Field Software Updates Using TPMS LF An example using the Low Frequency radio (LFR) for wireless software updating

Transcription

1 Freescale Semiconductor Document Number: AN5149 Application Note Rev. 1.0, 8/2015 Field Software Updates Using TPMS LF An example using the Low Frequency radio (LFR) for wireless software updating 1 Introduction This application note describes a procedure to perform over-the-air (OTA), customer applied, software updates for the Freescale FXTH87 family of Tire Pressure Monitor sensors. These updates are performed in the field using the Low Frequency receiver (LFR) and Radio Frequency transmitter as the communication interface. This is accomplished by including a bootloader residing in memory that, when properly addressed, loads the bootloader into flash memory and starts to read the incoming program. As a confirmation the program was successfully received, the bootloader will attempt to send a checksum result to the sender via the RF radio, when it sees the equivalent of a done command. The following is a list of software features: TPMS software updateable in the field. Programmable flash memory during board manufacturing, without a BDM pod. Bootloader software resides in protected flash memory. Power consumption during software update is minimized. Bootloader software has no influence on the application software. Contents 1 Introduction Applicable Parts Overview TPMS Bootloader Recommendations Hardware Configurations TPMS Bootloader Software Architecture and State Transitions Bootloader High Level Software Flow Bootloader Software Main Task Bootloader Transition Modes TPMS Bootloader Communication Protocol Details LFR message format RF message format Command protocol Communication Examples Erase flash example Program flash example Read TPMS memory example Quit TPMS bootloader mode example Memory Map on TPMS TPMS LF Bootloader Code Example References

2 Applicable Parts The next several sections describe the application software architecture, the bootloader software flow and the bootloader main application task. The memory map as it relates to the demo source code is provided, and the bootloader state transition modes and flow are also presented. Also described in this document are the hardware and configuration, the bootloader architecture and state transitions, the memory map and TPMS bootloader communication protocol details, with LF/RF communication examples. Finally, bootloader code snippets are included as a reference of how a user would typically perform the bootloader feature. A similar procedure can also be used for initial flash programming using the LF interface during the board manufacturing process, thereby eliminating the need of using a Background Debug Mode (BDM) pod. 2 Applicable Parts This document applies to the following Freescale sensors. Device Description Pressure Ranges FXTH T1 FXTH870511DT1 FXTH T1 FXTH870502DT1 FXTH T1 FXTH870912DT1 FXTH T1 FXTH T1 FXTH870911DT1 FXTH870902DT1 FXTH T1 FXTH T1 FXTH T1 FXTH871511DT1 FXTH871502DT1 FXTH T1 FXTH T1 High Pressure Tire Pressure Monitor sensor family supporting cars, light trucks for TPMS markets. High Pressure Tire Pressure Monitor sensor family supporting cars, light trucks for TPMS markets. High Pressure Tire Pressure Monitor sensor family supporting medium and heavy duty trucks, buses and construction vehicles for TPMS markets kpa kpa kpa 3 Overview Tire Pressure Monitor Sensors (TPMS) come from Freescale preloaded with a complete set of firmware library functions and test software necessary for a variety of customer use cases. The total flash memory map in the TMPS consists of 16 KB, of which only 8 KB is available for user application space. The software is located in the upper area of memory, in a protected 8 KB of flash from addresses 0xE040 through 0xFFFF. On power up, the firmware initializes the device and redirects all vectors to the user area, an 8 KB flash memory located from addresses 0xC000 through 0xDFBF. 2 Field Software Updates Using TPMS LF, 1.0, 8/2015

3 Overview Traditionally, the user s application software is loaded into your 8 KB flash area one time during manufacturing of the TPMS device. In the event that a tire is changed, and a new aftermarket TMPS is installed, the TPMS must be reprogrammed. A TPMS programming tool with preloaded software is used, via the LFR. An LF bootloader residing in user flash memory enables the usage of the same TPMS programming tool to perform software field updates, if changes in the user s application software become necessary. The same procedure can be used in a production environment, eliminating the need for a BDM pod and other tooling necessary for use with a BDM programmer. In this case, both user software and updates can be loaded into the device. For more information, refer to the TPMS data sheets listed in the References section. 3.1 TPMS Bootloader Recommendations The bootloader implementation is intended to limit the size of the code, as well as limit the power required to perform software updates in the field. The code size is critical since the bootloader program resides in user flash memory. In case an update failure occurs, using the bootloader is recommended for software updates in the field so that double the application space is available. In such a case, the device can be reset and resume normal operation using the previous resident software version. Power consumption is minimized during the update process to extend the battery life. In addition, the following software practices are employed: Bootloader software must reside in properly protected user flash area. Bootloader software has no influence on the user application software. 3.2 Hardware Configurations The hardware, in combination with the example software, uses currently available Freescale reference design hardware. The TPMS reference board is shown in Figure 1. Figure 1. TPMS evaluation board Field Software Updates Using TPMS LF, 1.0, 8/2015 3

4 TPMS Bootloader Software Architecture and State Transitions The TPMS programming tool, see Figure 2, uses the OTA communication methodology for both the LF download and RF Feedback cycles. The TPMS programming tool is used to download the updated user program from the tool to the mounted TPMS sensor. When the application runs, the programming tool sends the updated application code to the TPMS via the LFR at a frequency of 125 khz. Once the TPMS receives valid commands, it starts executing operations and sends the status updates to the Programming tool via the RF radio at either 315 MHz or 434 MHz. Figure 2. TPMS87xx mounted in a tire and external TPMS programming tool 4 TPMS Bootloader Software Architecture and State Transitions 4.1 Bootloader High Level Software Flow Figure 3 shows the flow for the Bootloader software. The user s application software architecture can be similar to this structure. From power-on reset (POR) or wakeup from STOP1, there is a standard system initialization, followed by one of the system wakeup interrupts (LFR, Periodic Wakeup (PWU) timer, RF or other sources). The bootloader mode is triggered by an LFR message from STOP1 mode. 4 Field Software Updates Using TPMS LF, 1.0, 8/2015

