NVM

1
Flash EEPROMModule

• NVM

2
System Memory
SCI 1
SCI 1



ATD 1
ATD 0
256K FLASH EEPROM
12K SRAM
Internal Bus


SPI 2 or PWM CH 4-7
SPI 1 or PWM CH 0-3
SPI 0
BKP INT MMI
PWM 8 CHAN
HCS12 CPU
SIM
CM BDM MEBI
PLL PIT

msCAN 3
msCAN 2
msCAN 1
BDLC or msCAN 0
msCAN 4 or IIC
ECT 8 CHAN
4K BYTES EEPROM
3
FLASH EEPROM

• 256K bytes of Flash made of four 64K byte
  blocks
• Single supply program and erase.
• Automated program and erase algorithm.
• Interrupt on command completion.
• All four flash blocks can be programmed and
  erased in parallel.
• Read-While-Write into different block.
• Fast sector erase and word program operation.
• Flexible protection scheme against accidental
  program or erase.
• Security feature to prevent intrusive access.

4
Memory Map Flash Control
0100 010F
Flash Control Registers
0000 0400 1000 4000 8000 C0
00 FF00 FFFF
Registers
4K EEPROM
30 - 3F Denotes contents of PPAGE Register
Page 3F
12K RAM
Page 3E
Flash Protect Low Area .5K, 1K, 2K, 4K
16K Flash (Fixed)
Page 3E
Page 31
Page 30
16Kx16 Flash Pages (Windowed)
Flash 0 Protection/Security Fields
Address
Description FF00 -FFF7 Backdoor
comparison key FF08-FF09
Reserved FF0A Flash block 3
protection FF0B Flash block 2
protection FF0C Flash block 1
protection FF0D Flash block 0
protection FF0E Reserved FF0F
Security Byte
Page 3F
16K Flash (Fixed)
Flash Protect High Area 2K, 4K, 8K, 16K
Vectors
Flash Protect High Area
5
Flash Control Registers

• All four Flash Blocks Occupy 16 Bytes In The
  I/O Register Area.
• Registers Are Divided Into Banked and Unbanked
• Banked Registers Are Selected With BLKSEL1
  BLKSEL0 In FCNFG
• Unbanked Registers Control State Machine Clock,
  Security, Interrupts
• Banked Registers Control Erasure, Programming,
  Protection
• Banked Registers Allow Erasure and Programming
  All Four Blocks in Parallel

6
Flash Clock Divider Register
FLCKDIV - Flash Clock Divider Register
Address Offset 0000
FDIVLD Flash Clock Divider Loaded This bit is
set when the FCLKDIV register is written to. An
attempt to program or erase the flash without
having written to this register previously will
result in an access error and the command will
not be executed. 1 Register has been written
to since the last reset. 0 Register has not
been written to. PRDIV8 Enable Prescaler by
8 1 Enables a prescaler by 8 before feeding
into the FCLKDIV divider. 0 OSCCLK is directly
fed into the FCLKDIV divider
FDIV50 Flash Clock Divider The combination
of FDIV8 and FDIV50 is used to divide the
oscillator clock down to a frequency of 150KHz -
200KHz. This resulting clock, FCLK, is used to
drive the program and erase state machines for
the flash. For frequencies of OSCCLK gt 12.8MHz
the Prescaler bit PRDIV8 must be set on.
FCLKDIV Settings
7
Flash Security

• Memory Security Mechanism Prevents Unauthorized
  Access To Flash and EEPROM.
• Prevents Access via BDM or Expanded Bus Unless
  Flash and EEPROM Are Erased.
• Security Is Controlled By The Two LSBs of The
  FSEC Register.
• These Bits Are Loaded From Flash Location FF0F.
• Two Bits of Opposite Polarity Are Used To Prevent
  Security Mechanism From Being Tricked.
• Security Mechanism Can Be Temporarily Disabled,
  But It Requires Firmware Support In The Target
  Application.
• 64-bit Access Key Ensures That Security Mechanism
  Can Not Be Easily Disabled By A Hacker.

