23 for further details. 0x40_0000–0x7F_FFFF N/A Y es 1 0xC000–0xFFFF N/A No 0x7F_C000–0x7F_FFFF

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 425 Expansion of the BDM Local Address Map PPAGE, RPAGE, and EPAGE registers are also used for the expansion of the BDM local address to the global address. These registers can be read and written by the BDM. The BDM expansion scheme is the same as the CPU expansion scheme.

11.4.2.2 Global Addresses Based on the Global Page

CPU Global Addresses Based on the Global Page The seven global page index bits allow access to the full 8MB address map that can be accessed with 23 address bits. This provides an alternative way to access all of the various pages of FLASH, RAM and EEE as well as additional external memory. The GPAGE Register is used only when the CPU is executing a global instruction (seeSection 11.3.2.3, “Global Page Index Register (GPAGE)). The generated global address is the result of concatenation of the CPU local address [15:0] with the GPAGE register [22:16] (seeFigure 11-7). BDM Global Addresses Based on the Global Page The seven BDMGPR Global Page index bits allow access to the full 8MB address map that can be accessed with 23 address bits. This provides an alternative way to access all of the various pages of FLASH, RAM and EEE as well as additional external memory. The BDM global page index register (BDMGPR) is used only in the case the CPU is executing a firmware command which uses a global instruction (like GLDD, GSTD) or by a BDM hardware command (like WRITE_W, WRITE_BYTE, READ_W, READ_BYTE). See the BDM Block Guide for further details. The generated global address is a result of concatenation of the BDM local address with the BDMGPR register [22:16] in the case of a hardware command or concatenation of the CPU local address and the BDMGPR register [22:16] in the case of a firmware command (see Figure 11-18).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

426 Freescale Semiconductor

Figure 11-18. BDMGPR Address Mapping

11.4.2.3 Implemented Memory Map

The global memory spaces reserved for the internal resources (RAM, EEE, and FLASH) are not determined by the MMC module. Size of the individual internal resources are however fixed in the design of the device cannot be changed by the user. Please refer to the SoC Guide for further details.Figure and Table 11-16 show the memory spaces occupied by the on-chip resources. Please note that the memory spaces have fixed top addresses. Table 11-16. Global Implemented Memory Space Internal Resource $Address RAM RAM_LOW = 0x10_0000 minus RAMSIZE (1) 1. RAMSIZE is the hexadecimal value of RAM SIZE in Bytes FLASH FLASH_LOW = 0x80_0000 minus FLASHSIZE (2) 2. FLASHSIZE is the hexadecimal value of FLASH SIZE in Bytes Bit16 Bit0Bit15Bit22 BDM Local AddressBDMGPR Register [6:0] Global Address [22:0] Bit16 Bit0Bit15Bit22 CPU Local AddressBDMGPR Register [6:0] Global Address [22:0] BDM HARDWARE COMMAND BDM FIRMWARE COMMAND

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 427 When the device is operating in expanded modes except emulation single-chip mode, accesses to global addresses which are not occupied by the on-chip resources (unimplemented areas or external memory space) result in accesses to the external bus (see Figure ). In emulation single-chip mode, accesses to global addresses which are not occupied by the on-chip resources (unimplemented areas) result in accesses to the external bus. CPU accesses to global addresses which are occupied by external memory space result in an illegal access reset (system reset) in case of no MPU error. BDM accesses to the external space are performed but the data will be undefined. In single-chip modes accesses by the CPU (except for firmware commands) to any of the unimplemented areas (see Figure ) will result in an illegal access reset (system reset) in case of no MPU error. BDM accesses to the unimplemented areas are allowed but the data will be undefined.No misaligned word access from the BDM module will occur; these accesses are blocked in the BDM module (Refer to BDM Block Guide). Misaligned word access to the last location of RAM is performed but the data will be undefined. Misaligned word access to the last location of any global page (64KB) by any global instruction, is performed by accessing the last byte of the page and the first byte of the same page, considering the above mentioned misaligned access cases. The non-internal resources (unimplemented areas or external space) are used to generate the chip selects (CS0,CS1,CS2 and CS3) (see Figure ), which are only active in normal expanded, emulation expanded (see Section 11.3.2.1, “MMC Control Register (MMCCTL0)).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

428 Freescale Semiconductor

0x7F_FFFF 0x00_0000 0x13_FFFF 0x0F_FFFF 0x00_07FF EPAGE RPAGE PPAGE 0x3F_FFFF CPU and BDM Local Memory Map Global Memory Map FLASHSIZE RAMSIZE CS3CS1CS0 0x1F_FFFF CS2 0xFFFF Reset Vectors 0xC000 0x8000 Unpaged 0x4000 0x1000 0x0000 16K FLASH window 0x0C00 0x2000 0x0800 8K RAM 4K RAM window 1K EEPROM 2K REGISTERS 1K EEPROM window 16K FLASH Unpaged 16K FLASH 2K REGISTERS Unimplemented RAM External Space RAM_LOW FLASH FLASH_LOW Unimplemented FLASH

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 429 S12X CPU & BDM Global Address MappingThe non-internal resources (unimplemented areas or external space) are used to generate the chip selects (CS0,CS1,CS2 and CS3) (see Figure ), which are only active in normal expanded, emulation expanded (see Section 11.3.2.1, “MMC Control Register (MMCCTL0)).

11.4.2.4 XGATE Memory Map Scheme

11.4.2.4.1 Expansion of the XGATE Local Address Map

The XGATE 64 Kbyte memory space allows access to internal resources only (Registers, RAM, and FLASH). The 2 Kilobyte register address range is the same register address range as for the CPU and the BDM module (see Table 11-17). XGATE can access the FLASH in single chip modes, even when the MCU is secured. In expanded modes, XGATE can not access the FLASH when MCU is secured. The local address of the XGATE RAM access is translated to the global RAM address range. The XGATE shares the RAM resource with the CPU and the BDM module (see Table 11-17). XGATE RAM size (XGRAMSIZE) may be lower or equal to the MCU RAM size (RAMSIZE). In case of XGATE RAM size less than 32 Kbytes (see Figure 11-19), the gap in the xgate local memory map will result in an illegal RAM access (see Section 11.4.3.1, “Illegal XGATE Accesses) The local address of the XGATE FLASH access is always translated to the global address 0x78_0800 - 0x78_7FFF. Example 11-3. is a general example of the XGATE memory map implementation. Example 11-3. The MCU FLASHSIZE is 64 Kbytes (0x10000) and MCU RAMSIZE is 32 Kbytes (0x8000). The XGATE RAMSIZE is 16 Kbytes (0x4000). The space occupied by the XGATE RAM in the global address space will be: Bottom address: (0x10_0000 minus 0x4000) = 0x0F_C000 Top address: 0x0F_FFFF XGATE accesses to local address range 0x0800–0x7FFF will result always in accesses to the following FLASH block in the global address space: Bottom address: 0x78_0800 Top address: 0x78_7FFF The gap range in the local memory map 0x8000–0xBFFF will be translated in the global address space: Table 11-17. XGATE Implemented Memory Space Internal Resource $Address XGATE RAM XGRAM_LOW = 0x0F_0000 plus (0x1_0000 minus XGRAMSIZE) (1) 1. XGRAMSIZE is the hexadecimal value of XGATE RAM SIZE in bytes.

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

430 Freescale Semiconductor

0x0F_8000 - 0x0F_BFFF (illegal xgate access to system RAM).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 431 Figure 11-19. XGATE Global Address Mapping 0x7F_FFFF 0x00_0000 0x0F_FFFF 0xFFFF 0x0000 Registers FLASH RAM 0x0800 Registers 0x00_07FF XGATE Local Memory Map Global Memory Map FLASHSIZE XGRAMSIZE RAMSIZE 0x78_0800 FLASH RAM XGRAM_LOW 0x78_7FFF 0x7FFF XGRAMSIZE Unimplemented area

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

432 Freescale Semiconductor

11.4.2.5 FLEXRAY Memory Map Scheme

11.4.2.5.1 Expansion of the FLEXRAY Local Address Map

The FLEXRAY memory space allows access to internal resources only (RAM). The local address of the FLEXRAY RAM access is connected to the global RAM address range. The FLEXRAY could share the RAM resource with the CPU, XGATE and the BDM module (Refer to the MPU Block Guide). FLEXRAY RAM size (FLXRAMSIZE) may be lower or equal to the MCU RAM size (RAMSIZE).

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 433 Figure 11-20. FLEXRAY Global Address Mapping 0x7F_FFFF 0x00_0000 0x0F_FFFF RAM FLEXRAY Local Memory Map Global Memory Map FLXRAMSIZE RAMSIZE FLXRAMSIZE Unimplemented area RAM

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

434 Freescale Semiconductor

11.4.2.6 Memory Configuration

Two bits in the MMCCTL1 register (ROMHM, RAMHM) configure the mapping of the local address (0x4000-0x7FFF) in the global memory map. ROMHM, RAMHM are write once in normal and emulation modes and anytime in special modes. Three areas are identified (See Figure 11-21):

• Program FLASH (0x7F_4000-0x7F_7FFF) when ROMHM = 0.
• External Space (0x14_4000-0x14_7FFF) when ROMHM = 1 and RAMHM = 0.
• XSRAM Space (0x0F_C000-0x0F_FFFF) when ROMHM = 1 and RAMHM = 1. Table 11-18 shows the translation from the local memory map to the global memory map taking in consideration the different configurations of ROMHM and RAMHM. Table 11-19 describes the application note of the RAM configuration and its dedicated global address. Table 11-18. ROMHM and RAMHM Address Location Local Address ROMHM RAMHM Global Address Location 0x4000 - 0x7FFF

0 X 0x7F_4000 - 0x7F_7FFF Internal Flash

1 0 0x14_4000 - 0x14_7FFF External Space 0x0F_C000 - 0x0F_FFFF Bottom of the Implemented RAM 0x2000 - 0x3FFF 0x0F_A000 - 0x0F_BFFF Fixed up to 8K RAM 0x2000 - 0x3FFF 1 0 0x0F_E000 - 0x0F_FFFF Fixed up to 8K RAM Table 11-19. RAM Configuration phase RPAGE ROMHM RAMHM RAM AREA Global Address After reset RPAGE = 0xFD (Reset value) 0 0 12 Kilobytes 0x0F_D000 - 0x0F_FFFF During setup RPAGE = 0xFD (Reset value) 1 1 24 Kilobytes 0x0F_A000 - 0x0F_FFFF Normal Operation (0x00 <= RPAGE <= 0xF9) 1 1 28 Kilobytes 0x00_0000 - 0x0F_9FFF (0xFA <= RPAGE <= 0xFF) 1 1 24 Kilobytes 0x0F_A000 - 0x0F_FFFF

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 435 Figure 11-21. ROMHM, RAMHM Memory Configuration 0x7F_FFFF 0x00_0000 0x14_0000 0x10_0000 0x00_0800 CPU and BDM Local Memory Map Global Memory Map 0xFFFF Reset Vectors 0xC000 0x8000 0x4000 0x1000 0x0000 16K FLASH window 0x0C00 0x2000 0x0800 8K RAM 4K RAM window 1K EEPROM 2K REGISTERS 1K EEPROM window Unpaged 16K FLASH 2K REGISTERS 2K RAM 251*4K paged RAM 1K EEPROM 255*1K paged EEPROM 253 *16K paged FLASH 16K FLASH 16K FLASH (PPAGE 0xFE) 16K FLASH (PPAGE 0xFF) 0x00_1000 0x0F_C000 0x13_FC00 0x40_0000 0x7F_4000 0x7F_8000 0x7F_C000 1M minus 2 Kilobytes256 Kilobytes4 Mbytes 2.75 Mbytes 8K RAM 16K RAM1 1 1 0 0 x ROMHM RAMHM ROMHM RAMHM ROMHM RAMHM 0x0F_A000 0x14_4000 External Space 16K External

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

436 Freescale Semiconductor

11.4.2.6.1 System XSRAM

System XSRAM has two ways to be accessed by the CPU. One is by the programming of RPAGE and the fixed XSRAM areas configured by the values of ROMHM, RAMHM, or by the usage of the global instruction and the usage of GPAGE. Figure 11-22 shows the memory map for the implemented XSRAM. The size of the implemented XSRAM is done by the device definition and denoted by RAMSIZE. Figure 11-22. S12XE System RAM in the global memory map 0x7F_FFFF 0x00_0000 0x13_FFFF 0x0F_FFFF EEPROM Area 0x00_07FF 0x3F_FFFF RAM Area in the global memory map FLASH Area RAMSIZE REG. Area External Space Area Unimplemented RAMRAM Area 16K RAM 8K RAM Unimplemented RAM 8K RAM 0x0F_FFFF 0x0F_FFFF 0x0F_C000 0x0F_A000 0x0F_E000 0x00_0800 0x00_0800 ROMHM = 1 RAMHM = 0 ROMHM = 0 RAMHM = X ROMHM = 1 RAMHM = 1

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 437

11.4.3 Chip Access Restrictions

CPU, FLEXRAY and XGATE accesses are watched in the memory protection unit (See MPU Block Guide). In case of access violation, the suspect master is acknowledged with an indication of an error; the victim target will not be accessed. Other violations MPU is not handling are listed below.

11.4.3.1 Illegal XGATE Accesses

A possible access error is flagged by the MMC and signalled to XGATE under the following conditions:

• XGATE performs misaligned word (in case of load-store or opcode or vector fetch accesses).
• XGATE accesses the register space (in case of opcode or vector fetch).
• XGATE performs a write to Flash in any modes (in case of load-store access).
• XGATE performs an access to a secured Flash in expanded modes (in case of load-store or opcode or vector fetch accesses). For further details refer to the XGATE Block Guide.

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

438 Freescale Semiconductor

11.4.4 Chip Bus Control

The MMC controls the address buses and the data buses that interface the S12X masters (CPU, BDM, FLEXRAY and XGATE) with the rest of the system (master buses). In addition the MMC handles all CPU read data bus swapping operations. All internal and external resources are connected to specific target buses (see Figure 11-23 1). Figure 11-23. MMC Block Diagram 1. Doted blocks and lines are optional. Please refer to the SoC Guide for their availlibilities. IPBIFLASH CPU BDM EEE/DFLASHEBI MMC “Crossbar Switch” XSRAM XGATE BDM FTM S12X1S12X0XGATE XBUS3 XBUS0XBUS1 XRAM XBUS2 BLKX DBG resources FLEXRAY S12X2

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 439

11.4.4.1 Master Bus Prioritization regarding access conflicts on Target Buses

The arbitration scheme allows only one master to be connected to a target at any given time. The following rules apply when prioritizing accesses from different masters to the same target bus:

• High priority 1 FLEXRAY access to XSRAM has priority over CPU, XGATE and BDM.
• CPU always has priority over BDM, FLEXRAY and XGATE.
• XGATE access to PRU registers constitutes a special case. It is always granted and stalls the CPU for its duration.
• XGATE has priority over FLEXRAY and BDM.
• BDM has priority over CPU, FLEXRAY and XGATE when its access is stalled for more than 128 cycles. In the later case the suspect master will be stalled after finishing the current operation and the BDM will gain access to the bus.
• In emulation modes all internal accesses are visible on the external bus as well and the external bus is used during access to the PRU registers.

11.5 Initialization/Application Information

11.5.1 CALL and RTC Instructions

CALL and RTC instructions are uninterruptible CPU instructions that automate page switching in the program page window. The CALL instruction is similar to the JSR instruction, but the subroutine that is called can be located anywhere in the local address space or in any Flash or ROM page visible through the program page window. The CALL instruction calculates and stacks a return address, stacks the current PPAGE value and writes a new instruction-supplied value to the PPAGE register. The PPAGE value controls which of the 256 possible pages is visible through the 16KB program page window in the 64KB local CPU memory map. Execution then begins at the address of the called subroutine. During the execution of the CALL instruction, the CPU performs the following steps: 1. Writes the current PPAGE value into an internal temporary register and writes the new instruction- supplied PPAGE value into the PPAGE register 2. Calculates the address of the next instruction after the CALL instruction (the return address) and pushes this 16-bit value onto the stack 3. Pushes the temporarily stored PPAGE value onto the stack 4. Calculates the effective address of the subroutine, refills the queue and begins execution at the new address This sequence is uninterruptible. There is no need to inhibit interrupts during the CALL instruction execution. A CALL instruction can be performed from any address to any other address in the local CPU memory space. The PPAGE value supplied by the instruction is part of the effective address of the CPU. For all addressing mode variations (except indexed-indirect modes) the new page value is provided by an immediate operand in the instruction. In indexed-indirect variations of the CALL instruction a pointer specifies memory locations where the new page value and the address of the called subroutine are stored. Using indirect 1. FLEXRAY has two priority access types, one called high priority access and the other called normal access.

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

440 Freescale Semiconductor

addressing for both the new page value and the address within the page allows usage of values calculated at run time rather than immediate values that must be known at the time of assembly. The RTC instruction terminates subroutines invoked by a CALL instruction. The RTC instruction unstacks the PPAGE value and the return address and refills the queue. Execution resumes with the next instruction after the CALL instruction. During the execution of an RTC instruction the CPU performs the following steps: 1. Pulls the previously stored PPAGE value from the stack 2. Pulls the 16-bit return address from the stack and loads it into the PC 3. Writes the PPAGE value into the PPAGE register 4. Refills the queue and resumes execution at the return address This sequence is uninterruptible. The RTC can be executed from anywhere in the local CPU memory space. The CALL and RTC instructions behave like JSR and RTS instruction, they however require more execution cycles. Usage of JSR/RTS instructions is therefore recommended when possible and CALL/RTC instructions should only be used when needed. The JSR and RTS instructions can be used to access subroutines that are already present in the local CPU memory map (i.e. in the same page in the program memory page window for example). However calling a function located in a different page requires usage of the CALL instruction. The function must be terminated by the RTC instruction. Because the RTC instruction restores contents of the PPAGE register from the stack, functions terminated with the RTC instruction must be called using the CALL instruction even when the correct page is already present in the memory map. This is to make sure that the correct PPAGE value will be present on stack at the time of the RTC instruction execution.

11.5.2 Port Replacement Registers (PRRs)

Registers used for emulation purposes must be rebuilt by the in-circuit emulator hardware to achieve full emulation of single chip mode operation. These registers are called port replacement registers (PRRs) (see Table 1-25). PRRs are accessible from CPU, BDM and XGATE using different access types (word aligned, word-misaligned and byte). Each access to PRRs will be extended to 2 bus cycles for write or read accesses independent of the operating mode. In emulation modes all write operations result in simultaneous writing to the internal registers (peripheral access) and to the emulated registers (external access) located in the PRU in the emulator. All read operations are performed from external registers (external access) in emulation modes. In all other modes the read operations are performed from the internal registers (peripheral access). Due to internal visibility of CPU accesses the CPU will be halted during XGATE or BDM access to any PRR. This rule applies also in normal modes to ensure that operation of the device is the same as in emulation modes. A summary of PRR accesses:

• An aligned word access to a PRR will take 2 bus cycles.

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 441

• A misaligned word access to a PRRs will take 4 cycles. If one of the two bytes accessed by the misaligned word access is not a PRR, the access will take only 3 cycles.
• A byte access to a PRR will take 2 cycles. Table 11-20. PRR Listing PRR Name PRR Local Address PRR Location PORTA 0x0000 PIM PORTB 0x0001 PIM DDRA 0x0002 PIM DDRB 0x0003 PIM PORTC 0x0004 PIM PORTD 0x0005 PIM DDRC 0x0006 PIM DDRD 0x0007 PIM PORTE 0x0008 PIM DDRE 0x0009 PIM MMCCTL0 0x000A MMC MODE 0x000B MMC PUCR 0x000C PIM RDRIV 0x000D PIM EBICTL0 0x000E EBI EBICTL1 0x000F EBI Reserved 0x0012 MMC MMCCTL1 0x0013 MMC ECLKCTL 0x001C PIM Reserved 0x001D PIM PORTK 0x0032 PIM DDRK 0x0033 PIM

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

442 Freescale Semiconductor

11.5.3 On-Chip ROM Control

The MCU offers two modes to support emulation. In the first mode (called generator) the emulator provides the data instead of the internal FLASH and traces the CPU actions. In the other mode (called observer) the internal FLASH provides the data and all internal actions are made visible to the emulator.

11.5.3.1 ROM Control in Single-Chip Modes

In single-chip modes the MCU has no external bus. All memory accesses and program fetches are internal (see Figure 11-24). Figure 11-24. ROM in Single Chip Modes

11.5.3.2 ROM Control in Emulation Single-Chip Mode

In emulation single-chip mode the external bus is connected to the emulator. If the EROMON bit is set, the internal FLASH provides the data and the emulator can observe all internal CPU actions on the external bus. If the EROMON bit is cleared, the emulator provides the data (generator) and traces the all CPU actions (see Figure 11-25). Figure 11-25. ROM in Emulation Single-Chip Mode MCU Flash No External Bus EROMON = 1 Emulator MCU EROMON = 0 Emulator Flash MCU Flash Observer Generator

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 443

11.5.3.3 ROM Control in Normal Expanded Mode

In normal expanded mode the external bus will be connected to the application. If the ROMON bit is set, the internal FLASH provides the data. If the ROMON bit is cleared, the application memory provides the data (see Figure 11-26). Figure 11-26. ROM in Normal Expanded Mode ROMON = 1 Application MCU ROMON = 0 Application MCU Flash Memory Memory

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

444 Freescale Semiconductor

11.5.3.4 ROM Control in Emulation Expanded Mode

In emulation expanded mode the external bus will be connected to the emulator and to the application. If the ROMON bit is set, the internal FLASH provides the data. If the EROMON bit is set as well the emulator observes all CPU internal actions, otherwise the emulator provides the data and traces all CPU actions (see Figure 11-27). When the ROMON bit is cleared, the application memory provides the data and the emulator will observe the CPU internal actions (see Figure 11-28). Figure 11-27. ROMON = 1 in Emulation Expanded Mode EROMON = 1 Application MCU Flash Memory Emulator EROMON = 0 Application MCU Memory Emulator Flash Generator Observer

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 445 Figure 11-28. ROMON = 0 in Emulation Expanded Mode

11.5.3.5 ROM Control in Special Test Mode

In special test mode the external bus is connected to the application. If the ROMON bit is set, the internal FLASH provides the data, otherwise the application memory provides the data (see Figure 11-29). Figure 11-29. ROM in Special Test Mode Application MCU Memory Emulator Observer ApplicationMCU Memory ROMON = 0 ApplicationMCU Memory ROMON = 1 Flash

Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19

446 Freescale Semiconductor

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 447 Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description

12.1 Introduction

This specification describes the function of the Clock Generation Module using an internal PLL (CGMIPLL).

12.1.1 Features

The main features of this block are:

• Phase Locked Loop (IPLL) frequency multiplier with internal filter — Reference divider — optional divide by 2 of VCO frequency — Configurable internal filter (no external pin) — Optional frequency modulation for defined jitter and reduced emission — Automatic frequency lock detector — Interrupt request on entry or exit from locked condition

12.1.2 Modes of Operation

This subsection lists and briefly describes all operating modes supported by the CGMIPLL.

• Off Mode Default after reset, as PLLON bit is zero
• Run Mode PLLON bit is one, CGMIPLL registers must be configured for desired target frequency.
• Stop Mode Version Number Revision Date Effective Date Author Description of Changes V01.00 4 Oct.. 06 4 Oct. 06 Initial release

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19

448 Freescale Semiconductor

In Stop Model the IPLL is always off.

12.1.3 Block Diagram

Figure 12-1 shows a block diagram of the CGMIPLL. Figure 12-1. Block diagram of CGMIPLL

12.2 Signal Description

This section lists and describes the signals that connect off chip.

12.2.1 V DDPLL, VSSPLL

These pins provides operating voltage (VDDPLL) and ground (VSSPLL) for the IPLL circuitry. This allows the supply voltage to the IPLL to be independently bypassed. Even if IPLL usage is not required VDDPLL and VSSPLL must be connected properly. CGMIPLL IPLL VDDPLL VSSPLL EXTAL XTAL CGMIPLL ClockOSCCLK Oscillator LOCK change Interrupt Reference Divider Feedback Divider SYNDIV REFDIV DIV2 REFFRQ VCOFRQ REFCLK VCOCLK FM1, FM0 FBCLK Lock Detector LOCK LOCKIF LOCKIE Phase Detector Charge Pump and Filter Up Down VCO UNLOCKF

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 449

12.3 Memory Map and Registers

This section provides a detailed description of all registers accessible in the CGMIPLL.

12.3.1 Module Memory Map

Figure 12-2 gives an overview on all CGMIPLL registers. NOTE Register Address = Base Address + Address Offset, where the Base Address is defined at the MCU level and the Address Offset is defined at the module level.

12.3.2 Register Descriptions

This section describes in address order all the CGMIPLL registers and their individual bits.

12.3.2.1 CGMIPLL Synthesizer Register (CGMSYNR)

The SYNR register controls the multiplication factor of the IPLL and selects the VCO frequency range. Address Name Bit 7 6 5 4 3 2 1 Bit 0 0x0000 CGMSYN R R VCOFRQ[1:0] SYNDIV[5:0] W 0x0001 CGMREF DV R REFFRQ[1:0] REFDIV[5:0] W 0x0002 RESERVE D R 0 0 0 000 0 0 W 0x0003 CGMFLG R LOCKIE LOCKIF LOCK 0 0 UNLOCKF W 0x0004 CGMCTL R0 0 0 0 DIV2 FM1 FM0 PLLON W 0x0005 CGMTES T02 R 0 0 0 000 0 0 W 0x0006 CGMTES T12 R 0 0 0 000 0 0 W 0x0007 CGMTES T22 R 0 0 0 000 0 0 W 2. CGMTEST0, CGMTEST1 and CGMTEST2 registers are intended for factory test purposes only. = Unimplemented or Reserved Figure 12-2. CGMIPLL Register Summary

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19

450 Freescale Semiconductor

Read: Anytime Write: Anytime Writing the CGMSYNR register clears the LOCK status bit. NOTE f VCO must be within the specified VCO frequency lock range. fCGMIPLL must not exceed the specified maximum. The VCOFRQ[1:0] bit are used to configure the VCO gain for optimal stability and lock time. For correct IPLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK frequency as shown in Table 12-1. Setting the VCOFRQ[1:0] bits wrong can result in a non functional IPLL (no locking and/or insufficient stability).

12.3.2.2 CGMIPLL Reference Divider Register (CGMREFDV)

The REFDV register provides a finer granularity for the IPLL multiplier steps. Module Base + 0x0000 76543210 R VCOFRQ[1:0] SYNDIV[5:0] W Reset 0 0 0 00000 Figure 12-3. CGMIPLL Synthesizer Register (CGMSYNR) Table 12-1. VCO Clock Frequency Selection VCOCLK Frequency Ranges VCOFRQ[1:0] 32MHz <= fVCO<= 48MHz 00 48MHz < fVCO<= 80MHz 01 Reserved 10 80MHz < fVCO <= 120MHz 11 fVCO 2f OSC× SYNDIV 1+() fCGMIPLL fVCO= fCGMIPLL fVCO (IF DIV2=0) (IF DIV2=1)

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 451 Read: Anytime Write: Anytime Writing the CGMREFDV register clears the LOCK status bit. The REFFRQ[1:0] bit are used to configure the internal PLL filter for optimal stability and lock time. For correct IPLL operation the REFFRQ[1:0] bits have to be selected according to the actual REFCLK frequency as shown in Figure 12-2. Setting the REFFRQ[1:0] bits wrong can result in a non functional IPLL (no locking and/or insufficient stability).

12.3.2.3 CGMIPLL Flags Register (CGMFLG)

This register provides CGMIPLL status bits and flags. Read: Anytime Write: Refer to each bit for individual write conditions Module Base + 0x0001 76543210 R REFFRQ[1:0] REFDIV[5:0] W Reset 0 0 0 00000 Figure 12-4. CGMIPLL Reference Divider Register (CGMREFDV) Table 12-2. Reference Clock Frequency Selection REFCLK Frequency Ranges REFFRQ[1:0] 1MHz <= fREF <= 2MHz 00 2MHz < fREF <= 6MHz 01 6MHz < fREF <= 12MHz 10 fREF >12MHz 11 Module Base + 0x0003 76543210 R LOCKIE LOCKIF LOCK 0 0 UNLOCKF W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 12-5. CGMIPLL Flags Register (CGMFLG) fREF fOSC

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19

452 Freescale Semiconductor

12.3.2.4 CGMIPLL Control Register (CGMCTL)

Read: Anytime Write: Anytime Writing the CGMCTL register clears the LOCK status bit. Table 12-3. CGMFLG Field Descriptions Field Description LOCKIE Lock Interrupt Enable Bit 0 LOCK interrupt requests are disabled. 1 Interrupt will be requested whenever LOCKIF is set. LOCKIF IPLL Lock Interrupt Flag — LOCKIF is set to 1 when LOCK status bit changes. This flag can only be cleared by writing a 1. Writing a 0 has no effect.If enabled (LOCKIE=1), LOCKIF causes an interrupt request. 0 No change in LOCK status bit. 1 LOCK status bit has changed. LOCK IPLL Lock Status Bit — LOCK reflects the current state of IPLL lock condition. Writes have no effect. Writing registers CGMSYNR or CGMREFDV or CGMCTL clears the LOCK status bit. 0 VCOCLK is not within the desired tolerance of the target frequency. 1 VCOCLK is within the desired tolerance of the target frequency. UNLOCKF IPLL Unlock Flag — UN LOCKF flag is set to 1 when LOCK status bit changes from locked (one) to unlocked (zero). This flag can only be cleared by writing a 1. Writing a 0 has no effect. 0 No change from locked (one) to unlocked (zero). 1 LOCK bit has changed from locked (one) to unlocked (zero). Module Base + 0x0004 76543210 R 0000 DIV2 FM1 FM0 PLLON W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 12-6. CGMIPLL Control Register (CGMCTL) Table 12-4. CGMCTL Field Descriptions Field Description DIV2 VCOCLK divide by 2 Bit 0 CGMIPLL Clock equals VCOCLK. 1 CGMIPLL Clock is half the frequency of VCOCLK.

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 453

12.3.2.5 Reserved Register (CGMTEST0)

This reserved register is designed for factory test purposes only, and is not intended for general user access. Writing to this register when in special modes can alter the CGMIPLL’s functionality. Read: Always read $00 except in special modes Write: Only in special modes 2, 1 FM1, FM0 IPLL Frequency Modulation Enable Bit — FM1 and FM0 enable additional frequency modulation on the VCOCLK. This is to reduce noise emission. The modulation frequency is fref divided by 16. See Table 12-5 for coding. PLLON Phase Lock Loop On Bit — PLLON turns on the IPLL circuitry. 0 IPLL is turned off. 1 IPLL is turned on. Table 12-5. FM Amplitude selection FM1 FM0 FM Amplitude / fVCO Variation 0 0 FM off 01 ±1% 10 ±2% 11 ±4% Module Base + 0x0005 76543210 R 00000000 W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 12-7. Reserved Register (CGMTEST0) Table 12-4. CGMCTL Field Descriptions (continued) Field Description

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19

454 Freescale Semiconductor

12.3.2.6 Reserved Register (CGMTEST1)

This reserved register is designed for factory test purposes only, and is not intended for general user access. Writing to this register when in special test modes can alter the CGMIPLL’s functionality. Read: Always read $00 except in special modes Write: Only in special modes

12.3.2.7 Reserved Register (CGMTEST2)

This reserved register is designed for factory test purposes only, and is not intended for general user access. Writing to this register when in special modes can alter the CGMIPLL’s functionality. Read: always read $00 except in special modes Write: only in special modes Module Base + 0x0006 76543210 R 00000000 W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 12-8. Reserved Register (CGMTEST1) Module Base + 0x0007 76543210 R 00000000 W Reset 0 0 0 00000 = Unimplemented or Reserved Figure 12-9. Reserved Register (CGMTEST2)

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 455

12.4 Functional Description

12.4.1 Examples of IPLL divider settings

Several examples of IPLL divider settings are shown in Table 12-6. Shaded rows indicated that these settings are not recommended. The following rules help to achieve optimum stability and shortest lock time:

• Use lowest possible f VCO / fREF ratio (SYNDIV value).
• Use highest possible REFCLK frequency f REF.

12.4.2 IPLL Operation

The oscillator output clock signal (OSCCLK) is fed through the reference programmable divider and is divided in a range of 1 to 64 (REFDIV+1) to output the REFCLK. The VCO output clock, (VCOCLK) is fed back through the programmable loop divider and is divided in a range of 2 to 128 in increments of [2 x (SYNDIV +1)] to output the FBCLK. The VCOCLK can by divided by 2 (DIV2 bit) to output the CGMIPLL Clock. The phase detector then compares the FBCLK, with the REFCLK. Correction pulses are generated based on the phase difference between the two signals. The loop filter then slightly alters the DC voltage on the internal filter capacitor, based on the width and direction of the correction pulse. The user must select the range of the REFCLK frequency and the range of the VCOCLK frequency to ensure that the correct IPLL loop bandwidth is set. The lock detector compares the frequencies of the FBCLK, and the REFCLK. Therefore, the speed of the lock detector is directly proportional to the reference clock frequency. The circuit determines the lock condition based on this comparison. If IPLL LOCK interrupt requests are enabled, the software can wait for an interrupt request and then check the LOCK bit. If interrupt requests are disabled, software can poll the LOCK bit continuously (during IPLL start-up, usually) or at periodic intervals.

• The LOCK bit is a read-only indicator of the locked state of the IPLL. Table 12-6. Examples of IPLL Divider Settings fOSC REFDIV[5:0] f REF REFFRQ[1:0] SYNDIV[5:0] f VCO VCOFRQ[1:0] DIV2 f CGMIPLL 4MHz $00 4MHz 01 $09 80MHz 01 0 80MHz 8MHz $00 8MHz 10 $04 80MHz 01 0 80MHz 4MHz $00 4MHz 01 $03 32MHz 00 1 16MHz 4MHz $01 2MHz 00 $18 100MHz 11 0 100MHz 4MHz $03 1MHz 00 $18 50MHz 01 0 50MHz 4MHz $03 1MHz 00 $32 100MHz 11 0 100MHz

Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description MC9S12XF - Family Reference Manual, Rev.1.19

456 Freescale Semiconductor

• The LOCK bit is set when the VCO frequency is within a certain tolerance, ∆Lock, and is cleared when the VCO frequency is out of a certain tolerance, ∆unl.
• Interrupt requests can occur if enabled (LOCKIE = 1) when the lock condition changes, toggling the LOCK bit.

12.5 Interrupts

The interrupts/reset vectors requested by the CGMIPLL are listed in Table 12-7. Refer to MCU specification for related vector addresses and priorities.

12.5.1 Description of Interrupt Operation

12.5.1.1 IPLL Lock Interrupt

The CGMIPLL generates a IPLL Lock interrupt when the LOCK condition of the IPLL has changed, either from a locked state to an unlocked state or vice versa. Lock interrupts are locally disabled by setting the LOCKIE bit to zero. The IPLL Lock interrupt flag (LOCKIF) is set to1 when the LOCK condition has changed, and is cleared to 0 by writing a 1 to the LOCKIF bit. Table 12-7. CGMIPLL Interrupt Vectors Interrupt Source CCR Mask Local Enable LOCK interrupt I bit CGMFLG (LOCKIE)

MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 457 Chapter 13 FlexRay Communication Controller (FLEXRAY)

13.1 Introduction

13.1.1 Reference

The following documents are referenced.

