MC9S12C Family MC9S12GC Family Reference Manual HCS12 Microcontrollers MC9S12C128 Rev 01.24 05/2010 freescale.com

Toprovidethemostup-to-dateinformation,therevisionofourdocumentsontheWorldWideWebwillbe the most current. Yourprinted copy may bean earlier revision. To verify youhave the latest information available, refer to: http://freescale.com/ A full list of family members and options is included in the appendices. The following revision history table summarizes changes contained in this document. This document contains information for all constituent modules, with the exception of the S12 CPU. For S12 CPU information please refer to the CPU S12 Reference Manual. Revision History Revision Date Description Level June, 2005 01.14 New Book Removed 16MHz option for 128K, 96K and 64K versions July, 2005 01.15 Minor corrections following review Added outstanding flash module descriptions Oct, 2005 01.16 Added EPP package options Corrected and Enhanced recommended PCB layouts Dec, 2005 01.17 Added note to PIM block diagram figure Dec, 2005 01.18 Added PIM rerouting information to 80-pin package diagram Modified LVI levels in electrical parameter section Jan, 2006 01.19 Corrected TSCR2 typo in timer register listing Mar, 2006 01.20 Cleaned up Device Overview Section Added 0M66G to PartID table May, 2006 01.21 Added units to MSCAN timing parameter table Corrected missing overbars on pin names Corrected CRGFLG contents in register summary Dec, 2006 01.22 Removed non existing part number options Removed unintended symbol fonts from table A6 Updated ATD section May, 2007 01.23 Corrected typos May, 2010 01.24 Updated TIM section

Chapter 1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) .17 Chapter 2 Port Integration Module (PIM9C32) . . . . . . . . . . . . . . . . . . . . .73 Chapter 3 Module Mapping Control (MMCV4) . . . . . . . . . . . . . . . . . . . .109 Chapter 4 Multiplexed External Bus Interface (MEBIV3) . . . . . . . . . . . .129 Chapter 5 Interrupt (INTV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157 Chapter 6 Background Debug Module (BDMV4) . . . . . . . . . . . . . . . . . .165 Chapter 7 Debug Module (DBGV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191 Chapter 8 Analog-to-Digital Converter (ATD10B8C) . . . . . . . . . . . . . . .223 Chapter 9 Clocks and Reset Generator (CRGV4) . . . . . . . . . . . . . . . . . .251 Chapter 10 Scalable Controller Area Network (S12MSCANV2). . . . . . . .287 Chapter 11 Oscillator (OSCV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .343 Chapter 12 Pulse-Width Modulator (PWM8B6CV1) . . . . . . . . . . . . . . . . .347 Chapter 13 Serial Communications Interface (S12SCIV2) . . . . . . . . . . . .383 Chapter 14 Serial Peripheral Interface (SPIV3) . . . . . . . . . . . . . . . . . . . . .413 Chapter 15 Timer Module (TIM16B8CV1) . . . . . . . . . . . . . . . . . . . . . . . . .435 Chapter 16 Dual Output Voltage Regulator (VREG3V3V2) . . . . . . . . . . .463 Chapter 17 16 Kbyte Flash Module (S12FTS16KV1). . . . . . . . . . . . . . . . .471 Chapter 18 32 Kbyte Flash Module (S12FTS32KV1). . . . . . . . . . . . . . . . .503 Chapter 19 64 Kbyte Flash Module (S12FTS64KV4). . . . . . . . . . . . . . . . .537 Chapter 20 96 Kbyte Flash Module (S12FTS96KV1). . . . . . . . . . . . . . . . .575 Chapter 21 128 Kbyte Flash Module (S12FTS128K1V1). . . . . . . . . . . . . .613 Appendix A Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . .647 Appendix B Emulation Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .679 Appendix C Package Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .681 Appendix D Derivative Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .685 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 3 Rev 01.24

Appendix E Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .686 4 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17 1.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17 1.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 1.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 1.2 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 1.2.1 Device Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 1.2.2 Detailed Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.2.3 Part ID Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44 1.3 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45 1.3.1 Device Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45 1.3.2 Signal Properties Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48 1.3.3 Pin Initialization for 48- and 52-Pin LQFP Bond Out Versions . . . . . . . . . . . . . . . . . . .49 1.3.4 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50 1.3.5 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55 1.4 System Clock Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57 1.5 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57 1.5.1 Chip Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57 1.5.2 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58 1.5.3 Low-Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 1.6 Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60 1.6.1 Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60 1.6.2 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62 1.7 Device Specific Information and Module Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62 1.7.1 PPAGE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62 1.7.2 BDM Alternate Clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63 1.7.3 Extended Address Range Emulation Implications . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63 1.7.4 VREGEN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 1.7.5 V , V , V , V DD1 DD2 SS1 SS2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 1.7.6 Clock Reset Generator And VREG Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 1.7.7 Analog-to-Digital Converter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 1.7.8 MODRR Register Port T And Port P Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 1.7.9 Port AD Dependency On PIM And ATD Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 1.8 Recommended Printed Circuit Board Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 Chapter 2 Port Integration Module (PIM9C32) Block Description 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73 2.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 5 Rev 01.24

2.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74 2.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76 2.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77 2.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77 2.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80 2.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104 2.4.1 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104 2.4.2 Port Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 2.4.3 Port A, B, E and BKGD Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 2.4.4 External Pin Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 2.4.5 Low Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 2.5 Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 2.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 2.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108 2.6.1 Interrupt Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108 2.6.2 Recovery from STOP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108 2.7 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108 Chapter 3 Module Mapping Control (MMCV4) Block Description 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .109 3.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 3.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 3.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 3.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 3.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 3.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 3.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122 3.4.1 Bus Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122 3.4.2 Address Decoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 3.4.3 Memory Expansion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124 Chapter 4 Multiplexed External Bus Interface (MEBIV3) 4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129 4.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129 4.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131 4.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131 4.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133 4.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134 4.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 4.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150 4.4.1 Detecting Access Type from External Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150 4.4.2 Stretched Bus Cycles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .151 6 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

4.4.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .151 4.4.4 Internal Visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156 4.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156 Chapter 5 Interrupt (INTV1) Block Description 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157 5.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158 5.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158 5.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159 5.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159 5.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159 5.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 5.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .161 5.4.1 Low-Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 5.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 5.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 5.6.1 Interrupt Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 5.6.2 Highest Priority I-Bit Maskable Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 5.6.3 Interrupt Priority Decoder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163 5.7 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163 Chapter 6 Background Debug Module (BDMV4) Block Description 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165 6.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165 6.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166 6.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167 6.2.1 BKGD — Background Interface Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167 6.2.2 TAGHI — High Byte Instruction Tagging Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167 6.2.3 TAGLO — Low Byte Instruction Tagging Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167 6.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .168 6.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .168 6.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 6.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174 6.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174 6.4.2 Enabling and Activating BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174 6.4.3 BDM Hardware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175 6.4.4 Standard BDM Firmware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .176 6.4.5 BDM Command Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177 6.4.6 BDM Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179 6.4.7 Serial Interface Hardware Handshake Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182 6.4.8 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184 6.4.9 SYNC — Request Timed Reference Pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 7 Rev 01.24

6.4.10 Instruction Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187 6.4.11 Instruction Tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188 6.4.12 Serial Communication Time-Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188 6.4.13 Operation in Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189 6.4.14 Operation in Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189 Chapter 7 Debug Module (DBGV1) Block Description 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191 7.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191 7.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193 7.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193 7.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195 7.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196 7.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196 7.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 7.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212 7.4.1 DBG Operating in BKP Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212 7.4.2 DBG Operating in DBG Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214 7.4.3 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221 7.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222 7.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222 Chapter 8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223 8.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223 8.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223 8.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224 8.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.1 AN7 / ETRIG / PAD7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.2 AN6 / PAD6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.3 AN5 / PAD5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.4 AN4 / PAD4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.5 AN3 / PAD3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.6 AN2 / PAD2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.7 AN1 / PAD1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.8 AN0 / PAD0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 8.2.9 V , V RH RL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 8.2.10 V , V DDA SSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 8.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226 8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226 8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 8 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

8.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .245 8.4.1 Analog Sub-block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 8.4.2 Digital Sub-block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .246 8.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .247 8.5.1 Setting up and starting an A/D conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .247 8.5.2 Aborting an A/D conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .248 8.6 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .248 8.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .249 Chapter 9 Clocks and Reset Generator (CRGV4) Block Description 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .251 9.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .251 9.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252 9.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252 9.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .253 9.2.1 V , V — PLL Operating Voltage, PLL Ground . . . . . . . . . . . . . . . . . . . . . .253 DDPLL SSPLL 9.2.2 XFC — PLL Loop Filter Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .253 9.2.3 RESET — Reset Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .254 9.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .254 9.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .254 9.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 9.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .266 9.4.1 Phase Locked Loop (PLL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .266 9.4.2 System Clocks Generator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .269 9.4.3 Clock Monitor (CM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .270 9.4.4 Clock Quality Checker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .270 9.4.5 Computer Operating Properly Watchdog (COP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .272 9.4.6 Real-Time Interrupt (RTI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .272 9.4.7 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .273 9.4.8 Low-Power Operation in Run Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .274 9.4.9 Low-Power Operation in Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .274 9.4.10 Low-Power Operation in Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .278 9.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .282 9.5.1 Clock Monitor Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .284 9.5.2 Computer Operating Properly Watchdog (COP) Reset . . . . . . . . . . . . . . . . . . . . . . . . .284 9.5.3 Power-On Reset, Low Voltage Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .285 9.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .286 9.6.1 Real-Time Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .286 9.6.2 PLL Lock Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 9.6.3 Self-Clock Mode Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .286 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 9 Rev 01.24

Chapter 10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .287 10.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .287 10.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .288 10.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .288 10.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 10.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .289 10.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .289 10.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .289 10.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .289 10.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 10.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290 10.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292 10.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314 10.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .323 10.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .323 10.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .324 10.4.3 Identifier Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .327 10.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 10.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .334 10.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .339 10.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .339 10.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .341 10.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .341 Chapter 11 Oscillator (OSCV2) Block Description 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .343 11.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .343 11.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 11.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .344 11.2.1 V andV — PLL Operating Voltage, PLL Ground . . . . . . . . . . . . . . . . . . .344 DDPLL SSPLL 11.2.2 EXTAL andXTAL — Clock/Crystal Source Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . .344 11.2.3 XCLKS — Colpitts/Pierce Oscillator Selection Signal . . . . . . . . . . . . . . . . . . . . . . . . .345 11.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346 11.4.1 Amplitude Limitation Control (ALC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346 11.4.2 Clock Monitor (CM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346 11.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346 Chapter 12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .347 10 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

12.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .347 12.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 12.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348 12.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348 12.2.1 PWM5 — Pulse Width Modulator Channel 5 Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348 12.2.2 PWM4 — Pulse Width Modulator Channel 4 Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348 12.2.3 PWM3 — Pulse Width Modulator Channel 3 Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348 12.2.4 PWM2 — Pulse Width Modulator Channel 2 Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . .349 12.2.5 PWM1 — Pulse Width Modulator Channel 1 Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . .349 12.2.6 PWM0 — Pulse Width Modulator Channel 0 Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . .349 12.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 12.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .349 12.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .351 12.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .371 12.4.1 PWM Clock Select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 12.4.2 PWM Channel Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .374 12.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .381 12.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .381 Chapter 13 Serial Communications Interface (S12SCIV2) Block Description 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .383 13.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .383 13.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .383 13.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384 13.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .385 13.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .385 13.2.1 TXD-SCI Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .385 13.2.2 RXD-SCI Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .385 13.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .386 13.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .386 13.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .386 13.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .394 13.4.1 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .395 13.4.2 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .396 13.4.3 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .397 13.4.4 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .400 13.4.5 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .409 13.4.6 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .409 13.5 Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .409 13.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .409 13.5.2 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .410 13.5.3 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .411 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 11 Rev 01.24

Chapter 14 Serial Peripheral Interface (SPIV3) Block Description 14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .413 14.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .413 14.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413 14.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .414 14.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .414 14.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .414 14.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .415 14.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .415 14.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .415 14.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415 14.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .415 14.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .416 14.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .423 14.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .424 14.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .425 14.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .426 14.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .429 14.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .430 14.4.6 Error Conditions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .431 14.4.7 Operation in Run Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .432 14.4.8 Operation in Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .432 14.4.9 Operation in Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .432 14.5 Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .433 14.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .433 14.6.1 MODF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .433 14.6.2 SPIF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .433 14.6.3 SPTEF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .433 Chapter 15 Timer Module (TIM16B8CV1) Block Description 15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .435 15.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .435 15.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436 15.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .436 15.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .438 15.2.1 IOC7 — Input Capture and Output Compare Channel 7 Pin . . . . . . . . . . . . . . . . . . . .438 15.2.2 IOC6 — Input Capture and Output Compare Channel 6 Pin . . . . . . . . . . . . . . . . . . . .438 15.2.3 IOC5 — Input Capture and Output Compare Channel 5 Pin . . . . . . . . . . . . . . . . . . . .438 15.2.4 IOC4 — Input Capture and Output Compare Channel 4 Pin . . . . . . . . . . . . . . . . . . . .438 15.2.5 IOC3 — Input Capture and Output Compare Channel 3 Pin . . . . . . . . . . . . . . . . . . . .438 15.2.6 IOC2 — Input Capture and Output Compare Channel 2 Pin . . . . . . . . . . . . . . . . . . . .439 15.2.7 IOC1 — Input Capture and Output Compare Channel 1 Pin . . . . . . . . . . . . . . . . . . . .439 12 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

15.2.8 IOC0 — Input Capture and Output Compare Channel 0 Pin . . . . . . . . . . . . . . . . . . . .439 15.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439 15.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .439 15.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .441 15.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .457 15.4.1 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .458 15.4.2 Input Capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .459 15.4.3 Output Compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .459 15.4.4 Pulse Accumulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .460 15.4.5 Event Counter Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .460 15.4.6 Gated Time Accumulation Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .461 15.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .461 15.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .461 15.6.1 Channel [7:0] Interrupt (C[7:0]F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .461 15.6.2 Pulse Accumulator Input Interrupt (PAOVI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .462 15.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .462 15.6.4 Timer Overflow Interrupt (TOF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .462 Chapter 16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .463 16.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .463 16.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 16.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .464 16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465 16.2.1 V — Regulator Power Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465 DDR 16.2.2 V , V — Regulator Reference Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465 DDA SSA 16.2.3 V , V — Regulator Output1 (Core Logic) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .466 DD SS 16.2.4 V , V — Regulator Output2 (PLL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .466 DDPLL SSPLL 16.2.5 V — Optional Regulator Enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .466 REGEN 16.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .466 16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .467 16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .467 16.4.1 REG — Regulator Core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .468 16.4.2 Full-Performance Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .468 16.4.3 Reduced-Power Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .468 16.4.4 LVD — Low-Voltage Detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .468 16.4.5 POR — Power-On Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .468 16.4.6 LVR — Low-Voltage Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .468 16.4.7 CTRL — Regulator Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .468 16.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469 16.5.1 Power-On Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469 16.5.2 Low-Voltage Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 13 Rev 01.24

16.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469 16.6.1 LVI — Low-Voltage Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469 Chapter 17 16 Kbyte Flash Module (S12FTS16KV1) 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .471 17.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .471 17.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .471 17.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 17.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472 17.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472 17.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .473 17.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .473 17.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .475 17.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .486 17.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .486 17.4.2 Operating Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .500 17.4.3 Flash Module Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .500 17.4.4 Flash Reset Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 17.4.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .502 Chapter 18 32 Kbyte Flash Module (S12FTS32KV1) 18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .503 18.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .503 18.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .503 18.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 18.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .504 18.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .504 18.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .505 18.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .505 18.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508 18.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .520 18.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .520 18.4.2 Operating Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .534 18.4.3 Flash Module Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .534 18.4.4 Flash Reset Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536 18.4.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .536 Chapter 19 64 Kbyte Flash Module (S12FTS64KV4) 19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .537 19.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .537 19.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .537 14 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

19.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538 19.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .538 19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .539 19.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .539 19.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .539 19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .545 19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .557 19.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .557 19.4.2 Operating Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .571 19.4.3 Flash Module Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .571 19.4.4 Flash Reset Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573 19.4.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .573 Chapter 20 96 Kbyte Flash Module (S12FTS96KV1) 20.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .575 20.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .575 20.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .575 20.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576 20.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .576 20.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .577 20.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .577 20.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .577 20.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .583 20.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .595 20.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .595 20.4.2 Operating Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .609 20.4.3 Flash Module Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .609 20.4.4 Flash Reset Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 20.4.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .611 Chapter 21 128 Kbyte Flash Module (S12FTS128K1V1) 21.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .613 21.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .613 21.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .613 21.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614 21.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .614 21.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .614 21.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .615 21.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .615 21.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .618 21.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .630 21.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .630 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 15 Rev 01.24

21.4.2 Operating Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .644 21.4.3 Flash Module Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .644 21.4.4 Flash Reset Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 646 21.4.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .646 Appendix A Electrical Characteristics A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .647 A.2 ATD Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .658 A.3 MSCAN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663 A.4 Reset, Oscillator and PLL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663 A.5 NVM, Flash, and EEPROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .669 A.6 SPI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .673 A.7 Voltage Regulator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .677 Appendix B Emulation Information B.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .679 Appendix C Package Information C.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .681 Appendix D Derivative Differences Appendix E Ordering Information 16 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.1 Introduction TheMC9S12C-Family/MC9S12GC-Familyare48/52/80pinFlash-basedMCUfamilies,whichdeliver the power and flexibility of the 16-bit core to a whole new range of cost and space sensitive, general purpose industrial and automotive network applications. All MC9S12C-Family / MC9S12GC-Family members feature standard on-chip peripherals including a 16-bit central processing unit (CPU12), up to 128KbytesofFlashEEPROM,upto4KbytesofRAM,anasynchronousserialcommunicationsinterface (SCI),aserialperipheralinterface(SPI),an8-channel16-bittimermodule(TIM),a6-channel8-bitpulse width modulator (PWM), an 8-channel, 10-bit analog-to-digital converter (ADC). The MC9S12C128-Family members also feature a CAN 2.0 A, B software compatible module (MSCAN12). All MC9S12C-Family / MC9S12GC-Family devices feature full 16-bit data paths throughout. The inclusion of a PLL circuit allows power consumption and performance to be adjusted to suit operational requirements. In addition to the I/O ports available in each module, up to 10 dedicated I/O port bits are available with wake-up capability from stop or wait mode. The devices are available in 48-, 52-, and 80- pin QFP packages, with the 80-pin version pin compatible to the HCS12 A, B, and D Family derivatives. 1.1.1 Features • 16-bit HCS12 core: — HCS12 CPU – Upward compatible with M68HC11 instruction set – Interrupt stacking and programmer’s model identical to M68HC11 – Instruction queue – Enhanced indexed addressing — MMC (memory map and interface) — INT (interrupt control) — BDM (background debug mode) — DBG12 (enhanced debug12 module, including breakpoints and change-of-flow trace buffer) — MEBI (multiplexed expansion bus interface) available only in 80-pin package version • Wake-up interrupt inputs: — Up to 12 port bits available for wake up interrupt function with digital filtering Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 17 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) • Memory options: — 16K or 32Kbyte Flash EEPROM (erasable in 512-byte sectors) 64K, 96K, or 128Kbyte Flash EEPROM (erasable in 1024-byte sectors) — 1K, 2K or 4K Byte RAM • Analog-to-digital converters: — One 8-channel module with 10-bit resolution — External conversion trigger capability • Available on MC9S12C Family: — One 1M bit per second, CAN2.0A, B software compatible module — Five receive and three transmit buffers — Flexible identifier filter programmable as 2x32 bit, 4x16 bit, or 8x8bit — Four separate interrupt channels for Rx, Tx, error, and wake-up — Low-pass filter wake-up function — Loop-back for self test operation • Timer module (TIM): — 8-channel timer — Each channel configurable as either input capture or output compare — Simple PWM mode — Modulo reset of timer counter — 16-bit pulse accumulator — External event counting — Gated time accumulation • PWM module: — Programmable period and duty cycle — 8-bit 6-channel or 16-bit 3-channel — Separate control for each pulse width and duty cycle — Center-aligned or left-aligned outputs — Programmable clock select logic with a wide range of frequencies — Fast emergency shutdown input • Serial interfaces: — One asynchronous serial communications interface (SCI) — One synchronous serial peripheral interface (SPI) • CRG (clock reset generator module) — Windowed COP watchdog — Real time interrupt — Clock monitor — Pierce or low current Colpitts oscillator — Phase-locked loop clock frequency multiplier — Limp home mode in absence of external clock — Low power 0.5MHz to 16MHz crystal oscillator reference clock 18 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) • Operating frequency: — 32MHz equivalent to 16MHz bus speed for single chip — 32MHz equivalent to 16MHz bus speed in expanded bus modes — Option of 9S12C Family: 50MHz equivalent to 25MHz bus speed — All 9S12GC Family members allow a 50MHz operating frequency. • Internal 2.5V regulator: — Supports an input voltage range from 2.97V to 5.5V — Low power mode capability — Includes low voltage reset (LVR) circuitry — Includes low voltage interrupt (LVI) circuitry • 48-pin LQFP, 52-pin LQFP, or 80-pin QFP package: — Up to 58 I/O lines with 5V input and drive capability (80-pin package) — Up to 2 dedicated 5V input only lines (IRQ, XIRQ) — 5V 8 A/D converter inputs and 5V I/O • Development support: — Single-wire background debug™ mode (BDM) — On-chip hardware breakpoints — Enhanced DBG12 debug features 1.1.2 Modes of Operation User modes (expanded modes are only available in the 80-pin package version). • Normal and emulation operating modes: — Normal single-chip mode — Normal expanded wide mode — Normal expanded narrow mode — Emulation expanded wide mode — Emulation expanded narrow mode • Special operating modes: — Special single-chip mode with active background debug mode — Special test mode(Freescale use only) — Special peripheral mode(Freescale use only) • Low power modes: — Stop mode — Pseudo stop mode — Wait mode Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 19 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.1.3 Block Diagram VSSR VDDA VDDA VDDR VSSA VSSA VDDX VRH VRH VSSX Voltage Regulator VRL VRL AN0 PAD0 AN1 PAD1 ATD AN2 PAD2 VVDSDS22 16K, 32K, 64K, 96K, 128K Byte Flash AAANNN345 DDRAD PTAD PPPAAADDD345 VDD1 1K, 2K, 4K Byte RAM AN6 PAD6 VSS1 AN7 PAD7 BKGD MODC/TAGHI BDM HCCPSU12 IIOOCC01 PPTT01 XFC IOC2 MUX PT2 VVDSDSPPLLLL PLL ClRoceks eatnd MToimdeurle IIOOCC34 DDRT PTT PPTT34 EXTAL Generation COP Watchdog IOC5 PT5 XTAL Module Clock Monitor IOC6 PT6 RESET Periodic Interrupt IOC7 PT7 PE0 XIRQ PW0 PP0 PE1 IRQ PW1 PP1 System PE2 R/W Integration PWM PW2 pt PP2 PPPEEE345 PTE DDRE LEMSCOTLDRKAB//ITPAIPGEL0O M(SodIMul)e Module PPPWWW345 d Interru DDRP PTP PPPPPP345 a PE6 MODB/IPIPE1 yp PP6 PE7 NOACC/XCLKS Ke PP7 TEST/VPP ey Int DDRJ PTJ PPJJ67 K Multiplexed Address/Data Bus RXD PS0 SCI MSCAN is not available on the TXD DDRS PTS PPSS12 DDRA DDRB 9S12GC Family Members PS3 PTA PTB RXCAN PM0 MSCAN TXCAN PM1 PA7PA6PA5PA4PA3PA2PA1PA0 PB7PB6PB5PB4PB3PB2PB1PB0 SPI MMIOSSSOSI DDRM PTM PPPMMM342 15141312111098 76543210 SCK PM5 RRRRRRRR RRRRRRRR DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD AAAAAAAA AAAAAAAA 543210 MWuidlteip Bleuxsed ATA1ATA1ATA1ATA1ATA1ATA1ATA9ATA8 ATA7ATA6ATA5ATA4ATA3ATA2ATA1ATA0 Signals shown inBold are not available on the 52 or 48 Pin Package DDDDDDDD DDDDDDDD Signals shown inBold Italicare available in the 52, but not the 48 Pin Package Internal Logic 2.5V I/O Driver 5V Voltage Regulator 5V & I/O VDD1,2 VDDX VDDR VSS1,2 VSSX VSSR PLL 2.5V A/D Converter 5V VDDPLL VDDA VRL is bonded internally to VSSA VSSPLL VSSA for 52- and 48-Pin packages Figure1-1. MC9S12C-Family / MC9S12GC-Family Block Diagram 20 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.2 Memory Map and Registers 1.2.1 Device Memory Map Table1-1showsthedeviceregistermapafterreset.Figure 1-2throughFigure1-6illustratethefulldevice memory map. Table1-1. Device Register Map Overview Address Module Size 0x0000–0x0017 Core (ports A, B, E, modes, inits, test) 24 0x0018 Reserved 1 0x0019 Voltage regulator (VREG) 1 0x001A–0x001B Device ID register 2 0x001C–0x001F Core (MEMSIZ, IRQ, HPRIO) 4 0x0020–0x002F Core (DBG) 16 0x0030–0x0033 Core (PPAGE(1)) 4 0x0034–0x003F Clock and reset generator (CRG) 12 0x0040–0x006F Standard timer module (TIM) 48 0x0070–0x007F Reserved 16 0x0080–0x009F Analog-to-digital converter (ATD) 32 0x00A0–0x00C7 Reserved 40 0x00C8–0x00CF Serial communications interface (SCI) 8 0x00D0–0x00D7 Reserved 8 0x00D8–0x00DF Serial peripheral interface (SPI) 8 0x00E0–0x00FF Pulse width modulator (PWM) 32 0x0100–0x010F Flash control register 16 0x0110–0x013F Reserved 48 0x0140–0x017F Scalable controller area network (MSCAN)(2) 64 0x0180–0x023F Reserved 192 0x0240–0x027F Port integration module (PIM) 64 0x0280–0x03FF Reserved 384 1. External memory paging is not supported on this device (Section1.7.1, “PPAGE”). 2. Not available on MC9S12GC Family devices Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 21 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0000 1K Register Space PAGE MAP 0x0000 0x03FF Mappable to any 2K Boundary 0x0400 0x0000 16K Fixed Flash EEPROM 0x3FFF 0x003D 0x3000 0x3000 4K Bytes RAM 0x3FFF Mappable to any 4K Boundary 0x4000 0x4000 16K Fixed Flash EEPROM 0x003E 0x7FFF 0x8000 0x8000 16K Page Window EXT 8 * 16K Flash EEPROM Pages PPAGE 0xBFFF 0xC000 0xC000 16K Fixed Flash EEPROM 0x003F 0xFFFF 0xFF00 BDM 0xFF00 (If Active) VECTORS VECTORS VECTORS 0xFFFF 0xFFFF NORMAL EXPANDED SPECIAL SINGLE CHIP SINGLE CHIP The figure shows a useful map, which is not the map out of reset. After reset the map is: 0x0000–0x03FF: Register Space 0x0000–0x0FFF: 4K RAM (only 3K visible 0x0400–0x0FFF) Flash erase sector size is 1024 bytes Figure1-2. MC9S12C128 and MC9S12GC128 User Configurable Memory Map 22 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0000 1K Register Space PAGE MAP 0x0000 0x03FF Mappable to any 2K Boundary 0x0400 0x0000 16K Fixed Flash EEPROM 0x3FFF 0x003D 0x3000 0x3000 4K Bytes RAM 0x3FFF Mappable to any 4K Boundary 0x4000 0x4000 16K Fixed Flash EEPROM 0x003E 0x7FFF 0x8000 0x8000 16K Page Window EXT 6 * 16K Flash EEPROM Pages PPAGE 0xBFFF 0xC000 0xC000 16K Fixed Flash EEPROM 0x003F 0xFFFF 0xFF00 BDM 0xFF00 (If Active) 0xFFFF VECTORS VECTORS VECTORS 0xFFFF NORMAL EXPANDED SPECIAL SINGLE CHIP SINGLE CHIP The figure shows a useful map, which is not the map out of reset. After reset the map is: 0x0000–0x03FF: Register Space 0x0000–0x0FFF: 4K RAM (only 3K visible 0x0400–0x0FFF) Flash erase sector size is 1024 bytes Figure 1-3. MC9S12C96 and MC9S12GC96 User Configurable Memory Map Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 23 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0000 1K Register Space PAGE MAP 0x0000 0x03FF Mappable to any 2K Boundary 0x0400 0x0000 16K Fixed Flash EEPROM 0x3FFF 0x003D 0x3000 0x3000 4K Bytes RAM 0x3FFF Mappable to any 4K Boundary 0x4000 0x4000 16K Fixed Flash EEPROM 0x003E 0x7FFF 0x8000 0x8000 16K Page Window EXT 4 * 16K Flash EEPROM Pages PPAGE 0xBFFF 0xC000 0xC000 16K Fixed Flash EEPROM 0x003F 0xFFFF 0xFF00 BDM 0xFF00 (If Active) 0xFFFF VECTORS VECTORS VECTORS 0xFFFF NORMAL EXPANDED SPECIAL SINGLE CHIP SINGLE CHIP The figure shows a useful map, which is not the map out of reset. After reset the map is: 0x0000–0x03FF: Register space 0x0000–0x0FFF: 4K RAM (only 3K visible 0x0400–0x0FFF) Flash erase sector size is 1024 Bytes Figure1-4. MC9S12C64 and MC9S12GC64 User Configurable Memory Map 24 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0000 1K Register Space PAGE MAP 0x0000 0x03FF Mappable to any 2K Boundary 0x0400 0x3800 0x3800 2K Bytes RAM 0x3FFF Mappable to any 2K Boundary 0x4000 0x003E 0x8000 0x8000 16K Page Window EXT 2 * 16K Flash EEPROM Pages PPAGE 0xBFFF 0xC000 0xC000 16K Fixed Flash EEPROM 0x003F 0xFFFF 0xFF00 BDM 0xFF00 (If Active) 0xFFFF VECTORS VECTORS VECTORS 0xFFFF NORMAL EXPANDED SPECIAL SINGLE CHIP SINGLE CHIP The figure shows a useful map, which is not the map out of reset. After reset the map is: 0x0000–0x03FF: Register space 0x0800–0x0FFF: 2K RAM Flash erase sector size is 512 bytes The flash page 0x003E is visible at 0x4000–0x7FFF in the memory map if ROMHM = 0. In the figure ROMHM = 1 removing page 0x003E from 0x4000–0x7FFF. Figure1-5. MC9S12C32 and MC9S12GC32 User Configurable Memory Map Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 25 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0000 1K Register Space PAGE MAP 0x0000 0x03FF Mappable to any 2K Boundary 0x0400 0x3C00 0x3C00 1K Bytes RAM 0x3FFF Mappable to any 2K Boundary 0x4000 0x8000 0x8000 16K Page Window EXT PPAGE 0xBFFF 0xC000 0xC000 16K Fixed Flash EEPROM 0x003F 0xFFFF 0xFF00 BDM 0xFF00 (If Active) VECTORS VECTORS VECTORS 0xFFFF 0xFFFF NORMAL EXPANDED SPECIAL SINGLE CHIP SINGLE CHIP The figure shows a useful map, which is not the map out of reset. After reset the map is: 0x0000–0x03FF: Register Space 0x0C00–0x0FFF: 1K RAM The 16K flash array page 0x003F is also visible in the PPAGE window when PPAGE register contents are odd. Flash Erase Sector Size is 512 Bytes Figure1-6. MC9S12GC16 User Configurable Memory Map 26 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.2.2 Detailed Register Map The detailed register map of the MC9S12C128 is listed in address order below. 0x0000–0x000F MEBI Map 1 of 3 (HCS12 Multiplexed External Bus Interface) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x0000 PORTA Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0001 PORTB Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0002 DDRA Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0003 DDRB Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0 0 0 0 0 0 0 0 0x0004 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0005 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0006 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0007 Reserved Write: Read: Bit 1 Bit 0 0x0008 PORTE Bit 7 6 5 4 3 2 Write: Read: 0 0 0x0009 DDRE Bit 7 6 5 4 3 Bit 2 Write: Read: 0 0 0 0x000A PEAR NOACCE PIPOE NECLK LSTRE RDWE Write: Read: 0 0 0x000B MODE MODC MODB MODA IVIS EMK EME Write: Read: 0 0 0 0 0x000C PUCR PUPKE PUPEE PUPBE PUPAE Write: Read: 0 0 0 0 0x000D RDRIV RDPK RDPE RDPB RDPA Write: Read: 0 0 0 0 0 0 0 0x000E EBICTL ESTR Write: Read: 0 0 0 0 0 0 0 0 0x000F Reserved Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 27 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0010–0x0014 MMC Map 1 of 4 (HCS12 Module Mapping Control) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0x0010 INITRM RAM15 RAM14 RAM13 RAM12 RAM11 RAMHAL Write: Read: 0 0 0 0 0x0011 INITRG REG14 REG13 REG12 REG11 Write: Read: 0 0 0x0012 INITEE EE15 EE14 EE13 EE12 EE11 EEON Write: Read: 0 0 0 0 0x0013 MISC EXSTR1 EXSTR0 ROMHM ROMON Write: Read: 0 0 0 0 0 0 0 0 0x0014 Reserved Write: 0x0015–0x0016 INT Map 1 of 2 (HCS12 Interrupt) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0x0015 ITCR WRINT ADR3 ADR2 ADR1 ADR0 Write: Read: 0x0016 ITEST INTE INTC INTA INT8 INT6 INT4 INT2 INT0 Write: 0x0017–0x0017 MMC Map 2 of 4 (HCS12 Module Mapping Control) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 0 0 0 0x0017 Reserved Write: 0x0018–0x0018 Miscellaneous Peripherals (Device User Guide) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 0 0 0 0x0018 Reserved Write: 0x0019–0x0019 VREG3V3 (Voltage Regulator) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 LVDS $0019 VREGCTRL LVIE LVIF Write: 28 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x001A–0x001B Miscellaneous Peripherals (Device User Guide) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: ID15 ID14 ID13 ID12 ID11 ID10 ID9 ID8 0x001A PARTIDH Write: Read: ID7 ID6 ID5 ID4 ID3 ID2 ID1 ID0 0x001B PARTIDL Write: 0x001C–0x001D MMC Map 3 of 4 (HCS12 Module Mapping Control, Device User Guide) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: reg_sw0 0 eep_sw1 eep_sw0 0 ram_sw2 ram_sw1 ram_sw0 0x001C MEMSIZ0 Write: Read: rom_sw1 rom_sw0 0 0 0 0 pag_sw1 pag_sw0 0x001D MEMSIZ1 Write: 0x001E–0x001E MEBI Map 2 of 3 (HCS12 Multiplexed External Bus Interface) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 0 0x001E INTCR IRQE IRQEN Write: 0x001F–0x001F INT Map 2 of 2 (HCS12 Interrupt) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0x001F HPRIO PSEL7 PSEL6 PSEL5 PSEL4 PSEL3 PSEL2 PSEL1 Write: 0x0020–0x002F DBG (Including BKP) Map 1 of 1 (HCS12 Debug) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0x0020 DBGC1 DBGEN ARM TRGSEL BEGIN DBGBRK CAPMOD Write: Read: AF BF CF 0 0x0021 DBGSC TRG Write: Read: Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0x0022 DBGTBH Write: Read: Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0023 DBGTBL Write: Read: TBF 0 CNT 0x0024 DBGCNT Write: Read: 0x0025 DBGCCX PAGSEL EXTCMP Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 29 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0020–0x002F DBG (Including BKP) Map 1 of 1 (HCS12 Debug) (continued) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x0026 DBGCCH Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x0027 DBGCCL Bit 7 6 5 4 3 2 1 Bit 0 Write: DBGC2 Read: 0x0028 BKABEN FULL BDM TAGAB BKCEN TAGC RWCEN RWC BKPCT0 Write: DBGC3 Read: 0x0029 BKAMBH BKAMBL BKBMBH BKBMBL RWAEN RWA RWBEN RWB BKPCT1 Write: DBGCAX Read: 0x002A PAGSEL EXTCMP BKP0X Write: DBGCAH Read: 0x002B Bit 15 14 13 12 11 10 9 Bit 8 BKP0H Write: DBGCAL Read: 0x002C Bit 7 6 5 4 3 2 1 Bit 0 BKP0L Write: DBGCBX Read: 0x002D PAGSEL EXTCMP BKP1X Write: DBGCBH Read: 0x002E Bit 15 14 13 12 11 10 9 Bit 8 BKP1H Write: DBGCBL Read: 0x002F Bit 7 6 5 4 3 2 1 Bit 0 BKP1L Write: 0x0030–0x0031 MMC Map 4 of 4 (HCS12 Module Mapping Control) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0x0030 PPAGE PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 Write: Read: 0 0 0 0 0 0 0 0 0x0031 Reserved Write: 0x0032–0x0033 MEBI Map 3 of 3 (HCS12 Multiplexed External Bus Interface) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x0032 PORTK(1) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0033 DDRK1 Bit 7 6 5 4 3 2 1 Bit 0 Write: Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 0 0 0 $0032 Reserved Write: Read: 0 0 0 0 0 0 0 0 $0033 Reserved Write: 1. Only applicable in special emulation-only bond outs, for emulation of extended memory map. 30 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0034–0x003F CRG (Clock and Reset Generator) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0x0034 SYNR SYN5 SYN4 SYN3 SYN2 SYN1 SYN0 Write: Read: 0 0 0 0 0x0035 REFDV REFDV3 REFDV2 REFDV1 REFDV0 Write: CTFLG Read: TOUT7 TOUT6 TOUT5 TOUT4 TOUT3 TOUT2 TOUT1 TOUT0 0x0036 TEST ONLY Write: Read: LOCK TRACK SCM 0x0037 CRGFLG RTIF PORF LVRF LOCKIF SCMIF Write: Read: 0 0 0 0 0 0x0038 CRGINT RTIE LOCKIE SCMIE Write: Read: 0x0039 CLKSEL PLLSEL PSTP SYSWAI ROAWAI PLLWAI CWAI RTIWAI COPWAI Write: Read: 0 0x003A PLLCTL CME PLLON AUTO ACQ PRE PCE SCME Write: Read: 0 0x003B RTICTL RTR6 RTR5 RTR4 RTR3 RTR2 RTR1 RTR0 Write: Read: 0 0 0 0x003C COPCTL WCOP RSBCK CR2 CR1 CR0 Write: FORBYP Read: 0 0 0 0 0x003D RTIBYP COPBYP PLLBYP FCM TEST ONLY Write: CTCTL Read: TCTL7 TCTL6 TCTL5 TCTL4 TCLT3 TCTL2 TCTL1 TCTL0 0x003E TEST ONLY Write: Read: 0 0 0 0 0 0 0 0 0x003F ARMCOP Write: Bit 7 6 5 4 3 2 1 Bit 0 0x0040-0x006F TIM ep Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x0040 TIOS IOS7 IOS6 IOS5 IOS4 IOS3 IOS2 IOS1 IOS0 Write: Read: 0 0 0 0 0 0 0 0 0x0041 CFORC Write: FOC7 FOC6 FOC5 FOC4 FOC3 FOC2 FOC1 FOC0 Read: 0x0042 OC7M OC7M7 OC7M6 OC7M5 OC7M4 OC7M3 OC7M2 OC7M1 OC7M0 Write: Read: 0x0043 OC7D OC7D7 OC7D6 OC7D5 OC7D4 OC7D3 OC7D2 OC7D1 OC7D0 Write: Read: Bit 15 14 13 12 11 10 9 Bit 8 0x0044 TCNT (hi) Write: Read: Bit 7 6 5 4 3 2 1 Bit 0 0x0045 TCNT (lo) Write: Read: 0 0 0 0 0x0046 TSCR1 TEN TSWAI TSFRZ TFFCA Write: Read: 0x0047 TTOV TOV7 TOV6 TOV5 TOV4 TOV3 TOV2 TOV1 TOV0 Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 31 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x0048 TCTL1 OM7 OL7 OM6 OL6 OM5 OL5 OM4 OL4 Write: Read: 0x0049 TCTL2 OM3 OL3 OM2 OL2 OM1 OL1 OM0 OL0 Write: Read: 0x004A TCTL3 EDG7B EDG7A EDG6B EDG6A EDG5B EDG5A EDG4B EDG4A Write: Read: 0x004B TCTL4 EDG3B EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A Write: Read: 0x004C TIE C7I C6I C5I C4I C3I C2I C1I C0I Write: Read: 0 0 0 0x004D TSCR2 TOI TCRE PR2 PR1 PR0 Write: Read: 0x004E TFLG1 C7F C6F C5F C4F C3F C2F C1F C0F Write: Read: 0 0 0 0 0 0 0 0x004F TFLG2 TOF Write: Read: 0x0050 TC0 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x0051 TC0 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0052 TC1 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x0053 TC1 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0054 TC2 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x0055 TC2 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0056 TC3 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x0057 TC3 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x0058 TC4 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x0059 TC4 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x005A TC5 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x005B TC5 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x005C TC6 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x005D TC6 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0x005E TC7 (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: 32 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x005F TC7 (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0 0x0060 PACTL PAEN PAMOD PEDGE CLK1 CLK0 PAOVI PAI Write: Read: 0 0 0 0 0 0 0x0061 PAFLG PAOVF PAIF Write: Read: 0x0062 PACNT (hi) Bit 15 14 13 12 11 10 9 Bit 8 Write: Read: 0x0063 PACNT (lo) Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0 0 0 0 0 0 0 0 0x0064 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0065 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0066 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0067 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0068 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0069 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x006A Reserved Write: Read: 0 0 0 0 0 0 0 0 0x006B Reserved Write: Read: 0 0 0 0 0 0 0 0 0x006C Reserved Write: Read: 0 0 0 0 0 0 0 0 0x006D Reserved Write: Read: 0 0 0 0 0 0 0 0 0x006E Reserved Write: Read: 0 0 0 0 0 0 0 0 0x006F Reserved Write: 0x0070–0x007F Reserved Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0070– Read: 0 0 0 0 0 0 0 0 Reserved 0x007F Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 33 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0080–0x009F ATD (Analog-to-Digital Converter 10 Bit 8 Channel) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 0 0 0 0x0080 ATDCTL0 Write: Read: 0 0 0 0 0 0 0 0 0x0081 ATDCTL1 Write: Read: ASCIF 0x0082 ATDCTL2 ADPU AFFC AWAI ETRIGLE ETRIGP ETRIG ASCIE Write: Read: 0 0x0083 ATDCTL3 S8C S4C S2C S1C FIFO FRZ1 FRZ0 Write: Read: 0x0084 ATDCTL4 SRES8 SMP1 SMP0 PRS4 PRS3 PRS2 PRS1 PRS0 Write: Read: 0 0x0085 ATDCTL5 DJM DSGN SCAN MULT CC CB CA Write: Read: 0 0 CC2 CC1 CC0 0x0086 ATDSTAT0 SCF ETORF FIFOR Write: Read: 0 0 0 0 0 0 0 0 0x0087 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0088 ATDTEST0 Write: Read: 0 0 0 0 0 0 0 0x0089 ATDTEST1 SC Write: Read: 0 0 0 0 0 0 0 0 0x008A Reserved Write: Read: CCF7 CCF6 CCF5 CCF4 CCF3 CCF2 CCF1 CCF0 0x008B ATDSTAT1 Write: Read: 0 0 0 0 0 0 0 0 0x008C Reserved Write: Read: 0x008D ATDDIEN Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0 0 0 0 0 0 0 0 0x008E Reserved Write: Read: Bit7 6 5 4 3 2 1 BIT 0 0x008F PORTAD Write: Read: Bit15 14 13 12 11 10 9 Bit8 0x0090 ATDDR0H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x0091 ATDDR0L Write: Read: Bit15 14 13 12 11 10 9 Bit8 0x0092 ATDDR1H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x0093 ATDDR1L Write: Read: Bit15 14 13 12 11 10 9 Bit8 0x0094 ATDDR2H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x0095 ATDDR2L Write: 34 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0080–0x009F ATD (Analog-to-Digital Converter 10 Bit 8 Channel) (continued) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: Bit15 14 13 12 11 10 9 Bit8 0x0096 ATDDR3H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x0097 ATDDR3L Write: Read: Bit15 14 13 12 11 10 9 Bit8 0x0098 ATDDR4H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x0099 ATDDR4L Write: Read: Bit15 14 13 12 11 10 9 Bit8 0x009A ATDDR5H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x009B ATDDR5L Write: Read: Bit15 14 13 12 11 10 9 Bit8 0x009C ATDDR6H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x009D ATDDR6L Write: Read: Bit15 14 13 12 11 10 9 Bit8 0x009E ATDDR7H Write: Read: Bit7 Bit6 0 0 0 0 0 0 0x009F ATDDR7L Write: 0x00A0–0x00C7 Reserved Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x00A0– Read: 0 0 0 0 0 0 0 0 Reserved 0x00C7 Write: 0x00C8–0x00CF SCI (Asynchronous Serial Interface) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0x00C8 SCIBDH SBR12 SBR11 SBR10 SBR9 SBR8 Write: Read: 0x00C9 SCIBDL SBR7 SBR6 SBR5 SBR4 SBR3 SBR2 SBR1 SBR0 Write: Read: 0x00CA SCICR1 LOOPS SCISWAI RSRC M WAKE ILT PE PT Write: Read: 0x00CB SCICR2 TIE TCIE RIE ILIE TE RE RWU SBK Write: Read: TDRE TC RDRF IDLE OR NF FE PF 0x00CC SCISR1 Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 35 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x00C8–0x00CF SCI (Asynchronous Serial Interface) (continued) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 RAF 0x00CD SCISR2 BRK13 TXDIR Write: Read: R8 0 0 0 0 0 0 0x00CE SCIDRH T8 Write: Read: R7 R6 R5 R4 R3 R2 R1 R0 0x00CF SCIDRL Write: T7 T6 T5 T4 T3 T2 T1 T0 0x00D0–0x00D7 Reserved Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x00D0– Read: 0 0 0 0 0 0 0 0 Reserved 0x00D7 Write: 0x00D8–0x00DF SPI (Serial Peripheral Interface) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x00D8 SPICR1 SPIE SPE SPTIE MSTR CPOL CPHA SSOE LSBFE Write: Read: 0 0 0 0 0x00D9 SPICR2 MODFEN BIDIROE SPISWAI SPC0 Write: Read: 0 0 0x00DA SPIBR SPPR2 SPPR1 SPPR0 SPR2 SPR1 SPR0 Write: Read: SPIF 0 SPTEF MODF 0 0 0 0 0x00DB SPISR Write: Read: 0 0 0 0 0 0 0 0 0x00DC Reserved Write: Read: 0x00DD SPIDR Bit7 6 5 4 3 2 1 Bit0 Write: Read: 0 0 0 0 0 0 0 0 0x00DE Reserved Write: Read: 0 0 0 0 0 0 0 0 0x00DF Reserved Write: 36 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x00E0–0x00FF PWM (Pulse Width Modulator) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 $00E0 PWME PWME5 PWME4 PWME3 PWME2 PWME1 PWME0 Write: Read: 0 0 $00E1 PWMPOL PPOL5 PPOL4 PPOL3 PPOL2 PPOL1 PPOL0 Write: Read: 0 0 $00E2 PWMCLK PCLK5 PCLK4 PCLK3 PCLK2 PCLK1 PCLK0 Write: Read: 0 0 $00E3 PWMPRCLK PCKB2 PCKB1 PCKB0 PCKA2 PCKA1 PCKA0 Write: Read: 0 0 $00E4 PWMCAE CAE5 CAE4 CAE3 CAE2 CAE1 CAE0 Write: Read: 0 0 0 $00E5 PWMCTL CON45 CON23 CON01 PSWAI PFRZ Write: PWMTST Read: 0 0 0 0 0 0 0 0 $00E6 Test Only Write: Read: 0 0 0 0 0 0 0 0 $00E7 PWMPRSC Write: Read: $00E8 PWMSCLA Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00E9 PWMSCLB Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0 0 0 0 0 0 0 0 $00EA PWMSCNTA Write: Read: 0 0 0 0 0 0 0 0 $00EB PWMSCNTB Write: Read: Bit 7 6 5 4 3 2 1 Bit 0 $00EC PWMCNT0 Write: 0 0 0 0 0 0 0 0 Read: Bit 7 6 5 4 3 2 1 Bit 0 $00ED PWMCNT1 Write: 0 0 0 0 0 0 0 0 Read: Bit 7 6 5 4 3 2 1 Bit 0 $00EE PWMCNT2 Write: 0 0 0 0 0 0 0 0 Read: Bit 7 6 5 4 3 2 1 Bit 0 $00EF PWMCNT3 Write: 0 0 0 0 0 0 0 0 Read: Bit 7 6 5 4 3 2 1 Bit 0 $00F0 PWMCNT4 Write: 0 0 0 0 0 0 0 0 Read: Bit 7 6 5 4 3 2 1 Bit 0 $00F1 PWMCNT5 Write: 0 0 0 0 0 0 0 0 Read: $00F2 PWMPER0 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00F3 PWMPER1 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00F4 PWMPER2 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00F5 PWMPER3 Bit 7 6 5 4 3 2 1 Bit 0 Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 37 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x00E0–0x00FF PWM (Pulse Width Modulator) (continued) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: $00F6 PWMPER4 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00F7 PWMPER5 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00F8 PWMDTY0 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00F9 PWMDTY1 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00FA PWMDTY2 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00FB PWMDTY3 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00FC PWMDTY4 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: $00FD PWMDTY5 Bit 7 6 5 4 3 2 1 Bit 0 Write: Read: 0 0 PWM5IN $00FE Reserved PWMIF PWMIE PWMLVL PWM5INL PWM5ENA Write: PWMRSTRT Read: 0 0 0 0 0 0 0 0 $00FF Reserved Write: 0x0110–0x013F Reserved Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0110– Read: 0 0 0 0 0 0 0 0 Reserved 0x003F Write: 0x0140–0x017F CAN (Scalable Controller Area Network — MSCAN)(1) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: RXACT SYNCH 0x0140 CANCTL0 RXFRM CSWAI TIME WUPE SLPRQ INITRQ Write: Read: 0 SLPAK INITAK 0x0141 CANCTL1 CANE CLKSRC LOOPB LISTEN WUPM Write: Read: 0x0142 CANBTR0 SJW1 SJW0 BRP5 BRP4 BRP3 BRP2 BRP1 BRP0 Write: Read: 0x0143 CANBTR1 SAMP TSEG22 TSEG21 TSEG20 TSEG13 TSEG12 TSEG11 TSEG10 Write: Read: RSTAT1 RSTAT0 TSTAT1 TSTAT0 0x0144 CANRFLG WUPIF CSCIF OVRIF RXF Write: Read: 0x0145 CANRIER WUPIE CSCIE RSTATE1 RSTATE0 TSTATE1 TSTATE0 OVRIE RXFIE Write: 38 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0140–0x017F CAN (Scalable Controller Area Network — MSCAN)(1) (continued) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 0x0146 CANTFLG TXE2 TXE1 TXE0 Write: Read: 0 0 0 0 0 0x0147 CANTIER TXEIE2 TXEIE1 TXEIE0 Write: Read: 0 0 0 0 0 0x0148 CANTARQ ABTRQ2 ABTRQ1 ABTRQ0 Write: Read: 0 0 0 0 0 ABTAK2 ABTAK1 ABTAK0 0x0149 CANTAAK Write: Read: 0 0 0 0 0 0x014A CANTBSEL TX2 TX1 TX0 Write: Read: 0 0 0 IDHIT2 IDHIT1 IDHIT0 0x014B CANIDAC IDAM1 IDAM0 Write: Read: 0 0 0 0 0 0 0 0 0x014C Reserved Write: Read: 0 0 0 0 0 0 0 0 0x014D Reserved Write: Read: RXERR7 RXERR6 RXERR5 RXERR4 RXERR3 RXERR2 RXERR1 RXERR0 0x014E CANRXERR Write: Read: TXERR7 TXERR6 TXERR5 TXERR4 TXERR3 TXERR2 TXERR1 TXERR0 0x014F CANTXERR Write: 0x0150– CANIDAR0 - Read: AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 0x0153 CANIDAR3 Write: 0x0154– CANIDMR0 - Read: AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 0x0157 CANIDMR3 Write: 0x0158– CANIDAR4 - Read: AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 0x015B CANIDAR7 Write: 0x015C– CANIDMR4 - Read: AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 0x015F CANIDMR7 Write: 0x0160– Read: FOREGROUND RECEIVE BUFFER seeTable1-2 CANRXFG 0x016F Write: 0x0170– Read: CANTXFG FOREGROUND TRANSMIT BUFFER seeTable1-2 0x017F Write: 1. Not available on the MC9S12GC Family members. Those memory locations should not be accessed. Table1-2. Detailed MSCAN Foreground Receive and Transmit Buffer Layout Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Extended ID Read: ID28 ID27 ID26 ID25 ID24 ID23 ID22 ID21 0xXXX0 Standard ID Read: ID10 ID9 ID8 ID7 ID6 ID5 ID4 ID3 CANxRIDR0 Write: Extended ID Read: ID20 ID19 ID18 SRR=1 IDE=1 ID17 ID16 ID15 0xXXX1 Standard ID Read: ID2 ID1 ID0 RTR IDE=0 CANxRIDR1 Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 39 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Table1-2. Detailed MSCAN Foreground Receive and Transmit Buffer Layout (continued) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Extended ID Read: ID14 ID13 ID12 ID11 ID10 ID9 ID8 ID7 0xXXX2 Standard ID Read: CANxRIDR2 Write: Extended ID Read: ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR 0xXXX3 Standard ID Read: CANxRIDR3 Write: 0xXXX4– CANxRDSR0– Read: DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 0xXXXB CANxRDSR7 Write: Read: DLC3 DLC2 DLC1 DLC0 0xXXXC CANRxDLR Write: Read: 0xXXXD Reserved Write: Read: TSR15 TSR14 TSR13 TSR12 TSR11 TSR10 TSR9 TSR8 0xXXXE CANxRTSRH Write: Read: TSR7 TSR6 TSR5 TSR4 TSR3 TSR2 TSR1 TSR0 0xXXXF CANxRTSRL Write: Extended ID Read: ID28 ID27 ID26 ID25 ID24 ID23 ID22 ID21 CANxTIDR0 Write: 0xxx10 Read: Standard ID ID10 ID9 ID8 ID7 ID6 ID5 ID4 ID3 Write: Extended ID Read: ID20 ID19 ID18 SRR=1 IDE=1 ID17 ID16 ID15 CANxTIDR1 Write: 0xxx11 Read: Standard ID ID2 ID1 ID0 RTR IDE=0 Write: Extended ID Read: ID14 ID13 ID12 ID11 ID10 ID9 ID8 ID7 CANxTIDR2 Write: 0xxx12 Read: Standard ID Write: Extended ID Read: ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR CANxTIDR3 Write: 0xxx13 Read: Standard ID Write: 0xxx14– CANxTDSR0– Read: DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 0xxx1B CANxTDSR7 Write: Read: 0xxx1C CANxTDLR DLC3 DLC2 DLC1 DLC0 Write: Read: 0xxx1D CONxTTBPR PRIO7 PRIO6 PRIO5 PRIO4 PRIO3 PRIO2 PRIO1 PRIO0 Write: Read: TSR15 TSR14 TSR13 TSR12 TSR11 TSR10 TSR9 TSR8 0xxx1E CANxTTSRH Write: Read: TSR7 TSR6 TSR5 TSR4 TSR3 TSR2 TSR1 TSR0 0xxx1F CANxTTSRL Write: 40 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0180–0x023F Reserved Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0180– Read: 0 0 0 0 0 0 0 0 Reserved 0x023F Write: 0x0240–0x027F PIM (Port Interface Module) (Sheet 1 of 3) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0x0240 PTT PTT7 PTT6 PTT5 PTT4 PTT3 PTT2 PTT1 PTT0 Write: Read: PTIT7 PTIT6 PTIT5 PTIT4 PTIT3 PTIT2 PTIT1 PTIT0 0x0241 PTIT Write: Read: 0x0242 DDRT DDRT7 DDRT7 DDRT5 DDRT4 DDRT3 DDRT2 DDRT1 DDRT0 Write: Read: 0x0243 RDRT RDRT7 RDRT6 RDRT5 RDRT4 RDRT3 RDRT2 RDRT1 RDRT0 Write: Read: 0x0244 PERT PERT7 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 Write: Read: 0x0245 PPST PPST7 PPST6 PPST5 PPST4 PPST3 PPST2 PPST1 PPST0 Write: Read: 0 0 0 0 0 0 0 0 0x0246 Reserved Write: Read: 0 0 0 0x0247 MODRR MODRR4 MODRR3 MODRR2 MODRR1 MODRR0 Write: Read: 0 0 0 0 0x0248 PTS PTS3 PTS2 PTS1 PTS0 Write: Read: 0 0 0 0 PTIS3 PTIS2 PTIS1 PTIS0 0x0249 PTIS Write: Read: 0 0 0 0 0x024A DDRS DDRS3 DDRS2 DDRS1 DDRS0 Write: Read: 0 0 0 0 0x024B RDRS RDRS3 RDRS2 RDRS1 RDRS0 Write: Read: 0 0 0 0 0x024C PERS PERS3 PERS2 PERS1 PERS0 Write: Read: 0 0 0 0 0x024D PPSS PPSS3 PPSS2 PPSS1 PPSS0 Write: Read: 0 0 0 0 0x024E WOMS WOMS3 WOMS2 WOMS1 WOMS0 Write: Read: 0 0 0 0 0 0 0 0 0x024F Reserved Write: Read: 0 0 0x0250 PTM PTM5 PTM4 PTM3 PTM2 PTM1 PTM0 Write: Read: 0 0 PTIM5 PTIM4 PTIM3 PTIM2 PTIM1 PTIM0 0x0251 PTIM Write: Read: 0 0 0x0252 DDRM DDRM5 DDRM4 DDRM3 DDRM2 DDRM1 DDRM0 Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 41 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0240–0x027F PIM (Port Interface Module) (Sheet 2 of 3) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0x0253 RDRM RDRM5 RDRM4 RDRM3 RDRM2 RDRM1 RDRM0 Write: Read: 0 0 0x0254 PERM PERM5 PERM4 PERM3 PERM2 PERM1 PERM0 Write: Read: 0 0 0x0255 PPSM PPSM5 PPSM4 PPSM3 PPSM2 PPSM1 PPSM0 Write: Read: 0 0 0x0256 WOMM WOMM5 WOMM4 WOMM3 WOMM2 WOMM1 WOMM0 Write: Read: 0 0 0 0 0 0 0 0 0x0257 Reserved Write: Read: 0x0258 PTP PTP7 PTP6 PTP5 PTP4 PTP3 PTP2 PTP1 PTP0 Write: Read: PTIP7 PTIP6 PTIP5 PTIP4 PTIP3 PTIP2 PTIP1 PTIP0 0x0259 PTIP Write: Read: 0x025A DDRP DDRP7 DDRP7 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 Write: Read: 0x025B RDRP RDRP7 RDRP6 RDRP5 RDRP4 RDRP3 RDRP2 RDRP1 RDRP0 Write: Read: 0x025C PERP PERP7 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 Write: Read: 0x025D PPSP PPSP7 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSS0 Write: Read: 0x025E PIEP PIEP7 PIEP6 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 Write: Read: 0x025F PIFP PIFP7 PIFP6 PIFP5 PIFP4 PIFP3 PIFP2 PIFP1 PIFP0 Write: Read: 0 0 0 0 0 0 0 0 0x0260 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0261 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0262 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0263 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0264 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0265 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0266 Reserved Write: Read: 0 0 0 0 0 0 0 0 0x0267 Reserved Write: Read: 0 0 0 0 0 0 0x0268 PTJ PTJ7 PTJ6 Write: Read: PTIJ7 PTIJ6 0 0 0 0 0 0 0x0269 PTIJ Write: 42 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 0x0240–0x027F PIM (Port Interface Module) (Sheet 3 of 3) Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Read: 0 0 0 0 0 0 0x026A DDRJ DDRJ7 DDRJ7 Write: Read: 0 0 0 0 0 0 0x026B RDRJ RDRJ7 RDRJ6 Write: Read: 0 0 0 0 0 0 0x026C PERJ PERJ7 PERJ6 Write: Read: 0 0 0 0 0 0 0x026D PPSJ PPSJ7 PPSJ6 Write: Read: 0 0 0 0 0 0 0x026E PIEJ PIEJ7 PIEJ6 Write: Read: 0 0 0 0 0 0 0x026F PIFJ PIFJ7 PIFJ6 Write: Read: 0x0270 PTAD PTAD7 PTAD6 PTAD5 PTAD4 PTAD3 PTAD2 PTAD1 PTAD0 Write: Read: PTIAD7 PTIAD6 PTIAD5 PTIAD4 PTIAD3 PTIAD2 PTIAD1 PTIJ7 0x0271 PTIAD Write: Read: 0x0272 DDRAD DDRAD7 DDRAD6 DDRAD5 DDRAD4 DDRAD3 DDRAD2 DDRAD1 DDRAD0 Write: Read: 0x0273 RDRAD RDRAD7 RDRAD6 RDRAD5 RDRAD4 RDRAD3 RDRAD2 RDRAD1 RDRAD0 Write: Read: 0x0274 PERAD PERAD7 PERAD6 PERAD5 PERAD4 PERAD3 PERAD2 PERAD1 PERAD0 Write: Read: 0x0275 PPSAD PPSAD7 PPSAD6 PPSAD5 PPSAD4 PPSAD3 PPSAD2 PPSAD1 PPSAD0 Write: 0x0276- Read: 0 0 0 0 0 0 0 0 Reserved 0x027F Write: 0x0280–0x03FF Reserved Space Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0280– Read: 0 0 0 0 0 0 0 0 Reserved 0x2FF Write: 0x0300 Read: 0 0 0 0 0 0 0 0 Unimplemented –0x03FF Write: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 43 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.2.3 Part ID Assignments ThepartIDislocatedintwo8-bitregistersPARTIDHandPARTIDL(addresses0x001Aandox001Bafter reset).Theread-onlyvalueisauniquepartIDforeachrevisionofthechip.Table1-3showstheassigned part ID numbers for production mask sets. Table1-3. Assigned Part ID Numbers Device Mask Set Number Part ID(1) MC9S12C32 1L45J $3300 MC9S12C32 2L45J $3302 MC9S12C32 1M34C $3311 MC9S12GC16 2L45J $3302 MC9S12GC32 2L45J $3302 MC9S12GC32 1M34C $3311 MC9S12C64,MC9S12C96,MC9S12C128 2L09S $3102 MC9S12GC64,MC9S12GC96,MC9S12GC128 2L09S $3102 MC9S12C64,MC9S12C96,MC9S12C128 0M66G $3103 MC9S12GC64,MC9S12GC96,MC9S12GC128 0M66G $3103 1. The coding is as follows: Bit 15–12: Major family identifier Bit 11–8: Minor family identifier Bit 7–4: Major mask set revision number including FAB transfers Bit 3–0: Minor — non full — mask set revision Thedevicememorysizesarelocatedintwo8-bitregistersMEMSIZ0andMEMSIZ1(addresses0x001C and0x001Dafterreset).Table1-4showstheread-onlyvaluesoftheseregisters.RefertoModuleMapping and Control (MMC) Block Guide for further details. Table1-4. Memory Size Registers Device Register Name Value MEMSIZ0 $00 MC9S12GC16 MEMSIZ1 $80 MEMSIZ0 $00 MC9S12C32, MC9S12GC32 MEMSIZ1 $80 MEMSIZ0 $01 MC9S12C64, MC9S12GC64 MEMSIZ1 $C0 MEMSIZ0 $01 MC9S12C96,MC9S12GC96 MEMSIZ1 $C0 MEMSIZ0 $01 MC9S12C128, MC9S12GC128 MEMSIZ1 $C0 44 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.3 Signal Description 1.3.1 Device Pinouts L T C 45 M WW O P4/KWP4/PP5/KWP5/PP7/KWP7 DDX SSXM0/RXCANM1/TXCANM2/MISOM3/SSM4/MOSIM5/SCKJ6/KWJ6J7/KWJ7P6/KWP6/RS3S2S1/TXDS0/RXD SSA RL PPPVVPPPPPPPPPPPPPVV 09876543210987654321 PW3/KWP3/PP3 18777777777766666666660 V RH PW2/KWP2/PP2 2 59 V DDA PW1/KWP1/PP1 3 58 PAD07/AN07 PW0/KWP0/PP0 4 57 PAD06/AN06 PW0/IOC0/PT0 5 56 PAD05/AN05 PW1/IOC1/PT1 6 55 PAD04/AN04 PW2/IOC2/PT2 7 54 PAD03/AN03 PW3/IOC3/PT3 8 53 PAD02/AN02 VDD1 9 MC9S12C-Family / 52 PAD01/AN01 VSS1 10 51 PAD00/AN00 PW4/IOC4/PT4 11 MC9S12GC-Family 50 V SS2 IOC5/PT5 12 49 V DD2 IOC6/PT6 13 48 PA7/ADDR15/DATA15 IOC7/PT7 14 47 PA6/ADDR14/DATA14 MODC/TAGHI/BKGD 15 46 PA5/ADDR13/DATA13 ADDR0/DATA0/PB0 16 45 PA4/ADDR12/DATA12 ADDR1/DATA1/PB1 17 44 PA3/ADDR11/DATA11 ADDR2/DATA2/PB2 18 43 PA2/ADDR10/DATA10 ADDR3/DATA3/PB3 19 42 PA1/ADDR9/DATA9 ADDR4/DATA4/PB4 20 41 PA0/ADDR8/DATA8 12345678901234567890 22222222233333333334 ADDR5/DATA5/PB5ADDR6/DATA6/PB6ADDR7/DATA7/PB7XCLKS/NOACC/PE7MODB/IPIPE1/PE6MODA/IPIPE0/PE5ECLK/PE4VSSRVDDRRESETVDDPLLXFCVSSPLLEXTALXTALV/TESTPPLSTRB/TAGLO/PE3R/W/PE2IRQ/PE1XIRQ/PE0 Signals shown inBold are not available on the 52- or 48-pin package Signals shown inBold Italicare available in the 52-pin, but not the 48-pin package Figure1-7. Pin Assignments in 80-Pin QFP The MODRR register within the PIM allows for mapping of PWM channels to Port T in the absence of Port P pins for the low pin count packages. For the 80QFP package option it is recommended not to use MODRRsincethisisintendedtosupportPWMchannelavailabilityinlowpincountpackages.Notethat when mapping PWM channels to Port T in an 80QFP option, the associated PWM channels are then mapped to both Port P and Port T Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 45 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 4 5 W W P P N N KWP4/ KWP5/ RXCA TXCA MISO SS MOSI SCK TXD RXD P4/ P5/ DDX SSX M0/ M1/ M2/ M3/ M4/ M5/ S1/ S0/ SSA P P V V P P P P P P P P V 2 1 0 9 8 7 6 5 4 3 2 1 0 PW3/KWP3/PP3 1 5 5 5 4 4 4 4 4 4 4 4 4 439 VRH PW0/IOC0/PT0 2 38 VDDA PW1/IOC1/PT1 3 37 PAD07/AN07 PW2/IOC2/PT2 4 36 PAD06/AN06 PW3/IOC3/PT3 5 35 PAD05/AN05 V 6 34 PAD04/AN04 DD1 MC9S12C-Family / VSS1 7 MC9S12GC-Family 33 PAD03/AN03 IOC4/PT4 8 32 PAD02/AN02 IOC5/PT5 9 31 PAD01/AN01 IOC6/PT6 10 30 PAD00/AN00 IOC7/PT7 11 29 PA2 MODC/BKGD 12 28 PA1 PB4 13 27 PA0 4 5 6 7 8 9 0 1 2 3 4 5 6 1 1 1 1 1 1 2 2 2 2 2 2 2 7 4 R R T L C L L L T 1 0 KS/PE LK/PE VSS VDD RESE VDDPL XF VSSPL EXTA XTA /TESPRQ/PE RQ/PE CL EC VPI XI X * Signals shown inBold italicare not available on the 48-pin package Figure1-8. Pin Assignments in 52-Pin LQFP 46 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 5 W P N N KWP5/ RXCA TXCA MISO SS MOSI SCK TXD RXD P5/ DDX SSX M0/ M1/ M2/ M3/ M4/ M5/ S1/ S0/ SSA P V V P P P P P P P P V 8 7 6 5 4 3 2 1 0 9 8 7 PW0/IOC0/PT0 1 4 4 4 4 4 4 4 4 4 3 3 336 V RH PW1/IOC1/PT1 2 35 V DDA PW2/IOC2/PT2 3 34 PAD07/AN07 PW3/IOC3/PT3 4 33 PAD06/AN06 V 5 32 PAD05/AN05 DD1 VSS1 6 MC9S12C-Family / 31 PAD04/AN04 IOC4/PT4 7 MC9S12GC-Family 30 PAD03/AN03 IOC5/PT5 8 29 PAD02/AN02 IOC6/PT6 9 28 PAD01/AN01 IOC7/PT7 10 27 PAD00/AN00 MODC/BKGD 11 26 PA0 PB4 12 25 XIRQ/PE0 3 4 5 6 7 8 9 0 1 2 3 4 1 1 1 1 1 1 1 2 2 2 2 2 7 4 R R T L C L L L T 1 KS/PE LK/PE VSS VDD RESE VDDPL XF VSSPL EXTA XTA /TESPRQ/PE CL EC VPI X Figure1-9. Pin Assignments in 48-Pin LQFP Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 47 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.3.2 Signal Properties Summary Table1-5. Signal Properties Internal Pull Resistor Pin Name Pin Name Pin Name Power Description Function 1 Function 2 Function 3 Domain Reset CTRL State EXTAL — — V NA NA Oscillator pins DDPLL XTAL — — V NA NA DDPLL RESET — — V None None External reset pin DDX XFC — — V NA NA PLL loop filter pin DDPLL TEST V — V NA NA Test pin only PP SSX BKGD MODC TAGHI V Up Up Background debug, mode pin, tag signal high DDX PE7 NOACC XCLKS V PUCR Up Port E I/O pin, access, clock select DDX WhileRESET Port E I/O pin and pipe status PE6 IPIPE1 MODB V DDX pin is low: Down WhileRESET Port E I/O pin and pipe status PE5 IPIPE0 MODA V DDX pin is low: Down Mode Port E I/O pin, bus clock output PE4 ECLK — V PUCR DDX Dep(1) Mode Port E I/O pin, low strobe, tag signal low PE3 LSTRB TAGLO V PUCR DDX Dep1 Mode Port E I/O pin, R/W in expanded modes PE2 R/W — V PUCR DDX Dep1 PE1 IRQ — V PUCR Up Port E input, external interrupt pin DDX PE0 XIRQ — V PUCR Up Port E input, non-maskable interrupt pin DDX ADDR[15:1/ Port A I/O pin and multiplexed address/data PA[7:3] — V PUCR Disabled DATA[15:1] DDX ADDR[10:9/ Port A I/O pin and multiplexed address/data PA[2:1] — V PUCR Disabled DATA[10:9] DDX ADDR[8]/ Port A I/O pin and multiplexed address/data PA[0] — V PUCR Disabled DATA[8] DDX ADDR[7:5]/ Port B I/O pin and multiplexed address/data PB[7:5] — V PUCR Disabled DATA[7:5] DDX ADDR[4]/ Port B I/O pin and multiplexed address/data PB[4] — V PUCR Disabled DATA[4] DDX ADDR[3:0]/ Port B I/O pin and multiplexed address/data PB[3:0] — V PUCR Disabled DATA[3:0] DDX PERAD/P Port AD I/O pins and ATD inputs PAD[7:0] AN[7:0] — V Disabled DDA PSAD PERP/ Port P I/O pins and keypad wake-up PP[7] KWP[7] — V Disabled DDX PPSP PERP/ Port P I/O pins, keypad wake-up, and ROMON PP[6] KWP[6] ROMCTL V Disabled DDX PPSP enable. PERP/ Port P I/O pin, keypad wake-up, PW5 output PP[5] KWP[5] PW5 V Disabled DDX PPSP PERP/ Port P I/O pin, keypad wake-up, PWM output PP[4:3] KWP[4:3] PW[4:3] V Disabled DDX PPSP 48 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Table1-5. Signal Properties (continued) Internal Pull Resistor Pin Name Pin Name Pin Name Power Description Function 1 Function 2 Function 3 Domain Reset CTRL State PERP/ Port P I/O pins, keypad wake-up, PWM outputs PP[2:0] KWP[2:0] PW[2:0] V Disabled DDX PPSP PERJ/ Port J I/O pins and keypad wake-up PJ[7:6] KWJ[7:6] — V Disabled DDX PPSJ PERM/ Port M I/O pin and SPI SCK signal PM5 SCK — V Up DDX PPSM PERM/ Port M I/O pin and SPIMOSI signal PM4 MOSI — V Up DDX PPSM PERM/ Port M I/O pin and SPISS signal PM3 SS — V Up DDX PPSM PERM/ Port M I/O pin and SPIMISO signal PM2 MISO — V Up DDX PPSM PERM/ Port M I/O pin and CAN transmit signal(2) PM1 TXCAN — V Up DDX PPSM PERM/ Port M I/O pin and CAN receive signal2 PM0 RXCAN — V Up DDX PPSM PERS/ Port S I/O pins PS[3:2] — — V Up DDX PPSS PERS/ Port S I/O pin and SCI transmit signal PS1 TXD — V Up DDX PPSS PERS/ Port S I/O pin and SCI receive signal PS0 RXD — V Up DDX PPSS PERT/ Port T I/O pins shared with timer (TIM) PT[7:5] IOC[7:5] — V Disabled DDX PPST PERT/ Port T I/O pins shared with timer and PWM PT[4:0] IOC[4:0] PW[4:0] V Disabled DDX PPST 1. The Port E output buffer enable signal control at reset is determined by the PEAR register and is mode dependent. For example,inspecialtestmodeRDWE=LSTRE=1whichenablesthePE[3:2]outputbuffersanddisablesthepull-ups.Refer to S12_MEBI user guide for PEAR register details. 2. CAN functionality is not available on the MC9S12GC Family members. 1.3.3 Pin Initialization for 48- and 52-Pin LQFP Bond Out Versions Not Bonded Pins: Iftheportpinsarenotbondedoutinthechosenpackagetheusershouldinitializetheregistersto be inputs with enabled pull resistance to avoid excess current consumption. This applies to the following pins: (48LQFP): Port A[7:1], Port B[7:5], Port B[3:0], PortE[6,5,3,2], Port P[7:6], PortP[4:0], Port J[7:6], PortS[3:2] (52LQFP): Port A[7:3], Port B[7:5], Port B[3:0], PortE[6,5,3,2], Port P[7:6], PortP[2:0], Port J[7:6], PortS[3:2] Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 49 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.3.4 Detailed Signal Descriptions 1.3.4.1 EXTAL, XTAL — Oscillator Pins EXTALandXTALarethecrystaldriverandexternalclockpins.Onresetallthedeviceclocksarederived from the EXTAL input frequency. XTAL is the crystal output. 1.3.4.2 RESET — External Reset Pin RESETisanactivelowbidirectionalcontrolsignalthatactsasaninputtoinitializetheMCUtoaknown start-up state. It also acts as an open-drain output to indicate that an internal failure has been detected in eithertheclockmonitororCOPwatchdogcircuit.ExternalcircuitryconnectedtotheRESETpinshould notincludealargecapacitancethatwouldinterferewiththeabilityofthissignaltorisetoavalidlogicone within 32 ECLK cycles after the low drive is released. Upon detection of any reset, an internal circuit drives theRESET pin low and a clocked reset sequence controls when the MCU can begin normal processing. 1.3.4.3 TEST / V — Test Pin PP This pin is reserved for test and must be tied to V in all applications. SS 1.3.4.4 XFC — PLL Loop Filter Pin DedicatedpinusedtocreatethePLLloopfilter.SeeCRGBUGformoredetailedinformation.PLLloop filter. Please ask your Motorola representative for the interactive application note to compute PLL loop filter elements. Any current leakage on this pin must be avoided. XFC R 0 C P MCU C S V V DDPLL DDPLL Figure1-10. PLL Loop Filter Connections 1.3.4.5 BKGD / TAGHI / MODC — Background Debug, Tag High, and Mode Pin The BKGD /TAGHI / MODC pin is used as a pseudo-open-drain pin for the background debug communication. In MCU expanded modes of operation when instruction tagging is on, an input low on this pin during the falling edge of E-clock tags the high half of the instruction word being read into the instructionqueue.ItisalsousedasaMCUoperatingmodeselectpinattherisingedgeduringreset,when the state of this pin is latched to the MODC bit. 50 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.3.4.6 PA[7:0] / ADDR[15:8] / DATA[15:8] — Port A I/O Pins PA7–PA0aregeneralpurposeinputoroutputpins,.InMCUexpandedmodesofoperation,thesepinsare usedforthemultiplexedexternaladdressanddatabus.PA[7:1]pinsarenotavailableinthe48-pinpackage version. PA[7:3] are not available in the 52-pin package version. 1.3.4.7 PB[7:0] / ADDR[7:0] / DATA[7:0] — Port B I/O Pins PB7–PB0aregeneralpurposeinputoroutputpins.InMCUexpandedmodesofoperation,thesepinsare used for the multiplexed external address and data bus. PB[7:5] and PB[3:0] pins are not available in the 48-pin nor 52-pin package version. 1.3.4.8 PE7 / NOACC / XCLKS — Port E I/O Pin 7 PE7 is a general purpose input or output pin. During MCU expanded modes of operation, the NOACC signal,whenenabled,isusedtoindicatethatthecurrentbuscycleisanunusedor“free”cycle.Thissignal will assert when the CPU is not using the bus.The XCLKS is an input signal which controls whether a crystal in combination with the internal Colpitts (low power) oscillator is used or whether Pierce oscillator/external clock circuitry is used. The state of this pin is latched at the rising edge ofRESET. If the input is a logic low the EXTAL pin is configured for an external clock drive or a Pierce oscillator. If input is a logic high a Colpitts oscillator circuit is configured on EXTAL and XTAL. Since this pin is an input with a pull-up device during reset, if the pin is left floating, the default configuration is a Colpitts oscillator circuit on EXTAL and XTAL. EXTAL CDC1 C MCU 1 Crystal or Ceramic Resonator XTAL C 2 V SSPLL 1. Due to the nature of a translated ground Colpitts oscillator a DC voltage bias is applied to the crystal. Please contact the crystal manufacturer for crystal DC. Figure1-11. Colpitts Oscillator Connections (PE7 = 1) EXTAL C 1 MCU RB Crystal or Ceramic Resonator R 1 S XTAL C 2 V SSPLL 1. RS can be zero (shorted) when used with higher frequency crystals, refer to manufacturer’s data. Figure1-12. Pierce Oscillator Connections (PE7 = 0) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 51 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) CMOS Compatible EXTAL External Oscillator (V Level) DDPLL MCU XTAL Not Connected Figure1-13. External Clock Connections (PE7 = 0) 1.3.4.9 PE6 / MODB / IPIPE1 — Port E I/O Pin 6 PE6isageneralpurposeinputoroutputpin.ItisusedasaMCUoperatingmodeselectpinduringreset. The state of this pin is latched to the MODB bit at the rising edge of RESET. This pin is shared with the instructionqueuetrackingsignalIPIPE1.Thispinisaninputwithapull-downdevicewhichisonlyactive whenRESET is low. PE[6] is not available in the 48- / 52-pin package versions. 1.3.4.10 PE5 / MODA / IPIPE0 — Port E I/O Pin 5 PE5isageneralpurposeinputoroutputpin.ItisusedasaMCUoperatingmodeselectpinduringreset. The state of this pin is latched to the MODA bit at the rising edge of RESET. This pin is shared with the instructionqueuetrackingsignalIPIPE0.Thispinisaninputwithapull-downdevicewhichisonlyactive whenRESET is low. This pin is not available in the 48- / 52-pin package versions. 1.3.4.11 PE4 / ECLK— Port E I/O Pin [4] / E-Clock Output ECLKistheoutputconnectionfortheinternalbusclock.Itisusedtodemultiplextheaddressanddatain expandedmodesandisusedasatimingreference.ECLKfrequencyisequalto1/2thecrystalfrequency outofreset.TheECLKpinisinitiallyconfiguredasECLKoutputwithstretchinallexpandedmodes.The EclockoutputfunctiondependsuponthesettingsoftheNECLKbitinthePEARregister,theIVISbitin theMODEregisterandtheESTRbitintheEBICTLregister.Allclocks,includingtheEclock,arehalted whentheMCUisinstopmode.ItispossibletoconfiguretheMCUtointerfacetoslowexternalmemory. ECLK can be stretched for such accesses. Reference the MISC register (EXSTR[1:0] bits) for more information. In normal expanded narrow mode, the E clock is available for use in external select decode logicorasaconstantspeedclockforuseintheexternalapplicationsystem.AlternativelyPE4canbeused as a general purpose input or output pin. 1.3.4.12 PE3 / LSTRB — Port E I/O Pin [3] / Low-Byte Strobe (LSTRB) In all modes this pin can be used as a general-purpose I/O and is an input with an active pull-up out of reset.Ifthestrobefunctionisrequired,itshouldbeenabledbysettingtheLSTREbitinthePEARregister. This signal is used in write operations. Therefore external low byte writes will not be possible until this function is enabled. This pin is also used asTAGLO in special expanded modes and is multiplexed with theLSTRB function. This pin is not available in the 48- / 52-pin package versions. 52 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.3.4.13 PE2 / R/W — Port E I/O Pin [2] / Read/Write In all modes this pin can be used as a general-purpose I/O and is an input with an active pull-up out of reset. If the read/write function is required it should be enabled by setting the RDWE bit in the PEAR register. External writes will not be possible until enabled. This pin is not available in the 48- / 52-pin package versions. 1.3.4.14 PE1 / IRQ — Port E Input Pin [1] / Maskable Interrupt Pin TheIRQ input provides a means of applying asynchronous interrupt requests to the MCU. Either falling edge-sensitive triggering or level-sensitive triggering is program selectable (INTCR register). IRQ is always enabled and configured to level-sensitive triggering out of reset. It can be disabled by clearing IRQEN bit (INTCR register). When the MCU is reset the IRQ function is masked in the condition code register.Thispinisalwaysaninputandcanalwaysberead.Thereisanactivepull-uponthispinwhilein resetandimmediatelyoutofreset.Thepull-upcanbeturnedoffbyclearingPUPEEinthePUCRregister. 1.3.4.15 PE0 / XIRQ — Port E input Pin [0] / Non Maskable Interrupt Pin TheXIRQinputprovidesameansofrequestinganon-maskableinterruptafterresetinitialization.During reset,theXbitintheconditioncoderegister(CCR)issetandanyinterruptismaskeduntilMCUsoftware enables it. Because the XIRQ input is level sensitive, it can be connected to a multiple-source wired-OR network. This pin is always an input and can always be read. There is an active pull-up on this pin while in reset and immediately out of reset. The pull-up can be turned off by clearing PUPEE in the PUCR register. 1.3.4.16 PAD[7:0] / AN[7:0] — Port AD I/O Pins [7:0] PAD7–PAD0 are general purpose I/O pins and also analog inputs for the analog to digital converter. In order to use a PAD pin as a standard input, the corresponding ATDDIEN register bit must be set. These bits are cleared out of reset to configure the PAD pins for A/D operation. When the A/D converter is active in multi-channel mode, port inputs are scanned and converted irrespective of Port AD configuration. Thus Port AD pins that are configured as digital inputs or digital outputs are also converted in the A/D conversion sequence. 1.3.4.17 PP[7] / KWP[7] — Port P I/O Pin [7] PP7isageneralpurposeinputoroutputpin,sharedwiththekeypadinterruptfunction.Whenconfigured asaninput,itcangenerateinterruptscausingtheMCUtoexitstoporwaitmode.Thispinisnotavailable in the 48- / 52-pin package versions. 1.3.4.18 PP[6] / KWP[6]/ROMCTL — Port P I/O Pin [6] PP6isageneralpurposeinputoroutputpin,sharedwiththekeypadinterruptfunction.Whenconfigured asaninput,itcangenerateinterruptscausingtheMCUtoexitstoporwaitmode.Thispinisnotavailable inthe48-/52-pinpackageversions.DuringMCUexpandedmodesofoperation,thispinisusedtoenable Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 53 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) the Flash EEPROM memory in the memory map (ROMCTL). At the rising edge of RESET, the state of this pin is latched to the ROMON bit. • PP6 = 1 in emulation modes equates to ROMON = 0 (ROM space externally mapped) • PP6 = 0 in expanded modes equates to ROMON = 0 (ROM space externally mapped) 1.3.4.19 PP[5:0] / KWP[5:0] / PW[5:0] — Port P I/O Pins [5:0] PP[5:0] are general purpose input or output pins, shared with the keypad interrupt function. When configured as inputs, they can generate interrupts causing the MCU to exit stop or wait mode. PP[5:0]arealsosharedwiththePWMoutputsignals,PW[5:0].PinsPP[2:0]areonlyavailableinthe80- pin package version. Pins PP[4:3] are not available in the 48-pin package version. 1.3.4.20 PJ[7:6] / KWJ[7:6] — Port J I/O Pins [7:6] PJ[7:6] are general purpose input or output pins, shared with the keypad interrupt function. When configuredasinputs,theycangenerateinterruptscausingtheMCUtoexitstoporwaitmode.Thesepins are not available in the 48-pin package version nor in the 52-pin package version. 1.3.4.21 PM5 / SCK — Port M I/O Pin 5 PM5 is a general purpose input or output pin and also the serial clock pin SCK for the serial peripheral interface (SPI). 1.3.4.22 PM4 / MOSI — Port M I/O Pin 4 PM4 is a general purpose input or output pin and also the master output (during master mode) or slave input (during slave mode) pin for the serial peripheral interface (SPI). 1.3.4.23 PM3 / SS — Port M I/O Pin 3 PM3 is a general purpose input or output pin and also the slave select pin SS for the serial peripheral interface (SPI). 1.3.4.24 PM2 / MISO — Port M I/O Pin 2 PM2 is a general purpose input or output pin and also the master input (during master mode) or slave output (during slave mode) pin for the serial peripheral interface (SPI). 1.3.4.25 PM1 / TXCAN — Port M I/O Pin 1 PM1 is a general purpose input or output pin and the transmit pin, TXCAN, of the CAN module if available. 1.3.4.26 PM0 / RXCAN — Port M I/O Pin 0 PM0isageneralpurposeinputoroutputpinandthereceivepin,RXCAN,oftheCANmoduleifavailable. 54 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.3.4.27 PS[3:2] — Port S I/O Pins [3:2] PS3 and PS2 are general purpose input or output pins. These pins are not available in the 48- / 52-pin package versions. 1.3.4.28 PS1 / TXD — Port S I/O Pin 1 PS1isageneralpurposeinputoroutputpinandthetransmitpin,TXD,ofserialcommunicationinterface (SCI). 1.3.4.29 PS0 / RXD — Port S I/O Pin 0 PS0isageneralpurposeinputoroutputpinandthereceivepin,RXD,ofserialcommunicationinterface (SCI). 1.3.4.30 PT[7:5] / IOC[7:5] — Port T I/O Pins [7:5] PT7–PT5aregeneralpurposeinputoroutputpins.Theycanalsobeconfiguredasthetimersysteminput capture or output compare pins IOC7-IOC5. 1.3.4.31 PT[4:0] / IOC[4:0] / PW[4:0]— Port T I/O Pins [4:0] PT4–PT0aregeneralpurposeinputoroutputpins.Theycanalsobeconfiguredasthetimersysteminput capture or output compare pins IOC[n] or as the PWM outputs PW[n]. 1.3.5 Power Supply Pins 1.3.5.1 V ,V — Power and Ground Pins for I/O Drivers DDX SSX ExternalpowerandgroundforI/Odrivers.BypassrequirementsdependonhowheavilytheMCUpinsare loaded. 1.3.5.2 V , V — Power and Ground Pins for I/O Drivers and for Internal DDR SSR Voltage Regulator External power and ground for the internal voltage regulator. Connecting V to ground disables the DDR internal voltage regulator. 1.3.5.3 V , V , V , V — Internal Logic Power Pins DD1 DD2 SS1 SS2 PowerissuppliedtotheMCUthroughV andV .This2.5Vsupplyisderivedfromtheinternalvoltage DD SS regulator.Thereisnostaticloadonthosepinsallowed.Theinternalvoltageregulatoristurnedoff,ifV DDR is tied to ground. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 55 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.3.5.4 V , V — Power Supply Pins for ATD and VREG DDA SSA V ,V arethepowersupplyandgroundinputpinsforthevoltageregulatorreferenceandtheanalog DDA SSA to digital converter. 1.3.5.5 V , V — ATD Reference Voltage Input Pins RH RL V and V are the reference voltage input pins for the analog to digital converter. RH RL 1.3.5.6 V , V — Power Supply Pins for PLL DDPLL SSPLL Provides operating voltage and ground for the oscillator and the phased-locked loop. This allows the supplyvoltagetotheoscillatorandPLLtobebypassedindependently.This2.5Vvoltageisgeneratedby the internal voltage regulator. Table1-6. Power and Ground Connection Summary Nominal Mnemonic Description Voltage (V) V 2.5 Internalpowerandgroundgeneratedbyinternalregulator.Thesealsoallowanexternalsource DD1, VDD2 to supply the core V /V voltages and bypass the internal voltage regulator. DD SS V 0 SS1, VSS2 In the 48 and 52 LQFP packages V and V are not available. DD2 SS2 V 5.0 External power and ground, supply to internal voltage regulator. DDR V 0 SSR V 5.0 External power and ground, supply to pin drivers. DDX V 0 SSX V 5.0 Operating voltage and ground for the analog-to-digital converters and the reference for the DDA internal voltage regulator, allows the supply voltage to the A/D to be bypassed independently. V 0 SSA V 5.0 Reference voltage low for the ATD converter. RH VRL 0 In the 48 and 52 LQFP packages VRL is bonded to VSSA. V 2.5 Providesoperatingvoltageandgroundforthephased-lockedloop.Thisallowsthesupplyvoltage DDPLL to the PLL to be bypassed independently. Internal power and ground generated by internal VSSPLL 0 regulator. NOTE All V pins must be connected together in the application. Because fast SS signal transitions place high, short-duration current demands on the power supply,usebypasscapacitorswithhigh-frequencycharacteristicsandplace them as close to the MCU as possible. Bypass requirements depend on MCU pin load. 56 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.4 System Clock Description The clock and reset generator provides the internal clock signals for the core and all peripheral modules. Figure1-14 shows the clock connections from the CRG to all modules. Consult the CRG Block User Guide for details on clock generation. S12_CORE Core Clock Flash RAM TIM ATD PIM EXTAL SCI SPI Bus Clock CRG MSCAN Oscillator Clock Not on 9S12GC XTAL VREG TPM Figure1-14. Clock Connections 1.5 Modes of Operation Eightpossiblemodesdeterminethedeviceoperatingconfiguration.Eachmodehasanassociateddefault memory map and external bus configuration controlled by a further pin. Three low power modes exist for the device. 1.5.1 Chip Configuration Summary TheoperatingmodeoutofresetisdeterminedbythestatesoftheMODC,MODB,andMODApinsduring reset. The MODC, MODB, and MODA bits in the MODE register show the current operating mode and providelimitedmodeswitchingduringoperation.ThestatesoftheMODC,MODB,andMODApinsare latchedintothesebitsontherisingedgeoftheresetsignal.TheROMCTLsignalallowsthesettingofthe ROMONbitintheMISCregisterthuscontrollingwhethertheinternalFlashisvisibleinthememorymap. ROMON=1meantheFlashisvisibleinthememorymap.ThestateoftheROMCTLpinislatchedinto the ROMON bit in the MISC register on the rising edge of the reset signal. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 57 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Table1-7. Mode Selection BKGD = PE6 = PE5 = PP6 = ROMON Mode Description MODC MODB MODA ROMCTL Bit SpecialSingleChip,BDMallowedandACTIVE.BDMisallowedin 0 0 0 X 1 all other modes but a serial command is required to make BDM active. 0 1 Emulation Expanded Narrow, BDM allowed 0 0 1 1 0 0 1 0 X 0 Special Test (Expanded Wide), BDM allowed 0 1 Emulation Expanded Wide, BDM allowed 0 1 1 1 0 1 0 0 X 1 Normal Single Chip, BDM allowed 0 0 Normal Expanded Narrow, BDM allowed 1 0 1 1 1 Peripheral; BDM allowed but bus operations would cause bus 1 1 0 X 1 conflicts (must not be used) 0 0 Normal Expanded Wide, BDM allowed 1 1 1 1 1 For further explanation on the modes refer to the S12_MEBI block guide. Table1-8. Clock Selection Based on PE7 PE7 =XCLKS Description 1 Colpitts Oscillator selected 0 Pierce Oscillator/external clock selected 1.5.2 Security The device will make available a security feature preventing the unauthorized read and write of the memory contents. This feature allows: • Protection of the contents of FLASH, • Operation in single-chip mode, • Operation from external memory with internal FLASH disabled. The user must be reminded that part of the security must lie with the user’s code. An extreme example wouldbeuser’scodethatdumpsthecontentsoftheinternalprogram.Thiscodewoulddefeatthepurpose ofsecurity.Atthesametimetheusermayalsowishtoputabackdoorintheuser’sprogram.Anexample of this is the user downloads a key through the SCI which allows access to a programming routine that updates parameters. 1.5.2.1 Securing the Microcontroller Once the user has programmed the FLASH, the part can be secured by programming the security bits locatedintheFLASHmodule.Thesenon-volatilebitswillkeepthepartsecuredthroughresettingthepart and through powering down the part. 58 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) The security byte resides in a portion of the Flash array. Check the Flash Block User Guide for more details on the security configuration. 1.5.2.2 Operation of the Secured Microcontroller 1.5.2.2.1 Normal Single Chip Mode Thiswillbethemostcommonusageofthesecuredpart.Everythingwillappearthesameasifthepartwas not secured with the exception of BDM operation. The BDM operation will be blocked. 1.5.2.2.2 Executing from External Memory The user may wish to execute from external space with a secured microcontroller. This is accomplished byresettingdirectlyintoexpandedmode.TheinternalFLASHwillbedisabled.BDMoperationswillbe blocked. 1.5.2.3 Unsecuring the Microcontroller Inordertounsecurethemicrocontroller,theinternalFLASHmustbeerased.Thiscanbedonethroughan externalprograminexpandedmodeorviaasequenceofBDMcommands.Unsecuringisalsopossiblevia the Backdoor Key Access. Refer to Flash Block Guide for details. Once the user has erased the FLASH, the part can be reset into special single chip mode. This invokes a programthatverifiestheerasureoftheinternalFLASH.Oncethisprogramcompletes,theusercanerase andprogramtheFLASHsecuritybitstotheunsecuredstate.ThisisgenerallydonethroughtheBDM,but theusercouldalsochangetoexpandedmode(bywritingthemodebitsthroughtheBDM)andjumpingto anexternalprogram(againthroughBDMcommands).Notethatifthepartgoesthrougharesetbeforethe security bits are reprogrammed to the unsecure state, the part will be secured again. 1.5.3 Low-Power Modes The microcontroller features three main low power modes. Consult the respective Block User Guide for information on the module behavior in stop, pseudo stop, and wait mode. An important source of information about the clock system is the Clock and Reset Generator User Guide (CRG). 1.5.3.1 Stop ExecutingtheCPUSTOPinstructionstopsallclocksandtheoscillatorthusputtingthechipinfullystatic mode. Wake up from this mode can be done via reset or external interrupts. 1.5.3.2 Pseudo Stop This mode is entered by executing the CPU STOP instruction. In this mode the oscillator is still running and the real time interrupt (RTI) or watchdog (COP) sub module can stay active. Other peripherals are turnedoff.Thismodeconsumesmorecurrentthanthefullstopmode,butthewakeuptimefromthismode is significantly shorter. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 59 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.5.3.3 Wait This mode is entered by executing the CPU WAI instruction. In this mode the CPU will not execute instructions. The internal CPU signals (address and data bus) will be fully static. All peripherals stay active.Forfurtherpowerconsumptionreductiontheperipheralscanindividuallyturnofftheirlocalclocks. 1.5.3.4 Run Althoughthisisnotalow-powermode,unusedperipheralmodulesshouldnotbeenabledinordertosave power. 1.6 Resets and Interrupts Consult the Exception Processing section of the CPU12 Reference Manual for information. 1.6.1 Vectors Table1-9 lists interrupt sources and vectors in default order of priority. Table1-9. Interrupt Vector Locations CCR HPRIO Value Vector Address Interrupt Source Local Enable Mask to Elevate External reset, power on reset, or low voltage reset 0xFFFE, 0xFFFF None None — (see CRG flags register to determine reset source) 0xFFFC, 0xFFFD Clock monitor fail reset None COPCTL (CME, FCME) — 0xFFFA, 0xFFFB COP failure reset None COP rate select — 0xFFF8, 0xFFF9 Unimplemented instruction trap None None — 0xFFF6, 0xFFF7 SWI None None — 0xFFF4, 0xFFF5 XIRQ X-Bit None — 0xFFF2, 0xFFF3 IRQ I bit INTCR (IRQEN) 0x00F2 0xFFF0, 0xFFF1 Real time Interrupt I bit CRGINT (RTIE) 0x00F0 0xFFEE, 0xFFEF Standard timer channel 0 I bit TIE (C0I) 0x00EE 0xFFEC, 0xFFED Standard timer channel 1 I bit TIE (C1I) 0x00EC $FFEE, $FFEF Reserved $FFEC, $FFED Reserved 0xFFEA, 0xFFEB Standard timer channel 2 I bit TIE (C2I) 0x00EA 0xFFE8, 0xFFE9 Standard timer channel 3 I bit TIE (C3I) 0x00E8 0xFFE6, 0xFFE7 Standard timer channel 4 I bit TIE (C4I) 0x00E6 0xFFE4, 0xFFE5 Standard timer channel 5 I bit TIE (C5I) 0x00E4 0xFFE2, 0xFFE3 Standard timer channel 6 I bit TIE (C6I) 0x00E2 0xFFE0, 0xFFE1 Standard timer channel 7 I bit TIE (C7I) 0x00E0 60 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Table1-9. Interrupt Vector Locations (continued) CCR HPRIO Value Vector Address Interrupt Source Local Enable Mask to Elevate 0xFFDE, 0xFFDF Standard timer overflow I bit TMSK2 (TOI) 0x00DE 0xFFDC, 0xFFDD Pulse accumulator A overflow I bit PACTL (PAOVI) 0x00DC 0xFFDA, 0xFFDB Pulse accumulator input edge I bit PACTL (PAI) 0x00DA 0xFFD8, 0xFFD9 SPI I bit SPICR1 (SPIE, SPTIE) 0x00D8 SCICR2 0xFFD6, 0xFFD7 SCI I bit 0x00D6 (TIE, TCIE, RIE, ILIE) 0xFFD4, 0xFFD5 Reserved 0xFFD2, 0xFFD3 ATD I bit ATDCTL2 (ASCIE) 0x00D2 0xFFD0, 0xFFD1 Reserved 0xFFCE, 0xFFCF Port J I bit PIEP (PIEP7-6) 0x00CE 0xFFCC, 0xFFCD Reserved 0xFFCA, 0xFFCB Reserved 0xFFC8, 0xFFC9 Reserved 0xFFC6, 0xFFC7 CRG PLL lock I bit PLLCR (LOCKIE) 0x00C6 0xFFC4, 0xFFC5 CRG self clock mode I bit PLLCR (SCMIE) 0x00C4 0xFFBA to 0xFFC3 Reserved 0xFFB8, 0xFFB9 FLASH I bit FCNFG (CCIE, CBEIE) 0x00B8 0xFFB6, 0xFFB7 CAN wake-up(1) I bit CANRIER (WUPIE) 0x00B6 0xFFB4, 0xFFB5 CAN errors1 I bit CANRIER (CSCIE, OVRIE) 0x00B4 0xFFB2, 0xFFB3 CAN receive1 I bit CANRIER (RXFIE) 0x00B2 0xFFB0, 0xFFB1 CAN transmit1 I bit CANTIER (TXEIE[2:0]) 0x00B0 0xFF90 to 0xFFAF Reserved 0xFF8E, 0xFF8F Port P I bit PIEP (PIEP7-0) 0x008E 0xFF8C, 0xFF8D Reserved 0xFF8C, 0xFF8D PWM Emergency Shutdown I bit PWMSDN(PWMIE) 0x008C 0xFF8A, 0xFF8B VREG LVI I bit CTRL0 (LVIE) 0x008A 0xFF80 to 0xFF89 Reserved 1. Not available on MC9S12GC Family members Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 61 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.6.2 Resets Resets are a subset of the interrupts featured in Table1-9. The different sources capable of generating a system reset are summarized in Table1-10. When a reset occurs, MCU registers and control bits are changed to known start-up states. Refer to the respective module Block User Guides for register reset states. 1.6.2.1 Reset Summary Table Table1-10. Reset Summary Reset Priority Source Vector Power-on Reset 1 CRG module 0xFFFE, 0xFFFF External Reset 1 RESET pin 0xFFFE, 0xFFFF Low Voltage Reset 1 VREG module 0xFFFE, 0xFFFF Clock Monitor Reset 2 CRG module 0xFFFC, 0xFFFD COP Watchdog Reset 3 CRG module 0xFFFA, 0xFFFB 1.6.2.2 Effects of Reset When a reset occurs, MCU registers and control bits are changed to known start-up states. Refer to the respective module Block User Guides for register reset states. Refer to the HCS12 Multiplexed External BusInterface(MEBI)BlockGuideformodedependentpinconfigurationofportA,BandEoutofreset. Refer to the PIM Block User Guide for reset configurations of all peripheral module ports. RefertoFigure1-2toFigure1-6footnotesforlocationsofthememoriesdependingontheoperatingmode after reset. The RAM array is not automatically initialized out of reset. NOTE For devices assembled in 48-pin or 52-pin LQFP packages all non-bonded outpinsshouldbeconfiguredasoutputsafterresetinordertoavoidcurrent drawn from floating inputs. Refer to Table1-5 for affected pins. 1.7 Device Specific Information and Module Dependencies 1.7.1 PPAGE External paging is not supported on these devices. In order to access the 16K flash blocks in the address range 0x8000–0xBFFF the PPAGE register must be loaded with the corresponding value for this range. Refer to Table1-11 for device specific page mapping. For all devices Flash Page 3F is visible in the 0xC000–0xFFFF range if ROMON is set. For all devices (except MC9S12GC16) Page 3E is also visible in the 0x4000–0x7FFF range if ROMHM is cleared and ROMON is set. For all devices apart from MC9S12C32 Flash Page 3D is visible in the 0x0000–0x3FFF range if ROMON is set... 62 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Table1-11. Device Specific Flash PAGE Mapping Device PAGE PAGE Visible with PPAGE Contents MC9S12GC16 3F $01,$03,$05,$07,$09......$35,$37,$39,$3B,$3D,$3F MC9S12C32 3E $00,$02,$04,$06,$08,$0A,$0C,$0E,$10,$12......$2C,$2E,$30,$32,$34,$36,$38,$3A,$3C,$3E MC9S12GC32 3F $01,$03,$05,$07,$09,$0B,$0D,$0F,$11,$13.....$2D,$2F,$31,$33,$35,$37,$39,$3B,$3D,$3F 3C $04,$0C,$14,$1C,$24,$2C,$34,$3C MC9S12C64 3D $05,$0D,$15,$1D,$25,$2D,$35,$3D MC9S12GC64 3E $06,$0E,$16,$1E,$26,$2E,$36,$3E 3F $07,$0F,$17,$1F,$27,$2F,$37,$3F 3A $02,$0A,$12,$1A,$22,$2A,$32,$3A 3B $03,$0B,$13,$1B,$23,$2B,$33,$3B MC9S12C96 3C $04,$0C,$14,$1C,$24,$2C,$34,$3C MC9S12GC96 3D $05,$0D,$15,$1D,$25,$2D,$35,$3D 3E $06,$0E,$16,$1E,$26,$2E,$36,$3E 3F $07,$0F,$17,$1F,$27,$2F,$37,$3F 38 $00,$08,$10,$18,$20,$28,$30,$38 39 $01,$09,$11,$19,$21,$29,$31,$39 3A $02,$0A,$12,$1A,$22,$2A,$32,$3A MC9S12C128 3B $03,$0B,$13,$1B,$23,$2B,$33,$3B MC9S12GC128 3C $04,$0C,$14,$1C,$24,$2C,$34,$3C 3D $05,$0D,$15,$1D,$25,$2D,$35,$3D 3E $06,$0E,$16,$1E,$26,$2E,$36,$3E 3F $07,$0F,$17,$1F,$27,$2F,$37,$3F 1.7.2 BDM Alternate Clock The BDM section reference to alternate clock is equivalent to the oscillator clock. 1.7.3 Extended Address Range Emulation Implications In order to emulate the MC9S12GC or MC9S12C-Family / MC9S12GC-Family devices, external addressing of a 128K memory map is required. This is provided in a 112 LQFP package version which includes the 3 necessary extra external address bus signals via PortK[2:0]. This package version is for emulation only and not provided as a general production package. The reset state of DDRK is 0x0000, configuring the pins as inputs. The reset state of PUPKE in the PUCR register is “1” enabling the internal Port K pullups. In this reset state the pull-ups provide a defined state and prevent a floating input, thereby preventing unnecessary current flow at the input stage. To prevent unnecessary current flow in production package options, the states of DDRK and PUPKE should not be changed by software. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 63 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.7.4 VREGEN The VREGEN input mentioned in the VREG section is device internal, connected internally to V . DDR 1.7.5 V , V , V , V DD1 DD2 SS1 SS2 Inthe80-pinQFPpackageversions,bothinternalV andV ofthe2.5Vdomainarebondedouton2 DD SS sidesofthedeviceastwopinpairs(V ,V &V ,V ).V andV areconnectedtogether DD1 SS1 DD2 SS2 DD1 DD2 internally.V andV areconnectedtogetherinternally.Theextrapinpairenablessystemsusingthe SS1 SS2 80-pin package to employ better supply routing and further decoupling. 1.7.6 Clock Reset Generator And VREG Interface The low voltage reset feature uses the low voltage reset signal from the VREG module as an input to the CRG module. When the regulator output voltage supply to the internal chip logic falls below a specified threshold the LVR signal from the VREG module causes the CRG module to generate a reset. NOTE IfthevoltageregulatorisshutdownbyconnectingV togroundthenthe DDR LVRF flag in the CRG flags register (CRGFLG) is undefined. 1.7.7 Analog-to-Digital Converter In the 48- and 52-pin package versions, the V pad is bonded internally to the V pin. RL SSA 1.7.8 MODRR Register Port T And Port P Mapping The MODRR register within the PIM allows for mapping of PWM channels to port T in the absence of portP pins for the low pin count packages. For the 80QFP package option it is recommended not to use MODRRsincethisisintendedtosupportPWMchannelavailabilityinlowpincountpackages.Notethat when mapping PWM channels to port T in an 80QFP option, the associated PWM channels are then mapped to both port P and port T. . 1.7.9 Port AD Dependency On PIM And ATD Registers TheportADpinsinterfacetothePIMmodule.However,theportpindigitalstatecanbereadfromeither the PORTAD register in the ATD register map or from the PTAD register in the PIM register map. In order to read a digital pin value from PORTAD the corresponding ATDDIEN bit must be set and the correspondingDDRDAbitcleared.IfthecorrespondingATDDIENbitisclearedthenthepinisconfigured as an analog input and the PORTAD bit reads back as "1". In order to read a digital pin value from PTAD, the corresponding DDRAD bit must be cleared, to configure the pin as an input. Furthermore in order to use a port AD pin as an analog input, the corresponding DDRAD bit must be cleared to configure the pin as an input 64 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 1.8 Recommended Printed Circuit Board Layout The PCB must be carefully laid out to ensure proper operation of the voltage regulator as well as of the MCU itself. The following rules must be observed: • Every supply pair must be decoupled by a ceramic capacitor connected as near as possible to the corresponding pins. • Central point of the ground star should be the V pin. SSR • Use low ohmic low inductance connections between V , V , and V . SS1 SS2 SSR • V must be directly connected to V . SSPLL SSR • Keep traces of V , EXTAL, and XTAL as short as possible and occupied board area for C6, SSPLL C7, C11, and Q1 as small as possible. • Do not place other signals or supplies underneath area occupied by C6, C7, C5, and Q1 and the connection area to the MCU. • Central power input should be fed in at the V /V pins. DDA SSA Table1-12. Recommended Component Values Component Purpose Type Value C1 V filter capacitor Ceramic X7R 220nF, 470nF(1) DD1 C2 V filter capacitor X7R/tantalum >=100nF DDR C3 V filter capacitor Ceramic X7R 100nF DDPLL C4 PLL loop filter capacitor See PLL specification chapter C5 PLL loop filter capacitor C6 OSC load capacitor See PLL specification chapter C7 OSC load capacitor C8 V filter capacitor (80 QFP only) Ceramic X7R 220nF DD2 C9 V filter capacitor Ceramic X7R 100nF DDA C10 V filter capacitor X7R/tantalum >=100nF DDX Colpitts mode only, if recommended by C11 DC cutoff capacitor quartz manufacturer R1 Pierce Mode Select Pullup Pierce Mode Only R2 PLL loop filter resistor See PLL Specification chapter R3 / R PLL loop filter resistor B Pierce mode only R4 / R PLL loop filter resistor S Q1 Quartz — — 1. In 48LQFP and 52LQFP package versions, V is not available. Thus 470nF must be connected to DD2 V . DD1 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 65 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Figure1-15. Recommended PCB Layout (48 LQFP) Colpitts Oscillator 66 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Figure1-16. Recommended PCB Layout (52 LQFP) Colpitts Oscillator Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 67 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Figure1-17. Recommended PCB Layout (80 QFP) Colpitts Oscillator 68 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Figure1-18. Recommended PCB Layout for 48 LQFP Pierce Oscillator Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 69 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Figure1-19. Recommended PCB Layout for 52 LQFP Pierce Oscillator 70 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) Figure1-20. Recommended PCB Layout for 80QFP Pierce Oscillator Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 71 Rev 01.24

