Home

TLE986xQX BE

1. Wait for Ack Max waiting time 10 ms 55 Ack Oln Data Block Program Codes for third page of first sector Checksum Block Length 2 bytes 128 Bytes 1 byte Wait for Max waiting time 10 ms 55 Oln Data Block Program Codes for fourth page of first sector Checksum Block Length 2 bytes 128 Bytes 4 byte eS Wait for Ack Max wai ng time 10 ms 55u Ack 024 EOT Last Block CodelEngth Not Used Byte Checksum 127 bytes 1 byte Wait for Ack Max waiting time 250 us 55n Ack Figure 5 2 Multiple NVM Page program via working mode 2 User Manual 59 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL 5 2 2 5 Mode 3 Code Execution inside NVM Mode 3 is used to execute a user program in the NVM of the microcontroller at the address pointed by the NVM location 11000004 The header block for this working mode has the following structure The header block Mode Data 5 bytes 00 034 Header Mode 3 Not Used Block Mode Data Description Not used The five Bytes are not used and will be ignored in mode 3 In working mode 3 the header block is the only transfer block to be se
2. NVM Table 6 11 100 Programmable Page 1 cont d Data SFR Variable Name Description Default Offset Value 76 CHIP ID BYTE 10 Chip Id Byte 101 Chip Individual 774 CHIP ID BYTE 11 Chip Id Byte 111 Chip Individual 8 CS SA WITH PROT E When set to A5 enables Service 00 N Algorithm even on protected NVM Data Sector 794 CS_USER_CAL_START Enable Byte for user calibration UP EN data download during startup If value 0xC3 then the download is enabled VAH CS USER CAL XADD High Byte of the RAM starting 004 H address where downloaded data has to be stored OxFO for RAM initial address 7By CS_USER_CAL_XADDL LOW Byte of the RAM starting 00H address where downloaded data has to be stored 0x00 for RAM initial address 7Cy CS USER CAL CS PA CS page where calibration data 004 GE has to be downloaded from By default 100TP page1 should be used Value 0x11 CS USER CAL NUM Number of Bytes to be downloaded 00 starting from the first Byte of the selected CS page CHECKSUM 50 P29 Checksum SO P29 XOR first 126 Chip Bytes of page 29 Individual PROG TIMES 100 _ This reflects the number of times 00 P1 that this page has been programmed Up to a maximum of 100 times 1 This is a unique device specific identification number The variant specific identification number is described in Chapter 6 2 1 User Manual 81 Rev 1 3 2015 07 1
3. 120 6 4 4 3 NVM user erase operation 120 6 4 4 4 NVM user programming abort operation 121 6 4 5 NVM protection 121 User Manual 4 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Introduction 1 Introduction This document specifies the BootROM firmware behaviors for the TLE986xQX family The specification is organised into the following major sections BootROM Overview Startup Procedure LIN and UART BSL features NVM structure and user routines description 1 1 Purpose The document describes the functionality of the BootROM firmware 1 2 Scope The BootROM firmware for the TLE986xQX family will provide the following features Startup procedure for stable operation of TLE986xQX chip Debugger connection for proper code debug BSL mode for users to download and run code from NVM and RAM e NVM operation handling e g program and erase 1 3Abbreviations and special terms Table 1 1 Abbreviations and Terms BSL BootStrap Loader CS Configuration Sector EOT End of Transmission EVR Embedded Voltage Regulator NAC No Activity Count NAD Node address for diagnostic NEA NVM End Address NLS NVM Linear Size NSA NVM Starting Address NVM Non Volatile Memory OCDS On Chip Debug Support OSC Oscillator PEM Program Execution Mode U
4. 92 6 3 6 Read user calibration data 92 6 3 7 Read NVM config status routine 93 6 3 8 Read NVM ECC2 address routine 94 6 3 9 MapRAM initialization 95 6 3 10 Read 100 Time Programmable parameter data routine 96 6 3 11 Program 100 Time Programmable routine 97 6 3 12 Sector Erasing Routine 99 6 3 13 NVMCLKFAC setting routine 99 6 3 14 RAM MBIST starting routine 99 6 3 15 NVM ECC check routines 100 6 3 16 NVM protection status change routines 102 6 4 NVM user applications 107 6 4 1 NVM Data sector handling 107 6 4 2 Supporting Background NVM Operation 114 6 4 3 Emergency operation handling 117 6 4 3 1 Emergency operation handling Type 1 routines 117 6 4 3 2 Emergency operation handling Type 2 routines 118 6 4 3 3 Emergency operation handling timing 118 6 4 4 NVM user routines operation 119 6 4 4 1 NVM user programming 119 6 4 4 2 Tearing safe Programming
5. User Manual 17 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode 4 2 LIN BSL mode overview The LIN BSL mode consists of three functional phases described below Phase I To establish a connection with every frame Master Request or Slave Response frame received by automatically synchronizing to the transfer speed baud rate of the communication partner host Phase Il To execute the host specified command In order to execute the commands host needs to send a Master Request Header first followed by a Command frame within the 8 byte payload of the Master Request Frame The selected mode information is embedded in the Command frame The possible modes are Mode 0 004 Transfer a user program from the host to RAM Mode 1 01 4 Execute a user program in the RAM Mode 2 024 Transfer a user program from the host to Mode 03 Execute a user program in the NVM Mode 4 04 Erase Mode 6 064 NVM Protection mode enabling disabling Scheme Mode 8 08 Transfer a user program from the host to RAM using classic LIN checksum Mode 9 09 Execute a user program in the RAM using classic LIN checksum Mode A 0A Get info based on Option Byte LIN BSL supports Fast Programming through modes 0 2 and 8 with the selection of Fast Programming Option Refer to Section 4 4 4 2 for more details Phase Ill To send micro
6. Mode4 Addr4 Addr3 Addr2 Addr1 40 byte MSB LSB 1 byte Mode Data Description Start Addr 4 to 1 32 bit address of the NVM sector to be erased Option set to 40 to enable sector erase When the Option Byte 404 the NVM sector selected by the address provided in the Mode Data field is erased The address should be aligned with the beginning of the chosen sector The Header for mass erase Option C0 The header block for Option has the following structure Mode Data 5 bytes 00 NAD 04 Option Checksum Header 1 byte pron Mode 4 Gone C0 1 byte y 1 byte Mode Data Description Not used This Byte is not used and will be ignored in mode 4 User Manual 30 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode Option set to CO to enable mass erase When the Option Byte CO mass erase on all the sectors in the NVM unit is performed Note When NVM is protected mode 4 is not accessible and so NVM cannot be erased 4 4 4 5 Mode 6 NVM protection Mode 6 is used to enable or disable the NVM protection mode read and write protection of the Linearly and Non Linearly mapped sectors via the given user password The header block for this working mode has the following structure The header block 00 Mode Data 5 bytes NAD H 06 Checksum 1 byte Header Mode 6 User password N
7. NVM Table 6 3 NVM memory sector organisation cont d Address NVM Sector Number 1101E000H to 31 1101EFFFH 1101FOOOH to 32 1101FFFFH Table 6 4 NVM memory sector 1 page organisation Address Page Number of NVM Sector 11000000H to 0 1100007FH 11000080H to 1 110000FFH 11000100H to 2 1100017FH 11000180H to 3 110001FFH 11000200H to 4 1100027FH 11000280H to 5 110002FFH 11000300H to 6 1100037FH 11000380H to 7 11000 11000400H to 8 1100047FH 11000480H to 9 110004FFH 11000500H to 10 1100057FH 11000580H to 11 110005FFH 11000600H to 12 1100067FH User Manual 72 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 4 NVM memory sector 1 page organisation cont d Address Page Number of NVM Sector 11000680H to 13 110006FFH 11000700H to 14 1100077FH 11000780H to 15 110007FFH 11000800H to 16 1100087FH 11000880H to 17 110008FFH 11000900H to 18 1100097FH 11000980H to 19 110009FFH 11000A00H to 20 11000A7FH 11000A80H to 21 11000AFFH 11000B00H to 22 11000B7FH 11000B80H to 23 11000BFFH 11000COOH to 24 11000C7FH 11000C80H to 25 11000CFFH 11000D00H to 26 11000D7FH 11000D80H to 27 11000DFFH 11000E00H to 28 11000E7FH 11000E80H to 29 11000EFFH User Manual 73 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 4 NVM memory sector 1 page organisation cont d Address Page Numb
8. instead of an Acknowledge 554 followed by no further Bytes To prevent user code to be read this option is disabled if NVM is protected and only a Protection Error Byte FD will be returned Note In case the address is pointing to an erased non linearly mapped page the address is considered invalid and a Block Type Error FF is returned The header block for user configuration sector page read Option F0j Mode Data 5 bytes 00 0A Option Checksum Header Mode A NotUsed NotUsed NotUsed CS Page FO 1 byte Block 1 byte 1 byte 1 byte 1 byte 1 byte Mode Data Description Not Used These Bytes are not used and will be ignored for Option FO CS Page Selection of the CS Page to be checked refer to Figure 6 2 Option set to FO to enable configuration sector page read This option will trigger a read of the addressed configuration sector page Microcontroller will return an Acknowledge 55 4 followed by the 128 CS page data Bytes starting from the least significant Byte of the page Configuration Sector page is selected by the CS Page Byte according to the scheme shown in Figure 6 2 In case an invalid CS page is selected the microcontroller will return a Block Type Error instead of an Acknowledge 55 4 followed by no further Bytes To prevent user code to be read this option is disabled if NVM is protected NVM password installed and only a Protectio
9. Infineon TLE986xQX BE BootROM LIN BSL mode 4 4 2 Block type This field determines the types of transfer blocks There are 3 transfer block types shown in Table 4 2 Table 4 2 Type of transfer block Block Name Block Type Description Header block 00 Special information is contained in the data area of the block which is used to select different working modes Data block 014 This block is used in working modes 0 2 and 8 to transfer a portion of program code The program code is in the data area of the block End of Transmission 02 This block is the last block in data transmission in EOT block working modes 0 2 and 8 The last program code to be transferred is in the data area of the block 4 4 3 Checksum Diagnostic LIN frame always uses classic checksum where checksum calculation is over the data Bytes only The Checksum is the last field of Command and Response LIN frames For TLE986xQX there are 2 types of checksum implemented Classic LIN and Programming checksum Both Programming and LIN Checksum are supported and are indicated in the respective modes 4 4 3 1 Classic LIN checksum The classic checksum is a standard LIN checksum used for communication with LIN 2 0 slaves The classic checksum contains the inverted eight Bits sum with carry over all data Bytes 4 4 3 2 Programming checksum The programming checksum or Inverted Classic checksum is a non LIN standard checksum
10. Infineon TLE986xQX BE BootROM NVM Table 6 37 NVM Data sectors not linearly mapped NVM sectors read protection enable subroutine Subroutine 000038F5 USER DFLASH RD PROT EN Prototype bool USER DFLASH RD PROT EN unsigned short DFLASH PW Input DFLASH PW unsigned short Password to be compared to the one stored in the 100TP page 1 offset OE Output Returned value bool Pass or Fail 0 Operation completed successfully 1 Operation failed Password does not match This routine sets the bit NVM PROT STS 2 to 0 Table 6 38 NVM Data sectors not linearly mapped NVM sectors read protection disable subroutine Subroutine 000038ED USER DFLASH RD PROT DIS Prototype bool USER DFLASH RD PROT DliS unsigned short DFLASH PW Input DFLASH PW unsigned short Password to be compared to the one stored in the 100TP page 1 offset OE Output Returned value bool Pass or Fail 0 Operation completed successfully 1 Operation failed Password does not match This routine sets the bit NVM_PROT_STS 2 to 1 For the NVM protection mechanism user configuration sector pages 100TP are considered being part of the NVM code area Read protection does not block code fetching Note Copying code from NVM to RAM requires a normal NVM read execution and so is blocked in case NVM Read Protection is enabled Read protection is meant to protect user application code from hacking Hence
11. User Manual 32 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode Mode Data 5 bytes 00 Start Start Exp Exp NAD 0A Check 1 bytey Header Addr Addr CHKS m n bv Block High Low High Low 1b te 1 byte 1 byte 1 byte 1 byte y Mode Data Description Start Addr High Low Address of the NVM page for checksum check Address should be page aligned Exp CHKS High Low Expected checksum High Low Byte Option set to 104 to enable NVM page checksum check Note The start address provided with the header block has to be shifted by 7 bits to the left and then added to the NVM start address to build the actual address i e it is calculated as follows in Mode A Option 10 Actual address 110000004 StartAddrHigh 15 StartAddrLow 7 This option will trigger a checksum calculation 16 bits inverted XOR over the whole page pointed by the address calculated form the offset provided in the header block and the result will then be compared with the expected checksum provided as well by the user in the header frame The response frame will then return an Acknowledge followed by four data Bytes These Bytes are in sequential order pass fail indication 00 if the calculated and expected checksum match 80 if they differ calculated checksum High Byte calculated checksum Low Byte and a final Byte equal to 00 In case
12. 1 byte 1 byte Mode Data Description CS Page Selection of the CS Page to be checked refer to Figure 6 2 Not used This Byte is not used and will be ignored Exp CHKS High Low Expected checksum High Low Byte Option set to 504 to enable configuration sector page checksum check Checksum 16 Bits inverted XOR on the selected configuration sector page is calculated and then compared with the expected values provided as well as an input The response frame will then give back a pass or fail indication plus the calculated checksum In case the provided CS address is not valid the microcontroller will return a Block Type Error followed by no further Bytes For mode A the header block is the only transfer block to be sent by the host followed by a Slave Response Header In case of valid header block the microcontroller will send a response block Acknowledgement code 55 4 followed by the 4 Bytes data The response for mode A is described in Section 4 5 3 4 5 Phase Ill Response protocol to the host The microcontroller status is sent to the host only when a Slave Response Header frame is received The microcontroller status is always sent in a transfer block of 9 Bytes User Manual 34 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode A typical transfer block consists of four parts NAD Response Response Data Checksum 1 byte 1 byte 6 bytes 1 byte
13. Output Return value bool Pass or Fail 0 Abort successfully assembly buffer closed 1 Abort failed as programming already started Possible reason of failure Programming already started Routine called as nested call during the execution of another NVM routine e g via RAM branching 6 3 5 Read NVM status routine This user routine checks for the NVM status Table 6 19 Read NVM status subroutine Subroutine 000038C5 USER NVMRDY Prototype bool USER NVMRDY void Input Output Return value bool Pass or Fail 0 NVM is not busy 1 2 NVM is busy now 6 3 6 Read user calibration data All data stored in user accessible config sector pages 100TP can be downloaded into the RAM using this routine In particular this routine has been developed to help user in downloading the ADC1 calibration parameters stored at the beginning of 100TP page 1 See Table 6 11 to an easily accessible data space RAM To download the data the user needs to provide the config sector page where data has to be read from number of Bytes to be copied and the RAM address where data has to be copied to The routine will copy the specified number of Bytes from the selected page starting always from first Byte in the page into the RAM starting at the given address Note The provided RAM address where data have to be copied is just an offset to the device RAM start address 18000000 User Manual 92 Rev 1 3
14. User Manual 42 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL 5 FastLIN BSL Mode UART BSL This chapter describes the protocol used for the FAST LIN and UART BSL The protocol is based on the phases described following Phase I Establish a serial connection and automatically synchronize to the transfer speed baud rate of the serial communication partner host Phase Il Perform the serial communication with the host The host controls the communication by sending special header information which selects one of the working modes These modes are Mode 0 00 Transfer a user program from the host to RAM or write 100TP pages Mode 1 014 Execute a user program in the RAM Mode 2 024 Transfer a user program from the host to NVM Mode 3 034 Execute a user program in the NVM Mode 4 04 Erase NVM Mode 6 064 NVM protection mode enabling disabling Scheme Mode A 0A4 Get Info based on Option Byte Except mode 1 mode 3 and mode 6 the microcontroller would return to the beginning of Phase Il and wait for the next command from the host after executing all other modes The serial communication which is activated in Phase Il is performed via the integrated LIN transceiver for FastLIN and via with the full duplex serial interface UART of the TLE986xQX for UART BSL The serial transfer is working in asynchronous mode with the serial parameters 8N1 eight
15. Block 1 byte 1 byte High Low te 1 byte 1byte y User Manual 65 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Mode Data Description CS Page Selection of the CS Page to be checked refer to Figure 6 2 Not Used This Byte is not used and will be ignored for Option 50 Expected CHKSum High Low Expected checksum High Low Byte Option set to 50 to enable CS page checksum check This option will trigger a checksum calculation 16 bits inverted XOR refer to Chapter 5 2 3 over the whole CS page pointed by the address given in the header block and the result will then be compared with the expected checksum provided as well by the user in the header frame CS page address has to be in accordance with the configuration sector address scheme described in the Figure 6 2 If the given address is valid the microcontroller will return an Acknowledge followed by four data Bytes and a single byte checksum The Bytes are in sequential order pass fail indication OO if the calculated and expected checksum match 80 if they differ calculated checksum High Byte calculated checksum Low Byte and a final Byte equal to 00 In case the provided address is not valid the microcontroller will return a Block Type Error FF instead of an Acknowledge 55 4 followed by no further Bytes Note The checksum is calculated on the acknowledge and the 4 data bytes The header bl
16. Minor no Pack CLK Family Design Step Major Design Step Minor Hexl values values Decimal values A Design Step A B Design Step B C Design Step C D Design Step D E Design Step E F Design Step F Derivative Feature CLK Decimal values 0 20 MHz 1 24 MHz 2 40 MHz 3 Reserved Figure 6 1 Customer ID definition 6 3 NVM user rou tines organisation The NVM user routines are BootROM routines called by user and placed from the address 0000383D to 000039251 The complete list of NVM user routines can be found in Table 6 13 User Manual 83 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 13 user routines list Address Routine Description 00003925 USER CFLASH WR PROT EN To enable write protection on the linearly mapped NVM sectors 0000391D USER_CFLASH_WR_PROT_DIS To disable write protection on the linearly mapped NVM sectors 00003915 USER_CFLASH_RD_PROT_EN To enable read protection on the linearly mapped NVM sectors 00003900 USER CFLASH RD PROT DIS To disable read protection on the linearly mapped NVM sectors 00003905 USER DFLASH WR PROT EN To enable write protection on the non linearly mapped NVM sectors 000038FDy USER_DFLASH_WR_PROT_DIS To disable write protection on the non linearly mapped NVM sectors 000038F5 USER_DFLASH_RD_PROT_EN To enable read protectio
17. range or invalid CS Page All other Either the Block Type is Retransmit a valid combinations undefined or option is invalid block or the flow is invalid Checksum FEy All There is a mismatch between Retransmit a valid Error combinations the calculated and the block received Checksum User Manual 49 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Table 5 4 Definitions of responses cont d Response Value Description Block BSL Reasons Implications Corrective Type Action Protection FDy Head 0 2 Protection against external Disable protection Error er 4 6 A access enabled i e user password is valid Combined FBy EOT 0 The operation is targeting Check the Byte Offset 100 TP page 1 and there is at offset Error Code least 1 Byte with a notin page offset and 1 byte pointing to the Customer ID reserved region ID Offset FA EOT 0 The operation is targeting Check the Byte Error Code 100 TP page 1 and there is at offset least 1 Byte pointing to the Customer ID reserved region Combined F9y EOT 0 There is at least 1 Byte with a Check the Byte Offset not in page offset offset Error Code 5 2 1 4 Block response delay As described in Section 5 2 1 3 after receiving any block the microcontroller communicates to the host whether the block was successfully received by sendin
18. NAD Node Address for Diagnostic specifies the address of the active slave node Response Response code indicating Acknowledge or Error status See Table 4 7 Response Data These 6 Bytes are generally not used and set to 004 An exception is mode A response which is described in detail in Section 4 5 3 Checksum The checksum is calculated based on NAD Response and Response Data Bytes All responses sent by microcontroller will adopt classic checksum See Section 4 4 3 1 4 5 1 Acknowledgement response The Acknowledge response code 55 4 is sent by microcontroller to host to indicate that a block has been successfully received 4 5 2 Error response There are 3 error responses indicated by microcontroller 4 5 2 1 Block Type Error FF This error can occur in the following conditions 1 A Block Type other than the implemented ones was received See Table 4 2 2 An incorrect sequence of transfer blocks was received For example in mode 0 operation upon receiving a header block a slave response request is expected However if another header block is received this will result in a Block Type Error 4 5 2 2 Checksum Error FE This error occurs when the checksum comparison fails Microcontroller will reject the transfer block by sending back a Checksum Error code to the host 4 5 2 3 Protection Error FD This error occurs when selected NVM sectors for programming or erasing are protected As the sele