5 TPMS Bootloader Software Architecture and State Transitions Figure 3. High-level bootloader software flow Depending on the application software state when an LFR packet is received, the message is compared to the bootloader entry keyword. In this context, the bootloader entry keyword (user configurable) is defined in the bootloader_user_cfg.h, example code summary listing in Section 5 and shown in Figure 9, which defines the keyword as 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A for this example. If the keyword is a match, the device enters the bootloader mode, otherwise normal application flow is continued. The other path of the application is currently in bootloader mode and continues in this mode until an exit event occurs. Field Software Updates Using TPMS LF, 1.0, 8/2015 5

6 TPMS Bootloader Software Architecture and State Transitions 4.2 Bootloader Software Main Task There are three wakeup sources in the Bootloader main task. LFR Periodic Wakeup Timer (PWU) RF Figure 4 shows the main bootloader software task process flow. Once a timeout condition is encountered, depending on the source of the wakeup, the bootloader mode operation continues until either STOP4 (bootloader RUN mode) or STOP1 (bootloader WAIT mode) is set. Figure 4. Bootloader software main task 6 Field Software Updates Using TPMS LF, 1.0, 8/2015

7 TPMS Bootloader Software Architecture and State Transitions 4.3 Bootloader Transition Modes The Bootloader employs several modes of operation as shown Figure 5 and described in Table 1. Application Mode (gu8bootappsel == MODE_SEL_APP) is one of the bootloader transition modes of operation. See Table 1. Bootloader Mode (gu8bootappsel == MODE_SEL_BOOT). There are four other Bootloader transition modes (state definitions); these are ENTRY, RUN, WAIT and QUIT. Figure 5. Bootloader transition flow Table 1. Bootloader modes Bootloader Mode Application Mode Functions or Characteristics User application code running LF wakeup occurs, 16-bit public ID; configurable, same for all sensors From power-on reset, software checks user application flash checksum for a preset value match. If yes, the application software is entered, otherwise the Bootloader WAIT mode is entered. The checksum validates that the program flash is successful. If an LF wakeup occurs and the received message matches the bootloader MODE_SEL_BOOT keyword, bootloader mode is entered as described next. Field Software Updates Using TPMS LF, 1.0, 8/2015 7

8 TPMS Bootloader Software Architecture and State Transitions Bootloader Mode Bootloader ENTRY mode Bootloader RUN mode Bootloader WAIT mode Bootloader QUIT mode Functions or Characteristics TPMS sends a user defined, and configurable RF message 30 times with 32-bit sensor ID at specified interval (default = 1 second). TPMS LF wakeup ID changed to sensor ID2 and ID3 TPMS waits to receive LF message with correct wakeup ID (sensor ID2 and ID3); once command with correct ID and format is received, the TPMS enters Bootloader RUN mode. If a timeout occurs during the user-defined message interval, without a correct LF command received, the TPMS enters Bootloader QUIT mode. TPMS waits to receive LF message, enters STOP4 mode LF module is in continuous ON state, LF Wakeup 16-bit ID is Sensor ID2 and ID3. Flash Erase and programming are completed in this mode. TPMS waits for LF bootloader entry keyword. The LF module is set at certain duty cycle, to save power and LF Wakeup 16-bit public ID. Once correct entry keyword is received, the code enters Bootloader ENTRY mode. The Periodic Wakeup Timer (PWU) is running in this mode. The wakeup interval is configurable in the user Config header file. Clears the PDF flag in the SPMSC2 register and calls the TPMS_RESET function part of the Freescale firmware. This has the equivalent effect of a power-on reset. The MCU will then run software to initialize the MCU like a POR occurred. 4.4 TPMS Bootloader Communication Protocol Details This section describes the process the bootloader follows to implement to update the user flash. The procedure uses both the LF (125 khz) and the RF (either 315 MHz or 434 MHz) radios of the TPMS to complete the software update cycle. Since the sequence is initiated through the LFR, a successful user software update includes initiating the bootloader with the start command, reading and storing the incoming data stream, re-flashing the user code and finally sending a success confirmation back to the sender through the RF transmitter. The following steps provide a software flow to follow for a successful code update: 1. LFR receives the bootloader entry key using a public, 16-bit LF ID from the Programming tool. TPMS enters boot entry mode and proceeds to send the sensor ID via the RF radio at 1 second intervals. 2. The tool sends the bootloader entry key to the LFR using sensor ID2 (8-bit) and ID3 (8-bit), as 16- bit LF ID. The TPMS enters boot run mode and transmits the state feedback message once. 3. The tool sends the erase all command to the LFR using sensor ID2 and ID3, as 16-bit LF ID. TPMS transmits the state feedback erase all was successful message. 4. The tool sends the flash program command and 48 byte data chunks to the LFR using sensor ID2 and ID3, as 16-bit LF ID. The TPMS transmits the state feedback flash program was successful message. 5. The tool repeats sending the flash program command and data until the complete user code download is successful. The TPMS transmits the state feedback flash program successful message for each flash program command. 8 Field Software Updates Using TPMS LF, 1.0, 8/2015

9 TPMS Bootloader Software Architecture and State Transitions 6. The tool sends the boot quit command to the LFR using sensor ID2 and ID3, as 16-bit LF ID. TPMS transmits the state feedback quit bootloader mode OK message and clears the flag to simulate a power-on reset. 7. TPMS initializes as if it starts from a power-on reset, verifies user flash checksum is correct and enters APP mode LFR message format This section describes the LFR message format from the Programming tool to the TPMS. Refer to Figure 6. Figure 6. LFR message format (host tool to TPMS) Field Software Updates Using TPMS LF, 1.0, 8/2015 9

10 TPMS Bootloader Software Architecture and State Transitions Byte 1 value is n (length of message body including Byte 1 itself, but not including the checksum). Byte (n+1) is the XOR checksum of message body from Byte1 to Byte n. In Bootloader Mode, the LF ID is the low 16 bit Sensor ID; LF IDH = Sensor ID2, LF IDL = Sensor ID3). In Application Mode, the LF ID is 16-bit fixed ID and configurable through the user Config header file. Table 2. Typical commands as listed in the example code snippet Program Mode Reference Command Enter Bootloader mode See page 18 cmd: 0x18 Erase All User flash See page 25 cmd: 0x12 Program flash See page 25 cmd: 0x13 Read Memory See page 26 cmd: 0x14 Quit Bootloader mode See page 26 cmd: 0x16 10 Field Software Updates Using TPMS LF, 1.0, 8/2015

