SLAU320AJ July   2010  – May 2021

 

  1.   Trademarks
  2. 1Introduction
    1. 1.1 About This Document
    2. 1.2 Organization of This Document
  3. 2Programming Using the JTAG Interface
    1. 2.1 Introduction
      1. 2.1.1 MSP430 JTAG Restrictions (Noncompliance With IEEE Std 1149.1)
      2. 2.1.2 TAP Controller State Machine
    2. 2.2 Interface and Instructions
      1. 2.2.1 JTAG Interface Signals
        1. 2.2.1.1 Pros and Cons of 2-Wire Spy-Bi-Wire and 4-Wire JTAG
        2. 2.2.1.2 4-Wire JTAG Interface
        3. 2.2.1.3 2-Wire Spy-Bi-Wire (SBW) JTAG Interface
      2. 2.2.2 JTAG Access Macros
        1. 2.2.2.1 Macros for 4-Wire JTAG Interface
          1. 2.2.2.1.1 IR_SHIFT (8-Bit Instruction)
          2. 2.2.2.1.2 DR_SHIFT16 (16-Bit Data)
          3. 2.2.2.1.3 DR_SHIFT20 (20-Bit Address) (Applies Only to MSP430X Devices)
          4. 2.2.2.1.4 MsDelay (Time)
          5. 2.2.2.1.5 SetTCLK
          6. 2.2.2.1.6 ClrTCLK
        2. 2.2.2.2 Macros for Spy-Bi-Wire (SBW) Interface
      3. 2.2.3 Spy-Bi-Wire (SBW) Timing and Control
        1. 2.2.3.1 Basic Timing
        2. 2.2.3.2 TMS Slot
          1. 2.2.3.2.1 TMSH Macro
          2. 2.2.3.2.2 TMSL Macro
          3. 2.2.3.2.3 TMSLDH Macro
        3. 2.2.3.3 TDI Slot
          1. 2.2.3.3.1 TDIH Macro
          2. 2.2.3.3.2 TDIL Macro
        4. 2.2.3.4 TDO Slot
          1. 2.2.3.4.1 TDO_RD Macro
          2. 2.2.3.4.2 TDOsbw Macro (No Read)
        5. 2.2.3.5 TCLK Handling in Spy-Bi-Wire (SBW) Mode
          1. 2.2.3.5.1 SetTCLK and ClrTCLK
          2. 2.2.3.5.2 TCLK Strobes
      4. 2.2.4 JTAG Communication Instructions
        1. 2.2.4.1 Controlling the Memory Address Bus (MAB)
          1. 2.2.4.1.1 IR_ADDR_16BIT
          2. 2.2.4.1.2 IR_ADDR_CAPTURE
        2. 2.2.4.2 Controlling the Memory Data Bus (MDB)
          1. 2.2.4.2.1 IR_DATA_TO_ADDR
          2. 2.2.4.2.2 IR_DATA_16BIT
          3. 2.2.4.2.3 IR_DATA_QUICK
          4. 2.2.4.2.4 IR_BYPASS
        3. 2.2.4.3 Controlling the CPU
          1. 2.2.4.3.1 IR_CNTRL_SIG_16BIT
          2. 2.2.4.3.2 IR_CNTRL_SIG_CAPTURE
          3. 2.2.4.3.3 IR_CNTRL_SIG_RELEASE
        4. 2.2.4.4 Memory Verification by Pseudo Signature Analysis (PSA)
          1. 2.2.4.4.1 IR_DATA_PSA
          2. 2.2.4.4.2 IR_SHIFT_OUT_PSA
        5. 2.2.4.5 JTAG Access Security Fuse Programming
          1. 2.2.4.5.1 IR_PREPARE_BLOW
          2. 2.2.4.5.2 IR_EX_BLOW
    3. 2.3 Memory Programming Control Sequences
      1. 2.3.1 Start-Up
        1. 2.3.1.1 Enable JTAG Access
        2. 2.3.1.2 Fuse Check and Reset of the JTAG State Machine (TAP Controller)
      2. 2.3.2 General Device (CPU) Control Functions
        1. 2.3.2.1 Function Reference for 1xx, 2xx, 4xx Families
          1. 2.3.2.1.1 Taking the CPU Under JTAG Control
          2. 2.3.2.1.2 Set CPU to Instruction-Fetch
          3. 2.3.2.1.3 Setting the Target CPU Program Counter (PC)
          4. 2.3.2.1.4 Controlled Stop or Start of the Target CPU
          5. 2.3.2.1.5 Resetting the CPU While Under JTAG Control
          6. 2.3.2.1.6 Release Device From JTAG Control
        2. 2.3.2.2 Function Reference for 5xx and 6xx Families