19. The different sections of the BootROM provide the following basic functionality Startup procedure The startup procedure is the main control program in the BootROM It is the first software controlled operation that is executed after any reset The startup procedure will perform configuration sector verification EVR calibration on chip oscillator trimming MapRAM initialisation BootROM protection NVM protection and decode the pin latched values of the TMS P0 0 and PO 2 to determine which mode it will jump to User mode User mode is used to support user code execution in the NVM address space However if the NVM memories are not protected and the Bytes at address 11000004 11000007 are erased then device enters sleep mode If a valid user reset vector was found at 11000004 values at 11000004 11000007 not equal to FFFFFFFF and a proper NAC value is found then the BootROM proceeds into user mode In case an invalid NAC value is found the device waits forever for a FastLIN BSL communication User Manual 8 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Overview LIN BSL mode It is used to support BSL via LIN like protocol Downloading of code data to RAM and NVM related programming is supported in this mode UART BSL mode It is used to support BSL via UART protocol Downloading of code data to RAM and NVM related programming is supported in this mode User Manual 9 Rev 1 3 2015 07 10 In
20. whereby the program code is transmitted from the host to the microcontroller by data block and EOT block which are described below 1 NVM address should be aligned to the Page address low Byte of the start address equal to 004 or 80 If the data starts in a non page address PC host should fill up the beginning vacancies with 00 and provide the start address of that page address 2 n the case NVM is protected entry to FastLIN BSL is not possible User Manual 26 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM LIN BSL mode The data block Data Area 6 bytes Hin Data Block d c eta E Data area Description Program Code The program code has a fixed length of 6 Bytes per data block The EOT block NAD 1 byte 024 EOT Block 1 byte Data Area 6 bytes Last Code length 1 byte Program Code Last Codelength 6 1 Last Codelength bytes Not Used bytes Checksum 1 byte Data area Description Last Codelength This Byte indicates the length of the program code in this EOT block Program Code The last program code valid data to be sent to the microcontroller Not used The length is 6 1 Last Codelength These Bytes are not used and they can be set to any value Note 1 NVM programming needs to be performed in multiples of a page 1 page is 128 Bytes Host is expected to introduce a delay of 15 ms after 12
21. 1 gives an overview of the action of the microcontroller with respect to No Activity Count NAC values and the Table 3 2 shows the selection of the BSL interface depending on the NAC bits 7 and 6 User Manual 14 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Startup procedure Table 3 1 Type of action w r t No Activity Count NAC values NAC Value Action 014 414 814 C1 0 ms delay Jump to user mode immediately 024 42u 824 C24 5 ms delay before jumping to user mode 034 43H 834 10 ms delay before jumping to user mode 04h 44u 844 4 15 ms delay before jumping to user mode 05y 454 854 Cy 20 ms delay before jumping to user mode 06 46 4 864 C64 25 ms delay before jumping to user mode 074 47H 874 C74 30 ms delay before jumping to user mode 08 48 4 88H C8H 35 ms delay before jumping to user mode 0914 494 891 9 40 ms delay before jumping to user mode OAy 4Ay 8 CAH 45 ms delay before jumping to user mode 4By 8By CBH 50 ms delay before jumping to user mode OCh 4 8Ch CCH 55 ms delay before jumping to user mode 3Fy 00 Wait forever for the first LIN frame 4Dy 7Fy 405 Invalid Wait forever for the first FAST LIN frame 80 BFy 804 Wait forever for the first UART frame CDy FFy COH Wait forever for the first UART frame 1 If a LIN frame UART frame is received within
22. 2015 07 10 Cinfineon Table 6 20 TLE986xQX BE BootROM NVM Read user calibration data subroutine Subroutine 000038 0 USER READ CAL Prototype char USER READ CAL char NumOfBytes char CSAddr short RAMAddr Input NumOfBytes char Number of Bytes to be copied from config sector into the RAM allowed values are form 01 to 80 CSAddr char user CS page to take data from refer to Figure 6 2 RAMAddr short RAM address offset to copy data to O3FFy RAMAddr RAMAddr NumOfBytes RAM size RAM size kB RAM OBFFy 6 kB RAM 17FFy Output Return value char Bit 0 Pass or Fail 0 Read is successful 1 Read is not successful due to invalid input values Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 7 Fail Routine was not executed Possible reasons of failure The input parameters are incorrect Possible reason for execution fail Routine called as nested call during the execution of another NVM routine e g via RAM branching 6 3 7 Read NVM config status routine This routine reads the NVM Configuration Status Details in the following table User Manual 93 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 21 Read NVM config status subroutine Subroutine 000038B5 USER CONFIG Prototype bool USER NVM CONFIG char NVMSize char MapRAMSize Input Output Return value boo
23. 5 50y to ADC2_CNT0O_3_ LOWE Postprocessing 121313124 534 R Lower counter trigger level of channels 0 to 3 User Manual 79 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 11 100 Programmable Page 1 cont d Data SFR Variable Name Description Default Offset Value 044 to ADC2 CNT4 5 LOWE Postprocessing 00000A0A 97H R Lower counter trigger level of channels 4 to 5 58 to ADC2 CNTO UPPER Postprocessing 12131B1Ay 5 Upper counter trigger level of channels 0 to 3 5C to ADC2 CNTA4 5 UPPER Postprocessing 000012124 DFy Upper counter trigger level of channels 4 to 5 60 4 to ADC2 MMODEO 5 Postprocessing 00000000 63H Overvoltage measurement mode of channels 0 to 5 4 Reserved Reserved 00 6By 6Cy CHIP_ID_BYTE_00 Chip Id Byte 00 Chip Individual 6Dy CHIP_ID_BYTE_01 Chip Id Byte 011 Chip Individual 6E CHIP ID BYTE 02 Chip Id Byte 02 Chip Individual 6Fy CHIP_ID_BYTE_03 Chip Id Byte 03 Chip Individual 704 CHIP ID BYTE 04 Chip Id Byte 041 Chip Individual 714 CHIP_ID_BYTE_05 Chip Id Byte 05 Chip Individual 724 CHIP_ID_BYTE_06 Chip Id Byte 06 Chip Individual 734 CHIP_ID_BYTE_07 Chip Id Byte 071 Chip Individual 744 CHIP_ID_BYTE_08 Chip Id Byte 081 Chip Individual 75 CHIP ID BYTE 09 Chip Id Byte 09 Chip Individual User Manual 80 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM
24. 5 2 3 Protection Error FD 23e llle isda nois ara ed 35 4 5 2 4 Response overview sisse lh hm hh 36 4 5 3 Mode Aresponse zs gc e var Ra See ee RR p Rn 37 4 6 Fast LIN BSL mee keep Ree de sens 38 4 6 1 Entering Fast LIN 51 38 4 7 After Reset conditions 40 4 8 BSL Mode User Parameters NAC NAD 41 4 8 1 Programming NAD 41 4 9 WDTT refreshing occis cu Rem i 42 5 FastLIN BSL Mode UART BSL 43 5 1 Phase Automatic serial synchronization to the host 43 5 1 1 General description 44 5 1 2 Calculation of BR VALUE and PRE values 44 5 2 Phase II Serial communication protocol and the working modes 45 5 2 1 Serial communication 45 5 2 1 1 Transfer block str ct re cid pl Rt ed ON eed ee 46 5 2 1 2 Transfer block type ees s rk care Rer eim exes io 46 5 2 1 3 Response codes the host 47 5 2 1 4 Block response delay ssec ce eee ee eR nnn 50 5 2 2 WARE BSE Modes ike PEE ae Phe een 52 5 2 2 1 Header Block vt ie peeing wanes 52 5 2 2 2 Mode 0 Code Data download to RAM 100TP 52 5 2 2 3 Mo
25. 7 Debug support mode entry Entry to Debug support mode is determined by pin setting at power up In case NVM address 11000004 11000007 is not FFFFFFFFy the firmware code clears the RAM waits for debugger to be connected moves the to 11000000 and jumps to user code 3 1 8 User mode and BSL mode entry Entry to user mode is determined by the No Activity Count NAC value which is defined in the user code refer to Chapter 3 1 8 1 After waiting the time defined by the current NAC value the startup procedure sets the VTOR register to point to the beginning of the NVM 11000000 and jumps to the reset handler If NVM double Bit error occurs when reading the NAC value the system goes into endless loop Before exiting to user mode the system clock frequency is switched to PLL output previously set by default to 20 MHz In case PLL has not locked within 1 ms the CPU clock source LP CLK low precision clock running nominally at 18 MHz will be used Note User mode is entered jumping to the reset handler This can happen directly from startup routine after a waiting time for possible BSL communication or as a result of BSL commands In all these cases jump to user mode will only occur either 1 when NVM is not protected and NVM content at 11000004 11000007 is not User Manual 13 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Startup procedure FFFFFFFFy or 2 when NVM is protected In all other cases firm
26. Cinfineon TLE986xQX BE BootROM NVM Table 6 16 Programming subroutine cont d Output Return value char Bit Pass or Fail This bit is the OR of the bits 4 5 6 and 7 0 Programming completed successfully No errors occurred 1 Programming failed At least one error occurred Bit 1 3 Reserved Bit 4 Verify Pass Fail 0 Pass The verification of the programmed data passed 1 Fail The verification of the programmed data failed Bit 5 Emergency Operation Pass Fail 0 Pass The normal flow of the program operation has not been interrupted by an emergency operation request 1 Fail The normal flow of the program operation has not been completed due to a request of an emergency operation Bit 6 Spare page selection Pass Fail Valid only for operation run on NVM Data pages 0 Pass A new random spare page has been properly selected 1 Fail The random spare page selection failed No random spare page selected Bit 7 Execution Pass Fail status 0 Pass Routine execution could be properly started 1 Fail Routine execution could not be properly started due to missing required setting Assembly Buffer not opened target region write protected nested call execution Note No NVM prog or erase routine can be called until this NVM operation is completed 6 3 3 NVM page erasing routine Similarly there are 2 types of erasing available Type 1 or Type 2 Type 1 without or Type 2 with RAM background activity
27. MEMSTAT NVMPROP before calling NVM Program Erase routines While the NVM operation is on going an event occurs triggering an interrupt 3 Interrupt subroutine ISR is serviced immediately when the NVM is free ISR has to check for the MEMSTAT NVMPROP status If this Bit is set MEMSTAT EMPROP has to be set and ISR has to be exited 5 With control returned to the BootROM the NVM routines will be executed bypassing the corrective activities This ensures that the routines are completed in the shortest time possible 6 Exiting the NVM routines the user code checks the MEMSTAT EMPROP Since it is set the code can branch to execute a user defined emergency sequence and clear the Bits MEMSTAT NVMPROP and MEMSTAT EMPROP These activities can include the programming of the critical data User Manual 117 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM 6 4 3 2 Emergency operation handling Type 2 routines For Type 2 routines including both program and erase an emergency programming may be handled with or without the interrupt enabled In the case with interrupt enabled it is similar to Type 1 Routines shown in Table 6 41 For the case without interrupt enabled it is shown in Table 6 42 Table 6 42 Emergency operation handling in Type 2 routines No interrupt Step Description 1 User code sets MEMSTAT NVMPROP before calling NVM Program Erase routines 2 While the NVM operation i
28. Operation failed Password does not match This routine sets the bit NVM PROT STS 1 to 0 Table 6 32 NVM Code sectors linearly mapped NVM sectors write protection disable subroutine Subroutine 0000391D USER CFLASH WR PROT DIS Prototype bool USER CFLASH WR PROT DiS unsigned short CFLASH PW Input CFLASH PW unsigned short Password to be compared to the one stored in the 100TP page 1 offset Output Returned value bool Pass or Fail 0 Operation completed successfully 1 Operation failed Password does not match User Manual 103 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM This routine sets the bit NVM PROT STSY 1 to 1 Table 6 33 NVM Code sectors linearly mapped NVM sectors read protection enable subroutine Subroutine 000039154 USER CFLASH RD PROT EN Prototype bool USER CFLASH RD PROT EN unsigned short CFLASH PW Input CFLASH PW unsigned short Password to be compared to the one stored the 100TP page 1 offset Output Returned value bool Pass or Fail 0 Operation completed successfully 1 Operation failed Password does not match This routine sets the bit NVM PROT STS 3 to 0 Table 6 34 NVM Code sectors linearly mapped NVM sectors read protection disable subroutine Subroutine 00003900 USER CFLASH RD PROT DIS Prototype bool USER CFLASH RD PROT DiS unsigned short CFLASH PW Input CFLASH PW unsigned shor
29. Phase Automatic synchronization to the host 20 4 3 1 General description 20 4 3 2 Calculation of BR VALUE and PRE values 21 44 Phase Il LIN BSL communication protocol and the working modes 23 4 4 1 Node Address for Diagnostic NAD 23 4 4 2 Block yp ays lt 1 Sage has Bae Pah edd Seen geass 24 4 4 3 ur cuu AT eek eee hate edhe Pe ee pate eee 24 4 4 3 1 Classic LIN checksum eh 24 4 4 3 2 Programming checksum 24 4 4 4 UN BSE Mods erg rene ta e le Re E Bonae E 25 4 4 4 1 The Header Block eve REG ERR tee ape ERR Bn 25 4 4 4 2 Mode 0 2 and 8 Code Data download to RAM or NVM 25 4 4 4 3 Mode 1 3 and 9 Code execution inside RAM or NVM 29 4 4 4 4 Mode 4 NVM erase 4 4 m eee ne 29 4 4 4 5 Mode 6 NVM protection 31 4 4 4 6 Mode A Chip ID Checksum read 32 4 5 Phase Ill Response protocol to the 5 34 4 5 1 Acknowledgement response 35 4 5 2 Errorresponse isis bee mer Rh Ree eem ner eis 35 4 5 2 1 Block Type Error FFu sss sheer RR kane ge nta 35 User Manual 2 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM 4 5 2 2 Checksum Error FE ome eo bx 35 4
30. Size NVM FLASH NSA NLS Address End Address NEA 36 11000000 8000 11008000 1000 11008FFF 64 11000000 FOOO 1100F000 1000 1100FFFF 128 11000000 1F000 1101F000 1000 1101FFFF Note An erased page is ECC Clean and will not generate an ECC error Note Reading an erased page in the Code space will return FF and will not trigger any error on the AHB Lite bus HRESP 00g Note Reading an erased page in the Data space will return 00 and will trigger an error on the AHB Lite bus 01g This will also create NVM Map Error NMI if enabled in NMICON in addition to the hard fault As a consequence an erased page in the Data space has to be written before it can be read without triggering an error 1 refer to Cortex M3 Integration and Implementation Manual revision r2p1 User Manual 69 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM 6 1 1 NVM organisation The NVM has 2 types of memory configuration Code and Data It is organised in sectors Each NVM Sector is a block of 4 kBytes organised into blocks of 128 Bytes called Page The page is the minimum data granularity for NVM code and data write and erase so with this NVM structure any NVM update even when targeting only one byte actually involves 128 bytes Table 6 3 shows the sector address organisation of 128 kBytes NVM Sector organization for other NVM sizes can be simply derived per extension
31. Table 3 1 or by sending a LIN command frame with Fast Prog set to 1 See Section 4 4 4 2 the Fast Prog option Byte is supported in LIN BSL modes 0 2 and 8 Note LIN BSL will no longer be supported in future revisions of this product All the LIN BSL features will be supported by FastLIN BSL but with higher baudrate Access to Fast LIN BSL will then be ensured only via proper NAC setting In case the Fast LIN is entered via LIN command frame by setting the Fast Prog option all other information sent with the frame are ignored The baud rate used for the Fast User Manual 38 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode LIN BSL is calculated based on the Master Request Header Command LIN frame received The LIN transceiver slope mode is set to Flash mode a specific setting of the internal slew rate control that allows transmission up to 115 2 kBaud and set the baudrate according to the received LIN frame The Fast LIN BSL entry is shown in Figure 4 5 In case instead the Fast LIN is entered directly via proper or invalid NAC the protocol is soon changed to UART In this last case the device still expects to receive a UART test byte 804 but the baudrate is not calculated based on the received test byte and is instead by default set to 115 2 kBaud after having properly set the transceiver slope mode to Flash mode The LIN transceiver slope mode is set back to normal mode before jumping to user code via
32. This is implemented in TLE986xQX to allow other slaves not in TLE986xQX BSL mode on the LIN bus to ignore this Programming frame The inversion of the classic checksum yields the programming checksum An example of the calculation of the Programming checksum is provided in Table 4 3 For this example data of 4Ay 554 934 and E5 is considered The calculated 1 the checksum is calculated summing all values 8 bit sum with carry and subtracting 255 every time the sum is greater or equal to 256 which is not the same as modulo 255 or modulo 256 User Manual 24 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode programming checksum is 19 4 The classic checksum is an inversion of the programming checksum value i e E6j Table 4 3 Programming checksum Addition of data HEX Result CARRY Addition with CARRY 4A 4 4 0 4 4Ay 554 9F OF y 0 OF y 9F yy 934 01324 324 1 334 334 E54 01184 184 1 194 4 4 4 LIN BSL Modes When Phase ll is entered TLE986xQX waits for the Command frame and the header block from the host containing indication about the desired mode to be selected 4 4 4 1 Header Block The header block is always the first transfer block to be sent by the host during each data communication process It contains the mode number and special information on the related mode referred to as Mode Data The general structure of a header block is sh
33. Type Error Checksum Type Error Protection Error Error Checksum Error 3 Acknowledge Block Type Error Checksum Error 4 Acknowledge Block Type Error Checksum Error Protection Error User Manual 48 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Table 5 3 Possible responses for various block types cont d Mode Header block Data block EOT block 6 Acknowledge Block Type Error Checksum Error Protection Error A Acknowledge Block Type Error Checksum Error Protection Error The responses are defined in Table 5 4 which lists the possible reasons and or implications for error and suggests the possible corrective actions that the host can take upon notification of the error Table 5 4 Definitions of responses Response Value Description Block BSL Reasons Implications Corrective Type Action Acknow 554 Head 1 3 The requested operation will ledge er be performed once the response is sent A The requested operation has been performed and was successful Requested data transmission follows 6 The requested operation has EOT 024 been performed and was successful All other Reception of the block was combinations successful Ready to receive the next block Block FFy Head 2 4 A Start Address in Mode Data is Retransmit a valid Type Error er not within NVM address header block
34. address reported as an output in the RAM location is passed as a pointer The returned value always provides the starting address of the 8 Byte section where the ECC error happened 6 3 9 MapRAM initialization This routine is meant to be used to re initialize the MapRAM The routine performs a complete MapRAM initialization by triggering a dedicated function of the NVM internal Finite State Machine When triggered the state machine resets the whole MapRAM and rebuilds information by reading the current logical to physical address information stored directly into the NVM data sector In case of mapping errors double or multiple mapping or faulty pages the initialization of the MapRAM is stopped on the first error found and the routine is exited reporting a proper error indication In case of fail the content of the MapRAM might be only partial and the mapping information might be corrupted The routine can be used to try to restore a clean MapRAM status in case a MapRAM error has been reported by the startup or by the program routine or in case some data sector pages have been lost In addition this routine can be used to check whether the mapped sector has a consistent status Note In case an NVM operation on the Data region is interrupted e g due to reset events the mapped sector might have an inconsistent status depending on the moment in which the interruption occurred In case of power on reset brown out reset pin reset or wake up r
35. an incoming frame from host STEP 3 Synchronize the baud rate to the host STEP 4 Enter Phase II for Master Request Frame or Phase III for Slave Response Frame Note Re synchronization and setup of baud rate are always done for every Master Request Header or Slave Response Header frame 4 3 1 General description The LIN baud rate detection feature provides the capability to detect the baud rate within the LIN protocol using timer 2 Initialization consists of Serial port of the microcontroller set to mode 1 8 bit UART variable baud rate for communication User Manual 20 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode baud rate range for detection controlled by the field BGSEL of the BCON set to 5 5 to 166 7 kBaud Capture Timer 2 data register contents on negative transition at pin T2EX Timer 2 external events are enabled EXF2 flag is set when a negative transition occurs at pin T2EX fr2 Secik 8 T2PRE 011g As shown in Figure 4 2 the LIN Header frame consists of the synch Break 13 Bits time low synch Byte 55 Protected ID field The Break is used to signal the beginning of a new frame and must be at least 13 Bits of dominant value When negative transition is detected at pin T2EX at the beginning of Break the Timer 2 External Start Enable Bit T2MOD T2RHEN is set This will automatically start Timer 2 at the next negative transition of pin T2EX Finally th
