1、 2002 Microchip Technology Inc. DS00851B-page 1 AN851 INTRODUCTION Among the many features built into Microchips Enhanced FLASH Microcontroller devices is the capa- bility of the program memory to self-program. This very useful feature has been deliberately included to give the user the ability to p
2、erform bootloading operations. Devices like the PIC18F452 are designed with a desig- nated “boot block”, a small section of protectable pro- gram memory allocated specifically for bootload firmware. This application note demonstrates a very powerful bootloader implementation for the PIC16F87XA and P
3、IC18F families of microcontrollers. The coding for the two device families is slightly different; however, the functionality is essentially the same. The goals of this implementation stress a maximum performance and functionality, while requiring a minimum of code space. FIRMWARE Basic Operation Fig
4、ure 1 summarizes the essential firmware design of the bootloader. Data is received through the USART module, configured in Asynchronous mode for compat- ibility with RS-232 and passed through the transmit/receive engine. The engine filters and parses the data, storing the information into a data buf
5、fer in RAM. The command interpreter evaluates the com- mand information within the buffer to determine what should be done (i.e., Is the data written into a memory unit? Is data read from a memory unit? Does the firm- ware version need to be read?). Once the operation is performed, data is passed ba
6、ck to the transmit/receive engine to be transmitted back to the source, closing the software flow control loop. FIGURE 1: BOOTLOADER FUNCTIONAL BLOCK DIAGRAM COMMUNICATIONS The microcontrollers USART module is used to receive and transmit data; it is configured as a UART to be compatible with RS-232
7、 communications. The device can be set up in an application to bootload from a computer through its standard serial interface. The following communications settings are used: 8 data bits N o p a r i t y 1 S T O P b i t The baud rate setting is variable depending on the application. Baud rate selecti
8、on is discussed later. Author: Ross M. Fosler and Rodger Richey Microchip Technology Inc. USART Transmit/Receive Engine RAM Buffer Command Interpreter FLASH Program Memory EE Configuration Data Memory TX RX Registers Bootloader Control Firmware Data Bus A FLASH Bootloader for PIC16 and PIC18 Devices
9、AN851 DS00851B-page 2 2002 Microchip Technology Inc. THE RECEIVE/TRANSMIT BUFFER All data is moved through a buffer (referred to as the Receive/Transmit Buffer). The buffer is a maximum of 255 bytes deep. This is the maximum packet length supported by the protocol. However, some devices may not supp
10、ort the largest packet size due to memory limitations. Figure 2 shows an example of the mapping of the buffer within the PIC18F452. A useful feature of the receive/transmit buffer is that it retains its memory between packets, thus allowing very fast repeat and replication operations. That is, if an
11、 empty packet is sent, the data currently in memory will be executed as if it were just received. FIGURE 2: DATA MEMORY USAGE ON THE PIC18F452 COMMAND INTERPRETER The command interpreter decodes and executes ten different commands, seven base commands and three special commands. A complete list of t
12、he commands is provided in Appendix A. The base commands allow for read, write, and erase operations on all types of non-volatile memory. The other three commands are for special operations, such as repeating the last command, replicating the data, and resetting the device. Note that the PIC18F devi
13、ces have greater access to, and control of, memory than PIC16F devices. For example, PIC16F devices do not have access to the configuration memory, thus they do not use the config- uration commands. Therefore, not all instructions are available in the PIC16F bootloader. Memory Organization PROGRAM M
14、EMORY USAGE Currently, PIC18F devices reserve the first 512 bytes of Program Memory as the boot block. Future devices may expand this, depending on application require- ments for these devices. However, this bootloader is designed to occupy the current designated boot block of 512 bytes (or 256 word
15、s) of memory. Figure 3 shows a memory map of the PIC18F452. The boot area can be code protected to prevent accidental overwriting of the boot program. FIGURE 3: PROGRAM MEMORY MAP OF THE PIC18F452 PIC16F87XA enhanced microcontrollers are designed to use the first 256 words of program memory. Figure
16、4 shows the memory map of the PIC16F877A. Like the PIC18F452 and other PIC18F devices, the boot area can be write protected to prevent accidental overwriting of the boot program. Note: The actual packet length supported by a particular device depends on the size of its data memory. 107h Unused 008h
17、Receive/Transmit Buffer FFFh 000h Bootloader Work Area SFRs RESET Vector Low Priority Interrupt Vector 0200h 0218h Program Memory High Priority Interrupt Vector 0208h User Memory Space 7FFFh Boot Program Note: Memory areas not shown to scale. 2002 Microchip Technology Inc. DS00851B-page 3 AN851 FIGU
