RL78 G23 Updating Firmware by Using UART Communication and Boot Swapping Rev.1.00
RL78 G23 Updating Firmware by Using UART Communication and Boot Swapping Rev.1.00
RL78/G23
Updating Firmware by Using UART Communication and Boot Swapping
Introduction
This application note describes how to update firmware in code flash memory by using an update program
that remains in the code flash memory.
In this method, the code flash memory is divided into two areas: the Execute area and the Temporary area.
Renesas Flash Driver RL78 Type01 is used to reprogram the flash memory and perform boot swapping.
Target Device
RL78/G23
When applying the sample program covered in this application note to another microcomputer, modify the
program according to the specifications for the target microcomputer and conduct an extensive evaluation of
the modified program.
1. Specifications ..........................................................................................................................4
1.1 Overview of Specifications ...................................................................................................................... 4
1.1.1 Overview of Renesas Flash Driver RL78 Type01 ................................................................................. 5
1.1.2 Code Flash Memory .............................................................................................................................. 6
1.1.3 Flash Memory Self-Programming.......................................................................................................... 8
1.1.4 Boot Swap Function .............................................................................................................................. 8
1.1.5 Updating the Firmware .......................................................................................................................... 9
1.1.6 Flash Shield Window ........................................................................................................................... 11
1.1.7 Obtaining Renesas Flash Driver RL78 Type01................................................................................... 11
1.2 Overview of Operation ........................................................................................................................... 12
1.2.1 Communication Specifications ............................................................................................................ 12
1.2.2 START Command ............................................................................................................................... 13
1.2.3 WRITE_BOOT1 Command ................................................................................................................. 13
1.2.4 WRITE_TEMP Command ................................................................................................................... 13
1.2.5 END Command ................................................................................................................................... 13
1.2.6 Checksum Calculation Method............................................................................................................ 13
1.2.7 Operation of the Sample Program....................................................................................................... 14
1.2.8 Copy Flag ............................................................................................................................................ 16
LED output port assign differ between the project for 128KB and the project for 768KB. In this application
note, in the case of using the project for 128 KB is explained as an example. When using the project for 768
KB, please read the port numbers as shown in the table below.
Table 1-4 Application operating state and indication on LED1 to LED8. (Updating sample project 1
to 2)
Application operating state Indication on LED1 to LED8 Operating firmware
Application before updated is LED1 blinks Sample project 1
running
START command received LED2 lights up
WRITE_BOOT1 command received LED3 lights up
WRITE_TEMP command received LED4 lights up
END command received LED5 lights up
Temporary area being copied LED6 lights up
Error termination Only LED7 lights up
Application after updated is running LED8 blinks Sample project 2
Table 1-5 Start and End Addresses of the Two Areas According to ROM Size
ROM size Execute area Temporary area
96KB 08000H to FFFFH 10000H to 17FFFH
128KB 08000H to 13FFFH 14000H to 1FFFFH
192KB 08000H to 1BFFFH 1C000H to 2FFFFH
256KB 08000H to 23FFFH 24000H to 3FFFFH
384KB 08000H to 33FFFH 34000H to 5FFFFH
512KB 08000H to 43FFFH 44000H to 7FFFFH
768KB 08000H to 63FFFH 64000H to BFFFFH
FFFFFH 1FFFFH
Special function registers (SFRs)
256 bytes
FFF00H
Program area
FFEFFH General-purpose registers
FFEE0H 32 bytes
FFEDFH
RAM
FBF00H 16 Kbytes 040CEH 07FFFH
FBEFFH 040CDH On-chip debug security
Mirror ID setting area
35.75 Kbytes 040C4H 10 bytes
F3000H
F2FFFH 040C3H Option bytes area
Data flash memory 040C0H 4 bytes Boot cluster 1
8 Kbytes 040BFH
F1000H CALLT table
F0FFFH 64 bytes
04080H
Reserved 0407FH
Data memory space
F0800H Vector table area
128 bytes
F07FFH Extended special function 04000H
registers (2nd SFRs) 03FFFH
F0000H 2 Kbytes
EFFFFH Program area
000CDH
000CEH On-chip debug security
ID setting area
Reserved 000C4H 10 bytes
Boot cluster 0
000C3H Option bytes area
000C0H 4 bytes
000BFH CALLT table
64 bytes
20000H 00080H
1FFFFH 0007FH
Code flash memory Vector table area
128 Kbytes 128 bytes
00000H 00000H
Caution: If you use the boot swap function, make sure that the same value that is set in the option byte area
in boot cluster 0 (000C0H to 000C3H) is also set in the option byte area in boot cluster 1 (010C0H to
010C3H) because these areas are swapped by the function.