11 TPMS Bootloader Software Architecture and State Transitions RF message format This section describes the RF message format from the TPMS to the Host tool is shown in Figure 7. Byte 1 value is n (length of message body including Byte 1 itself, not including checksum) Byte (n+1) is the XOR checksum of message body from Byte 1 to Byte n Sync word is configurable in user Config header file Figure 7. RF message format (TPMS to host tool) Field Software Updates Using TPMS LF, 1.0, 8/

12 TPMS Bootloader Software Architecture and State Transitions Table 3. Command state modes Program Mode Enter Bootloader mode Erase All User flash Program flash Read Memory Quit Bootloader mode Command cmd: 0x58 for OK cmd: 0x98 for Error cmd: 0x52 for OK cmd: 0x92 for Error cmd: 0x53 for OK cmd: 0x93 for Error cmd: 0x54 for OK cmd: 0x94 for Error cmd: 0x56 for OK cmd: 0x96 for Error Command protocol Figure 8 shows the communication protocol details for a complete LF/RF transmission cycle. The LFR receives the Enter Bootloader mode command, 0x18, as shown in the Cmd field in the LF Download Message. The TPMS sends the RF Feedback Message to the tool as shown in the lower portion of Figure 8. The protocol uses the embedded firmware function call, TPMS_CHECKSUM_XOR, to calculate the received message checksum, shown as CRC in Figure 8 through Figure 12. For more information on embedded firmware, refer to the embedded firmware user guides listed in the References section. Figure 8. LF command protocol Enter bootloader mode 12 Field Software Updates Using TPMS LF, 1.0, 8/2015

13 TPMS Bootloader Software Architecture and State Transitions 4.5 Communication Examples This section describes communication examples using the demo bootloader coding example provided in Section 4.6. The examples are typical use cases a user may want to be familiar with Erase flash example Figure 9 shows the communication protocol details for a complete LF/RF transmission cycle. The LFR receives the bootloader Erase All 6 KB user flash command, 0x12, as shown in the Cmd field in the LF Download Message. The TPMS sends the RF Feedback Message to the tool as shown in the lower portion of the figure. Figure 9. LF command protocol Erase all 6 KB user flash Field Software Updates Using TPMS LF, 1.0, 8/

14 TPMS Bootloader Software Architecture and State Transitions Program flash example Figure 10 shows the communication protocol details for a complete LF/RF transmission cycle. The LFR receives the bootloader Flash Program command, 0x13, as shown in the Cmd field in the LF Command Message. The TPMS sends the RF Feedback Message to the tool as shown in the lower portion of the figure. Figure 10. LF communication protocol Flash Program 48 byte data to user flash Read TPMS memory example Figure 11 shows the communication protocol details for a complete LF/RF transmission cycle. The LFR receives the bootloader Memory Read address command, 0x14, as shown in the Cmd field in the LF Command Message. The Address field specifies the starting address of the memory location followed by the number of bytes to read from that memory location. The TPMS sends the RF Feedback Message to the tool as shown in the lower portion of the figure. 14 Field Software Updates Using TPMS LF, 1.0, 8/2015

15 TPMS Bootloader Software Architecture and State Transitions Figure 11. LF/RF communication protocol Memory Read TPMS memory location Quit TPMS bootloader mode example Figure 12 shows the communication protocol details for a complete LF/RF transmission cycle. The LFR receives the Quit Bootloader command, 0x16, as shown in the Cmd field in the LF Command Message. The TPMS sends the RF Feedback Message to the tool as shown in the lower portion of the figure. Figure 12. LF/RF communication protocol Quit bootloader mode Field Software Updates Using TPMS LF, 1.0, 8/

16 TPMS LF Bootloader Code Example 4.6 Memory Map on TPMS The TPMS LF Bootloader Code Example provided in Section 5 uses the memory map details shown in Table 4. Table 4. TPMS memory map Region Memory Address Size Bootloader Standby RAM 0x008A~0x008F 6 bytes User Standby RAM 0x0050~0x bytes Bootloader Occupied RAM Variable 22 bytes User RAM Variable 490 bytes User App Code Checksum 0xC000~0xC001 1 byte User App Code Region 0xC000~0xD7FF 6 KB Bootloader Region 0xD800~0xDFFF 2 KB Firmware Region 0xE000~0xFFFF 8 KB There is 6 KB of flash memory for user application code and 2 KB flash for the bootloader. The protected, upper area 8 KB of flash is where Freescale s firmware is located. 5 TPMS LF Bootloader Code Example This section of the document presents example code for the TPMS LF bootloader. The code can be used in conjunction with the FXTH87 family of Starter Projects and with the TPMS Reference board, which is orderable through a Freescale sales representative. The following two bootloader variables may be used in application software if LF command reception is needed in application software: gu8lfrxcnt; (the number of bytes received via LF module) gu8lfrxbuf[]; (the data array received via LF module) Three code examples are presented in this section. Main_bootloader.c Bootloader.h Bootloader_user_cfg.h 16 Field Software Updates Using TPMS LF, 1.0, 8/2015