Chapter1 MC9S12C and MC9S12GC Device Overview (MC9S12C128) 72 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 2 Port Integration Module (PIM9C32) Block Description 2.1 Introduction ThePortIntegrationModuleestablishestheinterfacebetweentheperipheralmodulesandtheI/Opinsfor all ports. This chapter covers: • Port A, B, and E related to the core logic and the multiplexed bus interface • PortT connected to the TIM module (PWM module can be routed to port T as well) • PortS connected to the SCI module • Port M associated to the MSCAN and SPI module • Port P connected to the PWM module, external interrupt sources available • Port J pins can be used as external interrupt sources and standard I/O’s The following I/O pin configurations can be selected: • Available on all I/O pins: — Input/output selection — Drive strength reduction — Enable and select of pull resistors • Available on all Port P and Port J pins: — Interrupt enable and status flags The implementation of the Port Integration Module is device dependent. 2.1.1 Features A standard port has the following minimum features: • Input/output selection • 5-V output drive with two selectable drive strength • 5-V digital and analog input • Input with selectable pull-up or pull-down device Optional features: • Open drain for wired-OR connections • Interrupt inputs with glitch filtering Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 73 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.1.2 Block Diagram Figure2-1 is a block diagram of the PIM. Port Integration Module MUX IOC0 PT0 IOC1 PT1 IOC2 PT2 TIM IIOOCC34 ort T PPTT34 P IOC5 PT5 IOC6 PT6 IOC7 PT7 PP0 PWM0 c PP1 gi PWM1 o PP2 PJ6 Port J RQ Logic PWMPPPPWWWWMMMM2345 Interrupt L Port P PPPPPPPP3456 PJ7 I PP7 PS0 PAD0 AN0 SCI RTXXDD ort S PPSS12 PAD1 AN1 P PS3 PAD2 AN2 PPAADD34 A/D AANN34 ATD CAN RTXXCCAANN PPMM01 PPAADD56 AANN56 MMIOSSOI ort M PPMM23 PAD7 AN7 SPI SCK P PM4 SS PM5 PB0 ADDR0/DATA0 PB1 ADDR1/DATA1 PB2 ADDR2/DATA2 PB3 B ADDR3/DATA3 PPBB45 Port AADDDDRR45//DDAATTAA45 BKGD/MODC/TXAIGRHQI PBEK0GD PB6 ADDR6/DATA6 IRQ PE1 PB7 ADDR7/DATA7 R/W PE2 E PA0 ADDR8/DATA8 CORE LSTRB/TAEGCLLOK ort PPEE34 P PA1 ADDR9/DATA9 IPIPE0/MODA PE5 PA2 ADDR10/DATA10 IPIPE1/MODB PE6 PA3 A ADDR11/DATA11 NOACC/XCLKS PE7 PPAA45 Port AADDDDRR1123//DDAATTAA1123 PA6 ADDR14/DATA14 PA7 ADDR15/DATA15 Figure2-1.PIM Block Diagram Note:TheMODRRregisterwithinthePIMallowsformappingofPWMchannelstoPortTintheabsence ofPortPpinsforthelowpincountpackages.Forthe80QFPpackageoptionitisrecommendednottouse MODRRsincethisisintendedtosupportPWMchannelavailabilityinlowpincountpackages.Notethat 74 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description when mapping PWM channels to Port T in an 80QFP option, the associated PWM channels are then mapped to both Port P and Port T. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 75 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.2 Signal Description This section lists and describes the signals that do connect off-chip. Table2-1 shows all pins and their functions that are controlled by the PIM module. If there is more than one function associated to a pin, the priority is indicated by the position in the table from top (highest priority) to down (lowest priority). Table2-1. Pin Functions and Priorities PinFunction Port Pin Name Pin Function Description after Reset Port T PT[7:0] PWM[4:0] PWM outputs (only available if enabled in MODRR register) GPIO IOC[7:0] Standard timer channels GPIO General-purpose I/O Port S PS3 GPIO General-purpose I/O PS2 GPIO General purpose I/O PS1 TXD Serial communication interface transmit pin GPIO General-purpose I/O PS0 RXD Serial communication interface receive pin GPIO General-purpose I/O Port M PM5 SCK SPI clock PM4 MOSI SPI transmit pin PM3 SS SPI slave select line PM2 MISO SPI receive pin PM1 TXCAN MSCAN transmit pin PM0 RXCAN MSCAN receive pin Port P PP[7:0] PWM[5:0] PWM outputs GPIO[7:0] General purpose I/O with interrupt PP[6] ROMON ROMON input signal Port J PJ[7:6] GPIO General purpose I/O with interrupt Port AD PAD[7:0] ATD[7:0] ATD analog inputs GPIO[7:0] General purpose I/O Port A PA[7:0] ADDR[15:8]/ Refer to MEBI Block Guide. DATA[15:8]/ GPIO Port B PB[7:0] ADDR[7:0]/ Refer to MEBI Block Guide. DATA[7:0]/ GPIO 76 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description Table2-1. Pin Functions and Priorities (continued) PinFunction Port Pin Name Pin Function Description after Reset NOACC/ PE7 XCLKS/ GPIO IPIPE1/ PE6 MODB/ GPIO IPIPE0/ PE5 MODA/ GPIO Port E Refer to MEBI Block Guide. PE4 ECLK/GPIO LSTRB/ PE3 TAGLO/ GPIO R/W/ PE2 GPIO PE1 IRQ/GPI PE0 XIRQ/GPI 2.3 Memory Map and Registers This section provides a detailed description of all registers. 2.3.1 Module Memory Map Figure2-2 shows the register map of the Port Integration Module. Address Name Bit 7 6 5 4 3 2 1 Bit 0 R PTT7 PTT6 PTT5 PTT4 PTT3 PTT2 PTT1 PTT0 W TIM IOC7 IOC6 IOC5 IOC4 IOC3 IOC2 IOC1 IOC0 0x0000 PTT PWM PWM4 PWM3 PWM2 PWM1 PWM0 R PTIT7 PTIT6 PTIT5 PTIT4 PTIT3 PTIT2 PTIT1 PTIT0 0x0001 PTIT W R 0x0002 DDRT DDRT7 DDRT6 DDRT5 DDRT4 DDRT3 DDRT2 DDRT1 DDRT0 W R 0x0003 RDRT RDRT7 RDRT6 RDRT5 RDRT4 RDRT3 RDRT2 RDRT1 RDRT0 W R 0x0004 PERT PERT7 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 W R 0x0005 PPST PPST7 PPST6 PPST5 PPST4 PPST3 PPST2 PPST1 PPST0 W = Unimplemented or Reserved Figure2-2. Quick Reference to PIM Registers (Sheet 1 of 3) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 77 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description Address Name Bit 7 6 5 4 3 2 1 Bit 0 R 0 0 0 0 0 0 0 0 0x0006 Reserved W R 0 0 0 0x0007 MODRR MODRR4 MODRR3 MODRR2 MODRR1 MODRR0 W R 0 0 0 0 PTS3 PTS2 PTS1 PTS0 0x0008 PTS W SCI — — — — — — TXD RXD R 0 0 0 0 PTIS3 PTIS2 PTIS1 PTIS0 0x0009 PTIS W R 0 0 0 0 0x000A DDRS DDRS3 DDRS2 DDRS1 DDRS0 W R 0 0 0 0 0x000B RDRS RDRS3 RDRS2 RDRS1 RDRS0 W R 0 0 0 0 0x000C PERS PERS3 PERS2 PERS1 PERS0 W R 0 0 0 0 0x000D PPSS PPSS3 PPSS2 PPSS1 PPSS0 W R 0 0 0 0 0x000E WOMS WOMS3 WOMS2 WOMS1 WOMS0 W R 0 0 0 0 0 0 0 0 0x000F Reserved W R 0 0 PTM5 PTM4 PTM3 PTM2 PTM1 PTM0 W 0x0010 PTM MSCAN / — — SCK MOSI SS MISO TXCAN RXCAN SPI R 0 0 PTIM5 PTIM4 PTIM3 PTIM2 PTIM1 PTIM0 0x0011 PTIM W R 0 0 0x0012 DDRM DDRM5 DDRM4 DDRM3 DDRM2 DDRM1 DDRM0 W R 0 0 0x0013 RDRM RDRM5 RDRM4 RDRM3 RDRM2 RDRM1 RDRM0 W R 0 0 0x0014 PERM PERM5 PERM4 PERM3 PERM2 PERM1 PERM0 W R 0 0 0x0015 PPSM PPSM5 PPSM4 PPSM3 PPSM2 PPSM1 PPSM0 W R 0 0 0x0016 WOMM WOMM5 WOMM4 WOMM3 WOMM2 WOMM1 WOMM0 W R 0 0 0 0 0 0 0 0 0x0017 Reserved W R PTP7 PTP6 PTP5 PTP4 PTP3 PTP2 PTP1 PTP0 0x0018 PTP W PWM — — PWM5 PWM4 PWM3 PWM2 PWM1 PWM0 R PTIP7 PTIP6 PTIP5 PTIP4 PTIP3 PTIP2 PTIP1 PTIP0 0x0019 PTIP W = Unimplemented or Reserved Figure2-2. Quick Reference to PIM Registers (Sheet 2 of 3) 78 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description Address Name Bit 7 6 5 4 3 2 1 Bit 0 R 0x001A DDRP DDRP7 DDRP6 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 W R 0x001B RDRP RDRP7 RDRP6 RDRP5 RDRP4 RDRP3 RDRP2 RDRP1 RDRP0 W R 0x001C PERP PERP7 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 W R 0x001D PPSP PPSP7 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSP0 W R 0x001E PIEP PIEP7 PIEP6 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 W R 0x001F PIFP PIFP7 PIFP6 PIFP5 PIFP4 PIFP3 PIFP2 PIFP1 PIFP0 W 0x0020– R 0 0 0 0 0 0 0 0 Reserved 0x0027 W R 0 0 0 0 0 0 0x0028 PTJ PTJ7 PTJ6 W R PTIJ7 PTIJ6 0 0 0 0 0 0 0x0029 PTIJ W R 0 0 0 0 0 0 0x002A DDRJ DDRJ7 DDRJ6 W R 0 0 0 0 0 0 0x002B RDRJ RDRJ7 RDRJ6 W R 0 0 0 0 0 0 0x002C PERJ PERJ7 PERJ6 W R 0 0 0 0 0 0 0x002D PPSJ PPSJ7 PPSJ6 W R 0 0 0 0 0 0 0x002E PIEJ PIEJ7 PIEJ6 W R 0 0 0 0 0 0 0x002F PIFJ PIFJ7 PIFJ6 W R 0x0030 PTAD PTAD7 PTAD6 PTAD5 PTAD4 PTAD3 PTAD2 PTAD1 PTAD0 W R PTIAD7 PTIAD6 PTIAD5 PTIAD4 PTIAD3 PTIAD2 PTIAD1 PTIAD0 0x0031 PTIAD W R 0x0032 DDRAD DDRAD7 DDRAD6 DDRAD5 DDRAD4 DDRAD3 DDRAD2 DDRAD1 DDRAD0 W R 0x0033 RDRAD RDRAD7 RDRAD6 RDRAD5 RDRAD4 RDRAD3 RDRAD2 RDRAD1 RDRAD0 W R 0x0034 PERAD PERAD7 PERAD6 PERAD5 PERAD4 PERAD3 PERAD2 PERAD1 PERAD0 W R 0x0035 PPSAD PPSAD7 PPSAD6 PPSAD5 PPSAD4 PPSAD3 PPSAD2 PPSAD1 PPSAD0 W 0x0036– R 0 0 0 0 0 0 0 0 Reserved 0x003F W = Unimplemented or Reserved Figure2-2. Quick Reference to PIM Registers (Sheet 3 of 3) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 79 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2 Register Descriptions Table2-2 summarizes the effect on the various configuration bits — data direction (DDR), input/output level(I/O),reduceddrive(RDR),pullenable(PE),pullselect(PS),andinterruptenable(IE)fortheports. The configuration bit PS is used for two purposes: 1. Configure the sensitive interrupt edge (rising or falling), if interrupt is enabled. 2. Select either a pull-up or pull-down device if PE is active. Table2-2. Pin Configuration Summary DDR IO RDR PE PS IE(1) Function Pull Device Interrupt 0 X X 0 X 0 Input Disabled Disabled 0 X X 1 0 0 Input Pull up Disabled 0 X X 1 1 0 Input Pull down Disabled 0 X X 0 0 1 Input Disabled Falling edge 0 X X 0 1 1 Input Disabled Rising edge 0 X X 1 0 1 Input Pull up Falling edge 0 X X 1 1 1 Input Pull down rising edge 1 0 0 X X 0 Output, full drive to 0 Disabled Disabled 1 1 0 X X 0 Output, full drive to 1 Disabled Disabled 1 0 1 X X 0 Output, reduced drive to 0 Disabled Disabled 1 1 1 X X 0 Output, reduced drive to 1 Disabled Disabled 1 0 0 X 0 1 Output, full drive to 0 Disabled Falling edge 1 1 0 X 1 1 Output, full drive to 1 Disabled Rising edge 1 0 1 X 0 1 Output, reduced drive to 0 Disabled Falling edge 1 1 1 X 1 1 Output, reduced drive to 1 Disabled Rising edge 1. Applicable only on ports P and J. NOTE Allbitsofallregistersinthismodulearecompletelysynchronoustointernal clocks during a register read. 80 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.1 Port T Registers 2.3.2.1.1 Port T I/O Register (PTT) Module Base + 0x0000 7 6 5 4 3 2 1 0 R PTT7 PTT6 PTT5 PTT4 PTT3 PTT2 PTT1 PTT0 W TIM IOC7 IOC6 IOC5 IOC4 IOC3 IOC2 IOC1 IOC0 PWM PWM4 PWM3 PWM2 PWM1 PWM0 Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-3. Port T I/O Register (PTT) Read: Anytime. Write: Anytime. IfthedatadirectionbitsoftheassociatedI/Opinsaresetto1,areadreturnsthevalueoftheportregister, otherwise the value at the pins is read. If a TIM-channel is defined as output, the related port T is assigned to IOC function. In addition to the possible timer functionality of port T pins PWM channels can be routed to port T. For this the Module Routing Register (MODRR) needs to be configured. Table2-3. Port T[4:0] Pin Functionality Configurations(1) TIMEN[x] MODRR[x] PWME[x] Port T[x] Output (2) 0 0 0 General Purpose I/O 0 0 1 Timer 0 1 0 General Purpose I/O 0 1 1 Timer 1 0 0 General Purpose I/O 1 0 1 Timer 1 1 0 PWM 1 1 1 PWM 1. All fields in the that are not shaded are standard use cases. 2.TIMEN[x]meansthatthetimerisenabled(TSCR1[7]),therelatedchannelis configured for output compare function (TIOS[x] or special output on a timer overflowevent—configurableinTTOV[x])andthetimeroutputisroutedtothe port pin (TCTL1/TCTL2). Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 81 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.1.2 Port T Input Register (PTIT) Module Base + 0x0001 7 6 5 4 3 2 1 0 R PTIT7 PTIT6 PTIT5 PTIT4 PTIT3 PTIT2 PTIT1 PTIT0 W Reset — — — — — — — — = Unimplemented or Reserved Figure2-4. Port T Input Register (PTIT) Read: Anytime. Write: Never, writes to this register have no effect. Table2-4. PTIT Field Descriptions Field Description 7–0 Port T Input Register— This register always reads back the status of the associated pins. This can also be PTIT[7:0] used to detect overload or short circuit conditions on output pins. 2.3.2.1.3 Port T Data Direction Register (DDRT) Module Base + 0x0002 7 6 5 4 3 2 1 0 R DDRT7 DDRT6 DDRT5 DDRT4 DDRT3 DDRT2 DDRT1 DDRT0 W Reset 0 0 0 0 0 0 0 0 Figure2-5. Port T Data Direction Register (DDRT) Read: Anytime. Write: Anytime. Table2-5. DDRT Field Descriptions Field Description 7–0 Data Direction Port T — This register configures each port T pin as either input or output. DDRT[7:0] ThestandardTIM/PWMmodulesforcestheI/OstatetobeanoutputforeachstandardTIM/PWMmoduleport associated with an enabled output compare. In these cases the data direction bits will not change. The DDRT bits revert to controlling the I/O direction of a pin when the associated timer output compare is disabled. The timer input capture always monitors the state of the pin. 0 Associated pin is configured as input. 1 Associated pin is configured as output. Note:Duetointernalsynchronizationcircuits,itcantakeupto2buscyclesuntilthecorrectvalueisreadonPTT or PTIT registers, when changing the DDRT register. 82 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.1.4 Port T Reduced Drive Register (RDRT) Module Base + 0x0003 7 6 5 4 3 2 1 0 R RDRT7 RDRT6 RDRT5 RDRT4 RDRT3 RDRT2 RDRT1 RDRT0 W Reset 0 0 0 0 0 0 0 0 Figure2-6. Port T Reduced Drive Register (RDRT) Read: Anytime. Write: Anytime. Table2-6. RDRT Field Descriptions Field Description 7–0 Reduced Drive Port T — This register configures the drive strength of each port T output pin as either full or RDRT[7:0] reduced. If the port is used as input this bit is ignored. 0 Full drive strength at output. 1 Associated pin drives at about 1/3 of the full drive strength. 2.3.2.1.5 Port T Pull Device Enable Register (PERT) Module Base + 0x0004 7 6 5 4 3 2 1 0 R PERT7 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 W Reset 0 0 0 0 0 0 0 0 Figure2-7. Port T Pull Device Enable Register (PERT) Read: Anytime. Write: Anytime. Table2-7. PERT Field Descriptions Field Description 7–0 Pull Device Enable— This register configures whether a pull-up or a pull-down device is activated, if the port PERT[7:0] is used as input. This bit has no effect if the port is used as output. Out of reset no pull device is enabled. 0 Pull-up or pull-down device is disabled. 1 Either a pull-up or pull-down device is enabled. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 83 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.1.6 Port T Polarity Select Register (PTTST) Module Base + 0x0005 7 6 5 4 3 2 1 0 R PPST7 PPST6 PPST5 PPST4 PPST3 PPST2 PPST1 PPST0 W Reset 0 0 0 0 0 0 0 0 Figure2-8. Port T Polarity Select Register (PPST) Read: Anytime. Write: Anytime. Table2-8. PPST Field Descriptions Field Description 7–0 Pull Select Port T— This register selects whether a pull-down or a pull-up device is connected to the pin. PPST[7:0] 0 A pull-up device is connected to the associated port T pin, if enabled by the associated bit in register PERT and if the port is used as input. 1 Apull-downdeviceisconnectedtotheassociatedportTpin,ifenabledbytheassociatedbitinregisterPERT and if the port is used as input. 2.3.2.1.7 Port T Module Routing Register (MODRR) Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 MODRR4 MODRR3 MODRR2 MODRR1 MODRR0 W Reset — — — 0 0 0 0 0 = Unimplemented or Reserved Figure2-9. Port T Module Routing Register (MODRR) Read: Anytime. Write: Anytime. NOTE MODRR[4] must be kept clear on devices featuring a 4 channel PWM. Table2-9. MODRR Field Descriptions Field Description 4–0 Module Routing Register Port T— This register selects the module connected to port T. MODRR[4:0] 0 Associated pin is connected to TIM module 1 Associated pin is connected to PWM module 84 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.2 Port S Registers 2.3.2.2.1 Port S I/O Register (PTS) Module Base + 0x0008 7 6 5 4 3 2 1 0 R 0 0 0 0 PTS3 PTS2 PTS1 PTS0 W SCI — — — — — — TXD RXD Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-10. Port S I/O Register (PTS) Read: Anytime. Write: Anytime. IfthedatadirectionbitsoftheassociatedI/Opinsaresetto1,areadreturnsthevalueoftheportregister, otherwise the value at the pins is read. The SCI port associated with transmit pin 1 is configured as output if the transmitter is enabled and the SCIpinassociatedwithreceivepin0isconfiguredasinputifthereceiverisenabled.PleaserefertoSCI Block User Guide for details. 2.3.2.2.2 Port S Input Register (PTIS) Module Base + 0x0009 7 6 5 4 3 2 1 0 R 0 0 0 0 PTIS3 PTIS2 PTIS1 PTIS0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-11. Port S Input Register (PTIS) Read: Anytime. Write: Never, writes to this register have no effect. Table2-10. PTIS Field Descriptions Field Description 3–0 Port S Input Register— This register always reads back the status of the associated pins. This also can be PTIS[3:0] used to detect overload or short circuit conditions on output pins. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 85 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.2.3 Port S Data Direction Register (DDRS) Module Base + 0x000A 7 6 5 4 3 2 1 0 R 0 0 0 0 DDRS3 DDRS2 DDRS1 DDRS0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-12. Port S Data Direction Register (DDRS) Read: Anytime. Write: Anytime. Table2-11. DDRS Field Descriptions Field Description 3–0 Direction Register Port S— This register configures each port S pin as either input or output. DDRS[3:0] If the associated SCI transmit or receive channel is enabled this register has no effect on the pins. The pin is forcedtobeanoutputiftheSCItransmitchannelisenabled,itisforcedtobeaninputiftheSCIreceivechannel is enabled. The DDRS bits revert to controlling the I/O direction of a pin when the associated channel is disabled. 0 Associated pin is configured as input. 1 Associated pin is configured as output. Note:Duetointernalsynchronizationcircuits,itcantakeupto2buscyclesuntilthecorrectvalueisreadonPTS or PTIS registers, when changing the DDRS register. 86 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.2.4 Port S Reduced Drive Register (RDRS) Module Base + 0x000B 7 6 5 4 3 2 1 0 R 0 0 0 0 RDRS3 RDRS2 RDRS1 RDRS0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-13. Port S Reduced Drive Register (RDRS) Read: Anytime. Write: Anytime. Table2-12. RDRS Field Descriptions Field Description 3–0 Reduced Drive Port S— This register configures the drive strength of each port S output pin as either full or RDRS[3:0] reduced. If the port is used as input this bit is ignored. 0 Full drive strength at output. 1 Associated pin drives at about 1/3 of the full drive strength. 2.3.2.2.5 Port S Pull Device Enable Register (PERS) Module Base + 0x000C 7 6 5 4 3 2 1 0 R 0 0 0 0 PERS3 PERS2 PERS1 PERS0 W Reset 0 0 0 0 1 1 1 1 = Unimplemented or Reserved Figure2-14. Port S Pull Device Enable Register (PERS) Read: Anytime. Write: Anytime. Table2-13. PERS Field Descriptions Field Description 3–0 ReducedDrivePortS—Thisregisterconfigureswhetherapull-uporapull-downdeviceisactivated,iftheport PERS[3:0] isusedasinputorasoutputinwired-or(opendrain)mode.Thisbithasnoeffectiftheportisusedaspush-pull output. Out of reset a pull-up device is enabled. 0 Pull-up or pull-down device is disabled. 1 Either a pull-up or pull-down device is enabled. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 87 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.2.6 Port S Polarity Select Register (PPSS) Module Base + 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 0 PPSS3 PPSS2 PPSS1 PPSS0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-15. Port S Polarity Select Register (PPSS) Read: Anytime. Write: Anytime. Table2-14. PPSS Field Descriptions Field Description 3–0 Pull Select Port S— This register selects whether a pull-down or a pull-up device is connected to the pin. PPSS[3:0] 0 A pull-up device is connected to the associated port S pin, if enabled by the associated bit in register PERS and if the port is used as input or as wired-or output. 1 Apull-downdeviceisconnectedtotheassociatedportSpin,ifenabledbytheassociatedbitinregisterPERS and if the port is used as input. 2.3.2.2.7 Port S Wired-OR Mode Register (WOMS) Module Base + 0x000E 7 6 5 4 3 2 1 0 R 0 0 0 0 WOMS3 WOMS2 WOMS1 WOMS0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-16. Port S Wired-Or Mode Register (WOMS) Read: Anytime. Write: Anytime. Table2-15. WOMS Field Descriptions Field Description 3–0 Wired-OR Mode Port S— This register configures the output pins as wired-or. If enabled the output is driven WOMS[3:0] active low only (open-drain). A logic level of “1” is not driven. This bit has no influence on pins used as inputs. 0 Output buffers operate as push-pull outputs. 1 Output buffers operate as open-drain outputs. 88 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.3 Port M Registers 2.3.2.3.1 Port M I/O Register (PTM) Module Base + 0x0010 7 6 5 4 3 2 1 0 R 0 0 PTM5 PTM4 PTM3 PTM2 PTM1 PTM0 W MSCAN/ — — SCK MOSI SS MISO TXCAN RXCAN SPI Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-17. Port M I/O Register (PTM) Read: Anytime. Write: Anytime. IfthedatadirectionbitsoftheassociatedI/Opinsaresetto1,areadreturnsthevalueoftheportregister, otherwise the value at the pins is read. TheSPIpinconfigurations(PM[5:2])isdeterminedbyseveralstatusbitsintheSPImodule.Pleaserefer to the SPI Block User Guide for details. 2.3.2.3.2 Port M Input Register (PTIM) Module Base + 0x0011 7 6 5 4 3 2 1 0 R 0 0 PTIM5 PTIM4 PTIM3 PTIM2 PTIM1 PTIM0 W Reset — — — — — — — — = Unimplemented or Reserved Figure2-18. Port M Input Register (PTIM) Read: Anytime. Write: Never, writes to this register have no effect. Table2-16. PTIM Field Descriptions Field Description 5–0 Port M Input Register— This register always reads back the status of the associated pins. This also can be PTIM[5:0] used to detect overload or short circuit conditions on output pins. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 89 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.3.3 Port M Data Direction Register (DDRM) Module Base + 0x0012 7 6 5 4 3 2 1 0 R 0 0 DDRM5 DDRM4 DDRM3 DDRM2 DDRM1 DDRM0 W Reset — — 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-19. Port M Data Direction Register (DDRM) Read: Anytime. Write: Anytime. Table2-17. DDRM Field Descriptions Field Description 5–0 Data Direction Port M— This register configures each port S pin as either input or output DDRM[5:0] IfSPIorMSCANisenabled,theSPIandMSCANmodulesdeterminesthepindirections.PleaserefertotheSPI and MSCAN Block User Guides for details. IftheassociatedSCIorMSCANtransmitorreceivechannelsareenabled,thisregisterhasnoeffectonthepins. ThepinsareforcedtobeoutputsiftheSCIorMSCANtransmitchannelsareenabled,theyareforcedtobeinputs if the SCI or MSCAN receive channels are enabled. The DDRS bits revert to controlling the I/O direction of a pin when the associated channel is disabled. 0 Associated pin is configured as input. 1 Associated pin is configured as output. Note:Duetointernalsynchronizationcircuits,itcantakeupto2buscyclesuntilthecorrectvalueisreadonPTM or PTIM registers, when changing the DDRM register. 90 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.3.4 Port M Reduced Drive Register (RDRM) Module Base + 0x0013 7 6 5 4 3 2 1 0 R 0 0 RDRM5 RDRM4 RDRM3 RDRM2 RDRM1 RDRM0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-20. Port M Reduced Drive Register (RDRM) Read: Anytime. Write: Anytime. Table2-18. RDRM Field Descriptions Field Description 5–0 Reduced Drive Port M— This register configures the drive strength of each port M output pin as either full or RDRM[5:0] reduced. If the port is used as input this bit is ignored. 0 Full drive strength at output. 1 Associated pin drives at about 1/3 of the full drive strength. 2.3.2.3.5 Port M Pull Device Enable Register (PERM) Module Base + 0x0014 7 6 5 4 3 2 1 0 R 0 0 PERM5 PERM4 PERM3 PERM2 PERM1 PERM0 W Reset 0 0 1 1 1 1 1 1 = Unimplemented or Reserved Figure2-21. Port M Pull Device Enable Register (PERM) Read: Anytime. Write: Anytime. Table2-19. PERM Field Descriptions Field Description 5–0 Pull Device Enable Port M— This register configures whether a pull-up or a pull-down device is activated, if PERM[5:0] the port is used as input or as output in wired-or (open drain) mode. This bit has no effect if the port is used as push-pull output. Out of reset a pull-up device is enabled. 0 Pull-up or pull-down device is disabled. 1 Either a pull-up or pull-down device is enabled. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 91 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.3.6 Port M Polarity Select Register (PPSM) Module Base + 0x0015 7 6 5 4 3 2 1 0 R 0 0 PPSM5 PPSM4 PPSM3 PPSM2 PPSM1 PPSM0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-22. Port M Polarity Select Register (PPSM) Read: Anytime. Write: Anytime. Table2-20. PPSM Field Descriptions Field Description 5–0 Polarity Select Port M— This register selects whether a pull-down or a pull-up device is connected to the pin. PPSM[5:0] 0 Apull-updeviceisconnectedtotheassociatedportMpin,ifenabledbytheassociatedbitinregisterPERM and if the port is used as input or as wired-or output. 1 Apull-downdeviceisconnectedtotheassociatedportMpin,ifenabledbytheassociatedbitinregisterPERM and if the port is used as input. 2.3.2.3.7 Port M Wired-OR Mode Register (WOMM) Module Base + 0x0016 7 6 5 4 3 2 1 0 R 0 0 WOMM5 WOMM4 WOMM3 WOMM2 WOMM1 WOMM0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure2-23. Port M Wired-OR Mode Register (WOMM) Read: Anytime. Write: Anytime. Table2-21. WOMM Field Descriptions Field Description 5–0 Wired-OR Mode Port M— This register configures the output pins as wired-or. If enabled the output is driven WOMM[5:0] active low only (open-drain). A logic level of “1” is not driven. This bit has no influence on pins used as inputs. 0 Output buffers operate as push-pull outputs. 1 Output buffers operate as open-drain outputs. 92 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.4 Port P Registers 2.3.2.4.1 Port P I/O Register (PTP) Module Base + 0x0018 7 6 5 4 3 2 1 0 R PTP7 PTP6 PTP5 PTP4 PTP3 PTP2 PTP1 PTP0 W PWM — — PWM5 PWM4 PWM3 PWM2 PWM1 PWM0 Reset 0 0 0 0 0 0 0 0 Figure2-24. Port P I/O Register (PTP) Read: Anytime. Write: Anytime. IfthedatadirectionbitsoftheassociatedI/Opinsaresetto1,areadreturnsthevalueoftheportregister, otherwise the value at the pins is read. 2.3.2.4.2 Port P Input Register (PTIP) Module Base + 0x0019 7 6 5 4 3 2 1 0 R PTIP7 PTIP6 PTIP5 PTIP4 PTIP3 PTIP2 PTIP1 PTIP0 W Reset — — — — — — — — = Unimplemented or Reserved Figure2-25. Port P Input Register (PTIP) Read: Anytime. Write: Never, writes to this register have no effect. Thisregisteralwaysreadsbackthestatusoftheassociatedpins.Thiscanbealsousedtodetectoverload or short circuit conditions on output pins. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 93 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.4.3 Port P Data Direction Register (DDRP) Module Base + 0x001A 7 6 5 4 3 2 1 0 R DDRP7 DDRP6 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 W Reset 0 0 0 0 0 0 0 0 Figure2-26. Port P Data Direction Register (DDRP) Read: Anytime. Write: Anytime. Table2-22. DDRP Field Descriptions Field Description 7–0 Data Direction Port P— This register configures each port P pin as either input or output. DDRP[7:0] 0 Associated pin is configured as input. 1 Associated pin is configured as output. Note:Duetointernalsynchronizationcircuits,itcantakeupto2buscyclesuntilthecorrectvalueisreadonPTP or PTIP registers, when changing the DDRP register. 2.3.2.4.4 Port P Reduced Drive Register (RDRP) Module Base + 0x001B 7 6 5 4 3 2 1 0 R RDRP7 RDRP6 RDRP5 RDRP4 RDRP3 RDRP2 RDRP1 RDRP0 W Reset 0 0 0 0 0 0 0 0 Figure2-27. Port P Reduced Drive Register (RDRP) Read: Anytime. Write: Anytime. Table2-23. RDRP Field Descriptions Field Description 7–0 Reduced Drive Port P— This register configures the drive strength of each port P output pin as either full or RDRP[7:0] reduced. If the port is used as input this bit is ignored. 0 Full drive strength at output. 1 Associated pin drives at about 1/3 of the full drive strength. 94 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.4.5 Port P Pull Device Enable Register (PERP) Module Base + 0x001C 7 6 5 4 3 2 1 0 R PERP7 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 W Reset 0 0 0 0 0 0 0 0 Figure2-28. Port P Pull Device Enable Register (PERP) Read: Anytime. Write: Anytime. Table2-24. PERP Field Descriptions Field Description 7–0 PullDeviceEnablePortP—Thisregisterconfigureswhetherapull-uporapull-downdeviceisactivated,ifthe PERP[7:0] port is used as input. This bit has no effect if the port is used as output. Out of reset no pull device is enabled. 0 Pull-up or pull-down device is disabled. 1 Either a pull-up or pull-down device is enabled. 2.3.2.4.6 Port P Polarity Select Register (PPSP) Module Base + 0x001D 7 6 5 4 3 2 1 0 R PPSP7 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSP0 W Reset 0 0 0 0 0 0 0 0 Figure2-29. Port P Polarity Select Register (PPSP) Read: Anytime. Write: Anytime. Table2-25. PPSP Field Descriptions Field Description 7–0 Pull Select Port P— This register serves a dual purpose by selecting the polarity of the active interrupt edge PPSP[7:0] as well as selecting a pull-up or pull-down device if enabled. 0 Falling edge on the associated port P pin sets the associated flag bit in the PIFP register.A pull-up device is connectedtotheassociatedportPpin,ifenabledbytheassociatedbitinregisterPERPandiftheportisused as input. 1 RisingedgeontheassociatedportPpinsetstheassociatedflagbitinthePIFPregister.Apull-downdevice is connected to the associated port P pin, if enabled by the associated bit in register PERP and if the port is used as input. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 95 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.4.7 Port P Interrupt Enable Register (PIEP) Module Base + 0x001E 7 6 5 4 3 2 1 0 R PIEP7 PIEP6 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 W Reset 0 0 0 0 0 0 0 0 Figure2-30. Port P Interrupt Enable Register (PIEP) Read: Anytime. Write: Anytime. Table2-26. PIEP Field Descriptions Field Description 7–0 Pull Select Port P— This register disables or enables on a per pin basis the edge sensitive external interrupt PIEP[7:0] associated with port P. 0 Interrupt is disabled (interrupt flag masked). 1 Interrupt is enabled. 2.3.2.4.8 Port P Interrupt Flag Register (PIFP) Module Base + 0x001F 7 6 5 4 3 2 1 0 R PIFP7 PIFP6 PIFP5 PIFP4 PIFP3 PIFP2 PIFP1 PIFP0 W Reset 0 0 0 0 0 0 0 0 Figure2-31. Port P Interrupt Flag Register (PIFP) Read: Anytime. Write: Anytime. Table2-27. PIFP Field Descriptions Field Description 7–0 InterruptFlagsPortP—Eachflagissetbyanactiveedgeontheassociatedinputpin.Thiscouldbearising PIFP[7:0] or a falling edge based on the state of the PPSP register. To clear this flag, write a “1” to the corresponding bit in the PIFP register. Writing a “0” has no effect. 0 No active edge pending. Writing a “0” has no effect. 1 Active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set). Writing a “1” clears the associated flag. 96 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.5 Port J Registers 2.3.2.5.1 Port J I/O Register (PTJ) Module Base + 0x0028 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 PTJ7 PTJ6 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-32. Port J I/O Register (PTJ) Read: Anytime. Write: Anytime. IfthedatadirectionbitsoftheassociatedI/Opinsaresetto1,areadreturnsthevalueoftheportregister, otherwise the value at the pins is read. 2.3.2.5.2 Port J Input Register (PTIJ) Module Base + 0x0029 7 6 5 4 3 2 1 0 R PTIJ7 PTIJ6 0 0 0 0 0 0 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-33. Port J Input Register (PTIJ) Read: Anytime. Write: Never, writes to this register have no effect. This register always reads back the status of the associated pins. This can be used to detect overload or short circuit conditions on output pins. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 97 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.5.3 Port J Data Direction Register (DDRJ) Module Base + 0x002A 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 DDRJ7 DDRJ6 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-34. Port J Data Direction Register (DDRJ) Read: Anytime. Write: Anytime. Table2-28. DDRJ Field Descriptions Field Description 7–6 Data Direction Port J— This register configures port pins J[7:6] as either input or output. DDRJ[7:6] DDRJ[7:6] — Data Direction Port J 0 Associated pin is configured as input. 1 Associated pin is configured as output. Note:Duetointernalsynchronizationcircuits,itcantakeupto2buscyclesuntilthecorrectvalueisreadonPTJ or PTIJ registers, when changing the DDRJ register. 2.3.2.5.4 Port J Reduced Drive Register (RDRJ) Module Base + 0x002B 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 RDRJ7 RDRJ6 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-35. Port J Reduced Drive Register (RDRJ) Read: Anytime. Write: Anytime. Table2-29. RDRJ Field Descriptions Field Description 7–6 Reduced Drive Port J— This register configures the drive strength of each port J output pin as either full or RDRJ[7:6] reduced. If the port is used as input this bit is ignored. 0 Full drive strength at output. 1 Associated pin drives at about 1/3 of the full drive strength. 98 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.5.5 Port J Pull Device Enable Register (PERJ) Module Base + 0x002C 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 PERJ7 PERJ6 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-36. Port J Pull Device Enable Register (PERJ) Read: Anytime. Write: Anytime. Table2-30. PERJ Field Descriptions Field Description 7–6 ReducedDrivePortJ—Thisregisterconfigureswhetherapull-uporapull-downdeviceisactivated,iftheport PERJ[7:6] is used as input or as wired-or output. This bit has no effect if the port is used as push-pull output. 0 Pull-up or pull-down device is disabled. 1 Either a pull-up or pull-down device is enabled. 2.3.2.5.6 Port J Polarity Select Register (PPSJ) Module Base + 0x002D 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 PPSJ7 PPSJ6 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-37. Port J Polarity Select Register (PPSJ) Read: Anytime. Write: Anytime. Table2-31. PPSJ Field Descriptions Field Description 7–6 ReducedDrivePortJ—Thisregisterservesadualpurposebyselectingthepolarityoftheactiveinterruptedge PPSJ[7:6] as well as selecting a pull-up or pull-down device if enabled. 0 Falling edge on the associated port J pin sets the associated flag bit in the PIFJ register. A pull-up device is connected to the associated port J pin, if enabled by the associated bit in register PERJ and if the port is used as general purpose input. 1 Rising edge on the associated port J pin sets the associated flag bit in the PIFJ register. Apull-downdeviceisconnectedtotheassociatedportJpin,ifenabledbytheassociatedbitinregisterPERJ and if the port is used as input. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 99 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.5.7 Port J Interrupt Enable Register (PIEJ) Module Base + 0x002E 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 PIEJ7 PIEJ6 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-38. Port J Interrupt Enable Register (PIEJ) Read: Anytime. Write: Anytime. Table2-32. PIEJ Field Descriptions Field Description 7–6 Interrupt Enable Port J— This register disables or enables on a per pin basis the edge sensitive external PIEJ[7:6] interrupt associated with port J. 0 Interrupt is disabled (interrupt flag masked). 1 Interrupt is enabled. 2.3.2.5.8 Port J Interrupt Flag Register (PIFJ) Module Base + 0x002F 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 PIFJ7 PIFJ6 W Reset 0 0 — — — — — — = Unimplemented or Reserved Figure2-39. Port J Interrupt Flag Register (PIFJ) Read: Anytime. Write: Anytime. Table2-33. PIFJ Field Descriptions Field Description 7–6 InterruptFlagsPortJ—Eachflagissetbyanactiveedgeontheassociatedinputpin.Thiscouldbearising PIFJ[7:6] or a falling edge based on the state of the PPSJ register. To clear this flag, write “1” to the corresponding bit in the PIFJ register. Writing a “0” has no effect. 0 No active edge pending. Writing a “0” has no effect. 1 Active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set). Writing a “1” clears the associated flag. 100 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.6 Port AD Registers 2.3.2.6.1 Port AD I/O Register (PTAD) Module Base + 0x0030 7 6 5 4 3 2 1 0 R PTAD7 PTAD6 PTAD5 PTAD4 PTAD3 PTAD2 PTAD1 PTAD0 W Reset 0 0 0 0 0 0 0 0 Figure2-40. Port AD I/O Register (PTAD) Read: Anytime. Write: Anytime. IfthedatadirectionbitsoftheassociatedI/Opinsaresetto1,areadreturnsthevalueoftheportregister, otherwise the value at the pins is read. 2.3.2.6.2 Port AD Input Register (PTIAD) Module Base + 0x0031 7 6 5 4 3 2 1 0 R PTIAD7 PTIAD6 PTIAD5 PTIAD4 PTIAD3 PTIAD2 PTIAD1 PTIAD0 W Reset — — — — — — — — = Unimplemented or Reserved Figure2-41. Port AD Input Register (PTIAD) Read: Anytime. Write: Never, writes to this register have no effect. This register always reads back the status of the associated pins. This can be used to detect overload or short circuit conditions on output pins. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 101 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.6.3 Port AD Data Direction Register (DDRAD) Module Base + 0x0032 7 6 5 4 3 2 1 0 R DDRAD7 DDRAD6 DDRAD5 DDRAD4 DDRAD3 DDRAD2 DDRAD1 DDRAD0 W Reset 0 0 0 0 0 0 0 0 Figure2-42. Port AD Data Direction Register (DDRAD) Read: Anytime. Write: Anytime. Table2-34. DDRAD Field Descriptions Field Description 7–0 Data Direction Port AD— This register configures port pins AD[7:0] as either input or output. DDRAD[7:0] 0 Associated pin is configured as input. 1 Associated pin is configured as output. Note:Due to internal synchronization circuits, it can take up to 2 bus cycles until the correct value is read on PTAD or PTIAD registers, when changing the DDRAD register. 2.3.2.6.4 Port AD Reduced Drive Register (RDRAD) Module Base + 0x0033 7 6 5 4 3 2 1 0 R RDRAD7 RDRAD6 RDRAD5 RDRAD4 RDRAD3 RDRAD2 RDRAD1 RDRAD0 W Reset 0 0 0 0 0 0 0 0 Figure2-43. Port AD Reduced Drive Register (RDRAD) Read: Anytime. Write: Anytime. Table2-35. RDRAD Field Descriptions Field Description 7–0 Reduced Drive Port AD— This register configures the drive strength of each port AD output pin as either full RDRAD[7:0] or reduced. If the port is used as input this bit is ignored. 0 Full drive strength at output. 1 Associated pin drives at about 1/3 of the full drive strength. 102 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.3.2.6.5 Port AD Pull Device Enable Register (PERAD) Module Base + 0x0034 7 6 5 4 3 2 1 0 R PERAD7 PERAD6 PERAD5 PERAD4 PERAD3 PERAD2 PERAD1 PERAD0 W Reset 0 0 0 0 0 0 0 0 Figure2-44. Port AD Pull Device Enable Register (PERAD) Read: Anytime. Write: Anytime. Table2-36. PERAD Field Descriptions Field Description 7–0 PullDeviceEnablePortAD—Thisregisterconfigureswhetherapull-uporapull-downdeviceisactivated,if PERAD[7:0] theportisusedasinput.Thisbithasnoeffectiftheportisusedasoutput.Outofresetnopulldeviceisenabled. It is not possible to enable pull devices when a associated ATD channel is enabled simultaneously. 0 Pull-up or pull-down device is disabled. 1 Either a pull-up or pull-down device is enabled. 2.3.2.6.6 Port AD Polarity Select Register (PPSAD) Module Base + 0x0035 7 6 5 4 3 2 1 0 R PPSAD7 PPSAD6 PPSAD5 PPSAD4 PPSAD3 PPSAD2 PPSAD1 PPSAD0 W Reset 0 0 0 0 0 0 0 0 Figure2-45. Port AD Polarity Select Register (PPSAD) Read: Anytime. Write: Anytime. Table2-37. PPSAD Field Descriptions Field Description 7–0 Pull Select Port AD— This register selects whether a pull-down or a pull-up device is connected to the pin. PPSAD[7:0] 0 Apull-updeviceisconnectedtotheassociatedportADpin,ifenabledbytheassociatedbitinregisterPERAD and if the port is used as input. 1 A pull-down device is connected to the associated port AD pin, if enabled by the associated bit in register PERAD and if the port is used as input. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 103 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.4 Functional Description EachpincanactasgeneralpurposeI/O.Inadditionthepincanactasanoutputfromaperipheralmodule or an input to a peripheral module. Asetofconfigurationregistersiscommontoallports.Allregisterscanbewrittenatanytime,howevera specific configuration might not become active. Example:Selectingapull-upresistor.Thisresistordoesnotbecomeactivewhiletheportisusedasapush- pull output. 2.4.1 Registers 2.4.1.1 I/O Register This register holds the value driven out to the pin if the port is used as a general purpose I/O. Writing to thisregisterhasonlyaneffectonthepiniftheportisusedasgeneralpurposeoutput.Whenreadingthis address, the value of the pins are returned if the data direction register bits are set to 0. Ifthedatadirectionregisterbitsaresetto1,thecontentsoftheI/Oregisterisreturned.Thisisindependent of any other configuration (Figure2-46). PTI 0 1 PAD PT 0 1 DDR 0 1 Data Out Module Output Enable Module Enable Figure2-46. Illustration of I/O Pin Functionality 2.4.1.2 Input Register This is a read-only register and always returns the value of the pin (Figure 2-46). 2.4.1.3 Data Direction Register This register defines whether the pin is used as an input or an output. If a peripheral module controls the pin the contents of the data direction register is ignored (Figure2-46). 104 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.4.1.4 Reduced Drive Register If the port is used as an output the register allows the configuration of the drive strength. 2.4.1.5 Pull Device Enable Register This register turns on a pull-up or pull-down device. It becomes only active if the pin is used as an input or as a wired-or output. 2.4.1.6 Polarity Select Register This register selects either a pull-up or pull-down device if enabled. It becomes only active if the pin is used as an input. A pull-up device can be activated if the pin is used as a wired-OR output. 2.4.2 Port Descriptions 2.4.2.1 Port T ThisportisassociatedwiththeStandardCaptureTimer.PWMoutputchannelscanbereroutedfromport P to port pins T. In all modes, port T pins can be used for either general-purpose I/O, Standard Capture Timer I/O or as PWM channels module, if so configured by MODRR. During reset, port T pins are configured as high-impedance inputs. 2.4.2.2 Port S This port is associated with the serial SCI module. Port S pins PS[3:0] can be used either for general- purpose I/O, or with the SCI subsystem. During reset, port S pins are configured as inputs with pull-up. 2.4.2.3 Port M This port is associated with the MSCAN and SPI module. Port M pins PM[5:0] can be used either for general-purpose I/O, with the MSCAN or SPI subsystems. During reset, port M pins are configured as inputs with pull-up. 2.4.2.4 Port AD ThisportisassociatedwiththeATDmodule.PortADpinscanbeusedeitherforgeneral-purposeI/O,or fortheATDsubsystem.Thereare2dataportregistersassociatedwiththePortAD:PTAD[7:0],located in the PIM and PORTAD[7:0] located in the ATD. TousePTAD[n]asastandardinputport,thecorrespondingDDRD[n]mustbecleared.TousePTAD[n] as a standard output port, the corresponding DDRD[n] must be set NOTE:TousePORTAD[n],locatedintheATDasaninputportregister,DDRD[n]mustbeclearedand ATDDIEN[n] must be set. Please refer to ATD Block Guide for details. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 105 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description 2.4.2.5 Port P The PWM module is connected to port P. Port P pins can be used as PWM outputs. Further the Keypad Wake-Up function is implemented on pins PP[7:0]. During reset, port P pins are configured as high- impedance inputs. PortPoffers8generalpurposeI/Opinswithedgetriggeredinterruptcapabilityinwired-orfashion.The interrupt enable as well as the sensitivity to rising or falling edges can be individually configured on per pin basis. All 8 bits/pins share the same interrupt vector. Interrupts can be used with the pins configured as inputs or outputs. Aninterruptisgeneratedwhenabitintheportinterruptflagregisteranditscorrespondingportinterrupt enable bit are both set. This external interrupt feature is capable to wake up the CPU when it is in STOP or WAIT mode. Adigitalfilteroneachpinpreventspulses(Figure2-48)shorterthanaspecifiedtimefromgeneratingan interrupt. The minimum time varies over process conditions, temperature and voltage (Figure2-47 and Table2-38). Glitch, filtered out, no interrupt flag set Valid pulse, interrupt flag set t pign t pval Figure2-47. Interrupt Glitch Filter on Port P and J (PPS = 0) Table2-38.Pulse Detection Criteria STOP Mode STOP(1) Mode Pulse Value Unit Value Unit Ignored t <= 3 Bus clocks t <= 3.2 µs pign pign Uncertain 3 < t < 4 Bus clocks 3.2 < t < 10 µs pulse pulse Valid t >= 4 Bus clocks t >= 10 µs pval pval 1. These values include the spread of the oscillator frequency over temperature, voltage and process. t pulse Figure2-48. Pulse Illustration 106 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description Avalidedgeoninputisdetectedif4consecutivesamplesofapassivelevelarefollowedby4consecutive samples of an active level directly or indirectly. ThefiltersarecontinuouslyclockedbythebusclockinRUNandWAITmode.InSTOPmodetheclock isgeneratedbyasingleRCoscillatorinthePortIntegrationModule.TomaximizecurrentsavingtheRC oscillator runs only if the following condition is true on any pin: Sample count <= 4 and port interrupt enabled (PIE=1) and port interrupt flag not set (PIF=0). 2.4.2.6 Port J In all modes, port J pins PJ[7:6] can be used for general purpose I/O or interrupt driven general purpose I/O’s. During reset, port J pins are configured as inputs. Port J offers 2 I/O ports with the same interrupt features as on port P. 2.4.3 Port A, B, E and BKGD Pin Allportandpinlogicislocatedinthecoremodule.PleaserefertoS12_mebiBlockUserGuidefordetails. 2.4.4 External Pin Descriptions All ports start up as general purpose inputs on reset. 2.4.5 Low Power Options 2.4.5.1 Run Mode No low power options exist for this module in run mode. 2.4.5.2 Wait Mode No low power options exist for this module in wait mode. 2.4.5.3 Stop Mode All clocks are stopped. There are asynchronous paths to generate interrupts from STOP on port P and J. 2.5 Initialization Information The reset values of all registers are given inSection2.3.2, “Register Descriptions”. 2.5.1 Reset Initialization All registers including the data registers get set/reset asynchronously.Table 2-39 summarizes the port properties after reset initialization. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 107 Rev 01.24

Chapter2 Port Integration Module (PIM9C32) Block Description Table2-39. Port Reset State Summary Reset States Port Data Direction Pull Mode Reduced Drive Wired-OR Mode Interrupt T Input Hi-z Disabled n/a n/a S Input Pull up Disabled Disabled n/a M Input Pull up Disabled Disabled n/a P Input Hi-z Disabled n/a Disabled J Input Hi-z Disabled n/a Disabled A B Refer to MEBI Block Guide for details. E BKGD pin Refer to BDM Block Guide for details. 2.6 Interrupts Port P and J generate a separate edge sensitive interrupt if enabled. 2.6.1 Interrupt Sources Table2-40. Port Integration Module Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Port P PIFP[7:0] PIEP[7:0] I Bit Port J PIFJ[7:6] PIEJ[7:6] I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 2.6.2 Recovery from STOP The PIM can generate wake-up interrupts from STOP on port P and J. For other sources of external interrupts please refer to the respective Block User Guide. 2.7 Application Information ItisnotrecommendedtowritePORTxandDDRxinawordaccess.Whenchangingtheregisterpinsfrom inputstooutputs,thedatamayhaveextratransitionsduringthewriteaccess.Initializetheportdataregister before enabling the outputs. Power consumption will increase the more the voltages on general purpose input pins deviate from the supply voltages towards mid-range because the digital input buffers operate in the linear region. 108 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 3 Module Mapping Control (MMCV4) Block Description 3.1 Introduction Thissectiondescribesthefunctionalityofthemodulemappingcontrol(MMC)sub-blockoftheS12core platform. The block diagram of the MMC is shown in Figure3-1. MMC MMC_SECURE SECURE BDM_UNSECURE SECURITY STOP, WAIT ADDRESS DECODE READ & WRITE ENABLES REGISTERS CLOCKS, RESET PORT K INTERFACE INTERNAL MEMORY MODE INFORMATION EXPANSION MEMORY SPACE SELECT(S) PERIPHERAL SELECT EBI ALTERNATE ADDRESS BUS CORE SELECT (S) EBI ALTERNATE WRITE DATA BUS EBI ALTERNATE READ DATA BUS ALTERNATE ADDRESS BUS (BDM) CPU ADDRESS BUS BUS CONTROL ALTERNATE WRITE DATA BUS (BDM) CPU READ DATA BUS ALTERNATE READ DATA BUS (BDM) CPU WRITE DATA BUS CPU CONTROL Figure3-1. MMC Block Diagram TheMMCisthesub-modulewhichcontrolsmemorymapassignmentandselectionofinternalresources andexternalspace.Internalbusesbetweenthecoreandmemoriesandbetweenthecoreandperipheralsis controlled in this module. The memory expansion is generated in this module. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 109 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.1.1 Features • Registers for mapping of address space for on-chip RAM, EEPROM, and FLASH (or ROM) memory blocks and associated registers • Memory mapping control and selection based upon address decode and system operating mode • Core address bus control • Core data bus control and multiplexing • Core security state decoding • Emulation chip select signal generation (ECS) • External chip select signal generation (XCS) • Internal memory expansion • External stretch and ROM mapping control functions via the MISC register • Reserved registers for test purposes • Configurable system memory options defined at integration of core into the system-on-a-chip (SoC). 3.1.2 Modes of Operation Someoftheregistersoperatedifferentlydependingonthemodeofoperation(i.e.,normalexpandedwide, special single chip, etc.). This is best understood from the register descriptions. 3.2 External Signal Description All interfacing with the MMC sub-block is done within the core, it has no external signals. 3.3 Memory Map and Register Definition A summary of the registers associated with the MMC sub-block is shown in Figure 3-2. Detailed descriptions of the registers and bits are given in the subsections that follow. 3.3.1 Module Memory Map Table3-1. MMC Memory Map Address Register Access Offset 0x0010 Initialization of Internal RAM Position Register (INITRM) R/W 0x0011 Initialization of Internal Registers Position Register (INITRG) R/W 0x0012 Initialization of Internal EEPROM Position Register (INITEE) R/W 0x0013 Miscellaneous System Control Register (MISC) R/W 0x0014 Reserved — . . — . . 110 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description Table3-1. MMC Memory Map (continued) Address Register Access Offset 0x0017 Reserved — . . — . . 0x001C Memory Size Register 0 (MEMSIZ0) R 0x001D Memory Size Register 1 (MEMSIZ1) R . . . . 0x0030 Program Page Index Register (PPAGE) R/W 0x0031 Reserved — Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 111 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.3.2 Register Descriptions Name Bit 7 6 5 4 3 2 1 Bit 0 0x0010 R 0 0 RAM15 RAM14 RAM13 RAM12 RAM11 RAMHAL INITRM W 0x0011 R 0 0 0 0 REG14 REG13 REG12 REG11 INITRG W 0x0012 R 0 0 EE15 EE14 EE13 EE12 EE11 EEON INITEE W 0x0013 R 0 0 0 0 EXSTR1 EXSTR0 ROMHM ROMON MISC W 0x0014 R Bit 7 6 5 4 3 2 1 Bit 0 MTSTO W 0x0017 R Bit 7 6 5 4 3 2 1 Bit 0 MTST1 W 0x001C R REG_SW0 0 EEP_SW1 EEP_SW0 0 RAM_SW2 RAM_SW1 RAM_SW0 MEMSIZ0 W 0x001D R ROM_SW1 ROM_SW0 0 0 0 0 PAG_SW1 PAG_SW0 MEMSIZ1 W 0x0030 R 0 0 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 PPAGE W 0x0031 R 0 0 0 0 0 0 0 0 Reserved W = Unimplemented Figure3-2. MMC Register Summary 112 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.3.2.1 Initialization of Internal RAM Position Register (INITRM) Module Base + 0x0010 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 RAM15 RAM14 RAM13 RAM12 RAM11 RAMHAL W Reset 0 0 0 0 1 0 0 1 = Unimplemented or Reserved Figure3-3. Initialization of Internal RAM Position Register (INITRM) Read: Anytime Write: Once in normal and emulation modes, anytime in special modes NOTE Writes to this register take one cycle to go into effect. This register initializes the position of the internal RAM within the on-chip system memory map. Table3-2. INITRM Field Descriptions Field Description 7:3 Internal RAM Map Position — These bits determine the upper five bits of the base address for the system’s RAM[15:11] internal RAM array. 0 RAM High-Align— RAMHAL specifies the alignment of the internal RAM array. RAMHAL 0 Aligns the RAM to the lowest address (0x0000) of the mappable space 1 Aligns the RAM to the higher address (0xFFFF) of the mappable space Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 113 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.3.2.2 Initialization of Internal Registers Position Register (INITRG) Module Base + 0x0011 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 REG14 REG13 REG12 REG11 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure3-4. Initialization of Internal Registers Position Register (INITRG) Read: Anytime Write: Once in normal and emulation modes and anytime in special modes Thisregisterinitializesthepositionoftheinternalregisterswithintheon-chipsystemmemorymap.The registersoccupyeithera1Kbyteor2Kbytespaceandcanbemappedtoany2Kbytespacewithinthefirst 32K bytes of the system’s address space. Table3-3. INITRG Field Descriptions Field Description 6:3 Internal Register Map Position — These four bits in combination with the leading zero supplied by bit 7 of REG[14:11] INITRG determine the upper five bits of the base address for the system’s internal registers (i.e., the minimum base address is 0x0000 and the maximum is 0x7FFF). 114 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.3.2.3 Initialization of Internal EEPROM Position Register (INITEE) Module Base + 0x0012 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 EE15 EE14 EE13 EE12 EE11 EEON W Reset1 — — — — — — — — 1. The reset state of this register is controlled at chip integration. Please refer to the device overview section to determine the actual reset state of this register. = Unimplemented or Reserved Figure3-5. Initialization of Internal EEPROM Position Register (INITEE) Read: Anytime Write: The EEON bit can be written to any time on all devices. Bits E[11:15] are “write anytime in all modes”onmostdevices.Onsomedevices,bitsE[11:15]are“writeonceinnormalandemulationmodes and write anytime in special modes”. See device overview chapter to determine the actual write access rights. NOTE Writes to this register take one cycle to go into effect. This register initializes the position of the internal EEPROM within the on-chip system memory map. Table3-4. INITEE Field Descriptions Field Description 7:3 InternalEEPROMMapPosition—Thesebitsdeterminetheupperfivebitsofthebaseaddressforthesystem’s EE[15:11] internal EEPROM array. 0 Enable EEPROM — This bit is used to enable the EEPROM memory in the memory map. EEON 0 Disables the EEPROM from the memory map. 1 Enables the EEPROM in the memory map at the address selected by EE[15:11]. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 115 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.3.2.4 Miscellaneous System Control Register (MISC) Module Base + 0x0013 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 EXSTR1 EXSTR0 ROMHM ROMON W Reset: Expanded 0 0 0 0 1 1 0 —1 or Emulation Reset: Peripheral 0 0 0 0 1 1 0 1 or Single Chip Reset: Special Test 0 0 0 0 1 1 0 0 1. The reset state of this bit is determined at the chip integration level. = Unimplemented or Reserved Figure3-6. Miscellaneous System Control Register (MISC) Read: Anytime Write: As stated in each bit description NOTE Writes to this register take one cycle to go into effect. This register initializes miscellaneous control functions. Table3-5. INITEE Field Descriptions Field Description 3:2 External Access Stretch Bits 1 and 0 EXSTR[1:0] Write: once in normal and emulation modes and anytime in special modes Thistwo-bitfielddeterminestheamountofclockstretchonaccessestotheexternaladdressspaceasshownin Table3-6. In single chip and peripheral modes these bits have no meaning or effect. 1 FLASH EEPROM or ROM Only in Second Half of Memory Map ROMHM Write: once in normal and emulation modes and anytime in special modes 0 The fixed page(s) of FLASH EEPROM or ROM in the lower half of the memory map can be accessed. 1 DisablesdirectaccesstotheFLASHEEPROMorROMinthelowerhalfofthememorymap.Thesephysical locations of the FLASH EEPROM or ROM remain accessible through the program page window. 0 ROMON — Enable FLASH EEPROM or ROM ROMON Write: once in normal and emulation modes and anytime in special modes This bit is used to enable the FLASH EEPROM or ROM memory in the memory map. 0 Disables the FLASH EEPROM or ROM from the memory map. 1 Enables the FLASH EEPROM or ROM in the memory map. 116 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description Table3-6. External Stretch Bit Definition Stretch Bit EXSTR1 Stretch Bit EXSTR0 Number of E Clocks Stretched 0 0 0 0 1 1 1 0 2 1 1 3 3.3.2.5 Reserved Test Register 0 (MTST0) Module Base + 0x0014 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure3-7. Reserved Test Register 0 (MTST0) Read: Anytime Write: No effect — this register location is used for internal test purposes. 3.3.2.6 Reserved Test Register 1 (MTST1) Module Base + 0x0017 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 1 0 0 0 0 = Unimplemented or Reserved Figure3-8. Reserved Test Register 1 (MTST1) Read: Anytime Write: No effect — this register location is used for internal test purposes. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 117 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.3.2.7 Memory Size Register 0 (MEMSIZ0) Module Base + 0x001C Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R REG_SW0 0 EEP_SW1 EEP_SW0 0 RAM_SW2 RAM_SW1 RAM_SW0 W Reset — — — — — — — — = Unimplemented or Reserved Figure3-9. Memory Size Register 0 (MEMSIZ0) Read: Anytime Write: Writes have no effect Reset: Defined at chip integration, see device overview section. TheMEMSIZ0registerreflectsthestateoftheregister,EEPROMandRAMmemoryspaceconfiguration switches at the core boundary which are configured at system integration. This register allows read visibility to the state of these switches. Table3-7. MEMSIZ0 Field Descriptions Field Description 7 Allocated System Register Space REG_SW0 0 Allocated system register space size is 1K byte 1 Allocated system register space size is 2K byte 5:4 Allocated System EEPROM Memory Space — The allocated system EEPROM memory space size is as EEP_SW[1:0] given inTable3-8. 2 Allocated System RAM Memory Space — The allocated system RAM memory space size is as given in RAM_SW[2:0] Table3-9. Table3-8. Allocated EEPROM Memory Space eep_sw1:eep_sw0 Allocated EEPROM Space 00 0K byte 01 2K bytes 10 4K bytes 11 8K bytes Table3-9. Allocated RAM Memory Space Allocated RAM INITRM RAM Reset ram_sw2:ram_sw0 RAM Space Mappable Region Bits Used Base Address(1) 000 2K bytes 2K bytes RAM[15:11] 0x0800 001 4K bytes 4K bytes RAM[15:12] 0x0000 010 6K bytes 8K bytes(2) RAM[15:13] 0x0800 118 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description Table3-9. Allocated RAM Memory Space (continued) Allocated RAM INITRM RAM Reset ram_sw2:ram_sw0 RAM Space Mappable Region Bits Used Base Address(1) 011 8K bytes 8K bytes RAM[15:13] 0x0000 100 10K bytes 16K bytes2 RAM[15:14] 0x1800 101 12K bytes 16K bytes2 RAM[15:14] 0x1000 110 14K bytes 16K bytes2 RAM[15:14] 0x0800 111 16K bytes 16K bytes RAM[15:14] 0x0000 1. The RAM Reset BASE Address is based on the reset value of the INITRM register, 0x0009. 2. Alignment of the Allocated RAM space within the RAM mappable region is dependent on the value of RAMHAL. NOTE As stated, the bits in this register provide read visibility to the system physicalmemoryspaceallocationsdefinedatsystemintegration.Theactual arraysizeforanygiventypeofmemoryblockmaydifferfromtheallocated size. Please refer to the device overview chapter for actual sizes. 3.3.2.8 Memory Size Register 1 (MEMSIZ1) Module Base + 0x001D Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R ROM_SW1 ROM_SW0 0 0 0 0 PAG_SW1 PAG_SW0 W Reset — — — — — — — — = Unimplemented or Reserved Figure3-10. Memory Size Register 1 (MEMSIZ1) Read: Anytime Write: Writes have no effect Reset: Defined at chip integration, see device overview section. The MEMSIZ1 register reflects the state of the FLASH or ROM physical memory space and paging switches at the core boundary which are configured at system integration. This register allows read visibility to the state of these switches. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 119 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description Table3-10. MEMSIZ0 Field Descriptions Field Description 7:6 Allocated System FLASH or ROM Physical Memory Space — The allocated system FLASH or ROM ROM_SW[1:0] physical memory space is as given inTable3-11. 1:0 AllocatedOff-ChipFLASHorROMMemorySpace—Theallocatedoff-chipFLASHorROMmemoryspace PAG_SW[1:0] size is as given inTable3-12. Table3-11. Allocated FLASH/ROM Physical Memory Space Allocated FLASH rom_sw1:rom_sw0 or ROM Space 00 0K byte 01 16K bytes 10 48K bytes(1) 11 64K bytes(1) NOTES: 1. The ROMHM software bit in the MISC register determines the accessibility of the FLASH/ROMmemoryspace.PleaserefertoSection3.3.2.8,“MemorySizeRegister1 (MEMSIZ1),” for a detailed functional description of the ROMHM bit. Table3-12. Allocated Off-Chip Memory Options pag_sw1:pag_sw0 Off-Chip Space On-Chip Space 00 876K bytes 128K bytes 01 768K bytes 256K bytes 10 512K bytes 512K bytes 11 0K byte 1M byte NOTE As stated, the bits in this register provide read visibility to the system memory space and on-chip/off-chip partitioning allocations defined at system integration. The actual array size for any given type of memory blockmaydifferfromtheallocatedsize.Pleaserefertothedeviceoverview chapter for actual sizes. 120 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description 3.3.2.9 Program Page Index Register (PPAGE) Module Base + 0x0030 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 W Reset1 — — — — — — — — 1. The reset state of this register is controlled at chip integration. Please refer to the device overview section to determine the actual reset state of this register. = Unimplemented or Reserved Figure3-11. Program Page Index Register (PPAGE) Read: Anytime Write:Determinedatchipintegration.Generallyit’s:“writeanytimeinallmodes;”onsomedevicesitwill be: “write only in special modes.” Check specific device documentation to determine which applies. Reset: Defined at chip integration as either 0x00 (paired with write in any mode) or 0x3C (paired with write only in special modes), see device overview chapter. TheHCS12corearchitecturelimitsthephysicaladdressspaceavailableto64Kbytes.Theprogrampage index register allows for integrating up to 1M byte of FLASH or ROM into the system by using the six page index bits to page 16K byte blocks into the program page window located from 0x8000 to 0xBFFF as defined inTable3-14. CALL and RTC instructions have special access to read and write this register without using the address bus. NOTE Normalwritestothisregistertakeonecycletogointoeffect.Writestothis registerusingthespecialaccessoftheCALLandRTCinstructionswillbe complete before the end of the associated instruction. Table3-13. MEMSIZ0 Field Descriptions Field Description 5:0 Program Page Index Bits 5:0 — These page index bits are used to select which of the 64 FLASH or ROM PIX[5:0] array pages is to be accessed in the program page window as shown inTable3-14. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 121 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description Table3-14. Program Page Index Register Bits Program Space PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 Selected 0 0 0 0 0 0 16K page 0 0 0 0 0 0 1 16K page 1 0 0 0 0 1 0 16K page 2 0 0 0 0 1 1 16K page 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 1 1 0 0 16K page 60 1 1 1 1 0 1 16K page 61 1 1 1 1 1 0 16K page 62 1 1 1 1 1 1 16K page 63 3.4 Functional Description The MMC sub-block performs four basic functions of the core operation: bus control, address decoding and select signal generation, memory expansion, and security decoding for the system. Each aspect is described in the following subsections. 3.4.1 Bus Control TheMMCcontrolstheaddressbusanddatabusesthatinterfacethecorewiththerestofthesystem.This includesthemultiplexingoftheinputdatabusestothecoreontothemainCPUreaddatabusandcontrol ofdataflowfromtheCPUtotheoutputaddressanddatabusesofthecore.Inaddition,theMMCmanages all CPU read data bus swapping operations. 3.4.2 Address Decoding Asdataflowsonthecoreaddressbus,theMMCdecodestheaddressinformation,determineswhetherthe internalcoreregisterorfirmwarespace,theperipheralspaceoramemoryregisterorarrayspaceisbeing addressed and generates the correct select signal. This decoding operation also interprets the mode of operationofthesystemandthestateofthemappingcontrolregistersinordertogeneratetheproperselect. The MMC also generates two external chip select signals, emulation chip select (ECS) and external chip select (XCS). 3.4.2.1 Select Priority and Mode Considerations Althoughinternalresourcessuchascontrolregistersandon-chipmemoryhavedefaultaddresses,eachcan berelocatedbychangingthedefaultvaluesincontrolregisters.Normally,I/Oaddresses,controlregisters, 122 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description vector spaces, expansion windows, and on-chip memory are mapped so that their address ranges do not overlap.TheMMCwillmakeonlyoneselectsignalactiveatanygiventime.Thisactivationisbasedupon the priority outlined in Table3-15. If two or more blocks share the same address space, only the select signalfortheblockwiththehighestprioritywillbecomeactive.Anexampleofthisisiftheregistersand theRAMaremappedtothesamespace,theregisterswillhavepriorityovertheRAMandtheportionof RAMmappedinthissharedspacewillnotbeaccessible.Theexpansionwindowshavethelowestpriority. Thismeansthatregisters,vectors,and on-chipmemoryarealwaysvisibletoa programregardlessofthe values in the page select registers. Table3-15. Select Signal Priority Priority Address Space Highest BDM (internal to core) firmware or register space ... Internal register space ... RAM memory block ... EEPROM memory block ... On-chip FLASH or ROM Lowest Remaining external space Inexpandedmodes,alladdressspacenotusedbyinternalresourcesisbydefaultexternalmemoryspace. The data registers and data direction registers for ports A and B are removed from the on-chip memory map and become external accesses. If the EME bit in the MODE register (see MEBI block description chapter)isset,thedataanddatadirectionregistersforportEarealsoremovedfromtheon-chipmemory map and become external accesses. In special peripheral mode, the first 16 registers associated with bus expansion are removed from the on- chip memory map (PORTA, PORTB, DDRA, DDRB, PORTE, DDRE, PEAR, MODE, PUCR, RDRIV, and the EBI reserved registers). Inemulationmodes,iftheEMKbitintheMODEregister(seeMEBIblockdescriptionchapter)isset,the data and data direction registers for port K are removed from the on-chip memory map and become external accesses. 3.4.2.2 Emulation Chip Select Signal WhentheEMKbitintheMODEregister(seeMEBIblockdescriptionchapter)isset,portKbit7isused as an active-low emulation chip select signal, ECS. This signal is active when the system is in emulation mode, the EMK bit is set and the FLASH or ROM space is being addressed subject to the conditions outlined inSection3.4.3.2, “Extended Address (XAB19:14) and ECS Signal Functionality.” When the EMK bit is clear, this pin is used for general purpose I/O. 3.4.2.3 External Chip Select Signal WhentheEMKbitintheMODEregister(seeMEBIblockdescriptionchapter)isset,portKbit6isused asanactive-lowexternalchipselectsignal,XCS.ThissignalisactiveonlywhentheECSsignaldescribed above is not active and when the system is addressing the external address space. Accesses to Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 123 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description unimplementedlocationswithintheregisterspaceortolocationsthatareremovedfromthemap(i.e.,ports AandBinexpandedmodes)willnotcausethissignaltobecomeactive.WhentheEMKbitisclear,this pin is used for general purpose I/O. 3.4.3 Memory Expansion TheHCS12corearchitecturelimitsthephysicaladdressspaceavailableto64Kbytes.Theprogrampage index register allows for integrating up to 1M byte of FLASH or ROM into the system by using the six page index bits to page 16K byte blocks into the program page window located from 0x8000 to 0xBFFF in the physical memory space. The paged memory space can consist of solely on-chip memory or a combinationofon-chipandoff-chipmemory.Thispartitioningisconfiguredatsystemintegrationthrough the use of the paging configuration switches (pag_sw1:pag_sw0) at the core boundary. The options availabletotheintegratorareasgiveninTable3-16(thistablematchesTable 3-12butisrepeatedherefor easy reference). Table3-16. Allocated Off-Chip Memory Options pag_sw1:pag_sw0 Off-Chip Space On-Chip Space 00 876K bytes 128K bytes 01 768K bytes 256K bytes 10 512K bytes 512K bytes 11 0K byte 1M byte Based upon the system configuration, the program page window will consider its access to be either internal or external as defined in Table3-17. Table3-17. External/Internal Page Window Access Page Window pag_sw1:pag_sw0 Partitioning PIX5:0 Value Access 00 876K off-Chip, 0x0000–0x0037 External 128K on-Chip 0x0038–0x003F Internal 01 768K off-chip, 0x0000–0x002F External 256K on-chip 0x0030–0x003F Internal 10 512K off-chip, 0x0000–0x001F External 512K on-chip 0x0020–0x003F Internal 11 0K off-chip, N/A External 1M on-chip 0x0000–0x003F Internal NOTE The partitioning as defined inTable3-17 applies only to the allocated memory space and the actual on-chip memory sizes implemented in the system may differ. Please refer to the device overview chapter for actual sizes. 124 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description The PPAGE register holds the page select value for the program page window. The value of the PPAGE register can be manipulated by normal read and write (some devices don’t allow writes in some modes) instructions as well as the CALL and RTC instructions. Control registers, vector spaces, and a portion of on-chip memory are located in unpaged portions of the 64Kbytephysicaladdressspace.ThestackandI/Oaddressesshouldalsobeinunpagedmemorytomake them accessible from any page. Thestartingaddressofaserviceroutinemustbelocatedinunpagedmemorybecausethe16-bitexception vectorscannotpointtoaddressesinpagedmemory.However,aserviceroutinecancallotherroutinesthat are in paged memory. The upper 16K byte block of memory space (0xC000–0xFFFF) is unpaged. It is recommended that all reset and interrupt vectors point to locations in this area. 3.4.3.1 CALL and Return from Call Instructions CALL and RTC are uninterruptable instructions that automate page switching in the program expansion window.CALLissimilartoaJSRinstruction,butthesubroutinethatiscalledcanbelocatedanywherein the normal 64K byte address space or on any page of program expansion memory. CALL calculates and stacks a return address, stacks the current PPAGE value, and writes a new instruction-supplied value to PPAGE. The PPAGE value controls which of the 64 possible pages is visible through the 16K byte expansion window in the 64K byte memory map. Execution then begins at the address of the called subroutine. During the execution of a CALL instruction, the CPU: • Writes the old PPAGE value into an internal temporary register and writes the new instruction- supplied PPAGE value into the PPAGE register. • CalculatestheaddressofthenextinstructionaftertheCALLinstruction(thereturnaddress),and pushes this 16-bit value onto the stack. • Pushes the old PPAGE value onto the stack. • Calculatestheeffectiveaddressofthesubroutine,refillsthequeue,andbeginsexecutionatthenew address on the selected page of the expansion window. This sequence is uninterruptable; there is no need to inhibit interrupts during CALL execution. A CALL can be performed from any address in memory to any other address. The PPAGE value supplied by the instruction is part of the effective address. For all addressing mode variationsexceptindexed-indirectmodes,thenewpagevalueisprovidedbyanimmediateoperandinthe instruction. In indexed-indirect variations of CALL, a pointer specifies memory locations where the new pagevalueandtheaddressofthecalledsubroutinearestored.Usingindirectaddressingforboththenew page value and the address within the page allows values calculated at run time rather than immediate values that must be known at the time of assembly. The RTC instruction terminates subroutines invoked by a CALL instruction. RTC unstacks the PPAGE value and the return address and refills the queue. Execution resumes with the next instruction after the CALL. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 125 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description During the execution of an RTC instruction, the CPU: • Pulls the old PPAGE value from the stack • Pulls the 16-bit return address from the stack and loads it into the PC • Writes the old PPAGE value into the PPAGE register • Refills the queue and resumes execution at the return address Thissequenceisuninterruptable;anRTCcanbeexecutedfromanywhereinmemory,evenfromadifferent page of extended memory in the expansion window. The CALL and RTC instructions behave like JSR and RTS, except they use more execution cycles. Therefore,routinelysubstitutingCALL/RTCforJSR/RTSisnotrecommended.JSRandRTScanbeused toaccesssubroutinesthatareonthesamepageinexpandedmemory.However,asubroutineinexpanded memory that can be called from other pages must be terminated with an RTC. And the RTC unstacks a PPAGEvalue.Soanyaccesstothesubroutine,evenfromthesamepage,mustuseaCALLinstructionso that the correct PPAGE value is in the stack. 3.4.3.2 Extended Address (XAB19:14) and ECS Signal Functionality If the EMK bit in the MODE register is set (see MEBI block description chapter) the PIX5:0 values will be output on XAB19:14 respectively (port K bits 5:0) when the system is addressing within the physical program page window address space (0x8000–0xBFFF) and is in an expanded mode. When addressing anywhereelsewithinthephysicaladdressspace(outsideofthepagingspace),theXAB19:14signalswill be assigned a constant value based upon the physical address space selected. In addition, the active-low emulation chip select signal, ECS, will likewise function based upon the assigned memory allocation. In the cases of 48Kbyte and 64K byte allocated physical FLASH/ROM space, the operation of the ECS signal will additionally depend upon the state of the ROMHM bit (see Section3.3.2.4, “Miscellaneous SystemControlRegister(MISC)”)intheMISCregister.Table 3-18,Table3-19,Table 3-20,andTable3- 21 summarize the functionality of these signals based upon the allocated memory configuration. Again, this signal information is only available externally when the EMK bit is set and the system is in an expanded mode. Table3-18. 0K Byte Physical FLASH/ROM Allocated Address Space Page Window Access ROMHM ECS XAB19:14 0x0000–0x3FFF N/A N/A 1 0x3D 0x4000–0x7FFF N/A N/A 1 0x3E 0x8000–0xBFFF N/A N/A 0 PIX[5:0] 0xC000–0xFFFF N/A N/A 0 0x3F Table3-19. 16K Byte Physical FLASH/ROM Allocated Address Space Page Window Access ROMHM ECS XAB19:14 0x0000–0x3FFF N/A N/A 1 0x3D 0x4000–0x7FFF N/A N/A 1 0x3E 0x8000–0xBFFF N/A N/A 1 PIX[5:0] 0xC000–0xFFFF N/A N/A 0 0x3F 126 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description Table3-20. 48K Byte Physical FLASH/ROM Allocated Address Space Page Window Access ROMHM ECS XAB19:14 0x0000–0x3FFF N/A N/A 1 0x3D 0x4000–0x7FFF N/A 0 0 0x3E N/A 1 1 0x8000–0xBFFF External N/A 1 PIX[5:0] Internal N/A 0 0xC000–0xFFFF N/A N/A 0 0x3F Table3-21. 64K Byte Physical FLASH/ROM Allocated Address Space Page Window Access ROMHM ECS XAB19:14 0x0000–0x3FFF N/A 0 0 0x3D N/A 1 1 0x4000–0x7FFF N/A 0 0 0x3E N/A 1 1 0x8000–0xBFFF External N/A 1 PIX[5:0] Internal N/A 0 0xC000–0xFFFF N/A N/A 0 0x3F Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 127 Rev 01.24