18、RE 4: PROGRAM MEMORY MAP OF THE PIC16F877A REMAPPED VECTORS Since the hardware RESET and interrupt vectors lie within the boot area and cannot be edited if the block is protected, they are remapped through software to the nearest parallel location outside the boot block. Remapping is simply a branch
19、 for interrupts, so PIC18F users should note an additional latency of 2 instruction cycles to handle interrupts. Upon RESET, there are some boot condition checks, so the RESET latency is an additional 10 instruction cycles (as seen in the example source code). For PIC16F87XA devices, the interrupt l
20、atency is an additional 9 instruction cycles on top of the 3 to 4 nor- mally experienced; the RESET latency is 18 instruction cycles. This additional latency comes from saving device context data in shared memory. The example code uses locations 7Dh, 7Eh, and 7Fh to store the PCLATH, STATUS, and W r
21、egisters, respectively. The source code can be changed, but the saved data must remain in the shared memory area. DATA MEMORY USAGE The last location in data memory of the device (Figure 5) is reserved as a non-volatile Boot mode flag. This location contains FFh by default, which indicates Boot mode
22、. Any other value in this location indicates normal Execution mode. FIGURE 5: DATA MEMORY MAP Communication Protocol The bootloader employs a basic communication protocol that is robust, simple to use, and easy to implement. PACKET FORMAT All data that is transmitted to or from the device follows th
23、e basic packet format: . where each represents a byte and . represents the data field. The start of a packet is indicated by two Start of TeXt control characters (), and is terminated by a sin- gle End of TeXt control character (). The last byte before the is always a checksum, which is the twos com
24、plement of the Least Significant Byte of the sum of all data bytes. The data field is limited to 255 data bytes. If more bytes are received, then the packet is ignored until the nextpair is received. CONTROL CHARACTERS There are three control characters that have special meaning. Two of them, and ,
25、are intro- duced above. The last character not shown is the Data Link Escape, . Table 1 provides a summary of the three control characters. RESET Vector 0100h Program Memory Interrupt Vector 0104h User Memory Space 3FFFh Boot Program Note: Memory areas not shown to scale. Note: Although the protocol
26、 supports 255 bytes of data, the specific device that contains the bootloader firmware may have a sufficiently large data memory to support the largest packet size. Refer to the data sheet for the particular device for more information. TABLE 1: CONTROL CHARACTERS Control Value Description0Fh Start
27、of TeXt04h End of TeXt05h Data Link Escape EE Data Boot Control Byte XXXh 000hMemoryAN851 DS00851B-page 4 2002 Microchip Technology Inc. The is used to identify a value that could be interpreted in the data field as a control character. Within the data field, the bootloader will always accept the by
28、te following a as data, and will always send a before any of the three control charac- ters. For example, if a byte of value 0Fh is transmitted as part of the data field, rather than as the con- trol character, the character is inserted before the . This is called “byte stuffing”. COMMANDS The data
29、field for each packet contains one command and its associated data. The commands are detailed in Appendix A. COMMAND RESPONSE LATENCY Flow control is built into the protocol. Thus, for every received command (except RESET), there is a response. If there is no response, then one (or more) of the foll
30、owing has happened: the data was corrupted (bad checksum) the packet was never received the data field was too long RESET was executed So how long do you wait before deciding a problem has occurred? The response latency (shown in Figure 6) is dependent on the amount of data sent, the command being e
31、xecuted, and the clock frequency. For read commands, the latency is highly dependent on the clock frequency, and the size of the packet. For a small packet at high frequency, the response is almost immediate, typically on the order of a few micro- seconds. For large packets, the latency could be on
32、the order of hundreds of microseconds. In general, read commands require very little time com- pared to write commands. Write commands are mostly dependent on internally timed write cycles. For exam- ple, the typical write time required for a single EEPROM location is 4 ms. If the maximum packet siz
33、e (250 bytes of writable data) was sent, the receive to transmit latency would be about 1 second. FIGURE 6: RECEIVE TO TRANSMIT LATENCY Automatic Baud Rate Detection The bootloader is provided with an automatic baud rate detection algorithm that will detect most baud rates for most input clock frequ