          1. 2.3.2.2.1 Taking the CPU Under JTAG Control
          2. 2.3.2.2.2 Setting the Target CPU Program Counter (PC)
          3. 2.3.2.2.3 Resetting the CPU While Under JTAG Control
          4. 2.3.2.2.4 Release Device From JTAG Control
          5. 2.3.2.2.5 74
      3. 2.3.3 Accessing Non-Flash Memory Locations With JTAG
        1. 2.3.3.1 Read Access
        2. 2.3.3.2 Write Access
        3. 2.3.3.3 Quick Access of Memory Arrays
          1. 2.3.3.3.1 Flow for Quick Read (All Memory Locations)
          2. 2.3.3.3.2 Flow for Quick Write
      4. 2.3.4 Programming the Flash Memory (Using the Onboard Flash Controller)
        1. 2.3.4.1 Function Reference for 1xx, 2xx, 4xx Families
        2. 2.3.4.2 Function Reference for 5xx and 6xx Families
      5. 2.3.5 Erasing the Flash Memory (Using the Onboard Flash Controller)
        1. 2.3.5.1 Function Reference for 1xx, 2xx, 4xx Families
          1. 2.3.5.1.1 Flow to Erase a Flash Memory Segment
          2. 2.3.5.1.2 Flow to Erase the Entire Flash Address Space (Mass Erase)
        2. 2.3.5.2 Function Reference for 5xx and 6xx Families
      6. 2.3.6 Reading From Flash Memory
      7. 2.3.7 Verifying the Target Memory
      8. 2.3.8 FRAM Memory Technology
        1. 2.3.8.1 Writing and Reading FRAM
        2. 2.3.8.2 Erasing FRAM
    4. 2.4 JTAG Access Protection
      1. 2.4.1 Burning the JTAG Fuse - Function Reference for 1xx, 2xx, 4xx Families
        1. 2.4.1.1 Standard 4-Wire JTAG
          1. 2.4.1.1.1 Fuse-Programming Voltage on TDI Pin (Dedicated JTAG Pin Devices Only)
          2. 2.4.1.1.2 Fuse-Programming Voltage On TEST Pin
        2. 2.4.1.2 Fuse-Programming Voltage Using SBW
      2. 2.4.2 Programming the JTAG Lock Key - Function Reference for 5xx, 6xx, and FRxx Families
        1. 2.4.2.1 Flash Memory Devices
        2. 2.4.2.2 FRAM Memory Devices
      3. 2.4.3 Testing for a Successfully Protected Device
      4. 2.4.4 Unlocking an FRAM Device in Protected and Secured Modes
        1. 2.4.4.1 FR5xx and FR6xx Devices
        2. 2.4.4.2 FR4xx and FR2xx Devices
      5. 2.4.5 Memory Protection Unit Handling
      6. 2.4.6 Intellectual Property Encapsulation (IPE)
      7. 2.4.7 FRAM Write Protection
    5. 2.5 JTAG Function Prototypes
      1. 2.5.1 Low-Level JTAG Functions
      2. 2.5.2 High-Level JTAG Routines
    6. 2.6 JTAG Features Across Device Families
    7. 2.7 References
  4. 3JTAG Programming Hardware and Software Implementation
    1. 3.1 Implementation History
    2. 3.2 Implementation Overview
    3. 3.3 Software Operation
    4. 3.4 Software Structure
      1. 3.4.1 Programmer Firmware
      2. 3.4.2 Target Code
        1. 3.4.2.1 Target Code Download for Replicator430, Replicator430X, and Replicator430Xv2
        2. 3.4.2.2 Target Code Download for Replicator430FR (FRAM)
    5. 3.5 Hardware Setup
      1. 3.5.1 Host Controller
      2. 3.5.2 Target Connection
      3. 3.5.3 Host Controller or Programmer Power Supply
      4. 3.5.4 Third-Party Support
  5. 4Errata and Revision Information
    1. 4.1 Known Issues
    2. 4.2 Revisions and Errata From Previous Documents
  6. 5Revision History