Chapter3 Module Mapping Control (MMCV4) Block Description Agraphicalexampleofamemorypagingforasystemconfiguredas1Mbyteon-chipFLASH/ROMwith 64K allocated physical space is given in Figure3-12. 0x0000 61 16K FLASH (UNPAGED) 0x4000 62 16K FLASH (UNPAGED) ONE 16K FLASH/ROM PAGE ACCESSIBLE AT A TIME (SELECTED BY PPAGE = 0 TO 63) 0x8000 0 1 2 3 59 60 61 62 63 16K FLASH (PAGED) 0xC000 63 These 16K FLASH/ROM pages accessible from 0x0000 to 0x7FFF if selected by the ROMHM bit in the MISC register. 16K FLASH (UNPAGED) 0xFF00 VECTORS 0xFFFF NORMAL SINGLE CHIP Figure3-12. Memory Paging Example: 1M Byte On-Chip FLASH/ROM, 64K Allocation 128 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 4 Multiplexed External Bus Interface (MEBIV3) 4.1 Introduction Thissectiondescribesthefunctionalityofthemultiplexedexternalbusinterface(MEBI)sub-blockofthe S12coreplatform.ThefunctionalityofthemoduleiscloselycoupledwiththeS12CPUandthememory map controller (MMC) sub-blocks. Figure4-1isablockdiagramoftheMEBI.InFigure4-1,thesignalsontherighthandsiderepresentpins that are accessible externally. On some chips, these may not all be bonded out. The MEBI sub-block of the core serves to provide access and/or visibility to internal core data manipulationoperationsincludingtimingreferenceinformationattheexternalboundaryofthecoreand/or system.Dependinguponthesystemoperatingmodeandthestateofbitswithinthecontrolregistersofthe MEBI, the internal 16-bit read and write data operations will be represented in 8-bit or 16-bit accesses externally. Using control information from other blocks within the system, the MEBI will determine the appropriate type of data access to be generated. 4.1.1 Features The block name includes these distinctive features: • External bus controller with four 8-bit ports A,B, E, and K • Data and data direction registers for ports A, B, E, and K when used as general-purpose I/O • Control register to enable/disable alternate functions on ports E and K • Mode control register • Control register to enable/disable pull resistors on ports A, B, E, and K • Control register to enable/disable reduced output drive on ports A, B, E, and K • Control register to configure external clock behavior • Control register to configureIRQ pin operation • Logic to capture and synchronize external interrupt pin inputs Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 129 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) REGS K t PK[7:0]/ECS/XCS/X[19:14] ADDR r o P Addr[19:0] A us EXT ADDR rt PA[7:0]/A[15:8]/ al B Data[15:0] BIU/FS DATA Po D[15:8]/D[7:0] n r e CTL nt I (Control) B ADDR t PB[7:0]/A[7:0]/ r o D[7:0] P DATA PE[7:2]/NOACC/ IPIPE1/MODB/CLKTO ECLK CTL IPIPE0/MODA/ ECLK/ E LSTRB/TAGLO CPU pipe info PIPE CTL ort R/W P IRQ interrupt PE1/IRQ XIRQ interrupt IRQ CTL PE0/XIRQ TAG CTL BDM tag info BKGD BKGD/MODC/TAGHI mode Control signal(s) Data signal (unidirectional) Data signal (bidirectional) Data bus (unidirectional) Data bus (bidirectional) Figure4-1. MEBI Block Diagram 130 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.1.2 Modes of Operation • Normal expanded wide mode PortsAandBareconfiguredasa16-bitmultiplexedaddressanddatabusandportEprovidesbus controlandstatussignals.Thismodeallows16-bitexternalmemoryandperipheraldevicestobe interfaced to the system. • Normal expanded narrow mode Ports A and B are configured as a 16-bit address bus and port A is multiplexed with 8-bit data. PortE provides bus control and status signals. This mode allows 8-bit external memory and peripheral devices to be interfaced to the system. • Normal single-chip mode Thereisnoexternalexpansionbusinthismode.Theprocessorprogramisexecutedfrominternal memory. Ports A, B, K, and most of E are available as general-purpose I/O. • Special single-chip mode This mode is generally used for debugging single-chip operation, boot-strapping, or security relatedoperations.TheactivebackgroundmodeisincontrolofCPUexecutionandBDMfirmware iswaitingforadditionalserialcommandsthroughtheBKGDpin.Thereisnoexternalexpansion bus after reset in this mode. • Emulation expanded wide mode Developers use this mode for emulation systems in which the users target application is normal expanded wide mode. • Emulation expanded narrow mode Developers use this mode for emulation systems in which the users target application is normal expanded narrow mode. • Special test mode PortsAandBareconfiguredasa16-bitmultiplexedaddressanddatabusandportEprovidesbus control and status signals. In special test mode, the write protection of many control bits is lifted so that they can be thoroughly tested without needing to go through reset. • Special peripheral mode This mode is intended for Freescale Semiconductor factory testing of the system. The CPU is inactive and an external (tester) bus master drives address, data, and bus control signals. 4.2 External Signal Description Intypicalimplementations,theMEBIsub-blockofthecoreinterfacesdirectlywithexternalsystempins. Some pins may not be bonded out in all implementations. Table4-1 outlines the pin names and functions and gives a brief description of their operation reset state of these pins and associated pull-ups or pull-downs is dependent on the mode of operation and on the integration of this block at the chip level (chip dependent). Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 131 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) . Table4-1. External System Pins Associated With MEBI Pin Name Pin Functions Description BKGD/MODC/ MODC AttherisingedgeonRESET,thestateofthispinisregisteredintotheMODC TAGHI bit to set the mode. (This pin always has an internal pullup.) BKGD Pseudo open-drain communication pin for the single-wire background debug mode. There is an internal pull-up resistor on this pin. TAGHI Wheninstructiontaggingison,a0atthefallingedgeofEtagsthehighhalfof the instruction word being read into the instruction queue. PA7/A15/D15/D7 PA7–PA0 General-purpose I/O pins, see PORTA and DDRA registers. thru PA0/A8/D8/D0 A15–A8 High-order address lines multiplexed during ECLK low. Outputs except in special peripheral mode where they are inputs from an external tester system. D15–D8 High-order bidirectional data lines multiplexed during ECLK high in expanded widemodes,specialperipheralmode,andvisibleinternalaccesses(IVIS=1) in emulation expanded narrow mode. Direction of data transfer is generally indicated by R/W. D15/D7 Alternate high-order and low-order bytes of the bidirectional data lines thru multiplexedduringECLKhighinexpandednarrowmodesandnarrowaccesses D8/D0 in wide modes. Direction of data transfer is generally indicated by R/W. PB7/A7/D7 PB7–PB0 General-purpose I/O pins, see PORTB and DDRB registers. thru PB0/A0/D0 A7–A0 Low-order address lines multiplexed during ECLK low. Outputs except in special peripheral mode where they are inputs from an external tester system. D7–D0 Low-order bidirectional data lines multiplexed during ECLK high in expanded wide modes, special peripheral mode, and visible internal accesses (with IVIS=1) in emulation expanded narrow mode. Direction of data transfer is generally indicated by R/W. PE7/NOACC PE7 General-purpose I/O pin, see PORTE and DDRE registers. NOACC CPUNoAccessoutput.Indicateswhetherthecurrentcycleisafreecycle.Only available in expanded modes. PE6/IPIPE1/ MODB At the rising edge ofRESET, the state of this pin is registered into the MODB MODB/CLKTO bit to set the mode. PE6 General-purpose I/O pin, see PORTE and DDRE registers. IPIPE1 Instruction pipe status bit 1, enabled by PIPOE bit in PEAR. CLKTO Systemclocktestoutput.Onlyavailableinspecialmodes.PIPOE=1overrides this function. The enable for this function is in the clock module. PE5/IPIPE0/MODA MODA At the rising edge onRESET, the state of this pin is registered into the MODA bit to set the mode. PE5 General-purpose I/O pin, see PORTE and DDRE registers. IPIPE0 Instruction pipe status bit 0, enabled by PIPOE bit in PEAR. 132 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Table4-1. External System Pins Associated With MEBI (continued) Pin Name Pin Functions Description PE4/ECLK PE4 General-purpose I/O pin, see PORTE and DDRE registers. ECLK Bus timing reference clock, can operate as a free-running clock at the system clock rate or to produce one low-high clock per visible access, with the high period stretched for slow accesses. ECLK is controlled by the NECLK bit in PEAR, the IVIS bit in MODE, and the ESTR bit in EBICTL. PE3/LSTRB/TAGLO PE3 General-purpose I/O pin, see PORTE and DDRE registers. LSTRB Low strobe bar, 0 indicates valid data on D7–D0. SZ8 In special peripheral mode, this pin is an input indicating the size of the data transfer (0=16-bit; 1=8-bit). TAGLO Inexpandedwidemodeoremulationnarrowmodes,wheninstructiontagging isonandlowstrobeisenabled,a0atthefallingedgeofEtagsthelowhalfof the instruction word being read into the instruction queue. PE2/R/W PE2 General-purpose I/O pin, see PORTE and DDRE registers. R/W Read/write, indicates the direction of internal data transfers. This is an output except in special peripheral mode where it is an input. PE1/IRQ PE1 General-purpose input-only pin, can be read even ifIRQ enabled. IRQ Maskable interrupt request, can be level sensitive or edge sensitive. PE0/XIRQ PE0 General-purpose input-only pin. XIRQ Non-maskable interrupt input. PK7/ECS PK7 General-purpose I/O pin, see PORTK and DDRK registers. ECS Emulation chip select PK6/XCS PK6 General-purpose I/O pin, see PORTK and DDRK registers. XCS External data chip select PK5/X19 PK5–PK0 General-purpose I/O pins, see PORTK and DDRK registers. thru PK0/X14 X19–X14 Memory expansion addresses Detailed descriptions of these pins can be found in the device overview chapter. 4.3 Memory Map and Register Definition A summary of the registers associated with the MEBI sub-block is shown in Table4-2. Detailed descriptions of the registers and bits are given in the subsections that follow. On most chips the registers are mappable. Therefore, the upper bits may not be all 0s as shown in the table and descriptions. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 133 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.1 Module Memory Map Table4-2. MEBI Memory Map Address Use Access Offset 0x0000 Port A Data Register (PORTA) R/W 0x0001 Port B Data Register (PORTB) R/W 0x0002 Data Direction Register A (DDRA) R/W 0x0003 Data Direction Register B (DDRB) R/W 0x0004 Reserved R 0x0005 Reserved R 0x0006 Reserved R 0x0007 Reserved R 0x0008 Port E Data Register (PORTE) R/W 0x0009 Data Direction Register E (DDRE) R/W 0x000A Port E Assignment Register (PEAR) R/W 0x000B Mode Register (MODE) R/W 0x000C Pull Control Register (PUCR) R/W 0x000D Reduced Drive Register (RDRIV) R/W 0x000E External Bus Interface Control Register (EBICTL) R/W 0x000F Reserved R 0x001E IRQ Control Register (IRQCR) R/W 0x00032 Port K Data Register (PORTK) R/W 0x00033 Data Direction Register K (DDRK) R/W 4.3.2 Register Descriptions 4.3.2.1 Port A Data Register (PORTA) Module Base + 0x0000 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Single Chip PA7 PA6 PA5 PA4 PA3 PA2 PA1 PA0 Expanded Wide, Emulation Narrow with AB/DB15 AB/DB14 AB/DB13 AB/DB12 AB/DB11 AB/DB10 AB/DB9 AB/DB8 IVIS, and Peripheral Expanded Narrow AB15 and AB14 and AB13 and AB12 and AB11 and AB10 and AB9 and AB8 and DB15/DB7 DB14/DB6 DB13/DB5 DB12/DB4 DB11/DB3 DB10/DB2 DB9/DB1 DB8/DB0 Figure4-2. Port A Data Register (PORTA) 134 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Read: Anytime when register is in the map Write: Anytime when register is in the map Port A bits 7 through 0 are associated with address lines A15 through A8 respectively and data lines D15/D7 through D8/D0 respectively. When this port is not used for external addresses such as in single- chip mode, these pins can be used as general-purpose I/O. Data direction register A (DDRA) determines the primary direction of each pin. DDRA also determines the source of data for a read of PORTA. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. NOTE To ensure that you read the value present on the PORTA pins, always wait atleastonecycleafterwritingtotheDDRAregisterbeforereadingfromthe PORTA register. 4.3.2.2 Port B Data Register (PORTB) Module Base + 0x0001 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Single Chip PB7 PB6 PB5 PB4 PB3 PB2 PB1 PB0 Expanded Wide, Emulation Narrow with AB/DB7 AB/DB6 AB/DB5 AB/DB4 AB/DB3 AB/DB2 AB/DB1 AB/DB0 IVIS, and Peripheral Expanded Narrow AB7 AB6 AB5 AB4 AB3 AB2 AB1 AB0 Figure4-3. Port A Data Register (PORTB) Read: Anytime when register is in the map Write: Anytime when register is in the map Port B bits 7 through 0 are associated with address lines A7 through A0 respectively and data lines D7 through D0 respectively. When this port is not used for external addresses, such as in single-chip mode, thesepinscanbeusedasgeneral-purposeI/O.DatadirectionregisterB(DDRB)determinestheprimary direction of each pin. DDRB also determines the source of data for a read of PORTB. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. NOTE To ensure that you read the value present on the PORTB pins, always wait atleastonecycleafterwritingtotheDDRBregisterbeforereadingfromthe PORTB register. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 135 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.3 Data Direction Register A (DDRA) Module Base + 0x0002 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure4-4. Data Direction Register A (DDRA) Read: Anytime when register is in the map Write: Anytime when register is in the map ThisregistercontrolsthedatadirectionforportA.WhenportAisoperatingasageneral-purposeI/Oport, DDRA determines the primary direction for each port A pin. A 1 causes the associated port pin to be an outputanda0causestheassociatedpintobeahigh-impedanceinput.ThevalueinaDDRbitalsoaffects thesourceofdataforreadsofthecorrespondingPORTAregister.IftheDDRbitis0(input)thebuffered pin input state is read. If the DDR bit is 1 (output) the associated port data register bit state is read. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesseswillbeechoedexternally.Itisresetto0x00sotheDDRdoesnotoverridethethree-statecontrol signals. Table4-3. DDRA Field Descriptions Field Description 7:0 Data Direction Port A DDRA 0 Configure the corresponding I/O pin as an input 1 Configure the corresponding I/O pin as an output 136 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.4 Data Direction Register B (DDRB) Module Base + 0x0003 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure4-5. Data Direction Register B (DDRB) Read: Anytime when register is in the map Write: Anytime when register is in the map ThisregistercontrolsthedatadirectionforportB.WhenportBisoperatingasageneral-purposeI/Oport, DDRB determines the primary direction for each port B pin. A 1 causes the associated port pin to be an outputanda0causestheassociatedpintobeahigh-impedanceinput.ThevalueinaDDRbitalsoaffects thesourceofdataforreadsofthecorrespondingPORTBregister.IftheDDRbitis0(input)thebuffered pin input state is read. If the DDR bit is 1 (output) the associated port data register bit state is read. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesseswillbeechoedexternally.Itisresetto0x00sotheDDRdoesnotoverridethethree-statecontrol signals. Table4-4. DDRB Field Descriptions Field Description 7:0 Data Direction Port B DDRB 0 Configure the corresponding I/O pin as an input 1 Configure the corresponding I/O pin as an output Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 137 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.5 Reserved Registers Module Base + 0x0004 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-6. Reserved Register Module Base + 0x0005 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-7. Reserved Register Module Base + 0x0006 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-8. Reserved Register Module Base + 0x0007 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-9. Reserved Register 138 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Theseregisterlocationsarenotused(reserved).Allunusedregistersandbitsinthisblockreturnlogic0s when read. Writes to these registers have no effect. These registers are not in the on-chip map in special peripheral mode. 4.3.2.6 Port E Data Register (PORTE) Module Base + 0x0008 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 1 Bit 0 Bit 7 6 5 4 3 2 W Reset 0 0 0 0 0 0 u u Alternate MODB MODA LSTRB Pin Function NOACC or IPIPE1 ECLK R/W IRQ XIRQ or IPIPE0 orTAGLO or CLKTO = Unimplemented or Reserved u = Unaffected by reset Figure4-10. Port E Data Register (PORTE) Read: Anytime when register is in the map Write: Anytime when register is in the map Port E is associated with external bus control signals and interrupt inputs. These include mode select (MODB/IPIPE1, MODA/IPIPE0), E clock, size (LSTRB/TAGLO), read/write (R/W),IRQ, and XIRQ. Whennotusedforoneofthesespecificfunctions,portEpins7:2canbeusedasgeneral-purposeI/Oand pins1:0canbeusedasgeneral-purposeinput.TheportEassignmentregister(PEAR)selectsthefunction of each pin and DDRE determines whether each pin is an input or output when it is configured to be general-purpose I/O. DDRE also determines the source of data for a read of PORTE. Someofthesepinshavesoftwareselectablepullresistors.IRQandXIRQcanonlybepulledupwhereas thepolarityofthePE7,PE4,PE3,andPE2pullresistorsaredeterminedbychipintegration.Pleaserefer to the device overview chapter (Signal Property Summary) to determine the polarity of these resistors. Asingle control bit enables the pull devices for all of these pins when they are configured as inputs. This register is not in the on-chip map in special peripheral mode or in expanded modes when the EME bit is set. Therefore, these accesses will be echoed externally. NOTE It is unwise to write PORTE and DDRE as a word access. If you are changingportEpinsfrombeinginputstooutputs,thedatamayhaveextra transitionsduringthewrite.ItisbesttoinitializePORTEbeforeenablingas outputs. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 139 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) NOTE To ensure that you read the value present on the PORTE pins, always wait atleastonecycleafterwritingtotheDDREregisterbeforereadingfromthe PORTE register. 4.3.2.7 Data Direction Register E (DDRE) Module Base + 0x0009 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 Bit 7 6 5 4 3 Bit 2 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-11. Data Direction Register E (DDRE) Read: Anytime when register is in the map Write: Anytime when register is in the map DatadirectionregisterEisassociatedwithportE.ForbitsinportEthatareconfiguredasgeneral-purpose I/O lines, DDRE determines the primary direction of each of these pins. A 1 causes the associated bit to be an output and a 0 causes the associated bit to be an input. Port E bit 1 (associated withIRQ) and bit 0 (associated withXIRQ) cannot be configured as outputs. Port E, bits 1 and 0, can be read regardless of whetherthealternateinterruptfunctionisenabled.ThevalueinaDDRbitalsoaffectsthesourceofdata for reads of the corresponding PORTE register. If the DDR bit is 0 (input) the buffered pin input state is read. If the DDR bit is 1 (output) the associated port data register bit state is read. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesseswillbeechoedexternally.Also,itisnotinthemapinexpandedmodeswhiletheEMEcontrolbit is set. Table4-5. DDRE Field Descriptions Field Description 7:2 Data Direction Port E DDRE 0 Configure the corresponding I/O pin as an input 1 Configure the corresponding I/O pin as an output Note:It is unwise to write PORTE and DDRE as a word access. If you are changing portE pins from inputs to outputs,thedatamayhaveextratransitionsduringthewrite.ItisbesttoinitializePORTEbeforeenabling as outputs. 140 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.8 Port E Assignment Register (PEAR) Module Base + 0x000A Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 NOACCE PIPOE NECLK LSTRE RDWE W Reset Special Single Chip 0 0 0 0 0 0 0 0 Special Test 0 0 1 0 1 1 0 0 Peripheral 0 0 0 0 0 0 0 0 Emulation Expanded 1 0 1 0 1 1 0 0 Narrow Emulation Expanded 1 0 1 0 1 1 0 0 Wide Normal Single Chip 0 0 0 1 0 0 0 0 Normal Expanded 0 0 0 0 0 0 0 0 Narrow Normal Expanded Wide 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-12. Port E Assignment Register (PEAR) Read: Anytime (provided this register is in the map). Write:Eachbithasspecificwriteconditions.Pleaserefertothedescriptionsofeachbitonthefollowing pages. Port E serves as general-purpose I/O or as system and bus control signals. The PEAR register is used to choose between the general-purpose I/O function and the alternate control functions. When an alternate control function is selected, the associated DDRE bits are overridden. The reset condition of this register depends on the mode of operation because bus control signals are neededimmediatelyafterresetinsomemodes.Innormalsingle-chipmode,noexternalbuscontrolsignals are needed so all of port E is configured for general-purpose I/O. In normal expanded modes, only the E clock is configured for its alternate bus control function and the other bits of port E are configured for general-purpose I/O. As the reset vector is located in external memory, the E clock is required for this access. R/W is only needed by the system when there are external writable resources. If the normal expanded system needs any other bus control signals, PEAR would need to be written before any access that needed the additional signals. In special test and emulation modes, IPIPE1, IPIPE0, E,LSTRB, and R/W are configured out of reset as bus control signals. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 141 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Table4-6. PEAR Field Descriptions Field Description 7 CPU No Access Output Enable NOACCE Normal: write once Emulation: write never Special: write anytime 1 The associated pin (port E, bit 7) is general-purpose I/O. 0 The associated pin (port E, bit 7) is output and indicates whether the cycle is a CPU free cycle. This bit has no effect in single-chip or special peripheral modes. 5 Pipe Status Signal Output Enable PIPOE Normal: write once Emulation: write never Special: write anytime. 0 The associated pins (port E, bits 6:5) are general-purpose I/O. 1 The associated pins (port E, bits 6:5) are outputs and indicate the state of the instruction queue This bit has no effect in single-chip or special peripheral modes. 4 No External E Clock NECLK Normal and special: write anytime Emulation: write never 0 The associated pin (port E, bit 4) is the external E clock pin. External E clock is free-running if ESTR=0 1 The associated pin (port E, bit 4) is a general-purpose I/O pin. External E clock is available as an output in all modes. 3 Low Strobe (LSTRB) Enable LSTRE Normal: write once Emulation: write never Special: write anytime. 0 The associated pin (port E, bit 3) is a general-purpose I/O pin. 1 The associated pin (port E, bit 3) is configured as theLSTRB bus control output. If BDM tagging is enabled, TAGLO is multiplexed in on the rising edge of ECLK andLSTRB is driven out on the falling edge of ECLK. This bit has no effect in single-chip, peripheral, or normal expanded narrow modes. Note:LSTRBisusedduringexternalwrites.Afterresetinnormalexpandedmode,LSTRBisdisabledtoprovide an extra I/O pin. IfLSTRB is needed, it should be enabled before any external writes. External reads do not normally needLSTRB because all 16 data bits can be driven even if the system only needs 8 bits of data. 2 Read/Write Enable RDWE Normal: write once Emulation: write never Special: write anytime 0 The associated pin (port E, bit 2) is a general-purpose I/O pin. 1 The associated pin (port E, bit 2) is configured as the R/W pin This bit has no effect in single-chip or special peripheral modes. Note:R/Wisusedforexternalwrites.Afterresetinnormalexpandedmode,R/Wisdisabledtoprovideanextra I/O pin. If R/W is needed it should be enabled before any external writes. 142 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.9 Mode Register (MODE) Module Base + 0x000B Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 MODC MODB MODA IVIS EMK EME W Reset Special Single Chip 0 0 0 0 0 0 0 0 Emulation Expanded 0 0 1 0 1 0 1 1 Narrow Special Test 0 1 0 0 1 0 0 0 Emulation Expanded 0 1 1 0 1 0 1 1 Wide Normal Single Chip 1 0 0 0 0 0 0 0 Normal Expanded 1 0 1 0 0 0 0 0 Narrow Peripheral 1 1 0 0 0 0 0 0 Normal Expanded Wide 1 1 1 0 0 0 0 0 = Unimplemented or Reserved Figure4-13. Mode Register (MODE) Read: Anytime (provided this register is in the map). Write:Eachbithasspecificwriteconditions.Pleaserefertothedescriptionsofeachbitonthefollowing pages. The MODE register is used to establish the operating mode and other miscellaneous functions (i.e., internal visibility and emulation of port E and K). In special peripheral mode, this register is not accessible but it is reset as shown to system configuration features. Changes to bits in the MODE register are delayed one cycle after the write. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 143 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Table4-7. MODE Field Descriptions Field Description 7:5 Mode Select Bits — These bits indicate the current operating mode. MOD[C:A] If MODA = 1, then MODC, MODB, and MODA are write never. IfMODC=MODA=0,thenMODC,MODB,andMODAarewritablewiththeexceptionthatyoucannotchange to or from special peripheral mode IfMODC=1,MODB=0,andMODA=0,thenMODCiswritenever.MODBandMODAarewriteonce,except thatyoucannotchangetospecialperipheralmode.Fromnormalsingle-chip,onlynormalexpandednarrowand normal expanded wide modes are available. SeeTable4-8 andTable4-16. 3 Internal Visibility (for both read and write accesses) — This bit determines whether internal accesses IVIS generate a bus cycle that is visible on the external bus. Normal: write once Emulation: write never Special: write anytime 0 No visibility of internal bus operations on external bus. 1 Internal bus operations are visible on external bus. 1 Emulate Port K EMK Normal: write once Emulation: write never Special: write anytime 0 PORTK and DDRK are in the memory map so port K can be used for general-purpose I/O. 1 If in any expanded mode, PORTK and DDRK are removed from the memory map. In single-chip modes, PORTK and DDRK are always in the map regardless of the state of this bit. In special peripheral mode, PORTK and DDRK are never in the map regardless of the state of this bit. 0 Emulate Port E EME Normal and Emulation: write never Special: write anytime 0 PORTE and DDRE are in the memory map so port E can be used for general-purpose I/O. 1 Ifinanyexpandedmodeorspecialperipheralmode,PORTEandDDREareremovedfromthememorymap. Removing the registers from the map allows the user to emulate the function of these registers externally. In single-chip modes, PORTE and DDRE are always in the map regardless of the state of this bit. 144 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Table4-8. MODC, MODB, and MODA Write Capability(1) MODC MODB MODA Mode MODx Write Capability 0 0 0 Special single chip MODC, MODB, and MODA write anytime but not to 110(2) 0 0 1 Emulation narrow No write 0 1 0 Special test MODC, MODB, and MODA write anytime but not to 110(2) 0 1 1 Emulation wide No write 1 0 0 Normal single chip MODC write never, MODB and MODA write once but not to 110 1 0 1 Normal expanded narrow No write 1 1 0 Special peripheral No write 1 1 1 Normal expanded wide No write 1.NowritestotheMODbitsareallowedwhileoperatinginasecuremode.Formoredetails,refertothedeviceover- view chapter. 2.Ifyouareinaspecialsingle-chiporspecialtestmodeandyouwritetothisregister,changingtonormalsingle-chip mode,thenoneallowedwritetothisregisterremains.Ifyouwritetonormalexpandedoremulationmode,thenno writes remain. 4.3.2.10 Pull Control Register (PUCR) Module Base + 0x000C Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 PUPKE PUPEE PUPBE PUPAE W Reset1 1 0 0 1 0 0 0 0 NOTES: 1. The default value of this parameter is shown. Please refer to the device overview chapter to deter- mine the actual reset state of this register. = Unimplemented or Reserved Figure4-14. Pull Control Register (PUCR) Read: Anytime (provided this register is in the map). Write: Anytime (provided this register is in the map). This register is used to select pull resistors for the pins associated with the core ports. Pull resistors are assignedonaper-portbasisandapplytoanypininthecorrespondingportthatiscurrentlyconfiguredas an input. The polarity of these pull resistors is determined by chip integration. Please refer to the device overview chapter to determine the polarity of these resistors. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 145 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. NOTE These bits have no effect when the associated pin(s) are outputs. (The pull resistors are inactive.) Table4-9. PUCR Field Descriptions Field Description 7 Pull resistors Port K Enable PUPKE 0 Port K pull resistors are disabled. 1 Enable pull resistors for port K input pins. 4 Pull resistors Port E Enable PUPEE 0 Port E pull resistors on bits 7, 4:0 are disabled. 1 Enable pull resistors for port E input pins bits 7, 4:0. Note:Pins 5 and 6 of port E have pull resistors which are only enabled during reset. This bit has no effect on these pins. 1 Pull resistors Port B Enable PUPBE 0 Port B pull resistors are disabled. 1 Enable pull resistors for all port B input pins. 0 Pull resistors Port A Enable PUPAE 0 Port A pull resistors are disabled. 1 Enable pull resistors for all port A input pins. 4.3.2.11 Reduced Drive Register (RDRIV) Module Base + 0x000D Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 RDRK RDPE RDPB RDPA W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-15. Reduced Drive Register (RDRIV) Read: Anytime (provided this register is in the map) Write: Anytime (provided this register is in the map) Thisregisterisusedtoselectreduceddriveforthepinsassociatedwiththecoreports.Thisgivesreduced powerconsumptionandreducedRFIwithaslightincreaseintransitiontime(dependingonloading).This feature would be used on ports which have a light loading. The reduced drive function is independent of which function is being used on a particular port. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. 146 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Table4-10. RDRIV Field Descriptions Field Description 7 Reduced Drive of Port K RDRK 0 All port K output pins have full drive enabled. 1 All port K output pins have reduced drive enabled. 4 Reduced Drive of Port E RDPE 0 All port E output pins have full drive enabled. 1 All port E output pins have reduced drive enabled. 1 Reduced Drive of Port B RDPB 0 All port B output pins have full drive enabled. 1 All port B output pins have reduced drive enabled. 0 Reduced Drive of Ports A RDPA 0 All port A output pins have full drive enabled. 1 All port A output pins have reduced drive enabled. 4.3.2.12 External Bus Interface Control Register (EBICTL) Module Base + 0x000E Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 ESTR W Reset: Peripheral 0 0 0 0 0 0 0 0 All other modes 0 0 0 0 0 0 0 1 = Unimplemented or Reserved Figure4-16. External Bus Interface Control Register (EBICTL) Read: Anytime (provided this register is in the map) Write: Refer to individual bit descriptions below The EBICTL register is used to control miscellaneous functions (i.e., stretching of external E clock). Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. Table4-11. EBICTL Field Descriptions Field Description 0 EClockStretches—ThiscontrolbitdetermineswhethertheEclockbehavesasasimplefree-runningclockor ESTR as a bus control signal that is active only for external bus cycles. Normal and Emulation: write once Special: write anytime 0 E never stretches (always free running). 1 E stretches high during stretched external accesses and remains low during non-visible internal accesses. This bit has no effect in single-chip modes. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 147 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.13 Reserved Register Module Base + 0x000F Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-17. Reserved Register This register location is not used (reserved). All bits in this register return logic 0s when read. Writes to this register have no effect. Thisregisterisnotintheon-chipmemorymapinexpandedandspecialperipheralmodes.Therefore,these accesses will be echoed externally. 4.3.2.14 IRQ Control Register (IRQCR) Module Base + 0x001E Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 IRQE IRQEN W Reset 0 1 0 0 0 0 0 0 = Unimplemented or Reserved Figure4-18. IRQ Control Register (IRQCR) Read: See individual bit descriptions below Write: See individual bit descriptions below Table4-12. IRQCR Field Descriptions Field Description 7 IRQ Select Edge Sensitive Only IRQE Special modes: read or write anytime Normal and Emulation modes: read anytime, write once 0 IRQ configured for low level recognition. 1 IRQ configured to respond only to falling edges. Falling edges on the IRQ pin will be detected anytime IRQE=1 and will be cleared only upon a reset or the servicing of the IRQ interrupt. 6 External IRQ Enable IRQEN Normal, emulation, and special modes: read or write anytime 0 External IRQ pin is disconnected from interrupt logic. 1 External IRQ pin is connected to interrupt logic. Note:When IRQEN = 0, the edge detect latch is disabled. 148 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.15 Port K Data Register (PORTK) Module Base + 0x0032 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Alternate ECS XCS XAB19 XAB18 XAB17 XAB16 XAB15 XAB14 Pin Function Figure4-19. Port K Data Register (PORTK) Read: Anytime Write: Anytime Thisportisassociatedwiththeinternalmemoryexpansionemulationpins.Whentheportisnotenabled toemulatetheinternalmemoryexpansion,theportpinsareusedasgeneral-purposeI/O.WhenportKis operatingasageneral-purposeI/Oport,DDRKdeterminestheprimarydirectionforeachportKpin.A 1 causes the associated port pin to be an output and a 0 causes the associated pin to be a high-impedance input.ThevalueinaDDRbitalsoaffectsthesourceofdataforreadsofthecorrespondingPORTKregister. IftheDDRbitis0(input)thebufferedpininputisread.IftheDDRbitis1(output)theoutputoftheport data register is read. This register is not in the map in peripheral or expanded modes while the EMK control bit in MODE register is set. Therefore, these accesses will be echoed externally. When inputs, these pins can be selected to be high impedance or pulled up, based upon the state of the PUPKE bit in the PUCR register. Table4-13. PORTK Field Descriptions Field Description 7 Port K, Bit 7 — This bit is used as an emulation chip select signal for the emulation of the internal memory Port K, Bit 7 expansion, or as general-purpose I/O, depending upon the state of the EMK bit in the MODE register. While thisbitisusedasachipselect,theexternalbitwillreturntoitsde-assertedstate(V )forapproximately1/4 DD cyclejustafterthenegativeedgeofECLK,unlesstheexternalaccessisstretchedandECLKisfree-running (ESTR bit in EBICTL = 0). See the MMC block description chapter for additional details on when this signal will be active. 6 Port K, Bit 6 — This bit is used as an external chip select signal for most external accesses that are not Port K, Bit 6 selected byECS (see the MMC block description chapter for more details), depending upon the state the of the EMK bit in the MODE register. While this bit is used as a chip select, the external pin will return to its de- asserted state (V ) for approximately 1/4 cycle just after the negative edge of ECLK, unless the external DD access is stretched and ECLK is free-running (ESTR bit in EBICTL = 0). 5:0 PortK,Bits5:0—ThesesixbitsareusedtodeterminewhichFLASH/ROMorexternalmemoryarraypage Port K, Bits 5:0 isbeingaccessed.TheycanbeviewedasexpandedaddressesXAB19–XAB14ofthe20-bitaddressusedto accessupto1MbyteinternalFLASH/ROMorexternalmemoryarray.Alternatively,thesebitscanbeusedfor general-purpose I/O depending upon the state of the EMK bit in the MODE register. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 149 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.3.2.16 Port K Data Direction Register (DDRK) Module Base + 0x0033 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure4-20. Port K Data Direction Register (DDRK) Read: Anytime Write: Anytime ThisregisterdeterminestheprimarydirectionforeachportKpinconfiguredasgeneral-purposeI/O.This registerisnotinthemapinperipheralorexpandedmodeswhiletheEMKcontrolbitinMODEregisteris set. Therefore, these accesses will be echoed externally. Table4-14. EBICTL Field Descriptions Field Description 7:0 Data Direction Port K Bits DDRK 0 Associated pin is a high-impedance input 1 Associated pin is an output Note:It is unwise to write PORTK and DDRK as a word access. If you are changing portK pins from inputs to outputs,thedatamayhaveextratransitionsduringthewrite.ItisbesttoinitializePORTKbeforeenabling as outputs. Note:ToensurethatyoureadthecorrectvaluefromthePORTKpins,alwayswaitatleastonecycleafterwriting to the DDRK register before reading from the PORTK register. 4.4 Functional Description 4.4.1 Detecting Access Type from External Signals TheexternalsignalsLSTRB,R/W,andAB0indicatethetypeofbusaccessthatistakingplace.Accesses to the internal RAM module are the only type of access that would produce LSTRB = AB0 = 1, because the internal RAM is specifically designed to allow misaligned 16-bit accesses in a single cycle. In these cases the data for the address that was accessed is on the low half of the data bus and the data for address+ 1 is on the high half of the data bus. This is summarized in Table 4-15. Table4-15. Access Type vs. Bus Control Pins LSTRB AB0 R/W Type of Access 1 0 1 8-bit read of an even address 0 1 1 8-bit read of an odd address 1 0 0 8-bit write of an even address 0 1 0 8-bit write of an odd address 150 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) Table4-15. Access Type vs. Bus Control Pins LSTRB AB0 R/W Type of Access 0 0 1 16-bit read of an even address 1 1 1 16-bit read of an odd address (low/high data swapped) 0 0 0 16-bit write to an even address 1 1 0 16-bit write to an odd address (low/high data swapped) 4.4.2 Stretched Bus Cycles Inordertoallowfastinternalbuscyclestocoexistinasystemwithslowerexternalmemoryresources,the HCS12supportstheconceptofstretchedbuscycles(moduletimingreferenceclocksfortimersandbaud rategeneratorsarenotaffectedbythisstretching).ControlbitsintheMISCregisterintheMMCsub-block of the core specify the amount of stretch (0, 1, 2, or 3 periods of the internal bus-rate clock). While stretching, the CPU state machines are all held in their current state. At this point in the CPU bus cycle, write data would already be driven onto the data bus so the length of time write data is valid is extended inthecaseofastretchedbuscycle.ReaddatawouldnotbecapturedbythesystemuntiltheEclockfalling edge.Inthecaseofastretchedbuscycle,readdataisnotrequireduntilthespecifiedsetuptimebeforethe fallingedgeofthestretchedEclock.Thechipselects,andR/Wsignalsremainvalidduringtheperiodof stretching (throughout the stretched E high time). NOTE The address portion of the bus cycle is not stretched. 4.4.3 Modes of Operation TheoperatingmodeoutofresetisdeterminedbythestatesoftheMODC,MODB,andMODApinsduring reset(Table4-16).TheMODC,MODB,andMODAbitsintheMODEregistershowthecurrentoperating modeandprovidelimitedmodeswitchingduringoperation.ThestatesoftheMODC,MODB,andMODA pins are latched into these bits on the rising edge of the reset signal. Table4-16. Mode Selection MODC MODB MODA Mode Description 0 0 0 Special Single Chip, BDM allowed and ACTIVE. BDM is allowed in all other modes but a serial command is required to make BDM active. 0 0 1 Emulation Expanded Narrow, BDM allowed 0 1 0 Special Test (Expanded Wide), BDM allowed 0 1 1 Emulation Expanded Wide, BDM allowed 1 0 0 Normal Single Chip, BDM allowed 1 0 1 Normal Expanded Narrow, BDM allowed 1 1 0 Peripheral; BDM allowed but bus operations would cause bus conflicts (must not be used) 1 1 1 Normal Expanded Wide, BDM allowed Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 151 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) There are two basic types of operating modes: 1. Normal modes: Some registers and bits are protected against accidental changes. 2. Special modes: Allow greater access to protected control registers and bits for special purposes such as testing. A system development and debug feature, background debug mode (BDM), is available in all modes. In special single-chip mode, BDM is active immediately after reset. Some aspects of Port E are not mode dependent. Bit 1 of Port E is a general purpose input or the IRQ interruptinput.IRQcanbeenabledbybitsintheCPU’sconditioncodesregisterbutitisinhibitedatreset sothispinisinitiallyconfiguredasasimpleinputwithapull-up.Bit0ofPortEisageneralpurposeinput or theXIRQ interrupt input. XIRQ can be enabled by bits in the CPU’s condition codes register but it is inhibited at reset so this pin is initially configured as a simple input with a pull-up. The ESTR bit in the EBICTLregister issettoone byreset inanyusermode.Thisassures thatthereset vectorcan befetched evenifitislocatedinanexternalslowmemorydevice.ThePE6/MODB/IPIPE1andPE5/MODA/IPIPE0 pins act as high-impedance mode select inputs during reset. The following paragraphs discuss the default bus setup and describe which aspects of the bus can be changed after reset on a per mode basis. 4.4.3.1 Normal Operating Modes Thesemodesprovidethreeoperatingconfigurations.Backgrounddebugisavailableinallthreemodes,but must first be enabled for some operations by means of a BDM background command, then activated. 4.4.3.1.1 Normal Single-Chip Mode There is no external expansion bus in this mode. All pins of Ports A, B and E are configured as general purpose I/O pins Port E bits 1 and 0 are available as general purpose input only pins with internal pull resistors enabled. All other pins of Port E are bidirectional I/O pins that are initially configured as high- impedance inputs with internal pull resistors enabled. Ports A and B are configured as high-impedance inputs with their internal pull resistors disabled. ThepinsassociatedwithPortEbits6,5,3,and2cannotbeconfiguredfortheiralternatefunctionsIPIPE1, IPIPE0, LSTRB, and R/W while the MCU is in single chip modes. In single chip modes, the associated control bits PIPOE, LSTRE, and RDWE are reset to zero. Writing the opposite state into them in single chip mode does not change the operation of the associated Port E pins. Innormalsinglechipmode,theMODEregisteriswritableonetime.Thisallowsauserprogramtochange the bus mode to narrow or wide expanded mode and/or turn on visibility of internal accesses. PortE,bit4canbeconfiguredforafree-runningEclockoutputbyclearingNECLK=0.Typicallytheonly use for an E clock output while the MCU is in single chip modes would be to get a constant speed clock for use in the external application system. 152 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.4.3.1.2 Normal Expanded Wide Mode In expanded wide modes, Ports A and B are configured as a 16-bit multiplexed address and data bus and PortEbit4isconfiguredastheEclockoutputsignal.Thesesignalsallowexternalmemoryandperipheral devices to be interfaced to the MCU. Port E pins other than PE4/ECLK are configured as general purpose I/O pins (initially high-impedance inputs with internal pull resistors enabled). Control bits PIPOE, NECLK, LSTRE, and RDWE in the PEARregistercanbeusedtoconfigurePortEpinstoactasbuscontroloutputsinsteadofgeneralpurpose I/O pins. ItispossibletoenablethepipestatussignalsonPortEbits6and5bysettingthePIPOEbitinPEAR,but itwouldbeunusualtodosointhismode.Developmentsystemswherepipestatussignalsaremonitored would typically use the special variation of this mode. ThePortEbit2pincanbereconfiguredastheR/Wbuscontrolsignalbywriting“1”totheRDWEbitin PEAR.Iftheexpandedsystemincludesexternaldevicesthatcanbewritten,suchasRAM,theRDWEbit wouldneedtobesetbeforeanyattempttowritetoanexternallocation.Iftherearenowritableresources in the external system, PE2 can be left as a general purpose I/O pin. ThePortEbit3pincanbereconfiguredastheLSTRBbuscontrolsignalbywriting“1”totheLSTREbit inPEAR.ThedefaultconditionofthispinisageneralpurposeinputbecausetheLSTRBfunctionisnot needed in all expanded wide applications. The Port E bit 4 pin is initially configured as ECLK output with stretch. The E clock output function dependsuponthesettingsoftheNECLKbitinthePEARregister,theIVISbitintheMODEregisterand theESTRbitintheEBICTLregister.TheEclockisavailableforuseinexternalselectdecodelogicoras a constant speed clock for use in the external application system. 4.4.3.1.3 Normal Expanded Narrow Mode Thismodeisusedforlowercostproductionsystemsthatuse8-bitwideexternalEPROMsorRAMs.Such systems take extra bus cycles to access 16-bit locations but this may be preferred over the extra cost of additional external memory devices. PortsAandBareconfiguredasa16-bitaddressbusandPortAismultiplexedwithdata.Internalvisibility is not available in this mode because the internal cycles would need to be split into two 8-bit cycles. Since the PEAR register can only be written one time in this mode, use care to set all bits to the desired states during the single allowed write. ThePE3/LSTRBpinisalwaysageneralpurposeI/Opininnormalexpandednarrowmode.Althoughitis possible to write the LSTRE bit in PEAR to “1” in this mode, the state of LSTRE is overridden and Port E bit 3 cannot be reconfigured as theLSTRB output. ItispossibletoenablethepipestatussignalsonPortEbits6and5bysettingthePIPOEbitinPEAR,but it would be unusual to do so in this mode. LSTRB would also be needed to fully understand system activity. Development systems where pipe status signals are monitored would typically use special expanded wide mode or occasionally special expanded narrow mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 153 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) The PE4/ECLK pin is initially configured as ECLK output with stretch. The E clock output function dependsuponthesettingsoftheNECLKbitinthePEARregister,theIVISbitintheMODEregisterand theESTRbitintheEBICTLregister.Innormalexpandednarrowmode,theEclockisavailableforusein external select decode logic or as a constant speed clock for use in the external application system. The PE2/R/W pin is initially configured as a general purpose input with an internal pull resistor enabled but this pin can be reconfigured as the R/W bus control signal by writing “1” to the RDWE bit in PEAR. IftheexpandednarrowsystemincludesexternaldevicesthatcanbewrittensuchasRAM,theRDWEbit wouldneedtobesetbeforeanyattempttowritetoanexternallocation.Iftherearenowritableresources in the external system, PE2 can be left as a general purpose I/O pin. 4.4.3.1.4 Emulation Expanded Wide Mode In expanded wide modes, Ports A and B are configured as a 16-bit multiplexed address and data bus and PortEprovidesbuscontrolandstatussignals.Thesesignalsallowexternalmemoryandperipheraldevices tobeinterfacedtotheMCU.Thesesignalscanalsobeusedbyalogicanalyzertomonitortheprogressof application programs. The bus control related pins in Port E (PE7/NOACC, PE6/MODB/IPIPE1, PE5/MODA/IPIPE0, PE4/ECLK, PE3/LSTRB/TAGLO, and PE2/R/W) are all configured to serve their bus control output functions rather than general purpose I/O. Notice that writes to the bus control enable bits in the PEAR register in emulation mode are restricted. 4.4.3.1.5 Emulation Expanded Narrow Mode Expanded narrow modes are intended to allow connection of single 8-bit external memory devices for lowercostsystemsthatdonotneedtheperformanceofafull16-bitexternaldatabus.Accessestointernal resourcesthathavebeenmappedexternal(i.e.PORTA,PORTB,DDRA,DDRB,PORTE,DDRE,PEAR, PUCR, RDRIV) will be accessed with a 16-bit data bus on Ports A and B. Accesses of 16-bit external words to addresses which are normally mapped external will be broken into two separate 8-bit accesses usingPortAasan8-bitdatabus.Internaloperationscontinuetousefull16-bitdatapaths.Theyareonly visible externally as 16-bit information if IVIS=1. Ports A and B are configured as multiplexed address and data output ports. During external accesses, address A15, data D15 and D7 are associated with PA7, address A0 is associated with PB0 and data D8 and D0 are associated with PA0. During internal visible accesses and accesses to internal resources that have been mapped external, address A15 and data D15 is associated with PA7 and address A0 and data D0 is associated with PB0. The bus control related pins in Port E (PE7/NOACC, PE6/MODB/IPIPE1, PE5/MODA/IPIPE0, PE4/ECLK, PE3/LSTRB/TAGLO, and PE2/R/W) are all configured to serve their bus control output functions rather than general purpose I/O. Notice that writes to the bus control enable bits in the PEAR register in emulation mode are restricted. Themaindifferencebetweenspecialmodesandnormalmodesisthatsomeofthebuscontrolandsystem control signals cannot be written in emulation modes. 154 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) 4.4.3.2 Special Operating Modes Therearetwospecialoperatingmodesthatcorrespondtonormaloperatingmodes.Theseoperatingmodes are commonly used in factory testing and system development. 4.4.3.2.1 Special Single-Chip Mode WhentheMCUisresetinthismode,thebackgrounddebugmodeisenabledandactive.TheMCUdoes not fetch the reset vector and execute application code as it would in other modes. Instead the active background mode is in control of CPU execution and BDM firmware is waiting for additional serial commands through the BKGD pin. When a serial command instructs the MCU to return to normal execution, the system will be configured as described below unless the reset states of internal control registers have been changed through background commands after the MCU was reset. Thereisnoexternalexpansionbusafterresetinthismode.PortsAandBareinitiallysimplebidirectional I/O pins that are configured as high-impedance inputs with internal pull resistors disabled; however, writingtothemodeselectbitsintheMODEregister(whichisallowedinspecialmodes)canchangethis after reset. All of the Port E pins (except PE4/ECLK) are initially configured as general purpose high- impedance inputs with internal pull resistors enabled. PE4/ECLK is configured as the E clock output in this mode. ThepinsassociatedwithPortEbits6,5,3,and2cannotbeconfiguredfortheiralternatefunctionsIPIPE1, IPIPE0, LSTRB, and R/W while the MCU is in single chip modes. In single chip modes, the associated control bits PIPOE, LSTRE and RDWE are reset to zero. Writing the opposite value into these bits in single chip mode does not change the operation of the associated Port E pins. PortE,bit4canbeconfiguredforafree-runningEclockoutputbyclearingNECLK=0.Typicallytheonly use for an E clock output while the MCU is in single chip modes would be to get a constant speed clock for use in the external application system. 4.4.3.2.2 Special Test Mode Inexpandedwidemodes,PortsAandBareconfiguredasa16-bitmultiplexedaddressanddatabusand Port E provides bus control and status signals. In special test mode, the write protection of many control bits is lifted so that they can be thoroughly tested without needing to go through reset. 4.4.3.3 Test Operating Mode Thereisatestoperatingmodeinwhichanexternalmaster,suchasanI.C.tester,cancontroltheon-chip peripherals. 4.4.3.3.1 Peripheral Mode This mode is intended for factory testing of the MCU. In this mode, the CPU is inactive and an external (tester)busmasterdrivesaddress,dataandbuscontrolsignalsinthroughPortsA,BandE.Ineffect,the whole MCU acts as if it was a peripheral under control of an external CPU. This allows faster testing of on-chip memory and peripherals than previous testing methods. Since the mode control register is not accessibleinperipheralmode,theonlywaytochangetoanothermodeistoresettheMCUintoadifferent Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 155 Rev 01.24

Chapter4 Multiplexed External Bus Interface (MEBIV3) mode.BackgrounddebuggingshouldnotbeusedwhiletheMCUisinspecialperipheralmodeasinternal bus conflicts between BDM and the external master can cause improper operation of both functions. 4.4.4 Internal Visibility Internal visibility is available when the MCU is operating in expanded wide modes or emulation narrow mode.Itisnotavailableinsingle-chip,peripheralornormalexpandednarrowmodes.Internalvisibilityis enabled by setting the IVIS bit in the MODE register. IfaninternalaccessismadewhileE,R/W,andLSTRBareconfiguredasbuscontroloutputsandinternal visibilityisoff(IVIS=0),Ewillremainlowforthecycle,R/Wwillremainhigh,andaddress,dataandthe LSTRB pins will remain at their previous state. Wheninternalvisibilityisenabled(IVIS=1),certaininternalcycleswillbeblockedfromgoingexternal. DuringcycleswhentheBDMisselected,R/Wwillremainhigh,datawillmaintainitspreviousstate,and addressandLSTRBpinswillbeupdatedwiththeinternalvalue.DuringCPUnoaccesscycleswhenthe BDM is not driving, R/W will remain high, and address, data and theLSTRB pins will remain at their previous state. NOTE When the system is operating in a secure mode, internal visibility is not available (i.e., IVIS = 1 has no effect). Also, the IPIPE signals will not be visible, regardless of operating mode. IPIPE1–IPIPE0 will display 0es if they are enabled. In addition, the MOD bits in the MODE control register cannot be written. 4.4.5 Low-Power Options The MEBI does not contain any user-controlled options for reducing power consumption. The operation of the MEBI in low-power modes is discussed in the following subsections. 4.4.5.1 Operation in Run Mode TheMEBIdoesnotcontainanyoptionsforreducingpowerinrunmode;however,theexternaladdresses are conditioned to reduce power in single-chip modes. Expanded bus modes will increase power consumption. 4.4.5.2 Operation in Wait Mode The MEBI does not contain any options for reducing power in wait mode. 4.4.5.3 Operation in Stop Mode The MEBI will cease to function after execution of a CPU STOP instruction. 156 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 5 Interrupt (INTV1) Block Description 5.1 Introduction This section describes the functionality of the interrupt (INT) sub-block of the S12 core platform. A block diagram of the interrupt sub-block is shown in Figure5-1. INT HPRIO (OPTIONAL) WRITE DATA BUS HIGHEST PRIORITY I-INTERRUPT INTERRUPTS INTERRUPT INPUT REGISTERS XMASK READ DATA BUS AND CONTROL REGISTERS IMASK WAKEUP R O T C E V O QUALIFIED RI P INTERRUPTS H INTERRUPT PENDING RESET FLAGS PRIORITY DECODER VECTOR REQUEST VECTOR ADDRESS Figure5-1. INTV1 Block Diagram Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 157 Rev 01.24

Chapter5 Interrupt (INTV1) Block Description Theinterruptsub-blockdecodesthepriorityofallsystemexceptionrequestsandprovidestheapplicable vectorforprocessingtheexception.TheINTsupportsI-bitmaskableandX-bitmaskableinterrupts,anon- maskable unimplemented opcode trap, a non-maskable software interrupt (SWI) or background debug moderequest,andthreesystemresetvectorrequests.Allinterruptrelatedexceptionrequestsaremanaged by the interrupt sub-block (INT). 5.1.1 Features The INT includes these features: • Provides two to 122 I-bit maskable interrupt vectors (0xFF00–0xFFF2) • Provides one X-bit maskable interrupt vector (0xFFF4) • Provides a non-maskable software interrupt (SWI) or background debug mode request vector (0xFFF6) • Provides a non-maskable unimplemented opcode trap (TRAP) vector (0xFFF8) • Provides three system reset vectors (0xFFFA–0xFFFE) (reset, CMR, and COP) • Determines the appropriate vector and drives it onto the address bus at the appropriate time • Signals the CPU that interrupts are pending • Provides control registers which allow testing of interrupts • Provides additional input signals which prevents requests for servicing I and X interrupts • WakesthesystemfromstoporwaitmodewhenanappropriateinterruptoccursorwheneverXIRQ is active, even if XIRQ is masked • Provides asynchronous path for all I and X interrupts, (0xFF00–0xFFF4) • (Optional) selects and stores the highest priority I interrupt based on the value written into the HPRIO register 5.1.2 Modes of Operation ThefunctionalityoftheINTsub-blockinvariousmodesofoperationisdiscussedinthesubsectionsthat follow. • Normal operation The INT operates the same in all normal modes of operation. • Special operation Interrupts may be tested in special modes through the use of the interrupt test registers. • Emulation modes The INT operates the same in emulation modes as in normal modes. • Low power modes See Section5.4.1, “Low-Power Modes,” for details 158 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter5 Interrupt (INTV1) Block Description 5.2 External Signal Description Mostinterfacingwiththeinterruptsub-blockisdonewithinthecore.However,theinterruptdoesreceive direct input from the multiplexed external bus interface (MEBI) sub-block of the core for the IRQ and XIRQ pin data. 5.3 Memory Map and Register Definition Detailed descriptions of the registers and associated bits are given in the subsections that follow. 5.3.1 Module Memory Map Table5-1. INT Memory Map Address Use Access Offset 0x0015 Interrupt Test Control Register (ITCR) R/W 0x0016 Interrupt Test Registers (ITEST) R/W 0x001F Highest Priority Interrupt (Optional) (HPRIO) R/W 5.3.2 Register Descriptions 5.3.2.1 Interrupt Test Control Register Module Base + 0x0015 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 0 0 WRTINT ADR3 ADR2 ADR1 ADR0 W Reset 0 0 0 0 1 1 1 1 = Unimplemented or Reserved Figure5-2. Interrupt Test Control Register (ITCR) Read: See individual bit descriptions Write: See individual bit descriptions Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 159 Rev 01.24

Chapter5 Interrupt (INTV1) Block Description Table5-2. ITCR Field Descriptions Field Description 4 Write to the Interrupt Test Registers WRTINT Read: anytime Write: only in special modes and with I-bit mask and X-bit mask set. 0 Disables writes to the test registers; reads of the test registers will return the state of the interrupt inputs. 1 Disconnect the interrupt inputs from the priority decoder and use the values written into the ITEST registers instead. Note:Any interrupts which are pending at the time that WRTINT is set will remain until they are overwritten. 3:0 Test Register Select Bits ADR[3:0] Read: anytime Write: anytime Thesebitsdeterminewhichtestregisterisselectedonareadorwrite.Thehexadecimalvaluewrittenherewill bethesameastheuppernibbleofthelowerbyteofthevectorselects.Thatis,an“F”writtenintoADR[3:0]will select vectors 0xFFFE–0xFFF0 while a “7” written to ADR[3:0] will select vectors 0xFF7E–0xFF70. 5.3.2.2 Interrupt Test Registers Module Base + 0x0016 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R INTE INTC INTA INT8 INT6 INT4 INT2 INT0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure5-3. Interrupt TEST Registers (ITEST) Read:Onlyinspecialmodes.Readswillreturneitherthestateoftheinterruptinputsoftheinterruptsub- block (WRTINT = 0) or the values written into the TEST registers (WRTINT = 1). Reads will always return 0s in normal modes. Write: Only in special modes and with WRTINT = 1 and CCR I mask = 1. 160 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter5 Interrupt (INTV1) Block Description Table5-3. ITEST Field Descriptions Field Description 7:0 Interrupt TEST Bits — These registers are used in special modes for testing the interrupt logic and priority INT[E:0] independent of the system configuration. Each bit is used to force a specific interrupt vector by writing it to a logic1state.BitsarenamedINTEthroughINT0toindicatevectors0xFFxEthrough0xFFx0.Thesebitscanbe written only in special modes and only with the WRTINT bit set (logic 1) in the interrupt test control register (ITCR).Inaddition,IinterruptsmustbemaskedusingtheIbitintheCCR.Inthisstate,theinterruptinputlines to the interrupt sub-block will be disconnected and interrupt requests will be generated only by this register. These bits can also be read in special modes to view that an interrupt requested by a system block (such as a peripheral block) has reached the INT module. Thereisatestregisterimplementedforeveryeightinterruptsintheoverallsystem.Allofthetestregistersshare the same address and are individually selected using the value stored in the ADR[3:0] bits of the interrupt test control register (ITCR). Note:When ADR[3:0] have the value of 0x000F, only bits 2:0 in the ITEST register will be accessible. That is, vectors higher than 0xFFF4 cannot be tested using the test registers and bits 7:3 will always read as a logic0.IfADR[3:0]pointtoanunimplementedtestregister,writeswillhavenoeffectandreadswillalways return a logic 0 value. 5.3.2.3 Highest Priority I Interrupt (Optional) Module Base + 0x001F Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 PSEL7 PSEL6 PSEL5 PSEL4 PSEL3 PSEL2 PSEL1 W Reset 1 1 1 1 0 0 1 0 = Unimplemented or Reserved Figure5-4. Highest Priority I Interrupt Register (HPRIO) Read: Anytime Write: Only if I mask in CCR = 1 Table5-4. HPRIO Field Descriptions Field Description 7:1 HighestPriorityIInterruptSelectBits—ThestateofthesebitsdetermineswhichI-bitmaskableinterruptwill PSEL[7:1] bepromotedtohighestpriority(oftheI-bitmaskableinterrupts).Topromoteaninterrupt,theuserwritestheleast significantbyteoftheassociatedinterruptvectoraddresstothisregister.Ifanunimplementedvectoraddressor anonI-bitmaskedvectoraddress(valuehigherthan0x00F2)iswritten,IRQ(0xFFF2)willbethedefaulthighest priority interrupt. 5.4 Functional Description The interrupt sub-block processes all exception requests made by the CPU. These exceptions include interruptvectorrequestsandresetvectorrequests.Eachoftheseexceptiontypesandtheiroverallpriority level is discussed in the subsections below. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 161 Rev 01.24

Chapter5 Interrupt (INTV1) Block Description 5.4.1 Low-Power Modes TheINTdoesnotcontainanyuser-controlledoptionsforreducingpowerconsumption.Theoperationof the INT in low-power modes is discussed in the following subsections. 5.4.1.1 Operation in Run Mode The INT does not contain any options for reducing power in run mode. 5.4.1.2 Operation in Wait Mode Clocks to the INT can be shut off during system wait mode and the asynchronous interrupt path will be used to generate the wake-up signal upon recognition of a valid interrupt or any XIRQ request. 5.4.1.3 Operation in Stop Mode Clocks to the INT can be shut off during system stop mode and the asynchronous interrupt path will be used to generate the wake-up signal upon recognition of a valid interrupt or any XIRQ request. 5.5 Resets The INT supports three system reset exception request types: normal system reset or power-on-reset request,crystalmonitorresetrequest,andCOPwatchdogresetrequest.Thetypeofresetexceptionrequest must be decoded by the system and the proper request made to the core. The INT will then provide the service routine address for the type of reset requested. 5.6 Interrupts AsshownintheblockdiagraminFigure 5-1,theINTcontainsaregisterblocktoprovideinterruptstatus and control, an optional highest priority I interrupt (HPRIO) block, and a priority decoder to evaluate whether pending interrupts are valid and assess their priority. 5.6.1 Interrupt Registers The INT registers are accessible only in special modes of operation and function as described in Section5.3.2.1, “Interrupt Test Control Register,” andSection5.3.2.2, “Interrupt Test Registers,” previously. 5.6.2 Highest Priority I-Bit Maskable Interrupt When the optional HPRIO block is implemented, the user is allowed to promote a single I-bit maskable interrupt to be the highest priority I interrupt. The HPRIO evaluates all interrupt exception requests and passes the HPRIO vector to the priority decoder if the highest priority Iinterrupt is active. RTI replaces the promoted interrupt source. 162 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter5 Interrupt (INTV1) Block Description 5.6.3 Interrupt Priority Decoder Theprioritydecoderevaluatesallinterruptspendinganddeterminestheirvalidityandpriority.Whenthe CPU requests an interrupt vector, the decoder will provide the vector for the highest priority interrupt request. Because the vector is not supplied until the CPU requests it, it is possible that a higher priority interrupt request could override the original exception that caused the CPU to request the vector. In this case,theCPUwillreceivethehighestpriorityvectorandthesystemwillprocessthisexceptioninsteadof the original request. NOTE Caremustbetakentoensurethatallexceptionrequestsremainactiveuntil thesystembeginsexecutionoftheapplicableserviceroutine;otherwise,the exception request may not be processed. If for any reason the interrupt source is unknown (e.g., an interrupt request becomes inactive after the interrupthasbeenrecognizedbutpriortothevectorrequest),thevectoraddresswilldefaulttothatofthe last valid interrupt that existed during the particular interrupt sequence. If the CPU requests an interrupt vectorwhentherehasneverbeenapendinginterruptrequest,theINTwillprovidethesoftwareinterrupt (SWI) vector address. 5.7 Exception Priority Thepriority(fromhighesttolowest)andaddressofallexceptionvectorsissuedbytheINTuponrequest by the CPU is shown in Table5-5. Table5-5. Exception Vector Map and Priority Vector Address Source 0xFFFE–0xFFFF System reset 0xFFFC–0xFFFD Crystal monitor reset 0xFFFA–0xFFFB COP reset 0xFFF8–0xFFF9 Unimplemented opcode trap 0xFFF6–0xFFF7 Software interrupt instruction (SWI) or BDM vector request 0xFFF4–0xFFF5 XIRQ signal 0xFFF2–0xFFF3 IRQ signal 0xFFF0–0xFF00 Device-specificI-bitmaskableinterruptsources(priorityindescendingorder) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 163 Rev 01.24

Chapter5 Interrupt (INTV1) Block Description 164 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 6 Background Debug Module (BDMV4) Block Description 6.1 Introduction Thissectiondescribesthefunctionalityofthebackgrounddebugmodule(BDM)sub-blockoftheHCS12 core platform. A block diagram of the BDM is shown in Figure6-1. HOST 16-BIT SHIFT REGISTER SYSTEM BKGD ADDRESS ENTAG BUS INTERFACE INSTRUCTION DECODE BDMACT AND DATA AND EXECUTION CONTROL LOGIC TRACE CLOCKS SDV STANDARD BDM FIRMWARE CLKSW ENBDM LOOKUP TABLE Figure6-1. BDM Block Diagram Thebackgrounddebugmodule(BDM)sub-blockisasingle-wire,backgrounddebugsystemimplemented inon-chiphardwareforminimalCPUintervention.AllinterfacingwiththeBDMisdoneviatheBKGD pin. BDMV4 has enhanced capability for maintaining synchronization between the target and host while allowingmoreflexibilityinclockrates.Thisincludesasyncsignaltoshowtheclockrateandahandshake signaltoindicatewhenanoperationiscomplete.Thesystemisbackwardscompatiblewitholderexternal interfaces. 6.1.1 Features • Single-wire communication with host development system • BDMV4 (and BDM2): Enhanced capability for allowing more flexibility in clock rates • BDMV4: SYNC command to determine communication rate • BDMV4: GO_UNTIL command • BDMV4: Hardware handshake protocol to increase the performance of the serial communication • Active out of reset in special single-chip mode Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 165 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description • Nine hardware commands using free cycles, if available, for minimal CPU intervention • Hardware commands not requiring active BDM • 15 firmware commands execute from the standard BDM firmware lookup table • Instruction tagging capability • Software control of BDM operation during wait mode • Software selectable clocks • Whensecured,hardwarecommandsareallowedtoaccesstheregisterspaceinspecialsingle-chip mode, if the FLASH and EEPROM erase tests fail. 6.1.2 Modes of Operation BDM is available in all operating modes but must be enabled before firmware commands are executed. Some system peripherals may have a control bit which allows suspending the peripheral function during background debug mode. 6.1.2.1 Regular Run Modes Alloftheseoperationsrefertothepartinrunmode.TheBDMdoesnotprovidecontrolstoconservepower during run mode. • Normal operation General operation of the BDM is available and operates the same in all normal modes. • Special single-chip mode In special single-chip mode, background operation is enabled and active out of reset. This allows programming a system with blank memory. • Special peripheral mode BDM is enabled and active immediately out of reset. BDM can be disabled by clearing the BDMACTbitintheBDMstatus(BDMSTS)register.TheBDMserialsystemshouldnotbeused in special peripheral mode. NOTE TheBDMserialsystemshouldnotbeusedinspecialperipheralmodesince the CPU, which in other modes interfaces with the BDM to relinquish controlofthebusduringafreecycleorastealoperation,isnotoperatingin this mode. • Emulation modes General operation of the BDM is available and operates the same as in normal modes. 6.1.2.2 Secure Mode Operation Ifthepartisinsecuremode,theoperationoftheBDMisreducedtoasmallsubsetofitsregularrunmode operation. Secure operation prevents access to FLASH or EEPROM other than allowing erasure. 166 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.2 External Signal Description A single-wire interface pin is used to communicate with the BDM system. Two additional pins are used forinstructiontagging.Thesepinsarepartofthemultiplexedexternalbusinterface(MEBI)sub-blockand all interfacing between the MEBI and BDM is done within the core interface boundary. Functional descriptions of the pins are provided below for completeness. • BKGD — Background interface pin • TAGHI — High byte instruction tagging pin • TAGLO — Low byte instruction tagging pin • BKGD andTAGHI share the same pin. • TAGLO and LSTRB share the same pin. NOTE Generally these pins are shared as described, but it is best to check the device overview chapter to make certain. All MCUs at the time of this writing have followed this pin sharing scheme. 6.2.1 BKGD — Background Interface Pin Debugging control logic communicates with external devices serially via the single-wire background interface pin (BKGD). During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the background debug mode. 6.2.2 TAGHI — High Byte Instruction Tagging Pin Thispinisusedtotagthehighbyteofaninstruction.Wheninstructiontaggingison,alogic0atthefalling edgeoftheexternalclock(ECLK)tagsthehighhalfoftheinstructionwordbeingreadintotheinstruction queue. 6.2.3 TAGLO — Low Byte Instruction Tagging Pin This pin is used to tag the low byte of an instruction. When instruction tagging is on and low strobe is enabled,alogic0atthefallingedgeoftheexternalclock(ECLK)tagsthelowhalfoftheinstructionword being read into the instruction queue. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 167 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.3 Memory Map and Register Definition A summary of the registers associated with the BDM is shown in Figure6-2. Registers are accessed by host-driven communications to the BDM hardware using READ_BD and WRITE_BD commands. Detailed descriptions of the registers and associated bits are given in the subsections that follow. 6.3.1 Module Memory Map Table6-1. INT Memory Map Register Use Access Address 0xFF00 Reserved — 0xFF01 BDM Status Register (BDMSTS) R/W 0xFF02– Reserved — 0xFF05 0xFF06 BDM CCR Holding Register (BDMCCR) R/W 0xFF07 BDM Internal Register Position (BDMINR) R 0xFF08– Reserved — 0xFF0B 168 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.3.2 Register Descriptions Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0xFF00 R X X X X X X 0 0 Reserved W 0xFF01 R BDMACT SDV TRACE UNSEC 0 ENBDM ENTAG CLKSW BDMSTS W 0xFF02 R X X X X X X X X Reserved W 0xFF03 R X X X X X X X X Reserved W 0xFF04 R X X X X X X X X Reserved W 0xFF05 R X X X X X X X X Reserved W 0xFF06 R CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 BDMCCR W 0xFF07 R 0 REG14 REG13 REG12 REG11 0 0 0 BDMINR W 0xFF08 R 0 0 0 0 0 0 0 0 Reserved W 0xFF09 R 0 0 0 0 0 0 0 0 Reserved W 0xFF0A R X X X X X X X X Reserved W 0xFF0B R X X X X X X X X Reserved W = Unimplemented, Reserved = Implemented (do not alter) X = Indeterminate 0 = Always read zero Figure6-2. BDM Register Summary Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 169 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.3.2.1 BDM Status Register (BDMSTS) 0xFF01 7 6 5 4 3 2 1 0 R BDMACT SDV TRACE UNSEC 0 ENBDM ENTAG CLKSW W Reset: Special single-chip mode: 1(1) 1 0 0 0 0 0(2) 0 Special peripheral mode: 0 1 0 0 0 0 0 0 All other modes: 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved = Implemented (do not alter) Figure6-3. BDM Status Register (BDMSTS) Note: 1. ENBDM is read as "1" by a debugging environment in Special single-chip mode when the device is not secured or secured butfullyerased(FlashandEEPROM).ThisisbecausetheENBDMbitissetbythestandardfirmwarebeforeaBDMcommand can be fully transmitted and executed. 2.UNSECisreadas"1"byadebuggingenvironmentinSpecialsingle-chipmodewhenthedeviceissecuredandfullyerased, else it is "0" and can only be read if not secure (see also bit description). Read: All modes through BDM operation Write: All modes but subject to the following: • BDMACTcanonlybesetbyBDMhardwareuponentryintoBDM.Itcanonlybeclearedbythe standard BDM firmware lookup table upon exit from BDM active mode. • CLKSW can only be written via BDM hardware or standard BDM firmware write commands. • All other bits, while writable via BDM hardware or standard BDM firmware write commands, should only be altered by the BDM hardware or standard firmware lookup table as part of BDM command execution. • ENBDM should only be set via a BDM hardware command if the BDM firmware commands are needed. (This does not apply in special single-chip mode). 170 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description Table6-2. BDMSTS Field Descriptions Field Description 7 Enable BDM — This bit controls whether the BDM is enabled or disabled. When enabled, BDM can be made ENBDM active to allow firmware commands to be executed. When disabled, BDM cannot be made active but BDM hardware commands are allowed. 0 BDM disabled 1 BDM enabled Note:ENBDMissetbythefirmwareimmediatelyoutofresetinspecialsingle-chipmode.Insecuremode,this bit will not be set by the firmware until after the EEPROM and FLASH erase verify tests are complete. 6 BDM Active Status — This bit becomes set upon entering BDM. The standard BDM firmware lookup table is BDMACT then enabled and put into the memory map. BDMACT is cleared by a carefully timed store instruction in the standardBDMfirmwareaspartoftheexitsequencetoreturntousercodeandremovetheBDMmemoryfrom the map. 0 BDM not active 1 BDM active 5 Tagging Enable — This bit indicates whether instruction tagging in enabled or disabled. It is set when the ENTAG TAGGO command is executed and cleared when BDM is entered. The serial system is disabled and the tag functionenabled16cyclesafterthisbitiswritten.BDMcannotprocessserialcommandswhiletaggingisactive. 0 Tagging not enabled or BDM active 1 Tagging enabled 4 ShiftDataValid—ThisbitissetandclearedbytheBDMhardware.Itissetafterdatahasbeentransmittedas SDV part of a firmware read command or after data has been received as part of a firmware write command. It is cleared when the next BDM command has been received or BDM is exited. SDV is used by the standard BDM firmware to control program flow execution. 0 Data phase of command not complete 1 Data phase of command is complete 3 TRACE1 BDM Firmware Command is Being Executed— This bit gets set when a BDM TRACE1 firmware TRACE command is first recognized. It will stay set as long as continuous back-to-back TRACE1 commands are executed. This bit will get cleared when the next command that is not a TRACE1 command is recognized. 0 TRACE1 command is not being executed 1 TRACE1 command is being executed Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 171 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description Table6-2. BDMSTS Field Descriptions (continued) Field Description 2 ClockSwitch—TheCLKSWbitcontrolswhichclocktheBDMoperateswith.Itisonlywritablefromahardware CLKSW BDMcommand.A150cycledelayattheclockspeedthatisactiveduringthedataportionofthecommandwill occurbeforethenewclocksourceisguaranteedtobeactive.ThestartofthenextBDMcommandusesthenew clock for timing subsequent BDM communications. Table6-3showstheresultingBDMclocksourcebasedontheCLKSWandthePLLSEL(Pllselectfromtheclock and reset generator) bits. Note:TheBDMalternateclocksourcecanonlybeselectedwhenCLKSW=0andPLLSEL=1.TheBDMserial interfaceisnowfullysynchronizedtothealternateclocksource,whenenabled.Thiseliminatesfrequency restriction on the alternate clock which was required on previous versions. Refer to the device overview section to determine which clock connects to the alternate clock source input. Note:Iftheacknowledgefunctionisturnedon,changingtheCLKSWbitwillcausetheACKtobeatthenewrate for the write command which changes it. 1 Unsecure—Thisbitisonlywritableinspecialsingle-chipmodefromtheBDMsecurefirmwareandalwaysgets UNSEC reset to zero. It is in a zero state as secure mode is entered so that the secure BDM firmware lookup table is enabled and put into the memory map along with the standard BDM firmware lookup table. ThesecureBDMfirmwarelookuptableverifiesthattheon-chipEEPROMandFLASHEEPROMareerased.This being the case, the UNSEC bit is set and the BDM program jumps to the start of the standard BDM firmware lookup table and the secure BDM firmware lookup table is turned off. If the erase test fails, the UNSEC bit will not be asserted. 0 System is in a secured mode 1 System is in a unsecured mode Note:When UNSEC is set, security is off and the user can change the state of the secure bits in the on-chip FLASH EEPROM. Note that if the user does not change the state of the bits to “unsecured” mode, the system will be secured again when it is next taken out of reset. Table6-3. BDM Clock Sources PLLSEL CLKSW BDMCLK 0 0 Bus clock 0 1 Bus clock 1 0 Alternate clock (refer to the device overview chapter to determine the alternate clock source) 1 1 Bus clock dependent on the PLL 172 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.3.2.2 BDM CCR Holding Register (BDMCCR) 0xFF06 7 6 5 4 3 2 1 0 R CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 W Reset 0 0 0 0 0 0 0 0 Figure6-4. BDM CCR Holding Register (BDMCCR) Read: All modes Write: All modes NOTE WhenBDMismadeactive,theCPUstoresthevalueoftheCCRregisterin the BDMCCR register. However, out of special single-chip reset, the BDMCCRissetto0xD8andnot0xD0whichistheresetvalueoftheCCR register. Whenenteringbackgrounddebugmode,theBDMCCRholdingregisterisusedtosavethecontentsofthe condition code register of the user’s program. It is also used for temporary storage in the standard BDM firmware mode. The BDM CCR holding register can be written to modify the CCR value. 6.3.2.3 BDM Internal Register Position Register (BDMINR) 0xFF07 7 6 5 4 3 2 1 0 R 0 REG14 REG13 REG12 REG11 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure6-5. BDM Internal Register Position (BDMINR) Read: All modes Write: Never Table6-4. BDMINR Field Descriptions Field Description 6:3 InternalRegisterMapPosition—Thesefourbitsshowthestateoftheupperfivebitsofthebaseaddressfor REG[14:11] the system’s relocatable register block. BDMINR is a shadow of the INITRG register which maps the register block to any 2Kbyte space within the first 32K bytes of the 64K byte address space. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 173 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.4 Functional Description The BDM receives and executes commands from a host via a single wire serial interface. There are two types of BDM commands, namely, hardware commands and firmware commands. Hardware commands are used to read and write target system memory locations and to enter active background debug mode, see Section6.4.3, “BDM Hardware Commands.” Target system memory includes all memory that is accessible by the CPU. FirmwarecommandsareusedtoreadandwriteCPUresourcesandtoexitfromactivebackgrounddebug mode, see Section6.4.4, “Standard BDM Firmware Commands.” The CPU resources referred to are the accumulator(D),Xindexregister(X),Yindexregister(Y),stackpointer(SP),andprogramcounter(PC). Hardware commands can be executed at any time and in any mode excluding a few exceptions as highlighted,seeSection6.4.3,“BDMHardwareCommands.”Firmwarecommandscanonlybeexecuted when the system is in active background debug mode (BDM). 6.4.1 Security If the user resets into special single-chip mode with the system secured, a secured mode BDM firmware lookup table is brought into the map overlapping a portion of the standard BDM firmware lookup table. The secure BDM firmware verifies that the on-chip EEPROM and FLASH EEPROM are erased. This being the case, the UNSEC bit will get set. The BDM program jumps to the start of the standard BDM firmware and the secured mode BDM firmware is turned off and all BDM commands are allowed. If the EEPROM or FLASH do not verify as erased, the BDM firmware sets the ENBDM bit, without asserting UNSEC, and the firmware enters a loop. This causes the BDM hardware commands to become enabled, but does not enable the firmware commands. This allows the BDM hardware to be used to erase the EEPROMandFLASH.Afterexecutionofthesecurefirmware,regardlessoftheresultsoftheerasetests, the CPU registers, INITEE and PPAGE, will no longer be in their reset state. 6.4.2 Enabling and Activating BDM ThesystemmustbeinactiveBDMtoexecutestandardBDMfirmwarecommands.BDMcanbeactivated only after being enabled. BDM is enabled by setting the ENBDM bit in the BDM status (BDMSTS) register. The ENBDM bit is set by writing to the BDM status (BDMSTS) register, via the single-wire interface, using a hardware command such as WRITE_BD_BYTE. After being enabled, BDM is activated by one of the following1: • Hardware BACKGROUND command • BDM external instruction tagging mechanism • CPU BGND instruction • Breakpoint sub-block’s force or tag mechanism2 WhenBDMisactivated,theCPUfinishesexecutingthecurrentinstructionandthenbeginsexecutingthe firmware in the standard BDM firmware lookup table. When BDM is activated by the breakpoint sub- 1. BDM is enabled and active immediately out of special single-chip reset. 2. This method is only available on systems that have a a breakpoint or a debug sub-block. 174 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description block,thetypeofbreakpointuseddeterminesifBDMbecomesactivebeforeorafterexecutionofthenext instruction. NOTE If an attempt is made to activate BDM before being enabled, the CPU resumes normal instruction execution after a brief delay. If BDM is not enabled, any hardware BACKGROUND commands issued are ignored by the BDM and the CPU is not delayed. In active BDM, the BDM registers and standard BDM firmware lookup table are mapped to addresses 0xFF00 to 0xFFFF. BDM registers are mapped to addresses 0xFF00 to 0xFF07. The BDM uses these registers which are readable anytime by the BDM. However, these registers are not readable by user programs. 6.4.3 BDM Hardware Commands Hardware commands are used to read and write target system memory locations and to enter active backgrounddebugmode.TargetsystemmemoryincludesallmemorythatisaccessiblebytheCPUsuch as on-chip RAM, EEPROM, FLASH EEPROM, I/O and control registers, and all external memory. HardwarecommandsareexecutedwithminimalornoCPUinterventionanddonotrequirethesystemto beinactiveBDMforexecution,althoughtheycancontinuetobeexecutedinthismode.Whenexecuting a hardware command, the BDM sub-block waits for a free CPU bus cycle so that the background access doesnotdisturbtherunningapplicationprogram.Ifafreecycleisnotfoundwithin128clockcycles,the CPU is momentarily frozen so that the BDM can steal a cycle. When the BDM finds a free cycle, the operation does not intrude on normal CPU operation provided that it can be completed in a single cycle. However,ifanoperationrequiresmultiplecyclestheCPUisfrozenuntiltheoperationiscomplete,even though the BDM found a free cycle. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 175 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description The BDM hardware commands are listed in Table6-5. Table6-5. Hardware Commands Opcode Command Data Description (hex) BACKGROUND 90 None Enter background mode if firmware is enabled. If enabled, an ACK will be issued when the part enters active background mode. ACK_ENABLE D5 None Enable handshake. Issues an ACK pulse after the command is executed. ACK_DISABLE D6 None Disable handshake. This command does not issue an ACK pulse. READ_BD_BYTE E4 16-bit address Read from memory with standard BDM firmware lookup table in map. 16-bit data out Odd address data on low byte; even address data on high byte. READ_BD_WORD EC 16-bit address Read from memory with standard BDM firmware lookup table in map. 16-bit data out Must be aligned access. READ_BYTE E0 16-bit address Read from memory with standard BDM firmware lookup table out of 16-bit data out map. Odd address data on low byte; even address data on high byte. READ_WORD E8 16-bit address Read from memory with standard BDM firmware lookup table out of 16-bit data out map. Must be aligned access. WRITE_BD_BYTE C4 16-bit address WritetomemorywithstandardBDMfirmwarelookuptableinmap.Odd 16-bit data in address data on low byte; even address data on high byte. WRITE_BD_WORD CC 16-bit address WritetomemorywithstandardBDMfirmwarelookuptableinmap.Must 16-bit data in be aligned access. WRITE_BYTE C0 16-bit address WritetomemorywithstandardBDMfirmwarelookuptableoutofmap. 16-bit data in Odd address data on low byte; even address data on high byte. WRITE_WORD C8 16-bit address WritetomemorywithstandardBDMfirmwarelookuptableoutofmap. 16-bit data in Must be aligned access. NOTE: If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. TheREAD_BDandWRITE_BDcommandsallowaccesstotheBDMregisterlocations.Theselocations are not normally in the system memory map but share addresses with the application in memory. To distinguishbetweenphysicalmemorylocationsthatsharethesameaddress,BDMmemoryresourcesare enabled just for the READ_BD and WRITE_BD access cycle. This allows the BDM to access BDM locations unobtrusively, even if the addresses conflict with the application memory map. 6.4.4 Standard BDM Firmware Commands Firmware commands are used to access and manipulate CPU resources. The system must be in active BDMtoexecutestandardBDMfirmwarecommands,seeSection6.4.2,“EnablingandActivatingBDM.” Normal instruction execution is suspended while the CPU executes the firmware located in the standard BDMfirmwarelookuptable.ThehardwarecommandBACKGROUNDistheusualwaytoactivateBDM. As the system enters active BDM, the standard BDM firmware lookup table and BDM registers become visibleintheon-chipmemorymapat0xFF00–0xFFFF,andtheCPUbeginsexecutingthestandardBDM 176 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description firmware. The standard BDM firmware watches for serial commands and executes them as they are received. The firmware commands are shown in Table6-6. Table6-6. Firmware Commands Command(1) Opcode (hex) Data Description READ_NEXT 62 16-bit data out Increment X by 2 (X = X + 2), then read word X points to. READ_PC 63 16-bit data out Read program counter. READ_D 64 16-bit data out Read D accumulator. READ_X 65 16-bit data out Read X index register. READ_Y 66 16-bit data out Read Y index register. READ_SP 67 16-bit data out Read stack pointer. WRITE_NEXT 42 16-bit data in Increment X by 2 (X = X + 2), then write word to location pointed to by X. WRITE_PC 43 16-bit data in Write program counter. WRITE_D 44 16-bit data in Write D accumulator. WRITE_X 45 16-bit data in Write X index register. WRITE_Y 46 16-bit data in Write Y index register. WRITE_SP 47 16-bit data in Write stack pointer. GO 08 None Go to user program. If enabled, ACK will occur when leaving active background mode. GO_UNTIL(2) 0C None Go to user program. If enabled, ACK will occur upon returning to active background mode. TRACE1 10 None Execute one user instruction then return to active BDM. If enabled, ACK will occur upon returning to active background mode. TAGGO 18 None Enabletaggingandgotouserprogram.ThereisnoACKpulserelatedto this command. 1. If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 2.BothWAIT(withclockstotheS12CPUcoredisabled)andSTOPdisabletheACKfunction.TheGO_UNTILcommandwillnot getanAcknowledgeifoneofthesetwoCPUinstructionsoccursbeforethe“UNTIL”instruction.Thiscanbeaproblemforany instruction that uses ACK, but GO_UNTIL is a lot more difficult for the development tool to time-out. 6.4.5 BDM Command Structure HardwareandfirmwareBDMcommandsstartwithan8-bitopcodefollowedbya16-bitaddressand/ora 16-bitdataworddependingonthecommand.Allthereadcommandsreturn16bitsofdatadespitethebyte or word implication in the command name. NOTE 8-bitreadsreturn16-bitsofdata,ofwhich,onlyonebytewillcontainvalid data. If reading an even address, the valid data will appear in the MSB. If reading an odd address, the valid data will appear in the LSB. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 177 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description NOTE 16-bitmisalignedreadsandwritesarenotallowed.Ifattempted,theBDM will ignore the least significant bit of the address and will assume an even address from the remaining bits. For hardware data read commands, the external host must wait 150 bus clock cycles after sending the address before attempting to obtain the read data. This is to be certain that valid data is available in the BDM shift register, ready to be shifted out. For hardware write commands, the external host must wait 150busclockcyclesaftersendingthedatatobewrittenbeforeattemptingtosendanewcommand.This istoavoiddisturbingtheBDMshiftregisterbeforethewritehasbeencompleted.The150busclockcycle delay in both cases includes the maximum 128 cycle delay that can be incurred as the BDM waits for a free cycle before stealing a cycle. Forfirmwarereadcommands,theexternalhostshouldwait44busclockcyclesaftersendingthecommand opcodeandbeforeattemptingtoobtainthereaddata.Thisincludesthepotentialofanextra7cycleswhen the access is external with a narrow bus access (+1 cycle) and / or a stretch (+1, 2, or 3 cycles), (7 cycles could be needed if both occur). The 44 cycle wait allows enough time for the requested data to be made available in the BDM shift register, ready to be shifted out. NOTE This timing has increased from previous BDM modules due to the new capabilityinwhichtheBDMserialinterfacecanpotentiallyrunfasterthan thebus.OnpreviousBDMmodulesthisextratimecouldbehiddenwithin the serial time. Forfirmwarewritecommands,theexternalhostmustwait32busclockcyclesaftersendingthedatatobe written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The external host should wait 64 bus clock cycles after a TRACE1 or GO command before starting any newserialcommand.ThisistoallowtheCPUtoexitgracefullyfromthestandardBDMfirmwarelookup tableandresumeexecutionoftheusercode.DisturbingtheBDMshiftregisterprematurelymayadversely affect the exit from the standard BDM firmware lookup table. NOTE Ifthebusrateofthetargetprocessorisunknownorcouldbechanging,itis recommended that the ACK (acknowledge function) be used to indicate when an operation is complete. When using ACK, the delay times are automated. Figure6-6 represents the BDM command structure. The command blocks illustrate a series of eight bit timesstartingwithafallingedge.ThebaracrossthetopoftheblocksindicatesthattheBKGDlineidles in the high state. The time for an 8-bit command is 8 × 16 target clock cycles.1 1. Target clock cycles are cycles measured using the target MCU’s serial clock rate. SeeSection6.4.6, “BDM Serial Interface,” andSection6.3.2.1, “BDM Status Register (BDMSTS),” for information on how serial clock rate is selected. 178 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 8 BITS 16 BITS 150-BC 16 BITS AT∼16 TC/BIT AT∼16 TC/BIT DELAY AT ∼16 TC/BIT HARDWARE NEXT COMMAND ADDRESS DATA READ COMMAND 150-BC DELAY HARDWARE NEXT COMMAND ADDRESS DATA WRITE COMMAND 44-BC DELAY FIRMWARE NEXT COMMAND DATA READ COMMAND 32-BC DELAY FIRMWARE NEXT COMMAND DATA WRITE COMMAND 64-BC DELAY GO, NEXT TRACE COMMAND COMMAND BC = BUS CLOCK CYCLES TC = TARGET CLOCK CYCLES Figure6-6. BDM Command Structure 6.4.6 BDM Serial Interface TheBDMcommunicateswithexternaldevicesseriallyviatheBKGDpin.Duringreset,thispinisamode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the BDM. The BDM serial interface is timed using the clock selected by the CLKSW bit in the status register see Section6.3.2.1, “BDM Status Register (BDMSTS).” This clock will be referred to as the target clock in the following explanation. The BDM serial interface uses a clocking scheme in which the external host generates a falling edge on the BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is transmitted or received. Data is transferred most significant bit (MSB) first at 16 target clock cycles per bit. The interface times out if 512 clock cycles occur between falling edges from the host. The BKGD pin is a pseudo open-drain pin and has an weak on-chip active pull-up that is enabled at all times.Itisassumedthatthereisanexternalpull-upandthatdriversconnectedtoBKGDdonottypically drivethehighlevel.BecauseR-Crisetimecouldbeunacceptablylong,thetargetsystemandhostprovide briefdriven-high(speedup)pulsestodriveBKGDtoalogic1.Thesourceofthisspeeduppulseisthehost for transmit cases and the target for receive cases. The timing for host-to-target is shown in Figure6-7 and that of target-to-host in Figure6-8 and Figure6- 9.AllfourcasesbeginwhenthehostdrivestheBKGDpinlowtogenerateafallingedge.Becausethehost and target are operating from separate clocks, it can take the target system up to one full clock cycle to recognize this edge. The target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove BKGD low to start the bit up to one target clock cycle Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 179 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description earlier. Synchronization between the host and target is established in this manner at the start of every bit time. Figure6-7 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic requires the pin be driven high no later that eight target clock cycles after the falling edge for a logic 1 transmission. Because the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. CLOCK TARGET SYSTEM HOST TRANSMIT 1 HOST TRANSMIT 0 PERCEIVED TARGET SENSES BIT START OF BIT TIME 10 CYCLES EARLIEST START OF NEXT BIT SYNCHRONIZATION UNCERTAINTY Figure6-7. BDM Host-to-Target Serial Bit Timing The receive cases are more complicated.Figure6-8 shows the host receiving a logic 1 from the target system.Becausethehostisasynchronoustothetarget,thereisuptooneclock-cycledelayfromthehost- generated falling edge on BKGD to the perceived start of the bit time in the target. The host holds the BKGDpinlowlongenoughforthetargettorecognizeit(atleasttwotargetclockcycles).Thehostmust releasethelowdrivebeforethetargetdrivesabriefhighspeeduppulseseventargetclockcyclesafterthe perceived start of the bit time. The host should sample the bit level about 10 target clock cycles after it started the bit time. 180 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description CLOCK TARGET SYSTEM HOST DRIVE TO HIGH-IMPEDANCE BKGD PIN TARGET SYSTEM SPEEDUP PULSE HIGH-IMPEDANCE HIGH-IMPEDANCE PERCEIVED START OF BIT TIME R-C RISE BKGD PIN 10 CYCLES 10 CYCLES EARLIEST START OF HOST SAMPLES NEXT BIT BKGD PIN Figure6-8. BDM Target-to-Host Serial Bit Timing (Logic 1) Figure6-9 shows the host receiving a logic 0 from the target. Because the host is asynchronous to the target,thereisuptoaoneclock-cycledelayfromthehost-generatedfallingedgeonBKGDtothestartof thebittimeasperceivedbythetarget.Thehostinitiatesthebittimebutthetargetfinishesit.Becausethe targetwantsthehosttoreceivealogic0,itdrivestheBKGDpinlowfor13targetclockcyclesthenbriefly drivesithightospeeduptherisingedge.Thehostsamplesthebitlevelabout10targetclockcyclesafter starting the bit time. CLOCK TARGETSYS. HOST DRIVE TO HIGH-IMPEDANCE BKGDPIN SPEEDUP PULSE TARGET SYS. DRIVE AND SPEEDUP PULSE PERCEIVED START OF BIT TIME BKGD PIN 10 CYCLES 10 CYCLES EARLIEST START OF HOST SAMPLES NEXT BIT BKGD PIN Figure6-9. BDM Target-to-Host Serial Bit Timing (Logic 0) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 181 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.4.7 Serial Interface Hardware Handshake Protocol BDMcommandsthatrequireCPUexecutionareultimatelytreatedattheMCUbusrate.BecausetheBDM clock source can be asynchronously related to the bus frequency, when CLKSW = 0, it is very helpful to provideahandshakeprotocolinwhichthehostcoulddeterminewhenanissuedcommandisexecutedby theCPU.Thealternativeistoalwayswaittheamountoftimeequaltotheappropriatenumberofcyclesat the slowest possible rate the clock could be running. This sub-section will describe the hardware handshake protocol. Thehardwarehandshakeprotocolsignalstothehostcontrollerwhenanissuedcommandwassuccessfully executed by the target. This protocol is implemented by a 16 serial clock cycle low pulse followed by a briefspeeduppulseintheBKGDpin.ThispulseisgeneratedbythetargetMCUwhenacommand,issued bythehost,hasbeensuccessfullyexecuted(seeFigure6-10).ThispulseisreferredtoastheACKpulse. AftertheACKpulsehasfinished:thehostcanstartthebitretrievalifthelastissuedcommandwasaread command, or start a new command if the last command was a write command or a control command (BACKGROUND, GO, GO_UNTIL, or TRACE1). The ACK pulse is not issued earlier than 32 serial clock cycles after the BDM command was issued. The end of the BDM command is assumed to be the 16thtickofthelastbit.ThisminimumdelayassuresenoughtimeforthehosttoperceivetheACKpulse. Note also that, there is no upper limit for the delay between the command and the related ACK pulse, becausethecommandexecutiondependsupontheCPUbusfrequency,whichinsomecasescouldbevery slow compared to the serial communication rate. This protocol allows a great flexibility for the POD designers,becauseitdoesnotrelyonanyaccuratetimemeasurementorshortresponsetimetoanyevent in the serial communication. BDM CLOCK (TARGET MCU) 16 CYCLES TARGET HIGH-IMPEDANCE HIGH-IMPEDANCE TRANSMITS ACK PULSE 32 CYCLES SPEEDUP PULSE MINIMUM DELAY FROM THE BDM COMMAND BKGD PIN EARLIEST 16th TICK OF THE START OF LAST COMMAD BIT NEXT BIT Figure6-10. Target Acknowledge Pulse (ACK) NOTE If the ACK pulse was issued by the target, the host assumes the previous command was executed. If the CPU enters WAIT or STOP prior to executingahardwarecommand,theACKpulsewillnotbeissuedmeaning thattheBDMcommandwasnotexecuted.Afterenteringwaitorstopmode, the BDM command is no longer pending. 182 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description Figure6-11showstheACKhandshakeprotocolinacommandleveltimingdiagram.TheREAD_BYTE instruction is used as an example. First, the 8-bit instruction opcode is sent by the host, followed by the addressofthememorylocationtoberead.ThetargetBDMdecodestheinstruction.Abuscycleisgrabbed (free or stolen) by the BDM and it executes the READ_BYTE operation. Having retrieved the data, the BDMissuesanACKpulsetothehostcontroller,indicatingthattheaddressedbyteisreadytoberetrieved. AfterdetectingtheACKpulse,thehostinitiatesthebyteretrievalprocess.Notethatdataissentintheform ofawordandthehostneedstodeterminewhichistheappropriatebytebasedonwhethertheaddresswas odd or even. TARGET HOST (2) BYTES ARE NEW BDM BKGD PIN READ_BYTE BYTE ADDRESS RETRIEVED COMMAND HOST TARGET HOST TARGET BDM ISSUES THE ACK PULSE (OUT OF SCALE) BDM DECODES BDM EXECUTES THE THE COMMAND READ_BYTE COMMAND Figure6-11. Handshake Protocol at Command Level Differentlyfromthenormalbittransfer(wherethehostinitiatesthetransmission),theserialinterfaceACK handshakepulseisinitiatedbythetargetMCUbyissuingafallingedgeintheBKGDpin.Thehardware handshake protocol in Figure 6-10 specifies the timing when the BKGD pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical conflict in the BKGD pin. NOTE The only place the BKGD pin can have an electrical conflict is when one sideisdrivinglowandtheothersideisissuingaspeeduppulse(high).Other “highs”arepulledratherthandriven.However,atlowratesthetimeofthe speedup pulse can become lengthy and so the potential conflict time becomes longer as well. The ACK handshake protocol does not support nested ACK pulses. If a BDM command is not acknowledge by an ACK pulse, the host needs to abort the pending command first in order to be able to issueanewBDMcommand.WhentheCPUentersWAITorSTOPwhilethehostissuesacommandthat requires CPU execution (e.g., WRITE_BYTE), the target discards the incoming command due to the WAITorSTOPbeingdetected.Therefore,thecommandisnotacknowledgedbythetarget,whichmeans thattheACKpulsewillnotbeissuedinthiscase.Afteracertaintimethehostshoulddecidetoabortthe ACK sequence in order to be free to issue a new command. Therefore, the protocol should provide a mechanism in which a command, and therefore a pending ACK, could be aborted. NOTE DifferentlyfromaregularBDMcommand,theACKpulsedoesnotprovide atimeout.ThismeansthatinthecaseofaWAITorSTOPinstructionbeing executed,theACKwouldbepreventedfrombeingissued.Ifnotaborted,the ACKwouldremainpendingindefinitely.Seethehandshakeabortprocedure described inSection6.4.8, “Hardware Handshake Abort Procedure.” Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 183 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.4.8 Hardware Handshake Abort Procedure TheabortprocedureisbasedontheSYNCcommand.Inordertoabortacommand,whichhadnotissued thecorrespondingACKpulse,thehostcontrollershouldgeneratealowpulseintheBKGDpinbydriving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speeduppulse.BydetectingthislonglowpulseintheBKGDpin,thetargetexecutestheSYNCprotocol, seeSection6.4.9, “SYNC — Request Timed Reference Pulse,” and assumes that the pending command and therefore the related ACK pulse, are being aborted. Therefore, after the SYNC protocol has been completed the host is free to issue new BDM commands. Althoughitisnotrecommended,thehostcouldabortapendingBDMcommandbyissuingalowpulsein theBKGDpinshorterthan128serialclockcycles,whichwillnotbeinterpretedastheSYNCcommand. The ACK is actually aborted when a falling edge is perceived by the target in the BKGD pin. The short abort pulse should have at least 4 clock cycles keeping the BKGD pin low, in order to allow the falling edgetobedetectedbythetarget.Inthiscase,thetargetwillnotexecutetheSYNCprotocolbutthepending command will be aborted along with the ACK pulse. The potential problem with this abort procedure is whenthereisaconflictbetweentheACKpulseandtheshortabortpulse.Inthiscase,thetargetmaynot perceive the abort pulse. The worst case is when the pending command is a read command (i.e., READ_BYTE). If the abort pulse is not perceived by the target the host will attempt to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. In this case, host and target will run out of synchronism. However, if the command to be abortedisnotareadcommandtheshortabortpulsecouldbeused.Afteracommandisabortedthetarget assumes the next falling edge, after the abort pulse, is the first bit of a new BDM command. NOTE Thedetailsabouttheshortabortpulsearebeingprovidedonlyasareference for the reader to better understand the BDM internal behavior. It is not recommended that this procedure be used in a real application. Becausethehostknowsthetargetserialclockfrequency,theSYNCcommand(usedtoabortacommand) does not need to consider the lower possible target frequency. In this case, the host could issue a SYNC veryclosetothe128serialclockcycleslength.Providingasmalloverheadonthepulselengthinorderto assure the SYNC pulse will not be misinterpreted by the target. See Section6.4.9, “SYNC — Request Timed Reference Pulse.” Figure6-12showsaSYNCcommandbeingissuedafteraREAD_BYTE,whichabortstheREAD_BYTE command.Notethat,afterthecommandisabortedanewcommandcouldbeissuedbythehostcomputer. NOTE Figure6-12 does not represent the signals in a true timing scale 184 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description READ_BYTE CMD IS ABORTED SYNC RESPONSE BY THE SYNC REQUEST FROM THE TARGET (OUT OF SCALE) (OUT OF SCALE) BKGD PIN READ_BYTE MEMORY ADDRESS READ_STATUS NEW BDM COMMAND HOST TARGET HOST TARGET HOST TARGET BDM DECODE NEW BDM COMMAND AND STARTS TO EXECUTES THE READ_BYTE CMD Figure6-12. ACK Abort Procedure at the Command Level Figure6-13 shows a conflict between the ACK pulse and the SYNC request pulse. This conflict could occurifaPODdeviceisconnectedtothetargetBKGDpinandthetargetisalreadyindebugactivemode. ConsiderthatthetargetCPUisexecutingapendingBDMcommandattheexactmomentthePODisbeing connectedtotheBKGDpin.Inthiscase,anACKpulseisissuedalongwiththeSYNCcommand.Inthis case, there is an electrical conflict between the ACK speedup pulse and the SYNC pulse. Because this is not a probable situation, the protocol does not prevent this conflict from happening. AT LEAST 128 CYCLES BDM CLOCK (TARGET MCU) ACK PULSE TARGET MCU DRIVES TO HIGH-IMPEDANCE BKGD PIN ELECTRICAL CONFLICT HOST AND SPEEDUP PULSE HOST TARGET DRIVE DRIVES SYNC TO BKGD PIN TO BKGD PIN HOST SYNC REQUEST PULSE BKGD PIN 16 CYCLES Figure6-13. ACK Pulse and SYNC Request Conflict NOTE ThisinformationisbeingprovidedsothattheMCUintegratorwillbeaware that such a conflict could eventually occur. ThehardwarehandshakeprotocolisenabledbytheACK_ENABLEanddisabledbytheACK_DISABLE BDM commands. This provides backwards compatibility with the existing POD devices which are not able to execute the hardware handshake protocol. It also allows for new POD devices, that support the hardware handshake protocol, to freely communicate with the target device. If desired, without the need for waiting for the ACK pulse. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 185 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description The commands are described as follows: • ACK_ENABLE—enablesthehardwarehandshakeprotocol.ThetargetwillissuetheACKpulse whenaCPUcommandisexecutedbytheCPU.TheACK_ENABLEcommanditselfalsohasthe ACK pulse as a response. • ACK_DISABLE—disablestheACKpulseprotocol.Inthiscase,thehostneedstousetheworst case delay time at the appropriate places in the protocol. The default state of the BDM after reset is hardware handshake protocol disabled. AllthereadcommandswillACK(ifenabled)whenthedatabuscyclehascompletedandthedataisthen readyforreadingoutbytheBKGDserialpin.AllthewritecommandswillACK(ifenabled)afterthedata hasbeenreceivedbytheBDMthroughtheBKGDserialpinandwhenthedatabuscycleiscomplete.See Section6.4.3,“BDMHardwareCommands,”andSection6.4.4,“StandardBDMFirmwareCommands,” for more information on the BDM commands. TheACK_ENABLEsendsanACKpulsewhenthecommandhasbeencompleted.Thisfeaturecouldbe used by the host to evaluate if the target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command, the host knows that the target supports the hardware handshake protocol. If the target does not support the hardware handshake protocol the ACK pulse is not issued. In this case, the ACK_ENABLE command is ignored by the target because it is not recognized as a valid command. The BACKGROUND command will issue an ACK pulse when the CPU changes from normal to background mode. The ACK pulse related to this command could be aborted using the SYNC command. TheGOcommandwillissueanACKpulsewhentheCPUexitsfrombackgroundmode.TheACKpulse related to this command could be aborted using the SYNC command. The GO_UNTIL command is equivalent to a GO command with exception that the ACK pulse, in this case, is issued when the CPU enters into background mode. This command is an alternative to the GO command and should be used when the host wants to trace if a breakpoint match occurs and causes the CPUtoenteractivebackgroundmode.NotethattheACKisissuedwhenevertheCPUentersBDM,which couldbecausedbyabreakpointmatchorbyaBGNDinstructionbeingexecuted.TheACKpulserelated to this command could be aborted using the SYNC command. TheTRACE1commandhastherelatedACKpulseissuedwhentheCPUentersbackgroundactivemode afteroneinstructionoftheapplicationprogramisexecuted.TheACKpulserelatedtothiscommandcould be aborted using the SYNC command. TheTAGGOcommandwillnotissueanACKpulsebecausethiswouldinterferewiththetaggingfunction shared on the same pin. 186 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 6.4.9 SYNC — Request Timed Reference Pulse The SYNC command is unlike other BDM commands because the host does not necessarily know the correctcommunicationspeedtouseforBDMcommunicationsuntilafterithasanalyzedtheresponseto the SYNC command. To issue a SYNC command, the host should perform the following steps: 1. DrivetheBKGDpinlowforatleast128cyclesatthelowestpossibleBDMserialcommunication frequency(thelowestserialcommunicationfrequencyisdeterminedbythecrystaloscillatororthe clock chosen by CLKSW.) 2. Drive BKGD high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. Remove all drive to the BKGD pin so it reverts to high impedance. 4. Listen to the BKGD pin for the sync response pulse. Upon detecting the SYNC request from the host, the target performs the following steps: 1. Discards any incomplete command received or bit retrieved. 2. Waits for BKGD to return to a logic 1. 3. Delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. Drives BKGD low for 128 cycles at the current BDM serial communication frequency. 5. Drives a one-cycle high speedup pulse to force a fast rise time on BKGD. 6. Removes all drive to the BKGD pin so it reverts to high impedance. Thehostmeasuresthelowtimeofthis128cycleSYNCresponsepulseanddeterminesthecorrectspeed forsubsequentBDMcommunications.Typically,thehostcandeterminethecorrectcommunicationspeed within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. AssoonastheSYNCrequestisdetectedbythetarget,anypartiallyreceivedcommandorbitretrievedis discarded.Thisisreferredtoasasoft-reset,equivalenttoatime-outintheserialcommunication.Afterthe SYNC response, the target will consider the next falling edge (issued by the host) as the start of a new BDM command or the start of new SYNC request. Another use of the SYNC command pulse is to abort a pending ACK pulse. The behavior is exactly the same as in a regular SYNC command. Note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. In this case, the command may not have been understood by the target and so an ACK response pulse will not be issued. 6.4.10 Instruction Tracing When a TRACE1 command is issued to the BDM in active BDM, the CPU exits the standard BDM firmwareandexecutesasingleinstructionintheusercode.Assoonasthishasoccurred,theCPUisforced to return to the standard BDM firmware and the BDM is active and ready to receive a new command. If theTRACE1commandisissuedagain,thenextuserinstructionwillbeexecuted.Thisfacilitatesstepping or tracing through the user code one instruction at a time. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 187 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description IfaninterruptispendingwhenaTRACE1commandisissued,theinterruptstackingoperationoccursbut no user instruction is executed. Upon return to standard BDM firmware execution, the program counter points to the first instruction in the interrupt service routine. 6.4.11 Instruction Tagging Theinstructionqueueandcycle-by-cycleCPUactivityarereconstructibleinrealtimeorfromtracehistory that is captured by a logic analyzer. However, the reconstructed queue cannot be used to stop the CPU at a specific instruction. This is because execution already has begun by the time an operation is visible outside the system. A separate instruction tagging mechanism is provided for this purpose. The tag follows program information as it advances through the instruction queue. When a tagged instructionreachestheheadofthequeue,theCPUentersactiveBDMratherthanexecutingtheinstruction. NOTE TaggingisdisabledwhenBDMbecomesactiveandBDMserialcommands are not processed while tagging is active. ExecutingtheBDMTAGGOcommandconfigurestwosystempinsfortagging.TheTAGLOsignalshares a pin with theLSTRB signal, and the TAGHI signal shares a pin with the BKGD signal. Table6-7showsthefunctionsofthetwotaggingpins.Thepinsoperateindependently,thatisthestateof one pin does not affect the function of the other. The presence of logic level 0 on either pin at the fall of the external clock (ECLK) performs the indicated function. High tagging is allowed in all modes. Low taggingisallowedonlywhenlowstrobeisenabled(LSTRBisallowedonlyinwideexpandedmodesand emulation expanded narrow mode). Table6-7. Tag Pin Function TAGHI TAGLO Tag 1 1 No tag 1 0 Low byte 0 1 High byte 0 0 Both bytes 6.4.12 Serial Communication Time-Out The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If BKGD is kept low for more than 128 target clock cycles, the target understands that a SYNC command was issued. In this case, the target will keep waiting for a rising edge on BKGD in order to answer the SYNC request pulse. If the rising edge is not detected, the target will keep waiting forever without any time-out limit. ConsidernowthecasewherethehostreturnsBKGDtologiconebefore128cycles.Thisisinterpretedas avalidbittransmission,andnotasaSYNCrequest.Thetargetwillkeepwaitingforanotherfallingedge markingthestartofanewbit.If,however,anewfallingedgeisnotdetectedbythetargetwithin512clock cyclessincethelastfallingedge,atime-outoccursandthecurrentcommandisdiscardedwithoutaffecting memory or the operating mode of the MCU. This is referred to as a soft-reset. 188 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description If a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset will occurcausingthecommandtobedisregarded.Thedataisnotavailableforretrievalafterthetime-outhas occurred. This is the expected behavior if the handshake protocol is not enabled. However, consider the behaviorwheretheBDCisrunninginafrequencymuchgreaterthantheCPUfrequency.Inthiscase,the commandcouldtimeoutbeforethedataisreadytoberetrieved.Inordertoallowthedatatoberetrieved even with a large clock frequency mismatch (between BDC and CPU) when the hardware handshake protocolisenabled,thetimeoutbetweenareadcommandandthedataretrievalisdisabled.Therefore,the host could wait for more then 512 serial clock cycles and continue to be able to retrieve the data from an issuedreadcommand.However,assoonasthehandshakepulse(ACKpulse)isissued,thetime-outfeature is re-activated, meaning that the target will time out after 512 clock cycles. Therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ACK pulse had been issued. After that period, the read command is discarded and the data is no longer available for retrieval. Any falling edge of the BKGD pin after the time-out period is considered to be a new command or a SYNC request. Notethatwheneverapartiallyissuedcommand,orpartiallyretrieveddata,hasoccurredthetimeoutinthe serial communication is active. This means that if a time frame higher than 512 serial clock cycles is observedbetweentwoconsecutivenegativeedgesandthecommandbeingissuedordatabeingretrieved is not complete, a soft-reset will occur causing the partially received command or data retrieved to be disregarded. The next falling edge of the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDM command, or the start of a SYNC request pulse. 6.4.13 Operation in Wait Mode The BDM cannot be used in wait mode if the system disables the clocks to the BDM. There is a clearing mechanism associated with the WAIT instruction when the clocks to the BDM (CPU coreplatform)aredisabled.Astheclocksrestartfromwaitmode,theBDMreceivesasoftreset(clearing any command in progress) and the ACK function will be disabled. This is a change from previous BDM modules. 6.4.14 Operation in Stop Mode The BDM is completely shutdown in stop mode. ThereisaclearingmechanismassociatedwiththeSTOPinstruction.STOPmustbeenabledandthepart must go into stop mode for this to occur. As the clocks restart from stop mode, the BDM receives a soft reset (clearing any command in progress) and the ACK function will be disabled. This is a change from previous BDM modules. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 189 Rev 01.24

