To Download MC9S12NE64VTUE Datasheet File

 11.4.6.1.1 pre (preamble) the preamble (pre) consists of 32 contiguous logic 1 bits on mii_mdio with 32 corresponding cycles on mii_mdc to provide the phy with a pattern that it can use to establish synchronization. the preamble is optional as determined by nopre. 11.4.6.1.2 st (start of frame) the start of frame (st) is indicated by a <01> pattern. this pattern ensures transitions from the default logic 1 line state to 0 and then returns to 1. 11.4.6.1.3 op (operation code) the o peration code  (op) for a read instruction is <10>. for a write operation, the operation code is <01>. 11.4.6.1.4 phyad (phy address) the  phy address (phyad) is a 5-bit ?ld, allowing up to 32 unique phy addresses. the ?st address bit transmitted is the msb of the address. 11.4.6.1.5 regad (register address) the register address (regad) is a 5-bit ?ld, allowing 32 individual registers to be addresses within each phy. the ?st register bit transmitted is the msb of the address. 11.4.6.1.6 ta (turnaround) the turnaround (ta) ?ld is a two bit time spacing between the register address ?ld and the data ?ld of an mii management frame to avoid contention on the mii_mdio signal during a read operation. for a read transaction, both the mac and the phy remain in a high impedance state for the ?st bit time of the turnaround.  the phy drives a 0 bit during the second bit time of the turnaround  of a read transaction. during a write transaction, the mac drives a 1 bit for the ?st bit time of the turnaround  and a 0 bit for the second bit time of the turnaround . 11.4.6.1.7 data (data) the data  (data) ?ld is 16 bits wide. the ?st data bit transmitted and received is the msb of the data. 11.4.6.1.8 idle (idle condition) during idle condition  (idle), mii_mdio is in the high impedance state.

 chapter 11 ethernet media access controller (emacv1) mc9s12ne64 data sheet, rev. 1.1 344 freescale semiconductor 11.4.6.2 read operation to perform a read operation through mii management, the op ?ld in mcmst must be written to 10 while the busy bit is clear. the paddr ?ld in mpadr indicates which phy device is addressed and the raddr in mradr indicates which 16-bit register is read from the phy device. the mii management creates an mii management frame and serially shifts it out to the phy through the mii_mdio pin. after the turnaround ?ld, the phy serially shifts the register data from the phy to the emac through the mii_mdio pin. after the read mii management frame operation has completed, the busy bit clears, the mrdata register is updated, and the mmcif bit in ievent is set. if not masked (mmcie in imask is set), an mii management transfer complete interrupt is pending while this ?g is set. figure 11-26. typical mdc/mdio read operation 11.4.6.3 write operation to perform a write operation through mii management, the op ?ld in mcmst must be written to 01 while the busy bit is clear. the paddr ?ld in mpadr indicates which phy device is addressed and the raddr bit in mradr indicates which 16-bit register is read from the phy device. the mii management creates an mii management frame and serially shifts it out to the phy through the mii_mdio pin. after the turnaround ?ld, the mwdata register is serially shifted to the phy through the mii_mdio pin. after the write mii management frame operation has completed, the busy bit is cleared and the mmcif bit in ievent is set. if not masked (mmcie in imask is set), an mii management transfer complete interrupt is pending while this ?g is set. figure 11-27. typical mdc/mdio write operation 11.4.7 loopback the mii transmit data stream is internally looped back as an mii receive data stream if the mlb bit is set. the mii_txclk and mii_rxclk are internally driven from the system clock. mii_rxd is driven from mii_txd. mii_rxdv is driven from mii_txen. mii_rxer is driven from mii_txer. the mdc 0 1 1 0 0 1 1 1 00 0 0 0 1 0 z 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 z 32 1s optional start opcode phy address register address ta register data idle (read) 1 (phyad = 0eh) (regad = 01h) mdio (mac) mdio (phy) z z z preamble mdc 0 1 0 1 0 1 1 1 00 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 z start opcode phy address register address ta register data idle (write) 0 (phyad = 0eh) (regad = 01h) mdio (mac) z 0 32 1s optional preamble

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 345 mii_col, mii_crs, mii_mdc, and mii_mdio signals are disabled. during loopback, the mii to external and internal phys are disabled. loopback mode requires that the user set the fdx bit to con?ure for full-duplex mode. loopback connects the outs to the ins and relies on the unidirectional nature of full duplex to transfer data in parallel. the bidirectional nature of half duplex does not allow the rx to accept transmit data without using some kind of intermediate storage buffer. 11.4.8 software reset the emac provides a software reset capability. when the macrst bit is set, all registers are reset to their default values. the emace bit is cleared. the receiver and transmitter are initialized. any reception and/or transmission currently in progress is abruptly aborted. 11.4.9 interrupts when an interrupt event occurs, a bit is set in the ievent register. note that bits in the ievent register are set by the event and remain set until cleared by software. if a bit in the ievent register is set and the corresponding bit is set in the imask register, the corresponding interrupt signal asserts. individual interrupts are cleared by software by writing a 1 to the corresponding bit in the ievent register. the interrupt sources are listed in table 11-12 . 11.4.10 debug and stop during system debug (freeze) mode, the emac functions normally.when the system enters low-power stop mode, the emac is immediately disabled. any receive in progress is dropped and any pause timeout is cleared. the user must not enter low-power stop mode while txact or busy is set. table 11-12. interrupt vectors interrupt source ccr mask local enable receive flow control (rfcif) i bit  imask (rfcie) babbling receive error (breif) i bit imask (breie) receive error (rxeif) i bit imask (rxeie) receive buffer a overrun (rxaoif) i bit imask (rxaoie) receive buffer b overrun (rxboif) i bit imask (rxboie) receive buffer a complete (rxacif) i bit imask (rxacie) receive buffer b complete (rxbcif) i bit imask (rxbcie) mii management transfer complete (mmcif) i bit  imask (mmcie) late collision (lcif) i bit imask (lcie) excessive collision (ecif) i bit imask (ecie) frame transmission complete (txcif) i bit imask (txcie)

 chapter 11 ethernet media access controller (emacv1) mc9s12ne64 data sheet, rev. 1.1 346 freescale semiconductor

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 347 chapter 12 ethernet physical transceiver (ephyv2) 12.1 introduction the ethernet physical transceiver (ephy) is an ieee 802.3 compliant 10base-t/100base-tx ethernet phy transceiver. the ephy module supports both the medium-independent interface (mii) and the mii management interface. the ephy requires a 25-mhz crystal for its basic operation. 12.1.1 features  ieee 802.3 compliant  full-/half-duplex support in all modes  medium-independent interface (mii), which has these characteristics:  capable of supporting both 10 mbps and 100 mbps data rates  data and delimiters are synchronous to clock references  provides independent four-bit wide transmit and receive data paths  provides a simple management interface  supports auto-negotiation  auto-negotiation next page ability  single rj45 connection  1:1 common transformer  baseline wander correction  digital adaptive equalization  integrated wave-shaping circuitry  far-end fault detect  mdc rates up to 25 mhz  supports mdio preamble suppression  jumbo packet  2.5 v cmos  2.5 v mii interface  125 mhz clock generator and timing recovery  loopback modes

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 348 freescale semiconductor 12.1.2 block diagram . figure 12-1. ethernet physical transceiver (ephy) block diagram mii interface ip bus registers ip bus signals mii_txclk mii_txen mii_txd[3:0] mii_txer mii_crs mii_col mii_rxclk mii_rxdv mii_rxd[3:0] mii_rxer mii_mdio mii_mdc phy_txp phy_txn phy_rxp phy_rxn phy_rbias ref clock phy sub block

 external signal descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 349 figure 12-2. phy sub block diagram 12.2 external signal descriptions this section contains the ephy external pin descriptions. 12.2.1 phy_txp ?ephy twisted pair output + ethernet twisted-pair output pin. this pin is high-impedance out of reset. 12.2.2 phy_txn ?ephy twisted pair output  ethernet twisted-pair output pin. this pin is high-impedance out of reset. 12.2.3 phy_rxp ?ephy twisted pair input + ethernet twisted-pair input pin. this pin is high-impedance out of reset. clock recovery manchester decode polarity correction squelch link detect 10base-t receiver 100base-tx receiver mlt-3 decode descrambler 4b/5b decode 4b / 5b encode manchester encoder digital wave shaping scrambler mlt-3 encode 10base-t  pll 100base-tx  pll voltage/ current references collision carrier sense auto negotiate 10base-t driver vga control (coarse equalizer) digital equalizer slicer timing control blw control 100base-tx driver management (mii) configuration registers 100base-tx loopback 100base-tx dig loop b 10base-t dig loop b mii loopback mii rxp rxn txp txn rbias ref clock mdio mii connections

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 350 freescale semiconductor 12.2.4 phy_rxn ?ephy twisted pair input  ethernet twisted-pair input pin. this pin is high-impedance out of reset. 12.2.5 phy_rbias ?ephy bias control resistor connect a 1.0% external resistor, rbias (see electrical characteristics chapter), between the phy_rbias pin and analog ground. place this resistor as near to the chip pin as possible. stray capacitance must be kept to less than 10 pf (>50 pf will cause instability). no high-speed signals are permitted in the region of rbias. 12.2.6 phy_vddrx, phy_vssrx  power supply pins for ephy receiver power is supplied to the ephy receiver through phy_vddrx and phy_vssrx. this 2.5 v supply is derived from the internal voltage regulator. there is no static load on those pins allowed. the internal voltage regulator is turned off, if v ddr  is tied to ground. 12.2.7 phy_vddtx, phy_vsstx ?power supply pins for ephy transmitter external power is supplied to the ephy transmitter through phy_vddtx and phy_vsstx. this 2.5 v supply is derived from the internal voltage regulator. there is no static load on those pins allowed. the internal voltage regulator is turned off, if v ddr  is tied to ground. 12.2.8 phy_vdda, phy_vssa ?power supply pins for ephy analog power is supplied to the ephy plls through phy_vdda and phy_vssa. this 2.5 v supply is derived from the internal voltage regulator. there is no static load on those pins allowed. the internal voltage regulator is turned off, if v ddr  is tied to ground. 12.2.9 colled ?collision led flashes in half-duplex mode when a collision occurs on the network if ephyctl0 leden bit is set. 12.2.10 dupled ?duplex led indicates the duplex of the link, which can be full-duplex or half-duplex if ephyctl0 leden bit is set. 12.2.11 spdled ?speed led indicates the speed of a link, which can be 10 mbps or 100 mbps if ephyctl0 leden bit is set. 12.2.12 lnkled ?link led indicates whether a link is established with another network device if ephyctl0 leden bit is set.

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 351 12.2.13 actlec ?activity led flashes when data is received by the device if ephyctl0 leden bit is set. 12.3 memory map and register descriptions this section provides a detailed description of all registers accessible in the ephy. 12.3.1 module memory map table 12-1 gives an overview of all registers in the ephy memory map. the ephy occupies 48 bytes in the memory space. the register address results from the addition of base address and address offset. the base address  is determined at the mcu level. the address offset  is de?ed at the module level. table 12-1. ephy module memory map 12.3.2 register descriptions 12.3.2.1 ethernet physical transceiver control register 0 (ephyctl0) figure 12-3. ethernet physical transceiver control register 0 (ephyctl0) read: anytime write: see each bit description ephyen ?ephy enable this bit can be written anytime. 1 = enables ephy 0 = disables ephy address offset use access $__00 ethernet physical transceiver control register 0 (ephyctl0) r/w $__01 ethernet physical transceiver control register 1 (ephyctl1) r/w $__02 ethernet physical transceiver status register (ephysr) r/w $__03 reserved r module base + $0 7 6 5 4 3 2 1 0 r ephyen andis dis100 dis10 leden ephywai 0 ephyien w reset: 0 1 1 1 0 0 0 0 = unimplemented or reserved

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 352 freescale semiconductor andis ?auto negotiation disable this bit can be written anytime, but the value is latched in the ane bit of the mii phy control register (mii address 0.12) only when the ephyen bit transitions from 0 to 1. 1 = auto negotiation is disabled after start-up. a 0 is latched in the ane bit of the mii phy control register (mii address 0.12), and upon completion of the start-up delay (t start-up ), the ephy will bypass auto-negotiation. the mode of operation will be determined by the manual setting of mii registers. 0 = auto negotiation is enabled after start-up. a 1 is latched in the ane bit of the mii phy control register (mii address 0.12), and upon completion of the start-up delay (t start-up ), the ephy will enter auto-negotiation. the mode of operation will be automatically determined. dis100 ?disable 100 base-tx pll this bit can be written anytime. allows user to power down the clock generation pll for 100base-tx clocks. 1 = disables 100base-tx pll 0 = 100base-tx pll state determined by ephy operation mode dis10 ?disable 10base-t pll this bit can be written anytime. allows user to power down the clock generation pll for 10base-t clocks. 1 = disables 10base-t pll 0 = 10 base-t pll state determined by ephy operation mode leden ?led drive enable this bit can be written anytime. 1 = enables the ephy to drive led signals. 0 = disables the ephy to drive led signals. ephywai ?ephy module stops while in wait this bit can be written anytime. 1 = disables the ephy module while the mcu is in wait mode. ephy interrupts cannot be used to bring the mcu out of wait. 0 = allows the ephy module to continue running during wait. ephyien ?ephy interrupt enable this bit can be written anytime. 1 = enables ephy module interrupts 0 = disables ephy module interrupts 12.3.2.2 ethernet physical transceiver control register 1 (ephyctl1) figure 12-4. ethernet physical transceiver control register 1 (ephyctl1) module base + $1 7 6 5 4 3 2 1 0 r 0 0 0 phyadd4 phyadd3 phyadd2 phyadd1 phyadd0 w reset: 0 0 0 0 0 0 0 0 = unimplemented or reserved

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 353 read: anytime write: see each bit description phyadd[4:0] ?ephy address for mii requests these bits can be written anytime, but the ephy address is latched to the mii phy address register (mii address 21.4:0) only when the ephyen bit transitions from 0 to 1. phyadd4 is the msb of the of the ephy address. 12.3.2.3 ethernet physical transceiver status register (ephysr) figure 12-5. ethernet physical transceiver status register (ephysr) read: anytime write: see bit descriptions 100dis ?ephy port 100base-tx mode status this bit is not writable ?read only. output to indicate ephy port base100-tx mode status. 1 = ephy port 100base-tx disabled 0 = ephy port 100base-tx enabled 10dis ?ephy port 10base-t mode status this bit is not writable. output to indicate ephy port 10base-t mode status. 1 = ephy port 10base-t disabled 0 = ephy port 10base-t enabled ephyif ?ephy interrupt flag ephyif indicates that interrupt conditions have occurred. to clear the interrupt flag, write a 1 to this bit after reading the interrupt control register via the mii management interface. 1 = ephy interrupt has occurred 0 = ephy interrupt has not occurred module base + $2 7 6 5 4 3 2 1 0 r 0 0 100dis 10dis 0 0 0 ephyif w reset: 0 0 1 1 0 0 0 0 = unimplemented or reserved

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 354 freescale semiconductor 12.3.3 mii registers table 12-2  gives an overview of all registers in the ephy that are accessible via the mii management interface. these registers are not part of the mcu memory map. 1. always read $00 2. writable only in special modes (test_mode = 1) 4. write has no effect. note bit notation for mii registers is: bit 20.15 refers to mii register address 20 and bit number 15. 12.3.3.1 ephy control register figure 12-6. control register read: anytime write: anytime table 12-2. mii registers address use access 0 %00000 control register read/write 1 %00001 status register read/write 4 2 %00010 phy identi?ation register 1 read/write 4 3 %00011 phy identi?ation register 2 read/write 4 4 %00100 auto-negotiation advertisement register read/write 5 %00101 auto-negotiation link partner ability register read/write 4 6 %00110 auto-negotiation expansion register read/write 4 7 %00111 auto-negotiation next page transmit read/write 8 %01000 reserved read/write 1 9 %01001 reserved read/write 1 10 %01010 reserved read/write 1 11 %01011 reserved read/write 1 12 %01100 reserved read/write 1 13 %01101 reserved read/write 1 14 %01110 reserved read/write 1 15 %01111 reserved read/write 1 16 %10000 interrupt control register read/write 17 %10001 proprietary status register read/write 4 18 %10010 proprietary control register read/write mii register address 0 (%00000) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r reset loop back data rate ane pdwn isol ran dplx col test 0 0 0 0 0 0 0 w reset: 0 0 1 x 0 0 0 1 0 0 0 0 0 0 0 0 = unimplemented or reserved

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 355 reset ?ephy reset resetting a port is accomplished by setting this bit to 1. 1 = the phy will reset the port? status and registers to the default values. the phy will also reset the phy to its initial state. after the reset is complete, the phy clears this bit automatically. the reset process will be completed within 1.3 ms of this bit being set. while the preamble is suppressed, the management interface must not receive an st within three mdc clock cycles following a software reset. 0 = no effect loopback ?digital loopback mode determines digital loopback mode 1 = enables digital loopback mode. port will be placed in loopback mode. loopback mode will allow the txd data to be sent to the rxd data circuitry within 512 bit times. the phy will be isolated from the medium (no transmit or receive to the medium allowed) and the mii_col signal will remain de-asserted, unless this bit is set. 0 = disables digital loopback mode datarate ?speed selection the link speed will be selected either through the auto-negotiation process or by manual speed selection. ane allows manual speed selection while it is set to 0. while auto-negotiation is enabled, datarate can be read or written but its value is not required to reflect speed of the link. 1 = while auto-negotiation is disabled, selects 100 mbps operation 0 = while auto-negotiation is disabled, selects 10 mbps operation ane ?auto-negotiation enable the ane bit determines whether the a/n process is enabled. when auto-negotiation is disabled, datarate and dplx determine the link configuration. while auto-negotiation is enabled, bits datarate and dplx do not affect the link. 1 = enables auto-negotiation 0 = disables auto-negotiation pdwn ?power down when this bit is set, the port is placed in a low power consumption mode. 1 = port is placed in a low power consumption mode. normal operation will be allowed within 0.5 s after pdwn and isol are changed to 0. during a transition to power-down mode (or if already in power down mode), the port will respond only to management function requests through the mi interface. all other port operations will be disabled. when power-down mode is exited, all register values are maintained. the port will start its operation based on the register values. 0 =  normal operation isol ?isolate 1 = isolates the port? data path signals from the mii. the port will not respond to changes on mii_txdx, mii_txen, and mii_txer inputs, and it will present high impedance on mii_txclk, mii_rxclk, mii_rxdv, mii_rxer, mii_rxdx, mii_col, and mii_crs outputs. the port will respond to management transactions while in isolate mode. 0 = normal operation

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 356 freescale semiconductor ran ?restart auto-negotiation the ran bit determines when the a/n process can start processing. 1 = when auto-negotiation is enabled (ane=1), the auto-negotiation process will be restarted. after auto-negotiation indicates that it has been initialized, this bit is cleared. when bit ane is cleared to indicate auto-negotiation is disabled, ran must also be 0. 0 = normal operation. dplx ?duplex mode this mode can be selected by either the auto-negotiation process or manual duplex selection. manual duplex selection is allowed only while the auto-negotiation process is disabled (ane=0). while the auto-negotiation process is enabled (ane = 1), the state of dplx has no effect on the link configuration. while loopback mode is asserted (loopback =1), the value of dplx will have no effect on the phy. 1 = indicates full-duplex mode 0 = indicates half-duplex mode coltest ?collision test the collision test function will be enabled only if the loopback mode of operation is also selected (loopback = 1). 1 = forces the phy to assert the mii_col signal within 512 bit times from the assertion of mii_txen and de-assert mii_col within 4 bit times of mii_txen being de-asserted. 0 = normal operation 12.3.3.2 status register this register advertises the capabilities of the port to the mii. figure 12-7. status register read: anytime write: writes have no effect 100t4 ?00base-t4 1 = indicates phy supports 100base-t4 transmission 0 = indicates the phy does not support 100base-t4 transmission this function is not implemented in the ephy module. 100xfd ?00base-tx full-duplex 1 = indicates phy supports 100base-tx full-duplex mode 0 = indicates phy does not support 100base-tx full-duplex mode mii register address 1 (%00001) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r 100 t4 100x fd 100x hd 10t fd 10t hd 0 0 0 0 sup pre an comp rem flt an abl lnk stst jab dt ex cap w reset: 0 1 1 1 1 0 0 0 0 1 0 0 1 0 0 1 = unimplemented or reserved

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 357 100xhd ?00base-tx half-duplex 1 = indicates the phy supports 100base-tx half-duplex mode 0 = indicates the phy does not support 100base-tx half-duplex mode 10tfd ?0base-t full-duplex 1 = indicates the phy supports 10base-t full-duplex mode 0 = indicates the phy does not support 10base-t full-duplex mode 10thd ?0base-t half-duplex 1 = indicates the phy supports 10base-t half-duplex mode 0 = indicates the phy does not support 10base-t half-duplex mode suppre ?f preamble suppression 1 = indicates that management frames are not required to contain the preamble stream 0 = indicates that management frames are required to contain the preamble stream ancomp ?uto-negotiation complete to inform the management interface (mi) that it has completed processing, ancomp is set by the a/n process. after it has been started, the auto-negotiation process uses link code words to exchange capability information and establish the highest common denominator (hcd) for link transactions. 1 = indicates that the auto-negotiation process has completed and that the contents of registers 4 through 7 are valid. 0 = indicates that the auto-negotiation process has not completed and that the contents of registers 4 through 7 are not valid remflt ?remote fault possible remote faults (rf) a) the link partner transmits the rf bit (5.13=1) b) link partner protocol is not 00001 (5.4:0) c) link partner advertises only t4 capability (5.9:5) d) no common operation mode found between phy and the link partner. after it is set, remflt is cleared each time register 1 is read via the management interface. remflt is also cleared by a phy reset. 1 = indicates that a remote fault condition has been detected. 0 = no fault detected anabl ?auto-negotiation ability 1 = indicates that phy has auto-negotiation ability 0 = indicates that phy does not have auto-negotiation ability lnkstst ?link status the phy sets this bit when it determines that a valid link has been established. the occurrence of a link failure will cause lnkstst to be cleared. after it has been cleared, it remains cleared until it is read via the management interface. 1 = indicates a valid link has been established 0 = indicates a valid link has not been established

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 358 freescale semiconductor jabdt ?abber detect after it is set, jabdt is cleared each time register 1 is read via the management interface. jabdt is also cleared by a phy reset. for 100base-tx operation, this signal will always be cleared. 1 = indicates that a jabber condition has been detected 0 = indicates that no jabber condition has been detected excap ?extended capability 1 = indicates that the extended register set (registers 2?1) has been implemented in the phy. 0 = indicates that the extended register set (registers 2?1) has not been implemented in the phy 12.3.3.3 ephy identi?r register 1 registers $_02 and $_03 provide the phy identi?ation code. figure 12-8. ephy identi?r register 1 read: anytime write: writes have no effect ?read only phyid ?phy id number composed of bits 3:18 of the organization unique identifier (oui). 12.3.3.4 ephy identi?r register 2 registers $_02 and $_03 provide the phy identi?ation code. figure 12-9. ephy identi?r register 2 read: anytime write: writes have no effect ?read only phyid ?phy id number organization unique identifier. composed of bits 15:10. modelnumber ?manufacturers model number. composed of bits 9:4. revisionnumber ?manufacturers revision number. composed of bits 3:0. mii register address 2 (%00010) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r phyid w reset: 0 0 0 0 01 0 0 0 0 0 1 0 1 1 0 0 = unimplemented or reserved mii register address 3 (%00011) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r phyid modelnumber revisionnumber w reset: 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 = unimplemented or reserved

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 359 12.3.3.5 auto-negotiate (a/n) advertisement register the auto-negotiation (a/n) process requires four registers to communicate link information with its link partner: a/n advertisement register (mii register 4), a/n link partner ability register (mii register 5), a/n expansion register (mii register 6), and the a/n next page transmit register (mii register 7). figure 12-10  shows the contents of the a/n advertisement register. on power-up, before a/n starts, the register sets the selector ?ld, bits 4.4:0, to 00001 to indicate that it is ieee standard 802.3 compliant. the technology ability ?lds (4.9:5) are set according to the values in the mii status register (1.15:11). the mi can set the technology ability ?ld bits before renegotiations to allow management to auto-negotiate to an alternate common mode. figure 12-10. auto negotiate advertisement register read: anytime write: never nxtp ?next page 1 = capable of sending next pages 0 = not capable of sending next pages rflt ?remote fault 1 = remote fault 0 = no remote fault flctl ?flow control 1 = advertise implementation of the optional mac control sublayer and pause function as specified in ieee standard clause 31 and anex 31b of 802.3. setting flctl has no effect except to set the corresponding bit in the flp stream 0 = no mac-based flow control taf100fd ?100base-tx full-duplex 1 = 100base-tx full -duplex capable 0 = not 100base-tx full-duplex capable taf100hd ?100base-tx half-duplex 1 = 100base-tx half-duplex capable 0 = not 100base-tx half-duplex capable taf10fd ?10base-t full-duplex 1 = 10base-t full-duplex capable 0 = not 10base-t full-duplex capable mii register address 4 (%00100) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r nxtp 0 rflt 0 0 flctl 0 taf 100fd taf 100hd taf 10fd taf 10hd selectorfield[4:0] w reset: 1 0 0 0 0 0 0 1 1 1 1 0 0 0 0 1 = unimplemented or reserved

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 360 freescale semiconductor taf10hd ?10base-t half-duplex 1 = 10base-t half-duplex capable 0 = not 10base-t half-duplex capable 12.3.3.6 auto negotiation link partner ability (base page) figure 12-11  shows the contents of the a/n link partner ability register. the register can only be read by the mi and will be written by the auto-negotiation process when it receives a link code word advertising the capabilities of the link partner. this register has a dual purpose: exchange of base page information as shown in figure 12-11 , and exchange of next page information as shown in figure 12-12 . figure 12-11. auto negotiation link partner ability register (base page) read: write: nxtp ?next page 1 = link partner capable of sending next pages 0 = link partner not capable of sending next pages ack ?acknowledge 1 = link partner has received link code word 0 = link partner has not received link code word rflt ?remote fault 1 = remote fault 0 = no remote fault flctl ?flow control 1 = advertises implementation of the optional mac control sublayer and pause function as specified in ieee standard clause 31 and anex 31b of 802.3. setting flctl has no effect on the phy. 0 = no mac-based flow control taf100t4 ?100base-t4 full-duplex 1 = link partner is 100base-t4 capable 0 = link partner is not 100base-t4 capable this function is not implemented in the ephy. taf100fd ?100base-tx full-duplex 1 = link partner is 100base-tx full-duplex capable 0 = link partner is not 100base-tx full-duplex capable mii register address 5 (%00101) (base page) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r nxtp ack rflt taf[1:0] fctl taf 100t4 taf 100fd taf 100hd taf 10fd taf 10hd selectorfield[4:0] w reset: x x x x x x x x x x x x x x x x = unimplemented or reserved

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 361 taf100hd ?100base-tx half-duplex 1 = link partner is 100base-tx half-duplex capable 0 = link partner is not 100base-tx half-duplex capable taf10fd ?10base-t full-duplex 1 = link partner is10base-t full-duplex capable 0 = link partner is not 10base-t full-duplex capable taf10hd ?10base-t half-duplex 1 = link partner is 10base-t half-duplex capable 0 = link partner is not 10base-t half-duplex capable 12.3.3.7 auto negotiation link partner ability (next page) figure 12-12. auto negotiation link partner ability register (next page) read: anytime write: see each ?ld description nxtp ?next page 1 = additional next pages will follow 0 = last page transmitted ack ?acknowledge ack is used to acknowledge receipt of information. 1 = link partner has received link code word 0 = link partner has not received link code word msgp ?message page 1 = message page 0 = unformatted page ack2   ?acknowledge 2 ack2 is used to indicate that the receiver is able to act on the information (or perform the task) defined in the message. 1 = receiver is able to perform the task defined in the message 0 = receiver is unable to perform the task defined in the message tgl ?toggle 1 = previous value of the transmitted link code word equalled 0 0 = previous value of the transmitted link code word equalled 1 mii register address 5 (%00101) (next page) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r nxtp ack msgp ack2 tgl message/unformatted code field [10:0] w reset: x x x x x x x x x x x x x x x x = unimplemented or reserved

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 362 freescale semiconductor message/unformatted code field message code field ?predefined code fields defined in ieee 802.3u-1995 annex 28c unformatted code filed  11-bit field containing an arbitrary value 12.3.3.8 auto-negotiation expansion register figure 12-13 shows the contents of the a/n expansion register. the mi process can only read this register. this register contains information about the a/n capabilities of the ports link partner and information on the status of the parallel detection mechanism. figure 12-13. auto-negotiation expansion register read: anytime write: never pdflt ?parallel detection fault this bit is used to indicate that zero or more than one of the nlp receive link integrity test function for 100base-tx have indicated that the link is ready (link_status=ready) when the a/n wait timer has expired. pdflt will be reset to 0 after a read of register 6. 1 = parallel detection fault has occurred 0 = parallel detection fault has not occurred lpnpa ?link partner next page able bit to indicate whether the link partner has the capability of using np. 1 = link partner is next page able 0 = link partner is not next page able nxtpa ?next page able this bit is used to inform the mi and the link partner whether the port has next page capabilities. 1 = the port has next page capabilities 0 = the port does not have next page capabilities prcvd ?page received bit is used to indicate whether a new link code word has been received and stored in the a/n link partner ability register (mii register 5). prcvd is reset to 0 after register 6 is read. 1 = three identical and consecutive link code words have been received from link partner 0 = three identical and consecutive link code words have not been received from link partner mii register address 6 (%00110) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r 0 0 0 0 0 0 0 0 0 0 0 pdflt lpnpa nxtpa prcvd lpana w reset: 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 = unimplemented or reserved

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 363 lpana ?link partner a/n able indicates whether the link partner has a/n capabilities. 1 = link partner is a/n able 0 = link partner is not a/n able 12.3.3.9 auto negotiation next page transmit figure 12-14 shows the contents of the a/n next page transmit register. the mi writes to this register if it needs to exchange more information with the link partner. the phy defaults to sending only a null message page to the link partner unless the sta overrides the values in the register. next pages will be transmitted until the link partner has no more pages to transmit and bit 7.15 has been cleared by the sta. figure 12-14. auto negotiation next page transmit register read: anytime write: never nxtp ?next page 1 = additional next pages will follow 0 = last page to transmit msgp ?message page 1 = message page 0 = unformatted page ack2   ?acknowledge 2 ack2 is used to indicate that the receiver is able to act on the information (or perform the task) defined in the message. 1 = receiver is able to perform the task defined in the message 0 = receiver is unable to perform the task defined in the message tgl ?toggle 1 = previous value of the transmitted link code word equalled 0 0 = previous value of the transmitted link code word equalled 1 message/unformatted code field message code field ?predefined code fields defined in ieee 802.3u-1995 annex 28c unformatted code field ?eleven bit field containing an arbitrary value mii register address 7 (%00111) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r nxtp 0 msgp ack2 tgl message/unformatted code field [10:0] w reset: 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 = unimplemented or reserved

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 364 freescale semiconductor 12.3.4 phy-speci? registers phy also contains a number of registers to set its internal mode of operation. these registers can be set through the external management interface to determine capabilities such as speed, test-mode, circuit bypass mode, interrupt setting, etc. the phy register set includes registers 16 through 29. these registers are not part of the mcu memory map. 12.3.4.1 interrupt control register figure 12-15. interrupt control register read: anytime write: anytime ackie ?acknowledge bit received interrupt enable 1 = enable interrupt when the acknowledge bit is received from the link partner 0 = disable interrupt when acknowledge bit is received prie ?page received int enable 1 = enable interrupt when a new page is received 0 = disable interrupt when a page is received lcie ?link changed enable 1 = enable interrupt when the link status changes 0 = disable interrupt when the link status changes anie ?auto-negotiation changed enable 1 = enable interrupt when the state of the auto-negotiation state machine has changed since the last access of this register 0 = disable interrupt when the state of the auto-negotiation state machine has changed since the last access of this register pdfie ?parallel detect fault enable 1 = enable interrupt on a parallel detect fault 0 = disable interrupt on a parallel detect fault rfie ?remote fault interrupt enable 1 = enable interrupt on a parallel detect fault 0 = disable interrupt on a parallel detect fault jabie ?jabber interrupt enable 1 = enable setting interrupt on detection of a jabber condition 0 = disable setting interrupt on detection of a jabber condition mii register address 16 (%10000) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r 0 ackie prie lcie anie pdfie rfie jabie 0 ackr pgr lkc anc pdf rmtf jabi w reset: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = unimplemented or reserved

 memory map and register descriptions mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 365 ackr ?acknowledge bit received 1 = acknowledge bit has been received from the link partner 0 = acknowledge bit has not been received since the last access of this register. (ack bit 14 of the auto-negotiation link partner ability register was set by receipt of link code word) pgr ?page received 1 = a new page has been received from the link partner 0 = a new page has not been received from the link partner since the last access of this register (bit 1 was set by a page received event) lkc ?link changed 1 = the link status has changed since the last access of this register 0 = the link status has not changed since the last access of this register. (lnk bit 14 of the proprietary status register was changed) anc ?auto-negotiation changed 1 = the auto-negotiation status has changed since the last access of this register 0 = the auto-negotiation status has not changed since the last access of this register pdf ?parallel detect fault 1 = a parallel-detect fault has occurred since the last access of this register 0 = a parallel-detect fault has not been detected since the last access of this register. (bit 4 was set by rising edge of parallel detection fault) rmtf ?remote fault 1 = a remote fault condition has been detected since the last access of this register 0 = a remote fault condition has not been detected since the last access of this register. (rmtf bit 4 of the status register was set by rising edge of a remote fault) jabi ?jabber interrupt 1 = a jabber condition has been detected since the last access of this register 0 = a jabber condition has not been detected since the last access of this register (jabd bit 1 of the status register was set by rising edge of jabber condition) 12.3.4.2 proprietary status register figure 12-16.  proprietary status register read: anytime write: mii register address 17 (%10001) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r 0 lnk dpmd spd 0 annc prcvd anc mode 0 0 plr 0 0 0 0 0 w reset: 0 1 1 1 0 0 0 (1) 0 0 0 0 0 0 0 0 = unimplemented or reserved

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 366 freescale semiconductor lnk ?link status this is a duplicate of lnkstat bit 2 of the status register (1.2). 1 = link is down 0 = link is up dpmd ?duplex mode 1 = full-duplex 0 = half-duplex spd ?speed 1 = 100 mbps 0 = 10 mbps annc ?auto-negotiation complete this is a duplicate of ancomp bit 5 of the status register (1.5) 1 = a-n complete 0 = a-n not complete prcvd ?page received 1 = three identical and consecutive link code words have been received 0 = three identical and consecutive link code words have not been received ancmode ?auto-negotiation (a-n) common operating mode this bit is only valid while the annc bit 10 is 1 1 = a common operation mode was not found 0 = a-n is complete and a common operation mode has been found plr ?polarity reversed (10base-t) 1 = 10base-t receive polarity is reversed 0 = 10base-t receive polarity is normal 12.3.4.3 proprietary control register figure 12-17. proprietary control register the miscellaneous (emisc) register provides visibility of internal counters used by the emac. read: anytime write: anytime mii register address 18 (%10010) 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 r 0 fe fltd miilbd 0 1 jbde lnk tstd pol cord algd enc byp scr byp trd analb tr tst 0 0 0 w reset: 0 0 1 0 1 1 0 0 0 0 0 0 0 0 0 0 = unimplemented or reserved

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 367 fefltd ?far end fault disable 1 = far end fault detect is disabled 0 = far end fault detect on receive and transmit is enabled. this applies only while auto-negotiation is disabled miilbo ?mii loopback disable 1 = disable mii loopback 0 = mii transmit data is looped back to the mii receive pins jbde ?jabber detect enable (10base-t) 1 = enable jabber detection 0 = disable jabber detection lnktstd ?link test disable (10base-t) 1 = disable 10base-t link integrity test 0 = 10base-t link integrity test enabled polcord ?disable polarity correction (10base-t) 1 = 10base-t receive polarity correction is disabled 0 = 10base-t receive polarity is automatically corrected algd ?disable alignment 1 = un-aligned mode. available only in symbol mode 0 = aligned mode encbyp ?encoder bypass 1 = symbol mode and bypass 4b/5b encoder and decoder 0 = normal mode scrbyp ?scrambler bypass mode (100base-tx) 1 = bypass the scrambler and de-scrambler 0 = normal trdanalb ?transmit and receive disconnect and analog loopback 1 = high-impedance twisted pair transmitter. analog loopback mode overrides and forces this bit 0 = normal operation trtst ?transmit and receive test (100base-tx) 1 = transmit and receive data regardless of link status 0 = normal operation 12.4 functional description the ephy is an ieee 802.3 compliant 10/100 ethernet physical transceiver. the ephy can be con?ured to support 10base-t or 100base-tx applications. the ephy is con?urable via internal registers which are accessible through the mii management interface as well as limited con?urability using the ephy register map. there are ve basic modes of operation for the ephy:  power down/initialization  auto-negotiate

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 368 freescale semiconductor  10base-t  100base-tx  low-power 12.4.1 power down/initialization upon reset, the ephyen bit, in the ethernet physical transceiver control register 0 (ephyctl0), is cleared and ephy is in its lowest power consumption state. all analog circuits are powered down. the twisted-pair transmitter and receiver pins (phy_txp, phy_txn, phy_rxp, and phy_rxn) are high-impedance. the mii management interface is not accessible. all mii registers are initialized to their reset state. the andis, dis100, and dis10 bits, in the ephyctl0 register, have no effect until the ephyen bit is set. the ephyen bit can be set or cleared by a register write at any time. prior to enabling the ephy, setting ephyen to 1, the mii phy address phyadd[4:0] must be set in the ethernet physical transceiver control register 1 (ephyctl1), and the andis, dis100, dis10 bits, in the ephyctl0 register, must be con?ured for the desired start-up operation. whenever the ephyen bit transitions from 0 to 1, mdio communications must be delayed until the completion of a start-up delay period (t start-up , see figure 12-19 ).