17 TPMS LF Bootloader Code Example Main_bootloader.c Example Code Summary /* **************************************************************************** * * Main.c - Code will reside in here. * **************************************************************************** */ #include <hidef.h> /* for EnableInterrupts macro */ #include "derivative.h" /* include peripheral declarations */ #include "FXTH87XX_main.h" /* reference to all Firmware calls */ #include "main_bootloader.h" Memory Map flash: 0xC000~0xD7FF = 6K user flash; (including 0xD7C0~0xD7FF redirected vectors, and 0xC000~0xC001 checksum) 0xD800~0xDFFF = 2K bootloader code; (including 0xDFC0~0xDFFF user vectors) 0xE000~0xFFFF = 8K firmware; Memory Map RAM: 0x0050~0x0089 = 58 byte battery backed RAM 0x008A~0x008F = 6 byte battery backed RAM for bootloader and firmware. 0x0090~0x028F = 512 byte volatile RAM **************************************************************************** / #pragma CONST_SEG CRC_DATAUINT16 const gu32userflashchksumbegin = USER_FLASH_CHKSUM_BEGIN; UINT16 const gu32userflashchksumend = USER_FLASH_CHKSUM_END; #pragma CONST_SEG DEFAULT #pragma DATA_SEG FIRMWARE_GLOBAL_RAM UINT8 0x008Fu; /* Embedded Firmware maps this location */ /* Flag BIT MASK Trigger condition LVD Interrupt 7 0x80 LVD interrupt entered. PWU Interrupt 6 0x40 PWU interrupt entered. TOF Interrupt 5 0x20 TOF interrupt entered. LFR Error Interrupt 4 0x10 LFR interrupt entered and LFERF bit of the LFS register is set. ADC Interrupt 3 0x08 ADC interrupt entered. LFR Interrupt 2 0x04 LFR interrupt entered and LFERF bit of the LFS register is clear. RTI Interrupt 1 0x02 RTI interrupt entered. KBI Interrupt 0 0x01 KBI interrupt entered. Field Software Updates Using TPMS LF, 1.0, 8/

18 TPMS LF Bootloader Code Example LVD Interrupt */ /* Globals going into PARAM registers */ #pragma DATA_SEG BOOTLOADER_GLOBAL_RAM This variable is used to indicate whether to enter bootloader mode or application mode. Possible values this variable can be: MODE_SEL_APP - Enter application mode; (app flash is ready) MODE_SEL_BOOT - Enter bootloader mode. UINT8 0x008Du; /************************************************************************** Used to indicate the state of bootloader software, it's used only for bootloader mode. #define BOOT_STATE_ENTRY 0x01 - Entering boot mode, sending out sensor id, waiting for a correct LF cmd with sensor ID; #define BOOT_STATE_WAIT 0x02 - timeout occurred in bootloader entry or run mode, or app flash checksum is not correct when trying to enter app mode. #define BOOT_STATE_RUN 0x03 - bootloader software in run mode, processing LF cmd & data. #define BOOT_STATE_QUIT 0x04 - quit bootloader mode, try to enter app mode. UINT8 0x008Cu; The wakeup source bit is set when corresponding interrupt occurred. Mainly used to indicate RF interrupt occurred. UINT8 0x008Bu; This counter is used to count how many times bootentry mode or bootwait mode are entered. It's used to identify the boot entry timeout or boot wait timeout. UINT8 0x008Au; #pragma DATA_SEG DEFAULT These two global variables are used in application software. gu8lfrxcnt - length of data received via LF; gu8lfrxbuf - buffer to store LF received data. UINT8 gu8lfrxcnt; UINT8 gu8lfrxbuf[lfr_buf_size_app]; #pragma DATA_SEG DEFAULT 18 Field Software Updates Using TPMS LF, 1.0, 8/2015

19 TPMS LF Bootloader Code Example #pragma CONST_SEG BOOTLOADER_CONST This is the entry key to trigger bootloader mode, can be up to 10 bytes long. const UINT8 gu8bootentrykey[bootid_size] = BOOTID_BYTE1, BOOTID_BYTE2, BOOTID_BYTE3, BOOTID_BYTE4, BOOTID_BYTE5, BOOTID_BYTE6, BOOTID_BYTE7, BOOTID_BYTE8, BOOTID_BYTE9, BOOTID_BYTE10 ; #pragma CONST_SEG DEFAULT #pragma DATA_SEG DEFAULT /* sensor ID (in test):0x89 0xC3 0x73 0x4B */ #define ENABLE_DEBUG_BOOT 0 /* **************************************************************************** * * M A I N * **************************************************************************** */ #pragma CODE_SEG BOOTLOADER_CODE void main(void) vfnsetupmcuboot(user_def_spmsc1, USER_DEF_SIMOPT1, USER_DEF_SPMSC2); vfnsetstopmodeboot(stop4); PDF (power down flag) is cleared only for Power-on reset and LVD reset; For PIN/ILOP/ILAD/COP/PWU reset, this PDF flag is unaffected. If PDF is clear before ILOP reset, it remains clear after ILOP reset. So only PDF cannot judge power reset. /********************************************************************** Is the power down flag cleared (MCU did not recover from stop mode) or an illegal OP code occurred clear globals and the TPMS interrupt flag **********************************************************************/ if((spmsc2_pdf == CLEAR) (SRS_ILOP == 1)) gu8timerticksbtldr = 0; Field Software Updates Using TPMS LF, 1.0, 8/

20 TPMS LF Bootloader Code Example gu8wakeupsource = 0; TPMS_INTERRUPT_FLAG = CLEAR; /********************************************************************** if app flash OK, we can enter app mode, otherwise enter bootloader mode **********************************************************************/ vfnmodedetermine(); EnableInterrupts; if(mode_sel_boot!= gu8bootappsel) //if application mode. (User flash checksum is correct.) /********************************************************************** If wakeup from LF receiver, save LF received data into buffer. Check the LF message: if it matches bootloader entry id, enter bootloader mode; otherwise, remain in app mode or bootloader wait mode **********************************************************************/ gu8lfrxcnt = 0; if(tpms_interrupt_flag & BIT2) //if LFR flag set (wakeup from LF) gu8lfrxcnt = TPMS_LF_READ_DATA(gu8LfRxBuf, LFR_BUF_SIZE_APP); //Receive LF data using firmware function. //if received LF data matches the bootloader entry keywords. if((gu8lfrxcnt == (BOOTID_SIZE+5)) && (CLEAR == vfncmpstr(&gu8lfrxbuf[4], &gu8bootentrykey[0], BOOTID_SIZE))) gu8bootappsel = MODE_SEL_BOOT; //select bootloader mode vfnbootentryconfig(); //re-config PWU and LF for bootloader mode. TPMS_INTERRUPT_FLAG = BIT6; //set PWU flag and clear other flags to simulate a PWU wakeup event to sending RF frame else //at this point, FLAG BIT2 (LFR interrupt) was cleared by firmware; //FLAG BIT2 needs to be set 'purposely' so that app software can use this flag bit TPMS_INTERRUPT_FLAG = BIT2; if(mode_sel_app == gu8bootappsel) //if LF data doesn't match the keywords, enter application mode. (*USER_APP_INTERRUPT_TABLE[15])(); //go to user application main function, and should not return. if(mode_sel_boot == gu8bootappsel) //if mode select is bootloader mode. 20 Field Software Updates Using TPMS LF, 1.0, 8/2015