Chapter6 Background Debug Module (BDMV4) Block Description 190 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 7 Debug Module (DBGV1) Block Description 7.1 Introduction This section describes the functionality of the debug (DBG) sub-block of the HCS12 core platform. The DBG module is designed to be fully compatible with the existing BKP_HCS12_A module (BKP mode) and furthermore provides an on-chip trace buffer with flexible triggering capability (DBG mode). TheDBGmoduleprovidesfornon-intrusivedebugofapplicationsoftware.TheDBGmoduleisoptimized for the HCS12 16-bit architecture. 7.1.1 Features The DBG module in BKP mode includes these distinctive features: • Full or dual breakpoint mode — Compare on address and data (full) — Compare on either of two addresses (dual) • BDM or SWI breakpoint — Enter BDM on breakpoint (BDM) — Execute SWI on breakpoint (SWI) • Tagged or forced breakpoint — Break just before a specific instruction will begin execution (TAG) — Break on the first instruction boundary after a match occurs (Force) • Single, range, or page address compares — Compare on address (single) — Compare on address 256 byte (range) — Compare on any 16K page (page) • At forced breakpoints compare address on read or write • High and/or low byte data compares • Comparator C can provide an additional tag or force breakpoint (enhancement for BKP mode) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 191 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description The DBG in DBG mode includes these distinctive features: • Three comparators (A, B, and C) — Dual mode, comparators A and B used to compare addresses — Full mode, comparator A compares address and comparator B compares data — Can be used as trigger and/or breakpoint — Comparator C used in LOOP1 capture mode or as additional breakpoint • Four capture modes — Normal mode, change-of-flow information is captured based on trigger specification — Loop1 mode, comparator C is dynamically updated to prevent redundant change-of-flow storage. — Detail mode, address and data for all cycles except program fetch (P) and free (f) cycles are stored in trace buffer — Profilemode,lastinstructionaddressexecutedbyCPUisreturnedwhentracebufferaddressis read • Two types of breakpoint or debug triggers — Break just before a specific instruction will begin execution (tag) — Break on the first instruction boundary after a match occurs (force) • BDM or SWI breakpoint — Enter BDM on breakpoint (BDM) — Execute SWI on breakpoint (SWI) • Nine trigger modes for comparators A and B — A — A or B — A then B — A and B, where B is data (full mode) — A and not B, where B is data (full mode) — Event only B, store data — A then event only B, store data — Inside range, A≤ address ≤ B — Outside range, address< Αor address > B • ComparatorCprovidesanadditionaltagorforcebreakpointwhencapturemodeisnotconfigured in LOOP1 mode. • Sixty-fourword(16bitswide)tracebufferforstoringchange-of-flowinformation,eventonlydata and other bus information. — Sourceaddressoftakenconditionalbranches(long,short,bit-conditional,andloopconstructs) — Destination address of indexed JMP, JSR, and CALL instruction. — Destination address of RTI, RTS, and RTC instructions — Vector address of interrupts, except for SWI and BDM vectors 192 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description — Data associated with event B trigger modes — Detailreportmodestoresaddressanddataforallcyclesexceptprogram(P)andfree(f)cycles — Current instruction address when in profiling mode — BGND is not considered a change-of-flow (cof) by the debugger 7.1.2 Modes of Operation Therearetwomainmodesofoperation:breakpointmodeanddebugmode.Eachoneismutuallyexclusive of the other and selected via a software programmable control bit. In the breakpoint mode there are two sub-modes of operation: • Dual address mode, where a match on either of two addresses will cause the system to enter background debug mode (BDM) or initiate a software interrupt (SWI). • Full breakpoint mode, where a match on address and data will cause the system to enter background debug mode (BDM) or initiate a software interrupt (SWI). In debug mode, there are several sub-modes of operation. • Trigger modes Therearemanywaystocreatealogicaltrigger.Thetriggercanbeusedtocapturebusinformation either starting from the trigger or ending at the trigger. Types of triggers (A and B are registers): — A only — A or B — A then B — Event only B (data capture) — A then event only B (data capture) — A and B, full mode — A and not B, full mode — Inside range — Outside range • Capture modes There are several capture modes. These determine which bus information is saved and which is ignored. — Normal: save change-of-flow program fetches — Loop1: save change-of-flow program fetches, ignoring duplicates — Detail: save all bus operations except program and free cycles — Profile: poll target from external device 7.1.3 Block Diagram Figure7-1 is a block diagram of this module in breakpoint mode.Figure7-2 is a block diagram of this module in debug mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 193 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description CLOCKS AND BKP CONTROL CONTROL SIGNALS SIGNALS CONTROL BLOCK BREAKPOINT MODES . . . . . . AND GENERATION OF SWI, . . . . . . FORCE BDM, AND TAGS EL S S S TO T L L READ/WRICONTR ONTROL BI ROL SIGNA LTS SIGNA C T U N S O E C R EXPANSION ADDRESS ADDRESS WRITE DATA READ DATA REGISTER BLOCK BKPCT0 BKPCT1 COMPARE BLOCK EXPANSION ADDRESSES BKP READ BKP0X COMPARATOR DATA BUS WRITE ADDRESS HIGH BKP0H COMPARATOR DATA BUS ADDRESS LOW BKP0L COMPARATOR EXPANSION ADDRESSES BKP1X COMPARATOR DATA HIGH DATA/ADDRESS BKP1H COMPARATOR ADDRESS HIGH HIGH MUX DATA LOW DATA/ADDRESS BKP1L COMPARATOR LOW MUX ADDRESS LOW READ DATA HIGH COMPARATOR READ DATA LOW COMPARATOR Figure7-1. DBG Block Diagram in BKP Mode 194 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description DBG READ DATA BUS ADDRESS BUS ADDRESS/DATA/CONTROL CONTROL REGISTERS WRITE DATA BUS L O READ DATA BUS NTR COMPARATOR A MATCH_A TBRUAFCFEERR TAG O READ/WRITE C MATCH_B CONTROL COMPARATOR B DBG MODE ENABLE MATCH_C LOGIC FORCE COMPARATOR C LOOP1 CHANGE-OF-FLOW INDICATORS MCU IN BDM DETAIL EVENT ONLY CPU PROGRAM COUNTER STORE POINTER INSTRUCTION LAST CYCLE M REGISTER 64 x 16 BIT PROFILE CAPTURE MODE BUS CLOCK U M WORD X U TRACE X TRACE BUFFER BUFFER M OR PROFILING DATA U WRITE DATA BUS X M LAST PROFILE U READ DATA BUS INSTRUCTION CAPTURE X ADDRESS REGISTER READ/WRITE Figure7-2. DBG Block Diagram in DBG Mode 7.2 External Signal Description TheDBGsub-modulereliesontheexternalbusinterface(generallytheMEBI)whentheDBGismatching on the external bus. The tag pins inTable7-1 (part of the MEBI) may also be a part of the breakpoint operation. Table7-1. External System Pins Associated with DBG and MEBI Pin Name Pin Functions Description BKGD/MODC/ TAGHI Wheninstructiontaggingison,a0atthefallingedgeofEtagsthehighhalfofthe TAGHI instruction word being read into the instruction queue. PE3/LSTRB/TAGLO TAGLO Inexpandedwidemodeoremulationnarrowmodes,wheninstructiontaggingison and low strobe is enabled, a 0 at the falling edge of E tags the low half of the instruction word being read into the instruction queue. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 195 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.3 Memory Map and Register Definition A summary of the registers associated with the DBG sub-block is shown in Figure7-3. Detailed descriptions of the registers and bits are given in the subsections that follow. 7.3.1 Module Memory Map Table7-2. DBGV1 Memory Map Address Use Access Offset 0x0020 Debug Control Register (DBGC1) R/W 0x0021 Debug Status and Control Register (DBGSC) R/W 0x0022 Debug Trace Buffer Register High (DBGTBH) R 0x0023 Debug Trace Buffer Register Low (DBGTBL) R 0x0024 Debug Count Register (DBGCNT) R 0x0025 Debug Comparator C Extended Register (DBGCCX) R/W 0x0026 Debug Comparator C Register High (DBGCCH) R/W 0x0027 Debug Comparator C Register Low (DBGCCL) R/W 0x0028 Debug Control Register 2 (DBGC2) / (BKPCT0) R/W 0x0029 Debug Control Register 3 (DBGC3) / (BKPCT1) R/W 0x002A Debug Comparator A Extended Register (DBGCAX) / (/BKP0X) R/W 0x002B Debug Comparator A Register High (DBGCAH) / (BKP0H) R/W 0x002C Debug Comparator A Register Low (DBGCAL) / (BKP0L) R/W 0x002D Debug Comparator B Extended Register (DBGCBX) / (BKP1X) R/W 0x002E Debug Comparator B Register High (DBGCBH) / (BKP1H) R/W 0x002F Debug Comparator B Register Low (DBGCBL) / (BKP1L) R/W 7.3.2 Register Descriptions This section consists of the DBG register descriptions in address order. Most of the register bits can be written to in either BKP or DBG mode, although they may not have any effect in one of the modes. However,theonlybitsintheDBGmodulethatcanbewrittenwhilethedebuggerisarmed(ARM=1)are DBGEN and ARM Name(1) Bit 7 6 5 4 3 2 1 Bit 0 0x0020 R 0 DBGEN ARM TRGSEL BEGIN DBGBRK CAPMOD DBGC1 W 0x0021 R AF BF CF 0 TRG DBGSC W = Unimplemented or Reserved Figure7-3. DBG Register Summary 196 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Name(1) Bit 7 6 5 4 3 2 1 Bit 0 0x0022 R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 DBGTBH W 0x0023 R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 DBGTBL W 0x0024 R TBF 0 CNT DBGCNT W 0x0025 R PAGSEL EXTCMP DBGCCX((2)) W 0x0026 R Bit 15 14 13 12 11 10 9 Bit 8 DBGCCH(2) W 0x0027 R Bit 7 6 5 4 3 2 1 Bit 0 DBGCCL(2) W 0x0028 R DBGC2 BKABEN FULL BDM TAGAB BKCEN TAGC RWCEN RWC W BKPCT0 0x0029 R DBGC3 BKAMBH BKAMBL BKBMBH BKBMBL RWAEN RWA RWBEN RWB W BKPCT1 0x002A R DBGCAX PAGSEL EXTCMP W BKP0X 0x002B R DBGCAH Bit 15 14 13 12 11 10 9 Bit 8 W BKP0H 0x002C R DBGCAL Bit 7 6 5 4 3 2 1 Bit 0 W BKP0L 0x002D R DBGCBX PAGSEL EXTCMP W BKP1X 0x002E R DBGCBH Bit 15 14 13 12 11 10 9 Bit 8 W BKP1H 0x002F R DBGCBL Bit 7 6 5 4 3 2 1 Bit 0 W BKP1L = Unimplemented or Reserved Figure7-3. DBG Register Summary (continued) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 197 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 1.TheDBGmoduleisdesignedforbackwardscompatibilitytoexistingBKPmodules.Registerandbitnameshavechangedfrom the BKP module. This column shows the DBG register name, as well as the BKP register name for reference. 2. Comparator C can be used to enhance the BKP mode by providing a third breakpoint. 7.3.2.1 Debug Control Register 1 (DBGC1) NOTE All bits are used in DBG mode only. Module Base + 0x0020 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R 0 DBGEN ARM TRGSEL BEGIN DBGBRK CAPMOD W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure7-4. Debug Control Register (DBGC1) NOTE This register cannot be written if BKP mode is enabled (BKABEN in DBGC2 is set). Table7-3. DBGC1 Field Descriptions Field Description 7 DBG Mode Enable Bit — The DBGEN bit enables the DBG module for use in DBG mode. This bit cannot be DBGEN set if the MCU is in secure mode. 0 DBG mode disabled 1 DBG mode enabled 6 Arm Bit — The ARM bit controls whether the debugger is comparing and storing data in the trace buffer. See ARM Section7.4.2.4, “Arming the DBG Module,” for more information. 0 Debugger unarmed 1 Debugger armed Note:ThisbitcannotbesetiftheDBGENbitisnotalsobeingsetatthesametime.Forexample,awriteof01 to DBGEN[7:6] will be interpreted as a write of 00. 5 Trigger Selection Bit — The TRGSEL bit controls the triggering condition for comparators A and B in DBG TRGSEL mode.ItservesessentiallythesamefunctionastheTAGABbitintheDBGC2registerdoesinBKPmode.See Section7.4.2.1.2,“TriggerSelection,”formoreinformation.TRGSELmayalsodeterminethetypeofbreakpoint based on comparator A and B if enabled in DBG mode (DBGBRK = 1). Please refer toSection7.4.3.1, “Breakpoint Based on Comparator A and B.” 0 Trigger on any compare address match 1 Trigger before opcode at compare address gets executed (tagged-type) 4 Begin/EndTriggerBit—TheBEGINbitcontrolswhetherthetriggerbeginsorendsstoringofdatainthetrace BEGIN buffer.SeeSection7.4.2.8.1,“StoringwithBegin-Trigger,”andSection7.4.2.8.2,“StoringwithEnd-Trigger,”for more details. 0 Trigger at end of stored data 1 Trigger before storing data 198 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Table7-3. DBGC1 Field Descriptions (continued) Field Description 3 DBGBreakpointEnableBit—TheDBGBRKbitcontrolswhetherthedebuggerwillrequestabreakpointbased DBGBRK on comparator A and B to the CPU upon completion of a tracing session. Please refer toSection7.4.3, “Breakpoints,” for further details. 0 CPU break request not enabled 1 CPU break request enabled 1:0 Capture Mode Field — SeeTable7-4 for capture mode field definitions. In LOOP1 mode, the debugger will CAPMOD automaticallyinhibitredundantentriesintocapturememory.Indetailmode,thedebuggerisstoringaddressand data for all cycles except program fetch (P) and free (f) cycles. In profile mode, the debugger is returning the address of the last instruction executed by the CPU on each access of trace buffer address. Refer to Section7.4.2.6, “Capture Modes,” for more information. Table7-4. CAPMOD Encoding CAPMOD Description 00 Normal 01 LOOP1 10 DETAIL 11 PROFILE Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 199 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.3.2.2 Debug Status and Control Register (DBGSC) Module Base + 0x0021 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R AF BF CF 0 TRG W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure7-5. Debug Status and Control Register (DBGSC) Table7-5. DBGSC Field Descriptions Field Description 7 Trigger A Match Flag— The AF bit indicates if trigger A match condition was met since arming. This bit is AF cleared when ARM in DBGC1 is written to a 1 or on any write to this register. 0 Trigger A did not match 1 Trigger A match 6 Trigger B Match Flag — The BF bit indicates if trigger B match condition was met since arming.This bit is BF cleared when ARM in DBGC1 is written to a 1 or on any write to this register. 0 Trigger B did not match 1 Trigger B match 5 ComparatorCMatchFlag—TheCFbitindicatesifcomparatorCmatchconditionwasmetsincearming.This CF bit is cleared when ARM in DBGC1 is written to a 1 or on any write to this register. 0 Comparator C did not match 1 Comparator C match 3:0 Trigger Mode Bits — The TRG bits select the trigger mode of the DBG module as shownTable7-6. See TRG Section7.4.2.5, “Trigger Modes,” for more detail. Table7-6. Trigger Mode Encoding TRG Value Meaning 0000 A only 0001 A or B 0010 A then B 0011 Event only B 0100 A then event only B 0101 A and B (full mode) 0110 A and Not B (full mode) 0111 Inside range 1000 Outside range 1001 Reserved ↓ (Defaults to A only) 1111 200 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.3.2.3 Debug Trace Buffer Register (DBGTB) Module Base + 0x0022 Starting address location affected by INITRG register setting. 15 14 13 12 11 10 9 8 R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 W Reset u u u u u u u u = Unimplemented or Reserved Figure7-6. Debug Trace Buffer Register High (DBGTBH) Module Base + 0x0023 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 W Reset u u u u u u u u = Unimplemented or Reserved Figure7-7. Debug Trace Buffer Register Low (DBGTBL) Table7-7. DBGTB Field Descriptions Field Description 15:0 TraceBufferDataBits—Thetracebufferdatabitscontainthedataofthetracebuffer.Thisregistercanberead onlyasawordread.Anybytereadsormisalignedaccessoftheseregisterswillreturn0andwillnotcausethe trace buffer pointer to increment to the next trace buffer address. The same is true for word reads while the debuggerisarmed.Inaddition,thisregistermayappeartocontainincorrectdataifitisnotreadwiththesame capturemodebitsettingsaswhenthetracebufferdatawasrecorded(SeeSection7.4.2.9,“ReadingDatafrom Trace Buffer”). Because reads will reflect the contents of the trace buffer RAM, the reset state is undefined. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 201 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.3.2.4 Debug Count Register (DBGCNT) Module Base + 0x0024 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R TBF 0 CNT W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure7-8. Debug Count Register (DBGCNT) Table7-8. DBGCNT Field Descriptions Field Description 7 TraceBufferFull—TheTBFbitindicatesthatthetracebufferhasstored64ormorewordsofdatasinceitwas TBF lastarmed.Ifthisbitisset,thenall64wordswillbevaliddata,regardlessofthevalueinCNT[5:0].TheTBFbit is cleared when ARM in DBGC1 is written to a 1. 5:0 CountValue—TheCNTbitsindicatethenumberofvaliddatawordsstoredinthetracebuffer.Table7-9shows CNT thecorrelationbetweentheCNTbitsandthenumberofvaliddatawordsinthetracebuffer.WhentheCNTrolls over to 0, the TBF bit will be set and incrementing of CNT will continue if DBG is in end-trigger mode. The DBGCNT register is cleared when ARM in DBGC1 is written to a 1. Table7-9. CNT Decoding Table TBF CNT Description 0 000000 No data valid 0 000001 1 word valid 0 000010 2 words valid .. .. .. .. 111110 62 words valid 0 111111 63 words valid 1 000000 64 words valid; if BEGIN = 1, the ARM bit will be cleared. A breakpoint will be generated if DBGBRK = 1 1 000001 64 words valid, .. oldest data has been overwritten .. by most recent data 111111 202 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.3.2.5 Debug Comparator C Extended Register (DBGCCX) Module Base + 0x0025 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R PAGSEL EXTCMP W Reset 0 0 0 0 0 0 0 0 Figure7-9. Debug Comparator C Extended Register (DBGCCX) Table7-10. DBGCCX Field Descriptions Field Description 7:6 PageSelectorField—InbothBKPandDBGmode,PAGSELselectsthetypeofpagingasshowninTable7-11. PAGSEL DPAGEandEPAGEarenotyetimplementedsothevalueinbit7willbeignored(i.e.,PAGSELvaluesof10and 11 will be interpreted as values of 00 and 01, respectively). 5:0 ComparatorCExtendedCompareBits—TheEXTCMPbitsareusedascomparisonaddressbitsasshown EXTCMP inTable7-11 along with the appropriate PPAGE, DPAGE, or EPAGE signal from the core. Note:Comparator C can be used when the DBG module is configured for BKP mode. Extended addressing comparisonsforcomparatorCusePAGSELandwilloperatedifferentlytothewaythatcomparatorAand B operate in BKP mode. Table7-11. PAGSEL Decoding(1) PAGSEL Description EXTCMP Comment 00 Normal (64k) Not used No paged memory 01 PPAGE EXTCMP[5:0] is compared to PPAGE[7:0] / XAB[21:14] becomes (256 — 16K pages) address bits [21:16](2) address bits [21:14]1 10(3) DPAGE (reserved) EXTCMP[3:0] is compared to DPAGE / XAB[21:14] becomes address (256 — 4K pages) address bits [19:16] bits [19:12] 112 EPAGE (reserved) EXTCMP[1:0] is compared to EPAGE / XAB[21:14] becomes address (256 — 1K pages) address bits [17:16] bits [17:10] 1. SeeFigure7-10. 2. Current HCS12 implementations have PPAGE limited to 6 bits. Therefore, EXTCMP[5:4] should be set to 00. 3.Datapage(DPAGE)andExtrapage(EPAGE)arereservedforimplementationondevicesthatsupportpageddataandextra space. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 203 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description DBGCXX DBGCXH[15:12] PAGSEL EXTCMP 0 0 BIT 15 BIT 14 BIT 13 BIT 12 7 6 3 2 1 BIT 0 5 4 E D O SEE NOTE 1 M G PORTK/XAB XAB21 XAB20 XAB19 XAB18 XAB17 XAB16 XAB15 XAB14 B D P/ K B PPAGE PIX7 PIX6 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 SEE NOTE 2 NOTES: 1. In BKP and DBG mode, PAGSEL selects the type of paging as shown inTable7-11. 2. Current HCS12 implementations are limited to six PPAGE bits, PIX[5:0]. Therefore, EXTCMP[5:4] = 00. Figure7-10. Comparator C Extended Comparison in BKP/DBG Mode 7.3.2.6 Debug Comparator C Register (DBGCC) Module Base + 0x0026 Starting address location affected by INITRG register setting. 15 14 13 12 11 10 9 8 R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure7-11. Debug Comparator C Register High (DBGCCH) Module Base + 0x0027 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure7-12. Debug Comparator C Register Low (DBGCCL) 204 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Table7-12. DBGCC Field Descriptions Field Description 15:0 Comparator C Compare Bits— The comparator C compare bits control whether comparator C will compare the address bus bits [15:0] to a logic 1 or logic 0. SeeTable7-13. 0 Compare corresponding address bit to a logic 0 1 Compare corresponding address bit to a logic 1 Note:This register will be cleared automatically when the DBG module is armed in LOOP1 mode. Table7-13. Comparator C Compares PAGSEL EXTCMP Compare High-Byte Compare x0 No compare DBGCCH[7:0] = AB[15:8] x1 EXTCMP[5:0] = XAB[21:16] DBGCCH[7:0] = XAB[15:14],AB[13:8] 7.3.2.7 Debug Control Register 2 (DBGC2) Module Base + 0x0028 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R BKABEN(1) FULL BDM TAGAB BKCEN(2) TAGC2 RWCEN2 RWC2 W Reset 0 0 0 0 0 0 0 0 1.WhenBKABENisset(BKPmode),allbitsinDBGC2areavailable.WhenBKABENisclearedandDBGisusedinDBGmode, bits FULL and TAGAB have no meaning. 2.ThesebitscanbeusedinBKPmodeandDBGmode(whencapturemodeisnotsetinLOOP1)toprovideathirdbreakpoint. Figure7-13. Debug Control Register 2 (DBGC2) Table7-14. DBGC2 Field Descriptions Field Description 7 BreakpointUsingComparatorAandBEnable—Thisbitenablesthebreakpointcapabilityusingcomparator BKABEN A and B, when set (BKP mode) the DBGEN bit in DBGC1 cannot be set. 0 Breakpoint module off 1 Breakpoint module on 6 FullBreakpointModeEnable—Thisbitcontrolswhetherthebreakpointmoduleisindualmodeorfullmode. FULL In full mode, comparator A is used to match address and comparator B is used to match data. See Section7.4.1.2, “Full Breakpoint Mode,” for more details. 0 Dual address mode enabled 1 Full breakpoint mode enabled 5 Background Debug Mode Enable — This bit determines if the breakpoint causes the system to enter BDM background debug mode (BDM) or initiate a software interrupt (SWI). 0 Go to software interrupt on a break request 1 Go to BDM on a break request Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 205 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Table7-14. DBGC2 Field Descriptions (continued) Field Description 4 ComparatorA/BTagSelect—Thisbitcontrolswhetherthebreakpointwillcauseabreakonthenextinstruction TAGAB boundary(force)oronamatchthatwillbeanexecutableopcode(tagged).Non-executedopcodescannotcause a tagged breakpoint. 0 On match, break at the next instruction boundary (force) 1 On match, break if/when the instruction is about to be executed (tagged) 3 Breakpoint Comparator C Enable Bit — This bit enables the breakpoint capability using comparator C. BKCEN 0 Comparator C disabled for breakpoint 1 Comparator C enabled for breakpoint Note:This bit will be cleared automatically when the DBG module is armed in loop1 mode. 2 ComparatorCTagSelect—Thisbitcontrolswhetherthebreakpointwillcauseabreakonthenextinstruction TAGC boundary(force)oronamatchthatwillbeanexecutableopcode(tagged).Non-executedopcodescannotcause a tagged breakpoint. 0 On match, break at the next instruction boundary (force) 1 On match, break if/when the instruction is about to be executed (tagged) 1 Read/WriteComparatorCEnableBit—TheRWCENbitcontrolswhetherreadorwritecomparisonisenabled RWCEN for comparatorC. RWCEN is not useful for tagged breakpoints. 0 Read/Write is not used in comparison 1 Read/Write is used in comparison 0 Read/Write Comparator C Value Bit — The RWC bit controls whether read or write is used in compare for RWC comparator C. The RWC bit is not used if RWCEN = 0. 0 Write cycle will be matched 1 Read cycle will be matched 7.3.2.8 Debug Control Register 3 (DBGC3) Module Base + 0x0029 Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R BKAMBH(1) BKAMBL1 BKBMBH(2) BKBMBL2 RWAEN RWA RWBEN RWB W Reset 0 0 0 0 0 0 0 0 1. In DBG mode, BKAMBH:BKAMBL has no meaning and are forced to 0’s. 2. In DBG mode, BKBMBH:BKBMBL are used in full mode to qualify data. Figure7-14. Debug Control Register 3 (DBGC3) 206 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Table7-15. DBGC3 Field Descriptions Field Description 7:6 BreakpointMaskHighByteforFirstAddress—Indualorfullmode,thesebitsmaybeusedtomask(disable) BKAMB[H:L] the comparison of the high and/or low bytes of the first address breakpoint. The functionality is as given in Table7-16. The x:0 case is for a full address compare. When a program page is selected, the full address compare will be based on bits for a 20-bit compare. The registers used for the compare are {DBGCAX[5:0], DBGCAH[5:0], DBGCAL[7:0]}, where DBGAX[5:0] corresponds to PPAGE[5:0] or extended address bits [19:14] and CPU address[13:0].Whenaprogrampageisnotselected,thefulladdresscomparewillbebasedonbitsfora16-bit compare. The registers used for the compare are {DBGCAH[7:0], DBGCAL[7:0]} which corresponds to CPU address [15:0]. Note:This extended address compare scheme causes an aliasing problem in BKP mode in which several physicaladdressesmaymatchwithasinglelogicaladdress.ThisproblemmaybeavoidedbyusingDBG mode to generate breakpoints. The 1:0 case is not sensible because it would ignore the high order address and compare the low order and expansion addresses. Logic forces this case to compare all address lines (effectively ignoring the BKAMBH control bit). The1:1caseisusefulfortriggeringabreakpointonanyaccesstoaparticularexpansionpage.Thisonlymakes sense if a program page is being accessed so that the breakpoint trigger will occur only if DBGCAX compares. 5:4 Breakpoint Mask High Byte and Low Byte of Data (Second Address) — In dual mode, these bits may be BKBMB[H:L] used to mask (disable) the comparison of the high and/or low bytes of the second address breakpoint. The functionality is as given inTable7-17. The x:0 case is for a full address compare. When a program page is selected, the full address compare will be based on bits for a 20-bit compare. The registers used for the compare are {DBGCBX[5:0], DBGCBH[5:0], DBGCBL[7:0]} where DBGCBX[5:0] corresponds to PPAGE[5:0] or extended address bits [19:14] and CPU address[13:0].Whenaprogrampageisnotselected,thefulladdresscomparewillbebasedonbitsfora16-bit compare. The registers used for the compare are {DBGCBH[7:0], DBGCBL[7:0]} which corresponds to CPU address [15:0]. Note:This extended address compare scheme causes an aliasing problem in BKP mode in which several physicaladdressesmaymatchwithasinglelogicaladdress.ThisproblemmaybeavoidedbyusingDBG mode to generate breakpoints. The 1:0 case is not sensible because it would ignore the high order address and compare the low order and expansion addresses. Logic forces this case to compare all address lines (effectively ignoring the BKBMBH control bit). The1:1caseisusefulfortriggeringabreakpointonanyaccesstoaparticularexpansionpage.Thisonlymakes sense if a program page is being accessed so that the breakpoint trigger will occur only if DBGCBX compares. In full mode, these bits may be used to mask (disable) the comparison of the high and/or low bytes of the data breakpoint. The functionality is as given inTable7-18. 3 Read/WriteComparatorAEnableBit—TheRWAENbitcontrolswhetherreadorwritecomparisonisenabled RWAEN forcomparatorA.SeeSection7.4.2.1.1,“ReadorWriteComparison,”formoreinformation.Thisbitisnotuseful for tagged operations. 0 Read/Write is not used in comparison 1 Read/Write is used in comparison 2 Read/Write Comparator A Value Bit — The RWA bit controls whether read or write is used in compare for RWA comparator A. The RWA bit is not used if RWAEN = 0. 0 Write cycle will be matched 1 Read cycle will be matched Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 207 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Table7-15. DBGC3 Field Descriptions (continued) Field Description 1 Read/WriteComparatorBEnableBit—TheRWBENbitcontrolswhetherreadorwritecomparisonisenabled RWBEN forcomparatorB.SeeSection7.4.2.1.1,“ReadorWriteComparison,”formoreinformation.Thisbitisnotuseful for tagged operations. 0 Read/Write is not used in comparison 1 Read/Write is used in comparison 0 Read/Write Comparator B Value Bit — The RWB bit controls whether read or write is used in compare for RWB comparator B. The RWB bit is not used if RWBEN = 0. 0 Write cycle will be matched 1 Read cycle will be matched Note:RWB and RWBEN are not used in full mode. Table7-16. Breakpoint Mask Bits for First Address BKAMBH:BKAMBL Address Compare DBGCAX DBGCAH DBGCAL x:0 Full address compare Yes(1) Yes Yes 0:1 256 byte address range Yes1 Yes No 1:1 16K byte address range Yes1 No No 1. If PPAGE is selected. Table7-17. Breakpoint Mask Bits for Second Address (Dual Mode) BKBMBH:BKBMBL Address Compare DBGCBX DBGCBH DBGCBL x:0 Full address compare Yes(1) Yes Yes 0:1 256 byte address range Yes1 Yes No 1:1 16K byte address range Yes1 No No 1. If PPAGE is selected. Table7-18. Breakpoint Mask Bits for Data Breakpoints (Full Mode) BKBMBH:BKBMBL Data Compare DBGCBX DBGCBH DBGCBL 0:0 High and low byte compare No(1) Yes Yes 0:1 High byte No1 Yes No 1:0 Low byte No1 No Yes 1:1 No compare No1 No No 1. Expansion addresses for breakpoint B are not applicable in this mode. 208 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.3.2.9 Debug Comparator A Extended Register (DBGCAX) Module Base + 0x002A Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R PAGSEL EXTCMP W Reset 0 0 0 0 0 0 0 0 Figure7-15. Debug Comparator A Extended Register (DBGCAX) Table7-19. DBGCAX Field Descriptions Field Description 7:6 PageSelectorField—IfDBGENissetinDBGC1,thenPAGSELselectsthetypeofpagingasshowninTable7- PAGSEL 20. DPAGEandEPAGEarenotyetimplementedsothevalueinbit7willbeignored(i.e.,PAGSELvaluesof10and 11 will be interpreted as values of 00 and 01, respectively). InBKPmode,PAGSELhasnomeaningandEXTCMP[5:0]arecomparedtoaddressbits[19:14]iftheaddress is in the FLASH/ROM memory space. 5:0 ComparatorAExtendedCompareBits—TheEXTCMPbitsareusedascomparisonaddressbitsasshown EXTCMP inTable7-20 along with the appropriate PPAGE, DPAGE, or EPAGE signal from the core. Table7-20. Comparator A or B Compares Mode EXTCMP Compare High-Byte Compare BKP(1) Not FLASH/ROM access No compare DBGCxH[7:0] = AB[15:8] FLASH/ROM access EXTCMP[5:0] = XAB[19:14] DBGCxH[5:0] = AB[13:8] DBG(2) PAGSEL = 00 No compare DBGCxH[7:0] = AB[15:8] PAGSEL = 01 EXTCMP[5:0] = XAB[21:16] DBGCxH[7:0] = XAB[15:14], AB[13:8] 1. SeeFigure7-16. 2. SeeFigure7-10 (note that while this figure provides extended comparisons for comparator C, the figure also pertains to comparators A and B in DBG mode only). Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 209 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description PAGSEL EXTCMP DBGCXX 0 0 5 4 3 2 1 BIT 0 SEE NOTE 1 E D PORTK/XAB XAB21 XAB20 XAB19 XAB18 XAB17 XAB16 XAB15 XAB14 O M P K B PPAGE PIX7 PIX6 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 SEE NOTE 2 NOTES: 1. In BKP mode, PAGSEL has no functionality. Therefore, set PAGSEL to 00 (reset state). 2. Current HCS12 implementations are limited to six PPAGE bits, PIX[5:0]. Figure7-16. Comparators A and B Extended Comparison in BKP Mode 7.3.2.10 Debug Comparator A Register (DBGCA) Module Base + 0x002B Starting address location affected by INITRG register setting. 15 14 13 12 11 10 9 8 R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 W Reset 0 0 0 0 0 0 0 0 Figure7-17. Debug Comparator A Register High (DBGCAH) Module Base + 0x002C Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure7-18. Debug Comparator A Register Low (DBGCAL) Table7-21. DBGCA Field Descriptions Field Description 15:0 ComparatorACompareBits—ThecomparatorAcomparebitscontrolwhethercomparatorAcomparesthe 15:0 address bus bits [15:0] to a logic 1 or logic 0. SeeTable7-20. 0 Compare corresponding address bit to a logic 0 1 Compare corresponding address bit to a logic 1 210 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.3.2.11 Debug Comparator B Extended Register (DBGCBX) Module Base + 0x002D 7 6 5 4 3 2 1 0 R PAGSEL EXTCMP W Reset 0 0 0 0 0 0 0 0 Figure7-19. Debug Comparator B Extended Register (DBGCBX) Table7-22. DBGCBX Field Descriptions Field Description 7:6 PageSelectorField—IfDBGENissetinDBGC1,thenPAGSELselectsthetypeofpagingasshowninTable7- PAGSEL 11. DPAGEandEPAGEarenotyetimplementedsothevalueinbit7willbeignored(i.e.,PAGSELvaluesof10and 11 will be interpreted as values of 00 and 01, respectively.) InBKPmode,PAGSELhasnomeaningandEXTCMP[5:0]arecomparedtoaddressbits[19:14]iftheaddress is in the FLASH/ROM memory space. 5:0 ComparatorBExtendedCompareBits—TheEXTCMPbitsareusedascomparisonaddressbitsasshown EXTCMP inTable7-11 along with the appropriate PPAGE, DPAGE, or EPAGE signal from the core. Also seeTable7-20. 7.3.2.12 Debug Comparator B Register (DBGCB) Module Base + 0x002E Starting address location affected by INITRG register setting. 15 14 13 12 11 10 9 8 R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 W Reset 0 0 0 0 0 0 0 0 Figure7-20. Debug Comparator B Register High (DBGCBH) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 211 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Module Base + 0x002F Starting address location affected by INITRG register setting. 7 6 5 4 3 2 1 0 R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure7-21. Debug Comparator B Register Low (DBGCBL) Table7-23. DBGCB Field Descriptions Field Description 15:0 ComparatorBCompareBits—ThecomparatorBcomparebitscontrolwhethercomparatorBcomparesthe 15:0 address bus bits [15:0] or data bus bits [15:0] to a logic 1 or logic 0. SeeTable7-20. 0 Compare corresponding address bit to a logic 0, compares to data if in Full mode 1 Compare corresponding address bit to a logic 1, compares to data if in Full mode 7.4 Functional Description This section provides a complete functional description of the DBG module. The DBG module can be configured to run in either of two modes, BKP or DBG. BKP mode is enabled by setting BKABEN in DBGC2.DBGmodeisenabledbysettingDBGENinDBGC1.SettingBKABENinDBGC2overridesthe DBGENinDBGC1andpreventsDBGmode.Ifthepartisinsecuremode,DBGmodecannotbeenabled. 7.4.1 DBG Operating in BKP Mode InBKPmode,theDBGwillbefullybackwardscompatiblewiththeexistingBKP_ST12_Amodule.The DBGC2 register has four additional bits that were not available on existing BKP_ST12_A modules. As longasthesebitsarewrittentoeitherall1sorall0s,theyshouldbetransparenttotheuser.All1swould enablecomparatorCtobeusedasabreakpoint,buttaggingwouldbeenabled.Thematchaddressregister would be all 0s if not modified by the user. Therefore, code executing at address 0x0000 would have to occur before a breakpoint based on comparator C would happen. TheDBGmoduleinBKPmodesupportstwomodesofoperation:dualaddressmodeandfullbreakpoint mode. Within each of these modes, forced or tagged breakpoint types can be used. Forced breakpoints occur at the next instruction boundary if a match occurs and tagged breakpoints allow for breaking just beforethetaggedinstructionexecutes.Theactiontakenuponasuccessfulmatchcanbetoeitherplacethe CPU in background debug mode or to initiate a software interrupt. The breakpoint can operate in dual address mode or full breakpoint mode. Each of these modes is discussed in the subsections below. 7.4.1.1 Dual Address Mode When dual address mode is enabled, two address breakpoints can be set. Each breakpoint can cause the systemtoenterbackgrounddebugmodeortoinitiateasoftwareinterruptbaseduponthestateofBDMin 212 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description DBGC2beinglogic1orlogic0,respectively.BDMrequestshaveahigherprioritythanSWIrequests.No data breakpoints are allowed in this mode. TAGAB in DBGC2 selects whether the breakpoint mode is forced or tagged. The BKxMBH:L bits in DBGC3selectwhetherornotthebreakpointismatchedexactlyorisarangebreakpoint.Theyalsoselect whether the address is matched on the high byte, low byte, both bytes, and/or memory expansion. The RWx and RWxEN bits in DBGC3 select whether the type of bus cycle to match is a read, write, or read/write when performing forced breakpoints. 7.4.1.2 Full Breakpoint Mode Full breakpoint mode requires a match on address and data for a breakpoint to occur. Upon a successful match,thesystemwillenterbackgrounddebugmodeorinitiateasoftwareinterruptbaseduponthestate ofBDMinDBGC2beinglogic1orlogic0,respectively.BDMrequestshaveahigherprioritythanSWI requests. R/W matches are also allowed in this mode. TAGAB in DBGC2 selects whether the breakpoint mode is forced or tagged. When TAGAB is set in DBGC2, only addresses are compared and data is ignored. The BKAMBH:L bits in DBGC3 select whether or not the breakpoint is matched exactly, is a range breakpoint, or is in page space. The BKBMBH:LbitsinDBGC3selectwhetherthedataismatchedonthehighbyte,lowbyte,orbothbytes. RWAandRWAENbitsinDBGC2selectwhetherthetypeofbuscycletomatchisareadorawritewhen performing forced breakpoints. RWB and RWBEN bits in DBGC2 are not used in full breakpoint mode. NOTE The full trigger mode is designed to be used for either a word access or a byte access, but not both at the same time. Confusing trigger operation (seemingly false triggers or no trigger) can occur if the trigger address occurs in the user program as both byte and word accesses. 7.4.1.3 Breakpoint Priority Breakpoint operation is first determined by the state of the BDM module. If the BDM module is already active, meaning the CPU is executing out of BDM firmware, breakpoints are not allowed. In addition, while executing a BDM TRACE command, tagging into BDM is not allowed. If BDM is not active, the breakpoint will give priority to BDM requests over SWI requests. This condition applies to both forced and tagged breakpoints. Inallcases,BDMrelatedbreakpointswillhavepriorityoverthosegeneratedbytheBreakpointsub-block. This priority includes breakpoints enabled by the TAGLO and TAGHI external pins of the system that interface with the BDM directly and whose signal information passes through and is used by the breakpoint sub-block. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 213 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description NOTE BDMshouldnotbeenteredfromabreakpointunlesstheENABLEbitisset in the BDM. Even if the ENABLE bit in the BDM is cleared, the CPU actually executes the BDM firmware code. It checks the ENABLE and returnsifENABLEisnotset.IftheBDMisnotservicedbythemonitorthen thebreakpointwouldbere-assertedwhentheBDMreturnstonormalCPU flow. There is no hardware to enforce restriction of breakpoint operation if the BDM is not enabled. WhenprogramcontrolreturnsfromataggedbreakpointthroughanRTIor aBDMGOcommand,itwillreturntotheinstructionwhosetaggenerated the breakpoint. Unless breakpoints are disabled or modified in the service routineoractiveBDMsession,theinstructionwillbetaggedagainandthe breakpointwillberepeated.InthecaseofBDMbreakpoints,thissituation can also be avoided by executing a TRACE1 command before the GO to increment the program flow past the tagged instruction. 7.4.1.4 Using Comparator C in BKP Mode TheoriginalBKP_ST12_Amodulesupportstwobreakpoints.TheDBG_ST12_Amodulecanbeusedin BKP mode and allow a third breakpoint using comparator C. Four additional bits, BKCEN, TAGC, RWCEN,andRWCinDBGC2inconjunctionwithadditionalcomparatorCaddressregisters,DBGCCX, DBGCCH, and DBGCCL allow the user to set up a third breakpoint. Using PAGSEL in DBGCCX for expandedmemorywillworkdifferentlythanthewaypagedmemoryisdoneusingcomparatorAandBin BKP mode. SeeSection7.3.2.5, “Debug Comparator C Extended Register (DBGCCX),” for more information on using comparator C. 7.4.2 DBG Operating in DBG Mode Enabling the DBG module in DBG mode, allows the arming, triggering, and storing of data in the trace bufferandcanbeusedtocauseCPUbreakpoints.TheDBGmoduleismadeupofthreemainblocks,the comparators, trace buffer control logic, and the trace buffer. NOTE Ingeneral,thereisalatencybetweenthetriggeringeventappearingonthe busandbeingdetectedbytheDBGcircuitry.Ingeneral,taggedtriggerswill be more predictable than forced triggers. 7.4.2.1 Comparators TheDBGcontainsthreecomparators,A,B,andC.ComparatorAcomparesthecoreaddressbuswiththe addressstoredinDBGCAHandDBGCAL.ComparatorBcomparesthecoreaddressbuswiththeaddress storedinDBGCBHandDBGCBLexceptinfullmode,whereitcomparesthedatabusestothedatastored in DBGCBH and DBGCBL. Comparator C can be used as a breakpoint generator or as the address comparison unit in the loop1 mode. Matches on comparator A, B, and C are signaled to the trace buffer 214 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description control (TBC) block. When PAGSEL = 01, registers DBGCAX, DBGCBX, and DBGCCX are used to match the upper addresses as shown in Table7-11. NOTE If a tagged-type C breakpoint is set at the same address as an A/B tagged- typetrigger(includingtheinitialentryinaninsideoroutsiderangetrigger), the C breakpoint will have priority and the trigger will not be recognized. 7.4.2.1.1 Read or Write Comparison ReadorwritecomparisonsareusefulonlywithTRGSEL=0,becauseonlyopcodesshouldbetaggedas they are “read” from memory. RWAEN and RWBEN are ignored when TRGSEL = 1. In full modes (“A and B” and “A and not B”) RWAEN and RWA are used to select read or write comparisons for both comparators A and B.Table7-24 shows the effect for RWAEN, RWA, and RW on the DBGCB comparison conditions. The RWBEN and RWB bits are not used and are ignored in full modes. Table7-24. Read or Write Comparison Logic Table RWAEN bit RWA bit RW signal Comment 0 x 0 Write data bus 0 x 1 Read data bus 1 0 0 Write data bus 1 0 1 No data bus compare since RW=1 1 1 0 No data bus compare since RW=0 1 1 1 Read data bus 7.4.2.1.2 Trigger Selection TheTRGSELbitinDBGC1isusedtodeterminethetriggeringconditioninDBGmode.TRGSELapplies to both trigger A and B except in the event only trigger modes. By setting TRGSEL, the comparators A andBwillqualifyamatchwiththeoutputofopcodetrackinglogicandatriggeroccursbeforethetagged instruction executes (tagged-type trigger). With the TRGSEL bit cleared, a comparator match forces a trigger when the matching condition occurs (force-type trigger). NOTE If the TRGSEL is set, the address stored in the comparator match address registers must be an opcode address for the trigger to occur. 7.4.2.2 Trace Buffer Control (TBC) TheTBCisthemaincontrollerfortheDBGmodule.Itsfunctionistodecidewhetherdatashouldbestored in the trace buffer based on the trigger mode and the match signals from the comparator. The TBC also determines whether a request to break the CPU should occur. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 215 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.4.2.3 Begin- and End-Trigger The definitions of begin- and end-trigger as used in the DBG module are as follows: • Begin-trigger:Storage in trace buffer occurs after the trigger and continues until 64 locations are filled. • End-trigger:Storageintracebufferoccursuntilthetrigger,withtheleastrecentdatafallingoutof the trace buffer if more than 64 words are collected. 7.4.2.4 Arming the DBG Module InDBGmode,armingoccursbysettingDBGENandARMinDBGC1.TheARMbitinDBGC1iscleared when the trigger condition is met in end-trigger mode or when the Trace Buffer is filled in begin-trigger mode.TheTBClogicdetermineswhetheratriggerconditionhasbeenmetbasedonthetriggermodeand the trigger selection. 7.4.2.5 Trigger Modes TheDBGmodulesupportsninetriggermodes.ThetriggermodesareencodedasshowninTable7-6.The triggermodeisusedasaqualifierforeitherstartingorendingthestoringofdatainthetracebuffer.When thematchconditionismet,theappropriateflagAorBissetinDBGSC.ArmingtheDBGmoduleclears theA,B,andCflagsinDBGSC.Inalltriggermodesexceptfortheevent-onlymodesandDETAILcapture mode, change-of-flow addresses are stored in the trace buffer. In the event-only modes only the value on thedatabusatthetriggereventBwillbestored.InDETAILcapturemodeaddressanddataforallcycles except program fetch (P) and free (f) cycles are stored in trace buffer. 7.4.2.5.1 A Only In the A only trigger mode, if the match condition for A is met, the A flag in DBGSC is set and a trigger occurs. 7.4.2.5.2 A or B IntheAorBtriggermode,ifthematchconditionforAorBismet,thecorrespondingflaginDBGSCis set and a trigger occurs. 7.4.2.5.3 A then B IntheAthenBtriggermode,thematchconditionforAmustbemetbeforethematchconditionforBis compared. When the match condition for A or B is met, the corresponding flag in DBGSC is set. The trigger occurs only after A then B have matched. NOTE WhentaggingandusingAthenB,ifaddressesAandBareclosetogether, then B may not complete the trigger sequence. This occurs when A and B areintheinstructionqueueatthesametime.BasicallytheAtriggerhasnot yetoccurred,sotheBinstructionisnottagged.Generally,ifaddressBisat 216 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description least six addresses higher than address A (or B is lower than A) and there arenotchangesofflowtoputtheseinthequeueatthesametime,thenthis operation should trigger properly. 7.4.2.5.4 Event-Only B (Store Data) In the event-only B trigger mode, if the match condition for B is met, the B flag in DBGSC is set and a trigger occurs. The event-only B trigger mode is considered a begin-trigger type and the BEGIN bit in DBGC1 is ignored. Event-only B is incompatible with instruction tagging (TRGSEL = 1), and thus the value of TRGSEL is ignored. Please refer to Section7.4.2.7, “Storage Memory,” for more information. This trigger mode is incompatible with the detail capture mode so the detail capture mode will have priority.TRGSELandBEGINwillnotbeignoredandthistriggermodewillbehaveasifitwere“Bonly”. 7.4.2.5.5 A then Event-Only B (Store Data) IntheAthenevent-onlyBtriggermode,thematchconditionforAmustbemetbeforethematchcondition forBiscompared,aftertheAmatchhasoccurred,atriggeroccurseachtimeBmatches.Whenthematch conditionforAorBismet,thecorrespondingflaginDBGSCisset.TheAthenevent-onlyBtriggermode isconsideredabegin-triggertypeandBEGINinDBGC1isignored.TRGSELinDBGC1appliesonlyto the match condition for A. Please refer toSection7.4.2.7, “Storage Memory,” for more information. This trigger mode is incompatible with the detail capture mode so the detail capture mode will have priority. TRGSEL and BEGIN will not be ignored and this trigger mode will be the same as A then B. 7.4.2.5.6 A and B (Full Mode) In the A and B trigger mode, comparator A compares to the address bus and comparator B compares to thedatabus.IntheAandBtriggermode,ifthematchconditionforAandBhappenonthesamebuscycle, both the A and B flags in the DBGSC register are set and a trigger occurs. IfTRGSEL=1,onlymatchesfromcomparatorAareusedtodetermineifthetriggerconditionismetand comparator B matches are ignored. If TRGSEL = 0, full-word data matches on an odd address boundary (misaligned access) do not work unless the access is to a RAM that manages misaligned accesses in a single clock cycle (which is typical of RAM modules used in HCS12 MCUs). 7.4.2.5.7 A and Not B (Full Mode) IntheAandnotBtriggermode,comparatorAcomparestotheaddressbusandcomparatorBcompares tothedatabus.IntheAandnotBtriggermode,ifthematchconditionforAandnotBhappenonthesame bus cycle, both the A and B flags in DBGSC are set and a trigger occurs. IfTRGSEL=1,onlymatchesfromcomparatorAareusedtodetermineifthetriggerconditionismetand comparator B matches are ignored. As described inSection7.4.2.5.6, “A and B (Full Mode),” full-word data compares on misaligned accesses will not match expected data (and thus will cause a trigger in this mode) unless the access is to a RAM that manages misaligned accesses in a single clock cycle. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 217 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.4.2.5.8 Inside Range (A ≤ address ≤ B) In the inside range trigger mode, if the match condition for A and B happen on the same bus cycle, both theAandBflagsinDBGSCaresetandatriggeroccurs.IfamatchconditionononlyAoronlyBoccurs noflagsareset.IfTRGSEL=1,theinsiderangeisaccurateonlytowordboundaries.IfTRGSEL=0,an alignedwordaccesswhichstraddlestherangeboundarywillcauseatriggeronlyifthealignedaddressis within the range. 7.4.2.5.9 Outside Range (address < A or address > B) In the outside range trigger mode, if the match condition for A or B is met, the corresponding flag in DBGSCissetandatriggeroccurs.IfTRGSEL=1,theoutsiderangeisaccurateonlytowordboundaries. IfTRGSEL=0,analignedwordaccesswhichstraddlestherangeboundarywillcauseatriggeronlyifthe aligned address is outside the range. 7.4.2.5.10 Control Bit Priorities The definitions of some of the control bits are incompatible with each other. Table7-25 and the notes associated with it summarize how these incompatibilities are managed: • Read/writecomparisonsarenotcompatiblewithTRGSEL=1.Therefore,RWAENandRWBEN are ignored. • Event-only trigger modes are always considered a begin-type trigger. See Section7.4.2.8.1, “Storing with Begin-Trigger,” andSection7.4.2.8.2, “Storing with End-Trigger.” • Detailcapturemodehaspriorityovertheevent-onlytrigger/capturemodes.Therefore,event-only modes have no meaning in detail mode and their functions default to similar trigger modes. Table7-25. Resolution of Mode Conflicts Normal / Loop1 Detail Mode Tag Force Tag Force A only A or B A then B Event-only B 1 1, 3 3 A then event-only B 2 4 4 A and B (full mode) 5 5 A and not B (full mode) 5 5 Inside range 6 6 Outside range 6 6 1 — Ignored — same as force 2 — Ignored for comparator B 3 — Reduces to effectively “B only” 4 — Works same as A then B 5 — Reduces to effectively “A only” — B not compared 6 — Only accurate to word boundaries 218 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.4.2.6 Capture Modes The DBG in DBG mode can operate in four capture modes. These modes are described in the following subsections. 7.4.2.6.1 Normal Mode In normal mode, the DBG module uses comparator A and B as triggering devices. Change-of-flow information or data will be stored depending on TRG in DBGSC. 7.4.2.6.2 Loop1 Mode Theintentofloop1modeistopreventthetracebufferfrombeingfilledentirelywithduplicateinformation from a looping construct such as delays using the DBNE instruction or polling loops using BRSET/BRCLRinstructions.Immediatelyafteraddressinformationisplacedinthetracebuffer,theDBG module writes this value into the C comparator and the C comparator is placed in ignore address mode. This will prevent duplicate address entries in the trace buffer resulting from repeated bit-conditional branches. Comparator C will be cleared when the ARM bit is set in loop1 mode to prevent the previous contents of the register from interfering with loop1 mode operation. Breakpoints based on comparator C are disabled. Loop1 mode only inhibits duplicate source address entries that would typically be stored in most tight loopingconstructs.Itwillnotinhibitrepeatedentriesofdestinationaddressesorvectoraddresses,because repeated entries of these would most likely indicate a bug in the user’s code that the DBG module is designed to help find. NOTE Incertainverytightloops,thesourceaddresswillhavealreadybeenfetched againbeforetheCcomparatorisupdated.Thisresultsinthesourceaddress being stored twice before further duplicate entries are suppressed. This conditionoccurswithbranch-on-bitinstructionswhenthebranchisfetched by the first P-cycle of the branch or with loop-construct instructions in which the branch is fetched with the first or second P cycle. See examples below: LOOP INCX ; 1-byte instruction fetched by 1st P-cycle of BRCLR BRCLR CMPTMP,#$0c,LOOP ; the BRCLR instruction also will be fetched by 1st P-cycle of BRCLR LOOP2 BRN * ; 2-byte instruction fetched by 1st P-cycle of DBNE NOP ; 1-byte instruction fetched by 2nd P-cycle of DBNE DBNE A,LOOP2 ; this instruction also fetched by 2nd P-cycle of DBNE NOTE Loop1modedoesnotsupportpagedmemory,andinhibitsduplicateentries in the trace buffer based solely on the CPU address. There is a remote possibility of an erroneous address match if program flow alternates between paged and unpaged memory space. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 219 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description 7.4.2.6.3 Detail Mode In the detail mode, address and data for all cycles except program fetch (P) and free (f) cycles are stored in trace buffer. This mode is intended to supply additional information on indexed, indirect addressing modeswherestoringonlythedestinationaddresswouldnotprovideallinformationrequiredforauserto determine where his code was in error. 7.4.2.6.4 Profile Mode Thismodeisintendedtoallowahostcomputertopollarunningtargetandprovideahistogramofprogram execution.Eachreadofthetracebufferaddresswillreturntheaddressofthelastinstructionexecuted.The DBGCNTregisterisnotincrementedandthetracebufferdoesnotgetfilled.TheARMbitisnotusedand all breakpoints and all other debug functions will be disabled. 7.4.2.7 Storage Memory Thestoragememoryisa64wordsdeepby16-bitswidedualportRAMarray.TheCPUaccessestheRAM array through a single memory location window (DBGTBH:DBGTBL). The DBG module stores trace information in the RAM array in a circular buffer format. As data is read via the CPU, a pointer into the RAMwillincrementsothatthenextCPUreadwillreceivefreshinformation.Inalltriggermodesexcept forevent-onlyanddetailcapturemode,thedatastoredinthetracebufferwillbechange-of-flowaddresses. change-of-flow addresses are defined as follows: • Source address of conditional branches (long, short, BRSET, and loop constructs) taken • Destination address of indexed JMP, JSR, and CALL instruction • Destination address of RTI, RTS, and RTC instructions • Vector address of interrupts except for SWI and BDM vectors Intheevent-onlytriggermodesonlythe16-bitdatabusvaluecorrespondingtotheeventisstored.Inthe detail capture mode, address and then data are stored for all cycles except program fetch (P) and free (f) cycles. 7.4.2.8 Storing Data in Memory Storage Buffer 7.4.2.8.1 Storing with Begin-Trigger Storingwithbegin-triggercanbeusedinalltriggermodes.WhenDBGmodeisenabledandarmedinthe begin-triggermode,dataisnotstoredinthetracebufferuntilthetriggerconditionismet.Assoonasthe triggerconditionismet,theDBGmodulewillremainarmeduntil64wordsarestoredinthetracebuffer. If the trigger is at the address of the change-of-flow instruction the change-of-flow associated with the trigger event will be stored in the trace buffer. 7.4.2.8.2 Storing with End-Trigger Storing with end-trigger cannot be used in event-only trigger modes. When DBG mode is enabled and armed in the end-trigger mode, data is stored in the trace buffer until the trigger condition is met. When the trigger condition is met, the DBG module will become de-armed and no more data will be stored. If 220 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description the trigger is at the address of a change-of-flow address the trigger event will not be stored in the trace buffer. 7.4.2.9 Reading Data from Trace Buffer Thedatastoredinthetracebuffercanbereadusingeitherthebackgrounddebugmodule(BDM)module ortheCPUprovidedtheDBGmoduleisenabledandnotarmed.Thetracebufferdataisreadoutfirst-in first-out. By reading CNT in DBGCNT the number of valid words can be determined. CNT will not decrement as data is read from DBGTBH:DBGTBL. The trace buffer data is read by reading DBGTBH:DBGTBLwitha16-bitread.EachtimeDBGTBH:DBGTBLisread,apointerintheDBGwill be incremented to allow reading of the next word. Reading the trace buffer while the DBG module is armed will return invalid data and no shifting of the RAM pointer will occur. NOTE The trace buffer should be read with the DBG module enabled and in the same capture mode that the data was recorded. The contents of the trace buffer counter register (DBGCNT) are resolved differently in detail mode versestheothermodesandmayleadtoincorrectinterpretationofthetrace buffer data. 7.4.3 Breakpoints There are two ways of getting a breakpoint in DBG mode. One is based on the trigger condition of the trigger mode using comparator A and/or B, and the other is using comparator C. External breakpoints generated using theTAGHI andTAGLO external pins are disabled in DBG mode. 7.4.3.1 Breakpoint Based on Comparator A and B AbreakpointrequesttotheCPUcanbeenabledbysettingDBGBRKinDBGC1.ThevalueofBEGINin DBGC1 determines when the breakpoint request to the CPU will occur. When BEGIN in DBGC1 is set, begin-trigger is selected and the breakpoint request will not occur until the trace buffer is filled with 64words.WhenBEGINinDBGC1iscleared,end-triggerisselectedandthebreakpointrequestwilloccur immediately at the trigger cycle. There are two types of breakpoint requests supported by the DBG module, tagged and forced. Tagged breakpoints are associated with opcode addresses and allow breaking just before a specific instruction executes. Forced breakpoints are not associated with opcode addresses and allow breaking at the next instructionboundary.ThetypeofbreakpointbasedoncomparatorsAandBisdeterminedbyTRGSELin theDBGC1register(TRGSEL=1fortaggedbreakpoint,TRGSEL=0forforcedbreakpoint).Table7-26 illustrates the type of breakpoint that will occur based on the debug run. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 221 Rev 01.24