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 369 figure 12-18. ephy start-up / initialization sequence figure 12-19. ephy start-up delay reset or ephyen=0 set phyadd[4:0], and  andis, dis100, dis10 delay for t start-up configure mii registers via mdio initialization complete set ephyen=1 phyadd[4:0] and andis become latched in mii registers ephyen t start-up mdio

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 370 freescale semiconductor if the auto-negotiation mode of operation is desired, the andis bit in the ephyctl0 must be set to 0 and the dis100 and dis10 bits must be cleared prior to setting ephyen to 1. refer to section 12.4.2, auto-negotiation,  for more information on auto-negotiation operation. if the mode of operation will be set manually, the andis bit must be set to 1 in the ephyctl0 register and the dis100 and dis10 bits must be cleared prior to setting ephyen to 1. after the ephyen bit has been set and the start-up delay period is completed, the mode of operation can be con?ured through the mii registers. table 12-3  summarizes the mii register con?uration and operational modes. 12.4.2 auto-negotiation auto-negotiation is used to determine the capabilities of the link partner. auto-negotiation is compliant with ieee 802.3 clause 28. in this case, the phy will transmit fast link pulse (flp) bursts to share its capabilities with the link partner. if the link partner is also capable of performing auto-negotiation, it will also send flp bursts. the information shared through the flp bursts will allow both link partners to ?d the highest common mode (if it exists). if no common mode is found, the remote fault bit (1.4) will be set. a remote fault is de?ed as a condition in which the phy and the link partner cannot establish a common operating mode. con?uring auto-negotiation advertisement register sets the different auto-negotiation advertisement modes. if the link partner does not support auto-negotiation, it will transmit either normal link pulses (nlp) for 10 mbps operation, or 100 mbps idle symbols. based on the received signal, the phy determines whether the link partner is 10 mbps capable or 100 mbps capable. the ability to do this is called parallel detection. if using parallel detection, the link will be con?ured as a half-duplex link. after parallel detection has established the link con?uration, the remote fault bit will be set if the operating mode does not match the pre-set operating modes. table 12-3. operational con?uration while auto-negotiation is disabled 1 1 symbol mode is not supported. bit 0.12 auto neg. bit 0.13 data rate bit 0.8 duplex bit 18.6 encoder bypass bit 18.5 scrambler bypass bit 18.7 symbol unalign operation 0 0 1 x x x 10base-t full-duplex 0 0 0 x x x 10base-t half-duplex 0 1 1 0 0 0 100base-tx full-duplex 0 1 1 1 0 0 100base-tx full-duplex with encoder bypass (symbol mode) ?aligned 0 1 1 1 0 1 100base-tx full-duplex with encoder bypass (symbol mode) ?unaligned 0 1 1 1 1 0 100base-tx full-duplex with scrambler and encoder bypassed (symbol mode), aligned 0 1 1 1 1 1 100base-tx full-duplex with scrambler and encoder bypassed (symbol mode), unaligned 0 1 0 0 0 0 100base-tx half-duplex

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 371 figure 12-20  shows the main blocks used in the auto-negotiation function. the transmit block allows transmission of fast link pulses to establish communications with partners that are auto-negotiation able. the receive block determines the capabilities of the link partner and writes to the link partner ability register (register 5). the arbitration block determines the highest common mode of operation to establish the link. figure 12-20. auto-negotiation 12.4.3 10base-t the 10base-t interface implements the physical layer speci?ation for a 10 mbps over two pairs of twisted-pair cables. the speci?ations are given in clause 14 of the ieee 802.3 standard. in 10base-t mode, manchester encoding is used. when transmitting, nibbles from the mii are converted to a serial bit stream and then manchester encoded. when receiving, the manchester encoded bit stream is decoded and converted to nibbles for presentation to the mii. complete_ack transmit_ability transmit_ack transmit_disable ?_link_good ack_?ished ?_receive_idle match_wo_ack match_w_ack receive_done ?_link_good transmit arbitration receive mr_adv_ability[3:0] mr_adv_ability[15:0] mr_lp_adv_ability[3:0] mr_lp_adv_ability[15:0] nlp receive link integrity test tx_link_control[1:0] 1 2 1 2 lp_link_status[1:0] lp_link_control[1:0] tx_link_status[1:0] linkpulse do rd link_test_receive td_autoneg clk power_on mr_main_reset mr_autoneg_enable mr_autoneg_complete mr_parallel_detection_fault

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 372 freescale semiconductor a 2.5 mhz internal clock is used for nibble wide transactions. a 10 mhz internal clock is used for serial transactions. figure 12-21. 10base-t block diagram parallel to serial: converts the 4-bit wide nibbles from the mii to serial format before the information is processed by subsequent blocks. manchester encoder: allows encoding of both the clock and data in one bit stream. a logical one is encoded as a zero when the clock is high and a one when the clock is low. a logical zero is encoded as a one when the clock is high and a zero when the clock is low. digital filter:  performs pre-emphasis and low pass ?tering of the input manchester data. dac:  converts the digital data to an analog format before transmission on the media. carrier sense: in half-duplex operation, carrier is asserted when either the transmit or receive medium is active. in full-duplex operation, carrier asserted only on reception of data. during receive, carrier sense is asserted during reception of a valid preamble, and de-asserted after reception of an eof. loopback: enabled when bit 0.14 is asserted. this loopback mode allows for the manchester encoded and ?tered data to be looped back to the squelch block in the receive path. all the 10base-t digital functions are exercised during this mode. the transmit and receive channels are disconnected from the media. mii loopback (18.13) must be disabled to allow for correct operation of the digital loopback (0.14). link generator: generates a 100 ns duration pulse at the end of every 12 ms period of the transmission path being idle (txen de-asserted). this pulse is used to keep the 10base-t link operational in the absence of data transmission. serial parallel digital to parallel to serial mii mii tx rx manchester encoder filter carrier sense jabber manchester decoder and timing recovery polarity check squelch digital loopback (bit 0.14) phy_txn phy_txp phy_rxn phy_rxp line transmitter/ line receiver

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 373 link integrity test: used to determine whether the 10base-t link is operational. if neither data nor a link pulse is received for 64 ms, then the link is considered down. while the link is down, the transmit, loopback, collision detect, and sqe functions are disabled. the link down state is exited after receiving data or four link pulses. jabber: prevents the transmitter from erroneously transmitting for too long a period. the maximum time the device can transmit is 50,000 bit times. when the jabber timer is exceeded, the transmit output goes idle for 0.525 s. this function can be disabled with the jabber inhibit register bit (18.10). squelch: used to determine whether active data, a link pulse, or an idle condition exists on the 10base-t receive channel. while an idle or link pulse condition exists, a higher squelch level is used for greater noise immunity. the squelch output is used to determine when the manchester decoder should operate. the output is also used to determine when an end of packet is received. polarity check: by examining the polarity of the received link pulses, ephy can determine whether the received signal is inverted. if the pulses are inverted, this function changes the polarity of the signal.this feature is activated if eight inverted link pulses are received or four frames with inverted eof are encountered. manchester decoder and timing recovery: decodes the manchester encoded data. the receive data and clock are recovered during this process. serial to parallel: converts the serial bit stream from the manchester decoder to the required mii parallel format. pmd sublayer: transmits and receives signals compliant with ieee 802.3, section 14. line transmitter and line receiver: these analog blocks allow the ephy to drive and receive data from the 10base-t media. 12.4.4 100base-tx 100base-tx speci?s operation over two pairs of category 5 unshielded twisted-pair cable (utp). the ephy implementation includes the physical coding sublayer (pcs), the physical medium attachment (pma), and the physical medium dependent (pmd) sublayer. the block diagram for 100base-tx operation is shown in figure 12-22 .

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 374 freescale semiconductor figure 12-22. 100base-tx block diagram 12.4.4.1 sublayers 12.4.4.1.1 pcs sublayer the pcs sublayer is the mii interface that provides a uniform interface to the reconciliation sublayer. the services provided by the pcs include:  encoding/decoding of mii data nibbles to/from 5-bit code-groups (4b/5b)  carrier sense and collision indications  serialization/deserialization of code-groups for transmission/reception on the pma  mapping of transmit, receive, carrier sense, and collision detection between the mii and the underlying pma serial to parallel and symbol alignment: this block looks for the occurrence of the jk symbol to align the serial bit stream and convert it to a parallel format. carrier sense: in full-duplex mode, carrier sense is only asserted while the receive channel is active . the carrier sense examines the received data bit stream looking for the ssd, the jk symbol pair. in the idle state, idle symbols (all logic ones) will be received. if the ?st 5-bit symbols received after an idle stream forms the j symbol (11000) it asserts the crs signal. at this point the second symbol is checked to con?m the k symbol (10001). if successful, the following aligned data (symbols) are presented to the 4b/5b decoder. if the jk pair is not con?med, the false carrier detect is asserted and the idle state is re-entered. carrier sense is de-asserted when the esd (end-of-stream) delimiter, the tr symbol pair, is found, or when an idle state is detected. in half-duplex, crs is also asserted on transmit. parallel to serial:  this block takes parallel data and converts it to serial format. tx rx mii 4b5b encoder decoder 4b5b serial to parallel parallel to serial digital loopback (bit 0.14) descrambler scrambler carrier sense decoder mlt3 encoder mlt3 slope control line driver link monitor analog loopback (bit 18.4) equalizer and timing recovery wander baseline pcs pmd and symbol alignment pma pma

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 375 4b/5b encoder/decoder : the 4b/5b encoder converts the 4-bit nibbles from the reconciliation sublayer to a 5-bit code group. 12.4.4.1.2 pma sublayer the pma provides medium-independent means for the pcs and other bit-oriented clients (e.g., repeaters) to support the use of a range of physical media. for 100base-tx the pma performs these functions:  mapping of transmit and receive code-bits between the pmas client and the underlying pmd  generating a control signal indicating the availability of the pmd to a pcs or other client  synchronization with the auto-negotiation function  generating indications of carrier activity and carrier errors from the pmd  recovery of clock from the nrzi data supplied by the pmd 12.4.4.1.3 pmd sublayer for 100base-tx, the ansi x3.263: 199x (tp-pmd) standard is used. these signalling standards, called pmd sublayers, de?e 125 mbps, full-duplex signalling systems that use stp and utp wiring. scrambler/de-scrambler:  the scrambler and de-scrambler used in ephy meet the ansi standard x3.263-1995 fddi tp-pmd. the purpose of the scrambler is to randomize the 125 mbps data on transmission resulting in a reduction of the peak amplitudes in the frequency spectrum. the de-scrambler restores the received 5-bit code groups to their unscrambled values. the scrambler input data (plaintext) is encoded by modulo 2 addition of a key stream to produce a ciphertext bit stream. the key stream is a periodic sequence of 2047 bits generated by the recursive linear function x[n] = x[n-11] + x[n-9] (modulo 2). if not transmitting data, the scrambler encodes and transmits idles. this allows a pattern to use by the de-scrambler to synchronize and decode the scrambled data. the implementation of the scrambler and de-scrambler is as shown in appendix g of the ansi standard x3.263-1995. for test, the scrambler can be bypassed by setting bit 18.5. scrambler bypass mode is a special type of interface for 100base-tx operation that bypasses the scrambler and de-scrambler operation. this mode is typically used for test so that input and output test vectors match. in this mode, idles are not sent and the mac must provide idles. mlt-3 encoder/decoder: an mlt-3 encoder is used in the transmit path to convert nrz bit stream data from the pma sublayer into a three-level code. this encoding results in a reduction in the energy over the critical frequency range. the mlt-3 decoder converts the received three-level code back to an nrz bit stream. baseline wander: the use of the scrambler and mlt-3 encoding can cause long run lengths of 0s and 1s that can produce a dc component. the dc component cannot be transmitted through the isolation transformers and results in baseline wander. baseline wander reduces noise immunity because the base line moves nearer to either the positive or negative signal comparators. to correct for this ephy uses dc

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 376 freescale semiconductor restoration to restore the lost dc component of the recovered digital data to correct the baseline wander problem. timing recovery : the timing recovery block locks onto the incoming data stream, extracts the embedded clock, and presents the data synchronized to the recovered clock. in the event that the receive path is unable to converge to the receive signal, it resets the mse-good (bit 25.15) signal. the clock synthesizer provides a center frequency reference for operation of the clock recovery circuit in the absence of data. adaptive equalizer:  at a data rate of 125 mbps, the cable introduces signi?ant distortion due to high frequency roll off and phase shift. the high frequency loss is mainly due to skin effect, which causes the conductor resistance to rise as the square of the frequency. the adaptive equalizer will compensate for signal amplitude and phase distortion incurred from transmitting with different cable lengths. loopback : if asserted by bit 0.14, data encoded by the mlt3 encoder block is looped back to the mlt3 decoder block while the transmit and receive paths are disconnected from the media. a second loopback mode for 100base-tx is available by setting bit 18.13 (mii loopback) to a logical 1. this loopback mode takes the mii transmit data and loops it directly back to the mii receive pins. again, the transmit and receive paths are disconnected from the media. mii loopback has precedence over the digital loopback if both are enabled at the same time. a third loopback mode is available by setting bit 18.4 high. this analog loopback mode takes the mlt3 encoded data and loops it back through the base line wander and analog receive circuits. line transmitter and line receiver: these analog blocks allow ephy to drive and receive data to/from the 100base-tx media. the transmitter is designed to drive a 100- ?  utp cable. link monitor : the link monitor process is responsible for determining whether the underlying receive channel is providing reliable data. if a failure is found, normal operation will be disabled. as speci?d in the ieee 802.3 standard, the link is operating reliably if a signal is detected for a period of 330  s. far end fault : while the auto-negotiation function is disabled, this function is used to exchange fault information between the phy and the link partner. 12.4.5 low power modes there are several reduced power con?urations available for the ephy. 12.4.5.1 stop mode if the mcu executes a stop instruction, the ephy will be powered down and all internal mii registers reset to their default state. upon exiting stop mode, the ephy will exit the power-down state and latch the values previously written to the ephyctl0 and ephyctl1 registers. the mii registers will have to be re-initialized after the start-up delay (t start-up ) has expired.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 377 12.4.5.2 wait mode if the mcu executes a wait instruction with the ephywai bit set, the ephy will be powered down and all internal mii registers reset to their default state. upon exiting stop mode the ephy will exit the power-down state and latch the values previously written to the ephyctl0 and ephyctl1 registers. the mii registers must be re-initialized after the start-up delay (t start-up ) has expired. 12.4.5.3 mii power down this mode disconnects the phy from the network interface (three-state receiver and driver pins). setting bit 0.11 of the port enters this mode. in this mode, the management interface is accessible but all internal chip functions are in a zero power state. in this mode all analog blocks except the pll clock generator and band gap reference are in low power mode. all digital blocks except the mdio interface and management registers are inactive.

 chapter 12 ethernet physical transceiver (ephyv2) mc9s12ne64 data sheet, rev. 1.1 378 freescale semiconductor

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 379 chapter 13 penta output voltage regulator (vregphyv1) 13.1 introduction 13.1.1 overview block vreg_phy is a penta output voltage regulator providing ve separate 2.5v (typ) supplies differing in the amount of current that can be sourced. the regulator input voltage is 3.3v+/-10% . 13.1.2 features the block vreg_phy includes these distinctive features:  five parallel, linear voltage regulators  bandgap reference  power on reset (por)  low voltage reset (lvr) 13.1.3 modes of operation there are three modes vreg_phy can operate in:  full performance mode (fpm) (cpu is not in stop mode) the regulator is active, providing the nominal supply voltage of 2.5v with full current sourcing capability at all outputs. features lvr (low voltage reset) and por (power-on reset) are available.  reduced power mode (rpm) (cpu is in stop mode) the purpose is to reduce power consumption of the device. the output voltage may degrade to a lower value than in full performance mode, additionally the current sourcing capability is substantially reduced. only the por is available in this mode, lvr are disabled.  shutdown mode controlled by vregen (see device level speci?ation for connectivity of vregen). this mode is characterized by minimum power consumption. the regulator outputs are in a high impedance state, only the por feature is available, lvr is disabled. this mode must be used to disable the chip internal regulator vreg_phy, i.e. to bypass the vreg_phy to use external supplies.

 chapter 13 penta output voltage regulator (vregphyv1) mc9s12ne64 data sheet, rev. 1.1 380 freescale semiconductor 13.1.4 block diagram figure 13-1 shows the function principle of vreg_phy by means of a block diagram. the regulator core reg consists of ?e parallel subblocks, providing ve independent output voltages. figure 13-1. vreg_phy - block diagram lv r por vddr vdd lvi por lvr ctrl vss vddpll vsspll vregen reg reg2 reg1 pin vdda vssa reg: regulator core ctrl: regulator control lvr: low voltage reset por: power-on reset reg3 reg4 reg5 vddaux1 vssaux1 vddaux2 vssaux2 vddaux3 vssaux3 vddraux1 vddraux2 vddraux3

 signal description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 381 13.2 signal description 13.2.1 overview due to the nature of vreg_phy being a voltage regulator providing the chip internal power supply voltages most signals are power supply signals connected to pads.  table 13-1 shows all signals of vreg_phy associated with pins. 13.2.2 detailed signal descriptions check device level speci?ation for connectivity of the signals. 13.2.2.1 vddr,vddraux1,2,3, vss - regulator power inputs signal vddr/vddraux1,2,3 are the power inputs of vreg_phy. all currents sourced into the regulator loads ?w through these pins. a chip external decoupling capacitor (100nf...220nf, x7r ceramic) between vddr/vddraux1,2,3 and vss can smoothen ripple on vddr/vddraux1,2,3. if the regulator shall be bypassed, vddr should be tied to ground. in shutdown mode pin vddr should also be tied to ground on devices without vregen pin. table 13-1. vreg_phy - signal properties name port function reset state pull up vddr   vreg_phy power input (positive supply)   vddraux1   vreg_phy power input (positive supply)   vddraux2   vreg_phy power input (positive supply)   vddraux3   vreg_phy power input (positive supply)   vdda   vreg_phy quiet input (positive supply)   vssa   vreg_phy quiet input (ground)   vdd  vreg_phy primary output (positive supply)    vss  vreg_phy primary output (ground)   vddpll  vreg_phy secondary output (positive supply)   vsspll  vreg_phy secondary output (ground)    vddaux1  vreg_phy third output (positive supply)    vssaux1  vreg_phy third output (ground)   vddaux2  vreg_phy fourth output (positive supply)    vssaux2  vreg_phy fourth output (ground)   vddaux3  vreg_phy ?th output (positive supply)    vssaux3  vreg_phy ?th output (ground)   vregen (optional)  vreg_phy (optional) regulator enable  

 chapter 13 penta output voltage regulator (vregphyv1) mc9s12ne64 data sheet, rev. 1.1 382 freescale semiconductor 13.2.2.2 vdda, vssa - regulator reference supply signals vdda/vssa which are supposed to be relatively quiet are used to supply the analog parts of the regulator. internal precision reference circuits are supplied from these signals. a chip external decoupling capacitor (100nf...220nf, x7r ceramic) between vdda and vssa can further improve the quality of this supply. 13.2.2.3 vdd, vss - regulator output1 (core logic) signals vdd/vss are the primary outputs of vreg_phy that provide the power supply for the core logic. these signals are connected to device pins to allow external decoupling capacitors (100nf...220nf, x7r ceramic). in shutdown mode an external supply at vdd/vss can replace the voltage regulator. 13.2.2.4 vddpll, vsspll - regulator output2 (pll) signals vddpll/vsspll are the secondary outputs of vreg_phy that provide the power supply for the pll and oscillator. these signals are connected to device pins to allow external decoupling capacitors (100nf...220nf, x7r ceramic). in shutdown mode an external supply at vddpll/vsspll can replace the voltage regulator. 13.2.2.5 vddaux1,2,3, vssaux1,2,3 - regulator output3,4,5 signals vddaux1,2,3/vssaux1,2,3 are the auxilliary outputs of vreg_phy. these signals are connected to device pins to allow external decoupling capacitors (100nf...220nf, x7r ceramic). in shutdown mode an external supply at vddaux1,2,3/vssaux1,2,3 can replace the voltage regulator. 13.2.2.6 vregen - optional regulator enable this optional signal is used to shutdown vreg_phy. in that case vdd/vss and vddpll/vsspll  must be provided externally. shutdown mode is entered with vregen being low. if vregen is high, the vreg_phy is either in full performance mode or in reduced power mode. for the connectivity of vregen see device speci?ation. note switching from fpm or rpm to shutdown of vreg_phy and vice versa is not supported while mcu is powered.

 memory map and registers mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 383 13.3 memory map and registers 13.3.1 overview vreg_phy does not contain any cpu accessible registers. 13.4 functional description 13.4.1 general block vreg_phy is a voltage regulator as depicted in figure 13-1. the regulator functional elements are the regulator core (reg), a power-on reset module (por) and a low voltage reset module (lvr). there is also the regulator control block (ctrl) which represents the interface to the digital core logic but also handles the operating modes of vreg_phy. 13.4.2 reg - regulator core vreg_phy, respectively its regulator core has ve parallel, independent regulation loops (reg1 to reg5) that differ only in the amount of current that can be sourced to the connected loads. therefore only reg1, providing the supply at vdd/vss, is explained. the principle is also valid for reg2 to reg5. the regulator is a linear series regulator with a bandgap reference in its full performance mode and a voltage clamp in reduced power mode. all load currents ?w from input vddr or vddraux1,2,3 to vss or vsspll or vssaux1,2,3, the reference circuits are connected to vdda and vssa. 13.4.2.1 full performance mode in full performance mode a fraction of the output voltage (vdd) and the bandgap reference voltage are fed to an operational ampli?r. the ampli?d input voltage difference controls the gate of an output driver which basically is a large nmos transistor connected to the output. 13.4.2.2 reduced power mode in reduced power mode the driver gate is connected to a buffered fraction of the input voltage(vddr). the operational ampli?r and the bandgap are disabled to reduce power consumption.

 chapter 13 penta output voltage regulator (vregphyv1) mc9s12ne64 data sheet, rev. 1.1 384 freescale semiconductor 13.4.3 por - power-on reset this functional block monitors output vdd. if v dd  is below v pord , signal por is high, if it exceeds v pord , the signal goes low. the transition to low forces the cpu in the power-on sequence. due to its role during chip power-up this module must be active in all operating modes of vreg_phy. 13.4.4 lvr - low voltage reset block lvr monitors the primary output voltage v dd . if it drops below the assertion level (v lvra ) signal lvr asserts and when rising above the deassertion level (v lvrd ) signal lvr negates again. the lvr function is available only in full performance mode. 13.4.5 ctrl - regulator control this part contains the register block of vreg_phy and further digital functionality needed to control the operating modes. ctrl also represents the interface to the digital core logic. 13.5 resets 13.5.1 general this section describes how vreg_phy controls the reset of the mcu.the reset values of registers and signals are provided in section 13.3, ?emory map and registers.?possible reset sources are listed in table 13-2. 13.5.2 description of reset operation 13.5.2.1 power-on reset during chip power-up the digital core may not work if its supply voltage v dd  is below the por deassertion level (v pord ). therefore signal por which forces the other blocks of the device into reset is kept high until v dd  exceeds v pord . then por becomes low and the reset generator of the device continues the start-up sequence. the power-on reset is active in all operation modes of vreg_phy. table 13-2. vreg_phy - reset sources reset source local enable power-on reset always active low voltage reset available only in full performance mode

 interrupts mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 385 13.5.2.2 low voltage reset for details on low voltage reset see section section 13.4.4, ?vr - low voltage reset. 13.6 interrupts 13.6.1 general vreg_phy does not generate any interrupts.

 chapter 13 penta output voltage regulator (vregphyv1) mc9s12ne64 data sheet, rev. 1.1 386 freescale semiconductor

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 387 chapter 14 interrupt (intv1) 14.1 introduction this section describes the functionality of the interrupt (int) sub-block of the s12 core platform. a block diagram of the interrupt sub-block is shown in figure 14-1 . figure 14-1. intv1 block diagram the interrupt sub-block decodes the priority of all system exception requests and provides the applicable vector for processing the exception. the int supports i-bit maskable and x-bit maskable interrupts, a non-maskable unimplemented opcode trap, a non-maskable software interrupt (swi) or background debug hprio (optional) int priority decoder vector request interrupts reset flags write data bus hprio vector xmask imask qualified interrupt input registers interrupts and control registers highest priority i-interrupt read data bus wakeup vector address interrupt pending

 chapter 14 interrupt (intv1) mc9s12ne64 data sheet, rev. 1.1 388 freescale semiconductor mode request, and three system reset vector requests. all interrupt related exception requests are managed by the interrupt sub-block (int). 14.1.1 features the int includes these features:  provides two to 122 i-bit maskable interrupt vectors (0xff00?xfff2)  provides one x-bit maskable interrupt vector (0xfff4)  provides a non-maskable software interrupt (swi) or background debug mode request vector (0xfff6)  provides a non-maskable unimplemented opcode trap (trap) vector (0xfff8)  provides three system reset vectors (0xfffa?xfffe) (reset, cmr, and cop)  determines the appropriate vector and drives it onto the address bus at the appropriate time  signals the cpu that interrupts are pending  provides control registers which allow testing of interrupts  provides additional input signals which prevents requests for servicing i and x interrupts  wakes the system from stop or wait mode when an appropriate interrupt occurs or whenever xirq is active, even if xirq is masked  provides asynchronous path for all i and x interrupts, (0xff00?xfff4)  (optional) selects and stores the highest priority i interrupt based on the value written into the hprio register 14.1.2 modes of operation the functionality of the int sub-block in various modes of operation is discussed in the subsections that follow.  normal operation the int operates the same in all normal modes of operation.  special operation interrupts may be tested in special modes through the use of the interrupt test registers.  emulation modes the int operates the same in emulation modes as in normal modes.  low power modes see section 14.4.1, ?ow-power modes , for details 14.2 external signal description most interfacing with the interrupt sub-block is done within the core. however, the interrupt does receive direct input from the multiplexed external bus interface (mebi) sub-block of the core for the irq and xirq pin data.

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 389 14.3 memory map and register de?ition detailed descriptions of the registers and associated bits are given in the subsections that follow. 14.3.1 module memory map 14.3.2 register descriptions 14.3.2.1 interrupt test control register read: see individual bit descriptions write: see individual bit descriptions table 14-1. int memory map address offset use access 0x0015 interrupt test control register (itcr) r/w 0x0016 interrupt test registers (itest) r/w 0x001f highest priority interrupt (optional) (hprio) r/w 76543210 r000 wrtint adr3 adr2 adr1 adr0 w reset 0 0 0 01111 = unimplemented or reserved figure 14-2. interrupt test control register (itcr) table 14-2. itcr field descriptions field description 4 wrtint write to the interrupt test registers read: anytime write: only in special modes and with i-bit mask and x-bit mask set. 0 disables writes to the test registers; reads of the test registers will return the state of the interrupt inputs. 1 disconnect the interrupt inputs from the priority decoder and use the values written into the itest registers instead. note: any interrupts which are pending at the time that wrtint is set will remain until they are overwritten. 3:0 adr[3:0] test register select bits read: anytime write: anytime these bits determine which test register is selected on a read or write. the hexadecimal value written here will be the same as the upper nibble of the lower byte of the vector selects. that is, an ? written into adr[3:0] will select vectors 0xfffe?xfff0 while a ??written to adr[3:0] will select vectors 0xff7e?xff70.

 chapter 14 interrupt (intv1) mc9s12ne64 data sheet, rev. 1.1 390 freescale semiconductor 14.3.2.2 interrupt test registers read: only in special modes. reads will return either the state of the interrupt inputs of the interrupt sub-block (wrtint = 0) or the values written into the test registers (wrtint = 1). reads will always return 0s in normal modes. write: only in special modes and with wrtint = 1 and ccr i mask = 1. 14.3.2.3 highest priority i interrupt (optional) read: anytime write: only if i mask in ccr = 1 76543210 r inte intc inta int8 int6 int4 int2 int0 w reset 0 0 0 00000 = unimplemented or reserved figure 14-3. interrupt test registers (itest) table 14-3. itest field descriptions field description 7:0 int[e:0] interrupt test bits  ?these registers are used in special modes for testing the interrupt logic and priority independent of the system con?uration. each bit is used to force a speci? interrupt vector by writing it to a logic 1 state. bits are named inte through int0 to indicate vectors 0xffxe through 0xffx0. these bits can be written only in special modes and only with the wrtint bit set (logic 1) in the interrupt test control register (itcr). in addition, i interrupts must be masked using the i bit in the ccr. in this state, the interrupt input lines to the interrupt sub-block will be disconnected and interrupt requests will be generated only by this register. these bits can also be read in special modes to view that an interrupt requested by a system block (such as a peripheral block) has reached the int module. there is a test register implemented for every eight interrupts in the overall system. all of the test registers share the same address and are individually selected using the value stored in the adr[3:0] bits of the interrupt test control register (itcr). note: when adr[3:0] have the value of 0x000f, only bits 2:0 in the itest register will be accessible. that is, vectors higher than 0xfff4 cannot be tested using the test registers and bits 7:3 will always read as a logic 0. if adr[3:0] point to an unimplemented test register, writes will have no effect and reads will always return a logic 0 value. 76543210 r psel7 psel6 psel5 psel4 psel3 psel2 psel1 0 w reset 1 1 1 10010 = unimplemented or reserved figure 14-4. highest priority i interrupt register (hprio)

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 391 14.4 functional description the interrupt sub-block processes all exception requests made by the cpu. these exceptions include interrupt vector requests and reset vector requests. each of these exception types and their overall priority level is discussed in the subsections below. 14.4.1 low-power modes the int does not contain any user-controlled options for reducing power consumption. the operation of the int in low-power modes is discussed in the following subsections. 14.4.1.1 operation in run mode the int does not contain any options for reducing power in run mode. 14.4.1.2 operation in wait mode clocks to the int can be shut off during system wait mode and the asynchronous interrupt path will be used to generate the wake-up signal upon recognition of a valid interrupt or any xirq request. 14.4.1.3 operation in stop mode clocks to the int can be shut off during system stop mode and the asynchronous interrupt path will be used to generate the wake-up signal upon recognition of a valid interrupt or any xirq request. 14.5 resets the int supports three system reset exception request types: normal system reset or power-on-reset request, crystal monitor reset request, and cop watchdog reset request. the type of reset exception request must be decoded by the system and the proper request made to the core. the int will then provide the service routine address for the type of reset requested. 14.6 interrupts as shown in the block diagram in figure 14-1 , the int contains a register block to provide interrupt status and control, an optional highest priority i interrupt (hprio) block, and a priority decoder to evaluate whether pending interrupts are valid and assess their priority. table 14-4. hprio field descriptions field description 7:1 psel[7:1] highest priority i interrupt select bits  the state of these bits determines which i-bit maskable interrupt will be promoted to highest priority (of the i-bit maskable interrupts). to promote an interrupt, the user writes the least signi?ant byte of the associated interrupt vector address to this register. if an unimplemented vector address or a non i-bit masked vector address (value higher than 0x00f2) is written, irq (0xfff2) will be the default highest priority interrupt.

 chapter 14 interrupt (intv1) mc9s12ne64 data sheet, rev. 1.1 392 freescale semiconductor 14.6.1 interrupt registers the int registers are accessible only in special modes of operation and function as described in section 14.3.2.1, ?nterrupt test control register , and section 14.3.2.2, ?nterrupt test registers , previously. 14.6.2 highest priority i-bit maskable interrupt when the optional hprio block is implemented, the user is allowed to promote a single i-bit maskable interrupt to be the highest priority i interrupt. the hprio evaluates all interrupt exception requests and passes the hprio vector to the priority decoder if the highest priority i interrupt is active. rti replaces the promoted interrupt source. 14.6.3 interrupt priority decoder the priority decoder evaluates all interrupts pending and determines their validity and priority. when the cpu requests an interrupt vector, the decoder will provide the vector for the highest priority interrupt request. because the vector is not supplied until the cpu requests it, it is possible that a higher priority interrupt request could override the original exception that caused the cpu to request the vector. in this case, the cpu will receive the highest priority vector and the system will process this exception instead of the original request. note care must be taken to ensure that all exception requests remain active until the system begins execution of the applicable service routine; otherwise, the exception request may not be processed. if for any reason the interrupt source is unknown (e.g., an interrupt request becomes inactive after the interrupt has been recognized but prior to the vector request), the vector address will default to that of the last valid interrupt that existed during the particular interrupt sequence. if the cpu requests an interrupt vector when there has never been a pending interrupt request, the int will provide the software interrupt (swi) vector address. 14.7 exception priority the priority (from highest to lowest) and address of all exception vectors issued by the int upon request by the cpu is shown in table 14-5 . table 14-5. exception vector map and priority vector address  source 0xfffe?xffff system reset 0xfffc?xfffd crystal monitor reset 0xfffa?xfffb cop reset 0xfff8?xfff9 unimplemented opcode trap 0xfff6?xfff7 software interrupt instruction (swi) or bdm vector request 0xfff4?xfff5 xirq signal

 exception priority mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 393 0xfff2?xfff3 irq signal 0xfff0?xff00 device-speci? i-bit maskable interrupt sources (priority in descending order) table 14-5. exception vector map and priority vector address  source

 chapter 14 interrupt (intv1) mc9s12ne64 data sheet, rev. 1.1 394 freescale semiconductor

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 395 chapter 15 multiplexed external bus interface (mebiv3) 15.1 introduction this section describes the functionality of the multiplexed external bus interface (mebi) sub-block of the s12 core platform. the functionality of the module is closely coupled with the s12 cpu and the memory map controller (mmc) sub-blocks. figure 15-1  is a block diagram of the mebi. in figure 15-1 , the signals on the right hand side represent pins that are accessible externally. on some chips, these may not all be bonded out. the mebi sub-block of the core serves to provide access and/or visibility to internal core data manipulation operations including timing reference information at the external boundary of the core and/or system. depending upon the system operating mode and the state of bits within the control registers of the mebi, the internal 16-bit read and write data operations will be represented in 8-bit or 16-bit accesses externally. using control information from other blocks within the system, the mebi will determine the appropriate type of data access to be generated. 15.1.1 features the block name includes these distinctive features:  external bus controller with four 8-bit ports a,b, e, and k  data and data direction registers for ports a, b, e, and k when used as general-purpose i/o  control register to enable/disable alternate functions on ports e and k  mode control register  control register to enable/disable pull resistors on ports a, b, e, and k  control register to enable/disable reduced output drive on ports a, b, e, and k  control register to con?ure external clock behavior  control register to con?ure irq pin operation  logic to capture and synchronize external interrupt pin inputs

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 396 freescale semiconductor figure 15-1. mebi block diagram pe[7:2]/noacc/ pe1/ irq pe0/ xirq bkgd/modc/ t a ghi pk[7:0]/ ecs/ xcs/x[19:14] pa[7:0]/a[15:8]/ d[15:8]/d[7:0] port k port a pb[7:0]/a[7:0]/ d[7:0] port b port e bkgd regs ext bus i/f ctl addr[19:0] data[15:0] (control) internal bus eclk ctl irq ctl addr addr data addr data pipe ctl cpu pipe info irq interrupt xirq interrupt bdm tag info ipipe1/modb/clkto ipipe0/moda/ eclk/ lstrb/ t a glo r/ w tag ctl control signal(s) data signal (unidirectional) data bus (unidirectional) data bus (bidirectional) data signal (bidirectional) mode

 external signal description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 397 15.1.2 modes of operation  normal expanded wide mode ports a and b are con?ured as a 16-bit multiplexed address and data bus and port e provides bus control and status signals. this mode allows 16-bit external memory and peripheral devices to be interfaced to the system.  normal expanded narrow mode ports a and b are con?ured as a 16-bit address bus and port a is multiplexed with 8-bit data. port e provides bus control and status signals. this mode allows 8-bit external memory and peripheral devices to be interfaced to the system.  normal single-chip mode there is no external expansion bus in this mode. the processor program is executed from internal memory. ports a, b, k, and most of e are available as general-purpose i/o.  special single-chip mode this mode is generally used for debugging single-chip operation, boot-strapping, or security related operations. the active background mode is in control of cpu execution and bdm ?mware is waiting for additional serial commands through the bkgd pin. there is no external expansion bus after reset in this mode.  emulation expanded wide mode developers use this mode for emulation systems in which the users target application is normal expanded wide mode.  emulation expanded narrow mode developers use this mode for emulation systems in which the users target application is normal expanded narrow mode.  special test mode ports a and b are con?ured as a 16-bit multiplexed address and data bus and port e provides bus control and status signals. in special test mode, the write protection of many control bits is lifted so that they can be thoroughly tested without needing to go through reset.  special peripheral mode this mode is intended for freescale semiconductor factory testing of the system. the cpu is inactive and an external (tester) bus master drives address, data, and bus control signals. 15.2 external signal description in typical implementations, the mebi sub-block of the core interfaces directly with external system pins. some pins may not be bonded out in all implementations. table 15-1 outlines the pin names and functions and gives a brief description of their operation reset state of these pins and associated pull-ups or pull-downs is dependent on the mode of operation and on the integration of this block at the chip level (chip dependent).

