Slau 320
Slau 320
User's Guide
List of Figures
1-1. Spy-Bi-Wire Basic Concept ................................................................................................ 7
1-2. Timing Example for IR_SHIFT (0x83) Instruction....................................................................... 8
1-3. Data Register I/O: DR_SHIFT16 (0x158B) (TDO Output Is 0x55AA) ................................................ 9
1-4. Address Register I/O: DR_SHIFT20 (0x12568) (TDO Output Is 0xA55AA) ........................................ 9
1-5. SetTCLK .................................................................................................................... 10
1-6. ClrTCLK ..................................................................................................................... 10
1-7. Timing Diagram (Alternative Timing) .................................................................................... 11
1-8. SBW-to-JTAG Interface Diagram........................................................................................ 11
1-9. Detailed SBW Timing Diagram .......................................................................................... 12
1-10. Synchronization of TDI/TCLK During Run-Test/Idle .................................................................. 13
1-11. JTAG Access Entry Sequences (for Devices Supporting SBW) .................................................... 21
1-12. Fuse Check and TAP Controller Reset ................................................................................. 22
1-13. JTAG Entry Sequence for 430Xv2 Devices ............................................................................ 29
1-14. Accessing Flash Memory ................................................................................................. 39
1-15. Flash Access Code Binary Image Map ................................................................................. 40
1-16. Fuse Blow Timing ......................................................................................................... 47
2-1. Replicator Application Schematic ....................................................................................... 62
3-1. TAP Controller State Machine ........................................................................................... 65
List of Tables
1-1. Standard 4-Wire JTAG Signals ........................................................................................... 6
1-2. JTAG Signal Implementation Overview .................................................................................. 7
1-3. JTAG Communication Macros ............................................................................................ 8
1-4. Memory Access Instructions ............................................................................................. 14
1-5. JTAG Control Signal Register for 1xx/2xx/4xx Families .............................................................. 16
1-6. JTAG Control Signal Register for 5xx Family .......................................................................... 18
1-7. Shared JTAG Device Pin Functions .................................................................................... 20
1-8. Erase/Program Minimum TCLK Clock Cycles ......................................................................... 36
1-9. Flash Memory Parameters (fFTG = 450 kHz)............................................................................ 43
1-10. MSP430 Device JTAG Interface (Shared Pins) ....................................................................... 45
1-11. MSP430 Device Dedicated JTAG Interface............................................................................ 45
1-12. JTAG Features Across Device Families ............................................................................... 53
1-13. MSP430x5xx, CC430 JTAG Features ................................................................................. 54
This document describes the functions that are required to erase, program, and verify the memory module
of the MSP430 flash-based microcontroller family using the JTAG communication port. In addition, it
describes how to program the JTAG access security fuse that is available on all MSP430 devices. Device
access using standard 4-wire JTAG and 2-wire JTAG [also referred to as Spy-Bi-Wire (SBW)] is
discussed.
In addition, an example programmer system, which includes software (source code is provided) and the
corresponding hardware, is described in Chapter 2. This example is intended as a reference to aid in
understanding of the concepts presented in this report and to aid in development of similar MSP430
programmer solutions. In that sense, it is not meant to be a fully featured programming tool but, instead, it
is intended as a construction manual for those. Those users who are looking for a ready-to-use tool should
see Texas Instruments complete programming tool solution called MSP430 In-System Gang Programmer.
1.1 Introduction
This document provides an overview of how to program the flash memory module of an MSP430
flash-based device using the on-chip JTAG interface [4-wire or 2-wire Spy-Bi-Wire (SBW) interfaces]. A
focus is maintained on the high-level JTAG functions used to access and program the flash memory and
the respective timing.
Four main elements are presented:
Section 1.2, Interface and Instructions, describes the required JTAG signals and associated pin
functionality for programming the MSP430 family. In addition, this section includes the descriptions of
the provided software macro routines and JTAG instructions used to communicate with and control a
target MSP430 via the JTAG interface.
Section 1.3, Memory Programming Control Sequences, demonstrates use of the provided macros and
function prototypes in a software-flow format that are used to control a target MSP430 device and
program and/or erase the flash memory.
Section 1.4, Programming the JTAG Access Protection Fuse, details the fuse mechanism used to
disable memory access via JTAG to the target device’s memory, eliminating the possibility of
undesired memory access for security purposes.
Chapter 2 illustrates development of an example MSP430 flash programmer using an MSP430F149 as
the host controller and includes a schematic and required software/project files. A thorough description
of how to use the given implementation is also included, providing an example system that can be
referenced for custom MSP430 programmer solutions.
NOTE: The MSP430 JTAG interface implements the test access port state machine (TAP
controller) as specified by IEEE Std 1149.1. References to the TAP controller and specific
JTAG states identified in the 1149.1 standard are made throughout this document. The TAP
state machine is shown in Figure 3-1. Section 3.2 also lists various specialities of the
MSP430 JTAG implementation which are non-compliant with IEEE Std 1149.1.
The TEST input exists only on MSP430 devices with shared JTAG function, usually assigned to port 1. To
enable these pins for JTAG communication, a logic level 1 must be applied to the TEST pin. For normal
operation (non-JTAG mode), this pin is internally pulled down to ground, enabling the shared pins as
standard port I/O.
The TCLK signal is an input clock, which must be provided to the target device from an external source.