Chapter7 Debug Module (DBGV1) Block Description Table7-26. Breakpoint Setup BEGIN TRGSEL DBGBRK Type of Debug Run 0 0 0 Fill trace buffer until trigger address (no CPU breakpoint — keep running) 0 0 1 Fill trace buffer until trigger address, then a forced breakpoint request occurs 0 1 0 Fill trace buffer until trigger opcode is about to execute (no CPU breakpoint — keep running) 0 1 1 Fill trace buffer until trigger opcode about to execute, then a tagged breakpoint request occurs 1 0 0 Start trace buffer at trigger address (no CPU breakpoint — keep running) 1 0 1 Start trace buffer at trigger address, a forced breakpoint request occurs when trace buffer is full 1 1 0 Start trace buffer at trigger opcode (no CPU breakpoint — keep running) 1 1 1 Starttracebufferattriggeropcode,aforcedbreakpointrequest occurs when trace buffer is full 7.4.3.2 Breakpoint Based on Comparator C A breakpoint request to the CPU can be created if BKCEN in DBGC2 is set. Breakpoints based on a successful comparator C match can be accomplished regardless of the mode of operation for comparator A or B, and do not affect the status of the ARM bit. TAGC in DBGC2 is used to select either tagged or forcedbreakpointrequestsforcomparatorC.BreakpointsbasedoncomparatorCaredisabledinLOOP1 mode. NOTE BecausebreakpointscannotbedisabledwhentheDBGisarmed,onemust becarefultoavoidan“infinitebreakpointloop”whenusingtagged-typeC breakpoints while the DBG is armed. If BDM breakpoints are selected, executing a TRACE1 instruction before the GO instruction is the recommendedwaytoavoidre-triggeringabreakpointifonedoesnotwish tode-armtheDBG.IfSWIbreakpointsareselected,disarmingtheDBGin the SWI interrupt service routine is the recommended way to avoid re- triggering a breakpoint. 7.5 Resets The DBG module is disabled after reset. The DBG module cannot cause a MCU reset. 7.6 Interrupts The DBG contains one interrupt source. If a breakpoint is requested and BDM in DBGC2 is cleared, an SWI interrupt will be generated. 222 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.1 Introduction The ATD10B8C is an 8-channel, 10-bit, multiplexed input successive approximation analog-to-digital converter. Refer to device electrical specifications for ATD accuracy. The block is designed to be upwards compatible with the 68HC11 standard 8-bit A/D converter. In addition, there are new operating modes that are unique to the HC12 design. 8.1.1 Features • 8/10-bit resolution. • 7µsec, 10-bit single conversion time. • Sample buffer amplifier. • Programmable sample time. • Left/right justified, signed/unsigned result data. • External trigger control. • Conversion completion interrupt generation. • Analog input multiplexer for eight analog input channels. • Analog/digital input pin multiplexing. • 1-to-8 conversion sequence lengths. • Continuous conversion mode. • Multiple channel scans. 8.1.2 Modes of Operation 8.1.2.1 Conversion Modes There is software programmable selection between performing single or continuousconversion on a single channel ormultiple channels. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 223 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.1.2.2 MCU Operating Modes • Stop Mode Entering stop mode causes all clocks to halt and thus the system is placed in a minimum power standbymode.Thisabortsanyconversionsequenceinprogress.Duringrecoveryfromstopmode, there must be a minimum delay for the stop recovery time, t , before initiating a new ATD SR conversion sequence. • Wait Mode EnteringwaitmodetheATDconversioneithercontinuesorabortsforlowpowerdependingonthe logical value of the AWAIT bit. • Freeze Mode InfreezemodetheATD10B8CwillbehaveaccordingtothelogicalvaluesoftheFRZ1andFRZ0 bits. This is useful for debugging and emulation. 8.1.3 Block Diagram Figure8-1 is a block diagram of the ATD. ATD10B8C BUS CLOCK CLOCK ATD CLOCK PRESCALER CONVERSION MODE AND TIMING CONTROL COMPLETE INTERRUPT RESULTS ATD 0 VRH SUCCESSIVE ATD 1 V APPROXIMATION ATD 2 RL REGISTER (SAR) ATD 3 VDDA AND DAC ATD 4 V ATD 5 SSA ATD 6 ATD 7 AN7 / PAD7 AN6 / PAD6 + AN5 / PAD5 SAMPLE & HOLD AN4 / PAD4 1 – AN3 / PAD3 1 COMPARATOR AN2 / PAD2 AN1 / PAD1 AN0 / PAD0 ANALOG ATD INPUT ENABLE REGISTER MUX PORT AD DATA REGISTER Figure8-1. ATD10B8C Block Diagram 224 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.2 Signal Description The ATD10B8C has a total of 12 external pins. 8.2.1 AN7 / ETRIG / PAD7 This pin serves as the analog input channel 7. It can be configured to provide an external trigger for the ATD conversion. It can be configured as general-purpose digital I/O. 8.2.2 AN6 / PAD6 This pin serves as the analog input channel 6. It can be configured as general-purpose digital I/O. 8.2.3 AN5 / PAD5 This pin serves as the analog input channel 5. It can be configured as general-purpose digital I/O. 8.2.4 AN4 / PAD4 This pin serves as the analog input channel 4. It can be configured as general-purpose digital I/O. 8.2.5 AN3 / PAD3 This pin serves as the analog input channel 3. It can be configured as general-purpose digital I/O. 8.2.6 AN2 / PAD2 This pin serves as the analog input channel 2. It can be configured as general-purpose digital I/O. 8.2.7 AN1 / PAD1 This pin serves as the analog input channel 1. It can be configured as general-purpose digital I/O. 8.2.8 AN0 / PAD0 This pin serves as the analog input channel 0. It can be configured as general-purpose digital I/O. 8.2.9 V , V RH RL V is the high reference voltage and V is the low reference voltage for ATD conversion. RH RL 8.2.10 V , V DDA SSA These pins are the power supplies for the analog circuitry of the ATD10B8C block. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 225 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3 Memory Map and Registers This section provides a detailed description of all registers accessible in the ATD10B8C. 8.3.1 Module Memory Map Figure8-2 gives an overview on all ATD10B8C registers. Address Name Bit 7 6 5 4 3 2 1 Bit 0 R 0 0 0 0 0 0 0 0 0x0000 ATDCTL0 W R 0 0 0 0 0 0 0 0 0x0001 ATDCTL1 W R ASCIF 0x0002 ATDCTL2 ADPU AFFC AWAI ETRIGLE ETRIGP ETRIGE ASCIE W R 0 0x0003 ATDCTL3 S8C S4C S2C S1C FIFO FRZ1 FRZ0 W R 0x0004 ATDCTL4 SRES8 SMP1 SMP0 PRS4 PRS3 PRS2 PRS1 PRS0 W R 0 0x0005 ATDCTL5 DJM DSGN SCAN MULT CC CB CA W R 0 0 CC2 CC1 CC0 0x0006 ATDSTAT0 SCF ETORF FIFOR W R 0 0 0 0 0 0 0 0 0x0007 Unimplemented W R U U U U U U U U 0x0008 ATDTEST0 W R U U U U U U U 0x0009 ATDTEST1 SC W R 0 0 0 0 0 0 0 0 0x000A Unimplemented W R CCF7 CCF6 CCF5 CCF4 CCF3 CCF2 CCF1 CCF0 0x000B ATDSTAT1 W R 0 0 0 0 0 0 0 0 0x000C Unimplemented W R 0x000D ATDDIEN IEN7 IEN6 IEN5 IEN4 IEN3 IEN2 IEN1 IEN0 W R 0 0 0 0 0 0 0 0 0x000E Unimplemented W R PTAD7 PTAD6 PTAD5 PTAD4 PTAD3 PTAD2 PTAD1 PTAD0 0x000F PORTAD W = Unimplemented or Reserved Figure8-2. ATD Register Summary (Sheet 1 of 4) 226 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Address Name Bit 7 6 5 4 3 2 1 Bit 0 Left Justified Result Data R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x0010 ATDDR0H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x0011 ATDDR0L u u 0 0 0 0 0 0 W R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x0012 ATDDR1H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x0013 ATDDR1L u u 0 0 0 0 0 0 W R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x0014 ATDDR2H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x0015 ATDDR2L u u 0 0 0 0 0 0 W R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x0016 ATDDR3H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x0017 ATDDR3L u u 0 0 0 0 0 0 W R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x0018 ATDDR4H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x0019 ATDDR4L u u 0 0 0 0 0 0 W R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x001A ATDDR5H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x001B ATDDR5L u u 0 0 0 0 0 0 W R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x001C ATDDR6H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x001D ATDDR6L u u 0 0 0 0 0 0 W = Unimplemented or Reserved Figure8-2. ATD Register Summary (Sheet 2 of 4) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 227 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Address Name Bit 7 6 5 4 3 2 1 Bit 0 R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 0x001E ATDDR7H BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R BIT 1 BIT 0 0 0 0 0 0 0 0x001F ATDDR7L u u 0 0 0 0 0 0 W Right Justified Result Data R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x0010 ATDDR0H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x0011 ATDDR0L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x0012 ATDDR1H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x0013 ATDDR1L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x0014 ATDDR2H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x0015 ATDDR2L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x0016 ATDDR3H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x0017 ATDDR3L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x0018 ATDDR4H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x0019 ATDDR4L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x001A ATDDR5H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x001B ATDDR5L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W = Unimplemented or Reserved Figure8-2. ATD Register Summary (Sheet 3 of 4) 228 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Address Name Bit 7 6 5 4 3 2 1 Bit 0 R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x001C ATDDR6H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x001D ATDDR6L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W R 0 0 0 0 0 0 BIT 9 MSB BIT 8 0x001E ATDDR7H 0 0 0 0 0 0 0 0 W R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 0x001F ATDDR7L BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 W = Unimplemented or Reserved Figure8-2. ATD Register Summary (Sheet 4 of 4) NOTE Register Address = Module Base Address + Address Offset, where the ModuleBaseAddressisdefinedattheMCUlevelandtheAddressOffsetis defined at the module level. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 229 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2 Register Descriptions This section describes in address order all the ATD10B8C registers and their individual bits. 8.3.2.1 Reserved Register (ATDCTL0) Module Base + 0x0000 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-3. Reserved Register (ATDCTL0) Read: Always read $00 in normal modes Write: Unimplemented in normal modes 8.3.2.2 Reserved Register (ATDCTL1) Module Base + 0x0001 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-4. Reserved Register (ATDCTL1) Read: Always read $00 in normal modes Write: Unimplemented in normal modes NOTE Writing to this registers when in special modes can alter functionality. 230 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.3 ATD Control Register 2 (ATDCTL2) Thisregistercontrolspowerdown,interrupt,andexternaltrigger.Writestothisregisterwillabortcurrent conversion sequence but will not start a new sequence. Module Base + 0x0002 7 6 5 4 3 2 1 0 R ASCIF ADPU AFFC AWAI ETRIGLE ETRIGP ETRIGE ASCIE W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-5. ATD Control Register 2 (ATDCTL2) Read: Anytime Write: Anytime Table8-1. ATDCTL2 Field Descriptions Field Description 7 ATD Power Down — This bit provides on/off control over the ATD10B8C block allowing reduced MCU power ADPU consumption. Because analog electronic is turned off when powered down, the ATD requires a recovery time period after ADPU bit is enabled. 0 Power down ATD 1 Normal ATD functionality 6 ATD Fast Flag Clear All AFFC 0 ATDflagclearingoperatesnormally(readthestatusregisterATDSTAT1beforereadingtheresultregisterto clear the associate CCF flag). 1 ChangesallATDconversioncompleteflagstoafastclearsequence.Anyaccesstoaresultregisterwillcause the associate CCF flag to clear automatically. 5 ATDPowerDowninWaitMode—WhenenteringWaitModethisbitprovideson/offcontrolovertheATD10B8C AWAI block allowing reduced MCU power. Because analog electronic is turned off when powered down, the ATD requires a recovery time period after exit from Wait mode. 0 ATD continues to run in Wait mode 1 Halt conversion and power down ATD during Wait mode AfterexitingWaitmodewithaninterruptconversionwillresume.Butduetotherecoverytimetheresultofthis conversion should be ignored. 4 External Trigger Level/Edge Control — This bit controls the sensitivity of the external trigger signal. See ETRIGLE Table8-2 for details. 3 ExternalTriggerPolarity—Thisbitcontrolsthepolarityoftheexternaltriggersignal.SeeTable8-2fordetails. ETRIGP 2 External Trigger Mode Enable — This bit enables the external trigger on ATD channel 7. The external trigger ETRIGE allows to synchronize sample and ATD conversions processes with external events. 0 Disable external trigger 1 Enable external trigger Note:TheconversionresultsfortheexternaltriggerATDchannel7havenomeaningwhileexternaltriggermode is enabled. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 231 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Table8-1. ATDCTL2 Field Descriptions (continued) Field Description 1 ATD Sequence Complete Interrupt Enable ASCIE 0 ATD Sequence Complete interrupt requests are disabled. 1 ATD Interrupt will be requested whenever ASCIF = 1 is set. 0 ATD Sequence Complete Interrupt Flag — If ASCIE = 1 the ASCIF flag equals the SCF flag (see ASCIF Section8.3.2.7, “ATD Status Register 0 (ATDSTAT0)”), else ASCIF reads zero. Writes have no effect. 0 No ATD interrupt occurred 1 ATD sequence complete interrupt pending Table8-2. External Trigger Configurations ETRIGLE ETRIGP External Trigger Sensitivity 0 0 Falling edge 0 1 Rising edge 1 0 Low level 1 1 High level 8.3.2.4 ATD Control Register 3 (ATDCTL3) This register controls the conversion sequence length, FIFO for results registers and behavior in Freeze Mode. Writes to this register will abort current conversion sequence but will not start a new sequence. Module Base + 0x0003 7 6 5 4 3 2 1 0 R 0 S8C S4C S2C S1C FIFO FRZ1 FRZ0 W Reset 0 0 1 0 0 0 0 0 = Unimplemented or Reserved Figure8-6. ATD Control Register 3 (ATDCTL3) Read: Anytime Write: Anytime Table8-3. ATDCTL3 Field Descriptions Field Description 6–3 ConversionSequenceLength—Thesebitscontrolthenumberofconversionspersequence.Table8-4shows S8C, S4C, allcombinations.Atreset,S4Cissetto1(sequencelengthis4).ThisistomaintainsoftwarecontinuitytoHC12 S2C, S1C Family. 232 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Table8-3. ATDCTL3 Field Descriptions (continued) Field Description 2 ResultRegisterFIFOMode—Ifthisbitiszero(non-FIFOmode),theA/Dconversionresultsmapintotheresult FIFO registersbasedontheconversionsequence;theresultofthefirstconversionappearsinthefirstresultregister, the second result in the second result register, and so on. If this bit is one (FIFO mode) the conversion counter is not reset at the beginning or ending of a conversion sequence; sequential conversion results are placed in consecutive result registers. In a continuously scanning conversionsequence,theresultregistercounterwillwraparoundwhenitreachestheendoftheresultregister file. The conversion counter value (CC2-0 in ATDSTAT0) can be used to determine where in the result register file, the current conversion result will be placed. Aborting a conversion or starting a new conversion by write to an ATDCTL register (ATDCTL5-0) clears the conversion counter even if FIFO=1. So the first result of a new conversion sequence, started by writing to ATDCTL5,willalwaysbeplaceinthefirstresultregister(ATDDDR0).IntendedusageofFIFOmodeiscontinuos conversion (SCAN=1) or triggered conversion (ETRIG=1). Whichresultregistersholdvaliddatacanbetrackedusingtheconversioncompleteflags.Fastflagclearmode may or may not be useful in a particular application to track valid data. 0 Conversion results are placed in the corresponding result register up to the selected sequence length. 1 Conversion results are placed in consecutive result registers (wrap around at end). 1–0 Background Debug Freeze Enable — When debugging an application, it is useful in many cases to have the FRIZ[1:0] ATDpausewhenabreakpoint(FreezeMode)isencountered.These2bitsdeterminehowtheATDwillrespond toabreakpointasshowninTable8-5.Leakageontothestoragenodeandcomparatorreferencecapacitorsmay compromise the accuracy of an immediately frozen conversion depending on the length of the freeze period. Table8-4. Conversion Sequence Length Coding NumberofConversionsper S8C S4C S2C S1C Sequence 0 0 0 0 8 0 0 0 1 1 0 0 1 0 2 0 0 1 1 3 0 1 0 0 4 0 1 0 1 5 0 1 1 0 6 0 1 1 1 7 1 X X X 8 Table8-5. ATD Behavior in Freeze Mode (Breakpoint) FRZ1 FRZ0 Behavior in Freeze Mode 0 0 Continue conversion 0 1 Reserved 1 0 Finish current conversion, then freeze 1 1 Freeze Immediately Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 233 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.5 ATD Control Register 4 (ATDCTL4) Thisregisterselectstheconversionclockfrequency,thelengthofthesecondphaseofthesampletimeand the resolution of the A/D conversion (i.e.: 8-bits or 10-bits). Writes to this register will abort current conversion sequence but will not start a new sequence. Module Base + 0x0004 7 6 5 4 3 2 1 0 R SRES8 SMP1 SMP0 PRS4 PRS3 PRS2 PRS1 PRS0 W Reset 0 0 0 0 0 1 0 1 Figure8-7. ATD Control Register 4 (ATDCTL4) Read: Anytime Write: Anytime Table8-6. ATDCTL4 Field Descriptions Field Description 7 A/DResolutionSelect—ThisbitselectstheresolutionofA/Dconversionresultsaseither8or10bits.TheA/D SRES8 converter has an accuracy of 10 bits; however, if low resolution is required, the conversion can be speeded up by selecting 8-bit resolution. 0 10-bit resolution 1 8-bit resolution 6–5 SampleTimeSelect—ThesetwobitsselectthelengthofthesecondphaseofthesampletimeinunitsofATD SMP[1:0] conversionclockcycles.NotethattheATDconversionclockperiodisitselfafunctionoftheprescalervalue(bits PRS4-0).Thesampletimeconsistsoftwophases.ThefirstphaseistwoATDconversionclockcycleslongand transfers the sample quickly (via the buffer amplifier) onto the A/D machine’s storage node. The second phase attaches the external analog signal directly to the storage node for final charging and high accuracy.Table8-7 lists the lengths available for the second sample phase. 4–0 ATD Clock Prescaler— These 5 bits are the binary value prescaler value PRS. The ATD conversion clock PRS[4:0} frequency is calculated as follows: [BusClock] ATDclock = ------------------------------×0.5 [PRS+1] Note:The maximum ATD conversion clock frequency is half the Bus Clock. The default (after reset) prescaler value is 5 which results in a default ATD conversion clock frequency that is Bus Clock divided by 12. Table8-8 illustrates the divide-by operation and the appropriate range of the Bus Clock. Table8-7. Sample Time Select SMP1 SMP0 Length of 2nd Phase of Sample Time 0 0 2 A/D conversion clock periods 0 1 4 A/D conversion clock periods 1 0 8 A/D conversion clock periods 1 1 16 A/D conversion clock periods 234 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Table8-8. Clock Prescaler Values Total Divisor Maximum Minimum Prescale Value Value Bus Clock(1) Bus Clock(2) 00000 Divide by 2 4 MHz 1 MHz 00001 Divide by 4 8 MHz 2 MHz 00010 Divide by 6 12 MHz 3 MHz 00011 Divide by 8 16 MHz 4 MHz 00100 Divide by 10 20 MHz 5 MHz 00101 Divide by 12 24 MHz 6 MHz 00110 Divide by 14 28 MHz 7 MHz 00111 Divide by 16 32 MHz 8 MHz 01000 Divide by 18 36 MHz 9 MHz 01001 Divide by 20 40 MHz 10 MHz 01010 Divide by 22 44 MHz 11 MHz 01011 Divide by 24 48 MHz 12 MHz 01100 Divide by 26 52 MHz 13 MHz 01101 Divide by 28 56 MHz 14 MHz 01110 Divide by 30 60 MHz 15 MHz 01111 Divide by 32 64 MHz 16 MHz 10000 Divide by 34 68 MHz 17 MHz 10001 Divide by 36 72 MHz 18 MHz 10010 Divide by 38 76 MHz 19 MHz 10011 Divide by 40 80 MHz 20 MHz 10100 Divide by 42 84 MHz 21 MHz 10101 Divide by 44 88 MHz 22 MHz 10110 Divide by 46 92 MHz 23 MHz 10111 Divide by 48 96 MHz 24 MHz 11000 Divide by 50 100 MHz 25 MHz 11001 Divide by 52 104 MHz 26 MHz 11010 Divide by 54 108 MHz 27 MHz 11011 Divide by 56 112 MHz 28 MHz 11100 Divide by 58 116 MHz 29 MHz 11101 Divide by 60 120 MHz 30 MHz 11110 Divide by 62 124 MHz 31 MHz 11111 Divide by 64 128 MHz 32 MHz 1.MaximumATDconversionclockfrequencyis2MHz.Themaximumallowedbusclockfrequencyis shown in this column. 2. MinimumATDconversionclockfrequencyis500kHz.Theminimumallowedbusclockfrequency is shown in this column. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 235 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.6 ATD Control Register 5 (ATDCTL5) Thisregisterselectsthetypeofconversionsequenceandtheanaloginputchannelssampled.Writestothis register will abort current conversion sequence and start a new conversion sequence. Module Base + 0x0005 7 6 5 4 3 2 1 0 R 0 DJM DSGN SCAN MULT CC CB CA W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-8. ATD Control Register 5 (ATDCTL5) Read: Anytime Write: Anytime Table8-9. ATDCTL5 Field Descriptions Field Description 7 Result Register Data Justification — This bit controls justification of conversion data in the result registers. DJM SeeSection8.3.2.13, “ATD Conversion Result Registers (ATDDRHx/ATDDRLx)” for details. 0 Left justified data in the result registers 1 Right justified data in the result registers 6 Result Register Data Signed or Unsigned Representation — This bit selects between signed and unsigned DSGN conversion data representation in the result registers. Signed data is represented as 2’s complement. Signed data is not available in right justification. SeeSection8.3.2.13, “ATD Conversion Result Registers (ATDDRHx/ATDDRLx)” for details. 0 Unsigned data representation in the result registers 1 Signed data representation in the result registers Table8-10 summarizes the result data formats available and how they are set up using the control bits. Table8-11 illustrates the difference between the signed and unsigned, left justified output codes for an input signal range between 0 and 5.12 Volts. 5 Continuous Conversion Sequence Mode — This bit selects whether conversion sequences are performed SCAN continuously or only once. 0 Single conversion sequence 1 Continuous conversion sequences (scan mode) 4 Multi-ChannelSampleMode—WhenMULTis0,theATDsequencecontrollersamplesonlyfromthespecified MULT analog input channel for an entire conversion sequence. The analog channel is selected by channel selection code (control bits CC/CB/CA located in ATDCTL5). When MULT is 1, the ATD sequence controller samples acrosschannels.Thenumberofchannelssampledisdeterminedbythesequencelengthvalue(S8C,S4C,S2C, S1C). The first analog channel examined is determined by channel selection code (CC, CB, CA control bits); subsequent channels sampled in the sequence are determined by incrementing the channel selection code. 0 Sample only one channel 1 Sample across several channels 2–1 Analog Input Channel Select Code — These bits select the analog input channel(s) whose signals are CC, CB, CA sampled and converted to digital codes.Table8-12 lists the coding used to select the various analog input channels.Inthecaseofsinglechannelscans(MULT=0),thisselectioncodespecifiedthechannelexamined. In the case of multi-channel scans (MULT = 1), this selection code represents the first channel to be examined in the conversion sequence. Subsequent channels are determined by incrementing channel selection code; selection codes that reach the maximum value wrap around to the minimum value. 236 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Table8-10. Available Result Data Formats Result Data Formats SRES8 DJM DSGN Description and Bus Bit Mapping 1 0 0 8-bit / left justified / unsigned — bits 8–15 1 0 1 8-bit / left justified / signed — bits 8–15 1 1 X 8-bit / right justified / unsigned — bits 0–7 0 0 0 10-bit / left justified / unsigned — bits 6–15 0 0 1 10-bit / left justified / signed — bits 6–15 0 1 X 10-bit / right justified / unsigned — bits 0–9 Table8-11. Left Justified, Signed, and Unsigned ATD Output Codes. Input Signal Signed Unsigned Signed Unsigned V = 0 Volts 8-Bit 8-Bit 10-Bit 10-Bit RL V = 5.12 Volts Codes Codes Codes Codes RH 5.120 Volts 7F FF 7FC0 FFC0 5.100 7F FF 7F00 FF00 5.080 7E FE 7E00 FE00 2.580 01 81 0100 8100 2.560 00 80 0000 8000 2.540 FF 7F FF00 7F00 0.020 81 01 8100 0100 0.000 80 00 8000 0000 Table8-12. Analog Input Channel Select Coding CC CB CA Analog Input Channel 0 0 0 AN0 0 0 1 AN1 0 1 0 AN2 0 1 1 AN3 1 0 0 AN4 1 0 1 AN5 1 1 0 AN6 1 1 1 AN7 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 237 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.7 ATD Status Register 0 (ATDSTAT0) This read-only register contains the sequence complete flag, overrun flags for external trigger and FIFO mode, and the conversion counter. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 CC2 CC1 CC0 SCF ETORF FIFOR W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-9. ATD Status Register 0 (ATDSTAT0) Read: Anytime Write: Anytime (no effect on (CC2, CC1, CC0)) Table8-13. ATDSTAT0 Field Descriptions Field Description 7 Sequence Complete Flag — This flag is set upon completion of a conversion sequence. If conversion SCF sequences are continuously performed (SCAN = 1), the flag is set after each one is completed. This flag is cleared when one of the following occurs: A) Write “1” to SCF B) Write to ATDCTL5 (a new conversion sequence is started) C) If AFFC=1 and read of a result register 0 Conversion sequence not completed 1 Conversion sequence has completed 5 External Trigger Overrun Flag — While in edge trigger mode (ETRIGLE = 0), if additional active edges are ETORF detectedwhileaconversionsequenceisinprocesstheoverrunflagisset.Thisflagisclearedwhenoneofthe following occurs: A) Write “1” to ETORF B) Write to ATDCTL2, ATDCTL3 or ATDCTL4 (a conversion sequence is aborted) C) Write to ATDCTL5 (a new conversion sequence is started) 0 No External trigger over run error has occurred 1 External trigger over run error has occurred 238 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description Table8-13. ATDSTAT0 Field Descriptions (continued) Field Description 4 FIFO Over Run Flag — This bit indicates that a result register has been written to before its associated FIFOR conversioncompleteflag(CCF)hasbeencleared.ThisflagismostusefulwhenusingtheFIFOmodebecause the flag potentially indicates that result registers are out of sync with the input channels. However, it is also practicalfornon-FIFOmodes,andindicatesthataresultregisterhasbeenoverwrittenbeforeithasbeenread (i.e. the old data has been lost). This flag is cleared when one of the following occurs: A) Write “1” to FIFOR B) Start a new conversion sequence (write to ATDCTL5 or external trigger) 0 No over run has occurred 1 An over run condition exists 2–0 ConversionCounter—These3read-onlybitsarethebinaryvalueoftheconversioncounter.Theconversion CC[2:0] counterpointstotheresultregisterthatwillreceivetheresultofthecurrentconversion.Forexample,CC2=1, CC1 = 1, CC0 = 0 indicates that the result of the current conversion will be in ATD Result Register 6. If in non- FIFO mode (FIFO = 0) the conversion counter is initialized to zero at the begin and end of the conversion sequence. If in FIFO mode (FIFO = 1) the register counter is not initialized. The conversion counters wraps around when its maximum value is reached. Aborting a conversion or starting a new conversion by write to an ATDCTL register (ATDCTL5-2) clears the conversion counter even if FIFO=1. 8.3.2.8 Reserved Register (ATDTEST0) Module Base + 0x0008 7 6 5 4 3 2 1 0 R U U U U U U U U W Reset 1 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-10. Reserved Register (ATDTEST0) Read: Anytime, returns unpredictable values Write: Anytime in special modes, unimplemented in normal modes NOTE Writing to this registers when in special modes can alter functionality. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 239 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.9 ATD Test Register 1 (ATDTEST1) This register contains the SC bit used to enable special channel conversions. Module Base + 0x0009 7 6 5 4 3 2 1 0 R U U U U U U U SC W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-11. ATD Test Register 1 (ATDTEST1) Read: Anytime, returns unpredictable values for Bit 7 and Bit 6 Write: Anytime Table8-14. ATDTEST1 Field Descriptions Field Description 0 SpecialChannelConversionBit—Ifthisbitisset,thenspecialchannelconversioncanbeselectedusingCC, SC CB, and CA of ATDCTL5.Table8-15 lists the coding. 0 Special channel conversions disabled 1 Special channel conversions enabled Note:AlwayswriteremainingbitsofATDTEST1(Bit7toBit1)zerowhenwritingSCbit.Notdoingsomightresult in unpredictable ATD behavior. Table8-15. Special Channel Select Coding SC CC CB CA Analog Input Channel 1 0 X X Reserved 1 1 0 0 V RH 1 1 0 1 V RL 1 1 1 0 (V +V ) / 2 RH RL 1 1 1 1 Reserved 240 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.10 ATD Status Register 1 (ATDSTAT1) This read-only register contains the Conversion Complete Flags. Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCF7 CCF6 CCF5 CCF4 CCF3 CCF2 CCF1 CCF0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure8-12. ATD Status Register 1 (ATDSTAT1) Read: Anytime Write: Anytime, no effect Table8-16. ATDSTAT1 Field Descriptions Field Description 7–0 ConversionCompleteFlagx(x=7,6,5,4,3,2,1,0)—Aconversioncompleteflagissetattheendofeach CCF[7:0] conversioninaconversionsequence.Theflagsareassociatedwiththeconversionpositioninasequence(and alsotheresultregisternumber).Therefore,CCF0issetwhenthefirstconversioninasequenceiscompleteand the result is available in result register ATDDR0; CCF1 is set when the second conversion in a sequence is complete and the result is available in ATDDR1, and so forth. A flag CCFx (x = 7, 6, 5, 4, 3, 2, 1, 0) is cleared when one of the following occurs: A) Write to ATDCTL5 (a new conversion sequence is started) B) If AFFC = 0 and read of ATDSTAT1 followed by read of result register ATDDRx C) If AFFC = 1 and read of result register ATDDRx 0 Conversion number x not completed 1 Conversion number x has completed, result ready in ATDDRx Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 241 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.11 ATD Input Enable Register (ATDDIEN) Module Base + 0x000D 7 6 5 4 3 2 1 0 R IEN7 IEN6 IEN5 IEN4 IEN3 IEN2 IEN1 IEN0 W Reset 0 0 0 0 0 0 0 0 Figure8-13. ATD Input Enable Register (ATDDIEN) Read: Anytime Write: Anytime Table8-17. ATDDIEN Field Descriptions Field Description 7–0 ATDDigitalInputEnableonchannelx(x=7,6,5,4,3,2,1,0)—Thisbitcontrolsthedigitalinputbufferfrom IEN[7:0] the analog input pin (ANx) to PTADx data register. 0 Disable digital input buffer to PTADx 1 Enable digital input buffer to PTADx. Note:Setting this bit will enable the corresponding digital input buffer continuously. If this bit is set while simultaneouslyusingitasananalogport,thereispotentiallyincreasedpowerconsumptionbecausethe digital input buffer maybe in the linear region. 242 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.12 Port Data Register (PORTAD) The data port associated with the ATD is general purpose I/O. The port pins are shared with the analog A/D inputs AN7–AN0. Module Base + 0x000F 7 6 5 4 3 2 1 0 R PTAD7 PTAD6 PTAD5 PTAD4 PTAD3 PTAD2 PTAD1 PTAD0 W Reset 1 1 1 1 1 1 1 1 Pin AN7 AN6 AN5 AN4 AN3‘ AN2 AN1 AN0 Function = Unimplemented or Reserved Figure8-14. Port Data Register (PORTAD) Read: Anytime Write: Anytime, no effect The A/D input channels may be used for general-purpose digital I/0. Table8-18. PORTAD Field Descriptions Field Description 7 A/DChannelx(ANx)DigitalInput(x=7,6,5,4,3,2,1,0)—IfthedigitalinputbufferontheANxpinisenabled PTAD[7:0] (IENx=1)readreturnsthelogiclevelonANxpin(signalpotentialsnotmeetingV orV specificationswillhave IL IH an indeterminate value)). If the digital input buffers are disabled (IENx = 0), read returns a “1”. Reset sets all PORTAD bits to “1”. 8.3.2.13 ATD Conversion Result Registers (ATDDRHx/ATDDRLx) The A/D conversion results are stored in 8 read-only result registers ATDDRHx/ATDDRLx. The result dataisformattedintheresultregistersbasedontwocriteria.Firstthereisleftandrightjustification;this selectionismadeusingtheDJMcontrolbitinATDCTL5.Secondthereissignedandunsigneddata;this selection is made using the DSGN control bit in ATDCTL5. Signed data is stored in 2’s complement format and only exists in left justified format. Signed data selected for right justified format is ignored. Read: Anytime Write: Anytime, no effect in normal modes Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 243 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.3.2.13.1 Left Justified Result Data Module Base + 0x0010 = ATDDR0H, 0x0012 = ATDDR1H, 0x0014 = ATDDR2H, 0x0016 = ATDDR3H 0x0018 = ATDDR4H, 0x001A = ATDDR5H, 0x001C = ATDDR6H, 0x001E = ATDDR7H 7 6 5 4 3 2 1 0 R BIT 9 MSB BIT 8 BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 10-bit data BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 8-bit data W Reset 0 0 0 0 0 0 0 0 Figure8-15. Left Justified, ATD Conversion Result Register, High Byte (ATDDRxH) Module Base + 0x0011 = ATDDR0L, 0x0013 = ATDDR1L, 0x0015 = ATDDR2L, 0x0017 = ATDDR3L 0x0019 = ATDDR4L, 0x001B = ATDDR5L, 0x001D = ATDDR6L, 0x001F = ATDDR7L 7 6 5 4 3 2 1 0 R BIT 1 BIT 0 0 0 0 0 0 0 10-bit data U U 0 0 0 0 0 0 8-bit data W Reset 0 0 0 0 0 0 0 0 Figure8-16. Left Justified, ATD Conversion Result Register, Low Byte (ATDDRxL) 8.3.2.13.2 Right Justified Result Data Module Base + 0x0010 = ATDDR0H, 0x0012 = ATDDR1H, 0x0014 = ATDDR2H, 0x0016 = ATDDR3H 0x0018 = ATDDR4H, 0x001A = ATDDR5H, 0x001C = ATDDR6H, 0x001E = ATDDR7H 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 BIT 9 MSB BIT 8 10-bit data 0 0 0 0 0 0 0 0 8-bit data W Reset 0 0 0 0 0 0 0 0 Figure8-17. Right Justified, ATD Conversion Result Register, High Byte (ATDDRxH) Module Base + 0x0011 = ATDDR0L, 0x0013 = ATDDR1L, 0x0015 = ATDDR2L, 0x0017 = ATDDR3L 0x0019 = ATDDR4L, 0x001B = ATDDR5L, 0x001D = ATDDR6L, 0x001F = ATDDR7L 7 6 5 4 3 2 1 0 R BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 10-bit data BIT 7 MSB BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 8-bit data W Reset 0 0 0 0 0 0 0 0 Figure8-18. Right Justified, ATD Conversion Result Register, Low Byte (ATDDRxL) 244 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.4 Functional Description The ATD10B8C is structured in an analog and a digital sub-block. 8.4.1 Analog Sub-block The analog sub-block contains all analog electronics required to perform a single conversion. Separate powersuppliesV andV allowtoisolatenoiseofotherMCUcircuitryfromtheanalogsub-block. DDA SSA 8.4.1.1 Sample and Hold Machine Thesampleandhold(S/H)machineacceptsanalogsignalsfromtheexternalsurroundingsandstoresthem as capacitor charge on a storage node. The sample process uses a two stage approach. During the first stage, the sample amplifier is used to quickly charge the storage node.The second stage connects the input directly to the storage node to complete the sample for high accuracy. Whennotsampling,thesampleandholdmachinedisablesitsownclocks.Theanalogelectronicsstilldraw theirquiescentcurrent.Thepowerdown(ADPU)bitmustbesettodisableboththedigitalclocksandthe analog power consumption. The input analog signals are unipolar and must fall within the potential range of V to V . SSA DDA 8.4.1.2 Analog Input Multiplexer Theanaloginputmultiplexerconnectsoneofthe8externalanaloginputchannelstothesampleandhold machine. 8.4.1.3 Sample Buffer Amplifier The sample amplifier is used to buffer the input analog signal so that the storage node can be quickly charged to the sample potential. 8.4.1.4 Analog-to-Digital (A/D) Machine TheA/Dmachineperformsanalog-to-digitalconversions.Theresolutionisprogramselectableateither8 or10bits.TheA/Dmachineusesasuccessiveapproximationarchitecture.Itfunctionsbycomparingthe storedanalogsamplepotentialwithaseriesofdigitallygeneratedanalogpotentials.Byfollowingabinary search algorithm, the A/D machine locates the approximating potential that is nearest to the sampled potential. WhennotconvertingtheA/Dmachinedisablesitsownclocks.Theanalogelectronicsstilldrawsquiescent current.Thepowerdown(ADPU)bitmustbesettodisableboththedigitalclocksandtheanalogpower consumption. OnlyanaloginputsignalswithinthepotentialrangeofV toV (A/Dreferencepotentials)willresult RL RH in a non-railed digital output codes. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 245 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.4.2 Digital Sub-block This subsection explains some of the digital features in more detail. See 7 for all details. 8.4.2.1 External Trigger Input (ETRIG) The external trigger feature allows the user to synchronize ATD conversions to the external environment eventsratherthanrelyingonsoftwaretosignaltheATDmodulewhenATDconversionsaretotakeplace. The input signal (ATD channel 7) is programmable to be edge or level sensitive with polarity control. Table8-19 gives a brief description of the different combinations of control bits and their affect on the external trigger function . Table8-19. External Trigger Control Bits ETRIGLE ETRIGP ETRIGE SCAN Description X X 0 0 Ignoresexternaltrigger.Performsoneconversionsequence and stops. X X 0 1 Ignores external trigger. Performs continuous conversion sequences. 0 0 1 X Falling edge triggered. Performs one conversion sequence per trigger. 0 1 1 X Rising edge triggered. Performs one conversion sequence per trigger. 1 0 1 X Trigger active low. Performs continuous conversions while trigger is active. 1 1 1 X Trigger active high. Performs continuous conversions while trigger is active. During a conversion, if additional active edges are detected the overrun error flag ETORF is set. In either level or edge triggered modes, the first conversion begins when the trigger is received. In both cases,themaximumlatencytimeisoneBusClockcycleplusanyskewordelayintroducedbythetrigger circuitry. NOTE The conversion results for the external trigger ATD channel 7 have no meaning while external trigger mode is enabled. Once ETRIGE is enabled, conversions cannot be started by a write to ATDCTL5, but rather must be triggered externally. Ifthelevelmodeisactiveandtheexternaltriggerbothde-assertsandre-assertsitselfduringaconversion sequence,thisdoesnotconstituteanoverrun;therefore,theflagisnotset.Ifthetriggerisleftassertedin level mode while a sequence is completing, another sequence will be triggered immediately. 246 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.4.2.2 General-Purpose Digital Port Operation The channel pins can be multiplexed between analog and digital data. As analog inputs, they are multiplexed and sampled to supply signals to the A/D converter. Alternatively they can be configured as digital I/O signals with the port I/O data being held in PORTAD. Theanalog/digitalmultiplexoperationisperformedinthepads.Thepadisalwaysconnectedtotheanalog inputsoftheATD10B8C.Thepadsignalisbufferedtothedigitalportregisters.Thisbuffercanbeturned on or off with the ATDDIEN register. This is important so that the buffer does not draw excess current when analog potentials are presented at its input. 8.4.2.3 Low-Power Modes The ATD10B8C can be configured for lower MCU power consumption in three different ways: 1. StopMode:ThishaltsA/Dconversion.ExitfromStopmodewillresumeA/Dconversion,Butdue to the recovery time the result of this conversion should be ignored. 2. Wait Mode with AWAI = 1: This halts A/D conversion. Exit from Wait mode will resume A/D conversion, but due to the recovery time the result of this conversion should be ignored. 3. Writing ADPU = 0 (Note that all ATD registers remain accessible.): This aborts any A/D conversion in progress. NOTE The reset value for the ADPU bit is zero. Therefore, when this module is reset, it is reset into the power down state. 8.5 Initialization/Application Information 8.5.1 Setting up and starting an A/D conversion ThefollowingdescribesatypicalsetupprocedureforstartingA/Dconversions.Itishighlyrecommended to follow this procedure to avoid common mistakes. Each step of the procedure will have a general remark and a typical example 8.5.1.1 Step 1 Power up the ATD and concurrently define other settings in ATDCTL2 Example:WritetoATDCTL2:ADPU=1->powersuptheATD,ASCIE=1enableinterruptonfinishofa conversion sequence. 8.5.1.2 Step 2 Wait for the ATD Recovery Time t before you proceed with Step 3. REC Example: Use the CPU in a branch loop to wait for a defined number of bus clocks. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 247 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.5.1.3 Step 3 Configure how many conversions you want to perform in one sequence and define other settings in ATDCTL3. Example: Write S4C=1 to do 4 conversions per sequence. 8.5.1.4 Step 4 Configure resolution, sampling time and ATD clock speed in ATDCTL4. Example: Use default for resolution and sampling time by leaving SRES8, SMP1 and SMP0 clear. For a bus clock of 40MHz write 9 to PR4-0, this gives an ATD clock of 0.5*40MHz/(9+1) = 2MHz which is within the allowed range for f . ATDCLK 8.5.1.5 Step 5 Configurestartingchannel,single/multiplechannel,continuousorsinglesequenceandresultdataformat inATDCTL5.WritingATDCTL5willstarttheconversion,somakesureyourwriteATDCTL5inthelast step. Example: Leave CC,CB,CA clear to start on channel AN0. Write MULT=1 to convert channel AN0 to AN3 in a sequence (4 conversion per sequence selected in ATDCTL3). 8.5.2 Aborting an A/D conversion 8.5.2.1 Step 1 DisabletheATDInterruptbywritingASCIE=0inATDCTL2.Thiswillalsoabortanyongoingconversion sequence. It is important to clear the interrupt enable at this point, prior to step 3, as depending on the device clock gating it may not always be possible to clear it or the SCF flag once the module is disabled (ADPU=0). 8.5.2.2 Step 2 Clear the SCF flag by writing a 1 in ATDSTAT0. (Remaining flags will be cleared with the next start of a conversions, but SCF flag should be cleared to avoid SCF interrupt.) 8.5.2.3 Step 3 Power down ATD by writing ADPU=0 in ATDCTL2. 8.6 Resets At reset the ATD10B8C is in a power down state. The reset state of each individual bit is listed within Section8.3.2, “Register Descriptions” which details the registers and their bit-field. 248 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 8.7 Interrupts TheinterruptrequestedbytheATD10B8CislistedinTable8-20.RefertoMCUspecificationforrelated vector address and priority. Table8-20. ATD10B8C Interrupt Vectors CCR Interrupt Source Local Enable Mask Sequence complete interrupt I bit ASCIE in ATDCTL2 See Section8.3.2, “Register Descriptions” for further details. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 249 Rev 01.24

Chapter8 Analog-to-Digital Converter (ATD10B8C) Block Description 250 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 9 Clocks and Reset Generator (CRGV4) Block Description 9.1 Introduction This specification describes the function of the clocks and reset generator (CRGV4). 9.1.1 Features The main features of this block are: • Phase-locked loop (PLL) frequency multiplier — Reference divider — Automatic bandwidth control mode for low-jitter operation — Automatic frequency lock detector — CPU interrupt on entry or exit from locked condition — Self-clock mode in absence of reference clock • System clock generator — Clock quality check — Clock switch for either oscillator- or PLL-based system clocks — User selectable disabling of clocks during wait mode for reduced power consumption • Computer operating properly (COP) watchdog timer with time-out clear window • System reset generation from the following possible sources: — Power-on reset — Low voltage reset Refer to the device overview section for availability of this feature. — COP reset — Loss of clock reset — External pin reset • Real-time interrupt (RTI) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 251 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.1.2 Modes of Operation This subsection lists and briefly describes all operating modes supported by the CRG. • Run mode AllfunctionalpartsoftheCRGarerunningduringnormalrunmode.IfRTIorCOPfunctionality isrequiredtheindividualbitsoftheassociatedrateselectregisters(COPCTL,RTICTL)havetobe set to a nonzero value. • Wait mode This mode allows to disable the system and core clocks depending on the configuration of the individual bits in the CLKSEL register. • Stop mode DependingonthesettingofthePSTPbit,stopmodecanbedifferentiatedbetweenfullstopmode (PSTP= 0) and pseudo-stop mode (PSTP= 1). — Full stop mode The oscillator is disabled and thus all system and core clocks are stopped. The COP and the RTI remain frozen. — Pseudo-stop mode The oscillator continues to run and most of the system and core clocks are stopped. If the respective enable bits are set the COP and RTI will continue to run, else they remain frozen. • Self-clock mode Self-clock mode will be entered if the clock monitor enable bit (CME) and the self-clock mode enablebit(SCME)arebothassertedandtheclockmonitorintheoscillatorblockdetectsalossof clock. As soon as self-clock mode is entered the CRGV4 starts to perform a clock quality check. Self-clockmoderemainsactiveuntiltheclockqualitycheckindicatesthattherequiredqualityof the incoming clock signal is met (frequency and amplitude). Self-clock mode should be used for safetypurposesonly.ItprovidesreducedfunctionalitytotheMCUincasealossofclockiscausing severe system conditions. 9.1.3 Block Diagram Figure9-1 shows a block diagram of the CRGV4. 252 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Power-on Reset Voltage Regulator Low Voltage Reset1 CRG RESET Reset System Reset Generator Clock CM fail Monitor XCLKS ut o Clock Quality OSCCLK e Oscil- m Checker EXTAL Ti Bus Clock lator P O XTAL C Core Clock COP RTI Oscillator Clock Registers XFC PLLCLK V Clock and Reset Real-Time Interrupt DDPLL PLL VSSPLL Control PLL Lock Interrupt Self-Clock Mode Interrupt 1 Refer to the device overview section for availability of the low-voltage reset feature. Figure9-1. CRG Block Diagram 9.2 External Signal Description This section lists and describes the signals that connect off chip. 9.2.1 V , V — PLL Operating Voltage, PLL Ground DDPLL SSPLL Thesepinsprovidesoperatingvoltage(V )andground(V )forthePLLcircuitry.Thisallows DDPLL SSPLL the supply voltage to the PLL to be independently bypassed. Even if PLL usage is not required V DDPLL and V must be connected properly. SSPLL 9.2.2 XFC — PLL Loop Filter Pin A passive external loop filter must be placed on the XFC pin. The filter is a second-order, low-pass filter to eliminate the VCO input ripple. The value of the external filter network and the reference frequency determinesthespeedofthecorrectionsandthestabilityofthePLL.Refertothedeviceoverviewchapter for calculation of PLL loop filter (XFC) components. If PLL usage is not required the XFC pin must be tied to V . DDPLL Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 253 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description V DDPLL CS CP MCU RS XFC Figure9-2. PLL Loop Filter Connections 9.2.3 RESET — Reset Pin RESET is an active low bidirectional reset pin. As an input it initializes the MCU asynchronously to a knownstart-upstate.Asanopen-drainoutputitindicatesthatansystemreset(internaltoMCU)hasbeen triggered. 9.3 Memory Map and Register Definition This section provides a detailed description of all registers accessible in the CRGV4. 9.3.1 Module Memory Map Table9-1 gives an overview on all CRGV4 registers. Table9-1. CRGV4 Memory Map Address Use Access Offset 0x0000 CRG Synthesizer Register (SYNR) R/W 0x0001 CRG Reference Divider Register (REFDV) R/W 0x0002 CRG Test Flags Register (CTFLG)(1) R/W 0x0003 CRG Flags Register (CRGFLG) R/W 0x0004 CRG Interrupt Enable Register (CRGINT) R/W 0x0005 CRG Clock Select Register (CLKSEL) R/W 0x0006 CRG PLL Control Register (PLLCTL) R/W 0x0007 CRG RTI Control Register (RTICTL) R/W 0x0008 CRG COP Control Register (COPCTL) R/W 0x0009 CRG Force and Bypass Test Register (FORBYP)(2) R/W 0x000A CRG Test Control Register (CTCTL)(3) R/W 0x000B CRG COP Arm/Timer Reset (ARMCOP) R/W 1. CTFLG is intended for factory test purposes only. 2. FORBYP is intended for factory test purposes only. 3. CTCTL is intended for factory test purposes only. 254 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description NOTE Registeraddress=baseaddress+addressoffset,wherethebaseaddressis defined at the MCU level and the address offset is defined at the module level. 9.3.2 Register Descriptions This section describes in address order all the CRGV4 registers and their individual bits. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R 0 0 SYN5 SYN4 SYN3 SYN2 SYN1 SYN0 SYNR W 0x0001 R 0 0 0 0 REFDV3 REFDV2 REFDV1 REFDV0 REFDV W 0x0002 R 0 0 0 0 0 0 0 0 CTFLG W 0x0003 R LOCK TRACK SCM RTIF PORF LVRF LOCKIF SCMIF CRGFLG W 0x0004 R 0 0 0 0 0 RTIE LOCKIE SCMIE CRGINT W 0x0005 R PLLSEL PSTP SYSWAI ROAWAI PLLWAI CWAI RTIWAI COPWAI CLKSEL W 0x0006 R 0 CME PLLON AUTO ACQ PRE PCE SCME PLLCTL W 0x0007 R 0 RTR6 RTR5 RTR4 RTR3 RTR2 RTR1 RTR0 RTICTL W 0x0008 R 0 0 0 WCOP RSBCK CR2 CR1 CR0 COPCTL W 0x0009 R 0 0 0 0 0 0 0 0 FORBYP W 0x000A R 0 0 0 0 0 0 0 0 CTCTL W = Unimplemented or Reserved Figure9-3. CRG Register Summary Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 255 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x000B R 0 0 0 0 0 0 0 0 ARMCOP W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 = Unimplemented or Reserved Figure9-3. CRG Register Summary (continued) 9.3.2.1 CRG Synthesizer Register (SYNR) The SYNR register controls the multiplication factor of the PLL. If the PLL is on, the count in the loop divider(SYNR)registereffectivelymultipliesupthePLLclock(PLLCLK)fromthereferencefrequency by 2 x (SYNR+1). PLLCLK will not be below the minimum VCO frequency (f ). SCM (SYNR+1) PLLCLK = 2xOSCCLKx---------------------------------- (REFDV+1) NOTE If PLL is selected (PLLSEL=1), Bus Clock = PLLCLK / 2 Bus Clock must not exceed the maximum operating system frequency. Module Base + 0x0000 7 6 5 4 3 2 1 0 R 0 0 SYN5 SYNR SYN3 SYN2 SYN1 SYN0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-4. CRG Synthesizer Register (SYNR) Read: anytime Write: anytime except if PLLSEL = 1 NOTE Write to this register initializes the lock detector bit and the track detector bit. 256 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.3.2.2 CRG Reference Divider Register (REFDV) The REFDV register provides a finer granularity for the PLL multiplier steps. The count in the reference divider divides OSCCLK frequency by REFDV + 1. Module Base + 0x0001 7 6 5 4 3 2 1 0 R 0 0 0 0 REFDV3 REFDV2 REFDV1 REFDV0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-5. CRG Reference Divider Register (REFDV) Read: anytime Write: anytime except when PLLSEL = 1 NOTE Write to this register initializes the lock detector bit and the track detector bit. 9.3.2.3 Reserved Register (CTFLG) This register is reserved for factory testing of the CRGV4 module and is not available in normal modes. Module Base + 0x0002 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-6. CRG Reserved Register (CTFLG) Read: always reads 0x0000 in normal modes Write: unimplemented in normal modes NOTE Writing to this register when in special mode can alter the CRGV4 functionality. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 257 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.3.2.4 CRG Flags Register (CRGFLG) This register provides CRG status bits and flags. Module Base + 0x0003 7 6 5 4 3 2 1 0 R LOCK TRACK SCM RTIF PORF LVRF LOCKIF SCMIF W Reset 0 Note 1 Note 2 0 0 0 0 0 1. PORF is set to 1 when a power-on reset occurs. Unaffected by system reset. 2. LVRF is set to 1 when a low-voltage reset occurs. Unaffected by system reset. = Unimplemented or Reserved Figure9-7. CRG Flag Register (CRGFLG) Read: anytime Write: refer to each bit for individual write conditions Table9-2. CRGFLG Field Descriptions Field Description 7 Real-TimeInterruptFlag—RTIFissetto1attheendoftheRTIperiod.Thisflagcanonlybeclearedbywriting RTIF a 1. Writing a 0 has no effect. If enabled (RTIE = 1), RTIF causes an interrupt request. 0 RTI time-out has not yet occurred. 1 RTI time-out has occurred. 6 Power-onResetFlag—PORFissetto1whenapower-onresetoccurs.Thisflagcanonlybeclearedbywriting PORF a 1. Writing a 0 has no effect. 0 Power-on reset has not occurred. 1 Power-on reset has occurred. 5 Low-VoltageResetFlag—Iflowvoltageresetfeatureisnotavailable(seethedeviceoverviewchapter),LVRF LVRF always reads0. LVRF is set to 1 when a low voltage reset occurs. This flag can only be cleared by writing a 1. Writing a 0 has no effect. 0 Low voltage reset has not occurred. 1 Low voltage reset has occurred. 4 PLLLockInterruptFlag—LOCKIFissetto1whenLOCKstatusbitchanges.Thisflagcanonlybeclearedby LOCKIF writing a1. Writing a 0 has no effect.If enabled (LOCKIE = 1), LOCKIF causes an interrupt request. 0 No change in LOCK bit. 1 LOCK bit has changed. 3 LockStatusBit—LOCKreflectsthecurrentstateofPLLlockcondition.Thisbitisclearedinself-clockmode. LOCK Writes have no effect. 0 PLL VCO is not within the desired tolerance of the target frequency. 1 PLL VCO is within the desired tolerance of the target frequency. 2 TrackStatusBit—TRACKreflectsthecurrentstateofPLLtrackcondition.Thisbitisclearedinself-clockmode. TRACK Writes have no effect. 0 Acquisition mode status. 1 Tracking mode status. 258 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-2. CRGFLG Field Descriptions (continued) Field Description 1 Self-Clock Mode Interrupt Flag — SCMIF is set to 1 when SCM status bit changes. This flag can only be SCMIF cleared by writing a 1. Writing a 0 has no effect. If enabled (SCMIE=1), SCMIF causes an interrupt request. 0 No change in SCM bit. 1 SCM bit has changed. 0 Self-Clock Mode Status Bit — SCM reflects the current clocking mode. Writes have no effect. SCM 0 MCU is operating normally with OSCCLK available. 1 MCUisoperatinginself-clockmodewithOSCCLKinanunknownstate.AllclocksarederivedfromPLLCLK running at its minimum frequency f . SCM 9.3.2.5 CRG Interrupt Enable Register (CRGINT) This register enables CRG interrupt requests. Module Base + 0x0004 7 6 5 4 3 2 1 0 R 0 0 0 0 0 RTIE LOCKIE SCMIE W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-8. CRG Interrupt Enable Register (CRGINT) Read: anytime Write: anytime Table9-3. CRGINT Field Descriptions Field Description 7 Real-Time Interrupt Enable Bit RTIE 0 Interrupt requests from RTI are disabled. 1 Interrupt will be requested whenever RTIF is set. 4 Lock Interrupt Enable Bit LOCKIE 0 LOCK interrupt requests are disabled. 1 Interrupt will be requested whenever LOCKIF is set. 1 Self-Clock Mode Interrupt Enable Bit SCMIE 0 SCM interrupt requests are disabled. 1 Interrupt will be requested whenever SCMIF is set. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 259 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.3.2.6 CRG Clock Select Register (CLKSEL) This register controls CRG clock selection. Refer to Figure9-17 for details on the effect of each bit. Module Base + 0x0005 7 6 5 4 3 2 1 0 R PLLSEL PSTP SYSWAI ROAWAI PLLWAI CWAI RTIWAI COPWAI W Reset 0 0 0 0 0 0 0 0 Figure9-9. CRG Clock Select Register (CLKSEL) Read: anytime Write: refer to each bit for individual write conditions Table9-4. CLKSEL Field Descriptions Field Description 7 PLLSelectBit—Writeanytime.Writinga1whenLOCK=0andAUTO=1,orTRACK=0andAUTO=0has PLLSEL noeffect.ThispreventstheselectionofanunstablePLLCLKasSYSCLK.PLLSELbitisclearedwhentheMCU enters self-clock mode, stop mode or wait mode with PLLWAI bit set. 0 System clocks are derived from OSCCLK (Bus Clock = OSCCLK / 2). 1 System clocks are derived from PLLCLK (Bus Clock = PLLCLK / 2). 6 Pseudo-Stop Bit — Write: anytime — This bit controls the functionality of the oscillator during stop mode. PSTP 0 Oscillator is disabled in stop mode. 1 Oscillatorcontinuestoruninstopmode(pseudo-stop).Theoscillatoramplitudeisreduced.Refertooscillator block description for availability of a reduced oscillator amplitude. Note:Pseudo-stopallowsforfasterstoprecoveryandreducesthemechanicalstressandagingoftheresonator in case of frequent stop conditions at the expense of a slightly increased power consumption. Note:Lower oscillator amplitude exhibits lower power consumption but could have adverse effects during any electro-magnetic susceptibility (EMS) tests. 5 System Clocks Stop in Wait Mode Bit— Write: anytime SYSWAI 0 In wait mode, the system clocks continue to run. 1 In wait mode, the system clocks stop. Note:RTI and COP are not affected by SYSWAI bit. 4 Reduced Oscillator Amplitude in Wait Mode Bit— Write: anytime — Refer to oscillator block description ROAWAI chapter for availability of a reduced oscillator amplitude. If no such feature exists in the oscillator block then setting this bit to 1 will not have any effect on power consumption. 0 Normal oscillator amplitude in wait mode. 1 Reduced oscillator amplitude in wait mode. Note:Lower oscillator amplitude exhibits lower power consumption but could have adverse effects during any electro-magnetic susceptibility (EMS) tests. 3 PLLStopsinWaitModeBit—Write:anytime—IfPLLWAIisset,theCRGV4willclearthePLLSELbitbefore PLLWAI entering wait mode. The PLLON bit remains set during wait mode but the PLL is powered down. Upon exiting wait mode, the PLLSEL bit has to be set manually if PLL clock is required. WhilethePLLWAIbitissettheAUTObitissetto1inordertoallowthePLLtoautomaticallylockontheselected target frequency after exiting wait mode. 0 PLL keeps running in wait mode. 1 PLL stops in wait mode. 260 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-4. CLKSEL Field Descriptions (continued) Field Description 2 Core Stops in Wait Mode Bit— Write: anytime CWAI 0 Core clock keeps running in wait mode. 1 Core clock stops in wait mode. 1 RTI Stops in Wait Mode Bit— Write: anytime RTIWAI 0 RTI keeps running in wait mode. 1 RTI stops and initializes the RTI dividers whenever the part goes into wait mode. 0 COP Stops in Wait Mode Bit— Normal modes: Write once —Special modes: Write anytime COPWAI 0 COP keeps running in wait mode. 1 COP stops and initializes the COP dividers whenever the part goes into wait mode. 9.3.2.7 CRG PLL Control Register (PLLCTL) This register controls the PLL functionality. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 CME PLLON AUTO ACQ PRE PCE SCME W Reset 1 1 1 1 0 0 0 1 = Unimplemented or Reserved Figure9-10. CRG PLL Control Register (PLLCTL) Read: anytime Write: refer to each bit for individual write conditions Table9-5. PLLCTL Field Descriptions Field Description 7 Clock Monitor Enable Bit — CME enables the clock monitor. Write anytime except when SCM = 1. CME 0 Clock monitor is disabled. 1 Clock monitor is enabled. Slow or stopped clocks will cause a clock monitor reset sequence or self-clock mode. Note:Operating with CME = 0 will not detect any loss of clock. In case of poor clock quality this could cause unpredictable operation of the MCU. Note:InStopMode(PSTP=0)theclockmonitorisdisabledindependentlyoftheCMEbitsettingandanyloss of clock will not be detected. 6 PhaseLockLoopOnBit—PLLONturnsonthePLLcircuitry.Inself-clockmode,thePLListurnedon,butthe PLLON PLLON bit reads the last latched value. Write anytime except when PLLSEL = 1. 0 PLL is turned off. 1 PLL is turned on. If AUTO bit is set, the PLL will lock automatically. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 261 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-5. PLLCTL Field Descriptions (continued) Field Description 5 Automatic Bandwidth Control Bit — AUTO selects either the high bandwidth (acquisition) mode or the low AUTO bandwidth(tracking)modedependingonhowclosetothedesiredfrequencytheVCOisrunning.Writeanytime except when PLLWAI=1, because PLLWAI sets the AUTO bit to 1. 0 Automatic mode control is disabled and the PLL is under software control, using ACQ bit. 1 Automatic mode control is enabled and ACQ bit has no effect. 4 Acquisition Bit — Write anytime. If AUTO=1 this bit has no effect. ACQ 0 Low bandwidth filter is selected. 1 High bandwidth filter is selected. 2 RTI Enable during Pseudo-Stop Bit — PRE enables the RTI during pseudo-stop mode. Write anytime. PRE 0 RTI stops running during pseudo-stop mode. 1 RTI continues running during pseudo-stop mode. Note:IfthePREbitisclearedtheRTIdividerswillgostaticwhilepseudo-stopmodeisactive.TheRTIdividers willnot initialize like in wait mode with RTIWAI bit set. 1 COP Enable during Pseudo-Stop Bit — PCE enables the COP during pseudo-stop mode. Write anytime. PCE 0 COP stops running during pseudo-stop mode 1 COP continues running during pseudo-stop mode Note:IfthePCEbitisclearedtheCOPdividerswillgostaticwhilepseudo-stopmodeisactive.TheCOPdividers willnot initialize like in wait mode with COPWAI bit set. 0 Self-ClockModeEnableBit—Normalmodes:Writeonce—Specialmodes:Writeanytime—SCMEcannot SCME be cleared while operating in self-clock mode (SCM=1). 0 Detection of crystal clock failure causes clock monitor reset (seeSection9.5.1, “Clock Monitor Reset”). 1 DetectionofcrystalclockfailureforcestheMCUinself-clockmode(seeSection9.4.7.2,“Self-ClockMode”). 9.3.2.8 CRG RTI Control Register (RTICTL) This register selects the timeout period for the real-time interrupt. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 RTR6 RTR5 RTR4 RTR3 RTR2 RTR1 RTR0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-11. CRG RTI Control Register (RTICTL) Read: anytime Write: anytime NOTE A write to this register initializes the RTI counter. 262 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-6. RTICTL Field Descriptions Field Description 6:4 Real-TimeInterruptPrescaleRateSelectBits—ThesebitsselecttheprescaleratefortheRTI.SeeTable9-7. RTR[6:4] 3:0 Real-Time Interrupt Modulus Counter Select Bits — These bits select the modulus counter target value to RTR[3:0] provideadditionalgranularity.Table9-7showsallpossibledividevaluesselectablebytheRTICTLregister.The source clock for the RTI is OSCCLK. Table9-7. RTI Frequency Divide Rates RTR[6:4] = RTR[3:0] 000 001 010 011 100 101 110 111 (OFF) (210) (211) (212) (213) (214) (215) (216) 0000 (÷1) OFF* 210 211 212 213 214 215 216 0001 (÷2) OFF* 2x210 2x211 2x212 2x213 2x214 2x215 2x216 0010 (÷3) OFF* 3x210 3x211 3x212 3x213 3x214 3x215 3x216 0011 (÷4) OFF* 4x210 4x211 4x212 4x213 4x214 4x215 4x216 0100 (÷5) OFF* 5x210 5x211 5x212 5x213 5x214 5x215 5x216 0101 (÷6) OFF* 6x210 6x211 6x212 6x213 6x214 6x215 6x216 0110 (÷7) OFF* 7x210 7x211 7x212 7x213 7x214 7x215 7x216 0111 (÷8) OFF* 8x210 8x211 8x212 8x213 8x214 8x215 8x216 1000 (÷9) OFF* 9x210 9x211 9x212 9x213 9x214 9x215 9x216 1001 (÷10) OFF* 10x210 10x211 10x212 10x213 10x214 10x215 10x216 1010 (÷11) OFF* 11x210 11x211 11x212 11x213 11x214 11x215 11x216 1011 (÷12) OFF* 12x210 12x211 12x212 12x213 12x214 12x215 12x216 1100 (÷13) OFF* 13x210 13x211 13x212 13x213 13x214 13x215 13x216 1101 (÷14) OFF* 14x210 14x211 14x212 14x213 14x214 14x215 14x216 1110 (÷15) OFF* 15x210 15x211 15x212 15x213 15x214 15x215 15x216 1111 (÷16) OFF* 16x210 16x211 16x212 16x213 16x214 16x215 16x216 *Denotesthedefaultvalueoutofreset.ThisvalueshouldbeusedtodisabletheRTItoensurefuturebackwardscompatibility. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 263 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.3.2.9 CRG COP Control Register (COPCTL) This register controls the COP (computer operating properly) watchdog. Module Base + 0x0008 7 6 5 4 3 2 1 0 R 0 0 0 WCOP RSBCK CR2 CR1 CR0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-12. CRG COP Control Register (COPCTL) Read: anytime Write: WCOP, CR2, CR1, CR0: once in user mode, anytime in special mode Write: RSBCK: once Table9-8. COPCTL Field Descriptions Field Description 7 WindowCOPModeBit—Whenset,awritetotheARMCOPregistermustoccurinthelast25%oftheselected WCOP period. A write during the first 75% of the selected period will reset the part. As long as all writes occur during thiswindow,0x0055canbewrittenasoftenasdesired.Assoonas0x00AAiswrittenafterthe0x0055,thetime- out logic restarts and the user must wait until the next window before writing to ARMCOP.Table9-9 shows the exact duration of this window for the seven available COP rates. 0 Normal COP operation 1 Window COP operation 6 COP and RTI Stop in Active BDM Mode Bit RSBCK 0 Allows the COP and RTI to keep running in active BDM mode. 1 Stops the COP and RTI counters whenever the part is in active BDM mode. 2:0 COPWatchdogTimerRateSelect—ThesebitsselecttheCOPtime-outrate(seeTable9-9).TheCOPtime- CR[2:0] out period is OSCCLK period divided by CR[2:0] value. Writing a nonzero value to CR[2:0] enables the COP counterandstartsthetime-outperiod.ACOPcountertime-outcausesasystemreset.Thiscanbeavoidedby periodically (before time-out) reinitializing the COP counter via the ARMCOP register. Table9-9. COP Watchdog Rates(1) OSCCLK CR2 CR1 CR0 Cycles to Time Out 0 0 0 COP disabled 0 0 1 214 0 1 0 216 0 1 1 218 1 0 0 220 1 0 1 222 1 1 0 223 1 1 1 224 1.OSCCLKcyclesarereferencedfromthepreviousCOPtime-outreset (writing 0x0055/0x00AA to the ARMCOP register) 264 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.3.2.10 Reserved Register (FORBYP) NOTE This reserved register is designed for factory test purposes only, and is not intended for general user access. Writing to this register when in special modes can alter the CRG’s functionality. Module Base + 0x0009 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-13. Reserved Register (FORBYP) Read: always read 0x0000 except in special modes Write: only in special modes 9.3.2.11 Reserved Register (CTCTL) NOTE This reserved register is designed for factory test purposes only, and is not intendedforgeneraluseraccess.Writingtothisregisterwheninspecialtest modes can alter the CRG’s functionality. Module Base + 0x000A 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure9-14. Reserved Register (CTCTL) Read: always read 0x0080 except in special modes Write: only in special modes Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 265 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.3.2.12 CRG COP Timer Arm/Reset Register (ARMCOP) This register is used to restart the COP time-out period. Module Base + 0x000B 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Reset 0 0 0 0 0 0 0 0 Figure9-15. ARMCOP Register Diagram Read: always reads 0x0000 Write: anytime When the COP is disabled (CR[2:0] = “000”) writing to this register has no effect. When the COP is enabled by setting CR[2:0] nonzero, the following applies: Writinganyvalueotherthan0x0055or0x00AAcausesaCOPreset.TorestarttheCOPtime-out periodyoumustwrite0x0055followedbyawriteof0x00AA.Otherinstructionsmaybeexecuted betweenthesewritesbutthesequence(0x0055,0x00AA)mustbecompletedpriortoCOPendof time-outperiodtoavoidaCOPreset.Sequencesof0x0055writesorsequencesof0x00AAwrites areallowed.WhentheWCOPbitisset,0x0055and0x00AAwritesmustbedoneinthelast25% oftheselectedtime-outperiod;writinganyvalueinthefirst75%oftheselectedperiodwillcause a COP reset. 9.4 Functional Description This section gives detailed informations on the internal operation of the design. 9.4.1 Phase Locked Loop (PLL) The PLL is used to run the MCU from a different time base than the incoming OSCCLK. For increased flexibility,OSCCLKcanbedividedinarangeof1to16togeneratethereferencefrequency.Thisoffers a finer multiplication granularity. The PLL can multiply this reference clock by a multiple of 2, 4, 6,... 126,128 based on the SYNR register. [SYNR+1] PLLCLK = 2×OSCCLK×---------------------------------- [REFDV+1] CAUTION Althoughitispossibletosetthetwodividerstocommandaveryhighclock frequency, do not exceed the specified bus frequency limit for the MCU. If (PLLSEL = 1), Bus Clock = PLLCLK / 2 266 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description ThePLLisafrequencygeneratorthatoperatesineitheracquisitionmodeortrackingmode,dependingon the difference between the output frequency and the target frequency. The PLL can change between acquisition and tracking modes either automatically or manually. TheVCOhasaminimumoperatingfrequency,whichcorrespondstotheself-clockmodefrequencyf . SCM REFERENCE LOCK LOCK REFDV <3:0> EXTAL FEEDBACK DETECTOR REDUCED CONSUMPTION OSCCLK REFERENCE OSCILLATOR PROGRAMMABLE VDDPLL/VSSPLL DIVIDER UP PDET XTAL PHASE DOWN CPUMP VCO DETECTOR CRYSTAL VDDPLL MONITOR LOOP PROGRAMMABLE DIVIDER LOOP FILTER supplied by: XFC SYN <5:0> PIN VDDPLL/VSSPLL PLLCLK VDD/VSS Figure9-16. PLL Functional Diagram 9.4.1.1 PLL Operation The oscillator output clock signal (OSCCLK) is fed through the reference programmable divider and is dividedinarangeof1to16(REFDV+1)tooutputthereferenceclock.TheVCOoutputclock,(PLLCLK) is fed back through the programmable loop divider and is divided in a range of 2 to 128 in increments of [2 x (SYNR +1)] to output the feedback clock. See Figure9-16. The phase detector then compares the feedback clock, with the reference clock. Correction pulses are generatedbasedonthephasedifferencebetweenthetwosignals.TheloopfilterthenslightlyalterstheDC voltage on the external filter capacitor connected to XFC pin, based on the width and direction of the correction pulse. The filter can make fast or slow corrections depending on its mode, as described in the nextsubsection.Thevaluesoftheexternalfilternetworkandthereferencefrequencydeterminethespeed of the corrections and the stability of the PLL. 9.4.1.2 Acquisition and Tracking Modes Thelockdetectorcomparesthefrequenciesofthefeedbackclock,andthereferenceclock.Therefore,the speedofthelockdetectorisdirectlyproportionaltothefinalreferencefrequency.Thecircuitdetermines the mode of the PLL and the lock condition based on this comparison. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 267 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description The PLL filter can be manually or automatically configured into one of two possible operating modes: • Acquisition mode Inacquisitionmode,thefiltercanmakelargefrequencycorrectionstotheVCO.Thismodeisused at PLL start-up or when the PLL has suffered a severe noise hit and the VCO frequency is far off thedesiredfrequency.Wheninacquisitionmode,theTRACKstatusbitisclearedintheCRGFLG register. • Tracking mode In tracking mode, the filter makes only small corrections to the frequency of the VCO. PLL jitter ismuchlowerintrackingmode,buttheresponsetonoiseisalsoslower.ThePLLenterstracking modewhentheVCOfrequencyisnearlycorrectandtheTRACKbitissetintheCRGFLGregister. The PLL can change the bandwidth or operational mode of the loop filter manually or automatically. In automatic bandwidth control mode (AUTO = 1), the lock detector automatically switches between acquisition and tracking modes. Automatic bandwidth control mode also is used to determine when the PLLclock(PLLCLK)issafetouseasthesourceforthesystemandcoreclocks.IfPLLLOCKinterrupt requestsareenabled,thesoftwarecanwaitforaninterruptrequestandthenchecktheLOCKbit.IfCPU interrupts are disabled, software can poll the LOCK bit continuously (during PLL start-up, usually) or at periodic intervals. In either case, only when the LOCK bit is set, is the PLLCLK clock safe to use as the sourceforthesystemandcoreclocks.IfthePLLisselectedasthesourceforthesystemandcoreclocks andtheLOCKbitisclear,thePLLhassufferedaseverenoisehitandthesoftwaremusttakeappropriate action, depending on the application. The following conditions apply when the PLL is in automatic bandwidth control mode (AUTO = 1): • The TRACK bit is a read-only indicator of the mode of the filter. • TheTRACKbitissetwhentheVCOfrequencyiswithinacertaintolerance,∆ ,andisclearwhen trk the VCO frequency is out of a certain tolerance, ∆ . unt • The LOCK bit is a read-only indicator of the locked state of the PLL. • The LOCK bit is set when the VCO frequency is within a certain tolerance, ∆ , and is cleared Lock when the VCO frequency is out of a certain tolerance, ∆ . unl • CPUinterruptscanoccurifenabled(LOCKIE=1)whenthelockconditionchanges,togglingthe LOCK bit. The PLL can also operate in manual mode (AUTO = 0). Manual mode is used by systems that do not requireanindicatorofthelockconditionforproperoperation.Suchsystemstypicallyoperatewellbelow the maximum system frequency (f )and require fast start-up. The following conditions apply when in sys manual mode: • ACQ is a writable control bit that controls the mode of the filter. Before turning on the PLL in manual mode, the ACQ bit should be asserted to configure the filter in acquisition mode. • After turning on the PLL by setting the PLLON bit software must wait a given time (t ) before acq entering tracking mode (ACQ = 0). • After entering tracking mode software must wait a given time (t ) before selecting the PLLCLK al as the source for system and core clocks (PLLSEL = 1). 268 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.4.2 System Clocks Generator PLLSEL or SCM WAIT(CWAI,SYSWAI), STOP PHASE PLLCLK 1 SYSCLK LOCK Core Clock LOOP 0 WAIT(SYSWAI), STOP ÷2 CLOCK PHASE Bus Clock SCM GENERATOR WAIT(RTIWAI), STOP(PSTP,PRE), EXTAL RTI enable 1 RTI OSCCLK OSCILLATOR 0 WAIT(COPWAI), STOP(PSTP,PCE), XTAL COP enable COP Clock Monitor WAIT(SYSWAI), STOP Oscillator Clock STOP(PSTP) Gating Oscillator Condition Clock (running during = Clock Gate Pseudo-Stop Mode Figure9-17. System Clocks Generator TheclockgeneratorcreatestheclocksusedintheMCU(seeFigure9-17).Thegatingconditionplacedon topoftheindividualclockgatesindicatesthedependenciesofdifferentmodes(stop,wait)andthesetting of the respective configuration bits. The peripheral modules use the bus clock. Some peripheral modules also use the oscillator clock. The memory blocks use the bus clock. If the MCU enters self-clock mode (see Section9.4.7.2, “Self-Clock Mode”),oscillatorclocksourceisswitchedtoPLLCLKrunningatitsminimumfrequencyf .Thebus SCM clockisusedtogeneratetheclockvisibleattheECLKpin.ThecoreclocksignalistheclockfortheCPU. The core clock is twice the bus clock as shown in Figure9-18. But note that a CPU cycle corresponds to one bus clock. PLL clock mode is selected with PLLSEL bit in the CLKSEL register. When selected, the PLL output clockdrivesSYSCLKforthemainsystemincludingtheCPUandperipherals.ThePLLcannotbeturned offbyclearingthePLLONbit,ifthePLLclockisselected.WhenPLLSELischanged,ittakesamaximum Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 269 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description of 4 OSCCLK plus 4 PLLCLK cycles to make the transition. During the transition, all clocks freeze and CPU activity ceases. CORE CLOCK: BUS CLOCK / ECLK Figure9-18. Core Clock and Bus Clock Relationship 9.4.3 Clock Monitor (CM) If no OSCCLK edges are detected within a certain time, the clock monitor within the oscillator block generatesaclockmonitorfailevent.TheCRGV4thenassertsself-clockmodeorgeneratesasystemreset dependingonthestateofSCMEbit.Iftheclockmonitorisdisabledorthepresenceofclocksisdetected nofailureisindicatedbytheoscillatorblock.Theclockmonitorfunctionisenabled/disabledbytheCME control bit. 9.4.4 Clock Quality Checker The clock monitor performs a coarse check on the incoming clock signal. The clock quality checker provides a more accurate check in addition to the clock monitor. A clock quality check is triggered by any of the following events: • Power-on reset (POR) • Low voltage reset (LVR) • Wake-up from full stop mode (exit full stop) • Clock monitor fail indication (CM fail) A time window of 50000 VCO clock cycles1 is calledcheck window. Anumbergreaterequalthan4096risingOSCCLKedgeswithinacheckwindowiscalledoscok.Notethat osc ok immediately terminates the currentcheck window. See Figure9-19 as an example. check window 1 2 3 49999 50000 VCO clock 1 2 3 4 5 4096 OSCCLK 4095 osc ok Figure9-19. Check Window Example 1. VCO clock cycles are generated by the PLL when running at minimum frequency f . SCM 270 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description The sequence for clock quality check is shown in Figure9-20. CM fail Clock OK POR LVR exit full stop Clock Monitor Reset Enter SCM num=50 no num=0 yes SCM active? check window num=num+1 yes yes no no no osc ok num<50 SCME=1 ? ? ? yes SCM yes Switch to OSCCLK active? no Exit SCM Figure9-20. Sequence for Clock Quality Check NOTE Rememberthatinparalleltoadditionalactionscausedbyself-clockmode or clock monitor reset1 handling the clock quality checker continues to check the OSCCLK signal. NOTE The clock quality checker enables the PLL and the voltage regulator (VREG) anytime a clock check has to be performed. An ongoing clock quality check could also cause a running PLL (f ) and an active VREG SCM during pseudo-stop mode or wait mode 1. A Clock Monitor Reset will always set the SCME bit to logical’1’ Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 271 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.4.5 Computer Operating Properly Watchdog (COP) WAIT(COPWAI), CR[2:0] STOP(PSTP,PCE), COP enable 0:0:0 CR[2:0] 0:0:1 OSCCLK ÷ 16384 ÷ 4 0:1:0 ÷ 4 0:1:1 ÷ 4 1:0:0 ÷ 4 1:0:1 ÷ 2 1:1:0 gating condition = Clock Gate ÷ 2 1:1:1 COP TIMEOUT Figure9-21. Clock Chain for COP The COP (free running watchdog timer) enables the user to check that a program is running and sequencing properly. The COP is disabled out of reset. When the COP is being used, software is responsibleforkeepingtheCOPfromtimingout.IftheCOPtimesoutitisanindicationthatthesoftware is no longer being executed in the intended sequence; thus a system reset is initiated (seeSection9.5.2, “Computer Operating Properly Watchdog (COP) Reset).” The COP runs with a gated OSCCLK (see SectionFigure9-21.,“ClockChainforCOP”).ThreecontrolbitsintheCOPCTLregisterallowselection of seven COP time-out periods. When COP is enabled, the program must write 0x0055 and 0x00AA (in this order) to the ARMCOP registerduringtheselectedtime-outperiod.Assoonasthisisdone,theCOPtime-outperiodisrestarted. If the program fails to do this and the COP times out, the part will reset. Also, if any value other than 0x0055 or 0x00AA is written, the part is immediately reset. Windowed COP operation is enabled by setting WCOP in the COPCTL register. In this mode, writes to theARMCOPregistertocleartheCOPtimermustoccurinthelast25%oftheselectedtime-outperiod. A premature write will immediately reset the part. If PCE bit is set, the COP will continue to run in pseudo-stop mode. 9.4.6 Real-Time Interrupt (RTI) The RTI can be used to generate a hardware interrupt at a fixed periodic rate. If enabled (by setting RTIE=1), this interrupt will occur at the rate selected by the RTICTL register. The RTI runs with a gated OSCCLK (seeSectionFigure9-22., “Clock Chain for RTI”). At the end of the RTI time-out period the RTIF flag is set to 1 and a new RTI time-out period starts immediately. A write to the RTICTL register restarts the RTI time-out period. 272 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description If the PRE bit is set, the RTI will continue to run in pseudo-stop mode. . WAIT(RTIWAI), STOP(PSTP,PRE), RTI enable ÷ OSCCLK 1024 RTR[6:4] 0:0:0 0:0:1 ÷ 2 0:1:0 ÷ 2 0:1:1 ÷ 2 1:0:0 ÷ 2 1:0:1 ÷ 2 1:1:0 gating condition ÷ = Clock Gate 2 1:1:1 RTI TIMEOUT 4-BIT MODULUS COUNTER (RTR[3:0]) Figure9-22. Clock Chain for RTI 9.4.7 Modes of Operation 9.4.7.1 Normal Mode The CRGV4 block behaves as described within this specification in all normal modes. 9.4.7.2 Self-Clock Mode The VCO has a minimum operating frequency, f . If the external clock frequency is not available due SCM toafailureorduetolongcrystalstart-uptime,thebusclockandthecoreclockarederivedfromtheVCO runningatminimumoperatingfrequency;thismodeofoperationiscalledself-clockmode.Thisrequires CME=1andSCME=1.IftheMCUwasclockedbythePLLclockpriortoenteringself-clockmode,the PLLSELbitwillbe cleared.Iftheexternalclocksignalhasstabilizedagain,theCRGwillautomatically select OSCCLK to be the system clock and return to normal mode. See Section9.4.4, “Clock Quality Checker” for more information on entering and leaving self-clock mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 273 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description NOTE In order to detect a potential clock loss, the CME bit should be always enabled (CME=1). If CME bit is disabled and the MCU is configured to run on PLL clock (PLLCLK),alossofexternalclock(OSCCLK)willnotbedetectedandwill cause the system clock to drift towards the VCO’s minimum frequency f . As soon as the external clock is available again the system clock SCM ramps up to its PLL target frequency. If the MCU is running on external clock any loss of clock will cause the system to go static. 9.4.8 Low-Power Operation in Run Mode The RTI can be stopped by setting the associated rate select bits to 0. The COP can be stopped by setting the associated rate select bits to 0. 9.4.9 Low-Power Operation in Wait Mode The WAI instruction puts the MCU in a low power consumption stand-by mode depending on setting of theindividualbitsintheCLKSELregister.Allindividualwaitmodeconfigurationbitscanbesuperposed. Thisprovidesenhancedgranularityinreducingthelevelofpowerconsumptionduringwaitmode.Table9- 10 lists the individual configuration bits and the parts of the MCU that are affected in wait mode. Table9-10. MCU Configuration During Wait Mode PLLWAI CWAI SYSWAI RTIWAI COPWAI ROAWAI PLL stopped — — — — — Core — stopped stopped — — — System — — stopped — — — RTI — — — stopped — — COP — — — — stopped — Oscillator — — — — — reduced(1) 1. Refer to oscillator block description for availability of a reduced oscillator amplitude. AfterexecutingtheWAIinstructionthecorerequeststheCRGtoswitchMCUintowaitmode.TheCRG thencheckswhetherthePLLWAI,CWAIandSYSWAIbitsareasserted(seeFigure9-23).Dependingon theconfigurationtheCRGswitchesthesystemandcoreclockstoOSCCLKbyclearingthePLLSELbit, disablesthePLL,disablesthecoreclocksandfinallydisablestheremainingsystemclocks.Assoonasall clocks are switched off wait mode is active. 274 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Core req’s Wait Mode. no PLLWAI=1 ? yes Clear CWAI or no PLLSEL, SYSWAI=1 Disable PLL ? yes Disable SYSWAI=1 no core clocks ? yes no Disable Enter CME=1 no INT system clocks Wait Mode ? ? Wait Mode left due to external yes yes reset Exit Wait w. CM fail no ext.RESET ? yes Exit Wait w. no SCME=1 CMRESET ? yes Exit no Wait Mode SCMIE=1 ? Generate yes SCM Interrupt SCM=1 no (Wakeup from Wait) Exit ? Wait Mode yes Enter Enter SCM SCM Continue w. normal OP Figure9-23. Wait Mode Entry/Exit Sequence Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 275 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description There are five different scenarios for the CRG to restart the MCU from wait mode: • External reset • Clock monitor reset • COP reset • Self-clock mode interrupt • Real-time interrupt (RTI) If the MCU gets an external reset during wait mode active, the CRG asynchronously restores all configurationbitsintheregisterspacetoitsdefaultsettingsandstartstheresetgenerator.Aftercompleting theresetsequenceprocessingbeginsbyfetchingthenormalresetvector.WaitmodeisexitedandtheMCU is in run mode again. If the clock monitor is enabled (CME=1) the MCU is able to leave wait mode when loss of oscillator/external clock is detected by a clock monitor fail. If the SCME bit is not asserted the CRG generates a clock monitor fail reset (CMRESET). The CRG’s behavior for CMRESET is the same comparedtoexternalreset,butanotherresetvectorisfetchedaftercompletionoftheresetsequence.Ifthe SCME bit is asserted the CRG generates a SCM interrupt if enabled (SCMIE=1). After generating the interrupt the CRG enters self-clock mode and starts the clock quality checker (see Section9.4.4, “Clock Quality Checker”). Then the MCU continues with normal operation.If the SCM interrupt is blocked by SCMIE= 0,theSCMIFflagwillbeassertedandclockqualitycheckswillbeperformedbuttheMCUwill not wake-up from wait mode. Ifanyotherinterruptsource(e.g.RTI)triggersexitfromwaitmodetheMCUimmediatelycontinueswith normaloperation.IfthePLLhasbeenpowered-downduringwaitmodethePLLSELbitisclearedandthe MCUrunsonOSCCLKafterleavingwaitmode.ThesoftwaremustmanuallysetthePLLSELbitagain, in order to switch system and core clocks to the PLLCLK. Ifwaitmodeisenteredfromself-clockmode,theCRGwillcontinuetochecktheclockqualityuntilclock check is successful. The PLL and voltage regulator (VREG) will remain enabled. Table9-11 summarizes the outcome of a clock loss while in wait mode. 276 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-11. Outcome of Clock Loss in Wait Mode CME SCME SCMIE CRG Actions 0 X X Clock failure --> No action, clock loss not detected. 1 0 X Clock failure --> CRG performs Clock Monitor Reset immediately 1 1 0 Clock failure --> Scenario 1: OSCCLKrecovers prior to exiting Wait Mode. – MCU remains in Wait Mode, – VREG enabled, – PLL enabled, – SCM activated, – Start Clock Quality Check, – Set SCMIF interrupt flag. Some time later OSCCLK recovers. – CM no longer indicates a failure, – 4096 OSCCLK cycles later Clock Quality Check indicates clock o.k., – SCM deactivated, – PLL disabled depending on PLLWAI, – VREG remains enabled (never gets disabled in Wait Mode). – MCU remains in Wait Mode. Some time later either a wakeup interrupt occurs (no SCM interrupt) – Exit Wait Mode using OSCCLK as system clock (SYSCLK), – Continue normal operation. or an External Reset is applied. – Exit Wait Mode using OSCCLK as system clock, – Start reset sequence. Scenario 2: OSCCLKdoes not recover prior to exiting Wait Mode. – MCU remains in Wait Mode, – VREG enabled, – PLL enabled, – SCM activated, – Start Clock Quality Check, – Set SCMIF interrupt flag, – Keep performing Clock Quality Checks (could continue infinitely) while in Wait Mode. Some time later either a wakeup interrupt occurs (no SCM interrupt) – Exit Wait Mode in SCM using PLL clock (f ) as system clock, SCM – Continue to perform additional Clock Quality Checks until OSCCLK is o.k. again. or an External RESET is applied. – Exit Wait Mode in SCM using PLL clock (f ) as system clock, SCM – Start reset sequence, – Continue to perform additional Clock Quality Checks until OSCCLK is o.k.again. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 277 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-11. Outcome of Clock Loss in Wait Mode (continued) CME SCME SCMIE CRG Actions 1 1 1 Clock failure --> – VREG enabled, – PLL enabled, – SCM activated, – Start Clock Quality Check, – SCMIF set. SCMIF generates Self-Clock Mode wakeup interrupt. – Exit Wait Mode in SCM using PLL clock (f ) as system clock, SCM – Continue to perform a additional Clock Quality Checks until OSCCLK is o.k. again. 9.4.10 Low-Power Operation in Stop Mode All clocks are stopped in STOP mode, dependent of the setting of the PCE, PRE and PSTP bit. The oscillatorisdisabledinSTOPmodeunlessthePSTPbitisset.Allcountersanddividersremainfrozenbut donotinitialize.IfthePREorPCEbitsareset,theRTIorCOPcontinuestoruninpseudo-stopmode.In addition to disabling system and core clocks the CRG requests other functional units of the MCU (e.g. voltage-regulator)toentertheirindividualpower-savingmodes(ifavailable).Thisisthemaindifference between pseudo-stop mode and wait mode. AfterexecutingtheSTOPinstructionthecorerequeststheCRGtoswitchtheMCUintostopmode.Ifthe PLLSEL bit remains set when entering stop mode, the CRG will switch the system and core clocks to OSCCLKbyclearingthePLLSELbit.ThentheCRGdisablesthePLL,disablesthecoreclockandfinally disables the remaining system clocks. As soon as all clocks are switched off, stop mode is active. Ifpseudo-stopmode(PSTP=1)isenteredfromself-clockmodetheCRGwillcontinuetochecktheclock qualityuntilclockcheckissuccessful.ThePLLandthevoltageregulator(VREG)willremainenabled.If fullstopmode(PSTP=0)isenteredfromself-clockmodeanongoingclockqualitycheckwillbestopped. A complete timeout window check will be started when stop mode is exited again. Wake-up from stop mode also depends on the setting of the PSTP bit. 278 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Core req’s Stop Mode. Clear PLLSEL, Disable PLL Wait Mode left Exit Stop w. due to external Enter ext.RESET Stop Mode no no INT no PSTP=1 yes CME=1 no INT ? ? ? ? yes yes yes no Clock CM fail no OK ? ? yes Exit Stop w. no SCME=1 CMRESET ? yes yes Exit Stop w. no SCME=1 CMRESET ? yes Exit no Stop Mode SCMIE=1 ? Generate yes SCM Interrupt SCM=1 no Exit Exit (Wakeup from Stop) Exit ? Stop Mode Stop Mode Stop Mode yes Enter Enter Enter SCM SCM SCM Continue w. normal OP Figure9-24. Stop Mode Entry/Exit Sequence 9.4.10.1 Wake-Up from Pseudo-Stop (PSTP=1) Wake-upfrompseudo-stopisthesameaswake-upfromwaitmode.Therearealsothreedifferentscenarios for the CRG to restart the MCU from pseudo-stop mode: • External reset • Clock monitor fail • Wake-up interrupt Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 279 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description If the MCU gets an external reset during pseudo-stop mode active, the CRG asynchronously restores all configurationbitsintheregisterspacetoitsdefaultsettingsandstartstheresetgenerator.Aftercompleting theresetsequenceprocessingbeginsbyfetchingthenormalresetvector.Pseudo-stopmodeisexitedand the MCU is in run mode again. If the clock monitor is enabled (CME = 1) the MCU is able to leave pseudo-stop mode when loss of oscillator/external clock is detected by a clock monitor fail. If the SCME bit is not asserted the CRG generates a clock monitor fail reset (CMRESET). The CRG’s behavior for CMRESET is the same comparedtoexternalreset,butanotherresetvectorisfetchedaftercompletionoftheresetsequence.Ifthe SCME bit is asserted the CRG generates a SCM interrupt if enabled (SCMIE=1). After generating the interrupt the CRG enters self-clock mode and starts the clock quality checker (see Section9.4.4, “Clock Quality Checker”). Then the MCU continues with normal operation. If the SCM interrupt is blocked by SCMIE= 0, the SCMIF flag will be asserted but the CRG will not wake-up from pseudo-stop mode. If any other interrupt source (e.g. RTI) triggers exit from pseudo-stop mode the MCU immediately continueswithnormaloperation.BecausethePLLhasbeenpowered-downduringstopmodethePLLSEL bitisclearedandtheMCUrunsonOSCCLKafterleavingstopmode.ThesoftwaremustsetthePLLSEL bit again, in order to switch system and core clocks to the PLLCLK. Table9-12 summarizes the outcome of a clock loss while in pseudo-stop mode. 280 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-12. Outcome of Clock Loss in Pseudo-Stop Mode CME SCME SCMIE CRG Actions 0 X X Clock failure --> No action, clock loss not detected. 1 0 X Clock failure --> CRG performs Clock Monitor Reset immediately 1 1 0 Clock Monitor failure --> Scenario 1: OSCCLKrecovers prior to exiting Pseudo-Stop Mode. – MCU remains in Pseudo-Stop Mode, – VREG enabled, – PLL enabled, – SCM activated, – Start Clock Quality Check, – Set SCMIF interrupt flag. Some time later OSCCLK recovers. – CM no longer indicates a failure, – 4096 OSCCLK cycles later Clock Quality Check indicates clock o.k., – SCM deactivated, – PLL disabled, – VREG disabled. – MCU remains in Pseudo-Stop Mode. Some time later either a wakeup interrupt occurs (no SCM interrupt) – Exit Pseudo-Stop Mode using OSCCLK as system clock (SYSCLK), – Continue normal operation. or an External Reset is applied. – Exit Pseudo-Stop Mode using OSCCLK as system clock, – Start reset sequence. Scenario 2: OSCCLKdoes not recover prior to exiting Pseudo-Stop Mode. – MCU remains in Pseudo-Stop Mode, – VREG enabled, – PLL enabled, – SCM activated, – Start Clock Quality Check, – Set SCMIF interrupt flag, – Keep performing Clock Quality Checks (could continue infinitely) while in Pseudo-Stop Mode. Some time later either a wakeup interrupt occurs (no SCM interrupt) – Exit Pseudo-Stop Mode in SCM using PLL clock (f ) as system clock SCM – Continue to perform additional Clock Quality Checks until OSCCLK is o.k. again. or an External RESET is applied. – Exit Pseudo-Stop Mode in SCM using PLL clock (f ) as system clock SCM – Start reset sequence, – Continue to perform additional Clock Quality Checks until OSCCLK is o.k.again. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 281 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Table9-12. Outcome of Clock Loss in Pseudo-Stop Mode (continued) CME SCME SCMIE CRG Actions 1 1 1 Clock failure --> – VREG enabled, – PLL enabled, – SCM activated, – Start Clock Quality Check, – SCMIF set. SCMIF generates Self-Clock Mode wakeup interrupt. – Exit Pseudo-Stop Mode in SCM using PLL clock (f ) as system clock, SCM – Continue to perform a additional Clock Quality Checks until OSCCLK is o.k. again. 9.4.10.2 Wake-up from Full Stop (PSTP=0) The MCU requires an external interrupt or an external reset in order to wake-up from stop mode. If the MCU gets an external reset during full stop mode active, the CRG asynchronously restores all configuration bits in the register space to its default settings and will perform a maximum of 50 clock check_windows (seeSection9.4.4, “Clock Quality Checker”). After completing the clock quality check theCRGstartstheresetgenerator.Aftercompletingtheresetsequenceprocessingbeginsbyfetchingthe normal reset vector. Full stop mode is exited and the MCU is in run mode again. If the MCU is woken-up by an interrupt, the CRG will also perform a maximum of 50 clock check_windows(seeSection9.4.4,“ClockQualityChecker”).Iftheclockqualitycheckissuccessful,the CRGwillreleaseallsystemandcoreclocksandwillcontinuewithnormaloperation.Ifallclockchecks withinthetimeout-windowarefailing,theCRGwillswitchtoself-clockmodeorgenerateaclockmonitor reset (CMRESET) depending on the setting of the SCME bit. BecausethePLLhasbeenpowered-downduringstopmodethePLLSELbitisclearedandtheMCUruns onOSCCLKafterleavingstopmode.ThesoftwaremustmanuallysetthePLLSELbitagain,inorderto switch system and core clocks to the PLLCLK. NOTE In full stop mode, the clock monitor is disabled and any loss of clock will not be detected. 9.5 Resets ThissectiondescribeshowtoresettheCRGV4andhowtheCRGV4itselfcontrolstheresetoftheMCU. Itexplainsallspecialresetrequirements.BecausetheresetgeneratorfortheMCUispartoftheCRG,this sectionalsodescribesallautomaticactionsthatoccurduringorasaresultofindividualresetconditions. The reset values of registers and signals are provided in Section9.3, “Memory Map and Register 282 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description Definition.” All reset sources are listed inTable 9-13. Refer to the device overview chapter for related vector addresses and priorities. Table9-13. Reset Summary Reset Source Local Enable Power-on Reset None Low Voltage Reset None External Reset None Clock Monitor Reset PLLCTL (CME=1, SCME=0) COP Watchdog Reset COPCTL (CR[2:0] nonzero) The reset sequence is initiated by any of the following events: • Low level is detected at theRESET pin (external reset). • Power on is detected. • Low voltage is detected. • COP watchdog times out. • Clock monitor failure is detected and self-clock mode was disabled (SCME = 0). Upon detection of any reset event, an internal circuit drives the RESET pin low for 128 SYSCLK cycles (seeFigure9-25). Because entry into reset is asynchronous it does not require a running SYSCLK. However,theinternalresetcircuitoftheCRGV4cannotsequenceoutofcurrentresetconditionwithouta running SYSCLK. The number of 128 SYSCLK cycles might be increased by n= 3 to 6 additional SYSCLK cycles depending on the internal synchronization latency. After 128+n SYSCLK cycles the RESET pin is released. The reset generator of the CRGV4 waits for additional 64 SYSCLK cycles and then samples the RESET pin to determine the originating source. Table9-14 shows which vector will be fetched. Table9-14. Reset Vector Selection SampledRESET Pin Clock Monitor COP Reset (64 Cycles After Vector Fetch Reset Pending Pending Release) 1 0 0 POR / LVR / External Reset 1 1 X Clock Monitor Reset 1 0 1 COP Reset 0 X X POR / LVR / External Reset with rise ofRESET pin NOTE External circuitry connected to theRESET pin should not include a large capacitance that would interfere with the ability of this signal to rise to a valid logic 1 within 64 SYSCLK cycles after the low drive is released. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 283 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description TheinternalresetoftheMCUremainsassertedwhiletheresetgeneratorcompletesthe192SYSCLKlong reset sequence. The reset generator circuitry always makes sure the internal reset is deasserted synchronously after completion of the 192 SYSCLK cycles. In case the RESET pin is externally driven low for more than these 192 SYSCLK cycles (external reset), the internal reset remains asserted too. RESET ) ( ) ( CRG drivesRESET pin low RESET pin released ) ) ) SYSCLK ( ( ( 128+n cycles 64 cycles withnbeing possibly possibly min 3 / max 6 SYSCLK RESET cycles depending not driven low on internal running externally synchronization delay Figure9-25.RESET Timing 9.5.1 Clock Monitor Reset The CRGV4 generates a clock monitor reset in case all of the following conditions are true: • Clock monitor is enabled (CME=1) • Loss of clock is detected • Self-clock mode is disabled (SCME=0) Thereseteventasynchronouslyforcestheconfigurationregisterstotheirdefaultsettings(seeSection9.3, “MemoryMapandRegisterDefinition”).IndetailtheCMEandtheSCMEareresettological‘1’(which doesn’t change the state of the CME bit, because it has already been set). As a consequence, the CRG immediately enters self-clock mode and starts its internal reset sequence. In parallel the clock quality check starts. As soon as clock quality check indicates a valid oscillator clock the CRG switches to OSCCLKandleavesself-clockmode.Becausetheclockqualitycheckerisrunninginparalleltothereset generator, the CRG may leave self-clock mode while completing the internal reset sequence. When the resetsequenceisfinishedtheCRGcheckstheinternallylatchedstateoftheclockmonitorfailcircuit.Ifa clock monitor fail is indicated processing begins by fetching the clock monitor reset vector. 9.5.2 Computer Operating Properly Watchdog (COP) Reset When COP is enabled, the CRG expects sequential write of 0x0055 and 0x00AA (in this order) to the ARMCOP register during the selected time-out period. As soon as this is done, the COP time-out period restarts.IftheprogramfailstodothistheCRGwillgenerateareset.Also,ifanyvalueotherthan0x0055 or0x00AAiswritten,theCRGimmediatelygeneratesareset.IncasewindowedCOPoperationisenabled 284 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description writes(0x0055 or0x00AA)totheARMCOPregistermustoccurinthelast25%oftheselectedtime-out period. A premature write the CRG will immediately generate a reset. As soon as the reset sequence is completed the reset generator checks the reset condition. If no clock monitorfailureisindicatedandthelatchedstateoftheCOPtimeoutistrue,processingbeginsbyfetching the COP vector. 9.5.3 Power-On Reset, Low Voltage Reset Theon-chipvoltageregulatordetectswhenV totheMCUhasreachedacertainlevelandassertspower- DD onresetorlowvoltageresetorboth.Assoonasapower-onresetorlowvoltageresetistriggeredtheCRG performs a quality check on the incoming clock signal. As soon as clock quality check indicates a valid oscillator clock signal the reset sequence starts using the oscillator clock. If after 50 check windows the clockqualitycheckindicatedanon-validoscillatorclocktheresetsequencestartsusingself-clockmode. Figure9-26 and Figure9-27 show the power-up sequence for cases when theRESET pin is tied to V DD and when theRESET pin is held low. Clock Quality Check RESET (no Self-Clock Mode) ) ( Internal POR ) ( 128 SYSCLK InternalRESET 64 SYSCLK ) ( Figure9-26.RESET Pin Tied to V (by a Pull-Up Resistor) DD Clock Quality Check RESET (no Self-Clock Mode) ) ( Internal POR ) ( 128 SYSCLK InternalRESET 64 SYSCLK ) ( Figure9-27.RESET Pin Held Low Externally Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 285 Rev 01.24