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 398 freescale semiconductor . table 15-1. external system pins associated with mebi pin name pin functions description bkgd/modc/ t a ghi modc at the rising edge on reset, the state of this pin is registered into the modc bit to set the mode. (this pin always has an internal pullup.) bkgd pseudo open-drain communication pin for the single-wire background debug mode. there is an internal pull-up resistor on this pin. t a ghi when instruction tagging is on, a 0 at the falling edge of e tags the high half of the instruction word being read into the instruction queue. pa7/a15/d15/d7 thru pa0/a8/d8/d0 pa7?a0 general-purpose i/o pins, see porta and ddra registers. a15?8 high-order address lines multiplexed during eclk low. outputs except in special peripheral mode where they are inputs from an external tester system. d15?8 high-order bidirectional data lines multiplexed during eclk high in expanded wide modes, special peripheral mode, and visible internal accesses (ivis = 1) in emulation expanded narrow mode. direction of data transfer is generally indicated by r/ w. d15/d7 thru d8/d0 alternate high-order and low-order bytes of the bidirectional data lines multiplexed during eclk high in expanded narrow modes and narrow accesses in wide modes. direction of data transfer is generally indicated by r/ w. pb7/a7/d7 thru pb0/a0/d0 pb7?b0 general-purpose i/o pins, see portb and ddrb registers. a7?0 low-order address lines multiplexed during eclk low. outputs except in special peripheral mode where they are inputs from an external tester system. d7?0 low-order bidirectional data lines multiplexed during eclk high in expanded wide modes, special peripheral mode, and visible internal accesses (with ivis = 1) in emulation expanded narrow mode. direction of data transfer is generally indicated by r/ w. pe7/noacc pe7 general-purpose i/o pin, see porte and ddre registers. noacc cpu no access output. indicates whether the current cycle is a free cycle. only available in expanded modes. pe6/ipipe1/ modb/clkto modb at the rising edge of reset, the state of this pin is registered into the modb bit to set the mode. pe6 general-purpose i/o pin, see porte and ddre registers. ipipe1 instruction pipe status bit 1, enabled by pipoe bit in pear. clkto system clock test output. only available in special modes. pipoe = 1 overrides this function. the enable for this function is in the clock module. pe5/ipipe0/moda moda at the rising edge on reset, the state of this pin is registered into the moda bit to set the mode. pe5 general-purpose i/o pin, see porte and ddre registers. ipipe0 instruction pipe status bit 0, enabled by pipoe bit in pear.

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 399 detailed descriptions of these pins can be found in the device overview chapter. 15.3 memory map and register de?ition a summary of the registers associated with the mebi sub-block is shown in table 15-2 . detailed descriptions of the registers and bits are given in the subsections that follow. on most chips the registers are mappable. therefore, the upper bits may not be all 0s as shown in the table and descriptions. pe4/eclk pe4 general-purpose i/o pin, see porte and ddre registers. eclk bus timing reference clock, can operate as a free-running clock at the system clock rate or to produce one low-high clock per visible access, with the high period stretched for slow accesses. eclk is controlled by the neclk bit in pear, the ivis bit in mode, and the estr bit in ebictl. pe3/ lstrb/ t a glo pe3 general-purpose i/o pin, see porte and ddre registers. lstrb low strobe bar, 0 indicates valid data on d7?0. sz8 in special peripheral mode, this pin is an input indicating the size of the data transfer (0 = 16-bit; 1 = 8-bit). t a glo in expanded wide mode or emulation narrow modes, when instruction tagging is on and low strobe is enabled, a 0 at the falling edge of e tags the low half of the instruction word being read into the instruction queue. pe2/r/ w pe2 general-purpose i/o pin, see porte and ddre registers. r/ w read/write, indicates the direction of internal data transfers. this is an output except in special peripheral mode where it is an input. pe1/ irq pe1 general-purpose input-only pin, can be read even if irq enabled. irq maskable interrupt request, can be level sensitive or edge sensitive. pe0/ xirq pe0 general-purpose input-only pin. xirq non-maskable interrupt input. pk7/ ecs pk7 general-purpose i/o pin, see portk and ddrk registers. ecs emulation chip select pk6/ xcs pk6 general-purpose i/o pin, see portk and ddrk registers. xcs external data chip select pk5/x19 thru pk0/x14 pk5?k0 general-purpose i/o pins, see portk and ddrk registers. x19?14 memory expansion addresses table 15-1. external system pins associated with mebi (continued) pin name pin functions description

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 400 freescale semiconductor 15.3.1 module memory map 15.3.2 register descriptions 15.3.2.1 port a data register (porta) table 15-2. mebi memory map address offset use access 0x0000 port a data register (porta) r/w 0x0001 port b data register (portb) r/w 0x0002 data direction register a (ddra) r/w 0x0003 data direction register b (ddrb) r/w 0x0004 reserved r 0x0005 reserved r 0x0006 reserved r 0x0007 reserved r 0x0008 port e data register (porte) r/w 0x0009 data direction register e (ddre) r/w 0x000a port e assignment register (pear) r/w 0x000b mode register (mode) r/w 0x000c pull control register (pucr) r/w 0x000d reduced drive register (rdriv) r/w 0x000e external bus interface control register (ebictl) r/w 0x000f reserved r 0x001e irq control register (irqcr) r/w 0x00032 port k data register (portk) r/w 0x00033 data direction register k (ddrk) r/w 76543210 r bit 7 6 5 4 3 2 1 bit 0 w reset 0 0 0 0 0 0 0 0 single chip pa7 pa6 pa5 pa4 pa3 pa2 pa1 pa0 expanded wide, emulation narrow with ivis, and peripheral ab/db15 ab/db14 ab/db13 ab/db12 ab/db11 ab/db10 ab/db9 ab/db8 expanded narrow ab15 and db15/db7 ab14 and db14/db6 ab13 and db13/db5 ab12 and db12/db4 ab11 and db11/db3 ab10 and db10/db2 ab9 and db9/db1 ab8 and db8/db0 figure 15-2. port a data register (porta)

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 401 read: anytime when register is in the map write: anytime when register is in the map port a bits 7 through 0 are associated with address lines a15 through a8 respectively and data lines d15/d7 through d8/d0 respectively. when this port is not used for external addresses such as in single-chip mode, these pins can be used as general-purpose i/o. data direction register a (ddra) determines the primary direction of each pin. ddra also determines the source of data for a read of porta. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. note to ensure that you read the value present on the porta pins, always wait at least one cycle after writing to the ddra register before reading from the porta register. 15.3.2.2 port b data register (portb) read: anytime when register is in the map write: anytime when register is in the map port b bits 7 through 0 are associated with address lines a7 through a0 respectively and data lines d7 through d0 respectively. when this port is not used for external addresses, such as in single-chip mode, these pins can be used as general-purpose i/o. data direction register b (ddrb) determines the primary direction of each pin. ddrb also determines the source of data for a read of portb. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. note to ensure that you read the value present on the portb pins, always wait at least one cycle after writing to the ddrb register before reading from the portb register. 76543210 r bit 7 6 5 4 3 2 1 bit 0 w reset 0 0 0 0 0 0 0 0 single chip pb7 pb6 pb5 pb4 pb3 pb2 pb1 pb0 expanded wide, emulation narrow with ivis, and peripheral ab/db7 ab/db6 ab/db5 ab/db4 ab/db3 ab/db2 ab/db1 ab/db0 expanded narrow ab7 ab6 ab5 ab4 ab3 ab2 ab1 ab0 figure 15-3. port a data register (portb)

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 402 freescale semiconductor 15.3.2.3 data direction register a (ddra) read: anytime when register is in the map write: anytime when register is in the map this register controls the data direction for port a. when port a is operating as a general-purpose i/o port, ddra determines the primary direction for each port a pin. a 1 causes the associated port pin to be an output and a 0 causes the associated pin to be a high-impedance input. the value in a ddr bit also affects the source of data for reads of the corresponding porta register. if the ddr bit is 0 (input) the buffered pin input state is read. if the ddr bit is 1 (output) the associated port data register bit state is read. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. it is reset to 0x00 so the ddr does not override the three-state control signals. 76543210 r bit 7 6 5 4321 bit 0 w reset 0 0 0 00000 figure 15-4. data direction register a (ddra) table 15-3. ddra field descriptions field description 7:0 ddra data direction port a 0 con?ure the corresponding i/o pin as an input 1 con?ure the corresponding i/o pin as an output

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 403 15.3.2.4 data direction register b (ddrb) read: anytime when register is in the map write: anytime when register is in the map this register controls the data direction for port b. when port b is operating as a general-purpose i/o port, ddrb determines the primary direction for each port b pin. a 1 causes the associated port pin to be an output and a 0 causes the associated pin to be a high-impedance input. the value in a ddr bit also affects the source of data for reads of the corresponding portb register. if the ddr bit is 0 (input) the buffered pin input state is read. if the ddr bit is 1 (output) the associated port data register bit state is read. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. it is reset to 0x00 so the ddr does not override the three-state control signals. 76543210 r bit 7 6 5 4321 bit 0 w reset 0 0 0 00000 figure 15-5. data direction register b (ddrb) table 15-4. ddrb field descriptions field description 7:0 ddrb data direction port b 0 con?ure the corresponding i/o pin as an input 1 con?ure the corresponding i/o pin as an output

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 404 freescale semiconductor 15.3.2.5 reserved registers these register locations are not used (reserved). all unused registers and bits in this block return logic 0s when read. writes to these registers have no effect. these registers are not in the on-chip map in special peripheral mode. 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 15-6. reserved register 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 15-7. reserved register 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 15-8. reserved register 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 15-9. reserved register

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 405 15.3.2.6 port e data register (porte) read: anytime when register is in the map write: anytime when register is in the map port e is associated with external bus control signals and interrupt inputs. these include mode select (modb/ipipe1, moda/ipipe0), e clock, size ( lstrb/ t a glo), read/write (r/ w), irq, and xirq. when not used for one of these speci? functions, port e pins 7:2 can be used as general-purpose i/o and pins 1:0 can be used as general-purpose input. the port e assignment register (pear) selects the function of each pin and ddre determines whether each pin is an input or output when it is con?ured to be general-purpose i/o. ddre also determines the source of data for a read of porte. some of these pins have software selectable pull resistors. irq and xirq can only be pulled up whereas the polarity of the pe7, pe4, pe3, and pe2 pull resistors are determined by chip integration. please refer to the device overview chapter (signal property summary) to determine the polarity of these resistors. a single control bit enables the pull devices for all of these pins when they are con?ured as inputs. this register is not in the on-chip map in special peripheral mode or in expanded modes when the eme bit is set. therefore, these accesses will be echoed externally. note it is unwise to write porte and ddre as a word access. if you are changing port e pins from being inputs to outputs, the data may have extra transitions during the write. it is best to initialize porte before enabling as outputs. note to ensure that you read the value present on the porte pins, always wait at least one cycle after writing to the ddre register before reading from the porte register. 76543210 r bit 7 65432 bit 1 bit 0 w reset 000000uu alternate pin function noacc modb or ipipe1 or clkto moda or ipipe0 eclk lstrb or t a glo r/ w irq xirq = unimplemented or reserved u = unaffected by reset figure 15-10. port e data register (porte)

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 406 freescale semiconductor 15.3.2.7 data direction register e (ddre) read: anytime when register is in the map write: anytime when register is in the map data direction register e is associated with port e. for bits in port e that are con?ured as general-purpose i/o lines, ddre determines the primary direction of each of these pins. a 1 causes the associated bit to be an output and a 0 causes the associated bit to be an input. port e bit 1 (associated with irq) and bit 0 (associated with xirq) cannot be con?ured as outputs. port e, bits 1 and 0, can be read regardless of whether the alternate interrupt function is enabled. the value in a ddr bit also affects the source of data for reads of the corresponding porte register. if the ddr bit is 0 (input) the buffered pin input state is read. if the ddr bit is 1 (output) the associated port data register bit state is read. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. also, it is not in the map in expanded modes while the eme control bit is set. 76543210 r bit 7 6 5 4 3 bit 2 00 w reset 0 0 0 00000 = unimplemented or reserved figure 15-11. data direction register e (ddre) table 15-5. ddre field descriptions field description 7:2 ddre data direction port e 0 con?ure the corresponding i/o pin as an input 1 con?ure the corresponding i/o pin as an output note: it is unwise to write porte and ddre as a word access. if you are changing port e pins from inputs to outputs, the data may have extra transitions during the write. it is best to initialize porte before enabling as outputs.

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 407 15.3.2.8 port e assignment register (pear) read: anytime (provided this register is in the map). write: each bit has speci? write conditions. please refer to the descriptions of each bit on the following pages. port e serves as general-purpose i/o or as system and bus control signals. the pear register is used to choose between the general-purpose i/o function and the alternate control functions. when an alternate control function is selected, the associated ddre bits are overridden. the reset condition of this register depends on the mode of operation because bus control signals are needed immediately after reset in some modes. in normal single-chip mode, no external bus control signals are needed so all of port e is con?ured for general-purpose i/o. in normal expanded modes, only the e clock is con?ured for its alternate bus control function and the other bits of port e are con?ured for general-purpose i/o. as the reset vector is located in external memory, the e clock is required for this access. r/ w is only needed by the system when there are external writable resources. if the normal expanded system needs any other bus control signals, pear would need to be written before any access that needed the additional signals. in special test and emulation modes, ipipe1, ipipe0, e, lstrb, and r/ w are con?ured out of reset as bus control signals. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. 76543210 r noacce 0 pipoe neclk lstre rdwe 00 w reset special single chip 0 0 0 0 0 0 0 0 special test 0 0 1 0 1 1 0 0 peripheral 0 0 0 0 0 0 0 0 emulation expanded narrow 10101100 emulation expanded wide 10101100 normal single chip 0 0 0 1 0 0 0 0 normal expanded narrow 00000000 normal expanded wide 0 0 0 0 0 0 0 0 = unimplemented or reserved figure 15-12. port e assignment register (pear)

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 408 freescale semiconductor table 15-6. pear field descriptions field description 7 noacce cpu no access output enable normal: write once emulation: write never special: write anytime 1 the associated pin (port e, bit 7) is general-purpose i/o. 0 the associated pin (port e, bit 7) is output and indicates whether the cycle is a cpu free cycle. this bit has no effect in single-chip or special peripheral modes. 5 pipoe pipe status signal output enable normal: write once emulation: write never special: write anytime. 0 the associated pins (port e, bits 6:5) are general-purpose i/o. 1 the associated pins (port e, bits 6:5) are outputs and indicate the state of the instruction queue this bit has no effect in single-chip or special peripheral modes. 4 neclk no external e clock normal and special: write anytime emulation: write never 0 the associated pin (port e, bit 4) is the external e clock pin. external e clock is free-running if estr = 0 1 the associated pin (port e, bit 4) is a general-purpose i/o pin. external e clock is available as an output in all modes. 3 lstre low strobe ( lstrb) enable normal: write once emulation: write never special: write anytime. 0 the associated pin (port e, bit 3) is a general-purpose i/o pin. 1 the associated pin (port e, bit 3) is con?ured as the lstrb bus control output. if bdm tagging is enabled, t a glo is multiplexed in on the rising edge of eclk and lstrb is driven out on the falling edge of eclk. this bit has no effect in single-chip, peripheral, or normal expanded narrow modes. note: lstrb is used during external writes. after reset in normal expanded mode, lstrb is disabled to provide an extra i/o pin. if lstrb is needed, it should be enabled before any external writes. external reads do not normally need lstrb because all 16 data bits can be driven even if the system only needs 8 bits of data. 2 rdwe read/write enable normal: write once emulation: write never special: write anytime 0 the associated pin (port e, bit 2) is a general-purpose i/o pin. 1 the associated pin (port e, bit 2) is con?ured as the r/ w pin this bit has no effect in single-chip or special peripheral modes. note: r/ w is used for external writes. after reset in normal expanded mode, r/ w is disabled to provide an extra i/o pin. if r/ w is needed it should be enabled before any external writes.

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 409 15.3.2.9 mode register (mode) read: anytime (provided this register is in the map). write: each bit has specific write conditions. please refer to the descriptions of each bit on the following pages. the mode register is used to establish the operating mode and other miscellaneous functions (i.e., internal visibility and emulation of port e and k). in special peripheral mode, this register is not accessible but it is reset as shown to system con?uration features. changes to bits in the mode register are delayed one cycle after the write. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. 76543210 r modc modb moda 0 ivis 0 emk eme w reset special single chip 0 0 0 0 0 0 0 0 emulation expanded narrow 00101011 special test 0 1 0 0 1 0 0 0 emulation expanded wide 01101011 normal single chip 1 0 0 0 0 0 0 0 normal expanded narrow 10100000 peripheral 1 1 0 0 0 0 0 0 normal expanded wide 1 1 1 0 0 0 0 0 = unimplemented or reserved figure 15-13. mode register (mode)

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 410 freescale semiconductor table 15-7. mode field descriptions field description 7:5 mod[c:a] mode select bits  ?these bits indicate the current operating mode. if moda = 1, then modc, modb, and moda are write never. if modc = moda = 0, then modc, modb, and moda are writable with the exception that you cannot change to or from special peripheral mode if modc = 1, modb = 0, and moda = 0, then modc is write never. modb and moda are write once, except that you cannot change to special peripheral mode. from normal single-chip, only normal expanded narrow and normal expanded wide modes are available. see table 15-8  and table 15-16 . 3 ivis internal visibility (for both read and write accesses)  ?this bit determines whether internal accesses generate a bus cycle that is visible on the external bus. normal: write once emulation: write never special: write anytime 0 no visibility of internal bus operations on external bus. 1 internal bus operations are visible on external bus. 1 emk emulate port k normal: write once emulation: write never special: write anytime 0 portk and ddrk are in the memory map so port k can be used for general-purpose i/o. 1 if in any expanded mode, portk and ddrk are removed from the memory map. in single-chip modes, portk and ddrk are always in the map regardless of the state of this bit. in special peripheral mode, portk and ddrk are never in the map regardless of the state of this bit. 0 eme emulate port e normal and emulation: write never special: write anytime 0 porte and ddre are in the memory map so port e can be used for general-purpose i/o. 1 if in any expanded mode or special peripheral mode, porte and ddre are removed from the memory map. removing the registers from the map allows the user to emulate the function of these registers externally. in single-chip modes, porte and ddre are always in the map regardless of the state of this bit.

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 411 15.3.2.10 pull control register (pucr) read: anytime (provided this register is in the map). write: anytime (provided this register is in the map). this register is used to select pull resistors for the pins associated with the core ports. pull resistors are assigned on a per-port basis and apply to any pin in the corresponding port that is currently con?ured as an input. the polarity of these pull resistors is determined by chip integration. please refer to the device overview chapter to determine the polarity of these resistors. table 15-8. modc, modb, and moda write capability 1 1 no writes to the mod bits are allowed while operating in a secure mode. for more details, refer to the device overview chapter. modc modb moda mode modx write capability 0 0 0 special single chip modc, modb, and moda write anytime but not to 110 2 2 if you are in a special single-chip or special test mode and you write to this register, changing to normal sin- gle-chip mode, then one allowed write to this register remains. if you write to normal expanded or emulation mode, then no writes remain. 0 0 1 emulation narrow no write 0 1 0 special test modc, modb, and moda write anytime but not to 110 (2) 0 1 1 emulation wide no write 1 0 0 normal single chip modc write never, modb and moda write once but not to 110 1 0 1 normal expanded narrow no write 1 1 0 special peripheral no write 1 1 1 normal expanded wide no write 76543210 r pupke 00 pupee 00 pupbe pupae w reset 1 10010000 notes: 1. the default value of this parameter is shown. please refer to the device overview chapter to deter- mine the actual reset state of this register. = unimplemented or reserved figure 15-14. pull control register (pucr)

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 412 freescale semiconductor this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. note these bits have no effect when the associated pin(s) are outputs. (the pull resistors are inactive.) 15.3.2.11 reduced drive register (rdriv) read: anytime (provided this register is in the map) write: anytime (provided this register is in the map) this register is used to select reduced drive for the pins associated with the core ports. this gives reduced power consumption and reduced rfi with a slight increase in transition time (depending on loading). this feature would be used on ports which have a light loading. the reduced drive function is independent of which function is being used on a particular port. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. table 15-9. pucr field descriptions field description 7 pupke pull resistors port k enable 0 port k pull resistors are disabled. 1 enable pull resistors for port k input pins. 4 pupee pull resistors port e enable 0 port e pull resistors on bits 7, 4:0 are disabled. 1 enable pull resistors for port e input pins bits 7, 4:0. note: pins 5 and 6 of port e have pull resistors which are only enabled during reset. this bit has no effect on these pins. 1 pupbe pull resistors port b enable 0 port b pull resistors are disabled. 1 enable pull resistors for all port b input pins. 0 pupae pull resistors port a enable 0 port a pull resistors are disabled. 1 enable pull resistors for all port a input pins. 76543210 r rdrk 00 rdpe 00 rdpb rdpa w reset 00000000 = unimplemented or reserved figure 15-15. reduced drive register (rdriv)

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 413 15.3.2.12 external bus interface control register (ebictl) read: anytime (provided this register is in the map) write: refer to individual bit descriptions below the ebictl register is used to control miscellaneous functions (i.e., stretching of external e clock). this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. table 15-10. rdriv field descriptions field description 7 rdrk reduced drive of port k 0 all port k output pins have full drive enabled. 1 all port k output pins have reduced drive enabled. 4 rdpe reduced drive of port e 0 all port e output pins have full drive enabled. 1 all port e output pins have reduced drive enabled. 1 rdpb reduced drive of port b 0 all port b output pins have full drive enabled. 1 all port b output pins have reduced drive enabled. 0 rdpa reduced drive of ports a 0 all port a output pins have full drive enabled. 1 all port a output pins have reduced drive enabled. 76543210 r0000000 estr w reset: peripheral all other modes 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 = unimplemented or reserved figure 15-16. external bus interface control register (ebictl) table 15-11. ebictl field descriptions field description 0 estr e clock stretches  this control bit determines whether the e clock behaves as a simple free-running clock or as a bus control signal that is active only for external bus cycles. normal and emulation: write once special: write anytime 0 e never stretches (always free running). 1 e stretches high during stretched external accesses and remains low during non-visible internal accesses. this bit has no effect in single-chip modes.

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 414 freescale semiconductor 15.3.2.13 reserved register this register location is not used (reserved). all bits in this register return logic 0s when read. writes to this register have no effect. this register is not in the on-chip memory map in expanded and special peripheral modes. therefore, these accesses will be echoed externally. 15.3.2.14 irq control register (irqcr) read: see individual bit descriptions below write: see individual bit descriptions below 76543210 r00000000 w reset 00000000 = unimplemented or reserved figure 15-17. reserved register 76543210 r irqe irqen 000000 w reset 01000000 = unimplemented or reserved figure 15-18. irq control register (irqcr) table 15-12. irqcr field descriptions field description 7 irqe irq select edge sensitive only special modes: read or write anytime normal and emulation modes: read anytime, write once 0 irq con?ured for low level recognition. 1 irq con?ured to respond only to falling edges. falling edges on the irq pin will be detected anytime irqe = 1 and will be cleared only upon a reset or the servicing of the irq interrupt. 6 irqen external irq enable normal, emulation, and special modes: read or write anytime 0 external irq pin is disconnected from interrupt logic. 1 external irq pin is connected to interrupt logic. note: when irqen = 0, the edge detect latch is disabled.

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 415 15.3.2.15 port k data register (portk) read: anytime write: anytime this port is associated with the internal memory expansion emulation pins. when the port is not enabled to emulate the internal memory expansion, the port pins are used as general-purpose i/o. when port k is operating as a general-purpose i/o port, ddrk determines the primary direction for each port k pin. a 1 causes the associated port pin to be an output and a 0 causes the associated pin to be a high-impedance input. the value in a ddr bit also affects the source of data for reads of the corresponding portk register. if the ddr bit is 0 (input) the buffered pin input is read. if the ddr bit is 1 (output) the output of the port data register is read. this register is not in the map in peripheral or expanded modes while the emk control bit in mode register is set. therefore, these accesses will be echoed externally. when inputs, these pins can be selected to be high impedance or pulled up, based upon the state of the pupke bit in the pucr register. 76543210 r bit 7 654321 bit 0 w reset 00000000 alternate pin function ecs xcs xab19 xab18 xab17 xab16 xab15 xab14 figure 15-19. port k data register (portk) table 15-13. portk field descriptions field description 7 port k, bit 7 port k, bit 7  ?this bit is used as an emulation chip select signal for the emulation of the internal memory expansion, or as general-purpose i/o, depending upon the state of the emk bit in the mode register. while this bit is used as a chip select, the external bit will return to its de-asserted state (v dd ) for approximately 1/4 cycle just after the negative edge of eclk, unless the external access is stretched and eclk is free-running (estr bit in ebictl = 0). see the mmc block description chapter for additional details on when this signal will be active. 6 port k, bit 6 port k, bit 6  ?this bit is used as an external chip select signal for most external accesses that are not selected by ecs (see the mmc block description chapter for more details), depending upon the state the of the emk bit in the mode register. while this bit is used as a chip select, the external pin will return to its de- asserted state (v dd ) for approximately 1/4 cycle just after the negative edge of eclk, unless the external access is stretched and eclk is free-running (estr bit in ebictl = 0). 5:0 port k, bits 5:0 port k, bits 5:0  these six bits are used to determine which flash/rom or external memory array page is being accessed. they can be viewed as expanded addresses xab19?ab14 of the 20-bit address used to access up to1m byte internal flash/rom or external memory array. alternatively, these bits can be used for general-purpose i/o depending upon the state of the emk bit in the mode register.

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 416 freescale semiconductor 15.3.2.16 port k data direction register (ddrk) read: anytime write: anytime this register determines the primary direction for each port k pin con?ured as general-purpose i/o. this register is not in the map in peripheral or expanded modes while the emk control bit in mode register is set. therefore, these accesses will be echoed externally. 15.4 functional description 15.4.1 detecting access type from external signals the external signals lstrb, r/ w, and ab0 indicate the type of bus access that is taking place. accesses to the internal ram module are the only type of access that would produce lstrb = ab0 = 1, because the internal ram is speci?ally designed to allow misaligned 16-bit accesses in a single cycle. in these cases the data for the address that was accessed is on the low half of the data bus and the data for address + 1 is on the high half of the data bus. this is summarized in table 15-15 . 76543210 r bit 7 654321 bit 0 w reset 00000000 figure 15-20. port k data direction register (ddrk) table 15-14. ebictl field descriptions field description 7:0 ddrk data direction port k bits 0 associated pin is a high-impedance input 1 associated pin is an output note: it is unwise to write portk and ddrk as a word access. if you are changing port k pins from inputs to outputs, the data may have extra transitions during the write. it is best to initialize portk before enabling as outputs. note: to ensure that you read the correct value from the portk pins, always wait at least one cycle after writing to the ddrk register before reading from the portk register. table 15-15. access type vs. bus control pins lstrb ab0 r/ w type of access 1 0 1 8-bit read of an even address 0 1 1 8-bit read of an odd address 1 0 0 8-bit write of an even address 0 1 0 8-bit write of an odd address 0 0 1 16-bit read of an even address

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 417 15.4.2 stretched bus cycles in order to allow fast internal bus cycles to coexist in a system with slower external memory resources, the hcs12 supports the concept of stretched bus cycles (module timing reference clocks for timers and baud rate generators are not affected by this stretching). control bits in the misc register in the mmc sub-block of the core specify the amount of stretch (0, 1, 2, or 3 periods of the internal bus-rate clock). while stretching, the cpu state machines are all held in their current state. at this point in the cpu bus cycle, write data would already be driven onto the data bus so the length of time write data is valid is extended in the case of a stretched bus cycle. read data would not be captured by the system until the e clock falling edge. in the case of a stretched bus cycle, read data is not required until the speci?d setup time before the falling edge of the stretched e clock. the chip selects, and r/ w signals remain valid during the period of stretching (throughout the stretched e high time). note the address portion of the bus cycle is not stretched . 15.4.3 modes of operation the operating mode out of reset is determined by the states of the modc, modb, and moda pins during reset ( table 15-16 ). the modc, modb, and moda bits in the mode register show the current operating mode and provide limited mode switching during operation. the states of the modc, modb, and moda pins are latched into these bits on the rising edge of the reset signal. 1 1 1 16-bit read of an odd address (low/high data swapped) 0 0 0 16-bit write to an even address 1 1 0 16-bit write to an odd address (low/high data swapped) table 15-16. mode selection modc modb moda mode description 0 0 0 special single chip, bdm allowed and active. bdm is allowed in all other modes but a serial command is required to make bdm active. 0 0 1 emulation expanded narrow, bdm allowed 0 1 0 special test (expanded wide), bdm allowed 0 1 1 emulation expanded wide, bdm allowed 1 0 0 normal single chip, bdm allowed 1 0 1 normal expanded narrow, bdm allowed 1 1 0 peripheral; bdm allowed but bus operations would cause bus con?cts (must not be used) 1 1 1 normal expanded wide, bdm allowed table 15-15. access type vs. bus control pins lstrb ab0 r/ w type of access

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 418 freescale semiconductor there are two basic types of operating modes: 1. normal modes: some registers and bits are protected against accidental changes. 2. special modes: allow greater access to protected control registers and bits for special purposes such as testing. a system development and debug feature, background debug mode (bdm), is available in all modes. in special single-chip mode, bdm is active immediately after reset. some aspects of port e are not mode dependent. bit 1 of port e is a general purpose input or the irq interrupt input. irq can be enabled by bits in the cpus condition codes register but it is inhibited at reset so this pin is initially con?ured as a simple input with a pull-up. bit 0 of port e is a general purpose input or the xirq interrupt input. xirq can be enabled by bits in the cpus condition codes register but it is inhibited at reset so this pin is initially con?ured as a simple input with a pull-up. the estr bit in the ebictl register is set to one by reset in any user mode. this assures that the reset vector can be fetched even if it is located in an external slow memory device. the pe6/modb/ipipe1 and pe5/moda/ipipe0 pins act as high-impedance mode select inputs during reset. the following paragraphs discuss the default bus setup and describe which aspects of the bus can be changed after reset on a per mode basis. 15.4.3.1 normal operating modes these modes provide three operating con?urations. background debug is available in all three modes, but must ?st be enabled for some operations by means of a bdm background command, then activated. 15.4.3.1.1 normal single-chip mode there is no external expansion bus in this mode. all pins of ports a, b and e are con?ured as general purpose i/o pins port e bits 1 and 0 are available as general purpose input only pins with internal pull resistors enabled. all other pins of port e are bidirectional i/o pins that are initially con?ured as high-impedance inputs with internal pull resistors enabled. ports a and b are con?ured as high-impedance inputs with their internal pull resistors disabled. the pins associated with port e bits 6, 5, 3, and 2 cannot be con?ured for their alternate functions ipipe1, ipipe0, lstrb, and r/ w while the mcu is in single chip modes. in single chip modes, the associated control bits pipoe, lstre, and rdwe are reset to zero. writing the opposite state into them in single chip mode does not change the operation of the associated port e pins. in normal single chip mode, the mode register is writable one time. this allows a user program to change the bus mode to narrow or wide expanded mode and/or turn on visibility of internal accesses. port e, bit 4 can be con?ured for a free-running e clock output by clearing neclk=0. typically the only use for an e clock output while the mcu is in single chip modes would be to get a constant speed clock for use in the external application system.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 419 15.4.3.1.2 normal expanded wide mode in expanded wide modes, ports a and b are con?ured as a 16-bit multiplexed address and data bus and port e bit 4 is con?ured as the e clock output signal. these signals allow external memory and peripheral devices to be interfaced to the mcu. port e pins other than pe4/eclk are con?ured as general purpose i/o pins (initially high-impedance inputs with internal pull resistors enabled). control bits pipoe, neclk, lstre, and rdwe in the pear register can be used to con?ure port e pins to act as bus control outputs instead of general purpose i/o pins. it is possible to enable the pipe status signals on port e bits 6 and 5 by setting the pipoe bit in pear, but it would be unusual to do so in this mode. development systems where pipe status signals are monitored would typically use the special variation of this mode. the port e bit 2 pin can be recon?ured as the r/ w bus control signal by writing ? to the rdwe bit in pear. if the expanded system includes external devices that can be written, such as ram, the rdwe bit would need to be set before any attempt to write to an external location. if there are no writable resources in the external system, pe2 can be left as a general purpose i/o pin. the port e bit 3 pin can be recon?ured as the lstrb bus control signal by writing ? to the lstre bit in pear. the default condition of this pin is a general purpose input because the lstrb function is not needed in all expanded wide applications. the port e bit 4 pin is initially con?ured as eclk output with stretch. the e clock output function depends upon the settings of the neclk bit in the pear register, the ivis bit in the mode register and the estr bit in the ebictl register. the e clock is available for use in external select decode logic or as a constant speed clock for use in the external application system. 15.4.3.1.3 normal expanded narrow mode this mode is used for lower cost production systems that use 8-bit wide external eproms or rams. such systems take extra bus cycles to access 16-bit locations but this may be preferred over the extra cost of additional external memory devices. ports a and b are con?ured as a 16-bit address bus and port a is multiplexed with data. internal visibility is not available in this mode because the internal cycles would need to be split into two 8-bit cycles. since the pear register can only be written one time in this mode, use care to set all bits to the desired states during the single allowed write. the pe3/ lstrb pin is always a general purpose i/o pin in normal expanded narrow mode. although it is possible to write the lstre bit in pear to ??in this mode, the state of lstre is overridden and port e bit 3 cannot be recon?ured as the lstrb output. it is possible to enable the pipe status signals on port e bits 6 and 5 by setting the pipoe bit in pear, but it would be unusual to do so in this mode. lstrb would also be needed to fully understand system activity. development systems where pipe status signals are monitored would typically use special expanded wide mode or occasionally special expanded narrow mode.

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 420 freescale semiconductor the pe4/eclk pin is initially con?ured as eclk output with stretch. the e clock output function depends upon the settings of the neclk bit in the pear register, the ivis bit in the mode register and the estr bit in the ebictl register. in normal expanded narrow mode, the e clock is available for use in external select decode logic or as a constant speed clock for use in the external application system. the pe2/r/w pin is initially con?ured as a general purpose input with an internal pull resistor enabled but this pin can be recon?ured as the r/ w bus control signal by writing ??to the rdwe bit in pear. if the expanded narrow system includes external devices that can be written such as ram, the rdwe bit would need to be set before any attempt to write to an external location. if there are no writable resources in the external system, pe2 can be left as a general purpose i/o pin. 15.4.3.1.4 emulation expanded wide mode in expanded wide modes, ports a and b are con?ured as a 16-bit multiplexed address and data bus and port e provides bus control and status signals. these signals allow external memory and peripheral devices to be interfaced to the mcu. these signals can also be used by a logic analyzer to monitor the progress of application programs. the bus control related pins in port e (pe7/noacc, pe6/modb/ipipe1, pe5/moda/ipipe0, pe4/eclk, pe3/ lstrb/ t a glo, and pe2/r/ w) are all con?ured to serve their bus control output functions rather than general purpose i/o. notice that writes to the bus control enable bits in the pear register in emulation mode are restricted. 15.4.3.1.5 emulation expanded narrow mode expanded narrow modes are intended to allow connection of single 8-bit external memory devices for lower cost systems that do not need the performance of a full 16-bit external data bus. accesses to internal resources that have been mapped external (i.e. porta, portb, ddra, ddrb, porte, ddre, pear, pucr, rdriv) will be accessed with a 16-bit data bus on ports a and b. accesses of 16-bit external words to addresses which are normally mapped external will be broken into two separate 8-bit accesses using port a as an 8-bit data bus. internal operations continue to use full 16-bit data paths. they are only visible externally as 16-bit information if ivis=1. ports a and b are configured as multiplexed address and data output ports. during external accesses, address a15, data d15 and d7 are associated with pa7, address a0 is associated with pb0 and data d8 and d0 are associated with pa0. during internal visible accesses and accesses to internal resources that have been mapped external, address a15 and data d15 is associated with pa7 and address a0 and data d0 is associated with pb0. the bus control related pins in port e (pe7/noacc, pe6/modb/ipipe1, pe5/moda/ipipe0, pe4/eclk, pe3/ lstrb/ taglo, and pe2/r/ w) are all configured to serve their bus control output functions rather than general purpose i/o. notice that writes to the bus control enable bits in the pear register in emulation mode are restricted. the main difference between special modes and normal modes is that some of the bus control and system control signals cannot be written in emulation modes.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 421 15.4.3.2 special operating modes there are two special operating modes that correspond to normal operating modes. these operating modes are commonly used in factory testing and system development. 15.4.3.2.1 special single-chip mode when the mcu is reset in this mode, the background debug mode is enabled and active. the mcu does not fetch the reset vector and execute application code as it would in other modes. instead the active background mode is in control of cpu execution and bdm firmware is waiting for additional serial commands through the bkgd pin. when a serial command instructs the mcu to return to normal execution, the system will be configured as described below unless the reset states of internal control registers have been changed through background commands after the mcu was reset. there is no external expansion bus after reset in this mode. ports a and b are initially simple bidirectional i/o pins that are configured as high-impedance inputs with internal pull resistors disabled; however, writing to the mode select bits in the mode register (which is allowed in special modes) can change this after reset. all of the port e pins (except pe4/eclk) are initially configured as general purpose high-impedance inputs with internal pull resistors enabled. pe4/eclk is configured as the e clock output in this mode. the pins associated with port e bits 6, 5, 3, and 2 cannot be configured for their alternate functions ipipe1, ipipe0, lstrb, and r/ w while the mcu is in single chip modes. in single chip modes, the associated control bits pipoe, lstre and rdwe are reset to zero. writing the opposite value into these bits in single chip mode does not change the operation of the associated port e pins. port e, bit 4 can be configured for a free-running e clock output by clearing neclk=0. typically the only use for an e clock output while the mcu is in single chip modes would be to get a constant speed clock for use in the external application system. 15.4.3.2.2 special test mode in expanded wide modes, ports a and b are configured as a 16-bit multiplexed address and data bus and port e provides bus control and status signals. in special test mode, the write protection of many control bits is lifted so that they can be thoroughly tested without needing to go through reset. 15.4.3.3 test operating mode there is a test operating mode in which an external master, such as an i.c. tester, can control the on-chip peripherals. 15.4.3.3.1 peripheral mode this mode is intended for factory testing of the mcu. in this mode, the cpu is inactive and an external (tester) bus master drives address, data and bus control signals in through ports a, b and e. in effect, the whole mcu acts as if it was a peripheral under control of an external cpu. this allows faster testing of on-chip memory and peripherals than previous testing methods. since the mode control register is not accessible in peripheral mode, the only way to change to another mode is to reset the mcu into a different

 chapter 15 multiplexed external bus interface (mebiv3) mc9s12ne64 data sheet, rev. 1.1 422 freescale semiconductor mode. background debugging should not be used while the mcu is in special peripheral mode as internal bus conflicts between bdm and the external master can cause improper operation of both functions. 15.4.4 internal visibility internal visibility is available when the mcu is operating in expanded wide modes or emulation narrow mode. it is not available in single-chip, peripheral or normal expanded narrow modes. internal visibility is enabled by setting the ivis bit in the mode register. if an internal access is made while e, r/ w, and lstrb are con?ured as bus control outputs and internal visibility is off (ivis=0), e will remain low for the cycle, r/ w will remain high, and address, data and the lstrb pins will remain at their previous state. when internal visibility is enabled (ivis=1), certain internal cycles will be blocked from going external. during cycles when the bdm is selected, r/ w will remain high, data will maintain its previous state, and address and lstrb pins will be updated with the internal value. during cpu no access cycles when the bdm is not driving, r/ w will remain high, and address, data and the lstrb pins will remain at their previous state. note when the system is operating in a secure mode, internal visibility is not available (i.e., ivis = 1 has no effect). also, the ipipe signals will not be visible, regardless of operating mode. ipipe1?pipe0 will display 0es if they are enabled. in addition, the mod bits in the mode control register cannot be written. 15.4.5 low-power options the mebi does not contain any user-controlled options for reducing power consumption. the operation of the mebi in low-power modes is discussed in the following subsections. 15.4.5.1 operation in run mode the mebi does not contain any options for reducing power in run mode; however, the external addresses are conditioned to reduce power in single-chip modes. expanded bus modes will increase power consumption. 15.4.5.2 operation in wait mode the mebi does not contain any options for reducing power in wait mode. 15.4.5.3 operation in stop mode the mebi will cease to function after execution of a cpu stop instruction.