This clock is used internally as the target device’s system clock, MCLK, to load data into memory locations
and to clock the CPU. There is no dedicated pin for TCLK; instead, the TDI pin is used as the TCLK input.
This occurs while the MSP430 TAP controller is in the Run-Test/Idle state.
NOTE: TCLK input support on the MSP430 XOUT pin exists but has been superseded by the TDI
pin on all current MSP430 flash-based devices. Existing FET tools, as well as the software
provided with this document, implement TCLK on the TDI input pin.
SBWTDIO
Spy-Bi-Wire
RAM/Flash Memory
Logic
SBWTCK
TDO
TMS
TCK
TDI
Core Logic
JTAG and
TAP Controller Emulation Logic
The 2-wire interface is made up of the SBWTCK (Spy-Bi-Wire test clock) and SBWTDIO (Spy-Bi-Wire test
data input/output) pins. The SBWTCK signal is the clock signal and is a dedicated pin. In normal
operation, this pin is internally pulled to ground. The SBWTDIO signal represents the data and is a
bidirectional connection. To reduce the overhead of the 2-wire interface, the SBWTDIO line is shared with
the RST/NMI pin of the MSP430.
Table 1-2 gives a general overview of MSP430 devices and their respective JTAG interface
implementation.
TCK
TMS
TDI
TDO
TCLK
Save TDI value (= TCLK) Instruction Input via TDI Restore saved TDI value
bits wide.) The data word is shifted, most significant bit (MSB) first, into the target MSP430’s TDI input.
Each bit is captured from TDI on a rising edge of TCK. At the same time, TDO shifts out the last
captured/stored value in the addressed data register. A new bit is present at TDO with a falling edge of
TCK. TCLK should not change state while this macro is executing. Figure 1-3 shows how to load a 16-bit
word into the JTAG DR and read out a stored value via TDO.
Data to TDI MSB LSB
0 0 0 1 0 1 0 1 1 0 0 0 1 0 1 1
TCK
TMS
TDI
TDO
TCLK
Figure 1-3. Data Register I/O: DR_SHIFT16 (0x158B) (TDO Output Is 0x55AA)
NOTE: The DR_SHIFT20 (20-bit Address) macro in the associated C-code software example
application automatically reconstructs the swapped TDO (15:0) (19:16) output to a
continuous 20-bit address word (19:0) and simply returns a 32-bit LONG value.
Figure 1-4 shows how to load a 20-bit address word into the JTAG address register and read out a stored
value via TDO.
Data to TDI MSB LSB
0 0 0 1 0 0 1 0 0 1 0 1 0 1 1 0 1 0 0 0
TCK
TMS
TDI
TDO
TCLK
Figure 1-4. Address Register I/O: DR_SHIFT20 (0x12568) (TDO Output Is 0xA55AA)
1.2.2.1.5 SetTCLK
This macro sets the TCLK input clock (provided on the TDI signal input) high. TCK and TMS must hold
their last value while this macro is performed (see Section 1.2.3.3 and Figure 1-10 for SBW-specific
constraints).
SetTCLK
TCK
TMS
TDO
TCLK
1.2.2.1.6 ClrTCLK
This macro resets the TCLK input clock low. TCK and TMS must hold their last value while this action is
performed (see Section 1.2.3.3 and Figure 1-10 for SBW-specific constraints).
ClrTCLK
TCK
TMS
TDO
TCLK
SBWTCK
The implemented logic used to translate between the 2-wire and 4-wire interfaces is shown in Figure 1-8.
Reset
SET
SBWTDIO D Q TMS
In TMS Slot EN
SBWTCK
SET
D Q TDI/TCLK
JTAG TAP in
Run Test/Idle
In TDI Slot D Q
TCK
G
CLR
TDO
In TDO Slot
After power up, as long as the SBW interface is not activated yet, TMS and TDI are set to logic 1 level
internally.
NOTE: The low phase of the clock signal supplied on SBWTCK must not be longer than 7 µs, else
SBW logic is deactivated and must be activated again according to Section 1.3.1.
When using the provided source code example, make sure that interrupts are disabled
during the SBWTCK low phase to ensure accurate timings.
SBWTCK
0 1 2 0 1 2
SHIFT_COUNT 0 1 2 0 1 2
LOAD_JTAG_REG
JTAG_REG
TCLK
TCK
JTAG TAP
TAP STATEn 1 TAP STATEn
STATE
SBWTCK
(external signal)
Case 1:
SBWTDIO
TMS = 1
(external signal)
Case 1a:
TDI/TCLK Latched at 1
(internal signal) during previous
TDI slot
Case 2:
SBWTDIO
TMS = 0
(external signal)
Case 2b:
TDI/TCLK Latched at 1
(internal signal) during previous
TDI Slot
NOTE: Do not write any unlisted values to the JTAG instruction register. Instruction values written
to the MSP430 JTAG register other than those listed above may cause undesired device
behavior.
NOTE: When a new JTAG instruction is shifted into the JTAG instruction register, it takes effect
with the UPDATE-IR state of the TAP controller. When accessing a JTAG data register, the
last value written is captured with the CAPTURE-DR state, and the new value shifted in
becomes valid with the UPDATE-DR state. In other words, there is no need to go through
Run-Test/Idle state of the JTAG TAP controller to shift in instructions or data. Be aware of
the fact that clocking TCLK is only possible in the Run-Test/Idle state. This is why the
provided software example application exclusively makes use of the JTAG macros described
in Section 1.2.2, which always go through Run-Test/Idle state.