Chapter9 Clocks and Reset Generator (CRGV4) Block Description 9.6 Interrupts The interrupts/reset vectors requested by the CRG are listed in Table9-15. Refer to the device overview chapter for related vector addresses and priorities. Table9-15. CRG Interrupt Vectors CCR Interrupt Source Local Enable Mask Real-time interrupt I bit CRGINT (RTIE) LOCK interrupt I bit CRGINT (LOCKIE) SCM interrupt I bit CRGINT (SCMIE) 9.6.1 Real-Time Interrupt TheCRGV4generatesareal-timeinterruptwhentheselectedinterrupttimeperiodelapses.RTIinterrupts are locally disabled by setting the RTIE bit to 0. The real-time interrupt flag (RTIF) is set to 1 when a timeout occurs, and is cleared to 0 by writing a 1 to the RTIF bit. TheRTIcontinuestorunduringpseudo-stopmodeifthePREbitissetto1.Thisfeaturecanbeusedfor periodic wakeup from pseudo-stop if the RTI interrupt is enabled. 9.6.2 PLL Lock Interrupt The CRGV4 generates a PLL lock interrupt when the LOCK condition of the PLL has changed, either from a locked state to an unlocked state or vice versa. Lock interrupts are locally disabled by setting the LOCKIE bit to 0. The PLL Lock interrupt flag (LOCKIF) is set to1 when the LOCK condition has changed, and is cleared to 0 by writing a 1 to the LOCKIF bit. 9.6.3 Self-Clock Mode Interrupt The CRGV4 generates a self-clock mode interrupt when the SCM condition of the system has changed, either entered or exited self-clock mode. SCM conditions can only change if the self-clock mode enable bit (SCME) is set to 1. SCM conditions are caused by a failing clock quality check after power-on reset (POR) or low voltage reset (LVR) or recovery from full stop mode (PSTP= 0) or clock monitor failure. FordetailsontheclockqualitycheckrefertoSection9.4.4,“ClockQualityChecker.”Iftheclockmonitor is enabled (CME= 1) a loss of external clock will also cause a SCM condition (SCME= 1). SCMinterruptsarelocallydisabledbysettingtheSCMIEbitto0.TheSCMinterruptflag(SCMIF)isset to 1 when the SCM condition has changed, and is cleared to 0 by writing a 1 to the SCMIF bit. 286 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.1 Introduction Freescale’s scalable controller area network (S12MSCANV2) definition is based on the MSCAN12 definition, which is the specific implementation of the MSCAN concept targeted for the M68HC12 microcontroller family. The module is a communication controller implementing the CAN 2.0A/B protocol as defined in the Bosch specification dated September 1991. For users to fully understand the MSCAN specification, it is recommended that the Bosch specification be read first to familiarize the reader with the terms and concepts contained within this document. Though not exclusively intended for automotive applications, CAN protocol is designed to meet the specific requirements of a vehicle serial data bus: real-time processing, reliable operation in the EMI environment of a vehicle, cost-effectiveness, and required bandwidth. MSCAN uses an advanced buffer arrangement resulting in predictable real-time behavior and simplified application software. 10.1.1 Glossary ACK: Acknowledge of CAN message CAN: Controller Area Network CRC: Cyclic Redundancy Code EOF: End of Frame FIFO: First-In-First-Out Memory IFS: Inter-Frame Sequence SOF: Start of Frame CPU bus: CPU related read/write data bus CAN bus: CAN protocol related serial bus oscillator clock: Direct clock from external oscillator bus clock: CPU bus realated clock CAN clock: CAN protocol related clock Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 287 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.1.2 Block Diagram MSCAN Oscillator Clock CANCLK Tq Clk MUX Presc. Bus Clock RXCAN Receive/ Transmit Engine TXCAN Transmit Interrupt Req. Message Receive Interrupt Req. Control Filtering and and Errors Interrupt Req. Status Buffering Wake-Up Interrupt Req. Configuration Registers Wake-Up Low Pass Filter Figure10-1. MSCAN Block Diagram 10.1.3 Features The basic features of the MSCAN are as follows: • Implementation of the CAN protocol — Version 2.0A/B — Standard and extended data frames — Zero to eight bytes data length — Programmable bit rate up to 1 Mbps1 — Support for remote frames • Five receive buffers with FIFO storage scheme • Three transmit buffers with internal prioritization using a “local priority” concept • Flexiblemaskableidentifierfiltersupportstwofull-size(32-bit)extendedidentifierfilters,orfour 16-bit filters, or eight 8-bit filters • Programmable wakeup functionality with integrated low-pass filter • Programmable loopback mode supports self-test operation • Programmable listen-only mode for monitoring of CAN bus • Separate signalling and interrupt capabilities for all CAN receiver and transmitter error states (warning, error passive, bus-off) • Programmable MSCAN clock source either bus clock or oscillator clock • Internal timer for time-stamping of received and transmitted messages • Three low-power modes: sleep, power down, and MSCAN enable • Global initialization of configuration registers 1. Depending on the actual bit timing and the clock jitter of the PLL. 288 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.1.4 Modes of Operation ThefollowingmodesofoperationarespecifictotheMSCAN.SeeSection10.4,“FunctionalDescription,” for details. • Listen-Only Mode • MSCAN Sleep Mode • MSCAN Initialization Mode • MSCAN Power Down Mode 10.2 External Signal Description The MSCAN uses two external pins: 10.2.1 RXCAN — CAN Receiver Input Pin RXCAN is the MSCAN receiver input pin. 10.2.2 TXCAN — CAN Transmitter Output Pin TXCAN is the MSCAN transmitter output pin. The TXCAN output pin represents the logic level on the CAN bus: 0 = Dominant state 1 = Recessive state 10.2.3 CAN System AtypicalCANsystemwithMSCANisshowninFigure10-2.EachCANstationisconnectedphysically to the CAN bus lines through a transceiver device. The transceiver is capable of driving the large current needed for the CAN bus and has current protection against defective CAN or defective stations. CAN node 1 CAN node 2 CAN node n MCU CAN Controller (MSCAN) TXCAN RXCAN Transceiver CAN_H CAN_L CAN Bus Figure10-2. CAN System Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 289 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3 Memory Map and Register Definition This section provides a detailed description of all registers accessible in the MSCAN. 10.3.1 Module Memory Map Figure10-3givesanoverviewonallregistersandtheirindividualbitsintheMSCANmemorymap.The register address results from the addition ofbase address andaddress offset. Thebase address is determinedattheMCUlevelandcanbefoundintheMCUmemorymapdescription.Theaddressoffset is defined at the module level. The MSCAN occupies 64 bytes in the memory space. The base address of the MSCAN module is determinedattheMCUlevelwhentheMCUisdefined.Theregisterdecodemapisfixedandbeginsatthe first address of the module address offset. The detailed register descriptions follow in the order they appear in the register map. 290 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R RXACT SYNCH RXFRM CSWAI TIME WUPE SLPRQ INITRQ CANCTL0 W 0x0001 R SLPAK INITAK CANE CLKSRC LOOPB LISTEN WUPM CANCTL1 W 0x0002 R SJW1 SJW0 BRP5 BRP4 BRP3 BRP2 BRP1 BRP0 CANBTR0 W 0x0003 R SAMP TSEG22 TSEG21 TSEG20 TSEG13 TSEG12 TSEG11 TSEG10 CANBTR1 W 0x0004 R RSTAT1 RSTAT0 TSTAT1 TSTAT0 WUPIF CSCIF OVRIF RXF CANRFLG W 0x0005 R WUPIE CSCIE RSTATE1 RSTATE0 TSTATE1 TSTATE0 OVRIE RXFIE CANRIER W 0x0006 R 0 0 0 0 0 TXE2 TXE1 TXE0 CANTFLG W 0x0007 R 0 0 0 0 0 TXEIE2 TXEIE1 TXEIE0 CANTIER W 0x0008 R 0 0 0 0 0 ABTRQ2 ABTRQ1 ABTRQ0 CANTARQ W 0x0009 R 0 0 0 0 0 ABTAK2 ABTAK1 ABTAK0 CANTAAK W 0x000A R 0 0 0 0 0 TX2 TX1 TX0 CANTBSEL W 0x000B R 0 0 0 IDHIT2 IDHIT1 IDHIT0 IDAM1 IDAM0 CANIDAC W 0x000C–0x000D R 0 0 0 0 0 0 0 0 Reserved W 0x000E R RXERR7 RXERR6 RXERR5 RXERR4 RXERR3 RXERR2 RXERR1 RXERR0 CANRXERR W 0x000F R TXERR7 TXERR6 TXERR5 TXERR4 TXERR3 TXERR2 TXERR1 TXERR0 CANTXERR W = Unimplemented or Reserved u = Unaffected Figure10-3. MSCAN Register Summary Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 291 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0010–0x0013 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 CANIDAR0–3 W 0x0014–0x0017 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 CANIDMRx W 0x0018–0x001B R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 CANIDAR4–7 W 0x001C–0x001F R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 CANIDMR4–7 W 0x0020–0x002F R SeeSection10.3.3, “Programmer’s Model of Message Storage” CANRXFG W 0x0030–0x003F R SeeSection10.3.3, “Programmer’s Model of Message Storage” CANTXFG W = Unimplemented or Reserved u = Unaffected Figure10-3. MSCAN Register Summary (continued) 10.3.2 Register Descriptions ThissectiondescribesindetailalltheregistersandregisterbitsintheMSCANmodule.Eachdescription includes a standard register diagram with an associated figure number. Details of register bit and field function follow the register diagrams, in bit order. All bits of all registers in this module are completely synchronous to internal clocks during a register read. 10.3.2.1 MSCAN Control Register 0 (CANCTL0) The CANCTL0 register provides various control bits of the MSCAN module as described below. Module Base + 0x0000 7 6 5 4 3 2 1 0 R RXACT SYNCH RXFRM CSWAI TIME WUPE SLPRQ INITRQ W Reset: 0 0 0 0 0 0 0 1 = Unimplemented Figure10-4. MSCAN Control Register 0 (CANCTL0) 292 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) NOTE TheCANCTL0register,exceptWUPE,INITRQ,andSLPRQ,isheldinthe reset state when the initialization mode is active (INITRQ = 1 and INITAK = 1). This register is writable again as soon as the initialization mode is exited (INITRQ = 0 and INITAK = 0). Read: Anytime Write:Anytimewhenoutofinitializationmode;exceptionsareread-onlyRXACTandSYNCH,RXFRM (which is set by the module only), and INITRQ (which is also writable in initialization mode). Table10-1. CANCTL0 Register Field Descriptions Field Description 7 ReceivedFrameFlag—Thisbitisreadandclearonly.Itissetwhenareceiverhasreceivedavalidmessage RXFRM(1) correctly,independentlyofthefilterconfiguration.Afteritisset,itremainssetuntilclearedbysoftwareorreset. Clearing is done by writing a 1. Writing a 0 is ignored. This bit is not valid in loopback mode. 0 No valid message was received since last clearing this flag 1 A valid message was received since last clearing of this flag 6 Receiver Active Status — This read-only flag indicates the MSCAN is receiving a message. The flag is RXACT controlled by the receiver front end. This bit is not valid in loopback mode. 0 MSCAN is transmitting or idle2 1 MSCAN is receiving a message (including when arbitration is lost)(2) 5 CANStopsinWaitMode—Enablingthisbitallowsforlowerpowerconsumptioninwaitmodebydisablingall CSWAI(3) the clocks at the CPU bus interface to the MSCAN module. 0 The module is not affected during wait mode 1 The module ceases to be clocked during wait mode 4 SynchronizedStatus—Thisread-onlyflagindicateswhethertheMSCANissynchronizedtotheCANbusand SYNCH able to participate in the communication process. It is set and cleared by the MSCAN. 0 MSCAN is not synchronized to the CAN bus 1 MSCAN is synchronized to the CAN bus 3 TimerEnable—Thisbitactivatesaninternal16-bitwidefreerunningtimerwhichisclockedbythebitclockrate. TIME If the timer is enabled, a 16-bit time stamp will be assigned to each transmitted/received message within the active TX/RX buffer. Right after the EOF of a valid message on the CAN bus, the time stamp is written to the highestbytes(0x000E,0x000F)intheappropriatebuffer(seeSection10.3.3,“Programmer’sModelofMessage Storage”). The internal timer is reset (all bits set to 0) when disabled. This bit is held low in initialization mode. 0 Disable internal MSCAN timer 1 Enable internal MSCAN timer 2 Wake-UpEnable—ThisconfigurationbitallowstheMSCANtorestartfromsleepmodewhentrafficonCANis WUPE(4) detected (seeSection10.4.5.4, “MSCAN Sleep Mode”). 0 Wake-up disabled — The MSCAN ignores traffic on CAN 1 Wake-up enabled — The MSCAN is able to restart Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 293 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-1. CANCTL0 Register Field Descriptions (continued) Field Description 1 Sleep Mode Request — This bit requests the MSCAN to enter sleep mode, which is an internal power saving SLPRQ(5) mode(seeSection10.4.5.4,“MSCANSleepMode”).ThesleepmoderequestisservicedwhentheCANbusis idle, i.e., the module is not receiving a message and all transmit buffers are empty. The module indicates entry to sleep mode by setting SLPAK = 1 (seeSection10.3.2.2, “MSCAN Control Register 1 (CANCTL1)”). SLPRQ cannotbesetwhiletheWUPIFflagisset(seeSection10.3.2.5,“MSCANReceiverFlagRegister(CANRFLG)”). SleepmodewillbeactiveuntilSLPRQisclearedbytheCPUor,dependingonthesettingofWUPE,theMSCAN detects activity on the CAN bus and clears SLPRQ itself. 0 Running — The MSCAN functions normally 1 Sleep mode request — The MSCAN enters sleep mode when CAN bus idle 0 Initialization Mode Request — When this bit is set by the CPU, the MSCAN skips to initialization mode (see INITRQ(6),(7) Section10.4.5.5, “MSCAN Initialization Mode”). Any ongoing transmission or reception is aborted and synchronization to the CAN bus is lost. The module indicates entry to initialization mode by setting INITAK = 1 (Section10.3.2.2, “MSCAN Control Register 1 (CANCTL1)”). The following registers enter their hard reset state and restore their default values: CANCTL0(8), CANRFLG(9), CANRIER(10), CANTFLG, CANTIER, CANTARQ, CANTAAK, and CANTBSEL. The registers CANCTL1, CANBTR0, CANBTR1, CANIDAC, CANIDAR0-7, and CANIDMR0-7 can only be written by the CPU when the MSCAN is in initialization mode (INITRQ = 1 and INITAK = 1). The values of the error counters are not affected by initialization mode. When this bit is cleared by the CPU, the MSCAN restarts and then tries to synchronize to the CAN bus. If the MSCANisnotinbus-offstate,itsynchronizesafter11consecutiverecessivebitsontheCANbus;iftheMSCAN is in bus-off state, it continues to wait for 128 occurrences of 11 consecutive recessive bits. Writing to otherbits in CANCTL0, CANRFLG, CANRIER, CANTFLG, or CANTIER must be done only after initialization mode is exited, which is INITRQ = 0 and INITAK = 0. 0 Normal operation 1 MSCAN in initialization mode 1. The MSCAN must be in normal mode for this bit to become set. 2. See the Bosch CAN 2.0A/B specification for a detailed definition of transmitter and receiver states. 3.InordertoprotectfromaccidentallyviolatingtheCANprotocol,theTXCANpinisimmediatelyforcedtoarecessivestatewhen the CPU enters wait (CSWAI = 1) or stop mode (seeSection10.4.5.2, “Operation in Wait Mode” andSection10.4.5.3, “Operation in Stop Mode”). 4. The CPU has to make sure that the WUPE register and the WUPIE wake-up interrupt enable register (seeSection10.3.2.6, “MSCANReceiverInterruptEnableRegister(CANRIER))isenabled,iftherecoverymechanismfromstoporwaitisrequired. 5. The CPU cannot clear SLPRQ before the MSCAN has entered sleep mode (SLPRQ = 1 and SLPAK = 1). 6. The CPU cannot clear INITRQ before the MSCAN has entered initialization mode (INITRQ = 1 and INITAK = 1). 7.InordertoprotectfromaccidentallyviolatingtheCANprotocol,theTXCANpinisimmediatelyforcedtoarecessivestatewhen the initialization mode is requested by the CPU. Thus, the recommended procedure is to bring the MSCAN into sleep mode (SLPRQ = 1 and SLPAK = 1) before requesting initialization mode. 8. Not including WUPE, INITRQ, and SLPRQ. 9. TSTAT1 and TSTAT0 are not affected by initialization mode. 10. RSTAT1 and RSTAT0 are not affected by initialization mode. 10.3.2.2 MSCAN Control Register 1 (CANCTL1) The CANCTL1 register provides various control bits and handshake status information of the MSCAN module as described below. 294 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x0001 7 6 5 4 3 2 1 0 R SLPAK INITAK CANE CLKSRC LOOPB LISTEN WUPM W Reset: 0 0 0 1 0 0 0 1 = Unimplemented Figure10-5. MSCAN Control Register 1 (CANCTL1) Read: Anytime Write: Anytime when INITRQ= 1 and INITAK= 1, except CANE which is write once in normal and anytimeinspecialsystemoperationmodeswhentheMSCANisininitializationmode(INITRQ= 1and INITAK = 1). Table10-2. CANCTL1 Register Field Descriptions Field Description 7 MSCAN Enable CANE 0 MSCAN module is disabled 1 MSCAN module is enabled 6 MSCANClockSource—ThisbitdefinestheclocksourcefortheMSCANmodule(onlyforsystemswithaclock CLKSRC generationmodule;Section10.4.3.2,“ClockSystem,”andSectionFigure10-42.,“MSCANClockingScheme,”). 0 MSCAN clock source is the oscillator clock 1 MSCAN clock source is the bus clock 5 LoopbackSelfTestMode—Whenthisbitisset,theMSCANperformsaninternalloopbackwhichcanbeused LOOPB forselftestoperation.Thebitstreamoutputofthetransmitterisfedbacktothereceiverinternally.TheRXCAN inputpinisignoredandtheTXCANoutputgoestotherecessivestate(logic1).TheMSCANbehavesasitdoes normallywhentransmittingandtreatsitsowntransmittedmessageasamessagereceivedfromaremotenode. Inthisstate,theMSCANignoresthebitsentduringtheACKslotintheCANframeacknowledgefieldtoensure proper reception of its own message. Both transmit and receive interrupts are generated. 0 Loopback self test disabled 1 Loopback self test enabled 4 ListenOnlyMode—ThisbitconfigurestheMSCANasaCANbusmonitor.WhenLISTENisset,allvalidCAN LISTEN messages with matching ID are received, but no acknowledgement or error frames are sent out (see Section10.4.4.4, “Listen-Only Mode”). In addition, the error counters are frozen. Listen only mode supports applications which require “hot plugging” or throughput analysis. The MSCAN is unable to transmit any messages when listen only mode is active. 0 Normal operation 1 Listen only mode activated 2 Wake-Up Mode — If WUPE in CANCTL0 is enabled, this bit defines whether the integrated low-pass filter is WUPM applied to protect the MSCAN from spurious wake-up (seeSection10.4.5.4, “MSCAN Sleep Mode”). 0 MSCAN wakes up on any dominant level on the CAN bus 1 MSCAN wakes up only in case of a dominant pulse on the CAN bus that has a length of T wup Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 295 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-2. CANCTL1 Register Field Descriptions (continued) Field Description 1 Sleep Mode Acknowledge — This flag indicates whether the MSCAN module has entered sleep mode (see SLPAK Section10.4.5.4, “MSCAN Sleep Mode”). It is used as a handshake flag for the SLPRQ sleep mode request. Sleep mode is active when SLPRQ=1 and SLPAK=1. Depending on the setting of WUPE, the MSCAN will clear the flag if it detects activity on the CAN bus while in sleep mode. 0 Running — The MSCAN operates normally 1 Sleep mode active — The MSCAN has entered sleep mode 0 Initialization Mode Acknowledge — This flag indicates whether the MSCAN module is in initialization mode INITAK (seeSection10.4.5.5,“MSCANInitializationMode”).ItisusedasahandshakeflagfortheINITRQinitialization mode request. Initialization mode is active when INITRQ=1 and INITAK=1. The registers CANCTL1, CANBTR0,CANBTR1,CANIDAC,CANIDAR0–CANIDAR7,andCANIDMR0–CANIDMR7canbewrittenonlyby the CPU when the MSCAN is in initialization mode. 0 Running — The MSCAN operates normally 1 Initialization mode active — The MSCAN has entered initialization mode 296 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.3 MSCAN Bus Timing Register 0 (CANBTR0) The CANBTR0 register configures various CAN bus timing parameters of the MSCAN module. Module Base + 0x0002 7 6 5 4 3 2 1 0 R SJW1 SJW0 BRP5 BRP4 BRP3 BRP2 BRP1 BRP0 W Reset: 0 0 0 0 0 0 0 0 Figure10-6. MSCAN Bus Timing Register 0 (CANBTR0) Read: Anytime Write: Anytime in initialization mode (INITRQ= 1 and INITAK = 1) Table10-3. CANBTR0Register Field Descriptions Field Description 7:6 SynchronizationJumpWidth—Thesynchronizationjumpwidthdefinesthemaximumnumberoftimequanta SJW[1:0] (Tq) clock cycles a bit can be shortened or lengthened to achieve resynchronization to data transitions on the CAN bus (seeTable10-4). 5:0 BaudRatePrescaler—Thesebitsdeterminethetimequanta(Tq)clockwhichisusedtobuildupthebittiming BRP[5:0] (seeTable10-5). Table10-4. Synchronization Jump Width SJW1 SJW0 Synchronization Jump Width 0 0 1 Tq clock cycle 0 1 2 Tq clock cycles 1 0 3 Tq clock cycles 1 1 4 Tq clock cycles Table10-5. Baud Rate Prescaler BRP5 BRP4 BRP3 BRP2 BRP1 BRP0 Prescaler value (P) 0 0 0 0 0 0 1 0 0 0 0 0 1 2 0 0 0 0 1 0 3 0 0 0 0 1 1 4 : : : : : : : 1 1 1 1 1 1 64 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 297 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.4 MSCAN Bus Timing Register 1 (CANBTR1) The CANBTR1 register configures various CAN bus timing parameters of the MSCAN module. Module Base + 0x0003 7 6 5 4 3 2 1 0 R SAMP TSEG22 TSEG21 TSEG20 TSEG13 TSEG12 TSEG11 TSEG10 W Reset: 0 0 0 0 0 0 0 0 Figure10-7. MSCAN Bus Timing Register 1(CANBTR1) Read: Anytime Write: Anytime in initialization mode (INITRQ= 1 and INITAK = 1) Table10-6. CANBTR1 Register Field Descriptions Field Description 7 Sampling — This bit determines the number of CAN bus samples taken per bit time. SAMP 0 One sample per bit. 1 Three samples per bit(1). If SAMP = 0, the resulting bit value is equal to the value of the single bit positioned at the sample point. If SAMP=1, the resulting bit value is determined by using majority rule on the three total samples. For higher bit rates, it is recommended that only one sample is taken per bit time (SAMP = 0). 6:4 TimeSegment2—Timesegmentswithinthebittimefixthenumberofclockcyclesperbittimeandthelocation TSEG2[2:0] of the sample point (seeFigure10-43). Time segment 2 (TSEG2) values are programmable as shown in Table10-7. 3:0 TimeSegment1—Timesegmentswithinthebittimefixthenumberofclockcyclesperbittimeandthelocation TSEG1[3:0] of the sample point (seeFigure10-43). Time segment 1 (TSEG1) values are programmable as shown in Table10-8. 1. In this case, PHASE_SEG1 must be at least 2 time quanta (Tq). Table10-7. Time Segment 2 Values TSEG22 TSEG21 TSEG20 Time Segment 2 0 0 0 1 Tq clock cycle(1) 0 0 1 2 Tq clock cycles : : : : 1 1 0 7 Tq clock cycles 1 1 1 8 Tq clock cycles 1. This setting is not valid. Please refer toTable10-34 for valid settings. 298 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-8. Time Segment 1 Values TSEG13 TSEG12 TSEG11 TSEG10 Time segment 1 0 0 0 0 1 Tq clock cycle(1) 0 0 0 1 2 Tq clock cycles1 0 0 1 0 3 Tq clock cycles1 0 0 1 1 4 Tq clock cycles : : : : : 1 1 1 0 15 Tq clock cycles 1 1 1 1 16 Tq clock cycles 1. This setting is not valid. Please refer toTable10-34 for valid settings. The bit time is determined by the oscillator frequency, the baud rate prescaler, and the number of time quanta (Tq) clock cycles per bit (as shown in Table 10-7 and Table10-8). Eqn.10-1 (Prescaler value) Bit Time= ------------------------------------------------------•(1+TimeSegment1+TimeSegment2) f CANCLK 10.3.2.5 MSCAN Receiver Flag Register (CANRFLG) Aflagcanbeclearedonlybysoftware(writinga1tothecorrespondingbitposition)whenthecondition which caused the setting is no longer valid. Every flag has an associated interrupt enable bit in the CANRIER register. Module Base + 0x0004 7 6 5 4 3 2 1 0 R RSTAT1 RSTAT0 TSTAT1 TSTAT0 WUPIF CSCIF OVRIF RXF W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-8. MSCAN Receiver Flag Register(CANRFLG) NOTE The CANRFLG register is held in the reset state1 when the initialization modeisactive(INITRQ=1andINITAK=1).Thisregisteriswritableagain as soon as the initialization mode is exited (INITRQ = 0 and INITAK = 0). Read: Anytime Write:Anytimewhenoutofinitializationmode,exceptRSTAT[1:0]andTSTAT[1:0]flagswhichareread- only; write of 1 clears flag; write of 0 is ignored. 1. The RSTAT[1:0], TSTAT[1:0] bits are not affected by initialization mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 299 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-9. CANRFLG Register Field Descriptions Field Description 7 Wake-Up Interrupt Flag — If the MSCAN detects CAN bus activity while in sleep mode (seeSection10.4.5.4, WUPIF “MSCAN Sleep Mode,”) and WUPE = 1 in CANTCTL0 (seeSection10.3.2.1, “MSCAN Control Register 0 (CANCTL0)”), the module will set WUPIF. If not masked, a wake-up interrupt is pending while this flag is set. 0 No wake-up activity observed while in sleep mode 1 MSCAN detected activity on the CAN bus and requested wake-up 6 CAN Status Change Interrupt Flag — This flag is set when the MSCAN changes its current CAN bus status CSCIF duetotheactualvalueofthetransmiterrorcounter(TEC)andthereceiveerrorcounter(REC).Anadditional4- bit(RSTAT[1:0],TSTAT[1:0])statusregister,whichissplitintoseparatesectionsforTEC/REC,informsthesystem ontheactualCANbusstatus(seeSection10.3.2.6,“MSCANReceiverInterruptEnableRegister(CANRIER)”). If not masked, an error interrupt is pending while this flag is set. CSCIF provides a blocking interrupt. That guaranteesthatthereceiver/transmitterstatusbits(RSTAT/TSTAT)areonlyupdatedwhennoCANstatuschange interruptispending.IftheTECs/RECschangetheircurrentvalueaftertheCSCIFisasserted,whichwouldcause anadditionalstatechangeintheRSTAT/TSTATbits,thesebitskeeptheirstatusuntilthecurrentCSCIFinterrupt is cleared again. 0 No change in CAN bus status occurred since last interrupt 1 MSCAN changed current CAN bus status 5:4 Receiver Status Bits — The values of the error counters control the actual CAN bus status of the MSCAN. As RSTAT[1:0] soonasthestatuschangeinterruptflag(CSCIF)isset,thesebitsindicatetheappropriatereceiverrelatedCAN bus status of the MSCAN. The coding for the bits RSTAT1, RSTAT0 is: 00 RxOK:0≤ receive error counter≤ 96 01 RxWRN: 96< receive error counter≤ 127 10 RxERR: 127< receive error counter 11 Bus-off(1): transmit error counter> 255 3:2 Transmitter Status Bits — The values of the error counters control the actual CAN bus status of the MSCAN. TSTAT[1:0] Assoonasthestatuschangeinterruptflag(CSCIF)isset,thesebitsindicatetheappropriatetransmitterrelated CAN bus status of the MSCAN. The coding for the bits TSTAT1, TSTAT0 is: 00 TxOK:0≤transmit error counter≤ 96 01 TxWRN: 96< transmit error counter≤ 127 10 TxERR: 127< transmit error counter≤ 255 11 Bus-Off:transmit error counter> 255 1 OverrunInterruptFlag—Thisflagissetwhenadataoverrunconditionoccurs.Ifnotmasked,anerrorinterrupt OVRIF is pending while this flag is set. 0 No data overrun condition 1 A data overrun detected 0 ReceiveBufferFullFlag—RXFissetbytheMSCANwhenanewmessageisshiftedinthereceiverFIFO.This RXF(2) flag indicates whether the shifted buffer is loaded with a correctly received message (matching identifier, matching cyclic redundancy code (CRC) and no other errors detected). After the CPU has read that message from the RxFG buffer in the receiver FIFO, the RXF flag must be cleared to release the buffer. A set RXF flag prohibitstheshiftingofthenextFIFOentryintotheforegroundbuffer(RxFG).Ifnotmasked,areceiveinterrupt is pending while this flag is set. 0 No new message available within the RxFG 1 The receiver FIFO is not empty. A new message is available in the RxFG 1.RedundantInformationforthemostcriticalCANbusstatuswhichis“bus-off”.ThisonlyoccursiftheTxerrorcounterexceeds anumberof255errors.Bus-offaffectsthereceiverstate.Assoonasthetransmitterleavesitsbus-offstatethereceiverstate skips to RxOK too. Refer also to TSTAT[1:0] coding in this register. 2. To ensure data integrity, do not read the receive buffer registers while the RXF flag is cleared. For MCUs with dual CPUs, reading the receive buffer registers while the RXF flag is cleared may result in a CPU fault condition. 300 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.6 MSCAN Receiver Interrupt Enable Register (CANRIER) ThisregistercontainstheinterruptenablebitsfortheinterruptflagsdescribedintheCANRFLGregister. Module Base + 0x0005 7 6 5 4 3 2 1 0 R WUPIE CSCIE RSTATE1 RSTATE0 TSTATE1 TSTATE0 OVRIE RXFIE W Reset: 0 0 0 0 0 0 0 0 Figure10-9. MSCAN Receiver Interrupt Enable Register (CANRIER) NOTE TheCANRIERregisterisheldintheresetstatewhentheinitializationmode isactive(INITRQ=1andINITAK=1).Thisregisteriswritablewhennotin initialization mode (INITRQ=0 and INITAK=0). The RSTATE[1:0], TSTATE[1:0] bits are not affected by initialization mode. Read: Anytime Write: Anytime when not in initialization mode Table10-10. CANRIER Register Field Descriptions Field Description 7 Wake-Up Interrupt Enable WUPIE(1) 0 No interrupt request is generated from this event. 1 A wake-up event causes a Wake-Up interrupt request. 6 CAN Status Change Interrupt Enable CSCIE 0 No interrupt request is generated from this event. 1 A CAN Status Change event causes an error interrupt request. 5:4 ReceiverStatusChangeEnable—TheseRSTATenablebitscontrolthesensitivitylevelinwhichreceiverstate RSTATE[1:0] changesarecausingCSCIFinterrupts.IndependentofthechosensensitivityleveltheRSTATflagscontinueto indicate the actual receiver state and are only updated if no CSCIF interrupt is pending. 00 Do not generate any CSCIF interrupt caused by receiver state changes. 01 Generate CSCIF interrupt only if the receiver enters or leaves “bus-off” state. Discard other receiver state changes for generating CSCIF interrupt. 10 Generate CSCIF interrupt only if the receiver enters or leaves “RxErr” or “bus-off”(2) state. Discard other receiver state changes for generating CSCIF interrupt. 11 Generate CSCIF interrupt on all state changes. 3:2 TransmitterStatusChangeEnable—TheseTSTATenablebitscontrolthesensitivitylevelinwhichtransmitter TSTATE[1:0] state changes are causing CSCIF interrupts. Independent of the chosen sensitivity level, the TSTAT flags continue to indicate the actual transmitter state and are only updated if no CSCIF interrupt is pending. 00 Do not generate any CSCIF interrupt caused by transmitter state changes. 01 Generate CSCIF interrupt only if the transmitter enters or leaves “bus-off” state. Discard other transmitter state changes for generating CSCIF interrupt. 10 Generate CSCIF interrupt only if the transmitter enters or leaves “TxErr” or “bus-off” state. Discard other transmitter state changes for generating CSCIF interrupt. 11 Generate CSCIF interrupt on all state changes. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 301 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-10. CANRIER Register Field Descriptions (continued) Field Description 1 Overrun Interrupt Enable OVRIE 0 No interrupt request is generated from this event. 1 An overrun event causes an error interrupt request. 0 Receiver Full Interrupt Enable RXFIE 0 No interrupt request is generated from this event. 1 A receive buffer full (successful message reception) event causes a receiver interrupt request. 1. WUPIE and WUPE(seeSection10.3.2.1, “MSCAN Control Register 0 (CANCTL0)”) must both be enabled if the recovery mechanism from stop or wait is required. 2.Bus-offstateisdefinedbytheCANstandard(seeBoschCAN2.0A/Bprotocolspecification:foronlytransmitters.Becausethe only possible state change for the transmitter from bus-off to TxOK also forces the receiver to skip its current state to RxOK, thecodingoftheRXSTAT[1:0]flagsdefineanadditionalbus-offstateforthereceiver(seeSection10.3.2.5,“MSCANReceiver Flag Register (CANRFLG)”). 10.3.2.7 MSCAN Transmitter Flag Register (CANTFLG) The transmit buffer empty flags each have an associated interrupt enable bit in the CANTIER register. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 0 TXE2 TXE1 TXE0 W Reset: 0 0 0 0 0 1 1 1 = Unimplemented Figure10-10. MSCAN Transmitter Flag Register (CANTFLG) NOTE The CANTFLG register is held in the reset state when the initialization modeisactive(INITRQ=1andINITAK=1).Thisregisteriswritablewhen not in initialization mode (INITRQ = 0 and INITAK = 0). Read: Anytime Write:AnytimeforTXExflagswhennotininitializationmode;writeof1clearsflag,writeof0isignored 302 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-11. CANTFLG Register Field Descriptions Field Description 2:0 TransmitterBufferEmpty—Thisflagindicatesthattheassociatedtransmitmessagebufferisempty,andthus TXE[2:0] notscheduledfortransmission.TheCPUmustcleartheflagafteramessageissetupinthetransmitbufferand isduefortransmission.TheMSCANsetstheflagafterthemessageissentsuccessfully.Theflagisalsosetby the MSCAN when the transmission request is successfully aborted due to a pending abort request (see Section10.3.2.9, “MSCAN Transmitter Message Abort Request Register (CANTARQ)”). If not masked, a transmit interrupt is pending while this flag is set. Clearing a TXEx flag also clears the corresponding ABTAKx (seeSection10.3.2.10, “MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK)”). When a TXEx flag is set, the corresponding ABTRQx bit is cleared (seeSection10.3.2.9, “MSCAN Transmitter Message Abort Request Register (CANTARQ)”). When listen-mode is active (seeSection10.3.2.2, “MSCAN Control Register 1 (CANCTL1)”) the TXEx flags cannot be cleared and no transmission is started. Read and write accesses to the transmit buffer will be blocked, if the corresponding TXEx bit is cleared (TXEx=0) and the buffer is scheduled for transmission. 0 The associated message buffer is full (loaded with a message due for transmission) 1 The associated message buffer is empty (not scheduled) 10.3.2.8 MSCAN Transmitter Interrupt Enable Register (CANTIER) This register contains the interrupt enable bits for the transmit buffer empty interrupt flags. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 0 0 TXEIE2 TXEIE1 TXEIE0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-11. MSCAN Transmitter Interrupt Enable Register (CANTIER) NOTE TheCANTIERregisterisheldintheresetstatewhentheinitializationmode isactive(INITRQ=1andINITAK=1).Thisregisteriswritablewhennot in initialization mode (INITRQ = 0 and INITAK = 0). Read: Anytime Write: Anytime when not in initialization mode Table10-12. CANTIER Register Field Descriptions Field Description 2:0 Transmitter Empty Interrupt Enable TXEIE[2:0] 0 No interrupt request is generated from this event. 1 A transmitter empty (transmit buffer available for transmission) event causes a transmitter empty interrupt request. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 303 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.9 MSCAN Transmitter Message Abort Request Register (CANTARQ) The CANTARQ register allows abort request of queued messages as described below. Module Base + 0x0008 7 6 5 4 3 2 1 0 R 0 0 0 0 0 ABTRQ2 ABTRQ1 ABTRQ0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-12. MSCAN Transmitter Message Abort Request Register (CANTARQ) NOTE The CANTARQ register is held in the reset state when the initialization modeisactive(INITRQ=1andINITAK=1).Thisregisteriswritablewhen not in initialization mode (INITRQ = 0 and INITAK = 0). Read: Anytime Write: Anytime when not in initialization mode Table10-13. CANTARQ Register Field Descriptions Field Description 2:0 Abort Request — The CPU sets the ABTRQx bit to request that a scheduled message buffer (TXEx=0) be ABTRQ[2:0] aborted. The MSCAN grants the request if the message has not already started transmission, or if the transmission is not successful (lost arbitration or error). When a message is aborted, the associated TXE (see Section10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and abort acknowledge flags (ABTAK, see Section10.3.2.10, “MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK)”) are set and a transmitinterruptoccursifenabled.TheCPUcannotresetABTRQx.ABTRQxisresetwhenevertheassociated TXE flag is set. 0 No abort request 1 Abort request pending 304 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.10 MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK) The CANTAAK register indicates the successful abort of a queued message, if requested by the appropriate bits in the CANTARQ register. Module Base + 0x0009 7 6 5 4 3 2 1 0 R 0 0 0 0 0 ABTAK2 ABTAK1 ABTAK0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-13. MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK) NOTE The CANTAAK register is held in the reset state when the initialization mode is active (INITRQ = 1 and INITAK = 1). Read: Anytime Write: Unimplemented for ABTAKx flags Table10-14. CANTAAK Register Field Descriptions Field Description 2:0 Abort Acknowledge — This flag acknowledges that a message was aborted due to a pending abort request ABTAK[2:0] from the CPU. After a particular message buffer is flagged empty, this flag can be used by the application software to identify whether the message was aborted successfully or was sent anyway. The ABTAKx flag is cleared whenever the corresponding TXE flag is cleared. 0 The message was not aborted. 1 The message was aborted. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 305 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.11 MSCAN Transmit Buffer Selection Register (CANTBSEL) The CANTBSEL register allows the selection of the actual transmit message buffer, which then will be accessible in the CANTXFG register space. Module Base + 0x000A 7 6 5 4 3 2 1 0 R 0 0 0 0 0 TX2 TX1 TX0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-14. MSCAN Transmit Buffer Selection Register (CANTBSEL) NOTE The CANTBSEL register is held in the reset state when the initialization modeisactive(INITRQ=1andINITAK=1).Thisregisteriswritablewhen not in initialization mode (INITRQ = 0 and INITAK = 0). Read: Find the lowest ordered bit set to 1, all other bits will be read as 0 Write: Anytime when not in initialization mode Table10-15. CANTBSEL Register Field Descriptions Field Description 2:0 Transmit Buffer Select — The lowest numbered bit places the respective transmit buffer in the CANTXFG TX[2:0] register space (e.g., TX1 = 1 and TX0 = 1 selects transmit buffer TX0; TX1 = 1 and TX0 = 0 selects transmit bufferTX1).Readandwriteaccessestotheselectedtransmitbufferwillbeblocked,ifthecorrespondingTXEx bit is cleared and the buffer is scheduled for transmission (seeSection10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”). 0 The associated message buffer is deselected 1 The associated message buffer is selected, if lowest numbered bit The following gives a short programming example of the usage of the CANTBSEL register: Togetthenextavailabletransmitbuffer,applicationsoftwaremustreadtheCANTFLGregisterandwrite thisvaluebackintotheCANTBSELregister.InthisexampleTxbuffersTX1andTX2areavailable.The valuereadfromCANTFLGistherefore0b0000_0110.WhenwritingthisvaluebacktoCANTBSEL,the TxbufferTX1isselectedintheCANTXFGbecausethelowestnumberedbitsetto1isatbitposition1. Reading back this value out of CANTBSEL results in 0b0000_0010, because only the lowest numbered bit position set to 1 is presented. This mechanism eases the application software the selection of the next available Tx buffer. • LDD CANTFLG; value read is 0b0000_0110 • STD CANTBSEL; value written is 0b0000_0110 • LDD CANTBSEL; value read is 0b0000_0010 If all transmit message buffers are deselected, no accesses are allowed to the CANTXFG registers. 306 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.12 MSCAN Identifier Acceptance Control Register (CANIDAC) The CANIDAC register is used for identifier acceptance control as described below. Module Base + 0x000B 7 6 5 4 3 2 1 0 R 0 0 0 IDHIT2 IDHIT1 IDHIT0 IDAM1 IDAM0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-15. MSCAN Identifier Acceptance Control Register (CANIDAC) Read: Anytime Write:Anytimeininitializationmode(INITRQ=1andINITAK=1),exceptbitsIDHITx,whichareread- only Table10-16. CANIDAC Register Field Descriptions Field Description 5:4 IdentifierAcceptanceMode—TheCPUsetstheseflagstodefinetheidentifieracceptancefilterorganization IDAM[1:0] (seeSection10.4.3,“IdentifierAcceptanceFilter”).Table10-17summarizesthedifferentsettings.Infilterclosed mode, no message is accepted such that the foreground buffer is never reloaded. 2:0 Identifier Acceptance Hit Indicator — The MSCAN sets these flags to indicate an identifier acceptance hit (see IDHIT[2:0] Section10.4.3, “Identifier Acceptance Filter”).Table10-18 summarizes the different settings. Table10-17. Identifier Acceptance Mode Settings IDAM1 IDAM0 Identifier Acceptance Mode 0 0 Two 32-bit acceptance filters 0 1 Four 16-bit acceptance filters 1 0 Eight 8-bit acceptance filters 1 1 Filter closed Table10-18. Identifier Acceptance Hit Indication IDHIT2 IDHIT1 IDHIT0 Identifier Acceptance Hit 0 0 0 Filter 0 hit 0 0 1 Filter 1 hit 0 1 0 Filter 2 hit 0 1 1 Filter 3 hit 1 0 0 Filter 4 hit 1 0 1 Filter 5 hit 1 1 0 Filter 6 hit 1 1 1 Filter 7 hit Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 307 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) The IDHITx indicators are always related to the message in the foreground buffer (RxFG). When a message gets shifted into the foreground buffer of the receiver FIFO the indicators are updated as well. 10.3.2.13 MSCAN Reserved Registers These registers are reserved for factory testing of the MSCAN module and is not available in normal system operation modes. Module Base + 0x000C, 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-16. MSCAN Reserved Registers Read: Always read 0x0000 in normal system operation modes Write: Unimplemented in normal system operation modes NOTE Writing to this register when in special modes can alter the MSCAN functionality. 10.3.2.14 MSCAN Receive Error Counter (CANRXERR) This register reflects the status of the MSCAN receive error counter. Module Base + 0x000E 7 6 5 4 3 2 1 0 R RXERR7 RXERR6 RXERR5 RXERR4 RXERR3 RXERR2 RXERR1 RXERR0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-17. MSCAN Receive Error Counter (CANRXERR) Read: Only when in sleep mode (SLPRQ = 1 and SLPAK = 1) or initialization mode (INITRQ = 1 and INITAK = 1) Write: Unimplemented 308 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) NOTE Reading this register when in any other mode other than sleep or initialization mode may return an incorrect value. For MCUs with dual CPUs, this may result in a CPU fault condition. Writing to this register when in special modes can alter the MSCAN functionality. 10.3.2.15 MSCAN Transmit Error Counter (CANTXERR) This register reflects the status of the MSCAN transmit error counter. Module Base + 0x000F 7 6 5 4 3 2 1 0 R TXERR7 TXERR6 TXERR5 TXERR4 TXERR3 TXERR2 TXERR1 TXERR0 W Reset: 0 0 0 0 0 0 0 0 = Unimplemented Figure10-18. MSCAN Transmit Error Counter (CANTXERR) Read: Only when in sleep mode (SLPRQ = 1 and SLPAK = 1) or initialization mode (INITRQ = 1 and INITAK = 1) Write: Unimplemented NOTE Reading this register when in any other mode other than sleep or initialization mode, may return an incorrect value. For MCUs with dual CPUs, this may result in a CPU fault condition. Writing to this register when in special modes can alter the MSCAN functionality. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 309 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.16 MSCAN Identifier Acceptance Registers (CANIDAR0-7) On reception, each message is written into the background receive buffer. The CPU is only signalled to read the message if it passes the criteria in the identifier acceptance and identifier mask registers (accepted); otherwise, the message is overwritten by the next message (dropped). The acceptance registers of the MSCAN are applied on the IDR0–IDR3 registers (see Section10.3.3.1, “Identifier Registers (IDR0–IDR3)”) of incoming messages in a bit by bit manner (see Section10.4.3, “Identifier Acceptance Filter”). Forextendedidentifiers,allfouracceptanceandmaskregistersareapplied.Forstandardidentifiers,only the first two (CANIDAR0/1, CANIDMR0/1) are applied. Module Base + 0x0010 (CANIDAR0) 0x0011 (CANIDAR1) 0x0012 (CANIDAR2) 0x0013 (CANIDAR3) 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 Figure10-19. MSCAN Identifier Acceptance Registers (First Bank) — CANIDAR0–CANIDAR3 Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table10-19. CANIDAR0–CANIDAR3 Register Field Descriptions Field Description 7:0 AcceptanceCodeBits—AC[7:0]compriseauser-definedsequenceofbitswithwhichthecorrespondingbits AC[7:0] oftherelatedidentifierregister(IDRn)ofthereceivemessagebufferarecompared.Theresultofthiscomparison is then masked with the corresponding identifier mask register. 310 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x0018 (CANIDAR4) 0x0019 (CANIDAR5) 0x001A (CANIDAR6) 0x001B (CANIDAR7) 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 W Reset 0 0 0 0 0 0 0 0 Figure10-20. MSCAN Identifier Acceptance Registers (Second Bank) — CANIDAR4–CANIDAR7 Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table10-20. CANIDAR4–CANIDAR7 Register Field Descriptions Field Description 7:0 AcceptanceCodeBits—AC[7:0]compriseauser-definedsequenceofbitswithwhichthecorrespondingbits AC[7:0] oftherelatedidentifierregister(IDRn)ofthereceivemessagebufferarecompared.Theresultofthiscomparison is then masked with the corresponding identifier mask register. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 311 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.2.17 MSCAN Identifier Mask Registers (CANIDMR0–CANIDMR7) Theidentifiermaskregisterspecifieswhichofthecorrespondingbitsintheidentifieracceptanceregister are relevant for acceptance filtering. To receive standard identifiers in 32 bit filter mode, it is required to programthelastthreebits(AM[2:0])inthemaskregistersCANIDMR1andCANIDMR5to“don’tcare.” Toreceivestandardidentifiersin16bitfiltermode,itisrequiredtoprogramthelastthreebits(AM[2:0]) in the mask registers CANIDMR1, CANIDMR3, CANIDMR5, and CANIDMR7 to “don’t care.” Module Base + 0x0014 (CANIDMR0) 0x0015 (CANIDMR1) 0x0016 (CANIDMR2) 0x0017 (CANIDMR3) 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 Figure10-21. MSCAN Identifier Mask Registers (First Bank) — CANIDMR0–CANIDMR3 Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table10-21. CANIDMR0–CANIDMR3 Register Field Descriptions Field Description 7:0 AcceptanceMaskBits—Ifaparticularbitinthisregisteriscleared,thisindicatesthatthecorrespondingbitin AM[7:0] theidentifieracceptanceregistermustbethesameasitsidentifierbitbeforeamatchisdetected.Themessage isacceptedifallsuchbitsmatch.Ifabitisset,itindicatesthatthestateofthecorrespondingbitintheidentifier acceptance register does not affect whether or not the message is accepted. 0 Match corresponding acceptance code register and identifier bits 1 Ignore corresponding acceptance code register bit 312 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x001C (CANIDMR4) 0x001D (CANIDMR5) 0x001E (CANIDMR6) 0x001F (CANIDMR7) 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 7 6 5 4 3 2 1 0 R AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 W Reset 0 0 0 0 0 0 0 0 Figure10-22. MSCAN Identifier Mask Registers (Second Bank) — CANIDMR4–CANIDMR7 Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table10-22. CANIDMR4–CANIDMR7 Register Field Descriptions Field Description 7:0 AcceptanceMaskBits—Ifaparticularbitinthisregisteriscleared,thisindicatesthatthecorrespondingbitin AM[7:0] theidentifieracceptanceregistermustbethesameasitsidentifierbitbeforeamatchisdetected.Themessage isacceptedifallsuchbitsmatch.Ifabitisset,itindicatesthatthestateofthecorrespondingbitintheidentifier acceptance register does not affect whether or not the message is accepted. 0 Match corresponding acceptance code register and identifier bits 1 Ignore corresponding acceptance code register bit Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 313 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.3 Programmer’s Model of Message Storage The following section details the organization of the receive and transmit message buffers and the associated control registers. To simplify the programmer interface, the receive and transmit message buffers have the same outline. Each message buffer allocates 16 bytes in the memory map containing a 13 byte data structure. An additional transmit buffer priority register (TBPR) is defined for the transmit buffers. Within the last twobytesofthismemorymap,theMSCANstoresaspecial16-bittimestamp,whichissampledfroman internal timer after successful transmission or reception of a message. This feature is only available for transmit and receiver buffers, if the TIME bit is set (see Section10.3.2.1, “MSCAN Control Register 0 (CANCTL0)”). The time stamp register is written by the MSCAN. The CPU can only read these registers. Table10-23. Message Buffer Organization Offset Register Access Address 0x00X0 Identifier Register 0 0x00X1 Identifier Register 1 0x00X2 Identifier Register 2 0x00X3 Identifier Register 3 0x00X4 Data Segment Register 0 0x00X5 Data Segment Register 1 0x00X6 Data Segment Register 2 0x00X7 Data Segment Register 3 0x00X8 Data Segment Register 4 0x00X9 Data Segment Register 5 0x00XA Data Segment Register 6 0x00XB Data Segment Register 7 0x00XC Data Length Register 0x00XD Transmit Buffer Priority Register(1) 0x00XE Time Stamp Register (High Byte)(2) 0x00XF Time Stamp Register (Low Byte)(3) 1. Not applicable for receive buffers 2. Read-only for CPU 3. Read-only for CPU Figure10-23 shows the common 13-byte data structure of receive and transmit buffers for extended identifiers. The mapping of standard identifiers into the IDR registers is shown in Figure10-24. All bits of the receive and transmit buffers are ‘x’ out of reset because of RAM-based implementation1. All reserved or unused bits of the receive and transmit buffers always read ‘x’. 1. Exception: The transmit priority registers are 0 out of reset. 314 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Register Bit 7 6 5 4 3 2 1 Bit0 Name 0x00X0 R ID28 ID27 ID26 ID25 ID24 ID23 ID22 ID21 IDR0 W 0x00X1 R ID20 ID19 ID18 SRR (=1) IDE (=1) ID17 ID16 ID15 IDR1 W 0x00X2 R ID14 ID13 ID12 ID11 ID10 ID9 ID8 ID7 IDR2 W 0x00X3 R ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR IDR3 W 0x00X4 R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR0 W 0x00X5 R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR1 W 0x00X6 R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR2 W 0x00X7 R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR3 W 0x00X8 R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR4 W 0x00X9 R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR5 W 0x00XA R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR6 W 0x00XB R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DSR7 W 0x00XC R DLC3 DLC2 DLC1 DLC0 DLR W = Unused, always read ‘x’ Figure10-23. Receive/Transmit Message Buffer — Extended Identifier Mapping Read: For transmit buffers, anytime when TXEx flag is set (see Section10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section10.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). For receive buffers, only when RXF flag is set (seeSection10.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)”). Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 315 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Write: For transmit buffers, anytime when TXEx flag is set (see Section10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section10.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). Unimplemented for receive buffers. Reset: Undefined (0x00XX) because of RAM-based implementation Register Bit 7 6 5 4 3 2 1 Bit 0 Name IDR0 R ID10 ID9 ID8 ID7 ID6 ID5 ID4 ID3 0x00X0 W IDR1 R ID2 ID1 ID0 RTR IDE (=0) 0x00X1 W IDR2 R 0x00X2 W IDR3 R 0x00X3 W = Unused, always read ‘x’ Figure10-24. Receive/Transmit Message Buffer — Standard Identifier Mapping 10.3.3.1 Identifier Registers (IDR0–IDR3) Theidentifierregistersforanextendedformatidentifierconsistofatotalof32bits;ID[28:0],SRR,IDE, andRTRbits.Theidentifierregistersforastandardformatidentifierconsistofatotalof13bits;ID[10:0], RTR, and IDE bits. 10.3.3.1.1 IDR0–IDR3 for Extended Identifier Mapping Module Base + 0x00X1 7 6 5 4 3 2 1 0 R ID28 ID27 ID26 ID25 ID24 ID23 ID22 ID21 W Reset: x x x x x x x x Figure10-25. Identifier Register 0 (IDR0) — Extended Identifier Mapping Table10-24. IDR0 Register Field Descriptions— Extended Field Description 7:0 Extended Format Identifier —The identifiers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the ID[28:21] most significant bit and is transmitted first on the CAN bus during the arbitration procedure. The priority of an identifier is defined to be highest for the smallest binary number. 316 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x00X1 7 6 5 4 3 2 1 0 R ID20 ID19 ID18 SRR (=1) IDE (=1) ID17 ID16 ID15 W Reset: x x x x x x x x Figure10-26. Identifier Register 1 (IDR1) — Extended Identifier Mapping Table10-25. IDR1 Register Field Descriptions— Extended Field Description 7:5 Extended Format Identifier —The identifiers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the ID[20:18] most significant bit and is transmitted first on the CAN bus during the arbitration procedure. The priority of an identifier is defined to be highest for the smallest binary number. 4 Substitute Remote Request — This fixed recessive bit is used only in extended format. It must be set to 1 by SRR the user for transmission buffers and is stored as received on the CAN bus for receive buffers. 3 IDExtended—Thisflagindicateswhethertheextendedorstandardidentifierformatisappliedinthisbuffer.In IDE the case of a receive buffer, the flag is set as received and indicates to the CPU how to process the buffer identifierregisters.Inthecaseofatransmitbuffer,theflagindicatestotheMSCANwhattypeofidentifiertosend. 0 Standard format (11 bit) 1 Extended format (29 bit) 2:0 Extended Format Identifier —The identifiers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the ID[17:15] most significant bit and is transmitted first on the CAN bus during the arbitration procedure. The priority of an identifier is defined to be highest for the smallest binary number. Module Base + 0x00X2 7 6 5 4 3 2 1 0 R ID14 ID13 ID12 ID11 ID10 ID9 ID8 ID7 W Reset: x x x x x x x x Figure10-27. Identifier Register 2 (IDR2) — Extended Identifier Mapping Table10-26. IDR2 Register Field Descriptions— Extended Field Description 7:0 Extended Format Identifier —The identifiers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the ID[14:7] most significant bit and is transmitted first on the CAN bus during the arbitration procedure. The priority of an identifier is defined to be highest for the smallest binary number. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 317 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x00X3 7 6 5 4 3 2 1 0 R ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR W Reset: x x x x x x x x Figure10-28. Identifier Register 3 (IDR3) — Extended Identifier Mapping Table10-27. IDR3 Register Field Descriptions— Extended Field Description 7:1 Extended Format Identifier —The identifiers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the ID[6:0] most significant bit and is transmitted first on the CAN bus during the arbitration procedure. The priority of an identifier is defined to be highest for the smallest binary number. 0 Remote Transmission Request — This flag reflects the status of the remote transmission request bit in the RTR CAN frame. In the case of a receive buffer, it indicates the status of the received frame and supports the transmission of an answering frame in software. In the case of a transmit buffer, this flag defines the setting of the RTR bit to be sent. 0 Data frame 1 Remote frame 10.3.3.1.2 IDR0–IDR3 for Standard Identifier Mapping Module Base + 0x00X0 7 6 5 4 3 2 1 0 R ID10 ID9 ID8 ID7 ID6 ID5 ID4 ID3 W Reset: x x x x x x x x Figure10-29. Identifier Register 0 — Standard Mapping Table10-28. IDR0 Register Field Descriptions— Standard Field Description 7:0 Standard Format Identifier —The identifiers consist of 11 bits (ID[10:0]) for the standard format. ID10 is the ID[10:3] most significant bit and is transmitted first on the CAN bus during the arbitration procedure. The priority of an identifier is defined to be highest for the smallest binary number. See also ID bits inTable10-29. 318 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x00X1 7 6 5 4 3 2 1 0 R ID2 ID1 ID0 RTR IDE (=0) W Reset: x x x x x x x x = Unused; always read ‘x’ Figure10-30. Identifier Register 1 — Standard Mapping Table10-29. IDR1 Register Field Descriptions Field Description 7:5 Standard Format Identifier —The identifiers consist of 11 bits (ID[10:0]) for the standard format. ID10 is the ID[2:0] most significant bit and is transmitted first on the CAN bus during the arbitration procedure. The priority of an identifier is defined to be highest for the smallest binary number. See also ID bits inTable10-28. 4 RemoteTransmissionRequest—ThisflagreflectsthestatusoftheRemoteTransmissionRequestbitinthe RTR CAN frame. In the case of a receive buffer, it indicates the status of the received frame and supports the transmission of an answering frame in software. In the case of a transmit buffer, this flag defines the setting of the RTR bit to be sent. 0 Data frame 1 Remote frame 3 IDExtended—Thisflagindicateswhethertheextendedorstandardidentifierformatisappliedinthisbuffer.In IDE the case of a receive buffer, the flag is set as received and indicates to the CPU how to process the buffer identifierregisters.Inthecaseofatransmitbuffer,theflagindicatestotheMSCANwhattypeofidentifiertosend. 0 Standard format (11 bit) 1 Extended format (29 bit) Module Base + 0x00X2 7 6 5 4 3 2 1 0 R W Reset: x x x x x x x x = Unused; always read ‘x’ Figure10-31. Identifier Register 2 — Standard Mapping Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 319 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x00X3 7 6 5 4 3 2 1 0 R W Reset: x x x x x x x x = Unused; always read ‘x’ Figure10-32. Identifier Register 3 — Standard Mapping 10.3.3.2 Data Segment Registers (DSR0-7) The eight data segment registers, each with bits DB[7:0], contain the data to be transmitted or received. The number of bytes to be transmitted or received is determined by the data length code in the corresponding DLR register. Module Base + 0x0004 (DSR0) 0x0005 (DSR1) 0x0006 (DSR2) 0x0007 (DSR3) 0x0008 (DSR4) 0x0009 (DSR5) 0x000A (DSR6) 0x000B (DSR7) 7 6 5 4 3 2 1 0 R DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 W Reset: x x x x x x x x Figure10-33. Data Segment Registers (DSR0–DSR7) — Extended Identifier Mapping Table10-30. DSR0–DSR7 Register Field Descriptions Field Description 7:0 Data bits 7:0 DB[7:0] 320 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.3.3.3 Data Length Register (DLR) This register keeps the data length field of the CAN frame. Module Base + 0x00XB 7 6 5 4 3 2 1 0 R DLC3 DLC2 DLC1 DLC0 W Reset: x x x x x x x x = Unused; always read “x” Figure10-34. Data Length Register (DLR) — Extended Identifier Mapping Table10-31. DLR Register Field Descriptions Field Description 3:0 DataLengthCodeBits—Thedatalengthcodecontainsthenumberofbytes(databytecount)oftherespective DLC[3:0] message.Duringthetransmissionofaremoteframe,thedatalengthcodeistransmittedasprogrammedwhile the number of transmitted data bytes is always 0. The data byte count ranges from 0 to 8 for a data frame. Table10-32 shows the effect of setting the DLC bits. Table10-32. Data Length Codes Data Length Code Data Byte Count DLC3 DLC2 DLC1 DLC0 0 0 0 0 0 0 0 0 1 1 0 0 1 0 2 0 0 1 1 3 0 1 0 0 4 0 1 0 1 5 0 1 1 0 6 0 1 1 1 7 1 0 0 0 8 10.3.3.4 Transmit Buffer Priority Register (TBPR) This register defines the local priority of the associated message buffer. The local priority is used for the internalprioritizationprocessoftheMSCANandisdefinedtobehighestforthesmallestbinarynumber. The MSCAN implements the following internal prioritization mechanisms: • All transmission buffers with a cleared TXEx flag participate in the prioritization immediately before the SOF (start of frame) is sent. • The transmission buffer with the lowest local priority field wins the prioritization. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 321 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Incasesofmorethanonebufferhavingthesamelowestpriority,themessagebufferwiththelowerindex number wins. Module Base + 0xXXXD 7 6 5 4 3 2 1 0 R PRIO7 PRIO6 PRIO5 PRIO4 PRIO3 PRIO2 PRIO1 PRIO0 W Reset: 0 0 0 0 0 0 0 0 Figure10-35. Transmit Buffer Priority Register (TBPR) Read: Anytime when TXEx flag is set (seeSection10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section10.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). Write: Anytime when TXEx flag is set (see Section10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section10.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). 10.3.3.5 Time Stamp Register (TSRH–TSRL) If the TIME bit is enabled, the MSCAN will write a time stamp to the respective registers in the active transmit or receive buffer right after the EOF of a valid message on the CAN bus (see Section10.3.2.1, “MSCAN Control Register 0 (CANCTL0)”). In case of a transmission, the CPU can only read the time stamp after the respective transmit buffer has been flagged empty. Thetimervalue,whichisusedforstamping,istakenfromafreerunninginternalCANbitclock.Atimer overrunisnotindicatedbytheMSCAN.Thetimerisreset(allbitssetto0)duringinitializationmode.The CPU can only read the time stamp registers. Module Base + 0xXXXE 7 6 5 4 3 2 1 0 R TSR15 TSR14 TSR13 TSR12 TSR11 TSR10 TSR9 TSR8 W Reset: x x x x x x x x Figure10-36. Time Stamp Register — High Byte (TSRH) Module Base + 0xXXXF 7 6 5 4 3 2 1 0 R TSR7 TSR6 TSR5 TSR4 TSR3 TSR2 TSR1 TSR0 W Reset: x x x x x x x x Figure10-37. Time Stamp Register — Low Byte (TSRL) 322 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Read: Anytime when TXEx flag is set (seeSection10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section10.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). Write: Unimplemented 10.4 Functional Description 10.4.1 General This section provides a complete functional description of the MSCAN. It describes each of the features and modes listed in the introduction. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 323 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.4.2 Message Storage CAN CPU12 Receive / Transmit Memory Mapped Engine I/O Rx0 Rx1 Rx2 MSCAN G Rx3 B Rx4 x R RXF CPU bus G Receiver F x R Tx0 TXE0 G B x T PRIO Tx1 TXE1 CPU bus MSCAN G F x T PRIO Tx2 TXE2 G B Transmitter x PRIO T Figure10-38. User Model for Message Buffer Organization MSCAN facilitates a sophisticated message storage system which addresses the requirements of a broad range of network applications. 324 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.4.2.1 Message Transmit Background Modern application layer software is built upon two fundamental assumptions: • AnyCANnodeisabletosendoutastreamofscheduledmessageswithoutreleasingtheCANbus between the two messages. Such nodes arbitrate for the CAN bus immediately after sending the previous message and only release the CAN bus in case of lost arbitration. • The internal message queue within any CAN node is organized such that the highest priority message is sent out first, if more than one message is ready to be sent. Thebehaviordescribedinthebulletsabovecannotbeachievedwithasingletransmitbuffer.Thatbuffer mustbereloadedimmediatelyafterthepreviousmessageissent.Thisloadingprocesslastsafiniteamount of time and must be completed within the inter-frame sequence (IFS) to be able to send an uninterrupted stream of messages. Even if this is feasible for limited CAN bus speeds, it requires that the CPU reacts with short latencies to the transmit interrupt. A double buffer scheme de-couples the reloading of the transmit buffer from the actual message sending and, therefore, reduces the reactiveness requirements of the CPU. Problems can arise if the sending of a message is finished while the CPU re-loads the second buffer. No buffer would then be ready for transmission, and the CAN bus would be released. At least three transmit buffers are required to meet the first of the above requirements under all circumstances. The MSCAN has three transmit buffers. ThesecondrequirementcallsforsomesortofinternalprioritizationwhichtheMSCANimplementswith the “local priority” concept described in Section10.4.2.2, “Transmit Structures.” 10.4.2.2 Transmit Structures The MSCAN triple transmit buffer scheme optimizes real-time performance by allowing multiple messages to be set up in advance. The three buffers are arranged as shown in Figure10-38. All three buffers have a 13-byte data structure similar to the outline of the receive buffers (see Section10.3.3, “Programmer’s Model of Message Storage”). An additionalSection10.3.3.4, “Transmit Buffer Priority Register (TBPR) contains an 8-bit local priority field (PRIO) (see Section10.3.3.4, “Transmit Buffer Priority Register (TBPR)”). The remaining two bytes are used for time stamping of a message, if required (seeSection10.3.3.5, “Time Stamp Register (TSRH–TSRL)”). To transmit a message, the CPU must identify an available transmit buffer, which is indicated by a set transmitter buffer empty (TXEx) flag (see Section10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”).Ifatransmitbufferisavailable,theCPUmustsetapointertothisbufferbywritingtothe CANTBSEL register (seeSection10.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). This makes the respective buffer accessible within the CANTXFG address space (see Section10.3.3,“Programmer’sModelofMessageStorage”).Thealgorithmicfeatureassociatedwiththe CANTBSEL register simplifies the transmit buffer selection. In addition, this scheme makes the handler software simpler because only one address area is applicable for the transmit process, and the required address space is minimized. The CPU then stores the identifier, the control bits, and the data content into one of the transmit buffers. Finally, the buffer is flagged as ready for transmission by clearing the associated TXE flag. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 325 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) The MSCAN then schedules the message for transmission and signals the successful transmission of the bufferbysettingtheassociatedTXEflag.Atransmitinterrupt(seeSection10.4.7.2,“TransmitInterrupt”) is generated1 when TXEx is set and can be used to drive the application software to re-load the buffer. IfmorethanonebufferisscheduledfortransmissionwhentheCANbusbecomesavailableforarbitration, the MSCAN uses the local priority setting of the three buffers to determine the prioritization. For this purpose,everytransmitbufferhasan8-bitlocalpriorityfield(PRIO).Theapplicationsoftwareprograms this field when the message is set up. The local priority reflects the priority of this particular message relativetothesetofmessagesbeingtransmittedfromthisnode.ThelowestbinaryvalueofthePRIOfield is defined to be the highest priority. The internal scheduling process takes place whenever the MSCAN arbitrates for the CAN bus. This is also the case after the occurrence of a transmission error. Whenahighprioritymessageisscheduledbytheapplicationsoftware,itmaybecomenecessarytoabort a lower priority message in one of the three transmit buffers. Because messages that are already in transmissioncannotbeaborted,theusermustrequesttheabortbysettingthecorrespondingabortrequest bit (ABTRQ) (seeSection10.3.2.9, “MSCAN Transmitter Message Abort Request Register (CANTARQ)”.) The MSCAN then grants the request, if possible, by: 1. Setting the corresponding abort acknowledge flag (ABTAK) in the CANTAAK register. 2. Setting the associated TXE flag to release the buffer. 3. Generating a transmit interrupt. The transmit interrupt handler software can determine from the settingoftheABTAKflagwhetherthemessagewasaborted(ABTAK=1)orsent(ABTAK =0). 10.4.2.3 Receive Structures The received messages are stored in a five stage input FIFO. The five message buffers are alternately mapped into a single memory area (see Figure10-38). The background receive buffer (RxBG) is exclusively associated with the MSCAN, but the foreground receive buffer (RxFG) is addressable by the CPU (seeFigure10-38). This scheme simplifies the handler software because only one address area is applicable for the receive process. All receive buffers have a size of 15 bytes to store the CAN control bits, the identifier (standard or extended), the data contents, and a time stamp, if enabled (seeSection10.3.3, “Programmer’s Model of Message Storage”). The receiver full flag (RXF) (seeSection10.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)”) signalsthestatusoftheforegroundreceivebuffer.Whenthebuffercontainsacorrectlyreceivedmessage with a matching identifier, this flag is set. On reception, each message is checked to see whether it passes the filter (see Section10.4.3, “Identifier Acceptance Filter”) and simultaneously is written into the active RxBG. After successful reception of a valid message, the MSCAN shifts the content of RxBG into the receiver FIFO2, sets the RXF flag, and generates a receive interrupt (seeSection10.4.7.3, “Receive Interrupt”) to the CPU3. The user’s receive handler must read the received message from the RxFG and then reset the RXF flag to acknowledge the interruptandtoreleasetheforegroundbuffer.Anewmessage,whichcanfollowimmediatelyaftertheIFS field of the CAN frame, is received into the next available RxBG. If the MSCAN receives an invalid 1. The transmit interrupt occurs only if not masked. A polling scheme can be applied on TXEx also. 2. Only if the RXF flag is not set. 3. The receive interrupt occurs only if not masked. A polling scheme can be applied on RXF also. 326 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) message in its RxBG (wrong identifier, transmission errors, etc.) the actual contents of the buffer will be over-written by the next message. The buffer will then not be shifted into the FIFO. When the MSCAN module is transmitting, the MSCAN receives its own transmitted messages into the backgroundreceivebuffer,RxBG,butdoesnotshiftitintothereceiverFIFO,generateareceiveinterrupt, or acknowledge its own messages on the CAN bus. The exception to this rule is in loopback mode (see Section10.3.2.2,“MSCANControlRegister1(CANCTL1)”)wheretheMSCANtreatsitsownmessages exactlylikeallotherincomingmessages.TheMSCANreceivesitsowntransmittedmessagesintheevent that it loses arbitration. If arbitration is lost, the MSCAN must be prepared to become a receiver. An overrun condition occurs when all receive message buffers in the FIFO are filled with correctly receivedmessageswithacceptedidentifiersandanothermessageiscorrectlyreceivedfromtheCANbus withanacceptedidentifier.Thelattermessageisdiscardedandanerrorinterruptwithoverrunindication is generated if enabled (seeSection10.4.7.5, “Error Interrupt”). The MSCAN remains able to transmit messages while the receiver FIFO being filled, but all incoming messages are discarded. As soon as a receive buffer in the FIFO is available again, new valid messages will be accepted. 10.4.3 Identifier Acceptance Filter The MSCAN identifier acceptance registers (see Section10.3.2.12, “MSCAN Identifier Acceptance Control Register (CANIDAC)”) define the acceptable patterns of the standard or extended identifier (ID[10:0] or ID[28:0]). Any of these bits can be marked ‘don’t care’ in the MSCAN identifier mask registers (see Section10.3.2.17, “MSCAN Identifier Mask Registers (CANIDMR0–CANIDMR7)”). Afilterhitisindicatedtotheapplicationsoftwarebyasetreceivebufferfullflag(RXF=1)andthreebits in the CANIDAC register (see Section10.3.2.12, “MSCAN Identifier Acceptance Control Register (CANIDAC)”). These identifier hit flags (IDHIT[2:0]) clearly identify the filter section that caused the acceptance.Theysimplifytheapplicationsoftware’stasktoidentifythecauseofthereceiverinterrupt.If more than one hit occurs (two or more filters match), the lower hit has priority. A very flexible programmable generic identifier acceptance filter has been introduced to reduce the CPU interrupt loading. The filter is programmable to operate in four different modes (see Bosch CAN 2.0A/B protocol specification): • Two identifier acceptance filters, each to be applied to: — The full 29 bits of the extended identifier and to the following bits of the CAN 2.0B frame: – Remote transmission request (RTR) – Identifier extension (IDE) – Substitute remote request (SRR) — The11bitsofthestandardidentifierplustheRTRandIDEbitsoftheCAN2.0A/Bmessages1. This mode implements two filters for a full length CAN 2.0B compliant extended identifier. Figure10-39 shows how the first 32-bit filter bank (CANIDAR0–CANIDAR3, CANIDMR0–CANIDMR3) produces a filter 0 hit. Similarly, the second filter bank (CANIDAR4–CANIDAR7, CANIDMR4–CANIDMR7) produces a filter 1 hit. • Four identifier acceptance filters, each to be applied to 1. Although this mode can be used for standard identifiers, it is recommended to use the four or eight identifier acceptance filters for standard identifiers Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 327 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) — a)the14mostsignificantbitsoftheextendedidentifierplustheSRRandIDEbitsofCAN2.0B messages or — b) the 11 bits of the standard identifier, the RTR and IDE bits of CAN 2.0A/B messages. Figure10-40 shows how the first 32-bit filter bank (CANIDAR0–CANIDA3, CANIDMR0–3CANIDMR) produces filter 0 and 1 hits. Similarly, the second filter bank (CANIDAR4–CANIDAR7, CANIDMR4–CANIDMR7) produces filter 2 and 3 hits. • Eightidentifieracceptancefilters,eachtobeappliedtothefirst8bitsoftheidentifier.Thismode implements eight independent filters for the first 8 bits of a CAN 2.0A/B compliant standard identifier or a CAN 2.0B compliant extended identifier. Figure 10-41 shows how the first 32-bit filter bank (CANIDAR0–CANIDAR3, CANIDMR0–CANIDMR3) produces filter 0 to 3 hits. Similarly, the second filter bank (CANIDAR4–CANIDAR7, CANIDMR4–CANIDMR7) produces filter 4 to 7 hits. • Closed filter. No CAN message is copied into the foreground buffer RxFG, and the RXF flag is never set. CAN 2.0B Extended Identifier ID28 IDR0 ID21 ID20 IDR1 ID15 ID14 IDR2 ID7 ID6 IDR3 RTR CAN 2.0A/B Standard Identifier ID10 IDR0 ID3 ID2 IDR1 IDE ID10 IDR2 ID3 ID10 IDR3 ID3 AM7 CANIDMR0 AM0 AM7 CANIDMR1 AM0 AM7 CANIDMR2 AM0 AM7 CANIDMR3 AM0 AC7 CANIDAR0 AC0 AC7 CANIDAR1 AC0 AC7 CANIDAR2 AC0 AC7 CANIDAR3 AC0 ID Accepted (Filter 0 Hit) Figure10-39. 32-bit Maskable Identifier Acceptance Filter 328 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) CAN 2.0B Extended Identifier ID28 IDR0 ID21 ID20 IDR1 ID15 ID14 IDR2 ID7 ID6 IDR3 RTR CAN 2.0A/B ID10 IDR0 ID3 ID2 IDR1 IDE ID10 IDR2 ID3 ID10 IDR3 ID3 Standard Identifier AM7 CANIDMR0 AM0 AM7 CANIDMR1 AM0 AC7 CANIDAR0 AC0 AC7 CANIDAR1 AC0 ID Accepted (Filter 0 Hit) AM7 CANIDMR2 AM0 AM7 CANIDMR3 AM0 AC7 CANIDAR2 AC0 AC7 CANIDAR3 AC0 ID Accepted (Filter 1 Hit) Figure10-40. 16-bit Maskable Identifier Acceptance Filters Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 329 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) CAN 2.0B Extended Identifier ID28 IDR0 ID21 ID20 IDR1 ID15 ID14 IDR2 ID7 ID6 IDR3 RTR CAN 2.0A/B ID10 IDR0 ID3 ID2 IDR1 IDE ID10 IDR2 ID3 ID10 IDR3 ID3 Standard Identifier AM7 CIDMR0 AM0 AC7 CIDAR0 AC0 ID Accepted (Filter 0 Hit) AM7 CIDMR1 AM0 AC7 CIDAR1 AC0 ID Accepted (Filter 1 Hit) AM7 CIDMR2 AM0 AC7 CIDAR2 AC0 ID Accepted (Filter 2 Hit) AM7 CIDMR3 AM0 AC7 CIDAR3 AC0 ID Accepted (Filter 3 Hit) Figure10-41. 8-bit Maskable Identifier Acceptance Filters 330 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.4.3.1 Protocol Violation Protection TheMSCANprotectstheuserfromaccidentallyviolatingtheCANprotocolthroughprogrammingerrors. The protection logic implements the following features: • The receive and transmit error counters cannot be written or otherwise manipulated. • AllregisterswhichcontroltheconfigurationoftheMSCANcannotbemodifiedwhiletheMSCAN is on-line. The MSCAN has to be in Initialization Mode. The corresponding INITRQ/INITAK handshake bits in the CANCTL0/CANCTL1 registers (see Section10.3.2.1, “MSCAN Control Register 0 (CANCTL0)”) serve as a lock to protect the following registers: — MSCAN control 1 register (CANCTL1) — MSCAN bus timing registers 0 and 1 (CANBTR0, CANBTR1) — MSCAN identifier acceptance control register (CANIDAC) — MSCAN identifier acceptance registers (CANIDAR0–CANIDAR7) — MSCAN identifier mask registers (CANIDMR0–CANIDMR7) • TheTXCANpinisimmediatelyforcedtoarecessivestatewhentheMSCANgoesintothepower down mode or initialization mode (seeSection10.4.5.6, “MSCAN Power Down Mode,” and Section10.4.5.5, “MSCAN Initialization Mode”). • The MSCAN enable bit (CANE) is writable only once in normal system operation modes, which providesfurther protection against inadvertently disabling the MSCAN. 10.4.3.2 Clock System Figure10-42 shows the structure of the MSCAN clock generation circuitry. MSCAN Bus Clock Time quanta clock (Tq) CANCLK Prescaler (1 .. 64) CLKSRC CLKSRC Oscillator Clock Figure10-42. MSCAN Clocking Scheme Theclocksourcebit(CLKSRC)intheCANCTL1register(10.3.2.2/10-294)defineswhethertheinternal CANCLK is connected to the output of a crystal oscillator (oscillator clock) or to the bus clock. Theclocksourcehastobechosensuchthatthetightoscillatortolerancerequirements(upto0.4%)ofthe CAN protocol are met. Additionally, for high CAN bus rates (1 Mbps), a 45% to 55% duty cycle of the clock is required. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 331 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) If the bus clock is generated from a PLL, it is recommended to select the oscillator clock rather than the bus clock due to jitter considerations, especially at the faster CAN bus rates. For microcontrollers without a clock and reset generator (CRG), CANCLK is driven from the crystal oscillator (oscillator clock). A programmable prescaler generates the time quanta (Tq) clock from CANCLK. A time quantum is the atomic unit of time handled by the MSCAN. Eqn.10-2 f CANCLK = ------------------------------------------------------ Tq (Prescaler value) AbittimeissubdividedintothreesegmentsasdescribedintheBoschCANspecification.(seeFigure10- 43): • SYNC_SEG: This segment has a fixed length of one time quantum. Signal edges are expected to happen within this section. • Time Segment 1: This segment includes the PROP_SEG and the PHASE_SEG1 of the CAN standard.ItcanbeprogrammedbysettingtheparameterTSEG1toconsistof4to16timequanta. • Time Segment 2: This segment represents the PHASE_SEG2 of the CAN standard. It can be programmed by setting the TSEG2 parameter to be 2 to 8 time quanta long. Eqn.10-3 f Tq Bit Rate= --------------------------------------------------------------------------------- (number of Time Quanta) NRZ Signal Time Segment 1 Time Segment 2 SYNC_SEG (PROP_SEG + PHASE_SEG1) (PHASE_SEG2) 1 4 ... 16 2 ... 8 8 ... 25 Time Quanta = 1 Bit Time Transmit Point Sample Point (single or triple sampling) Figure10-43. Segments within the Bit Time 332 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-33. Time Segment Syntax Syntax Description System expects transitions to occur on the CAN bus during this SYNC_SEG period. A node in transmit mode transfers a new value to the CAN bus at Transmit Point this point. A node in receive mode samples the CAN bus at this point. If the Sample Point three samples per bit option is selected, then this point marks the position of the third sample. The synchronization jump width (see the Bosch CAN specification for details) can be programmed in a range of 1 to 4 time quanta by setting the SJW parameter. TheSYNC_SEG,TSEG1,TSEG2,andSJWparametersaresetbyprogrammingtheMSCANbustiming registers(CANBTR0,CANBTR1)(seeSection10.3.2.3,“MSCANBusTimingRegister0(CANBTR0)” and Section10.3.2.4, “MSCAN Bus Timing Register 1 (CANBTR1)”). Table10-34 gives an overview of the CAN compliant segment settings and the related parameter values. NOTE Itistheuser’sresponsibilitytoensurethebittimesettingsareincompliance with the CAN standard. Table10-34. CAN Standard Compliant Bit Time Segment Settings Synchronization Time Segment 1 TSEG1 Time Segment 2 TSEG2 SJW Jump Width 5 .. 10 4 .. 9 2 1 1 .. 2 0 .. 1 4 .. 11 3 .. 10 3 2 1 .. 3 0 .. 2 5 .. 12 4 .. 11 4 3 1 .. 4 0 .. 3 6 .. 13 5 .. 12 5 4 1 .. 4 0 .. 3 7 .. 14 6 .. 13 6 5 1 .. 4 0 .. 3 8 .. 15 7 .. 14 7 6 1 .. 4 0 .. 3 9 .. 16 8 .. 15 8 7 1 .. 4 0 .. 3 10.4.4 Modes of Operation 10.4.4.1 Normal Modes TheMSCANmodulebehavesasdescribedwithinthisspecificationinallnormalsystemoperationmodes. 10.4.4.2 Special Modes TheMSCANmodulebehavesasdescribedwithinthisspecificationinallspecialsystemoperationmodes. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 333 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.4.4.3 Emulation Modes In all emulation modes, the MSCAN module behaves just like normal system operation modes as described within this specification. 10.4.4.4 Listen-Only Mode InanoptionalCANbusmonitoringmode(listen-only),theCANnodeisabletoreceivevaliddataframes and valid remote frames, but it sends only “recessive” bits on the CAN bus. In addition, it cannot start a transmision.IftheMACsub-layerisrequiredtosenda“dominant”bit(ACKbit,overloadflag,oractive errorflag),thebitisreroutedinternallysothattheMACsub-layermonitorsthis“dominant”bit,although the CAN bus may remain in recessive state externally. 10.4.4.5 Security Modes The MSCAN module has no security features. 10.4.5 Low-Power Options If the MSCAN is disabled (CANE = 0), the MSCAN clocks are stopped for power saving. If the MSCAN is enabled (CANE = 1), the MSCAN has two additional modes with reduced power consumption,comparedtonormalmode:sleepandpowerdownmode.Insleepmode,powerconsumption is reduced by stopping all clocks except those to access the registers from the CPU side. In power down mode, all clocks are stopped and no power is consumed. Table10-35 summarizes the combinations of MSCAN and CPU modes. A particular combination of modes is entered by the given settings on the CSWAI and SLPRQ/SLPAK bits. Forallmodes,anMSCANwake-upinterruptcanoccuronlyiftheMSCANisinsleepmode(SLPRQ= 1 and SLPAK = 1), wake-up functionality is enabled (WUPE = 1), and the wake-up interrupt is enabled (WUPIE= 1). 334 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table10-35. CPU vs. MSCAN Operating Modes MSCAN Mode Reduced Power Consumption CPU Mode Normal Disabled Sleep Power Down (CANE=0) CSWAI = X(1) CSWAI = X CSWAI = X RUN SLPRQ = 0 SLPRQ = 1 SLPRQ = X SLPAK = 0 SLPAK = 1 SLPAK = X CSWAI = 0 CSWAI = 0 CSWAI = 1 CSWAI = X WAIT SLPRQ = 0 SLPRQ = 1 SLPRQ = X SLPRQ = X SLPAK = 0 SLPAK = 1 SLPAK = X SLPAK = X CSWAI = X CSWAI = X STOP SLPRQ = X SLPRQ = X SLPAK = X SLPAK = X 1. ‘X’ means don’t care. 10.4.5.1 Operation in Run Mode AsshowninTable10-35,onlyMSCANsleepmodeisavailableaslowpoweroptionwhentheCPUisin run mode. 10.4.5.2 Operation in Wait Mode The WAI instruction puts the MCU in a low power consumption stand-by mode. If the CSWAI bit is set, additional power can be saved in power down mode because the CPU clocks are stopped. After leaving this power down mode, the MSCAN restarts its internal controllers and enters normal mode again. While the CPU is in wait mode, the MSCAN can be operated in normal mode and generate interrupts (registerscanbeaccessedviabackgrounddebugmode).TheMSCANcanalsooperateinanyofthelow- power modes depending on the values of the SLPRQ/SLPAK and CSWAI bits as seen in Table10-35. 10.4.5.3 Operation in Stop Mode The STOP instruction puts the MCU in a low power consumption stand-by mode. In stop mode, the MSCAN is set in power down mode regardless of the value of the SLPRQ/SLPAK and CSWAI bits Table10-35. 10.4.5.4 MSCAN Sleep Mode The CPU can request the MSCAN to enter this low power mode by asserting the SLPRQ bit in the CANCTL0 register. The time when the MSCAN enters sleep mode depends on a fixed synchronization delay and its current activity: Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 335 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) • Ifthereareoneormoremessagebuffersscheduledfortransmission(TXEx=0),theMSCANwill continue to transmit until all transmit message buffers are empty (TXEx = 1, transmitted successfully or aborted) and then goes into sleep mode. • If the MSCANis receiving, it continues to receive and goes into sleep mode as soon as the CAN bus next becomes idle. • If the MSCAN is neither transmitting nor receiving, it immediately goes into sleep mode. Bus Clock Domain CAN Clock Domain SLPRQ SLPRQ SYNC sync. Flag CPU SLPRQ Sleep Request SLPAK sync. SYNC SLPAK Flag SLPAK MSCAN in Sleep Mode Figure10-44. Sleep Request / Acknowledge Cycle NOTE Theapplicationsoftwaremustavoidsettingupatransmission(byclearing oneormoreTXExflag(s))andimmediatelyrequestsleepmode(bysetting SLPRQ).WhethertheMSCANstartstransmittingorgoesintosleepmode directly depends on the exact sequence of operations. Ifsleepmodeisactive,theSLPRQandSLPAKbitsareset(Figure10-44).Theapplicationsoftwaremust use SLPAK as a handshake indication for the request (SLPRQ) to go into sleep mode. Wheninsleepmode(SLPRQ=1andSLPAK=1),theMSCANstopsitsinternalclocks.However,clocks that allow register accesses from the CPU side continue to run. If the MSCAN is in bus-off state, it stops counting the 128 occurrences of 11 consecutive recessive bits due to the stopped clocks. The TXCAN pin remains in a recessive state. If RXF = 1, the message can be read and RXF can be cleared. Shifting a new message into the foreground buffer of the receiver FIFO (RxFG) does not take place while in sleep mode. ItispossibletoaccessthetransmitbuffersandtocleartheassociatedTXEflags.Nomessageaborttakes place while in sleep mode. IftheWUPEbitinCANCLT0isnotasserted,theMSCANwillmaskanyactivityitdetectsonCAN.The RXCAN pin is therefore held internally in a recessive state. This locks the MSCAN in sleep mode (Figure10-45). WUPE must be set before entering sleep mode to take effect. 336 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) The MSCAN is able to leave sleep mode (wake up) only when: • CAN bus activity occurs and WUPE = 1 or • the CPU clears the SLPRQ bit NOTE The CPU cannot clear the SLPRQ bit before sleep mode (SLPRQ = 1 and SLPAK = 1) is active. After wake-up, the MSCAN waits for 11 consecutive recessive bits to synchronize to the CAN bus. As a consequence, if the MSCAN is woken-up by a CAN frame, this frame is not received. Thereceivemessagebuffers(RxFGandRxBG)containmessagesiftheywerereceivedbeforesleepmode wasentered.Allpendingactionswillbeexecuteduponwake-up;copyingofRxBGintoRxFG,message abortsandmessagetransmissions.IftheMSCANremainsinbus-offstateaftersleepmodewasexited,it continues counting the 128 occurrences of 11 consecutive recessive bits. CAN Activity (CAN Activity & WUPE) |SLPRQ Wait StartUp for Idle CAN Activity SLPRQ CAN Activity & Idle Sleep SLPRQ (CAN Activity &WUPE) | CAN Activity CAN Activity & CAN Activity SLPRQ Tx/Rx Message Active CAN Activity Figure10-45. Simplified State Transitions for Entering/Leaving Sleep Mode Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 337 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.4.5.5 MSCAN Initialization Mode Ininitializationmode,anyon-goingtransmissionorreceptionisimmediatelyabortedandsynchronization totheCANbusislost,potentiallycausingCANprotocolviolations.ToprotecttheCANbussystemfrom fatal consequences of violations, the MSCAN immediately drives the TXCAN pin into a recessive state. NOTE The user is responsible for ensuring that the MSCAN is not active when initialization mode is entered. The recommended procedure is to bring the MSCAN into sleep mode (SLPRQ = 1 and SLPAK = 1) before setting the INITRQbitintheCANCTL0register.Otherwise,theabortofanon-going message can cause an error condition and can impact other CAN bus devices. Ininitializationmode,theMSCANisstopped.However,interfaceregistersremainaccessible.Thismode is used to reset the CANCTL0, CANRFLG, CANRIER, CANTFLG, CANTIER, CANTARQ, CANTAAK, and CANTBSEL registers to their default values. In addition, the MSCAN enables the configuration of the CANBTR0, CANBTR1 bit timing registers; CANIDAC; and the CANIDAR, CANIDMR message filters. SeeSection10.3.2.1, “MSCAN Control Register 0 (CANCTL0),” for a detailed description of the initialization mode. Bus Clock Domain CAN Clock Domain INIT INITRQ SYNC sync. Flag CPU INITRQ Init Request INITAK sync. SYNC INITAK Flag INITAK Figure10-46. Initialization Request/Acknowledge Cycle DuetoindependentclockdomainswithintheMSCAN,INITRQmustbesynchronizedtoalldomainsby using a special handshake mechanism. This handshake causes additional synchronization delay (see SectionFigure10-46., “Initialization Request/Acknowledge Cycle”). If there is no message transfer ongoing on the CAN bus, the minimum delay will be two additional bus clocks and three additional CAN clocks. When all parts of the MSCAN are in initialization mode, the INITAK flag is set. The application software must use INITAK as a handshake indication for the request (INITRQ) to go into initialization mode. NOTE TheCPUcannotclearINITRQbeforeinitializationmode(INITRQ=1and INITAK = 1) is active. 338 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.4.5.6 MSCAN Power Down Mode The MSCAN is in power down mode (Table10-35) when • CPU is in stop mode or • CPU is in wait mode and the CSWAI bit is set When entering the power down mode, the MSCAN immediately stops all ongoing transmissions and receptions, potentially causing CAN protocol violations. To protect the CAN bus system from fatal consequences of violations to the above rule, the MSCAN immediately drives the TXCAN pin into a recessive state. NOTE The user is responsible for ensuring that the MSCAN is not active when power down mode is entered. The recommended procedure is to bring the MSCAN into Sleep mode before the STOP or WAI instruction (if CSWAI isset)isexecuted.Otherwise,theabortofanongoingmessagecancausean error condition and impact other CAN bus devices. In power down mode, all clocks are stopped and no registers can be accessed. If the MSCAN was not in sleepmodebeforepowerdownmodebecameactive,themoduleperformsaninternalrecoverycycleafter powering up. This causes some fixed delay before the module enters normal mode again. 10.4.5.7 Programmable Wake-Up Function The MSCAN can be programmed to wake up the MSCAN as soon as CAN bus activity is detected (see control bit WUPE inSection10.3.2.1, “MSCAN Control Register 0 (CANCTL0)”). The sensitivity to existingCANbusactioncanbemodifiedbyapplyingalow-passfilterfunctiontotheRXCANinputline while in sleep mode (see control bit WUPM inSection10.3.2.2, “MSCAN Control Register 1 (CANCTL1)”). ThisfeaturecanbeusedtoprotecttheMSCANfromwake-upduetoshortglitchesontheCANbuslines. Such glitches can result from—for example—electromagnetic interference within noisy environments. 10.4.6 Reset Initialization TheresetstateofeachindividualbitislistedinSection10.3.2,“RegisterDescriptions,”whichdetailsall the registers and their bit-fields. 10.4.7 Interrupts ThissectiondescribesallinterruptsoriginatedbytheMSCAN.Itdocumentstheenablebitsandgenerated flags. Each interrupt is listed and described separately. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 339 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 10.4.7.1 Description of Interrupt Operation TheMSCANsupportsfourinterruptvectors(seeTable10-36),anyofwhichcanbeindividuallymasked (for details see sections from Section10.3.2.6, “MSCAN Receiver Interrupt Enable Register (CANRIER),” toSection10.3.2.8, “MSCAN Transmitter Interrupt Enable Register (CANTIER)”). NOTE The dedicated interrupt vector addresses are defined in the Resets and Interrupts chapter. Table10-36. Interrupt Vectors Interrupt Source CCR Mask Local Enable Wake-Up Interrupt (WUPIF) I bit CANRIER (WUPIE) Error Interrupts Interrupt (CSCIF, OVRIF) I bit CANRIER (CSCIE, OVRIE) Receive Interrupt (RXF) I bit CANRIER (RXFIE) Transmit Interrupts (TXE[2:0]) I bit CANTIER (TXEIE[2:0]) 10.4.7.2 Transmit Interrupt Atleastoneofthethreetransmitbuffersisempty(notscheduled)andcanbeloadedtoscheduleamessage for transmission. The TXEx flag of the empty message buffer is set. 10.4.7.3 Receive Interrupt A message is successfully received and shifted into the foreground buffer (RxFG) of the receiver FIFO. ThisinterruptisgeneratedimmediatelyafterreceivingtheEOFsymbol.TheRXFflagisset.Ifthereare multiple messages in the receiver FIFO, the RXF flag is set as soon as the next message is shifted to the foreground buffer. 10.4.7.4 Wake-Up Interrupt A wake-up interrupt is generated if activity on the CAN bus occurs during MSCN internal sleep mode. WUPE (see Section10.3.2.1, “MSCAN Control Register 0 (CANCTL0)”) must be enabled. 10.4.7.5 Error Interrupt An error interrupt is generated if an overrun of the receiver FIFO, error, warning, or bus-off condition occurrs. Section10.3.2.5, “MSCAN Receiver Flag Register (CANRFLG) indicates one of the following conditions: • Overrun—AnoverrunconditionofthereceiverFIFOasdescribedinSection10.4.2.3,“Receive Structures,” occurred. • CAN Status Change — The actual value of the transmit and receive error counters control the CAN bus state of the MSCAN. As soon as the error counters skip into a critical range (Tx/Rx- warning, Tx/Rx-error, bus-off) the MSCAN flags an error condition. The status change, which caused the error condition, is indicated by the TSTAT and RSTAT flags (see Section10.3.2.5, 340 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) “MSCAN Receiver Flag Register (CANRFLG)” andSection10.3.2.6, “MSCAN Receiver Interrupt Enable Register (CANRIER)”). 10.4.7.6 Interrupt Acknowledge Interrupts are directly associated with one or more status flags in either the Section10.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)” or theSection10.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG).” Interrupts are pending as long as one of the corresponding flags is set. The flags in CANRFLGandCANTFLGmustberesetwithintheinterrupthandlertohandshaketheinterrupt.Theflags are reset by writing a 1 to the corresponding bit position. A flag cannot be cleared if the respective condition prevails. NOTE It must be guaranteed that the CPU clears only the bit causing the current interrupt.Forthisreason,bitmanipulationinstructions(BSET)mustnotbe used to clear interrupt flags. These instructions may cause accidental clearing of interrupt flags which are set after entering the current interrupt service routine. 10.4.7.7 Recovery from Stop or Wait TheMSCANcanrecoverfromstoporwaitviathewake-upinterrupt.Thisinterruptcanonlyoccurifthe MSCAN was in sleep mode (SLPRQ = 1 and SLPAK = 1) before entering power down mode, the wake- up option is enabled (WUPE = 1), and the wake-up interrupt is enabled (WUPIE = 1). 10.5 Initialization/Application Information 10.5.1 MSCAN initialization The procedure to initially start up the MSCAN module out of reset is as follows: 1. Assert CANE 2. Write to the configuration registers in initialization mode 3. Clear INITRQ to leave initialization mode and enter normal mode If the configuration of registers which are writable in initialization mode needs to be changed only when the MSCAN module is in normal mode: 1. BringthemoduleintosleepmodebysettingSLPRQandawaitingSLPAKtoassertaftertheCAN bus becomes idle. 2. Enter initialization mode: assert INITRQ and await INITAK 3. Write to the configuration registers in initialization mode 4. Clear INITRQ to leave initialization mode and continue in normal mode Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 341 Rev 01.24

Chapter10 Freescale’s Scalable Controller Area Network (S12MSCANV2) 342 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 11 Oscillator (OSCV2) Block Description 11.1 Introduction The OSCV2 module provides two alternative oscillator concepts: • A low noise and low power Colpitts oscillator with amplitude limitation control (ALC) • A robust full swing Pierce oscillator with the possibility to feed in an external square wave 11.1.1 Features The Colpitts OSCV2 option provides the following features: • Amplitude limitation control (ALC) loop: — Low power consumption and low current induced RF emission — Sinusoidal waveform with low RF emission — Low crystal stress (an external damping resistor is not required) — Normal and low amplitude mode for further reduction of power and emission • An external biasing resistor is not required The Pierce OSC option provides the following features: • Wider high frequency operation range • No DC voltage applied across the crystal • Full rail-to-rail (2.5V nominal) swing oscillation with low EM susceptibility • Fast start up Common features: • Clock monitor (CM) • Operation from the V 2.5 V (nominal) supply rail DDPLL 11.1.2 Modes of Operation Two modes of operation exist: • Amplitude limitation controlled Colpitts oscillator mode suitable for power and emission critical applications • Full swing Pierce oscillator mode that can also be used to feed in an externally generated square wave suitable for high frequency operation and harsh environments Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 343 Rev 01.24