• FlexRay Communications System Protocol Specification, Version 2.1 Rev A Rev. No. Revision Date Effective Date Author Summary of Changes 1.4 20 Aug 2006

31 Aug

Added lower bit rate description add pe-pll description fixed PSR1[APTAC] description updated calculation of message buffers that can be used renamed PRESCALE field in MCR to BITRATE 1.5 7 Nov 2006

7 Nov

Module Configuration Register (MCR) - updated description of CLKSEL bit Section 13.6.7, “Individual Message Buffer Search” - split message buffer priority table into static / dynamic segment - add statement of rx tx buffer pair in dynamic segment Section 13.6.3.7.2, “Receive FIFO Control Data” - removed Note on empty receive fifo update issue - added statement, that empty fifo can not be updated 1.6 02 Feb 07 02 Feb 07 Section 13.6.7, “Individual Message Buffer Search” - major update Section 13.7.6, “Message Buffer Search on Simple Message Buffer Configuration” - added to illustrate message buffer search Section 13.7.2, “Shut Down Sequence” - simplified description Section 13.1.6.3, “Stop Mode” - make shutdown mandatory added w1c indication to all flag bits, added rwm to CMT bit added flexray bus related minimum chi frequency Section 13.1.6, “Modes of Operation” - updated desciption Section 13.3, “Controller Host Interface Clocking” - added and provide minimum chi frequency Section 13.7.1, “Initialization Sequence -updated, changed shutdown sequence

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

458 Freescale Semiconductor

• FlexRay Communications System Electrical Physical Layer Specification, Version 2.1 Rev A

13.1.2 Glossary

This section provides a list of terms used in the description of the FlexRay block.

13.1.3 Color Coding

Throughout this chapter types of items are highlighted through the use of an italicized color font. FlexRay protocol parameters, constants and variables are highlighted withblue italics. An example is the parameter gdActionPointOffset. Table 13-1. List of Terms Term Definition BCU Buffer Control Unit. Handles message buffer access. BMIF Bus Master Interface. Provides master access to FlexRay memory block. CC Communication Controller CDC Clock Domain Crosser CHI Controller Host Interface Cycle length in µT The actual length of a cycle in µT for the ideal controller (+/- 0 ppm) EBI External Bus Interface FRM FlexRay Memory. Memory to store message buffer payload, header, and status, and to store synchronization frame related tables. FSS Frame Start Sequence HIF Host Interface. Provides host access to FlexRay block. Host The FlexRay CC host MCU LUT Look Up Table. Stores message buffer header index value. MB Message Buffer MBIDX Message Buffer Index: the position of a header field entry within the header area. If the header area is accessed as an array, this is the same as the array index of the entry. MBNum Message Buffer Number: Position of message buffer configuration registers within the register map. For example, Message Buffer Number 5 corresponds to the MBCCS5 register. MCU Microcontroller Unit µT Microtick MT Macrotick MTS Media Access Test Symbol NIT Network Idle Time PE Protocol Engine POC Protocol Operation Control. Each state of the POC is denoted by POC:state Rx Reception SEQ Sequencer Engine TCU Time Control Unit Tx Transmission

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 459 FlexRay protocol states are highlighted in green italics. An example is the state POC:normal active.

13.1.4 Overview

The FlexRay block is a FlexRay communication controller that implements theFlexRay Communications System Protocol Specification, Version 2.1 Rev A. The FlexRay block has three main components:

• Controller host interface (CHI)
• Protocol engine (PE)
• Clock domain crossing unit (CDC) A block diagram of the FlexRay block with its surrounding modules is given in Figure 13-1. Figure 13-1. FLEXRAY Block Diagram The protocol engine has two transmitter units TxA and TxB and two receiver units RxA and RxB for sending and receiving frames through the two FlexRay channels. The time control unit (TCU) is responsible for maintaining global clock synchronization to the FlexRay network. The overall activity of the PE is controlled by the sequencer engine (SEQ). The controller host interface provides host access to the module’s configuration, control, and status registers, as well as to the message buffer configuration, control, and status registers. The message buffers themselves, which contain the frame header and payload data received or to be transmitted, and the slot status information, are stored in the FlexRay Memory (FRM). The clock domain crossing unit implements signal crossing from the CHI clock domain to the PE clock domain and vice versa, to allow for asynchronous PE and CHI clock domains. Clock Domain Crossing PE TxA RxA TCU config SEQ CHI HIF SEARCH LUT BCU RXD_A RXD_B STB0 TXD_A TXE_A TXD_B TXE_B STB1 STB2 STB3 FLEXRAY Host CPU System Memory BMIF

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

460 Freescale Semiconductor

The FlexRay block stores the frame header and payload data of frames received or of frames to be transmitted in the FRM. The application accesses the FRM to retrieve and provide the frames to be processed by the FlexRay block. In addition to the frame header and payload data, the FlexRay block stores the synchronization frame related tables in the FRM for application processing. The FlexRay Memory is located in the system memory of the MCU. The FlexRay block has access to the FRM via its bus master interface (BMIF). The host provides the start address of the FRM window within the system memory by programming the System Memory Base Address High Register (SYMBADHR) and System Memory Base Address Low Register (SYMBADLR). All FRM related offsets are stored in offset registers. The physical address pointer into the FRM window of the MCU system memory is calculated using the offset values the FlexRay Memory base address. NOTE The FlexRay block does not provide a memory protection scheme for the FlexRay Memory.

13.1.5 Features

The FlexRay block provides the following features:

• FlexRay Communications System Protocol Specification, Version 2.1 Rev A compliant protocol implementation
• FlexRay Communications System Electrical Physical Layer Specification, Version 2.1 Rev A compliant bus driver interface
• single channel support — FlexRay Port A can be configured to be connected either to physical FlexRay channel A or physical FlexRay channel B.
• FlexRay bus data rates of 10 Mbit/s, 8 Mbit/s, 5 Mbit/s, and 2.5 Mbit/s supported
• internal oscillator or internal PLL clocking of the protocol engine
• 32 configurable message buffers with — individual frame ID filtering — individual channel ID filtering — individual cycle counter filtering
• message buffer header, status and payload data stored in dedicated FlexRay Memory — allows for flexible and efficient message buffer implementation — consistent data access ensured by means of buffer locking scheme — application can lock multiple buffers at the same time
• size of message buffer payload data section configurable from 0 up to 254 bytes
• two independent message buffer segments with configurable size of payload data section — each segment can contain message buffers assigned to the static segment and message buffers assigned to the dynamic segment at the same time
• zero padding for transmit message buffers in static segment — applied when the frame payload length exceeds the size of the message buffer data section

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 461

• transmit message buffers configurable with state/event semantics
• message buffers can be configured as — receive message buffer — single buffered transmit message buffer — double buffered transmit message buffer (combines two single buffered message buffer)
• individual message buffer reconfiguration supported — means provided to safely disable individual message buffers — disabled message buffers can be reconfigured
• two independent receive FIFOs — one receive FIFO per channel — up to 255 entries for each FIFO — global frame ID filtering, based on both value/mask filters and range filters — global channel ID filtering — global message ID filtering for the dynamic segment
• 4 configurable slot error counters
• 4 dedicated slot status indicators — used to observe slots without using receive message buffers
• measured value indicators for the clock synchronization — internal synchronization frame ID and synchronization frame measurement tables can be copied into the FlexRay Memory
• fractional macroticks are supported for clock correction
• maskable interrupt sources provided via individual and combined interrupt lines
• 1 absolute timer
• 1 timer that can be configured to absolute or relative

13.1.6 Modes of Operation

This section describes the basic operational power modes of the FlexRay block.

13.1.6.1 Disabled Mode

This is the mode the FlexRay block enters during hard reset. The FlexRay block indicates that it is in the Disabled Mode by negating the module enable bit MEN in the Module Configuration Register (MCR). No communication is performed on the FlexRay bus. All registers with the write access conditionsAny Time and Disabled Mode can be accessed for writing as stated in Section 13.5.2, “Register Descriptions”. The application configures the FlexRay block by accessing the configuration bits and fields in theModule Configuration Register (MCR).

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

462 Freescale Semiconductor

13.1.6.1.1 Leave Disabled Mode

The FlexRay block leaves the Disabled Mode and enters the Normal Mode, when the application writes 1 to the module enable bit MEN in the Module Configuration Register (MCR) NOTE When the FlexRay block was enabled, it cannot be disabled the later on.

13.1.6.2 Normal Mode

In this mode the FlexRay block is fully functional. The FlexRay block indicates that it is in Normal Mode by asserting the module enable bit MEN in the Module Configuration Register (MCR).

13.1.6.2.1 Enter Normal Mode

This mode is entered when the application requests the FlexRay block to leave the Disabled Mode or when the MCU leaves the Stop Mode. If the Normal Mode was entered by leaving the Disabled Mode, the application has to perform the protocol initialization described in 13.7.1.2, “Protocol Initialization” to achieve full FlexRay functionality. Depending on the values of the SCM, CHA, and CHB bits in theModule Configuration Register (MCR), the corresponding FlexRay bus driver ports are driven.

13.1.6.3 Stop Mode

The FlexRay block is in Stop Mode when the MCU is either in Full Stop or Pseudo Stop Mode. In this mode all FlexRay block clocks are stopped. No registers can be accessed. No communication is performed on the FlexRay Bus.

13.1.6.3.1 Enter Stop Mode

Before the application requests the MCU to enter one of the Stop Modes, it has to shut down the FlexRay block as described in Section 13.7.2, “Shut Down Sequence”. NOTE If the FlexRay block is stopped during transmission of data, it is not guaranteed, that the FlexRay ports return to its inactive state before the clocks are stopped. This can result in the lockup of the FlexRay Bus.

13.1.6.3.2 Leave Stop Mode

The FlexRay block leaves the Stop Mode when the MCU leaves its Stop Mode and all clocks are reapplied to the FlexRay block. The FlexRay block enters the operational mode it was in before going into Stop Mode. If the FlexRay block enters the Normal Mode, the application has to put the protocol engine into the default config state by the following sequence: d) issue the DEFAULT_CONFIG command viaProtocol Operation Control Register (POCR) e) wait for POC:default config in Protocol Status Register 0 (PSR0)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 463 Subsequently the application can reconfigure and/or reintegrate the FlexRay node into the FlexRay cluster.

13.2 External Signal Description

This section lists and describes the FlexRay block signals, connected to external pins. These signals are summarized in Table 13-2 and described in detail in Section 13.2.1, “Detailed Signal Descriptions”. NOTE The off chip signals RXD_A, TXD_A, and TXE_A are available on each package option. The availability of the other off chip signals depends on the package option.

13.2.1 Detailed Signal Descriptions

This section provides a detailed description of the FlexRay block signals, connected to external pins.

13.2.1.1 RXD_A — Receive Data Channel A

The RXD_A signal carries the receive data for channel A from the corresponding FlexRay bus driver.

13.2.1.2 TXD_A — Transmit Data Channel A

The TXD_A signal carries the transmit data for channel A to the corresponding FlexRay bus driver.

13.2.1.3 TXE_A — Transmit Enable Channel A

The TXE_A signal indicates to the FlexRay bus driver that the FlexRay block is attempting to transmit data on channel A.

13.2.1.4 RXD_B — Receive Data Channel B

The RXD_B signal carries the receive data for channel B from the corresponding FlexRay bus driver. Table 13-2. External Signal Properties Name Direction Active Reset Function RXD_A Input — — Receive Data Channel A TXD_A Output — 1 Transmit Data Channel A TXE_A Output Low 1 Transmit Enable Channel A RXD_B Input — — Receive Data Channel B TXD_B Output — 1 Transmit Data Channel B TXE_B Output Low 1 Transmit Enable Channel B STB0 Output — 0 Debug Strobe Signal 0 STB1 Output — 0 Debug Strobe Signal 1 STB2 Output — 0 Debug Strobe Signal 2 STB3 Output — 0 Debug Strobe Signal 3

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

464 Freescale Semiconductor

13.2.1.5 TXD_B — Transmit Data Channel B

The TXD_B signal carries the transmit data for channel B to the corresponding FlexRay bus driver

13.2.1.6 TXE_B — Transmit Enable Channel B

The TXE_B signal indicates to the FlexRay bus driver that the FlexRay block is attempting to transmit data on channel B.

13.2.1.7 STB3, STB2, STB1, STB0 — Strobe Signals

These signals provide the selected debug strobe signals. For details on the debug strobe signal selection refer to Section 13.6.16, “Strobe Signal Support”.

13.3 Controller Host Interface Clocking

The clock for the CHI is derived from the system bus clock and has the same phase and frequency. Since the FlexRay protocol requires data delivery at fixed points in time, the memory read cycles from the FRM must be finished after a fixed amount of time. To ensure this, a minimum frequency f chi of the CHI clock is required, which is given in Equation 13-1. Eqn. 13-1 Additional requirements for the minimum frequency of the CHI clock result from the number of message buffer. The requirement is provides in Section 13.7.3, “Number of Usable Message Buffers”

13.4 Protocol Engine Clocking

The clock for the protocol engine can be generated by two sources. The first source is the internal crystal oscillator and the second source is an internal PLL. The clock source to be used is selected by the clock source select bit CLKSEL in the Module Configuration Register (MCR).

13.4.1 Oscillator Clocking

If the protocol engine is clocked by the internal crystal oscillator, an 80 MHz crystal or 80 MHz CMOS compatible clock must be connected to the oscillator pins. The crystal or clock must fulfill the requirements given by the FlexRay Communications System Protocol Specification, Version 2.1 Rev A.

13.4.2 PLL Clocking

If the protocol engine is clocked by the dedicated internal PLL, which is described inChapter 12, “Clock Generation Module using IPLL (CGMIPLL) Block Description, the CGMIPLL must be programmed to generate an output clock with fCGMIPLL = 80 MHz. fchi 16MHz≥

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 465

13.4.3 PLL Lock Handling

For correct flexray bus functionality of the protocol engine, it is required that the PLL in the CGMIPLL module is locked while the protocol engine is driving data onto the flexray bus. The lock state of the PLL is indicated by the lock status bit LOCK in the CGMIPLL Flags Register (CGMFLG). The FlexRay block drives its FlexRay transmit enable ports TXE_A and TXE_B to active state only if the PLL unlock flag UNLOCKF in the CGMIPLL Flags Register (CGMFLG) is 0. If the unlock flag UNLOCKF is 1, the FlexRay block drives its FlexRay transmit enable ports TXE_A and TXE_B to its inactive state 1.

13.4.3.1 PLL Loss of Lock

If the PLL goes from the locked state to the unlock state, the CGMIPLL module sets the lock bit LOCK to 0 and the unlock flag UNLOCKF to 1. As a result, the FlexRay block drives its FlexRay transmit enable ports TXE_A and TXE_B to its inactive states 1 and thus stops the transmission onto the FlexRay bus immediately. As a result of the loss of lock, the correct operation of the PE is no longer guaranteed. The application should perform a shutdown of the FlexRay module as described in 13.7.2, “Shut Down Sequence”.

13.4.3.2 PLL Gain of Lock

If the PLL goes from the unlocked state to the locked state, the CGMIPLL module sets the lock bit LOCK to 1. The unlock flag UNLOCKF is not cleared by the module, this has to be done by the application. After the clearing of the unlock flag UNLOCKF, the application can perform the FlexRay initialization as described in 13.7.1, “Initialization Sequence”.

13.5 Memory Map and Register Description

The FlexRay block occupies 512 bytes of address space starting atthe FlexRay block’s base address defined by the memory map of the MCU.

13.5.1 Memory Map

The complete memory map of the FlexRay block is shown inTable 13-3. The addresses presented here are the offsets relative to the FlexRay block base address which is defined by the MCU address map. Table 13-3. FlexRay Memory Map (Sheet 1 of 4) Offset Register Access Module Configuration and Control 0x0000 Module Version Register (MVR) R 0x0002 Module Configuration Register (MCR) R/W 0x0004 System Memory Base Address High Register (SYMBADHR) R/W 0x0006 System Memory Base Address Low Register (SYMBADLR) R/W 0x0008 Strobe Signal Control Register (STBSCR) R/W 0x000A Strobe Port Control Register (STBPCR) R/W

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

466 Freescale Semiconductor

0x000C Message Buffer Data Size Register (MBDSR) R/W 0x000E Message Buffer Segment Size and Utilization Register (MBSSUTR) R/W Test Registers 0x0010 Reserved R 0x0012 Reserved R Interrupt and Error Handling 0x0014 Protocol Operation Control Register (POCR) R/W 0x0016 Global Interrupt Flag and Enable Register (GIFER) R/W 0x0018 Protocol Interrupt Flag Register 0 (PIFR0) R/W 0x001A Protocol Interrupt Flag Register 1 (PIFR1) R/W 0x001C Protocol Interrupt Enable Register 0 (PIER0) R/W 0x001E Protocol Interrupt Enable Register 1 (PIER1) R/W 0x0020 CHI Error Flag Register (CHIERFR) R/W 0x0022 Message Buffer Interrupt Vector Register (MBIVEC) R 0x0024 Channel A Status Error Counter Register (CASERCR) R 0x0026 Channel B Status Error Counter Register (CBSERCR) R Protocol Status 0x0028 Protocol Status Register 0 (PSR0) R 0x002A Protocol Status Register 1 (PSR1) R 0x002C Protocol Status Register 2 (PSR2) R 0x002E Protocol Status Register 3 (PSR3) R/W 0x0030 Macrotick Counter Register (MTCTR) R 0x0032 Cycle Counter Register (CYCTR) R 0x0034 Slot Counter Channel A Register (SLTCTAR) R 0x0036 Slot Counter Channel B Register (SLTCTBR) R 0x0038 Rate Correction Value Register (RTCORVR) R 0x003A Offset Correction Value Register (OFCORVR) R 0x003C Combined Interrupt Flag Register (CIFRR) R 0x003E System Memory Access Time-Out Register (SYMATOR) R/W Sync Frame Counter and Tables 0x0040 Sync Frame Counter Register (SFCNTR) R 0x0042 Sync Frame Table Offset Register (SFTOR) R/W 0x0044 Sync Frame Table Configuration, Control, Status Register (SFTCCSR) R/W Sync Frame Filter 0x0046 Sync Frame ID Rejection Filter Register (SFIDRFR) R/W 0x0048 Sync Frame ID Acceptance Filter Value Register (SFIDAFVR) R/W 0x004A Sync Frame ID Acceptance Filter Mask Register (SFIDAFMR) R/W Network Management Vector 0x004C Network Management Vector Register 0 (NMVR0) R 0x004E Network Management Vector Register 1 (NMVR1) R 0x0050 Network Management Vector Register 2 (NMVR2) R Table 13-3. FlexRay Memory Map (Sheet 2 of 4) Offset Register Access

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 467 0x0052 Network Management Vector Register 3 (NMVR3) R 0x0054 Network Management Vector Register 4 (NMVR4) R 0x0056 Network Management Vector Register 5 (NMVR5) R 0x0058 Network Management Vector Length Register (NMVLR) R/W Timer Configuration 0x005A Timer Configuration and Control Register (TICCR) R/W 0x005C Timer 1 Cycle Set Register (TI1CYSR) R/W 0x005E Timer 1 Macrotick Offset Register (TI1MTOR) R/W 0x0060 Timer 2 Configuration Register 0 (TI2CR0) R/W 0x0062 Timer 2 Configuration Register 1 (TI2CR1) R/W Slot Status Configuration 0x0064 Slot Status Selection Register (SSSR) R/W 0x0066 Slot Status Counter Condition Register (SSCCR) R/W Slot Status 0x0068 Slot Status Register 0 (SSR0) R 0x006A Slot Status Register 1 (SSR1) R 0x006C Slot Status Register 2 (SSR2) R 0x006E Slot Status Register 3 (SSR3) R 0x0070 Slot Status Register 4 (SSR4) R 0x0072 Slot Status Register 5 (SSR5) R 0x0074 Slot Status Register 6 (SSR6) R 0x0076 Slot Status Register 7 (SSR7) R 0x0078 Slot Status Counter Register 0 (SSCR0) R 0x007A Slot Status Counter Register 1 (SSCR1) R 0x007C Slot Status Counter Register 2 (SSCR2) R 0x007E Slot Status Counter Register 3 (SSCR3) R MTS Generation 0x0080 MTS A Configuration Register (MTSACFR) R/W 0x0082 MTS B Configuration Register (MTSBCFR) R/W Shadow Buffer Configuration 0x0084 Receive Shadow Buffer Index Register (RSBIR) R/W Receive FIFO — Configuration 0x0086 Receive FIFO Selection Register (RFSR) R/W 0x0088 Receive FIFO Start Index Register (RFSIR) R/W 0x008A Receive FIFO Depth and Size Register (RFDSR) R/W Receive FIFO - Status 0x008C Receive FIFO A Read Index Register (RFARIR) R 0x008E Receive FIFO B Read Index Register (RFBRIR) R Receive FIFO - Filter 0x0090 Receive FIFO Message ID Acceptance Filter Value Register (RFMIDAFVR) R/W Table 13-3. FlexRay Memory Map (Sheet 3 of 4) Offset Register Access

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

468 Freescale Semiconductor

13.5.2 Register Descriptions

This section provides detailed descriptions of all registers in ascending address order, presented as 16-bit wide entities Table 13-4 provides a key for the register figures and register tables. 0x0092 Receive FIFO Message ID Acceptance Filter Mask Register (RFMIAFMR) R/W 0x0094 Receive FIFO Frame ID Rejection Filter Value Register (RFFIDRFVR) R/W 0x0096 Receive FIFO Frame ID Rejection Filter Mask Register (RFFIDRFMR) R/W 0x0098 Receive FIFO Range Filter Configuration Register (RFRFCFR) R/W 0x009A Receive FIFO Range Filter Control Register (RFRFCTR) R/W Dynamic Segment Status 0x009C Last Dynamic Transmit Slot Channel A Register (LDTXSLAR) R 0x009E Last Dynamic Transmit Slot Channel B Register (LDTXSLBR) R Protocol Configuration 0x00A0 ... 0x00DC Protocol Configuration Register 0 (PCR0) ... Protocol Configuration Register 30 (PCR30) R/W R/W 0x00DE ... 0x00FE Reserved R Message Buffers Configuration, Control, Status 0x0100 Message Buffer Configuration, Control, Status Register 0 (MBCCSR0) R/W 0x0102 Message Buffer Cycle Counter Filter Register 0 (MBCCFR0) R/W 0x0104 Message Buffer Frame ID Register 0 (MBFIDR0) R/W 0x0106 Message Buffer Index Register 0 (MBIDXR0) R/W 0x01F8 Message Buffer Configuration, Control, Status Register 31 (MBCCSR31) R/W 0x01FA Message Buffer Cycle Counter Filter Register 31 (MBCCFR31) R/W 0x01FC Message Buffer Frame ID Register 31 (MBFIDR31) R/W 0x01FE Message Buffer Index Register 31 (MBIDXR31) R/W Table 13-4. Register Access Conventions Convention Description Depending on its placement in the read or write row, indicates that the bit is not readable or not writeable. R* Reserved bit or field, will not be changed. Application must not write any value different from the reset value. FIELDNAME Identifies the field. Its presence in the read or write row indicates that it can be read or written. Register Field Types rwm A read/write bit that may be modified by a hardware in some fashion other than by a reset. w1c Write one to clear. A flag bit that can be read, is cleared by writing a one, writing 0 has no effect. Table 13-3. FlexRay Memory Map (Sheet 4 of 4) Offset Register Access

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 469

13.5.2.1 Register Reset

All registers except the Message Buffer Cycle Counter Filter Registers (MBCCFRn), Message Buffer Frame ID Registers (MBFIDRn), and Message Buffer Index Registers (MBIDXRn)are reset to their reset value on system reset. The registers mentioned above are located in physical memory blocks and, thus, they are not affected by reset. For some register fields, additional reset conditions exist. These additional reset conditions are mentioned in the detailed description of the register. The additional reset conditions are explained in Table 13-5.

13.5.2.2 Register Write Access

This section describes the write access restriction terms that apply to all registers.

13.5.2.2.1 Register Write Access Restriction

For each register bit and register field, the write access conditions are specified in the detailed register description. A description of the write access conditions is given in Table 13-6. If, for a specific register bit or field, none of the given write access conditions is fulfilled, any write attempt to this register bit or field is ignored without any notification. The values of the bits or fields are not changed. The condition term [A or B] indicates that the register or field can be written to if at least one of the conditions is fulfilled. Reset Value 0 Resets to zero. 1 Resets to one. – Not defined after reset and not affected by reset.Table 13-5. Additional Register Reset Conditions Condition Description Protocol RUN Command The register field is reset when the application writes to RUN command “0101” to the POCCMD field in the Protocol Operation Control Register (POCR). Message Buffer Disable The register field is reset when the application has disabled the message buffer. This happens when the application writes 1 to the message buffer disable trigger bit MBCCSRn.EDT while the message buffer is enabled (MBCCSn.EDS = 1) and the FlexRay block grants the disable to the application by clearing the MBCCSRn.EDS bit.Table 13-6. Register Write Access Restrictions Condition Indication Description Any Time - No write access restriction. Disabled Mode MCR.MEN = 0 Write access only when the FlexRay block is in Disabled Mode. Normal Mode MCR.MEN = 1 Write access only when the FlexRay block is in Normal Mode. POC:config PSR0.PROTSTATE =POC:config Write access only when the Protocol is in the POC:config state. MB_DIS MBCCSRn.EDS = 0 Write access only when the related Message Buffer is disabled. Table 13-4. Register Access Conventions (continued) Convention Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

470 Freescale Semiconductor

13.5.2.2.2 Register Write Access Requirements

For some of the registers, a 16-bit wide write access is required to ensure correct operation. This write access requirement is stated in the detailed register description for each register affected

13.5.2.2.3 Internal Register Access

The following memory mapped registers are used to access multiple internal registers.

• Strobe Signal Control Register (STBSCR)
• Slot Status Selection Register (SSSR)
• Slot Status Counter Condition Register (SSCCR)
• Receive Shadow Buffer Index Register (RSBIR) Each of these memory mapped registers provides a SEL field and a WMD bit. The SEL field is used to select the internal register. The WMD bit controls the write mode. If the WMD bit is set to 0 during the write access, all fields of the internal register are updated. If the WMD bit set to 1, only the SEL field is changed. All other fields of the internal register remain unchanged. This allows for reading back the values of the selected internal register in a subsequent read access.

13.5.2.3 Module Version Register (MVR)

This register provides the FlexRay block version number. The module version number is derived from the CHI version number and the PE version number. MB_LCK MBCCSRn.LCKS = 1 Write access only when the related Message Buffer is locked. Module Base + 0x0000 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R CHIVER PEVER W Reset 1 0 0 0 1 0 0 0 0 1 1 00110 Figure 13-2. Module Version Register (MVR) Table 13-7. MVR Field Descriptions Field Description 15–8 CHIVER CHI Version Number — This field provides the version number of the controller host interface. 7–0 PEVER PE Version Number — This field provides the version number of the protocol engine. Table 13-6. Register Write Access Restrictions Condition Indication Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 471

13.5.2.4 Module Configuration Register (MCR)

This register defines the global configuration of the FlexRay block. Module Base + 0x0002 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R MEN 0 SCM CHB CHA SFFE 0 R* 000 CLKS EL BITRATE 0 W Reset 0000000000000000 Figure 13-3. Module Configuration Register (MCR) Write: MEN, SCM, CHB, CHA, CLKSEL, BITRATE: Disabled Mode SFFE: Disabled Mode or POC:config Table 13-8. MCR Field Descriptions Field Description MEN Module Enable — This bit indicates whether or not the FlexRay block is in the Disabled Mode. The application requests the FlexRay block to leave the Disabled Mode by writing 1 to this bit. Before leaving the Disabled Mode, the application must configure the SCM, CHB, CHA, TMODE, CLKSEL, BITRATE values. For details see Section 13.1.6, “Modes of Operation”.

0 Write: ignored, FlexRay block disable not possible

Read: FlexRay block disabled

1 Write: enable FlexRay block

Read: FlexRay block enabled Note: If the FlexRay block is enabled it can not be disabled. SCM Single Channel Device Mode — This control bit defines the channel device mode of the FlexRay block as described in Section 13.6.10, “Channel Device Modes”.

0 FlexRay block works in dual channel device mode

1 FlexRay block works in single channel device mode

12–11 CHB CHA Channel Enable — protocol related parameter: pChannels The semantic of these control bits depends on the channel device mode controlled by the SCM bit and is given Table 13-9. SFFE Synchronization Frame Filter Enable— This bit controls the filtering for received synchronization frames. For details see Section 13.6.15, “Sync Frame Filtering”.

0 Synchronization frame filtering disabled

1 Synchronization frame filtering enabled

Reserved — This bit is reserved. It is read as 0. Application must not write 1 to this bit. CLKSEL Protocol Engine Clock Source Select — This bit is used to select the clock source for the protocol engine. 0 PE clock source is generated by on-chip crystal oscillator. 1 PE clock source is generated by on-chip PLL. 3–1 BITRATE FlexRay Bus Bit Rate — This bit field defines the bit rate of the flexray channels according to Table 13-10. Table 13-9. FlexRay Channel Selection (Sheet 1 of 2) SCM CHB CHA Description Dual Channel Device Modes

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

472 Freescale Semiconductor

ports RXD_A, TXD_A, and TXE_A not driven by FlexRay block ports RXD_B, TXD_B, and TXE_A not driven by FlexRay block PE channel 0 idle PE channel 1 idle ports RXD_A, TXD_A, and TXE_A driven by FlexRay block ports RXD_B, TXD_B, and TXE_A not driven by FlexRay block PE channel 0 active PE channel 1 idle ports RXD_A, TXD_A, and TXE_A not driven by FlexRay block ports RXD_B, TXD_B, and TXE_A driven by FlexRay block PE channel 0 idle PE channel 1 active ports RXD_A, TXD_A, and TXE_A driven by FlexRay block ports RXD_B, TXD_B, and TXE_A driven by FlexRay block PE channel 0 active PE channel 1 active Single Channel Device Mode ports RXD_A, TXD_A, and TXE_A not driven by FlexRay block ports RXD_B, TXD_B, and TXE_A not driven by FlexRay block PE channel 0 idle PE channel 1 idle ports RXD_A, TXD_A, and TXE_A driven by FlexRay block ports RXD_B, TXD_B, and TXE_A not driven by FlexRay block PE channel 0 active PE channel 1 idle ports RXD_A, TXD_A, and TXE_A driven by FlexRay block ports RXD_B, TXD_B, and TXE_A not driven by FlexRay block PE channel 0 active, uses cCrcInit[B] (see Figure 13-135) PE channel 1 idle 1 1 reserved Table 13-10. FlexRay Channel Bit Rate Selection MCR[BITRATE] FlexRay Channel Bit Rate [Mbit/s] 000 10.0 001 5.0 010 2.5 011 8.0 100 reserved 101 reserved 110 reserved 111 reserved Table 13-9. FlexRay Channel Selection (Sheet 2 of 2) SCM CHB CHA Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 473

13.5.2.5 System Memory Base Address High Register (SYMBADHR) and

System Memory Base Address Low Register (SYMBADLR) NOTE The system memory base address must be set before the FlexRay block is enabled. The system memory base address registers define the base address of the FRM within the system memory. The base address is used by the BMIF to calculate the physical memory address for system memory accesses.