21 TPMS LF Bootloader Code Example vfnflashinit(user_def_fcdiv); //initialize flash timing setting. for(;;) vfnmaintaskbtldr(); //send RF feedback and wait for LF command from host tool if((boot_state_entry == gu8bootstate) (BOOT_STATE_RUN == gu8bootstate)) TPMS_INTERRUPT_FLAG = CLEAR; gu8wakeupsource = CLEAR; vfnsetstopmodeboot(stop4); _Stop; else if(boot_state_quit == gu8bootstate) //if need quit bootloader mode SPMSC2_PPDACK = 1; //clear PDF to simulate a POR TPMS_INTERRUPT_FLAG = CLEAR; gu8wakeupsource = CLEAR; gu8timerticksbtldr = 0; TPMS_RESET(); //reset MCU break; else //if (BOOT_STATE_WAIT == gu8bootstate) break; for(;;) //only in bootloader wait mode may run to here. TPMS_INTERRUPT_FLAG = CLEAR; gu8wakeupsource = CLEAR; vfnsetstopmodeboot(stop1); _Stop; Config PWU and LF module for BootEntry mode: - set PWU to a pre-defined interval with which the sensor ID is sent out via RF. - re-config LF detection as continuous ON, and LF wakeup 16-bit ID as sensor ID2 & ID3. void vfnbootentryconfig(void) gu8bootstate = BOOT_STATE_ENTRY; gu8timerticksbtldr = CLEAR;vfnPwuSet(PWU_WUT_INIT_BOOT_ENTRY); vfnlfrreconfig(lf_boot_run_mode); Field Software Updates Using TPMS LF, 1.0, 8/

22 TPMS LF Bootloader Code Example Determine which mode to enter according to user application code checksum: - If user code area calculated checksum matches the preset value by CodeWarrior compiler, enter application mode; Set corresponding app PWU interval and set LF wakeup ID as 16-bit fixed ID. - Otherwise enter bootloader mode. (bootloader wait mode.) Set corresponding bootloader PWU interval and set LF wakeup ID as 16-bit fixed ID. (bootloader wait mode should also use the 16-bit fixed ID instead of sensor ID2&ID3.) void vfnmodedetermine(void) if(appflashok()) gu8bootappsel = MODE_SEL_APP; vfnpwuinit(pwu_wut_init_app, PWU_PRST_INIT_APP); //enable PWU, disable PRST (periodic reset timer interval) else gu8bootappsel = MODE_SEL_BOOT; gu8bootstate = BOOT_STATE_WAIT; vfnpwuinit(pwu_wut_init_boot_wait, CLEAR); //enable PWU, disable PRST EnableInterrupts; vfnlfrinitconfig(lf_app_mode); This function process the msg received from LFR, including 1)Erase and program flash; 2)Read back the value of specified flash address; 3)Quit bootloader mode;... void vfnmaintaskbtldr(void) UINT8 tmp1 = CLEAR; UINT8 u8lfcnt; UINT8 u8lfbuffer[lfr_buf_size_boot]; if(tpms_interrupt_flag & BIT2) //if wakeup from LFR, process the input message u8lfcnt = TPMS_LF_READ_DATA(u8LfBuffer, LFR_BUF_SIZE_BOOT); tmp1 = vfnprocesslfcmd(u8lfbuffer, u8lfcnt); if(tmp1==0) //if LF cmd was completed correctly if(boot_state_entry == gu8bootstate) //may come from BTLD_ENTRY or BTLD_WAIT 22 Field Software Updates Using TPMS LF, 1.0, 8/2015

23 TPMS LF Bootloader Code Example gu8bootstate = BOOT_STATE_RUN; vfnpwuset(pwu_wut_init_boot_run); else if(boot_state_wait == gu8bootstate) vfnbootentryconfig(); gu8timerticksbtldr = 0 else send_error_cmd_to_host(); //if error, send feedback if(boot_state_quit!= gu8bootstate) vfnsendfeedback(u8lfbuffer, u8lfbuffer[0], 0); vfnsendfeedback(u8lfbuffer, else if(tpms_interrupt_flag & BIT6) //if wakeup from PWU if(boot_state_run == gu8bootstate) if(gu8timerticksbtldr > BOOT_RUN_TIMEOUT_LIMIT) gu8bootstate = BOOT_STATE_QUIT; else if(boot_state_entry == gu8bootstate) //boot wait state or boot entry state if(gu8timerticksbtldr > BOOT_ENTRY_TIMEOUT_LIMIT) gu8bootstate = BOOT_STATE_QUIT; if((boot_state_entry == gu8bootstate) (BOOT_STATE_WAIT == gu8bootstate)) u8lfbuffer[0] = 5; u8lfbuffer[1] = 0x58; u8lfbuffer[2] = gu8timerticksbtldr; u8lfbuffer[3] = *(UINT8 *)(ADDR_NUM_OF_AXIS); u8lfbuffer[4] = gu8bootstate; vfnsendfeedback(u8lfbuffer, u8lfbuffer[0], 0); //feedback command to the host tool for each processed LFR command else if(gu8wakeupsource == RF_INTERRUPT_WAKE_UP) //if wakeup from RF TPMS_RF_ENABLE(CLEAR); //Disable RF Power Field Software Updates Using TPMS LF, 1.0, 8/