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 423 chapter 16 module mapping control (mmcv4) 16.1 introduction this section describes the functionality of the module mapping control (mmc) sub-block of the s12 core platform. the block diagram of the mmc is shown in figure 16-1 . figure 16-1. mmc block diagram the mmc is the sub-module which controls memory map assignment and selection of internal resources and external space. internal buses between the core and memories and between the core and peripherals is controlled in this module. the memory expansion is generated in this module. 16.1.1 features  registers for mapping of address space for on-chip ram, eeprom, and flash (or rom) memory blocks and associated registers mmc mode information registers cpu write data bus cpu address bus cpu control stop, wait address decode cpu read data bus ebi alternate address bus ebi alternate write data bus ebi alternate read data bus security clocks, reset read & write enables  alternate address bus (bdm) alternate write data bus (bdm)  alternate read data bus (bdm)  core select (s)  port k interface  memory space select(s)  peripheral select bus control secure bdm_unsecure mmc_secure internal memory expansion

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 424 freescale semiconductor  memory mapping control and selection based upon address decode and system operating mode  core address bus control  core data bus control and multiplexing  core security state decoding  emulation chip select signal generation ( ecs)  external chip select signal generation ( xcs)  internal memory expansion  external stretch and rom mapping control functions via the misc register  reserved registers for test purposes  con?urable system memory options de?ed at integration of core into the system-on-a-chip (soc). 16.1.2 modes of operation some of the registers operate differently depending on the mode of operation (i.e., normal expanded wide, special single chip, etc.). this is best understood from the register descriptions. 16.2 external signal description all interfacing with the mmc sub-block is done within the core, it has no external signals. 16.3 memory map and register de?ition a summary of the registers associated with the mmc sub-block is shown in figure 16-2 . detailed descriptions of the registers and bits are given in the subsections that follow. 16.3.1 module memory map table 16-1. mmc memory map address offset register access initialization of internal ram position register (initrm) r/w initialization of internal registers position register (initrg) r/w initialization of internal eeprom position register (initee) r/w miscellaneous system control register (misc) r/w reserved  . . . .  reserved  . . . . 

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 425 memory size register 0 (memsiz0) r memory size register 1 (memsiz1) r . . . . program page index register (ppage) r/w reserved  table 16-1. mmc memory map (continued) address offset register access

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 426 freescale semiconductor 16.3.2 register descriptions 16.3.2.1 initialization of internal ram position register (initrm) read: anytime name bit 7 6 5 4321 bit 0 initrm r ram15 ram14 ram13 ram12 ram11 00 ramhal w initrg r 0 reg14 reg13 reg12 reg11 000 w initee r ee15 ee14 ee13 ee12 ee11 00 eeon w misc r 0 0 0 0 exstr1 exstr0 romhm romon w mtsto r bit 7 6 5 4321 bit 0 w mtst1 r bit 7 6 5 4321 bit 0 w memsiz0 r reg_sw0 0 eep_sw1 eep_sw0 0 ram_sw2 ram_sw1 ram_sw0 w memsiz1 r rom_sw1 rom_sw0 0 0 0 0 pag_sw1 pag_sw0 w ppage r 0 0 pix5 pix4 pix3 pix2 pix1 pix0 w reserved r 0 0 0 00000 w = unimplemented figure 16-2. mmc register summary 76543210 r ram15 ram14 ram13 ram12 ram11 00 ramhal w reset 0 0 0 01001 = unimplemented or reserved figure 16-3. initialization of internal ram position register (initrm)

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 427 write: once in normal and emulation modes, anytime in special modes note writes to this register take one cycle to go into effect. this register initializes the position of the internal ram within the on-chip system memory map. table 16-2. initrm field descriptions field description 7:3 ram[15:11] internal ram map position  ?these bits determine the upper ?e bits of the base address for the systems internal ram array. 0 ramhal ram high-align ?ramhal speci?s the alignment of the internal ram array. 0 aligns the ram to the lowest address (0x0000) of the mappable space 1 aligns the ram to the higher address (0xffff) of the mappable space

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 428 freescale semiconductor 16.3.2.2 initialization of internal registers position register (initrg) read: anytime write: once in normal and emulation modes and anytime in special modes this register initializes the position of the internal registers within the on-chip system memory map. the registers occupy either a 1k byte or 2k byte space and can be mapped to any 2k byte space within the ?st 32k bytes of the systems address space. 76543210 r0 reg14 reg13 reg12 reg11 000 w reset 0 0 0 00000 = unimplemented or reserved figure 16-4. initialization of internal registers position register (initrg) table 16-3. initrg field descriptions field description 6:3 reg[14:11] internal register map position  ?these four bits in combination with the leading zero supplied by bit 7 of initrg determine the upper ?e bits of the base address for the systems internal registers (i.e., the minimum base address is 0x0000 and the maximum is 0x7fff).

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 429 16.3.2.3 initialization of internal eeprom position register (initee) read: anytime write: the eeon bit can be written to any time on all devices. bits e[11:15] are ?rite anytime in all modes on most devices. on some devices, bits e[11:15] are ?rite once in normal and emulation modes and write anytime in special modes? see device overview chapter to determine the actual write access rights. note writes to this register take one cycle to go into effect. this register initializes the position of the internal eeprom within the on-chip system memory map. 76543210 r ee15 ee14 ee13 ee12 ee11 00 eeon w reset 1  1. the reset state of this register is controlled at chip integration. please refer to the device overview section to determine  the actual reset state of this register. = unimplemented or reserved figure 16-5. initialization of internal eeprom position register (initee) table 16-4. initee field descriptions field description 7:3 ee[15:11] internal eeprom map position  these bits determine the upper ?e bits of the base address for the systems internal eeprom array. 0 eeon enable eeprom  ?this bit is used to enable the eeprom memory in the memory map. 0 disables the eeprom from the memory map. 1 enables the eeprom in the memory map at the address selected by ee[15:11].

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 430 freescale semiconductor 16.3.2.4 miscellaneous system control register (misc) read: anytime write: as stated in each bit description note writes to this register take one cycle to go into effect. this register initializes miscellaneous control functions. 76543210 r0000 exstr1 exstr0 romhm romon w reset: expanded or emulation 0000110 1 reset: peripheral or single chip 00001101 reset: special test 00001100 1. the reset state of this bit is determined at the chip integration level. = unimplemented or reserved figure 16-6. miscellaneous system control register (misc) table 16-5. initee field descriptions field description 3:2 exstr[1:0] external access stretch bits 1 and 0 write: once in normal and emulation modes and anytime in special modes this two-bit ?ld determines the amount of clock stretch on accesses to the external address space as shown in table 16-6 . in single chip and peripheral modes these bits have no meaning or effect. 1 romhm flash eeprom or rom only in second half of memory map write: once in normal and emulation modes and anytime in special modes 0 the ?ed page(s) of flash eeprom or rom in the lower half of the memory map can be accessed. 1 disables direct access to the flash eeprom or rom in the lower half of the memory map. these physical locations of the flash eeprom or rom remain accessible through the program page window. 0 romon romon ?enable flash eeprom or rom write: once in normal and emulation modes and anytime in special modes this bit is used to enable the flash eeprom or rom memory in the memory map. 0 disables the flash eeprom or rom from the memory map. 1 enables the flash eeprom or rom in the memory map. table 16-6. external stretch bit de?ition stretch bit exstr1 stretch bit exstr0 number of e clocks stretched 00 0 01 1 10 2 11 3

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 431 16.3.2.5 reserved test register 0 (mtst0) read: anytime write: no effect ?this register location is used for internal test purposes. 16.3.2.6 reserved test register 1 (mtst1) read: anytime write: no effect ?this register location is used for internal test purposes. 76543210 r00000000 w reset 0 0 0 00000 = unimplemented or reserved figure 16-7. reserved test register 0 (mtst0) 76543210 r00000000 w reset 0 0 0 10000 = unimplemented or reserved figure 16-8. reserved test register 1 (mtst1)

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 432 freescale semiconductor 16.3.2.7 memory size register 0 (memsiz0) read: anytime write: writes have no effect reset: de?ed at chip integration, see device overview section. the memsiz0 register re?cts the state of the register, eeprom and ram memory space con?uration switches at the core boundary which are con?ured at system integration. this register allows read visibility to the state of these switches. 76543210 r reg_sw0 0 eep_sw1 eep_sw0 0 ram_sw2 ram_sw1 ram_sw0 w reset    = unimplemented or reserved figure 16-9. memory size register 0 (memsiz0) table 16-7. memsiz0 field descriptions field description 7 reg_sw0 allocated system register space 0 allocated system register space size is 1k byte 1 allocated system register space size is 2k byte 5:4 eep_sw[1:0] allocated system eeprom memory space  ?the allocated system eeprom memory space size is as given in table 16-8 . 2 ram_sw[2:0] allocated system ram memory space  ?the allocated system ram memory space size is as given in table 16-9 . table 16-8. allocated eeprom memory space eep_sw1:eep_sw0 allocated eeprom space 00 0k byte 01 2k bytes 10 4k bytes 11 8k bytes table 16-9. allocated ram memory space ram_sw2:ram_sw0 allocated ram space ram mappable region initrm bits used ram reset base address 1 000 2k bytes 2k bytes ram[15:11] 0x0800 001 4k bytes 4k bytes ram[15:12] 0x0000 010 6k bytes 8k bytes 2 ram[15:13] 0x0800 011 8k bytes 8k bytes ram[15:13] 0x0000 100 10k bytes 16k bytes 2 ram[15:14] 0x1800

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 433 note as stated, the bits in this register provide read visibility to the system physical memory space allocations de?ed at system integration. the actual array size for any given type of memory block may differ from the allocated size. please refer to the device overview chapter for actual sizes. 16.3.2.8 memory size register 1 (memsiz1) read: anytime write: writes have no effect reset: de?ed at chip integration, see device overview section. the memsiz1 register re?cts the state of the flash or rom physical memory space and paging switches at the core boundary which are con?ured at system integration. this register allows read visibility to the state of these switches. 101 12k bytes 16k bytes 2 ram[15:14] 0x1000 110 14k bytes 16k bytes 2 ram[15:14] 0x0800 111 16k bytes 16k bytes ram[15:14] 0x0000 1 the ram reset base address is based on the reset value of the initrm register, 0x0009. 2 alignment of the allocated ram space within the ram mappable region is dependent on the value of ramhal. 76543210 r rom_sw1 rom_sw0 0 0 0 0 pag_sw1 pag_sw0 w reset    = unimplemented or reserved figure 16-10. memory size register 1 (memsiz1) table 16-10. memsiz0 field descriptions field description 7:6 rom_sw[1:0] allocated system flash or rom physical memory space  ?the allocated system flash or rom physical memory space is as given in table 16-11 . 1:0 pag_sw[1:0] allocated off-chip flash or rom memory space  the allocated off-chip flash or rom memory space size is as given in table 16-12 . table 16-9. allocated ram memory space (continued) ram_sw2:ram_sw0 allocated ram space ram mappable region initrm bits used ram reset base address 1

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 434 freescale semiconductor note as stated, the bits in this register provide read visibility to the system memory space and on-chip/off-chip partitioning allocations de?ed at system integration. the actual array size for any given type of memory block may differ from the allocated size. please refer to the device overview chapter for actual sizes. 16.3.2.9 program page index register (ppage) read: anytime write: determined at chip integration. generally its: ?rite anytime in all modes; on some devices it will be: ?rite only in special modes.?check speci? device documentation to determine which applies. reset: de?ed at chip integration as either 0x00 (paired with write in any mode) or 0x3c (paired with write only in special modes), see device overview chapter. table 16-11. allocated flash/rom physical memory space rom_sw1:rom_sw0 allocated flash or rom space 00 0k byte 01 16k bytes 10 48k bytes (1) 11 64k bytes (1) notes: 1. the romhm software bit in the misc register determines the accessibility of the flash/rom memory space. please refer to section 16.3.2.8, ?emory size register 1 (memsiz1) , for a detailed functional description of the romhm bit. table 16-12. allocated off-chip memory options pag_sw1:pag_sw0 off-chip space on-chip space 00 876k bytes 128k bytes 01 768k bytes 256k bytes 10 512k bytes 512k bytes 11 0k byte 1m byte 76543210 r0 0 pix5 pix4 pix3 pix2 pix1 pix0 w reset 1  1. the reset state of this register is controlled at chip integration. please refer to the device overview section to determine  the actual reset state of this register. = unimplemented or reserved figure 16-11. program page index register (ppage)

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 435 the hcs12 core architecture limits the physical address space available to 64k bytes. the program page index register allows for integrating up to 1m byte of flash or rom into the system by using the six page index bits to page 16k byte blocks into the program page window located from 0x8000 to 0xbfff as de?ed in table 16-14 . call and rtc instructions have special access to read and write this register without using the address bus. note normal writes to this register take one cycle to go into effect. writes to this register using the special access of the call and rtc instructions will be complete before the end of the associated instruction. 16.4 functional description the mmc sub-block performs four basic functions of the core operation: bus control, address decoding and select signal generation, memory expansion, and security decoding for the system. each aspect is described in the following subsections. 16.4.1 bus control the mmc controls the address bus and data buses that interface the core with the rest of the system. this includes the multiplexing of the input data buses to the core onto the main cpu read data bus and control table 16-13. memsiz0 field descriptions field description 5:0 pix[5:0] program page index bits 5:0  ?these page index bits are used to select which of the 64 flash or rom array pages is to be accessed in the program page window as shown in table 16-14 . table 16-14. program page index register bits pix5 pix4 pix3 pix2 pix1 pix0 program space selected 000000 16k page 0 000001 16k page 1 000010 16k page 2 000011 16k page 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111100 16k page 60 111101 16k page 61 111110 16k page 62 111111 16k page 63

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 436 freescale semiconductor of data ?w from the cpu to the output address and data buses of the core. in addition, the mmc manages all cpu read data bus swapping operations. 16.4.2 address decoding as data ?ws on the core address bus, the mmc decodes the address information, determines whether the internal core register or ?mware space, the peripheral space or a memory register or array space is being addressed and generates the correct select signal. this decoding operation also interprets the mode of operation of the system and the state of the mapping control registers in order to generate the proper select. the mmc also generates two external chip select signals, emulation chip select ( ecs) and external chip select ( xcs). 16.4.2.1 select priority and mode considerations although internal resources such as control registers and on-chip memory have default addresses, each can be relocated by changing the default values in control registers. normally, i/o addresses, control registers, vector spaces, expansion windows, and on-chip memory are mapped so that their address ranges do not overlap. the mmc will make only one select signal active at any given time. this activation is based upon the priority outlined in table 16-15 . if two or more blocks share the same address space, only the select signal for the block with the highest priority will become active. an example of this is if the registers and the ram are mapped to the same space, the registers will have priority over the ram and the portion of ram mapped in this shared space will not be accessible. the expansion windows have the lowest priority. this means that registers, vectors, and on-chip memory are always visible to a program regardless of the values in the page select registers. in expanded modes, all address space not used by internal resources is by default external memory space. the data registers and data direction registers for ports a and b are removed from the on-chip memory map and become external accesses. if the eme bit in the mode register (see mebi block description chapter) is set, the data and data direction registers for port e are also removed from the on-chip memory map and become external accesses. in special peripheral mode, the ?st 16 registers associated with bus expansion are removed from the on-chip memory map (porta, portb, ddra, ddrb, porte, ddre, pear, mode, pucr, rdriv, and the ebi reserved registers). table 16-15. select signal priority priority address space highest bdm (internal to core) ?mware or register space ... internal register space ... ram memory block ... eeprom memory block ... on-chip flash or rom lowest remaining external space

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 437 in emulation modes, if the emk bit in the mode register (see mebi block description chapter) is set, the data and data direction registers for port k are removed from the on-chip memory map and become external accesses. 16.4.2.2 emulation chip select signal when the emk bit in the mode register (see mebi block description chapter) is set, port k bit 7 is used as an active-low emulation chip select signal, ecs. this signal is active when the system is in emulation mode, the emk bit is set and the flash or rom space is being addressed subject to the conditions outlined in section 16.4.3.2, ?xtended address (xab19:14) and ecs signal functionality . when the emk bit is clear, this pin is used for general purpose i/o. 16.4.2.3 external chip select signal when the emk bit in the mode register (see mebi block description chapter) is set, port k bit 6 is used as an active-low external chip select signal, xcs. this signal is active only when the ecs signal described above is not active and when the system is addressing the external address space. accesses to unimplemented locations within the register space or to locations that are removed from the map (i.e., ports a and b in expanded modes) will not cause this signal to become active. when the emk bit is clear, this pin is used for general purpose i/o. 16.4.3 memory expansion the hcs12 core architecture limits the physical address space available to 64k bytes. the program page index register allows for integrating up to 1m byte of flash or rom into the system by using the six page index bits to page 16k byte blocks into the program page window located from 0x8000 to 0xbfff in the physical memory space. the paged memory space can consist of solely on-chip memory or a combination of on-chip and off-chip memory. this partitioning is con?ured at system integration through the use of the paging con?uration switches ( pag_sw1:pag_sw0 ) at the core boundary. the options available to the integrator are as given in table 16-16 (this table matches table 16-12 but is repeated here for easy reference). based upon the system con?uration, the program page window will consider its access to be either internal or external as de?ed in table 16-17 . table 16-16. allocated off-chip memory options pag_sw1:pag_sw0 off-chip space on-chip space 00 876k bytes 128k bytes 01 768k bytes 256k bytes 10 512k bytes 512k bytes 11 0k byte 1m byte

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 438 freescale semiconductor note the partitioning as de?ed in table 16-17  applies only to the allocated memory space and the actual on-chip memory sizes implemented in the system may differ. please refer to the device overview chapter for actual sizes. the ppage register holds the page select value for the program page window. the value of the ppage register can be manipulated by normal read and write (some devices dont allow writes in some modes) instructions as well as the call and rtc instructions. control registers, vector spaces, and a portion of on-chip memory are located in unpaged portions of the 64k byte physical address space. the stack and i/o addresses should also be in unpaged memory to make them accessible from any page. the starting address of a service routine must be located in unpaged memory because the 16-bit exception vectors cannot point to addresses in paged memory. however, a service routine can call other routines that are in paged memory. the upper 16k byte block of memory space (0xc000?xffff) is unpaged. it is recommended that all reset and interrupt vectors point to locations in this area. 16.4.3.1 call and return from call instructions call and rtc are uninterruptable instructions that automate page switching in the program expansion window. call is similar to a jsr instruction, but the subroutine that is called can be located anywhere in the normal 64k byte address space or on any page of program expansion memory. call calculates and stacks a return address, stacks the current ppage value, and writes a new instruction-supplied value to ppage. the ppage value controls which of the 64 possible pages is visible through the 16k byte expansion window in the 64k byte memory map. execution then begins at the address of the called subroutine. during the execution of a call instruction, the cpu:  writes the old ppage value into an internal temporary register and writes the new instruction-supplied ppage value into the ppage register. table 16-17. external/internal page window access pag_sw1:pag_sw0 partitioning pix5:0 value page window access 00 876k off-chip, 128k on-chip 0x0000?x0037 external 0x0038?x003f internal 01 768k off-chip, 256k on-chip 0x0000?x002f external 0x0030?x003f internal 10 512k off-chip, 512k on-chip 0x0000?x001f external 0x0020?x003f internal 11 0k off-chip, 1m on-chip n/a external 0x0000?x003f internal

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 439  calculates the address of the next instruction after the call instruction (the return address), and pushes this 16-bit value onto the stack.  pushes the old ppage value onto the stack.  calculates the effective address of the subroutine, re?ls the queue, and begins execution at the new address on the selected page of the expansion window. this sequence is uninterruptable; there is no need to inhibit interrupts during call execution. a call can be performed from any address in memory to any other address. the ppage value supplied by the instruction is part of the effective address. for all addressing mode variations except indexed-indirect modes, the new page value is provided by an immediate operand in the instruction. in indexed-indirect variations of call, a pointer speci?s memory locations where the new page value and the address of the called subroutine are stored. using indirect addressing for both the new page value and the address within the page allows values calculated at run time rather than immediate values that must be known at the time of assembly. the rtc instruction terminates subroutines invoked by a call instruction. rtc unstacks the ppage value and the return address and re?ls the queue. execution resumes with the next instruction after the call. during the execution of an rtc instruction, the cpu:  pulls the old ppage value from the stack  pulls the 16-bit return address from the stack and loads it into the pc  writes the old ppage value into the ppage register  re?ls the queue and resumes execution at the return address this sequence is uninterruptable; an rtc can be executed from anywhere in memory, even from a different page of extended memory in the expansion window. the call and rtc instructions behave like jsr and rts, except they use more execution cycles. therefore, routinely substituting call/rtc for jsr/rts is not recommended. jsr and rts can be used to access subroutines that are on the same page in expanded memory. however, a subroutine in expanded memory that can be called from other pages must be terminated with an rtc. and the rtc unstacks a ppage value. so any access to the subroutine, even from the same page, must use a call instruction so that the correct ppage value is in the stack. 16.4.3.2 extended address (xab19:14) and ecs signal functionality if the emk bit in the mode register is set (see mebi block description chapter) the pix5:0 values will be output on xab19:14 respectively (port k bits 5:0) when the system is addressing within the physical program page window address space (0x8000?xbfff) and is in an expanded mode. when addressing anywhere else within the physical address space (outside of the paging space), the xab19:14 signals will be assigned a constant value based upon the physical address space selected. in addition, the active-low emulation chip select signal, ecs, will likewise function based upon the assigned memory allocation. in the cases of 48k byte and 64k byte allocated physical flash/rom space, the operation of the ecs signal will additionally depend upon the state of the romhm bit (see section 16.3.2.4, ?iscellaneous system control register (misc) ? in the misc register. table 16-18 , table 16-19 , table 16-20 , and

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 440 freescale semiconductor table 16-21 summarize the functionality of these signals based upon the allocated memory con?uration. again, this signal information is only available externally when the emk bit is set and the system is in an expanded mode. table 16-18. 0k byte physical flash/rom allocated address space page window access romhm ecs xab19:14 0x0000?x3fff n/a n/a 1 0x3d 0x4000?x7fff n/a n/a 1 0x3e 0x8000?xbfff n/a n/a 0 pix[5:0] 0xc000?xffff n/a n/a 0 0x3f table 16-19. 16k byte physical flash/rom allocated address space page window access romhm ecs xab19:14 0x0000?x3fff n/a n/a 1 0x3d 0x4000?x7fff n/a n/a 1 0x3e 0x8000?xbfff n/a n/a 1 pix[5:0] 0xc000?xffff n/a n/a 0 0x3f table 16-20. 48k byte physical flash/rom allocated address space page window access romhm ecs xab19:14 0x0000?x3fff n/a n/a 1 0x3d 0x4000?x7fff n/a 0 0 0x3e n/a 1 1 0x8000?xbfff external n/a 1 pix[5:0] internal n/a 0 0xc000?xffff n/a n/a 0 0x3f table 16-21. 64k byte physical flash/rom allocated address space page window access romhm ecs xab19:14 0x0000?x3fff n/a 0 0 0x3d n/a 1 1 0x4000?x7fff n/a 0 0 0x3e n/a 1 1 0x8000?xbfff external n/a 1 pix[5:0] internal n/a 0 0xc000?xffff n/a n/a 0 0x3f

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 441 a graphical example of a memory paging for a system con?ured as 1m byte on-chip flash/rom with 64k allocated physical space is given in figure 16-12 . figure 16-12. memory paging example: 1m byte on-chip flash/rom, 64k allocation these 16k flash/rom pages accessible from 0x0000 to 0x7fff if selected by the romhm bit in the misc register. normal single chip one 16k flash/rom page accessible at a time (selected by ppage = 0 to 63) 0x0000 0x8000 0xff00 0xffff 0x4000 0xc000 59 62 63 60 61 62 63 0123 61 16k flash (unpaged) 16k flash (unpaged) 16k flash (paged) 16k flash (unpaged) vectors

 chapter 16 module mapping control (mmcv4) mc9s12ne64 data sheet, rev. 1.1 442 freescale semiconductor

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 443 chapter 17 background debug module (bdmv4) 17.1 introduction this section describes the functionality of the background debug module (bdm) sub-block of the hcs12 core platform. a block diagram of the bdm is shown in figure 17-1 . figure 17-1. bdm block diagram the background debug module (bdm) sub-block is a single-wire, background debug system implemented in on-chip hardware for minimal cpu intervention. all interfacing with the bdm is done via the bkgd pin. bdmv4 has enhanced capability for maintaining synchronization between the target and host while allowing more ?xibility in clock rates. this includes a sync signal to show the clock rate and a handshake signal to indicate when an operation is complete. the system is backwards compatible with older external interfaces. 17.1.1 features  single-wire communication with host development system  bdmv4 (and bdm2): enhanced capability for allowing more ?xibility in clock rates  bdmv4: sync command to determine communication rate  bdmv4: go_until command  bdmv4: hardware handshake protocol to increase the performance of the serial communication  active out of reset in special single-chip mode  nine hardware commands using free cycles, if available, for minimal cpu intervention  hardware commands not requiring active bdm  15 ?mware commands execute from the standard bdm ?mware lookup table enbdm sdv 16-bit shift register bkgd clocks data address host system bus interface and control logic instruction decode and execution standard bdm firmware lookup table clksw bdmact entag trace

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 444 freescale semiconductor  instruction tagging capability  software control of bdm operation during wait mode  software selectable clocks  when secured, hardware commands are allowed to access the register space in special single-chip mode, if the flash and eeprom erase tests fail. 17.1.2 modes of operation bdm is available in all operating modes but must be enabled before ?mware commands are executed. some system peripherals may have a control bit which allows suspending the peripheral function during background debug mode. 17.1.2.1 regular run modes all of these operations refer to the part in run mode. the bdm does not provide controls to conserve power during run mode.  normal operation general operation of the bdm is available and operates the same in all normal modes.  special single-chip mode in special single-chip mode, background operation is enabled and active out of reset. this allows programming a system with blank memory.  special peripheral mode bdm is enabled and active immediately out of reset. bdm can be disabled by clearing the bdmact bit in the bdm status (bdmsts) register. the bdm serial system should not be used in special peripheral mode.  emulation modes general operation of the bdm is available and operates the same as in normal modes. 17.1.2.2 secure mode operation if the part is in secure mode, the operation of the bdm is reduced to a small subset of its regular run mode operation. secure operation prevents access to flash or eeprom other than allowing erasure. 17.2 external signal description a single-wire interface pin is used to communicate with the bdm system. two additional pins are used for instruction tagging. these pins are part of the multiplexed external bus interface (mebi) sub-block and all interfacing between the mebi and bdm is done within the core interface boundary. functional descriptions of the pins are provided below for completeness.  bkgd ?background interface pin  t a ghi ?high byte instruction tagging pin  t a glo ?low byte instruction tagging pin

 external signal description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 445  bkgd and t a ghi share the same pin.  t a glo and lstrb share the same pin. note generally these pins are shared as described, but it is best to check the device overview chapter to make certain. all mcus at the time of this writing have followed this pin sharing scheme. 17.2.1 bkgd ?background interface pin debugging control logic communicates with external devices serially via the single-wire background interface pin (bkgd). during reset, this pin is a mode select input which selects between normal and special modes of operation. after reset, this pin becomes the dedicated serial interface pin for the background debug mode. 17.2.2 t a ghi ?high byte instruction tagging pin this pin is used to tag the high byte of an instruction. when instruction tagging is on, a logic 0 at the falling edge of the external clock (eclk) tags the high half of the instruction word being read into the instruction queue. 17.2.3 t a glo ?low byte instruction tagging pin this pin is used to tag the low byte of an instruction. when instruction tagging is on and low strobe is enabled, a logic 0 at the falling edge of the external clock (eclk) tags the low half of the instruction word being read into the instruction queue.

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 446 freescale semiconductor 17.3 memory map and register de?ition a summary of the registers associated with the bdm is shown in figure 17-2 . registers are accessed by host-driven communications to the bdm hardware using read_bd and write_bd commands. detailed descriptions of the registers and associated bits are given in the subsections that follow. 17.3.1 module memory map table 17-1. int memory map register address use access reserved  bdm status register (bdmsts) r/w reserved  bdm ccr holding register (bdmccr) r/w 7 bdm internal register position (bdminr) r 8 reserved 

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 447 17.3.2 register descriptions register name bit 7 6 5 4321 bit 0 reserved r x x x x x x 0 0 w bdmsts r enbdm bdmact entag sdv trace clksw unsec 0 w reserved r x x x xxxxx w reserved r x x x xxxxx w reserved r x x x xxxxx w reserved r x x x xxxxx w bdmccr r ccr7 ccr6 ccr5 ccr4 ccr3 ccr2 ccr1 ccr0 w bdminr r 0 reg14 reg13 reg12 reg11 0 0 0 w reserved r 0 0 0 00000 w reserved r 0 0 0 00000 w reserved r x x x xxxxx w reserved r x x x xxxxx w  = unimplemented, reserved  = implemented (do not alter) x  = indeterminate 0  = always read zero figure 17-2.  bdm register summary

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 448 freescale semiconductor 17.3.2.1 bdm status register (bdmsts) read: all modes through bdm operation write: all modes but subject to the following:  bdmact can only be set by bdm hardware upon entry into bdm. it can only be cleared by the standard bdm ?mware lookup table upon exit from bdm active mode.  clksw can only be written via bdm hardware or standard bdm ?mware write commands.  all other bits, while writable via bdm hardware or standard bdm ?mware write commands, should only be altered by the bdm hardware or standard ?mware lookup table as part of bdm command execution.  enbdm should only be set via a bdm hardware command if the bdm ?mware commands are needed. (this does not apply in special single-chip mode). 76543210 r enbdm bdmact entag sdv trace clksw unsec 0 w reset: special single-chip mode: special peripheral mode: all other modes: 1 1 0 0 0 1 enbdm is read as "1" by a debugging environment in special single-chip mode when the device is not secured or secured but fully erased (flash and eeprom).this is because the enbdm bit is set by the standard firmware before a bdm command can be fully transmitted and executed. 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 2 unsec is read as "1" by a debugging environment in special single-chip mode when the device is secured and fully erased, else it is "0" and can only be read if not secure (see also bit description). 0 0 0 0 = unimplemented or reserved = implemented (do not alter) figure 17-3. bdm status register (bdmsts) note: table 17-2. bdmsts field descriptions field description 7 enbdm enable bdm  ?this bit controls whether the bdm is enabled or disabled. when enabled, bdm can be made active to allow ?mware commands to be executed. when disabled, bdm cannot be made active but bdm hardware commands are allowed. 0 bdm disabled 1 bdm enabled note: enbdm is set by the ?mware immediately out of reset in special single-chip mode. in secure mode, this bit will not be set by the ?mware until after the eeprom and flash erase verify tests are complete. 6 bdmact bdm active status  ?this bit becomes set upon entering bdm. the standard bdm ?mware lookup table is then enabled and put into the memory map. bdmact is cleared by a carefully timed store instruction in the standard bdm ?mware as part of the exit sequence to return to user code and remove the bdm memory from the map. 0 bdm not active 1 bdm active

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 449 5 entag tagging enable  ?this bit indicates whether instruction tagging in enabled or disabled. it is set when the taggo command is executed and cleared when bdm is entered. the serial system is disabled and the tag function enabled 16 cycles after this bit is written. bdm cannot process serial commands while tagging is active. 0 tagging not enabled or bdm active 1 tagging enabled 4 sdv shift data valid  this bit is set and cleared by the bdm hardware. it is set after data has been transmitted as part of a ?mware read command or after data has been received as part of a ?mware write command. it is cleared when the next bdm command has been received or bdm is exited. sdv is used by the standard bdm ?mware to control program ?w execution. 0 data phase of command not complete 1 data phase of command is complete 3 trace trace1 bdm firmware command is being executed ?this bit gets set when a bdm trace1 ?mware command is ?st recognized. it will stay set as long as continuous back-to-back trace1 commands are executed. this bit will get cleared when the next command that is not a trace1 command is recognized. 0 trace1 command is not being executed 1 trace1 command is being executed 2 clksw clock switch  the clksw bit controls which clock the bdm operates with. it is only writable from a hardware bdm command. a 150 cycle delay at the clock speed that is active during the data portion of the command will occur before the new clock source is guaranteed to be active. the start of the next bdm command uses the new clock for timing subsequent bdm communications. table 17-3  shows the resulting bdm clock source based on the clksw and the pllsel (pll select from the clock and reset generator) bits. note: the bdm alternate clock source can only be selected when clksw = 0 and pllsel = 1. the bdm serial interface is now fully synchronized to the alternate clock source, when enabled. this eliminates frequency restriction on the alternate clock which was required on previous versions. refer to the device overview section to determine which clock connects to the alternate clock source input. note: if the acknowledge function is turned on, changing the clksw bit will cause the ack to be at the new rate for the write command which changes it. 1 unsec unsecure  this bit is only writable in special single-chip mode from the bdm secure ?mware and always gets reset to zero. it is in a zero state as secure mode is entered so that the secure bdm ?mware lookup table is enabled and put into the memory map along with the standard bdm ?mware lookup table. the secure bdm ?mware lookup table veri?s that the on-chip eeprom and flash eeprom are erased. this being the case, the unsec bit is set and the bdm program jumps to the start of the standard bdm ?mware lookup table and the secure bdm ?mware lookup table is turned off. if the erase test fails, the unsec bit will not be asserted. 0 system is in a secured mode 1 system is in a unsecured mode note: when unsec is set, security is off and the user can change the state of the secure bits in the on-chip flash eeprom. note that if the user does not change the state of the bits to ?nsecured?mode, the system will be secured again when it is next taken out of reset. table 17-3. bdm clock sources pllsel clksw bdmclk 0 0 bus clock 0 1 bus clock table 17-2. bdmsts field descriptions (continued) field description

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 450 freescale semiconductor 1 0 alternate clock (refer to the device overview chapter to determine the alternate clock source) 1 1 bus clock dependent on the pll table 17-3. bdm clock sources pllsel clksw bdmclk

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 451 17.3.2.2 bdm ccr holding register (bdmccr) read: all modes write: all modes note when bdm is made active, the cpu stores the value of the ccr register in the bdmccr register. however, out of special single-chip reset, the bdmccr is set to 0xd8 and not 0xd0 which is the reset value of the ccr register. when entering background debug mode, the bdm ccr holding register is used to save the contents of the condition code register of the users program. it is also used for temporary storage in the standard bdm ?mware mode. the bdm ccr holding register can be written to modify the ccr value. 17.3.2.3 bdm internal register position register (bdminr) read: all modes write: never 76543210 r ccr7 ccr6 ccr5 ccr4 ccr3 ccr2 ccr1 ccr0 w reset 0 0 0 00000 figure 17-4. bdm ccr holding register (bdmccr) 76543210 r 0 reg14 reg13 reg12 reg11 0 0 0 w reset 0 0 0 00000 = unimplemented or reserved figure 17-5. bdm internal register position (bdminr) table 17-4. bdminr field descriptions field description 6:3 reg[14:11] internal register map position  these four bits show the state of the upper ?e bits of the base address for the systems relocatable register block. bdminr is a shadow of the initrg register which maps the register block to any 2k byte space within the ?st 32k bytes of the 64k byte address space.