Chapter11 Oscillator (OSCV2) Block Description 11.2 External Signal Description This section lists and describes the signals that connect off chip. 11.2.1 V and V — PLL Operating Voltage, PLL Ground DDPLL SSPLL These pins provide the operating voltage (V ) and ground (V ) for the OSCV2 circuitry. This DDPLL SSPLL allows the supply voltage to the OSCV2 to be independently bypassed. 11.2.2 EXTAL and XTAL — Clock/Crystal Source Pins These pins provide the interface for either a crystal or a CMOS compatible clock to control the internal clockgeneratorcircuitry.EXTAListheexternalclockinputortheinputtothecrystaloscillatoramplifier. XTAListheoutputofthecrystaloscillatoramplifier.AlltheMCUinternalsystemclocksarederivedfrom the EXTAL input frequency. In full stop mode (PSTP = 0) the EXTAL pin is pulled down by an internal resistor of typical 200 kΩ. NOTE Freescale Semiconductor recommends an evaluation of the application board and chosen resonator or crystal by the resonator or crystal supplier. The Crystal circuit is changed from standard. The Colpitts circuit is not suited for overtone resonators and crystals. EXTAL CDC* C1 Crystal or Ceramic MCU Resonator XTAL C2 V SSPLL *Due to the nature of a translated ground Colpitts oscillator a DC voltage bias is applied to the crystal. Please contact the crystal manufacturer for crystal DC bias conditions and recommended capacitor value CDC. Figure11-1. Colpitts Oscillator Connections (XCLKS = 0) NOTE ThePiercecircuitisnotsuitedforovertoneresonatorsandcrystalswithout a careful component selection. 344 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter11 Oscillator (OSCV2) Block Description EXTAL C3 MCU Crystal or Ceramic RB Resonator RS* XTAL C4 V SSPLL * Rs can be zero (shorted) when used with higher frequency crystals. Refer to manufacturer’s data. Figure11-2. Pierce Oscillator Connections (XCLKS = 1) CMOS-Compatible EXTAL External Oscillator (V Level) DDPLL MCU XTAL Not Connected Figure11-3. External Clock Connections (XCLKS = 1) 11.2.3 XCLKS — Colpitts/Pierce Oscillator Selection Signal TheXCLKSisaninputsignalwhichcontrolswhetheracrystalincombinationwiththeinternalColpitts (lowpower)oscillatorisusedorwhetherthePierceoscillator/externalclockcircuitryisused.TheXCLKS signal is sampled during reset with the rising edge ofRESET. Table11-1 lists the state coding of the sampled XCLKS signal. Refer to the device overview chapter for polarity of the XCLKS pin. Table11-1. Clock Selection Based on XCLKS XCLKS Description 0 Colpitts oscillator selected 1 Pierce oscillator/external clock selected Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 345 Rev 01.24

Chapter11 Oscillator (OSCV2) Block Description 11.3 Memory Map and Register Definition The CRG contains the registers and associated bits for controlling and monitoring the OSCV2 module. 11.4 Functional Description TheOSCV2blockhastwoexternalpins,EXTALandXTAL.Theoscillatorinputpin,EXTAL,isintended tobeconnectedtoeitheracrystaloranexternalclocksource.TheselectionofColpittsoscillatororPierce oscillator/external clock depends on the XCLKS signal which is sampled during reset. The XTAL pin is an output signal that provides crystal circuit feedback. AbufferedEXTALsignal,OSCCLK,becomestheinternalreferenceclock.Toimprovenoiseimmunity, the oscillator is powered by the V and V power supply pins. DDPLL SSPLL The Pierce oscillator can be used for higher frequencies compared to the low power Colpitts oscillator. 11.4.1 Amplitude Limitation Control (ALC) The Colpitts oscillator is equipped with a feedback system which does not waste current by generating harmonics. Its configuration is “Colpitts oscillator with translated ground.” The transconductor used is driven by a current source under the control of a peak detector which will measure the amplitude of the ACsignalappearingonEXTALnodeinordertoimplementanamplitudelimitationcontrol(ALC)loop. TheALCloopisinchargeofreducingthequiescentcurrentinthetransconductorasaresultofanincrease intheoscillationamplitude.Theoscillationamplitudecanbelimitedtotwovalues.Thenormalamplitude which is intended for non power saving modes and a small amplitude which is intended for low power operationmodes.PleaserefertotheCRGblockdescriptionchapterforthecontrolandassignmentofthe amplitude value to operation modes. 11.4.2 Clock Monitor (CM) Theclockmonitorcircuitisbasedonaninternalresistor-capacitor(RC)timedelaysothatitcanoperate withoutanyMCUclocks.IfnoOSCCLKedgesaredetectedwithinthisRCtimedelay,theclockmonitor indicates a failure which asserts self clock mode or generates a system reset depending on the state of SCMEbit.Iftheclockmonitorisdisabledorthepresenceofclocksisdetectednofailureisindicated.The clockmonitorfunctionisenabled/disabledbytheCMEcontrolbit,describedintheCRGblockdescription chapter. 11.5 Interrupts OSCV2 contains a clock monitor, which can trigger an interrupt or reset. The control bits and status bits for the clock monitor are described in the CRG block description chapter. 346 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.1 Introduction Thepulsewidthmodulation(PWM)definitionisbasedontheHC12PWMdefinitions.ThePWM8B6CV1 module contains the basic features from the HC11 with some of the enhancements incorporated on the HC12,thatiscenteralignedoutputmodeandfouravailableclocksources.ThePWM8B6CV1modulehas six channels with independent control of left and center aligned outputs on each channel. EachofthesixPWMchannelshasaprogrammableperiodanddutycycleaswellasadedicatedcounter. A flexible clock select scheme allows a total of four different clock sources to be used with the counters. Eachofthemodulatorscancreateindependentcontinuouswaveformswithsoftware-selectabledutyrates from0%to100%.ThePWMoutputscanbeprogrammedasleftalignedoutputsorcenteralignedoutputs 12.1.1 Features • Six independent PWM channels with programmable period and duty cycle • Dedicated counter for each PWM channel • Programmable PWM enable/disable for each channel • Software selection of PWM duty pulse polarity for each channel • Periodanddutycyclearedoublebuffered.Changetakeseffectwhentheendoftheeffectiveperiod is reached (PWM counter reaches 0) or when the channel is disabled. • Programmable center or left aligned outputs on individual channels • Six 8-bit channel or three 16-bit channel PWM resolution • Four clock sources (A, B, SA, and SB) provide for a wide range of frequencies. • Programmable clock select logic • Emergency shutdown 12.1.2 Modes of Operation Thereisasoftwareprogrammableoptionforlowpowerconsumptioninwaitmodethatdisablestheinput clock to the prescaler. Infreezemodethereisasoftwareprogrammableoptiontodisabletheinputclocktotheprescaler.Thisis useful for emulation. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 347 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.1.3 Block Diagram PWM8B6C PWM Channels Channel 5 PWM5 Period and Duty Counter Bus Clock PWM Clock Clock Select Channel 4 PWM4 Period and Duty Counter Control Channel 3 PWM3 Period and Duty Counter Channel 2 PWM2 Period and Duty Counter Enable Channel 1 Polarity PWM1 Period and Duty Counter Alignment Channel 0 PWM0 Period and Duty Counter Figure12-1. PWM8B6CV1 Block Diagram 12.2 External Signal Description The PWM8B6CV1 module has a total of six external pins. 12.2.1 PWM5 — Pulse Width Modulator Channel 5 Pin This pin serves as waveform output of PWM channel 5 and as an input for the emergency shutdown feature. 12.2.2 PWM4 — Pulse Width Modulator Channel 4 Pin This pin serves as waveform output of PWM channel 4. 12.2.3 PWM3 — Pulse Width Modulator Channel 3 Pin This pin serves as waveform output of PWM channel 3. 348 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.2.4 PWM2 — Pulse Width Modulator Channel 2 Pin This pin serves as waveform output of PWM channel 2. 12.2.5 PWM1 — Pulse Width Modulator Channel 1 Pin This pin serves as waveform output of PWM channel 1. 12.2.6 PWM0 — Pulse Width Modulator Channel 0 Pin This pin serves as waveform output of PWM channel 0. 12.3 Memory Map and Register Definition This subsection describes in detail all the registers and register bits in the PWM8B6CV1 module. The special-purpose registers and register bit functions that would not normally be made available to deviceendusers,suchasfactorytestcontrolregistersandreservedregistersareclearlyidentifiedbymeans of shading the appropriate portions of address maps and register diagrams. Notes explaining the reasons forrestrictingaccesstotheregistersandfunctionsarealsoexplainedintheindividualregisterdescriptions. 12.3.1 Module Memory Map The following paragraphs describe the content of the registers in the PWM8B6CV1 module. The base address of the PWM8B6CV1 module is determined at the MCU level when the MCU is defined. The registerdecodemapisfixedandbeginsatthefirstaddressofthemoduleaddressoffset.Table12-1shows the registers associated with the PWM and their relative offset from the base address. The register detail description follows the order in which they appear in the register map. Reservedbitswithinaregisterwillalwaysreadas0andthewritewillbeunimplemented.Unimplemented functions are indicated by shading the bit. Table12-1 shows the memory map for the PWM8B6CV1 module. NOTE Registeraddress=baseaddress+addressoffset,wherethebaseaddressis defined at the MCU level and the address offset is defined at the module level. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 349 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-1. PWM8B6CV1 Memory Map Address Register Access Offset 0x0000 PWM Enable Register (PWME) R/W 0x0001 PWM Polarity Register (PWMPOL) R/W 0x0002 PWM Clock Select Register (PWMCLK) R/W 0x0003 PWM Prescale Clock Select Register (PWMPRCLK) R/W 0x0004 PWM Center Align Enable Register (PWMCAE) R/W 0x0005 PWM Control Register (PWMCTL) R/W 0x0006 PWM Test Register (PWMTST)(1) R/W 0x0007 PWM Prescale Counter Register (PWMPRSC)(2) R/W 0x0008 PWM Scale A Register (PWMSCLA) R/W 0x0009 PWM Scale B Register (PWMSCLB) R/W 0x000A PWM Scale A Counter Register (PWMSCNTA)(3) R/W 0x000B PWM Scale B Counter Register (PWMSCNTB)(4) R/W 0x000C PWM Channel 0 Counter Register (PWMCNT0) R/W 0x000D PWM Channel 1 Counter Register (PWMCNT1) R/W 0x000E PWM Channel 2 Counter Register (PWMCNT2) R/W 0x000F PWM Channel 3 Counter Register (PWMCNT3) R/W 0x0010 PWM Channel 4 Counter Register (PWMCNT4) R/W 0x0011 PWM Channel 5 Counter Register (PWMCNT5) R/W 0x0012 PWM Channel 0 Period Register (PWMPER0) R/W 0x0013 PWM Channel 1 Period Register (PWMPER1) R/W 0x0014 PWM Channel 2 Period Register (PWMPER2) R/W 0x0015 PWM Channel 3 Period Register (PWMPER3) R/W 0x0016 PWM Channel 4 Period Register (PWMPER4) R/W 0x0017 PWM Channel 5 Period Register (PWMPER5) R/W 0x0018 PWM Channel 0 Duty Register (PWMDTY0) R/W 0x0019 PWM Channel 1 Duty Register (PWMDTY1) R/W 0x001A PWM Channel 2 Duty Register (PWMDTY2) R/W 0x001B PWM Channel 3 Duty Register (PWMDTY3) R/W 0x001C PWM Channel 4 Duty Register (PWMDTY4) R/W 0x001D PWM Channel 5 Duty Register (PWMDTY5) R/W 0x001E PWM Shutdown Register (PWMSDN) R/W 1. PWMTST is intended for factory test purposes only. 2. PWMPRSC is intended for factory test purposes only. 3. PWMSCNTA is intended for factory test purposes only. 4. PWMSCNTB is intended for factory test purposes only. 350 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.3.2 Register Descriptions ThefollowingparagraphsdescribeindetailalltheregistersandregisterbitsinthePWM8B6CV1module. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R 0 0 PWME5 PWME4 PWME3 PWME2 PWME1 PWME0 PWME W 0x0001 R 0 0 PPOL5 PPOL4 PPOL3 PPOL2 PPOL1 PPOL0 PWMPOL W 0x0002 R 0 0 PCLK5 PCLK4 PCLK3 PCLK2 PCLK1 PCLK0 PWMCLK W 0x0003 R 0 0 PCKB2 PCKB1 PCKB0 PCKA2 PCKA1 PCKA0 PWMPRCLK W 0x0004 R 0 0 CAE5 CAE4 CAE2 CAE2 CAE1 CAE0 PWMCAE W 0x0005 R 0 0 0 CON45 CON23 CON01 PSWAI PFRZ PWMCTL W 0x0006 R 0 0 0 0 0 0 0 0 PWMTST W 0x0007 R 0 0 0 0 0 0 0 0 PWMPRSC W 0x0008 R Bit 7 6 5 4 3 2 1 Bit 0 PWMSCLA W 0x0009 R Bit 7 6 5 4 3 2 1 Bit 0 PWMSCLB W 0x000A R 0 0 0 0 0 0 0 0 PWMSCNTA W 0x000B R 0 0 0 0 0 0 0 0 PWMSCNTB W 0x000C R Bit 7 6 5 4 3 2 1 Bit 0 PWMCNT0 W 0 0 0 0 0 0 0 0 0x000D R Bit 7 6 5 4 3 2 1 Bit 0 PWMCNT1 W 0 0 0 0 0 0 0 0 0x000E R Bit 7 6 5 4 3 2 1 Bit 0 PWMCNT2 W 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-2. PWM Register Summary Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 351 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x000F R Bit 7 6 5 4 3 2 1 Bit 0 PWMCNT3 W 0 0 0 0 0 0 0 0 0x0010 R Bit 7 6 5 4 3 2 1 Bit 0 PWMCNT4 W 0 0 0 0 0 0 0 0 0x0011 R Bit 7 6 5 4 3 2 1 Bit 0 PWMCNT5 W 0 0 0 0 0 0 0 0 0x0012 R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER0 W 0x0013 R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER1 W 0x0014 R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER2 W 0x0015 R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER3 W 0x0016 R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER4 W 0x0017 R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER5 W 0x0018 R Bit 7 6 5 4 3 2 1 Bit 0 PWMDTY0 W 0x0019 R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER1 W 0x001A R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER2 W 0x001B R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER3 W 0x001C R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER4 W 0x001D R Bit 7 6 5 4 3 2 1 Bit 0 PWMPER5 W 0x001E R 0 0 PWM5IN PWMIF PWMIE PWMLVL PWM5INL PWM5ENA PWMSDB W PWMRSTRT = Unimplemented or Reserved Figure12-2. PWM Register Summary (continued) 352 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.3.2.1 PWM Enable Register (PWME) Each PWM channel has an enable bit (PWMEx) to start its waveform output. When any of the PWMEx bitsareset(PWMEx=1),theassociatedPWMoutputisenabledimmediately.However,theactualPWM waveformisnotavailableontheassociatedPWMoutputuntilitsclocksourcebeginsitsnextcycledueto the synchronization of PWMEx and the clock source. NOTE The first PWM cycle after enabling the channel can be irregular. Anexceptiontothisiswhenchannelsareconcatenated.Afterconcatenatedmodeisenabled(CONxxbits setinPWMCTLregister),enabling/disablingthecorresponding16-bitPWMchanneliscontrolledbythe low-order PWMEx bit. In this case, the high-order bytes PWMEx bits have no effect and their corresponding PWM output lines are disabled. While in run mode, if all six PWM channels are disabled (PWME5–PWME0 = 0), the prescaler counter shuts off for power savings. Module Base + 0x0000 7 6 5 4 3 2 1 0 R 0 0 PWME5 PWME4 PWME3 PWME2 PWME1 PWME0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-3. PWM Enable Register (PWME) Read: anytime Write: anytime Table12-2. PWME Field Descriptions Field Description 5 Pulse Width Channel 5 Enable PWME5 0 Pulse width channel 5 is disabled. 1 Pulsewidthchannel5isenabled.ThepulsemodulatedsignalbecomesavailableatPWM,outputbit5when its clock source begins its next cycle. 4 Pulse Width Channel 4 Enable PWME4 0 Pulse width channel 4 is disabled. 1 Pulsewidthchannel4isenabled.ThepulsemodulatedsignalbecomesavailableatPWM,outputbit4when itsclocksourcebeginsitsnextcycle.IfCON45=1,thenbithasnoeffectandPWMoutputline4isdisabled. 3 Pulse Width Channel 3 Enable PWME3 0 Pulse width channel 3 is disabled. 1 Pulsewidthchannel3isenabled.ThepulsemodulatedsignalbecomesavailableatPWM,outputbit3when its clock source begins its next cycle. 2 Pulse Width Channel 2 Enable PWME2 0 Pulse width channel 2 is disabled. 1 Pulsewidthchannel2isenabled.ThepulsemodulatedsignalbecomesavailableatPWM,outputbit2when itsclocksourcebeginsitsnextcycle.IfCON23=1,thenbithasnoeffectandPWMoutputline2isdisabled. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 353 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-2. PWME Field Descriptions (continued) Field Description 1 Pulse Width Channel 1 Enable PWME1 0 Pulse width channel 1 is disabled. 1 Pulsewidthchannel1isenabled.ThepulsemodulatedsignalbecomesavailableatPWM,outputbit1when its clock source begins its next cycle. 0 Pulse Width Channel 0 Enable PWME0 0 Pulse width channel 0 is disabled. 1 Pulsewidthchannel0isenabled.ThepulsemodulatedsignalbecomesavailableatPWM,outputbit0when itsclocksourcebeginsitsnextcycle.IfCON01=1,thenbithasnoeffectandPWMoutputline0isdisabled. 12.3.2.2 PWM Polarity Register (PWMPOL) The starting polarity of each PWM channel waveform is determined by the associated PPOLx bit in the PWMPOL register. If the polarity bit is 1, the PWM channel output is high at the beginning of the cycle andthengoeslowwhenthedutycountisreached.Conversely,ifthepolaritybitis0theoutputstartslow and then goes high when the duty count is reached. Module Base + 0x0001 7 6 5 4 3 2 1 0 R 0 0 PPOL5 PPOL4 PPOL3 PPOL2 PPOL1 PPOL0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-4. PWM Polarity Register (PWMPOL) Read: anytime Write: anytime NOTE PPOLxregisterbitscanbewrittenanytime.Ifthepolarityischangedwhile a PWM signal is being generated, a truncated or stretched pulse can occur during the transition Table12-3. PWMPOL Field Descriptions Field Description 5 Pulse Width Channel 5 Polarity PPOL5 0 PWM channel 5 output is low at the beginning of the period, then goes high when the duty count is reached. 1 PWM channel 5 output is high at the beginning of the period, then goes low when the duty count is reached. 4 Pulse Width Channel 4 Polarity PPOL4 0 PWM channel 4 output is low at the beginning of the period, then goes high when the duty count is reached. 1 PWM channel 4 output is high at the beginning of the period, then goes low when the duty count is reached. 354 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-3. PWMPOL Field Descriptions (continued) Field Description 3 Pulse Width Channel 3 Polarity PPOL3 0 PWM channel 3 output is low at the beginning of the period, then goes high when the duty count is reached. 1 PWM channel 3 output is high at the beginning of the period, then goes low when the duty count is reached. 2 Pulse Width Channel 2 Polarity PPOL2 0 PWM channel 2 output is low at the beginning of the period, then goes high when the duty count is reached. 1 PWM channel 2 output is high at the beginning of the period, then goes low when the duty count is reached. 1 Pulse Width Channel 1 Polarity PPOL1 0 PWM channel 1 output is low at the beginning of the period, then goes high when the duty count is reached. 1 PWM channel 1 output is high at the beginning of the period, then goes low when the duty count is reached. 0 Pulse Width Channel 0 Polarity PPOL0 0 PWM channel 0 output is low at the beginning of the period, then goes high when the duty count is reached 1 PWM channel 0 output is high at the beginning of the period, then goes low when the duty count is reached. 12.3.2.3 PWM Clock Select Register (PWMCLK) Each PWM channel has a choice of two clocks to use as the clock source for that channel as described below. Module Base + 0x0002 7 6 5 4 3 2 1 0 R 0 0 PCLK5 PCLK4 PCLK3 PCLK2 PCLK1 PCLK0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-5. PWM Clock Select Register (PWMCLK) Read: anytime Write: anytime NOTE Register bits PCLK0 to PCLK5 can be written anytime. If a clock select is changed while a PWM signal is being generated, a truncated or stretched pulse can occur during the transition. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 355 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-4. PWMCLK Field Descriptions Field Description 5 Pulse Width Channel 5 Clock Select PCLK5 0 Clock A is the clock source for PWM channel 5. 1 Clock SA is the clock source for PWM channel 5. 4 Pulse Width Channel 4 Clock Select PCLK4 0 Clock A is the clock source for PWM channel 4. 1 Clock SA is the clock source for PWM channel 4. 3 Pulse Width Channel 3 Clock Select PCLK3 0 Clock B is the clock source for PWM channel 3. 1 Clock SB is the clock source for PWM channel 3. 2 Pulse Width Channel 2 Clock Select PCLK2 0 Clock B is the clock source for PWM channel 2. 1 Clock SB is the clock source for PWM channel 2. 1 Pulse Width Channel 1 Clock Select PCLK1 0 Clock A is the clock source for PWM channel 1. 1 Clock SA is the clock source for PWM channel 1. 0 Pulse Width Channel 0 Clock Select PCLK0 0 Clock A is the clock source for PWM channel 0. 1 Clock SA is the clock source for PWM channel 0. 12.3.2.4 PWM Prescale Clock Select Register (PWMPRCLK) This register selects the prescale clock source for clocks A and B independently. Module Base + 0x0003 7 6 5 4 3 2 1 0 R 0 0 PCKB2 PCKB1 PCKB0 PCKA2 PCKA1 PCKA0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-6. PWM Prescaler Clock Select Register (PWMPRCLK) Read: anytime Write: anytime NOTE PCKB2–PCKB0andPCKA2–PCKA0registerbitscanbewrittenanytime. If the clock prescale is changed while a PWM signal is being generated, a truncated or stretched pulse can occur during the transition. 356 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-5. PWMPRCLK Field Descriptions Field Description 6:5 PrescalerSelectforClockB—ClockBis1oftwoclocksourceswhichcanbeusedforchannels2or3.These PCKB[2:0] three bits determine the rate of clock B, as shown inTable12-6. 2:0 PrescalerSelectforClockA—ClockAis1oftwoclocksourceswhichcanbeusedforchannels0,1,4,or5. PCKA[2:0] These three bits determine the rate of clock A, as shown inTable12-7. Table12-6. Clock B Prescaler Selects PCKB2 PCKB1 PCKB0 Value of Clock B 0 0 0 Bus Clock 0 0 1 Bus Clock / 2 0 1 0 Bus Clock / 4 0 1 1 Bus Clock / 8 1 0 0 Bus Clock / 16 1 0 1 Bus Clock / 32 1 1 0 Bus Clock / 64 1 1 1 Bus Clock / 128 Table12-7. Clock A Prescaler Selects PCKA2 PCKA1 PCKA0 Value of Clock A 0 0 0 Bus Clock 0 0 1 Bus Clock / 2 0 1 0 Bus Clock / 4 0 1 1 Bus Clock / 8 1 0 0 Bus Clock / 16 1 0 1 Bus Clock / 32 1 1 0 Bus Clock / 64 1 1 1 Bus Clock / 128 12.3.2.5 PWM Center Align Enable Register (PWMCAE) ThePWMCAEregistercontainssixcontrolbitsfortheselectionofcenteralignedoutputsorleftaligned outputsforeachPWMchannel.IftheCAExbitissettoa1,thecorrespondingPWMoutputwillbecenter aligned. If the CAEx bit is cleared, the corresponding PWM output will be left aligned. Reference Section12.4.2.5, “Left Aligned Outputs,” andSection12.4.2.6, “Center Aligned Outputs,” for a more detailed description of the PWM output modes. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 357 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Module Base + 0x0004 7 6 5 4 3 2 1 0 R 0 0 CAE5 CAE4 CAE3 CAE2 CAE1 CAE0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-7. PWM Center Align Enable Register (PWMCAE) Read: anytime Write: anytime NOTE Write these bits only when the corresponding channel is disabled. Table12-8. PWMCAE Field Descriptions Field Description 5 Center Aligned Output Mode on Channel 5 CAE5 0 Channel 5 operates in left aligned output mode. 1 Channel 5 operates in center aligned output mode. 4 Center Aligned Output Mode on Channel 4 CAE4 0 Channel 4 operates in left aligned output mode. 1 Channel 4 operates in center aligned output mode. 3 Center Aligned Output Mode on Channel 3 CAE3 1 Channel 3 operates in left aligned output mode. 1 Channel 3 operates in center aligned output mode. 2 Center Aligned Output Mode on Channel 2 CAE2 0 Channel 2 operates in left aligned output mode. 1 Channel 2 operates in center aligned output mode. 1 Center Aligned Output Mode on Channel 1 CAE1 0 Channel 1 operates in left aligned output mode. 1 Channel 1 operates in center aligned output mode. 0 Center Aligned Output Mode on Channel 0 CAE0 0 Channel 0 operates in left aligned output mode. 1 Channel 0 operates in center aligned output mode. 12.3.2.6 PWM Control Register (PWMCTL) The PWMCTL register provides for various control of the PWM module. 358 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Module Base + 0x0005 7 6 5 4 3 2 1 0 R 0 0 0 CON45 CON23 CON01 PSWAI PFRZ W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-8. PWM Control Register (PWMCTL) Read: anytime Write: anytime There are three control bits for concatenation, each of which is used to concatenate a pair of PWM channelsintoone16-bitchannel.Whenchannels4and5areconcatenated,channel4registersbecomethe high-orderbytesofthedouble-bytechannel.Whenchannels2and3areconcatenated,channel2registers become the high-order bytes of the double-byte channel. When channels 0 and 1 are concatenated, channel0 registers become the high-order bytes of the double-byte channel. ReferenceSection12.4.2.7,“PWM16-BitFunctions,”foramoredetaileddescriptionoftheconcatenation PWM function. NOTE Change these bits only when both corresponding channels are disabled. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 359 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-9. PWMCTL Field Descriptions Field Description 6 Concatenate Channels 4 and 5 CON45 0 Channels 4 and 5 are separate 8-bit PWMs. 1 Channels 4 and 5 are concatenated to create one 16-bit PWM channel. Channel 4 becomes the high-order byteandchannel5becomesthelow-orderbyte.Channel5outputpinisusedastheoutputforthis16-bitPWM (bit 5 of port PWMP). Channel 5 clock select control bit determines the clock source, channel 5 polarity bit determines the polarity, channel 5 enable bit enables the output and channel 5 center aligned enable bit determines the output mode. 5 Concatenate Channels 2 and 3 CON23 0 Channels 2 and 3 are separate 8-bit PWMs. 1 Channels 2 and 3 are concatenated to create one 16-bit PWM channel. Channel 2 becomes the high-order byteandchannel3becomesthelow-orderbyte.Channel3outputpinisusedastheoutputforthis16-bitPWM (bit 3 of port PWMP). Channel 3 clock select control bit determines the clock source, channel 3 polarity bit determines the polarity, channel 3 enable bit enables the output and channel 3 center aligned enable bit determines the output mode. 4 Concatenate Channels 0 and 1 CON01 0 Channels 0 and 1 are separate 8-bit PWMs. 1 Channels 0 and 1 are concatenated to create one 16-bit PWM channel. Channel 0 becomes the high-order byteandchannel1becomesthelow-orderbyte.Channel1outputpinisusedastheoutputforthis16-bitPWM (bit 1 of port PWMP). Channel 1 clock select control bit determines the clock source, channel 1 polarity bit determines the polarity, channel 1 enable bit enables the output and channel 1 center aligned enable bit determines the output mode. 3 PWMStopsinWaitMode—Enablingthisbitallowsforlowerpowerconsumptioninwaitmodebydisablingthe PSWAI input clock to the prescaler. 0 Allow the clock to the prescaler to continue while in wait mode. 1 Stop the input clock to the prescaler whenever the MCU is in wait mode. 2 PWM Counters Stop in Freeze Mode — In freeze mode, there is an option to disable the input clock to the PFRZ prescalerbysettingthePFRZbitinthePWMCTLregister.Ifthisbitisset,whenevertheMCUisinfreezemode theinputclocktotheprescalerisdisabled.ThisfeatureisusefulduringemulationasitallowsthePWMfunction tobesuspended.Inthisway,thecountersofthePWMcanbestoppedwhileinfreezemodesothatafternormal program flow is continued, the counters are re-enabled to simulate real-time operations. Because the registers remainaccessibleinthismode,tore-enabletheprescalerclock,eitherdisablethePFRZbitorexitfreezemode. 0 Allow PWM to continue while in freeze mode. 1 Disable PWM input clock to the prescaler whenever the part is in freeze mode. This is useful for emulation. 360 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.3.2.7 Reserved Register (PWMTST) This register is reserved for factory testing of the PWM module and is not available in normal modes. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-9. Reserved Register (PWMTST) Read: always read 0x0000 in normal modes Write: unimplemented in normal modes NOTE Writing to this register when in special modes can alter the PWM functionality. 12.3.2.8 Reserved Register (PWMPRSC) This register is reserved for factory testing of the PWM module and is not available in normal modes. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-10. Reserved Register (PWMPRSC) Read: always read 0x0000 in normal modes Write: unimplemented in normal modes NOTE Writing to this register when in special modes can alter the PWM functionality. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 361 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.3.2.9 PWM Scale A Register (PWMSCLA) PWMSCLA is the programmable scale value used in scaling clock A to generate clock SA. Clock SA is generatedbytakingclockA,dividingitbythevalueinthePWMSCLAregisteranddividingthatbytwo. Clock SA = Clock A / (2 * PWMSCLA) NOTE When PWMSCLA = 0x0000, PWMSCLA value is considered a full scale value of 256. Clock A is thus divided by 512. Any value written to this register will cause the scale counter to load the new scale value (PWMSCLA). Module Base + 0x0008 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-11. PWM Scale A Register (PWMSCLA) Read: anytime Write: anytime (causes the scale counter to load the PWMSCLA value) 12.3.2.10 PWM Scale B Register (PWMSCLB) PWMSCLB is the programmable scale value used in scaling clock B to generate clock SB. Clock SB is generatedbytakingclockB,dividingitbythevalueinthePWMSCLBregisteranddividingthatbytwo. Clock SB = Clock B / (2 * PWMSCLB) NOTE When PWMSCLB = 0x0000, PWMSCLB value is considered a full scale value of 256. Clock B is thus divided by 512. Any value written to this register will cause the scale counter to load the new scale value (PWMSCLB). Module Base + 0x0009 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-12. PWM Scale B Register (PWMSCLB) Read: anytime Write: anytime (causes the scale counter to load the PWMSCLB value). 362 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.3.2.11 Reserved Registers (PWMSCNTx) The registers PWMSCNTA and PWMSCNTB are reserved for factory testing of the PWM module and are not available in normal modes. Module Base + 0x000A 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-13. Reserved Register (PWMSCNTA) Module Base + 0x000B 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-14. Reserved Register (PWMSCNTB) Read: always read 0x0000 in normal modes Write: unimplemented in normal modes NOTE Writing to these registers when in special modes can alter the PWM functionality. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 363 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.3.2.12 PWM Channel Counter Registers (PWMCNTx) Each channel has a dedicated 8-bit up/down counter which runs at the rate of the selected clock source. ThecountercanbereadatanytimewithoutaffectingthecountortheoperationofthePWMchannel.In leftalignedoutputmode,thecountercountsfrom0tothevalueintheperiodregister–1.Incenteraligned output mode, the counter counts from 0 up to the value in the period register and then back down to 0. Any value written to the counter causes the counter to reset to 0x0000, the counter direction to be set to up, the immediate load of both duty and period registers with values from the buffers, and the output to change according to the polarity bit. The counter is also cleared at the end of the effective period (see Section12.4.2.5, “Left Aligned Outputs,” andSection12.4.2.6, “Center Aligned Outputs,” for more details). When the channel is disabled (PWMEx = 0), the PWMCNTx register does not count. When a channel becomes enabled (PWMEx = 1), the associated PWM counter starts at the count in the PWMCNTx register. For more detailed information on the operation of the counters, reference Section12.4.2.4, “PWM Timer Counters.” Inconcatenatedmode,writestothe16-bitcounterbyusinga16-bitaccessorwritestoeitherthelow-or high-order byte of the counter will reset the 16-bit counter. Reads of the 16-bit counter must be made by 16-bit access to maintain data coherency. NOTE Writingtothecounterwhilethechannelisenabledcancauseanirregular PWM cycle to occur. Module Base + 0x000C 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W 0 0 0 0 0 0 0 0 Reset 0 0 0 0 0 0 0 0 Figure12-15. PWM Channel Counter Registers (PWMCNT0) Module Base + 0x000D 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W 0 0 0 0 0 0 0 0 Reset 0 0 0 0 0 0 0 0 Figure12-16. PWM Channel Counter Registers (PWMCNT1) 364 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Module Base + 0x000E 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W 0 0 0 0 0 0 0 0 Reset 0 0 0 0 0 0 0 0 Figure12-17. PWM Channel Counter Registers (PWMCNT2) Module Base + 0x000F 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W 0 0 0 0 0 0 0 0 Reset 0 0 0 0 0 0 0 0 Figure12-18. PWM Channel Counter Registers (PWMCNT3) Module Base + 0x00010 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W 0 0 0 0 0 0 0 0 Reset 0 0 0 0 0 0 0 0 Figure12-19. PWM Channel Counter Registers (PWMCNT4) Module Base + 0x00011 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W 0 0 0 0 0 0 0 0 Reset 0 0 0 0 0 0 0 0 Figure12-20. PWM Channel Counter Registers (PWMCNT5) Read: anytime Write: anytime (any value written causes PWM counter to be reset to 0x0000). 12.3.2.13 PWM Channel Period Registers (PWMPERx) There is a dedicated period register for each channel. The value in this register determines the period of the associated PWM channel. The period registers for each channel are double buffered so that if they change while the channel is enabled, the change will NOT take effect until one of the following occurs: • The effective period ends • The counter is written (counter resets to 0x0000) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 365 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description • The channel is disabled Inthisway,theoutputofthePWMwillalwaysbeeithertheoldwaveformorthenewwaveform,notsome variationinbetween.Ifthechannelisnotenabled,thenwritestotheperiodregisterwillgodirectlytothe latches as well as the buffer. NOTE Reads of this register return the most recent value written. Reads do not necessarilyreturnthevalueofthecurrentlyactiveperiodduetothedouble buffering scheme. Reference Section12.4.2.3, “PWM Period and Duty,” for more information. Tocalculatetheoutputperiod,taketheselectedclocksourceperiodforthechannelofinterest(A,B,SA, or SB) and multiply it by the value in the period register for that channel: • Left aligned output (CAEx = 0) • PWMx period = channel clock period * PWMPERx center aligned output (CAEx = 1) • PWMx period = channel clock period * (2 * PWMPERx) For boundary case programming values, please refer to Section12.4.2.8, “PWM Boundary Cases.” Module Base + 0x0012 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-21. PWM Channel Period Registers (PWMPER0) Module Base + 0x0013 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-22. PWM Channel Period Registers (PWMPER1) Module Base + 0x0014 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-23. PWM Channel Period Registers (PWMPER2) 366 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Module Base + 0x0015 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-24. PWM Channel Period Registers (PWMPER3) Module Base + 0x0016 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-25. PWM Channel Period Registers (PWMPER4) Module Base + 0x0017 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure12-26. PWM Channel Period Registers (PWMPER5) Read: anytime Write: anytime 12.3.2.14 PWM Channel Duty Registers (PWMDTYx) There is a dedicated duty register for each channel. The value in this register determines the duty of the associatedPWMchannel.Thedutyvalueiscomparedtothecounterandifitisequaltothecountervalue a match occurs and the output changes state. Thedutyregistersforeachchannelaredoublebufferedsothatiftheychangewhilethechannelisenabled, the change will NOT take effect until one of the following occurs: • The effective period ends • The counter is written (counter resets to 0x0000) • The channel is disabled Inthisway,theoutputofthePWMwillalwaysbeeithertheolddutywaveformorthenewdutywaveform, notsomevariationinbetween.Ifthechannelisnotenabled,thenwritestothedutyregisterwillgodirectly to the latches as well as the buffer. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 367 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description NOTE Reads of this register return the most recent value written. Reads do not necessarily return the value of the currently active duty due to the double buffering scheme. Reference Section12.4.2.3, “PWM Period and Duty,” for more information. NOTE Depending on the polarity bit, the duty registers will contain the count of eitherthehightimeorthelowtime.Ifthepolaritybitis1,theoutputstarts highandthengoeslowwhenthedutycountisreached,sothedutyregisters containacountofthehightime.Ifthepolaritybitis0,theoutputstartslow and then goes high when the duty count is reached, so the duty registers contain a count of the low time. To calculate the output duty cycle (high time as a % of period) for a particular channel: • Polarity = 0 (PPOLx = 0) Duty cycle = [(PWMPERxPWMDTYx)/PWMPERx] * 100% • Polarity = 1 (PPOLx = 1) Duty cycle = [PWMDTYx / PWMPERx] * 100% • Forboundarycaseprogrammingvalues,pleaserefertoSection12.4.2.8,“PWMBoundaryCases.” Module Base + 0x0018 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 1 1 1 1 1 1 1 1 Figure12-27. PWM Channel Duty Registers (PWMDTY0) Module Base + 0x0019 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 1 1 1 1 1 1 1 1 Figure12-28. PWM Channel Duty Registers (PWMDTY1) Module Base + 0x001A 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 1 1 1 1 1 1 1 1 Figure12-29. PWM Channel Duty Registers (PWMDTY2) 368 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Module Base + 0x001B 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 1 1 1 1 1 1 1 1 Figure12-30. PWM Channel Duty Registers (PWMDTY3) Module Base + 0x001C 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 1 1 1 1 1 1 1 1 Figure12-31. PWM Channel Duty Registers (PWMDTY4) Module Base + 0x001D 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 1 Bit 0 W Reset 1 1 1 1 1 1 1 1 Figure12-32. PWM Channel Duty Registers (PWMDTY5) Read: anytime Write: anytime 12.3.2.15 PWM Shutdown Register (PWMSDN) The PWMSDN register provides for the shutdown functionality of the PWM module in the emergency cases. Module Base + 0x00E 7 6 5 4 3 2 1 0 R 0 0 PWM5IN PWMIF PWMIE PWMLVL PWM5INL PWM5ENA W PWMRSTRT Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure12-33. PWM Shutdown Register (PWMSDN) Read: anytime Write: anytime Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 369 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-10. PWMSDN Field Descriptions Field Description 7 PWMInterruptFlag—Anychangefrompassivetoasserted(active)stateorfromactivetopassivestatewillbe PWMIF flagged by setting the PWMIF flag = 1. The flag is cleared by writing a logic 1 to it. Writing a 0 has no effect. 0 No change on PWM5IN input. 1 Change on PWM5IN input 6 PWM Interrupt Enable — If interrupt is enabled an interrupt to the CPU is asserted. PWMIE 0 PWM interrupt is disabled. 1 PWM interrupt is enabled. 5 PWMRestart—ThePWMcanonlyberestartedifthePWMchannelinput5isdeasserted.Afterwritingalogic1 PWMRSTRT to the PWMRSTRT bit (trigger event) the PWM channels start running after the corresponding counter passes next “counter = 0” phase. Also, if the PWM5ENA bit is reset to 0, the PWM do not start before the counter passes 0x0000. The bit is always read as 0. 4 PWMShutdownOutputLevel—IfactivelevelasdefinedbythePWM5INinput,getsassertedallenabledPWM PWMLVL channels are immediately driven to the level defined by PWMLVL. 0 PWM outputs are forced to 0 1 PWM outputs are forced to 1. 2 PWM Channel 5 Input Status — This reflects the current status of the PWM5 pin. PWM5IN 1 PWM Shutdown Active Input Level for Channel 5 — If the emergency shutdown feature is enabled PWM5INL (PWM5ENA = 1), this bit determines the active level of the PWM5 channel. 0 Active level is low 1 Active level is high 0 PWM Emergency Shutdown Enable — If this bit is logic 1 the pin associated with channel 5 is forced to input PWM5ENA and the emergency shutdown feature is enabled. All the other bits in this register are meaningful only if PWM5ENA = 1. 0 PWM emergency feature disabled. 1 PWM emergency feature is enabled. 370 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.4 Functional Description 12.4.1 PWM Clock Select There are four available clocks called clock A, clock B, clock SA (scaled A), and clock SB (scaled B). These four clocks are based on the bus clock. ClockAandBcanbesoftwareselectedtobe1,1/2,1/4,1/8,...,1/64,1/128timesthebusclock.ClockSA usesclockAasaninputanddividesitfurtherwithareloadablecounter.Similarly,clockSBusesclockB asaninputanddividesitfurtherwithareloadablecounter.TheratesavailableforclockSAaresoftware selectable to be clock A divided by 2, 4, 6, 8, ..., or 512 in increments of divide by 2. Similar rates are available for clock SB. Each PWM channel has the capability of selecting one of two clocks, either the pre-scaled clock (clock A or B) or the scaled clock (clock SA or SB). TheblockdiagraminFigure12-34showsthefourdifferentclocksandhowthescaledclocksarecreated. 12.4.1.1 Prescale The input clock to the PWM prescaler is the bus clock. It can be disabled whenever the part is in freeze mode by setting the PFRZ bit in the PWMCTL register. If this bit is set, whenever the MCU is in freeze modetheinputclocktotheprescalerisdisabled.ThisisusefulforemulationinordertofreezethePWM. The input clock can also be disabled when all six PWM channels are disabled (PWME5–PWME0 = 0) This is useful for reducing power by disabling the prescale counter. ClockAandclockBarescaledvaluesoftheinputclock.ThevalueissoftwareselectableforbothclockA and clock B and has options of 1, 1/2, 1/4, 1/8, 1/16, 1/32, 1/64, or 1/128 times the bus clock. The value selectedforclockAisdeterminedbythePCKA2,PCKA1,andPCKA0bitsinthePWMPRCLKregister. The value selected for clock B is determined by the PCKB2, PCKB1, and PCKB0 bits also in the PWMPRCLK register. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 371 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Clock A M Clock to U PWM Ch 0 X Clock A/2, A/4, A/6,....A/512 PCLK0 210 AAA Count = 1 KKK 8-Bit Down Counter M CCC Clock to PPP U PWM Ch 1 Load X Clock SA PCLK1 PWMSCLA DIV 2 M M U Clock to PWM Ch 2 X U PCLK2 X M Clock to U 8 PWM Ch 3 ps: 12 X Ta 4 er 6 cal 32 PCLK3 s e 6 Pr 1 Clock B e by 8 MU CPWlocMk Ctoh 4 vid 4 X Di 2 Clock B/2, B/4, B/6,....B/512 M PCLK4 Count = 1 U 8-Bit Down Counter M Clock to U PWM Ch 5 X Load X Clock SB PCLK5 PWMSCLB DIV 2 210 BBB KKK Clock FRZEZE PCPCPC s PE Bu FR 5:0 E M W P PRESCALE SCALE CLOCK SELECT Figure12-34. PWM Clock Select Block Diagram 372 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.4.1.2 Clock Scale The scaled A clock uses clock A as an input and divides it further with a user programmable value and then divides this by 2. The scaled B clock uses clock B as an input and divides it further with a user programmable value and then divides this by 2. The rates available for clock SA are software selectable tobeclockAdividedby2,4,6,8,...,or512inincrementsofdivideby2.Similarratesareavailablefor clock SB. ClockAisusedasaninputtoan8-bitdowncounter.Thisdowncounterloadsauserprogrammablescale valuefromthescaleregister(PWMSCLA).Whenthedowncounterreaches1,twothingshappen;apulse is output and the 8-bit counter is re-loaded. The output signal from this circuit is further divided by two. Thisgivesagreaterrangewithonlyaslightreductioningranularity.ClockSAequalsclockAdividedby two times the value in the PWMSCLA register. NOTE Clock SA = Clock A / (2 * PWMSCLA) When PWMSCLA = 0x0000, PWMSCLA value is considered a full scale value of 256. Clock A is thus divided by 512. Similarly,clockBisusedasaninputtoan8-bitdowncounterfollowedbyadividebytwoproducingclock SB. Thus, clock SB equals clock B divided by two times the value in the PWMSCLB register. NOTE Clock SB = Clock B / (2 * PWMSCLB) When PWMSCLB = 0x0000, PWMSCLB value is considered a full scale value of 256. Clock B is thus divided by 512. Asanexample,considerthecaseinwhichtheuserwrites0x00FFintothePWMSCLAregister.ClockA forthiscasewillbebusclockdividedby4.Apulsewilloccuratarateofonceevery255x4buscycles. Passingthisthroughthedividebytwocircuitproducesaclocksignalatabusclockdividedby2040rate. Similarly, a value of 0x0001 in the PWMSCLA register when clock A is bus clock divided by 4 will produce a bus clock divided by 8 rate. Writing to PWMSCLA or PWMSCLB causes the associated 8-bit down counter to be re-loaded. Otherwise, when changing rates the counter would have to count down to 0x0001 before counting at the proper rate. Forcing the associated counter to re-load the scale register value every time PWMSCLA or PWMSCLB is written prevents this. NOTE Writing to the scale registers while channels are operating can cause irregularities in the PWM outputs. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 373 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.4.1.3 Clock Select EachPWMchannelhasthecapabilityofselectingoneoftwoclocks.Forchannels0,1,4,and5theclock choices are clock A or clock SA. For channels 2 and 3 the choices are clock B or clock SB. The clock selection is done with the PCLKx control bits in the PWMCLK register. NOTE Changing clock control bits while channels are operating can cause irregularities in the PWM outputs. 12.4.2 PWM Channel Timers ThemainpartofthePWMmodulearetheactualtimers.Eachofthetimerchannelshasacounter,aperiod registerandadutyregister(eachare8bit).Thewaveformoutputperiodiscontrolledbyamatchbetween theperiodregisterandthevalueinthecounter.Thedutyiscontrolledbyamatchbetweenthedutyregister andthecountervalueandcausesthestateoftheoutputtochangeduringtheperiod.Thestartingpolarity oftheoutputisalsoselectableonaperchannelbasis.Figure12-35showsablockdiagramforPWMtimer. Clock Source From Port PWMP 8-Bit Counter Data Register GATE PWMCNTx (clock edge sync) up/down reset 8-Bit Compare = T M M Q PWMDTYx U U Q X X To Pin R Driver 8-Bit Compare = PWMPERx PPOLx T Q CAEx Q R PWMEx Figure12-35. PWM Timer Channel Block Diagram 374 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.4.2.1 PWM Enable Each PWM channel has an enable bit (PWMEx) to start its waveform output. When any of the PWMEx bitsareset(PWMEx=1),theassociatedPWMoutputsignalisenabledimmediately.However,theactual PWMwaveformisnotavailableontheassociatedPWMoutputuntilitsclocksourcebeginsitsnextcycle due to the synchronization of PWMEx and the clock source. An exception to this is when channels are concatenated. Refer to Section12.4.2.7, “PWM 16-Bit Functions,” for more detail. NOTE The first PWM cycle after enabling the channel can be irregular. OnthefrontendofthePWMtimer,theclockisenabledtothePWMcircuitbythePWMExbitbeinghigh. There is an edge-synchronizing circuit to guarantee that the clock will only be enabled or disabled at an edge. When the channel is disabled (PWMEx = 0), the counter for the channel does not count. 12.4.2.2 PWM Polarity Eachchannelhasapolaritybittoallowstartingawaveformcyclewithahighorlowsignal.Thisisshown ontheblockdiagramasamuxselectofeithertheQoutputortheQoutputofthePWMoutputflip-flop. When one of the bits in the PWMPOL register is set, the associated PWM channel output is high at the beginningofthewaveform,thengoeslowwhenthedutycountisreached.Conversely,ifthepolaritybit is 0, the output starts low and then goes high when the duty count is reached. 12.4.2.3 PWM Period and Duty Dedicatedperiodanddutyregistersexistforeachchannelandaredoublebufferedsothatiftheychange while the channel is enabled, the change will NOT take effect until one of the following occurs: • The effective period ends • The counter is written (counter resets to 0x0000) • The channel is disabled Inthisway,theoutputofthePWMwillalwaysbeeithertheoldwaveformorthenewwaveform,notsome variation in between. If the channel is not enabled, then writes to the period and duty registers will go directly to the latches as well as the buffer. A change in duty or period can be forced into effect “immediately” by writing the new value to the duty and/or period registers and then writing to the counter. This forces the counter to reset and the new duty and/orperiodvaluestobelatched.Inaddition,becausethecounterisreadableitispossibletoknowwhere the count is with respect to the duty value and software can be used to make adjustments. NOTE When forcing a new period or duty into effect immediately, an irregular PWM cycle can occur. Depending on the polarity bit, the duty registers will contain the count of either the high time or the low time. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 375 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.4.2.4 PWM Timer Counters Each channel has a dedicated 8-bit up/down counter which runs at the rate of the selected clock source (referenceFigure12-34fortheavailableclocksourcesandrates).Thecountercomparestotworegisters, adutyregisterandaperiodregisterasshowninFigure12-35.WhenthePWMcountermatchestheduty register the output flip-flop changes state causing the PWM waveform to also change state. A match betweenthePWMcounterandtheperiodregisterbehavesdifferentlydependingonwhatoutputmodeis selected as shown in Figure12-35 and described in Section12.4.2.5, “Left Aligned Outputs,” and Section12.4.2.6, “Center Aligned Outputs.” Each channel counter can be read at anytime without affecting the count or the operation of the PWM channel. Any value written to the counter causes the counter to reset to 0x0000, the counter direction to be set to up, the immediate load of both duty and period registers with values from the buffers, and the output to changeaccordingtothepolaritybit.Whenthechannelisdisabled(PWMEx=0),thecounterstops.When a channel becomes enabled (PWMEx = 1), the associated PWM counter continues from the count in the PWMCNTx register. This allows the waveform to resume when the channel is re-enabled. When the channel is disabled, writing 0 to the period register will cause the counter to reset on the next selected clock. NOTE If the user wants to start a new “clean” PWM waveform without any “history” from the old waveform, the user must write to channel counter (PWMCNTx) prior to enabling the PWM channel (PWMEx = 1). Generally,writestothecounteraredonepriortoenablingachanneltostartfromaknownstate.However, writingacountercanalsobedonewhilethePWMchannelisenabled(counting).Theeffectissimilarto writing the counter when the channel is disabled except that the new period is started immediately with the output set according to the polarity bit. NOTE Writing to the counter while the channel is enabled can cause an irregular PWM cycle to occur. Thecounterisclearedattheendoftheeffectiveperiod(seeSection12.4.2.5,“LeftAlignedOutputs,”and Section12.4.2.6, “Center Aligned Outputs,” for more details). Table12-11. PWM Timer Counter Conditions Counter Clears (0x0000) Counter Counts Counter Stops When PWMCNTx register When PWM channel is When PWM channel is written to any value enabled(PWMEx=1).Counts disabled (PWMEx = 0) from last value in PWMCNTx. Effective period ends 376 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 12.4.2.5 Left Aligned Outputs ThePWMtimerprovidesthechoiceoftwotypesofoutputs,leftalignedorcenteralignedoutputs.They are selected with the CAEx bits in the PWMCAE register. If the CAEx bit is cleared (CAEx = 0), the corresponding PWM output will be left aligned. In left aligned output mode, the 8-bit counter is configured as an up counter only. It compares to two registers, a duty register and a period register as shown in the block diagram inFigure 12-35. When the PWMcountermatchesthedutyregistertheoutputflip-flopchangesstatecausingthePWMwaveformto also change state. A match between the PWM counter and the period register resets the counter and the outputflip-flopasshowninFigure12-35aswellasperformingaloadfromthedoublebufferperiodand duty register to the associated registers as described in Section12.4.2.3, “PWM Period and Duty.” The counter counts from 0 to the value in the period register – 1. NOTE ChangingthePWMoutputmodefromleftalignedoutputtocenteraligned output (or vice versa) while channels are operating can cause irregularities inthePWMoutput.Itisrecommendedtoprogramtheoutputmodebefore enabling the PWM channel. PPOLx = 0 PPOLx = 1 PWMDTYx Period = PWMPERx Figure12-36. PWM Left Aligned Output Waveform To calculate the output frequency in left aligned output mode for a particular channel, take the selected clocksourcefrequencyforthechannel(A,B,SA,orSB)anddivideitbythevalueintheperiodregister for that channel. • PWMx frequency = clock (A, B, SA, or SB) / PWMPERx • PWMx duty cycle (high time as a% of period): — Polarity = 0 (PPOLx = 0) Duty cycle = [(PWMPERx-PWMDTYx)/PWMPERx] * 100% — Polarity = 1 (PPOLx = 1) Duty cycle = [PWMDTYx / PWMPERx] * 100% As an example of a left aligned output, consider the following case: Clock source = bus clock, where bus clock = 10 MHz (100 ns period) PPOLx = 0 PWMPERx = 4 PWMDTYx = 1 PWMx frequency = 10 MHz/4 = 2.5 MHz PWMx period = 400 ns PWMx duty cycle = 3/4 *100% = 75% Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 377 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Shown below is the output waveform generated. E = 100 ns DUTY CYCLE = 75% PERIOD = 400 ns Figure12-37. PWM Left Aligned Output Example Waveform 12.4.2.6 Center Aligned Outputs Forcenteralignedoutputmodeselection,settheCAExbit(CAEx=1)inthePWMCAEregisterandthe corresponding PWM output will be center aligned. The 8-bit counter operates as an up/down counter in this mode and is set to up whenever the counter is equalto0x0000.Thecountercomparestotworegisters,adutyregisterandaperiodregisterasshownin theblockdiagraminFigure 12-35.WhenthePWMcountermatchesthedutyregistertheoutputflip-flop changes state causing the PWM waveform to also change state. A match between the PWM counter and the period register changes the counter direction from an up-count to a down-count. When the PWM counter decrements and matches the duty register again, the output flip-flop changes state causing the PWMoutputtoalsochangestate.WhenthePWMcounterdecrementsandreaches0,thecounterdirection changes from a down-count back to an up-count and a load from the double buffer period and duty registers to the associated registers is performed as described inSection12.4.2.3, “PWM Period and Duty.”Thecountercountsfrom0uptothevalueintheperiodregisterandthenbackdownto0.Thusthe effective period is PWMPERx*2. NOTE ChangingthePWMoutputmodefromleftalignedoutputtocenteraligned output (or vice versa) while channels are operating can cause irregularities inthePWMoutput.Itisrecommendedtoprogramtheoutputmodebefore enabling the PWM channel. PPOLx = 0 PPOLx = 1 PWMDTYx PWMDTYx PWMPERx PWMPERx Period = PWMPERx*2 Figure12-38. PWM Center Aligned Output Waveform 378 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Tocalculatetheoutputfrequencyincenteralignedoutputmodeforaparticularchannel,taketheselected clock source frequency for the channel (A, B, SA, or SB) and divide it by twice the value in the period register for that channel. • PWMx frequency = clock (A, B, SA, or SB) / (2*PWMPERx) • PWMx duty cycle (high time as a% of period): — Polarity = 0 (PPOLx = 0) Duty cycle = [(PWMPERx-PWMDTYx)/PWMPERx] * 100% — Polarity = 1 (PPOLx = 1) Duty cycle = [PWMDTYx / PWMPERx] * 100% As an example of a center aligned output, consider the following case: Clock source = bus clock, where bus clock = 10 MHz (100 ns period) PPOLx = 0 PWMPERx = 4 PWMDTYx = 1 PWMx frequency = 10 MHz/8 = 1.25 MHz PWMx period = 800 ns PWMx duty cycle = 3/4 *100% = 75% Shown below is the output waveform generated. E = 100 ns E = 100 ns DUTY CYCLE = 75% PERIOD = 800 ns Figure12-39. PWM Center Aligned Output Example Waveform 12.4.2.7 PWM 16-Bit Functions ThePWMtimeralsohastheoptionofgenerating6-channelsof8-bitsor3-channelsof16-bitsforgreater PWMresolution}.This16-bitchanneloptionisachievedthroughtheconcatenationoftwo8-bitchannels. The PWMCTL register contains three control bits, each of which is used to concatenate a pair of PWM channelsintoone16-bitchannel.Channels4and5areconcatenatedwiththeCON45bit,channels2and3 are concatenated with the CON23 bit, and channels 0 and 1 are concatenated with the CON01 bit. NOTE Change these bits only when both corresponding channels are disabled. When channels 4 and 5 are concatenated, channel 4 registers become the high-order bytes of the double byte channel as shown in Figure12-40. Similarly, when channels 2 and 3 are concatenated, channel 2 registersbecomethehigh-orderbytesofthedoublebytechannel.Whenchannels0and1areconcatenated, channel 0 registers become the high-order bytes of the double byte channel. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 379 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Clock Source 5 High Low PWMCNT4 PWCNT5 Period/Duty Compare PWM5 Clock Source 3 High Low PWMCNT2 PWCNT3 Period/Duty Compare PWM3 Clock Source 1 High Low PWMCNT0 PWCNT1 Period/Duty Compare PWM1 Figure12-40. PWM 16-Bit Mode Whenusingthe16-bitconcatenatedmode,theclocksourceisdeterminedbythelow-order8-bitchannel clock select control bits. That is channel 5 when channels 4 and 5 are concatenated, channel 3 when channels2and3areconcatenated,andchannel1whenchannels0and1areconcatenated.Theresulting PWM is output to the pins of the corresponding low-order 8-bit channel as also shown inFigure12-40. ThepolarityoftheresultingPWMoutputiscontrolledbythePPOLxbitofthecorrespondinglow-order 8-bit channel as well. After concatenated mode is enabled (CONxx bits set in PWMCTL register), enabling/disabling the corresponding16-bitPWMchanneliscontrolledbythelow-orderPWMExbit.Inthiscase,thehigh-order bytes PWMEx bits have no effect and their corresponding PWM output is disabled. In concatenated mode, writes to the 16-bit counter by using a 16-bit access or writes to either the low or high-order byte of the counter will reset the 16-bit counter. Reads of the 16-bit counter must be made by 16-bit access to maintain data coherency. Either left aligned or center aligned output mode can be used in concatenated mode and is controlled by the low-order CAEx bit. The high-order CAEx bit has no effect. 380 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description Table12-12 is used to summarize which channels are used to set the various control bits when in 16-bit mode. Table12-12. 16-bit Concatenation Mode Summary CONxx PWMEx PPOLx PCLKx CAEx PWMx Output CON45 PWME5 PPOL5 PCLK5 CAE5 PWM5 CON23 PWME3 PPOL3 PCLK3 CAE3 PWM3 CON01 PWME1 PPOL1 PCLK1 CAE1 PWM1 12.4.2.8 PWM Boundary Cases Table12-13summarizestheboundaryconditionsforthePWMregardlessoftheoutputmode(leftaligned or center aligned) and 8-bit (normal) or 16-bit (concatenation): Table12-13. PWM Boundary Cases PWMDTYx PWMPERx PPOLx PWMx Output 0x0000 >0x0000 1 Always Low (indicates no duty) 0x0000 >0x0000 0 Always High (indicates no duty) XX 0x0000(1) 1 Always High (indicates no period) XX 0x00001 0 Always Low (indicates no period) >= PWMPERx XX 1 Always High >= PWMPERx XX 0 Always Low 1. Counter = 0x0000 and does not count. 12.5 Resets The reset state of each individual bit is listed within the register description section (see Section12.3, “Memory Map and Register Definition,” which details the registers and their bit-fields. All special functions or modes which are initialized during or just following reset are described within this section. • The 8-bit up/down counter is configured as an up counter out of reset. • All the channels are disabled and all the counters don’t count. 12.6 Interrupts ThePWM8B6CV1modulehasonlyoneinterruptwhichisgeneratedatthetimeofemergencyshutdown, if the corresponding enable bit (PWMIE) is set. This bit is the enable for the interrupt. The interrupt flag PWMIF is set whenever the input level of the PWM5 channel changes while PWM5ENA=1 or when PWMENA is being asserted while the level at PWM5 is active. AdescriptionoftheregistersinvolvedandaffectedduetothisinterruptisexplainedinSection12.3.2.15, “PWM Shutdown Register (PWMSDN).” Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 381 Rev 01.24

Chapter12 Pulse-Width Modulator (PWM8B6CV1) Block Description 382 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 13 Serial Communications Interface (S12SCIV2) Block Description 13.1 Introduction This block guide provide an overview of serial communication interface (SCI) module. The SCI allows asynchronous serial communications with peripheral devices and other CPUs. 13.1.1 Glossary IRQ — Interrupt Request LSB — Least Significant Bit MSB — Most Significant Bit NRZ — Non-Return-to-Zero RZI — Return-to-Zero-Inverted RXD — Receive Pin SCI — Serial Communication Interface TXD — Transmit Pin 13.1.2 Features The SCI includes these distinctive features: • Full-duplex operation • Standard mark/space non-return-to-zero (NRZ) format • 13-bit baud rate selection • Programmable 8-bit or 9-bit data format • Separately enabled transmitter and receiver • Programmable transmitter output parity • Two receiver wake up methods: — Idle line wake-up — Address mark wake-up • Interrupt-driven operation with eight flags: — Transmitter empty Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 383 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description — Transmission complete — Receiver full — Idle receiver input — Receiver overrun — Noise error — Framing error — Parity error • Receiver framing error detection • Hardware parity checking • 1/16 bit-time noise detection 13.1.3 Modes of Operation TheSCIoperationisthesameindependentofdeviceresourcemappingandbusinterfacemode.Different power modes are available to facilitate power saving. 13.1.3.1 Run Mode Normal mode of operation. 13.1.3.2 Wait Mode SCI operation in wait mode depends on the state of the SCISWAI bit in the SCI control register 1 (SCICR1). • If SCISWAI is clear, the SCI operates normally when the CPU is in wait mode. • If SCISWAI is set, SCI clock generation ceases and the SCI module enters a power-conservation state when the CPU is in wait mode. Setting SCISWAI does not affect the state of the receiver enable bit, RE, or the transmitter enable bit, TE. • If SCISWAI is set, any transmission or reception in progress stops at wait mode entry. The transmissionorreceptionresumeswheneitheraninternalorexternalinterruptbringstheCPUout of wait mode. Exiting wait mode by reset aborts any transmission or reception in progress and resets the SCI. 13.1.3.3 Stop Mode The SCI is inactive during stop mode for reduced power consumption. The STOP instruction does not affecttheSCIregisterstates,buttheSCImoduleclockwillbedisabled.TheSCIoperationresumesfrom where it left off after an external interrupt brings the CPU out of stop mode. Exiting stop mode by reset aborts any transmission or reception in progress and resets the SCI. 384 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.1.4 Block Diagram Figure13-1isahighlevelblockdiagramoftheSCImodule,showingtheinteractionofvariousfunctional blocks. SCI DATA REGISTER IDLE IRQ N O RX DATA IN RECEIVE SHIFT REGISTER ATI R E N E BUS CLOCK G Q RDR/OR IRQ R RECEIVE & WAKE UP CONTROL I IRQ G TO CPU BAUD ÷16 DATA FORMAT CONTROL RIN O GENERATOR TRANSMIT CONTROL TDRE IRQ N O TI A R E TRANSMIT SHIFT REGISTER N E TC IRQ G Q R I SCI DATA REGISTER TXDATA OUT Figure13-1. SCI Block Diagram 13.2 External Signal Description The SCI module has a total of two external pins: 13.2.1 TXD-SCI Transmit Pin This pin serves as transmit data output of SCI. 13.2.2 RXD-SCI Receive Pin This pin serves as receive data input of the SCI. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 385 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.3 Memory Map and Registers This section provides a detailed description of all memory and registers. 13.3.1 Module Memory Map ThememorymapfortheSCImoduleisgivenbelowinFigure13-2.TheAddresslistedforeachregister istheaddressoffset.ThetotaladdressforeachregisteristhesumofthebaseaddressfortheSCImodule and the address offset for each register. Address Name Bit 7 6 5 4 3 2 1 Bit 0 R 0 0 0 0x0000 SCIBDH SBR12 SBR11 SBR10 SBR9 SBR8 W R 0x0001 SCIBDL SBR7 SBR6 SBR5 SBR4 SBR3 SBR2 SBR1 SBR0 W R 0x0002 SCICR1 LOOPS SCISWAI RSRC M WAKE ILT PE PT W R 0x0003 SCICR2 TIE TCIE RIE ILIE TE RE RWU SBK W R TDRE TC RDRF IDLE OR NF FE PF 0x0004 SCISR1 W R 0 0 0 0 0 RAF 0x0005 SCISR2 BRK13 TXDIR W R R8 0 0 0 0 0 0 0x0006 SCIDRH T8 W R R7 R6 R5 R4 R3 R2 R1 R0 0x0007 SCIDRL W T7 T6 T5 T4 T3 T2 T1 T0 = Unimplemented or Reserved Figure13-2. SCI Register Summary 13.3.2 Register Descriptions Thissectionconsistsofregisterdescriptionsinaddressorder.Eachdescriptionincludesastandardregister diagramwithanassociatedfigurenumber.Writestoareservedregisterlocationdonothaveanyeffectand readsoftheselocationsreturnazero.Detailsofregisterbitandfieldfunctionfollowtheregisterdiagrams, in bit order. 386 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.3.2.1 SCI Baud Rate Registers (SCIBDH and SCHBDL) Module Base + 0x_0000 7 6 5 4 3 2 1 0 R 0 0 0 SBR12 SBR11 SBR10 SBR9 SBR8 W Reset 0 0 0 0 0 0 0 0 Module Base + 0x_0001 7 6 5 4 3 2 1 0 R SBR7 SBR6 SBR5 SBR4 SBR3 SBR2 SBR1 SBR0 W Reset 0 0 0 0 0 1 0 0 = Unimplemented or Reserved Figure13-3. SCI Baud Rate Registers (SCIBDH and SCIBDL) TheSCIBaudRateRegisterisusedbythecountertodeterminethebaudrateoftheSCI.Theformulafor calculating the baud rate is: SCI baud rate = SCI module clock / (16 x BR) where: BRisthecontentoftheSCIbaudrateregisters,bitsSBR12throughSBR0.Thebaudrateregisters can contain a value from 1 to 8191. Read: Anytime. If only SCIBDH is written to, a read will not return the correct data until SCIBDL is written to as well, following a write to SCIBDH. Write: Anytime Table13-1. SCIBDH AND SCIBDL Field Descriptions Field Description 4–0 SCI Baud Rate Bits— The baud rate for the SCI is determined by these 13 bits. 7–0 Note:The baud rate generator is disabled until the TE bit or the RE bit is set for the first time after reset.The SBR[12:0] baud rate generator is disabled when BR = 0. Writing to SCIBDH has no effect without writing to SCIBDL, since writing to SCIBDH puts the data in a temporary location until SCIBDL is written to. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 387 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.3.2.2 SCI Control Register 1 (SCICR1) Module Base + 0x_0002 7 6 5 4 3 2 1 0 R LOOPS SCISWAI RSRC M WAKE ILT PE PT W Reset 0 0 0 0 0 0 0 0 Figure13-4. SCI Control Register 1 (SCICR1) Read: Anytime Write: Anytime Table13-2. SCICR1 Field Descriptions Field Description 7 LoopSelectBit—LOOPSenablesloopoperation.Inloopoperation,theRXDpinisdisconnectedfromtheSCI LOOPS andthetransmitteroutputisinternallyconnectedtothereceiverinput.Boththetransmitterandthereceivermust be enabled to use the loop function.SeeTable13-3. 0 Normal operation enabled 1 Loop operation enabled Note:The receiver input is determined by the RSRC bit. 6 SCI Stop in Wait Mode Bit— SCISWAI disables the SCI in wait mode. SCISWAI 0 SCI enabled in wait mode 1 SCI disabled in wait mode 5 Receiver Source Bit — When LOOPS = 1, the RSRC bit determines the source for the receiver shift register RSRC input. 0 Receiver input internally connected to transmitter output 1 Receiver input connected externally to transmitter 4 Data Format Mode Bit— MODE determines whether data characters are eight or nine bits long. M 0 One start bit, eight data bits, one stop bit 1 One start bit, nine data bits, one stop bit 3 WakeupConditionBit—WAKEdetermineswhichconditionwakesuptheSCI:alogic1(addressmark)inthe WAKE most significant bit position of a received data character or an idle condition on the RXD. 0 Idle line wakeup 1 Address mark wakeup 2 Idle Line Type Bit— ILT determines when the receiver starts counting logic 1s as idle character bits. The ILT countingbeginseitherafterthestartbitorafterthestopbit.Ifthecountbeginsafterthestartbit,thenastringof logic 1s preceding the stop bit may cause false recognition of an idle character.Beginning the count after the stop bit avoids false idle character recognition, but requires properly synchronized transmissions. 0 Idle character bit count begins after start bit 1 Idle character bit count begins after stop bit 1 ParityEnableBit—PEenablestheparityfunction.Whenenabled,theparityfunctioninsertsaparitybitinthe PE most significant bit position. 0 Parity function disabled 1 Parity function enabled 0 ParityTypeBit—PTdetermineswhethertheSCIgeneratesandchecksforevenparityoroddparity.Witheven PT parity,anevennumberof1sclearstheparitybitandanoddnumberof1ssetstheparitybit.Withoddparity,an odd number of 1s clears the parity bit and an even number of 1s sets the parity bit. 0 Even parity 1 Odd parity 388 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description Table13-3. Loop Functions LOOPS RSRC Function 0 x Normal operation 1 0 Loop mode with Rx input internally connected to Tx output 1 1 Single-wire mode with Rx input connected to TXD 13.3.2.3 SCI Control Register 2 (SCICR2) Module Base + 0x_0003 7 6 5 4 3 2 1 0 R TIE TCIE RIE ILIE TE RE RWU SBK W Reset 0 0 0 0 0 0 0 0 Figure13-5. SCI Control Register 2 (SCICR2) Read: Anytime Write: Anytime Table13-4. SCICR2 Field Descriptions Field Description 7 Transmitter Interrupt Enable Bit— TIE enables the transmit data register empty flag, TDRE, to generate TIE interrupt requests. 0 TDRE interrupt requests disabled 1 TDRE interrupt requests enabled 6 TransmissionCompleteInterruptEnableBit—TCIEenablesthetransmissioncompleteflag,TC,togenerate TCIE interrupt requests. 0 TC interrupt requests disabled 1 TC interrupt requests enabled 5 ReceiverFullInterruptEnableBit—RIEenablesthereceivedataregisterfullflag,RDRF,ortheoverrunflag, RIE OR, to generate interrupt requests. 0 RDRF and OR interrupt requests disabled 1 RDRF and OR interrupt requests enabled 4 Idle Line Interrupt Enable Bit— ILIE enables the idle line flag, IDLE, to generate interrupt requests. ILIE 0 IDLE interrupt requests disabled 1 IDLE interrupt requests enabled 3 Transmitter Enable Bit— TE enables the SCI transmitter and configures the TXD pin as being controlled by TE the SCI. The TE bit can be used to queue an idle preamble. 0 Transmitter disabled 1 Transmitter enabled 2 Receiver Enable Bit— RE enables the SCI receiver. RE 0 Receiver disabled 1 Receiver enabled Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 389 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description Table13-4. SCICR2 Field Descriptions (continued) Field Description 1 Receiver Wakeup Bit— Standby state RWU 0 Normal operation. 1 RWUenablesthewakeupfunctionandinhibitsfurtherreceiverinterruptrequests.Normally,hardwarewakes the receiver by automatically clearing RWU. 0 Send Break Bit— Toggling SBK sends one break character (10 or 11 logic 0s, respectively 13 or 14 logics 0s SBK if BRK13 is set). Toggling implies clearing the SBK bit before the break character has finished transmitting. As long as SBK is set, the transmitter continues to send complete break characters (10 or 11 bits, respectively 13 or 14 bits). 0 No break characters 1 Transmit break characters 13.3.2.4 SCI Status Register 1 (SCISR1) The SCISR1 and SCISR2 registers provides inputs to the MCU for generation of SCI interrupts. Also, these registers can be polled by the MCU to check the status of these bits. The flag-clearing procedures requirethatthestatusregisterbereadfollowedbyareadorwritetotheSCIDataRegister.Itispermissible toexecuteotherinstructionsbetweenthetwostepsaslongasitdoesnotcompromisethehandlingofI/O, but the order of operations is important for flag clearing. Module Base + 0x_0004 7 6 5 4 3 2 1 0 R TDRE TC RDRF IDLE OR NF FE PF W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure13-6. SCI Status Register 1 (SCISR1) Read: Anytime Write: Has no meaning or effect Table13-5. SCISR1 Field Descriptions Field Description 7 Transmit Data Register Empty Flag— TDRE is set when the transmit shift register receives a byte from the TDRE SCIdataregister.WhenTDREis1,thetransmitdataregister(SCIDRH/L)isemptyandcanreceiveanewvalue totransmit.ClearTDREbyreadingSCIstatusregister1(SCISR1),withTDREsetandthenwritingtoSCIdata register low (SCIDRL). 0 No byte transferred to transmit shift register 1 Byte transferred to transmit shift register; transmit data register empty 6 TransmitCompleteFlag—TCissetlowwhenthereisatransmissioninprogressorwhenapreambleorbreak TC characterisloaded.TCissethighwhentheTDREflagissetandnodata,preamble,orbreakcharacterisbeing transmitted.WhenTCisset,theTXDoutsignalbecomesidle(logic1).ClearTCbyreadingSCIstatusregister 1 (SCISR1) with TC set and then writing to SCI data register low (SCIDRL).TC is cleared automatically when data, preamble, or break is queued and ready to be sent. TC is cleared in the event of a simultaneous set and clear of the TC flag (transmission not complete). 0 Transmission in progress 1 No transmission in progress 390 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description Table13-5. SCISR1 Field Descriptions (continued) Field Description 5 ReceiveDataRegisterFullFlag—RDRFissetwhenthedatainthereceiveshiftregistertransferstotheSCI RDRF dataregister.ClearRDRFbyreadingSCIstatusregister1(SCISR1)withRDRFsetandthenreadingSCIdata register low (SCIDRL). 0 Data not available in SCI data register 1 Received data available in SCI data register 4 Idle Line Flag — IDLE is set when 10 consecutive logic 1s (if M=0) or 11 consecutive logic 1s (if M=1) appear IDLE on the receiver input. Once the IDLE flag is cleared, a valid frame must again set the RDRF flag before an idle condition can set the IDLE flag.Clear IDLE by reading SCI status register 1 (SCISR1) with IDLE set and then reading SCI data register low (SCIDRL). 0 Receiver input is either active now or has never become active since the IDLE flag was last cleared 1 Receiver input has become idle Note:When the receiver wakeup bit (RWU) is set, an idle line condition does not set the IDLE flag. 3 Overrun Flag — OR is set when software fails to read the SCI data register before the receive shift register OR receives the next frame. The OR bit is set immediately after the stop bit has been completely received for the secondframe.Thedataintheshiftregisterislost,butthedataalreadyintheSCIdataregistersisnotaffected. Clear OR by reading SCI status register 1 (SCISR1) with OR set and then reading SCI data register low (SCIDRL). 0 No overrun 1 Overrun Note:OR flag may read back as set when RDRF flag is clear. This may happen if the following sequence of events occurs: 1. After the first frame is received, read status register SCISR1 (returns RDRF set and OR flag clear); 2. Receive second frame without reading the first frame in the data register (the second frame is not received and OR flag is set); 3. Read data register SCIDRL (returns first frame and clears RDRF flag in the status register); 4. Read status register SCISR1 (returns RDRF clear and OR set). Event 3 may be at exactly the same time as event 2 or any time after. When this happens, a dummy SCIDRL read following event 4 will be required to clear the OR flag if further frames are to be received. 2 NoiseFlag—NFissetwhentheSCIdetectsnoiseonthereceiverinput.NFbitissetduringthesamecycleas NF theRDRFflagbutdoesnotgetsetinthecaseofanoverrun.ClearNFbyreadingSCIstatusregister1(SCISR1), and then reading SCI data register low (SCIDRL). 0 No noise 1 Noise 1 FramingErrorFlag—FEissetwhenalogic0isacceptedasthestopbit.FEbitissetduringthesamecycle FE as the RDRF flag but does not get set in the case of an overrun.FE inhibits further data reception until it is cleared.ClearFEbyreadingSCIstatusregister1(SCISR1)withFEsetandthenreadingtheSCIdataregister low (SCIDRL). 0 No framing error 1 Framing error 0 ParityErrorFlag—PFissetwhentheparityenablebit(PE)issetandtheparityofthereceiveddatadoesnot PF match the parity type bit (PT). PF bit is set during the same cycle as the RDRF flag but does not get set in the caseofanoverrun.ClearPFbyreadingSCIstatusregister1(SCISR1),andthenreadingSCIdataregisterlow (SCIDRL). 0 No parity error 1 Parity error Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 391 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.3.2.5 SCI Status Register 2 (SCISR2) Module Base + 0x_0005 7 6 5 4 3 2 1 0 R 0 0 0 0 0 RAF BK13 TXDIR W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure13-7. SCI Status Register 2 (SCISR2) Read: Anytime Write: Anytime; writing accesses SCI status register 2; writing to any bits except TXDIR and BRK13 (SCISR2[1] & [2]) has no effect Table13-6. SCISR2 Field Descriptions Field Description 2 Break Transmit Character Length— This bit determines whether the transmit break character is 10 or 11 bit BK13 respectively 13 or 14 bits long. The detection of a framing error is not affected by this bit. 0 Break Character is 10 or 11 bit long 1 Break character is 13 or 14 bit long 1 TransmitterPinDataDirectioninSingle-WireMode.—ThisbitdetermineswhethertheTXDpinisgoingto TXDIR be used as an input or output, in the Single-Wire mode of operation. This bit is only relevant in the Single-Wire mode of operation. 0 TXD pin to be used as an input in Single-Wire mode 1 TXD pin to be used as an output in Single-Wire mode 0 ReceiverActiveFlag—RAFissetwhenthereceiverdetectsalogic0duringtheRT1timeperiodofthestart RAF bit search. RAF is cleared when the receiver detects an idle character. 0 No reception in progress 1 Reception in progress 392 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.3.2.6 SCI Data Registers (SCIDRH and SCIDRL) Module Base + 0x_0006 7 6 5 4 3 2 1 0 R R8 0 0 0 0 0 0 T8 W Reset 0 0 0 0 0 0 0 0 Module Base + 0x_0007 7 6 5 4 3 2 1 0 R R7 R6 R5 R4 R3 R2 R1 R0 W T7 T6 T5 T4 T3 T2 T1 T0 Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure13-8. SCI Data Registers (SCIDRH and SCIDRL) Read: Anytime; reading accesses SCI receive data register Write: Anytime; writing accesses SCI transmit data register; writing to R8 has no effect Table13-7. SCIDRH AND SCIDRL Field Descriptions Field Description 7 Received Bit 8 — R8 is the ninth data bit received when the SCI is configured for 9-bit data format (M = 1). R8 6 Transmit Bit 8 — T8 is the ninth data bit transmitted when the SCI is configured for 9-bit data format (M = 1). T8 7–0 Received Bits— Received bits seven through zero for 9-bit or 8-bit data formats R[7:0] T[7:0] Transmit Bits — Transmit bits seven through zero for 9-bit or 8-bit formats NOTE If the value of T8 is the same as in the previous transmission, T8 does not have to be rewritten.The same value is transmitted until T8 is rewritten In 8-bit data format, only SCI data register low (SCIDRL) needs to be accessed. When transmitting in 9-bit data format and using 8-bit write instructions, write first to SCI data register high (SCIDRH), then SCIDRL. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 393 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.4 Functional Description This section provides a complete functional description of the SCI block, detailing the operation of the design from the end user perspective in a number of subsections. Figure13-9showsthestructureoftheSCImodule.TheSCIallowsfullduplex,asynchronous,NRZserial communication between the CPU and remote devices, including other CPUs. The SCI transmitter and receiver operate independently, although they use the same baud rate generator. The CPU monitors the status of the SCI, writes the data to be transmitted, and processes received data. SCI DATA REGISTER R8 RECEIVE NF RXD SHIFT REGISTER FE RE PF RWU RECEIVE AND WAKEUP LOOPS RAF ILIE CONTROL IDLE SBR12–SBR0 RSRC RDRF M OR CBLOUCSK GBEANUEDR RAATTOER DACTOAN FTORROMLAT WIPALETKE RIE DRF/OR IRQ IDLE IRQ IRQ R PT TO CPU Q R TE RE I ÷16 TCROANNTSRMOILT LOOPS TIE TD C IRQ SBK T TDRE RSRC TC TRANSMIT T8 TCIE SHIFT REGISTER SCI DATA TXD REGISTER Figure13-9. SCI Block Diagram 394 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.4.1 Data Format The SCI uses the standard NRZ mark/space data format illustrated inFigure 13-10 below. 8-BIT DATA FORMAT PARITY BIT M IN SCICR1 CLEAR OR DATA BIT NEXT START START BIT BIT 0 BIT 1 BIT 2 BIT 3 BIT 4 BIT 5 BIT 6 BIT 7 STOP BIT BIT 9-BIT DATA FORMAT PARITY BIT M IN SCICR1 SET OR DATA BIT NEXT START START BIT BIT 0 BIT 1 BIT 2 BIT 3 BIT 4 BIT 5 BIT 6 BIT 7 BIT 8 STOP BIT BIT Figure13-10. SCI Data Formats Eachdatacharacteriscontainedinaframethatincludesastartbit,eightorninedatabits,andastopbit. ClearingtheMbitinSCIcontrolregister1configurestheSCIfor8-bitdatacharacters.Aframewitheight data bits has a total of 10 bits. Setting the M bit configures the SCI for nine-bit data characters. A frame with nine data bits has a total of 11 bits Table13-8. Example of 8-Bit Data Formats Start Data Address Parity Stop Bit Bits Bits Bits Bit 1 8 0 0 1 1 7 0 1 1 1 7 1(1) 0 1 1. The address bit identifies the frame as an address character. See Section13.4.4.6, “Receiver Wakeup”. When the SCI is configured for 9-bit data characters, the ninth data bit is the T8 bit in SCI data register high(SCIDRH).Itremainsunchangedaftertransmissionandcanbeusedrepeatedlywithoutrewritingit. A frame with nine data bits has a total of 11 bits. Table13-9. Example of 9-Bit Data Formats Start Data Address Parity Stop Bit Bits Bits Bits Bit 1 9 0 0 1 1 8 0 1 1 1 8 1(1) 0 1 1. The address bit identifies the frame as an address character. See Section13.4.4.6, “Receiver Wakeup”. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 395 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.4.2 Baud Rate Generation A 13-bit modulus counter in the baud rate generator derives the baud rate for both the receiver and the transmitter. The value from 0 to 8191 written to the SBR12–SBR0 bits determines the module clock divisor. The SBR bits are in the SCI baud rate registers (SCIBDH and SCIBDL). The baud rate clock is synchronized with the bus clock and drives the receiver. The baud rate clock divided by 16 drives the transmitter. The receiver has an acquisition rate of 16 samples per bit time. Baud rate generation is subject to one source of error: Integer division of the module clock may not give the exact target frequency. Table13-10listssomeexamplesofachievingtargetbaudrateswithamoduleclockfrequencyof25MHz SCI baud rate = SCI module clock / (16 * SCIBR[12:0]) Table13-10. Baud Rates (Example: Module Clock = 25 MHz) Bits Receiver Transmitter Target Baud Error SBR[12-0] Clock (Hz) Clock (Hz) Rate (%) 41 609,756.1 38,109.8 38,400 .76 81 308,642.0 19,290.1 19,200 .47 163 153,374.2 9585.9 9600 .16 326 76,687.1 4792.9 4800 .15 651 38,402.5 2400.2 2400 .01 1302 19,201.2 1200.1 1200 .01 2604 9600.6 600.0 600 .00 5208 4800.0 300.0 300 .00 396 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.4.3 Transmitter INTERNAL BUS CLBOUCSK BAUD DIVIDER ÷ 16 SCI DATA REGISTERS SBR12–SBR0 T P R O A ST 11-BIT TRANSMIT SHIFT REGISTER ST M H 8 7 6 5 4 3 2 1 0 L TXD B S M T8 LOOP TO S) CONTROL RXD E DR ON PPET GENPAERRIATTYION OAD FROM SCI HIFT ENABLE REAMBLE (ALL REAK (ALL 0s) LROSORPCS L S P B TRANSMITTER CONTROL TDRE TE SBK TDRE INTERRUPT REQUEST TIE TC TC INTERRUPT REQUEST TCIE Figure13-11. Transmitter Block Diagram 13.4.3.1 Transmitter Character Length The SCI transmitter can accommodate either 8-bit or 9-bit data characters. The state of the M bit in SCI controlregister1(SCICR1)determinesthelengthofdatacharacters.Whentransmitting9-bitdata,bitT8 in SCI data register high (SCIDRH) is the ninth bit (bit 8). 13.4.3.2 Character Transmission Totransmitdata,theMCUwritesthedatabitstotheSCIdataregisters(SCIDRH/SCIDRL),whichinturn are transferred to the transmitter shift register. The transmit shift register then shifts a frame out through theTxoutputsignal,afterithasprefacedthemwithastartbitandappendedthemwithastopbit.TheSCI data registers (SCIDRH and SCIDRL) are the write-only buffers between the internal data bus and the transmit shift register. TheSCIalsosetsaflag,thetransmitdataregisteremptyflag(TDRE),everytimeittransfersdatafromthe buffer(SCIDRH/L)tothetransmittershiftregister.Thetransmitdriverroutinemayrespondtothisflagby Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 397 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description writinganotherbytetotheTransmitterbuffer(SCIDRH/SCIDRL),whiletheshiftregisterisstillshifting out the first byte. To initiate an SCI transmission: 1. Configure the SCI: a) Select a baud rate. Write this value to the SCI baud registers (SCIBDH/L) to begin the baud rate generator. Remember that the baud rate generator is disabled when the baud rate is zero. Writing to the SCIBDH has no effect without also writing to SCIBDL. b) Write to SCICR1 to configure word length, parity, and other configuration bits (LOOPS,RSRC,M,WAKE,ILT,PE,PT). c) Enablethetransmitter,interrupts,receive,andwakeupasrequired,bywritingtotheSCICR2 register bits (TIE,TCIE,RIE,ILIE,TE,RE,RWU,SBK). A preamble or idle character will now be shifted out of the transmitter shift register. 2. Transmit Procedure for Each Byte: a. PolltheTDREflagbyreadingtheSCISR1orrespondingtotheTDREinterrupt.Keepinmind that the TDRE bit resets to one. d) If the TDRE flag is set, write the data to be transmitted to SCIDRH/L, where the ninth bit is writtentotheT8bitinSCIDRHiftheSCIisin9-bitdataformat.Anewtransmissionwillnot result until the TDRE flag has been cleared. 3. Repeat step 2 for each subsequent transmission. NOTE TheTDREflagissetwhentheshiftregisterisloadedwiththenextdatato betransmittedfromSCIDRH/L,whichhappens,generallyspeaking,alittle over half-way through the stop bit of the previous frame. Specifically, this transfer occurs 9/16ths of a bit time AFTER the start of the stop bit of the previous frame. WritingtheTEbitfrom0toa1automaticallyloadsthetransmitshiftregisterwithapreambleof10logic 1s(ifM=0)or11logic1s(ifM=1).Afterthepreambleshiftsout,controllogictransfersthedatafrom the SCI data register into the transmit shift register. A logic 0 start bit automatically goes into the least significant bit position of the transmit shift register. A logic 1 stop bit goes into the most significant bit position. Hardware supports odd or even parity. When parity is enabled, the most significant bit (msb) of the data character is the parity bit. Thetransmitdataregisteremptyflag,TDRE,inSCIstatusregister1(SCISR1)becomessetwhentheSCI data register transfers a byte to the transmit shift register. The TDRE flag indicates that the SCI data register can accept new data from the internal data bus. If the transmit interrupt enable bit, TIE, in SCI control register 2 (SCICR2) is also set, the TDRE flag generates a transmitter interrupt request. Whenthetransmitshiftregisterisnottransmittingaframe,theTxoutputsignalgoestotheidlecondition, logic1.IfatanytimesoftwareclearstheTEbitinSCIcontrolregister2(SCICR2),thetransmitterenable signal goes low and the transmit signal goes idle. 398 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description IfsoftwareclearsTEwhileatransmissionisinprogress(TC=0),theframeinthetransmitshiftregister continuestoshiftout.Toavoidaccidentallycuttingoffthelastframeinamessage,alwayswaitforTDRE to go high after the last frame before clearing TE. To separate messages with preambles with minimum idle line time, use this sequence between messages: 1. Write the last byte of the first message to SCIDRH/L. 2. Wait for the TDRE flag to go high, indicating the transfer of the last frame to the transmit shift register. 3. Queue a preamble by clearing and then setting the TE bit. 4. Write the first byte of the second message to SCIDRH/L. 13.4.3.3 Break Characters Writing a logic 1 to the send break bit, SBK, in SCI control register 2 (SCICR2) loads the transmit shift registerwithabreakcharacter.Abreakcharactercontainsalllogic0sandhasnostart,stop,orparitybit. Break character length depends on the M bit in SCI control register 1 (SCICR1). As long as SBK is at logic1,transmitterlogiccontinuouslyloadsbreakcharactersintothetransmitshiftregister.Aftersoftware clearstheSBKbit,theshiftregisterfinishestransmittingthelastbreakcharacterandthentransmitsatleast onelogic1.Theautomaticlogic1attheendofabreakcharacterguaranteestherecognitionofthestartbit of the next frame. The SCI recognizes a break character when a start bit is followed by eight or nine logic 0 data bits and a logic 0 where the stop bit should be. Receiving a break character has these effects on SCI registers: • Sets the framing error flag, FE • Sets the receive data register full flag, RDRF • Clears the SCI data registers (SCIDRH/L) • Maysettheoverrunflag,OR,noiseflag,NF,parityerrorflag,PE,orthereceiveractiveflag,RAF (seeSection13.3.2.4, “SCI Status Register 1 (SCISR1)” and Section13.3.2.5, “SCI Status Register 2 (SCISR2)” 13.4.3.4 Idle Characters Anidlecharactercontainsalllogic1sandhasnostart,stop,orparitybit.Idlecharacterlengthdependson the M bit in SCI control register 1 (SCICR1). The preamble is a synchronizing idle character that begins the first transmission initiated after writing the TE bit from 0 to 1. If the TE bit is cleared during a transmission, the Tx outputsignal becomes idle after completion of the transmission in progress. Clearing and then setting the TE bit during a transmission queues an idle character to be sent after the frame currently being transmitted. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 399 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description NOTE Whenqueueinganidlecharacter,returntheTEbittologic1beforethestop bitofthecurrentframeshiftsoutthroughtheTxoutputsignal.SettingTE afterthestopbitappearsonTxoutputsignalcausesdatapreviouslywritten to the SCI data register to be lost. Toggle the TE bit for a queued idle character while the TDRE flag is set and immediately before writing the next byte to the SCI data register. NOTE If the TE bit is clear and the transmission is complete, the SCI is not the master of the TXD pin 13.4.4 Receiver INTERNAL BUS SBR12–SBR0 SCI DATA REGISTER BUS CLOCK BAUD DIVIDER P RT O A ST 11-BIT RECEIVE SHIFT REGISTER ST DATA RXD H 8 7 6 5 4 3 2 1 0 L RECOVERY S FROM TXD COLNOTORPOL ONE RE ALL MSB RAF LOOPS FE RSRC M NF RWU WAKE WAKEUP PE LOGIC ILT PE PARITY R8 CHECKING PT IDLE IDLE INTERRUPT REQUEST ILIE RDRF RDRF/OR INTERRUPT REQUEST OR RIE Figure13-12. SCI Receiver Block Diagram 13.4.4.1 Receiver Character Length The SCI receiver can accommodate either 8-bit or 9-bit data characters. The state of the M bit in SCI controlregister1(SCICR1)determinesthelengthofdatacharacters.Whenreceiving9-bitdata,bitR8in SCI data register high (SCIDRH) is the ninth bit (bit 8). 400 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.4.4.2 Character Reception DuringanSCIreception,thereceiveshiftregistershiftsaframeinfromtheRxinputsignal.TheSCIdata register is the read-only buffer between the internal data bus and the receive shift register. After a complete frame shifts into the receive shift register, the data portion of the frame transfers to the SCIdataregister.Thereceivedataregisterfullflag,RDRF,inSCIstatusregister1(SCISR1)becomesset, indicating that the received byte can be read. If the receive interrupt enable bit, RIE, in SCI control register 2 (SCICR2) is also set, the RDRF flag generates an RDRF interrupt request. 13.4.4.3 Data Sampling The receiver samples the Rx inputsignal at the RT clock rate. The RT clock is an internal signal with a frequency16timesthebaudrate.Toadjustforbaudratemismatch,theRTclock(seeFigure13-13)isre- synchronized: • After every start bit • After the receiver detects a data bit change from logic 1 to logic 0 (after the majority of data bit samplesatRT8,RT9,andRT10returnsavalidlogic1andthemajorityofthenextRT8,RT9,and RT10 samples returns a valid logic 0) To locate the start bit, data recovery logic does an asynchronous search for a logic 0 preceded by three logic1s.When the falling edge of a possible start bit occurs, the RT clock begins to count to 16. START BIT LSB Rx Input Signal SAMPLES 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 START BIT START BIT DATA QUALIFICATION VERIFICATION SAMPLING RT CLOCK RT CLOCK COUNT T1 T1 T1 T1 T1 T1 T1 T1 T1 T2 T3 T4 T5 T6 T7 T8 T9 10 11 12 13 14 15 16 T1 T2 T3 T4 R R R R R R R R R R R R R R R R R T T T T T T T R R R R R R R R R R R RESET RT CLOCK Figure13-13. Receiver Data Sampling To verify the start bit and to detect noise, data recovery logic takes samples at RT3, RT5, and RT7. Table13-11 summarizes the results of the start bit verification samples. Table13-11. Start Bit Verification RT3, RT5, and RT7 Samples Start Bit Verification Noise Flag 000 Yes 0 001 Yes 1 010 Yes 1 011 No 0 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 401 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description Table13-11. Start Bit Verification RT3, RT5, and RT7 Samples Start Bit Verification Noise Flag 100 Yes 1 101 No 0 110 No 0 111 No 0 If start bit verification is not successful, the RT clock is reset and a new search for a start bit begins. To determine the value of a data bit and to detect noise, recovery logic takes samples at RT8, RT9, and RT10. Table13-12 summarizes the results of the data bit samples. Table13-12. Data Bit Recovery RT8, RT9, and RT10 Samples Data Bit Determination Noise Flag 000 0 0 001 0 1 010 0 1 011 1 1 100 0 1 101 1 1 110 1 1 111 1 0 NOTE TheRT8,RT9,andRT10samplesdonotaffectstartbitverification.Ifany or all of the RT8, RT9, and RT10 start bit samples are logic 1s following a successful start bit verification, the noise flag (NF) is set and the receiver assumes that the bit is a start bit (logic 0). Toverifyastopbitandtodetectnoise,recoverylogictakessamplesatRT8,RT9,andRT10.Table13-13 summarizes the results of the stop bit samples. Table13-13. Stop Bit Recovery RT8, RT9, and RT10 Samples Framing Error Flag Noise Flag 000 1 0 001 1 1 010 1 1 011 0 1 100 1 1 101 0 1 110 0 1 111 0 0 402 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description InFigure13-14theverificationsamplesRT3andRT5determinethatthefirstlowdetectedwasnoiseand not the beginning of a start bit. The RT clock is reset and the start bit search begins again. The noise flag is not set because the noise occurred before the start bit was found. START BIT LSB Rx Input Signal SAMPLES 1 1 1 0 1 1 1 0 0 0 0 0 0 0 RT CLOCK RT CLOCK COUNT T1 T1 T1 T1 T2 T3 T4 T5 T1 T1 T2 T3 T4 T5 T6 T7 T8 T9 10 11 12 13 14 15 16 T1 T2 T3 R R R R R R R R R R R R R R R R R R T T T T T T T R R R R R R R R R R RESET RT CLOCK Figure13-14. Start Bit Search Example 1 In Figure13-15, verification sample at RT3 is high. The RT3 sample sets the noise flag. Although the perceived bit time is misaligned, the data samples RT8, RT9, and RT10 are within the bit time and data recovery is successful. PERCEIVED START BIT ACTUAL START BIT LSB Rx Input Signal SAMPLES 1 1 1 1 1 0 1 0 0 0 0 0 RT CLOCK RT CLOCK COUNT T1 T1 T1 T1 T1 T1 T2 T3 T4 T5 T6 T7 T8 T9 10 11 12 13 14 15 16 T1 T2 T3 T4 T5 T6 T7 R R R R R R R R R R R R R R T T T T T T T R R R R R R R R R R R R R R RESET RT CLOCK Figure13-15. Start Bit Search Example 2 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 403 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description InFigure13-16,alargeburstofnoiseisperceivedasthebeginningofastartbit,althoughthetestsample atRT5ishigh.TheRT5samplesetsthenoiseflag.Althoughthisisaworst-casemisalignmentofperceived bit time, the data samples RT8, RT9, and RT10 are within the bit time and data recovery is successful. PERCEIVED START BIT ACTUAL START BIT LSB Rx input Signal SAMPLES 1 1 1 0 0 1 0 0 0 0 RT CLOCK RT CLOCK COUNT T1 T1 T1 T1 T2 T3 T4 T5 T6 T7 T8 T9 10 11 12 13 14 15 16 T1 T2 T3 T4 T5 T6 T7 T8 T9 R R R R R R R R R R R R T T T T T T T R R R R R R R R R R R R R R R R RESET RT CLOCK Figure13-16. Start Bit Search Example 3 Figure13-17showstheeffectofnoiseearlyinthestartbittime.Althoughthisnoisedoesnotaffectproper synchronization with the start bit time, it does set the noise flag. PERCEIVED AND ACTUAL START BIT LSB Rx Input Signal SAMPLES 1 1 1 1 1 1 1 1 1 0 1 0 RT CLOCK RT CLOCK COUNT T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 T2 T3 T4 T5 T6 T7 T8 T9 10 11 12 13 14 15 16 T1 T2 T3 R R R R R R R R R R R R R R R R R R T T T T T T T R R R R R R R R R R RESET RT CLOCK Figure13-17. Start Bit Search Example 4 404 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description Figure13-18showsaburstofnoisenearthebeginningofthestartbitthatresetstheRTclock.Thesample after the reset is low but is not preceded by three high samples that would qualify as a falling edge. Dependingonthetimingofthestartbitsearchandonthedata,theframemaybemissedentirelyoritmay set the framing error flag. START BIT LSB Rx Input Signal NO START BIT FOUND SAMPLES 1 1 1 1 1 1 1 1 1 0 0 1 1 0 0 0 0 0 0 0 0 RT CLOCK RT CLOCK COUNT T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 T2 T3 T4 T5 T6 T7 T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 R R R R R R R R R R R R R R R R R R R R R R R R R R R R RESET RT CLOCK Figure13-18. Start Bit Search Example 5 InFigure13-19,anoiseburstmakesthemajorityofdatasamplesRT8,RT9,andRT10high.Thissetsthe noise flag but does not reset the RT clock. In start bits only, the RT8, RT9, and RT10 data samples are ignored. START BIT LSB Rx Input Signal SAMPLES 1 1 1 1 1 1 1 1 1 0 0 0 0 1 0 1 RT CLOCK RT CLOCK COUNT T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 T2 T3 T4 T5 T6 T7 T8 T9 10 11 12 13 14 15 16 T1 T2 T3 R R R R R R R R R R R R R R R R R R T T T T T T T R R R R R R R R R R RESET RT CLOCK Figure13-19. Start Bit Search Example 6 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 405 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.4.4.4 Framing Errors If the data recovery logic does not detect a logic 1 where the stop bit should be in an incoming frame, it sets the framing error flag, FE, in SCI status register 1 (SCISR1). A break character also sets the FE flag because a break character has no stop bit. The FE flag is set at the same time that the RDRF flag is set. 13.4.4.5 Baud Rate Tolerance Atransmittingdevicemaybeoperatingatabaudratebeloworabovethereceiverbaudrate.Accumulated bittimemisalignmentcancauseoneofthethreestopbitdatasamples(RT8,RT9,andRT10)tofalloutside theactualstopbit.AnoiseerrorwilloccuriftheRT8,RT9,andRT10samplesarenotallthesamelogical values.Aframingerrorwilloccurifthereceiverclockismisalignedinsuchawaythatthemajorityofthe RT8, RT9, and RT10 stop bit samples are a logic zero. As the receiver samples an incoming frame, it re-synchronizes the RT clock on any valid falling edge within the frame. Re synchronization within frames will correct a misalignment between transmitter bit times and receiver bit times. 13.4.4.5.1 Slow Data Tolerance Figure13-20 shows how much a slow received frame can be misaligned without causing a noise error or a framing error. The slow stop bit begins at RT8 instead of RT1 but arrives in time for the stop bit data samples at RT8, RT9, and RT10. MSB STOP RECEIVER RT CLOCK 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 T T T T T T T T T 1 1 1 1 1 1 1 R R R R R R R R R T T T T T T T R R R R R R R DATA SAMPLES Figure13-20. Slow Data Let’s take RTras receiver RT clock and RTt as transmitter RT clock. Foran8-bitdatacharacter,ittakesthereceiver9bittimesx16RTrcycles+7RTrcycles=151RTrcycles to start data sampling of the stop bit. WiththemisalignedcharactershowninFigure13-20,thereceivercounts151RTrcyclesatthepointwhen the count of the transmitting device is 9 bit times x 16 RTt cycles = 144 RTt cycles. Themaximumpercentdifferencebetweenthereceivercountandthetransmittercountofaslow8-bitdata character with no errors is: ((151 – 144) / 151) x 100 = 4.63% Fora9-bitdatacharacter,ittakesthereceiver10bittimesx16RTrcycles+7RTrcycles=167RTrcycles to start data sampling of the stop bit. 406 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description WiththemisalignedcharactershowninFigure13-20,thereceivercounts167RTrcyclesatthepointwhen the count of the transmitting device is 10 bit times x 16 RTt cycles = 160 RTt cycles. The maximum percent difference between the receiver count and the transmitter count of a slow 9-bit character with no errors is: ((167 – 160) / 167) X 100 = 4.19% 13.4.4.5.2 Fast Data Tolerance Figure13-21 shows how much a fast received frame can be misaligned. The fast stop bit ends at RT10 instead of RT16 but is still sampled at RT8, RT9, and RT10. STOP IDLE OR NEXT FRAME RECEIVER RT CLOCK 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 T T T T T T T T T 1 1 1 1 1 1 1 R R R R R R R R R T T T T T T T R R R R R R R DATA SAMPLES Figure13-21. Fast Data Foran8-bitdatacharacter,ittakesthereceiver9bittimesx16RTrcycles+10RTrcycles=154RTrcycles to finish data sampling of the stop bit. WiththemisalignedcharactershowninFigure13-21,thereceivercounts154RTrcyclesatthepointwhen the count of the transmitting device is 10 bit times x 16 RTt cycles = 160 RTt cycles. The maximum percent difference between the receiver count and the transmitter count of a fast 8-bit character with no errors is: ((160 – 154) / 160) x 100 = 3.75% Fora9-bitdatacharacter,ittakesthereceiver10bittimesx16RTrcycles+10RTrcycles=170RTrcycles to finish data sampling of the stop bit. WiththemisalignedcharactershowninFigure13-21,thereceivercounts170RTrcyclesatthepointwhen the count of the transmitting device is 11 bit times x 16 RTt cycles = 176 RTt cycles. The maximum percent difference between the receiver count and the transmitter count of a fast 9-bit character with no errors is: ((176 – 170) / 176) x 100 = 3.40% 13.4.4.6 Receiver Wakeup ToenabletheSCIto ignoretransmissionsintendedonlyforotherreceiversinmultiple-receiver systems, thereceivercanbeputintoastandbystate.Settingthereceiverwakeupbit,RWU,inSCIcontrolregister 2(SCICR2)putsthereceiverintostandbystateduringwhichreceiverinterruptsaredisabled.TheSCIwill still load the receive data into the SCIDRH/L registers, but it will not set the RDRF flag. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 407 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description Thetransmittingdevicecanaddressmessagestoselectedreceiversbyincludingaddressinginformationin the initial frame or frames of each message. TheWAKEbitinSCIcontrolregister1(SCICR1)determineshowtheSCIisbroughtoutofthestandby state to process an incoming message. The WAKE bit enables either idle line wakeup or address mark wakeup. 13.4.4.6.1 Idle Input Line Wakeup (WAKE = 0) Inthiswakeupmethod,anidleconditionontheRxInputsignalclearstheRWUbitandwakesuptheSCI. The initial frame or frames of every message contain addressing information. All receivers evaluate the addressinginformation,andreceiversforwhichthemessageisaddressedprocesstheframesthatfollow. AnyreceiverforwhichamessageisnotaddressedcansetitsRWUbitandreturntothestandbystate.The RWU bit remains set and the receiver remains on standby until another idle character appears on the Rx Input signal. Idle line wakeup requires that messages be separated by at least one idle character and that no message contains idle characters. Theidlecharacterthatwakesareceiverdoesnotsetthereceiveridlebit,IDLE,orthereceivedataregister full flag, RDRF. Theidlelinetypebit,ILT,determineswhetherthereceiverbeginscountinglogic1sasidlecharacterbits after the start bit or after the stop bit. ILT is in SCI control register 1 (SCICR1). 13.4.4.6.2 Address Mark Wakeup (WAKE = 1) Inthiswakeupmethod,alogic1inthemostsignificantbit(msb)positionofaframeclearstheRWUbit and wakes up the SCI. The logic 1 in the msb position marks a frame as an address frame that contains addressinginformation.Allreceiversevaluatetheaddressinginformation,andthereceiversforwhichthe messageisaddressedprocesstheframesthatfollow.Anyreceiverforwhichamessageisnotaddressedcan set its RWU bit and return to the standby state. The RWU bit remains set and the receiver remains on standby until another address frame appears on theRx Input signal. Thelogic1msbofanaddressframeclearsthereceiver’sRWUbitbeforethestopbitisreceivedandsets the RDRF flag. Addressmarkwakeupallowsmessagestocontainidlecharactersbutrequiresthatthemsbbereservedfor use in address frames.{sci_wake} NOTE WiththeWAKEbitclear,settingtheRWUbitaftertheRxInputsignalhas been idle can cause the receiver to wake up immediately. 408 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.4.5 Single-Wire Operation Normally, the SCI uses two pins for transmitting and receiving. In single-wire operation, the RXD pin is disconnected from the SCI. The SCI uses the TXD pin for both receiving and transmitting. Tx OUTPUT SIGNAL TRANSMITTER Tx INPUT SIGNAL RECEIVER RXD Figure13-22. Single-Wire Operation (LOOPS = 1, RSRC = 1) Enablesingle-wireoperationbysettingtheLOOPSbitandthereceiversourcebit,RSRC,inSCIcontrol register 1 (SCICR1). Setting the LOOPS bit disables the path from the Rx Input signal to the receiver. SettingtheRSRCbitconnectsthereceiverinputtotheoutputoftheTXDpindriver.Boththetransmitter and receiver must be enabled (TE = 1 and RE = 1).The TXDIR bit (SCISR2[1]) determines whether the TXDpinisgoingtobeusedasaninput(TXDIR=0)oranoutput(TXDIR=1)inthismodeofoperation. 13.4.6 Loop Operation In loop operation the transmitter output goes to the receiver input. The Rx Input signal is disconnected from the SCI . TRANSMITTER Tx OUTPUT SIGNAL RECEIVER RXD Figure13-23. Loop Operation (LOOPS = 1, RSRC = 0) Enable loop operation by setting the LOOPS bit and clearing the RSRC bit in SCI control register 1 (SCICR1).SettingtheLOOPSbitdisablesthepathfromtheRxInputsignaltothereceiver.Clearingthe RSRC bit connects the transmitter output to the receiver input. Both the transmitter and receiver must be enabled (TE = 1 and RE = 1). 13.5 Initialization Information 13.5.1 Reset Initialization TheresetstateofeachindividualbitislistedinSection13.3,“MemoryMapandRegisters”whichdetails the registers and their bit fields. All special functions or modes which are initialized during or just following reset are described within this section. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 409 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.5.2 Interrupt Operation 13.5.2.1 System Level Interrupt Sources There are five interrupt sources that can generate an SCI interrupt in to the CPU. They are listed in Table13-14. Table13-14. SCI Interrupt Source Interrupt Source Flag Local Enable Transmitter TDRE TIE Transmitter TC TCIE Receiver RDRF RIE OR Receiver IDLE ILIE 410 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 13.5.2.2 Interrupt Descriptions TheSCIonlyoriginatesinterruptrequests.ThefollowingisadescriptionofhowtheSCImakesarequest andhowtheMCUshouldacknowledgethatrequest.Theinterruptvectoroffsetandinterruptnumberare chipdependent.TheSCIonlyhasasingleinterruptline(SCIInterruptSignal,activehighoperation)and all the following interrupts, when generated, are ORed together and issued through that port. 13.5.2.2.1 TDRE Description The TDRE interrupt is set high by the SCI when the transmit shift register receives a byte from the SCI data register. A TDRE interrupt indicates that the transmit data register (SCIDRH/L) is empty and that a new byte can be written to the SCIDRH/L for transmission.Clear TDRE by reading SCI status register 1 with TDRE set and then writing to SCI data register low (SCIDRL). 13.5.2.2.2 TC Description TheTCinterruptissetbytheSCIwhenatransmissionhasbeencompleted.ATCinterruptindicatesthat there is no transmission in progress. TC is set high when the TDRE flag is set and no data, preamble, or break character is being transmitted. When TC is set, the TXD pin becomes idle (logic 1). Clear TC by readingSCIstatusregister1(SCISR1)withTCsetandthenwritingtoSCIdataregisterlow(SCIDRL).TC is cleared automatically when data, preamble, or break is queued and ready to be sent. 13.5.2.2.3 RDRF Description The RDRF interrupt is set when the data in the receive shift register transfers to the SCI data register. A RDRF interrupt indicates that the received data has been transferred to the SCI data register and that the byte can now be read by the MCU. The RDRF interrupt is cleared by reading the SCI status register one (SCISR1) and then reading SCI data register low (SCIDRL). 13.5.2.2.4 OR Description The OR interrupt is set when software fails to read the SCI data register before the receive shift register receivesthenextframe.Thenewlyacquireddataintheshiftregisterwillbelostinthiscase,butthedata already in the SCI data registers is not affected. The OR interrupt is cleared by reading the SCI status register one (SCISR1) and then reading SCI data register low (SCIDRL). 13.5.2.3 IDLE Description The IDLE interrupt is set when 10 consecutive logic 1s (if M = 0) or 11 consecutive logic 1s (if M = 1) appearonthereceiverinput.OncetheIDLEiscleared,avalidframemustagainsettheRDRFflagbefore anidleconditioncansettheIDLEflag.ClearIDLEbyreadingSCIstatusregister1(SCISR1)withIDLE set and then reading SCI data register low (SCIDRL). 13.5.3 Recovery from Wait Mode The SCI interrupt request can be used to bring the CPU out of wait mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 411 Rev 01.24