24 TPMS LF Bootloader Code Example #if TURN_OFF_LF_DURING_RF_ON TPMS_LF_ENABLE(SET); //enable LFR #endif This function process the message received by LF; validate the format of the message and verify the checksum; send feedback RF message according the process result. pmsgbuf - The message buffer pointer; u8size - The message size to receive, it can be greater than the expected value, function will save the actually received number of bytes into global variable gu8lfrxcnt. LF Message frame format: 16bit ID - u8lfrbuffer[0] [1] [2] [3] [4] [5] [6] [7]... u8lfrbuffer[0] = len, message length not including checksum at the end; u8lfrbuffer[1] = cmd, 0x11, 0x12, 0x13...; u8lfrbuffer[2~3] = 16bit addr, 0x0000~0xFFFF; u8lfrbuffer[4~n] = data bytes to write. u8lfrbuffer[n+1] = checksum, XOR. /* This function will check the cmd first byte value and cmd length. If the value and the length do not match any cmd, then return 1, meaning error cmd. */ UINT8 vfnprocesslfcmd(uint8* pmsgio, UINT8 u8msglen) UINT8 rslt; UINT8 tmp1; if(u8msglen<5) //a message must be at least 5 bytes length (len + cmd + addr + chksum) return 1; tmp1 = pmsgio[0]+1; //Msg[0] is the msg length, including itself, not including 1 byte checksum at the end if((tmp1!= u8msglen) (pmsgio[u8msglen-1]!= TPMS_CHECKSUM_XOR(pMsgIO, u8msglen-1, 0))) return 1; //if checksum and size correct, proceed to next step if(pmsgio[1] == CMD_FLASH_PGM) rslt = vfncmdflashpgmverify(pmsgio); else if(pmsgio[1] == CMD_FLASH_ERASE_ALL) rslt = vfncmdflasheraseall(pmsgio); 24 Field Software Updates Using TPMS LF, 1.0, 8/2015

25 TPMS LF Bootloader Code Example else if(pmsgio[1] == CMD_MEM_READ) rslt = vfncmdmemread(pmsgio); else if(pmsgio[1] == CMD_FLASH_ERASE_BLOCK) rslt = vfncmdflasheraseblock(pmsgio); else if(pmsgio[1] == CMD_QUIT_BOOT) rslt = vfncmdquitboot(pmsgio); else if(pmsgio[1] == CMD_FLASH_PROT) rslt = vfncmdflashprot(pmsgio); else if(pmsgio[1] == CMD_BOOT_ENTRY) rslt = vfncmdbootentry(pmsgio); return rslt; Erase flash Block message format: 0x04(len), 0x11(cmd), 0xC0(addr1), 0x00(addr0), checksum, /* erase specified 512byte flash block, return 0 if erase OK */ UINT8 vfncmdflasheraseblock(uint8* pmsgio) // Your code here Erase flash All message format: 0x04(len), 0x12(cmd), 0xD6(addr1), 0x00(addr0), checksum, Erase begin with the last 512byte user flash from 0xD600~0xD7FF. 0xD600 is required to identify this cmd as an erase all user flash cmd. erase all 6K user flash, total 12 blocks. UINT8 vfncmdflasheraseall(uint8* pmsgio) // Your code here Program flash and verify. flash Program message format: len, 0x13(cmd), 0xC0(addr1), 0x00(addr0), databyte0, databyte1, databyte2,... checksum byte 0 = length of the message; byte 1 = cmd value; byte 2~3 = flash program address; byte 4~n = data chunk. byte n+1 = checksum UINT8 vfncmdflashpgmverify(uint8* pmsgio) // Your code here Field Software Updates Using TPMS LF, 1.0, 8/

26 TPMS LF Bootloader Code Example Memory Read message format: 0x05(len), 0x14(cmd), 0xC0(addr1), 0x00(addr0), 0x01(data, size to read), checksum Corresponding RF uplink message format: length, 0x54(fdbk), 0xC0, 0x00, data chunk..., checksum. UINT8 vfncmdmemread(uint8* pmsgio) // Your code here /* set flash protection FPROT/NVPROT at 0xFFBD */ #define NVPROT_FLASH_ADDR 0xFFBD #define NVPROT_FLASH_VAL 0xD6 //0xD7FF is the end of unprotected flash address UINT8 vfncmdflashprot(uint8* pmsgio) // Your code here This command request to quit bootloader mode. It only changes the variable gu8bootstate. Code in "main" function will call TPMS_RESET to have software run from the beginning. UINT8 CmdQuitBoot(UINT8* pmsgio) // Your code here This command check entry keyword, feedback the sensor ID via RF. 0x18, 0xFF, 0x11, 0x04, ID1, ID2, ID3, ID4, chksum. UINT8 vfncmdbootentry(uint8* pmsgio) // Your code here #pragma CODE_SEG BOOTLOADER_CODE /* **************************************************************************** * End of file. * 26 Field Software Updates Using TPMS LF, 1.0, 8/2015

27 TPMS LF Bootloader Code Example End Code Example Bootloader_header.h Example Code Summary #ifndef MAIN_BOOTLOADER_INCLUDED #define MAIN_BOOTLOADER_INCLUDED /* MAIN_INCLUDED */ * * DEFINES * #include "FXTH87XX_main.h" #pragma DATA_SEG BOOTLOADER_GLOBAL_RAM extern UINT8 0x008Du; extern UINT8 0x008Cu; extern UINT8 0x008Bu; extern UINT8 0x008Au; #pragma DATA_SEG DEFAULT extern UINT8 gu8lfrxcnt; extern UINT8 gu8lfrxbuf[]; extern void(* const USER_APP_INTERRUPT_TABLE[])(void); typedef UINT8 (*CmdFunPtr)(UINT8*); #pragma CONST_SEG BOOTLOADER_CONST extern const UINT8 gu8bootentrykey[]; #pragma CONST_SEG DEFAULT #pragma DATA_SEG DEFAULT //mode selection for bootloader mode or application mode #define MODE_SEL_APP 0x5A #define MODE_SEL_BOOT 0xC3 //bootloader state definitions #define BOOT_STATE_WAIT 0x01 #define BOOT_STATE_ENTRY 0x02 #define BOOT_STATE_RUN 0x03 #define BOOT_STATE_QUIT 0x04 #define CMD_FLASH_ERASE_BLOCK 0x11 #define CMD_FLASH_ERASE_ALL 0x12 #define CMD_FLASH_PGM 0x13 #define CMD_MEM_READ 0x14 Field Software Updates Using TPMS LF, 1.0, 8/