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 452 freescale semiconductor 17.4 functional description the bdm receives and executes commands from a host via a single wire serial interface. there are two types of bdm commands, namely, hardware commands and ?mware commands. hardware commands are used to read and write target system memory locations and to enter active background debug mode, see section 17.4.3, ?dm hardware commands . target system memory includes all memory that is accessible by the cpu. firmware commands are used to read and write cpu resources and to exit from active background debug mode, see section 17.4.4, ?tandard bdm firmware commands . the cpu resources referred to are the accumulator (d), x index register (x), y index register (y), stack pointer (sp), and program counter (pc). hardware commands can be executed at any time and in any mode excluding a few exceptions as highlighted, see section 17.4.3, ?dm hardware commands . firmware commands can only be executed when the system is in active background debug mode (bdm). 17.4.1 security if the user resets into special single-chip mode with the system secured, a secured mode bdm ?mware lookup table is brought into the map overlapping a portion of the standard bdm ?mware lookup table. the secure bdm ?mware veri?s that the on-chip eeprom and flash eeprom are erased. this being the case, the unsec bit will get set. the bdm program jumps to the start of the standard bdm ?mware and the secured mode bdm ?mware is turned off and all bdm commands are allowed. if the eeprom or flash do not verify as erased, the bdm ?mware sets the enbdm bit, without asserting unsec, and the ?mware enters a loop. this causes the bdm hardware commands to become enabled, but does not enable the ?mware commands. this allows the bdm hardware to be used to erase the eeprom and flash. after execution of the secure ?mware, regardless of the results of the erase tests, the cpu registers, initee and ppage, will no longer be in their reset state. 17.4.2 enabling and activating bdm the system must be in active bdm to execute standard bdm ?mware commands. bdm can be activated only after being enabled. bdm is enabled by setting the enbdm bit in the bdm status (bdmsts) register. the enbdm bit is set by writing to the bdm status (bdmsts) register, via the single-wire interface, using a hardware command such as write_bd_byte. after being enabled, bdm is activated by one of the following 1 :  hardware background command  bdm external instruction tagging mechanism  cpu bgnd instruction  breakpoint sub-blocks force or tag mechanism 2 when bdm is activated, the cpu ?ishes executing the current instruction and then begins executing the ?mware in the standard bdm ?mware lookup table. when bdm is activated by the breakpoint 1. bdm is enabled and active immediately out of special single-chip reset. 2. this method is only available on systems that have a a breakpoint or a debug sub-block.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 453 sub-block, the type of breakpoint used determines if bdm becomes active before or after execution of the next instruction. note if an attempt is made to activate bdm before being enabled, the cpu resumes normal instruction execution after a brief delay. if bdm is not enabled, any hardware background commands issued are ignored by the bdm and the cpu is not delayed. in active bdm, the bdm registers and standard bdm ?mware lookup table are mapped to addresses 0xff00 to 0xffff. bdm registers are mapped to addresses 0xff00 to 0xff07. the bdm uses these registers which are readable anytime by the bdm. however, these registers are not readable by user programs. 17.4.3 bdm hardware commands hardware commands are used to read and write target system memory locations and to enter active background debug mode. target system memory includes all memory that is accessible by the cpu such as on-chip ram, eeprom, flash eeprom, i/o and control registers, and all external memory. hardware commands are executed with minimal or no cpu intervention and do not require the system to be in active bdm for execution, although they can continue to be executed in this mode. when executing a hardware command, the bdm sub-block waits for a free cpu bus cycle so that the background access does not disturb the running application program. if a free cycle is not found within 128 clock cycles, the cpu is momentarily frozen so that the bdm can steal a cycle. when the bdm ?ds a free cycle, the operation does not intrude on normal cpu operation provided that it can be completed in a single cycle. however, if an operation requires multiple cycles the cpu is frozen until the operation is complete, even though the bdm found a free cycle.

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 454 freescale semiconductor the bdm hardware commands are listed in table 17-5 . note: if enabled, ack will occur when data is ready for transmission for all bdm read commands and will occur after the write is complete for all bdm write commands. the read_bd and write_bd commands allow access to the bdm register locations. these locations are not normally in the system memory map but share addresses with the application in memory. to distinguish between physical memory locations that share the same address, bdm memory resources are enabled just for the read_bd and write_bd access cycle. this allows the bdm to access bdm locations unobtrusively, even if the addresses con?ct with the application memory map. 17.4.4 standard bdm firmware commands firmware commands are used to access and manipulate cpu resources. the system must be in active bdm to execute standard bdm ?mware commands, see section 17.4.2, ?nabling and activating bdm . normal instruction execution is suspended while the cpu executes the ?mware located in the standard bdm ?mware lookup table. the hardware command background is the usual way to activate bdm. as the system enters active bdm, the standard bdm ?mware lookup table and bdm registers become visible in the on-chip memory map at 0xff00?xffff, and the cpu begins executing the standard bdm table 17-5. hardware commands command opcode  (hex) data description background 90 none enter background mode if ?mware is enabled. if enabled, an ack will be issued when the part enters active background mode. ack_enable d5 none enable handshake. issues an ack pulse after the command is executed. ack_disable d6 none disable handshake. this command does not issue an ack pulse. read_bd_byte e4 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table in map. odd address data on low byte; even address data on high byte. read_bd_word ec 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table in map. must be aligned access. read_byte e0 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table out of map. odd address data on low byte; even address data on high byte. read_word e8 16-bit address 16-bit data out read from memory with standard bdm ?mware lookup table out of map. must be aligned access. write_bd_byte c4 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table in map. odd address data on low byte; even address data on high byte. write_bd_word cc 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table in map. must be aligned access. write_byte c0 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table out of map. odd address data on low byte; even address data on high byte. write_word c8 16-bit address 16-bit data in write to memory with standard bdm ?mware lookup table out of map. must be aligned access.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 455 ?mware. the standard bdm ?mware watches for serial commands and executes them as they are received. the ?mware commands are shown in table 17-6 . 17.4.5 bdm command structure hardware and ?mware bdm commands start with an 8-bit opcode followed by a 16-bit address and/or a 16-bit data word depending on the command. all the read commands return 16 bits of data despite the byte or word implication in the command name. note 8-bit reads return 16-bits of data, of which, only one byte will contain valid data. if reading an even address, the valid data will appear in the msb. if reading an odd address, the valid data will appear in the lsb. table 17-6. firmware commands command 1 1 if enabled, ack will occur when data is ready for transmission for all bdm read commands and will occur after the write is complete for all bdm write commands. opcode (hex) data description read_next 62 16-bit data out increment x by 2 (x = x + 2), then read word x points to. read_pc 63 16-bit data out read program counter. read_d 64 16-bit data out read d accumulator. read_x 65 16-bit data out read x index register. read_y 66 16-bit data out read y index register. read_sp 67 16-bit data out read stack pointer. write_next 42 16-bit data in increment x by 2 (x = x + 2), then write word to location pointed to by x. write_pc 43 16-bit data in write program counter. write_d 44 16-bit data in write d accumulator. write_x 45 16-bit data in write x index register. write_y 46 16-bit data in write y index register. write_sp 47 16-bit data in write stack pointer. go 08 none go to user program. if enabled, ack will occur when leaving active background mode. go_until 2 2 both wait (with clocks to the s12 cpu core disabled) and stop disable the ack function. the go_until command will not get an acknowledge if one of these two cpu instructions occurs before the ?ntil instruction. this can be a problem for any instruction that uses ack, but go_until is a lot more dif?ult for the development tool to time-out. 0c none go to user program. if enabled, ack will occur upon returning to active background mode. trace1 10 none execute one user instruction then return to active bdm. if enabled, ack will occur upon returning to active background mode. taggo 18 none enable tagging and go to user program. there is no ack pulse related to this command.

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 456 freescale semiconductor note 16-bit misaligned reads and writes are not allowed. if attempted, the bdm will ignore the least signi?ant bit of the address and will assume an even address from the remaining bits. for hardware data read commands, the external host must wait 150 bus clock cycles after sending the address before attempting to obtain the read data. this is to be certain that valid data is available in the bdm shift register, ready to be shifted out. for hardware write commands, the external host must wait 150 bus clock cycles after sending the data to be written before attempting to send a new command. this is to avoid disturbing the bdm shift register before the write has been completed. the 150 bus clock cycle delay in both cases includes the maximum 128 cycle delay that can be incurred as the bdm waits for a free cycle before stealing a cycle. for ?mware read commands, the external host should wait 44 bus clock cycles after sending the command opcode and before attempting to obtain the read data. this includes the potential of an extra 7 cycles when the access is external with a narrow bus access (+1 cycle) and / or a stretch (+1, 2, or 3 cycles), (7 cycles could be needed if both occur). the 44 cycle wait allows enough time for the requested data to be made available in the bdm shift register, ready to be shifted out. note this timing has increased from previous bdm modules due to the new capability in which the bdm serial interface can potentially run faster than the bus. on previous bdm modules this extra time could be hidden within the serial time. for ?mware write commands, the external host must wait 32 bus clock cycles after sending the data to be written before attempting to send a new command. this is to avoid disturbing the bdm shift register before the write has been completed. the external host should wait 64 bus clock cycles after a trace1 or go command before starting any new serial command. this is to allow the cpu to exit gracefully from the standard bdm ?mware lookup table and resume execution of the user code. disturbing the bdm shift register prematurely may adversely affect the exit from the standard bdm ?mware lookup table. note if the bus rate of the target processor is unknown or could be changing, it is recommended that the ack (acknowledge function) be used to indicate when an operation is complete. when using ack, the delay times are automated. figure 17-6  represents the bdm command structure. the command blocks illustrate a series of eight bit times starting with a falling edge. the bar across the top of the blocks indicates that the bkgd line idles in the high state. the time for an 8-bit command is 8   16 target clock cycles. 1 1. target clock cycles are cycles measured using the target mcus serial clock rate. see section 17.4.6, ?dm serial interface , and section 17.3.2.1, ?dm status register (bdmsts) , for information on how serial clock rate is selected.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 457 figure 17-6. bdm command structure 17.4.6 bdm serial interface the bdm communicates with external devices serially via the bkgd pin. during reset, this pin is a mode select input which selects between normal and special modes of operation. after reset, this pin becomes the dedicated serial interface pin for the bdm. the bdm serial interface is timed using the clock selected by the clksw bit in the status register see section 17.3.2.1, ?dm status register (bdmsts) . this clock will be referred to as the target clock in the following explanation. the bdm serial interface uses a clocking scheme in which the external host generates a falling edge on the bkgd pin to indicate the start of each bit time. this falling edge is sent for every bit whether data is transmitted or received. data is transferred most signi?ant bit (msb) ?st at 16 target clock cycles per bit. the interface times out if 512 clock cycles occur between falling edges from the host. the bkgd pin is a pseudo open-drain pin and has an weak on-chip active pull-up that is enabled at all times. it is assumed that there is an external pull-up and that drivers connected to bkgd do not typically drive the high level. because r-c rise time could be unacceptably long, the target system and host provide brief driven-high (speedup) pulses to drive bkgd to a logic 1. the source of this speedup pulse is the host for transmit cases and the target for receive cases. the timing for host-to-target is shown in figure 17-7  and that of target-to-host in figure 17-8  and figure 17-9 . all four cases begin when the host drives the bkgd pin low to generate a falling edge. because the host and target are operating from separate clocks, it can take the target system up to one full clock cycle to recognize this edge. the target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove bkgd low to start the bit up to one target hardware hardware firmware firmware go, 44-bc bc = bus clock cycles command address 150-bc delay next delay 8 bits at  16 tc/bit 16 bits at  16 tc/bit 16 bits at   16 tc/bit command address data next data read write read write trace command next command data 64-bc delay next command 150-bc delay 32-bc delay command command command command data next command tc = target clock cycles

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 458 freescale semiconductor clock cycle earlier. synchronization between the host and target is established in this manner at the start of every bit time. figure 17-7 shows an external host transmitting a logic 1 and transmitting a logic 0 to the bkgd pin of a target system. the host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. ten target clock cycles later, the target senses the bit level on the bkgd pin. internal glitch detect logic requires the pin be driven high no later that eight target clock cycles after the falling edge for a logic 1 transmission. because the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. figure 17-7. bdm host-to-target serial bit timing the receive cases are more complicated. figure 17-8  shows the host receiving a logic 1 from the target system. because the host is asynchronous to the target, there is up to one clock-cycle delay from the host-generated falling edge on bkgd to the perceived start of the bit time in the target. the host holds the bkgd pin low long enough for the target to recognize it (at least two target clock cycles). the host must release the low drive before the target drives a brief high speedup pulse seven target clock cycles after the perceived start of the bit time. the host should sample the bit level about 10 target clock cycles after it started the bit time. earliest start of next bit target senses bit 10 cycles synchronization uncertainty clock target system host transmit 1 host transmit 0 perceived s tart of bit time

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 459 figure 17-8. bdm target-to-host serial bit timing (logic 1) figure 17-9  shows the host receiving a logic 0 from the target. because the host is asynchronous to the target, there is up to a one clock-cycle delay from the host-generated falling edge on bkgd to the start of the bit time as perceived by the target. the host initiates the bit time but the target ?ishes it. because the target wants the host to receive a logic 0, it drives the bkgd pin low for 13 target clock cycles then brie? drives it high to speed up the rising edge. the host samples the bit level about 10 target clock cycles after starting the bit time. figure 17-9. bdm target-to-host serial bit timing (logic 0) high-impedance earliest start of next bit r-c rise 10 cycles 10 cycles host samples bkgd pin perceived start of bit time bkgd pin clock target system host drive to bkgd pin target system speedup pulse high-impedance high-impedance earliest start of next bit clock target sys. host drive to bkgd pin bkgd pin perceived start of bit time 10 cycles 10 cycles host samples bkgd pin target sys. drive and speedup pulse speedup pulse high-impedance

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 460 freescale semiconductor 17.4.7 serial interface hardware handshake protocol bdm commands that require cpu execution are ultimately treated at the mcu bus rate. because the bdm clock source can be asynchronously related to the bus frequency, when clksw = 0, it is very helpful to provide a handshake protocol in which the host could determine when an issued command is executed by the cpu. the alternative is to always wait the amount of time equal to the appropriate number of cycles at the slowest possible rate the clock could be running. this sub-section will describe the hardware handshake protocol. the hardware handshake protocol signals to the host controller when an issued command was successfully executed by the target. this protocol is implemented by a 16 serial clock cycle low pulse followed by a brief speedup pulse in the bkgd pin. this pulse is generated by the target mcu when a command, issued by the host, has been successfully executed (see figure 17-10 ). this pulse is referred to as the ack pulse. after the ack pulse has ?ished: the host can start the bit retrieval if the last issued command was a read command, or start a new command if the last command was a write command or a control command (background, go, go_until, or trace1). the ack pulse is not issued earlier than 32 serial clock cycles after the bdm command was issued. the end of the bdm command is assumed to be the 16th tick of the last bit. this minimum delay assures enough time for the host to perceive the ack pulse. note also that, there is no upper limit for the delay between the command and the related ack pulse, because the command execution depends upon the cpu bus frequency, which in some cases could be very slow compared to the serial communication rate. this protocol allows a great ?xibility for the pod designers, because it does not rely on any accurate time measurement or short response time to any event in the serial communication. figure 17-10. target acknowledge pulse (ack) note if the ack pulse was issued by the target, the host assumes the previous command was executed. if the cpu enters wait or stop prior to executing a hardware command, the ack pulse will not be issued meaning that the bdm command was not executed. after entering wait or stop mode, the bdm command is no longer pending. 16 cycles bdm clock (target mcu) target transmits pulse ack high-impedance bkgd pin minimum delay from the bdm command 32 cycles earliest start of next bit speedup pulse 16th tick of the last commad bit high-impedance

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 461 figure 17-11 shows the ack handshake protocol in a command level timing diagram. the read_byte instruction is used as an example. first, the 8-bit instruction opcode is sent by the host, followed by the address of the memory location to be read. the target bdm decodes the instruction. a bus cycle is grabbed (free or stolen) by the bdm and it executes the read_byte operation. having retrieved the data, the bdm issues an ack pulse to the host controller, indicating that the addressed byte is ready to be retrieved. after detecting the ack pulse, the host initiates the byte retrieval process. note that data is sent in the form of a word and the host needs to determine which is the appropriate byte based on whether the address was odd or even. figure 17-11. handshake protocol at command level differently from the normal bit transfer (where the host initiates the transmission), the serial interface ack handshake pulse is initiated by the target mcu by issuing a falling edge in the bkgd pin. the hardware handshake protocol in figure 17-10  speci?s the timing when the bkgd pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical con?ct in the bkgd pin. note the only place the bkgd pin can have an electrical con?ct is when one side is driving low and the other side is issuing a speedup pulse (high). other ?ighs are pulled rather than driven. however, at low rates the time of the speedup pulse can become lengthy and so the potential con?ct time becomes longer as well. the ack handshake protocol does not support nested ack pulses. if a bdm command is not acknowledge by an ack pulse, the host needs to abort the pending command ?st in order to be able to issue a new bdm command. when the cpu enters wait or stop while the host issues a command that requires cpu execution (e.g., write_byte), the target discards the incoming command due to the wait or stop being detected. therefore, the command is not acknowledged by the target, which means that the ack pulse will not be issued in this case. after a certain time the host should decide to abort the ack sequence in order to be free to issue a new command. therefore, the protocol should provide a mechanism in which a command, and therefore a pending ack, could be aborted. note differently from a regular bdm command, the ack pulse does not provide a time out. this means that in the case of a wait or stop instruction being executed, the ack would be prevented from being issued. if not aborted, the ack would remain pending inde?itely. see the handshake abort procedure described in section 17.4.8, ?ardware handshake abort procedure . read_byte bdm issues the bkgd pin byte address bdm executes the read_byte command host target host target bdm decodes the command ack pulse (out of scale) host target (2) bytes are retrieved new bdm command

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 462 freescale semiconductor 17.4.8 hardware handshake abort procedure the abort procedure is based on the sync command. in order to abort a command, which had not issued the corresponding ack pulse, the host controller should generate a low pulse in the bkgd pin by driving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speedup pulse. by detecting this long low pulse in the bkgd pin, the target executes the sync protocol, see section 17.4.9, ?ync  request timed reference pulse , and assumes that the pending command and therefore the related ack pulse, are being aborted. therefore, after the sync protocol has been completed the host is free to issue new bdm commands. although it is not recommended, the host could abort a pending bdm command by issuing a low pulse in the bkgd pin shorter than 128 serial clock cycles, which will not be interpreted as the sync command. the ack is actually aborted when a falling edge is perceived by the target in the bkgd pin. the short abort pulse should have at least 4 clock cycles keeping the bkgd pin low, in order to allow the falling edge to be detected by the target. in this case, the target will not execute the sync protocol but the pending command will be aborted along with the ack pulse. the potential problem with this abort procedure is when there is a con?ct between the ack pulse and the short abort pulse. in this case, the target may not perceive the abort pulse. the worst case is when the pending command is a read command (i.e., read_byte). if the abort pulse is not perceived by the target the host will attempt to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. in this case, host and target will run out of synchronism. however, if the command to be aborted is not a read command the short abort pulse could be used. after a command is aborted the target assumes the next falling edge, after the abort pulse, is the ?st bit of a new bdm command. note the details about the short abort pulse are being provided only as a reference for the reader to better understand the bdm internal behavior. it is not recommended that this procedure be used in a real application. because the host knows the target serial clock frequency, the sync command (used to abort a command) does not need to consider the lower possible target frequency. in this case, the host could issue a sync very close to the 128 serial clock cycles length. providing a small overhead on the pulse length in order to assure the sync pulse will not be misinterpreted by the target. see section 17.4.9, ?ync ?request timed reference pulse . figure 17-12  shows a sync command being issued after a read_byte, which aborts the read_byte command. note that, after the command is aborted a new command could be issued by the host computer. note figure 17-12  does not represent the signals in a true timing scale

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 463 figure 17-12. ack abort procedure at the command level figure 17-13  shows a con?ct between the ack pulse and the sync request pulse. this con?ct could occur if a pod device is connected to the target bkgd pin and the target is already in debug active mode. consider that the target cpu is executing a pending bdm command at the exact moment the pod is being connected to the bkgd pin. in this case, an ack pulse is issued along with the sync command. in this case, there is an electrical con?ct between the ack speedup pulse and the sync pulse. because this is not a probable situation, the protocol does not prevent this con?ct from happening. figure 17-13. ack pulse and sync request con?ct note this information is being provided so that the mcu integrator will be aware that such a con?ct could eventually occur. the hardware handshake protocol is enabled by the ack_enable and disabled by the ack_disable bdm commands. this provides backwards compatibility with the existing pod devices which are not able to execute the hardware handshake protocol. it also allows for new pod devices, that support the hardware handshake protocol, to freely communicate with the target device. if desired, without the need for waiting for the ack pulse. read_byte read_status bkgd pin memory address new bdm command new bdm command host target host target host target sync response from the target (out of scale) bdm decode and starts to executes the read_byte cmd read_byte cmd is aborted by the sync request (out of scale) bdm clock (target mcu) target mcu drives to bkgd pin bkgd pin 16 cycles speedup pulse high-impedance host drives sync to bkgd pin ack pulse host sync request pulse at least 128 cycles electrical conflict host and target drive to bkgd pin

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 464 freescale semiconductor the commands are described as follows:  ack_enable  enables the hardware handshake protocol. the target will issue the ack pulse when a cpu command is executed by the cpu. the ack_enable command itself also has the ack pulse as a response.  ack_disable  disables the ack pulse protocol. in this case, the host needs to use the worst case delay time at the appropriate places in the protocol. the default state of the bdm after reset is hardware handshake protocol disabled. all the read commands will ack (if enabled) when the data bus cycle has completed and the data is then ready for reading out by the bkgd serial pin. all the write commands will ack (if enabled) after the data has been received by the bdm through the bkgd serial pin and when the data bus cycle is complete. see section 17.4.3, ?dm hardware commands , and section 17.4.4, ?tandard bdm firmware commands , for more information on the bdm commands. the ack_enable sends an ack pulse when the command has been completed. this feature could be used by the host to evaluate if the target supports the hardware handshake protocol. if an ack pulse is issued in response to this command, the host knows that the target supports the hardware handshake protocol. if the target does not support the hardware handshake protocol the ack pulse is not issued. in this case, the ack_enable command is ignored by the target because it is not recognized as a valid command. the background command will issue an ack pulse when the cpu changes from normal to background mode. the ack pulse related to this command could be aborted using the sync command. the go command will issue an ack pulse when the cpu exits from background mode. the ack pulse related to this command could be aborted using the sync command. the go_until command is equivalent to a go command with exception that the ack pulse, in this case, is issued when the cpu enters into background mode. this command is an alternative to the go command and should be used when the host wants to trace if a breakpoint match occurs and causes the cpu to enter active background mode. note that the ack is issued whenever the cpu enters bdm, which could be caused by a breakpoint match or by a bgnd instruction being executed. the ack pulse related to this command could be aborted using the sync command. the trace1 command has the related ack pulse issued when the cpu enters background active mode after one instruction of the application program is executed. the ack pulse related to this command could be aborted using the sync command. the taggo command will not issue an ack pulse because this would interfere with the tagging function shared on the same pin.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 465 17.4.9 sync ?request timed reference pulse the sync command is unlike other bdm commands because the host does not necessarily know the correct communication speed to use for bdm communications until after it has analyzed the response to the sync command. to issue a sync command, the host should perform the following steps: 1. drive the bkgd pin low for at least 128 cycles at the lowest possible bdm serial communication frequency (the lowest serial communication frequency is determined by the crystal oscillator or the clock chosen by clksw.) 2. drive bkgd high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. remove all drive to the bkgd pin so it reverts to high impedance. 4. listen to the bkgd pin for the sync response pulse. upon detecting the sync request from the host, the target performs the following steps: 1. discards any incomplete command received or bit retrieved. 2. waits for bkgd to return to a logic 1. 3. delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. drives bkgd low for 128 cycles at the current bdm serial communication frequency. 5. drives a one-cycle high speedup pulse to force a fast rise time on bkgd. 6. removes all drive to the bkgd pin so it reverts to high impedance. the host measures the low time of this 128 cycle sync response pulse and determines the correct speed for subsequent bdm communications. typically, the host can determine the correct communication speed within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. as soon as the sync request is detected by the target, any partially received command or bit retrieved is discarded. this is referred to as a soft-reset, equivalent to a time-out in the serial communication. after the sync response, the target will consider the next falling edge (issued by the host) as the start of a new bdm command or the start of new sync request. another use of the sync command pulse is to abort a pending ack pulse. the behavior is exactly the same as in a regular sync command. note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. in this case, the command may not have been understood by the target and so an ack response pulse will not be issued. 17.4.10 instruction tracing when a trace1 command is issued to the bdm in active bdm, the cpu exits the standard bdm ?mware and executes a single instruction in the user code. as soon as this has occurred, the cpu is forced to return to the standard bdm ?mware and the bdm is active and ready to receive a new command. if the trace1 command is issued again, the next user instruction will be executed. this facilitates stepping or tracing through the user code one instruction at a time.

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 466 freescale semiconductor if an interrupt is pending when a trace1 command is issued, the interrupt stacking operation occurs but no user instruction is executed. upon return to standard bdm ?mware execution, the program counter points to the ?st instruction in the interrupt service routine. 17.4.11 instruction tagging the instruction queue and cycle-by-cycle cpu activity are reconstructible in real time or from trace history that is captured by a logic analyzer. however, the reconstructed queue cannot be used to stop the cpu at a speci? instruction. this is because execution already has begun by the time an operation is visible outside the system. a separate instruction tagging mechanism is provided for this purpose. the tag follows program information as it advances through the instruction queue. when a tagged instruction reaches the head of the queue, the cpu enters active bdm rather than executing the instruction. note tagging is disabled when bdm becomes active and bdm serial commands are not processed while tagging is active. executing the bdm taggo command con?ures two system pins for tagging. the t a glo signal shares a pin with the lstrb signal, and the t a ghi signal shares a pin with the bkgd signal. table 17-7 shows the functions of the two tagging pins. the pins operate independently, that is the state of one pin does not affect the function of the other. the presence of logic level 0 on either pin at the fall of the external clock (eclk) performs the indicated function. high tagging is allowed in all modes. low tagging is allowed only when low strobe is enabled (lstrb is allowed only in wide expanded modes and emulation expanded narrow mode). 17.4.12 serial communication time-out the host initiates a host-to-target serial transmission by generating a falling edge on the bkgd pin. if bkgd is kept low for more than 128 target clock cycles, the target understands that a sync command was issued. in this case, the target will keep waiting for a rising edge on bkgd in order to answer the sync request pulse. if the rising edge is not detected, the target will keep waiting forever without any time-out limit. consider now the case where the host returns bkgd to logic one before 128 cycles. this is interpreted as a valid bit transmission, and not as a sync request. the target will keep waiting for another falling edge marking the start of a new bit. if, however, a new falling edge is not detected by the target within 512 clock cycles since the last falling edge, a time-out occurs and the current command is discarded without affecting memory or the operating mode of the mcu. this is referred to as a soft-reset. table 17-7. tag pin function t a ghi t a glo tag 1 1 no tag 1 0 low byte 0 1 high byte 0 0 both bytes

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 467 if a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset will occur causing the command to be disregarded. the data is not available for retrieval after the time-out has occurred. this is the expected behavior if the handshake protocol is not enabled. however, consider the behavior where the bdc is running in a frequency much greater than the cpu frequency. in this case, the command could time out before the data is ready to be retrieved. in order to allow the data to be retrieved even with a large clock frequency mismatch (between bdc and cpu) when the hardware handshake protocol is enabled, the time out between a read command and the data retrieval is disabled. therefore, the host could wait for more then 512 serial clock cycles and continue to be able to retrieve the data from an issued read command. however, as soon as the handshake pulse (ack pulse) is issued, the time-out feature is re-activated, meaning that the target will time out after 512 clock cycles. therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ack pulse had been issued. after that period, the read command is discarded and the data is no longer available for retrieval. any falling edge of the bkgd pin after the time-out period is considered to be a new command or a sync request. note that whenever a partially issued command, or partially retrieved data, has occurred the time out in the serial communication is active. this means that if a time frame higher than 512 serial clock cycles is observed between two consecutive negative edges and the command being issued or data being retrieved is not complete, a soft-reset will occur causing the partially received command or data retrieved to be disregarded. the next falling edge of the bkgd pin, after a soft-reset has occurred, is considered by the target as the start of a new bdm command, or the start of a sync request pulse. 17.4.13 operation in wait mode the bdm cannot be used in wait mode if the system disables the clocks to the bdm. there is a clearing mechanism associated with the wait instruction when the clocks to the bdm (cpu core platform) are disabled. as the clocks restart from wait mode, the bdm receives a soft reset (clearing any command in progress) and the ack function will be disabled. this is a change from previous bdm modules. 17.4.14 operation in stop mode the bdm is completely shutdown in stop mode. there is a clearing mechanism associated with the stop instruction. stop must be enabled and the part must go into stop mode for this to occur. as the clocks restart from stop mode, the bdm receives a soft reset (clearing any command in progress) and the ack function will be disabled. this is a change from previous bdm modules.

 chapter 17 background debug module (bdmv4) mc9s12ne64 data sheet, rev. 1.1 468 freescale semiconductor

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 469 chapter 18 debug module (dbgv1) 18.1 introduction this section describes the functionality of the debug (dbg) sub-block of the hcs12 core platform. the dbg module is designed to be fully compatible with the existing bkp_hcs12_a module (bkp mode) and furthermore provides an on-chip trace buffer with ?xible triggering capability (dbg mode). the dbg module provides for non-intrusive debug of application software. the dbg module is optimized for the hcs12 16-bit architecture. 18.1.1 features the dbg module in bkp mode includes these distinctive features:  full or dual breakpoint mode  compare on address and data (full)  compare on either of two addresses (dual)  bdm or swi breakpoint  enter bdm on breakpoint (bdm)  execute swi on breakpoint (swi)  tagged or forced breakpoint  break just before a speci? instruction will begin execution (tag)  break on the ?st instruction boundary after a match occurs (force)  single, range, or page address compares  compare on address (single)  compare on address 256 byte (range)  compare on any 16k page (page)  at forced breakpoints compare address on read or write  high and/or low byte data compares  comparator c can provide an additional tag or force breakpoint (enhancement for bkp mode)

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 470 freescale semiconductor the dbg in dbg mode includes these distinctive features:  three comparators (a, b, and c)  dual mode, comparators a and b used to compare addresses  full mode, comparator a compares address and comparator b compares data  can be used as trigger and/or breakpoint  comparator c used in loop1 capture mode or as additional breakpoint  four capture modes  normal mode, change-of-?w information is captured based on trigger speci?ation  loop1 mode, comparator c is dynamically updated to prevent redundant change-of-?w storage.  detail mode, address and data for all cycles except program fetch (p) and free (f) cycles are stored in trace buffer  pro?e mode, last instruction address executed by cpu is returned when trace buffer address is read  two types of breakpoint or debug triggers  break just before a speci? instruction will begin execution (tag)  break on the ?st instruction boundary after a match occurs (force)  bdm or swi breakpoint  enter bdm on breakpoint (bdm)  execute swi on breakpoint (swi)  nine trigger modes for comparators a and b ?  a or b  a then b  a and b, where b is data (full mode)  a and not b, where b is data (full mode)  event only b, store data  a then event only b, store data  inside range, a   address  b  outside range, address <  or address >  b  comparator c provides an additional tag or force breakpoint when capture mode is not con?ured in loop1 mode.  sixty-four word (16 bits wide) trace buffer for storing change-of-?w information, event only data and other bus information.  source address of taken conditional branches (long, short, bit-conditional, and loop constructs)  destination address of indexed jmp, jsr, and call instruction.  destination address of rti, rts, and rtc instructions  vector address of interrupts, except for swi and bdm vectors

 introduction mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 471  data associated with event b trigger modes  detail report mode stores address and data for all cycles except program (p) and free (f) cycles  current instruction address when in pro?ing mode  bgnd is not considered a change-of-?w (cof) by the debugger 18.1.2 modes of operation there are two main modes of operation: breakpoint mode and debug mode. each one is mutually exclusive of the other and selected via a software programmable control bit. in the breakpoint mode there are two sub-modes of operation:  dual address mode, where a match on either of two addresses will cause the system to enter background debug mode (bdm) or initiate a software interrupt (swi).  full breakpoint mode, where a match on address and data will cause the system to enter background debug mode (bdm) or initiate a software interrupt (swi). in debug mode, there are several sub-modes of operation.  trigger modes there are many ways to create a logical trigger. the trigger can be used to capture bus information either starting from the trigger or ending at the trigger. types of triggers (a and b are registers):  a only  a or b  a then b  event only b (data capture)  a then event only b (data capture)  a and b, full mode  a and not b, full mode  inside range  outside range  capture modes there are several capture modes. these determine which bus information is saved and which is ignored.  normal: save change-of-?w program fetches  loop1: save change-of-?w program fetches, ignoring duplicates  detail: save all bus operations except program and free cycles  pro?e: poll target from external device 18.1.3 block diagram figure 18-1 is a block diagram of this module in breakpoint mode. figure 18-2 is a block diagram of this module in debug mode.