36. and liabilities of any kind including without limitation warranties of non infringement of intellectual property rights of any third party Information For further information on technology delivery terms and conditions and prices please contact your nearest Infineon Technologies Office www infineon com Warnings Due to technical requirements components may contain dangerous substances For information on the types in question please contact your nearest Infineon Technologies Office Infineon Technologies Components may only be used in life support devices or systems with the express written approval of Infineon Technologies if a failure of such components can reasonably be expected to cause the failure of that life support device or system or to affect the safety or effectiveness of that device or system Life support devices or systems are intended to be implanted in the human body or to support and or maintain and sustain and or protect human life If they fail it is reasonable to assume that the health of the user or other persons may be endangered
37. code is contained in the data area of the block EOT block 024 This block length depends on the special information given in the previous header block This block is the last block in data transmission in working mode 0 and 2 The last program code to be transferred is in the data area of the block 5 2 1 3 Response codes to the host The microcontroller communicates to the host whether a block has been successfully received by sending out a response code If a block is received correctly an Acknowledge Code 55 is sent In case of failure an error code is returned There are two possible error codes FF 4 or reflecting the two possible types of fail Block Type or Checksum Error A Block Type Error occurs when either a not implemented Block Type or transfer blocks in wrong sequence are received For example if in working mode 0 two consecutive header blocks are received a Block Type Error is detected and a Block Type Error indication is returned A Checksum Error occurs when the checksum comparison on a received block fails In such a case the transfer is rejected and a Checksum Error indication is returned In both error cases the UART BSL routine awaits the actual block from the host again When program and erase operation of NVM is restricted due to enabled NVM protection only modes 1 3 and some options of mode A are allowed All other modes are blocked and a Protection Error code FDj will be se
38. consuming steps in case high priority tasks are required For this reason leaving an NVM operation via an emergency operation request might leave some inconsistent data into the sector targeted by the interrupted operation When using this feature on Data NVM sector the user is recommended soon after the completion of the execution of the high priority tasks to issue a pin reset or sleep entry exit sequence to let the firmware to properly clean the sector To ensure that NVM is functioning correctly all NVM operations i e program or erase are to be completed before a new NVM operation is started In addition corrective activities such as retries and disturb handling are added in an NVM program routine and could add additional time In an emergency situation where the system needs to save important user data in the shortest time possible this becomes critical Therefore a mechanism to bypass these corrective activities as well as to inform that a new NVM sequence will not be started is needed To support an emergency situation the following steps are recommended in the code whenever the NVM programming is called 6 4 3 1 Emergency operation handling Type 1 routines For Type 1 routines including both program and erase an emergency programming may only be handled with the interrupt enabled shown in Table 6 41 Table 6 41 Emergency operation handling in Type 1 routines Step Description 1 User code enables interrupt and sets
39. data Bits no parity and one stop Bit The host can vary the baud rate in a wide range because the microcontroller does an automatic synchronization to the host in Phase I The following section provides detailed information on these two UART BSL phases 5 1 Phase I Automatic serial synchronization to the host Upon entering UART BSL mode a serial connection is established and the transfer speed baud rate of the serial communication partner host is automatically synchronized in the following steps STEP 1 Initialize serial interface for reception and timer for baud rate measurement STEP 2 Wait for test Byte 804 from host STEP 3 Synchronize the baud rate to the host STEP 4 Send Acknowledge Byte 554 to the host STEP 5 Enter Phase II 1 The microcontroller returns to the beginning of phase Il and waits for the next command from the host 2 UART BSL and serial communication are terminated User Manual 43 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL 5 1 1 General description The microcontroller will set the serial port to mode 1 8 bit UART variable baud rate for communication Timer 2 will be set in auto reload mode 16 bit timer for baud rate measurement In the process of waiting for the test Byte 804 microcontroller will start the timer on reception of the start Bit 0 and stop it on reception of the last Bit of the test Byte 1 Then the UART BSL routine calc
40. either faulty or double mapped pages The repair step then requires the right of modifying the NVM Data sector content which can be in contrast to the NVM protection settings user has provided To avoid any risk of unwanted data loss the user can control via dedicated 100TP page parameter whether the SA is allowed to proceed to the repair step in case NVM password protection for NVM Data sector is installed Detailed description of the MapRAM initialization and repair step can be found at Section 6 4 1 User Manual 11 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Startup procedure 3 1 4 Oscillator trimming and system clock selection After every power on reset brown out reset pin reset or wakeup from sleep reset the system runs with an internal low precision clock nominally 18 MHz During the start up procedure the internal oscillator and PLL are trimmed to a fixed standard value of 20 MHz In order to reduce the boot time the start up procedure continues to run with the low precision clock while the PLL is locking System clock will be switched to PLL output before jumping to user or BSL mode in case of successful lock In case the PLL does not lock the startup sequence proceeds further using the low precision clock as System clock Once user mode is entered user is allowed to set the final desired frequency by proper register setting Note After every power on reset brown out reset pin reset or wakeup reset the use
41. emergency handling timing when linear sector is used Worst case time shown in Figure 6 8 is then 13 5 ms This does not include time for user code execution It can be reduced by about 4 1 ms if the user ensures that the page used for critical data saving is erased 6 4 4 NVM user routines operation This section describes the application of some NVM user routines 6 4 41 NVM user programming operation In TLE986xQX the NVM supports programming of up to 128 Bytes of data at once The user can execute the following sequence illustrated in Figure 6 9 for NVM user User Manual 119 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM programming Once the assembly buffer has been successfully opened the user can load the assembly buffer with the user defined contents This can be achieved by a store instruction targeting the selected byte in the NVM page opened with the OPEN AB user routine C Start User calls USER OPENAB Routine v Load the assembly buffer v User calls USER PROG Routine Figure 6 9 user program 6 4 4 2 Tearing safe Programming In TLE986xQX the mapping mechanism of the non linearly mapped sector is used like a log structured file system When a page is programmed in this sector the old values are not physically overwritten but a different physical page spare page in the same sector is programmed If the programming fail
42. even if read protection is enabled on Code region Data regions or both the code executed from User Manual 106 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Code NVM region can always read both NVM Code and Data regions Please refer to the User Manual for more information about read and write protection mechanism 6 4 NVM user applications The NVM user routines application is described in this section 6 4 1 NVM Data sector handling The NVM provides a special sector for Data storage Through a non linear mapping of the address space the FW and the NVM module provides a special feature to increase the maximum number of write erase cycles a logical page can stand and to reduce the risk of data loss in case of interrupted NVM operations tearing events The handling of this special Data sector requires the usage of an NVM internal look up table MapRAM which is used to store and handle the link between logical and physical addresses of the sector s pages Since the MapRAM is a volatile memory the firmware takes care to rebuild the MapRAM content at each power up based on mapping information stored into a specific field of the Data sectors pages mapblock This process is called Data sector initialization MapRAM initialization During this initialization phase mapping errors induced by tearing events might be found This would then prevent the firmware from properly restoring the link between the logical and ph
43. execution of another NVM routine e g via RAM branching Note No NVM prog or erase routine can be called until this NVM operation is completed User Manual 98 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM 6 3 12 Sector Erasing Routine This routine is used to perform an erase of a NVM data sector Table 6 26 Sector Erasing Subroutine Subroutine 000038654 USER ERASE SECTOR Prototype char USER ERASE SECTOR unsigned int sectorAddress Input SectorAddress unsigned int NVM Sector address Output Returned value char Bit 0 Pass or Fail 0 Erasing completed successfully 1 Erasing failed Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reason for execution fail Routine called as nested call during the execution of another NVM routine e g via RAM branching Note No NVM prog or erase routine can be called until this NVM operation is completed 6 3 13 NVMCLKFAC setting routine This routine is used to write the NVMCLKFAC Bit in SYSCONO register Table 6 27 NVMCLKFAC setting subroutine Subroutine 000038554 USER NVMCLKFAC SET Prototype void USER NVMCLKFAC SET char Value Input Value char SYSCONO NVMCLKFAC value to be written b Output 6 3 14 RAM MBIST starting routine This routine is used to perform a RAM test A linear write read algorithm using alternating data is executed on a RAM ran
44. follows 5 2 1 Serial communication protocol The communication between the host and the UART BSL routine is done by a simple transfer protocol The information is sent from the host to the microcontroller in blocks All the blocks follow the specified block structure The host is sending several transfer blocks and the UART BSL routine is just confirming them by sending back single Acknowledge or error Bytes The microcontroller itself does not send any transfer blocks However the above regulation does not apply to some modes where the microcontroller might need to send the required data to the host besides the Acknowledge or error Byte e g mode A User Manual 45 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL 5 2 1 1 Transfer block structure A transfer block consists of three parts Block Type Data Area Checksum 1 byte X bytes 1 byte Block Type the type of block which determines how the Bytes in the data area are interpreted Implemented block types are 004 type Header 01 type Data 024 type End of Transmission EOT Data area A list of Bytes which represents the data of the block The length of data area cannot exceed 128 Bytes for mode 0 and 2 For mode 2 the length of data area must always be 128 Bytes This is due to the fact that NVM is written page wise Checksum the XOR checksum of the Block Type and data area The h
45. header block contains the information for the selection of the working modes Depending on this information the UART BSL routine selects and activates the desired working mode If the microcontroller receives an incorrect header block the UART BSL routine sends instead of an Acknowledge code a Checksum or Block Type Error code to the host and awaits the header block again In this case the host may react by re sending the header block or by releasing a message to the user 5 2 2 1 Header Block The header block is always the first transfer block to be sent by the host during one data communication process It contains the working mode number and special information on the related mode referred to as Mode Data The general structure of a header block is shown below Block Type aeons Checksum 00 Mode Mode Data 1 byte Header Block 1 byte 5 bytes Description Block Type 00 The Block Type which marks the block as a header block Mode The mode to be selected The implemented modes are covered in Section 5 Mode Data Five Bytes of special information which are necessary to activate corresponding working mode Checksum The checksum of the header block 5 222 Mode 0 Code Data download to RAM 100TP Mode 0 is used to transfer a user program or data from the host to the RAM of the microcontroller via serial interface Selecting the proper mode option this mode can be used to transfer data into th
46. of the reported scheme Table 6 4 shows the page address organisation of NVM Sector 1 and it can be used as a reference for page organization of any NVM Sector Table 6 3 NVM memory sector organisation Address NVM Sector Number 11000000H to 1 11000FFFH 11001000H to 2 11001FFFH 11002000H to 3 11002FFFH 11003000H to 4 11003FFFH 11004000H to 5 11004FFFH 11005000H to 6 11005FFFH 11006000H to 7 11006FFFH 11007000H to 8 11007FFFH 11008000H to 9 11008FFFH 11009000H to 10 11009FFFH 1100A000H to 11 1100AFFFH 1100B000H to 12 1100BFFFH 1100COOOH to 13 1100CFFFH User Manual 70 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 3 NVM memory sector organisation cont d Address NVM Sector Number 1100D000H to 14 1100DFFFH 1100E000H to 15 1100EFFFH 1100F000H to 16 1100FFFFH 11010000H to 17 11010FFFH 11011000H to 18 11011FFFH 11012000H to 19 11012FFFH 11013000H to 20 11013FFFH 11004000H to 21 11004FFFH 11015000H to 22 11015FFFH 11016000H to 23 11016FFFH 11017000H to 24 11017FFFH 11018000H to 25 11018FFFH 11019000H to 26 11019FFFH 1101A000H to 27 1101AFFFH 1101B000H to 28 1101BFFFH 1101C000H to 29 1101CFFFH 1101D000H to 30 1101DFFFH User Manual 71 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM
47. test is running no RAM access should be attempted on the whole RAM 6 3 15 NVM ECC check routines The firmware provides 2 different routines to enable the user to check and monitor the quality of the NVM cells upon shipment and or over the lifetime of the device The first routine USER NVM ECC CHECK provides an easy way for the user to perform a quick check of the status of the whole NVM array The routine performs a read of the complete NVM returning the single and double bit ECC flags This is meant to be User Manual 100 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM used as a quick check of the programming quality of the NVM Code region and the mapped pages of the NVM Data region Table 6 29 NVM ECC check subroutine Subroutine 000038454 USER ECC CHECK Prototype char USER NVM ECC CHECK void Input Output Returned value char ECC error indication Bit 0 ECC1READ 0 No single bit ECC error on the whole NVM read 1 At least one single bit ECC error on the whole NVM read Bit 1 ECC2READ 0 No double bit ECC error on the whole NVM read 1 At least one double bit ECC error on the whole NVM read Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reason for execution fail Routine called as nested call during the execution of another NVM routine e g via test is running no RAM access should be attempted on
48. the 2 pages linked to the double mapping with standard soft and hard read levels to detect which one has better quality more margin towards the standard read level refer to Figure 6 4 The page with smaller margin is then erased 2 In case both pages have same quality the algorithm checks some specific bits of the mapblock called map counter to check which of the pages has been programmed last In this case the older one is erased In case both pages have same map counter value the SA cannot decide which page has to be erased and ends the flow reporting an error on the MEMSTAT register MEMSTAT set to AOp Whenever the SA is triggered the addressed data sector number will be stored in SECTORINFO this is an indication that the SA was executed during the start up phase In addition in case the SA cannot recover all incorrect mapped pages the SA reports a fail into the SASTATUS field of the MEMSTAT writing the value 10g In such a case the user shall properly handle the reported mapping issue by either triggering a reset Power on reset pin reset WDT1 reset brown out reset or wake up from sleep reset in order to trigger a new NVM initialisation or to erase the whole NVM data sector to reset the mapping info Detailed description of the MEMSTAT register can be found in the following table Table 6 39 User Manual 111 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 39 MEMSTAT Register Status for NVM Int
49. the provided address is not a valid NVM address the microcontroller will return a Block Type Error instead of an Acknowledge 554 followed by no further Bytes The header block Mass NVM checksum check Option 18 The header block for Option 184 has the following structure Mode Data 5 bytes 00 Exp Exp NAD 0A Not Not Option Checksum Head 1 byte pereo Mode Used Used pound pes 18 1 byte 1 byte 1 byte byte 1 byte 1 byte Mode Data Description Not used These Bytes are not used and will be ignored Exp CHKS High Low Expected checksum High Low Byte User Manual 33 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode Option set to 184 to enable Mass NVM checksum check Checksum 16 Bits inverted XOR on the whole linearly mapped sectors configuration sector pages and non linearly mapped sectors not included is calculated and then compared with the expected values provided as well as an input The response frame will then give back a pass or fail indication plus the calculated checksum The header block Configuration sector page checksum check Option 50 The header block for Option 50 has the following structure Mode Data 5 bytes 00 Exp Exp NAD 0A cs Not Option Checksum Head 1 byte Mode A Page Used SO m 50 1 byte 1 byte 1 byte 1 byte
50. will be copied into the RAM at the specified address 18000000 StartAddr The header block for RAM download and CS page programming Option F0 j Mode Data 5 bytes 00 00 i Check Header Mode 0 StartAddr StartAddr Block CS Page Option ecksum Block High Low Length 1 byte FO 1 byte 1 byte 1 byte 1 byte y 1 byte Mode Data Description Start Addr High Low 16 bit Start Address which determines where to copy the received data in the RAM Block Length The length of the following data blocks or EOT block CS Page This Byte is used to select the desired user configuration sector page to be programmed This Byte is relevant only in case option FO is used CS page is selected according to the addressing scheme reported in Figure 6 2 Option Set to FO for RAM download and CS page programming User Manual 53 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Using this option user can write data into the user CS pages 100TP pages In this case data has to be sent to the RAM according to the Table 6 12 and therefore start address has to be equal to 18000400 In case a different starting address is provided the operation will result in a Block Type Error indication When this option is selected a proper CS page has to be provided Note RAM Address provided as input in mode 0 has to be considered as an offset to be added to the st
51. will fill up the addresses 11000F80 and 11000F81 with O00 and provide the Start Address 11000F80 to microcontroller Moreover if data is only 8 Bytes the PC host will also fill up the remaining addresses with 00 and transfer 128 data Bytes The Block Length refers to the whole length Block Type data area and Checksum of the following transfer block data block or EOT block After successfully receiving the header block the microcontroller enters mode 2 during which the program codes are transmitted from the host to the microcontroller by data block and EOT block which are described as below The data block Deis Program Codes Checksum Block Block Length 2 bytes 1 byte Description Program Codes The program codes have a length of Block Length 2 Bytes where Block Length is provided in the previous header block User Manual 56 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL The EOT block 024 Last Program Code Not Used Checksum EOT Codelength Last Codelength Block Length 3 Last 1 byte Block 1 byte bytes Codelength bytes y Description Last Codelength This Byte indicates the number of program code bytes in this EOT block Program Code The last program code bytes to be sent to the microcontroller Not used The length is Block Length 3 Last Codelength Bytes The following Figures sho
52. 0 Cinfineon TLE986xQX BE BootROM NVM Table 6 12 RAM preloading for 100 Time Programmable page programming RAM Address Function 18000400 Number of Bytes to be programmed i e N up toa maximum of 1271 Bytes 18000401 100TP offset 1 180004024 100TP data 1 to be programmed 18000403 100TP offset 2 18000404 100TP data 2 to be programmed 18000401 N 1 x 2 100TP offset N 180004024 N 1 x 2 100TP data N to be programmed 1 The maximum number of bytes that the user can load into the 100TP pages is limited to 127 since last byte is used as a program operation counter To ensure that the page are not programmed more than 100 times even not by accident the counter byte last byte in the page can be read but not overwritten by the user User Manual 82 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM 0 Reserved 1 2 phase TLE986x 2 3 phase TLE987x Others Reserved Derivative Sales code Decimal values 0 TLE98x0 1 TLE98x1 2 TLE98x2 3 TLE98x3 4 TLE98x4 5 TLE98x5 6 TLE98x6 T TLE98x7 8 TLE98x8 9 TLE98x9 others Reserved A Design Step A B Design Step B C Design Step C Others Reserved Derivative Feature Pack Decimal values 0 VQFN48QX Others Reserved NVM 31 24 23 20 19 1615 12 11 87 0 Family Derivative Design step Reserved Sales code Feature Major no