1.2.4.1.1 IR_ADDR_16BIT
This instruction enables setting of the MAB to a specific value, which is shifted in with the next JTAG
16-bit data access using the DR_SHIFT16 (16-bit Data) macro or the next JTAG 20-bit address word
access using the DR_SHIFT (20-bit Address) macro. The MSP430 CPU’s MAB is set to the value written
to the JTAG MAB register. The previous value stored in the JTAG MAB register is simultaneously shifted
out on TDO while the new 16- or 20-bit address is shifted in via TDI.
NOTE: In MSP430X devices, a 16-bit shift to update the JTAG MAB register does not
automatically reset the upper four bits (19:16) of the JTAG MAB register. Always use the
20-bit shift macro to ensure that the upper four bits (19:16) are set to a defined value.
1.2.4.1.2 IR_ADDR_CAPTURE
This instruction enables readout of the data on the MAB with the next 16- or 20-bit data access. The MAB
value is not changed during the 16- or 20-bit data access; that is, the 16- or 20-bit data sent on TDI with
this command is ignored (0 is sent as a default in the provided software).
1.2.4.2.1 IR_DATA_TO_ADDR
This instruction enables setting of the MSP430 MDB to a specific value shifted in with the next JTAG
16-bit data access using the DR_SHIFT16 (16-bit Data) macro. The MSP430 CPU’s MDB is set to the
value written to the JTAG MDB register. As the new value is written into the MDB register, the prior value
in the MSP430 MDB is captured and shifted out on TDO. The MSP430 MAB is set by the value in the
JTAG MAB register during execution of the IR_DATA_TO_ADDR instruction. This instruction is used to
write to all memory locations of the MSP430.
1.2.4.2.2 IR_DATA_16BIT
This instruction enables setting of the MSP430 MDB to the specified 16-bit value shifted in with the next
16-bit JTAG data access. The complete MSP430 MDB is set to the value of the JTAG MDB register. At
the same time, the last value of the MSP430 MDB is captured and shifted out on TDO. In this situation,
the MAB is still controlled by the CPU. The program counter (PC) of the target CPU sets the MAB value.
1.2.4.2.3 IR_DATA_QUICK
This instruction enables setting of the MSP430 MDB to a specific value shifted in with the next 16-bit
JTAG data access. The 16-bit MSP430 MDB is set to the value written to the JTAG MDB register. During
the 16-bit data transfer, the previous MDB value is captured and shifted out on TDO. The MAB value is
set by the program counter (PC) of the CPU. This instruction auto-increments the program counter by two
on every falling edge of TCLK to automatically point to the next 16-bit memory location. The target CPU’s
program counter must be loaded with the starting memory address prior to execution of this instruction,
which can be used to quickly read or write to a memory array. (See Section 3.2 for more information on
setting the PC.)
1.2.4.2.4 IR_BYPASS
This instruction delivers the input to TDI as an output on TDO delayed by one TCK clock. When this
instruction is loaded, the IR_CNTRL_SIG_RELEASE instruction, which is defined in the following section,
is performed simultaneously. After execution of the bypass instruction, the 16-bit data shifted out on TDI
does not affect any register of the target MSP430’s JTAG control module.
Table 1-5. JTAG Control Signal Register for 1xx/2xx/4xx Families (continued)
Bit No. Name Description
Controls the power-on-reset (POR) signal
11 POR 1 = Perform POR
0 = No reset
Selects control source of the RW and BYTE bits
12 Release low byte 1 = CPU has control
0 = Control signal register has control
Sets flash module into JTAG access mode
13 TAGFUNCSAT 1 = CPU has control (default)
0 = JTAG has control
Enables TDO output as TDI input
14 SWITCH 1 = JTAG has control
0 = Normal operation
15 (N/A) Always write 0
1.2.4.3.1 IR_CNTRL_SIG_16BIT
This instruction enables setting of the complete JTAG control signal register with the next 16-bit JTAG
data access. Simultaneously, the last value stored in the register is shifted out on TDO. The new value
takes effect when the TAP controller enters the UPDATE-DR state.
1.2.4.3.2 IR_CNTRL_SIG_CAPTURE
This instruction enables readout of the JTAG control signal register with the next JTAG 16-bit data access
instruction.
1.2.4.3.3 IR_CNTRL_SIG_RELEASE
This instruction completely releases the CPU from JTAG control. Once executed, the JTAG control signal
register and other JTAG data registers no longer have any effect on the target MSP430 CPU. This
instruction is normally used to release the CPU from JTAG control.
1.2.4.4.1 IR_DATA_PSA
The IR_DATA_PSA instruction switches the JTAG_DATA_REG into the PSA mode. In this mode, the
program counter of the MSP430 is incremented by every two system clocks provided on TCLK. The CPU
program counter must be loaded with the start address prior to execution of this instruction. The number of
TCLK clocks determines how many memory locations are included in the PSA calculation.
1.2.4.4.2 IR_SHIFT_OUT_PSA
The IR_SHIFT_OUT_PSA instruction should be used in conjunction with the IR_DATA_PSA instruction.