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 472 freescale semiconductor figure 18-1. dbg block diagram in bkp mode comparator compare block register block comparator comparator comparator comparator comparator expansion addresses expansion addresses address high address low data high data low address high address low comparator comparator read data high read data low . . . . . . . . . . . . clocks and bkp control control signals signals control block breakpoint modes and generation of swi, force bdm, and tags expansion address address write data read data read/write control control bits control signals results signals bkp0h bkp0l bkp0x bkpct0 bkp1x bkpct1 bkp1l bkp1h write bkp read data bus data bus data/address high mux data/address low mux

 external signal description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 473 figure 18-2. dbg block diagram in dbg mode 18.2 external signal description the dbg sub-module relies on the external bus interface (generally the mebi) when the dbg is matching on the external bus. the tag pins in table 18-1  (part of the mebi) may also be a part of the breakpoint operation. table 18-1. external system pins associated with dbg and mebi pin name pin functions description bkgd/modc/ t a ghi t a ghi when instruction tagging is on, a 0 at the falling edge of e tags the high half of the instruction word being read into the instruction queue. pe3/ lstrb/ t a glo t a glo in expanded wide mode or emulation narrow modes, when instruction tagging is on and low strobe is enabled, a 0 at the falling edge of e tags the low half of the instruction word being read into the instruction queue. tag force address bus match_a control read data bus read/write store mcu in bdm m u x pointer register match_b m u x event only write data bus trace buffer dbg read data bus dbg mode enable m u x write data bus read data bus read/write match_c loop1 detail m u x profile capture mode cpu program counter control comparator a address/data/control comparator b comparator c registers tracer buffer control logic change-of-flow indicators or profiling data 64 x 16 bit word trace buffer profile capture register last instruction address bus clock instruction last cycle

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 474 freescale semiconductor 18.3 memory map and register de?ition a summary of the registers associated with the dbg sub-block is shown in figure 18-3 . detailed descriptions of the registers and bits are given in the subsections that follow. 18.3.1 module memory map 18.3.2 register descriptions this section consists of the dbg register descriptions in address order. most of the register bits can be written to in either bkp or dbg mode, although they may not have any effect in one of the modes. however, the only bits in the dbg module that can be written while the debugger is armed (arm = 1) are dbgen and arm table 18-2. dbgv1 memory map address offset use access debug control register (dbgc1) r/w debug status and control register (dbgsc) r/w debug trace buffer register high (dbgtbh) r debug trace buffer register low (dbgtbl) r 4  debug count register (dbgcnt) r 5  debug comparator c extended register (dbgccx) r/w 6  debug comparator c register high (dbgcch) r/w  debug comparator c register low (dbgccl) r/w 8 debug control register 2 (dbgc2) / (bkpct0) r/w 9 debug control register 3 (dbgc3) / (bkpct1) r/w a debug comparator a extended register (dbgcax) / (/bkp0x) r/w b debug comparator a register high (dbgcah) / (bkp0h) r/w debug comparator a register low (dbgcal) / (bkp0l) r/w debug comparator b extended register (dbgcbx) / (bkp1x) r/w e debug comparator b register high (dbgcbh) / (bkp1h) r/w f debug comparator b register low (dbgcbl) / (bkp1l) r/w name 1 bit 7 6 5 4 3 2 1 bit 0 dbgc1 r dbgen arm trgsel begin dbgbrk 0 capmod w dbgsc raf bf cf 0 trg w = unimplemented or reserved figure 18-3. dbg register summary

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 475 dbgtbh r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w dbgtbl r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w dbgcnt r tbf 0 cnt w dbgccx (2 ) r pagsel extcmp w dbgcch (2) r bit 15 14 13 12 11 10 9 bit 8 w dbgccl (2) r bit 7 6 5 4 3 2 1 bit 0 w dbgc2 bkpct0 r bkaben full bdm tagab bkcen tagc rwcen rwc w dbgc3 bkpct1 r bkambh bkambl bkbmbh bkbmbl rwaen rwa rwben rwb w dbgcax bkp0x r pagsel extcmp w dbgcah bkp0h r bit 15 14 13 12 11 10 9 bit 8 w dbgcal bkp0l r bit 7 6 5 4 3 2 1 bit 0 w dbgcbx bkp1x r pagsel extcmp w dbgcbh bkp1h r bit 15 14 13 12 11 10 9 bit 8 w dbgcbl bkp1l r bit 7 6 5 4 3 2 1 bit 0 w 1 the dbg module is designed for backwards compatibility to existing bkp modules. register and bit names have changed from the bkp module. this column shows the dbg register name, as well as the bkp register name for reference. 2 comparator c can be used to enhance the bkp mode by providing a third breakpoint. name 1 bit 7 6 5 4 3 2 1 bit 0 = unimplemented or reserved figure 18-3. dbg register summary (continued)

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 476 freescale semiconductor 18.3.2.1 debug control register 1 (dbgc1) note all bits are used in dbg mode only. note this register cannot be written if bkp mode is enabled (bkaben in dbgc2 is set). 76543210 r dbgen arm trgsel begin dbgbrk 0 capmod w reset 0 0 0 00000 = unimplemented or reserved figure 18-4. debug control register (dbgc1) table 18-3. dbgc1 field descriptions field description 7 dbgen dbg mode enable bit  ?the dbgen bit enables the dbg module for use in dbg mode. this bit cannot be set if the mcu is in secure mode. 0 dbg mode disabled 1 dbg mode enabled 6 arm arm bit  ?the arm bit controls whether the debugger is comparing and storing data in the trace buffer. see section 18.4.2.4, ?rming the dbg module , for more information. 0 debugger unarmed 1 debugger armed note: this bit cannot be set if the dbgen bit is not also being set at the same time. for example, a write of 01 to dbgen[7:6] will be interpreted as a write of 00. 5 trgsel trigger selection bit  ?the trgsel bit controls the triggering condition for comparators a and b in dbg mode. it serves essentially the same function as the tagab bit in the dbgc2 register does in bkp mode. see section 18.4.2.1.2, ?rigger selection , for more information. trgsel may also determine the type of breakpoint based on comparator a and b if enabled in dbg mode (dbgbrk = 1). please refer to section 18.4.3.1, ?reakpoint based on comparator a and b . 0 trigger on any compare address match 1 trigger before opcode at compare address gets executed (tagged-type) 4 begin begin/end trigger bit  the begin bit controls whether the trigger begins or ends storing of data in the trace buffer. see section 18.4.2.8.1, ?toring with begin-trigger , and section 18.4.2.8.2, ?toring with end-trigger , for more details. 0 trigger at end of stored data 1 trigger before storing data

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 477 3 dbgbrk dbg breakpoint enable bit  the dbgbrk bit controls whether the debugger will request a breakpoint based on comparator a and b to the cpu upon completion of a tracing session. please refer to section 18.4.3, ?reakpoints , for further details. 0 cpu break request not enabled 1 cpu break request enabled 1:0 capmod capture mode field  ?see table 18-4  for capture mode ?ld de?itions. in loop1 mode, the debugger will automatically inhibit redundant entries into capture memory. in detail mode, the debugger is storing address and data for all cycles except program fetch (p) and free (f) cycles. in pro?e mode, the debugger is returning the address of the last instruction executed by the cpu on each access of trace buffer address. refer to section 18.4.2.6, ?apture modes , for more information. table 18-4. capmod encoding capmod description 00 normal 01 loop1 10 detail 11 profile table 18-3. dbgc1 field descriptions (continued) field description

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 478 freescale semiconductor 18.3.2.2 debug status and control register (dbgsc) 76543210 raf bf cf 0 trg w reset 0 0 0 00000 = unimplemented or reserved figure 18-5. debug status and control register (dbgsc) table 18-5. dbgsc field descriptions field description 7 af trigger a match flag ?the af bit indicates if trigger a match condition was met since arming. this bit is cleared when arm in dbgc1 is written to a 1 or on any write to this register. 0 trigger a did not match 1 trigger a match 6 bf trigger b match flag  ?the bf bit indicates if trigger b match condition was met since arming.this bit is cleared when arm in dbgc1 is written to a 1 or on any write to this register. 0 trigger b did not match 1 trigger b match 5 cf comparator c match flag  the cf bit indicates if comparator c match condition was met since arming.this bit is cleared when arm in dbgc1 is written to a 1 or on any write to this register. 0 comparator c did not match 1 comparator c match 3:0 trg trigger mode bits  ?the trg bits select the trigger mode of the dbg module as shown table 18-6 . see section 18.4.2.5, ?rigger modes , for more detail. table 18-6. trigger mode encoding trg value meaning 0000 a only 0001 a or b 0010 a then b 0011 event only b 0100 a then event only b 0101 a and b (full mode) 0110 a and not b (full mode) 0111 inside range 1000 outside range 1001  1111 reserved (defaults to a only)

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 479 18.3.2.3 debug trace buffer register (dbgtb) 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset u u u uuuuu = unimplemented or reserved figure 18-6. debug trace buffer register high (dbgtbh) 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset u u u uuuuu = unimplemented or reserved figure 18-7. debug trace buffer register low (dbgtbl) table 18-7. dbgtb field descriptions field description 15:0 trace buffer data bits  the trace buffer data bits contain the data of the trace buffer. this register can be read only as a word read. any byte reads or misaligned access of these registers will return 0 and will not cause the trace buffer pointer to increment to the next trace buffer address. the same is true for word reads while the debugger is armed. in addition, this register may appear to contain incorrect data if it is not read with the same capture mode bit settings as when the trace buffer data was recorded (see section 18.4.2.9, ?eading data from trace buffer ?. because reads will re?ct the contents of the trace buffer ram, the reset state is unde?ed.

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 480 freescale semiconductor 18.3.2.4 debug count register (dbgcnt) 76543210 r tbf 0 cnt w reset 0 0 0 00000 = unimplemented or reserved figure 18-8. debug count register (dbgcnt) table 18-8. dbgcnt field descriptions field description 7 tbf trace buffer full  the tbf bit indicates that the trace buffer has stored 64 or more words of data since it was last armed. if this bit is set, then all 64 words will be valid data, regardless of the value in cnt[5:0]. the tbf bit is cleared when arm in dbgc1 is written to a 1. 5:0 cnt count value  the cnt bits indicate the number of valid data words stored in the trace buffer. table 18-9 shows the correlation between the cnt bits and the number of valid data words in the trace buffer. when the cnt rolls over to 0, the tbf bit will be set and incrementing of cnt will continue if dbg is in end-trigger mode. the dbgcnt register is cleared when arm in dbgc1 is written to a 1. table 18-9. cnt decoding table tbf cnt description 0 000000 no data valid 0 000001 1 word valid 0 000010 .. .. 111110 2 words valid .. .. 62 words valid 0 111111 63 words valid 1 000000 64 words valid; if begin = 1, the arm bit will be cleared. a breakpoint will be generated if dbgbrk = 1 1 000001 .. .. 111111 64 words valid, oldest data has been overwritten by most recent data

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 481 18.3.2.5 debug comparator c extended register (dbgccx) 76543210 r pagsel extcmp w reset 0 0 0 00000 figure 18-9. debug comparator c extended register (dbgccx) table 18-10. dbgccx field descriptions field description 7:6 pagsel page selector field  ?in both bkp and dbg mode, pagsel selects the type of paging as shown in table 18-11 . dpage and epage are not yet implemented so the value in bit 7 will be ignored (i.e., pagsel values of 10 and 11 will be interpreted as values of 00 and 01, respectively). 5:0 extcmp comparator c extended compare bits  the extcmp bits are used as comparison address bits as shown in table 18-11  along with the appropriate ppage, dpage, or epage signal from the core. note: comparator c can be used when the dbg module is con?ured for bkp mode. extended addressing comparisons for comparator c use pagsel and will operate differently to the way that comparator a and b operate in bkp mode. table 18-11. pagsel decoding 1 1 see figure 18-10 . pagsel description extcmp comment 00 normal (64k) not used no paged memory 01 ppage (256 ?16k pages) extcmp[5:0] is compared to address bits [21:16] 2 2 current hcs12 implementations have ppage limited to 6 bits. therefore, extcmp[5:4] should be set to 00. ppage[7:0] / xab[21:14] becomes address bits [21:14] 1 10 3 3 data page (dpage) and extra page (epage) are reserved for implementation on devices that support paged data and extra space. dpage (reserved) (256 ?4k pages) extcmp[3:0] is compared to address bits [19:16] dpage / xab[21:14] becomes address bits [19:12] 11 2 epage (reserved) (256 ?1k pages) extcmp[1:0] is compared to address bits [17:16] epage / xab[21:14] becomes address bits [17:10]

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 482 freescale semiconductor 18.3.2.6 debug comparator c register (dbgcc) dbgcxx dbgcxh[15:12] pagsel extcmp bit 15 bit 14 bit 13 bit 12 76 0 5 0 4 3 2 1 bit 0 see note 1 portk/xab xab21 xab20 xab19 xab18 xab17 xab16 xab15 xab14 ppage pix7 pix6 pix5 pix4 pix3 pix2 pix1 pix0 see note 2 notes: 1. in bkp and dbg mode, pagsel selects the type of paging as shown in table 18-11 . 2. current hcs12 implementations are limited to six ppage bits, pix[5:0]. therefore, extcmp[5:4] = 00. figure 18-10. comparator c extended comparison in bkp/dbg mode 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 0 0 0 00000 = unimplemented or reserved figure 18-11. debug comparator c register high (dbgcch) 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 0 0 0 00000 = unimplemented or reserved figure 18-12. debug comparator c register low (dbgccl) table 18-12. dbgcc field descriptions field description 15:0 comparator c compare bits ?the comparator c compare bits control whether comparator c will compare the address bus bits [15:0] to a logic 1 or logic 0. see table 18-13 . 0 compare corresponding address bit to a logic 0 1 compare corresponding address bit to a logic 1 note: this register will be cleared automatically when the dbg module is armed in loop1 mode. bkp/dbg mode

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 483 18.3.2.7 debug control register 2 (dbgc2) figure 18-13. debug control register 2 (dbgc2) table 18-13. comparator c compares pagsel extcmp compare high-byte compare x0 no compare dbgcch[7:0] = ab[15:8] x1 extcmp[5:0] = xab[21:16] dbgcch[7:0] = xab[15:14],ab[13:8] 76543210 r bkaben 1 1 when bkaben is set (bkp mode), all bits in dbgc2 are available. when bkaben is cleared and dbg is used in dbg mode, bits full and tagab have no meaning. full bdm tagab bkcen 2 2 these bits can be used in bkp mode and dbg mode (when capture mode is not set in loop1) to provide a third breakpoint. tag c 2 rwcen 2 rwc 2 w reset 0 0 0 00000 table 18-14. dbgc2 field descriptions field description 7 bkaben breakpoint using comparator a and b enable  this bit enables the breakpoint capability using comparator a and b, when set (bkp mode) the dbgen bit in dbgc1 cannot be set. 0 breakpoint module off 1 breakpoint module on 6 full full breakpoint mode enable  this bit controls whether the breakpoint module is in dual mode or full mode. in full mode, comparator a is used to match address and comparator b is used to match data. see section 18.4.1.2, ?ull breakpoint mode , for more details. 0 dual address mode enabled 1 full breakpoint mode enabled 5 bdm background debug mode enable  ?this bit determines if the breakpoint causes the system to enter background debug mode (bdm) or initiate a software interrupt (swi). 0 go to software interrupt on a break request 1 go to bdm on a break request 4 tagab comparator a/b tag select  this bit controls whether the breakpoint will cause a break on the next instruction boundary (force) or on a match that will be an executable opcode (tagged). non-executed opcodes cannot cause a tagged breakpoint. 0 on match, break at the next instruction boundary (force) 1 on match, break if/when the instruction is about to be executed (tagged) 3 bkcen breakpoint comparator c enable bit  ?this bit enables the breakpoint capability using comparator c. 0 comparator c disabled for breakpoint 1 comparator c enabled for breakpoint note: this bit will be cleared automatically when the dbg module is armed in loop1 mode. 2 tag c comparator c tag select  this bit controls whether the breakpoint will cause a break on the next instruction boundary (force) or on a match that will be an executable opcode (tagged). non-executed opcodes cannot cause a tagged breakpoint. 0 on match, break at the next instruction boundary (force) 1 on match, break if/when the instruction is about to be executed (tagged)

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 484 freescale semiconductor 18.3.2.8 debug control register 3 (dbgc3) figure 18-14. debug control register 3 (dbgc3) 1 rwcen read/write comparator c enable bit  the rwcen bit controls whether read or write comparison is enabled for comparator c. rwcen is not useful for tagged breakpoints. 0 read/write is not used in comparison 1 read/write is used in comparison 0 rwc read/write comparator c value bit  ?the rwc bit controls whether read or write is used in compare for comparator c. the rwc bit is not used if rwcen = 0. 0 write cycle will be matched 1 read cycle will be matched 76543210 r bkambh 1 1 in dbg mode, bkambh:bkambl has no meaning and are forced to 0s. bkambl 1 bkbmbh 2 2 in dbg mode, bkbmbh:bkbmbl are used in full mode to qualify data. bkbmbl 2 rwaen rwa rwben rwb w reset 0 0 0 00000 table 18-15. dbgc3 field descriptions field description 7:6 bkamb[h:l] breakpoint mask high byte for first address  in dual or full mode, these bits may be used to mask (disable) the comparison of the high and/or low bytes of the ?st address breakpoint. the functionality is as given in table 18-16 . the x:0 case is for a full address compare. when a program page is selected, the full address compare will be based on bits for a 20-bit compare. the registers used for the compare are {dbgcax[5:0], dbgcah[5:0], dbgcal[7:0]}, where dbgax[5:0] corresponds to ppage[5:0] or extended address bits [19:14] and cpu address [13:0]. when a program page is not selected, the full address compare will be based on bits for a 16-bit compare. the registers used for the compare are {dbgcah[7:0], dbgcal[7:0]} which corresponds to cpu address [15:0]. note: this extended address compare scheme causes an aliasing problem in bkp mode in which several physical addresses may match with a single logical address. this problem may be avoided by using dbg mode to generate breakpoints. the 1:0 case is not sensible because it would ignore the high order address and compare the low order and expansion addresses. logic forces this case to compare all address lines (effectively ignoring the bkambh control bit). the 1:1 case is useful for triggering a breakpoint on any access to a particular expansion page. this only makes sense if a program page is being accessed so that the breakpoint trigger will occur only if dbgcax compares. table 18-14. dbgc2 field descriptions (continued) field description

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 485 5:4 bkbmb[h:l] breakpoint mask high byte and low byte of data (second address)  ?in dual mode, these bits may be used to mask (disable) the comparison of the high and/or low bytes of the second address breakpoint. the functionality is as given in table 18-17 . the x:0 case is for a full address compare. when a program page is selected, the full address compare will be based on bits for a 20-bit compare. the registers used for the compare are {dbgcbx[5:0], dbgcbh[5:0], dbgcbl[7:0]} where dbgcbx[5:0] corresponds to ppage[5:0] or extended address bits [19:14] and cpu address [13:0]. when a program page is not selected, the full address compare will be based on bits for a 16-bit compare. the registers used for the compare are {dbgcbh[7:0], dbgcbl[7:0]} which corresponds to cpu address [15:0]. note: this extended address compare scheme causes an aliasing problem in bkp mode in which several physical addresses may match with a single logical address. this problem may be avoided by using dbg mode to generate breakpoints. the 1:0 case is not sensible because it would ignore the high order address and compare the low order and expansion addresses. logic forces this case to compare all address lines (effectively ignoring the bkbmbh control bit). the 1:1 case is useful for triggering a breakpoint on any access to a particular expansion page. this only makes sense if a program page is being accessed so that the breakpoint trigger will occur only if dbgcbx compares. in full mode, these bits may be used to mask (disable) the comparison of the high and/or low bytes of the data breakpoint. the functionality is as given in table 18-18 . 3 rwaen read/write comparator a enable bit  the rwaen bit controls whether read or write comparison is enabled for comparator a. see section 18.4.2.1.1, ?ead or write comparison , for more information. this bit is not useful for tagged operations. 0 read/write is not used in comparison 1 read/write is used in comparison 2 rwa read/write comparator a value bit  ?the rwa bit controls whether read or write is used in compare for comparator a. the rwa bit is not used if rwaen = 0. 0 write cycle will be matched 1 read cycle will be matched 1 rwben read/write comparator b enable bit  the rwben bit controls whether read or write comparison is enabled for comparator b. see section 18.4.2.1.1, ?ead or write comparison , for more information. this bit is not useful for tagged operations. 0 read/write is not used in comparison 1 read/write is used in comparison 0 rwb read/write comparator b value bit  ?the rwb bit controls whether read or write is used in compare for comparator b. the rwb bit is not used if rwben = 0. 0 write cycle will be matched 1 read cycle will be matched note: rwb and rwben are not used in full mode. table 18-16. breakpoint mask bits for first address bkambh:bkambl address compare dbgcax dbgcah dbgcal x:0 full address compare yes 1 1 if ppage is selected. ye s ye s 0:1 256 byte address range yes 1 ye s n o 1:1 16k byte address range yes 1 no no table 18-15. dbgc3 field descriptions (continued) field description

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 486 freescale semiconductor table 18-17. breakpoint mask bits for second address (dual mode) bkbmbh:bkbmbl address compare dbgcbx dbgcbh dbgcbl x:0 full address compare yes 1 1 if ppage is selected. ye s ye s 0:1 256 byte address range yes 1 ye s n o 1:1 16k byte address range yes 1 no no table 18-18. breakpoint mask bits for data breakpoints (full mode) bkbmbh:bkbmbl data compare dbgcbx dbgcbh dbgcbl 0:0 high and low byte compare no 1 1 expansion addresses for breakpoint b are not applicable in this mode. ye s ye s 0:1 high byte no 1 ye s n o 1:0 low byte no 1 no yes 1:1 no compare no 1 no no

 memory map and register de?ition mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 487 18.3.2.9 debug comparator a extended register (dbgcax) 76543210 r pagsel extcmp w reset 0 0 0 00000 figure 18-15. debug comparator a extended register (dbgcax) table 18-19. dbgcax field descriptions field description 7:6 pagsel page selector field  ?if dbgen is set in dbgc1, then pagsel selects the type of paging as shown in table 18-20 . dpage and epage are not yet implemented so the value in bit 7 will be ignored (i.e., pagsel values of 10 and 11 will be interpreted as values of 00 and 01, respectively). in bkp mode, pagsel has no meaning and extcmp[5:0] are compared to address bits [19:14] if the address is in the flash/rom memory space. 5:0 extcmp comparator a extended compare bits  the extcmp bits are used as comparison address bits as shown in table 18-20  along with the appropriate ppage, dpage, or epage signal from the core. table 18-20. comparator a or b compares mode extcmp compare high-byte compare bkp 1 1 see figure 18-16 . not flash/rom access no compare dbgcxh[7:0] = ab[15:8] flash/rom access extcmp[5:0] = xab[19:14] dbgcxh[5:0] = ab[13:8] dbg 2 2 see figure 18-10  (note that while this ?ure provides extended comparisons for comparator c, the ?ure also pertains to comparators a and b in dbg mode only). pagsel = 00 no compare dbgcxh[7:0] = ab[15:8] pagsel = 01 extcmp[5:0] = xab[21:16] dbgcxh[7:0] = xab[15:14], ab[13:8] pagsel extcmp dbgcxx 0 0 54321 bit 0 see note 1 portk/xab xab21 xab20 xab19 xab18 xab17 xab16 xab15 xab14 ppage pix7 pix6 pix5 pix4 pix3 pix2 pix1 pix0 see note 2 notes: 1. in bkp mode, pagsel has no functionality. therefore, set pagsel to 00 (reset state). 2. current hcs12 implementations are limited to six ppage bits, pix[5:0]. figure 18-16. comparators a and b extended comparison in bkp mode bkp mode

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 488 freescale semiconductor 18.3.2.10 debug comparator a register (dbgca) 18.3.2.11 debug comparator b extended register (dbgcbx) 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 0 0 0 00000 figure 18-17. debug comparator a register high (dbgcah) 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 0 0 0 00000 figure 18-18. debug comparator a register low (dbgcal) table 18-21. dbgca field descriptions field description 15:0 15:0 comparator a compare bits  the comparator a compare bits control whether comparator a compares the address bus bits [15:0] to a logic 1 or logic 0. see table 18-20 . 0 compare corresponding address bit to a logic 0 1 compare corresponding address bit to a logic 1 76543210 r pagsel extcmp w reset 0 0 0 00000 figure 18-19. debug comparator b extended register (dbgcbx) table 18-22. dbgcbx field descriptions field description 7:6 pagsel page selector field  ?if dbgen is set in dbgc1, then pagsel selects the type of paging as shown in table 18-11 . dpage and epage are not yet implemented so the value in bit 7 will be ignored (i.e., pagsel values of 10 and 11 will be interpreted as values of 00 and 01, respectively.) in bkp mode, pagsel has no meaning and extcmp[5:0] are compared to address bits [19:14] if the address is in the flash/rom memory space. 5:0 extcmp comparator b extended compare bits  the extcmp bits are used as comparison address bits as shown in table 18-11 along with the appropriate ppage, dpage, or epage signal from the core. also see table 18-20 .

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 489 18.3.2.12 debug comparator b register (dbgcb) 18.4 functional description this section provides a complete functional description of the dbg module. the dbg module can be con?ured to run in either of two modes, bkp or dbg. bkp mode is enabled by setting bkaben in dbgc2. dbg mode is enabled by setting dbgen in dbgc1. setting bkaben in dbgc2 overrides the dbgen in dbgc1 and prevents dbg mode. if the part is in secure mode, dbg mode cannot be enabled. 18.4.1 dbg operating in bkp mode in bkp mode, the dbg will be fully backwards compatible with the existing bkp_st12_a module. the dbgc2 register has four additional bits that were not available on existing bkp_st12_a modules. as long as these bits are written to either all 1s or all 0s, they should be transparent to the user. all 1s would enable comparator c to be used as a breakpoint, but tagging would be enabled. the match address register would be all 0s if not modi?d by the user. therefore, code executing at address 0x0000 would have to occur before a breakpoint based on comparator c would happen. the dbg module in bkp mode supports two modes of operation: dual address mode and full breakpoint mode. within each of these modes, forced or tagged breakpoint types can be used. forced breakpoints occur at the next instruction boundary if a match occurs and tagged breakpoints allow for breaking just before the tagged instruction executes. the action taken upon a successful match can be to either place the cpu in background debug mode or to initiate a software interrupt. 15 14 13 12 11 10 9 8 r bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 w reset 0 0 0 00000 figure 18-20. debug comparator b register high (dbgcbh) 76543210 r bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 w reset 0 0 0 00000 figure 18-21. debug comparator b register low (dbgcbl) table 18-23. dbgcb field descriptions field description 15:0 15:0 comparator b compare bits  the comparator b compare bits control whether comparator b compares the address bus bits [15:0] or data bus bits [15:0] to a logic 1 or logic 0. see table 18-20 . 0 compare corresponding address bit to a logic 0, compares to data if in full mode 1 compare corresponding address bit to a logic 1, compares to data if in full mode

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 490 freescale semiconductor the breakpoint can operate in dual address mode or full breakpoint mode. each of these modes is discussed in the subsections below. 18.4.1.1 dual address mode when dual address mode is enabled, two address breakpoints can be set. each breakpoint can cause the system to enter background debug mode or to initiate a software interrupt based upon the state of bdm in dbgc2 being logic 1 or logic 0, respectively. bdm requests have a higher priority than swi requests. no data breakpoints are allowed in this mode. tagab in dbgc2 selects whether the breakpoint mode is forced or tagged. the bkxmbh:l bits in dbgc3 select whether or not the breakpoint is matched exactly or is a range breakpoint. they also select whether the address is matched on the high byte, low byte, both bytes, and/or memory expansion. the rwx and rwxen bits in dbgc3 select whether the type of bus cycle to match is a read, write, or read/write when performing forced breakpoints. 18.4.1.2 full breakpoint mode full breakpoint mode requires a match on address and data for a breakpoint to occur. upon a successful match, the system will enter background debug mode or initiate a software interrupt based upon the state of bdm in dbgc2 being logic 1 or logic 0, respectively. bdm requests have a higher priority than swi requests. r/w matches are also allowed in this mode. tagab in dbgc2 selects whether the breakpoint mode is forced or tagged. when tagab is set in dbgc2, only addresses are compared and data is ignored. the bkambh:l bits in dbgc3 select whether or not the breakpoint is matched exactly, is a range breakpoint, or is in page space. the bkbmbh:l bits in dbgc3 select whether the data is matched on the high byte, low byte, or both bytes. rwa and rwaen bits in dbgc2 select whether the type of bus cycle to match is a read or a write when performing forced breakpoints. rwb and rwben bits in dbgc2 are not used in full breakpoint mode. note the full trigger mode is designed to be used for either a word access or a byte access, but not both at the same time. confusing trigger operation (seemingly false triggers or no trigger) can occur if the trigger address occurs in the user program as both byte and word accesses. 18.4.1.3 breakpoint priority breakpoint operation is ?st determined by the state of the bdm module. if the bdm module is already active, meaning the cpu is executing out of bdm ?mware, breakpoints are not allowed. in addition, while executing a bdm trace command, tagging into bdm is not allowed. if bdm is not active, the breakpoint will give priority to bdm requests over swi requests. this condition applies to both forced and tagged breakpoints. in all cases, bdm related breakpoints will have priority over those generated by the breakpoint sub-block. this priority includes breakpoints enabled by the t a glo and t a ghi external pins of the system that interface with the bdm directly and whose signal information passes through and is used by the breakpoint sub-block.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 491 note bdm should not be entered from a breakpoint unless the enable bit is set in the bdm. even if the enable bit in the bdm is cleared, the cpu actually executes the bdm ?mware code. it checks the enable and returns if enable is not set. if the bdm is not serviced by the monitor then the breakpoint would be re-asserted when the bdm returns to normal cpu ?w. there is no hardware to enforce restriction of breakpoint operation if the bdm is not enabled. when program control returns from a tagged breakpoint through an rti or a bdm go command, it will return to the instruction whose tag generated the breakpoint. unless breakpoints are disabled or modi?d in the service routine or active bdm session, the instruction will be tagged again and the breakpoint will be repeated. in the case of bdm breakpoints, this situation can also be avoided by executing a trace1 command before the go to increment the program ?w past the tagged instruction. 18.4.1.4 using comparator c in bkp mode the original bkp_st12_a module supports two breakpoints. the dbg_st12_a module can be used in bkp mode and allow a third breakpoint using comparator c. four additional bits, bkcen, tagc, rwcen, and rwc in dbgc2 in conjunction with additional comparator c address registers, dbgccx, dbgcch, and dbgccl allow the user to set up a third breakpoint. using pagsel in dbgccx for expanded memory will work differently than the way paged memory is done using comparator a and b in bkp mode. see section 18.3.2.5, ?ebug comparator c extended register (dbgccx) , for more information on using comparator c. 18.4.2 dbg operating in dbg mode enabling the dbg module in dbg mode, allows the arming, triggering, and storing of data in the trace buffer and can be used to cause cpu breakpoints. the dbg module is made up of three main blocks, the comparators, trace buffer control logic, and the trace buffer. note in general, there is a latency between the triggering event appearing on the bus and being detected by the dbg circuitry. in general, tagged triggers will be more predictable than forced triggers. 18.4.2.1 comparators the dbg contains three comparators, a, b, and c. comparator a compares the core address bus with the address stored in dbgcah and dbgcal. comparator b compares the core address bus with the address stored in dbgcbh and dbgcbl except in full mode, where it compares the data buses to the data stored in dbgcbh and dbgcbl. comparator c can be used as a breakpoint generator or as the address comparison unit in the loop1 mode. matches on comparator a, b, and c are signaled to the trace buffer

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 492 freescale semiconductor control (tbc) block. when pagsel = 01, registers dbgcax, dbgcbx, and dbgccx are used to match the upper addresses as shown in table 18-11 . note if a tagged-type c breakpoint is set at the same address as an a/b tagged-type trigger (including the initial entry in an inside or outside range trigger), the c breakpoint will have priority and the trigger will not be recognized. 18.4.2.1.1 read or write comparison read or write comparisons are useful only with trgsel = 0, because only opcodes should be tagged as they are ?ead?from memory. rwaen and rwben are ignored when trgsel = 1. in full modes (a and b?and a and not b? rwaen and rwa are used to select read or write comparisons for both comparators a and b. table 18-24 shows the effect for rwaen, rwa, and rw on the dbgcb comparison conditions. the rwben and rwb bits are not used and are ignored in full modes. 18.4.2.1.2 trigger selection the trgsel bit in dbgc1 is used to determine the triggering condition in dbg mode. trgsel applies to both trigger a and b except in the event only trigger modes. by setting trgsel, the comparators a and b will qualify a match with the output of opcode tracking logic and a trigger occurs before the tagged instruction executes (tagged-type trigger). with the trgsel bit cleared, a comparator match forces a trigger when the matching condition occurs (force-type trigger). note if the trgsel is set, the address stored in the comparator match address registers must be an opcode address for the trigger to occur. 18.4.2.2 trace buffer control (tbc) the tbc is the main controller for the dbg module. its function is to decide whether data should be stored in the trace buffer based on the trigger mode and the match signals from the comparator. the tbc also determines whether a request to break the cpu should occur. table 18-24. read or write comparison logic table rwaen bit rwa bit rw signal comment 0 x 0 write data bus 0 x 1 read data bus 1 0 0 write data bus 1 0 1 no data bus compare since rw=1 1 1 0 no data bus compare since rw=0 1 1 1 read data bus

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 493 18.4.2.3 begin- and end-trigger the de?itions of begin- and end-trigger as used in the dbg module are as follows:  begin-trigger: storage in trace buffer occurs after the trigger and continues until 64 locations are ?led.  end-trigger: storage in trace buffer occurs until the trigger, with the least recent data falling out of the trace buffer if more than 64 words are collected. 18.4.2.4 arming the dbg module in dbg mode, arming occurs by setting dbgen and arm in dbgc1. the arm bit in dbgc1 is cleared when the trigger condition is met in end-trigger mode or when the trace buffer is ?led in begin-trigger mode. the tbc logic determines whether a trigger condition has been met based on the trigger mode and the trigger selection. 18.4.2.5 trigger modes the dbg module supports nine trigger modes. the trigger modes are encoded as shown in table 18-6 . the trigger mode is used as a quali?r for either starting or ending the storing of data in the trace buffer. when the match condition is met, the appropriate ?g a or b is set in dbgsc. arming the dbg module clears the a, b, and c ?gs in dbgsc. in all trigger modes except for the event-only modes and detail capture mode, change-of-?w addresses are stored in the trace buffer. in the event-only modes only the value on the data bus at the trigger event b will be stored. in detail capture mode address and data for all cycles except program fetch (p) and free (f) cycles are stored in trace buffer. 18.4.2.5.1 a only in the a only trigger mode, if the match condition for a is met, the a ?g in dbgsc is set and a trigger occurs. 18.4.2.5.2 a or b in the a or b trigger mode, if the match condition for a or b is met, the corresponding ?g in dbgsc is set and a trigger occurs. 18.4.2.5.3 a then b in the a then b trigger mode, the match condition for a must be met before the match condition for b is compared. when the match condition for a or b is met, the corresponding ?g in dbgsc is set. the trigger occurs only after a then b have matched. note when tagging and using a then b, if addresses a and b are close together, then b may not complete the trigger sequence. this occurs when a and b are in the instruction queue at the same time. basically the a trigger has not yet occurred, so the b instruction is not tagged. generally, if address b is at

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 494 freescale semiconductor least six addresses higher than address a (or b is lower than a) and there are not changes of ?w to put these in the queue at the same time, then this operation should trigger properly. 18.4.2.5.4 event-only b (store data) in the event-only b trigger mode, if the match condition for b is met, the b ?g in dbgsc is set and a trigger occurs. the event-only b trigger mode is considered a begin-trigger type and the begin bit in dbgc1 is ignored. event-only b is incompatible with instruction tagging (trgsel = 1), and thus the value of trgsel is ignored. please refer to section 18.4.2.7, ?torage memory , for more information. this trigger mode is incompatible with the detail capture mode so the detail capture mode will have priority. trgsel and begin will not be ignored and this trigger mode will behave as if it were ? only? 18.4.2.5.5 a then event-only b (store data) in the a then event-only b trigger mode, the match condition for a must be met before the match condition for b is compared, after the a match has occurred, a trigger occurs each time b matches. when the match condition for a or b is met, the corresponding ?g in dbgsc is set. the a then event-only b trigger mode is considered a begin-trigger type and begin in dbgc1 is ignored. trgsel in dbgc1 applies only to the match condition for a. please refer to section 18.4.2.7, ?torage memory , for more information. this trigger mode is incompatible with the detail capture mode so the detail capture mode will have priority. trgsel and begin will not be ignored and this trigger mode will be the same as a then b. 18.4.2.5.6 a and b (full mode) in the a and b trigger mode, comparator a compares to the address bus and comparator b compares to the data bus. in the a and b trigger mode, if the match condition for a and b happen on the same bus cycle, both the a and b ?gs in the dbgsc register are set and a trigger occurs. if trgsel = 1, only matches from comparator a are used to determine if the trigger condition is met and comparator b matches are ignored. if trgsel = 0, full-word data matches on an odd address boundary (misaligned access) do not work unless the access is to a ram that manages misaligned accesses in a single clock cycle (which is typical of ram modules used in hcs12 mcus). 18.4.2.5.7 a and not b (full mode) in the a and not b trigger mode, comparator a compares to the address bus and comparator b compares to the data bus. in the a and not b trigger mode, if the match condition for a and not b happen on the same bus cycle, both the a and b ?gs in dbgsc are set and a trigger occurs. if trgsel = 1, only matches from comparator a are used to determine if the trigger condition is met and comparator b matches are ignored. as described in section 18.4.2.5.6, a and b (full mode) , full-word data compares on misaligned accesses will not match expected data (and thus will cause a trigger in this mode) unless the access is to a ram that manages misaligned accesses in a single clock cycle.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 495 18.4.2.5.8 inside range (a   address   b) in the inside range trigger mode, if the match condition for a and b happen on the same bus cycle, both the a and b ?gs in dbgsc are set and a trigger occurs. if a match condition on only a or only b occurs no ?gs are set. if trgsel = 1, the inside range is accurate only to word boundaries. if trgsel = 0, an aligned word access which straddles the range boundary will cause a trigger only if the aligned address is within the range. 18.4.2.5.9 outside range (address < a or address > b) in the outside range trigger mode, if the match condition for a or b is met, the corresponding ?g in dbgsc is set and a trigger occurs. if trgsel = 1, the outside range is accurate only to word boundaries. if trgsel = 0, an aligned word access which straddles the range boundary will cause a trigger only if the aligned address is outside the range. 18.4.2.5.10 control bit priorities the de?itions of some of the control bits are incompatible with each other. table 18-25  and the notes associated with it summarize how these incompatibilities are managed:  read/write comparisons are not compatible with trgsel = 1. therefore, rwaen and rwben are ignored.  event-only trigger modes are always considered a begin-type trigger. see section 18.4.2.8.1, ?toring with begin-trigger , and section 18.4.2.8.2, ?toring with end-trigger .  detail capture mode has priority over the event-only trigger/capture modes. therefore, event-only modes have no meaning in detail mode and their functions default to similar trigger modes. table 18-25. resolution of mode con?cts mode normal / loop1 detail tag force tag force a only a or b a then b event-only b 1 1, 3 3 a then event-only b 2 4 4 a and b (full mode) 5 5 a and not b (full mode) 5 5 inside range 6 6 outside range 6 6 1 ?ignored ?same as force 2 ?ignored for comparator b 3 ?reduces to effectively ? only 4 ?works same as a then b 5 ?reduces to effectively ? only??b not compared 6 ?only accurate to word boundaries