2.5.2 High-Level JTAG Routines

word GetDevice (void)
Takes the target MSP430 device under JTAG control. Sets the target device's CPU watchdog to a hold state; sets the global DEVICE variable.
Arguments: None
Result: word (STATUS_ERROR if fuse is blown, JTAG_ID is incorrect (not = 0x89) or synchronizing time-out occurs; STATUS_OK otherwise)
void ReleaseDevice (word Addr)
Releases the target device from JTAG control; CPU starts execution at the specified PC address
Arguments: word Addr (0xFFFE: perform reset; address at reset vector loaded into PC;
otherwise address specified by Addr loaded into PC)
Result: None
void WriteMem (word Format, word Addr, word Data)
Writes a single byte or word to a given address (RAM/peripheral only)
Arguments: word Format (F_BYTE or F_WORD)
word Addr (destination address for data to be written)
word Data (data value to be written)
Result: None
void WriteMemQuick (word StartAddr, word Length, word *DataArray)
Writes an array of words into the target device memory (RAM/peripheral only)
Arguments: word StartAddr (start address of destination memory)
word Length (number of words to be programmed)
word *DataArray (pointer to array containing the data)
Result: None
void WriteFLASH (word StartAddr, word Length, word *DataArray)
Programs/verifies an array of words into flash memory using the flash controller of the target device
Arguments: word StartAddr (start address of destination flash memory)
word Length (number of words to be programmed)
word *DataArray (pointer to array containing the data)
Result: None
word WriteFLASHallSections(const unsigned int *data, const unsigned long *address, const unsigned long *length_of_sections, const unsigned long sections)
Programs and verifies a set of data arrays of words into a flash memory by using the WriteFLASH() function. It conforms with the CodeArray structure convention of file Target_Code_(IDE).s43 or Target_Code.h.
Arguments: const unsigned int *DataArray (pointer to array with the data)
const unsigned long *address (pointer to array with the startaddresses)
const unsigned long *length_of_sections (pointer to array with the number of words counting from startaddress)
const unsigned long sections (number of sections in code file)
Result: word (STATUS_OK if verification was successful, STATUS_ERROR otherwise)
word ReadMem (word Format, word Addr)
Reads one byte or word from a specified target memory address
Arguments: word Format (F_BYTE or F_WORD)
word Addr (target address for data to be read)
Result: word (data value stored in the target address memory location)
void ReadMemQuick (word StartAddr, word Length, word *DataArray)
Reads an array of words from target memory
Arguments: word StartAddr (start address of target memory to be read)
word Length (number of words to be read)
word *DataArray (pointer to array for data storage)
Result: None
void EraseFLASH (word EraseMode, word EraseAddr)
Performs a mass erase (with or without information memory) or a segment erase of a flash module specified by the given mode and address
Arguments: word EraseMode (ERASE_MASS, ERASE_MAIN or ERASE_SGMT)
word EraseAddr (any address within the selected segment to be erased)
Result: None
word EraseCheck (word StartAddr, word Length)
Uses the VerifyPSA function to perform an erase check over the given memory range
Arguments: word StartAddr (start address of memory to be checked)
word Length (number of words to be checked)
Result: word (STATUS_OK if erase check was successful, STATUS_ERROR otherwise)
word VerifyMem (word StartAddr, word Length, word *DataArray)
Performs a program verification over the given memory range
Arguments: word StartAddr (start address of memory to be verified)
word Length (number of words to be verified)
word *DataArray (pointer to array containing the data)
Result: word (STATUS_OK if verification was successful, STATUS_ERROR otherwise)