0x1FFFF 0x1FFFF
0x8000
0x7FFF 0x14000
0x13FFF
Boot cluster 1
Boot cluster 0
0x0000 0x8000
The following table summarizes the features of the code flash memory of the RL78/G23 microcontroller.
Caution: The security functions that are available during flash memory self-programming are only protection
against reprogramming of the boot area and the flash shield window.
Erase
New Execute program Execute area
Execute area
Copy new execute program
08000H
Window area
(rewriteable)
07FFFH
workspace Description
r01an6255jj0100-
rl78g23-flash
\src
\RFD
\include
Place the downloaded Renesas Flash Driver
\source
RL78 Type01
\userown
You can obtain the Renesas Flash Driver RL78 Type01 from the following URL:
https://www.renesas.com/jp/ja/document/scd/renesas-flash-driver-rl78-type-01-rl78g23
(3) Use command communication to reprogram the data in boot cluster 1 and the program area, and then
perform boot swapping.
* If a reset occurs (due to a temporary blackout, for example) while data is being copied from the
Temporary area to the Execute area, the r_temp_copy function is called again. The r_RequestBootSwap
function is called after the copy is complete.
Caution: If the sample program receives the END command (05H) in steps (10) to (17), the sample program
copies data from the Temporary area to the Execute area unless there is an error. Then, the sample
program sends "01H" (normal), calls the r_RequestBootSwap function, and performs boot swapping. If
the sample program receives the END command (05H) while boot cluster 1 is being reprogrammed,
the sample program performs boot swapping before the reprogramming ends normally. In this case,
the sample program can no longer start after the boot area is swapped.
Caution: If flash memory self-programming does not end normally, the sample program only turns on LED6
and performs no subsequent processing.
Table 1-8 Location of the Copy Flag Section According to the ROM Size
ROM Size Execute Area Address of the Copy Flag Section
96KB 08000H to FFFFH FFFCH
128KB 08000H to 13FFFH 13FFCH
192KB 08000H to 1BFFFH 1BFFCH
256KB 08000H to 23FFFH 23FFCH
384KB 08000H to 33FFFH 33FFCH
512KB 08000H to 43FFFH 43FFCH
768KB 08000H to 63FFFH 63FFCH
VDD VDD
EVDD
VDD
RL78/G23 RESET
P03 LED1
P02 LED2
P43 LED3
P42 LED4
P76 LED8
Cautions: 1. The purpose of this circuit is only to provide the connection outline and the circuit is simplified
accordingly. When designing and implementing an actual circuit, provide proper pin treatment
and make sure that the hardware's electrical specifications are met (connect the input-only ports
separately to VDD or VSS via a resistor).
2. Connect any pins whose name begins with EVSS to VSS and any pins whose name begins with
EVDD to VDD, respectively.
3. VDD must be held at not lower than the reset release voltage (VLVD) that is specified as LVD.
Caution: In this application note, only the used pins are processed. When actually designing your circuit,
make sure the design includes sufficient pin processing and meets electrical characteristic
requirements.
4. Software Explanation
4.1 Setting of Option Byte
Table 4-1 shows the option byte settings.
The option bytes of the RL78/G23 comprise the user option bytes (000C0H to 000C2H) and on-chip debug
option byte (000C3H).
The option bytes are automatically referenced and the specified settings are configured at power-on time or
the reset is released. When using the boot swap function for self-programming, it is necessary to set the
same values that are set in 000C0H to 000C3H also in 040C0H to 040C3H because the bytes in 000C0H to
000C3H are swapped with the bytes in 040C0H to 040C3H.
;--------------------------------------------------
; setting the stack pointer
;--------------------------------------------------
$IF (__RENESAS_VERSION__ >= 0x01010000)
;MOVW SP,#LOWW(__STACK_ADDR_START) Comment out the line by prefixing a
semicolon (;).