53. 4 1 and Equation 4 2 with N578 1 8 2 011 results in the following x8 PCLK 8 4 3 16 x PREx BR VALUE FDSEL T2 32 By simplifying Equation 4 3 the following is obtained PRE x BR VALUE FDSEL 12 44 32 16 4 4 After setting BR_VALUE PRE and FDSEL the baud rate generator will then be enabled and the subsequent Command frame or Response frame will follow this baud rate 115 2 kBaud for FAST LIN To support FAST LIN with baud rate 115 2 kBaud fractional divider is enabled via a predefined factor calculated and stored in the configuration sector The detection of 115 2 kBaud is determined by the T2 timing If T2H and T2L is less than 154 i e baud rate roughly above 70 kBaud baud rate will be set to 115 2 kBaud As a consequence the settings for 115 2 kBaud are BR VALUE 13 SFR BGL BR VALUE 101g and SFR 1 PRE SFR BCON BRPRE 000g Read FD SEL value from configuration sector and store into SFR BGL FD SEL User Manual 22 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode 4 4 Phase Il LIN BSL communication protocol and the working modes Once successful synchronization to the host is completed with a Master Request Header the routine enters Phase ll Here the host communicates to the microcontroller the desired working mode A simple protocol is defined for the communication between the host and TLE986xQX
54. 4 4 4 5 and Section 5 2 2 7 for more details regarding NVM password setting Once a valid password different from 00000000 and FFFFFFFFj is programmed program and read protection on both code and data NVM regions is enabled upon startup regardless User Manual 121 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM of reset source During normal operation if user wishes to program or read the NVM memories he can temporarily disable the NVM protection writing the desired protection settings into the least significant nibble of the NVM PROT STS register by means of the dedicated BootROM functions refer to Section 6 3 16 User Manual 122 Rev 1 3 2015 07 10 TLE986xQX BE Step Revision History 2015 07 10 Rev 1 3 Previous Version First Version Page Subjects major changes since last revision Infineon TLE986xQX BE BootROM User Manual 124 Rev 1 3 2015 07 10 Edition 2015 07 10 Published by Infineon Technologies AG 81726 M nchen Germany Infineon Technologies AG 2015 All Rights Reserved Legal Disclaimer The information given in this document shall in no event be regarded as a guarantee of conditions or characteristics Beschaffenheitsgarantie With respect to any examples or hints given herein any typical values stated herein and or any information regarding the application of the device Infineon Technologies hereby disclaims any and all warranties
55. 6 bits inverted XOR checksum calculation 5 3 WDT1 refreshing After a reset the WDT1 is starting with a long open window WDT1 keeps on running while waiting for first UART frame In case during the UART BSL waiting time defined by NAC a UART communication is detected WTD1 is disabled and its status frozen Subsequently before exiting to RAM or NVM in UART BSL modes 1 and 3 the watchdog is re enabled and starts from the previously frozen state The WDT1 is then still in long open window and the remaining valid time is equal to long open window minus the time between reset release and first UART communication User program needs to trigger the WDT1 refresh accordingly User Manual 68 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM 6 NVM Non Volatile Memory NVM is the flash module of the TLE986xQX which partly supports EEPROM emulation 6 1 NVM overview The NVM is a single block of NVM memory of up to 128 kBytes separated into Code and Data space The TLE986xQX device family provides products with different NVM sizes all sharing the same architecture and features The following table shows the NVM address range Table 6 1 NVM address range Address Address Range NSA to NEA NVM memory NSA and NEA values are shown in Table 6 2 Table 6 2 NVM Size and Address Range NVM Size NVM NVM Linear NVM NVM NVM DFLASH kB Starting Size NVM DFLASH DFLASH End Address Address CFLASH Size Starting
56. 8 Bytes of program code are sent Refer to example given below on mode 2 downloading 2 To prevent external access once the NVM is protected modes 0 2 and 8 are not accessible User Manual 27 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM Table 4 4 LIN BSL mode Example for 200 Bytes downloading using mode 0 8 and mode 2 Mode 0 8 RAM download Mode 2 NVM download Send Master Request Header Send Master Request Header Send header block No of data blocks used 33 Start address e g 000000 Send header block No of data blocks used 21 Start address e g 0001004 Delay Delay Send Slave Response Header Send Slave Response Header Check for Acknowledge Check for Acknowledge Send 33 times Master Request Header data blocks Delay after each data block required Send 21 times Master Request Header data blocks Delay after each data block required Send Master Request Header Send Master Request Header Send EOT block Last Codelength 2 Send EOT Block Last Codelength 2 Delay Delay Send Slave Response Header Send Slave Response Header Check for Acknowledge Check for Acknowledge Send Master Request Header Send header block No of data blocks used 12 Start address e g 0001803 Delay Send Slave Response Header Check for Acknowledge Send 12 times Master Req
57. BE BootROM LIN BSL mode 3 Up to max 10 Bytes are saved into the RAM In case less than 10 Bytes are received firmware proceeds to user code after a time out of 35 ms 4 Valid modes for LIN checksum are mode 8 and mode 9 Other modes are considered invalid 5 Valid modes for programming checksum are mode 0 6 and A Other modes are considered invalid 4 8 BSL Mode User Parameters NAC NAD There are 2 programmable parameters in the uppermost linearly mapped NVM Bank that are used in LIN BSL The parameter values are specified by the user 1 No Activity Count NAC Defines the duration of BSL connection acceptance window in multiple of 5ms starting from the reset release 2 Node Address for Diagnostic NAD Specifies the node address used for the LIN BSL communication Note Timer 21 is initialized to have 5 ms overflow and is used to create the delay The BootROM will detect any activities on the LIN bus for a period of time determined by NAC amp 01 4 5 ms When nothing is detected on the LIN bus during this time it will jump to user mode Note For FastLIN protocol any pulse on the LIN bus causes entering BSL mode The NAC counter will be stopped The BootROM will even then stay in BSL mode if no valid BSL command is received at all This means unexpected noise on the LIN bus might cause unwanted entering of the BSL mode and therefore might prevent normal user code execution In order to overcome t
58. CHECK unsigned int ECC2Addr Input ECC2Addr unsigned int pointer Pointer to the RAM location where the last NVM address with ECC2 error shall be stored Output Returned value char ECC error indication Bit 0 ECCTREAD 0 No single bit ECC error on the whole NVM read 1 At least one single bit ECC error on the whole NVM read Bit 1 ECC2READ 0 No double bit ECC error on the whole NVM read 1 At least one double bit ECC error on the whole NVM read Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reason for execution fail Routine called as nested call during the execution of another NVM routine e g via test is running no RAM access should be attempted on the whole RAM branching Note The ECC error flags provided as output of the NVM ECC check routines are a copy of the ECC internal error flags registers These registers are set when a read access to the NVM results in a single and or double bit error and are cleared only in case of power off incl Sleep Mode or in the following cases 1 2 3 When programming or erasing a NVM page When calling the USER NVM ECC CHECK routine before performing the NVM complete read When calling the USER ECC check routine before returning to user code 6 3 16 NVM protection status change routines These routines allow to enable or disable the read or write protection individually on the NVM C
59. IN BSL 814 8C for UART BSL NSA NLS 3 y NAC 1 s complement NSA NLS 2 NAD for LINBSL 014 FFy 00 is reserved 7Fy only NSA NLS 1 NAD for LIN BSL 1 s complement only For NSA and NLS values refer to Table 6 2 User Manual 16 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode 4 LIN BSL mode Note LIN BSL will no longer be supported in future revisions of this product All the LIN BSL features will be supported by FastLIN BSL but with higher baudrate LIN BSL is a LIN like protocol based on LIN 2 0 but for security reasons the checksum is inverted for most of the supported modes Standard LIN protocol can support a max baud rate of 20 kBaud In order to support higher baudrates a FastLIN BSL protocol has been introduced This is an enhanced feature implemented in TLE986xQX device that supports baud rates of 20 kBaud to 57 6 kBaud and 115 2 kBaud via integrated LIN transceiver using UART BSL protocol See Section 4 6 4 1 LIN BSL features Features that are implemented include 1 Re synchronization to the transfer speed baud rate of the communication partner upon receiving every frame Using Diagnostic Frame Master Request and Slave Response Usage of user values NAD and NAC stored in uppermost linearly mapped NVM Non standard LIN checksum Programming checksum see Section 4 4 3 2 Fast LIN BSL using UART protocol on integrated LIN transceiver
60. IN BSL mode 2 When disabling NVM protection together with NVM the NAC and NAD values are erased too As a result after next reset default NAD will be used and chip waits forever in FastLIN mode with 115 2 kBaud 4446 Mode A Chip ID Checksum read out Mode A is used to get 4 Bytes Chip ID data NVM page or CS page or mass NVM checksum check info depending on the Option Byte value in the header block The header block for this mode has the following structure 00 Mode Data 5 bytes NAD H 0A Checksum 1 Header Mode A Input Data bytes Option 1 byte Block 4 bytes 1 byte Different options are supported Option 004 Get 4 Bytes Chip ID Option 104 NVM page checksum check Option 184 Mass NVM checksum check Option 504 Configuration sector page checksum check The header block Get 4 Bytes Chip ID Option 00 The header block for Option 00 has the following structure Mode Data 5 bytes 00 NAD 0A Option Checksum Head 1 byte Mode A phe 00 1byte y 1 byte Mode Data Description Not used These Bytes are not used and will be ignored Option set to 00 to enable getting 4 Bytes Chip ID info When the Option Byte 00 the 4 Byte Chip ID Number will be returned see Chapter 4 5 3 The header block NVM page checksum check Option 10 The header block for Option 10 has the following structure
61. NVM A NVM program operation can take from 500 us to 13 5 ms to be completed Therefore there is a need to support the user for critical activities To support other user activities while NVM is busy the BootROM can redirect code execution to RAM after triggering time consuming NVM operations like program and erase This type of background code execution is known as Type 2 NVM operations or RAM branching When RAM branching is active the BootROM routines jump to the RAM address 18000400 every time it has to wait for NVM internal operation to be completed In this way the user can execute code from RAM while NVM is busy While executing user code from RAM due to RAM branching if the ongoing internal NVM operation is completed the BootROM code execution is not automatically restarted and the previously triggered BootROM user routine is suspended The user needs to explicitly re trigger the user routine code execution by giving back control to the BootROM via a return instruction BX LR In this way the suspended user routine execution is resumed The USER NVMRDY user routine refer to Chapter 6 3 5 is provided to check whether the internal on going NVM operation is finished User can use this routine to poll the busy status of the NVM to decide when to return control to the suspended user routine In case the user RAM code returns control to BootROM user routine while NMV is still busy the BootROM code waits till the internal operation is co
62. OM NVM Table 6 11 100 Time Programmable Page 1 Data SFR Variable Name Description Default Offset Value 00 to CUSTOMER ID Device ID for user Device ID 034 dependent 044 GAIN_VS_10B Calibration gain for supply voltage Chip measurement Individual 054 OFFSET_VS_10B Calibration offset for supply Chip voltage measurement Individual GAIN VBAT SENSE 1 Calibration gain for battery voltage Chip 0B measurement Individual OFFSET _ SENSE Calibration offset for battery Chip 10B voltage measurement Individual 084 GAIN_VMON_ATT_1_5 Calibration gain for high voltage Chip monitoring input voltage Individual measurement 094 OFFSET_VMON_ATT_1 Calibration offset for high voltage Chip 5 monitoring input voltage Individual measurement CONFIG VERS Configuration Sector version 02u OBy Reserved Reserved 004 CFLASH PW Linearly mapped region protection 00004 removal password OEuto DFLASH PW Non Linearly mapped region 00004 OFy protection removal password 104 to MEAS ADC2 CTRL1 Measurement unit 00000000 134 Control register 1 144 to MEAS_ADC2_CTRL2 Measurement unit 000007034 174 Control register 2 184to MEAS_ADC2_SQ1_4 Channel controller 29362837 1By Measurement channel enable Bits of cycle 1 to 4 1 to MEAS ADC2 SQ5 8 Channel controller 28372836 1Fu Measurement channel enable Bits of cycle 5 to 8 User Manual 78
63. Option 004 Mode Data 5 bytes 00 0A ot Use ption Header Mode A Not Used Opt Checksum Block 004 1 byte 4 bytes 1 byte Mode Data Description Not Used These Bytes are not used and will be ignored for Option 00 User Manual 63 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Option Set to 00 for Get 4 Byte Chip ID If this command is successfully received microcontroller will return an Acknowledge followed by 4 data Bytes and a single byte checksum The order of the 4 Bytes of data are SFR ID CHIP 102 CHIP 101 and CHIP 100 Refer to Chapter 6 2 1 for CHIP ID definition Note The checksum is calculated on the acknowledge and the 4 data bytes The header block for NVM page checksum check Option 104 Data Area 00 0A ay StartAddr Startadar ExPected Expected Option Checksum Header Mode A CHKSum CHKSum High Low 210 1 byte ee 1 byte 1 byte High Low 1 byte 1 byte 1 byte Mode Data Description Start Addr High Low Address of the NVM page for checksum check Address should be page aligned Expected CHKSum High Low Expected checksum High Low Byte Option set to 104 to enable NVM page checksum check Note The start address provided with the header block has to be shifted by 7 bits to the left and then added to the NVM start address to build the a
64. Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 11 100 Programmable Page 1 cont d Data SFR Variable Name Description Default Offset Value 20y to MEAS ADC2 SQ9 10 Channel controller 00002936 23H Measurement channel enable Bits of cycle 9 to 10 24 ADC2 CAL CHO 1 Calibration unit Chip 27H Calibration of channel 0 and 1 Individual 284 to ADC2_CAL_CH2_3 Calibration unit Chip 2Bu Calibration of channel 2 and 3 Individual 2C to ADC2 CAL CHA 5 Calibration unit Chip 2Fy Calibration of channel 4 and 5 Individual 304 to ADC2_FILTCOEFFO_5 filter 00000 33y Filter coefficients of ADC channels 0 to 5 344 to ADC2 UP CTRL 00000F3F 374 Upper threshold filter enable 384 to ADC2_FILT_LOW_CTR Postprocessing 00000F3F 3Bu L Lower threshold filter enable to ADC2 THO 3 LOWER Postprocessing 182F423A BFy Lower comparator trigger level of channels 0 to 3 404 to ADC2 4 5 LOWER Postprocessing 00009A00 43H Lower comparator trigger level of channels 4 to 5 444 to ADC2_TH6_9 LOWER Postprocessing C6D339CD Lower comparator trigger level of channels 6 to 9 48 to ADC2 THO UPPER Postprocessing ABBDCSCO 4By Upper comparator trigger level of channels 0 to 3 4Cy to ADC2 4 5 UPPER Postprocessing 0000BC004 AFy Upper comparator trigger level of channels 4 to
65. The protocol data is performed in information blocks The information block follows a specified block structure and is named transfer block Each transfer block is 8 Bytes long plus 1 checksum Byte required to be compliant to the LIN frame structure A transfer block has the following structure NAD Block Type Data Area Checksum 1 byte 1 byte 6 bytes 1 byte NAD Node Address for Diagnostic specifies the address of the active slave node See Section 4 4 1 Block Type This field determines the type of the message See Section 4 4 2 Data Area This is the data of the block The length is fixed at 6 Bytes Checksum This checksum is calculated based on the NAD Block Type and Data Area See Section 4 4 3 4 4 1 Node Address for Diagnostic NAD The NAC value is stored similar to the NAC value inside the NVM This field specifies the address of the active slave node Only slave nodes have an address The NAD address range supported in TLE986xQX is listed in Table 4 1 Table 4 1 NAD address range NAD Value Description 001 Invalid Slave Address Default Address NAD value is invalid or itis programmed linear area 014 to 7E Valid Slave Address 804 to FFy Note LIN block with Broadcast NAD 7F is ignored if valid NAD value is programmed in NVM linear area Note For NAD address and details refer to Table 3 3 User Manual 23 Rev 1 3 2015 07 10
66. am flow refer to Figure 6 9 or close the assembly buffer using the dedicated abort programming user routine refer to Chapter 6 3 4 All other sequences are not allowed and might lead to loss of data 6 3 2 NVM programming routine There are 2 types of programming available Type 1 or Type 2 Type 1 without or Type 2 with RAM background activity during NVM operation For Type 1 programming the flow control is always kept by the BootROM NVM programming routine Consequently no other operations can be run in parallel thus avoiding making use of the NVM operation waiting time In Type 2 programming the BootROM routine starts the write operation and then gives back control to the user software by branching to the RAM address 18000400 In this scenario the user software needs to reside in RAM because no access to the NVM is possible while User Manual 87 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM internal program sequence is on going The user software needs to hand back the control to the NVM programming routine which continues with polling the busy Bit A description of the BootROM programming routine is provided in the following Table 6 16 More information on the support for background activity during NVM operation can be found in Section 6 4 2 The program operation is executed on the page selected by the previously called USER OPENAB In case the target page belongs to the NVM Data region at the end of a succ
67. ammed has to be preloaded into the RAM The details can be found in Section 6 2 2 User Manual 97 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 25 Program 100 Time Programmable subroutine Subroutine 0000386D USER_100TP_PROG Prototype char USER 100TP PROG char 100TP Page Sel Input 100TP Page Sel char 100TP page selection Byte CS Byte refer to Figure 6 2 RAM preloaded with the 100TP data to be programmed Output Returned value char Bit 0 Program operation pass or fail flag 0 Program completed successfully 1 Program failed Bit 1 In page offset error flag 0 All bytes have in page offset 1 At least one byte has a not in page offset Note not in page bytes are not programmed and do not result in a program error on bit 0 Note Counter position is already considered out of range Bit 2 ID protected region fail flag 0 All bytes do not target the reserved Customer ID region 1 At least 1 Byte targets the reserved Customer ID region Note Bytes targeting the Customer ID region are not programmed and do not result in a program fail error on bit 0 Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reasons of failure The NVM code area is protected against programming The 100TP page is already programmed to a maximum of 100 times Possible reason for execution fail Routine called as nested call during the
68. andard RAM starting address of the TLE986xQX So for option the Start Addr parameter has to be set to 0400 All other options will be treated as option 00 Note The Block Length refers to the whole length Block Type data area and checksum of the following transfer block data block or EOT block After successfully receiving the header block the microcontroller enters mode 0 during which the program codes are transmitted from the host to the microcontroller by data block and EOT block which are described as below The data block 01 Data Program Code Checksum Block Block Length 2 bytes 1 byte Description Program Code The program code has a length of Block Length 2 Byte where the Block Length is provided in the previous header block The EOT block 024 Last Program Code Not Used Checksum EOT Codelength Last Codelength Block Length 3 Last 1 byte Block 1 byte bytes Codelength bytes y Description Last Codelength This Byte indicates the length of the program code in this EOT block Program Code The last program code to be sent to the microcontroller Not used The length is Block Length 3 Last Codelength Bytes User Manual 54 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL When trying to program config sector some special error handling is provided In particular in addition t
69. anual 75 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM Table 6 8 Chip ID Byte 1 Bits Description NVM Field Bits Description EEPROM_SIZE 3 0 00000 Kbyte 00014 Kbyte 00108 Kbyte 0011 12 Kbyte 0100 16 Kbyte 0101 20 Kbyte 0110 24 Kbyte 0111 28 Kbyte 1000 32 Kbyte 1001 36 kByte 1010 40 Kbyte 1011 44 Kbyte 1100 48 Kbyte 1101 52 Kbyte 1110 56 Kbyte 1111 60 Kbyte EEPROM Non linearly Mapped NVM Size NVM_SIZE 7 4 Linearly Mapped NVM Size 000024 Kbyte 000128 Kbyte 001032 Kbyte 001136 Kbyte 010052 Kbyte 010156 Kbyte 011060 Kbyte 011164 Kbyte 100084 Kbyte 100188 kByte 101092 Kbyte 101196 Kbyte 1100 116 Kbyte 1101 120 Kbyte 1110 124 Kbyte 1111 128 Kbyte Table 6 9 Chip ID Byte 2 Res RAM ID VARIANT ID User Manual 76 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 10 Chip ID Byte 2 Bits Description Field Bits Description VARIANT ID 3 0 Variant ID RAM ID 5 4 RAM ID 00 3kB 01 4kB 10 6kB 11 3kB Res 7 6 Reserved 6 2 2 100 Time Programmable data User has eight 100 time programmable pages The first one is used to store user configuration parameters for measurement interface and sense amplifier as well as ADC1 calibration parameters These parameters are usually determined in the user application and might require several iterations before the best fit is found The values of the fir