13.5.2.6 Strobe Signal Control Register (STBSCR)

1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000000 SYS_MEM_BASE_ADDR[22:16]W Reset 0000000000000000 Figure 13-4. System Memory Base Address High Register (SYMBADHR) Write: Disabled Mode Module Base + 0x0006 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R SYS_MEM_BASE_ADDR[15:4] 0000 W Reset 0000000000000000 Figure 13-5. System Memory Base Address Low Register (SYMBADLR) Write: Disabled Mode Table 13-11. SYMBADHR and SYMBADLR Field Descriptions Field Description 22–4 SYMBADHR SYMBADLR This base address will be added to all system memory offset values stored in registers or calculated in the FlexRay block before the FlexRay block accesses the system memory via its bus master interface. The system memory base address must be aligned to an 16-byte boundary. Module Base + 0x0008 16-bit write access required 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 SEL 000 ENB 00 STBPSELW WMD Reset 0000000000000000 Figure 13-6. Strobe Signal Control Register (STBSCR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

474 Freescale Semiconductor

Write: Anytime This register is used to assign the individual protocol timing related strobe signals given inTable 13-13 to the external strobe ports. Each strobe signal can be assigned to at most one strobe port. Each write access to registers overwrites the previously written ENB and STBPSEL values for the signal indicated by SEL. If more than one strobe signal is assigned to one strobe port, the current values of the strobe signals are combined with a binary OR and presented at the strobe port. If no strobe signal is assigned to a strobe port, the strobe port carries logic 0. For more detailed and timing information refer toSection 13.6.16, “Strobe Signal Support”. NOTE In single channel device mode, channel B related strobe signals are undefined and should not be assigned to the strobe ports. Table 13-12. STBSCR Field Descriptions Field Description WMD Write Mode — This control bit defines the write mode of this register. 0 Write to all fields in this register on write access. 1 Write to SEL field only on write access. 14–8 SEL Strobe Signal Select — This control field selects one of the strobe signals given in Table 13-13to be enabled or disabled and assigned to one of the four strobe ports given in Table 13-13. ENB Strobe Signal Enable — The control bit is used to enable and to disable the strobe signal selected by STBSSEL. 0 Strobe signal is disabled and not assigned to any strobe port. 1 Strobe signal is enabled and assigned to the strobe port selected by STBPSEL. 1–0 STBPSEL Strobe Port Select — This field selects the strobe port that the strobe signal selected by the SEL is assigned to. All strobe signals that are enabled and assigned to the same strobe port are combined with a binary OR operation. 00 assign selected signal to STB0 01 assign selected signal to STB1 10 assign selected signal to STB2 11 assign selected signal to STB3 Table 13-13. Strobe Signal Mapping (Sheet 1 of 3) SEL Description Channel Type Offset (1) Reference dec hex 0 0x00 poc_startup_state[0] (for coding see PSR0[4]) - value 0 MT start 1 0x01 poc_startup_state[1] (for coding see PSR0[5]) 2 0x02 poc_startup_state[2] (for coding see PSR0[6]) 3 0x03 poc_startup_state[3] (for coding see PSR0[7]) 4 0x04 poc_state[0] (for coding see PSR0[8]) 5 0x05 poc_state[1] (for coding see PSR0[9]) 6 0x06 poc_state[2] (for coding see PSR0[10]) 7 0x07 channel idle indicator A level +5 RXD_A 8 0x08 B RXD_B 9 0x09 receive data after glitch filtering A value +4 RXD_A 10 0x0A B RXD_B

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 475 11 0x0B synchronization edge strobe A pulse +4 RXD_A 12 0x0C B RXD_B 13 0x0D header received A pulse +4 RXD_A 14 0x0E B RXD_B 15 0x0F wakeup symbol decoded A pulse +5 RXD_A 16 0x10 B RXD_B 17 0x11 MTS or CAS symbol decoded A pulse +4 RXD_A 18 0x12 B RXD_B 19 0x13 frame decoded A pulse +4 RXD_A 20 0x14 B RXD_B 21 0x15 channel idle detected A pulse +4 RXD_A 22 0x16 B RXD_B 23 0x17 start of communication element detected A pulse +4 RXD_A 24 0x18 B RXD_B 25 0x19 potential frame start channel A pulse +4 RXD_A 26 0x1A B RXD_B 27 0x1B wakeup collision detected A pulse +5 RXD_A 28 0x1C B RXD_B 29 0x1D content error detected A level +4 RXD_A 30 0x1E B RXD_B 31 0x1F syntax error detected A pulse +4 RXD_A 32 0x20 B RXD_B 33 0x21 start transmission of wakeup pattern A pulse -1 TXD_A 34 0x22 B TXD_B 35 0x23 start transmission of MTS or CAS symbol A pulse -1 TXD_A 36 0x24 B TXD_B 37 0x25 start of transmission A pulse -1 TXD_A 38 0x26 B TXD_B 39 0x27 end of transmission A pulse -1 TXD_A 40 0x28 B TXD_B 41 0x29 static segment indicator - level 0 MT start 42 0x2A dynamic segment indicator - level 0 MT start 43 0x2B symbol window indicator - level 0 MT start 44 0x2C NIT indicator - level 0 MT start 45 0x2D action point - pulse -1 TXD_A 46 0x2E sync calculation complete (2) - pulse - - 47 0x2F start of offset correction - pulse -2 MT start Table 13-13. Strobe Signal Mapping (Sheet 2 of 3) SEL Description Channel Type Offset (1) Reference dec hex

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

476 Freescale Semiconductor

48 0x30 cycle count[0] - value -2 MT start 49 0x31 cycle count[1] 50 0x32 cycle count[2] 51 0x33 cycle count[3] 52 0x34 cycle count[4] 53 0x35 cycle count[5] 54 0x36 slot count[0] A value 0 MT start 55 0x37 slot count[1] 56 0x38 slot count[2] 57 0x39 slot count[3] 58 0x3A slot count[4] 59 0x3B slot count[5] 60 0x3C slot count[6] 61 0x3D slot count[7] 62 0x3E slot count[8] 63 0x3F slot count[9] 64 0x40 slot count[10] 65 0x41 slot count[0] B value 0 MT start 66 0x42 slot count[1] 67 0x43 slot count[2] 68 0x44 slot count[3] 69 0x45 slot count[4] 70 0x46 slot count[5] 71 0x47 slot count[6] 72 0x48 slot count[7] 73 0x49 slot count[8] 74 0x4A slot count[9] 75 0x4B slot count[10] 76 0x4C cycle start - pulse 0 MT start 77 0x4D slot start A pulse 0 MT start78 0x4E B 79 0x4F minislot start - pulse 0 MT start 80 0x50 arm - value +1 MT start 81 0x51 mt - value +1 MT start 1. Given in PE clock cycles 2. Indicates internal PE event not directly related to FlexRay bus timing Table 13-13. Strobe Signal Mapping (Sheet 3 of 3) SEL Description Channel Type Offset (1) Reference dec hex

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 477

13.5.2.7 Strobe Port Control Register (STBPCR)

Write: Anytime This register is used to enable and disable the strobe port signals. Each disabled port will stay disabled even when strobe signals are assigned to it.

13.5.2.8 Message Buffer Data Size Register (MBDSR)

Write: POC:config This register defines the size of the message buffer data section for the two message buffer segments in a number of two-byte entities. The FlexRay block provides two independent segments for the individual message buffers. All individual message buffers within one segment have to have the same size for the message buffer data section. This size can be different for the two message buffer segments. Module Base + 0x000A 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000000000 STB3 EN STB2 EN STB1 EN STB0 ENW Reset 0000000000000000 Figure 13-7. Strobe Port Control Register (STBPCR) Table 13-14. STBPCR Field Descriptions Field Description STB3EN Strobe Port 3 Enable — This control bit defines whether the STB3 port is enabled or disabled.

0 Strobe port STB3 disabled

1 Strobe port STB3 enabled

Strobe Port 2 Enable — This control bit defines whether the STB2 port is enabled or disabled.

0 Strobe port STB2 disabled

1 Strobe port STB2 enabled

Strobe Port 1 Enable — This control bit defines whether the STB1 port is enabled or disabled.

0 Strobe port STB1 disabled

1 Strobe port STB1 enabled

Strobe Port 0 Enable — This control bit defines whether the STB0 port is enabled or disabled.

0 Strobe port STB0 disabled

1 Strobe port STB0 enabled

1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 MBSEG2DS 0 MBSEG1DSW Reset 0000000000000000 Figure 13-8. Message Buffer Data Size Register (MBDSR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

478 Freescale Semiconductor

13.5.2.9 Message Buffer Segment Size and Utilization Register (MBSSUTR)

Write: POC:config This register is used to define the last individual message buffer that belongs to the first message buffer segment and the number of the last used individual message buffer.

13.5.2.10 Protocol Operation Control Register (POCR)

Table 13-15. MBDSR Field Descriptions Field Description 14–8 MBSEG2DS Message Buffer Segment 2 Data Size — The field defines the size of the message buffer data section in two- byte entities for message buffers within the second message buffer segment. 6–0 MBSEG1DS Message Buffer Segment 1 Data Size — The field defines the size of the message buffer data section in two- byte entities for message buffers within the first message buffer segment. Module Base + 0x000E 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000 LAST_MB_SEG1 000 LAST_MB_UTILW Reset 0001111100011111 Figure 13-9. Message Buffer Segment Size and Utilization Register (MBSSUTR) Table 13-16. MBSSUTR Field Descriptions Field Description 12–8 LAST_MB_SEG1 Last Message Buffer In Segment 1— This field defines the message buffer number of the last individual message buffer that is assigned to thefirst message buffer segment. The individual message buffers in the first segment correspond to the message buffer control registers MBCCSRn, MBCCFRn, MBFIDRn, MBIDXRn with n <= LAST_MB_SEG1. The first message buffer segment contains LAST_MB_SEG1+1 individual message buffers. Note: The first message buffer segment contains at least one individual message buffer. The individual message buffers in the second message buffer segment correspond to the message buffer control registers MBCCSRn, MBCCFRn, MBFIDRn, MBIDXRn with LAST_MB_SEG1 < n < 32. Note: If LAST_MB_SEG1 = 31 all individual message buffers belong to the first message buffer segment and the second message buffer segment is empty. 4–0 LAST_MB_UTIL Last Message Buffer Utilized — This field defines the message buffer number of last utilized individual message buffer. The message buffer search engine examines all individual message buffer with a message buffer number n <= LAST_MB_UTIL. Note: If LAST_MB_UTIL=LAST_MB_SEG1 all individual message buffers belong to the first message buffer segment and the second message buffer segment is empty. Module Base + 0x0014 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0000 EOC_AP ERC_AP BSY 0 0 0 POCCMDW WME WMC Reset 0000000000000000 Figure 13-10. Protocol Operation Control Register (POCR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 479 Write: Normal Mode The application uses this register to issue

• protocol control commands
• external clock correction commands Protocol control commands are issued by writing to the POCCMD field. For more information on protocol control commands, see Section 13.7.4, “Protocol Control Command Execution”. External clock correction commands are issued by writing to the EOC_AP and ERC_AP fields. For more information on external clock correction, refer to Section 13.6.11, “External Clock Synchronization”. Table 13-17. POCR Field Descriptions (Sheet 1 of 2) Field Description WME Write Mode External Correction — This bit controls the write mode of the EOC_AP and ERC_AP fields. 0 Write to EOC_AP and ERC_AP fields on register write. 1 No write to EOC_AP and ERC_AP fields on register write. 11–10 EOC_AP External Offset Correction Application — This field is used to trigger the application of the external offset correction value defined in the Protocol Configuration Register 29 (PCR29). 00 do not apply external offset correction value 01 reserved 10 subtract external offset correction value 11 add external offset correction value 9–8 ERC_AP External Rate Correction Application— This field is used to trigger application of the external rate correction value defined in the Protocol Configuration Register 21 (PCR21) 00 do not apply external rate correction value 01 reserved 10 subtract external rate correction value 11 add external rate correction value

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

480 Freescale Semiconductor

13.5.2.11 Global Interrupt Flag and Enable Register (GIFER)

Protocol Control Command Write Busy — This status bit indicates the acceptance of the protocol control command issued by the application via the POCCMD field. The FlexRay block sets this status bit when the application has issued a protocol control command via the POCCMD field. The FlexRay block clears this status bit when protocol control command was accepted by the PE.When the application issues a protocol control command while the BSY bit is asserted, the FlexRay block ignores this command, sets the protocol command ignored error flag PCMI_EF in the CHI Error Flag Register (CHIERFR), and will not change the value of the POCCMD field. 0 Command write idle, command accepted and ready to receive new protocol command. 1 Command write busy, command not yet accepted, not ready to receive new protocol command. Write Mode Command — This bit controls the write mode of the POCCMD field. 0 Write to POCCMD field on register write. 1 Do not write to POCCMD field on register write. 3–0 POCCMD Protocol Control Command — The application writes to this field to issue a protocol control command to the PE. The FlexRay block sends the protocol command to the PE immediately. While the transfer is running, the BSY bit is set. 0000 ALLOW_COLDSTART — Immediately activate capability of node to cold start cluster.

0001 ALL_SLOTS — Delayed

(1) transition to the all slots transmission mode. 0010 CONFIG — Immediately transition to the POC:config state. 0011 FREEZE — Immediately transition to the POC:halt state. 0100 READY , CONFIG_COMPLETE — Immediately transition to the POC:ready state. 0101 RUN — Immediately transition to the POC:startup start state. 0110 DEFAULT_CONFIG — Immediately transition to the POC:default config state.

0111 HALT — Delayed transition to the POC:halt state

1000 WAKEUP — Immediately initiate the wakeup procedure. 1001 reserved 1010 reserved 1011 reserved

1100 RESET

(2) — Immediately reset the Protocol Engine. 1101 reserved 1110 reserved 1111 reserved 1. Delayed means on completion of current communication cycle. 2. Additional to FlexRay Communications System Protocol Specification, Version 2.1 Rev A After sending the RESET command, it is mandatory to execute the command sequence described in Section 13.7.5, “Protocol Reset Command” immediately, to reach the DEFAULT CONFIG state correctly. Module Base + 0x0016 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R MIF PRIF CHIF WUP IF FNEB IF FNEA IF RBIF TBIF MIE PRIE CHIE WUP IE FNEB IE FNEA IE RBIE TBIE W w1c w1c w1c Reset 0000000000000000 Figure 13-11. Global Interrupt Flag and Enable Register (GIFER) Table 13-17. POCR Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 481 Write: Normal Mode This register provides the means to control some of the interrupt request lines and provides the corresponding interrupt flags. The interrupt flags MIF, PRIF, CHIF, RBIF, and TBIF are the outcome of a binary OR of the related individual interrupt flags and interrupt enables. The generation scheme for these flags is depicted in Figure 13-144. For more details on interrupt generation, seeSection 13.6.19, “Interrupt Support. These flags are cleared automatically when all of the corresponding interrupt flags or interrupt enables in the related interrupt flag and enable registers are cleared by the application. Table 13-18. GIFER Field Descriptions (Sheet 1 of 2) Field Description MIF Module Interrupt Flag — This flag is set if at least one of the other interrupt flags is in this register is asserted and the related interrupt enable is asserted, too. The FlexRay block generates the module interrupt request if MIE is asserted.

0 No interrupt flag is asserted or no interrupt enable is set

1 At least one of the other interrupt flags in this register is asserted and the related interrupt bit is asserted, too PRIF Protocol Interrupt Flag — This flag is set if at least one of the individual protocol interrupt flags in the Protocol Interrupt Flag Register 0 (PIFR0) and Protocol Interrupt Flag Register 1 (PIFR1) is asserted and the related interrupt enable flag is asserted, too. The FlexRay block generates the combined protocol interrupt request if the PRIE flag is asserted. 0 All individual protocol interrupt flags are equal to 0 or no interrupt enable bit is set. 1 At least one of the individual protocol interrupt flags and the related interrupt enable is equal to 1. CHIF CHI Interrupt Flag— This flag is set if at least one of the individual CHI error flags in theCHI Error Flag Register (CHIERFR) is asserted and the chi error interrupt enable GIFER.CHIE is asserted. The FlexRay block generates the combined CHI error interrupt if the CHIE flag is asserted, too.

0 All CHI error flags are equal to 0 or the chi error interrupt is disabled

1 At least one CHI error flag is asserted and chi error interrupt is enabled

Wakeup Interrupt Flag — This flag is set when the FlexRay block has received a wakeup symbol on the FlexRay bus. The application can determine on which channel the wakeup symbol was received by reading the related wakeup flags WUB and WUA in the Protocol Status Register 3 (PSR3). The FlexRay block generates the wakeup interrupt request if the WUPIE flag is asserted.

0 No wakeup condition or interrupt disabled

1 Wakeup symbol received on FlexRay bus and interrupt enabled

Receive FIFO channel B Not Empty Interrupt Flag— This flag is set when the receive FIFO for channel B is not empty. If the application writes 1 to this bit, the FlexRay block updates the FIFO status, increments or wraps the FIFO read index in the Receive FIFO B Read Index Register (RFBRIR) and clears the interrupt flag if the FIFO B is now empty. If the FIFO is still not empty, the FlexRay block sets this flag again. The FlexRay block generates the Receive FIFO B Not empty interrupt if the FNEBIE flag is asserted.

0 Receive FIFO B is empty or interrupt is disabled

1 Receive FIFO B is not empty and interrupt enabled

Receive FIFO channel A Not Empty Interrupt Flag— This flag is set when the receive FIFO for channel A is not empty. If the application writes 1 to this bit, the FlexRay block updates the FIFO status, increments or wraps the FIFO read index in the Receive FIFO A Read Index Register (RFARIR) and clears the interrupt flag if the FIFO A is now empty. If the FIFO is still not empty, the FlexRay block sets this flag again. The FlexRay block generates the Receive FIFO A Not empty interrupt if the FNEAIE flag is asserted.

0 Receive FIFO A is empty or interrupt is disabled

1 Receive FIFO A is not empty and interrupt enabled

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

482 Freescale Semiconductor

Receive Message Buffer Interrupt Flag — This flag is set if for at least one of the individual receive message buffers (MBCCSn.MTD = 0) both the interrupt flag MBIF and the interrupt enable bit MBIE in the corresponding Message Buffer Configuration, Control, Status Registers (MBCCSRn) are asserted. The application can not clear this RBIF flag directly. This flag is cleared by the FlexRay block when all of the interrupt flags MBIF of the individual receive message buffers are cleared by the application or if the application has cleared the interrupt enables bit MBIE. 0 None of the individual receive message buffers has the MBIF and MBIE flag asserted. 1 At least one individual receive message buffer has the MBIF and MBIE flag asserted. TBIF Transmit Buffer Interrupt Flag — This flag is set if for at least one of the individual single or double transmit message buffers (MBCCSn.MTD = 0) both the interrupt flag MBIF and the interrupt enable bit MBIE in the corresponding Message Buffer Configuration, Control, Status Registers (MBCCSRn) are equal to 1. The application can not clear this TBIF flag directly. This flag is cleared by the FlexRay block when either all of the individual interrupt flags MBIF of the individual transmit message buffers are cleared by the application or the host has cleared the interrupt enables bit MBIE. 0 None of the individual transmit message buffers has the MBIF and MBIE flag asserted. 1 At least one individual transmit message buffer has the MBIF and MBIE flag asserted. MIE Module Interrupt Enable — This flag controls if the module interrupt line is asserted when the MIF flag is set.

0 Disable interrupt line

1 Enable interrupt line

Protocol Interrupt Enable— This flag controls if the protocol interrupt line is asserted when the PRIF flag is set. CHI Interrupt Enable — This flag controls if the CHI interrupt line is asserted when the CHIF flag is set. Wakeup Interrupt Enable — This flag controls if the wakeup interrupt line is asserted when the WUPIF flag is set. Receive FIFO channel B Not Empty Interrupt Enable— This flag controls if the receive FIFO B interrupt line is asserted when the FNEBIF flag is set. Receive FIFO channel A Not Empty Interrupt Enable— This flag controls if the receive FIFO A interrupt line is asserted when the FNEAIF flag is set. Receive Buffer Interrupt Enable — This flag controls if the receive buffer interrupt line is asserted when the RBIF flag is set. Transmit Interrupt Enable — This flag controls if the transmit buffer interrupt line is asserted when the TBIF flag is set. Table 13-18. GIFER Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 483

13.5.2.12 Protocol Interrupt Flag Register 0 (PIFR0)

Write: Normal Mode The register holds one set of the protocol-related individual interrupt flags. Module Base + 0x0018 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 RF A T L _IF INTL _IF ILCF _IF CSA _IF MRC _IF MOC _IF CCL _IF MXS _IF MTX _IF LTXB _IF LTXA _IF TBVB _IF TBVA _IF TI2 _IF TI1 _IF CYS _IF W w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c Reset 0000000000000000 Figure 13-12. Protocol Interrupt Flag Register 0 (PIFR0) Table 13-19. PIFR0 Field Descriptions (Sheet 1 of 2) Field Description FATL_IF Fatal Protocol Error Interrupt Flag — This flag is set when the protocol engine has detected a fatal protocol error. In this case, the protocol engine goes into the POC:halt state immediately. The fatal protocol errors are: 1) pLatestTx violation, as described in the MAC process of the FlexRay protocol 2) transmission across slot boundary violation, as described in the FSP process of the FlexRay protocol 0 No such event. 1 Fatal protocol error detected. INTL_IF Internal Protocol Error Interrupt Flag — This flag is set when the protocol engine has detected an internal protocol error. In this case, the protocol engine goes into the POC:halt state immediately. An internal protocol error occurs when the protocol engine has not finished a calculation and a new calculation is requested. This can be caused by a hardware error. 0 No such event. 1 Internal protocol error detected. ILCF_IF Illegal Protocol Configuration Interrupt Flag — This flag is set when the protocol engine has detected an illegal protocol configuration parameter setting. In this case, the protocol engine goes into the POC:halt state immediately. The protocol engine checks the listen_timeout value programmed into the Protocol Configuration Register 14 (PCR14) and Protocol Configuration Register 15 (PCR15)when the CONFIG_COMPLETE command was sent by the application via the Protocol Operation Control Register (POCR). If the value of listen_timeout is equal to zero, the protocol configuration setting is considered as illegal. 0 No such event. 1 Illegal protocol configuration detected. CSA_IF Cold Start Abort Interrupt Flag — This flag is set when the configured number of allowed cold start attempts is reached and none of these attempts was successful. The number of allowed cold start attempts is configured by the coldstart_attempts field in the Protocol Configuration Register 3 (PCR3). 0 No such event. 1 Cold start aborted and no more coldstart attempts allowed. MRC_IF Missing Rate Correction Interrupt Flag — This flag is set when an insufficient number of measurements is available for rate correction at the end of the communication cycle.

0 No such event

1 Insufficient number of measurements for rate correction detected

MOC_IF Missing Offset Correction Interrupt Flag — This flag is set when an insufficient number of measurements is available for offset correction. This is related to the MISSING_TERM event in the CSP process for offset correction in the FlexRay protocol. 0 No such event. 1 Insufficient number of measurements for offset correction detected.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

484 Freescale Semiconductor

CCL_IF Clock Correction Limit Reached Interrupt Flag — This flag is set when the internal calculated offset or rate calculation values have reached or exceeded its configured thresholds as given by the offset_coorection_out field in the Protocol Configuration Register 9 (PCR9) and the rate_correction_out field in the Protocol Configuration Register 14 (PCR14). 0 No such event. 1 Offset or rate correction limit reached. MXS_IF Max Sync Frames Detected Interrupt Flag — This flag is set when the number of synchronization frames detected in the current communication cycle exceeds the value of the node_sync_max field in the Protocol Configuration Register 30 (PCR30). 0 No such event. 1 More than node_sync_max sync frames detected. Note: Only synchronization frames that have passed the synchronization frame acceptance and rejection filters are taken into account. MTX_IF Media Access Test Symbol Received Interrupt Flag — This flag is set when the MTS symbol was received on channel A or channel B. 0 No such event. 1 MTS symbol received. LTXB_IF pLatestTx Violation on Channel B Interrupt Flag— This flag is set when the frame transmission on channel B in the dynamic segment exceeds the dynamic segment boundary. This is related to thepLatestTx violation, as described in the MAC process of the FlexRay protocol. 0 No such event. 1 pLatestTx violation occurred on channel B. LTXA_IF pLatestTx Violation on Channel A Interrupt Flag— This flag is set when the frame transmission on channel A in the dynamic segment exceeds the dynamic segment boundary. This is related to the pLatestTx violation as described in the MAC process of the FlexRay protocol. 0 No such event. 1 pLatestTx violation occurred on channel A. TBVB_IF Transmission across boundary on channel B Interrupt Flag— This flag is set when the frame transmission on channel B crosses the slot boundary. This is related to the transmission across slot boundary violation as described in the FSP process of the FlexRay protocol. 0 No such event. 1 Transmission across boundary violation occurred on channel B. TBVA_IF Transmission across boundary on channel A Interrupt Flag— This flag is set when the frame transmission on channel A crosses the slot boundary. This is related to the transmission across slot boundary violation as described in the FSP process of the FlexRay protocol. 0 No such event. 1 Transmission across boundary violation occurred on channel A. TI2_IF Timer 2 Expired Interrupt Flag — This flag is set whenever timer 2 expires. 0 No such event. 1 Timer 2 has reached its time limit. TI1_IF Timer 1 Expired Interrupt Flag — This flag is set whenever timer 1 expires.

1 Timer 1 has reached its time limit

CYS_IF Cycle Start Interrupt Flag — This flag is set when a communication cycle starts. 1 Communication cycle started. Table 13-19. PIFR0 Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 485

13.5.2.13 Protocol Interrupt Flag Register 1 (PIFR1)

Write: Normal Mode The register holds one set of the protocol-related individual interrupt flags. Module Base + 0x001A 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R EMC _IF IPC _IF PECF _IF PSC _IF SSI3 _IF SSI2 _IF SSI1 _IF SSI0 _IF 00 EVT _IF ODT _IF 0000 W w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c Reset 0000000000000000 Figure 13-13. Protocol Interrupt Flag Register 1 (PIFR1) Table 13-20. PIFR1 Field Descriptions Field Description EMC_IF Error Mode Changed Interrupt Flag— This flag is set when the value of the ERRMODE bit field in theProtocol Status Register 0 (PSR0) is changed by the FlexRay block. 0 No such event. 1 ERRMODE field changed. IPC_IF Illegal Protocol Control Command Interrupt Flag — This flag is set when the PE tries to execute a protocol control command, which was issued via the POCCMD field of theProtocol Operation Control Register (POCR), and detects that this protocol control command is not allowed in the current protocol state. In this case the command is not executed. For more details, see Section 13.7.4, “Protocol Control Command Execution”. 0 No such event. 1 Illegal protocol control command detected. PECF_IF Protocol Engine Communication Failure Interrupt Flag — This flag is set if the FlexRay block has detected a communication failure between the protocol engine and the controller host interface 0 No such event. 1 Protocol Engine Communication Failure detected. PSC_IF Protocol State Changed Interrupt Flag — This flag is set when the protocol state in the PROTSTATE field in the Protocol Status Register 0 (PSR0) has changed. 0 No such event. 1 Protocol state changed. 11–8 SSI[3:0]_IF Slot Status Counter Incremented Interrupt Flag — Each of these flags is set when the SLOTSTATUSCNT field in the corresponding Slot Status Counter Registers (SSCR0–SSCR3) is incremented. 0 No such event. 1 The corresponding slot status counter has incremented. EVT_IF Even Cycle Table Written Interrupt Flag — This flag is set if the FlexRay block has written the sync frame measurement / ID tables into the FlexRay Memory for the even cycle. 0 No such event.

1 Sync frame measurement table written

ODT_IF Odd Cycle Table Written Interrupt Flag — This flag is set if the FlexRay block has written the sync frame measurement / ID tables into the FlexRay Memory for the odd cycle. 0 No such event.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

486 Freescale Semiconductor

13.5.2.14 Protocol Interrupt Enable Register 0 (PIER0)

Write: Anytime This register defines whether or not the individual interrupt flags defined in the Protocol Interrupt Flag Register 0 (PIFR0) can generate a protocol interrupt request. Module Base + 0x001C 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R FATL _IE INTL _IE ILCF _IE CSA _IE MRC _IE MOC _IE CCL _IE MXS _IE MTX _IE LTXB _IE LTXA _IE TBVB _IE TBVA _IE TI2 _IE TI1 _IE CYS _IEW Reset 0000000000000000 Figure 13-14. Protocol Interrupt Enable Register 0 (PIER0) Table 13-21. PIER0 Field Descriptions Field Description FATL_IE Fatal Protocol Error Interrupt Enable — This bit controls FATL_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled INTL_IE Internal Protocol Error Interrupt Enable — This bit controls INTL_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled ILCF_IE Illegal Protocol Configuration Interrupt Enable — This bit controls ILCF_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled CSA_IE Cold Start Abort Interrupt Enable — This bit controls CSA_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled MRC_IE Missing Rate Correction Interrupt Enable — This bit controls MRC_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled MOC_IE Missing Offset Correction Interrupt Enable — This bit controls MOC_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled CCL_IE Clock Correction Limit Reached Interrupt Enable — This bit controls CCL_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled MXS_IE Max Sync Frames Detected Interrupt Enable — This bit controls MXS_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled MTX_IE Media Access Test Symbol Received Interrupt Enable — This bit controls MTX_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled LTXB_IE pLatestTx Violation on Channel B Interrupt Enable— This bit controls LTXB_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled LTXA_IE pLatestTx Violation on Channel A Interrupt Enable— This bit controls LTXA_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 487

13.5.2.15 Protocol Interrupt Enable Register 1 (PIER1)

Write: Anytime This register defines whether or not the individual interrupt flags defined in Protocol Interrupt Flag Register 1 (PIFR1) can generate a protocol interrupt request. TBVB_IE Transmission across boundary on channel B Interrupt Enable — This bit controls TBVB_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled TBVA_IE Transmission across boundary on channel A Interrupt Enable— This bit controls TBVA_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled TI2_IE Timer 2 Expired Interrupt Enable — This bit controls TI1_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled TI1_IE Timer 1 Expired Interrupt Enable — This bit controls TI1_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled CYS_IE Cycle Start Interrupt Enable — This bit controls CYC_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled Module Base + 0x001E 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R EMC _IE IPC _IE PECF _IE PSC _IE SSI3 _IE SSI2 _IE SSI1 _IE SSI0 _IE

00 EVT

_IE ODT _IE 0000 W Reset 0000000000000000 Figure 13-15. Protocol Interrupt Enable Register 1 (PIER1) Table 13-22. PIER1 Field Descriptions Field Description EMC_IE Error Mode Changed Interrupt Enable — This bit controls EMC_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled IPC_IE Illegal Protocol Control Command Interrupt Enable — This bit controls IPC_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled PECF_IE Protocol Engine Communication Failure Interrupt Enable — This bit controls PECF_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled PSC_IE Protocol State Changed Interrupt Enable — This bit controls PSC_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled Table 13-21. PIER0 Field Descriptions (continued) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

488 Freescale Semiconductor

13.5.2.16 CHI Error Flag Register (CHIERFR)

Write: Normal Mode This register holds the CHI related error flags. The interrupt generation for each of these error flags is controlled by the CHI interrupt enable bit CHIE in theGlobal Interrupt Flag and Enable Register (GIFER). 11–8 SSI[3:0]_IE Slot Status Counter Incremented Interrupt Enable — This bit controls SSI[3:0]_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled EVT_IE Even Cycle Table Written Interrupt Enable — This bit controls EVT_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled ODT_IE Odd Cycle Table Written Interrupt Enable — This bit controls ODT_IF interrupt request generation. 0 interrupt request generation disabled 1 interrupt request generation enabled Module Base + 0x0020 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R FRLB _EF FRLA _EF PCMI _EF FOVB _EF FOVA _EF MBS _EF MBU _EF LCK _EF DBL _EF SBCF _EF FID _EF DPL _EF SPL _EF NML _EF NMF _EF ILSA _EF W w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c Reset 0000000000000000 Figure 13-16. CHI Error Flag Register (CHIERFR) Table 13-23. CHIERFR Field Descriptions (Sheet 1 of 3) Field Description FRLB_EF Frame Lost Channel B Error Flag— This flag is set if a complete frame was received on channel B but could not be stored in the selected individual message buffer because this message buffer is currently locked by the application. In this case, the frame and the related slot status information are lost.

1 Frame lost on channel B detected

FRLA_EF Frame Lost Channel A Error Flag— This flag is set if a complete frame was received on channel A but could not be stored in the selected individual message buffer because this message buffer is currently locked by the application. In this case, the frame and the related slot status information are lost.

0 No such error

1 Frame lost on channel A detected

PCMI_EF Protocol Command Ignored Error Flag — This flag is set if the application has issued a POC command by writing to the POCCMD field in the Protocol Operation Control Register (POCR) while the BSY flag is equal to 1. In this case the command is ignored by the FlexRay block and is lost.

1 POC command ignored

Table 13-22. PIER1 Field Descriptions (continued) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 489 FOVB_EF Receive FIFO Overrun Channel B Error Flag — This flag is set when an overrun of the Receive FIFO for channel B occurred. This error occurs if a semantically valid frame was received on channel B and matches the all criteria to be appended to the FIFO for channel B but the FIFO is full. In this case, the received frame and its related slot status information is lost.

1 Receive FIFO overrun on channel B has been detected

FOVA_EF Receive FIFO Overrun Channel A Error Flag — This flag is set when an overrun of the Receive FIFO for channel A occurred. This error occurs if a semantically valid frame was received on channel A and matches the all criteria to be appended to the FIFO for channel A but the FIFO is full. In this case, the received frame and its related slot status information is lost. MSB_EF Message Buffer Search Error Flag— This flag is set if the message buffer search engine is still running while the next search cycle must be started due to the FlexRay protocol timing. In this case, not all message buffers are considered while searching.

1 Search engine active while search start appears

MBU_EF Message Buffer Utilization Error Flag — This flag is asserted if the application writes to a message buffer control field that is beyond the number of utilized message buffers programmed in the Message Buffer Segment Size and Utilization Register (MBSSUTR). If the application writes to a MBCCSRn register with n > LAST_MB_UTIL, the FlexRay block ignores the write attempt and asserts the message buffer utilization error flag MBU_EF in theCHI Error Flag Register (CHIERFR).

1 Non-utilized message buffer enabled

LCK_EF Lock Error Flag — This flag is set if the application tries to lock a message buffer that is already locked by the FlexRay block due to internal operations. In that case, the FlexRay block does not grant the lock to the application. The application must issue the lock request again.

1 Lock error detected

DBL_EF Double Transmit Message Buffer Lock Error Flag— This flag is set if the application tries to lock the transmit side of a double transmit message buffer. In this case, the FlexRay block does not grant the lock to the transmit side of a double transmit message buffer.

1 Double transmit buffer lock error occurred

SBCF_EF System Bus Communication Failure Error Flag— This flag is set if the FlexRay block was not able to transmit or receive data via the system bus in time. In the case of writing, data is lost; in the case of reading, the transmission onto the FlexRay bus is stopped for the current slot and resumed in the next slot.

1 System bus communication failure occurred

FID_EF Frame ID Error Flag— This flag is set if the frame ID stored in the message buffer header area differs from the frame ID stored in the message buffer control register.

0 No such error occurred

1 Frame ID error occurred

DPL_EF Dynamic Payload Length Error Flag — This flag is set if the payload length written into the message buffer header field of a single or double transmit message buffer assigned to the dynamic segment is greater than the maximum payload length for the dynamic segment as it is configured in the corresponding protocol configuration register field max_payload_length_dynamic in the Protocol Configuration Register 24 (PCR24).

1 Dynamic payload length error occurred

Table 13-23. CHIERFR Field Descriptions (Sheet 2 of 3) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

490 Freescale Semiconductor

13.5.2.17 Message Buffer Interrupt Vector Register (MBIVEC)

This register indicates the lowest numbered receive message buffer and the lowest numbered transmit message buffer that have their interrupt status flag MBIF and interrupt enable MBIE bits asserted. This means that message buffers with lower message buffer numbers have higher priority. SPL_EF Static Payload Length ErrorFlag — This flag is set if the payload length written into the message buffer header field of a single or double transmit message buffer assigned to the static segment is different from the payload length for the static segment as it is configured in the corresponding protocol configuration register field payload_length_static in the Protocol Configuration Register 19 (PCR19).

1 Static payload length error occurred

NML_EF Network Management Length Error Flag — This flag is set if the payload length written into the header structure of a receive message buffer assigned to the static segment is less than the configured length of the Network Management Vector as configured in the Network Management Vector Length Register (NMVLR). In this case the received part of the Network Management Vector will be used to update the Network Management Vector.

1 Network management length error occurred

NMF_EF Network Management Frame Error Flag— This flag is set if a received message in the static segment with a Preamble Indicator flag PP asserted has its Null Frame indicator flag NF asserted as well. In this case, the Global Network Management Registers (see Network Management Vector Registers (NMVR0–NMVR5)) are not updated.

1 Network management frame error occurred

ILSA_EF Illegal System Memory Access Error Flag — This flag is set if the external system memory subsystem has detected and indicated an illegal system memory access from the FlexRay block. The exact meaning of an illegal system memory access is defined by the current implementation of the memory subsystem. 0 No such event. 1 Illegal system memory access occurred. Module Base + 0x0022 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0 0 0 TBIVEC 0 0 0 RBIVEC W Reset 0000000000000000 Figure 13-17. Message Buffer Interrupt Vector Register (MBIVEC) Table 13-24. MBIVEC Field Descriptions Field Description 12–8 TBIVEC Transmit Buffer Interrupt Vector — This field provides the number of the lowest numbered enabled transmit message buffer that has its interrupt status flag MBIF and its interrupt enable bit MBIE set. If there is no transmit message buffer with the interrupt status flag MBIF and the interrupt enable MBIE bits asserted, the value in this field is set to 0. 4–0 RBIVEC Receive Buffer Interrupt Vector — This field provides the message buffer number of the lowest numbered receive message buffer which has its interrupt flag MBIF and its interrupt enable bit MBIE asserted. If there is no receive message buffer with the interrupt status flag MBIF and the interrupt enable MBIE bits asserted, the value in this field is set to 0. Table 13-23. CHIERFR Field Descriptions (Sheet 3 of 3) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 491

13.5.2.18 Channel A Status Error Counter Register (CASERCR)

This register provides the channel status error counter for channel A. The protocol engine generates a slot status vector for each static slot, each dynamic slot, the symbol window, and the NIT. The slot status vector contains the four protocol related error indicator bitsvSS!SyntaxError, vSS!ContentError, vSS!BViolation, and vSS!TxConflict. The FlexRay block increments the status error counter by 1 if, for a slot or segment, at least one error indicator bit is set to 1. The counter wraps around after it has reached the maximum value. For more information on slot status monitoring, see Section 13.6.18, “Slot Status Monitoring”.