;$ELSE ; for CC-RL V1.00 Comment out the line by prefixing a
semicolon (;).
MOVW SP,#LOWW(_stacktop)
$ENDIF
;--------------------------------------------------
; initializing stack area
;--------------------------------------------------
$IF (__RENESAS_VERSION__ >= 0x01010000)
;MOVW AX,#LOWW(__STACK_ADDR_END) Comment out the line by prefixing a
semicolon (;).
;$ELSE ; for CC-RL V1.00 Comment out the line by prefixing a
semicolon (;).
MOVW AX,#LOWW(_stackend)
$ENDIF
CALL !!_stkinit
To deploy the preceding sections in the RAM area, you must add the necessary processing to the cstart.asm
file.
In the cstart.asm file, locate the following lines, and then add the necessary processing after these lines:
;--------------------------------------------------
; ROM data copy
;--------------------------------------------------
r_rfd_initialize
Summary Initialization processing for RFD RL78 Type01
Header r_rfd_common_api.h, r_rfd_code_flash_api.h, r_cg_userdefine.h
Declaration R_RFD_FAR_FUNC e_ret_t r_rfd_initialize(void);
Explanation This function performs the processing to initialize RFD RL78 Type01.
Arguments None
ENUM_RET_STS_OK: Normal end
Return values ENUM_RET_ERR_CONFIGURATION: Clock configuration error
ENUM_RET_ERR_PARAMETER: Frequency setting error
r_cmd_start
Summary START command processing
Header r_rfd_common_api.h, r_cg_userdefine.h
Declaration R_RFD_FAR_FUNC e_ret_t r_cmd_start(void);
This function performs processing in response to reception of the START
Explanation
command.
Arguments None
ENUM_RET_STS_OK: Normal end
Return values ENUM_RET_ERR_MODE_MISMATCHED: Mode mismatch error
ENUM_RET_ERR_ERASE: Erase error
r_cmd_end
Summary END command processing
Header r_rfd_common_api.h, r_cg_userdefine.h
Declaration R_RFD_FAR_FUNC e_ret_t r_cmd_end(void);
Explanation This function performs processing in response to reception of the END command.
Arguments None
Return values ENUM_RET_ERR_MODE_MISMATCHED: Mode mismatch error
r_CF_RangeErase
Summary Range erase processing for the code flash memory
Header r_rfd_common_api.h, r_rfd_code_flash_api.h, r_cg_userdefine.h
R_RFD_FAR_FUNC e_ret_t r_CF_RangeErase(uint32_t start_addr, uint32_t
Declaration
end_addr);
This function erases data in the code flash memory.
Explanation Data is erased in blocks. The blocks in the range of addresses specified for
arguments will be erased.
uint32_t start_addr: Erase start address
Arguments
uint32_t end_addr: Erase end address
ENUM_RET_STS_OK: Normal end
Return values ENUM_RET_ERR_MODE_MISMATCHED: Mode mismatch error
ENUM_RET_ERR_ERASE: Erase error
r_CF_WriteVerifySequence
Summary Write-and-verify processing for the code flash memory
Header r_rfd_common_api.h, r_rfd_code_flash_api.h, r_cg_userdefine.h
R_RFD_FAR_FUNC e_ret_t r_CF_WriteVerifySequence(uint32_t
Declaration
write_start_addr, uint16_t write_data_length, uint8_t __near *write_data);
Explanation This function writes data to the code flash memory and verifies the written data.
uint32_t start_addr,: Write start address
Arguments uint16_t write_data_length: Size of the data to be written
uint8_t __near *write_data: Data to be written
ENUM_RET_STS_OK: Normal end
Return values ENUM_RET_ERR_MODE_MISMATCHED: Mode mismatch error
ENUM_RET_ERR_ERASE: Erase error
r_CF_WriteData
Summary Write processing for the code flash memory
Header r_rfd_common_api.h, r_rfd_code_flash_api.h, r_cg_userdefine.h
R_RFD_FAR_FUNC e_ret_t r_CF_WriteData(uint32_t start_addr, uint16_t
Declaration
write_data_length, uint8_t __near *write_data);
Explanation This function writes data to the code flash memory.
