MSP430 through the JTAG interface. Section 1.3, Memory Programming Control Sequences, describes how to use the provided macros and function prototypes in a software-flow format to control a target MSP430 device and program or erase the memory. Section 1.4, JTAG Access Protection, describes the mechanism that can disable memory access through JTAG to the memory of the target device, which can eliminate undesired memory access for security purposes.
Section 1.3.1.1. • The MSP430 device must be the first device in the JTAG chain (because of clocking on TDI and JTAG fuse check sequence). • Only the BYPASS instruction is supported. There is no support for SAMPLE, PRELOAD, or EXTEST instructions.
This section also describes the software macro routines that are used to program a MSP430 target and the JTAG instructions that are used to communicate with and control the target through the JTAG interface.
Interface and Instructions www.ti.com The TEST input exists only on MSP430 devices with shared JTAG function, usually assigned to port 1. For normal operation (non-JTAG mode), this pin is internally pulled down to ground, which enables the shared pins as standard port I/O. To enable these pins for JTAG communication, refer to Section 1.3.1.1.
16 bits wide). The data word is shifted, most significant bit (MSB) first, into the TDI input of the target MSP430 device. Each bit is captured from TDI on a rising edge of TCK. At the same time, TDO shifts out the last captured and stored value in the addressed data register.
20-bit address word into the 20-bit wide JTAG MAB register. The address word is shifted, MSB first, into the TDI input of the target MSP430 device. Each bit is captured from TDI on a rising edge of TCK. At the same time, TDO shifts out the last captured and stored value in the JTAG MAB register. A new bit is present at TDO with a falling edge of TCK.
1.2.2.1.4 MsDelay (Time) This macro causes the programming interface software to wait for a specified amount of time in milliseconds (ms). While this macro is executing, all signals to and from the target MSP430 must hold their previous values. 1.2.2.1.5 SetTCLK This macro sets the TCLK input clock (which is provided on the TDI signal input) high.
Figure 1-10 shows handling of TCLK in SBW mode. See the reference functions SetTCLK_sbw and ClrTCLK_sbw in the MSP430 Replicator project (slau320.zip) for software implementation. The provided code example for the MSP430Xv2 architecture uses preprocessor definitions to enable a better layered software architecture.
1.2.3.5.2 TCLK Strobes For MSP430 devices from the F1xx, F2xx, G2xx, and F4xx families, a custom number of TCLK clocks can be provided within a single TDI slot as can be seen in the example projects Replicator430 and Replicator430X. See reference function: TCLKstrobes(). This implementation is not applicable for any newer devices from the MSP430F5xx or MSP430F6xx families.
Page 17
JTAG MDB register. As the new value is written into the MDB register, the prior value in the MSP430 MDB is captured and shifted out on TDO. The MSP430 MAB is set by the value in the JTAG MAB register during execution of the IR_DATA_TO_ADDR instruction.
Page 18
16-bit JTAG data access. The complete MSP430 MDB is set to the value of the JTAG MDB register. At the same time, the last value of the MSP430 MDB is captured and shifted out on TDO. In this situation, the MAB is still controlled by the CPU. The program counter (PC) of the target CPU sets the MAB value.
Interface and Instructions www.ti.com 1.2.4.3 Controlling the CPU The following instructions enable control of the MSP430 CPU through a 16-bit register accessed through JTAG. This data register is called the JTAG control signal register. Table 1-6 describes the bit functions making up the JTAG control signal register used for memory access.
Page 21
This instruction completely releases the CPU from JTAG control. Once executed, the JTAG control signal register and other JTAG data registers no longer have any effect on the target MSP430 CPU. This instruction is normally used to release the CPU from JTAG control.
MSP430 devices with TEST pin and 4-wire JTAG access only (no SBW) To use the JTAG features of MSP430 devices with shared JTAG and a TEST pin, it is necessary to enable the shared JTAG pins for JTAG communication mode. Devices with dedicated JTAG inputs/outputs and no TEST pin do not require this step.
Figure 1-12. JTAG Access Entry Sequences (for Devices That Support SBW) NOTE: On some Spy-Bi-Wire capable MSP430 devices, TEST/SBWTCK is very sensitive to rising signal edges that can cause the test logic to enter a state where an entry sequence (either 2- wire or 4-wire) is not recognized correctly and JTAG access stays disabled.