This instruction shifts out the PSA pattern generated by the IR_DATA_PSA command. During the
SHIFT-DR state of the TAP controller, the content of the JTAG_DATA_REG is shifted out via the TDO pin.
While this JTAG instruction is executed, the capture and update functions of the JTAG_DATA_REG are
disabled.
1.2.4.5.1 IR_PREPARE_BLOW
This instruction sets the MSP430 into program-fuse mode.
1.2.4.5.2 IR_EX_BLOW
This instruction programs (blows) the access-protection fuse. To execute properly, it must be loaded after
the IR_PREPARE_BLOW instruction is given.
1.3.1 Start-Up
Before the main flash programming routine can begin, the target device must be initialized for
programming. This section describes how to perform the initialization sequence.
TEST/SBWTCK
Enter 4-Wire
BSL Entry JTAG Mode
disabled.
Figure 1-11. JTAG Access Entry Sequences (for Devices Supporting SBW)
NOTE: On some Spy-Bi-Wire capable MSP430 devices the TEST/SBWTCK is very sensitive to
rising signal edges which could cause the test logic to enter a state where according entry
sequences (either 2-wire or 4-wire) are not recognized correctly and JTAG access stays
disabled. Unintentional edges on the SBWTCK most probably occur when the JTAG
connector gets connected to the target device. There are two possibilities to work around this
problem and ensure a stable JTAG access initialization:
• SBWTCK needs to be actively driven low before powering up the device or during the
connector plug in action to avoid unintentional rising signal edges.
• Run the according initialization sequence multiple times (two to three repeats are
typically sufficient to establish a stable connection).
1.3.1.2 Fuse Check and Reset of the JTAG State Machine (TAP Controller)
Reference functions: ResetTAP, ResetTAP_sbw
Each MSP430 family device includes a physical fuse used to permanently disable memory access via
JTAG communication. When this fuse is programmed (or blown), access to memory via JTAG is
permanently disabled and cannot be restored. When initializing JTAG access after power up, a fuse check
must be done before JTAG access is granted. Toggling of the TMS signal twice performs the check.
While the fuse is tested, a current of up to 2 mA flows into the TDI input (or into the TEST pin on devices
without dedicated JTAG pins). To enable settling of the current, the low phase of the two TMS pulses
should last a minimum of 5 µs.
Under certain circumstances (e.g., plugging in a battery), a toggling of TMS may accidentally occur while
TDI is logical low. In that case, no current flows through the security fuse, but the internal logic remembers
that a fuse check was performed. Thus, the fuse is mistakenly recognized as programmed (e.g., blown).
To avoid the issue, newer MSP430 JTAG implementations also reset the internal fuse-check logic on
performing a reset of the TAP controller. Thus, it is recommended to first perform a reset of the TAP and
then check the JTAG fuse status as shown in Figure 1-12. To perform a reset of the TAP controller it is
recommended that a minimum of six TCK clocks be sent to the target device while TMS is high followed
by setting TMS low for at least one TCK clock. This sets the JTAG state machine (TAP controller) to a
defined starting point: the Run-Test/Idle state. This procedure can also be used at any time during JTAG
communication to reset the JTAG port.
JTAG State-Machine Reset JTAG Fuse
SetTCLK
Run-Test/Idle Checked
TCK
TMS
TDI
TDO
TCLK
Following the same sequence in SBW mode has the side effect of changing the TAP controller state while
the fuse check is performed. As described in Section 1.2.3.1, the internal signal TCK is generated
automatically in every TDI_SLOT. Performing a fuse check in SBW mode, starting directly after a reset of
the TAP controller, ends in its Exit2-DR state. Two more dummy TCKs must be generated to return to
Run-Test/Idle state; one TCK with SBWTDIO being high during the TMS_SLOT followed by one TCK with
SBWTDIO being low during the TMS_SLOT (reference function: ResetTAP_sbw).
NOTE: A dedicated fuse check sequence (toggling TMS twice) is not required for the MSP430F5xx
family. Those families implement a software mechanism rather than a hardware fuse (which
needs to be checked or burned) to enable JTAG security protection.
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2401)
IR_SHIFT("IR_CNTRL_SIG_CAPTURE")
DR_SHIFT16(0x0000)
No
Bit 9 of TDOword = 1?
Yes
CPU is under JTAG control
IR_SHIFT("IR_CNTRL_SIG_CAPTURE")
DR_SHIFT16(0x0000) = Readout data
Bit 7 of TDOvalue = 0?
ClrTCLK
SetTCLK
CPU is in the instruction-fetch state
HaltCPU ClrTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2409) : set HALT_JTAG bit
SetTCLK
Now the CPU is in a controlled state and is not altered during memory accesses.
Note: Do not reset the HALT_JTAG bit (= 0) while accessing the target memory.
Memory Access Performed Here
The CPU is switched back to normal operation using ReleaseCPU.
ClrTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
ReleaseC
DR_SHIFT16(0x2401) : Clear HALT_JTAG bit
PU
IR_SHIFT("IR_ADDR_CAPTURE")
SetTCLK
The CPU is now in the instruction-fetch state and ready to receive a new JTAG instruction. If the PC has
been changed while the memory was being accessed, the PC must be loaded with the correct address.