13.5.2.19 Channel B Status Error Counter Register (CBSERCR)

This register provides the channel status error counter for channel B. The protocol engine generates a slot status vector for each static slot, each dynamic slot, the symbol window, and the NIT. The slot status vector contains the four protocol related error indicator bitsvSS!SyntaxError, vSS!ContentError, vSS!BViolation, and vSS!TxConflict. The FlexRay block increments the status error counter by 1 if, for a slot or segment, at least one error indicator bit is set to 1. The counter wraps around after it has reached the maximum value. For more information on slot status monitoring see Section 13.6.18, “Slot Status Monitoring”. Module Base + 0x0024 Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R STATUS_ERR_CNT W Reset 0000000000000000 Figure 13-18. Channel A Status Error Counter Register (CASERCR) Table 13-25. CASERCR Field Descriptions Field Description 15–0 STATUS_ERR_CNT Channel Status Error Counter— This field provides the current value channel status error counter. The counter value is updated within the first macrotick of the following slot or segment. Module Base + 0x0026 Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R STATUS_ERR_CNT W Reset 0000000000000000 Figure 13-19. Channel B Status Error Counter Register (CBSERCR) Table 13-26. CBSERCR Field Descriptions Field Description 15–0 STATUS_ERR_CNT Channel Status Error Counter— This field provides the current channel status error count. The counter value is updated within the first macrotick of the following slot or segment.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

492 Freescale Semiconductor

13.5.2.20 Protocol Status Register 0 (PSR0)

This register provides information about the current protocol status. Module Base + 0x0028 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R ERRMODE SLOTMODE 0 PROTSTATE STARTUPSTATE 0 WAKEUPSTATUS W Reset 0000000000000000 Figure 13-20. Protocol Status Register 0 (PSR0) Table 13-27. PSR0 Field Descriptions (Sheet 1 of 2) Field Description 15–14 ERRMODE Error Mode — protocol related variable: vPOC!ErrorMode. This field indicates the error mode of the protocol.

00 ACTIVE

01 PASSIVE

10 COMM_HALT

13–12 SLOTMODE Slot Mode — protocol related variable: vPOC!SlotMode. This field indicates the slot mode of the protocol.

00 SINGLE

01 ALL_PENDING

10 ALL

10–8 PROTSTATE Protocol State — protocol related variable: vPOC!State. This field indicates the state of the protocol.

000 POC:default config

001 POC:config

010 POC:wakeup

011 POC:ready

100 POC:normal passive

101 POC:normal active

110 POC:halt

111 POC:startup

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 493

13.5.2.21 Protocol Status Register 1 (PSR1)

Write: Normal Mode 7–4 STARTUP STATE Startup State — protocol related variable: vPOC!StartupState. This field indicates the current sub-state of the startup procedure. 0000 reserved 0001 reserved

0010 POC:coldstart collision resolution

0011 POC:coldstart listen

0100 POC:integration consistency check

0101 POC:integrationi listen

0111 POC:initialize schedule

1010 POC:coldstart consistency check

1101 POC:integration coldstart check

1110 POC:coldstart gap

1111 POC:coldstart join

2–0 WAKEUP STATUS Wakeup Status — protocol related variable: vPOC!WakeupStatus. This field provides the outcome of the execution of the wakeup mechanism.

000 UNDEFINED

001 RECEIVED_HEADER

010 RECEIVED_WUP

011 COLLISION_HEADER

100 COLLISION_WUP

101 COLLISION_UNKNOWN

110 TRANSMITTED

Module Base + 0x002A Additional Reset: CSAA, CSP , CPN: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R CSAA CSP 0 REMCSAT CPN HHR FRZ APTAC W w1c Reset 0000000000000000 Figure 13-21. Protocol Status Register 1 (PSR1) Table 13-27. PSR0 Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

494 Freescale Semiconductor

13.5.2.22 Protocol Status Register 2 (PSR2)

This register provides a snapshot of status information about the Network Idle Time NIT, the Symbol Window and the clock synchronization. The NIT related status bits NBVB, NSEB, NBV A, and NSEA are updated by the FlexRay block after the end of the NIT and before the end of the first slot of the next communication cycle. The Symbol Window related status bits STCB, SBVB, SSEB, MTB, STCA, SBV A, Table 13-28. PSR1 Field Descriptions Field Description CSAA Cold Start Attempt Aborted Flag — protocol related event: ‘set coldstart abort indicator in CHI’ This flag is set when the FlexRay block has aborted a cold start attempt.

1 Cold start attempt aborted

Leading Cold Start Path — This status bit is set when the FlexRay block has reached the POC:normal active state via the leading cold start path. This indicates that this node has started the network

1 POC:normal active reached from POC:startup state via leading cold start path

12–8 REMCSAT Remaining Coldstart Attempts — protocol related variable: vRemainingColdstartAttempts This field provides the number of remaining cold start attempts that the FlexRay block will execute. CPN Leading Cold Start Path Noise — protocol related variable: vPOC!ColdstartNoise This status bit is set if the FlexRay block has reached thePOC:normal active state via the leading cold start path under noise conditions. This indicates there was some activity on the FlexRay bus while the FlexRay block was starting up the cluster.

1 POC:normal active state was reached from POC:startup state via noisy leading cold start path

Host Halt Request Pending — protocol related variable: vPOC!CHIHaltRequest This status bit is set when FlexRay block receives the HALT command from the application via theProtocol Operation Control Register (POCR). The FlexRay block clears this status bit after a hard reset condition or when the protocol is in the POC:default config state.

1 HALT command received

Freeze Occurred — protocol related variable: vPOC!Freeze This status bit is set when the FlexRay block has reached thePOC:halt state due to the host FREEZE command or due to an internal error condition requiring immediate halt. The FlexRay block clears this status bit after a hard reset condition or when the protocol is in the POC:default config state.

1 Immediate halt due to FREEZE or internal error condition

4–0 APTAC Allow Passive to Active Counter — protocol related variable: vPOC!vAllowPassivetoActive This field provides the number of consecutive even/odd communication cycle pairs that have passed with valid rate and offset correction terms, but the protocol is still in the POC:normal passive state due to an application configured delay to enter POC:normal active state. This delay is defined by the allow_passive_to_active field in the Protocol Configuration Register 12 (PCR12). Module Base + 0x002C Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R NBVB NSEB STCB SBVB SSEB MTB NBVA NSEA STCA SBVA SSEA MTA CLKCORRFAILCNT W Reset 0000000000000000 Figure 13-22. Protocol Status Register 2 (PSR2)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 495 SSEB, and MTA are updated by the FlexRay block after the end of the symbol window and before the end of the current communication cycle. If no symbol window is configured, the symbol window related status bits remain in their reset state. The clock synchronization related CLKCORRFAILCNT is updated by the FlexRay block after the end of the static segment and before the end of the current communication cycle. Table 13-29. PSR2 Field Descriptions (Sheet 1 of 2) Field Description NBVB NIT Boundary Violation on Channel B — protocol related variable: vSS!BViolation for NIT on channel B This status bit is set when there was some media activity on the FlexRay bus channel B at the end of the NIT.

1 Media activity at boundaries detected

NIT Syntax Error on Channel B — protocol related variable: vSS!SyntaxError for NIT on channel B This status bit is set when a syntax error was detected during NIT on channel B.

1 Syntax error detected

Symbol Window Transmit Conflict on Channel B — protocol related variable: vSS!TxConflict for symbol window on channel B This status bit is set if there was a transmission conflict during the symbol window on channel B.

1 Transmission conflict detected

Symbol Window Boundary Violation on Channel B — protocol related variable: vSS!BViolation for symbol window on channel B This status bit is set if there was some media activity on the FlexRay bus channel B at the start or at the end of the symbol window. Symbol Window Syntax Error on Channel B— protocol related variable: vSS!SyntaxError for symbol window on channel B This status bit is set when a syntax error was detected during the symbol window on channel B. Media Access Test Symbol MTS Received on Channel B — protocol related variable: vSS!ValidMTS for Symbol Window on channel B This status bit is set if the Media Access Test Symbol MTS was received in the symbol window on channel B.

1 MTS symbol received

NIT Boundary Violation on Channel A — protocol related variable: vSS!BViolation for NIT on channel A This status bit is set when there was some media activity on the FlexRay bus channel A at the end of the NIT. NIT Syntax Error on Channel A — protocol related variable: vSS!SyntaxError for NIT on channel A This status bit is set when a syntax error was detected during NIT on channel A. Symbol Window Transmit Conflict on Channel A — protocol related variable: vSS!TxConflict for symbol window on channel A This status bit is set if there was a transmission conflicts during the symbol window on channel A.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

496 Freescale Semiconductor

13.5.2.23 Protocol Status Register 3 (PSR3)

Write: Normal Mode This register provides aggregated channel status information as an accrued status of channel activity for all communication slots, regardless of whether they are assigned for transmission or subscribed for reception. It provides accrued information for the symbol window, the NIT, and the wakeup status. SBVA Symbol Window Boundary Violation on Channel A — protocol related variable: vSS!BViolation for symbol window on channel A This status bit is set if there was some media activity on the FlexRay bus channel A at the start or at the end of the symbol window. Symbol Window Syntax Error on Channel A— protocol related variable: vSS!SyntaxError for symbol window on channel A This status bit is set when a syntax error was detected during the symbol window on channel A. Media Access Test Symbol MTS Received on Channel A — protocol related variable: vSS!ValidMTS for symbol window on channel A This status bit is set if the Media Access Test Symbol MTS was received in the symbol window on channel A. 3–0 CLKCORR- FAILCNT Clock Correction Failed Counter — protocol related variable: vClockCorrectionFailed This field provides the number of consecutive even/odd communication cycle pairs that have passed without clock synchronization having performed an offset or a rate correction due to lack of synchronization frames. It is not incremented when it has reached the configured value of either max_without_clock_correction_fatal or max_without_clock_correction_passive as defined in the Protocol Configuration Register 8 (PCR8). The FlexRay block resets this counter on a hard reset condition, when the protocol enters the POC:normal active state, or when both the rate and offset correction terms have been calculated successfully. Module Base + 0x002E Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0 0 WUB ABVB AACB ACEB ASEB AVFB 0 0 WUA ABVA AACA ACEA ASEA AVFA W w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c w1c Reset 0000000000000000 Figure 13-23. Protocol Status Register 3 (PSR3) Table 13-29. PSR2 Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 497 Table 13-30. PSR3 Field Descriptions (Sheet 1 of 2) Field Description WUB Wakeup Symbol Received on Channel B — This flag is set when a wakeup symbol was received on channel B.

0 No wakeup symbol received

1 Wakeup symbol received

Aggregated Boundary Violation on Channel B — This flag is set when a boundary violation has been detected on channel B. Boundary violations are detected in the communication slots, the symbol window, and the NIT.

0 No boundary violation detected

1 Boundary violation detected

Aggregated Additional Communication on Channel B — This flag is set when at least one valid frame was received on channel B in a slot that also contained an additional communication with either syntax error, content error, or boundary violations.

0 No additional communication detected

1 Additional communication detected

Aggregated Content Error on Channel B — This flag is set when a content error has been detected on channel B. Content errors are detected in the communication slots, the symbol window, and the NIT.

0 No content error detected

1 Content error detected

Aggregated Syntax Error on Channel B — This flag is set when a syntax error has been detected on channel B. Syntax errors are detected in the communication slots, the symbol window and the NIT.

0 No syntax error detected

1 Syntax errors detected

Aggregated Valid Frame on Channel B — This flag is set when a syntactically correct valid frame has been received in any static or dynamic slot through channel B.

1 At least one syntactically valid frame received

0 No syntactically valid frames received

Wakeup Symbol Received on Channel A — This flag is set when a wakeup symbol was received on channel A. Aggregated Boundary Violation on Channel A — This flag is set when a boundary violation has been detected on channel A. Boundary violations are detected in the communication slots, the symbol window, and the NIT. Aggregated Additional Communication on Channel A— This flag is set when a valid frame was received in a slot on channel A that also contained an additional communication with either syntax error, content error, or boundary violations. Aggregated Content Error on Channel A — This flag is set when a content error has been detected on channel A. Content errors are detected in the communication slots, the symbol window, and the NIT.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

498 Freescale Semiconductor

13.5.2.24 Macrotick Counter Register (MTCTR)

This register provides the macrotick count of the current communication cycle.

13.5.2.25 Cycle Counter Register (CYCTR)

This register provides the number of the current communication cycle. ASEA Aggregated Syntax Error on Channel A— This flag is set when a syntax error has been detected on channel A. Syntax errors are detected in the communication slots, the symbol window, and the NIT. Aggregated Valid Frame on Channel A — This flag is set when a syntactically correct valid frame has been received in any static or dynamic slot through channel A. 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0 0 MTCT W Reset 0000000000000000 Figure 13-24. Macrotick Counter Register (MTCTR) Table 13-31. MTCTR Field Descriptions Field Description 13–0 MTCT Macrotick Counter — protocol related variable: vMacrotick This field provides the macrotick count of the current communication cycle. Module Base + 0x0032 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0000000000 CYCCNT W Reset 0000000000000000 Figure 13-25. Cycle Counter Register (CYCTR) Table 13-32. CYCTR Field Descriptions Field Description 5–0 CYCCNT Cycle Counter — protocol related variable: vCycleCounter This field provides the number of the current communication cycle. If the counter reaches the maximum value of 63, the counter wraps and starts from zero again. Table 13-30. PSR3 Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 499

13.5.2.26 Slot Counter Channel A Register (SLTCTAR)

This register provides the number of the current slot in the current communication cycle for channel A.

13.5.2.27 Slot Counter Channel B Register (SLTCTBR)

This register provides the number of the current slot in the current communication cycle for channel B.

13.5.2.28 Rate Correction Value Register (RTCORVR)

This register provides the sign extended rate correction value in microticks as it was calculated by the clock synchronization algorithm. The FlexRay block updates this register during the NIT of each odd numbered communication cycle. Module Base + 0x0034 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000 S L O TCNTA W Reset 0000000000000000 Figure 13-26. Slot Counter Channel A Register (SLTCTAR) Table 13-33. SLTCTAR Field Descriptions Field Description 10–0 SLOTCNTA Slot Counter Value for Channel A — protocol related variable: vSlotCounter for channel A This field provides the number of the current slot in the current communication cycle. Module Base + 0x0036 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000 S L O TCNTB W Reset 0000000000000000 Figure 13-27. Slot Counter Channel B Register (SLTCTBR) Table 13-34. SLTCTBR Field Descriptions Field Description 10–0 SLOTCNTA Slot Counter Value for Channel B — protocol related variable: vSlotCounter for channel B This field provides the number of the current slot in the current communication cycle. Module Base + 0x0038 Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R RATECORR W Reset 0000000000000000 Figure 13-28. Rate Correction Value Register (RTCORVR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

500 Freescale Semiconductor

13.5.2.29 Offset Correction Value Register (OFCORVR)

This register provides the sign extended offset correction value in microticks as it was calculated by the clock synchronization algorithm. The FlexRay block updates this register during the NIT.

13.5.2.30 Combined Interrupt Flag Register (CIFRR)

Table 13-35. RTCORVR Field Descriptions Field Description 15–0 RATECORR Rate Correction Value — protocol related variable: vRateCorrection (before value limitation and external rate correction) This field provides the sign extended rate correction value in microticks as it was calculated by the clock synchronization algorithm. The value is represented in 2’s complement format. This value does not include the value limitation and the application of the external rate correction. If the magnitude of the internally calculated rate correction value exceeds the limit given by rate_correction_out in the Protocol Configuration Register 13 (PCR13), the clock correction reached limit interrupt flag CCL_IF is set in theProtocol Interrupt Flag Register 0 (PIFR0). Note: If the FlexRay block was not able to calculate a new rate correction term due to a lack of synchronization frames, the RATECORR value is not updated. Module Base + 0x003A Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R OFFSETCORR W Reset 0000000000000000 Figure 13-29. Offset Correction Value Register (OFCORVR) Table 13-36. OFCORVR Field Descriptions Field Description 15–0 OFFSET - CORR Offset Correction Value — protocol related variable: vOffsetCorrection (before value limitation and external offset correction) This field provides the sign extended offset correction value in microticks as it was calculated by the clock synchronization algorithm. The value is represented in 2’s complement format. This value does not include the value limitation and the application of the external offset correction. If the magnitude of the internally calculated rate correction value exceeds the limit given by offset_correction_out field in theProtocol Configuration Register 29 (PCR29), the clock correction reached limit interrupt flag CCL_IF is set in theProtocol Interrupt Flag Register 0 (PIFR0). Note: If the FlexRay block was not able to calculate an new offset correction term due to a lack of synchronization frames, the OFFSETCORR value is not updated. Module Base + 0x003C 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000000 M I F PRIF CHIF WUP IF FNEB IF FNEA IF RBIF TBIF W Reset 0000000000000000 Figure 13-30. Combined Interrupt Flag Register (CIFRR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 501 This register provides five combined interrupt flags and a copy of three individual interrupt flags. The combined interrupt flags are the result of a binary OR of the values of other interrupt flags regardless of the state of the interrupt enable bits. The generation scheme for the combined interrupt flags is depicted in Figure 13-146. The individual interrupt flags WUPIF, FNEBIF, and FNEAIF are copies of corresponding flags in the Global Interrupt Flag and Enable Register (GIFER) and are provided here to simplify the application interrupt flag check. To clear the individual interrupt flags, the application must use theGlobal Interrupt Flag and Enable Register (GIFER). NOTE The meanings of the combined status bits MIF, PRIF, CHIF, RBIF, and TBIF are different from those mentioned in the Global Interrupt Flag and Enable Register (GIFER). Table 13-37. CIFRR Field Descriptions Field Description MIF Module Interrupt Flag — This flag is set if there is at least one interrupt source that has its interrupt flag asserted.

0 No interrupt source has its interrupt flag asserted

1 At least one interrupt source has its interrupt flag asserted

Protocol Interrupt Flag — This flag is set if at least one of the individual protocol interrupt flags in the Protocol Interrupt Flag Register 0 (PIFR0) or Protocol Interrupt Flag Register 1 (PIFR1) is equal to 1.

0 All individual protocol interrupt flags are equal to 0

1 At least one of the individual protocol interrupt flags is equal to 1

CHI Interrupt Flag— This flag is set if at least one of the individual CHI error flags in theCHI Error Flag Register (CHIERFR) is equal to 1.

0 All CHI error flags are equal to 0

1 At least one CHI error flag is equal to 1

Wakeup Interrupt Flag — Provides the same value as GIFER[WUPIF] FNEBIF Receive FIFO channel B Not Empty Interrupt Flag — Provides the same value as GIFER[FNEBI] FNEAIF Receive FIFO channel A Not Empty Interrupt Flag — Provides the same value as GIFER[FNEAIF] RBIF Receive Message Buffer Interrupt Flag — This flag is set if for at least one of the individual receive message buffers (MBCCSRn[MTD] = 0) the interrupt flag MBIF in the corresponding Message Buffer Configuration, Control, Status Registers (MBCCSRn) is equal to 1. 0 None of the individual receive message buffers has the MBIF flag asserted. 1 At least one individual receive message buffers has the MBIF flag asserted. TBIF Transmit Message Buffer Interrupt Flag— This flag is set if for at least one of the individual single or double transmit message buffers (MBCCSRn[MTD] = 1) the interrupt flag MBIF in the corresponding Message Buffer Configuration, Control, Status Registers (MBCCSRn) is equal to 1. 0 None of the individual transmit message buffers has the MBIF flag asserted. 1 At least one individual transmit message buffers has the MBIF flag asserted.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

502 Freescale Semiconductor

13.5.2.31 System Memory Access Time-Out Register (SYMATOR)

13.5.2.32 Sync Frame Counter Register (SFCNTR)

This register provides the number of synchronization frames that are used for clock synchronization in the last even and in the last odd numbered communication cycle. This register is updated after the start of the NIT and before 10 MT after offset correction start. NOTE If the application has locked the even synchronization table at the end of the static segment of an even communication cycle, the FlexRay block will not update the fields SFEVB and SFEV A. If the application has locked the odd synchronization table at the end of the static segment of an odd communication cycle, the FlexRay block will not update the values SFODB and SFODA. Module Base + 0x003E 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000000000 TIMEOUTW Reset 0000000000000100 Figure 13-31. System Memory Access Time-Out Register (SYMATOR) Write: Disabled Mode Table 13-38. SYMATOR Field Descriptions Field Description 4–0 TIMEOUT Time-Out — This value defines the maximum number of wait states on the system memory bus interface. This value must never exceeded in order to ensure no data are lost even under internal worst case conditions. If the number of wait states is greater than the TIMEOUT value, but is less than twice the TIMEOUT value, and internal worst case conditions occur, than data might be lost. If data are lost, the System Bus Communication Failure Error Flag SBCF_EF is set in the CHI Error Flag Register (CHIERFR). If the number of wait states is greater than twice the TIMEOUT value, data will be lost, and the System Bus Communication Failure Error Flag SBCF_EF is set in the CHI Error Flag Register (CHIERFR). Module Base + 0x0040 Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R SFEVB SFEVA SFODB SFODA W Reset 0000000000000000 Figure 13-32. Sync Frame Counter Register (SFCNTR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 503

13.5.2.33 Sync Frame Table Offset Register (SFTOR)

Write: POC:config This register defines the Flexray Memory related offset for sync frame tables. For more details, see Section 13.6.12, “Sync Frame ID and Sync Frame Deviation Tables”.

13.5.2.34 Sync Frame Table Configuration, Control, Status Register (SFTCCSR)

Write: Normal Mode Table 13-39. SFCNTR Field Descriptions Field Description 15–12 SFEVB Sync Frames Channel B, even cycle — protocol related variable: size of ( vsSyncIdListB for even cycle) This field provides the size of the internal list of frame IDs of received synchronization frames used for clock synchronization. 11–8 SFEVB Sync Frames Channel A, even cycle — protocol related variable: size of ( vsSyncIdListA for even cycle) This field provides the size of the internal list of frame IDs of received synchronization frames used for clock synchronization. 7–4 SFODB Sync Frames Channel B, odd cycle — protocol related variable: size of ( vsSyncIdListB for odd cycle) This field provides the size of the internal list of frame IDs of received synchronization frames used for clock synchronization. 3–0 SFODA Sync Frames Channel A, odd cycle — protocol related variable: size of ( vsSyncIdListA for odd cycle) This field provides the size of the internal list of frame IDs of received synchronization frames used for clock synchronization. Module Base + 0x0042 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R SFT_OFFSET[15:1] 0 W Reset 0000000000000000 Figure 13-33. Sync Frame Table Offset Register (SFTOR) Table 13-40. SFTOR Field Description Field Description 15–1 SFTOR Sync Frame Table Offset— The offset of the Sync Frame Tables in the Flexray Memory. This offset is required to be 16-bit aligned. Thus STF_OFFSET[0] is always 0. Module Base + 0x0044 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0 0 CYCNUM ELKS OLKS EVAL OVAL 0 0 SDV EN SID ENW ELKT OLKT OPT Reset 0000000000000000 Figure 13-34. Sync Frame Table Configuration, Control, Status Register (SFTCCSR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

504 Freescale Semiconductor

This register provides configuration, control, and status information related to the generation and access of the clock sync ID tables and clock sync measurement tables. For a detailed description, see Section 13.6.12, “Sync Frame ID and Sync Frame Deviation Tables”. Table 13-41. SFTCCSR Field Descriptions Field Description ELKT Even Cycle Tables Lock/Unlock Trigger— This trigger bit is used to lock and unlock the even cycle tables.

0 No effect

1 Triggers lock/unlock of the even cycle tables. OLKT Odd Cycle Tables Lock/Unlock Trigger— This trigger bit is used to lock and unlock the odd cycle tables. 1 Triggers lock/unlock of the odd cycle tables. 13–8 CYCNUM Cycle Number — This field provides the number of the cycle in which the currently locked table was recorded. If none or both tables are locked, this value is related to the even cycle table. ELKS Even Cycle Tables Lock Status — This status bit indicates whether the application has locked the even cycle tables. 0 Application has not locked the even cycle tables. 1 Application has locked the even cycle tables. OLKS Odd Cycle Tables Lock Status— This status bit indicates whether the application has locked the odd cycle tables. 0 Application has not locked the odd cycle tables. 1 Application has locked the odd cycle tables. EVAL Even Cycle Tables Valid— This status bit indicates whether the Sync Frame ID and Sync Frame Deviation Tables for the even cycle are valid. The FlexRay block clears this status bit when it starts updating the tables, and sets this bit when it has finished the table update.

0 Tables are not valid (update is ongoing)

1 Tables are valid (consistent). OVAL Odd Cycle Tables Valid— This status bit indicates whether the Sync Frame ID and Sync Frame Deviation Tables for the odd cycle are valid. The FlexRay block clears this status bit when it starts updating the tables, and sets this bit when it has finished the table update. 1 Tables are valid (consistent). OPT One Pair Trigger— This trigger bit controls whether the FlexRay block writes continuously or only one pair of Sync Frame Tables into the FRM. If this trigger is set to 1 while SDVEN or SIDEN is set to 1, the FlexRay block writes only one pair of the enabled Sync Frame Tables corresponding to the next even-odd-cycle pair into the FRM. In this case, the FlexRay block clears the SDVEN or SIDEN bits immediately. If this trigger is set to 0 while SDVEN or SIDEN is set to 1, the FlexRay block writes continuously the enabled Sync Frame Tables into the FRM. 0 Write continuously pairs of enabled Sync Frame Tables into FRM. 1 Write only one pair of enabled Sync Frame Tables into FRM. SDVEN Sync Frame Deviation Table Enable— This bit controls the generation of the Sync Frame Deviation Tables. The application must set this bit to request the FlexRay block to write the Sync Frame Deviation Tables into the FRM.

0 Do not write Sync Frame Deviation Tables

1 Write Sync Frame Deviation Tables into FRM

Note: If SDVEN is set to 1, then SIDEN must also be set to 1. SIDEN Sync Frame ID Table Enable — This bit controls the generation of the Sync Frame ID Tables. The application must set this bit to 1 to request the FlexRay block to write the Sync Frame ID Tables into the FRM.

0 Do not write Sync Frame ID Tables

1 Write Sync Frame ID Tables into FRM

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 505

13.5.2.35 Sync Frame ID Rejection Filter Register (SFIDRFR)

Write: Normal Mode This register defines the Sync Frame Rejection Filter ID. The application must update this register outside of the static segment. If the application updates this register in the static segment, it can appear that the FlexRay block accepts the sync frame in the current cycle.

13.5.2.36 Sync Frame ID Acceptance Filter Value Register (SFIDAFVR)

Write: POC:config This register defines the sync frame acceptance filter value. For details on filtering, see Section 13.6.15, “Sync Frame Filtering”.

13.5.2.37 Sync Frame ID Acceptance Filter Mask Register (SFIDAFMR)

Module Base + 0x0046 16-bit write access required 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000 SYNFRIDW Reset 0000000000000000 Figure 13-35. Sync Frame ID Rejection Filter Register (SFIDRFR) Table 13-42. SFIDRFR Field Descriptions Field Description 9–0 SYNFRID Sync Frame Rejection ID — This field defines the frame ID of a frame that must not be used for clock Module Base + 0x0048 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000 FVALW Reset 0000000000000000 Figure 13-36. Sync Frame ID Acceptance Filter Value Register (SFIDAFVR) Table 13-43. SFIDAFVR Field Descriptions Field Description 9–0 FVAL Filter Value — This field defines the value for the sync frame acceptance filtering. Module Base + 0x004A 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000 FMSKW Reset 0000000000000000 Figure 13-37. Sync Frame ID Acceptance Filter Mask Register (SFIDAFMR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

506 Freescale Semiconductor

Write: POC:config This register defines the sync frame acceptance filter mask. For details on filtering see Section 13.6.15.1, “Sync Frame Acceptance Filtering”.

13.5.2.38 Network Management Vector Registers (NMVR0–NMVR5)

Each of these six registers holds one part of the Network Management Vector. The length of the Network Management Vector is configured in the Network Management Vector Length Register (NMVLR). If NMVLR is programmed with a value that is less than 12 bytes, the remaining bytes of the Network Management Vector Registers (NMVR0–NMVR5), which are not used for the Network Management Vector accumulating, will remain 0. The NMVR provides accrued information over all received NMVs in the last communication cycle. All NMVs received in one cycle are ORed into the NMVR. The NMVR is updated at the end of the communication cycle. Table 13-44. SFIDAFMR Field Descriptions Field Description 9–0 FMSK Filter Mask — This field defines the mask for the sync frame acceptance filtering. Module Base + 0x004C (NMVR0) Module Base + 0x004E (NMVR1) Module Base + 0x0050 (NMVR2) Module Base + 0x0052 (NMVR3) Module Base + 0x0054 (NMVR4) Module Base + 0x0056 (NMVR5) 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R NMVP[15:8] NMVP[7:0] W Reset 0000000000000000 Figure 13-38. Network Management Vector Registers (NMVR0–NMVR5) Table 13-45. NMVR[0:5] Field Descriptions Field Description 15–0 NMVP Network Management Vector Part — The mapping between the Network Management Vector Registers (NMVR0–NMVR5) and the receive message buffer payload bytes in NMV[0:11] is depicted in Table 13-46. Table 13-46. Mapping of NMVRn to the Received Payload Bytes NMVn NMVRn Register NMVn Received Payload NMVR0[NMVP[15:8]] NMV0 NMVR0[NMVP[7:0]] NMV1 NMVR1[NMVP[15:8]] NMV2 NMVR1[NMVP[7:0]] NMV3 ...

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 507

13.5.2.39 Network Management Vector Length Register (NMVLR)

Write: POC:config This register defines the length of the network management vector in bytes.

13.5.2.40 Timer Configuration and Control Register (TICCR)

Write: T2_CFG: POC:config T2_REP, T1_REP, T1SP, T2SP, T1TR, T2TR: Normal Mode This register is used to configure and control the two timers T1 and T2. For timer details, see Section 13.6.17, “Timer Support”. The Timer T1 is an absolute timer. The Timer T2 can be configured as an absolute or relative timer. NMVR5[NMVP[15:8]] NMV10 NMVR5[NMVP[7:0]] NMV11 Module Base + 0x0058 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000000000 NMVLW Reset 0000000000000000 Figure 13-39. Network Management Vector Length Register (NMVLR) Table 13-47. NMVLR Field Descriptions Field Description 3–0 NMVL Network Management Vector Length — protocol related variable: gNetworkManagementVectorLength This field defines the length of the Network Management Vector in bytes. Legal values are between 0 and 12. Module Base + 0x005A 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 T2_ CFG T2_ REP 0 0 0 T2ST 0 0 0 T1_ REP 0 0 0 T1ST W T2SP T2TR T1SP T1TR Reset 0000000000000000 Figure 13-40. Timer Configuration and Control Register (TICCR) Table 13-48. TICCR Field Descriptions (Sheet 1 of 2) Field Description T2_CFG Timer T2 Configuration — This bit configures the timebase mode of Timer T2. 0 T2 is absolute timer. 1 T2 is relative timer. T2_REP Timer T2 Repetitive Mode — This bit configures the repetition mode of Timer T2.

0 T2 is non repetitive

1 T2 is repetitive

Table 13-46. Mapping of NMVRn to the Received Payload Bytes NMVn NMVRn Register NMVn Received Payload

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

508 Freescale Semiconductor

Both timers are deactivated immediately when the protocol enters a state different from POC:normal active or POC:normal passive.

13.5.2.41 Timer 1 Cycle Set Register (TI1CYSR)

Write: Anytime This register defines the cycle filter value and the cycle filter mask for timer T1. For a detailed description of timer T1, refer to Section 13.6.17.1, “Absolute Timer T1”. T2SP Timer T2 Stop — This trigger bit is used to stop timer T2. 0 no effect 1 stop timer T2 T2TR Timer T2 Trigger — This trigger bit is used to start timer T2. 0 no effect 1 start timer T2 T2ST Timer T2 State — This status bit provides the current state of timer T2. 0 timer T2 is idle 1 timer T2 is running T1_REP Timer T1 Repetitive Mode — This bit configures the repetition mode of timer T1.

0 T1 is non repetitive

1 T1 is repetitive

Timer T1 Stop — This trigger bit is used to stop timer T1. 0 no effect 1 stop timer T1 T1TR Timer T1 Trigger — This trigger bit is used to start timer T1. 0 no effect 1 start timer T1 T1ST Timer T1 State — This status bit provides the current state of timer T1. 0 timer T1 is idle 1 timer T1 is running Module Base + 0x005C 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 T1_CYC_VAL 00 T1_CYC_MSKW Reset 0000000000000000 Figure 13-41. Timer 1 Cycle Set Register (TI1CYSR) Table 13-48. TICCR Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 509 NOTE If the application modifies the value in this register while the timer is running, the change becomes effective immediately and timer T1 will expire according to the changed value.

13.5.2.42 Timer 1 Macrotick Offset Register (TI1MTOR)

Write: Anytime This register holds the macrotick offset value for timer T1. For a detailed description of timer T1, refer to Section 13.6.17.1, “Absolute Timer T1”. NOTE If the application modifies the value in this register while the timer is running, the change becomes effective immediately and timer T1 will expire according to the changed value. Table 13-49. TI1CYSR Field Descriptions Field Description 13–8 T1_CYC_VAL Timer T1 Cycle Filter Value — This field defines the cycle filter value for timer T1. 5–0 T1_CYC_MSK Timer T1 Cycle Filter Mask — This field defines the cycle filter mask for timer T1. Module Base + 0x005E 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 T1_MTOFFSETW Reset 0000000000000000 Figure 13-42. Timer 1 Macrotick Offset Register (TI1MTOR) Table 13-50. TI1MTOR Field Descriptions Field Description 13–0 T1_MTOFFSET Timer 1 Macrotick Offset — This field defines the macrotick offset value for timer 1.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

510 Freescale Semiconductor

13.5.2.43 Timer 2 Configuration Register 0 (TI2CR0)

Write: Anytime The content of this register depends on the value of the T2_CFG bit in theTimer Configuration and Control Register (TICCR). For a detailed description of timer T2, refer to Section 13.6.17.2, “Absolute / Relative Timer T2”. NOTE If timer T2 is configured as an absolute timer and the application modifies the values in this register while the timer is running, the change becomes effective immediately and timer T2 will expire according to the changed values. If timer T2 is configured as a relative timer and the application changes the values in this register while the timer is running, the change becomes effective when the timer has expired according to the old values. Module Base + 0x0060 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 T2_CYC_VAL 00 T2_CYC_MSKW R T2_MTCNT[31:16]W Reset 0000000000000000 Figure 13-43. Timer 2 Configuration Register 0 (TI2CR0) Table 13-51. TI2CR0 Field Descriptions Field Description Fields for absolute timer T2 (TICCR[T2_CFG] = 0) 13–8 T2_CYC_VAL Timer T2 Cycle Filter Value — This field defines the cycle filter value for timer T2. 5–0 T2_CYC_MSK Timer T2 Cycle Filter Mask — This field defines the cycle filter mask for timer T2. Fields for relative timer T2 (TICCR[T2_CFG = 1) 15–0 T2_MTCNT[31:16] Timer T2 Macrotick High Word — This field defines the high word of the macrotick count for timer T2.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 511

13.5.2.44 Timer 2 Configuration Register 1 (TI2CR1)

Write: Anytime The content of this register depends on the value of the T2_CFG bit in theTimer Configuration and Control Register (TICCR). For a detailed description of timer T2, refer to Section 13.6.17.2, “Absolute / Relative Timer T2”. NOTE If timer T2 is configured as an absolute timer and the application modifies the values in this register while the timer is running, the change becomes effective immediately and the timer T2 will expire according to the changed values. If timer T2 is configured as a relative timer and the application changes the values in this register while the timer is running, the change becomes effective when the timer has expired according to the old values.