TDI is logical low. In that case, no current flows through the security fuse, but the internal logic remembers that a fuse check was performed. Thus, the fuse is mistakenly recognized as programmed (that is, blown). To avoid the issue, newer MSP430 JTAG implementations (devices with CPUXv2 - see Table 1-15) also reset the internal fuse-check logic on performing a reset of the TAP controller.
Memory Programming Control Sequences www.ti.com 1.3.2 General Device (CPU) Control Functions The functions described in this section are used for general control of the target MSP430 CPU, as well as high-level JTAG access and bus control. 1.3.2.1 Function Reference for 1xx, 2xx, 4xx Families 1.3.2.1.1 Taking the CPU Under JTAG Control...
Page 26
1.3.2.1.3 Setting the Target CPU Program Counter (PC) To use some of the features of the JTAG interface provided by the MSP430, setting of the CPU PC of the target device is required. The following flow is used to accomplish this. Implementations for both the MSP430 and MSP430X architectures are shown.
Page 28
0xFFFEh (the reset vector). • Release MSP430 from JTAG control. This is done by performing a reset using the JTAG control signal register. The CPU must then be released from JTAG control by using the IR_CNTRL_SIG_RELEASE instruction.
Page 29
POR signal in the JTAG Control Signal Register. Also, care must be taken that the CPU is in the Full-Emulation-State (equivalent to the Instruction-Fetch state for MSP430/MSP430X architectures) by setting the CPUSUSP signal and providing a number of TCLK until the CPU pre-fetch pipes are cleared.
To read from any memory address location (peripherals, RAM, or flash/FRAM), the R/W signal must be set to READ using the JTAG control signal register (bit 0 set to 1). The MSP430 MAB must be set to the specific address to be read using the IR_ADDR_16BIT instruction while TCLK is 0. To capture the corresponding value of the MSP430 MDB, the IR_DATA_TO_ADDR instruction must be executed.
Page 35
Memory Programming Control Sequences www.ti.com • MSP430 architecture, Reference function: ReadMem Set CPU to stopped state (HaltCPU) ClrTCLK IR_SHIFT("IR_CNTRL_SIG_16BIT") DR_SHIFT16(0x2409) : Read Memory IR_SHIFT("IR_ADDR_16BIT") DR_SHIFT16("Address") : Set desired address IR_SHIFT("IR_DATA_TO_ADDR") SetTCLK ClrTCLK DR_SHIFT16(0x0000) : Memory value shifted out on TDO Read again? ReleaseCPU should now be executed, returning the CPU to normal operation.
Page 36
MAB and MDB. After completion of the write operation, it is recommended to set the R/W signal back to READ. Following is the flow for a peripheral or RAM memory address write. Implementations for both the MSP430 and MSP430X architectures are shown.
Page 38
Before this instruction can be loaded into the JTAG IR register, the program counter (PC) of the target MSP430 CPU must be set to the desired memory starting address. After the IR_DATA_QUICK instruction is shifted into the IR register, the PC is incremented by two with each falling edge of TCLK, automatically pointing the PC to the next memory location.
Function Reference for 1xx, 2xx, 4xx Families Reference function: WriteFLASH This section describes one method available to program the flash memory module in an MSP430 device. It uses the same procedure that user-defined application software would use, which would be programmed into a production-equipment MSP430 device.
Table 1-9 shows the required minimum number of TCLK cycles, depending on the action performed on the flash (for FCTL2 register bits 0 to 7 = 0x40 as defined in the MSP430 user's guide). Table 1-9. Erase and Program Minimum TCLK Clock...
Page 41
Because the 5xx and 6xx devices have a dedicated timing generator available on chip, flash access is significantly easier compared to the other MSP430 families. There is no need for the user to ensure a certain erase or program frequency on the TCLK signal. All timings that are required for memory erase and write access are generated automatically.
Page 42
5xx and 6xx devices through the JTAG interface. The term Flash-Access-Code stands for an appropriate executable MSP430 code that can be used to perform the flash access operation. The following sections use the term Flash- Write-Code for code that is used to program the flash memory and Flash-Erase-Code for code that is used to erase the flash memory.
(mass erase time). Two different specification combinations of these Mass Erase parameters are currently implemented in dedicated MSP430 devices. Table 1-10 shows an overview of the parameters (assuming a maximum TCLK frequency of 450 KHz).
Page 47
For implementation 1, to assure the recommended 200-ms erase time to safely erase the flash memory space, 5300 TCLK cycles are transmitted to the target MSP430 device and repeated 19 times. With implementation 2, the following sequence needs to be performed only once.