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2C01) : Apply Reset
DR_SHIFT16(0x2401) : Remove Reset
ClrTCLK
SetTCLK
ClrTCLK
SetTCLK
ClrTCLK
IR_SHIFT("IR_ADDR_CAPTURE")
SetTCLK
The target CPU is now reset; the PC points to the start address of the user program, which is the address
pointed to by the data stored in the reset vector memory location 0xFFFEh and all registers are set to
their respective power-up values.
The target device’s watchdog timer must now be disabled to avoid an undesired reset of the target.
IR_SHIFT("IR_DATA_16BIT")
DR_SHIFT16(0x3FFF) : "JMP $" instruction to keep CPU from changing the state
ClrTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2409) : set HALT_JTAG bit
SetTCLK
ClrTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT") : Disable Watchdog
DR_SHIFT16(0x2408) : Set to Write
IR_SHIFT("IR_ADDR_16BIT")
DR_SHIFT16(0x0120) : Set Watchdog Control Register Address
IR_SHIFT("IR_DATA_TO_ADDR")
DR_SHIFT16(0x5A80) : Write to Watchdog Control Register
SetTCLK
The target CPU is now released for the next operation.
ClrTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2401) : Set to Read
IR_SHIFT("IR_ADDR_CAPTURE")
SetTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2C01) : Apply Reset
DR_SHIFT16(0x2401) : Remove Reset
IR_SHIFT("IR_CNTRL_SIG_RELEASE")
The target CPU starts program execution with the address stored at location 0x0FFFE (reset vector).
NOTE: It is not recommended to release the device from JTAG control (or perform a power-up
cycle) during an erase-program-verify memory access cycle. Releasing the device from
JTAG control starts execution of the previously programmed user code, which might change
the flash memory content. In that case, verification of the memory content against the
originally programmed code image would fail.
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x1501)
IR_SHIFT("IR_CNTRL_SIG_CAPTURE")
DR_SHIFT16(0x0000)
No
Bit 9 of TDOword = 1?
Yes
CPU is under JTAG control - always apply Power on Reset (POR) afterwards.
ClrTCLK
SetTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x0C01) : clear CPUSUSP signal and apply POR
DR_SHIFT16(0x0401) : clear POR signal
ClrTCLK Repeat 5
SetTCLK times
Start sequence
Stop JTAG
release JTAG & TEST
signals
Connect JTAG
drive JTAG & TEST signals
NO Valid JTAG-ID
Start JTAG-Mailbox
returned
exchange
YES
When JTAG-Mailbox is
ready for input request feed
in 0xA55A (magic pattern)
Start JTAG
Apply again 4WIRE or
SBW entry Sequence.
NO
Set error
End sequence
NOTE: It is not recommended to release the device from JTAG control (or perform a power-up
cycle) during an erase-program-verify memory access cycle. Releasing the device from
JTAG control starts execution of the previously programmed user code, which might change
the flash memory content. In that case, verification of the memory content against the
originally programmed code image would fail.
IR_SHIFT("IR_ADDR_16BIT")
DR_SHIFT20("Address") : Set desired address
IR_SHIFT("IR_DATA_TO_ADDR")
Yes
DR_SHIFT16("Data") : Send 16-bit Data
SetTCLK
Write again?
No
ReleaseCPU should now be executed, returning the CPU to normal operation.
• MSP430Xv2 architecture, Reference function: WriteMem_430Xv2
NOTE: For the MSP430F5xx family quick memory access must be used with care as the PC
already points to one address ahead of the actual address to be read. This could easily lead
to security access violations especially at the end of a physical memory block.
1.3.3.3.2 Flow for Quick Write (RAM and Peripheral Memory Only)
• Both MSP430 and MSP430X architecture, Reference function: WriteMemQuick
NOTE: Quick memory write access is not supported for the MSP430F5xx family.
1.3.4 Programming the Flash Memory (Using the Onboard Flash Controller)
The following JTAG communication flow shows programming of the MSP430 flash memory using the
onboard flash controller. In this implementation, 16-bit words are programmed into the main flash memory
area. To program bytes, the BYTE bit in the JTAG CNTRL_SIG register must be set high while in
programming mode. StartAddr is the starting address of the flash memory array to be programmed.
End of sequence
0 Offset to code
...
n
n+2
...
Code
...
n+m
n+m+2 jmp $
1.3.5 Erasing the Flash Memory (Using the Onboard Flash Controller)
(1)
Replace with DR_SHIFT20("Address") when programming an MSP430X architecture device.
(2)
Substitute 0xA540 for '2xx devices for Info-Segment A programming.
IR_SHIFT("IR_ADDR_16BIT")
(1) (3)
DR_SHIFT16(“EraseAddr”) : Set Address for Erase
IR_SHIFT("IR_DATA_TO_ADDR")
: Write Dummy Data for Erase
DR_SHIFT16(0x55AA)
Start
SetTCLK
ClrTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2409) : Set RW to Read
SetTCLK (4)
Repeat 4819 times
ClrTCLK
IR_SHIFT("IR_CNTRL_SIG_16BIT")
DR_SHIFT16(0x2408) : Set RW to Write
IR_SHIFT("IR_ADDR_16BIT")
(5)
DR_SHIFT16(0x0128) : Point to FCTL1 Address
IR_SHIFT("IR_DATA_TO_ADDR")
DR_SHIFT16(0xA500) : Disable FLASH Erase
SetTCLK
ClrTCLK
IR_SHIFT("IR_ADDR_16BIT")
(5)
DR_SHIFT16(0x012C) : Point to FCTL3 Address
IR_SHIFT("IR_DATA_TO_ADDR")
(6)
DR_SHIFT16(0xA500) : Disable FLASH Write Access
SetTCLK
ReleaseCPU should now be executed, returning the CPU to normal operation.