13.5.2.45 Slot Status Selection Register (SSSR)

Write: Anytime Module Base + 0x0062 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 T2_MTOFFSETW R T2_MTCNT[15:0]W Reset 0000000000000000 Figure 13-44. Timer 2 Configuration Register 1 (TI2CR1) Table 13-52. TI2CR1 Field Descriptions Field Description Fields for absolute timer T2 (TICCR[T2_CFG] = 0) 13–0 T2_MTOFFSET Timer T2 Macrotick Offset — This field holds the macrotick offset value for timer T2. Fields for relative timer T2 (TICCR[T2_CFG] = 1) 15–0 T2_MTCNT[15:0] Timer T2 Macrotick Low Word — This field defines the low word of the macrotick value for timer T2. Module Base + 0x0064 16-bit write access required 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 SEL 0 SLOTNUMBERW WMD Reset 0000000000000000 Figure 13-45. Slot Status Selection Register (SSSR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

512 Freescale Semiconductor

This register is used to access the four internal non memory-mapped slot status selection registers SSSR0 to SSSR3. Each internal registers selects a slot, or symbol window/NIT, whose status vector will be saved in the corresponding Slot Status Registers (SSR0–SSR7) according to Table 13-54. For a detailed description of slot status monitoring, refer to Section 13.6.18, “Slot Status Monitoring”.

13.5.2.46 Slot Status Counter Condition Register (SSCCR)

Write: Anytime This register is used to access and program the four internal non-memory mapped Slot Status Counter Condition Registers SSCCR0 to SSCCR3. Each of these four internal slot status counter condition registers defines the mode and the conditions for incrementing the counter in the correspondingSlot Status Counter Registers (SSCR0–SSCR3). The correspondence is given in Table 13-56. For a detailed description of slot status counters, refer to Section 13.6.18.4, “Slot Status Counter Registers”. Table 13-53. SSSR Field Descriptions Field Description WMD Write Mode — This control bit defines the write mode of this register. 0 Write to all fields in this register on write access. 1 Write to SEL field only on write access. 13–12 SEL Selector — This field selects one of the four internal slot status selection registers for access. 00 select SSSR0. 01 select SSSR1. 10 select SSSR2. 11 select SSSR3. 10–0 SLOTNUMBER Slot Number — This field specifies the number of the slot whose status will be saved in the corresponding slot status registers. Note: If this value is set to 0, the related slot status register provides the status of the symbol window after the NIT start, and provides the status of the NIT after the cycle start. Table 13-54. Mapping Between SSSRn and SSRn Internal Slot Status Selection Register Write the Slot Status of the Slot Selected by SSSRn for each Even Communication Cycle Odd Communication Cycle For Channel B to For Channel A to For Channel B to For Channel A to SSSR0 SSR0[15:8] SSR0[7:0] SSR1[15:8] SSR1[7:0] SSSR1 SSR2[15:8] SSR2[7:0] SSR3[15:8] SSR3[7:0] SSSR2 SSR4[15:8] SSR4[7:0] SSR5[15:8] SSR5[7:0] SSSR3 SSR6[15:8] SSR6[7:0] SSR7[15:8] SSR7[7:0] Module Base + 0x0066 16-bit write access required 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 SEL 0 CNTCFG MCY VFR SYF NUF SUF STATUSMASKW WMD Reset 0000000000000000 Figure 13-46. Slot Status Counter Condition Register (SSCCR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 513 Table 13-55. SSCCR Field Descriptions Field Description WMD Write Mode — This control bit defines the write mode of this register. 0 Write to all fields in this register on write access. 1 Write to SEL field only on write access. 13–12 SEL Selector — This field selects one of the four internal slot counter condition registers for access. 00 select SSCCR0. 01 select SSCCR1. 10 select SSCCR2. 11 select SSCCR3. 10–9 CNTCFG Counter Configuration — These bit field controls the channel related incrementing of the slot status counter. 00 increment by 1 if condition is fulfilled on channel A. 01 increment by 1 if condition is fulfilled on channel B. 10 increment by 1 if condition is fulfilled on at least one channel. 11 increment by 2 if condition is fulfilled on both channels channel. increment by 1 if condition is fulfilled on only one channel. MCY Multi Cycle Selection — This bit defines whether the slot status counter accumulates over multiple communication cycles or provides information for the previous communication cycle only. 0 The Slot Status Counter provides information for the previous communication cycle only. 1 The Slot Status Counter accumulates over multiple communication cycles. VFR Valid Frame Restriction — This bit is used to restrict the counter to received valid frames. 0 The counter is not restricted to valid frames only. 1 The counter is restricted to valid frames only. SYF Sync Frame Restriction — This bit is used to restrict the counter to received frames with the sync frame indicator bit set to 1. 0 The counter is not restricted with respect to the sync frame indicator bit. 1 The counter is restricted to frames with the sync frame indicator bit set to 1. NUF Null Frame Restriction — This bit is used to restrict the counter to received frames with the null frame indicator bit set to 0. 0 The counter is not restricted with respect to the null frame indicator bit. 1 The counter is restricted to frames with the null frame indicator bit set to 0. SUF Startup Frame Restriction — This bit is used to restrict the counter to received frames with the startup frame indicator bit set to 1. 0 The counter is not restricted with respect to the startup frame indicator bit. 1 The counter is restricted to received frames with the startup frame indicator bit set to 1. 3–0 STATUSMASK Slot Status Mask — This bit field is used to enable the counter with respect to the four slot status error indicator bits. STATUSMASK[3]– This bit enables the counting for slots with the syntax error indicator bit set to 1. STATUSMASK[2]– This bit enables the counting for slots with the content error indicator bit set to 1. STATUSMASK[1]– This bit enables the counting for slots with the boundary violation indicator bit set to 1. STATUSMASK[0]– This bit enables the counting for slots with the transmission conflict indicator bit set to 1. Table 13-56. Mapping between internal SSCCRn and SSCRn Condition Register Condition Defined for Register SSCCR0 SSCR0 SSCCR1 SSCR1 SSCCR2 SSCR2 SSCCR3 SSCR3

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

514 Freescale Semiconductor

13.5.2.47 Slot Status Registers (SSR0–SSR7)

Each of these eight registers holds the status vector of the slot specified in the corresponding internal slot status selection register, which can be programmed using theSlot Status Selection Register (SSSR). Each register is updated after the end of the corresponding slot as shown inFigure 13-142. The register bits are directly related to the protocol variables and described in more detail in Section 13.6.18, “Slot Status Monitoring”. Module Base + 0x0068 (SSR0) Module Base + 0x006A (SSR1) Module Base + 0x006C (SSR2) Module Base + 0x006E (SSR3) Module Base + 0x0070 (SSR4) Module Base + 0x0072 (SSR5) Module Base + 0x0074 (SSR6) Module Base + 0x0076 (SSR7) 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R VFB SYB NFB SUB SEB CEB BVB TCB VFA SYA NFA SUA SEA CEA BVA TCA W Reset 0000000000000000 Figure 13-47. Slot Status Registers (SSR0–SSR7) Table 13-57. SSR0–SSR7 Field Descriptions Field Description VFB Valid Frame on Channel B — protocol related variable: vSS!ValidFrame channel B 0 vSS!ValidFrame = 0 1 vSS!ValidFrame = 1 SYB Sync Frame Indicator Channel B — protocol related variable: vRF!Header!SyFIndicator channel B 0 vRF!Header!SyFIndicator = 0 1 vRF!Header!SyFIndicator = 1 NFB Null Frame Indicator Channel B — protocol related variable: vRF!Header!NFIndicator channel B 0 vRF!Header!NFIndicator = 0 1 vRF!Header!NFIndicator = 1 SUB Startup Frame Indicator Channel B — protocol related variable: vRF!Header!SuFIndicator channel B 0 vRF!Header!SuFIndicator = 0 1 vRF!Header!SuFIndicator = 1 SEB Syntax Error on Channel B — protocol related variable: vSS!SyntaxError channel B 0 vSS!SyntaxError = 0 1 vSS!SyntaxError = 1 CEB Content Error on Channel B — protocol related variable: vSS!ContentError channel B 0 vSS!ContentError = 0 1 vSS!ContentError = 1 BVB Boundary Violation on Channel B — protocol related variable: vSS!BViolation channel B 0 vSS!BViolation = 0 1 vSS!BViolation = 1 TCB Transmission Conflict on Channel B — protocol related variable: vSS!TxConflict channel B 0 vSS!TxConflict = 0 1 vSS!TxConflict = 1

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 515

13.5.2.48 Slot Status Counter Registers (SSCR0–SSCR3)

Each of these four registers provides the slot status counter value for the previous communication cycle(s) and is updated at the cycle start. The provided value depends on the control bits and fields in the related internal slot status counter condition register SSCCRn, which can be programmed by using theSlot Status Counter Condition Register (SSCCR). For more details, see Section 13.6.18.4, “Slot Status Counter Registers”. VFA Valid Frame on Channel A — protocol related variable: vSS!ValidFrame channel A 0 vSS!ValidFrame = 0 1 vSS!ValidFrame = 1 SYA Sync Frame Indicator Channel A — protocol related variable: vRF!Header!SyFIndicator channel A 0 vRF!Header!SyFIndicator = 0 1 vRF!Header!SyFIndicator = 1 NFA Null Frame Indicator Channel A — protocol related variable: vRF!Header!NFIndicator channel A 0 vRF!Header!NFIndicator = 0 1 vRF!Header!NFIndicator = 1 SUA Startup Frame Indicator Channel A — protocol related variable: vRF!Header!SuFIndicator channel A 0 vRF!Header!SuFIndicator = 0 1 vRF!Header!SuFIndicator = 1 SEA Syntax Error on Channel A — protocol related variable: vSS!SyntaxError channel A 0 vSS!SyntaxError = 0 1 vSS!SyntaxError = 1 CEA Content Error on Channel A — protocol related variable: vSS!ContentError channel A 0 vSS!ContentError = 0 1 vSS!ContentError = 1 BVA Boundary Violation on Channel A — protocol related variable: vSS!BViolation channel A 0 vSS!BViolation = 0 1 vSS!BViolation = 1 TCA Transmission Conflict on Channel A — protocol related variable: vSS!TxConflict channel A 0 vSS!TxConflict = 0 1 vSS!TxConflict = 1 Module Base + 0x0078 (SSCR0) Module Base + 0x007A (SSCR1) Module Base + 0x007C (SSCR2) Module Base + 0x007E (SSCR3) Additional Reset: RUN Command 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R SLOTSTATUSCNT W Reset 0000000000000000 Figure 13-48. Slow Status Counter Registers (SSCR0–SSCR3) Table 13-57. SSR0–SSR7 Field Descriptions (continued) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

516 Freescale Semiconductor

If the counter has reached its maximum value 0xFFFF and is in the multicycle mode, i.e. SSCCRn[MCY] = 1, the counter is not reset to 0x0000. The application can reset the counter by clearing the SSCCRn[MCY] bit and waiting for the next cycle start, when the FlexRay block clears the counter. Subsequently, the counter can be set into the multicycle mode again.

13.5.2.49 MTS A Configuration Register (MTSACFR)

Write: MTE: Anytime; CYCCNTMSK,CYCCNTV AL:POC:config This register controls the transmission of the Media Access Test Symbol MTS on channel A. For more details, see Section 13.6.13, “MTS Generation”.

13.5.2.50 MTS B Configuration Register (MTSBCFR)

Table 13-58. SSCR0–SSCR3 Field Descriptions Field Description 15–0 SLOTSTATUSCNT Slot Status Counter — This field provides the current value of the Slot Status Counter. Module Base + 0x0080 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R MTE 0 CYCCNTMSK 00 CYCCNTVALW Reset 0000000000000000 Figure 13-49. MTS A Configuration Register (MTSACFR) Table 13-59. MTSACFR Field Descriptions Field Description MTE Media Access Test Symbol Transmission Enable— This control bit is used to enable and disable the transmission of the Media Access Test Symbol in the selected set of cycles.

0 MTS transmission disabled

1 MTS transmission enabled

13–8 CYCCNTMSK Cycle Counter Mask — This field provides the filter mask for the MTS cycle count filter. 5–0 CYCCNTVAL Cycle Counter Value — This field provides the filter value for the MTS cycle count filter. Module Base + 0x0082 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R MTE 0 CYCCNTMSK 00 CYCCNTVALW Reset 0000000000000000 Figure 13-50. MTS B Configuration Register (MTSBCFR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 517 Write: MTE: Anytime; CYCCNTMSK,CYCCNTV AL:POC:config This register controls the transmission of the Media Access Test Symbol MTS on channel B. For more details, see Section 13.6.13, “MTS Generation”.

13.5.2.51 Receive Shadow Buffer Index Register (RSBIR)

Write: WMD, SEL: Any Time; RSBIDX: POC:config This register is used to provide and retrieve the indices of the message buffer header fields currently associated with the receive shadow buffers. For more details on the receive shadow buffer concept, refer Table 13-60. MTSBCFR Field Descriptions Field Description MTE Media Access Test Symbol Transmission Enable — This control bit is used to enable and disable the transmission of the Media Access Test Symbol in the selected set of cycles. 13–8 CYCCNTMSK Cycle Counter Mask — This field provides the filter mask for the MTS cycle count filter. 5–0 CYCCNTVAL Cycle Counter Value — This field provides the filter value for the MTS cycle count filter. Module Base + 0x0084 16-bit write access required 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 SEL 000000 RSBIDXW WMD Reset 0000000000000000 Figure 13-51. Receive Shadow Buffer Index Register (RSBIR) Table 13-61. RSBIR Field Descriptions Field Description WMD Write Mode — This bit controls the write mode for this register. 0 update SEL and RSBIDX field on register write 1 update only SEL field on register write 13–12 SEL Selector — This field is used to select the internal receive shadow buffer index register for access.

00 RSBIR_A1 — receive shadow buffer index register for channel A, segment 1

01 RSBIR_A2 — receive shadow buffer index register for channel A, segment 2

10 RSBIR_B1 — receive shadow buffer index register for channel B, segment 1

11 RSBIR_B2 — receive shadow buffer index register for channel B, segment 2

5–0 RSBIDX Receive Shadow Buffer Index— This field contains the current index of the message buffer header field of the receive shadow message buffer selected by the SEL field. The FlexRay block uses this index to determine the physical location of the shadow buffer header field in the FlexRay memory. The FlexRay block will update this field during receive operation.The application provides initial message buffer header index value in the configuration phase. FlexRay block: Updates the message buffer header index after successful reception. Application: Provides initial message buffer header index.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

518 Freescale Semiconductor

13.5.2.52 Receive FIFO Selection Register (RFSR)

Write: Anytime This register is used to select a receiver FIFO for subsequent access through the receiver FIFO configuration registers summarized in Table 13-62.

13.5.2.53 Receive FIFO Start Index Register (RFSIR)

Write: POC:config This register defines the message buffer header index of the first message buffer of the selected FIFO. Module Base + 0x0086 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000000000000 SELW Reset 0000000000000000 Figure 13-52. Receive FIFO Selection Register (RFSR) Table 13-62. SEL Controlled Receiver FIFO Registers Register Receive FIFO Start Index Register (RFSIR) Receive FIFO Depth and Size Register (RFDSR) Receive FIFO Message ID Acceptance Filter Value Register (RFMIDAFVR) Receive FIFO Message ID Acceptance Filter Mask Register (RFMIAFMR) Receive FIFO Frame ID Rejection Filter Value Register (RFFIDRFVR) Receive FIFO Frame ID Rejection Filter Mask Register (RFFIDRFMR) Receive FIFO Range Filter Configuration Register (RFRFCFR) Receive FIFO Range Filter Control Register (RFRFCTR) Table 13-63. RFSR Field Descriptions Field Description SEL Select — This control bit selects the receiver FIFO for subsequent programming.

0 Receiver FIFO for channel A selected

1 Receiver FIFO for channel B selected

1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000 SIDXW Reset 0000000000000000 Figure 13-53. Receive FIFO Start Index Register (RFSIR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 519

13.5.2.54 Receive FIFO Depth and Size Register (RFDSR)

Write: POC:config This register defines the structure of the selected FIFO, i.e. the number of entries and the size of each entry.

13.5.2.55 Receive FIFO A Read Index Register (RFARIR)

This register provides the message buffer header index of the next available receive FIFO A entry that the application can read. Table 13-64. RFSIR Field Descriptions Field Description 9–0 SIDX Start Index — This field defines the number of the message buffer header field of the first message buffer of the selected receive FIFO. The FlexRay block uses the value of the SIDX field to determine the physical location of the receiver FIFO’s first message buffer header field. Module Base + 0x008A 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R FIFO_DEPTH 0 ENTRY_SIZEW Reset 0000000000000000 Figure 13-54. Receive FIFO Depth and Size Register (RFDSR) Table 13-65. RFDSR Field Descriptions Field Description 15–8 FIFO_DEPTH FIFO Depth — This field defines the depth of the selected receive FIFO, i.e. the number of entries. 6–0 ENTRY_SIZE Entry Size — This field defines the size of the frame data sections for the selected receive FIFO in 2 byte entities. Module Base + 0x008C 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000 RDIDX W Reset 0000000000000000 Figure 13-55. Receive FIFO A Read Index Register (RFARIR) Table 13-66. RFARIR Field Descriptions Field Description 9–0 RDIDX Read Index — This field provides the message buffer header index of the next available receive FIFO message buffer that the application can read. The FlexRay block increments this index when the application writes to the FNEAIF flag in the Global Interrupt Flag and Enable Register (GIFER). The index wraps back to the first message buffer header index if the end of the FIFO was reached.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

520 Freescale Semiconductor

If the receive FIFO not empty flag FNEAIF is not set, the RDIDX field points to an physical message buffer which content is not valid. Only when FNEAIF is set, the message buffer indicated by RDIDX contains valid data.

13.5.2.56 Receive FIFO B Read Index Register (RFBRIR)

This register provides the message buffer header index of the next available receive FIFO B entry that the application can read. NOTE If the receive FIFO not empty flag FNEBIF is not set, the RDIDX field points to an physical message buffer which content is not valid. Only when FNEBIF is set, the message buffer indicated by RDIDX contains valid data.

13.5.2.57 Receive FIFO Message ID Acceptance Filter Value Register

(RFMIDAFVR) Write: POC:config This register defines the filter value for the message ID acceptance filter of the selected receive FIFO. For details on message ID filtering see Section 13.6.9.5, “Receive FIFO filtering”. Module Base + 0x008E 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000 RDIDX W Reset 0000000000000000 Figure 13-56. Receive FIFO B Read Index Register (RFBRIR) Table 13-67. RFBRIR Field Descriptions Field Description 9–0 RDIDX Read Index — This field provides the message buffer header index of the next available receive FIFO entry that the application can read. The FlexRay block increments this index when the application writes to the FNEBIF flag in the Global Interrupt Flag and Enable Register (GIFER).The index wraps back to the first message buffer header index if the end of the FIFO was reached. Module Base + 0x0090 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R MIDAFVALW Reset 0000000000000000 Figure 13-57. Receive FIFO Message ID Acceptance Filter Value Register (RFMIDAFVR)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 521

13.5.2.58 Receive FIFO Message ID Acceptance Filter Mask Register (RFMIAFMR)

Write: POC:config This register defines the filter mask for the message ID acceptance filter of the selected receive FIFO. For details on message ID filtering see Section 13.6.9.5, “Receive FIFO filtering”.

13.5.2.59 Receive FIFO Frame ID Rejection Filter Value Register (RFFIDRFVR)

Write: POC:config This register defines the filter value for the frame ID rejection filter of the selected receive FIFO. For details on frame ID filtering see Section 13.6.9.5, “Receive FIFO filtering”. Table 13-68. RFMIDAFVR Field Descriptions Field Description 15–0 MIDAFVAL Message ID Acceptance Filter Value — Filter value for the message ID acceptance filter. Module Base + 0x0092 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R MIDAFMSKW Reset 0000000000000000 Figure 13-58. Receive FIFO Message ID Acceptance Filter Mask Register (RFMIAFMR) Table 13-69. RFMIAFMR Field Descriptions Field Description 15–0 MIDAFMSK Message ID Acceptance Filter Mask — Filter mask for the message ID acceptance filter. Module Base + 0x0094 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000 FIDRFVALW Reset 0000000000000000 Figure 13-59. Receive FIFO Frame ID Rejection Filter Value Register (RFFIDRFVR) Table 13-70. RFFIDRFVR Field Descriptions Field Description 10–0 FIDRFVAL Frame ID Rejection Filter Value — Filter value for the frame ID rejection filter.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

522 Freescale Semiconductor

13.5.2.60 Receive FIFO Frame ID Rejection Filter Mask Register (RFFIDRFMR)

Write: POC:config This register defines the filter mask for the frame ID rejection filter of the selected receive FIFO. For details on frame ID filtering see Section 13.6.9.5, “Receive FIFO filtering”.

13.5.2.61 Receive FIFO Range Filter Configuration Register (RFRFCFR)

Write: WMD, IBD, SEL: Any Time; SID: POC:config This register provides access to the four internal frame ID range filter boundary registers of the selected Module Base + 0x0096 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000 FIDRFMSKW Reset 0000000000000000 Figure 13-60. Receive FIFO Frame ID Rejection Filter Mask Register (RFFIDRFMR) Table 13-71. RFFIDRFMR Field Descriptions Field Description 10–0 FIDRFMSK Frame ID Rejection Filter Mask — Filter mask for the frame ID rejection filter. Module Base + 0x0098 16-bit write access required 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 IBD SEL 0 SIDW WMD Reset 0000000000000000 Figure 13-61. Receive FIFO Range Filter Configuration Register (RFRFCFR) Table 13-72. RFRFCFR Field Descriptions Field Description WMD Write Mode — This control bit defines the write mode of this register. 0 Write to all fields in this register on write access. 1 Write to SEL and IBD field only on write access. IBD Interval Boundary — This control bit selects the interval boundary to be programmed with the SID value. 0 program lower interval boundary 1 program upper interval boundary

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 523

13.5.2.62 Receive FIFO Range Filter Control Register (RFRFCTR)

Write: Anytime This register is used to enable and disable each frame ID range filter and to define whether it is running as acceptance or rejection filter. 13–12 SEL Filter Selector — This control field selects the frame ID range filter to be accessed. 00 select frame ID range filter 0. 01 select frame ID range filter 1. 10 select frame ID range filter 2. 11 select frame ID range filter 3. 10–0 SID Slot ID — Defines the IBD-selected frame ID boundary value for the SEL-selected range filter. Module Base + 0x009A 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0000 F3MD F2MD F1MD F0MD 0000 F3EN F2EN F1EN F0ENW Reset 0000000000000000 Figure 13-62. Receive FIFO Range Filter Control Register (RFRFCTR) Table 13-73. RFRFCTR Field Descriptions (Sheet 1 of 2) Field Description F3MD Range Filter 3 Mode — This control bit defines the filter mode of the frame ID range filter 3. 0 range filter 3 runs as acceptance filter 1 range filter 3 runs as rejection filter F2MD Range Filter 2 Mode — This control bit defines the filter mode of the frame ID range filter 2. 0 range filter 2 runs as acceptance filter 1 range filter 2 runs as rejection filter F1MD Range Filter 1 Mode — This control bit defines the filter mode of the frame ID range filter 1. 0 range filter 1 runs as acceptance filter 1 range filter 1 runs as rejection filter F0MD Range Filter 0 Mode — This control bit defines the filter mode of the frame ID range filter 0. 0 range filter 0 runs as acceptance filter 1 range filter 0 runs as rejection filter F3EN Range Filter 3 Enable — This control bit is used to enable and disable the frame ID range filter 3. 0 range filter 3 disabled 1 range filter 3 enabled F2EN Range Filter 2 Enable — This control bit is used to enable and disable the frame ID range filter 2. 0 range filter 2 disabled 1 range filter 2 enabled Table 13-72. RFRFCFR Field Descriptions (continued) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

524 Freescale Semiconductor

13.5.2.63 Last Dynamic Transmit Slot Channel A Register (LDTXSLAR)

This register provides the number of the last transmission slot in the dynamic segment for channel A. This register is updated after the end of the dynamic segment and before the start of the next communication cycle.

13.5.2.64 Last Dynamic Transmit Slot Channel B Register (LDTXSLBR)

This register provides the number of the last transmission slot in the dynamic segment for channel B. This register is updated after the end of the dynamic segment and before the start of the next communication cycle. F1EN Range Filter 1 Enable — This control bit is used to enable and disable the frame ID range filter 1. 0 range filter 1 disabled 1 range filter 1 enabled F0EN Range Filter 0 Enable — This control bit is used to enable and disable the frame ID range filter 0. 0 range filter 0 disabled 1 range filter 0 enabled Module Base + 0x009C 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000 LASTDYNTXSLOTA W Reset 0000000000000000 Figure 13-63. Last Dynamic Slot Channel A Register (LDTXSLAR) Table 13-74. LDTXSLAR Field Descriptions Field Description 10–0 LASTDYNTX SLOTA Last Dynamic Transmission Slot Channel A — protocol related variable: zLastDynTxSlot channel A Number of the last transmission slot in the dynamic segment for channel A. If no frame was transmitted during the dynamic segment on channel A, the value of this field is set to 0. Module Base + 0x009E 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000 LASTDYNTXSLOTB W Reset 0000000000000000 Figure 13-64. Last Dynamic Slot Channel B Register (LDTXSLBR) Table 13-75. LDTXSLBR Field Descriptions Field Description 10–0 LASTDYNTX SLOTB Last Dynamic Transmission Slot Channel B — protocol related variable: zLastDynTxSlot channel B Number of the last transmission slot in the dynamic segment for channel B. If no frame was transmitted during the dynamic segment on channel B the value of this field is set to 0. Table 13-73. RFRFCTR Field Descriptions (Sheet 2 of 2) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 525

13.5.2.65 Protocol Configuration Registers

The following configuration registers provide the necessary configuration information to the protocol engine. The individual values in the registers are described in Table 13-76. For more details about the FlexRay related configuration parameters and the allowed parameter ranges, seeFlexRay Communications System Protocol Specification, Version 2.1 Rev A. Table 13-76. Protocol Configuration Register Fields (Sheet 1 of 2) Name Description (1) Min Max Unit PCR coldstart_attempts gColdstartAttempts number 3 action_point_offset gdActionPointOffset - 1 MT 0 cas_rx_low_max gdCASRxLowMax - 1 gdBit 4 dynamic_slot_idle_phase gdDynamicSlotIdlePhase minislot 28 minislot_action_point_offset gdMinislotActionPointOffset - 1 MT 3 minislot_after_action_point gdMinislot - gdMinislotActionPointOffset - 1 MT 2 static_slot_length gdStaticSlot MT 0 static_slot_after_action_point gdStaticSlot - gdActionPointOffset - 1 MT 13 symbol_window_exists gdSymbolWindow!=0 0 1 bool 9 symbol_window_after_action_point gdSymbolWindow - gdActionPointOffset - 1 MT 6 tss_transmitter gdTSSTransmitter gdBit 5 wakeup_symbol_rx_idle gdWakeupSymbolRxIdle gdBit 5 wakeup_symbol_rx_low gdWakeupSymbolRxLow gdBit 3 wakeup_symbol_rx_window gdWakeupSymbolRxWindow gdBit 4 wakeup_symbol_tx_idle gdWakeupSymbolTxIdle gdBit 8 wakeup_symbol_tx_low gdWakeupSymbolTxLow gdBit 5 noise_listen_timeout ( gListenNoise * pdListenTimeout) - 1 µT 16/17 macro_initial_offset_a pMacroInitialOffset[A] MT 6 macro_initial_offset_b pMacroInitialOffset[B] MT 16 macro_per_cycle gMacroPerCycle MT 10 macro_after_first_static_slot gMacroPerCycle - gdStaticSlot MT 1 macro_after_offset_correction gMacroPerCycle - gOffsetCorrectionStart MT 28 max_without_clock_correction_fatal gMaxWithoutClockCorrectionFatal cyclepairs 8 max_without_clock_correction_passive gMaxWithoutClockCorrectionPassive cyclepairs 8 minislot_exists gNumberOfMinislots!=0 0 1 bool 9 minislots_max gNumberOfMinislots - 1 minislot 29 number_of_static_slots gNumberOfStaticSlots static slot 2 offset_correction_start gOffsetCorrectionStart MT 11 payload_length_static gPayloadLengthStatic 2-bytes 19 max_payload_length_dynamic pPayloadLengthDynMax 2-bytes 24 first_minislot_action_point_offset max( gdActionPointOffset, gdMinislotActionPointOffset) - 1 MT 13 allow_halt_due_to_clock pAllowHaltDueToClock bool 26 allow_passive_to_active pAllowPassiveToActive cyclepairs 12

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

526 Freescale Semiconductor

cluster_drift_damping pClusterDriftDamping µT2 4 comp_accepted_startup_range_a pdAcceptedStartupRange - pDelayCompensationChA µT2 2 comp_accepted_startup_range_b pdAcceptedStartupRange - pDelayCompensationChB µT2 6 listen_timeout pdListenTimeout - 1 µT 14/15 key_slot_id pKeySlotId number 18 key_slot_used_for_startup pKeySlotUsedForStartup bool 11 key_slot_used_for_sync pKeySlotUsedForSync bool 11 latest_tx gNumberOfMinislots - pLatestTx minislot 21 sync_node_max gSyncNodeMax number 30 micro_initial_offset_a pMicroInitialOffset[A] µT2 0 micro_initial_offset_b pMicroInitialOffset[B] µT2 0 micro_per_cycle pMicroPerCycle µT 22/23 micro_per_cycle_min pMicroPerCycle - pdMaxDrift µT 24/25 micro_per_cycle_max pMicroPerCycle + pdMaxDrift µT 26/27 micro_per_macro_nom_half round( pMicroPerMacroNom / 2) µT7 offset_correction_out pOffsetCorrectionOut µT9 rate_correction_out pRateCorrectionOut µT1 4 single_slot_enabled pSingleSlotEnabled bool 10 wakeup_channel pWakeupChannel see Table 13-77 10 wakeup_pattern pWakeupPattern number 18 decoding_correction_a pDecodingCorrection + pDelayCompensation[A] + 2 µT1 9 decoding_correction_b pDecodingCorrection + pDelayCompensation[B] + 2 µT7 key_slot_header_crc header CRC for key slot 0x000 0x7FF number 12 extern_offset_correction pExternOffsetCorrection µT2 9 extern_rate_correction pExternRateCorrection µT2 1 1. See FlexRay Communications System Protocol Specification, Version 2.1 Rev A for detailed protocol parameter definitions Table 13-77. Wakeup Channel Selection wakeup_channel Wakeup Channel Table 13-76. Protocol Configuration Register Fields (Sheet 2 of 2) Name Description (1) Min Max Unit PCR

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 527

13.5.2.65.1 Protocol Configuration Register 0 (PCR0)

Write: POC:config

13.5.2.65.2 Protocol Configuration Register 1 (PCR1)

Write: POC:config

13.5.2.65.3 Protocol Configuration Register 2 (PCR2)

Write: POC:config

13.5.2.65.4 Protocol Configuration Register 3 (PCR3)

Write: POC:config Module Base + 0x00A0 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R action_point_offset static_slot_lengthW Reset 0000000000000000 Figure 13-65. Protocol Configuration Register 0 (PCR0) Module Base + 0x00A2 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 0 macro_after_first_static_slotW Reset 0000000000000000 Figure 13-66. Protocol Configuration Register 1 (PCR1) Module Base + 0x00A4 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R minislot_after_action_point number_of_static_slotsW Reset 0000000000000000 Figure 13-67. Protocol Configuration Register 2 (PCR2) Module Base + 0x00A6 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R wakeup_symbol_rx_low minislot_action_point_offset[4:0] coldstart_attemptsW Reset 0000000000000000 Figure 13-68. Protocol Configuration Register 3 (PCR3)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

528 Freescale Semiconductor

13.5.2.65.5 Protocol Configuration Register 4 (PCR4)

Write: POC:config

13.5.2.65.6 Protocol Configuration Register 5 (PCR5)

Write: POC:config

13.5.2.65.7 Protocol Configuration Register 6 (PCR6)

Write: POC:config

13.5.2.65.8 Protocol Configuration Register 7 (PCR7)

Write: POC:config Module Base + 0x00A8 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R cas_rx_low_max wakeup_symbol_rx_windowW Reset 0000000000000000 Figure 13-69. Protocol Configuration Register 4 (PCR4) Module Base + 0x00AA 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R tss_transmitter wakeup_symbol_tx_low wakeup_symbol_rx_idleW Reset 0000000000000000 Figure 13-70. Protocol Configuration Register 5 (PCR5) Module Base + 0x00AC 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 symbol_window_after_action_point macro_initial_offset_aW Reset 0000000000000000 Figure 13-71. Protocol Configuration Register 6 (PCR6) Module Base + 0x00AE 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R decoding_correction_b micro_per_macro_nom_halfW Reset 0000000000000000 Figure 13-72. Protocol Configuration Register 7 (PCR7)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 529

13.5.2.65.9 Protocol Configuration Register 8 (PCR8)

Write: POC:config

13.5.2.65.10 Protocol Configuration Register 9 (PCR9)

Write: POC:config

13.5.2.65.11 Protocol Configuration Register 10 (PCR10)

Write: POC:config Module Base + 0x00B0 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R max_without_clock_ correction_fatal max_without_clock_ correction_passive wakeup_symbol_tx_idleW Reset 0000000000000000 Figure 13-73. Protocol Configuration Register 8 (PCR8) Module Base + 0x00B2 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R mini slot_ exists sym bol_ win dow_ exists offset_correction_out W Reset 0000000000000000 Figure 13-74. Protocol Configuration Register 9 (PCR9) Module Base + 0x00B4 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R single _slot _en abled wake up_ chan nel macro_per_cycle W Reset 0000000000000000 Figure 13-75. Protocol Configuration Register 10 (PCR10)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