1.3.7 Verifying the Target Memory Reference function: VerifyMem Verification is performed using a pseudo signature analysis (PSA) algorithm, which is built into the MSP430 JTAG logic and executes in approximately 23 ms/4KB. • Both MSP430 and MSP430X architecture, Reference functions: VerifyPSA, VerifyPSA_430X...
1.4.1 Burning the JTAG Fuse - Function Reference for 1xx, 2xx, 4xx Families Two similar methods are described and implemented, depending on the target MSP430 device family. All devices having a TEST pin use this input to apply the programming voltage, V .
Page 55
Switch TDI pin back to TDI function and reset the JTAG state machine (ResetTAP) 1.4.1.1.2 Fuse-Programming Voltage On TEST Pin The same method is used to program the fuse for the TEST pin MSP430 devices, with the exception that the fuse-blow voltage, V , is now applied to the TEST input pin.
0x17FC to 0x17FF. Any value other than 0 or 0xFFFFFFFF programmed to these addresses irreversibly locks the JTAG interface. All of the 5xx and 6xx MSP430 devices come with a preprogrammed BSL (TI-BSL) code that, by default, protects itself from unintended erase and write access. This is done by...
5xx or 6xx devices) and a RESET (by the JTAG ExecutePOR command or the RST/NMI pin in hardware) has been issued, the only JTAG function that is available on the target MSP430 is BYPASS. When the target is in BYPASS, data sent from host to target is delayed by one TCK pulse and then output on TDO, where it can be received by other devices downstream of the target MSP430.
(STATUS_OK if comparison was successful, STATUS_ERROR otherwise) 1.5.2 High-Level JTAG Routines word GetDevice (void) Takes the target MSP430 device under JTAG control. Sets the target device's CPU watchdog to a hold state; sets the global DEVICE variable. Arguments: None...
Page 63
Length (number of words to be programmed) word *DataArray (pointer to array containing the data) Result: None short DownloadProgram(struct_Program* program) This function downloads a converted MSP430.txt file Arguments: struct_Program* program Structure containing executable code and memory data Result: word STATUS_OK if verification was successful, STATUS_ERROR otherwise short DownloadMsp430Code() This function configures all needed information to download a program into target memory.
Each example demonstrates the software functions described in the previous sections using an MSP430F5437 as the host controller that programs the given target MSP430 device of choice. The complete C source code and project files are provided in the examples zip file. A schematic for the system as implemented in this discussion is also provided.
6KB, so approximately 250KB remain for the target device program. The Replicator host can be loaded with the target source code by the flash emulation tool (FET) or by the MSP430 serial programming adapter. (See the MSP430 website at www.ti.com...
Target_Code.s43 (IAR) resp. Target_Code.asm (CCS) from the project. The Target_Code.h file is generated by the srec_cat.exe file directly or by the srec.bat file. JTAG functions All MSP430-specific functions are defined here. These files should not be modified under any circumstance. JTAGfunc.c JTAGfunc430X.c Contain the MSP430-specific functions needed for flash programming JTAGfunc430Xv2.c...
The required Spy-Bi-Wire or 4-wire JTAG and GND must be connected. (On devices requiring the TEST pin, the TEST signal also must be provided from the programmer to the target MSP430 device.) Host controller in the REP430F is supplied from the V = 3 V, JTAG Programming Hardware and Software Implementation SLAU320Z –...
Page 81
I/O levels exactly as required by the target device.) To enable programming of all MSP430 flash-based devices including a JTAG access fuse, voltage translators are used and MOSFET switches are controlled by the host MSP430. MOSFET Q2 controls V on devices with a TEST pin; Q1 connects V to TDI on devices not requiring a TEST signal.
JTAG access fuse. While the fuse is being programmed, a peak current of 100 mA can flow through the TEST or TDI input pin (see the corresponding target MSP430 device data sheet). When using a target system that is powered locally, the V level from the target device should be connected to pin 2 of the JTAG connector that supplies the I/O voltage translator in the REP430F.
Appendix D: Universal Bootstrap Loader Interface Board: Operational amplifier IC2 must be replaced with TL062D or equivalent type. The following is a summary of changes in former revisions of the Programming a Flash-Based MSP430 Using the JTAG Interface application report (SLAA149).
Page 86
IMPORTANT NOTICE FOR TI DESIGN INFORMATION AND RESOURCES Texas Instruments Incorporated (‘TI”) technical, application or other design advice, services or information, including, but not limited to, reference designs and materials relating to evaluation modules, (collectively, “TI Resources”) are intended to assist designers who are developing applications that incorporate TI products;...