(3)
The EraseAddr parameter is the address pointing to the flash memory segment to be erased.
(4)
Correct timing required. Must meet min/max TCLK frequency requirement of 350 kHz ±100 kHz.
(5)
Replace with DR_SHIFT20("Address") when programming an MSP430X architecture device.
(6)
Substitute 0xA540 for '2xx devices for Info-Segment A programming.
1.3.5.1.2 Flow to Erase the Entire Flash Address Space (Mass Erase)
Beside the TCLK signal at a frequency of 350 kHz ± 100 kHz (used for the Flash Timing Generator, data
sheet parameter fFTG), two more data sheet parameters must be taken into account when using the
described method to perform a mass or main memory erase. The first is tCMErase (cumulative mass erase
time) and the second is tMass Erase (mass erase time). Two different specification combinations of these
parameters are currently implemented in dedicated MSP430 devices. Table 1-9 shows an overview of the
parameters (assuming a maximum TCLK frequency of 450 KHz).
For implementation 1, to assure the recommended 200-ms erase time to safely erase the flash memory
space, 5300 TCLK cycles are transmitted to the target MSP430 device and repeated 19 times. With
implementation 2, the following sequence needs to be performed only once.
NOTE: MSP430F2xx devices have four information memory segments of 64 bytes each. Segment
INFOA (see the MSP430F2xx Family User’s Guide for more information) is a lockable flash
information segment and contains important calibration data for the MSP430F2xx clock
system (DCO) unique to the given device programmed at production test. The remaining
three information memory segments (INFOB, INFOC, and INFOD) cannot be erased by a
mass erase operation as long as INFOA is locked. INFOB, INFOC, and INFOD can be
erased segment by segment, independent of the lock setting for INFOA. Unlocking INOFA
allows performing the mass erase operation.
(1)
Correct timing required. Must meet min/max TCLK frequency requirement of 350 kHz ± 100 kHz.
(2)
Replace with DR_SHIFT20(“Address”) when programming an MSP430X architecture device.
The flash memory can be read using the normal memory read flow given earlier for non-flash memory
addresses. The quick access method can also be used to read flash memory.
1.4.1 Burning the JTAG Fuse - Function Reference for 1xx/2xx/4xx Families
Two similar methods are described and implemented, depending on the target MSP430 device family.
All devices having a TEST pin use this input to apply the programming voltage, VPP. As previously
described, these devices have shared-function JTAG interface pins. The higher pin count MSP430
devices with dedicated JTAG interface pins use the TDI pin for fuse programming.
Devices with a TEST pin:
NOTE: The value of VPP required for fuse programming can be found in the corresponding target
device data sheet. For existing flash devices, the required voltage for VPP is 6.5 V ± 0.5 V.
1.4.1.1.1 Fuse-Programming Voltage Via TDI Pin (Dedicated JTAG Pin Devices Only)
When the fuse is being programmed, VPP is applied via the TDI input. Communication data that is normally
sent on TDI is sent via TDO during this mode. (Table 1-11 describes the dual functionality for the TDI and
TDO pins.) The settling time of the VPP source must be taken into account when generating the proper
timing to blow the fuse. The following flow details the fuse-programming sequence built into the BlowFuse
function.
IR_SHIFT(“IR_CNTRL_SIG_16BIT”)
DR_SHIFT_IN(0x7201) : Configure TDO as TDI
TDI signal releases to target, TDI is now provided on TDO.
IR_SHIFT(“IR_PREPARE_BLOW”) (through TDO pin)
MsDelay(1) : Delay for 1ms
Connect VPP to TDI pin
Wait until VPP input has settled (depends on VPP source)
IR_SHIFT(“IR_EX_BLOW”) : Sent to target via TDO
MsDelay(1) : Delay for 1ms
Remove VPP from TDI pin
Switch TDI pin back to TDI function and reset the JTAG state machine (ResetTAP)
IR_SHIFT(“IR_PREPARE_BLOW”)
MsDelay(1) : Delay for 1ms
Connect VPP to TEST pin
Wait until VPP input has settled (depends on VPP source)
IR_SHIFT(“IR_EX_BLOW”)
MsDelay(1) : Delay for 1ms
Remove VPP from TEST pin
Reset the JTAG state machine (ResetTAP)
SBWTCK
SBWTDIO
TDI Slot TDO Slot TMS Slot TDI Slot TDO Slot TMS Slot TDI Slot
TCK
Enable Blow
Execute Blow
1.4.2 Programming the JTAG Lock Key - Function Reference for 5xx Family
Reference function: ProgramLockKey
NOTE: For the MSP430F5xx family it is NOT required to apply a special high voltage to the
device's TEST pin.
