Blank an LPC23XX microcontroller
Introduction
The development of a project on microcontroller generally needs the use of JTAG interface; through this you can start a complete test session, by deletion of the flash memory, writing the new source code, then move to in circuit debug.
But sometimes it happens that just because of a new project the startup settings of the microcontroller can make it deaf to commands from the JTAG, so as to make impossible even the cancellation of the flash memory. This may happen, for example, when the PLL is programmed with the critical values, which then don't allow the sync coupling between the PC with software JTAG control and the micro itself.
This document will explain a procedure to work around the problem, using ISP (In-System Programming) programming. The procedure was tested on Linux (Ubuntu 9.10) with OpenOCD 2.0 JTAG manager, JTAGTiny interface of Amontec and Olimex development board for LPC-2378-STK .
ISP (In-System Programming)
The ISP programming allows, via a serial link, to access the micro for a few basic operations, by using the firmware bootloader resident in the ROM of the micro (i.e. in an area that cannot be changed by the developer). At reset the micro check the logic level of a given pin (usually EINT0) to recognize a request to initiate the bootloader: if the level is low it starts the bootloader code in place of the user program. In this way we can anticipate the execution of the code that does not allow us the link with the micro so to be able to delete it later, thereby restoring the situation of blank micro.
In the case of the device LPC23XX the boot procedure is shown in the following figure, taken from User Manual available on the website of the manufacturer NXP.
Hardware arrangement
Prepare the Olimex board LPC-23678-STK closing jumpers ISP_E and RST_E, then join RS232_0 connector to the RS232-USB cable that interfaces the card with the PC. The circuit on the Olimex board is shown in the figure below; it is noteworthy that the DTR signal (pin 4 RS232) acts on the micro Reset, while the RTS signal (pin 7 RS232) acts on the pin EINT0 to activate the ISP mode. Both lines are active high.
Obviously the JTAG remains unused, as well as its management software (in our case OpenOCD). It's important to remember to set before the logic level low on EINT0 (RTS high) and then to power the card to activate the power-on reset. Alternatively, you can act on the DTR line to enable the cycle of Reset (DTR high-> low).
Software Usage
The software required for the ISP session is any serial port terminal; in our test we used the program gtkterm, available from the official repository of Ubuntu. Program settings are shown in the figure below, with values: 115200, 8, N, 1.
After connecting the board we set RTS high, then running a Reset cycle with DTR high-> low (Control Signals menu of gtkterm). The first command that we type is the character ? which the micro answer with the word Synchronized. We write Synchronized too and the micro responds with OK; after that we type the value in kHz of the crystal on the card (in our case 12000) and the micro confirms with OK. At this point we can start the sequence for the cancellation of the flash. First we give the release command with the string U 23130; then we arrange the areas of memory with the command P 0 26 and finally we execute the cancellation of the same fields with E 0 26. For all our commands (if successful) the micro responds with code 0. To further check we run the command I 0 26 for verification of the blank areas; it is noteworthy that the verification on the first sector always gives error because the first 64 bytes are remapped to the boot block flash; hence the micro answer will be like 8 0 XXXXXXXXXX. The following figure shows how the above procedure works.
From this moment the flash of the micro is fully cleared. Note: This procedure assumes that the CRP (Code Read Protection) has never been activated at Level 3; this operatin, indeed, disables JTAG and ISP access if a valid program (correct checksum) is present in sector 0. The CRP3 makes, in fact, the chip flash inaccessible.