uint32_t start_addr,: Write start address
Arguments uint16_t write_data_length: Size of the data to be written
uint8_t __near *write_data: Data to be written
ENUM_RET_STS_OK: Normal end
Return values ENUM_RET_ERR_MODE_MISMATCHED: Mode mismatch error
ENUM_RET_ERR_WRITE: Write error
r_CheckCFDFSequencerEnd
Summary Sequence end processing for the code flash memory
Header r_rfd_common_api.h, r_cg_userdefine.h
Declaration R_RFD_FAR_FUNC e_ret_t r_CheckCFDFSequencerEnd(void);
Explanation This function confirms that the code flash memory sequence has terminated.
Arguments None
ENUM_RET_STS_OK: Normal end
ENUM_RET_ERR_CFDF_SEQUENCER: Code/data flash memory sequencer
error
Return values
ENUM_RET_ERR_ERASE: Erase error
ENUM_RET_ERR_WRITE: Write error
ENUM_RET_ERR_BLANKCHECK: Blank error
r_CheckExtraSequencerEnd
Summary Sequence end processing for the extra area
Header r_rfd_common_api.h, r_cg_userdefine.h
Declaration R_RFD_FAR_FUNC e_ret_t r_CheckExtraSequencerEnd (void);
Explanation This function confirms that the extra area sequence has terminated.
Arguments None
ENUM_RET_STS_OK: Normal end
ENUM_RET_ERR_EXTRA_SEQUENCER: Extra area sequencer error
Return values ENUM_RET_ERR_ERASE: Erase error
ENUM_RET_ERR_WRITE: Write error
ENUM_RET_ERR_BLANKCHECK: Blank error
r_Config_UART0_callback_sendend()
Summary Callback processing at a sending completion interrupt for UART0
Header r_cg_macrodriver.h
Declaration static void r_Config_UART0_callback_sendend(void);
This is a callback function that is called at a sending completion interrupt for
Explanation
UART0.
Arguments None
Return values None
r_Send_nByte
Summary Data sending processing by UART0
Header Config_UART0.h, Config_WDT.h
Declaration MD_STATUS r_Send_nByte(uint8_t *tx_buff, const uint16_t tx_num);
This function performs sending processing by UART0.
Explanation This function waits until sending of the number of characters specified for an
argument is completed.
uint8_t *rx_buff: Pointer to the send data storage buffer
Arguments
const uint16_t rx_num: Number of characters to be sent
MD_OK: Normal end (sending completed)
Return values
MD_ARGERROR: Parameter error
r_SendACK
Summary Normal response sending processing by UART0
Header Config_UART0.h, Config_WDT.h
Declaration MD_STATUS r_SendACK (void);
This function uses UART0 to perform sending processing for normal response
Explanation
(01H).
Arguments None
MD_OK: Normal end (sending completed)
Return values
MD_ARGERROR: Parameter error
r_CF_TempCopy
Summary Processing to copy data from the Temporary area
Header r_cg_userdefine.h, string.h
Declaration R_RFD_FAR_FUNC e_ret_t r_CF_TempCopy(void);
Explanation This function copies data from the Temporary area.
Arguments None
ENUM_RET_STS_OK: Normal end
Return values
r_AsyncRecvPacketData
Summary Processing to receive asynchronous command packets
Header r_cg_userdefine.h
Declaration __far uint8_t r_AsyncRecvPacketData(uint8_t *p_cmd_type, uint8_t rdata[]);
Explanation This function analyzes asynchronously received data and returns the status.
uint8_t *p_cmd_type: Command information
Arguments
uint8_t rdata[]: Receive data buffer
ENUM_PACKET_STATUS_OK: Normal end
Return values ENUM_PACKET_STATUS_ERROR: Packet reception error
ENUM_PACKET_STATUS_RECEIVING: Now receiving packets
r_GetUARTRecvSize
Summary Processing to obtain the size of the receive data
r_cg_userdefine.h
Header
Config_UART0.h
Declaration uint16_t r_GetUARTRecvSize(void);
Explanation This function returns the length of the received data.
Arguments None
Return values Size: Length of the received data
r_ClearUARTRecvBuff
Summary Processing to clear the receive buffer
r_cg_userdefine.h
Header
Config_UART0.h
Declaration void r_ClearUARTRecvBuff(void);
Explanation This function clears the buffer that stores received data.