Other than for the 1xx/2xx/4xx families, where special handling was required to burn the JTAG security
fuse, with the 5xx family the JTAG is locked by programming a certain signature into the devices’ flash
memory at dedicated addresses. The JTAG security lock key resides at the end of the bootstrap loader
(BSL) memory at addresses 0x17FC to 0x17FF. Anything other than 0 or 0xFFFFFFFF programmed to
these addresses locks the JTAG interface irreversibly. All of the 5xx MSP430 devices come with a
preprogrammed BSL (TI-BSL) code which by default protects itself from unintended erase and write
access. This is done by setting the SYSBSLPE bit in the according SYSBSLC register of the SYS module
(see MSP430F5xx Family User's Guide SYS Module chapter for details). As the JTAG security lock key
resides in the BSL memory address range, appropriate action must be taken to unprotect the memory
area before programming the protection key. This can be done by a regular memory write access as
described in Section 1.3.3.2 by writing directly to the SYSBSLC register address and setting the
SYSBSLPE to 0. Afterwards the BSL memory behaves like regular flash memory and a JTAG lock key
can be programmed at addresses 0x17FC to 0x17FF like described in Section 1.3.4.2. Note that a
Brownout Reset (BOR) is required to activate the JTAG security protection during boot. The BOR can be
issued like described in Section 1.3.2.2.3. If the hardware setup does not allow performing a power cycle
(e.g., the battery is already soldered to the PCB) a BOR can also be generated by JTAG by writing into a
dedicated JTAG test data register. Note that a BOR also resets the JTAG interface, which causes the
device to be released from JTAG control.
(1)
All devices in this table have JTAG ID 0x91.
(2)
All devices with JTAG ID 0x91 contain an MSP430Xv2 architecture
and s0x80upport both 4-wire JTAG and Spy-Bi-Wire.
(3)
See Section 1.11 Device Descriptor Table in the MSP430x5xx Family
User's Guide (SLAU208) for more details on identification information.
(continued)
Device ID @ Device ID @ Device ID @
Device
0x1A04 0x1A05 0x1A06
MSP430F5633 0x80 0x42
MSP430F5634 0x80 0x44
MSP430F5635 0x80 0x0E
MSP430F5636 0x80 0x10
MSP430F5637 0x80 0x12
MSP430F5638 0x80 0x14
MSP430F6630 0x80 0x46
MSP430F6631 0x80 0x48
MSP430F6632 0x80 0x4A
MSP430F6633 0x80 0x4C
MSP430F6634 0x80 0x4E
MSP430F6635 0x80 0x16
MSP430F6636 0x80 0x18
MSP430F6637 0x80 0x1A
MSP430F6638 0x80 0x1C
1.6 References
MSP430Fxxx device data sheets
MSP430x1xx Family User’s Guide, literature number SLAU049
MSP430x4xx Family User’s Guide, literature number SLAU056
MSP430x2xx Family User’s Guide, literature number SLAU144
IEEE Standard Test Access Port and Boundary-Scan Architecture, IEEE Std 1149.1
NOTE: The Replicator source files are provided in independent folders with the same names as
previously given. Within these folders, filenames are assigned accordingly when
applicable specifically to a certain device type. For example, the file JTAGfunc.c used in
the Replicator version, is renamed JTAGfuncSBW.c in the Replicator for SBW version
and JTAGfunc430X.c in the Replicator for MSP430X version.
• Maximum target device program code size: approximately 250 KB (due to the limited memory
resources of the MSP430F5437 host controller of 256 KB)
• Programming speed (Erase, Program, Verify): approximately 8 KB in 1.5 s, 48 KB in 8 s
• Fast verify and erase check: 17 KB/10 ms
• Support programming of the JTAG access fuse (permanently disables device memory access via
JTAG)
• Stand-alone target programming operation (no personal computer or additional supporting
hardware/software required)
Top level Specifies which programming functions (erase, program, verify, blow fuse) are to be executed.
Contains the main section, which can be modified to meet custom requirements. In
the main section of this program, the target device is erased, checked for
successful erasure, and programmed. Programming loads the provided example
code to the target device’s memory space. (The provided code file simply flashes
port pins P1.0 and/or P5.1, which drive the LEDs on the socket board provided with
the FET tools, available from Texas Instruments MSP430 Group. This is the
Replicator.c
compiled FETXXX_1.s43 example code file.) This file must be replaced by the
required user program and added to the project in order be compiled and loaded
into the host. To demonstrate the capabilities of the MSP430 JTAG interface,
additional code is included, which manipulates the I/O-ports and RAM of the target
device. These routines can be used to test the target device and PCB for
successful communication.
Contains the basic declarations of the program code of the target device. If a
C-header file should be implemented to program the target device instead of an
assembly file simply replace the content of Target_Code.h by the output of
Target_Code.h
srec_cat.exe and remove Target_Code.s43 (IAR) resp. Target_Code.asm (CCE)
from the project. The Target_Code.h file is generated by the srec_cat.exe file
directly or via the srec.bat file.
JTAG functions All MSP430-specific functions are defined here. These files should not be modified under any
circumstance.
JTAGfunc.c
JTAGfuncSBW.c
Contain the MSP430-specific functions needed for flash programming
JTAGfunc430X.c
JTAGfunc430Xv2.c
JTAGfunc.h
JTAGfuncSBW.h
Contain constant definitions and function prototypes used for JTAG communication
JTAGfunc430X.h
JTAGfunc430Xv2.h
Low-level functions All functions that depend specifically on the host controller (JTAG port I/O and timing functions) are located
here. These files need to be adapted if a host controller other than the MSP430F5437 is implemented.