530 Freescale Semiconductor

13.5.2.65.12 Protocol Configuration Register 11 (PCR11)

Write: POC:config

13.5.2.65.13 Protocol Configuration Register 12 (PCR12)

Write: POC:config

13.5.2.65.14 Protocol Configuration Register 13 (PCR13)

Write: POC:config

13.5.2.65.15 Protocol Configuration Register 14 (PCR14)

Write: POC:config Module Base + 0x00B6 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 Rk e y _ slot_ used_ for_ start up key_ slot_ used_ for_ sync offset_correction_start W Reset 0000000000000000 Figure 13-76. Protocol Configuration Register 11 (PCR11) Module Base + 0x00B8 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R allow_passive_to_active key_slot_header_crcW Reset 0000000000000000 Figure 13-77. Protocol Configuration Register 12 (PCR12) Module Base + 0x00BA 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R first_minislot_action_point_offset static_slot_after_action_pointW Reset 0000000000000000 Figure 13-78. Protocol Configuration Register 13 (PCR13) Module Base + 0x00BC 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R rate_correction_out listen_timeout[20:16]W Reset 0000000000000000 Figure 13-79. Protocol Configuration Register 14 (PCR14)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 531

13.5.2.65.16 Protocol Configuration Register 15 (PCR15)

Write: POC:config

13.5.2.65.17 Protocol Configuration Register 16 (PCR16)

Write: POC:config

13.5.2.65.18 Protocol Configuration Register 17 (PCR17)

Write: POC:config

13.5.2.65.19 Protocol Configuration Register 18 (PCR18)

Write: POC:config Module Base + 0x00BE 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R listen_timeout[15:0]W Reset 0000000000000000 Figure 13-80. Protocol Configuration Register 15 (PCR15) Module Base + 0x00C0 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R macro_initial_offset_b noise_listen_timeout[24:16]W Reset 0000000000000000 Figure 13-81. Protocol Configuration Register 16 (PCR16) Module Base + 0x00C2 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R noise_listen_timeout[15:0]W Reset 0000000000000000 Figure 13-82. Protocol Configuration Register 17 (PCR17) Module Base + 0x00C4 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R wakeup_pattern key_slot_idW Reset 0000000000000000 Figure 13-83. Protocol Configuration Register 18 (PCR18)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

532 Freescale Semiconductor

13.5.2.65.20 Protocol Configuration Register 19 (PCR19)

Write: POC:config

13.5.2.65.21 Protocol Configuration Register 20 (PCR20)

Write: POC:config

13.5.2.65.22 Protocol Configuration Register 21 (PCR21)

Write: POC:config

13.5.2.65.23 Protocol Configuration Register 22 (PCR22)

Write: POC:config Module Base + 0x00C6 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R decoding_correction_a payload_length_staticW Reset 0000000000000000 Figure 13-84. Protocol Configuration Register 19 (PCR19) Module Base + 0x00C8 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R micro_initial_offset_b micro_initial_offset_aW Reset 0000000000000000 Figure 13-85. Protocol Configuration Register 20 (PCR20) Module Base + 0x00CA 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R extern_rate_ correction latest_txW Reset 0000000000000000 Figure 13-86. Protocol Configuration Register 21 (PCR21) Module Base + 0x00CC 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R R* comp_accepted_startup_range_a micro_per_cycle[19:16W Reset 0000000000000000 Figure 13-87. Protocol Configuration Register 22 (PCR22)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 533

13.5.2.65.24 Protocol Configuration Register 23 (PCR23)

Write: POC:config

13.5.2.65.25 Protocol Configuration Register 24 (PCR24)

Write: POC:config

13.5.2.65.26 Protocol Configuration Register 25 (PCR25)

Write: POC:config

13.5.2.65.27 Protocol Configuration Register 26 (PCR26)

Write: POC:config Module Base + 0x00CE 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R micro_per_cycle[15:0]W Reset 0000000000000000 Figure 13-88. Protocol Configuration Register 23 (PCR23) Module Base + 0x00D0 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R cluster_drift_damping max_payload_length_dynamic micro_per_cycle_min [19:16]W Reset 0000000000000000 Figure 13-89. Protocol Configuration Register 24 (PCR24) Module Base + 0x00D2 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R micro_per_cycle_min[15:0]W Reset 0000000000000000 Figure 13-90. Protocol Configuration Register 25 (PCR25) Module Base + 0x00D4 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R allow _halt_ due _to_ clock comp_accepted_startup_range_b micro_per_cycle_max [19:16]W Reset 0000000000000000 Figure 13-91. Protocol Configuration Register 26 (PCR26)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

534 Freescale Semiconductor

13.5.2.65.28 Protocol Configuration Register 27 (PCR27)

Write: POC:config

13.5.2.65.29 Protocol Configuration Register 28 (PCR28)

Write: POC:config

13.5.2.65.30 Protocol Configuration Register 29 (PCR29)

Write: POC:config

13.5.2.65.31 Protocol Configuration Register 30 (PCR30)

Write: POC:config Module Base + 0x00D6 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R micro_per_cycle_max[15:0]W Reset 0000000000000000 Figure 13-92. Protocol Configuration Register 27 (PCR27) Module Base + 0x00D8 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R dynamic_slot _idle_phase macro_after_offset_correctionW Reset 0000000000000000 Figure 13-93. Protocol Configuration Register 28 (PCR28) Module Base + 0x00DA 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R extern_offset_ correction minislots_maxW Reset 0000000000000000 Figure 13-94. Protocol Configuration Register 29 (PCR29) Module Base + 0x00DC 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 000000000000 sync_node_maxW Reset 0000000000000000 Figure 13-95. Protocol Configuration Register 30 (PCR30)

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 535

13.5.2.66 Message Buffer Configuration, Control, Status Registers (MBCCSRn)

Write: MCM, MBT, MTD: POC:config or MB_DIS CMT: MB_LCK EDT, LCKT, MBIE, MBIF: Normal Mode The content of these registers comprises message buffer configuration data, message buffer control data, message buffer status information, and message buffer interrupt flags. Module Base + 0x0100 (MBCCSR0) Module Base + 0x0108 (MBCCSR1) ... Module Base + 0x01F8 (MBCCSR31) Additional Reset: CMT, DUP , DVAL, MBIF: Message Buffer Disable 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R0 MCM MBT MTD CMT 0 0 MBIE 0 0 0 DUP DVAL EDS LCKS MBIF W rwm EDT LCKT w1c Reset 0000000000000000 Figure 13-96. Message Buffer Configuration, Control, Status Registers (MBCCSRn) Table 13-78. MBCCSRn Field Descriptions (Sheet 1 of 3) Field Description Message Buffer Configuration MCM Message Buffer Commit Mode— This bit applies only to double buffered transmit message buffers and defines the commit mode.

0 Streaming commit mode

1 Immediate commit mode

Message Buffer Type — This bit applies only to transmit message buffers and defines the buffering type.

0 Single buffered transmit message buffer

1 Double buffered transmit message buffer

Message Buffer Transfer Direction — This bit defines the transfer direction of the message buffer.

0 Receive message buffer

1 Transmit message buffer

Commit for Transmission — This bit applies only to transmit message buffers and indicates whether the message buffer contains valid data that are ready for transmission. Both the application and the FlexRay block can modify this bit.

• Application: The application sets this bit to indicate that the transmit message buffer contains valid data ready for transmission. The application clears this bit to indicate that the message buffer data are no longer valid for transmission.
• FlexRay block: The FlexRay block clears this bit when the message buffer data are no longer valid for transmission. 0 Message buffer does not contain valid data. 1 Message buffer contains valid data.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

536 Freescale Semiconductor

Enable/Disable Trigger— This trigger bit is used to enable and disable a message buffer. The message buffer enable is triggered when the application writes 1 to this bit and the message buffer is disabled, i.e. the EDS status bit is 0. The message buffer disable is triggered when the application writes 1 to this bit and the message buffer is enabled, i.e. the EDS status bit is 1. 1 message buffer enable/disable triggered Note: If the application writes 1 to this bit, the write access to all other bits is ignored. LCKT Lock/Unlock Trigger — This trigger bit is used to lock and unlock a message buffer. The message buffer lock is triggered when the application writes 1 to this bit and the message buffer is not locked, i.e. the LCKS status bit is 0. The message buffer unlock is triggered when the application writes 1 to this bit and the message buffer is locked, i.e. the LCKS status bit is 1.

1 Trigger message buffer lock/unlock

Note: If the application writes 1 to this bit and 0 to the EDT bit, the write access to all other bits is ignored. MBIE Message Buffer Interrupt Enable — This control bit defines whether the message buffer will generate an interrupt request when its MBIF flag is set.

0 Interrupt request generation disabled

1 Interrupt request generation enabled

Data Updated — This status bit applies only to receive message buffers. It is always 0 for transmit message buffers. This bit provides information whether the frame header in the message buffer header field and the description of the update condtions. 0 Frame Header and Message buffer data field not updated. 1 Frame Header and Message buffer data field updated. DVAL Data Valid — The semantic of this status bit depends on the message buffer type and transfer direction.

• Receive Message Buffer: Indicates whether the message buffer data field contains valid frame data. See 0 message buffer data field contains no valid frame data 1 message buffer data field contains valid frame data
• Single Transmit Message Buffer: Indicates whether the message is transferred again due to the state transmission mode of the message buffer. 0 Message transferred for the first time. 1 Message will be transferred again.
• Double Transmit Message Buffer: For the commit side it is always 0. For the transmit side it indicates whether the message is transferred again due to the state transmission mode of the message buffer. 0 Message transferred for the first time. 1 Message will be transferred again. EDS Enable/Disable Status — This status bit indicates whether the message buffer is enabled or disabled. 0 Message buffer is disabled. 1 Message buffer is enabled. Table 13-78. MBCCSRn Field Descriptions (Sheet 2 of 3) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 537

13.5.2.67 Message Buffer Cycle Counter Filter Registers (MBCCFRn)

Write: POC:config or MB_DIS This register contains message buffer configuration data for the transmission mode, the channel assignment, and for the cycle counter filtering. For detailed information on cycle counter filtering, refer to Section 13.6.7.1, “Message Buffer Cycle Counter Filtering”. LCKS Lock Status — This status bit indicates the current lock status of the message buffer. 0 Message buffer is not locked by the application. 1 Message buffer is locked by the application. MBIF Message Buffer Interrupt Flag — The semantic of this flag depends on the message buffer transfer direction.

• Receive Message Buffer:This flag is set when the slot status in the message buffer header field was updated detailed description of the update conditions. 0 slot status not updated 1 slot status updated and slot was not an empty dynamic slot
• Transmit Message Buffer:This flag is set when the slot status in the message buffer header field was updated. Additionally this flag is set immediately when a transmit message buffer was enabled. 0 slot status not updated 1 slot status updated / message buffer just enabled Module Base + 0x0102 (MBCCFR0) Module Base + 0x010A (MBCCFR1) ... Module Base + 0x01FA (MBCCFR31) 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R MTM CHA CHB CCFE CCFMSK CCFVALW Figure 13-97. Message Buffer Cycle Counter Filter Registers (MBCCFRn) Table 13-79. MBCCFRn Field Descriptions Field Description MTM Message Buffer Transmission Mode — This control bit applies only to transmit message buffers and defines the transmission mode.

0 Event transmission mode

1 State transmission mode

14–13 CHA CHB Channel Assignment — These control bits define the channel assignment and control the receive and transmit behavior of the message buffer according to Table 13-80. CCFE Cycle Counter Filtering Enable — This control bit is used to enable and disable the cycle counter filtering.

0 Cycle counter filtering disabled

1 Cycle counter filtering enabled

Table 13-78. MBCCSRn Field Descriptions (Sheet 3 of 3) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

538 Freescale Semiconductor

If at least one message buffer assigned to a certain slot is assigned to both channels, then all message buffers assigned to this slot have to be assigned to both channels. Otherwise, the message buffer configuration is illegal and the result of the message buffer search is not defined.

13.5.2.68 Message Buffer Frame ID Registers (MBFIDRn)

Write: POC:config or MB_DIS 11–6 CCFMSK Cycle Counter Filtering Mask — This field defines the filter mask for the cycle counter filtering. 5–0 CCFVAL Cycle Counter Filtering Value — This field defines the filter value for the cycle counter filtering. Table 13-80. Channel Assignment Description CHA CHB Transmit Message Buffer Receive Message Buffer static segment dynamic segment static segment dynamic segment 1 1 transmit on both channel A and channel B transmit on channel A only store first valid frame received on either channel A or channel B store first valid frame received on channel A, ignore channel B 0 1 transmit on channel B transmit on channel B store first valid frame received on channel B store first valid frame received on channel B 1 0 transmit on channel A transmit on channel A store first valid frame received on channel A store first valid frame received on channel A 0 0 no frame transmission no frame transmission no frame stored no frame stored Module Base + 0x0104 (MBFIDR0) Module Base + 0x010C (MBFIDR1) ... Module Base + 0x01FC (MBFIDR31) 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 00000 FIDW Figure 13-98. Message Buffer Frame ID Registers (MBFIDRn) Table 13-79. MBCCFRn Field Descriptions Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 539

13.5.2.69 Message Buffer Index Registers (MBIDXRn)

Write: POC:config or MB_DIS Table 13-81. MBFIDRn Field Descriptions Field Description 10–0 FID Frame ID — The semantic of this field depends on the message buffer transfer type.

• Receive Message Buffer: This field is used as a filter value to determine if the message buffer is used for reception of a message received in a slot with the slot ID equal to FID.
• Transmit Message Buffer:This field is used to determine the slot in which the message in this message buffer should be transmitted. Module Base + 0x0106 (MBIDXR0) Module Base + 0x010E (MBIDXR1) ... Module Base + 0x01FE (MBIDXR31) 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 R 0000000000 MBIDXW Figure 13-99. Message Buffer Index Registers (MBIDXRn) Table 13-82. MBIDXRn Field Descriptions Field Description 5–0 MBIDX Message Buffer Index — This field provides the index of the message buffer header field of the physical message buffer that is currently associated with this message buffer. The application writes the index of the initially associated message buffer header field into this register. The FlexRay block updates this register after frame reception or transmission.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

540 Freescale Semiconductor

13.6 Functional Description

This section provides a detailed description of the functionality implemented in the FlexRay block.

13.6.1 Message Buffer Concept

The FlexRay block uses a data structure calledmessage buffer to store frame data, configuration, control, and status data. Each message buffer consists of two parts, themessage buffer control dataand thephysical message buffer.The message buffer control data are located in dedicated registers. The structure of the message buffer control data depends on the message buffer type and is described in Section 13.6.3, “Message Buffer Types”. The physical message buffer is located in the FRM and is described in Section 13.6.2, “Physical Message Buffer”.

13.6.2 Physical Message Buffer

All FlexRay messages and related frame and slot status information of received frames and of frames to be transmitted to the FlexRay bus are stored in data structures called physical message buffers. The physical message buffers are located in the FRM.The structure of a physical message buffer is depicted in Figure 13-100. A physical message buffer consists of two fields, the message buffer header field and the message buffer data field. The message buffer header field contains the frame header, the data field offset, and the slot status.The message buffer data field contains the frame data. The connection between the two fields is established by the data field offset. Figure 13-100. Physical Message Buffer Structure

13.6.2.1 Message Buffer Header Field

The message buffer header field is a contiguous region in the FRM and occupies ten bytes. It contains the frame header, the data field offset, and the slot status. Its structure is shown inFigure 13-100. The physical start address SADR_MBHF of the message buffer header field must be 16-bit aligned.

13.6.2.1.1 Frame Header

The frame header occupies the first six bytes in the message buffer header field. It contains all FlexRay frame header related information according to the FlexRay Communications System Protocol Data Field Offset Frame Data Message Buffer Header Field Message Buffer Data Field Slot StatusFrame Header SADR_MBDF SADR_MBHF System Memory

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 541 Specification, Version 2.1 Rev A. A detailed description of the usage and the content of the frame header

13.6.2.1.2 Data Field Offset

The data field offset follows the frame header in the message buffer data field and occupies two bytes. It contains the offset of the corresponding message buffer data field with respect to the FlexRay block FRM base address as provided by SYS_MEM_BASE_ADDR field in the System Memory Base Address High Register (SYMBADHR) and System Memory Base Address Low Register (SYMBADLR)”. The data field offset is used to determine the start address SADR_MBDF of the corresponding message buffer data field in the FRM according to Equation 13-2. SADR_MBDF = [Data Field Offset] + SYS_MEM_BASE_ADDR Eqn. 13-2

13.6.2.1.3 Slot Status

The slot status occupies the last two bytes of the message buffer header field. It provides the slot and frame status related information according to the FlexRay Communications System Protocol Specification, Version 2.1 Rev A. A detailed description of the content and usage of the slot status is provided in

13.6.2.2 Message Buffer Data Field

The message buffer data field is a contiguous area of 2-byte entities. This field contains the frame payload data, or a part of it, of the frame to be transmitted to or received from the FlexRay bus. The minimum length of this field depends on the specific message buffer configuration and is specified in the message buffer descriptions given in Section 13.6.3, “Message Buffer Types”.

13.6.3 Message Buffer Types

The FlexRay block provides three different types of message buffers.

• Individual Message Buffers
• Receive Shadow Buffers
• Receive FIFO Buffers For each message buffer type the structure of the physical message buffer is identical. The message buffer types differ only in the structure and content of message buffer control data, which control the related physical message buffer. The message buffer control data are described in the following sections.

13.6.3.1 Individual Message Buffers

The individual message buffers are used for all types of frame transmission and for dedicated frame reception based on individual filter settings for each message buffer. The FlexRay block supports three types of individual message buffers, which are described in Section 13.6.6, “Individual Message Buffer Functional Description”.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

542 Freescale Semiconductor

Each individual message buffer consists of two parts, the physical message buffer, which is located in the FRM, and the message buffer control data, which are located in dedicated registers. The structure of an individual message buffer is given in Figure 13-101. Each individual message buffer has a message buffer number n assigned, which determines the set of message buffer control registers associated to this individual message buffer. The individual message buffer with message buffer number n is controlled by the registers MBCCSRn, MBCCFRn, MBFIDRn, and MBIDXRn. The connection between the message buffer control registers and the physical message buffer is established by the message buffer index field MBIDX in theMessage Buffer Index Registers (MBIDXRn). The start address SADR_MBHF of the related message buffer header field in the FRM is determined according to Equation 13-3. SADR_MBHF = (MBIDXRn[MBIDX] * 10) + SYS_MEM_BASE_ADDR Eqn. 13-3 Figure 13-101. Individual Message Buffer Structure

13.6.3.1.1 Individual Message Buffer Segments

The set of the individual message buffers can be split up into two message buffer segments using the Message Buffer Segment Size and Utilization Register (MBSSUTR). All individual message buffers with a message buffer number n <= MBSSUTR.LAST_MB_SEG1 belong to the first message buffer segment. All individual message buffers with a message buffer number n > MBSSUTR.LAST_MB_SEG1 belong to the second message buffer segment. The following rules apply to the length of the message buffer data field:

• all physical message buffers associated to individual message buffers that belong to the same message buffer segment must have message buffer data fields of the same length
• the minimum length of the message buffer data field for individual message buffers in the first message buffer segment is 2 * MBDSR.MBSEG1DS bytes
• the minimum length of the message buffer data field for individual message buffers assigned to the second segment is 2 * MBDSR.MBSEG2DS bytes. MBFIDRn Message Buffer Control Registers MBCCSRn MBCCFRn MBIDXRn (min) MBDSR[MBSEG1DS] * 2 bytes / MBDSR[MBSEG2DS] * 2 bytes Data Field Offset Frame Data Message Buffer Header Field Message Buffer Data Field Slot StatusFrame Header SADR_MBDF SADR_MBHF System Memory

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 543

13.6.3.2 Receive Shadow Buffers

The receive shadow buffers are required for the frame reception process for individual message buffers. The FlexRay block provides four receive shadow buffers, one receive shadow buffer per channel and per message buffer segment. Each receive shadow buffer consists of two parts, the physical message buffer located in the FRM and the receive shadow buffer control registers located in dedicated registers. The structure of a receive shadow buffer is shown inFigure 13-102. The four internal shadow buffer control registers can be accessed by the Receive Shadow Buffer Index Register (RSBIR). The connection between the receive shadow buffer control register and the physical message buffer for the selected receive shadow buffer is established by the receive shadow buffer index field RSBIDX in the Receive Shadow Buffer Index Register (RSBIR). The start address SADR_MBHF of the related message buffer header field in the FRM is determined according to Equation 13-4. SADR_MBHF = (RSBIR[RSBIDX] * 10) + SYS_MEM_BASE_ADDR Eqn. 13-4 The length required for the message buffer data field depends on the message buffer segment that the receive shadow buffer is assigned to. For the receive shadow buffers assigned to the first message buffer segment, the length must be the same as for the individual message buffers assigned to the first message buffer segment. For the receive shadow buffers assigned to the second message buffer segment, the length must be the same as for the individual message buffers assigned to the second message buffer segment. The receive shadow buffer assignment is described in Receive Shadow Buffer Index Register (RSBIR). Figure 13-102. Receive Shadow Buffer Structure

13.6.3.3 Receive FIFO

The receive FIFO implements a frame reception system based on the FIFO concept. The FlexRay block provides two independent receive FIFOs, one per channel. A receive FIFO consists of a set of physical message buffers in the FRM and a set of receive FIFO control registers located in dedicated registers. The structure of a receive FIFO is given in Figure 13-103. RSBIDX[3] RSBIDX[2] RSBIDX[1] RSBIDX[0] Receive Shadow Buffer Control Register (min) MBDSR[MBSEG1DS] * 2 bytes / MBDSR[MBSEG2DS] * 2 bytes Data Field Offset Frame Data Message Buffer Header Field Message Buffer Data Field Slot StatusFrame Header SADR_MBDF SADR_MBHF System Memory

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

544 Freescale Semiconductor

The connection between the receive FIFO control registers and the set of physical message buffers is established by the start index field SIDX in the Receive FIFO Start Index Register (RFSIR), the FIFO depth field FIFO_DEPTH in theReceive FIFO Depth and Size Register (RFDSR), and the read index field RDIDX Receive FIFO A Read Index Register (RFARIR) / Receive FIFO B Read Index Register (RFBRIR). The start address SADR_MBHF_1 of the first message buffer header field that belongs to the receive FIFO in the FRM is determined according to Equation 13-5. SADR_MBHF[1] = (RFSIR[SIDX] * 10) + SYS_MEM_BASE_ADDR Eqn. 13-5 The start address SADR_MBHF[n] of the last message buffer header field that belongs to the receive FIFO in the FRM is determined according to Equation 13-6. SADR_MBHF[n] = ((RFSIR[SIDX] + RFDSR[FIFO_DEPTH]) * 10) + SYS_MEM_BASE_ADDR Eqn. 13-6 NOTE All message buffer header fields assigned to a receive FIFO must be a contiguous region. Figure 13-103. Receive FIFO Structure RFBRIRRFDSR[B] RFSIR[B] RFARIRRFDSR[A] RFSIR[A] Frame Header[1] Slot Status[1]Data Field Offset[1] Receive FIFO Control Register Message Buffer Header Fields Message Buffer Data Fields Frame Header[n] Slot Status[n]Data Field Offset[n] (min) RFDSR[ENTRY_SIZE] * 2 bytes RFDSR[FIFO_DEPTH] Frame Header[i] Slot Status[i]Data Field Offset[i] Frame Data[n] SADR_MBDF[n] Frame Data[i] SADR_MBDF[i] Frame Data[1] SADR_MBDF[1] RFDSR[FIFO_DEPTH] SADR_MBHF[n] SADR_MBHF[i] SADR_MBHF[1] System Memory

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 545

13.6.3.4 Message Buffer Configuration and Control Data

This section describes the configuration and control data for each message buffer type.

13.6.3.4.1 Individual Message Buffer Configuration Data

Before an individual message buffer can be used for transmission or reception, it must be configured. There is a set of common configuration parameters that applies to all individual message buffers and a set of configuration parameters that applies to each message buffer individually. Common Configuration Data The set of common configuration data for individual message buffers is located in the following registers.

• Message Buffer Data Size Register (MBDSR) The MBSEG2DS and MBSEG1DS fields define the minimum length of the message buffer data field with respect to the message buffer segment.
• Message Buffer Segment Size and Utilization Register (MBSSUTR) The LAST_MB_SEG1 and LAST_MB_UTIL fields define the segmentation of the individual message buffers and the number of individual message buffers that are used. For more details, see Section 13.6.3.1.1, “Individual Message Buffer Segments” Specific Configuration Data The set of message buffer specific configuration data for individual message buffers is located in the following registers.
• Message Buffer Configuration, Control, Status Registers (MBCCSRn) The MCM, MBT, MTD bits configure the message buffer type.
• Message Buffer Cycle Counter Filter Registers (MBCCFRn) The MTM, CHA, CHB bits configure the transmission mode and the channel assignment. The CCFE, CCFMSK, and CCFV AL bits and fields configure the cycle counter filter.
• Message Buffer Frame ID Registers (MBFIDRn) For a transmit message buffer, the FID field is used to determine the slot in which the message in this message buffer will be transmitted.
• Message Buffer Index Registers (MBIDXRn) This MBIDX field provides the index of the message buffer header field of the physical message buffer that is currently associated with this message buffer.

13.6.3.5 Individual Message Buffer Control Data

During normal operation, each individual message buffer can be controlled by the control and trigger bits CMT, LCKT, EDT, and MBIE in theMessage Buffer Configuration, Control, Status Registers (MBCCSRn).

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

546 Freescale Semiconductor

13.6.3.6 Receive Shadow Buffer Configuration Data

Before frame reception into the individual message buffers can be performed, the receive shadow buffers must be configured. The configuration data are provided by the Receive Shadow Buffer Index Register (RSBIR). For each receive shadow buffer, the application provides the message buffer header index. When the protocol is in the POC:normal active or POC:normal passive state, the receive shadow buffers are under full FlexRay block control.

13.6.3.7 Receive FIFO Control and Configuration Data

This section describes the configuration and control data for the two receive FIFOs.

13.6.3.7.1 Receive FIFO Configuration Data

The FlexRay block provides two completely independent receive FIFOs, one per channel. Each FIFO has its own set of configuration data. The configuration data are located in the following registers:

• Receive FIFO Start Index Register (RFSIR)
• Receive FIFO Depth and Size Register (RFDSR)
• Receive FIFO Message ID Acceptance Filter Value Register (RFMIDAFVR)
• Receive FIFO Message ID Acceptance Filter Mask Register (RFMIAFMR)
• Receive FIFO Frame ID Rejection Filter Value Register (RFFIDRFVR)
• Receive FIFO Frame ID Rejection Filter Mask Register (RFFIDRFMR)
• Receive FIFO Range Filter Configuration Register (RFRFCFR)

13.6.3.7.2 Receive FIFO Control Data

The application can access the receive FIFO at any time using the values provided in theReceive FIFO A Read Index Register (RFARIR) and Receive FIFO B Read Index Register (RFBRIR). To update the Receive FIFO A Read Index Register (RFARIR), the application must write 1 to the FIFO A Not Empty Interrupt Flag FNEAIF in the Global Interrupt Flag and Enable Register (GIFER). To update theReceive FIFO B Read Index Register (RFBRIR) the application must write 1 to the FIFO B Not Empty Interrupt Flag FNEBIF in theGlobal Interrupt Flag and Enable Register (GIFER). As long as the FIFO is not empty, each update increments the related read index. If the read index has reached the last FIFO entry, it wraps back to the FIFO start index.

13.6.4 FlexRay Memory Layout

The FlexRay block supports a wide range of possible layouts for the FRM. Figure 13-104 shows an example layout. The following set of rules applies to the layout of the FRM:

• The FRM is a contiguous region.
• The FRM size is maximum 64 Kbytes.
• The FRM starts at a 16 byte boundary. The FRM contains three areas: themessage buffer header area, the message buffer data area, and thesync frame table area. The areas are described in this section.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 547 Figure 13-104. Example of FRM Layout

13.6.4.1 Message Buffer Header Area

The message buffer header area contains all message buffer header fields of the physical message buffers for all message buffer types. The following rules apply to the message buffer header fields for the three type of message buffers. 1. The start address SADR_MBHF of each message buffer header field forindividual message buffers and receive shadow buffers must fulfill Equation 13-7. SADR_MBHF = (i * 10) + SYS_MEM_BASE_ADDR; (0 <= i < 64) Eqn. 13-7 2. The start address SADR_MBHF of each message buffer header field for the receive FIFO must fulfill Equation 13-8. SADR_MBHF = (i * 10) + SYS_MEM_BASE_ADDR; (0 <= i < 1024) Eqn. 13-8 3. The message buffer header fields for a receive FIFO have to be a contiguous area.

13.6.4.2 Message Buffer Data Area

The message buffer data area contains all the message buffer data fields of the physical message buffers. Each message buffer data field must start at a 16-bit boundary. Message Buffer Header Area FRM Message Buffer Data Area Sync Frame Table Area Data Field OffsetFrame Header Slot Status Data Field OffsetFrame Header Slot Status Message Buffer Header Fields Individual Message Buffers Receive Shadow Buffers Data Field OffsetFrame Header Slot Status Data Field OffsetFrame Header Slot Status Message Buffer Header Fields Receive FIFO A Data Field OffsetFrame Header Slot Status Data Field OffsetFrame Header Slot Status Message Buffer Header Fields Receive FIFO B Data Field OffsetFrame Header Slot Status 10 bytesSYS_MEM_BASE_ADDR System Memory

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

548 Freescale Semiconductor

13.6.4.3 Sync Frame Table Area

The sync frame table area is used to provide a copy of the internal sync frame tables for application access. Refer to Section 13.6.12, “Sync Frame ID and Sync Frame Deviation Tables” for the description of the sync frame table area.

13.6.5 Physical Message Buffer Description

This section provides a detailed description of the usage and the content of the two parts of a physical message buffer, the message buffer header field and the message buffer data field.

13.6.5.1 Message Buffer Protection and Data Consistency

The physical message buffers are located in the FRM. The FlexRay block provides no means to protect the FRM from uncontrolled or illegal host or other client write access. To ensure data consistency of the physical message buffers, the application must follow the write access scheme that is given in the description of each of the physical message buffer fields.

13.6.5.2 Message Buffer Header Field Description

This section provides a detailed description of the usage and content of the message buffer header field. A description of the structure of the message buffer header fields is given in Section 13.6.2.1, “Message Buffer Header Field”. Each message buffer header field consists of three sections: the frame header section, the data field offset, and the slot status section. For a detailed description of the Data Field Offset,

13.6.5.2.1 Frame Header Section Description

Frame Header Section Content The semantic and content of the frame header section depends on the message buffer type. For individual receive message buffers and receive FIFOs, the frame header receives the frame header data of the first valid frame received on the assigned channels. If a receive message buffer is assigned to both channels, the first valid frame received on either channel A or channel B is stored. For receive shadow buffers, the frame header receives the frame header data of the current frame received regardless of whether the frame is valid or not. For single and double transmit message buffers, the application writes the frame header of the frame to be transmitted into this location. The frame header will be read out when the frame is transferred to the FlexRay bus. The structure of the frame header in the message buffer header field is given inFigure 13-105. A detailed description of the frame header fields is given in Table 13-84.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 549 Figure 13-105. Frame Header Structure Frame Header Section Access The frame header is located in the FRM. To ensure data consistency, the application must follow the write access scheme described below. For receive message buffers, receive shadow buffers, and receive FIFOs, the application must not write to the frame header field. For transmit message buffers, the application must follow the write access restrictions given in Table 13- 83. This table shows the condition under which the application can write to the frame header entries. In general, the application can modify all frame header entries when the protocol is in the POC:config state or when the message buffer is disabled. For message buffers assigned to the dynamic segment, the application can modify all frame header entries except the frame ID when the message buffer is locked. The frame header entries NUF, SYF, SUF, and CYCCNT are not used for frame transmission. These values are generated internally before frame transmission depending on the current transmission state and configuration. For transmit message buffers assigned to thestatic segment, the PLDLEN value must be equal to the value of the payload_length_static field in theProtocol Configuration Register 19 (PCR19). If this is not fulfilled, the static payload length error flag SPL_EF in the CHI Error Flag Register (CHIERFR) is set when the message buffer is under transmission. The PE generates a syntactically and semantically correct frame with payload_length_static payload words and the payload length field in the frame header set to payload_length_static. 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 0x0 R* PPI NUF SYF SUF FID 0x2 CYCCNT PLDLEN 0x4 HDCRC = not used for TX message buffers, not updated for RX message buffers Table 13-83. Frame Header Write Access Constraints Field TX Single Buffered Double Buffered Static Segment Dynamic Segment Static Segment Dynamic Segment Commit Side Transmit Side Commit Side Transmit Side FID POC:config or MB_DIS R*, PPI NUF , SYF SUF CYCCNT PLDLEN HDCRD POC:config or MB_DIS POC:config or MB_DIS or MB_LCK POC:config or MB_DIS POC:config or MB_DIS or MB_LCK POC:config or MB_DIS

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

550 Freescale Semiconductor

For transmit message buffers assigned to the dynamic segment, the PLDLEN value must be less than or equal to the value of the max_payload_length_dynamic field in the Protocol Configuration Register 24 (PCR24). If this is not fulfilled, the dynamic payload length error flag DPL_EF in the CHI Error Flag Register (CHIERFR) is set when the message buffer is under transmission. The PE generates a syntactically and semantically correct dynamic frame with PLDLEN payload words and the payload length field in the frame header set to PLDLEN. Table 13-84. Frame Header Field Descriptions Field Description R* Reserved Bit — This bit corresponds to the Reserved bit in the FlexRay frame header.

• For receive and FIFO message buffers, this is a status bit and represents the value of the Reserved bit in the frame received on the FlexRay bus in the corresponding slot.
• For transmit message buffers, this is a control bit. The FlexRay block transmits this within the frame header. Note: For protocol compliant operation, this control bit must be set to 0 for transmit message buffers. PPI Payload Preamble Indicator — This bit corresponds to the Payload Preamble Indicator in the FlexRay frame header.
• For receive and FIFO message buffers, this is a status bit and represents the value of thePayload Preamble Indicator of the first valid frame received on the FlexRay in the slot indicated by the CYCCNT field.
• For transmit message buffers, this is a control bit. The FlexRay block uses this value to set the Payload Preamble Indicator in the frame header of the frame to transmit.

0 No network management vector or message ID in frame payload data

1 Static Segment: Frame payload data contains network management vector

Dynamic Segment: Frame payload data contains message ID NUF Null Frame Indicator — This bit corresponds to the Null Frame Indicator in the FlexRay frame header.

• For receive message buffers and receive FIFOs, this is a status bit and represents the value of theNull Frame Indicator of the first valid frame received on the FlexRay bus in the slot indicated by the CYCCNT field.
• For transmit message buffers, the value of this bit is ignored. The FlexRay block determines internally whether a null frame or non-null frame must be transmitted and sets the Null Frame Indicator accordingly.

0 Null frame received

1 Normal frame received

SYF Sync Frame Indicator — This bit corresponds to the Sync Frame Indicator in the FlexRay frame header.