Arguments None
Return values None
updateLoop
Summary Processing to receive and run the firmware update command
Header r_cg_userdefine.h
Declaration e_ret_t updateLoop(void);
Explanation This function receives and runs the firmware update command.
Arguments None
ENUM_RET_STS_OK: Normal end
ENUM_RET_ERR_CONFIGURATION: Clock configuration error
ENUM_RET_ERR_PARAMETER: Frequency setting error
Return values ENUM_PACKET_STATUS_ERROR: Packet reception error
ENUM_PACKET_STATUS_RECEIVING: Receiving packets
ENUM_RET_ERR_MODE_MISMATCHED: Mode mismatch error
ENUM_RET_ERR_ERASE: Erase error
errorLedOn
Summary Processing to turn on the error LED
Header r_cg_userdefine.h
Declaration void errorLedOn(void);
Explanation This function turns on LED7 and turns off the other LEDs if an error occurs.
Arguments None
Return values None
main
Enable Interrupts
IE = 1
EI()
NO
Is the value of copy flag normal?
YES
r_rfd_initialize()
RFD RL78 Type01 Initialization process
NO
Initialization completed successfully
YES
P41(LED6): lights up
r_cmd_end
END command processing
NO
Process completed successfully
YES
r_RequestBootSwap()
Request boot swap process
YES
Error process
errorLedOn()
:While(1) loop
Figure 4-3 Processing to receive and run the firmware update command (1/3)
updateLoop()
NO
Is RFD initialization flag False?
YES
r_rfd_initialize()
RFD RL78 Type01 Initialization process
YES
YES B
A B
NO
Is received packet correct?
YES
Clear receive buffer
r_ClearUARTRecvBuff
Received command
COMMAND_START
Writing mode
Operating mode
Normal mode
P02(LED2) : Lights up
COMMAND_WRITE_BOOT1
Normal mode
Operating mode
Writing mode
P43(LED3) : Lights up
YES
C D E
C D E
COMMAND_WRITE_TEMP
Normal mode
Operating mode
Writing mode
P42(LED2) : Lights up
COMMAND_END
Normal mode
Operating mode
Writing mode
P77(LED5) : Lights up
P41(LED6) : Lights up
return
r_rfd_initialize()
NO
Is HOCO running?
YES
NO
Is initialization finished?
YES
return
r_cmd_start()
Disable Interrupts
IE = 0
DI()
Enable interrupts
IE = 1
EI()
NO
Has erase processing
been successfully completed?
YES
Disable interrupts
IE = 0
DI()
Enable interrupts
IE = 1
EI()
NO
Has erase processing
been successfully completed?
YES
return
r_cmd_end()
Disable interrupts
IE = 0
DI()
Enable interrupts
IE = 1
EI()
return
Figure 4-9 Range erase processing for the code flash memory
r_CF_RangeErase(start_addr,end_addr)
NO
Has the specified range been erased?
YES
NO
Has erase processing
been successfully completed?
YES
return
Figure 4-10 Block erase processing for the code flash memory
r_CF_EraseBlock(start_addr)
NO
Changed to programming mode
NO
ret_value matches the value of error status
YES
Start erasing blocks
R_RFD_EraseCodeFlashReq(block_number)
NO
Has error check function
been successfully completed?
NO
Changed to normal mode
return
r_CF_WriteVerifySequence(write_start_addr,
write_data_length, *write_data)
Write Data
r_CF_WriteData(write_start_addr,
write_data_length, write_data)
return
r_CF_WriteData(start_addr, write_data_length,
write_data)
NO
Changed to programming mode
YES
NO
Start 4 bytes of writing processing
R_RFD_WriteCodeFlashReq(start_addr + count,
&write_data[count])
NO
Has 4 bytes ofwrite processing
been successfully completed?