70. controller status to host In order to receive the microcontroller status host needs to send a Slave Response Header first Re synchronization and setup of baud rate Phase 1 are done at all times before Phases II and III Thus different baud rates can be supported Phase ll is entered when its Master Request Header is received otherwise Phase Ill is entered Slave Response Header The Master Request Header has a Protected ID of 3C while the Slave Response Header has a Protected ID of 7D The Command and Response frames identified as Diagnostic LIN frame which has a standard 8 data Byte structure Figure 4 1 shows the relationship between the PC host and the microcontroller for the 3 phases while Figure 4 2 shows the Master Request Header Slave Response Header Command and Response frames 1 The microcontroller returns to the beginning of Phase 1 11 and waits for the next command from the host 2 LIN BSL and serial communication are terminated 3 Similar to mode 0 mode 8 uses classic LIN checksum instead of Programming checksum 4 Similar to mode 1 mode 9 uses classic LIN checksum instead of Programming checksum User Manual 18 Rev 1 3 2015 07 10 e Infineon TLE986xQX BE BootROM LIN BSL mode Host TLE986x Master Request Header Phase I Synchronize and Setup Baud rate Command Phase II Selection of Working Mo
71. cted NVM sectors are protected no programming or erasing is allowed In this special error case the LIN routine will abort current command and wait for the next header block from the host again User Manual 35 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode 4 5 2 4 Response overview Table 4 5 shows a tabulated summary of the possible responses the device may transmit following the reception of a header data or EOT block Table 4 5 Possible responses for various block types Mode Header block Data block EOT block 0 2 8 Acknowledge Block Type Acknowledge Block Acknowledge Block Error Checksum Error Type Error Checksum Type Error Protection Error Error Checksum Error 1 3 9 Acknowledge Block Type Error Checksum Error 4 6 Acknowledge Block Type Error Checksum Error Protection Error A Acknowledge Block Type Error Checksum Error The responses are defined in Table 4 6 which lists the possible reasons and or implications for error and suggests the possible corrective actions that the host can take upon notification of the error Table 4 6 Definitions of responses Response Value Description Block BSL Reasons Implications Corrective Type Mode Action Acknow 55 Header 1 3 9 The requested operation will ledge be performed once the response is sent A The requested operation has been performed and is successful 4 Byte data transm
72. ctual address i e it is calculated as follows Mode A Option CO Actual address 11000000 StartAddrHigh lt lt 15 StartAddrLow lt lt 7 This option will trigger a checksum calculation 16 bits inverted XOR refer to Chapter 5 2 3 over the whole page pointed by the address given in the header block and the result will then be compared with the expected checksum provided as well by the user in the header frame If the given address is a valid NVM address the microcontroller will return an Acknowledge followed by four data Bytes and a single byte checksum The Bytes are in sequential order pass fail indication 00 if the calculated and expected checksum match 80 if they differ calculated checksum High Byte calculated checksum Low Byte and a final Byte equal to 00 Note The checksum is calculated on the acknowledge and the 4 data bytes The input address should always be page aligned In case it is not aligned the address will be internally changed to point to the beginning of the addressed page so that checksum is always evaluated on a complete page User Manual 64 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL In case the provided address is not a valid NVM address the microcontroller will return a Block Type Error instead of an Acknowledge 554 followed by no further Bytes Note In case the address is pointing to an erased non linearly mapped page the a
73. d value BR VALUE stored in the and BGL SFRs the fractional divider FDSEL and PRE with T2PRE predefined as 011 This calculation needs two formulas First the correlation between the baud rate baud and the reload value BG depends on the internal peripheral frequency fpc c RES 5 1 16x PRE x BR vALUE 50 Second the relation between the baud rate baud the recording value of Timer 2 T2 depends on the T2 peripheral frequency fr2 and the number of received Bits fT2Nb fro x N T2 baud 5 2 User Manual 44 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Combining Equation 5 1 and Equation 5 2 with N578 fr2 fpc 8 T2PRE 01 1 8 fpcLK 8 x E seem 5 3 16x PREx BR VALUE EDSEL Simplifying Equation 5 3 we get PRE x BR_VALUE EDSEL 12 5 4 After setting BR VALUE FDSEL and PRE baud rate generator will then be enabled and the UART BSL routine sends an Acknowledge Byte 55 to the host If this Byte is received correctly it will be guaranteed that both serial interfaces are working with the same baud rate 5 2 Phase Il Serial communication protocol and the working modes After the successful synchronization to the host the UART BSL routine enters Phase II during which it communicates with the host to select the desired working modes The detailed communication protocol is explained as
74. date the content of the Assembly Buffer 128 bytes by over writing the data starting from the address handed over to the OpenAB function In case the provided address targets the NVM data region before copying the data the OpenAB routine will check to which physical page the provided address is linked to and make the data of this physical page available into the Assembly Buffer Note The assembly buffer opening routine needs to be executed successfully before the NVM programming routine can be called User Manual 86 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 15 Opening assembly buffer subroutine Subroutine 000038 5 USER OPENAB Prototype char USER OPENAB unsigned int address Input Address integer pointer pointer to the NVM address to be programmed Output Return value char Bit 0 Pass or fail 0 Assembly Buffer is successfully opened 1 Assembly Buffer cannot be opened Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reasons of failure Corrupted NVM data sector The range of the address is protected The range of the address is incorrect Possible reason for execution fail Routine called as nested call during the execution of another NVM routine e g via RAM branching Assembly Buffer is already opened Once assembly buffer is opened user must either proceed with the standard progr
75. ddress is considered invalid and a Block Type Error FFy is returned The header block for Mass checksum check Option 184 Mode Data 5 bytes 00 0A Expected Expected Checksum Header ModeA NotUsed NotUsed CHKSum CHKSum pics 1 byio Block 1 byte 1byte High Low 1 byte 1 byte 1 byte Mode Data Description Not Used These Bytes are not used and will be ignored for Option 184 Expected CHKSum High Low Expected checksum High Low Byte Option set to 184 to enable mass checksum check This option will trigger a checksum calculation 16 bits inverted XOR refer to Chapter 5 2 3 over all the linearly mapped sectors not including the not linearly mapped sectors and CS pages The result will then be compared with the expected checksum provided by the user in the header frame The microcontroller will return an Acknowledge followed by four data Bytes and a single byte checksum The Bytes are in sequential order pass fail indication 00 if the calculated and expected checksum match 80 if they differ calculated checksum High Byte calculated checksum Low Byte and a final Byte equal to 00 Note The checksum is calculated on the acknowledge and the 4 data bytes The header block for CS page checksum check Option 50 Mode Data 5 bytes 00 0A Expected Expected Checksum Header Mode A CSPage NotUsed CHKSum CHKSum pi byio
76. de 1 Code Execution inside 55 5 2 2 4 Mode 2 Code Data download to NVM 55 5 2 2 5 Mode Code Execution inside NVM 60 5 2 2 6 Mode 4 Erase 60 5 2 2 7 Mode 6 NVM Protection 62 5 2 2 8 Mode A NVM Readout Chip ID Checksum 63 5 2 3 16 bits inverted checksum 68 5 3 WDT1 refreshing eii eserse s EUR deed et Pes 68 6 os Sees nee Dawe ae ee tee as 69 6 1 NVM OVervieW 2 2 ci eee eee rd rok eres 69 6 1 1 NVM organisation 70 6 2 NVM configuration sectors organisation 74 6 2 1 Chip ID definition xir rere beta Rade hood keel hes 74 6 2 2 100 Time Programmable data 77 6 3 NVM user routines organisation 83 6 3 1 Opening assembly buffer routine 86 6 3 2 NVM programming 87 6 3 3 NVM page erasing routine 90 6 3 4 Abort NVM programming routine 91 User Manual 3 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM 6 3 5 Read NVM status
77. de 4 is allowed and Protection Error will be sent 2 NAC and NAD values will also be erased and the device will no longer be accessible in UART BSL because NAC is invalid and default NAC will be used 5 2 2 7 Mode 6 NVM Protection Mode 6 is used to enable or disable the NVM Protection Mode by the given user password The header block for this working mode has the following structure The header block Mode Data 5 bytes 00 06 6 User Not Used Checksum Block password 1 byte 1 byte 4 bytes Mode Data Description User password This Byte is given by user to enable or disable NVM protection mode Not used The four Bytes are not used and will be ignored in mode 6 In mode 6 the header block is the only transfer block to be sent by the host If device is unprotected the provided user password will be set as NVM PASSWORD and internally stored No further commands will be accepted until a power up or hardware reset Afterwards protection mode will be enabled However if the NVM is already protected the microcontroller will deactivate the Protection and erase the NVM if the user password Byte matches the stored NVM PASSWORD Byte If MSB of the NVM PASSWORD is 0 only NVM Linearly mapped sectors are erased If the Bit is 1 both NVM Linearly and Non linearly mapped regions are erased No further commands will be accepted until a power up or hardware reset Afterwards protect
78. de cumulated ECC single bit error indication since last call of the function Table 6 14 NVM User Routines Maximum Stack Usage Routine Maximum Stack Usage USER CFLASH WR PROT EN 00004 USER CFLASH WR PROT DIS 00004 USER CFLASH RD PROT EN 0000 USER CFLASH RD PROT DIS 00004 USER DFLASH WR PROT EN 0000 USER DFLASH WR PROT DIS 00004 USER DFLASH RD PROT EN 0000 USER DFLASH RD PROT DIS 00004 USER OPENAB 0038 USER PROG OOBO USER_ERASEPG 00404 User Manual 85 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 14 NVM User Routines Maximum Stack Usage cont d Routine Maximum Stack Usage USER ABORTPROG 00104 USER NVMRDY 0000 USER READ CAL 0030 USER NVM CONFIG 000C USER NVM ECC2ADDR 000C USER MAPRAM INIT 00104 USER READ 100TP 0030 USER 100TP PROG 00844 USER ERASE SECTOR 0030 USER SET USER CLK 0030 USER NVMCLKFAC SET 0008 USER RAM MBIST START 01D0y USER_NVM_ECC_CHECK 00204 USER ECC CHECK 00204 6 3 1 Opening assembly buffer routine The NVM programming routine consists of two parts The assembly buffer opening routine and the programming and verification routine The Open Assembly buffer routine reads the content of the physical page into a NVM internal RAM memory block Assembly Buffer The address of the page to be read is provided with the OpenAB function call Once the OpenAB call has been executed successfully the user can up
79. de for valid command Slave Response Header Phase l Synchronize and Setup baud rate 4 Response Phase 11 Report its status to the host Figure 4 1 LIN mode Phases II and Ill Host Master Request Header Gammand TLE986x lt gt lt gt SYN Break SYN Char Protected ID Checksum pico 555 3C 8 Data bytes for Command 1 byte Slave Response Header Msi SYN Char Pretepted ID bit low H Response lt 8 Data bytes for Response TENIS Figure 4 2 LIN mode Frames For all modes entry the Master Request Header is transmitted from host to microcontroller followed by the command which is the header block The Slave Response Header is transmitted to check the status of the operation For mode 0 2 and 8 there is no need to send a Slave Response Header after every data block The microcontroller supports multiple data block transfers up to 256 data blocks without Slave Response Headers in between which saves overhead As the commands are sent one after another without waiting for any status indication a certain delay is required as shown in Figure 4 3 to ensure sufficient time is provided for the microcontroller to execute the desired operations User Manual 19 Rev 1 3 2015 07 10 e Infineon TLE986xQX BE BootROM LIN BSL mode Host TLE986x Master Request Header Header Block Mode 0 2 8 gt HOST TLE986x Delay
80. during NVM operation Details in the following table User Manual 90 Rev 1 3 2015 07 10 Cinfineon Table 6 17 TLE986xQX BE BootROM NVM Page erasing subroutine Subroutine 000038D5 USER ERASEPG Prototype char USER ERASEPG unsigned int NVMPageAddr char RAM RTNE BRNCHNG Input NVMPageAddr integer pointer pointer to the NVM address to be erased RAM RTNE BRNCHNG char To enable or disable background execution from RAM Bit 0 RAM branching control bit 0 RAM branching disabled 1 RAM branching enabled Output Return value char Bit 0 Pass or Fail 0 Erasing completed successfully 1 Erasing failed Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reasons of failure The range of the address is incorrect This is a protected range Possible reason for execution fail Routine called as nested call during the execution of another NVM routine e g via RAM branching Note No NVM prog or erase routine can be called until this NVM operation is completed 6 3 4 Abort NVM programming routine This user routine aborts the NVM programming by closing an opened assembly buffer User Manual 91 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 18 Abort NVM programming subroutine Subroutine 000038CD USER ABORTPROG Prototype bool USER ABORTPROG void Input
81. e 1 and mode 9 or jump to NVM address at the address pointed by 110000044 mode 3 respectively Note For mode 3 jump to NVM will only occur either 1 when NVM is not protected and NVM content at 11000004 is not FFy or 2 when NVM is protected In all other cases firmware will put the device in sleep mode 4 4 4 4 Mode 4 NVM erase Mode 4 is used to erase the NVM 3 different options are supported e Option 00 Page Erase Option 404 Sector Erase Option Mass Erase The header block for Option 00 has the following structure User Manual 29 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode The header block for page erase Option 00 Mode Data 5 bytes 00 NAD Header 04 Start Start Start Start Option Checksum 1 byte Block Mode 4 Addr4 Addr3 Addr2 Addr1 00 1 byte MSB LSB 1 byte Mode Data Description Start Addr 4 to 1 32 bit address of the NVM page to be erased Option set to 00 to enable page erase When the Option Byte is 004 the NVM page selected by the address provided in the Mode Data field is erased The address should be aligned with the beginning of the chosen page The header block for sector erase Option 404 The header block for Option 404 has the following structure Mode Data 5 bytes 004 NAD Header 04 Start Start Start Start Option Checksum 1byte
82. e end of synch Byte flag LINST EOFSYN is polled When this flag is set Timer 2 is stopped T2 Reload Capture register RC2H L is the time taken for 8 Bits Then the LIN routine calculates the actual baud rate sets the PRE and BG values and activates baud Rate Generator The baud rate detection for LIN is shown in Figure 4 4 1st negative transition T2 automatically Last captured value of T2 EOFSYN bit is set set T2RHEN bit starts upon negative transition T2 is stopped Synch Break Synch Char 55x Start Y Y i Y Stop Y Bit Bit 00 01 02 03 04 Captured Value 8 bits Figure 4 4 LIN autobaud rate detection 4 3 2 Calculation of BR VALUE and PRE values To set up auto baud rate detection the BG and PRE values must be calculated As there are two unknown values two formulas are therefore needed Firstly the correlation between the baud rate baud and the reload value BR VALUE stored in the registers User Manual 21 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode BGL and BGH and fractional divider FDSEL depends on the internal peripheral frequency fpc T 4 1 16x PRE x BR VALUE 50 Secondly the relation between baud rate baud and the captured value of Timer 2 T2 depends on the T2 peripheral frequency fr2 and the number of received Bits Np fro x Ny T2 baud 4 2 Combining Equation
83. e standard read level Note The result of the last NVM Data sector initialization executed during the Startup flow is reported to the user via the bit 1 of the SYS_STRTUP_STS register MRMINITSTS If this bit is set to 1 then the last initialization failed and the mapping info might be corrupted In this case a reset power on reset brown out reset pin reset or wakeup reset can be issued in order to start the Service Algorithm to try to fix the integrity issue inside the Data NVM If the MRAMINITSTS is still flagged afterwards the Data NVM sector has to be re initialized by performing a sector erase Service Algorithm User Manual 110 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM The Service Algorithm is called by the NVM Data sector initialization in case incorrect mapping issues have been found The Service Algorithm checks the data sector page by page reading the mapblocks with soft read levels refer to Figure 6 4 At first the Service Algorithm looks for faulty pages and tries to repair them by erasing these pages Following the algorithm proceeds looking for double or higher mappings In case two or more double mappings or at least one triple or higher mapping were found the SA stops execution and reports an error on the MEMSTAT register MEMSTAT set to AO In case instead only one double mapping is found the algorithm selects which page has to be erased according to the following steps 1 The SA checks
84. e user configuration sector pages In this case user has to transfer data to the RAM in accordance with the format reported in the Table 6 12 and after EOT block has been received data is automatically copied with proper offset in the target page If NVM protection is installed programming to RAM is not allowed Different options supported are Option 004 RAM download Option FO RAM download and Configuration sector page programming The header block for this working mode has the following structure User Manual 52 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL The header block for RAM download Option 004 Mode Data 5 bytes 00 00 StartAddr StartAddr Block Option Checksum Head Mode 0 psa Mode 0 High Low Length Gi 00 1 byte 1 byte 1 byte 1 byte y 1 byte Mode Data Description Start Addr High Low 16 bit Start Address which determines where to copy the received program codes into the RAM Block Length The length number of Bytes of the following data blocks or EOT block Not Used this Byte is not used and will be ignored Option Set to 00 for RAM download Note RAM Address provided as input in mode 0 has to be considered as an offset to be added to the standard RAM starting address of the TLE986xQX In option OOH start address can be each valid RAM offset address Data sent in the following data EOT blocks
85. egrity Handling Field Bits Description SASTATUS 7 6 Service Algorithm Status 00 Depending on SECTORINFO 2 possible outcomes For SECTORINFO 004 NVM initialisation successful no SA is executed For SECTORINFO Otherwise SA execution successful Only 1 mapping error fixed 01 SAexecution successful At least 1 mapping error fixed 10 SA execution failed Map error in data sector 11 Reserved SECTORINFO 5 0 Sector Information 014 to 20 representing the different sector addresses For values not within this range the data will be considered invalid Once the SA has been executed regardless of the execution status the last access sector information will be stored here Note The MEMSTAT register has a dual function It is used to store the return value of the SA as well as input value for the NVM operations to indicate the Emergency Operation For this reason the user shall reset the MEMSTAT register after every power on reset brown out reset pin reset or wake up reset before the execution of any NVM operation During the repair phase pages with incorrect mapping are erased Each page erase operation takes up to 4 5 ms User Manual 112 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Startup and Service Algorithm timing Single Faulty page MAPRAM Startup INIT SA Startup phase 1 Mapping Faulty page Erase 45 ms 2 0 3 ms check 1 ms 0 1 ms S
86. er The test consists of a linear write read algorithm using alternating data Once started the firmware waits until the test is completed before checking the result and continuing accordingly the start up sequence In case an error is detected the device is set to loop endlessly with WDT1 enabled Anyhow in case of power on reset brown out reset or wake up reset from sleep mode the start up procedure will continue with a complete RAM initialization by writing all the RAM to zero with proper ECC status This is needed to prevent an ECC error during user code execution due to a write operation to an un initialised location with invalid ECC code Afterwards the Firmware proceeds checking the NVM status Note The test sequence on the entire RAM takes 350 us while the initialization of the complete RAM takes 100 us 3 1 2 NVM initialisation routine This routine will set the NVM protection according to the password in the configuration sector refer to Section 6 4 5 for further details on NVM protection and protection password 3 1 3 NVM MapRAM initialisation After every power on reset brown out reset pin reset or wakeup reset the system performs the MapRAM initialisation This operation is triggered to restore the MapRAM content In case during the initialisation at least one error is detected the service algorithm routine is called to do the repair In case of mapping errors the repair mechanism consists of erasing the wrong pages
87. er of NVM Sector 11000F00H to 30 11000F7FH 11000F80H to 31 11000FFFH 6 2 NVM configuration sectors organisation The configuration sector contains important user data needed for proper system initialization 6 2 1 Chip ID definition The specific characteristics of the different variants of the product family are captured in the definition of the CHIP ID Bytes The Chip ID bytes can be read via BSL mode A When triggered this mode replies providing the CHIP ID Bytes plus the content of the Identification Register ID Please refer to the following tables for CHIP ID details This is a variant specific identification number The unique device specific identification number is described in Table 6 11 Table 6 5 Chip ID Byte 0 Res MAX FREQ OP AMP Phases DMA PKG Type Table 6 6 Chip ID Byte 0 Bits Description Field Bits Description PKG Type 1 0 Package Type 00 VQFN 48 01 Reserved 10 Reserved 11 Reserved DMA 2 DMA 0 with DMA 1 without DMA Phases 3 Bridge driver number of phases 0 2 phases 1 3 phases User Manual 74 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 6 Chip ID Byte 0 Bits Description Field Bits Description OP_AMP 4 Op Amp 0 with Op Amp 1 without Op Amp Max Freq 6 5 Maximum Frequency 00 reserved 01 20MHz 10 24MHz 11 40 MHz Res 7 Reserved Table 6 7 Chip ID Byte 1 NVM_SIZE EEPROM_SIZE User M