28 TPMS LF Bootloader Code Example #define CMD_FLASH_PROT #define CMD_QUIT_BOOT #define CMD_FLASH_REPGM #define CMD_BOOT_ENTRY #define BL_CMD_1 #define BL_CMD_2 #define BL_CMD_3 #define BL_CMD_4 #define BL_CMD_5 #define BL_CMD_6 #define BL_CMD_7 0x15 0x16 0x17 0x18 CMD_FLASH_ERASE_BLOCK CMD_FLASH_ERASE_ALL CMD_FLASH_PGM CMD_MEM_READ CMD_FLASH_PROT CMD_QUIT_BOOT CMD_FLASH_REPGM /* length of a cmd includes the crc byte at the end */ /* len==0 means its length is variable and depends on 4th byte of the cmd */ #define BL_CMD1_LEN 4 #define BL_CMD2_LEN 4 #define BL_CMD3_LEN 0 #define BL_CMD4_LEN 5 #define BL_CMD5_LEN 4 #define BL_CMD6_LEN 4 #define BL_CMD7_LEN 0 /* value at this address indicates number of axis: 5A 1-axis, 5B 2-axis. */ #define ADDR_NUM_OF_AXIS 0xE0A2 typedef struct btldr_cmd_struct UINT8 cmd_val; CmdFunPtr cmd_fun; btldr_cmd; /* Functions Prototypes */ #pragma CODE_SEG BOOTLOADER_CODE void main(void); void vfnmaintaskbtldr(void); UINT8 vfnprocesslfcmd(uint8* pmsgio, UINT8 u8msglen); UINT8 vfncmdflasheraseblock(uint8* pmsgio); UINT8 vfncmdflasheraseall(uint8* pmsgio); UINT8 vfncmdmemread(uint8* pmsgio); UINT8 vfncmdflashprot(uint8* pmsgio); UINT8 vfncmdquitboot(uint8* pmsgio); UINT8 vfncmdflashpgmverify(uint8* pmsgio); UINT8 vfncmdbootentry(uint8* pmsgio); void vfnbootentryconfig(void); void vfnmodedetermine(void); #pragma CODE_SEG DEFAULT #endif /* MAIN_INCLUDED */ /* 28 Field Software Updates Using TPMS LF, 1.0, 8/2015

29 TPMS LF Bootloader Code Example **************************************************************************** * * End of file. * **************************************************************************** */ End Code Example Bootloader_user_cfg.h Example Code Summary #ifndef BOOTLOADER_USER_CFG_INCLUDED #define BOOTLOADER_USER_CFG_INCLUDED /* MAIN_INCLUDED */ ** * * DEFINES * //0 for 2-axis, 1 for 1-axis //use this line for 2-axis sensor #define SINGLE_AXIS_SENSOR 0 //use this line for 1-axis sensor //#define SINGLE_AXIS_SENSOR 1 /* define 1 if need user app code checksum verification */ #define ENABLE_FLASH_CHKSUM_CALC 1 * Define the user app code begin and end address in the flash: * User flash begins from 0xC000 and ends at 0xD7FF (6K size) or 0xD5FF (5.5K size). (mininum 0.5K erase size, sector) * Checksum value is stored at address 0xC000~0xC001 * Checksum block begin address is stored at address 0xC002~0xC003, end address is stored at 0xC004~0xC0005 * APP code is from 0xC010 to 0xD7FF (or 0xD5FF), and this area is used for Checksum calculation * #define USER_FLASH_BEGIN 0xC000 #define USER_FLASH_END 0xD7FF #define USER_FLASH_CFG_SIZE 0x0010 #define USER_FLASH_SECTOR_SIZE 0x0200 /* Define the flash block begin and end address for checksum calculation */ #define USER_FLASH_CHKSUM_BEGIN (USER_FLASH_BEGIN + USER_FLASH_CFG_SIZE) #define USER_FLASH_CHKSUM_END USER_FLASH_END /* define where to store the preset checksum value by CodeWarrior Compiler */ #define USER_FLASH_CHKSUM_ADDR USER_FLASH_BEGIN Field Software Updates Using TPMS LF, 1.0, 8/

30 TPMS LF Bootloader Code Example The application "main_app" function begin address is stored at end of user flash at 0xD7FE; //#define MAIN_APP_VECT_ADDR (word *)(0xD5FE) #define MAIN_APP_VECT_ADDR (word *)(0xD7FE) #define MAIN_APP_FUNC_ADDR 0xC010 /* define where to store the preset checksum value by CodeWarrior Compiler */ #define APP_FLASH_CHKSUM_ADDR 0xC000 /************************************************************************** because PWU_WUT_INIT_BOOT_RUN is 5, so here 1 means 1x5=5 seconds not received a correct LF cmd in bootloader run mode will be a timeout; and software will enter from bootloader run mode to bootloader wait mode. #define BOOT_RUN_TIMEOUT_LIMIT 1 because PWU_WUT_INIT_BOOT_ENTRY is 1, so here 5 means 5x1=5 seconds not received a correct LF cmd in bootloader entry mode will be a timeout; and software will enter from bootloader entry mode to bootloader quit mode. #define BOOT_ENTRY_TIMEOUT_LIMIT 5 because PWU_WUT_INIT_BOOT_WAIT is 12, so here 90 means 90x12=xxx seconds not received a correct LF cmd in bootloader wait mode will be a timeout; and software will enter from bootloader wait mode to bootloader quit mode. #define BOOT_WAIT_TIMEOUT_LIMIT 90 If an LF command is received but the format is with error or the cmd processsing function doesn't return OK result, a cmd error counter will increase by 1. When this error counter exceeds the following defined number, bootloader run mode will be changed to bootloader quit mode. #define BOOT_CMDERR_LIMIT 254 /* LF buffer size for bootloader reception, max 48 bytes payload data */ #define LFR_BUF_SIZE_BOOT Field Software Updates Using TPMS LF, 1.0, 8/2015