For MSP430 and MSP430X architecture devices, the following functions are defined:

word BlowFuse (void)
Programs (or blows) the JTAG interface access security fuse. This function also checks for a successfully programmed fuse using the IsFuseBlown() prototype.
Arguments: None
Result: word (STATUS_OK if fuse blow was successful, STATUS_ERROR otherwise)
word IsFuseBlown (void)
Determines if the security fuse has been programmed on the target device
Arguments: None
Result: word (STATUS_OK if fuse is blown, STATUS_ERROR otherwise)
void UnlockInfoA(void)
Unlocks segment A of the InfoMemory (Flash)
Arguments: None
Result: None

For MSP430Xv2 architecture (flash and FRAM devices), the following functions are defined:

word ProgramLockKey(void)
Disables JTAG access to the target device.
Arguments: None
Result: word (TRUE if fuse blow was successful, FALSE otherwise)
word IsLockKeyProgrammed(void)
Checks if the JTAG lock key is programmed.
Arguments: None
Result: word (STATUS_OK if fuse is blown, STATUS_ERROR otherwise)

For MSP430Xv2 architecture (only flash devices), the following functions are defined:

void UnlockInfoA_430Xv2(void)
Unlocks segment A of the InfoMemory (flash).
Arguments: None
Result: None
void UnlockBsl_430Xv2Flash(void)
Unlocks the BSL memory protection.
Arguments: None
Result: None

For MSP430Xv2 architecture (only FRAM devices), the following functions are defined:

word UnlockDevice_430Xv2(unsigned short* password, unsigned long passwordLength)
Unlocks the FRAM memory when a JTAG password is set
Arguments: unsigned short* password (Pointer to array containing the JTAG Password)
unsigned long passwordLength (length of the password in words)
Result: word (STATUS_OK if memory unlock was successful, STATUS_ERROR otherwise)
void EraseFRAM_430Xv2(unsigned long StartAddr, unsigned long Length)
Performs an erase of a user defined FRAM memory section. For FRAM devices the erase equals a write operation of 0xFFFF to the respective memory section. (Could be extended with erase check via PSA) This function should be used for "segment erases" only. For a "mass erase", consider using EraseFRAMViaBootCode_430Xv2 instead.
Arguments: word StartAddr (start address for the erase)
word Length (length of the memory section in WORDS)
Result: None
word DisableMpu_430Xv2(void)
Disables the Memory Protection Unit (FRAM devices only)
Arguments: None
Result: word (STATUS_OK if MPU was disabled successfully, STATUS_ERROR otherwise)
word DisableFramWprod_430Xv2(void)
Disables the Memory Write Protection (FRAM devices only FR6047, FR5994)
Arguments: None
Result: word (STATUS_OK if Memory Write Protection was disabled successfully, STATUS_ERROR otherwise)
void UnlockBsl_430Xv2FRAM(void)
Unlocks the BSL memory protection.
Arguments: None
Result: None
word EraseFRAMViaBootCode_430Xv2(word mailBoxMode, word data1, word data2)
Performs a Erase of FRxx devices using the JTAG mailbox.
Arguments: word mailBoxMode 32Bit 16Bit mode
word data1 mailbox data - first 16BIT
word data2 mailbox data - second 16BIT
Result: word (STATUS_OK if erase was successful, STATUS_ERROR otherwise)
short DownloadProgram(struct_Program* program)
This function downloads a converted MSP430.txt file
Arguments: struct_Program* program Structure containing executable code and memory data
Result: word STATUS_OK if verification was successful, STATUS_ERROR otherwise
short DownloadMsp430Code()
This function configures all needed information to download a program into target memory. After configuration is done it calls the DownloadProgram() function.
Arguments: None
Result: None