8
Flash Security Control
FSEC - Flash Security Register
Address Offset x001
This register is loaded from flash address FF0F
during the reset sequence, indicated by F in
the reset row of the register description. KEYEN
Enable backdoor key to security 1 Backdoor to
flash read via BDM or external bus interface is
enabled 0 Backdoor to flash read via BDM or
external bus interface is disabled. When KEYEN
is set, the user can then bypass the security
by 1. Setting the KEYACC bit in the
configuration (FCNFG) register. 2. Writing the
correct four 16 bit words to the flash using the
backdoor comparison keys addresses. 3. Clear
the KEYACC bit. 4. If all four 16bit words match
the flash content, the MCU is unsecured by
forcing the bits SEC10 to the unsecured
state. 5. If any of the four 16bit words does
not match the flash content the MCU remains
secured and a security violation signal is sent
to the CPU.
NV62 Non-Volatile Flags These Non-Volatile
Flags are available to the user
9
Flash Configuration
FCNFG - Flash Configuration Register
Address Offset 0003
This unbanked register enables the interrupts,
gates the security backdoor writes and selects
the register bank to be operated on. CBEIE
Command Buffers Empty Interrupt Enable This bit
enables the interrupts in case of empty address,
data and command buffers. 1 An interrupt will
be requested whenever the CBEIF flag is set 0
Command Buffers Empty Interrupts disabled CCIE
Command Complete Interrupt Enable This bit
enables the interrupts in case of all commands
being completed. 1 An interrupt will be
requested whenever the CCIF flag is set 0
Command Complete Interrupts disabled KEYACC
Enable Security Key Writing 1 Writes to flash
module are interpreted as keys to open the
backdoor. 0 Flash writes are interpreted as the
start of a program or erase sequence. BKSEL10
Register bank select These two bits are used to
select which of the four register banks
are addressed. The register bank associated with
Flash 0 is the default out of reset. 00 Bank
0 01 Bank 1 10 Bank 2 11 Bank 3
10
Flash Protection
FPROT - Flash Protection Register
Address Offset 0004
This register determines whether a whole block or
subsections of a block are protected against
accidental program or erase. Each flash block can
have two protected areas, one starting from
relative address 8000 (called lower) towards
higher addresses and the other growing downwards
from FFFF (called higher). FPOPEN Opens the
flash block or subsections of it for program or
erase. 1 The flash block or subsections are
enabled to program or erase. 0 The whole flash
block is protected. FPHDIS Flash Protection
Higher address range disable This bit determines
whether there is a protected area at the higher
end of the flash block address map. 1
Protection disabled 0 Protection
enabled FPHS10 Flash Protection Higher
address size. These bits determine the size of
the protected area. FPLDIS Flash Protection
Lower address range disable This bit determines
whether there is a protected area at the lower
end of the flash block address map. 1
Protection disabled 0 Protection
enabled FPLS10 Flash Protection Lower
Address size These 2 bits determine the size of
the protected area.
Note F indicates that registers are loaded
from Flash control area as follows.
FF0D --gt Block 0, FF0C --gt Block 1, FF0B --gt
Block 2, FF0A --gt Block 3
11
Higher AddressRange Protection
12
Lower AddressProtection Range
13
Memory Protection
14
Flash Status
FSTAT - Flash Status Register
Address Offset 0005
CBEIF Command Buffers Empty Interrupt
Flag Indicates that the address, data and command
buffers are empty so that a new command sequence
can be started. The flag is cleared by writing a
1. By clearing the flag the command sequence is
launched. Writing a 0 aborts a command sequence
that has not yet been launched and sets the
ACCERR flag. 1 Buffers are ready to accept a
new command. 0 Buffers are full. CCIF
Command Complete Interrupt Flag Indicates that
there are no more commands pending. 1 All
commands are completed 0 Command in
progress PVIOL Protection violation Indicates
an attempt was made to program or erase an
address in a protected memory area. A subsequent
program or erase command cannot be executed while
this flag is set. The flag is also cleared by
writing a new, valid command after CBEIF is
cleared or when CCIF is clear. 1 A protection
violation has occurred. 0 no failure
BLANK Blank Verify Flag Indicates that the
flash block is fully erased in response to an
Erase-Verify command. 1 Flash block fully
erased. 0 Flash block not fully erased.
These flags are cleared by writing 1 to them.
15
Access Errors
1. Writing to the flash address space before
initializing FCLKDIV. 2. Writing to the flash
address space in the range 8000BFFF when
PPAGE does not select a 16K block in the flash
selected by BKSEL10. 3. Writing to the flash
address space 40007FFF or C000FFFF with
BKSEL10 not selecting Flash 0. 4. Writing a
misaligned word or a byte to the flash address
space. 5. Writing to the flash address space
while CBEIF is not set. 6. Writing a second
aligned word to the flash address space before
executing a program or erase command on the
previously written word. 7. Writing to any Flash
register other than FCMD after writing an aligned
word to the flash address space. 8. Writing a
second command to the FCMD register before
executing the previously written command. 9.
Writing a MASS erase command to FCMD while any
protection is enabled. See FPROT register
description. 10. Writing a SECTOR erase command
to FCMD while protection is enabled for that
sector. See FPROT register description. 11.
Writing to any Flash register other than FSTAT
(to clear CBEIF) after writing to the command
register. 12. The part enters STOP mode and a
program or erase command is in progress. The
command is aborted. The flag is cleared by
writing a 1. 1 Access error has occurred. 0
Command sequence or command execution
successfully completed.
16
Flash Command
FCMD - Flash Command Buffer Register
Address Offset 0006
ERASE Erase flash Erases a flash sector (512
bytes) or the whole flash depending on the MASS
bit. Trying to erase a sector located in a
protected area will result in a protection
violation indicated by the PVIOL bit in the FSTAT
register being set. 1 Perform a sector erase if
MASS0 or a mass erase if MASS1. PROG Word
programming Trying to program a word located in a
protected area will result in a protection error
indicated by PVIOL set. ERVER - Enable Erase
Verify Verifies the flash block is fully erased.
A successful verification will set the BLANK bit
in the FSTAT register. 1 Perform an erase
verify after mass erase. MASS - Enables Mass
Erase Perform a mass erase of the selected 64K
byte block. This bit works in conjunction with
the ERASE bit. If any protection is active on
the selected block, mass erase has no effect and
the PVIOL bit in the FSTAT register is set. Write
at anytime. 1 Perform a mass erase of the whole
block. 0 Perform sector erase.
17
Erase Flowchart
18
Programming Flowchart
19
EEPROM4K BYTE
20
EEPROM Features