YES
NO
Changed to normal mode
YES
Set error status in ret_value
return
NO
Increment address
return
Figure 4-14 Sequence end processing for the code flash memory (1/2)
r_CheckCFDFSequencerEnd()
VALUE_U08_MASK1_FSQ_STATUS_ERR_CFDF_SEQUENCER
Set ENUM_RET_ERR_CFDF_SEQUENCER
(0x10) to ret_value
VALUE_U08_MASK1_FSQ_STATUS_ERR_ERASE
Set ENUM_RET_ERR_ERASE
(0x12) to ret_value
VALUE_U08_MASK1_FSQ_STATUS_ERR_WRITE
Set ENUM_RET_ERR_WRITE
(0x13) to ret_value
VALUE_U08_MASK1_FSQ_STATUS_ERR_BLANKCHECK
ENUM_RET_ERR_BLANKCHECK
(0x14) to ret_value
Set ENUM_RET_STS_OK
(0x00) to ret_value
return
Figure 4-16 Sequence end processing for the extra area (1/2)
r_CheckExtraSequencerEnd
VALUE_U08_MASK1_FSQ_STATUS_ERR_EXTRA_SEQUENCER
Set ENUM_RET_ERR_EXTRA_SEQUENCER
(0x10) to ret_value
VALUE_U08_MASK1_FSQ_STATUS_ERR_ERASE
Set ENUM_RET_ERR_ERASE
(0x12) to ret_value
VALUE_U08_MASK1_FSQ_STATUS_ERR_WRITE
Set ENUM_RET_ERR_WRITE
(0x13) to ret_value
VALUE_U08_MASK1_FSQ_STATUS_ERR_BLANKCHECK
Set ENUM_RET_ERR_BLANKCHECK
(0x14) to ret_value
Set ENUM_RET_STS_OK
(0x00) to ret_value
return
r_RequestBootSwap()
Select 1 for next boot cluster Select 0 for next boot cluster
next_boot_cluster = R_RFD_ENUM_BOOT_CLUSTER_1 next_boot_cluster = R_RFD_ENUM_BOOT_CLUSTER_0
No
Changed to programming mode
NO
ret_value = 0x00
YES
No
Changed to normal mode
NO
ret_value = 0x00
YES
Invoke internal reset
R_RFD_ForceReset
return
r_Config_UART0_callback_sendend()
return
r_Send_nByte(*tx_buff, tx_num)
Transmit data
R_Config_UART0_Send(tx_buff, tx_num)
YES
return
r_SendACK()
Data sending
r_Send_nByte(&send_buff, 1)
return
r_CF_TempCopy(void)
NO
Write data
r_CF_WriteData(start_addr, write_data_length,
*write_data)
return
r_CF_MemoryWrite(*write_start_addr, write_end_addr,
*write_data)
Out of write_end_addr
destination address to write
Within write_end_addr
Disable interrupts
DI()
Enable interrupts
EI()
return
r_AsyncRecvPacketData(*p_cmd_type, rdata[])
NO
Number of data received is 5 or more
YES
NO
g_soft_overrun is not occurring
YES
NO
START code received
YES
Calculate packet length from received data
len = g_recv_data[1] << 8 || g_recv_data[2]
NO
Number of data received is len or more
YES
Obtain command data from received data
cmd_type = g_recv_data[3]
NO
Normal command data is received
YES
NO
Matches checksum data received
YES
NO
Received WRITE command
YES
Copy received data to buffer
MemCpy(rdata, &g_recv_data[4], 256)
return
r_getUARTRecvSize(void)
Disable interrupts
DI()
Enable interrupts
EI()
return
r_ClearUARTRecvBuff(void)
return
errorLedOn()
errorLedOn()
In the [Hex Output Options: tab, under [Hex Format], set [Hex file format] to [Binary file (-FOrm=Binary)].
In the [Hex Output Options] tab, under [Hex Format], set [Output padding data] to [FF].
Figure 5-6 Generate a binary file in CS+ (6/6)
Select the radio button for the ROM size of the device to be used.
Progress bar
7. Reference Documents
RL78/G23 User’s Manual: Hardware (R01UH0896)
RL78 family user's manual software (R01US0015)
The latest versions can be downloaded from the Renesas Electronics website.
Technical update
The latest versions can be downloaded from the Renesas Electronics website.
Inquiries
http://www.renesas.com/contact/
All trademarks and registered trademarks are the property of their respective owners.
Trademarks
Renesas and the Renesas logo are trademarks of Renesas Electronics
Corporation. All trademarks and registered trademarks are the property
of their respective owners.