88. eset the system performs the MapRAM initialisation during the following startup and triggers the Service Algorithm to try to repair mapping inconsistency if required The user shall then check the status of the mapped region evaluating the information User Manual 95 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM reported on the MEMSTAT and SYS_STRTUP_STS registers In case of software reset e g issued during a RAM branching or internal watchdog reset the following startup sequence does not perform any check of the mapped sector In this case the user shall trigger the USER MAPRAM INIT function in the application code before performing any other NVM operation to check the presence of inconsistent mapping in the NVM Data region Table 6 23 MapRAM initialization subroutine Subroutine 00003890 USER INIT Prototype char USER MAPRAM INIT void Input Output Return value char Bit 0 Pass or Fail It is the OR of the bits 5 6 and 7 0 MapRAM initialization pass 1 MapRAM initialization fail Bit 1 to 4 Reserved Bit 5 Double mapping 0 Pass No double mapping found 1 Fail The initialization failed due to double mapping Bit 6 Faulty page 0 Pass No faulty pages found 1 Fail The initialization failed due to faulty page Bit 7 Execution Pass Fail status 0 Pass Routine execution could be properly started 1 Fail Routine execution could not be properly started due to mis
89. essful program operation the USER PROG routine properly updates the MapRAM information mapping the page just written and randomly selects a proper spare page between the available not written and not faulty pages In case for any reason a valid spare page cannot be found the routine returns a proper error indication In such case all data previously written including the page just written is still accessible no data loss Table 6 16 Programming subroutine Subroutine 000038DD USER PROG Prototype char USER PROG char PROG FLAG User Manual 88 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 16 Programming subroutine cont d Input PROG_FLAG char Byte for controlling the programing routine Bit 0 RAM branching control bit 0 RAM branching disabled 1 RAM branching enabled Bit 1 Corrective action retry and disturb handling control bit 0 Corrective actions disabled 1 Corrective actions enabled Bit 2 Failing page erase control bit when addressing non linearly mapped sector refer to Chapter 6 4 4 2 for more details 0 Failing page erase enabled The programmed data are erased in case of fail If the page was already used old data are kept 1 Failing page erase disabled Programmed data are not erased in case of fail If page was already used old data are not kept and the new failing data are accessible by reading the target page User Manual 89 Rev 1 3 2015 07 10
90. estore the mapping information into the MapRAM reading specific bytes called mapblock of the NVM data sector pages see Figure 6 3 The state machine accesses these bytes and page by page reads out the logical page to which the current physical page has to be linked to updating accordingly the dedicated MapRAM location In case a mapblock is read as erased the physical page is not mapped All the logical pages for which no valid mapping is found are marked into the MapRAM as unmapped While reading out the info from the mapblock the hardware state machine might find incorrect mapping info In particular following scenarios might appear more physical pages are mapped to the same logical page double or higher mapping the mapblock information cannot be read correctly due to ECC errors faulty page In this case the hardware state machine stops the initialization on the first incorrect mapping and triggers the execution of the Service Algorithm SA MAPRAM Mapblock Data sector Log Pg 0 LogPg1 LogPg2 0 LogPg3 LogPg4 DM LogPg5 Log Pg 27 Phys Pg 27 Log Pg 28 PhysPg 28 Log Pg 29 Phys Pg 29 Log Pg 30 Phys Pg 30 Log Pg 31 D Phys Pg 31 Log Pg 32 PY Prys Pg 32 Figure 6 3 MapRAM and Mapblocks User Manual 108 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Good programmed page Erased ce
91. et sources different from power on reset brown out reset and wakeup reset For these 3 reset sources either a RAM test or a RAM clear is executed thus destroying the previously stored values After that depending on the reset source the firmware will do NVM protection NVM MapRAM initialisation on chip oscillator trimming PLL setting and analog module trimming It will decode the pin latched values of the TMS P0 0 and P0 2 to determine which mode it will jump to If bootup mode is Debug Support mode the WDT1 is disabled For entry to user mode the WDT1 remains active Next the firmware will wait for NVM module to be ready For software or internal watchdog reset triggered by the WDT in the SCU the following steps are skipped RAM test and initialisation NVM MapRAM initialisation and service algorithm Setting of oscillator and PLL and switching system clock input to PLL output Loading of analog modules trimming parameters from first 100TP page Loading of user configuration data from 100TP page into the RAM Clearing of NMI status before exit to user mode or Debug support mode User Manual 10 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Startup procedure 3 1 1 Test and initialisation of RAM A functional test sequence is executed on the entire RAM after power on reset and brown out reset and can be executed after a wakeup reset depending on the value stored in the System Startup Configuration regist
92. fineon TLE986xQX BE BootROM Startup procedure 3 Startup procedure This chapter describes the BootROM startup procedure in TLE986xQX The startup procedure is the first software controlled operation in the BootROM that is automatically started after every reset Certain operations are skipped depending on the type of reset Refer to next section for further details 3 1 Program structure The first task executed by the startup firmware is the check of the reset source For power on brown out reset or wake up from sleep mode reset RAM test optional and initialization mandatory are executed while they are skipped for the other resets In particular the RAM test is always executed in case of power on and brown out reset For wake up reset instead the memory test execution is controlled by the MBIST EN bit in the SystemStartConfig register The user can freely set the value of this bit and its value is kept over wake up reset If the bit is set to 0 the RAM test is not performed on wake up If the bit is set to 1 then the RAM test is performed even for wake up resets Firmware code uses part of the RAM for variable storage literal pools and stack pointer The startup code anyhow only uses specific RAM region the first 1kB mapped from address 18000000 to 180003FF JJ subset of the total available RAM address range The remaining region not used by the FW can be used by the user to store values to be valid across reset for all res
93. g out a response code If a block is received correctly an Acknowledge Code 55H is sent In case of failure an error code is returned The response is transmitted with a delay that depends on the selected mode and on the type of the block received The following Table 5 5 reports the maximum response delay for each mode and block type User Manual 50 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM Table 5 5 ax Response Delay Table FastLIN BSL Mode UART BSL Maximum Response Delay Block Type Option Description Download Code Data to RAM Header 1 us per Byte 1 us per Byte Download data to 100TP pages RAM code execution Download Code Data to NVM NVM code execution NVM page erase 4 5 ms 1 us per Byte 10 ms 1 NVM sector erase 4 5ms NVM mass erase NVM Protection set 4 5 ms per sector 10 ms NVM Protection reset Get Chip ID 4 5 ms 4 5 ms per sector NVM Page Checksum Check NVM Mass checksum check 100TP page Checksum Check NVM Page 100TP page 1 Time needed for data collection OpenAB erasing old data if required and programming the data given User Manual 51 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL 5 2 2 UART BSL Modes When the UART BSL routine enters Phase ll it first waits for an 8 byte long header block from the host The
94. ge specified by the start and stop addresses given as input parameters When starting the MBIST test standard RAM interface is disabled User Manual 99 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Therefore data stored into it will not be accessible and data stored in the memory range under test will be cleared to zero The standard interface will be re enabled after completion before the end of the routine execution Note The start and stop address passed as parameter are offsets to be added to the RAM start address 18000000 Table 6 28 RAM MBIST start subroutine Subroutine 0000384D USER RAM START Prototype char USER RAM MBIST START unsigned short RAM MBIST Stop Addr unsigned short RAM MBIST Start addr Input RAM MBIST Stop Addr unsigned short RAM offset of the stop address of RAM range to be tested RAM MBIST Start addr unsigned short RAM offset of the start address of RAM range to be tested Output Returned value char Pass or Fail Bit 0 MBIST pass or fail 0 MBIST test pass 1 MBIST test fail Bit 1 Address range fail 0 test routine pass address range valid 1 7 test routine fail address range invalid Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reason for execution fail Routine called as nested during the execution of another NVM routine e g via RAM branching Note While
95. gering an interrupt In the worst case interrupt comes soon after a new erase was started User Manual 118 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 43 Emergency operation handling in Type 1 routines cont d Phase Description 3 Interrupt subroutine ISR is serviced immediately when the NVM is free 4 With control returned to the BootROM the NVM routines will be executed bypassing the corrective activities This ensures that the routines will end in the shortest time possible even if a successful execution of the on going NVM operation is not ensured 5 Exiting the NVM routines the user code checks the MEMSTAT EMPROP Since it is set the code can branch to execute a user defined emergency sequence First step is open AB and load user relevant data 6 Before programming new data if target page is already used a preliminary erase is performed 7 User critical data are programmed in the target page The Table 6 43 refers to the type 1 routines but data are similar for type 2 routines as well Waiting for NVM BootROM Open AB available erase just routine and load Erasing Critical data Interrupt started ISR completion critical data used page program event occurrin 2000 us x us user 4100 us xus 300 us code 4100 us 3000 us Phase 1 Phase2 pe 4 Phase 4 5 6 7 Figure 6 8 Worst case
96. he high Byte of the RAM starting address where to copy data downloaded from CS This Byte is ignored if the routine is not enabled User Manual 12 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Startup procedure CS USER CAL XADDL offset 7B It defines the low Byte of the RAM starting address where to copy data downloaded from CS This Byte is ignored if the routine is not enabled CS USER CAL CS PAGE offset 7C It defines the CS page where data has to be downloaded from refer to Figure 6 2 This Byte is ignored if the routine is not enabled e CS USER CAL NUM offset 7Dy It defines the number of Bytes to be downloaded starting from the first Byte of the selected CS page This Byte is ignored if the routine is not enabled The RAM address where the user configuration data has to be copied to is stored as a 16 bit offset to the RAM start address 18000000 This offset is defined by the CS USER CAL XADDL and CS USER CAL XADDH parameters The routine has been developed to support downloading of the Customer ID and the ADC calibration parameters stored at the beginning of the first 100TP page see Table 6 11 into the RAM for an easy access but can be more generally used for all other CS user parameters If the routine is enabled firmware will copy the data from config sector into the RAM Moreover independent of startup setting a similar routine is provided as NVM user routine refer to Section 6 3 6 3 1
97. he vector table position at the beginning of the NVM in user accessible space by proper setting of the VTOR register and jump to the user defined reset handler routine jump to the location pointed by the address 11000004 11000007 to execute the user program Note The firmware will only set the VTOR to point at the beginning of the user accessible NVM region but will not write any vector table This is the responsibility of the user to download a correct vector table Table 2 1 lists the boot options available in the TLE986xQX User Manual 7 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Overview Table 2 1 TLE986xQX Boot options TMS DAP1 P0 0 P0 2 Mode Comment DAPO 0 X X User mode BSL mode 1 0 X Device test mode 1 1 0 Debug mode with SWD port 1 1 1 Device test mode On chip OSC is selected as PLL input System is running on LP CLK until firmware switches to PLL output before jumping to user code Exception is with hardware reset where user settings are retained Boot in user mode or BSL mode depends on the NAC word in user memory NVM 9 Power up with special internal settings At completion device runs in endless loop No NVM code execution is performed Attention The device test mode is not intended to be selected by the user The user shall ensure by external configuration of the pins TMS P0 0 and P0 2 that no device test mode is entered 2 2 Program structure
98. his behavior the BootROM internal BSL mode shall be disabled by the user application by setting the NAC value to X1h or by selecting LIN BSL protocol NAC value is restricted to OC as the first open WDT1 window is worst case 65 ms The firmware has to either refresh the WDT within the 65 ms or jump to user mode If NAC value is bigger than BootROM code will refresh the WDT and wait for a LIN frame indefinitely 4 8 1 Programming NAC and NAD User needs to program the NAC and NAD in the format listed in Table 3 3 To ensure the parameter validity the 2 parameters actual values and their inverted values are checked If the NAD parameter is not valid nor within the range the default value 7 is used in the LIN BSL User Manual 41 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode 4 9 WDTI refreshing After a reset the WDT1 is starting with a long open window WDT1 keeps on running while waiting for first LIN frame In case during the LIN BSL waiting time defined by NAC a LIN communication is detected WTD1 is disabled and its status frozen Subsequently before exiting to RAM or NVM in LIN BSL modes 1 3 and 9 the watchdog is re enabled and starts from the previously frozen state The WDT1 is then still in long open window and the remaining valid time is equal to Long open window minus the time between reset release and first LIN communication User program needs to trigger the WDT1 refresh accordingly
99. ion mode will be disabled User Manual 62 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL In case NVM is protected and the given user password does not match the stored NVM PASSWORD no actions will be triggered and a Protection Error FDy will be returned instead of Acknowledge Note 1 Password value has to be different from 004 and If PASSWORD is set to either 004 or FFy on an unprotected device the protection will not be set and a protection error FD will be returned 2 When disabling NVM protection together with NVM the NAC and NAD values are erased too As a result after next reset default NAD will be used and chip waits forever for the first Fast LIN BSL frame Table 5 6 Erase NVM during unprotection NVM PASSWORD Bit7 Description 0 Only linearly mapped NVM is erased 1 Both linearly and non linearly mapped NVM are erased 5 2 2 8 Mode A NVM Readout Chip ID Checksum Mode A is used to get 4 Bytes Chip ID data NVM or CS page read NVM or CS page or NVM mass checksum check depending on the Option Byte value in the header block Different options are supported Option 00 4 Get 4 Bytes Chip ID Option 104 NVM page checksum check Option 184 Mass NVM checksum check Option 50 4 Configuration sector page checksum check Option NVM page read Option FO Configuration sector page read The header block for Get 4 Byte Chip ID
100. ission follows 6 The requested operation has EOT 0 2 4 been performed and is 8 successful All other Reception of the Block is combinations successful Ready to receive the next block User Manual 36 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode Table 4 6 Definitions of responses cont d Response Value Description Block Reasons Implications Corrective Type Mode Action Block FFy Header 2 4 NVM start address out of Retransmit a Type Error range valid header block All other Either the block Type is Retransmit a combinations undefined or the flow is valid block invalid see Figure 4 2 Checksum All combinations There is a mismatch between Retransmit the Error the calculated and the block received Checksum see Section 4 4 3 Protection FDy Header 0 2 4 Protection against external Disable Error 6 8 access enabled i e protection NVM PASSWORD is valid FD Header 6 User password invalid set Repeat either to 0 or FF onan command with unprotected device valid password Table 4 7 gives a summary of the response codes to be sent back to the host by the microcontroller Table 4 7 Type of Response Code Communication status Response code to the host Acknowledge Success 554 Block Type Error FFy Checksum Error FEy Protection Error FDy 4 5 3 Mode A response This re
101. l Pass or fail 0 Configuration read successfully 1 Configuration read failed NVMSize char pointer pointer to the RAM location where the number of available sectors of the code area 4 kBytes each has to be saved MapRAMSize char pointer pointer to the RAM location where to store the number of available sectors of the data area 4 kBytes each Possible reason of failure NVM Linear sector is set as 00 6 3 8 Read NVM ECC2 address routine This routine returns the result of the last NVM address accessed resulting in a double ECC error Details in the following table Table 6 22 Read NVM ECC2 address subroutine Subroutine 000038 USER NVM ECC2ADDR Prototype char USER NVM ECC2ADDR unsigned int ECC2Addr User Manual 94 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 22 Read NVM ECC2 address subroutine cont d Input ECC2Addr unsigned short pointer Pointer to the RAM location where the last NVM address with ECC2 error shall be stored Output Returned Value char Bit 0 ECC2 error detection 0 No NVM ECC2 detected 1 2 address detected Bit 7 Execution Pass Fail status 0 Pass Routine was correctly executed 1 Fail Routine was not executed Possible reason for execution fail Null pointer passed to the routine Routine called as nested call during the execution of another NVM routine e g via RAM branching The
102. lls Faulty page Iz Ig EF Erased cells l l lo l Ei 9 Im dm g I 8 Figure 6 4 Read levels and faulty page User Manual 109 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Restore MapRAM info reading out page by page mapblocks using standard read level Correct mappi info found No UNES Check Mapping info Yes into mapblocks with v soft read level and SERVICE ALGOR repairallfaulty pages and upto one double mapping v v MEMSTAT 0x00 da s EU Figure 6 5 NVM data sector initialization flow In order to detect pages whose mapblock is marginal towards the standard read level the NVM finite state machine that performs the mapping initialization is triggered three times with three different read levels standard read margin soft read level erased and Soft read level programmed refer to Figure 6 4 As soon as the first incorrect mapping faulty or multiple mapping is detected by any of these three initialization sequences the Service Algorithm is called At the end of the Service Algorithm execution a new initialization of the Data sector is needed to properly initialize the mapping info This final initialization is again executed by triggering the NVM Finite State Machine and is performed using only th
103. mode 1 or mode 3 Host Master Request Header Command TLE986x gt L Synch 8 Data bytes for Command y Synch Protected NAD Header Mode Fast Prog Break Checksum Char ID 0 XXH XXH XXH XXH 01 H At least 55g 3C 1 byte 13 bit low yy 00 02 08 ye Slave Response Header gt Synch Synch Protected z Break Char ID At least 55 7D 13 bit low a _ gt 8 Data bytes for Command NAD Response 1 not used Checksum 1 byte XXH 554 004 004 004 004 00 00 lt lt lt lt lt lt lt lt lt lt lt lt lt lt UART BSL Mode protocol gt gt gt gt gt gt gt gt gt gt gt gt 1524 NITI Figure 4 5 Fast LIN BSL mode entry User Manual 39 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode 4 7 After Reset conditions When more than one parameter in the transfer block is invalid different actions are performed The different scenarios and its consequent actions are listed in Table 4 8 Table 4 8 LIN BSL After Reset conditions First ID Check NAD Block Mode Action Frame sum Type Header only Yes Invalid Dont Dont Don t Dont Save LIN Message to RAM and care care care to NVM 11000004429 No Invalid Don t Don t Do
104. mpleted before continuing with the normal user routine execution Table 6 40 shows RAM branching address and provides an example for the RAM code exit point Figure 6 7 shows how background programming can be supported during calls to a NVM programming routine Note The context switch between BootROM user routine and user RAM code in NVM operation Type 2 is user responsibility To avoid that RAM code execution interferes with BootROM user code completion the user must save the content of the used resources e g core registers upon starting User Manual 114 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM the RAM code execution and restore them before jumping back to the BootROM code Under no circumstances shall the user return with modified core registers as proper resuming the BootROM function cannot be ensured Note During user RAM code execution in Type 2 NVM operations no calls to NVM user routine are allowed Calling other NVM user routines can change internal NVM registers content thus affecting the completion of the suspended operation Table 6 40 RAM branch code structure RAM Address RAM content 18000400 Start of user defined code It can be directly code or jump to some other RAM location End of user defined BX LR Return instruction code location User Manual 115 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM BootROM User routine USER PROG on a already