• For receive message buffers and receive FIFOs, this is a status bit and represents the value of theSync Frame Indicator of the first valid frame received on the FlexRay bus in the slot indicated by the CYCCNT field.
• For transmit message buffers, the value of this bit is ignored. The FlexRay block determines internally whether a sync frame must be transmitted and sets the Sync Frame Indicator accordingly. SUF Startup Frame Indicator — This bit corresponds to the Startup Frame Indicator in the FlexRay frame header.
• For receive message buffers and receive FIFOs, this is a status bit and represents the value of the Startup Frame Indicator of the first valid frame received on the FlexRay bus in the slot indicated by the CYCCNT field
• For transmit message buffers, the value of this bit is ignored. The FlexRay block determines internally whether a startup frame must be transmitted and sets the Startup Frame Indicator accordingly. FID Frame ID
• For receive message buffers and receive FIFOs, this field provides the value of the Frame ID field of the first valid frame received on the FlexRay bus in the slot indicated by the CYCCNT field.
• For transmit message buffers, this field provides the value that will be transmitted in the Frame ID field of the FlexRay frame. Note: For transmit message buffers, the application must program this field to the same value as in the corresponding Message Buffer Frame ID Registers (MBFIDRn). If the FlexRay block detects a mismatch while transmitting the frame header, it will set the frame ID error flag FID_EF in theCHI Error Flag Register (CHIERFR). The value of the FID field will be ignored and replaced by the value provided in theMessage Buffer Frame ID Registers (MBFIDRn).

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 551

13.6.5.2.2 Data Field Offset Description

The application shall program the Data Field Offset when configuring the message buffers either in the POC:config state or when the message buffer is disabled.

13.6.5.2.3 Slot Status Description

The slot status is a read-only structure for the application and a write-only structure for the FlexRay block. The meaning and content of the slot status in the message buffer header field depends on the message buffer type. Receive Message Buffer and Receive FIFO Slot Status Description This section describes the slot status structure for the individual receive message buffers and receive FIFOs. The content of the slot status structure for receive message buffers depends on the message buffer type and on the channel assignment for individual receive message buffers as given byTable 13-85. CYCCNT Cycle Count

• For receive message buffer and receive FIFOs, this field provides the number of the communication cycle in which the frame stored in this message buffer was received.
• For transmit message buffers, the value of this field is ignored. The FlexRay block will overwrite this value with the current cycle count value when it transmits the frame. PLDLEN Payload Length in 16-Bit Units
• For receive message buffers and receive FIFOs, this field provides the value of the payload length field of the first valid frame received on the FlexRay bus in the slot indicated by the FID field.
• For transmit message buffers assigned to the static segment, this value is ignored for the frame generation. The FlexRay block uses the value in the PCR19.paylaod_length_static to set the value of thePayload length field in the transmitted frame.
• For transmit message buffers assigned to the dynamic segment, this value is used to set the value of the Payload length field in the transmitted frame. Note: The value of this field is given in numbers of 16-bit units HDCRC Header CRC
• For receive and FIFO message buffers, this field provides the value of theHeader CRC of the received frame.
• For transmit message buffers, this field provides theHeader CRC value as it was given by the application.The FlexRay block transmits this value in the Header CRC field of the transmitted frame. Table 13-84. Frame Header Field Descriptions (continued) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

552 Freescale Semiconductor

The meaning of the bits in the slot status structure is explained in Table 13-86. Figure 13-106. Receive Message Buffer Slot Status Structure (ChAB) Figure 13-107. Receive Message Buffer Slot Status Structure (ChA) Figure 13-108. Receive Message Buffer Slot Status Structure (ChB) Table 13-85. Receive Message Buffer Slot Status Content Receive Message Buffer Type Slot Status Content Individual Receive Message Buffer assigned to both channels MBCCSRn.CHA=1 and MBCCSRn.CHB=1 see Figure 13-106 Individual Receive Message Buffer assigned to channel A MBCCSRn.CHA=1 and MBCCSRn.CHB=0 see Figure 13-107 Individual Receive Message Buffer assigned to channel B MBCCSRn.CHA=0 and MBCCSRn.CHB=1 see Figure 13-108 Receive FIFO Channel A Message Buffer see Figure 13-107 Receive FIFO Channel B Message Buffer see Figure 13-108 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R VFB SYB NFB SUB SEB CEB BVB CH VFA SYA NFA SUA SEA CEA BVA 0 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 VFA SYA NFA SUA SEA CEA BVA 0 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R VFB SYB NFB SUB SEB CEB BVB 1 0 0 0 0 0 0 0 0 Table 13-86. Receive Message Buffer Slot Status Field Descriptions Field Description Common Message Buffer Status Bits VFB Valid Frame on Channel B — protocol related variable: vSS!ValidFrame channel B 0 vSS!ValidFrame = 0 1 vSS!ValidFrame = 1 SYB Sync Frame Indicator Channel B — protocol related variable: vRF!Header!SyFIndicator channel B 0 vRF!Header!SyFIndicator = 0 1 vRF!Header!SyFIndicator = 1 NFB Null Frame Indicator Channel B — protocol related variable: vRF!Header!NFIndicator channel B 0 vRF!Header!NFIndicator = 0 1 vRF!Header!NFIndicator = 1 SUB Startup Frame Indicator Channel B — protocol related variable: vRF!Header!SuFIndicator channel B 0 vRF!Header!SuFIndicator = 0 1 vRF!Header!SuFIndicator = 1

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 553 Transmit Message Buffer Slot Status Description This section describes the slot status structure for transmit message buffers. Only the TCA and TCB status bits are directly related to the transmission process. All other status bits in this structure are related to a receive process that may have occurred. The content of the slot status structure for transmit message buffers depends on the channel assignment as given by Table 13-87. SEB Syntax Error on Channel B — protocol related variable: vSS!SyntaxError channel B 0 vSS!SyntaxError = 0 1 vSS!SyntaxError = 1 CEB Content Error on Channel B — protocol related variable: vSS!ContentError channel B 0 vSS!ContentError = 0 1 vSS!ContentError = 1 BVB Boundary Violation on Channel B — protocol related variable: vSS!BViolation channel B 0 vSS!BViolation = 0 1 vSS!BViolation = 1 CH Channel first valid received — This status bit applies only to receive message buffers assigned to the static segment and to both channels. It indicates the channel that has received thefirst valid frame in the slot. This flag is set to 0 if no valid frame was received at all in the subscribed slot. 0 first valid frame received on channel A, or no valid frame received at all 0 first valid frame received on channel B VFA Valid Frame on Channel A — protocol related variable: vSS!ValidFrame channel A 0 vSS!ValidFrame = 0 1 vSS!ValidFrame = 1 SYA Sync Frame Indicator Channel A — protocol related variable: vRF!Header!SyFIndicator channel A 0 vRF!Header!SyFIndicator = 0 1 vRF!Header!SyFIndicator = 1 NFA Null Frame Indicator Channel A — protocol related variable: vRF!Header!NFIndicator channel A 0 vRF!Header!NFIndicator = 0 1 vRF!Header!NFIndicator = 1 SUA Startup Frame Indicator Channel A — protocol related variable: vRF!Header!SuFIndicator channel A 0 vRF!Header!SuFIndicator = 0 1 vRF!Header!SuFIndicator = 1 SEA Syntax Error on Channel A — protocol related variable: vSS!SyntaxError channel A 0 vSS!SyntaxError = 0 1 vSS!SyntaxError = 1 CEA Content Error on Channel A — protocol related variable: vSS!ContentError channel A 0 vSS!ContentError = 0 1 vSS!ContentError = 1 BVA Boundary Violation on Channel A — protocol related variable: vSS!BViolation channel A 0 vSS!BViolation = 0 1 vSS!BViolation = 1 Table 13-86. Receive Message Buffer Slot Status Field Descriptions (continued) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

554 Freescale Semiconductor

The meaning of the bits in the slot status structure is described in Table 13-86. Figure 13-109. Transmit Message Buffer Slot Status Structure (ChAB) Figure 13-110. Transmit Message Buffer Slot Status Structure (ChA) Figure 13-111. Transmit Message Buffer Slot Status Structure (ChB) Table 13-87. Transmit Message Buffer Slot Status Content Transmit Message Buffer Type Slot Status Content Individual Transmit Message Buffer assigned to both channels MBCCSRn.CHA=1 and MBCCSRn.CHB=1 see Figure 13-109 Individual Transmit Message Buffer assigned to channel A MBCCSRn.CHA=1 and MBCCSRn.CHB=0 see Figure 13-110 Individual Transmit Message Buffer assigned to channel B MBCCSRn.CHA=0 and MBCCSRn.CHB=1 see Figure 13-111 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R VFB SYB NFB SUB SEB CEB BVB TCB VFA SYA NFA SUA SEA CEA BVA TCA 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 VFA SYA NFA SUA SEA CEA BVA TCA 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R VFB SYB NFB SUB SEB CEB BVB TCB 0 0 0 0 0 0 0 0 Table 13-88. Transmit Message Buffer Slot Status Structure Field Descriptions Field Description VFB Valid Frame on Channel B — protocol related variable: vSS!ValidFrame channel B 0 vSS!ValidFrame = 0 1 vSS!ValidFrame = 1 SYB Sync Frame Indicator Channel B — protocol related variable: vRF!Header!SyFIndicator channel B 0 vRF!Header!SyFIndicator = 0 1 vRF!Header!SyFIndicator = 1 NFB Null Frame Indicator Channel B — protocol related variable: vRF!Header!NFIndicator channel B 0 vRF!Header!NFIndicator = 0 1 vRF!Header!NFIndicator = 1 SUB Startup Frame Indicator Channel B — protocol related variable: vRF!Header!SuFIndicator channel B 0 vRF!Header!SuFIndicator = 0 1 vRF!Header!SuFIndicator = 1 SEB Syntax Error on Channel B — protocol related variable: vSS!SyntaxError channel B 0 vSS!SyntaxError = 0 1 vSS!SyntaxError = 1 CEB Content Error on Channel B — protocol related variable: vSS!ContentError channel B 0 vSS!ContentError = 0 1 vSS!ContentError = 1

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 555

13.6.5.3 Message Buffer Data Field Description

The message buffer data field is used to store the frame payload data, or a part of it, of the frame to be transmitted to or received from the FlexRay bus. The minimum required length of this field depends on the message buffer type that the physical message buffer is assigned to and is given inTable 13-89. The structure of the message buffer data field is given in Figure 13-112. BVB Boundary Violation on Channel B — protocol related variable: vSS!BViolation channel B 0 vSS!BViolation = 0 1 vSS!BViolation = 1 TCB Transmission Conflict on Channel B — protocol related variable: vSS!TxConflict channel B 0 vSS!TxConflict = 0 1 vSS!TxConflict = 1 VFA Valid Frame on Channel A — protocol related variable: vSS!ValidFrame channel A 0 vSS!ValidFrame = 0 1 vSS!ValidFrame = 1 SYA Sync Frame Indicator Channel A — protocol related variable: vRF!Header!SyFIndicator channel A 0 vRF!Header!SyFIndicator = 0 1 vRF!Header!SyFIndicator = 1 NFA Null Frame Indicator Channel A — protocol related variable: vRF!Header!NFIndicator channel A 0 vRF!Header!NFIndicator = 0 1 vRF!Header!NFIndicator = 1 SUA Startup Frame Indicator Channel A — protocol related variable: vRF!Header!SuFIndicator channel A 0 vRF!Header!SuFIndicator = 0 1 vRF!Header!SuFIndicator = 1 SEA Syntax Error on Channel A — protocol related variable: vSS!SyntaxError channel A 0 vSS!SyntaxError = 0 1 vSS!SyntaxError = 1 CEA Content Error on Channel A — protocol related variable: vSS!ContentError channel A 0 vSS!ContentError = 0 1 vSS!ContentError = 1 BVA Boundary Violation on Channel A — protocol related variable: vSS!BViolation channel A 0 vSS!BViolation = 0 1 vSS!BViolation = 1 TCA Transmission Conflict on Channel A — protocol related variable: vSS!TxConflict channel A 0 vSS!TxConflict = 0 1 vSS!TxConflict = 1 Table 13-89. Message Buffer Data Field Minimum Length physical message buffer assigned to minimum length defined by Individual Message Buffer in Segment 1 MBDSR.MBSEG1DS Receive Shadow Buffer in Segment 1 MBDSR.MBSEG1DS Individual Message Buffer in Segment 2 MBDSR.MBSEG2DS Receive Shadow Buffer in Segment 2 MBDSR.MBSEG2DS Receive FIFO for channel A RFDSR.ENTRY_SIZE (RFSR.SEL = 0) Table 13-88. Transmit Message Buffer Slot Status Structure Field Descriptions (continued) Field Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

556 Freescale Semiconductor

The FlexRay block will not access any locations outside the message buffer data field boundaries given by Table 13-89. Figure 13-112. Message Buffer Data Field Structure The message buffer data field is located in the FRM; thus, the FlexRay block has no means to control application write access to the field. To ensure data consistency, the application must follow a write and read access scheme.

13.6.5.3.1 Message Buffer Data Field Read Access

For transmit message buffers, the FlexRay block will not modify the content of the Message Buffer Data Field. Thus the application can read back the data at any time without any impact on data consistency. For receive message buffers the application must lock the related receive message buffer and retrieve the message buffer header index from the Message Buffer Index Registers (MBIDXRn). While the message buffer is locked, the FlexRay block will not update the Message Buffer Data Field. For receive FIFOs, the application can read the message buffer indicated by the Receive FIFO A Read Index Register (RFARIR)or the Receive FIFO B Read Index Register (RFBRIR)when the related receive FIFO non-empty interrupt flag FNEAIF or FNEBIF is set in theGlobal Interrupt Flag and Enable Register (GIFER). While the non-empty interrupt flag is set, the FlexRay block will not update the Message Buffer Data Field related to message buffer indicated by Receive FIFO A Read Index Register (RFARIR)or the Receive FIFO B Read Index Register (RFBRIR).

13.6.5.3.2 Message Buffer Data Field Write Access

For receive message buffers, receive shadow buffers, and receive FIFOs, the application must not write to the message buffer data field. For transmit message buffers, the application must follow the write access restrictions given in Table 13- 90. Receive FIFO for channel B RFDSR.ENTRY_SIZE (RFSR.SEL = 1) 1 5 1 4 1 3 1 2 1 1 1 0 9876543210 0x0 DATA0 / MID0 / NMV0 DATA1 / MID1 / NMV1 0x2 DATA2 / NMV2 DATA3 / NMV3 0xN-2 DATA N-2 DATA N-1 Table 13-89. Message Buffer Data Field Minimum Length physical message buffer assigned to minimum length defined by

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 557

13.6.6 Individual Message Buffer Functional Description

The FlexRay block provides three basic types of individual message buffers: 1. Single Transmit Message Buffers 2. Double Transmit Message Buffers 3. Receive Message Buffers Before an individual message buffer can be used, it must be configured by the application. After the initial configuration, the message buffer can be reconfigured later. The set of the configuration data for individual

13.6.6.1 Individual Message Buffer Configuration

The individual message buffer configuration consists of two steps. The first step is the allocation of the required amount of memory for the FRM. The second step is the programming of the message buffer configuration registers, which is described in this section.

13.6.6.1.1 Common Configuration Data

One part of the message buffer configuration data is common to all individual message buffers and the receive shadow buffers. These data can only be set when the protocol is in the POC:config state. The application configures the number of utilized individual message buffers by writing the message buffer number of the last utilized message buffer into the LAST_MB_UTIL field in the Message Buffer Segment Size and Utilization Register (MBSSUTR). Table 13-90. Frame Data Write Access Constraints Field single buffered double buffered commit side transmit side DATA, MID, NMV POC:config or MB_DIS or MB_LCK POC:config or MB_DIS or MB_LCK POC:config or MB_DIS Table 13-91. Frame Data Field Descriptions Field Description DATA[0:N-1] Message Data — Provides the message data received or to be transmitted. For receive message buffer and receive FIFOs, this field provides the message data received for this message buffer. For transmit message buffers, the field provides the message data to be transmitted. MID[0:1] Message Identifier — If the payload preamble bit PPI is set in the message buffer frame header, the MID field holds the message ID of a dynamic frame located in the message buffer. The receive FIFO filter uses the received message ID for message ID filtering. NMV[0:11] Network Management Vector— If the payload preamble bit PPI is set in the message buffer frame header, the network management vector field holds the network management vector of a static frame located in the message buffer. Note: The MID and NMV bytes replace the corresponding DATA bytes.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

558 Freescale Semiconductor

The application configures the size of the two segments of individual message buffers by writing the message buffer number of the last message buffer in the first segment into the LAST_MB_SEG1 field in the Message Buffer Segment Size and Utilization Register (MBSSUTR) The application configures the length of the message buffer data fields for both of the message buffer segments by writing to the MBSEG2DS and MBSEG1DS fields in theMessage Buffer Data Size Register (MBDSR). Depending on the current receive functionality of the FlexRay block, the application must configure the receive shadow buffers. For each segment and for each channel with at least one individual receive message buffer assigned, the application must configure the related receive shadow buffer using the Receive Shadow Buffer Index Register (RSBIR).

13.6.6.1.2 Specific Configuration Data

The second part of the message buffer configuration data is specific for each message buffer. These data can be changed only when either

• the protocol is in the POC:config state or
• the message buffer is disabled, i.e. MBCCSRn.EDS = 0 The individual message buffer type is defined by the MTD and MBT bits in the Message Buffer Configuration, Control, Status Registers (MBCCSRn) as given in Table 13-92. The message buffer specific configuration data are 1. MCM, MBT, MTD bits in Message Buffer Configuration, Control, Status Registers (MBCCSRn) 2. all fields and bits in Message Buffer Cycle Counter Filter Registers (MBCCFRn) 3. all fields and bits in Message Buffer Frame ID Registers (MBFIDRn) 4. all fields and bits in Message Buffer Index Registers (MBIDXRn) The meaning of the specific configuration data depends on the message buffer type, as given in the detailed “Receive Message Buffers”, and Section 13.6.6.4, “Double Transmit Message Buffer”.

13.6.6.2 Single Transmit Message Buffers

The section provides a detailed description of the functionality of single buffered transmit message buffers. A single transmit message buffer is used by the application to provide message data to the FlexRay block that will be transmitted over the FlexRay Bus. The FlexRay block uses the transmit message buffers to Table 13-92. Individual Message Buffer Types MBCCSRn.MTD MBCCSRn.MBT Individual Message Buffer Description 0 0 Receive Message Buffer 0 1 Reserved 1 0 Single Transmit Message Buffer 1 1 Double Transmit Message Buffer

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 559 provide information about the transmission process and status information about the slot in which message was transmitted. The individual message buffer with message buffer numbern is configured to be a single transmit message buffer by the following settings:

• MBCCSRn.MBT = 0 (single buffered message buffer)
• MBCCSRn.MTD = 1 (transmit message buffer)

13.6.6.2.1 Access Regions

To certain message buffer fields, both the application and the FlexRay block have access. To ensure data consistency, a message buffer locking scheme is implemented, which is used to control the access to the data, control, and status bits of a message buffer. The access regions for single transmit message buffers are depicted in Figure 13-113. A description of the regions is given in Table 13-93. If an region is active as indicated in Table 13-94, the access scheme given for that region applies to the message buffer. Figure 13-113. Single Transmit Message Buffer Access Regions The trigger bits MBCCSRn.EDT and MBCCSRn.LCKT, and the interrupt enable bit MBCCSRn.MBIE are not under access control and can be accessed from the application at any time. The status bits Table 13-93. Single Transmit Message Buffer Access Regions Description Region Access from Region used for Application Module CFG read/write - Message Buffer Configuration MSG read/write - Message Data and Slot Status Access NF - read-only Message Header Access for Null Frame Transmission TX - read/write Message Transmission and Slot Status Update CM - read-only Message Buffer Validation SR - read-only Message Buffer Search Message Buffer Data Field: DATA[0-N] Message Buffer Header Field: Frame Header MBCCSRn.CMT Message Buffer Header Field: Slot Status Message Buffer Header Field: Data Field Offset MBCCFRn.MTM/CHA/CHB/CCF* MBFIDRn.FID MBIDXRn.MBIDX MBCCSRn.MBT/MTD TX NF CMT SR CFG MSG

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

560 Freescale Semiconductor

MBCCSRn.EDS and MBCCSRn.LCKS are not under access control and can be accessed from the FlexRay block at any time. The interrupt flag MBCCSnR.MBIF is not under access control and can be accessed from the application and the FlexRay block at any time. FlexRay block clear access has higher priority. The FlexRay block restricts its access to the regions depending on the current state of the message buffer. The application must adhere to these restrictions in order to ensure data consistency. The transmit message buffer states are given in Figure 13-114. A description of the states is given in Table 13-94, which also provides the access scheme for the access regions. The status bits MBCCSRn.EDS and MBCCSRn.LCKS provide the application with the required message buffer status information. The internal status information is not visible to the application.

13.6.6.2.2 Message Buffer States

This section describes the transmit message buffer states and provides a state diagram. Figure 13-114. Single Transmit Message Buffer States Table 13-94. Single Transmit Message Buffer State Description (Sheet 1 of 2) State MBCCSRn Access Region

Description

EDS LCKS Appl. Module Idle 1 0 – CM, SR Idle - Message Buffer is idle. Included in message buffer search. HDis 0 0 CFG – Disabled - Message Buffer under configuration. Excluded from message buffer search. HDisLck 0 1 CFG – Disabled and Locked - Message Buffer under configuration. Excluded from message buffer search. HLck 1 1 MSG SR Locked - Applications access to data, control, and status. Included in message buffer search. HLckCCSa HL HLck HDisLck HDis Idle CCTx HE HLckCCMa SA CCSa CCMa SA MA TX RESET_STATE DSS DSS CCNf SSS STS HLckCCNf STS SSS STS HU HD HL HU HL HU HL HU HL HU HE HD STS CCSuSU SSSDSS DSS MA

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 561

13.6.6.2.3 Message Buffer Transitions

The application transitions can be triggered by the application using the commands described inTable 13- 95. The application issues the commands by writing to theMessage Buffer Configuration, Control, Status Registers (MBCCSRn). Only one command can be issued with one write access. Each command is executed immediately. If the command is ignored, it must be issued again. The enable and disable commands issued by writing 1 to the trigger bit MBCCSRn.EDT. The transition that will be triggered by each of these command depends on the current value of the status bit MBCCSRn.EDS. If the command triggers the disable transition HD and the message buffer is in one of the states CCSa, HLckCCSa, CCMa, HLckCCMa, CCNf, HLckCCNf, or CCTx, the disable transition has no effect (command is ignored) and the message buffer state is not changed. No notification is given to the application. The lock and unlock commands issued by writing 1 to the trigger bit MBCCSRn.LCKT. The transition that will be triggered by each of these commands depends on the current value of the status bit MBCCSRn.LCKS. If the command triggers the lock transition HL and the message buffer is in the state CCTx, the lock transition has no effect (command is ignored) and message buffer state is not changed. In this case, the message buffer lock error flag LCK_EF in the CHI Error Flag Register (CHIERFR) is set. CCSa 10–– Slot Assigned - Message buffer assigned to next static slot. Ready for Null Frame transmission. HLckCCSa 1 1 MSG – Locked and Slot Assigned - Applications access to data, control, and status.Message buffer assigned to next static slot CCNf 1 0 – NF Null Frame Transmission Header is used for null frame transmission. HLckCCNf 1 1 MSG NF Locked and Null Frame Transmission - Applications access to data, control, and status. Header is used for null frame transmission. CCMa 1 0 – CM Message Available - Message buffer is assigned to next slot and cycle counter filter matches. HLckCCMa 1 1 MSG – Locked and Message Available - Applications access to data, control, and status. Message buffer is assigned to next slot and cycle counter filter matches. CCTx 1 0 – TX Message Transmission - Message buffer data transmit. Payload data from buffer transmitted CCSu 1 0 – TX Status Update - Message buffer status update. Update of status flags, the slot status field, and the header index. Table 13-95. Single Transmit Message Buffer Application Transitions Transition Command Condition Description HE MBCCSRn.EDT:= 1 MBCCSRn.EDS = 0 Application triggers message buffer enable. HD MBCCSRn.EDS = 1 Application triggers message buffer disable. Table 13-94. Single Transmit Message Buffer State Description (Sheet 2 of 2) State MBCCSRn Access Region EDS LCKS Appl. Module

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

562 Freescale Semiconductor

The module transitions that can be triggered by the FlexRay block are described in Table 13-96. Each transition will be triggered for certain message buffers when the related condition is fulfilled. Transition Priorities The application can trigger only one transition at a time. There is no need to specify priorities among them. As shown in the first part ofTable 13-97, the module transitions have a higher priority than the application transitions. For all states except the CCMa state, both a lock/unlock transition HL/HD and a module transition can be executed at the same time. The result state is reached by first applying the application transition and subsequently the module transition to the intermediately reached state. For example, if the message buffer is in the HLck state and the application unlocks the message buffer by the HU transition and the module triggers the slot assigned transition SA, the intermediate state is Idle and the resulting state is CCSa. The priorities among the module transitions is given in the second part of Table 13-97. HL MBCCSRn.LCKT:= 1 MBCCSRn.LCKS = 0 Application triggers message buffer lock. HU MBCCSRn.LCKS = 1 Application triggers message buffer unlock. Table 13-96. Single Transmit Message Buffer Module Transitions Transition Condition Description SA slot match and static slot Slot Assigned - Message buffer is assigned to next static slot. MA slot match and CycleCounter match Message Available - Message buffer is assigned to next slot and cycle counter filter matches. TX slot start and MBCCSRn.CMT = 1 Transmission Slot Start - Slot Start and commit bit CMT is set. In case of a dynamic slot, pLatestTx is not exceeded. SU status updated Status Updated - Slot Status field and message buffer status flags updated. Interrupt flag set. STS static slot start Static Slot Start - Start of static slot. DSS dynamic slot start or symbol window start or NIT start Dynamic Slot or Segment Start. - Start of dynamic slot or symbol window or NIT. SSS slot start or symbol window start or NIT start Slot or Segment Start - Start of static slot or dynamic slot or symbol window or NIT. Table 13-97. Single Transmit Message Buffer Transition Priorities State Priorities Description module vs. application Idle, HLck SA > HD MA > HD Slot Assigned > Message Buffer Disable Message Available > Message Buffer Disable CCMa TX > HL Transmission Start > Message Buffer Lock Table 13-95. Single Transmit Message Buffer Application Transitions Transition Command Condition Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 563

13.6.6.2.4 Transmit Message Setup

To transmit a message over the FlexRay bus, the application writes the message data into the message buffer data field and sets the commit bit CMT in the Message Buffer Configuration, Control, Status Registers (MBCCSRn). The physical access to the message buffer data field is described in Section 13.6.3.1, “Individual Message Buffers”. As indicated by Table 13-94, the application shall write to the message buffer data field and change the commit bit CMT only if the transmit message buffer is in one of the states HDis, HDisLck, HLck, HLckCCSa, HLckCCMa, or HLckCCMa. The application can change the state of a message buffer if it issues the appropriate commands shown in Table 13-95. The state change is indicated through the MBCCSRn.EDS and MBCCSRn.LCKS status bits. If the transmit message buffer enters one of the states HDis, HDisLck, HLck, HLckCCSa, HLckCCMa, or HLckCCMa the MBCCSRn.DV AL flag is negated.

13.6.6.2.5 Message Transmission

As a result of the message buffer search described inSection 13.6.7, “Individual Message Buffer Search”, the FlexRay block triggers the message available transition MA for up to two transmit message buffers. This changes the message buffer state from Idle to CCMa and the message buffers can be used for message transmission in the next slot. The FlexRay block transmits a message from a message buffer if both of the following two conditions are fulfilled at the start of the transmission slot: 1. the message buffer is in the message available state CCMa 2. the message data are still valid, i.e. MBCCSRn.CMT = 1 In this case, the FlexRay block triggers the TX transition and changes the message buffer state to CCTx. A transmit message buffer timing and state change diagram for message transmission is given in Figure 13-115. In this example, the message buffer with message buffer number n is Idle at the start of the search slot, matches the slot and cycle number of the next slot, and message buffer data are valid, i.e. MBCCSRn.CMT = 1. module internal Idle, HLck MA > SA Message Available > Slot Assigned CCMa TX > STS TX > DSS Transmission Slot Start > Static Slot Start Transmission Slot Start > Dynamic Slot Start Table 13-97. Single Transmit Message Buffer Transition Priorities State Priorities Description

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

564 Freescale Semiconductor

Figure 13-115. Message Transmission Timing Figure 13-116. Message Transmission from HLck state with unlock The amount of message data read from the FRM and transferred to the FlexRay bus is determined by the following three items 1. the message buffer segment that the message buffer is assigned to, as defined by the Message Buffer Segment Size and Utilization Register (MBSSUTR). 2. the message buffer data field size, as defined by the related field of the Message Buffer Data Size Register (MBDSR) 3. the value of the PLDLEN field in the message buffer header field, as described in Section 13.6.5.2.1, “Frame Header Section Description” If a message buffer is assigned to message buffer segment 1, and PLDLEN > MBSEG1DS, then 2 * MBSEG1DS bytes will be read from the message buffer data field and zero padding is used for the remaining bytes for the FlexRay bus transfer. If PLDLEN <= MBSEG1DS, the FlexRay block reads and transfers 2*PLDLEN bytes. The same holds for segment 2 and MBSEG2DS.

13.6.6.2.6 Null Frame Transmission

A static slot with slot number S is assigned to the FlexRay block for channel A, if at least one transmit message buffer is configured with the MBFIDRn.FID set to S and MBCCFRn.CHA set to 1. A Null Frame is transmitted in the static slot S on channel A, if this slot is assigned to the FlexRay block for channel A, and all transmit message buffers with MBFIDRn.FID = s and MBCCFRn.CHA = 1 are either not counter filter is enabled and does not match. Additionally, the application can clear the commit bit of a message buffer that is in the CCMa state, which is called uncommit or transmit abort. This message buffer will be used for null frame transmission. As a result of the message buffer search described inSection 13.6.7, “Individual Message Buffer Search”, the FlexRay block triggers the slot assigned transition SA for up to two transmit message buffers if at least search[s+1] MT start MA slot s TX SU CCMa CCTx slot s+1 Idle MT start Idle slot s+2 slot start slot start slot start MT start message transmit SSS CCSu search[s+1] MT start MT start MA slot s TX SSS HLckCCMa CCTx slot s+1 HLck MT start Idle slot s+2 slot start slot start slot start HU CCMa message transmit

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

566 Freescale Semiconductor

Figure 13-120. Null Frame Transmission from Idle state with locking

13.6.6.2.7 Message Buffer Status Update

After the end of each slot, the PE generates the slot status vector. Depending on the this status, the transmitted frame type, and the amount of transmitted data, the message buffer status is updated. Message Buffer Status Update after Complete Message Transmission The term complete message transmission refers to the fact that all payload data stored in the message buffer were send to FlexRay bus. In this case, the FlexRay block updates the slot status field of the message buffer and triggers the status updated transition SU. With the SU transition, the FlexRay block sets the message buffer interrupt flag MBCCSn.MBIF to indicate the successful message transmission. Depending on the transmission mode flag MBCCFRn.MTM, the FlexRay block changes the commit flag MBCCSRn.CMT and the valid flag MBCCSRn.DV AL. If the MBCCFRn.MTM flag is negated, the message buffer is in theevent transmission mode.In this case, each committed message is transmitted only once. The commit flag MBCCSRn.CMT is cleared with the SU transition. If the MBCCFRn.MTM flag is asserted, the message buffer is in the state transmission mode. In this case, each committed message is transmitted as long as the application provides new data or locks the message buffers. The FlexRay block will not clear the MBCCSRn.CMT flag at the end of transmission and will set the valid flag MBCCSRn.DV AL to indicate that the message will be transmitted again. Message Buffer Status Update after Incomplete Message Transmission The term incomplete message transmission refers to the fact that not all payload data that should be transmitted were send to FlexRay bus. This may be caused by the following regular conditions in the dynamic segment: 1. The transmission slot starts in a minislot with a minislot number greater than pLatestTx. 2. The transmission slot did not exist in the dynamic segment at all. Additionally, an incomplete message transmission can be caused by internal communication errors. If those error occur, the Protocol Engine Communication Failure Interrupt Flag PECF_IF is set in the Protocol Interrupt Flag Register 1 (PIFR1). In any of these two cases, the status of the message buffer is not changed at all with the SU transition. The slot status field is not updated, the status and control flags are not changed, and the interrupt flag is not set. search[s+1] MT start MT start SA slot s STS SSS slot s+1 Idle MT start HLck slot s+2 slot start slot start slot startnull frame transmit HL CCSa CCNf HLckCCNf

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 567 Message Buffer Status Update after Null Frame Transmission After the transmission of a null frame, the status of the message buffer that was used for the null frame transmission is not changed at all. The slot status field is not updated, the status and control flags are not changed, and the interrupt flag is not set.