34、encies (FOSC). The algorithm determines the best value for the Baud Rate Generator and then loads the SPBRG register on the microcontroller with the determined value. SYNCHRONIZING The first in the protocol is the synchronization byte. It is used to match the devices baud rate to the sources baud ra
35、te. Thus, the device is synchronized to the source on every new packet. SELECTING FOSC AND BAUD RATE The recommended baud rate for this application is 9600 bps. This is the ideal rate for a device operating from 4 MHz, to the devices maximum operating fre- quency (40 MHz in most cases). Higher baud
36、rates are possible, but degenerate conditions can occur. There are a few clock frequency/standard baud rate combinations that lead to a degenerate baud rate selection during synchronization; under such condi- tions, the device will never synchronize to the source. Clock frequencies that avoid such d
37、egenerate conditions are given by the equation: where E is the error (typically 2%), X is the value for the SPBRG register, and B is the baud rate. A table of cal- culated clock oscillator ranges for most of the common baud rates is provided in AppendixB for quick reference. BOOTING A DEVICE Enterin
38、g and Leaving Boot Mode With the bootloader firmware loaded, there are two dis- tinct modes of operation: Boot Mode and User Mode. The bootloader uses the last location of data memory to determine which mode to run in. A value of FFh indi- cates Boot mode. Any other value indicates User mode. Thus,
39、a new part with its data memory not initialized will automatically enter Boot mode the first time. Note: Control characters are not considered data and are not included in the checksum. RX TX Delay Note: Refer to the specific device data sheet for information about the USART module and its associate
40、d registers. Note: If a Start of TeXt condition is received during the reception of a packet, then no synchronization occurs. FOSC = (1 E)(X + 1)(16)(B) 2002 Microchip Technology Inc. DS00851B-page 5 AN851 To leave Boot mode, the last location must be changed to some value other than FFh. Then, a de
41、vice RESET (hardware or software) is initiated. For PIC18F devices, the RESET command actually generates a true RESET via the RESET instruction (same as MCLR). Other than tying a port pin to MCLR, a true RESET is not possible in firmware on PIC16F87XA devices. Although the RESET command is supported
42、, it only causes the PIC16F device to jump to the RESET vector; the regis- ters used to perform bootload operations are not changed to their RESET states. Reading/Writing/Erasing Program Memory PIC18F For the PIC18F devices, commands 1 through 3 sup- port operations to FLASH program memory. Read ope
43、rations occur at the byte level. Write operations are performed on multiples of 8 bytes (one block). Erase operations are performed on 64 bytes (one row). When writing program memory on a PIC18F device, the memory should be erased. The default operation is: bits can only be cleared when written to.
44、An erase oper- ation is the only action that can be used to set bits in program memory. Thus, if the bootloader protection bits are not setup in the configuration bytes, operations on memory from 000h to 1FFh could partially, or completely disable the bootloader firmware. User IDs (starting at addre
45、ss 200000h) are considered to be part of program memory and are written and erased like normal FLASH program memory. The Device ID (addresses 3FFFFEh and 3FFFFFh) is also considered program memory. While they can be accessed, however, they are read only and cannot be altered. PIC16F The PIC16F87XA d
46、evices support reading and writing to program memory. Commands 1 and 2 support oper- ations to FLASH program memory. Read operations occur at the word level (2 bytes). Write operations are performed on multiples of 4 words (8 bytes). Since write operations are erase-before-write, the erase com- mand
47、 is not supported. The bootloader area, from 000h to 0FFh, should be write protected to prevent overwriting itself. Neither the User ID nor the Device ID locations are accessible during normal operation on the PIC16 archi- tecture; therefore, these areas can neither be read nor written. Reading/Writ
48、ing Data Memory Data memory is read or written one byte at a time, through commands 4 and 5. Since it is not actually mapped to the normal FLASH memory space, the address starts at 000h and continues to the end of EEDATA memory. Note that the last location of the data memory is used as a boot flag.
49、Writing anything other than FFh to the last location indicates normal code execution. Configuration Bits PIC18F PIC18F devices allow access to the device configura- tion bits (addresses starting at 300000h) during normal operation. In the bootloader, commands 6 and 7 pro- vide this access. Data is read one byte at a time and, unlike program memory, is written one byte at a time. Since configuration bits are automatically erased before being written, there is no erase command for configuration memory. Having access to configuration settings is very power-