31 TPMS LF Bootloader Code Example /* LF buffer size for application, it should be at least bigger than the size of bootloader entry keywords array. */ #define LFR_BUF_SIZE_APP 20 /* RF Tx buffer size in RAM */ #define RF_TX_BUF_SIZE 32 //PWU registers values init definition /* PWU init wakeup interval for application mode */ #define PWU_WUT_INIT_APP 6 /* PWU init wakeup interval for bootloader entry mode */ #define PWU_WUT_INIT_BOOT_ENTRY 1 /* PWU init wakeup interval for bootloader run mode */ #define PWU_WUT_INIT_BOOT_RUN 5 /* PWU init wakeup interval for bootloader wait mode */ #define PWU_WUT_INIT_BOOT_WAIT 12 /* PWU init reset interval for application mode */ #define PWU_PRST_INIT_APP 0 /* PWU init reset interval for bootloader mode */ #define PWU_PRST_INIT_BOOT 0 /* should be 0 for this demo code */ #define TURN_OFF_LF_DURING_RF_ON 0 /********************************************************************** BOOTID (bootloader entry keywords) is used to trigger the entering of bootloader mode. After entering bootloader mode, LFR 16bit ID will be sensor ID2&ID3. **********************************************************************/ #define BOOTID_SIZE 10 #define BOOTID_BYTE1 1 #define BOOTID_BYTE2 2 #define BOOTID_BYTE3 3 #define BOOTID_BYTE4 4 #define BOOTID_BYTE5 5 #define BOOTID_BYTE6 6 #define BOOTID_BYTE7 7 #define BOOTID_BYTE8 8 #define BOOTID_BYTE9 9 #define BOOTID_BYTE10 10 Define the fixed/public LF wakeup ID. //#define USER_DEF_LFIDL_APP 0x31 //#define USER_DEF_LFIDH_APP 0x5E #define USER_DEF_LFIDL_APP 0x44 #define USER_DEF_LFIDH_APP 0x38 Field Software Updates Using TPMS LF, 1.0, 8/

32 TPMS LF Bootloader Code Example /*#define USER_DEF_LFIDL_BOOT 0x33 #define USER_DEF_LFIDH_BOOT 0x55*/ /* Register init value definitions: */ #define USER_DEF_SPMSC1 (SPMSC1_BGBE_MASK SPMSC1_LVDE_MASK SPMSC1_LVDSE_MASK) #define USER_DEF_SIMOPT1 (SIMOPT1_STOPE_MASK SIMOPT1_BKGDPE_MASK) #define USER_DEF_SPMSC2 (SPMSC2_PDC_MASK) #define USER_DEF_FCDIV 19 #define USER_DEF_LFCTL1 (LFCTL1_IDSEL1_MASK LFCTL1_SENS1_MASK) #define USER_DEF_LFCTL2_APP 0x51 #define USER_DEF_LFCTL2_BOOT 0x00 #define USER_DEF_LFCTL3 0x30 #define USER_DEF_LFCTL4 0xC8 #define USER_DEF_LFCTRLA 0x00 #define USER_DEF_LFCTRLB 0xC6 #define USER_DEF_LFCTRLC 0x1D #define USER_DEF_LFCTRLD 0x01 #define USER_DEF_PWUDIV #define USER_DEF_RFCR0 #define USER_DEF_RFCR1 #define USER_DEF_RFCR2 #define USER_DEF_RFCR3 #define USER_DEF_RFCR4 #define USER_DEF_RFCR5 #define USER_DEF_RFCR6 #define USER_DEF_RFCR7 #define USER_DEF_PLLCR0 #define USER_DEF_PLLCR1 #define USER_DEF_PLLCR2 #define USER_DEF_PLLCR3 0x1F 0x34 0x7F 0xAE 0x00 0x01 0x00 0x01 0x1A 0xB0 0x1A 0xB0 0xBE #define HOST_TOOL_RF_SYNC_WORD1 0x01 #define HOST_TOOL_RF_SYNC_WORD2 0x01 #define HOST_TOOL_RF_SYNC_WORD3 0x01 #define HOST_TOOL_RF_SYNC_WORD4 0x01 #endif /* MAIN_INCLUDED */ /* **************************************************************************** * End of file. * **************************************************************************** */ End Code Example 32 Field Software Updates Using TPMS LF, 1.0, 8/2015

33 References 6 References Available on Freescale.com/TPMS FXTH871x6, Tire Pressure Monitor Sensor Data Sheet FXTH871x7, Tire Pressure Monitor Sensor Data Sheet FXTH87xx02 Embedded Firmware User Guide FXTH87xx11 and FXTH87xx12 Embedded Firmware User Guide FXTH87xx22 Embedded Firmware User Guide Field Software Updates Using TPMS LF, 1.0, 8/

34 How to Reach Us: Home Page: freescale.com Web Support: freescale.com/support Information in this document is provided solely to enable system and software implementers to use Freescale products. There are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits based on the information in this document. Freescale reserves the right to make changes without further notice to any products herein. Freescale makes no warranty, representation, or guarantee regarding the suitability of its products for any particular purpose, nor does Freescale assume any liability arising out of the application or use of any product or circuit, and specifically disclaims any and all liability, including without limitation consequential or incidental damages. Typical parameters that may be provided in Freescale data sheets and/or specifications can and do vary in different applications, and actual performance may vary over time. All operating parameters, including typicals, must be validated for each customer application by customer's technical experts. Freescale does not convey any license under its patent rights nor the rights of others. Freescale sells products pursuant to standard terms and conditions of sale, which can be found at the following address: freescale.com/salestermsandconditions. Freescale and the Freescale logo are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off. All other product or service names are the property of their respective owners Document Number: AN5149 Revision 1.0, 8/2015