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 496 freescale semiconductor 18.4.2.6 capture modes the dbg in dbg mode can operate in four capture modes. these modes are described in the following subsections. 18.4.2.6.1 normal mode in normal mode, the dbg module uses comparator a and b as triggering devices. change-of-?w information or data will be stored depending on trg in dbgsc. 18.4.2.6.2 loop1 mode the intent of loop1 mode is to prevent the trace buffer from being ?led entirely with duplicate information from a looping construct such as delays using the dbne instruction or polling loops using brset/brclr instructions. immediately after address information is placed in the trace buffer, the dbg module writes this value into the c comparator and the c comparator is placed in ignore address mode. this will prevent duplicate address entries in the trace buffer resulting from repeated bit-conditional branches. comparator c will be cleared when the arm bit is set in loop1 mode to prevent the previous contents of the register from interfering with loop1 mode operation. breakpoints based on comparator c are disabled. loop1 mode only inhibits duplicate source address entries that would typically be stored in most tight looping constructs. it will not inhibit repeated entries of destination addresses or vector addresses, because repeated entries of these would most likely indicate a bug in the users code that the dbg module is designed to help ?d. note in certain very tight loops, the source address will have already been fetched again before the c comparator is updated. this results in the source address being stored twice before further duplicate entries are suppressed. this condition occurs with branch-on-bit instructions when the branch is fetched by the ?st p-cycle of the branch or with loop-construct instructions in which the branch is fetched with the ?st or second p cycle. see examples below: loop  incx                   ; 1-byte instruction fetched by 1st p-cycle of brclr       brclr cmptmp,#$0c,loop ; the brclr instruction also will be fetched by 1st p-cycle of brclr loop2 brn   *                ; 2-byte instruction fetched by 1st p-cycle of dbne       nop                    ; 1-byte instruction fetched by 2nd p-cycle of dbne       dbne  a,loop2          ; this instruction also fetched by 2nd p-cycle of dbne note loop1 mode does not support paged memory, and inhibits duplicate entries in the trace buffer based solely on the cpu address. there is a remote possibility of an erroneous address match if program ?w alternates between paged and unpaged memory space.

 functional description mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 497 18.4.2.6.3 detail mode in the detail mode, address and data for all cycles except program fetch (p) and free (f) cycles are stored in trace buffer. this mode is intended to supply additional information on indexed, indirect addressing modes where storing only the destination address would not provide all information required for a user to determine where his code was in error. 18.4.2.6.4 pro?e mode this mode is intended to allow a host computer to poll a running target and provide a histogram of program execution. each read of the trace buffer address will return the address of the last instruction executed. the dbgcnt register is not incremented and the trace buffer does not get ?led. the arm bit is not used and all breakpoints and all other debug functions will be disabled. 18.4.2.7 storage memory the storage memory is a 64 words deep by 16-bits wide dual port ram array. the cpu accesses the ram array through a single memory location window (dbgtbh:dbgtbl). the dbg module stores trace information in the ram array in a circular buffer format. as data is read via the cpu, a pointer into the ram will increment so that the next cpu read will receive fresh information. in all trigger modes except for event-only and detail capture mode, the data stored in the trace buffer will be change-of-?w addresses. change-of-?w addresses are de?ed as follows:  source address of conditional branches (long, short, brset, and loop constructs) taken  destination address of indexed jmp, jsr, and call instruction  destination address of rti, rts, and rtc instructions  vector address of interrupts except for swi and bdm vectors in the event-only trigger modes only the 16-bit data bus value corresponding to the event is stored. in the detail capture mode, address and then data are stored for all cycles except program fetch (p) and free (f) cycles. 18.4.2.8 storing data in memory storage buffer 18.4.2.8.1 storing with begin-trigger storing with begin-trigger can be used in all trigger modes. when dbg mode is enabled and armed in the begin-trigger mode, data is not stored in the trace buffer until the trigger condition is met. as soon as the trigger condition is met, the dbg module will remain armed until 64 words are stored in the trace buffer. if the trigger is at the address of the change-of-?w instruction the change-of-?w associated with the trigger event will be stored in the trace buffer. 18.4.2.8.2 storing with end-trigger storing with end-trigger cannot be used in event-only trigger modes. when dbg mode is enabled and armed in the end-trigger mode, data is stored in the trace buffer until the trigger condition is met. when the trigger condition is met, the dbg module will become de-armed and no more data will be stored. if

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 498 freescale semiconductor the trigger is at the address of a change-of-?w address the trigger event will not be stored in the trace buffer. 18.4.2.9 reading data from trace buffer the data stored in the trace buffer can be read using either the background debug module (bdm) module or the cpu provided the dbg module is enabled and not armed. the trace buffer data is read out ?st-in ?st-out. by reading cnt in dbgcnt the number of valid words can be determined. cnt will not decrement as data is read from dbgtbh:dbgtbl. the trace buffer data is read by reading dbgtbh:dbgtbl with a 16-bit read. each time dbgtbh:dbgtbl is read, a pointer in the dbg will be incremented to allow reading of the next word. reading the trace buffer while the dbg module is armed will return invalid data and no shifting of the ram pointer will occur. note the trace buffer should be read with the dbg module enabled and in the same capture mode that the data was recorded. the contents of the trace buffer counter register (dbgcnt) are resolved differently in detail mode verses the other modes and may lead to incorrect interpretation of the trace buffer data. 18.4.3 breakpoints there are two ways of getting a breakpoint in dbg mode. one is based on the trigger condition of the trigger mode using comparator a and/or b, and the other is using comparator c. external breakpoints generated using the t a ghi and t a glo external pins are disabled in dbg mode. 18.4.3.1 breakpoint based on comparator a and b a breakpoint request to the cpu can be enabled by setting dbgbrk in dbgc1. the value of begin in dbgc1 determines when the breakpoint request to the cpu will occur. when begin in dbgc1 is set, begin-trigger is selected and the breakpoint request will not occur until the trace buffer is ?led with 64 words. when begin in dbgc1 is cleared, end-trigger is selected and the breakpoint request will occur immediately at the trigger cycle. there are two types of breakpoint requests supported by the dbg module, tagged and forced. tagged breakpoints are associated with opcode addresses and allow breaking just before a speci? instruction executes. forced breakpoints are not associated with opcode addresses and allow breaking at the next instruction boundary. the type of breakpoint based on comparators a and b is determined by trgsel in the dbgc1 register (trgsel = 1 for tagged breakpoint, trgsel = 0 for forced breakpoint). table 18-26  illustrates the type of breakpoint that will occur based on the debug run.

 resets mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 499 18.4.3.2 breakpoint based on comparator c a breakpoint request to the cpu can be created if bkcen in dbgc2 is set. breakpoints based on a successful comparator c match can be accomplished regardless of the mode of operation for comparator a or b, and do not affect the status of the arm bit. tagc in dbgc2 is used to select either tagged or forced breakpoint requests for comparator c. breakpoints based on comparator c are disabled in loop1 mode. note because breakpoints cannot be disabled when the dbg is armed, one must be careful to avoid an ?n?ite breakpoint loop when using tagged-type c breakpoints while the dbg is armed. if bdm breakpoints are selected, executing a trace1 instruction before the go instruction is the recommended way to avoid re-triggering a breakpoint if one does not wish to de-arm the dbg. if swi breakpoints are selected, disarming the dbg in the swi interrupt service routine is the recommended way to avoid re-triggering a breakpoint. 18.5 resets the dbg module is disabled after reset. the dbg module cannot cause a mcu reset. 18.6 interrupts the dbg contains one interrupt source. if a breakpoint is requested and bdm in dbgc2 is cleared, an swi interrupt will be generated. table 18-26. breakpoint setup begin trgsel dbgbrk type of debug run 0 0 0 fill trace buffer until trigger address (no cpu breakpoint ?keep running) 0 0 1 fill trace buffer until trigger address, then a forced breakpoint request occurs 0 1 0 fill trace buffer until trigger opcode is about to execute (no cpu breakpoint ?keep running) 0 1 1 fill trace buffer until trigger opcode about to execute, then a tagged breakpoint request occurs 1 0 0 start trace buffer at trigger address (no cpu breakpoint ?keep running) 1 0 1 start trace buffer at trigger address, a forced breakpoint request occurs when trace buffer is full 1 1 0 start trace buffer at trigger opcode (no cpu breakpoint ?keep running) 1 1 1 start trace buffer at trigger opcode, a forced breakpoint request occurs when trace buffer is full

 chapter 18 debug module (dbgv1) mc9s12ne64 data sheet, rev. 1.1 500 freescale semiconductor

 mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 501 appendix a electrical characteristics note the mc9s12ne64 is speci?d and tested at the 3.3-v range. this section contains the most accurate electrical information for the mc9s12ne64 microcontroller available at the time of publication. the information is subject to change. this introduction is intended to give an overview on several common topics like power supply, current injection etc. a.1 parameter classi?ation the electrical parameters shown in this supplement are guaranteed by various methods. to give the customer a better understanding the following classi?ation is used and the parameters are tagged accordingly in the tables where appropriate, under the ??column heading. p:    those parameters are guaranteed during production testing on each individual device. c:  those parameters are achieved by the design characterization by measuring a statistically relevant sample size across process variations. they are regularly veri?d by production monitors. t: those parameters are achieved by design characterization on a small sample size from typical devices. all values shown in the typical column are within this category. d:    those parameters are derived mainly from simulations. a.2 power supply the mc9s12ne64 uses several pins to supply power to the i/o ports, a/d converter, oscillator and pll, the ethernet physical transceiver (ephy), as well as the digital core.  the v dda , v ssa  pair supplies the a/d converter and portions of the ephy  the v ddx1 ,v ddx2 ,v ssx1 ,v ssx2 pairs supply the i/o pins, and internal voltage regulator  the v ddr  supplies the internal voltage regulator, and is the v regen  signal ? dd1 , v ss1 , v dd2 , and v ss2  are the supply pins for the digital logic ? ddpll , v sspll  supply the oscillator and the pll ? ss1  and v ss2  are internally connected by metal ? dd1  and v dd2  are internally connected by metal  phy_vdda, phy_vssa are power supply pins for ephy analog  phy_vddrx, phy_vssrx are power supply pins for ephy receiver

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 502 freescale semiconductor  phy_vddtx, phy_vsstx are power supply pins for ephy transmitter ? dda , v ddx1 , v ddx2  as well as v ssa , v ssx1 , v ssx2  are connected by anti-parallel diodes for esd protection. note in the following context: ? dd3  is used for either v dda , v ddr , and v ddx1 /v ddx2 ? ss3  is used for either v ssa , v ssr , and v ssx1 /v ssx2  unless otherwise noted ? dd3  denotes the sum of the currents ?wing into the v dda , v ddr , and v ddx1 /v ddx2  pins ? dd  is used for v dd1 , v dd2 , v ddpll , phy_vddtx, phy_vddrx, and phy_vdda ? ss is used for v ss1 ,v ss2 ,v sspl , phy_vsstx, phy_vssrx, and phy_vssa ? dd  is used for the sum of the currents ?wing into v dd1 , v dd2 ? ddphy  is used for the sum of currents ?wing into phy_vddtx, phy_vddrx, and phy_vdda ? ddphy  is used for phy_vddtx, phy_vddrx, and phy_vdda ? ddtx  is used for twisted pair differential voltage present on the phy_txp and phy_txn pins ? ddtx is used for twisted pair differential current ?wing into the phy_txp or phy_txn pins a.3 pins there are four groups of functional pins. a.3.1 3.3 v i/o pins these i/o pins have a nominal level of 3.3 v. this group of pins is comprised of all port i/o pins, the analog inputs, bkgd pin and the reset inputs. the internal structure of these pins are identical, however some of the functionality may be disabled. a.3.2 analog reference, special function analog this group of pins is comprised of the v rh , v rl , phy_txn, phy_txp, phy_rxn, phy_rxp, and r bias  pins.

 current injection mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 503 a.3.3 oscillator the pins xfc, extal, xtal dedicated to the oscillator have a nominal 2.5 v level. they are supplied by v ddpll . a.3.4 test this pin is used for production testing only, and should be tied to ground during normal operation. a.4 current injection power supply must maintain regulation within operating v dd3 or v dd range during instantaneous and operating maximum current conditions. if positive injection current (v in >v dd3 ) is greater than i dd3 , the injection current may ?w out of v dd3  and could result in external power supply going out of regulation. ensure external v dd3  load will shunt current greater than maximum injection current. this will be the greatest risk when the mcu is not consuming power; e.g., if no system clock is present, or if clock rate is very low, which would reduce overall power consumption. a.5 absolute maximum ratings absolute maximum ratings are stress ratings only. a functional operation under or outside those maxima is not guaranteed. stress beyond those limits may affect the reliability or cause permanent damage of the device. this device contains circuitry protecting against damage due to high static voltage or electrical ?lds; however, it is advised that normal precautions be taken to avoid application of any voltages higher than maximum-rated voltages to this high-impedance circuit. reliability of operation is enhanced if unused inputs are tied to an appropriate logic voltage level (e.g., either v ss3 or v dd3 ).

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 504 freescale semiconductor a.6 esd protection and latch-up immunity all esd testing is in conformity with cdf-aec-q100 stress test quali?ation for automotive grade integrated circuits. during the device quali?ation esd stresses were performed for the human body model (hbm), the machine model (mm), and the charge device model. a device will be de?ed as a failure if after exposure to esd pulses the device no longer meets the device speci?ation. complete dc parametric and functional testing is performed per the applicable device speci?ation at room temperature followed by hot temperature, unless speci?d otherwise in the device speci?ation. table a-1. absolute maximum ratings num rating symbol min max unit 1 i/o, regulator and analog supply voltage v dd3 ?.3 4.5 v 2 digital logic supply voltage  1 1 the device contains an internal voltage regulator to generate the logic and pll supply out of the i/o supply. the absolute maximum ratings apply when the device is powered from an external source. v dd ?.3 3.0 v 3 pll supply voltage 1 v ddpll ?.3 3.0 v 4 voltage difference v ddx  to v ddr  and v dda ? vddx ?.3 0.3 v 5 voltage difference v ssx  to v ssr  and v ssa ? vssx ?.3 0.3 v 6 digital i/o input voltage v in ?.3 6.5 v 7 analog reference v rh, v rl ?.3 6.5 v 8 xfc, extal, xtal inputs v ilv ?.3 3.0 v 9 test input v test ?.3 10.0 v 10 instantaneous maximum current single pin limit for all digital i/o pins  2 2 all digital i/o pins are internally clamped to v ssx  and v ddx , v ddr  or v ssa  and v dda . i d ?5 +25 ma 11 instantaneous maximum current single pin limit for xfc, extal, xtal  3 3 these pins are internally clamped to v sspll  and v ddpll . i dl ?5 +25 ma 12 instantaneous maximum current single pin limit for test  4 4 this pin is clamped low to v sspll , but not clamped high. this pin must be tied low in applications. i dt ?.25 0 ma 13 operating temperature range (ambient) t a ?0 105  5 5 maximum ambient temperature is package dependent.  c 14 operating temperature range (junction) t j ?0 140  c 15 storage temperature range t stg ?5 155  c

 esd protection and latch-up immunity mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 505 table a-2. esd and latch-up test conditions model description symbol value unit human body series resistance r1 1500 ? storage capacitance c 100 pf number of pulse per pin positive negative   3 3 machine series resistance r1 0 ? storage capacitance c 200 pf number of pulse per pin positive negative   3 3 latch-up minimum input voltage limit ?.5 v maximum input voltage limit 7.5 v table a-3. esd and latch-up protection characteristics num c rating symbol min max unit 1c human body model (hbm) v hbm 2000  v only phy_txp, phy_txn, phy_rxp, phy_rxn pins 1000  v 2c machine model (mm) v mm 200  v only phy_txp, phy_txn, phy_rxp, phy_rxn pins 100  v 3c charge device model (cdm) v cdm 500  v only phy_txp, phy_txn, phy_rxp, phy_rxn pins 250  v 4c latch-up current at 125  c positive negative i lat +100 ?00 ?a 5c latch-up current at 27  c positive negative i lat +200 ?00 ?a

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 506 freescale semiconductor a.7 operating conditions this section describes the operating conditions of the device. unless otherwise noted those conditions apply to all the following data. note instead of specifying ambient temperature, all parameters are speci?d for the more meaningful silicon junction temperature. for power dissipation calculations refer to section a.8, ?ower dissipation and thermal characteristics. a.8 power dissipation and thermal characteristics power dissipation and thermal characteristics are closely related. the user must assure that the maximum operating junction temperature is not exceeded. the average chip-junction temperature (t j ) in  c can be obtained from: table a-4. operating conditions rating symbol min typ max unit i/o and regulator supply voltage v ddx 3.135 3.3 3.465 v analog supply voltage v dda 3.135 3.3 3.465 v regulator supply voltage v ddr 3.135 3.3 3.465 v digital logic supply voltage  1 1 the device contains an internal voltage regulator to generate v dd1 ,v dd2 ,v ddpll , phy_vddrx, phy_vddtx and phy_vdda supplies out of the v ddx  and v ddr  supply. the absolute maximum ratings apply when this regulator is disabled and the device is powered from an external source. v dd 2.375 2.5 2.625 v pll supply voltage 1 v ddpll 2.375 2.5 2.625 v voltage difference v ddx1 /v ssx2  to v dda ? vddx ?.1 0 0.1 v voltage difference v ssx /v ssx2   to  v ssa ? vssx ?.1 0 0.1 v oscillator  2 2 for the internal ethernet physical transceiver (ephy) to operate properly a 25 mhz oscillator is required. f osc 0.5  25 mhz bus frequency f bus 0.5  25 mhz operating junction temperature range t j ?0  125  c t j t a p d  ja ? () + = t j junction temperature, [  c ] = t a ambient temperature, [  c ] = p d total chip power dissipation, [w] =

 power dissipation and thermal characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 507 the total power dissipation can be calculated from: two cases with internal voltage regulator enabled and disabled must be considered: 1. internal voltage regulator disabled which is the sum of all output currents on i/o ports associated with v ddx . for r dson  is valid: respectively 2. internal voltage regulator enabled i ddx  is the current shown in table a-7 and not the overall current ?wing into v ddx , which additionally contains the current ?wing into the external loads with output high. which is the sum of all output currents on i/o ports associated with v ddx .  ja package thermal resistance, [  c/w] = p d p int p io + = p int chip internal power dissipation, [w] = p int i dd v dd ? i ddpll v ddpll ? i dda +v dda i ddp hy v ddp hy i ddtx v ddtx ? + ? + ? + = p io r dson i  i io i 2 ? = r dson v ol i ol ------------ for outputs driven low ; = r dson v dd 3 5 () v oh  i oh -------------------------------------------- for outputs driven high ; = p int i ddr v ddr ? i dda v dda i dd x v dd x i ddtx v ddtx ? + ? + ? + = p io r dson i  i io i 2 ? =

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 508 freescale semiconductor a.9 i/o characteristics this section describes the characteristics of all 3.3 v i/o pins. all parameters are not always applicable; e.g., not all pins feature pullup/pulldown resistances. table a-5. thermal package characteristics  1 1 the values for thermal resistance are achieved by package simulations num c rating symbol min typ max unit 1t thermal resistance lqfp112, single sided pcb  2 2 pc board according to eia/jedec standard 51-3  ja 54 o c/w 2t thermal resistance lqfp112, double sided pcb with two internal planes  3 3 pc board according to eia/jedec standard 51-7  ja 41 o c/w 3 t junction to board lqfp112  jb 31 o c/w 4 t junction to case lqfp112  jc 11 o c/w 5 t junction to package top lqfp112  jt  2 o c/w 6 t thermal resistance tqfp-ep80, single sided pcb  ja 51 o c/w 7t thermal resistance tqfp-ep80, double sided pcb with two internal planes  ja 41 o c/w 8 t junction to board tqfp-ep80  jb 27 o c/w 9 t junction to case tqfp-ep80  jc 14 o c/w 10 t junction to package top tqfp-ep80  jt  3 o c/w 6t thermal resistance epad tqfp-ep80, single sided pcb  ja 48 o c/w 7t thermal resistance epad tqfp-ep80, double sided pcb with two internal planes  ja 24 o c/w 8 t junction to board tqfp-ep80  jb 10 o c/w 9t junction to case tqfp-ep80  4 4 thermal resistance between the die and the exposed die pad.  jc   0.7 o c/w 10 t junction to package top tqfp-ep80  jt  2 o c/w

 i/o characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 509 table a-6. preliminary 3.3 v i/o characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit 1 p input high voltage v ih 0.65*v dd3 v t input high voltage v ih  v dd3  + 0.3 v 2 p input low voltage v il  0.35*v dd3 v t input low voltage v il v ss3  ?0.3 v 3 c input hysteresis v hys 250 mv 4p input leakage current (pins in high ohmic input mode)  1 v in = v dd5 or v ss5 1 maximum leakage current occurs at maximum operating temperature. current decreases by approximately one-half for each 8  c to 12  c in the temperature range from 50  c to 125  c. i in ?.5  2.5  a 5c output high voltage (pins in output mode) partial drive i oh = ?.75 ma v oh v dd3  ?0.4 v 6p output high voltage (pins in output mode) full drive i oh = ?.5 ma v oh v dd3  ?0.4 v 7c output low voltage (pins in output mode) partial drive i ol = +0.9 ma v ol   0.4 v 8p output low voltage (pins in output mode) full drive i ol = +5.5 ma v ol   0.4 v 9p internal pull up device current, tested at v il  max. i pul    ?0  a 10 c internal pull up device current, tested at v ih  min. i puh ?    a 11 p internal pull down device current, tested at v ih  min. i pdh 60  a 12 c internal pull down device current, tested at v il  max. i pdl 6  a 13 d input capacitance c in 7 pf 14 t injection current  2 single pin limit total device limit. sum of all injected currents 2 refer to section a.4, ?urrent injection,?for more details. i ics i icp ?.5 ?5  2.5 25 ? 15 p port g, h, and j  interrupt input pulse ?tered  3 3 parameter only applies in stop or pseudo stop mode. t pign 3  s 16 p port g, h, and j interrupt input pulse passed 3 t pval 10  s

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 510 freescale semiconductor a.10 supply currents this section describes the current consumption characteristics of the device as well as the conditions for the measurements. a.10.1 measurement conditions all measurements are without output loads. unless otherwise noted the currents are measured in single chip mode, internal voltage regulator enabled and at 25 mhz bus frequency using a 25 mhz oscillator. a.10.2 additional remarks in expanded modes the currents ?wing in the system are highly dependent on the load at the address, data and control signals as well as on the duty cycle of those signals. no generally applicable numbers can be given. a very good estimate is to take the single chip currents and add the currents due to the external loads. table a-7. supply current characteristics conditions are shown in table a-4 unless otherwise noted num c rating symbol min typ max unit 1 p c p c run supply currents single chip, internal regulator enabled, ephy disabled single chip, internal regulator enabled, ephy auto negotiate  1 single chip, internal regulator enabled, ephy 100base-tx 1 single chip, internal regulator enabled, ephy 10base-t 1 1 when calculating power consumption, the additional current sunk by the phy_txn and phy_txp pins must be taken into account. see table a-8 for currents and voltages to use in the power calculations. i dd3 65 285 265 185 ma 2 c c p wait supply current all modules enabled all modules but ephy enabled only rti enabled i ddw 270 50 5 ma 3 c p c c pseudo stop current (rti and cop enabled) ?0  c 27  c 85  c 105  c i ddps 600 600 1000 1000 750 5000  a 4 c c c c pseudo stop current (rti and cop disabled) ?0  c 27  c 85  c 105  c i ddps 160 160 700 700 400 5000  a 5 c p c c stop current ?0  c 27  c 85  c 105  c i dds 60 60 400 500 200 5000  a

 supply currents mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 511 table a-8. ephy twisted pair transmit pin characteristics num c rating symbol min typ max unit 1 c auto-negotiate transmitter current i ddtx 130 ma 2 c auto-negotiate transmitter voltage v ddtx v dd3  ?1.1 v v 3 c 10base-t mode transmitter current i ddtx 130 ma 4 c 10base-t mode transmitter voltage v ddtx v dd3  ?1.1 v v 5 c 100base-tx mode transmitter current i ddtx 45 ma 6 c 100base-tx mode transmitter voltage v ddtx v dd3  ?0.95 v v

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 512 freescale semiconductor a.11 atd electrical characteristics this section describes the characteristics of the analog-to-digital converter. a.11.1 atd operating characteristics ?3.3 v range table 18-27 shows conditions under which the atd operates. the following constraints exist to obtain full-scale, full range results: v ssa  v rl   v in   v rh   v dda . this constraint exists since the sample buffer ampli?r can not drive beyond the power supply levels that it ties to. if the input level goes outside of this range it will effectively be clipped. table 18-27. 3.3v atd operating characteristics a.11.2 factors influencing accuracy three factors ?source resistance, source capacitance, and current injection ?have an in?ence on the accuracy of the atd. a.11.2.1 source resistance due to the input pin leakage current as speci?d in table a-6  in conjunction with the source resistance there will be a voltage drop from the signal source to the atd input. the maximum source resistance r s speci?s results in an error of less than 1/2 lsb (2.5 mv) at the maximum leakage current. if device or operating conditions are less than worst case or leakage-induced error is acceptable, larger values of source resistance are allowed. conditions are shown in table a-4  unless otherwise noted; supply voltage 3.3 v-10% <= v dda  <= 3.3 v +10% num c rating symbol min typ max unit 1 d reference potential low high v rl v rh v ssa v dda /2 v dda /2 v dda v v 2 c differential reference voltage v rh -v rl 3.0 3.3 3.6 v 3 d atd clock frequency f atdclk 0.5 2.0 mhz 4 d atd 10-bit conversion period clock cycles  1 conv, time at 2.0 mhz atd clock f atdclk 1 the minimum time assumes a ?al sample period of 2 atd clocks cycles while the maximum time assumes a ?al sample period of 16 atd clocks. n conv10 t conv10 14 7 28 14 cycles  s 5 d atd 8-bit conversion period clock cycles 1 conv, time at 2.0 mhz atd clock f atdclk n conv8 t conv8 12 6 26 13 cycles  s 6 d recovery time (v dda = 3.3 v) t rec 20  s 7 p reference supply current i ref 0.250 ma

 atd electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 513 a.11.2.2 source capacitance when sampling an additional internal capacitor is switched to the input. this can cause a voltage drop due to charge sharing with the external and the pin capacitance. for a maximum sampling error of the input voltage   1lsb, then the external ?ter capacitor, c f   1024 * (c ins - c inn ). a.11.2.3 current injection there are two cases to consider.  a current is injected into the channel being converted. the channel being stressed has conversion values of $3ff ($ff in 8-bit mode) for analog inputs greater than vrh and $000 for values less than vrl unless the current is higher than speci?d as disruptive conditions.  current is injected into pins in the neighborhood of the channel being converted. a portion of this current is picked up by the channel (coupling ratio k), this additional current impacts the accuracy of the conversion depending on the source resistance. the additional input voltage error on the converted channel can be calculated as v err =k*r s * i inj , with i inj  being the sum of the currents injected into the two pins adjacent to the converted channel. a.11.3 atd accuracy ?3.3 v range table a-10 speci?s the atd conversion performance excluding any errors due to current injection, input capacitance and source resistance. table a-9. atd electrical characteristics conditions are shown in table a-4  unless otherwise noted num c rating symbol min typ max unit 1 c max input source resistance r s  1 k ? 2 t total input capacitance non sampling sampling c inn c ins 10 15 pf 3 c disruptive analog input current i na ?.5 2.5 ma 4 c coupling ratio positive current injection k p 10 -4 a/a 5 c coupling ratio negative current injection k n 10 -2 a/a

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 514 freescale semiconductor table a-10. 3.3-v a/d conversion performance for the following de?itions see also figure a-1. differential non-linearity (dnl) is de?ed as the difference between two adjacent switching steps. the integral non-linearity (inl) is de?ed as the sum of all dnls: conditions are shown in table a-4  unless otherwise noted v ref  = v rh  - v rl  = 3.328 v. resulting to one 8 bit count = 13 mv and one 10 bit count = 3.25 mv f atdclk  = 2.0 mhz num c rating symbol min typ max unit 1 p 10-bit resolution lsb 3.25 mv 2 p 10-bit differential nonlinearity dnl ?.5 1.5 counts 3 p 10-bit integral nonlinearity inl ?.5  1.5 3.5 counts 4p 10-bit absolute error  1 1 these values include the quantization error which is inherently 1/2 count for any a/d converter. ae ?  2.5 5 counts 5 c 10-bit absolute error at f atdclk = 4mhz ae  7.0 counts 6 p 8-bit resolution lsb 13 mv 7 p 8-bit differential nonlinearity dnl ?.5 0.5 counts 8 p 8-bit integral nonlinearity inl ?.5  1.0 1.5 counts 9p 8-bit absolute error 1 ae ?.0  1.5 2.0 counts d nl i () v i v i1   1lsb ------------------------- 1  = inl n () dnl i () i1 = n  v n v 0  1lsb ------------------- - n  ==

 atd electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 515 figure a-1. atd accuracy de?itions note figure a-1 shows only de?itions, for speci?ation values refer to table a-10. 1 5 v in mv 10 15 20 25 30 35 40 5085 5090 5095 5100 5105 5110 5115 5120 5065 5070 5075 5080 5060 0 3 2 5 4 7 6 50 $3f7 $3f9 $3f8 $3fb $3fa $3fd $3fc $3fe $3ff $3f4 $3f6 $3f5 8 9 1 2 $ff $fe $fd $3f3 10-bit resolution 8-bit resolution ideal transfer curve 10-bit transfer curve 8-bit transfer curve 5055 10-bit absolute error boundary 8-bit absolute error boundary lsb v i-1 v i dnl

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 516 freescale semiconductor a.12 reset, oscillator, and pll electrical characteristics this section summarizes the electrical characteristics of the various startup scenarios for oscillator and phase-locked loop (pll). a.12.1 startup table a-11 summarizes several startup characteristics explained in this section. detailed description of the startup behavior can be found in the clock and reset generator (crg) block description chapter. a.12.1.1 por the release level v porr and the assert level v pora are derived from the v dd supply. they are also valid if the device is powered externally. after releasing the por reset the oscillator and the clock quality check are started. if after a time t cqout no valid oscillation is detected, the mcu will start using the internal self clock. the fastest startup time possible is given by n uposc . a.12.1.2 lvr the release level v lvrr and the assert level v lvra are derived from the v dd supply. they are also valid if the device is powered externally. after releasing the lvr reset the oscillator and the clock quality check are started. if after a time t cqout no valid oscillation is detected, the mcu will start using the internal self clock. the fastest startup time possible is given by n uposc . a.12.1.3 sram data retention provided an appropriate external reset signal is applied to the mcu, preventing the cpu from executing code when v dd5 is out of speci?ation limits, the sram contents integrity is guaranteed if after the reset the porf bit in the crg ?gs register has not been set. table a-11. startup characteristics conditions are shown in table a-4  unless otherwise noted num c rating symbol min typ max unit 1 t por release level v porr 2.07 v 2 t por assert level v pora 0.97 v 3 d reset input pulse width, minimum input time pw rstl 2t osc 4 d startup from reset n rst 192 196 n osc 5 d interrupt pulse width, irq edge-sensitive mode pw irq 20 ns 6 d wait recovery startup time t wrs 14 t cyc 7 p lvr release level v lvrr 2.25 v 8 p lvr assert level v lvra 2.55 v

 reset, oscillator, and pll electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 517 a.12.1.4 external reset when external reset is asserted for a time greater than pw rstl  the crg module generates an internal reset, and the cpu starts fetching the reset vector without doing a clock quality check, if there was an oscillation before reset. a.12.1.5 stop recovery out of stop, the controller can be woken up by an external interrupt. a clock quality check as after por is performed before releasing the clocks to the system. a.12.1.6 pseudo stop and wait recovery the recovery from pseudo stop and wait are essentially the same because the oscillator was not stopped in either mode. the controller can be woken up by internal or external interrupts. after t wrs  the cpu starts fetching the interrupt vector. a.12.2 oscillator the device features an internal pierce oscillator. before asserting the oscillator to the internal system clocks the quality of the oscillation is checked for each start from either power-on, stop or oscillator fail. t cqout speci?s the maximum time before switching to the internal self clock mode after por or stop if a proper oscillation is not detected. the quality check also determines the minimum oscillator start-up time t uposc . the device also features a clock monitor. a clock monitor failure is asserted if the frequency of the incoming clock signal is below the assert frequency f cmfa.

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 518 freescale semiconductor a.12.3 phase-locked loop the oscillator provides the reference clock for the pll. the plls voltage controlled oscillator (vco) is also the system clock source in self clock mode. a.12.3.1 xfc component selection this section describes the selection of the xfc components to achieve a good ?ter characteristics. table a-12.  oscillator characteristics conditions are shown in table a-4  unless otherwise noted num c rating symbol min typ max unit 1c crystal oscillator range (pierce)  1, 2 1 depending on the crystal a damping series resistor might be necessary 2 xclks =0 during reset f osc 0.5 40 mhz 2 p startup current i osc 100  a 3 c oscillator start-up time (pierce) t uposc 8  3 3 f osc  = 25 mhz, c = 22 pf. 100  4 4 maximum value is for extreme cases using high q, low frequency crystals ms 4 d clock quality check time-out t cqout 0.45 2.5 s 5 p clock monitor failure assert frequency f cmfa 50 100 200 khz 6p external square wave input frequency 2 f ext 0.5 50 mhz 7 d external square wave pulse width low t extl 9.5 ns 8 d external square wave pulse width high t exth 9.5 ns 9 d external square wave rise time t extr 1ns 10 d external square wave fall time t extf 1ns 11 d input capacitance (extal, xtal pins) c in 7pf 12 c dc operating bias in colpitts con?uration on extal pin v dcbias 1.1 v extal pin input high voltage 4 v ih,extal 0.7*v ddpll v extal pin input high voltage 4 v ih,extal v ddpll + 0.3 v extal pin input low voltage 4 v il,extal 0.3*v ddpll v extal pin input low voltage 4 v il,extal v sspll  0.3 v extal pin input hysteresis 4 v hys,extal 250 mv

 reset, oscillator, and pll electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 519 figure 18-22. basic pll functional diagram the following procedure can be used to calculate the resistance and capacitance values using typical values for k 1 , f 1  and i ch  from table a-13. the grey boxes show the calculation for f vco = 50 mhz and f ref = 1 mhz. e.g., these frequencies are used for f osc  = 4 mhz and a 25 mhz bus clock. the vco gain at the desired vco frequency is approximated by: the phase detector relationship is given by: i ch  is the current in tracking mode. the loop bandwidth f c should be chosen to ful?l the gardners stability criteria by at least a factor of 10, typical values are 50.   = 0.9 ensures a good transient response. f osc 1 refdv+1 f ref phase detector vco k v 1 synr+1 f vco loop divider k  1 2 ? f cmp c s r c p v ddpll xfc pin k v k 1 e f 1 f vco  () k 1 1v ? ----------------------- ? = 100  e 60 50  () 100  ---------------------- ? = = -90.48mhz/v k  i ch  k v ? = = 316.7hz/ ? f c 2  f ref ??  1  2 + + ?? ?? ? ------------------------------------------ 1 10 ----- - f c f ref 410 ? -------------  0.9 = () ; <  < f c  < 25khz

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 520 freescale semiconductor and ?ally the frequency relationship is de?ed as: with the above values the resistance can be calculated. the example is shown for a loop bandwidth f c = 10 khz: the capacitance c s  can now be calculated as: the capacitance c p  should be chosen in the range of: a.12.3.1.1 jitter information the basic functionality of the pll is shown in figure 18-22. with each transition of the clock f cmp , the deviation from the reference clock f ref is measured and input voltage to the vco is adjusted accordingly. the adjustment is done continuously with no abrupt changes in the clock output frequency. noise, voltage, temperature, and other factors cause slight variations in the control loop resulting in a clock jitter. this jitter affects the real minimum and maximum clock periods as illustrated in figure 18-23. figure 18-23. jitter de?itions n f vco f ref ------------- 2 s y n r 1 + () ? == = 50 r 2  nf c ??? k  ---------------------------- - = =2*  *50*10khz/(316.7hz/ ? ) =9.9k ? =~10k ? c s 2  2 ?  f c r ?? --------------------- - 0.516 f c r ? -------------- -  0.9 = () ;  = = 5.19nf =~ 4.7nf c s 20 ? c p c s 10 ? ? c p  = 470pf 2 3 n-1 n 1 0 t nom t max1 t min1 t maxn t minn

 reset, oscillator, and pll electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 521 the relative deviation of t nom is at its maximum for one clock period, and decreases towards zero for larger number of clock periods (n). de?ing the jitter as: for n < 100, the following equation is a good ? for the maximum jitter: this is very important to notice with respect to timers, serial modules where a prescaler will eliminate the effect of the jitter to a large extent. jn () max 1 t max n () nt nom ? ---------------------  1 t min n () nt nom ? -------------------- -  , ?? ?? ?? = j n () j 1 n -------- j 2 + = 1 5 10 20 n j (n)

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 522 freescale semiconductor table a-13.  pll characteristics conditions are shown in table a-4  unless otherwise noted num c rating symbol min typ max unit 1 p self clock mode frequency f scm 1 5.5 mhz 2 d vco locking range f vco 8 50 mhz 3 d lock detector transition from acquisition to tracking mode |? trk |3 4%  1 1 % deviation from target frequency 4 d lock detection |? lock | 0 1.5 % 1 5 d unlock detection |? unl | 0.5 2.5 % 1 6 d lock detector transition from tracking to acquisition mode |? unt |6 8% 1 7c pllon total stabilization delay (auto mode)  2 2 f ref  = 25 mhz, f bus  = 25 mhz equivalent f vco  = 50 mhz: refdv = #$00, synr = #$00, cs = 4700 pf, cp = 470 pf, rs = 2.2 k ? . t stab 0.5 ms 8d pllon acquisition mode stabilization delay 2 t acq 0.3 ms 9d pllon tracking mode stabilization delay 2 t al 0.2 ms 10 d fitting parameter vco loop gain k 1 ?00 mhz/v 11 d fitting parameter vco loop frequency f 1 60 mhz 12 d charge pump current acquisition mode | i ch  | 38.5  a 13 d charge pump current tracking mode | i ch  | 3.5  a 14 c jitter ? parameter 1 2 j 1 1.1 % 15 c jitter ? parameter 2 2 j 2 0.13 %

 emac electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 523 a.13 emac electrical characteristics note the electrical characteristics given in the emac section are preliminary and should be used as a guide only. values cannot be guaranteed by freescale semiconductor and are subject to change without notice. a.13.1 mii timing the following mii timing is based on ieee std 802.3. a.13.1.1 mii receive signal timing (mii_rxd[3:0], mii_rxdv, mii_rxer, mii_rxclk) figure 18-24. mii receive signal timing diagram table a-14. mii receive signal timing num characteristic min max unit m1 rxd[3:0], rxdv, rxer setup to rxclk rise 10  ns m2 rxclk rise to rxd[3:0], rxdv, rxer hold 10  ns m3 rxclk pulse width high 35% 65% rxclk period m4 rxclk pulse width low 35% 65% rxclk period m1 m2 rxclk (input) rxd[3:0] (inputs) rxdv rxer m3 m4