105. n TLE986xQX BE BootROM User Manual Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM 1 Introduction ue Pek uo xa bh B CRUS SR US GU 5 PUIpOSe io ehh DESEE Nu e hdd ee eds 5 1 2 SCOPE sek as SECRET MEME Rd fus te US DRE 5 1 3 Abbreviations and special terms 5 2 gj PCIE 7 2 1 Firmware architecture sls cede ee pe gar d Red 7 2 2 Program StEUCLle 20 inu duced dor d wd ori ROS gah en men ee Rok AUR 8 3 Startup procedure 10 3 1 Program Structure uoo err Gon hee eka Pa PRA bue de 10 3 1 1 Test and initialisation of RAM 11 3 1 2 NVM initialisation routine 11 3 1 3 NVM MapRAM initialisation 11 3 1 4 Oscillator trimming and system clock selection 12 3 1 5 Analog module trimming 12 3 1 6 User configuration data initialization 12 3 1 7 Debug support mode entry 13 3 1 8 User mode and BSL mode entry 13 3 1 8 1 NAC definition liess ln Re mex e ns 14 4 LIN BSL mode 17 4 1 LIN BSE features eei oe tet mo septo Ee recede 17 4 2 LIN BSL mode overview 4 44 ne 18 4 3
106. n Error Byte FD will be returned User Manual 67 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL All other values for option Byte Block Type Error indication is sent back In mode A the header block is the only transfer block to be sent by the host The microcontroller will return an Acknowledge followed by data Bytes if the header block is received successfully If an invalid option is received the microcontroller will return a Block Type Error indication FF and no further Bytes 5 2 3 16 bits inverted XOR checksum This checksum structure is used in BSL Mode A options 10H 184 504 as a fast data integrity check These modes will read the specified NVM range calculate the checksum and compare it against the expected one provided as command parameter To calculate this checksum all Half Words 16 bits of the selected NVM region are xored The resulting value is then logically complemented 1 s complement The following figure shows the calculation algorithm Byte 0 Byte 1 Byte 2 Byte 3 4 5 2 Byte n 1 HalfWord 0 HalfWord 1 HalfWord 2 HalfWord n 2 2 HW 0 xor HW 1 xor HW 2 xor xor HW n 2 2 For a NVM page n 128 gt HW 0 xor HW 1 xor HW 2 xor HW 63 Figure 5 3 1
107. n on the non linearly mapped NVM sectors 000038EDy USER_DFLASH_RD_PROT_DIS To disable read protection on the non linearly mapped NVM sectors 000038E5 USER_OPENAB To open the assembly buffer for writing 000038DD USER_PROG To program the NVM 000038D5 USER_ERASEPG To erase an NVM page 000038CD USER_ABORTPROG To abort the NVM programming by closing the assembly buffer 000038C5 USER_NVMRDY To access if the NVM is in ready to read status 000038BDy USER_READ_CAL To read the NVM calibration data 000038B5 USER_NVM_CONFIG To read the NVM configuration status User Manual 84 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 13 NVM user routines list cont d Address Routine Description 000038AD4 USER NVM ECC2ADDR To read the NVM ECC2 address 0000389D USER MAPRAM INIT To initialize MapRAM 000038754 USER READ 100TP To read the NVM 100TP parameter data 0000386Dy USER 100TP PROG To perform the 100TP program This can be used 100 times per 100TP page 00003865 USER ERASE SECTOR To erase an NVM Sector 00003855H USER NVMCLKFAC SET To set NVMCLKFAC Bit in SYSCONO 0000384Dy USER RAM MBIST START To perform a sequential checkerboard and inverted checkerboard test on the RAM 00003845 USER NVM ECC CHECK To trigger a complete NVM read and provide cumulated ECC single bit error indication 0000383Dy USER ECC CHECK To provi
108. n t Don t Messageis ignored Wait for next care care care frame Yes 7Dy NA N A NA N A Save LIN ID to RAM and jump to NVM 1100000429 No N A N A Reply if there is a previous valid Master Request Command Frame else wait for next frame Yes 3Cy LIN Don t Invalid Valid Error flag is triggered Wait for care Response frame to reflect error Yes 3Cy LIN Don t Don t Invalid Save LIN message to RAM and care 4 jump to NVM 11000004429 Yes LIN Valid Valid Valid Execute command Yes 3Cy LIN Invalid Valid Valid Message is ignored Wait for next frame Yes 3Cy Prog Invalid Don t Don t Message is ignored Wait for next care care frame Yes 3Cy Prog Valid Invalid Valid Error flag is triggered Wait for Response frame to reflect error Yes 3Cy Prog Valid Valid Invalid Error flag is triggered Wait for 5 Response frame to reflect error Yes 3Cy Prog Valid Valid Valid Execute command Yes 3CH Invalid Don t Don t Don t Save LIN message to RAM and care care jump to NVM 11000004429 1 The LIN frame will be saved and dumped for debugging at RAM address 18000500H 2 Jump to user mode will only occur either 1 when NVM is not protected and NVM content at 11000004 is not or 2 when NVM is protected User Manual 40 Rev 1 3 2015 07 10 Infineon TLE986xQX
109. ng the value FE in the MEMSTAT register Via a dedicated 100TP sector parameter the user can always allow Service Algorithm to perform the repair step even in case the Data sector is protected The control Byte for this feature C8 SA WITH PROT EN is stored into the first 100TP page refer to Table 6 11 When this parameter is set to the value A5 the repair step is executed even in case protection is set The repair flow saves the protection setting removes temporarily the protection on the data sector performs the needed repair operation and User Manual 113 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM then restores the original protection settings The temporary protection disabling is performed at NVM protection register no access or changes to the user defined NVM protection password is performed By default the C8 SA WITH PROT EN parameter is set to 00 i e protection status is considered 6 4 2 Supporting Background NVM Operation There is only one NVM module present in TLE986xQX When NVM is busy executing internal operations e g cells programming or erasing data verify no other activities within NVM can be executed Although the NVM programming or erasing is handled by the NVM module the user code cannot be read or executed as the NVM module is busy For this reason interrupts can only be serviced when the NVM is free if the interrupt vector table or interrupt service routines are located in the
110. nt by the host no further serial communication is necessary The microcontroller will exit the UART BSL mode set the vector table in NVM at the address 11000000 and jump to the address pointed by the NVM location 110000044 Note Jump to NVM will only occur when either 1 NVM is not protected and NVM content at 11000004 is not FFy or 2 when NVM is protected In all other cases firmware will put the device in sleep mode 5 2 2 6 Mode 4 NVM Erase Mode 4 is used to erase different areas of the NVM It supports mass erase of all the NVM sectors individual erase of the sectors for linear area or for non linear area and single page erase This is determined by the Option Byte This mode is not accessible if the NVM protection is enabled Different options supported are Option 00 NVM page erase Option 40 NVM sector erase Option CO NVM Mass erase User Manual 60 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL The header block for NVM page erase with Option 004 Mode Data 5 bytes 00 044 Header Mode 4 StartAddr StartAddr StartAddr StartAddr Option Checksum Block 4 3 2 1 700 1 byte MSB LSB 1 byte Mode Data Description Start Addr High Low 32 bit Start Address which determines which NVM page to be erased Address should be page aligned Option Set to 00 for page erase When the Option Byte 00
111. nt to host This will indicate that NVM is protected and no programming and erasing are allowed In this error case the UART BSL routine will wait for the next header block from the host again Table 5 2 gives a summary of the response codes to be sent back to the host by the microcontroller after it receives a transfer block User Manual 47 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Table 5 2 Type of response codes Communication status Response code to the host Acknowledge Success 554 Block Type Error FFy Checksum Error FEy Protection Error FDy Combined Offset Error OFBy only valid for Mode 0 option FO COMBOFFSETFAULT ID Offset Error OFA only valid for Mode 0 option F0 IDOFFSETFAULT In Page Offset Error OF9 only valid for Mode 0 option FO INPAGEOFFSETFAULT Table 5 3 shows a tabulated summary of the possible responses the device may transmit following the reception of a header data or EOT block Table 5 3 Possible responses for various block types Mode Header block Data block EOT block 0 Acknowledge Block Type Acknowledge Block Acknowledge Block Error Checksum Error Type Error Checksum Type Error Protection Error Error Checksum Error Combined ID InPage offset error 1 Acknowledge Block Type Error Checksum Error 2 Acknowledge Block Type Acknowledge Block Acknowledge Block Error Checksum Error
112. o the generic error code the UART BSL Mode 0 option F0 may return BLOCKFAULT indication FF in case of wrong config sector page selection INPAGEOFFSETFAULT indication F94 in case at least one byte has an offset gt 7E has a not in page offset or is targeting the page counter refer to Table 6 12 In this case the program for the valid Bytes is still performed IDOFFSETFAULT indication FAy in case at least one byte is targeting the Customer ID reserved region when programming 100TP page 1 In this case the program for the valid Bytes is still performed COMBOFFSETFAULT indication FBy in case at least one byte is targeting the Customer ID reserved region when programming 100TP page 1 and at least 1 Byte has a not in page offset or is targeting the page counter In this case the program for the valid Bytes is still performed 5 2 2 3 Mode 1 Code Execution inside RAM Mode 1 is used to execute a user program in the RAM of the microcontroller at the address pointed by the RAM location 18000404 The header block for this working mode has the following structure The header block Mode Data 5 bytes 00 014 Header Mode 1 Not Used gros Block Mode Data Description Not used The five Bytes are not used and will be ignored in mode 1 In working mode 1 the header block is the only transfer block to be sent by the host no further serial communication is necessary The microc
113. ock for NVM page read Option C0 Mode Data 5 bytes 00 0A i Checksum Header Mode A baud ee Not Used Not Used 1 byte Block 19 Ow 1 byte 1 byte 1 byte 1 byte 1 byte Mode Data Description Start Addr High Low Address of the NVM page to be read Address should be page aligned Not Used These Bytes are not used and will be ignored for Option Option set to CO to enable NVM page read Note The start address provided with the header block has to be shifted by 7 bits to the left and then added to the NVM start address to build the actual address i e it is calculated as follows in Mode A Option C0 Actual address 11000000 StartAddrHigh 15 StartAddrLow 7 User Manual 66 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL This option will trigger a read of the addressed NVM page Microcontroller will return an Acknowledge 554 followed by the 128 NVM page data Bytes starting from the least significant Byte of the page The input address should always be aligned with a page In case it is not aligned the address will be internally changed to point to the beginning of the addressed page so that the page Bytes are always returned ordered from the least to the most significant Byte In case the provided address is not a valid NVM address the microcontroller will return a Block Type Error
114. ode Sectors Linearly mapped NVM sectors and on the NVM Data Sectors Not linearly mapped NVM sectors These routines control the protection status updating the value of the lower nibble of the NVM PROT STS register The status of the register will be anyhow restored according User Manual 102 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM to the NVM PASSWORD stored in the Configuration Sector at next reset Please refer to User Manual for NVM PROT STS bits description Note Each routine requires a password 16 bit that shall be provided as an input to the user routine call The BootROM code will compare this password with the one stored into the configuration sector 100TP page 1 offset for the routines addressing the linearly mapped region protection and offset OE for the routines addressing the non linearly mapped region protection Only in case the password read out of the 100TP page 1 matches the password provided as input the requested protection status change is performed refer to Table 6 11 Table 6 31 NVM Code sectors linearly mapped NVM sectors write protection enable subroutine Subroutine 000039254 USER CFLASH WR PROT EN Prototype bool USER CFLASH WR PROT EN unsigned short CFLASH PW Input CFLASH PW unsigned short Password to be compared to the one stored in the 100TP page 1 offset Output Returned value bool Pass or Fail 0 Operation completed successfully 1
115. ontroller will exit the UART BSL mode set the vector table in RAM at address 18000400 and branch to the address pointed by the standard reset handler 18000404 5 2 24 Mode2 Code Data download to NVM Mode 2 is used to transfer a user program from the host to the NVM of the microcontroller via serial interface This mode is not accessible if NVM protection is installed The header block for this working mode has the following structure User Manual 55 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL The header block Mode Data 5 bytes 00 02 Header Mode 2 StartAddr StartAddr StartAddr StartAddr Block Checksum Block 4 3 2 1 Length 1 byte MSB LSB 1 byte Mode Data Description Start Addr 4 3 2 and 1 32 bit Start Address which determines where to copy the received program codes in the NVM This address must be aligned to the page address Block Length The length of the following data blocks or EOT block If data blocks are to be sent the block length has to be 130 128 2 Bytes If only EOT block is sent the block length has to be 131 128 3 Bytes Other block length values than 130 data block or 131 EOT block are not allowed Note If the data starts in a non page address PC host must fill up the beginning vacancies with 00 and provide the start address of that page For e g if data starts in 11000F82 the PC host
116. ost will decide the number of transfer blocks and their respective lengths during one serial communication process For safety purpose the last Byte of each transfer block is a simple checksum of the Block Type and data area The host generates the checksum by XOR ing all the Bytes of the Block Type and data area Every time the UART BSL routine receives a transfer block it recalculates the checksum of the received Bytes Block Type and data area and compares it with the attached checksum Note If there is less than one page to be programmed to NVM the PC host will have to fill up the vacancies with 00 and transfer data in the length of 128 Bytes 5 2 1 2 Transfer block type There are three types of transfer blocks depending on the value of the Block Type Table 5 1 provides the general information on these block types More details will be described in the corresponding sections later User Manual 46 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Table 5 1 Type of transfer block Block Name Block Type Description Header block 00 This block has a fixed length of 8 Bytes Special information is contained in the data area of the block which is used to select different working modes Data block 014 This block length depends on the special information given in the previous header block This block is used in working mode 0 and 2 to transfer a portion of program code The program
117. ot Used 1 byte Block 1 byte 4 bytes Mode Data Description User password This Byte is given by user to enable or disable NVM protection mode Not used The four Bytes are not used and will be ignored in mode 6 In mode 6 the header block is the only transfer block to be sent by the host If device is unprotected the provided user password will be set as NVM PASSWORD and internally stored No further commands will be accepted until a power up or hardware reset Afterwards protection mode will be enabled However if the NVM is already protected the microcontroller will deactivate the Protection and erase the NVM if the user password Byte matches the stored NVM PASSWORD Byte If MSB of the NVM PASSWORD is 0 only NVM Linearly mapped sectors are erased If the Bit is 1 both NVM Linearly and Non linearly mapped regions are erased No further commands will be accepted until a power up or hardware reset Afterwards protection mode will be disabled In case NVM is protected and the given user password does not match the stored NVM PASSWORD no actions will be triggered and a Protection Error Byte will be returned instead of Acknowledge Note 1 Password value has to be different from 00 and In case on an unprotected device User password is set to either 004 or FF the protection will not be set and a protection error will be returned User Manual 31 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM L
118. own below Data Area NAD Block Checksum 1 byte i Mode Mode Data 1 byte Header Block 1 byte 5 bytes Description NAD Node Address for Diagnostic See Section 4 4 1 Block Type 004 The Block Type which marks the block as a header block Mode The mode to be selected The implemented modes are covered in Section 4 2 Mode Data Five Bytes of special information to activate corresponding mode Checksum The programming or LIN checksum of the header block Note Mode 8 and mode 9 support LIN checksum while mode 0 4 6 and A support Programming checksum 4 4 4 2 Mode 0 2 and 8 Code Data download to RAM NVM Mode 0 2 and 8 are used to transfer a user program from host to microcontroller Mode and 8 allow RAM transfers while mode 2 allows NVM transfers These modes are disabled in case NVM is protected by proper password and a protection error is returned User Manual 25 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode The header block has the following structure The header block Mode Data 5 bytes 00 00 02 08 NAD Start Start Start No of Data Checksum 1 byte Header Mode 0 2 Addr Addr Blocks Past 1 Block 8 3 2 1 Used byte MSB LSB 1 byte yt Mode Data Description Start Addr High Low 24 bit Start Address which determines where to copy the received p
119. programmed page in Data NVM Region Typical task for RAM user code Perform important user task Refresh watchdog window c 8 E 9 a Poll LIN status agsijprogram RET to BootROM preparation Note CA1 is a fixed label at Internal page program RAM address 18000400 H NVM FSM started for programming RAM Branching User code pP RR Call to RAM lt Br chi Yt a es E p es routine CA1 Save the used resource e g push registers on stack Y User code execution 4 1 Y Call USER NVMRDY Yes Restore used resources ready gt Yes Y MapRAM update Old page NVM FSM started for Call to RAM routine CA1 enabled Save the used resource e g push registers on stack Y User code execution 4 1 Y Call USER NVMRDY No No NVM Ready Yes v Restore used resources Figure 6 7 Background NVM programming operation with jumps to RAM code example for non linearly mapped sector User Manual 116 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM 6 4 3 Emergency operation handling Note Emergency operation provides the possibility to exit an on going NVM operation in a faster way skipping some internal time
120. r shall check whether the system is running on the low precision clock or on the PLL output reading the SYSCONO register 3 1 5 Analog module trimming In this routine the trimming values of voltage regulators LIN module temperature sensor bridge driver and other analog modules are read from the configuration sector and written into the respective SFR For user mode or Debug Support mode checksum on 100TP page is evaluated In case of error default values are used Refer to Table 6 11 for a list of user parameters in 100TP page 3 1 6 User configuration data initialization The firmware provides a routine to download data stored in user accessible configuration sector pages 100TP during the startup flow In particular the routine copies a specified number of Bytes from a selected CS page starting always from first Byte in the page into the RAM starting at a given address The routine is by default disabled and can be enabled and controlled by proper programming of the Bytes stored in first 100TP page as described in the Table 6 11 This routine is not performed after a software or watchdog reset Relevant routine control parameters stored in the first 100TP page are CS USER CAL STARTUP EN offset 79 When set to C3 it enables the user data download from a 100TP page into the RAM during startup flow All other values will be ignored and the routine will not be executed at startup CS USER CAL XADDH offset 7Ay It defines t
121. rogram codes in the RAM NVM No of data blocks used Total number of data blocks to be sent maximum 255 for mode 0 and 8 and maximum 21 15 for mode 2 Consistency between number of data blocks declared in the header block and data blocks actually received is verified when EOT block is received If numbers do not match microcontroller will send a Block Type Error PC host will then have to re send the whole series of blocks header data and EOT blocks Fast_Prog Indication Byte to enter Fast LIN BSL 01 Enter Fast LIN BSL Other values Ignored Fast LIN BSL is not entered Note The programming of NVM in mode 2 will be started after 128 Bytes or EOT are received All Bytes sent during the program operation will be lost The start address provided with the header block has to be considered as a 24 bit offset to be added to the standard RAM 18000000 NVM 11000000 base address For mode 0 and 8 the most significant Byte of the start address is ignored When this Command frame header block is used for entering Fast LIN BSL no other Master Request Header and Command frames for data block or EOT block should be sent Instead the microcontroller expects a Slave Response Header frame and sends a Response frame to Acknowledge receiving correct header block to enter Fast LIN BSL where UART BSL protocol is used See Section 4 6 On successful receipt of the header block the microcontroller enters mode 0 2 8