13.6.6.3 Receive Message Buffers

The section provides a detailed description of the functionality of the receive message buffers. A receive message buffer is used to receive a message from the FlexRay Bus based on individual filter criteria. The FlexRay block uses the receive message buffer to provide the following data to the application 1. message data received 2. information about the reception process 3. status information about the slot in which the message was received A individual message buffer with message buffer number n is configured as a receive message buffer by the following configuration settings

• MBCCSRn.MBT = 0 (single buffered message buffer)
• MBCCSRn.MTD = 0 (receive message buffer) To certain message buffer fields, both the application and the FlexRay block have access. To ensure data consistency, a message buffer locking scheme is implemented that is used to control the access to the data, control, and status bits of a message buffer. The access regions for receive message buffers are depicted in Figure 13-121. A description of the regions is given in Table 13-98. If an region is active as indicated in Table 13-99, the access scheme given for that region applies to the message buffer. Figure 13-121. Receive Message Buffer Access Regions Message Buffer Data Field: DATA[0-N] Message Buffer Header Field: Frame Header MBCCSRn.DVAL/DUP Message Buffer Header Field: Slot Status Message Buffer Header Field: Data Field Offset MBCCFRn.CHA/CHB/CCF* MBFIDRn.FID MBIDXRn.MBIDX MBCCSRn.MTD RX SR CFG MSG

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

568 Freescale Semiconductor

The trigger bits MBCCSRn.EDT and MBCCSRn.LCKT and the interrupt enable bit MBCCSRn.MBIE are not under access control and can be accessed from the application at any time. The status bits MBCCSRn.EDS and MBCCSRn.LCKS are not under access control and can be accessed from the FlexRay block at any time. The interrupt flag MBCCSRn.MBIF is not under access control and can be accessed from the application and the FlexRay block at any time. FlexRay block set access has higher priority. The FlexRay block restricts its access to the regions depending on the current state of the message buffer. The application must adhere to these restrictions in order to ensure data consistency. The receive message buffer states are given in Figure 13-122. A description of the message buffer states is given in Table 13- 94, which also provides the access scheme for the access regions. The status bits MBCCSRn.EDS and MBCCSRn.LCKS provide the application with the required status information. The internal status information is not visible to the application. Figure 13-122. Receive Message Buffer States Table 13-98. Receive Message Buffer Access Region Description Region Access from Region used for Application Module CFG read/write - Message Buffer Configuration, Message Data and Status Access MSG read/write - Message Data, Header, and Status Access RX - write-only Message Reception and Status Update SR - read-only Message Buffer Search Data Table 13-99. Receive Message Buffer States and Access (Sheet 1 of 2) State MBCCSRn Access from EDS LCKS Appl. Module Idle 1 0 – SR Idle - Message Buffer is idle. Included in message buffer search. HDis 0 0 CFG – Disabled - Message Buffer under configuration. Excluded from message buffer search. RESET_STATE HLck HDisLck HDis Idle HLckCCBs SU CCBs BS SLS SNS SNS HL HU HE HD HLHE HD HU HL HU CCSu BS CCRx HL HU HLckCCRxSLS SSS SSS

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 569

13.6.6.3.1 Message Buffer Transitions

The application transitions that can be triggered by the application using the commands described in Table 13-100. The application issues the commands by writing to the Message Buffer Configuration, Control, Status Registers (MBCCSRn). Only one command can be issued with one write access. Each command is executed immediately. If the command is ignored, it must be issued again. The enable and disable commands issued by writing 1 to the trigger bit MBCCSRn.EDT. The transition that will be triggered by each of these command depends on the current value of the status bit MBCCSRn.EDS. If the command triggers the disable transition HD and the message buffer is in one of the states CCBs, HLckCCBs, or CCRx, the disable transition has no effect (command is ignored) and the message buffer state is not changed. No notification is given to the application. The lock and unlock commands issued by writing 1 to the trigger bit MBCCSRn.LCKT. The transition that will be triggered by each of these commands depends on the current value of the status bit MBCCSRn.LCKS. If the command triggers the lock transition HL while the message buffer is in the state CCRx, the lock transition has no effect (command is ignored) and message buffer state is not changed. In this case, the message buffer lock error flag LCK_EF in the CHI Error Flag Register (CHIERFR) is set. HDisLck 0 1 CFG – Disabled and Locked - Message Buffer under configuration. Excluded from message buffer search. HLck 1 1 MSG – Locked - Applications access to data, control, and status. Included in message buffer search. CCBs 10–– Buffer Subscribed - Message buffer subscribed for reception. Filter matches next (slot, cycle, channel) tuple. HLckCCBs 1 1 MSG – Locked and Buffer Subscribed - Applications access to data, control, and status. Message buffer subscribed for reception. CCRx 10–– Message Receive - Message data received into related shadow buffer. HLckCCRx 1 1 MSG – Locked and Message Receive - Applications access to data, control, and status. Message data received into related shadow buffer. CCSu 1 0 – RX Status Update - Message buffer status update. Update of status flags, the slot status field, and the header index. Table 13-100. Receive Message Buffer Application Transitions Transition Host Command Condition Description HE MBCCSRn.EDT:= 1 MBCCSRn.EDS = 0 Application triggers message buffer enable. HD MBCCSRn.EDS = 1 Application triggers message buffer disable. HL MBCCSRn.LCKT:= 1 MBCCSRn.LCKS = 0 Application triggers message buffer lock. HU MBCCSRn.LCKS = 1 Application triggers message buffer unlock. Table 13-99. Receive Message Buffer States and Access (Sheet 2 of 2) State MBCCSRn Access from EDS LCKS Appl. Module

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

570 Freescale Semiconductor

The module transitions that can be triggered by the FlexRay block are described in Table 13-101. Each transition will be triggered for certain message buffers when the related condition is fulfilled. Transition Priorities The application can trigger only one transition at a time. There is no need to specify priorities among them. As shown in Table 13-102, the module transitions have a higher priority than the application transitions. For all states except the CCRx state, a module transition and the application lock/unlock transition HL/HU and can be executed at the same time. The result state is reached by first applying the module transition and subsequently the application transition to the intermediately reached state. For example, if the message buffer is in the buffer subscribed state CCBs and the module triggers the slot start transition SLS at the same time as the application locks the message buffer by the HL transition, the intermediate state is CCRx and the resulting state is locked buffer subscribed state HLckCCRx.

13.6.6.3.2 Message Reception

As a result of the message buffer search, the FlexRay block changes the state of up to two enabled receive message buffers from either idle state Idle or locked state HLck to the either subscribed state CCBs or locked buffer subscribed state HLckCCBs by triggering the buffer subscribed transition BS. If the receive message buffers for the next slot are assigned to both channels, then at most one receive message buffer is changed to a buffer subscribed state. If more than one matching message buffers assigned to a certain channel, then only the message buffer with the lowest message buffer number is in one of the states mentioned above. Table 13-101. Receive Message Buffer Module Transitions Transition Condition Description BS slot match and CycleCounter match Buffer Subscribed - The message buffer filter matches next slot and cycle. SLS slot start Slot Start - Start of either Static Slot or Dynamic Slot. SNS symbol window start or NIT start Symbol Window or NIT Start - Start of either Symbol Window or NIT. SSS slot start or symbol window start or NIT start Slot or Segment Start - Start of either Static Slot, Dynamic Slot, Symbol Window, or NIT. SU status updated Status Updated - Slot Status field, message buffer status flags, header index updated. Interrupt flag set. Table 13-102. Receive Message Buffer Transition Priorities State Priorities Description module vs. application Idle BS > HD Buffer Subscribed > Message Buffer Disable HLck BS > HD Buffer Subscribed > Message Buffer Disable CCRx SSS > HL Slot or Segment Start > Message Buffer Lock

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 571 With the start of the next static or dynamic slot the module trigger the slot start transition SLS. This changes the state of the subscribed receive message buffers from either CCBs to CCRx or from HLckCCBs to HLckCCRx, respectively. During the reception slot, the received frame data are written into the shadow buffers. For details on receive receive message buffers that are the CCRx or HLckCCRx are not modified in the reception slot.

13.6.6.3.3 Message Buffer Status Update

With the start of the next static or dynamic slot or with the start of the symbol window or NIT, the module trigger the slot or segment start transition SSS. This transition changes the state of the receiving receive message buffers from either CCRx to CCSu or from HLckCCRx to HLck, respectively. If a message buffer was in the locked state HLckCCRx, no update will be performed. The received data are lost. This is indicated by setting the Frame Lost Channel A/B Error Flag FRLA_EF/FRLB_EF in the CHI Error Flag Register (CHIERFR). If a message buffer was in the CCRx state it is now in the CCSu state. After the evaluation of the slot status provided by the PE the message buffer is updated. The message buffer update depends on the slot status bits and the segment the message buffer is assigned to. This is described in Table 13-103. Table 13-103. Receive Message Buffer Update vSS!ValidFrame vRF!Header!NFIndicator Update description 11 Valid non-null frame received. - Message Buffer Data Field updated. - Frame Header Field updated. - Slot Status Field updated. - DUP:= 1 - DVAL:= 1 - MBIF:= 1 10 Valid null frame received. - Message Buffer Data Field not updated. - Frame Header Field not updated. - Slot Status Field updated. - DUP:= 0 - DVALnot changed - MBIF:= 1 0x No valid frame received. - Message Buffer Data Field not updated. - Frame Header Field not updated. - Slot Status Field updated. - DUP:= 0 - DVALnot changed. - MBIF:= 1, if the slot was not an empty dynamic slot. Note: An empty dynamic slot is indicated by the following frame and slot status bit values: vSS!ValidFrame = 0 and vSS!SyntaxError = 0 and vSS!ContentError = 0 and vSS!BViolation = 0.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

572 Freescale Semiconductor

If the number of the last slot in the current communication cycle on a given channel is n, then all receive message buffers assigned to this channel with MBFIDRn.FID > n will not be updated at all. When the receive message buffer update has finished the status updated transition SU is triggered, which changes the buffer state from CCSu to Idle. An example receive message buffer timing and state change diagram for a normal frame reception is given in Figure 13-123. Figure 13-123. Message Reception Timing The amount of message data written into the message buffer data field of the receive shadow buffer is determined by the following two items: 1. the message buffer segment that the message buffer is assigned to, as defined by the Message Buffer Segment Size and Utilization Register (MBSSUTR). 2. the message buffer data field size, as defined by the related field of the Message Buffer Data Size Register (MBDSR) 3. the number of bytes received over the FlexRay bus If the message buffer is assigned to the message buffer segment 1, and the number of received bytes is greater than 2*MBDSR.MBSEG1DS, the FlexRay block writes only 2*MBDSR.MBSEG1DS bytes into the message buffer data field of the receive shadow buffer. If the number of received bytes is less than 2*MBDSR.MBSEG1DS, the FlexRay block writes only the received number of bytes and will not change the trailing bytes in the message buffer data field of the receive shadow buffer. The same holds for the message buffer segment 2 with MBDSR.MBSEG2DS.

13.6.6.3.4 Received Message Access

To access the message data received over the FlexRay bus, the application reads the message data stored in the message buffer data field of the corresponding receive message buffer. The access to the message buffer data field is described in Section 13.6.3.1, “Individual Message Buffers”. The application can read the message buffer data field if the receive message buffer is one of the states HDis, HDisLck, or HLck. If the message buffer is in one of these states, the FlexRay block will not change the content of the message buffer.

13.6.6.3.5 Receive Shadow Buffers Concept

The receive shadow buffer concept applies only to individual receive message buffers. The intention of this concept is to ensure that only syntactically and semantically valid received non-null frames are presented search[s+1] MT start BS slot s SLS SU CCBs CCRx slot s+1 Idle MT start Idle slot s+2 slot start slot start MT start message receive to receive shadow buffer SSS CCSuslot start

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 573 to the application in a receive message buffer. The basic structure of a receive shadow buffer is described in Section 13.6.3.2, “Receive Shadow Buffers”. The receive shadow buffers temporarily store the received frame header and message data. After the slot boundary the slot status information is generated. If the slot status information indicates the reception of the valid non-null frame (see Table 13-103), the FlexRay block writes the slot status into the slot status field of the receive shadow buffer and exchanges the content of the Message Buffer Index Registers (MBIDXRn) with the content of the corresponding internal shadow buffer index register. In all other cases, the FlexRay block writes the slot status into the identified receive message buffer, depending on the slot status and the FlexRay segment the message buffer is assigned to. The shadow buffer concept, with its index exchange, results in the fact that the FRM located message buffer associated to an individual receive message buffer changes after successful reception of a valid frame. This means that the message buffer area in the FRM accessed by the application for reading the received message is different from the initial setting of the message buffer. Therefore, the application must not rely on the index information written initially into the Message Buffer Index Registers (MBIDXRn). Instead, the index of the message buffer header field must be fetched from the Message Buffer Index Registers (MBIDXRn).

13.6.6.4 Double Transmit Message Buffer

The section provides a detailed description of the functionality of the double transmit message buffers. Double transmit message buffers are used by the application to provide the FlexRay block with the message data to be transmitted over the FlexRay Bus. The FlexRay block uses this message buffer to provide information to the application about the transmission process, and status information about the slot in which message data was transmitted. In contrast to the single transmit message buffers, the application can provide new transmission data while the transmission of the previously provided message data is running. This scheme is called double buffering and can be considered as a FIFO of depth 2. Double transmit message buffers are implemented by combining two individual message buffers that form the two sides of an double transmit message buffer. One side is called thecommit side and will be accessed by the application to provide the message data. The other side is called thetransmit side and is used by the FlexRay block to transmit the message data to the FlexRay bus. The two sides are located in adjacent individual message buffers. The message buffer that implements the commit side has an even message buffer number 2n. The transmit side message buffer follows the commit side message buffer and has the message buffer number 2n+1. The basic structure and data flow of a double transmit message buffer is given in Figure 13-124. Figure 13-124. Double Transmit Buffer Structure and Data Flow Commit Side Transmit Side Application FlexRay Bus MB# 2n MB# 2n+1 Internal Message Transfer message data message data message data

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

574 Freescale Semiconductor

Both the commit and the transmit side must be configured with identical values except for the Message Buffer Index Registers (MBIDXRn).

13.6.6.4.1 Access Regions

To certain message buffer fields, both the application and the FlexRay block have access. To ensure data consistency, a message buffer locking scheme is implemented, which controls the exclusive access to the data, control, and status bits of the message buffer. The access scheme for double transmit message buffers is depicted in Figure 13-125. The given regions represent fields that can be accessed from both the application and the FlexRay block and, thus, require access restrictions. A description of the regions is given in Table 13-104. Figure 13-125. Double Transmit Message Buffer Access Regions Layout Table 13-104. Double Transmit Message Buffer Access Regions Description Access Description Region Type Application Module Commit Side CFG read/write - Message Buffer Configuration MSG read/write - Message Buffer Data and Control access ITX - read/write Internal Message Transfer. SS - write-only Slot Status Update Transmit Side CFG read/write - Message Buffer Configuration SR - read-only Message Buffer Search TX - read-only Internal Message Transfer, Message Transmission Message Buffer Data Field: DATA[0-N] Message Buffer Header Field: Frame Header MBCCSR[2n]n.CMT Message Buffer Header Field: Slot Status Message Buffer Header Field: Data Field Offset MBCCFR[2n].MTM/CHA/CHB/CCF* MBFIDR[2n].FID MBIDXR[2n].MBIDX MBCCSR[2n].MBT/MTD Message Buffer Data Field: DATA[0-N] Message Buffer Header Field: Frame Header MBCCSR[2n+1].CMT Message Buffer Header Field: Slot Status Message Buffer Header Field: Data Field Offset MBCCFR[2n+1].MTM/CHA/CHB/CCF* MBFIDR[2n+1].FID MBIDXR[2n+1].MBIDX MBCCSR[2n+1].MBT/MTD Commit Side Transmit Side CFG MSG CFG ITX SS SS SR TX

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 575 The trigger bits MBCCSRn.EDT and MBCCSRn.LCKT, and the interrupt enable bit MBCCSRn.MBIE are not under access control and can be accessed from the application at any time. The status bits MBCCSRn.EDS and MBCCSRn.LCKS are not under access control and can be accessed from the FlexRay block at any time. The interrupt flag MBCCSnR.MBIF is not under access control and can be accessed from the application and the FlexRay block at any time. FlexRay block set access has higher priority. The FlexRay block restricts its access to the regions, depending on the current state of the corresponding part of the double transmit message buffer. The application must adhere to these restrictions in order to ensure data consistency. The states for the commit side of a double transmit message buffer are given in Figure 13-126. A description of the states is given in Table 13-106. The states for the transmit side of a double transmit message buffer are given inFigure 13-127. A description of the states is given inTable 13- 106. The description tables also provide the access scheme for the access regions. The status bits MBCCSRn.EDS and MBCCSRn.LCKS provide the application with the required message buffer status information. The internal status information is not visible to the application.

13.6.6.4.2 Message Buffer States

This section describes the transmit message buffer states and provides a state diagram. Figure 13-126. Double Transmit Message Buffer State Diagram (Commit Side) A description of the states of the commit side of a double transmit message buffer is given inTable 13-105. SS - write-only Slot Status Update Table 13-105. Double Transmit Message Buffer State Description (Sheet 1 of 2)(Commit Side) State MBCCSR[2n] Access Region EDS LCKS Appl. Module common states Table 13-104. Double Transmit Message Buffer Access Regions Description Access Description Region Type Application Module HLck HDisLck HDis Idle CCITx IS IE RESET_STATE HE HD HL HU HE HD HL HU

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

576 Freescale Semiconductor

Figure 13-127. Double Transmit Message Buffer State Diagram (Transmit Side) A description of the states of the transmit side of a double transmit message buffer is given inTable 13-106. HDis 0 0 CFG – Disabled - Message Buffer under configuration. Commit Side can not be used for internal message transfer. CCITx 1 0 – ITX Internal Message Transfer- Message Buffer Data transferred from commit side to transmit side. commit side specific states Idle 1 0 – ITX, SS Idle - Message Buffer Commit Side is idle. Commit Side can be used for internal message transfer. HDisLck 0 1 CFG SS Disabled and Locked - Message Buffer under configuration. Commit Side can not be used for internal message transfer. HLck 1 1 MSG SS Locked - Applications access to data, control, and status. Commit Side can not be used for internal message transfer. Table 13-106. Double Transmit Message Buffer State Description (Transmit Side) (Sheet 1 of 2) State MBCCSRn Access Region EDS LCKS Appl. Module common states HDis 0 0 CFG – Disabled - Message Buffer under configuration. Excluded from message buffer search. CCITx 1 0 – TX Internal Message Transfer- Message Buffer Data transferred from commit side to transmit side. transmit side specific states Idle 1 0 – SR Idle - Message Buffer Transmit Side is idle. Transmit Side is included in message buffer search. Table 13-105. Double Transmit Message Buffer State Description (Sheet 2 of 2)(Commit Side) State MBCCSR[2n] Access Region EDS LCKS Appl. Module CCSaCCITxCCITx HDis Idle CCTx CCMaCCITx CCSa CCMa SA MA TX RESET_STATE DSS CCNf SSS STS CCNfCCITx IS IE IS IE IS IE HE HD STS CCSuSU SSSDSS IS IE

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 577

13.6.6.4.3 Message Buffer Transitions

The application transitions that can be triggered by the application using the commands described in Table 13-107. The application issues the commands by writing to the Message Buffer Configuration, Control, Status Registers (MBCCSRn). Only one command can be issued with one write access. Each command is executed immediately. If the command is ignored, it must be issued again. The enable and disable commands can be issued on the transmit side only. Any enable or disable command issued on the commit side will be ignored without notification. The transitions that will be triggered depends on the value of the EDS bit. The enable and disable commands will affect both the commit side and the transmit side at the same time. If the application triggers the disable transition HD while the transmit side is in one of the states CCSa, CCSaCCITx, CCNf, CCNfCCITx, CCMa, CCMaCCITx, CCTx, or CCSu, the disable transition has no effect (command is ignored) and the message buffer state is not changed. No notification is given to the application. The lock and unlock commands can be issued on the commit side only. Any lock or unlock command issued on the transmit side will be ignored and the double transmit buffer lock error flag DBL_EF in the CHI Error Flag Register (CHIERFR) will be set. The transitions that will be triggered depends on the current value of the LCKS bit. The lock and unlock commands will only affect the commit side. If the application triggers the lock transition HL while the commit side is in the state CCITx, the message buffer state will not be changed and the message buffer lock error flag LCK_EF in the CHI Error Flag Register (CHIERFR) will be set. CCSa 1 0 – – Slot Assigned - Message buffer assigned to next static slot. Ready for Null Frame transmission. CCSaCCITx 1 0 – TX Slot Assigned and Internal Message Transfer - Message buffer assigned to next static slot and Message Buffer Data transferred from commit side to transmit side. CCNf 1 0 – TX Null Frame Transmission Header is used for null frame transmission. CCNfCCITx 1 0 – TX Null Frame Transmission and Internal Message Transfer - Header is used for null frame transmission and Message Buffer Data transferred from commit side to transmit side. CCMa 1 0 – – Message Available - Message buffer is assigned to next slot and cycle counter filter matches. CCMaCCITx 1 0 – – Message Available and Internal Message Transfer - Message buffer is assigned to next slot and cycle counter filter matches and Message Buffer Data transferred from commit side to transmit side. CCTx 1 0 – TX Message Transmission - Message buffer data transmit. Payload data from buffer transmitted CCSu 1 0 – SS Status Update - Message buffer status update. Update of status flags, the slot status field, and the header index. Note: The slot status field of the commit side is updated too, even if the application has locked the commit side. Table 13-106. Double Transmit Message Buffer State Description (Transmit Side) (Sheet 2 of 2) State MBCCSRn Access Region EDS LCKS Appl. Module

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

578 Freescale Semiconductor

The module transitions that can be triggered by the FlexRay block are described in Table 13-108. The transitions C1 and C2 apply to both sides of the message buffer and are applied at the same time. All other FlexRay block transitions apply to the transmit side only. Transition Priorities The application can trigger only one transition at a time. There is no need to specify priorities among them. As shown in the first part ofTable 13-109, the module transitions have a higher priority than the application transitions. The priorities among the FlexRay block transitions and the related states are given in the second part ofTable 13-109. These priorities apply only to the transmit side. The internal message transmit start transition IS has tho lowest priority. Table 13-107. Double Transmit Message Buffer Host Transitions Transition Host Command Condition Description HE MBCCSR[2n+1].EDT:= 1 MBCCSR[2n+1].EDS = 0 Application triggers message buffer enable. HD MBCCSR[2n+1].EDS = 1 Application triggers message buffer disable. HL MBCCSR[2n].LCKT:= 1 MBCCSR[2n].LCKS = 0 Application triggers message buffer lock. HU MBCCSR[2n].LCKS = 1 Application triggers message buffer unlock. Table 13-108. Double Transmit Message Buffer Module Transitions Transition Condition Description common transitions IS see Section 13.6.6.4.5, “Internal Message Transfer Internal Message Transfer Start - Start transfer of message data from commit side to transmit side. IE Internal Message Transfer End - Stop transfer of message data from commit side to transmit side. Note: The internal message transfer is stopped before the slot or segment start. transmit side specific transitions SA slot match and static slot Slot Assigned - Message buffer is assigned to next static slot. MA slot match and CycleCounter match Message Available - Message buffer is assigned to next slot and cycle counter filter matches. TX slot start and MBCCSR[2n+1].CMT = 1 Transmission Slot Start - Slot Start and commit bit CMT is set. In case of a dynamic slot, pLatestTx is not exceeded. SU status updated Status Updated - Slot Status field and message buffer status flags updated. Interrupt flag set. STS static slot start Static Slot Start - Start of static slot. DSS dynamic slot start or symbol window start or NIT start Dynamic Slot or Segment Start. - Start of dynamic slot or symbol window or NIT. SSS slot start or symbol window start or NIT start Slot or Segment Start - Start of static slot or dynamic slot or symbol window or NIT.

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 579

13.6.6.4.4 Message Preparation

The application provides the message data through the commit side. The transmission itself is executed from the transmit side. The transfer of the message data from the commit side to the transmit side is done by the Internal Message Transfer, which is described in Section 13.6.6.4.5, “Internal Message Transfer To transmit a message over the FlexRay bus, the application writes the message data into the message buffer data field of the commit side and sets the commit bit CMT in the Message Buffer Configuration, Control, Status Registers (MBCCSRn). The physical access to the message buffer data field is described in Section 13.6.3.1, “Individual Message Buffers”. As indicated by Table 13-105, the application shall write to the message buffer data field and change the commit bit CMT only if the transmit message buffer is in one of the states HDis, HDisLck, or HLck. The application can change the state of a message buffer if it issues the appropriate commands shown in Table 13-107. The state change is indicated through the MBCCSRn.EDS and MBCCSRn.LCKS status bits.

13.6.6.4.5 Internal Message Transfer

The internal message transfer transfers the message data from the commit side to the transmit side. The internal message transfer is implemented as the swapping of the content of the Message Buffer Index Registers (MBIDXRn)of the commit side and the transmit side. After the swapping, the commit side CMT bit is cleared, the commit side interrupt flag MBIF is set, the transmit side CMT bit is set, and the transmit side DV AL bit is cleared. The conditions and the point in time when the internal message transfer is started are controlled by the message buffer commit mode bit MCM in the Message Buffer Configuration, Control, Status Registers (MBCCSRn). The MCM bit configures the message buffer for either the streaming commit mode or the immediate commit mode. A detailed description is given in Streaming Commit Mode and Immediate Commit Mode. The Internal Message Transfer is triggered with the transition IS. Both sides of the message buffer enter one of the CCITx states. The internal message transfer is finished with the transition IE. Streaming Commit Mode The intention of the streaming commit mode is to ensure that each committed message is transmitted at least once. The FlexRay block will not start the Internal Message Transfer for a message buffer as long as the message data on the transmit side is not transmitted at least once. Table 13-109. Double Transmit Message Buffer Transition Priorities State Priority Description module vs. application Idle IS > HD IS > HL Internal Message Transfer Start > Message Buffer Disable Internal Message Transfer Start > Message Buffer Lock module internal Idle MA > SA Message Available > Slot Assigned CCMa TX > STS TX > DSS Transmission Slot Start > Static Slot Start Transmission Slot Start > Dynamic Slot Start

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

580 Freescale Semiconductor

The streaming commit mode is configured by clearing the message buffer commit mode bit MCM in the Message Buffer Configuration, Control, Status Registers (MBCCSRn). In this mode, the internal message transfer from the commit side to the transmit side is started for a double transmit message buffer when all of the following conditions are fulfilled 1. the commit side is in the Idle state 2. the commit site message data are valid, i.e. MBCCSR[2n].CMT = 1 3. the transmit side is in one of the states Idle, CCSa, or CCMa 4. the transmit side contains either no valid message data, i.e. MBCCSR[2n+1].CMT = 0 or the message data were transmitted at least once, i.e. MBCCSR[2n+1].DV AL = 1 An example of a streaming commit mode state change diagram is given inFigure 13-128. In this example, both the commit and the transmit side do not contain valid message data and the application provides two messages. The message buffer does not match the next slot. Figure 13-128. Internal Message Transfer in Streaming Commit Mode Immediate Commit Mode The intention of the immediate commit mode is to transmit thelatest data provided by the application. This implies that it is not guaranteed that each provided message will be transmitted at least once. The immediate commit mode is configured by setting the message buffer commit mode bit MCM in the Message Buffer Configuration, Control, Status Registers (MBCCSRn). In this mode, the internal message transfer from the commit side to the transmit side is started for one double transmit message buffer when all of the following conditions are fulfilled 1. the commit side is in the Idle state 2. the commit site message data are valid, i.e. MBCCSR[2n].CMT = 1 3. the transmit side is in one of the states Idle, CCSa, or CCMa It is not checked whether the transmit side contains no valid message data or valid message data were transmitted at least once. If message data are valid and not transmitted, they may be overwritten. An example of a streaming commit mode state change diagram is given inFigure 13-129. In this example, both the commit and the transmit side do not contain valid message data, and the application provides two messages and the first message is gets overwritten. The message buffer does not match the next slot. Idle CommitTransmit Idle HL HLck Side Side slot s slot s+1 slot s+2 search[s+1] slot start slot start slot start HU CCITxIdle IS CCITx IE Idle HL HLck HU Idle Idle no internal message transfer, until message transmitted

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 581 Figure 13-129. Internal Message Transfer in Immediate Commit Mode

13.6.6.4.6 Message Transmission

For double transmit message buffers, the message buffer search checks only the transmit side part. The internal scheduling ensures, that the internal message transfer is stopped on the message buffer search start. Thus, the transmit side of message buffer, that is not in its transmission or status update slot, is always in the Idle state. The message transmit behavior and transmission state changes of the transmit side of a double transmit message buffer are the same as for single buffered transmit buffers, except that the transmit side of double buffers can not be locked by the application, i.e. the HU and HL transition do not exist. Therefore, refer to Section 13.6.6.2.5, “Message Transmission”

13.6.6.4.7 Message Buffer Status Update

The message buffer status update behavior of the transmit side of a double transmit message buffer is the same as for single transmit message buffers which is described in Section 13.6.6.2.7, “Message Buffer Status Update”. Additionally, the slot status field of the commit side is update after the update of the slot status field of the transmit side, even if the commit side is locked by the application. This is implemented to provide the slot status of the most recent transmission slot. Idle CommitTransmit Idle HL HLck Side Side slot s slot s+1 slot s+2 search[s+1] slot start slot start slot start HU CCITxIdle IS CCITx IE Idle HL HLck HU Idle CCITxIdle IS CCITx IE Idle Idle internal message transfer overwrites non-transmitted message

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

582 Freescale Semiconductor

13.6.7 Individual Message Buffer Search

This section provides a detailed description of the message buffer search algorithm. The message buffer search determines for each enabled channel if a slot s in a communication cycle c is assigned for frame or null frame transmission or if it is subscribed for frame reception on that channel. The message buffer search is a sequential algorithm which is invoked at the following protocol related events: 1. NIT start 2. slot start in the static segment 3. minislot start in the dynamic segment The message buffer search within the NIT searches for message buffers assigned or subscribed to slot 1. The message buffer search within slot n searches for message buffers assigned or subscribed to slot n+1. In general, the message buffer search for the next slot n considers only message buffers which are 1. enabled, i.e. MBCCSRn.EDS = 1, and 2. matches the next slot n, i.e. MBFIDRn.FID = n, and 3. are the transmit side buffer in case of a double transmit message buffer. On top of that, for the static segment only those message buffers are considered, that match the condition of at least one row of Table 13-110. For the dynamic segment only those message buffers are considered, that match the condition of at least one row of Table 13-111. These message buffers are called matching message buffers. For each enabled channel the message buffer search may identify multiple matching message buffers. Among all matching message buffers the message buffers with highest priority according toTable 13-110 for the static segment and according to Table 13-111 for the dynamic segment are selected. Table 13-110. Message Buffer Search Priority (static segment) Priority MTD LCKS CMT CCFM (1) 1. Cycle Counter Filter Match, see Section 13.6.7.1, “Message Buffer Cycle Counter Filtering” Description Transition (highest) 0 1011 t r ansmit buffer, matches cycle count, not locked and committed MA 1 - 0 1 transmit buffer, matches cycle count, not committed SA 1 1 - 1 transmit buffer, matches cycle count, locked SA 2 1 - - - transmit buffer SA 3 0 0 n/a 1 receive buffer, matches cycle count, not locked SB (lowest) 4 0 1 n/a 1 receive buffer, matches cycle count, locked SB

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 583 If there are multiple message buffer with highest priority, the message buffer with the lowest message buffer number is selected. All message buffer which have the highest priority must have a consistent channel assignment as specified in Section 13.6.7.2, “Message Buffer Channel Assignment Consistency”. Depending on the message buffer channel assignment the same message buffer can be found for both channel A and channel B. In this case, this message buffer is used as described in Section 13.6.3.1, “Individual Message Buffers”.

13.6.7.1 Message Buffer Cycle Counter Filtering

The message buffer cycle counter filter is a value-mask filter defined by the CCFE, CCFMSK, and CCFV AL fields in theMessage Buffer Cycle Counter Filter Registers (MBCCFRn). This filter determines a set of communication cycles in which the message buffer is considered for message reception or message transmission. If the cycle counter filter is disabled, i.e. CCFE = 0, this set of cycles consists of all communication cycles. If the cycle counter filter of a message buffer does not match a certain communication cycle number, this message buffer is not considered for message transmission or reception in that communication cycle. In case of a transmit message buffer assigned to a slot in the static segment, though, this buffer is added to the matching message buffers to indicate the slot assignment and to trigger the null frame transmission. The cycle counter filter of a message buffer matches the communication cycle with the number CYCCNT if at least one of the following conditions evaluates to true: Eqn. 13-9 Eqn. 13-10

13.6.7.2 Message Buffer Channel Assignment Consistency

The message buffer channel assignment given by the CHA and CHB bits in the Message Buffer Cycle Counter Filter Registers (MBCCFRn) defines the channels on which the message buffer will receive or transmit. The message buffer with number n transmits or receives on channel A if MBCCFRn[CHA] = 1 and transmits or receives on channel B if MBCCFRn[CHB] = 1. To ensure correct message buffer operation, all message buffers assigned to the same slot and with the same priority must have aconsistent channel assignment. That means they must be either assigned to one channel only, or must be assigned to both channels. The behavior of the message buffer search is not Table 13-111. Message Buffer Search Priority (dynamic segment) Priority MTD LCKS CMT CCFM (1) 1. Cycle Counter Filter Match, see Section 13.6.7.1, “Message Buffer Cycle Counter Filtering” Description Transition (highest) 0 1011 t r ansmit buffer, matches cycle count, not locked and committed MA 1 0 0 n/a 1 receive buffer, matches cycle count, not locked SB (lowest) 2 0 1 n/a 1 receive buffer, matches cycle count, locked SB MBCCFRn CCFE[] 0= CYCCNT MBCCFRn CCFMSK[]∧ MBCCFRn CCFVAL[] MBCCFRn CCFMSK[]∧=

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19

584 Freescale Semiconductor

defined, if both types of channel assignments occur for one slot and priority. An inconsistent channel assignment for message buffer 0 and message buffer 1 is depicted in Figure 13-130. Figure 13-130. Inconsistent Channel Assignment

13.6.7.3 Node Related Slot Multiplexing

The term Node Related Slot Multiplexing applies to the dynamic segment only and refers to the functionality if there are transmit as well as receive message buffers are configured for the same slot. According to Table 13-111 the transmit buffer is only found if the cycle counter filter matches, and the buffer is not locked and committed. In all other cases, the receive buffer will be found. Thus, if the block has no data to transmit in a dynamic slot, it is able to receive frames on that slot.

13.6.7.4 Message Buffer Search Error

If the message buffer search is running while the next message buffer search start event appears, the message buffer search is stopped and the Message Buffer Search Error Flag MSB_EF is set in the CHI Error Flag Register (CHIERFR). This appears only if the CHI frequency is too low to search through all message buffers within the NIT or a minislot. The message buffer result is not defined in this case. For more details see Section 13.7.3, “Number of Usable Message Buffers”. MB0 MBCCFR0[CHA] = 1, MBCCFR0[CHB] = 0 MB1 dual channel assignment single channel assignmentMBFIDR0[FID] = 10 MBFIDR1[FID] = 10 MBCCFR1[CHA] = 1, MBCCFR1[CHB] = 1

Chapter 13 FlexRay Communication Controller (FLEXRAY) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 585

13.6.8 Individual Message Buffer Reconfiguration

The initial configuration of each individual message buffer can be changed even when the protocol is not in thePOC:config state. This is referred to as individual message bufferreconfiguration. The configuration bits and fields that can be changed are given in the section on Specific Configuration Data . The common configuration data given in the section on Specific Configuration Data can not be reconfigured when the protocol is out of the POC:config state.

13.6.8.1 Reconfiguration Schemes

Depending on the target and destination basic state of the message buffer that is to be reconfigured, there are three reconfiguration schemes.

13.6.8.1.1 Basic Type Not Changed (RC1)

A reconfiguration will not change the basic type of the individual message buffer, if both the message buffer transfer direction bit MBCCSn.MTD and the message buffer type bit MBCCSn.MBT are not changed. This type of reconfiguration is denoted by RC1 in Figure 13-131. Single transmit and receive message buffers can be RC1-reconfigured when in the HDis or HDisLck state. Double transmit message buffers can be RC1-reconfigured if both the transmit side and the commit side are in the HDis state.

13.6.8.1.2 Buffer Type Not Changed (RC2)

A reconfiguration will not change the buffer type of the individual message buffer if the message buffer buffer type bit MBCCSRn.MBT is not changed. This type of reconfiguration is denoted by RC2 in Figure 13-131. It applies only to single transmit and receive message buffers. Single transmit and receive message buffers can be RC2-reconfigured when in the HDis or HDisLck state.

13.6.8.1.3 Buffer Type Changed (RC3)

A reconfiguration will change the buffer type of the individual message buffer if the message buffer type bit MBCCSRn.MBT is changed. This type of reconfiguration is denoted by RC3 in Figure 13-131. The RC3 reconfiguration splits one double buffer into two single buffers or combines two single buffer into one double buffer. In the later case, the two single message buffers must have consecutive message buffer numbers and the smaller one must be even. Message Buffers can be RC3 reconfigured if they are in the HDis state. Figure 13-131. Message Buffer Reconfiguration Scheme single RX single TX double TX (commit side) double TX (transmit side) RC1RC1 RC1 RC2 RC3RC3

PDF text was truncated. Refer to the original document for complete details.