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 524 freescale semiconductor a.13.1.2 mii transmit signal timing (txd[3:0], txen, txer, txclk) figure a-2. mii transmit signal timing diagram a.13.1.3 mii asynchronous inputs signal timing (crs, col) table a-15. mii transmit signal timing num characteristic min max unit m5 txclk rise to txd[3:0], txen, txer invalid 0  ns m6 txclk rise to txd[3:0], txen, txer valid  25 ns m7 txclk pulse width high 35% 65% txclk period m8 txclk pulse width low 35% 65% txclk period table a-16. mii transmit signal timing num characteristic min max unit m9 crs, col minimum pulse width 1.5  txclk period m6 txclk (input) txd[3:0] (outputs) txen txer m5 m7 m8

 emac electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 525 figure a-3. mii asynchronous inputs timing diagram a.13.1.4 mii management timing (mdio, mdc) table a-17. mii management signal timing num characteristic min max unit m10 mdc rise to mdio (output) invalid 10  ns m11 mdc rise to mdio (output) valid  390 ns m12 mdio (input) setup to mdc rise 100  ns m13 mdc rise to mdio (input) hold 0  ns m14 mdc pulse width high 40% 60% mdc period m15 mdc pulse width low 40% 60% mdc period crs, col m9

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 526 freescale semiconductor figure a-4. mii serial management channel timing diagram m11 mdc (output) mdio (output) m12 m13 mdio (input) m10 m14 m15

 ephy electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 527 a.14 ephy electrical characteristics note the electrical characteristics given in the ephy section are preliminary and should be used as a guide only. values cannot be guaranteed by freescale semiconductor and are subject to change without notice. typical values are at 25  c. 1 bt = bit time = 100 ns figure a-5. 10base-t sqe (heartbeat) timing a.14.1 10base-t jab and unjab timing typical values are at 25  c. 1 bt = bit time = 100 ns table a-18. 10base-t sqe (heartbeat) timing parameters num c parameter sym min typ max units 1 d col (sqe) delay after txen off t1 1.0  s 2 d col (sqe) pulse duration t2 1.0  s table a-19. 10base-t jab and unjab timing parameters num c parameter sym min typ max units 1 d maximum transmit time t1 98 ms 2 d unjab time t2 525 ms txc col txen t1 t2

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 528 freescale semiconductor figure a-6. 10base-t sqe (heartbeat) timing a.14.2 auto negotiation a.14.2.1 mii ?100base-tx transmit timing parameters typical values are at 25  c. 1 bt = bit time = 100 ns these parameters are the minimum and maximum times as specified in section 24.6 of the ieee 802.3u standard figure a-7. auto-negotiation and fast link pulse timing table a-20. mii ?auto negotiation and fast link pulse timing parameters num c parameter sym min typ max units 1 d clock/data pulse width t1 100 ns 2 d clock pulse to clock pulse t2 111 125 139  s 3 d clock pulse to data pulse (data = 1) t3 55.5 62.5 69.5  s 4 d pulses in a burst t4 17 33 # 5 d flp burst width t5 2 ms 6 d flp burst to flp burst t6 8 16 24 ms             txen txd col t2 t1 tx+ t1 data pulse clock pulse clock pulse t2 t3 t1

 ephy electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 529 a.14.2.2 mii ?10base-t receive timing typical values are at 25  c. 1 bt = bit time = 100 ns figure a-8. fast link pulse timing figure a-9. auto-negotiation pulse timing table a-21. auto-negotiation and fast link pulse timing num c parameter sym min typ max units 1 d transmit flnp width 1.25 1.5 1.75  s 2 d receive flnp width 1 1.5 2  s 3 d clock/data pulse width t1 100 ns 4 d clock flnp to clock flnp t2 111 125 139  s 5 d clock flnp to data flnp (data = 1) t3 55.5 62.5 69.5  s 6 d pulses in a burst t4 17 33 # 7 d flnp burst width t5 2 ms 8 d flnp burst to flnp burst t6 8 16 24 ms tx+ t5 t6 flp burst flp burst tx+ t1 data pulse clock pulse clock pulse t2 t3 t1

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 530 freescale semiconductor figure a-10. fast link pulse timing table a-22. 10base-t transceiver characteristics num c parameter sym min typ max units test conditions 1 d peak differential output voltage v op 2.2 2.5 2.8 v with speci?d transformer and line replaced by 100 ? (1%) load 2 d transmit timing jitter  0 2 11 ns using line model speci?d in the ieee 802.3 3 d receive dc input impedance z in ?0k ? 0.0 < v in  < 3.3 v 4 d receive differential squelch level v squelch 300 400 585 mv 3.3 mhz sine wave input table a-23. 100base-tx transceiver characteristics num c parameter sym min typ max units test conditions 1 d transmit peak differential output voltage v op 0.95 1.00 1.05 v with speci?d transformer and line replaced by 100 ? ( 1%) load 2 d transmit signal amplitude symmetry v sym 98 100 102 % with speci?d transformer and line replaced by 100 ? (1%) load 3 d transmit rise/fall time t rf 3 4 5 ns with speci?d transformer and line replaced by 100 ? (1%) load 4 d transmit rise/fall time symmetry t rfs ?.5 0 +0.5 ns see ieee 802.3 for details 5 d transmit overshoot/undershoot v osh  2.5 5 % 6 d transmit jitter  0 .6 1.4 ns 7 d receive common mode voltage v cm  1.6  v v ddrx  = 2.5 v 8 d receiver maximum input voltage v max   4.7 v v ddrx  = 2.5 v.  internal circuits protected by divider in shutdown tx+                        flnp burst                            flnp burst t5 t6

 ephy electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 531 table a-24. ephy operating conditions num parameter min typ max units 1 crystal  1 1 crystal tolerance must conform to ieee requirements. 25  25 mhz 2 bus clock in single chip mode ?10 mbps operation 2.5  25 mhz 3 bus clock in external mode ?10 mbps operation 2.5  f o mhz 4 bus clock in single chip mode ?100 mbps operation 25  25 mhz 5 bus clock in external mode ?100 mbps not available 6 bias resistor 12.4, 1% k ?

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 532 freescale semiconductor a.15 flash nvm electrical characteristics a.15.1 nvm timing the time base for all nvm program or erase operations is derived from the oscillator. a minimum oscillator frequency f nvmosc is required for performing program or erase operations. the nvm modules do not have any means to monitor the frequency and will not prevent program or erase operation at frequencies above or below the speci?d minimum. programming or erasing the nvm modules at a lower frequency will not result in a full program or erase transition. the flash program and erase operations are timed using a clock derived from the oscillator using the fclkdiv register. the frequency of this clock must be set within the limits speci?d as f nvmop . the minimum program and erase times shown in table a-25 are calculated for maximum f nvmop  and maximum f bus . the maximum times are calculated for minimum f nvmop  and a f bus  of 2 mhz. a.15.1.1 single word programming the programming time for single word programming is dependent on the bus frequency as a well as on the frequency f nvmop  and can be calculated according to the following formula. a.15.1.2 burst programming flash programming where up to 32 words in a row can be programmed consecutively using burst programming by keeping the command pipeline ?led. the time to program a consecutive word can be calculated as: the time to program a whole row is: burst programming is more than two times faster than single word programming. a.15.1.3 sector erase erasing a 512 byte flash sector takes: the setup times can be ignored for this operation. t swpgm 9 1 f nvmop --------------------- ? 25 1 f bus ---------- ? + = t bwpgm 4 1 f nvmop --------------------- ? 9 1 f bus ---------- ? + = t brpgm t swpgm 31 t bwpgm ? + = t era 4000 1 f nvmop --------------------- ? 

 flash nvm electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 533 a.15.1.4 mass erase erasing a nvm block takes: the setup times can be ignored for this operation. a.15.2 nvm reliability the reliability of the nvm blocks is guaranteed by stress test during quali?ation, constant process monitors and burn-in to screen early life failures. the failure rates for data retention and program/erase cycling are speci?d at < 2 ppm defects over lifetime at the operating conditions noted. a program/erase cycle is speci?d as two transitions of the cell value from erased   programmed  erased, 1   0   1. table a-25.  nvm timing characteristics conditions are shown in table a-4  unless otherwise noted num c rating symbol min typ max unit 1 d external oscillator clock f nvmosc 0.5 50  1 1 restrictions for oscillator in crystal mode apply! mhz 2 d bus frequency for programming or erase operations f nvmbus 1 mhz 3 d operating frequency f nvmop 150 200 khz 4 p single word programming time t swpgm 46  2 2 minimum programming times are achieved under maximum nvm operating frequency f nvmop and maximum bus frequency f bus . 74.5  3 3 maximum erase and programming times are achieved under particular combinations of f nvmop and bus frequency f bus.  s 5 d flash burst programming consecutive word t bwpgm 20.4 2 31 3  s 6 d flash burst programming time for 32 words t brpgm 678.4 2 1035.5 3  s 7 p sector erase time t era 20  4 4 minimum erase times are achieved under maximum nvm operating frequency f  nvmop . 26.7 3 ms 8 p mass erase time t mass 100 4 133 3 ms 9 d blank check time flash per block t  check 11  5 5 minimum time, if ?st word in the array is not blank 32778  6 6 maximum time to complete check on an erased block. t cyc t mass 20000 1 f nvmop --------------------- ? 

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 534 freescale semiconductor note all values shown in table a-26 are target values and subject to further extensive characterization. table a-26.  nvm reliability characteristics conditions are shown in table a-4  unless otherwise noted num c rating symbol min typ max unit 1 c data retention at an average junction temperature of t javg  = 85  c t nvmret 15 years 2 c data retention at a junction temperature of t j  = 140 c t nvmret 10 years 3 c flash number of program/erase cycles n flpe 10,000 cycles

 spi electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 535 a.16 spi electrical characteristics this section provides electrical parametrics and ratings for the spi. in table a-27 the measurement conditions are listed. a.16.1 master mode in figure a-11 the timing diagram for master mode with transmission format cpha=0 is depicted. figure a-11. spi master timing (cpha=0) in figure a-12 the timing diagram for master mode with transmission format cpha=1 is depicted. table a-27. measurement conditions description value unit drive mode full drive mode  load capacitance c load, on all outputs 50 pf thresholds for delay measurement points (20% / 80%) vddx v sck (output) sck (output) miso (input) mosi (output) ss 1 (output) 1 9 5 6 msb in 2 bit 6 . . . 1 lsb in msb out 2 lsb out bit 6 . . . 1 11 4 4 2 10 (cpol =  0) (cpol =  1) 3 13 13 1.if configured as an output. 2. lsbf = 0. for lsbf = 1, bit order is lsb, bit 1, ..., bit 6, msb. 12 12

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 536 freescale semiconductor figure a-12. spi master timing (cpha=1) in table a-28 the timing characteristics for master mode are listed. a.16.2 slave mode in figure a-13 the timing diagram for slave mode with transmission format cpha = 0 is depicted. table a-28. spi master mode timing characteristics num c characteristic symbol min typ max unit 1 p sck frequency f sck 1/2048  1 / 2f bus 1 p sck period t sck 2  2048 t bus 2 d enable lead time t lead  1/2  t sck 3 d enable lag time t lag  1/2  t sck 4 d clock (sck) high or low time t wsck  1/2  t sck 5 d data setup time (inputs) t su 8  ns 6 d data hold time (inputs) t hi 8  ns 9 d data valid after sck edge t vsck   30 ns 10 d data valid after ss fall (cpha=0) t vss   15 ns 11 d data hold time (outputs) t ho 20   ns 12 d rise and fall time inputs t r  8 ns 13 d rise and fall time outputs t rfo  8 ns sck (output) sck (output) miso (input) mosi (output) 1 5 6 msb in 2 bit 6 . . . 1 lsb in master msb out 2 master lsb out bit 6 . . . 1 4 4 9 12 13 11 port data (cpol =  0) (cpol =  1) port data ss 1 (output) 2 12 13 3 1.if configured as output 2. lsbf = 0. for lsbf = 1, bit order is lsb, bit 1, ..., bit 6, msb.

 spi electrical characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 537 figure a-13. spi slave timing (cpha = 0) in figure a-14 the timing diagram for slave mode with transmission format cpha = 1 is depicted. figure a-14. spi slave timing (cpha = 1) in table a-29 the timing characteristics for slave mode are listed. sck (input) sck (input) mosi (input) miso (output) ss (input) 1 9 5 6 msb in bit 6 . . . 1 lsb in slave msb slave lsb out bit 6 . . . 1 11 4 4 2 7 (cpol =  0) (cpol =  1) 3 13 note: not defined! 12 12 11 see 13 note 8 10 see note sck (input) sck (input) mosi (input) miso (output) 1 5 6 msb in bit 6 . . . 1 lsb in msb out slave lsb out bit 6 . . . 1 4 4 9 12 13 11 (cpol =  0) (cpol =  1) ss (input) 2 12 13 3 note: not defined! slave 7 8 see note

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 538 freescale semiconductor table a-29. spi slave mode timing characteristics num c characteristic symbol min typ max unit 1 p sck frequency f sck dc  1 / 4f bus 1 p sck period t sck 4 t bus 2 d enable lead time t lead 4  t bus 3 d enable lag time t lag 4  t bus 4 d clock (sck) high or low time t wsck 4  t bus 5 d data setup time (inputs) t su 8  ns 6 d data hold time (inputs) t hi 8  ns 7 d slave access time (time to data active) t a  20 ns 8 d slave miso disable time t dis  22 ns 9 d data valid after sck edge t vsck   30 + t bus  1 1 t bus  added due to internal synchronization delay ns 10 d data valid after ss fall t vss   30 + t bus 1 ns 11 d data hold time (outputs) t ho 20   ns 12 d rise and fall time inputs t r  8 ns 13 d rise and fall time outputs t rfo  8 ns 

 voltage regulator operating characteristics mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 539 a.17 voltage regulator operating characteristics this section describes the characteristics of the on-chip voltage regulator (vreg_phy). table a-30. vreg_phy - operating conditions a.17.1 mcu power-up and lvr graphical explanation voltage regulator sub modules por (power-on reset) and lvr (low-voltage reset) handle chip power-up or drops of the supply voltage. their function is described in figure a-15. num c characteristic symbol min typical max unit 1 p input voltages v vddr,a,x1,x2 3.135  3.465 v 2 p regulator current reduced power mode shutdown mode i reg   20 12 50 40  a  a 3 p output voltage core full performance mode reduced power mode shutdown mode v dd 2.375 1.6  2.5 2.5 1 1 high impedance output 2.625 2.75  v v v 4 p output voltage pll full performance mode    reduced power mode  2 shutdown mode 2 current i ddpll  = 3 ma (pierce oscillator) v ddpll 2.375 1.6  2.5 2.5 3 3 high impedance output 2.625 2.75  v v v 5p low voltage reset  4 assert level deassert level 4 monitors v dd , active only in full performance mode. v lvra  and v pord  must overlap v lvra v lvrd 2.25     2.55 v v 7c power-on reset  5 assert level deassert level 5 monitors v dd . active in all modes. the electrical characteristics given in this section are preliminary and should be used as a guide only. values in this section cannot be guaranteed by freescale semiconductor and are subject to change without notice. v pora v pord 0.97  --- ---  2.05 v v

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 540 freescale semiconductor figure a-15. voltage regulator ?mcu power-up and voltage drops (not scaled) a.17.2 output loads a.17.2.1 resistive loads the on-chip voltage regulator is intended to supply the internal logic and oscillator circuits allows no external dc loads. a.17.2.2 capacitive loads the capacitive loads are speci?d in table a-31. ceramic capacitors with x7r dielectricum are required. table a-31. voltage regulator ?capacitive loads num characteristic symbol min typical max unit 1 v dd  external capacitive load c ddext 200 440 12000 nf 2 phy_vddtx external capacitive load c ddpllext 90 220 5000 nf 2 phy_vddrx external capacitive load c ddpllext 90 220 5000 nf 2 phy_vdda external capacitive load c ddpllext 90 220 5000 nf 2 v ddpll  external capacitive load c ddpllext 90 220 5000 nf v lvrd v lvra v pord por lvr t v v dd

 external bus timing mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 541 a.18 external bus timing a timing diagram of the external multiplexed-bus is illustrated in figure 18-25 with the actual timing values shown on table table a-32. all major bus signals are included in the diagram. although both a data write and data read cycle are shown, only one or the other would occur on a particular bus cycle. the expanded bus timings are highly dependent on the load conditions. the timing parameters shown assume a balanced load across all outputs. figure 18-25. general external bus timing addr/data (read) addr/data (write) addr data data 5 10 11 8 16 6 eclk 1, 2 3 4 addr data data 12 15 9 7 14 13 lstrb 22 no a cc 25 pipo0 pipo1, pe6,5 28 20 21 23 26 29 24 27 r/ w 17 19 18 pe4 pa, pb pa, pb pe2 pe3 pe7

 appendix a electrical characteristics mc9s12ne64 data sheet, rev. 1.1 542 freescale semiconductor table a-32.  expanded bus timing characteristics (3.3 v range) conditions are vddx = 3.3 v 5%, junction temperature -40?c to +125?c, c load  = 50 pf num c rating symbol min typ max unit 1 p frequency of operation (e-clock) f o 0 16.0 mhz 2 p cycle time t cyc 62.5 ns 3 d pulse width, e low pw el 30 ns 4d pulse width, e high  1 pw eh 30 ns 5 d address delay time t ad 16 ns 6 d address valid time to e rise (pw el ? ad )t av 16 ns 7 d muxed address hold time t mah 2ns 8 d address hold to data valid t ahds 7ns 9 d data hold to address t dha 2ns 10 d read data setup time t dsr 15 ns 11 d read data hold time t dhr 0ns 12 d write data delay time t ddw 15 ns 13 d write data hold time t dhw 2ns 14 d write data setup time 1  (pw eh ? ddw ) t dsw 15 ns 15 d address access time 1 t acca 29 ns 16 d e high access time 1 (pw eh ? dsr ) t acce 15 ns 17 d read/write delay time t rwd 14 ns 18 d read/write valid time to e rise (pw el ? rwd )t rwv 16 ns 19 d read/write hold time t rwh 2ns 20 d low strobe delay time t lsd 14 ns 21 d low strobe valid time to e rise (pw el ? lsd )t lsv 16 ns 22 d low strobe hold time t lsh 2ns 23 d noacc strobe delay time t nod 14 ns 24 d noacc valid time to e rise (pw el ? lsd )t nov 16 ns 25 d noacc hold time t noh 2ns 26 d ipipo[1:0] delay time t p0d 214ns 27 d ipipo[1:0] valid time to e rise (pw el ? p0d )t p0v 16 ns 28 d ipipo[1:0] delay time 1 t p1d 225ns 29 d ipipo[1:0] valid time to e fall t p1v 11 ns 1 affected by clock stretch: add n x t cyc  where n=0,1,2 or 3, depending on the number of clock stretches.

 introduction mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 543 appendix b schematic and pcb layout design recommendations b.1 introduction this sections provides recommendations for schematic and pcb layout design for implementing an ethernet interface with the mc9s12ne64 microcontroller unit (mcu). b.1.1 schematic designing with the mc9s12ne64 and adding an ethernet interface figure b-1 is a schematic of a mc9s12ne64 80-pin package minimum system implementation con?ured in normal-chip mode and utilizing the internal voltage regulator. this con?uration is the recommended implementation for the mc9s12ne64. the schematic provides a reference for the following mc9s12ne64 design items.  operation mode  clocks  power  ethernet, high-speed lan magnetics isolation module, and rj45 ethernet connector  ephy status indicators  background debug connector (j1) to con?ure the mc9s12ne64 in normal single-chip mode, the modc, modb, and moda pins should be con?ured as documented in the device overview chapter of this book.

 3.3v r9 220 pl1/lnkled y1 25 mhz led5 col_led r11 2.2k r3 49.9 c6 0.22 r5 rbias c5 0.22 led3 dup_led j1 background debug 1 3 5 2 4 6 1 3 5 2 4 6 u1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 29 mii_txer/kwh6/ph6 mii_txen/kwh5/ph5 mii_txclk/kwh4/ph4 mii_txd3/kwh3/ph3 mii_txd2/kwh2/ph2 mii_txd1/kwh1/ph1 mii_txd0/kwh0/ph0 mii_mdc/kwj0/pj0 mii_mdio/kwj1/pj1 vddx1 vssx1 mii_crs/kwj2/pj2 mii_col/kwj3/pj3 mii_rxd0/kwg0/pg0 mii_rxd1/kwg1/pg1 mii_rxd2/kwg2/pg2 mii_rxd3/kwg3/pg3 mii_rxclk/kwg4/pg4 mii_rxdv/kwg5/pg5 mii_rxer/kwg6/pg6 sci0_ rxd/ ps0 sci0_ txd/ ps1 sci1_ rxd/ ps2 sci1_ txd/ ps3 spi_ miso/ ps4 spi_ mosi/ ps5 spi_ sck/ ps6 spi_ss/ ps7 vssx2 vddx2 reset vddpll xfc vsspll extal xtal test irq/ pe1 xirq/ pe0 bkgd/modc pl4/colled pl3/dupled vss2 vdd2 phy_rbias phy_vssa phy_vdda phy_vddtx phy_txp phy_txn phy_vsstx phy_rxp phy_rxn phy_vddrx phy_vssrx pl2/spdled vddr pl1/lnkled pl0/actled pad0/ an0 pad1/ an1 pad2/ an2 pad3/ an3 pad4/ an4 pad5/ an5 pad6/ an6 pad7/ an7 vdda vrh vrl vssa vss1 vdd1 pt7/ tim_ ioc7 pt6/ tim_ ioc6 pt5/ tim_ ioc5 pt4/ tim_ ioc4 pj7/ kwj7/ iic_ scl pj6/ kwj6/ iic_sda eclk/pe4 pl0/actled c4 0.22 r10 10m pl0/actled c11 4700 pf r2 49.9 3.3v rj-4 5 c10 470 pf 3.3v led2 spd_led led1 lnk_led r1 49.9 *reset c7 0.22 *reset pl2/spdled r13 10k 3.3v c1 0.22 3.3v mc9s12ne64 led4 act_led r7 220 c2 0.01 c3 0.22 3.3v 3.3v pl3/dupled c9 15 pf pl4/colled optional status led's pl1/lnkled 75 ohms 75 ohms 1000 pf 2kv cable side mcu side t1 transformer / rj-45 connector 1 2 3 4 5 6 7 3 2 5 4 1 8 8 6 t+ ct t- r+ ct r- j7 j3 j2 j5 j4 j1 . j8 j6 3.3v pl2/spdled c8 15 pf r14 10k r8 220 r6 220 earth/chassis pl3/dupled pl4/colled r12 220 r4 49.9 3.3v r9 220 pl1/lnkled y1 25 mhz led5 col_led r11 2.2k r3 49.9 c6 0.22 r5 rbias c5 0.22 led3 dup_led j1 background debug 1 3 5 2 4 6 1 3 5 2 4 6 u1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 3.3v r9 220 pl1/lnkled y1 25 mhz led5 col_led r11 2.2k r3 49.9 c6 0.22 r5 rbias c5 0.22 led3 dup_led j1 background debug 1 3 5 2 4 6 1 3 5 2 4 6 u1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 29 mii_txer/kwh6/ph6 mii_txen/kwh5/ph5 mii_txclk/kwh4/ph4 mii_txd3/kwh3/ph3 mii_txd2/kwh2/ph2 mii_txd1/kwh1/ph1 mii_txd0/kwh0/ph0 mii_mdc/kwj0/pj0 mii_mdio/kwj1/pj1 vddx1 vssx1 mii_crs/kwj2/pj2 mii_col/kwj3/pj3 mii_rxd0/kwg0/pg0 mii_rxd1/kwg1/pg1 mii_rxd2/kwg2/pg2 mii_rxd3/kwg3/pg3 mii_rxclk/kwg4/pg4 mii_rxdv/kwg5/pg5 mii_rxer/kwg6/pg6 sci0_ rxd/ ps0 sci0_ txd/ ps1 sci1_ rxd/ ps2 sci1_ txd/ ps3 spi_ miso/ ps4 spi_ mosi/ ps5 spi_ sck/ ps6 spi_ss/ ps7 vssx2 vddx2 reset vddpll xfc vsspll extal xtal test irq/ pe1 xirq/ pe0 bkgd/modc pl4/colled pl3/dupled vss2 vdd2 phy_rbias phy_vssa phy_vdda phy_vddtx phy_txp phy_txn phy_vsstx phy_rxp phy_rxn phy_vddrx phy_vssrx pl2/spdled vddr pl1/lnkled pl0/actled pad0/ an0 pad1/ an1 pad2/ an2 pad3/ an3 pad4/ an4 pad5/ an5 pad6/ an6 pad7/ an7 vdda vrh vrl vssa 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 29 mii_txer/kwh6/ph6 mii_txen/kwh5/ph5 mii_txclk/kwh4/ph4 mii_txd3/kwh3/ph3 mii_txd2/kwh2/ph2 mii_txd1/kwh1/ph1 mii_txd0/kwh0/ph0 mii_mdc/kwj0/pj0 mii_mdio/kwj1/pj1 vddx1 vssx1 mii_crs/kwj2/pj2 mii_col/kwj3/pj3 mii_rxd0/kwg0/pg0 mii_rxd1/kwg1/pg1 mii_rxd2/kwg2/pg2 mii_rxd3/kwg3/pg3 mii_rxclk/kwg4/pg4 mii_rxdv/kwg5/pg5 mii_rxer/kwg6/pg6 sci0_ rxd/ ps0 sci0_ txd/ ps1 sci1_ rxd/ ps2 sci1_ txd/ ps3 spi_ miso/ ps4 spi_ mosi/ ps5 spi_ sck/ ps6 spi_ss/ ps7 vssx2 vddx2 reset vddpll xfc vsspll extal xtal test irq/ pe1 xirq/ pe0 bkgd/modc pl4/colled pl3/dupled vss2 vdd2 phy_rbias phy_vssa phy_vdda phy_vddtx phy_txp phy_txn phy_vsstx phy_rxp phy_rxn phy_vddrx phy_vssrx pl2/spdled vddr pl1/lnkled pl0/actled pad0/ an0 pad1/ an1 pad2/ an2 pad3/ an3 pad4/ an4 pad5/ an5 pad6/ an6 pad7/ an7 vdda vrh vrl vssa vss1 vdd1 pt7/ tim_ ioc7 pt6/ tim_ ioc6 pt5/ tim_ ioc5 pt4/ tim_ ioc4 pj7/ kwj7/ iic_ scl pj6/ kwj6/ iic_sda eclk/pe4 pl0/actled c4 0.22 r10 10m pl0/actled c11 4700 pf r2 49.9 3.3v rj-4 5 c10 470 pf vss1 vdd1 pt7/ tim_ ioc7 pt6/ tim_ ioc6 pt5/ tim_ ioc5 pt4/ tim_ ioc4 pj7/ kwj7/ iic_ scl pj6/ kwj6/ iic_sda eclk/pe4 pl0/actled c4 0.22 r10 10m pl0/actled c11 4700 pf r2 49.9 3.3v rj-4 5 c10 470 pf 3.3v led2 spd_led led1 lnk_led r1 49.9 *reset c7 0.22 *reset pl2/spdled r13 10k 3.3v c1 0.22 3.3v mc9s12ne64 led4 act_led r7 220 c2 0.01 c3 0.22 3.3v led2 spd_led led1 lnk_led r1 49.9 *reset c7 0.22 *reset pl2/spdled r13 10k 3.3v c1 0.22 3.3v mc9s12ne64 led4 act_led r7 220 c2 0.01 c3 0.22 3.3v 3.3v pl3/dupled c9 15 pf pl4/colled optional status led's pl1/lnkled 75 ohms 75 ohms 1000 pf 2kv cable side mcu side 3.3v 3.3v pl3/dupled c9 15 pf pl4/colled optional status led's pl1/lnkled 75 ohms 75 ohms 1000 pf 2kv cable side mcu side t1 transformer / rj-45 connector 1 2 3 4 5 6 7 3 2 5 4 1 8 8 6 t+ ct t- r+ ct r- j7 j3 j2 j5 j4 j1 . j8 j6 3.3v pl2/spdled c8 15 pf r14 10k r8 220 r6 220 earth/chassis pl3/dupled pl4/colled r12 220 r4 49.9

 introduction mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 545 b.1.2 power supply notes a 3.3-v power supply is required. this power supply shall be compatible with table a-7. supply current characteristics . b.1.3 clocking notes for basic operation of the mc9s12ne64, a 25-mhz crystal is required to provide the clock input to the integrated phy. the crystal must connect to the mc9s12ne64 in a pierce con?uration by the xtal and extal pins as shown in figure b-1. in addition to providing a 25-mhz crystal input, to operate at 100 mbps, the internal bus clock must be con?ured as shown in the ephy electrical characteristics. b.1.4 ephy notes figure b-2 provides a close-up view of the ephy pin connections to a high-speed lan magnetics isolation module and rj45 ethernet connector. figure b-2. ethernet interface circuitry b.1.5 ephy led indicator notes the ephy can be con?uring by software to drive indicator pins (ptl[5:0]) automatically by setting the leden bit of the ephy ephyctl0 register. when leden = 1, ptl[5:0] pins are dedicated to the ephy.

 appendix b schematic and pcb layout design recommendations mc9s12ne64 data sheet, rev. 1.1 546 freescale semiconductor b.2 pcb design recommendation the section provides recommendations for general hcs12 pcb design and recommendations for pcb design with ethernet. b.2.1 general pcb design recommendations the pcb layout must be designed to ensure proper operation of the voltage regulator and the mcu. the following recommendations are provided to ensure a robust pcb design:  every supply pair must be decoupled by a ceramic capacitor connected as near as possible to the corresponding pins (c1 - c6).  central point of the ground star should be the vssx pin.  use low ohmic low inductance connections between vss1, vss2 and vssx.  vsspll must be directly connected to vssx.  keep traces of vsspll, extal and xtal as short as possible and occupied board area for c7,c8, c11 and q1 as small as possible.  do not place other signals or supplies underneath area occupied by c7, c8, c10 and q1 and the connection area to the mcu.  central power input should be fed in at the vdda/vssa pins. b.2.2 ethernet pcb design recommendations when designing a pcb that uses the mc9s12ne64 ethernet module, several design considerations must be made to ensure that ethernet operation conforms to the ieee 802.3 physical interface speci?ation. these ethernet pcb design recommendations include:  the distance between the magnetic module and the rj-45 jack is the most critical and must always be as short as possible (less than one inch).  never use 90   traces. use 45   angles or radius curves in traces.  trace widths of 0.010?are recommended. wider is better. trace widths should not vary.  route differential tx and rx pairs near together (max 0.010?separation with 0.010?traces).  trace lengths must always be as short as possible (must be less than one inch).  make trace lengths as equal as possible.  keep tx and rx differential pairs routes separated (at least 0.020 separation). better to separate with a ground plane.  avoid routing tx and rx traces over or under a plane. areas under the tx and rx traces should be open.  use precision components in the line termination circuitry with 1% tolerance.  ensure that the power supply is rated for a load of 300 ma minimum.  avoid vias and layer changes.

 pcb design recommendation mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 547  all termination resistors should be near to the driving source. the mcu is the driving source for phy_txp and phy_txn pins. the high-speed lan magnetics isolation module is the driving source for phy_rxp and phy_rxn pins.  4-layer pcbs recommended to provide better heat dissipation b.2.2.1 high-speed lan magnetics isolation module requirements the mc9s12ne64 requires a 1:1 ratio for the high-speed lan magnetics isolation module for both the receive and the transmit signals. because the mc9s12ne64 does not implement auto-mdix, an auto-mdix capable high-speed lan magnetics isolation module is not required. a high-speed lan magnetics isolation module with improved return loss characteristics is recommended to avoid ethernet return loss issues. b.2.2.2 80-pin package exposed flag the 80-pin tqfp-ep package has an exposed ?g for heat dissipation and requires special pcb layout to accommodate the ?g. there are two ways to accommodate the ?g:  have a hatched pattern in the solder mask  use small copper areas under the ?g the requirement is to have about 50% of the ?g soldered to the pc board.

 appendix b schematic and pcb layout design recommendations mc9s12ne64 data sheet, rev. 1.1 548 freescale semiconductor

 112-pin lqfp package mc9s12ne64 data sheet, rev. 1.1 freescale semiconductor 549 appendix c package information c.1 112-pin lqfp package figure c-1. 112-pin lqfp mechanical drawing (case no. 987-01) dim a min max 20.000 bsc millimeters a1 10.000 bsc b 20.000 bsc b1 10.000 bsc c --- 1.600 c1 0.050 0.150 c2 1.350 1.450 d 0.270 0.370 e 0.450 0.750 f 0.270 0.330 g 0.650 bsc j 0.090 0.170 k 0.500 ref p 0.325 bsc r1 0.100 0.200 r2 0.100 0.200 s 22.000 bsc s1 11.000 bsc v 22.000 bsc v1 11.000 bsc y 0.250 ref z 1.000 ref aa 0.090 0.160     11  11  13  7  13  view y l-m 0.20 n t 4x 4x 28 tips pin 1 ident 1 112 85 84 28 57 29 56 b v v1 b1 a1 s1 a s view ab 0.10 3 c c2  2  0.050 seating plane gage plane 1   view ab c1 (z) (y) e (k) r2 r1 0.25 j1 view y j1 p g 108x 4x section j1-j1 base rotated 90   counterclockwise  metal j aa f d l-m m 0.13 n t 1 2 3 c l l-m 0.20 n t l n m t t 112x x x=l, m or n r r notes: 1. dimensioning and tolerancing per asme y14.5m, 1994. 2. dimensions in millimeters. 3. datums l, m and n to be determined at seating plane, datum t. 4. dimensions s and v to be determined at seating plane, datum t. 5. dimensions a and b do not include mold protrusion. allowable protrusion is 0.25 per side. dimensions a and b include mold mismatch. 6. dimension d does not include dambar protrusion. allowable dambar protrusion shall not cause the d dimension to exceed 0.46. 8  3  0 









 how to reach us: home page: www.freescale.com usa/europe or locations not listed: freescale semiconductor technical information center, ch370 1300 n. alma school road chandler, arizona 85224 1-800-521-6274 or 480-768-2130 europe, middle east, and africa: +44 1296 380 456 (english) +46 8 52200080 (english) +49 89 92103 559 (german) +33 1 69 35 48 48 (french) japan: freescale semiconductor japan ltd. technical information center 3-20-1, minami-azabu, minato-ku tokyo 106-0047, japan 0120-191014 or +81-3-3440-3569 asia/paci?: freescale semiconductor hong kong ltd. technical information center 2 dai king street tai po industrial estate tai po, n.t., hong kong 852-26668334 for literature requests only: freescale semiconductor literature distribution center p.o. box 5405 denver, colorado 80217 1-800-441-2447 or 303-675-2140 fax: 303-675-2150 freescale and the freescale logo are trademarks of freescale semiconductor, inc. all other product or service names are the property of their respective owners. the arm powered logo is a registered trademark of arm limited. arm7tdmi-s is a trademark of arm limited. java and all other java-based marks are trademarks or registered trademarks of sun microsystems, inc. in the u.s. and other countries. the bluetooth trademarks are owned by their proprietor and used by freescale semiconductor, inc. under license. ?freescale semiconductor, inc. 2005. all rights reserved. mc9s12ne64v1 rev. 1.1 06/2006 information in this document is provided solely to enable system and software implementers to use freescale semiconductor products. there are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. freescale semiconductor reserves the right to make changes without further notice to any products herein. freescale semiconductor makes no warranty, representation or guarantee regarding the suitability of its products for any particular purpose, nor does freescale semiconductor assume any liability arising out of the application or use of any product or circuit, and speci?ally disclaims any and all liability, including without limitation consequential or incidental damages. typical parameters that may be provided in freescale semiconductor data sheets and/or speci?ations can and do vary in different applications and actual performance may vary over time. all operating parameters, including ?ypicals? must be validated for each customer application by customers technical experts. freescale semiconductor does not convey any license under its patent rights nor the rights of others. freescale semiconductor products are not designed, intended, or authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other application in which the failure of the freescale semiconductor product could create a situation where personal injury or death may occur. should buyer purchase or use freescale semiconductor products for any such unintended or unauthorized application, buyer shall indemnify and hold freescale semiconductor and its of?ers, employees, subsidiaries, af?iates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that freescale semiconductor was negligent regarding the design or manufacture of the part.

▲Up To Search▲   

All Rights Reserved © IC-ON-LINE 2003 - 2022