122. s the old values are still present in the sector and user can decide by means of a specific input parameter of the user programming routine refer to Table 6 16 whether the old values or the new failing values should be physically kept in the sector When an erase or write procedure is interrupted by a power down this is identified during the reconstruction of the MapRAM content after the next reset In this case the service algorithm routine is automatically started and repairs the NVM state exploiting the fact that either the old or the new data or both are fully valid 6 4 4 3 NVM user erase operation The user can execute the following sequence illustrated in Figure 6 10 for NVM user erase User Manual 120 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Start User calls USER ERASEPG Routine Com Figure 6 10 NVM user erase 6 4 44 NVM user programming abort operation The user can execute the following sequence illustrated in Figure 6 11 for NVM user programming abort C Start D v User calls USER OPENAB Routine Vv Load the assembly buffer wv User calls USER ABORTPROG Routine Figure 6 11 NVM user abort program 6 4 5 NVM protection mechanism User can use BSL mode 6 of LIN FAST LIN or UART to control the NVM protection by providing or deleting a dedicated password please refer to Section
123. s started the BootROM jumps to execute a user defined code in the RAM Within this code the user checks periodically for critical events 3 During the checking an emergency event occurs The code has to set MEMSTAT EMPROP and give back control to BootROM 4 With control returned to the BootROM the NVM routines will be executed bypassing the corrective activities This ensures that the routines are completed in the shortest time possible 5 Exiting the NVM routines the user code checks the MEMSTAT EMPROP Since it is set the code can branch to execute a user defined emergency sequence and clear the Bits MEMSTAT NVMPROP and MEMSTAT EMPROP These activities can include the programming of the critical data 6 4 3 3 Emergency operation handling timing In this chapter some information about overall emergency operation worst case timing is provided Table 6 43 describes the case in which user data has to be saved into the linear sector due to an emergency event Flow for programming the critical information in the not lin early mapped region of the NVM is similar step 6 and 7 are inverted and a few us have to be added for MapRAM update and overall worst case time is the same Table 6 43 Emergency operation handling in Type 1 routines Phase Description 1 User code enables interrupt and sets MEMSTAT NVMPROP before calling NVM Program Erase routines 2 While the NVM operation is on going an event occurs trig
124. ser Manual 5 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM Introduction Table 1 1 Abbreviations and Terms PLL Phase Locked Loop SA Service Algorithm SCU System Control Unit SWD Serial Wire Debug VTOR Vector Table Offset Register WDT WatchDog Timer User Manual Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Overview 2 Overview This specification includes the description of all firmware features including the operations and tasks defined to support the general startup behaviour and various boot options 2 1 Firmware architecture TLE986xQX on chip BootROM consists of the startup procedure the bootstrap loader via LIN the bootstrap loader via UART NVM user routines and NVM integrity handling routines The BootROM in TLE986xQX is located at 00000000 and so represents the standard reset handler routine The startup procedure includes the EVR calibration MapRAM initialisation on chip oscillator configurations NVM protection enabling and branching to the different modes The deciding factor will be on the latched values of TMS P0 0 and PO 2 upon a reset During reset these signals are latched at the rising edge of RESET pin and the latched values are used to define which operation mode has to be entered There are generally 2 operation modes in the BootROM User BSL mode Debug Support mode For user mode it will execute the startup procedure set t
125. sing required setting e g Opened Assembly Buffer nested call execution Note No NVM prog or erase routine can be called until this NVM operation is completed 6 3 10 Read 100 Time Programmable parameter data routine This routine reads the 100TP page content For the 100TP page 1 the data offset range is listed in Table 6 11 Details in the following table User Manual 96 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM Table 6 24 Read 100 Time Programmable subroutine Subroutine 000038754 USER READ 100TP Prototype bool USER READ 100TP char 100TP Page Sel unsigned char DataOffset int HundredTPData Input 100TP_Page_Sel char 100TP page selection Byte CS_Byte refer to Figure 6 2 DataOffset unsigned char Data Offset in page 00 to 7Fp Output Returned value bool Pass or Fail 0 Read is successful 1 Read is not successful due to invalid range selected HundredTPData integer pointer Pointer to the RAM location where 100TP Data is saved Reserved 100TP page 1 100TP page 2 100TP page 3 CS Byte CS Byte High nibble Low nibble 100 TP Page Reserved 100TP page 4 selection selection 100TP page 5 100TP page 6 100TP page 7 100TP page 8 Reserved Figure 6 2 User configuration sector pages address Byte description 6 3 11 Program 100 Time Programmable routine This routine programs data into the 100TP pages The 100TP content to be progr
126. sponse frame is only applicable for mode A The response frame depends on the option Byte value used Option Byte 004 User Manual 37 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode ACK NAD p ID CHIP ID 2 CHIP ID 1 CHIP ID 0 Not Used Checksum 1 byte ibytes bytes 1 bytes 1bytes 2bytes 1 byte H Refer to Chapter 6 2 1 for Chip ID definition Option Byte 104 184 50 ACK Error Calculated Calculated esl Response indicator CHKS High CHKS Low ge iore y 554 1 bytes 1 bytes 1 bytes y y Error indicator 004 the calculated checksum and the expected one provided as an input in the header frame are equal 804 the calculated checksum and the expected one provided as an input in the header frame differ 4 6 Fast LIN BSL Fast LIN BSL is an enhanced feature in TLE986xQX device supporting higher baud rates up to 57 6 kBaud or 115 2 kBaud To support this faster baudrate once entered to Fast LIN BSL the protocol used will be the same as UART BSL refer to Chapter 5 for transfer protocol This mode is especially useful during back end programming where faster programming time is desirable The Fast LIN BSL is not meant to be used for in car communication since it is not protected against noise on the LIN line 4 6 1 Entering Fast LIN BSL User can enter Fast LIN BSL using an invalid NAC using a dedicated NAC value refer to
127. st page from offset 104 to 634 are automatically copied into the dedicated SFR registers after every power on reset brown out reset or wake up reset from sleep mode thus replacing the registers default reset values The user can check them by reading the dedicated SFRs or by reading directly the content of the page The first 4 Bytes of the first 100TP page are used to store a device ID that can be read by the user The content of these 4 bytes are preloaded prior to shipment and cannot be modified by the user In case the user tries to write these values via the 100TP page writing features offered in BSL or via NVM user routine an error is reported and the original content of the bytes is preserved The Customer ID definition is described in Figure 6 1 The data stored in this first 100 time programmable page can be found in Table 6 11 To read data stored in the 100TP pages refer to Section 6 3 10 To perform the programming of these pages the user is required to preload the contents to be programmed into the RAM as listed in Table 6 12 The offset entered for the programming does not need to be in sequential order Once a page has been programmed 100 times no further programming on that page is allowed In the last Byte of each 100TP page a program counter is stored not changeable by user For further information regarding 100TP page program refer to Section 6 3 11 User Manual 77 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootR
128. t Password to be compared to the one stored the 100TP page 1 offset Output Returned value bool Pass or Fail 0 Operation completed successfully 1 Operation failed Password does not match This routine sets the bit NVM PROT STS 3 to 1 User Manual 104 Rev 1 3 2015 07 10 Cinfineon Table 6 35 TLE986xQX BE BootROM NVM NVM Data sectors not linearly mapped NVM sectors write protection enable subroutine Subroutine 000039054 USER DFLASH WR PROT EN Prototype bool USER DFLASH WR PROT EN unsigned short DFLASH PW Input DFLASH PW unsigned short Password to be compared to the one stored in the 100TP page 1 offset OE Output Returned value bool Pass or Fail 0 Operation completed successfully 1 Operation failed Password does not match This routine sets the bit NVM PROT STS 0 to 0 Table 6 36 NVM Data sectors not linearly mapped NVM sectors write protection disable subroutine Subroutine 000038FD USER DFLASH WR PROT DIS Prototype bool USER DFLASH WR PROT DliS unsigned short DFLASH PW Input DFLASH PW unsigned short Password to be compared to the one stored in the 100TP page 1 offset OE Output Returned value bool Pass or Fail 0 Operation completed successfully 1 Operation failed Password does not match This routine sets the bit NVM_PROT_STS 0 to 1 User Manual 105 Rev 1 3 2015 07 10
129. t Slave Response Header Master Request Header gt la Response Block Acknowledge Header Block Mode 1 3 4 6 9 A Master Request Header gt pune Data Block gt Slave Response Header belay Response Block Acknowledge l i Master Request Header gt Data Block Mode 1 3 4 6 9 A gt i i Delayt i Master Request Header Delay is implemented to ensure that sufficient time is provided for the microcontroller to execute the operations EOT Block gt Delay1 is approximately 500 us 1 ms max Delay2 is approximately 500 us 1 ms max for mode 0 and 8 while it is approximately 8 Delay ms 15 ms max for mode 2 NVM programming time Slave Response Heade r Delay3 is approximately 500 us 1 ms max for mode 1 3 and 9 and it is max 50 ms for x 9 Mode4 6andA Response Block Acknowledge The number of Data Blocks to be sent is indicated at No of Data Blocks field in the Header Block Mode 0 2 8 All blocks follow LIN BSL Protocol 9 bytes of data including a NAD and a checksum Figure 4 3 Communication structure of the LIN BSL modes 4 3 Phase 1 Automatic synchronization to the host Upon entry to LIN mode a connection is established The transfer speed baud rate of the device is automatically synchronized to the serial communication partner host in the following steps STEP 1 Initialize LIN interface for reception and timer 2 for baud rate measurement STEP 2 Wait for
130. tartup and Service Algorithm timing 3 Faulty pages and 1 Double Mapping MAPRAM Startup INIT SA phase 1 Mapping Faulty page 1 Erase Faulty page 2 Erase Faulty page 3 Erase Double Mapping Page Erase 4 5 ms 4 5 ms 4 5 ms 4 5 ms 0 3 ms check 0 1 ms Figure 6 6 Service Algorithm Timing examples Due to the duration of the first WDT1 open window after reset long open window the maximum number of pages that can be repaired in one Service Algorithm execution is 13 The result of the Service Algorithm repair phase is reported in the MEMSTAT register At the end of the startup procedure user shall evaluate the content of this register to properly handle fails and clear the register before performing any NVM operation The value is only available after reset before any NVM operation Program Erase OpenAB is started The corresponding NVM address to the Sector Information read is listed in Table 6 3 Service Algorithm and NVM Protection In case the Service Algorithm detects mapping issues it tries to repair mapping by erasing the wrong pages either faulty or double mapped pages Consequently the repair step can modify the NVM Data sector content To avoid data loss the SA checks the NVM data sector protection and proceeds towards the repair step only if the protection is not enabled In case protection is enabled instead the repair actions are not performed and a warning is provided to the user by writi
131. the delay period the following actions occur 1 the remaining delay is ignored 2 it will not enter user mode anymore 3 it will process the LIN UART frame accordingly Table 3 2 BSL interface selection NAC 7 NAC 6 Selected BSL interface 0 0 LIN BSL 0 1 FAST LIN BSL 1 X UART BSL Note LIN BSL will no longer be supported in future revisions of this product All the LIN BSL features will be supported by FastLIN BSL but with higher baudrate For each derivative the NAC value is stored together with the NAD value in the last 4 Bytes of the linearly mapped NVM region To ensure the parameter validity the 2 parameters actual values and their inverted values are checked In case the stored value and inverted value are not consistent value inverted value 1 not equal to 0 User Manual 15 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM Startup procedure the parameter is considered to be invalid and the default value is used The BSL window will be open indefinitely and FastLIN is selected as BSL interface The Table 3 3 shows the addresses for all the available family devices In the table NSA stands for NVM Starting Address whose value is 11000000 for all derivatives and NLS stands for NVM Linear Size in Bytes whose value is derivative dependent Table 3 3 NAC and NAD parameters details Address User Defined Criteria Range Default Value NSA NLS 4 NAC 01 OC for L
132. the whole RAM branching Note The USER NVM ECC CHECK routine performs a read of the entire NVM code region and of all the non erased mapped pages of the Data region All logical pages of the Data NVM region not yet programmed and consequently not mapped are not checked since there is no link to a physical address In case the user needs to completely check the NVM Data region a program of all the logical pages of the sector has to be performed before calling the USER NVM ECC CHECK The second routine USER ECC CHECK provides a way to check whether during code execution any ECC error occurred With its return value the routine indicates if a single or a double bit error ECC error flag was set since last power off incl Sleep Mode of the device last call of this routine or since last call of a user routine for NVM operation whatever happened last This routine is meant to be used over device life time to monitor the occurrence of ECC errors In addition in case of EEC2 error the routine will provide as an output the address of the last ECC2 error occurred The address is reported as an output in the RAM location passed as a pointer The returned value always provides the starting address of the 8 Byte section where the ECC error happened User Manual 101 Rev 1 3 2015 07 10 Cinfineon TLE986xQX BE BootROM NVM Table 6 30 ECC check subroutine Subroutine 0000383D USER ECC CHECK Prototype char USER ECC
133. this mode performs an erase of the NVM page specified by the provided address The header block for NVM sector erase with Option 404 Mode Data 5 bytes 00 04 StartAddr StartAddr StartAddr StartAddr Option Checksum Block 4 3 2 1 404 1 byte MSB LSB 1 byte Mode Data Description Start Addr High Low 32 bit Start Address which determines which NVM sector to be erased Address should be sector aligned Option Set to 404 for sector erase When the Option Byte 40 this mode performs an erase of the NVM sector specified by the provided address The time taken to erase a sector is max 4 5 ms The header block for NVM mass erase with Option C0 Mode Data 5 bytes 00 04 Header Mode 4 Not Used Option Checksum Block 0 1 byte 4 bytes 1 byte Mode Data Description Not used The four Bytes are not used and will be ignored in option User Manual 61 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Option Set to CO for mass erase When the Option Byte CO this mode performs a mass erase of all the NVM sectors The time taken will be max 4 5 ms number of sectors as the erase operation is done sequentially Note 1 In mode 4 a Block Type Error will be sent if an invalid option Byte is received Once password is set no access to mo
134. uest Header data blocks Delay after each data block required Send Master Request Header Send EOT block Last Codelength 0 Delay Send Slave Response Header Check for Acknowledge 33 blocks 6 Bytes 2 Bytes 200 Bytes User Manual 28 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM LIN BSL mode 4443 Mode 1 9 Code execution inside RAM NVM Mode 1 3 and 9 are used to trigger execution of a user program by the microcontroller Mode 1 and 9 set the vector table in the RAM at the address 18000400 and trigger execution of user program branching at address pointed by the standard reset handler 18000404 Mode 3 sets the vector table in the NVM at the address 11000000 and triggers execution of user program branching at address pointed by the standard reset handler 11000004 The header block for this working mode has the following structure The header block NAD 004 01 03 09 Mode Data Checksum 1 byte Header Block Mode 1 3 9 Not Used 5 bytes 1 byte Mode Data Description Not used The five Bytes are not used and will be ignored in mode 1 3 9 For modes 1 3 and 9 the header block is the only transfer block to be sent by the host followed by a Slave Response Header The microcontroller will send a response block Acknowledgement code 55 exit the LIN BSL and jump to the RAM at the address pointed by 18000404 mod
135. ulates the actual baud rate sets the PRE and BR VALUE values and activates baud rate generator When the synchronization is done the microcontroller sends back the Acknowledge Byte 55 to the host If the synchronization fails the baud rates for the microcontroller and the host are different and the Acknowledge code from the microcontroller cannot be received properly by the host In this case on the host side the host software may give a message to the user e g asking the user to repeat the synchronization procedure On the microcontroller side the UART BSL routine cannot judge whether the synchronization is correct or not It always enters phase Il after sending the Acknowledge Byte Therefore if synchronization fails a reset of the microcontroller has to be invoked to restart it for a new synchronization attempt 5 1 2 Calculation of BR VALUE and PRE values For the baud rate synchronization of the microcontroller to the fixed baud rate of the host the UART BSL routine waits for a test Byte 804 which has to be sent by the host By polling the receive port of the serial interface P1 DATA 4 RxD Pin the Timer 2 is started on the reception of the start Bit 0 and stopped on the reception of the last Bit of the test Byte 1 Hence the time recorded is the receiving time of 8 Bits 1 start Bit plus 7 least significant Bits of the test Byte The resulting timer value is 16 bit T2 This value is used to calculate the 11 bit auto reloa
136. w examples of how to program one or several NVM pages using working mode 2 User Manual 57 Rev 1 3 2015 07 10 e Infineon Tiana EE BRON FastLIN BSL Mode UART BSL Host TLE98xx Mode Data 5 bytes 00 02 Header Mode 2 116 00 00 80 83 Checksum Block StartAddr 4 StartAddr 3 StartAddr 2 StartAddr 1 Block Length 1 byte Wait for Ack Max waiting time 250 us 55u Ack 024 804 EOT Last Block CodelEngth Program Code Checksum 128 bytes 1 byte Wait for Ack Max waiting time 10 ms 554 Ack Figure 5 1 Single NVM Page program via working mode 2 User Manual 58 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM FastLIN BSL Mode UART BSL Programming second third and fourth page of the first Linear sector NVM addresses 11000080 to 1100017F Host TLE98xx o0 Header Block 024 Mode 2 Mode Data 5 bytes 1145 82 Checksum Startaddr 4 StanAdar 3 Startaddr 2 StartAddr 1 Block Length 4 byte Wait for Ack Max waiting time 250 us 55 Ack Oln Data Block Program Codes for second page of first sector Checksum Block Length 2 bytes 128 Bytes 1 byte
137. ware will put the device in sleep mode 3 1 8 1 NAC definition The NAC value defines the time window after reset release in which the firmware is able to receive BSL connection messages The bits 3 to 0 define the duration of the time window while the bits 6 and 7 of the NAC define which BSL interface is selected Bit 5 and 4 are not used If no BSL messages are received on the selected BSL interface during the NAC window and NAC time has expired the firmware code proceeds to user mode After ending the start up procedure the program will detect any activities on the LIN UART for a period of time determined by NAC amp 1 5 ms reduced by the time already spent to perform the start up procedure When nothing is detected on the LIN UART and NAC amp 3Fy 14 5 ms is passed from reset going high the microcontroller will jump to user mode If NAC is 14 414 814 or C1 the BSL window is closed no BSL connection is possible and the user mode is entered without delay The maximum NAC value is restricted to Cy as the first open WDT1 window is worst case 65 ms In case a valid BSL command is detected during the BSL window the firmware suspends the counting of the WDT1 in order to avoid that requested BSL communication is broken by a WDT1 reset The firmware will then re enable the WDT1 before jumping to user code If NAC is not valid BootROM code will switch off the WDT1 and wait for a Fast LIN frame infinitely Table 3
138. ysical addresses thus preventing proper usage of this sector In this case the firmware provides a specific algorithm Service Algorithm to identify and solve these errors In particular the Service Algorithm tries to repair bad pages created unintentionally into the NVM Data region due to for example a NVM program or erase operation interrupted by any reset or power loss tearing events The Service Algorithm is triggered during the startup by the NVM data sector initialization in case mapping issues are found The Service Algorithm provides proper analysis features to try to preserve the integrity of the NVM Data region in case ongoing NVM operation program or erase is unintentionally and unexpectedly aborted e g due to power loss Anyhow it is not meant to cover all possible scenarios that can be created by an interrupted NVM operation The user shall put in place proper action to avoid any possible interruption of NVM operation e g using proper capacitor on the power supply The NVM data sector initialization and Service Algorithm flows are described below NVM Data sector initialization Upon power on reset brown out reset pin reset WDT1 reset or wake up from sleep reset as part of the start up the firmware triggers a NVM initialization of the NVM data User Manual 107 Rev 1 3 2015 07 10 Infineon TLE986xQX BE BootROM NVM sector This initialization is performed by a hardware state machine which takes care to r

TLE986xQX BE

Contents

Download Pdf Manuals

Related Search

Related Contents