• 4K Non-Volatile Electrically Erasable
  programmable memory located _at_0000 - 0FFF.
• Relocateable to any 4K Boundary
• Organized as 2048 by 16-bit Words to allow for
  word size Read/Write and Programming
• Erase Sector 4 bytes (2 words)
• Three-step MCU instructions sequence to program
  or erase the EEPROM.
• Single supply program and erase.
• Automated program and erase algorithm.
• Interrupt on command completion.
• Fast sector erase and word program operation.
• Flexible protection scheme against accidental
  program or erase.
• Programming voltage derived from VDD with
  internal charge pump
• Hardware Interlocks

21
4K EEPROM MODULE
Command Interface
EEPROM ARRAY 2K x 16 Bits
Command Complete Interrupt
word0
Registers
word1
word2
word3
Command Buffer Empty Interrupt
Command Pipeline
comm2 addr2 data2
comm1 addr1 data1
word2044
word2045
word2046
Clock Divider
word2047
Oscillator Clock
22
MC9S12 0.25u EEPROM Info

• High Speed Programming (EECLK 200KHz)
• Very fast EEPROM Program (word) 46ms
• EEPROM Sector Erase (2 words) 20ms
• EEPROM Mass Erase (4Kbytes) 100ms
• Erase Cycling
• 100,000 Erase cycles
• (should always check individual data sheets)
• Further Reading
• AN2204/D Fast NVM Programming for the
  MC9S12DP256.

23
EEPROM Register Summary

• Three Configuration registers
• Clock Divider Register (ECLKDIV)
• Prescaler value for the EEPROM sub-system clock.
• MUST be configured to generate a module clock
  between 150KHz and 200KHz for program erase.
• Configuration Register (ECNFG)
• Enables EEPROM interrupts
• Protection Register (EPROT)
• Controls whether the EEPROM is protected against
  program erase.
• Configures the size of the protected block all
  4K OR 64 to 512 bytes.
• Loaded from the non-volatile EEPROM Protection
  Field on Reset.

• Two working registers
• Command Buffer Register (ECMD)
• Determines what operation is to be performed on
  the EEPROM block.
• Status Register (ESTAT) -
• Contains EEPROM state machine Control, Status and
  Interrupt flags