LowLevelFunc.c
LowLevelFuncSBW.c Contain the basic host-specific functions
LowLevelFunc430X.c
LowLevelFunc.h
LowLevelFuncSBW.h Contain host-specific definitions and function prototypes
LowLevelFunc430X.h
Devices Describes features and differences between MSP430 devices with respect to FLASH programming.
Devices.c Functions to distinguish MSP430 devices concerning FLASH programming.
Devices.h Device function prototypes and definitions for FLASH programming.
As mentioned previously, the target device’s program code must be supplied separately. There are two
ways to include the provided example in the project space of the program to be sent to the host. Either
include a separate file (e.g., Target_Code.s43 (IAR) or Target_Code.asm (CCE)), which contains the
target code in assembly format, or replace the C-Array in the Target_Code.h header file. Both alternatives
must conform to the format expected by the slaa149 source code.
To build these files from the TI-txt format output from the compiler, a conversion program called
srec_cat.exe and a batch file, srec.bat, are provided. TI-txt format can be output by the IAR Linker by
setting the required compiler/linker options (see the IAR tool instruction guides for more information). This
can also be done in CCE using the hex430 command line executable. srec_cat.exe is a command line
application which expects parameters in the following format:
'srec_cat.exe Target_Code.txt -ti_txt -Output Target_Code.h -c_array -output_word -c_compressed'
or
'srec_cat.exe Target_Code.txt -ti_txt -Output Target_Code.s43 -asm -output_word -a430' (IAR)
resp.
'srec_cat.exe Target_Code.txt -ti_txt -Output Target_Code.asm -asm -output_word -cl430' (CCE)
Parameter description:
• srec_cat.exe : The name of the application
• Target_Code.txt -ti_txt : This is the input file by name and the format of it
• -Output : A keyword to make clear that following parameters describe the output file and format
• Target_Code.x -[c_array,asm] : This is the output file by name and the format that the input file should
be converted in. For this example only, C-header and assembly formats are allowed. Choose one
format for your purpose.
• -output_word : The parameter is necessary, because the source code expects words to write to the
target device. Otherwise, srec_cat.exe would write bytes.
• -c_compressed : This statement is additional to the c_array output. If specified, the output does not fill
any address gap with a 0xFF pattern, and does not increase the file size.
• The following statements are additional to the assembly output. Choose one to specify your format.
– -a430 : Writes an assembly file that is understood by the IAR Embedded Workbench in the
Replicator context.
– -cl430 : Writes an assembly file that is understood by TI CCE in the Replicator context.
The srec.bat file generates all three types of output files (.h, .asm, and .s43) simultaneously. The
command line format is: srec Target_Code.
NOTE: If the TI-txt source file includes odd segment addresses and/or an odd number of data
bytes, additional byte padding might be required to generate appropriate word-aligned output
format. Use srec_cat.exe with a "--fill 0xFF --within <input> --range-padding 2" filter to fix this
problem. The srec.bat automatically filters the output format for appropriate word alignment.
For example, 'srec_cat.exe Target_Code.txt -ti_txt --fill 0xFF --within Target_Code.txt -ti_txt
--range-padding 2 -Output Target_Code.h -c_array -output_word -c_compressed'
NOTE: If using assembly source code that contains the target code, make sure that the array
declarations are stored in target_code.h . An example can be seen in the included basic
header file.
NOTE: The provided conversion program is Open Source and has a much larger range of
functions. For more information and documentation see http://srecord.sourceforge.net/.
This software was tested to function correctly with version 1.36, but is not necessarily
compatible with future versions.
NOTE: To enable easy porting of the software to other microcontrollers, the provided source code
is written in ANSI-C. As always, it is recommended that the latest available version of the
applicable MSP430 development software be installed before beginning a new project.
NOTE: An MSP430 flash programmer system designed for a specific MSP430 target device or a
system not implementing fuse-blow functionality may require fewer relays or no relays at all.
The programmer system described herein was developed with the intention that it can be
used with any MSP430 flash-based device, across all families, including all memory access
functionality, as well as fuse-blow capability.
Power
Fuse Check
On
1 Test-Logic-Reset
0
1
0 Run-Test/IDLE Select DR-Scan Select IR-Scan
1
Capture-DR Capture-IR
Shift-DR Shift-IR
Exit1-DR Exit1-IR
Pause-DR Pause-IR
Exit2-DR Exit2-IR
Update-DR Update-IR
Products Applications
Amplifiers amplifier.ti.com Audio www.ti.com/audio
Data Converters dataconverter.ti.com Automotive www.ti.com/automotive
DLP® Products www.dlp.com Communications and www.ti.com/communications
Telecom
DSP dsp.ti.com Computers and www.ti.com/computers
Peripherals
Clocks and Timers www.ti.com/clocks Consumer Electronics www.ti.com/consumer-apps
Interface interface.ti.com Energy www.ti.com/energy
Logic logic.ti.com Industrial www.ti.com/industrial
Power Mgmt power.ti.com Medical www.ti.com/medical
Microcontrollers microcontroller.ti.com Security www.ti.com/security
RFID www.ti-rfid.com Space, Avionics & www.ti.com/space-avionics-defense
Defense
RF/IF and ZigBee® Solutions www.ti.com/lprf Video and Imaging www.ti.com/video
Wireless www.ti.com/wireless-apps
Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265
Copyright © 2010, Texas Instruments Incorporated