24
EEPROM Module Clock Prescaler
ECLKDIV - EEPROM Clock Divider Register
Bit 7
6
5
4
3
2
1
0
EDIVLD
PRDIV8
EDIV50
EDIVLD Flash Clock Divider Loaded This bit is
set when the ECLKDIV register is written to. An
attempt to program or erase the EEPROM without
having written to this register previously will
result in an access error and the command will
not be executed. PRDIV8 Enable Prescaler by
8 A pre-prescaler! Set this bit if oscillator
frequency is gt12.8MHz. EDIV50 Flash Clock
Divider The combination of PRDIV8 and EDIV50
is used to divide the oscillator clock down to a
frequency of 150KHz - 200KHz. This resulting
clock, EECLK, is used to drive the program and
erase state machines for the EEPROM. Follow the
flow chart in the specification to calculate the
correct value for each application. FOR CORRECT
PROGRAM AND ERASE OPERATION EECLK MUST BE WITHIN
SPEC REGARDLESS OF THE SYSTEM FREQUENCY.
25
EEPROM Command Summary
The operation executed by the EEPROM state
machine is determined by the value written to
the Command Buffer Register (ECMD)
Command Value
Operation
Comments
20
Word Program
Program a word. (2 bytes, word aligned)
40
Sector Erase
Erase an EEPROM sector. (4 bytes, double word
aligned)
41
Mass Erase
Erase the whole EEPROM. (Only possible when
EPDIS and EOPEN bits are set)
05
Erase Verify
Verify the EEPROM block is fully erased. A
successful verification will set the BLANK bit
in the ESTAT register.
60
Sector Modify
Erase the EEPROM sector containing the word and
then program one word with the new data. By
launching a sector modify command and then
pipelining a Program command its possible to
completely update a Sector.
other
illegal
Any other value will generate an Access Error.
NOTE locations must only be programmed once
following each erase.
26
EEPROM Configuration
ECNFG - EEPROM Configuration Register
Address Offset 0003
CBEIE - Command Buffers Empty Interrupt
Enable This bit enables the interrupts in case of
an empty address, data and command buffers. 1
An interrupt will be requested whenever the CBEIF
flag is set 0 Command Buffers Empty Interrupts
disabled CCIE - Command Complete Interrupt
Enable This bit enables the interrupts in case of
all commands being completed. 1 An interrupt
will be requested whenever the CCIF flag is set 0
Command Complete Interrupts disabled
27
EEPROM Protection
EPROT - EEPROM Configuration Register
Address Offset 0004
EPOPEN Opens the EEPROM block or a subsection
of it for program or erase. 1 The EEPROM block
or subsections are enabled to program or erase. 0
The whole EEPROM block is protected. In this
case the other bits within the protect register
are dont care. EPDIS EEPROM Protection
disable This bit determines whether there is a
protected area at the higher end of the EEPROM
block address map. 1 Protection disabled 0
Protection enabled
EEPROM Protection address size
28
EEPROM Command
ECMD - EEPROM Command Buffer Register
Address Offset 0006
ERASE Erase EEPROM Erases a EEPROM sector (4
bytes) or the whole EEPROM depending on the MASS
bit. Trying to erase a sector located in a
protected area will result in a protection
violation indicated by the PVIOL bit in the
FSTAT register being set. 1 Perform a sector
erase if MASS0 or a mass erase if MASS1. PROG
Word programming Trying to program a word
located in a protected area will result in a
protection error indicated by PVIOL set. ERVER -
Enable Erase Verify Verifies the EEPROM block is
fully erased. A successful verification will set
the BLANK bit in the FSTAT register. 1 Perform
an erase verify after mass erase. MASS - Enables
Mass Erase Perform a mass erase of the selected
64K byte block. This bit works in conjunction
with the ERASE bit. If any protection is active
on the selected block, mass erase has no effect
and the PVIOL bit in the FSTAT register is set.
Write at anytime. 1 Perform a mass erase of the
whole block. 0 Perform sector erase.
29
EEPROM Status
ESTAT - EEPROM Status Register
Address Offset 0005
CBEIF Command Buffers Empty Interrupt
Flag Indicates that the address, data and command
buffers are empty so that a new command sequence
can be started. The flag is cleared by writing a
1. By clearing the flag the command sequence is
launched. Writing a 0 aborts a command sequence
that has not yet been launched and sets the
ACCERR flag. 1 Buffers are ready to accept a
new command. 0 Buffers are full. CCIF
Command Complete Interrupt Flag Indicates that
there are no more commands pending. 1 All
commands are completed 0 Command in
progress PVIOL Protection violation Indicates
an attempt was made to program or erase an
address in a protected memory area. A subsequent
program or erase command cannot be executed while
this flag is set. The flag is also cleared by
writing a new, valid command after CBEIF is
cleared or when CCIF is clear. 1 A protection
violation has occurred. 0 no failure
BLANK Blank Verify Flag Indicates that the
EEPROM block is fully erased in response to an
Erase-Verify command. 1 EEPROM block fully
erased. 0 EEPROM block not fully erased.
These flags are cleared by writing 1 to them.
30
Access Errors
1. Writing to the EEPROM address space before
initializing ECLKDIV. 2. Writing a misaligned
word or a byte to the EEPROM address space. 3.
Writing to the EEPROM address space while CBEIF
is not set. 4. Writing a second aligned word to
the EEPROM address space before executing a
program or erase command on the previously
written word. 5. Writing to any EEPROM register
other than ECMD after writing an aligned word to
the EEPROM address space. 6. Writing a second
command to the ECMD register before executing the
previously written command. 7. Writing a MASS
erase command to ECMD while any protection is
enabled. See EPROT register description. 8.
Writing a sector erase command to ECMD while
protection is enabled for that sector. See EPROT
register description. 9. Writing to any EEPROM
register other than ESTAT (to clear CBEIF) after
writing to the command register. BLANK Blank
Verify Flag Indicates that the EEPROM block is
fully erased in response to an Erase- Verify
command. The flag is cleared by writing a 1. 1
EEPROM block fully erased. 0 EEPROM block not
fully erased.