Chapter13 Serial Communications Interface (S12SCIV2) Block Description 412 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 14 Serial Peripheral Interface (SPIV3) Block Description 14.1 Introduction The SPI module allows a duplex, synchronous, serial communication between the MCU and peripheral devices. Software can poll the SPI status flags or the SPI operation can be interrupt driven. 14.1.1 Features The SPIV3 includes these distinctive features: • Master mode and slave mode • Bidirectional mode • Slave select output • Mode fault error flag with CPU interrupt capability • Double-buffered data register • Serial clock with programmable polarity and phase • Control of SPI operation during wait mode 14.1.2 Modes of Operation The SPI functions in three modes, run, wait, and stop. • Run Mode This is the basic mode of operation. • Wait Mode SPI operation in wait mode is a configurable low power mode, controlled by the SPISWAI bit located in the SPICR2 register. In wait mode, if the SPISWAI bit is clear, the SPI operates like in Run Mode. If the SPISWAI bit is set, the SPI goes into a power conservative state, with the SPI clockgenerationturnedoff.IftheSPIisconfiguredasamaster,anytransmissioninprogressstops, but is resumed after CPU goes into Run Mode. If the SPI is configured as a slave, reception and transmission of a byte continues, so that the slave stays synchronized to the master. • Stop Mode The SPI is inactive in stop mode for reduced power consumption. If the SPI is configured as a master,anytransmissioninprogressstops,butisresumedafterCPUgoesintorunmode.IftheSPI is configured as a slave, reception and transmission of a byte continues, so that the slave stays synchronized to the master. This is a high level description only, detailed descriptions of operating modes are contained in Section14.4, “Functional Description.” Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 413 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.1.3 Block Diagram Figure14-1 gives an overview on the SPI architecture. The main parts of the SPI are status, control, and data registers, shifter logic, baud rate generator, master/slave control logic, and port control logic. SPI 2 SPI Control Register 1 BIDIROE 2 SPI Control Register 2 SPC0 SPI Status Register Slave CPOL CPHA MOSI Control SPIF MODF SPTEF Phase + SCK in Interrupt Control Slave Baud Rate Polarity SPI Control Interrupt Master Baud Rate Phase + SCK out Request Polarity Port Control Control SCK Baud Rate Generator Master Logic Control Counter SS Bus Clock Baud Rate Shift Sample Prescaler Clock Select Clock Clock SPPR 3 SPR 3 Shifter SPI Baud Rate Register data in LSBFE=1 LSBFE=0 8 LSBFE=1 SPI Data Register 8 MSB LSB LSBFE=0 LSBFE=0 LSBFE=1 data out Figure14-1. SPI Block Diagram 14.2 External Signal Description Thissectionliststhenameanddescriptionofallportsincludinginputsandoutputsthatdo,ormay,connect off chip. The SPIV3 module has a total of four external pins. 14.2.1 MOSI — Master Out/Slave In Pin ThispinisusedtotransmitdataoutoftheSPImodulewhenitisconfiguredasamasterandreceivedata when it is configured as slave. 414 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.2.2 MISO — Master In/Slave Out Pin This pin is used to transmit data out of the SPI module when it is configured as a slave and receive data when it is configured as master. 14.2.3 SS — Slave Select Pin This pin is used to output the select signal from the SPI module to another peripheral with which a data transferistotakeplacewhenitsconfiguredasamasteranditsusedasaninputtoreceivetheslaveselect signal when the SPI is configured as slave. 14.2.4 SCK — Serial Clock Pin ThispinisusedtooutputtheclockwithrespecttowhichtheSPItransfersdataorreceiveclockincaseof slave. 14.3 Memory Map and Register Definition This section provides a detailed description of address space and registers used by the SPI. The memory map for the SPIV3 is given below in Table 14-1. The address listed for each register is the sumofabaseaddressandanaddressoffset.ThebaseaddressisdefinedattheSoClevelandtheaddress offset is defined at the module level. Reads from the reserved bits return zeros and writes to the reserved bits have no effect. 14.3.1 Module Memory Map Table14-1. SPIV3 Memory Map Address Use Access 0x0000 SPI Control Register 1 (SPICR1) R/W 0x0001 SPI Control Register 2 (SPICR2) R/W(1) 0x0002 SPI Baud Rate Register (SPIBR) R/W1 0x0003 SPI Status Register (SPISR) R(2) 0x0004 Reserved —2,(3) 0x0005 SPI Data Register (SPIDR) R/W 0x0006 Reserved —2,3 0x0007 Reserved —2,3 1. Certain bits are non-writable. 2. Writes to this register are ignored. 3. Reading from this register returns all zeros. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 415 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.3.2 Register Descriptions Thissectionconsistsofregisterdescriptionsinaddressorder.Eachdescriptionincludesastandardregister diagram with an associated figure number. Details of register bit and field function follow the register diagrams, in bit order. Name 7 6 5 4 3 2 1 0 0x0000 R SPIE SPE SPTIE MSTR CPOL CPHA SSOE LSBFE SPICR1 W 0x0001 R 0 0 0 0 MODFEN BIDIROE SPISWAI SPC0 SPICR2 W 0x0002 R 0 0 SPPR2 SPPR1 SPPR0 SPR2 SPR1 SPR0 SPIBR W 0x0003 R SPIF 0 SPTEF MODF 0 0 0 0 SPISR W 0x0004 R Reserved W 0x0005 R Bit 7 6 5 4 3 2 2 Bit 0 SPIDR W 0x0006 R Reserved W 0x0007 R Reserved W = Unimplemented or Reserved Figure14-2. SPI Register Summary 14.3.2.1 SPI Control Register 1 (SPICR1) Module Base 0x0000 7 6 5 4 3 2 1 0 R SPIE SPE SPTIE MSTR CPOL CPHA SSOE LSBFE W Reset 0 0 0 0 0 1 0 0 Figure14-3. SPI Control Register 1 (SPICR1) Read: anytime Write: anytime 416 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description Table14-2. SPICR1 Field Descriptions Field Description 7 SPI Interrupt Enable Bit — This bit enables SPI interrupt requests, if SPIF or MODF status flag is set. SPIE 0 SPI interrupts disabled. 1 SPI interrupts enabled. 6 SPI System Enable Bit— This bit enables the SPI system and dedicates the SPI port pins to SPI system SPE functions. If SPE is cleared, SPI is disabled and forced into idle state, status bits in SPISR register are reset. 0 SPI disabled (lower power consumption). 1 SPI enabled, port pins are dedicated to SPI functions. 5 SPI Transmit Interrupt Enable — This bit enables SPI interrupt requests, if SPTEF flag is set. SPTIE 0 SPTEF interrupt disabled. 1 SPTEF interrupt enabled. 4 SPI Master/Slave Mode Select Bit — This bit selects, if the SPI operates in master or slave mode. Switching MSTR the SPI from master to slave or vice versa forces the SPI system into idle state. 0 SPI is in slave mode 1 SPI is in master mode 3 SPIClockPolarityBit—Thisbitselectsaninvertedornon-invertedSPIclock.TotransmitdatabetweenSPI CPOL modules, the SPI modules must have identical CPOL values. In master mode, a change of this bit will abort a transmission in progress and force the SPI system into idle state. 0 Active-high clocks selected. In idle state SCK is low. 1 Active-low clocks selected. In idle state SCK is high. 2 SPIClockPhaseBit—ThisbitisusedtoselecttheSPIclockformat.Inmastermode,achangeofthisbitwill CPHA abort a transmission in progress and force the SPI system into idle state. 0 Sampling of data occurs at odd edges (1,3,5,...,15) of the SCK clock 1 Sampling of data occurs at even edges (2,4,6,...,16) of the SCK clock 1 Slave Select Output Enable — TheSS output feature is enabled only in master mode, if MODFEN is set, by SSOE asserting the SSOE as shown inTable14-3. In master mode, a change of this bit will abort a transmission in progress and force the SPI system into idle state. 0 LSB-First Enable — This bit does not affect the position of the MSB and LSB in the data register. Reads and LSBFE writes of the data register always have the MSB in bit 7. In master mode, a change of this bit will abort a transmission in progress and force the SPI system into idle state. 0 Data is transferred most significant bit first. 1 Data is transferred least significant bit first. Table14-3.SS Input / Output Selection MODFEN SSOE Master Mode Slave Mode 0 0 SS not used by SPI SS input 0 1 SS not used by SPI SS input 1 0 SS input with MODF feature SS input 1 1 SS is slave select output SS input Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 417 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.3.2.2 SPI Control Register 2 (SPICR2) Module Base 0x0001 7 6 5 4 3 2 1 0 R 0 0 0 0 MODFEN BIDIROE SPISWAI SPC0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure14-4. SPI Control Register 2 (SPICR2) Read: anytime Write: anytime; writes to the reserved bits have no effect Table14-4. SPICR2 Field Descriptions Field Description 4 Mode Fault Enable Bit — This bit allows the MODF failure being detected. If the SPI is in master mode and MODFEN MODFEN is cleared, then theSS port pin is not used by the SPI. In slave mode, theSS is available only as an inputregardlessofthevalueofMODFEN.ForanoverviewontheimpactoftheMODFENbitontheSSportpin configuration refer toTable14-3. In master mode, a change of this bit will abort a transmission in progress and force the SPI system into idle state. 0 SS port pin is not used by the SPI 1 SS port pin with MODF feature 3 OutputEnableintheBidirectionalModeofOperation—ThisbitcontrolstheMOSIandMISOoutputbuffer BIDIROE of the SPI, when in bidirectional mode of operation (SPC0 is set). In master mode this bit controls the output bufferoftheMOSIport,inslavemodeitcontrolstheoutputbufferoftheMISOport.Inmastermode,withSPC0 set, a change of this bit will abort a transmission in progress and force the SPI into idle state. 0 Output buffer disabled 1 Output buffer enabled 1 SPI Stop in Wait Mode Bit — This bit is used for power conservation while in wait mode. SPISWAI 0 SPI clock operates normally in wait mode 1 Stop SPI clock generation when in wait mode 0 Serial Pin Control Bit 0 — This bit enables bidirectional pin configurations as shown inTable14-5. In master SPC0 mode, a change of this bit will abort a transmission in progress and force the SPI system into idle state Table14-5. Bidirectional Pin Configurations Pin Mode SPC0 BIDIROE MISO MOSI Master Mode of Operation Normal 0 X Master In Master Out Bidirectional 1 0 MISO not used by SPI Master In 1 Master I/O Slave Mode of Operation Normal 0 X Slave Out Slave In 418 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description Table14-5. Bidirectional Pin Configurations (continued) Pin Mode SPC0 BIDIROE MISO MOSI Bidirectional 1 0 Slave In MOSI not used by SPI 1 Slave I/O 14.3.2.3 SPI Baud Rate Register (SPIBR) Module Base 0x0002 7 6 5 4 3 2 1 0 R 0 0 SPPR2 SPPR1 SPPR0 SPR2 SPR1 SPR0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure14-5. SPI Baud Rate Register (SPIBR) Read: anytime Write: anytime; writes to the reserved bits have no effect Table14-6. SPIBR Field Descriptions Field Description 6:4 SPI Baud Rate Preselection Bits — These bits specify the SPI baud rates as shown inTable14-7. In master SPPR[2:0] mode, a change of these bits will abort a transmission in progress and force the SPI system into idle state. 2:0 SPIBaudRateSelectionBits—ThesebitsspecifytheSPIbaudratesasshowninTable14-7.Inmastermode, SPR[2:0} a change of these bits will abort a transmission in progress and force the SPI system into idle state. The baud rate divisor equation is as follows: (SPR+1) BaudRateDivisor = (SPPR+1)•2 The baud rate can be calculated with the following equation: Baud Rate = BusClock⁄BaudRateDivisor Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 419 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description Table14-7. Example SPI Baud Rate Selection (25 MHz Bus Clock) Baud Rate SPPR2 SPPR1 SPPR0 SPR2 SPR1 SPR0 Baud Rate Divisor 0 0 0 0 0 0 2 12.5 MHz 0 0 0 0 0 1 4 6.25 MHz 0 0 0 0 1 0 8 3.125 MHz 0 0 0 0 1 1 16 1.5625 MHz 0 0 0 1 0 0 32 781.25 kHz 0 0 0 1 0 1 64 390.63 kHz 0 0 0 1 1 0 128 195.31 kHz 0 0 0 1 1 1 256 97.66 kHz 0 0 1 0 0 0 4 6.25 MHz 0 0 1 0 0 1 8 3.125 MHz 0 0 1 0 1 0 16 1.5625 MHz 0 0 1 0 1 1 32 781.25 kHz 0 0 1 1 0 0 64 390.63 kHz 0 0 1 1 0 1 128 195.31 kHz 0 0 1 1 1 0 256 97.66 kHz 0 0 1 1 1 1 512 48.83 kHz 0 1 0 0 0 0 6 4.16667 MHz 0 1 0 0 0 1 12 2.08333 MHz 0 1 0 0 1 0 24 1.04167 MHz 0 1 0 0 1 1 48 520.83 kHz 0 1 0 1 0 0 96 260.42 kHz 0 1 0 1 0 1 192 130.21 kHz 0 1 0 1 1 0 384 65.10 kHz 0 1 0 1 1 1 768 32.55 kHz 0 1 1 0 0 0 8 3.125 MHz 0 1 1 0 0 1 16 1.5625 MHz 0 1 1 0 1 0 32 781.25 kHz 0 1 1 0 1 1 64 390.63 kHz 0 1 1 1 0 0 128 195.31 kHz 0 1 1 1 0 1 256 97.66 kHz 0 1 1 1 1 0 512 48.83 kHz 0 1 1 1 1 1 1024 24.41 kHz 1 0 0 0 0 0 10 2.5 MHz 1 0 0 0 0 1 20 1.25 MHz 1 0 0 0 1 0 40 625 kHz 1 0 0 0 1 1 80 312.5 kHz 1 0 0 1 0 0 160 156.25 kHz 1 0 0 1 0 1 320 78.13 kHz 1 0 0 1 1 0 640 39.06 kHz 420 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description Table14-7. Example SPI Baud Rate Selection (25 MHz Bus Clock) (continued) Baud Rate SPPR2 SPPR1 SPPR0 SPR2 SPR1 SPR0 Baud Rate Divisor 1 0 0 1 1 1 1280 19.53 kHz 1 0 1 0 0 0 12 2.08333 MHz 1 0 1 0 0 1 24 1.04167 MHz 1 0 1 0 1 0 48 520.83 kHz 1 0 1 0 1 1 96 260.42 kHz 1 0 1 1 0 0 192 130.21 kHz 1 0 1 1 0 1 384 65.10 kHz 1 0 1 1 1 0 768 32.55 kHz 1 0 1 1 1 1 1536 16.28 kHz 1 1 0 0 0 0 14 1.78571 MHz 1 1 0 0 0 1 28 892.86 kHz 1 1 0 0 1 0 56 446.43 kHz 1 1 0 0 1 1 112 223.21 kHz 1 1 0 1 0 0 224 111.61 kHz 1 1 0 1 0 1 448 55.80 kHz 1 1 0 1 1 0 896 27.90 kHz 1 1 0 1 1 1 1792 13.95 kHz 1 1 1 0 0 0 16 1.5625 MHz 1 1 1 0 0 1 32 781.25 kHz 1 1 1 0 1 0 64 390.63 kHz 1 1 1 0 1 1 128 195.31 kHz 1 1 1 1 0 0 256 97.66 kHz 1 1 1 1 0 1 512 48.83 kHz 1 1 1 1 1 0 1024 24.41 kHz 1 1 1 1 1 1 2048 12.21 kHz NOTE In slave mode of SPI S-clock speed DIV2 is not supported. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 421 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.3.2.4 SPI Status Register (SPISR) Module Base 0x0003 7 6 5 4 3 2 1 0 R SPIF 0 SPTEF MODF 0 0 0 0 W Reset 0 0 1 0 0 0 0 0 = Unimplemented or Reserved Figure14-6. SPI Status Register (SPISR) Read: anytime Write: has no effect Table14-8. SPISR Field Descriptions Field Description 7 SPIFInterruptFlag—ThisbitissetafterareceiveddatabytehasbeentransferredintotheSPIDataRegister. SPIF This bit is cleared by reading the SPISR register (with SPIF set) followed by a read access to the SPI Data Register. 0 Transfer not yet complete 1 New data copied to SPIDR 5 SPITransmitEmptyInterruptFlag—Ifset,thisbitindicatesthatthetransmitdataregisterisempty.Toclear SPTEF thisbitandplacedataintothetransmitdataregister,SPISRhastobereadwithSPTEF=1,followedbyawrite to SPIDR. Any write to the SPI Data Register without reading SPTEF = 1, is effectively ignored. 0 SPI Data register not empty 1 SPI Data register empty 4 ModeFaultFlag—ThisbitissetiftheSSinputbecomeslowwhiletheSPIisconfiguredasamasterandmode MODF fault detection is enabled, MODFEN bit of SPICR2 register is set. Refer to MODFEN bit description in Section14.3.2.2,“SPIControlRegister2(SPICR2).”TheflagisclearedautomaticallybyareadoftheSPIStatus Register (with MODF set) followed by a write to the SPI Control Register 1. 0 Mode fault has not occurred. 1 Mode fault has occurred. 14.3.2.5 SPI Data Register (SPIDR) Module Base 0x0005 7 6 5 4 3 2 1 0 R Bit 7 6 5 4 3 2 2 Bit 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure14-7. SPI Data Register (SPIDR) Read: anytime; normally read only after SPIF is set 422 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description Write: anytime The SPI Data Register is both the input and output register for SPI data. A write to this register allows a databytetobequeuedandtransmitted.ForaSPIconfiguredasamaster,aqueueddatabyteistransmitted immediately after the previous transmission has completed. The SPI Transmitter Empty Flag SPTEF in the SPISR register indicates when the SPI Data Register is ready to accept new data. ReadingthedatacanoccuranytimefromaftertheSPIFissettobeforetheendofthenexttransfer.Ifthe SPIFisnotservicedbytheendofthesuccessivetransfers,thosedatabytesarelostandthedatawithinthe SPIDR retains the first byte until SPIF is serviced. 14.4 Functional Description The SPI module allows a duplex, synchronous, serial communication between the MCU and peripheral devices. Software can poll the SPI status flags or SPI operation can be interrupt driven. TheSPIsystemisenabledbysettingtheSPIenable(SPE)bitinSPIControlRegister1.WhileSPEbitis set, the four associated SPI port pins are dedicated to the SPI function as: • Slave select (SS) • Serial clock (SCK) • Master out/slave in (MOSI) • Master in/slave out (MISO) ThemainelementoftheSPIsystemistheSPIDataRegister.The8-bitdataregisterinthemasterandthe 8-bitdataregisterintheslavearelinkedbytheMOSIandMISOpinstoformadistributed16-bitregister. Whenadatatransferoperationisperformed,this16-bitregisterisseriallyshiftedeightbitpositionsbythe S-clockfromthemaster,sodataisexchangedbetweenthemasterandtheslave.Datawrittentothemaster SPIDataRegisterbecomestheoutputdatafortheslave,anddatareadfromthemasterSPIDataRegister after a transfer operation is the input data from the slave. A read of SPISR with SPTEF = 1 followed by a write to SPIDR puts data into the transmit data register. Whenatransferiscomplete,receiveddataismovedintothereceivedataregister.Datamaybereadfrom this double-buffered system any time before the next transfer has completed. This 8-bit data register acts as the SPI receive data register for reads and as the SPI transmit data register for writes. A single SPI registeraddressisusedforreadingdatafromthereaddatabufferandforwritingdatatothetransmitdata register. Theclockphasecontrolbit(CPHA)andaclockpolaritycontrolbit(CPOL)intheSPIControlRegister1 (SPICR1) select one of four possible clock formats to be used by the SPI system. The CPOL bit simply selects a non-inverted or inverted clock. The CPHA bit is used to accommodate two fundamentally different protocols by sampling data on odd numbered SCK edges or on even numbered SCK edges (see Section14.4.3, “Transmission Formats”). The SPI can be configured to operate as a master or as a slave. When the MSTR bit in SPI Control Register1 is set, master mode is selected, when the MSTR bit is clear, slave mode is selected. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 423 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.4.1 Master Mode The SPI operates in master mode when the MSTR bit is set. Only a master SPI module can initiate transmissions. A transmission begins by writing to the master SPI Data Register. If the shift register is empty, the byte immediately transfers to the shift register. The byte begins shifting out on the MOSI pin under the control of the serial clock. • S-clock The SPR2, SPR1, and SPR0 baud rate selection bits in conjunction with the SPPR2, SPPR1, and SPPR0baudratepreselectionbitsintheSPIBaudRateregistercontrolthebaudrategeneratorand determine the speed of the transmission. The SCK pin is the SPI clock output. Through the SCK pin, the baud rate generator of the master controls the shift register of the slave peripheral. • MOSI and MISO Pins In master mode, the function of the serial data output pin (MOSI) and the serial data input pin (MISO) is determined by the SPC0 and BIDIROE control bits. • SS Pin If MODFEN and SSOE bit are set, theSS pin is configured as slave select output. The SS output becomes low during each transmission and is high when the SPI is in idle state. IfMODFENissetandSSOEiscleared,theSSpinisconfiguredasinputfordetectingmodefault error. If theSS input becomes low this indicates a mode fault error where another master tries to drive the MOSI and SCK lines. In this case, the SPI immediately switches to slave mode, by clearing the MSTR bit and also disables the slave output buffer MISO (or SISO in bidirectional mode). So the result is that all outputs are disabled and SCK, MOSI and MISO are inputs. If a transmissionisinprogresswhenthemodefaultoccurs,thetransmissionisabortedandtheSPIis forced into idle state. Thismodefaulterroralsosetsthemodefault(MODF)flagintheSPIStatusRegister(SPISR).IftheSPI interrupt enable bit (SPIE) is set when the MODF flag gets set, then an SPI interrupt sequence is also requested. WhenawritetotheSPIDataRegisterinthemasteroccurs,thereisahalfSCK-cycledelay.Afterthedelay, SCKisstartedwithinthemaster.Therestofthetransferoperationdiffersslightly,dependingontheclock format specified by the SPI clock phase bit, CPHA, in SPI Control Register 1 (see Section14.4.3, “Transmission Formats”). NOTE A change of the bits CPOL, CPHA, SSOE, LSBFE, MODFEN, SPC0, BIDIROEwithSPC0set,SPPR2–SPPR0andSPR2–SPR0inmastermode will abort a transmission in progress and force the SPI into idle state. The remote slave cannot detect this, therefore the master has to ensure that the remote slave is set back to idle state. 424 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.4.2 Slave Mode The SPI operates in slave mode when the MSTR bit in SPI Control Register1 is clear. • SCK Clock In slave mode, SCK is the SPI clock input from the master. • MISO and MOSI Pins Inslavemode,thefunctionoftheserialdataoutputpin(MISO)andserialdatainputpin(MOSI) is determined by the SPC0 bit and BIDIROE bit in SPI Control Register 2. • SS Pin TheSSpinistheslaveselectinput.Beforeadatatransmissionoccurs,theSSpinoftheslaveSPI must be low. SS must remain low until the transmission is complete. If SS goes high, the SPI is forced into idle state. TheSS input also controls the serial data output pin, ifSS is high (not selected), the serial data outputpinishighimpedance,and,ifSSislowthefirstbitintheSPIDataRegisterisdrivenoutof the serial data output pin. Also, if the slave is not selected (SS is high), then the SCK input is ignored and no internal shifting of the SPI shift register takes place. AlthoughtheSPIiscapableofduplexoperation,someSPIperipheralsarecapableofonlyreceivingSPI data in a slave mode. For these simpler devices, there is no serial data out pin. NOTE When peripherals with duplex capability are used, take care not to simultaneously enable two receivers whose serial outputs drive the same system slave’s serial data output line. Aslongasnomorethanoneslavedevicedrivesthesystemslave’sserialdataoutputline,itispossiblefor severalslavestoreceivethesametransmissionfromamaster,althoughthemasterwouldnotreceivereturn information from all of the receiving slaves. If the CPHA bit in SPI Control Register 1 is clear, odd numbered edges on the SCK input cause the data attheserialdatainputpintobelatched.Evennumberededgescausethevaluepreviouslylatchedfromthe serial data input pin to shift into the LSB or MSB of the SPI shift register, depending on the LSBFE bit. IftheCPHAbitisset,evennumberededgesontheSCKinputcausethedataattheserialdatainputpinto belatched.Oddnumberededgescausethevaluepreviouslylatchedfromtheserialdatainputpintoshift into the LSB or MSB of the SPI shift register, depending on the LSBFE bit. WhenCPHAisset,thefirstedgeisusedtogetthefirstdatabitontotheserialdataoutputpin.WhenCPHA isclearandtheSSinputislow(slaveselected),thefirstbitoftheSPIdataisdrivenoutoftheserialdata output pin. After the eighth shift, the transfer is considered complete and the received data is transferred intotheSPIDataRegister.Toindicatetransferiscomplete,theSPIFflagintheSPIStatusRegisterisset. NOTE A change of the bits CPOL, CPHA, SSOE, LSBFE, MODFEN, SPC0 and BIDIROE with SPC0 set in slave mode will corrupt a transmission in progress and has to be avoided. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 425 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.4.3 Transmission Formats During an SPI transmission, data is transmitted (shifted out serially) and received (shifted in serially) simultaneously.Theserialclock(SCK)synchronizesshiftingandsamplingoftheinformationonthetwo serial data lines. A slave select line allows selection of an individual slave SPI device, slave devices that arenotselecteddonotinterferewithSPIbusactivities.Optionally,onamasterSPIdevice,theslaveselect line can be used to indicate multiple-master bus contention. MASTER SPI SLAVE SPI MISO MISO SHIFT REGISTER MOSI MOSI SHIFT REGISTER SCK SCK BAUD RATE GENERATOR SS SS V DD Figure14-8. Master/Slave Transfer Block Diagram 14.4.3.1 Clock Phase and Polarity Controls UsingtwobitsintheSPIControlRegister1,softwareselectsoneoffourcombinationsofserialclockphase and polarity. TheCPOLclockpolaritycontrolbitspecifiesanactivehighorlowclockandhasnosignificanteffecton the transmission format. The CPHA clock phase control bit selects one of two fundamentally different transmission formats. Clock phase and polarity should be identical for the master SPI device and the communicating slave device.Insomecases,thephaseandpolarityarechangedbetweentransmissionstoallowamasterdevice to communicate with peripheral slaves having different requirements. 14.4.3.2 CPHA = 0 Transfer Format The first edge on the SCK line is used to clock the first data bit of the slave into the master and the first databitofthemasterintotheslave.Insomeperipherals,thefirstbitoftheslave’sdataisavailableatthe slave’sdataoutpinassoonastheslaveisselected.Inthisformat,thefirstSCKedgeisissuedahalfcycle afterSS has become low. AhalfSCKcyclelater,thesecondedgeappearsontheSCKline.Whenthissecondedgeoccurs,thevalue previously latched from the serial data input pin is shifted into the LSB or MSB of the shift register, depending on LSBFE bit. Afterthissecondedge,thenextbitoftheSPImasterdataistransmittedoutoftheserialdataoutputpinof the master to the serial input pin on the slave. This process continues for a total of 16 edges on the SCK line, with data being latched on odd numbered edges and shifted on even numbered edges. 426 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description Datareceptionisdoublebuffered.DataisshiftedseriallyintotheSPIshiftregisterduringthetransferand is transferred to the parallel SPI Data Register after the last bit is shifted in. After the 16th (last) SCK edge: • Data that was previously in the master SPI Data Register should now be in the slave data register and the data that was in the slave data register should be in the master. • The SPIF flag in the SPI Status Register is set indicating that the transfer is complete. Figure14-9 is a timing diagram of an SPI transfer where CPHA = 0. SCK waveforms are shown for CPOL= 0 and CPOL = 1. The diagram may be interpreted as a master or slave timing diagram because theSCK,MISO,andMOSIpinsareconnecteddirectlybetweenthemasterandtheslave.TheMISOsignal is the output from the slave and the MOSI signal is the output from the master. The SS pin of the master must be either high or reconfigured as a general-purpose output not affecting the SPI. End of Idle State Begin Transfer End Begin of Idle State SCK Edge Nr. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 SCK (CPOL = 0) SCK (CPOL = 1) SAMPLE I MOSI/MISO e er h s n CHANGE O gi MOSI pin be er CHANGE O sf n MISO pin a xt tr e n SELSS (O) If Master only SELSS (I) tL tT tI tL MSB first (LSBFE = 0): MSB Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 LSB Minimum 1/2 SCK LSB first (LSBFE = 1): LSB Bit 1 Bit 2 Bit 3 Bit 4 Bit 5 Bit 6 MSB for tT, tl, tL t = Minimum leading time before the first SCK edge L t = Minimum trailing time after the last SCK edge T t = Minimum idling time between transfers (minimumSS high time) I t , t, and t are guaranteed for the master mode and required for the slave mode. L T I Figure14-9. SPI Clock Format 0 (CPHA = 0) Inslavemode,iftheSSlineisnotdeassertedbetweenthesuccessivetransmissionsthenthecontentofthe SPIDataRegisterisnottransmitted,insteadthelastreceivedbyteistransmitted.IftheSSlineisdeasserted foratleastminimumidletime(halfSCKcycle)betweensuccessivetransmissionsthenthecontentofthe SPI Data Register is transmitted. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 427 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description Inmastermode,withslaveselectoutputenabledtheSSlineisalwaysdeassertedandreassertedbetween successive transfers for at least minimum idle time. 14.4.3.3 CPHA = 1 Transfer Format SomeperipheralsrequirethefirstSCKedgebeforethefirstdatabitbecomesavailableatthedataoutpin, the second edge clocks data into the system. In this format, the first SCK edge is issued by setting the CPHA bit at the beginning of the 8-cycle transfer operation. ThefirstedgeofSCKoccursimmediatelyafterthehalfSCKclockcyclesynchronizationdelay.Thisfirst edge commands the slave to transfer its first data bit to the serial data input pin of the master. A half SCK cycle later, the second edge appears on the SCK pin. This is the latching edge for both the master and slave. When the third edge occurs, the value previously latched from the serial data input pin is shifted into the LSBorMSBoftheSPIshiftregister,dependingonLSBFEbit.Afterthisedge,thenextbitofthemaster data is coupled out of the serial data output pin of the master to the serial input pin on the slave. Thisprocesscontinuesforatotalof16edgesontheSCKlinewithdatabeinglatchedonevennumbered edges and shifting taking place on odd numbered edges. Datareceptionisdoublebuffered,dataisseriallyshiftedintotheSPIshiftregisterduringthetransferand is transferred to the parallel SPI Data Register after the last bit is shifted in. After the 16th SCK edge: • Data that was previously in the SPI Data Register of the master is now in the data register of the slave, and data that was in the data register of the slave is in the master. • The SPIF flag bit in SPISR is set indicating that the transfer is complete. Figure14-10showstwoclockingvariationsforCPHA=1.Thediagrammaybeinterpretedasamasteror slavetimingdiagrambecausetheSCK,MISO,andMOSIpinsareconnecteddirectlybetweenthemaster and the slave. The MISO signal is the output from the slave, and the MOSI signal is the output from the master. TheSS line is the slave select input to the slave. The SS pin of the master must be either high or reconfigured as a general-purpose output not affecting the SPI. TheSSlinecanremainactivelowbetweensuccessivetransfers(canbetiedlowatalltimes).Thisformat issometimespreferredinsystemshavingasinglefixedmasterandasingleslavethatdrivetheMISOdata line. • Back-to-back transfers in master mode Inmastermode,ifatransmissionhascompletedandanewdatabyteisavailableintheSPIDataRegister, this byte is send out immediately without a trailing and minimum idle time. The SPI interrupt request flag (SPIF) is common to both the master and slave modes. SPIF gets set one half SCK cycle after the last SCK edge. 428 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description End of Idle State Begin Transfer End Begin of Idle State SCK Edge Nr. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 SCK (CPOL = 0) SCK (CPOL = 1) SAMPLE I MOSI/MISO e er h s n CHANGE O gi MOSI pin be er CHANGE O sf n MISO pin a xt tr e n SELSS (O) If Master only SELSS (I) tL tT tI tL MSB first (LSBFE = 0): MSB Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 LSB Minimum 1/2 SCK LSB first (LSBFE = 1): LSB Bit 1 Bit 2 Bit 3 Bit 4 Bit 5 Bit 6 MSB for tT, tl, tL t = Minimum leading time before the first SCK edge, not required for back to back transfers L t = Minimum trailing time after the last SCK edge T t = Minimum idling time between transfers (minimumSS high time), not required for back to back transfers I Figure14-10. SPI Clock Format 1 (CPHA = 1) 14.4.4 SPI Baud Rate Generation Baudrategenerationconsistsofaseriesofdividerstages.SixbitsintheSPIBaudRateregister(SPPR2, SPPR1, SPPR0, SPR2, SPR1, and SPR0) determine the divisor to the SPI module clock which results in the SPI baud rate. The SPI clock rate is determined by the product of the value in the baud rate preselection bits (SPPR2–SPPR0) and the value in the baud rate selection bits (SPR2–SPR0). The module clock divisor equation is shown in Figure14-11 When all bits are clear (the default condition), the SPI module clock is divided by 2. When the selection bits (SPR2–SPR0) are 001 and the preselection bits (SPPR2–SPPR0) are 000, the module clock divisor becomes 4. When the selection bits are 010, the module clock divisor becomes 8 etc. When the preselection bits are 001, the divisor determined by the selection bits is multiplied by 2. When the preselection bits are 010, the divisor is multiplied by 3, etc. See Table14-7 for baud rate calculations forallbitconditions,basedona25-MHzbusclock.Thetwosetsofselectsallowstheclocktobedivided by a non-power of two to achieve other baud rates such as divide by 6, divide by 10, etc. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 429 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description ThebaudrategeneratorisactivatedonlywhentheSPIisinthemastermodeandaserialtransferistaking place. In the other cases, the divider is disabled to decrease I current. DD (SPR+1) BaudRateDivisor = (SPPR+1)•2 Figure14-11. Baud Rate Divisor Equation 14.4.5 Special Features 14.4.5.1 SS Output TheSS output feature automatically drives the SS pin low during transmission to select external devices and drives it high during idle to deselect external devices. When SS output is selected, the SS output pin is connected to theSS input pin of the external device. TheSS output is available only in master mode during normal SPI operation by asserting SSOE and MODFEN bit as shown in Table14-3. The mode fault feature is disabled while SS output is enabled. NOTE Care must be taken when using the SS output feature in a multimaster systembecausethemodefaultfeatureisnotavailablefordetectingsystem errors between masters. 14.4.5.2 Bidirectional Mode (MOSI or MISO) ThebidirectionalmodeisselectedwhentheSPC0bitissetinSPIControlRegister2(seeTable14-9).In this mode, the SPI uses only one serial data pin for the interface with external device(s). The MSTR bit decideswhichpintouse.TheMOSIpinbecomestheserialdataI/O(MOMI)pinforthemastermode,and theMISOpinbecomesserialdataI/O(SISO)pinfortheslavemode.TheMISOpininmastermodeand MOSI pin in slave mode are not used by the SPI. Table14-9. Normal Mode and Bidirectional Mode When SPE = 1 Master Mode MSTR = 1 Slave Mode MSTR = 0 Serial Out MOSI Serial In MOSI Normal Mode SPI SPI SPC0 = 0 Serial In MISO Serial Out MISO Serial Out MOMI Serial In Bidirectional Mode BIDIROE SPC0 = 1 SPI BIDIROE SPI Serial In Serial Out SISO 430 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description The direction of each serial I/O pin depends on the BIDIROE bit. If the pin is configured as an output, serialdatafromtheshiftregisterisdrivenoutonthepin.Thesamepinisalsotheserialinputtotheshift register. The SCK is output for the master mode and input for the slave mode. TheSS is the input or output for the master mode, and it is always the input for the slave mode. The bidirectional mode does not affect SCK and SS functions. NOTE Inbidirectionalmastermode,withmodefaultenabled,bothdatapinsMISO and MOSI can be occupied by the SPI, though MOSI is normally used for transmissions in bidirectional mode and MISO is not used by the SPI. If a mode fault occurs, the SPI is automatically switched to slave mode, in this caseMISObecomesoccupiedbytheSPIandMOSIisnotused.Thishasto be considered, if the MISO pin is used for other purpose. 14.4.6 Error Conditions The SPI has one error condition: • Mode fault error 14.4.6.1 Mode Fault Error IftheSSinputbecomeslowwhiletheSPIisconfiguredasamaster,itindicatesasystemerrorwheremore than one master may be trying to drive the MOSI and SCK lines simultaneously. This condition is not permittedinnormaloperation,theMODFbitintheSPIStatusRegisterissetautomaticallyprovidedthe MODFEN bit is set. InthespecialcasewheretheSPIisinmastermodeandMODFENbitiscleared,theSSpinisnotusedby theSPI.Inthisspecialcase,themodefaulterrorfunctionisinhibitedandMODFremainscleared.Incase theSPIsystemisconfiguredasaslave,theSSpinisadedicatedinputpin.Modefaulterrordoesn’toccur in slave mode. If a mode fault error occurs the SPI is switched to slave mode, with the exception that the slave output buffer is disabled. So SCK, MISO and MOSI pins are forced to be high impedance inputs to avoid any possibility of conflict with another output driver. A transmission in progress is aborted and the SPI is forced into idle state. IfthemodefaulterroroccursinthebidirectionalmodeforaSPIsystemconfiguredinmastermode,output enable of the MOMI (MOSI in bidirectional mode) is cleared if it was set. No mode fault error occurs in the bidirectional mode for SPI system configured in slave mode. ThemodefaultflagisclearedautomaticallybyareadoftheSPIStatusRegister(withMODFset)followed byawritetoSPIControlRegister1.Ifthemodefaultflagiscleared,theSPIbecomesanormalmasteror slave again. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 431 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.4.7 Operation in Run Mode In run mode with the SPI system enable (SPE) bit in the SPI control register clear, the SPI system is in a low-power, disabled state. SPI registers remain accessible, but clocks to the core of this module are disabled. 14.4.8 Operation in Wait Mode SPI operation in wait mode depends upon the state of the SPISWAI bit in SPI Control Register 2. • If SPISWAI is clear, the SPI operates normally when the CPU is in wait mode • If SPISWAI is set, SPI clock generation ceases and the SPI module enters a power conservation state when the CPU is in wait mode. — If SPISWAI is set and the SPI is configured for master, any transmission and reception in progressstopsatwaitmodeentry.ThetransmissionandreceptionresumeswhentheSPIexits wait mode. — If SPISWAI is set and the SPI is configured as a slave, any transmission and reception in progress continues if the SCK continues to be driven from the master. This keeps the slave synchronized to the master and the SCK. Ifthemastertransmitsseveralbyteswhiletheslaveisinwaitmode,theslavewillcontinueto sendoutbytesconsistentwiththeoperationmodeatthestartofwaitmode(i.e.Iftheslaveis currently sending its SPIDR to the master, it will continue to send the same byte. Else if the slave is currently sending the last received byte from the master, it will continue to send each previous master byte). NOTE Caremustbetakenwhenexpectingdatafromamasterwhiletheslaveisin wait or stop mode. Even though the shift register will continue to operate, the rest of the SPI is shut down (i.e. a SPIF interrupt will not be generated until exiting stop or wait mode). Also, the byte from the shift register will notbecopiedintotheSPIDRregisteruntilaftertheslaveSPIhasexitedwait orstopmode.ASPIFflagandSPIDRcopyisonlygeneratedifwaitmode isenteredorexitedduringatranmission.Iftheslaveenterswaitmodeinidle mode and exits wait mode in idle mode, neither a SPIF nor a SPIDR copy will occur. 14.4.9 Operation in Stop Mode Stopmodeisdependentonthesystem.TheSPIentersstopmodewhenthemoduleclockisdisabled(held high or low). If the SPI is in master mode and exchanging data when the CPU enters stop mode, the transmission is frozen until the CPU exits stop mode. After stop, data to and from the external SPI is exchanged correctly. In slave mode, the SPI will stay synchronized with the master. The stop mode is not dependent on the SPISWAI bit. 432 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 14.5 Reset The reset values of registers and signals are described in the Memory Map and Registers section (see Section14.3, “Memory Map and Register Definition”) which details the registers and their bit-fields. • If a data transmission occurs in slave mode after reset without a write to SPIDR, it will transmit garbage, or the byte last received from the master before the reset. • Reading from the SPIDR after reset will always read a byte of zeros. 14.6 Interrupts TheSPIV3onlyoriginatesinterruptrequestswhenSPIisenabled(SPEbitinSPICR1set).Thefollowing is a description of how the SPIV3 makes a request and how the MCU should acknowledge that request. The interrupt vector offset and interrupt priority are chip dependent. The interrupt flags MODF, SPIF and SPTEF are logically ORed to generate an interrupt request. 14.6.1 MODF MODFoccurswhenthemasterdetectsanerrorontheSSpin.ThemasterSPImustbeconfiguredforthe MODFfeature(seeTable14-3).AfterMODFisset,thecurrenttransferisabortedandthefollowingbitis changed: • MSTR = 0, The master bit in SPICR1 resets. The MODF interrupt is reflected in the status register MODF flag. Clearing the flag will also clear the interrupt. This interrupt will stay active while the MODF flag is set. MODF has an automatic clearing process which is described inSection14.3.2.4, “SPI Status Register (SPISR).” 14.6.2 SPIF SPIF occurs when new data has been received and copied to the SPI Data Register. After SPIF is set, it does not clear until it is serviced. SPIF has an automatic clearing process which is described in Section14.3.2.4,“SPIStatusRegister(SPISR).”IntheeventthattheSPIFisnotservicedbeforetheend of the next transfer (i.e. SPIF remains active throughout another transfer), the latter transfers will be ignored and no new data will be copied into the SPIDR. 14.6.3 SPTEF SPTEFoccurswhentheSPIDataRegisterisreadytoacceptnewdata.AfterSPTEFisset,itdoesnotclear untilitisserviced.SPTEFhasanautomaticclearingprocesswhichisdescribedinSection14.3.2.4,“SPI Status Register (SPISR).” Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 433 Rev 01.24

Chapter14 Serial Peripheral Interface (SPIV3) Block Description 434 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 15 Timer Module (TIM16B8CV1) Block Description Table15-1. Revision History Version Effective Revision Dates Author Description of Changes Number Date 01.03 06 Feb 2006 06 Feb 2006 S. Chinnam Corrected the type at 0x006 and later in the document from TSCR2 and TSCR1 01.04 08 July 2008 08 July 2008 S. Chinnam Revisedflagclearingprocedure,wherebyTENbitmustbe set when clearing flags. 01.05 05 May 2010 05 May 2010 Ame Wang -in15.3.2.8/15-446,addTable15-11 -in15.3.2.11/15-450,TCRE bit description part,add Note -in15.4.3/15-459,addFigure15-29 15.1 Introduction The basic timer consists of a 16-bit, software-programmable counter driven by a seven-stage programmable prescaler. Thistimercanbeusedformanypurposes,includinginputwaveformmeasurementswhilesimultaneously generating an output waveform. Pulse widths can vary from microseconds to many seconds. This timer contains 8 complete input capture/output compare channels and one pulse accumulator. The inputcapturefunctionisusedtodetectaselectedtransitionedgeandrecordthetime.Theoutputcompare function is used for generating output signals or for timer software delays. The 16-bit pulse accumulator is used to operate as a simple event counter or a gated time accumulator. The pulse accumulator shares timer channel 7 when in event mode. A full access for the counter registers or the input capture/output compare registers should take place in one clock cycle. Accessing high byte and low byte separately for all of these registers may not yield the same result as accessing them in one word. 15.1.1 Features The TIM16B8CV1 includes these distinctive features: • Eight input capture/output compare channels. • Clock prescaling. • 16-bit counter. • 16-bit pulse accumulator. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 435 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.1.2 Modes of Operation Stop: Timer is off because clocks are stopped. Freeze: Timer counter keep on running, unless TSFRZ in TSCR (0x0006) is set to 1. Wait: Counters keep on running, unless TSWAI in TSCR (0x0006) is set to 1. Normal: Timer counter keep on running, unless TEN in TSCR (0x0006) is cleared to 0. 15.1.3 Block Diagrams Channel 0 Input capture Bus clock Prescaler IOC0 Output compare Channel 1 Input capture 16-bit Counter IOC1 Output compare Channel 2 Timer overflow Input capture interrupt IOC2 Output compare Timer channel 0 Channel 3 interrupt Input capture IOC3 Output compare Registers Channel 4 Input capture IOC4 Output compare Channel 5 Input capture IOC5 Output compare Timer channel 7 interrupt Channel 6 Input capture IOC6 Output compare PA overflow Channel 7 interrupt 16-bit Input capture IOC7 PA input Pulse accumulator Output compare interrupt Figure15-1. TIM16B8CV1 Block Diagram 436 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description TIMCLK(Timer clock) CLK1 4:1 MUX CLK0 Prescaled clock 36 Clock select (PCLK) 55 56 (PAMOD) 6 2 Edge detector PT7 K / K / K L L L C C C A A A P P P us Interrupt B e ul d o m er nt I PACNT MUX Divide by 64 M clock Figure15-2. 16-Bit Pulse Accumulator Block Diagram 16-bit Main Timer PTn Edge detector Set CnF Interrupt TCn Input Capture Reg. Figure15-3. Interrupt Flag Setting Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 437 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description PULSE PAD ACCUMULATOR CHANNEL 7 OUTPUT COMPARE OM7 OL7 OC7M7 Figure15-4. Channel 7 Output Compare/Pulse Accumulator Logic NOTE For more information see the respective functional descriptions in Section15.4, “Functional Description,” of this document. 15.2 External Signal Description The TIM16B8CV1 module has a total of eight external pins. 15.2.1 IOC7 — Input Capture and Output Compare Channel 7 Pin This pin serves as input capture or output compare for channel 7. This can also be configured as pulse accumulator input. 15.2.2 IOC6 — Input Capture and Output Compare Channel 6 Pin This pin serves as input capture or output compare for channel 6. 15.2.3 IOC5 — Input Capture and Output Compare Channel 5 Pin This pin serves as input capture or output compare for channel 5. 15.2.4 IOC4 — Input Capture and Output Compare Channel 4 Pin This pin serves as input capture or output compare for channel 4. Pin 15.2.5 IOC3 — Input Capture and Output Compare Channel 3 Pin This pin serves as input capture or output compare for channel 3. 438 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.2.6 IOC2 — Input Capture and Output Compare Channel 2 Pin This pin serves as input capture or output compare for channel 2. 15.2.7 IOC1 — Input Capture and Output Compare Channel 1 Pin This pin serves as input capture or output compare for channel 1. 15.2.8 IOC0 — Input Capture and Output Compare Channel 0 Pin This pin serves as input capture or output compare for channel 0. NOTE For the description of interrupts see Section15.6, “Interrupts”. 15.3 Memory Map and Register Definition This section provides a detailed description of all memory and registers. 15.3.1 Module Memory Map ThememorymapfortheTIM16B8CV1moduleisgivenbelowinTable15-2.Theaddresslistedforeach register is the address offset. The total address for each register is the sum of the base address for the TIM16B8CV1 module and the address offset for each register. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 439 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Table15-2. TIM16B8CV1 Memory Map Address Offset Use Access 0x0000 Timer Input Capture/Output Compare Select (TIOS) R/W 0x0001 Timer Compare Force Register (CFORC) R/W(1) 0x0002 Output Compare 7 Mask Register (OC7M) R/W 0x0003 Output Compare 7 Data Register (OC7D) R/W 0x0004 Timer Count Register (TCNT(hi)) R/W(2) 0x0005 Timer Count Register (TCNT(lo)) R/W2 0x0006 Timer System Control Register1 (TSCR1) R/W 0x0007 Timer Toggle Overflow Register (TTOV) R/W 0x0008 Timer Control Register1 (TCTL1) R/W 0x0009 Timer Control Register2 (TCTL2) R/W 0x000A Timer Control Register3 (TCTL3) R/W 0x000B Timer Control Register4 (TCTL4) R/W 0x000C Timer Interrupt Enable Register (TIE) R/W 0x000D Timer System Control Register2 (TSCR2) R/W 0x000E Main Timer Interrupt Flag1 (TFLG1) R/W 0x000F Main Timer Interrupt Flag2 (TFLG2) R/W 0x0010 Timer Input Capture/Output Compare Register 0 (TC0(hi)) R/W(3) 0x0011 Timer Input Capture/Output Compare Register 0 (TC0(lo)) R/W3 0x0012 Timer Input Capture/Output Compare Register 1 (TC1(hi)) R/W3 0x0013 Timer Input Capture/Output Compare Register 1 (TC1(lo)) R/W3 0x0014 Timer Input Capture/Output Compare Register 2 (TC2(hi)) R/W3 0x0015 Timer Input Capture/Output Compare Register 2 (TC2(lo)) R/W3 0x0016 Timer Input Capture/Output Compare Register 3 (TC3(hi)) R/W3 0x0017 Timer Input Capture/Output Compare Register 3 (TC3(lo)) R/W3 0x0018 Timer Input Capture/Output Compare Register4 (TC4(hi)) R/W3 0x0019 Timer Input Capture/Output Compare Register 4 (TC4(lo)) R/W3 0x001A Timer Input Capture/Output Compare Register 5 (TC5(hi)) R/W3 0x001B Timer Input Capture/Output Compare Register 5 (TC5(lo)) R/W3 0x001C Timer Input Capture/Output Compare Register 6 (TC6(hi)) R/W3 0x001D Timer Input Capture/Output Compare Register 6 (TC6(lo)) R/W3 0x001E Timer Input Capture/Output Compare Register 7 (TC7(hi)) R/W3 0x001F Timer Input Capture/Output Compare Register 7 (TC7(lo)) R/W3 0x0020 16-Bit Pulse Accumulator Control Register (PACTL) R/W 0x0021 Pulse Accumulator Flag Register (PAFLG) R/W 0x0022 Pulse Accumulator Count Register (PACNT(hi)) R/W 0x0023 Pulse Accumulator Count Register (PACNT(lo)) R/W 0x0024 – 0x002C Reserved —(4) 0x002D Timer Test Register (TIMTST) R/W2 0x002E – 0x002F Reserved —4 1. Always read 0x0000. 2. Only writable in special modes (test_mode = 1). 3. Write to these registers have no meaning or effect during input capture. 4. Write has no effect; return 0 on read 440 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.3.2 Register Descriptions This section consists of register descriptions in address order. Each description includes a standard register diagram with an associated figure number. Details of register bit and field function follow the register diagrams, in bit order. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R IOS7 IOS6 IOS5 IOS4 IOS3 IOS2 IOS1 IOS0 TIOS W 0x0001 R 0 0 0 0 0 0 0 0 CFORC W FOC7 FOC6 FOC5 FOC4 FOC3 FOC2 FOC1 FOC0 0x0002 R OC7M7 OC7M6 OC7M5 OC7M4 OC7M3 OC7M2 OC7M1 OC7M0 OC7M W 0x0003 R OC7D7 OC7D6 OC7D5 OC7D4 OC7D3 OC7D2 OC7D1 OC7D0 OC7D W 0x0004 R TCNT15 TCNT14 TCNT13 TCNT12 TCNT11 TCNT10 TCNT9 TCNT8 TCNTH W 0x0005 R TCNT7 TCNT6 TCNT5 TCNT4 TCNT3 TCNT2 TCNT1 TCNT0 TCNTL W 0x0006 R 0 0 0 0 TEN TSWAI TSFRZ TFFCA TSCR1 W 0x0007 R TOV7 TOV6 TOV5 TOV4 TOV3 TOV2 TOV1 TOV0 TTOV W 0x0008 R OM7 OL7 OM6 OL6 OM5 OL5 OM4 OL4 TCTL1 W 0x0009 R OM3 OL3 OM2 OL2 OM1 OL1 OM0 OL0 TCTL2 W 0x000A R EDG7B EDG7A EDG6B EDG6A EDG5B EDG5A EDG4B EDG4A TCTL3 W 0x000B R EDG3B EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A TCTL4 W 0x000C R C7I C6I C5I C4I C3I C2I C1I C0I TIE W = Unimplemented or Reserved Figure15-5. TIM16B8CV1 Register Summary Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 441 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x000D R 0 0 0 TOI TCRE PR2 PR1 PR0 TSCR2 W 0x000E R C7F C6F C5F C4F C3F C2F C1F C0F TFLG1 W 0x000F R 0 0 0 0 0 0 0 TOF TFLG2 W R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 W 0x0010–0x001F TCxH–TCxL R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 W 0x0020 R 0 PAEN PAMOD PEDGE CLK1 CLK0 PAOVI PAI PACTL W 0x0021 R 0 0 0 0 0 0 PAOVF PAIF PAFLG W 0x0022 R PACNT15 PACNT14 PACNT13 PACNT12 PACNT11 PACNT10 PACNT9 PACNT8 PACNTH W 0x0023 R PACNT7 PACNT6 PACNT5 PACNT4 PACNT3 PACNT2 PACNT1 PACNT0 PACNTL W 0x0024–0x002F R Reserved W = Unimplemented or Reserved Figure15-5. TIM16B8CV1 Register Summary (continued) 15.3.2.1 Timer Input Capture/Output Compare Select (TIOS) Module Base + 0x0000 7 6 5 4 3 2 1 0 R IOS7 IOS6 IOS5 IOS4 IOS3 IOS2 IOS1 IOS0 W Reset 0 0 0 0 0 0 0 0 Figure15-6. Timer Input Capture/Output Compare Select (TIOS) Read: Anytime 442 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Write: Anytime Table15-3. TIOS Field Descriptions Field Description 7:0 Input Capture or Output Compare Channel Configuration IOS[7:0] 0 The corresponding channel acts as an input capture. 1 The corresponding channel acts as an output compare. 15.3.2.2 Timer Compare Force Register (CFORC) Module Base + 0x0001 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W FOC7 FOC6 FOC5 FOC4 FOC3 FOC2 FOC1 FOC0 Reset 0 0 0 0 0 0 0 0 Figure15-7. Timer Compare Force Register (CFORC) Read: Anytime but will always return 0x0000 (1 state is transient) Write: Anytime Table15-4. CFORC Field Descriptions Field Description 7:0 ForceOutputCompareActionforChannel7:0—Awritetothisregisterwiththecorrespondingdatabit(s)set FOC[7:0] causes the action which is programmed for output compare “x” to occur immediately. The action taken is the sameasifasuccessfulcomparisonhadjusttakenplacewiththeTCxregisterexcepttheinterruptflagdoesnot get set. Note:Asuccessfulchannel7outputcompareoverridesanychannel6:0compares.Ifforcedoutputcompareon anychanneloccursatthesametimeasthesuccessfuloutputcomparethenforcedoutputcompareaction will take precedence and interrupt flag won’t get set. 15.3.2.3 Output Compare 7 Mask Register (OC7M) Module Base + 0x0002 7 6 5 4 3 2 1 0 R OC7M7 OC7M6 OC7M5 OC7M4 OC7M3 OC7M2 OC7M1 OC7M0 W Reset 0 0 0 0 0 0 0 0 Figure15-8. Output Compare 7 Mask Register (OC7M) Read: Anytime Write: Anytime Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 443 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Table15-5. OC7M Field Descriptions Field Description 7:0 OutputCompare7Mask—SettingtheOC7Mx(xrangesfrom0to6)willsetthecorrespondingporttobean OC7M[7:0] output port when the corresponding TIOSx (x ranges from 0 to 6) bit is set to be an output compare. Note:A successful channel 7 output compare overrides any channel 6:0 compares. For each OC7M bit that is set, the output compare action reflects the corresponding OC7D bit. 15.3.2.4 Output Compare 7 Data Register (OC7D) Module Base + 0x0003 7 6 5 4 3 2 1 0 R OC7D7 OC7D6 OC7D5 OC7D4 OC7D3 OC7D2 OC7D1 OC7D0 W Reset 0 0 0 0 0 0 0 0 Figure15-9. Output Compare 7 Data Register (OC7D) Read: Anytime Write: Anytime Table15-6. OC7D Field Descriptions Field Description 7:0 Output Compare 7 Data — A channel 7 output compare can cause bits in the output compare 7 data register OC7D[7:0] to transfer to the timer port data register depending on the output compare 7 mask register. 15.3.2.5 Timer Count Register (TCNT) Module Base + 0x0004 15 14 13 12 11 10 9 9 R TCNT15 TCNT14 TCNT13 TCNT12 TCNT11 TCNT10 TCNT9 TCNT8 W Reset 0 0 0 0 0 0 0 0 Figure15-10. Timer Count Register High (TCNTH) Module Base + 0x0005 7 6 5 4 3 2 1 0 R TCNT7 TCNT6 TCNT5 TCNT4 TCNT3 TCNT2 TCNT1 TCNT0 W Reset 0 0 0 0 0 0 0 0 Figure15-11. Timer Count Register Low (TCNTL) 444 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description The 16-bit main timer is an up counter. A full access for the counter register should take place in one clock cycle. A separate read/write for high byte and low byte will give a different result than accessing them as a word. Read: Anytime Write: Has no meaning or effect in the normal mode; only writable in special modes (test_mode = 1). TheperiodofthefirstcountafterawritetotheTCNTregistersmaybeadifferentsizebecausethewrite is not synchronized with the prescaler clock. 15.3.2.6 Timer System Control Register 1 (TSCR1) Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 TEN TSWAI TSFRZ TFFCA W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure15-12. Timer System Control Register 1 (TSCR1) Read: Anytime Write: Anytime Table15-7. TSCR1 Field Descriptions Field Description 7 Timer Enable TEN 0 Disables the main timer, including the counter. Can be used for reducing power consumption. 1 Allows the timer to function normally. If for any reason the timer is not active, there is no÷64 clock for the pulse accumulator because the÷64 is generated by the timer prescaler. 6 Timer Module Stops While in Wait TSWAI 0 Allows the timer module to continue running during wait. 1 DisablesthetimermodulewhentheMCUisinthewaitmode.TimerinterruptscannotbeusedtogettheMCU out of wait. TSWAI also affects pulse accumulator. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 445 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Table15-7. TSCR1 Field Descriptions (continued) Field Description 5 Timer Stops While in Freeze Mode TSFRZ 0 Allows the timer counter to continue running while in freeze mode. 1 Disables the timer counter whenever the MCU is in freeze mode. This is useful for emulation. TSFRZ does not stop the pulse accumulator. 4 Timer Fast Flag Clear All TFFCA 0 Allows the timer flag clearing to function normally. 1 ForTFLG1(0x000E),areadfromaninputcaptureorawritetotheoutputcomparechannel(0x0010–0x001F) causes the corresponding channel flag, CnF, to be cleared. For TFLG2 (0x000F), any access to the TCNT register (0x0004, 0x0005) clears the TOF flag. Any access to the PACNT registers (0x0022, 0x0023) clears the PAOVF and PAIF flags in the PAFLG register (0x0021). This has the advantage of eliminating software overhead in a separate clear sequence. Extra care is required to avoid accidental flag clearing due to unintended accesses. 15.3.2.7 Timer Toggle On Overflow Register 1 (TTOV) Module Base + 0x0007 7 6 5 4 3 2 1 0 R TOV7 TOV6 TOV5 TOV4 TOV3 TOV2 TOV1 TOV0 W Reset 0 0 0 0 0 0 0 0 Figure15-13. Timer Toggle On Overflow Register 1 (TTOV) Read: Anytime Write: Anytime Table15-8. TTOV Field Descriptions Field Description 7:0 ToggleOnOverflowBits—TOVxtogglesoutputcomparepinonoverflow.Thisfeatureonlytakeseffectwhen TOV[7:0] inoutputcomparemode.Whenset,ittakesprecedenceoverforcedoutputcomparebutnotchannel7override events. 0 Toggle output compare pin on overflow feature disabled. 1 Toggle output compare pin on overflow feature enabled. 15.3.2.8 Timer Control Register 1/Timer Control Register 2 (TCTL1/TCTL2) Module Base + 0x0008 7 6 5 4 3 2 1 0 R OM7 OL7 OM6 OL6 OM5 OL5 OM4 OL4 W Reset 0 0 0 0 0 0 0 0 Figure15-14. Timer Control Register 1 (TCTL1) 446 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Module Base + 0x0009 7 6 5 4 3 2 1 0 R OM3 OL3 OM2 OL2 OM1 OL1 OM0 OL0 W Reset 0 0 0 0 0 0 0 0 Figure15-15. Timer Control Register 2 (TCTL2) Read: Anytime Write: Anytime Table15-9. TCTL1/TCTL2 Field Descriptions Field Description 7:0 OutputMode—Theseeightpairsofcontrolbitsareencodedtospecifytheoutputactiontobetakenasaresult OMx of a successful OCx compare. When either OMx or OLx is 1, the pin associated with OCx becomes an output tied to OCx. Note:To enable output action by OMx bits on timer port, the corresponding bit in OC7M should be cleared. 7:0 OutputLevel—Theseeightpairsofcontrolbitsareencodedtospecifytheoutputactiontobetakenasaresult OLx of a successful OCx compare. When either OMx or OLx is 1, the pin associated with OCx becomes an output tied to OCx. Note:To enable output action by OLx bits on timer port, the corresponding bit in OC7M should be cleared. Table15-10. Compare Result Output Action OMx OLx Action 0 0 Timer disconnected from output pin logic 0 1 Toggle OCx output line 1 0 Clear OCx output line to zero 1 1 Set OCx output line to one To operate the 16-bit pulse accumulator independently of input capture or output compare 7 and 0 respectively the user must set the corresponding bits IOSx = 1, OMx = 0 and OLx = 0. OC7M7 in the OC7M register must also be cleared. To enable output action using the OM7 and OL7 bits on the timer port,the corresponding bit OC7M7 in the OC7M register must also be cleared. The settings for these bits can be seen in Table15-11 Table15-11. The OC7 and OCx event priority OC7M7=0 OC7M7=1 OC7Mx=1 OC7Mx=0 OC7Mx=1 OC7Mx=0 TC7=TCx TC7>TCx TC7=TCx TC7>TCx TC7=TCx TC7>TCx TC7=TCx TC7>TCx IOCx=OC7Dx IOCx=OC7Dx IOCx=OMx/OLx IOCx=OC7Dx IOCx=OC7Dx IOCx=OMx/OLx IOC7=OM7/O +OMx/OLx IOC7=OM7/OL7 IOC7=OC7D7 +OMx/OLx IOC7=OC7D7 L7 IOC7=OM7/O IOC7=OC7D7 L7 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 447 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Note: inTable15-11, the IOS7 and IOSx should be set to 1 IOSx is the register TIOS bit x, OC7Mx is the register OC7M bit x, TCx is timer Input Capture/Output Compare register, IOCx is channel x, OMx/OLx is the register TCTL1/TCTL2, OC7Dx is the register OC7D bit x. IOCx = OC7Dx+ OMx/OLx, means that both OC7 event and OCx event will change channel x value. 448 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.3.2.9 Timer Control Register 3/Timer Control Register 4 (TCTL3 and TCTL4) Module Base + 0x000A 7 6 5 4 3 2 1 0 R EDG7B EDG7A EDG6B EDG6A EDG5B EDG5A EDG4B EDG4A W Reset 0 0 0 0 0 0 0 0 Figure15-16. Timer Control Register 3 (TCTL3) Module Base + 0x000B 7 6 5 4 3 2 1 0 R EDG3B EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A W Reset 0 0 0 0 0 0 0 0 Figure15-17. Timer Control Register 4 (TCTL4) Read: Anytime Write: Anytime. Table15-12. TCTL3/TCTL4 Field Descriptions Field Description 7:0 Input Capture Edge Control— These eight pairs of control bits configure the input capture edge detector EDGnB circuits. EDGnA Table15-13. Edge Detector Circuit Configuration EDGnB EDGnA Configuration 0 0 Capture disabled 0 1 Capture on rising edges only 1 0 Capture on falling edges only 1 1 Capture on any edge (rising or falling) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 449 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.3.2.10 Timer Interrupt Enable Register (TIE) Module Base + 0x000C 7 6 5 4 3 2 1 0 R C7I C6I C5I C4I C3I C2I C1I C0I W Reset 0 0 0 0 0 0 0 0 Figure15-18. Timer Interrupt Enable Register (TIE) Read: Anytime Write: Anytime. Table15-14. TIE Field Descriptions Field Description 7:0 Input Capture/Output Compare “x” Interrupt Enable —The bits in TIE correspond bit-for-bit with the bits in C7I:C0I theTFLG1statusregister.Ifcleared,thecorrespondingflagisdisabledfromcausingahardwareinterrupt.Ifset, the corresponding flag is enabled to cause a interrupt. 15.3.2.11 Timer System Control Register 2 (TSCR2) Module Base + 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 TOI TCRE PR2 PR1 PR0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure15-19. Timer System Control Register 2 (TSCR2) Read: Anytime Write: Anytime. 450 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Table15-15. TSCR2 Field Descriptions Field Description 7 Timer Overflow Interrupt Enable TOI 0 Interrupt inhibited. 1 Hardware interrupt requested when TOF flag set. 3 TimerCounterResetEnable—Thisbitallowsthetimercountertoberesetbyasuccessfuloutputcompare7 TCRE event. This mode of operation is similar to an up-counting modulus counter. 0 Counter reset inhibited and counter free runs. 1 Counter reset by a successful output compare 7. Note:IfTC7=0x0000andTCRE=1,TCNTwillstayat0x0000continuously.IfTC7=0xFFFFandTCRE=1, TOF will never be set when TCNT is reset from 0xFFFF to 0x0000. Note:TCRE=1andTC7!=0,theTCNTcycleperiodwillbeTC7x"prescalercounterwidth"+"1BusClock",for a more detail explanation please refer toSection15.4.3, “Output Compare 2 Timer Prescaler Select — These three bits select the frequency of the timer prescaler clock derived from the PR[2:0] Bus Clock as shown inTable15-16. Table15-16. Timer Clock Selection PR2 PR1 PR0 Timer Clock 0 0 0 Bus Clock / 1 0 0 1 Bus Clock / 2 0 1 0 Bus Clock / 4 0 1 1 Bus Clock / 8 1 0 0 Bus Clock / 16 1 0 1 Bus Clock / 32 1 1 0 Bus Clock / 64 1 1 1 Bus Clock / 128 NOTE The newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. 15.3.2.12 Main Timer Interrupt Flag 1 (TFLG1) Module Base + 0x000E 7 6 5 4 3 2 1 0 R C7F C6F C5F C4F C3F C2F C1F C0F W Reset 0 0 0 0 0 0 0 0 Figure15-20. Main Timer Interrupt Flag 1 (TFLG1) Read: Anytime Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 451 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Write: Used in the clearing mechanism (set bits cause corresponding bits to be cleared). Writing a zero will not affect current status of the bit. Table15-17. TRLG1 Field Descriptions Field Description 7:0 Input Capture/Output Compare Channel “x” Flag — These flags are set when an input capture or output C[7:0]F compare event occurs. Clearing requires writing a one to the corresponding flag bit when TEN is set to one. WhenTFFCAbitinTSCRregisterisset,areadfromaninputcaptureorawriteintoanoutputcomparechannel (0x0010–0x001F) will cause the corresponding channel flag CxF to be cleared. 15.3.2.13 Main Timer Interrupt Flag 2 (TFLG2) Module Base + 0x000F 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 TOF W Reset 0 0 0 0 0 0 0 0 Unimplemented or Reserved Figure15-21. Main Timer Interrupt Flag 2 (TFLG2) TFLG2 indicates when interrupt conditions have occurred. To clear a bit in the flag register, write the bit to one while TEN of TSCR1 is set to one. Read: Anytime Write: Used in clearing mechanism (set bits cause corresponding bits to be cleared). Any access to TCNT will clear TFLG2 register if the TFFCA bit in TSCR register is set. Table15-18. TRLG2 Field Descriptions Field Description 7 TimerOverflowFlag—Setwhen16-bitfree-runningtimeroverflowsfrom0xFFFFto0x0000.Clearingthisbit TOF requires writing a one to bit 7 of TFLG2 register while TEN bit of TSCR1 is set to one. (See also TCRE control bit explanation.) 452 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.3.2.14 Timer Input Capture/Output Compare Registers High and Low 0–7 (TCxH and TCxL) Module Base + 0x0010 = TC0H 0x0018 = TC4H 0x0012 = TC1H 0x001A = TC5H 0x0014 = TC2H 0x001C = TC6H 0x0016 = TC3H 0x001E = TC7H 15 14 13 12 11 10 9 0 R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 W Reset 0 0 0 0 0 0 0 0 Figure15-22. Timer Input Capture/Output Compare Register x High (TCxH) Module Base + 0x0011 = TC0L 0x0019 = TC4L 0x0013 = TC1L 0x001B = TC5L 0x0015 = TC2L 0x001D = TC6L 0x0017 = TC3L 0x001F = TC7L 7 6 5 4 3 2 1 0 R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 W Reset 0 0 0 0 0 0 0 0 Figure15-23. Timer Input Capture/Output Compare Register x Low (TCxL) DependingontheTIOSbitforthecorrespondingchannel,theseregistersareusedtolatchthevalueofthe free-runningcounterwhenadefinedtransitionissensedbythecorrespondinginputcaptureedgedetector or to trigger an output action for output compare. Read: Anytime Write: Anytime for output compare function.Writes to these registers have no meaning or effect during input capture. All timer input capture/output compare registers are reset to 0x0000. NOTE Read/Writeaccessinbytemodeforhighbyteshouldtakesplacebeforelow byte otherwise it will give a different result. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 453 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.3.2.15 16-Bit Pulse Accumulator Control Register (PACTL) Module Base + 0x0020 7 6 5 4 3 2 1 0 R 0 PAEN PAMOD PEDGE CLK1 CLK0 PAOVI PAI W Reset 0 0 0 0 0 0 0 0 Unimplemented or Reserved Figure15-24. 16-Bit Pulse Accumulator Control Register (PACTL) When PAEN is set, the PACT is enabled.The PACT shares the input pin with IOC7. Read: Any time Write: Any time Table15-19. PACTL Field Descriptions Field Description 6 Pulse Accumulator System Enable — PAEN is independent from TEN. With timer disabled, the pulse PAEN accumulator can function unless pulse accumulator is disabled. 0 16-Bit Pulse Accumulator system disabled. 1 Pulse Accumulator system enabled. 5 Pulse Accumulator Mode — This bit is active only when the Pulse Accumulator is enabled (PAEN = 1).See PAMOD Table15-20. 0 Event counter mode. 1 Gated time accumulation mode. 4 PulseAccumulatorEdgeControl—ThisbitisactiveonlywhenthePulseAccumulatorisenabled(PAEN=1). PEDGE For PAMOD bit = 0 (event counter mode). SeeTable15-20. 0 Falling edges on IOC7 pin cause the count to be incremented. 1 Rising edges on IOC7 pin cause the count to be incremented. For PAMOD bit = 1 (gated time accumulation mode). 0 IOC7 input pin high enables M (bus clock) divided by 64 clock to Pulse Accumulator and the trailing falling edge on IOC7 sets the PAIF flag. 1 IOC7inputpinlowenablesM(busclock)dividedby64clocktoPulseAccumulatorandthetrailingrisingedge on IOC7 sets the PAIF flag. 3:2 Clock Select Bits —Refer toTable15-21. CLK[1:0] 1 Pulse Accumulator Overflow Interrupt Enable PAOVI 0 Interrupt inhibited. 1 Interrupt requested if PAOVF is set. 0 Pulse Accumulator Input Interrupt Enable PAI 0 Interrupt inhibited. 1 Interrupt requested if PAIF is set. 454 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Table15-20. Pin Action PAMOD PEDGE Pin Action 0 0 Falling edge 0 1 Rising edge 1 0 Div. by 64 clock enabled with pin high level 1 1 Div. by 64 clock enabled with pin low level NOTE If the timer is not active (TEN = 0 in TSCR), there is no divide-by-64 because the÷64 clock is generated by the timer prescaler. Table15-21. Timer Clock Selection CLK1 CLK0 Timer Clock 0 0 Use timer prescaler clock as timer counter clock 0 1 Use PACLK as input to timer counter clock 1 0 Use PACLK/256 as timer counter clock frequency 1 1 Use PACLK/65536 as timer counter clock frequency For the description of PACLK please refer Figure15-24. If the pulse accumulator is disabled (PAEN = 0), the prescaler clock from the timer is always used as an input clock to the timer counter. The change from one selected clock to the other happens immediately after these bits are written. 15.3.2.16 Pulse Accumulator Flag Register (PAFLG) Module Base + 0x0021 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 PAOVF PAIF W Reset 0 0 0 0 0 0 0 0 Unimplemented or Reserved Figure15-25. Pulse Accumulator Flag Register (PAFLG) Read: Anytime Write: Anytime WhentheTFFCAbitintheTSCRregisterisset,anyaccesstothePACNTregisterwillclearalltheflags in the PAFLG register. Timer module must stay enabled (TEN =1) while clearing thse bits. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 455 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Table15-22. PAFLG Field Descriptions Field Description 1 PulseAccumulatorOverflowFlag—Setwhenthe16-bitpulseaccumulatoroverflowsfrom0xFFFFto0x0000. PAOVF ClearingthisbitrequireswirtingaonetothisbitinthePAFLGregisterwhileTENbitofTSCR1registerissetto one. 0 PulseAccumulatorInputedgeFlag—SetwhentheselectededgeisdetectedattheIOC7inputpin.Inevent PAIF mode the event edge triggers PAIF and in gated time accumulation mode the trailing edge of the gate signal at the IOC7 input pin triggers PAIF. ClearingthisbitrequireswritingaonetothisbitinthePAFLGregisterwhileTENbitofTSCR1registerissetto one. Any access to the PACNT register will clear all the flags in this register when TFFCA bit in register TSCR(0x0006) is set. 456 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.3.2.17 Pulse Accumulators Count Registers (PACNT) Module Base + 0x0022 15 14 13 12 11 10 9 0 R PACNT15 PACNT14 PACNT13 PACNT12 PACNT11 PACNT10 PACNT9 PACNT8 W Reset 0 0 0 0 0 0 0 0 Figure15-26. Pulse Accumulator Count Register High (PACNTH) Module Base + 0x0023 7 6 5 4 3 2 1 0 R PACNT7 PACNT6 PACNT5 PACNT4 PACNT3 PACNT2 PACNT1 PACNT0 W Reset 0 0 0 0 0 0 0 0 Figure15-27. Pulse Accumulator Count Register Low (PACNTL) Read: Anytime Write: Anytime These registers contain the number of active input edges on its input pin since the last reset. When PACNT overflows from 0xFFFF to 0x0000, the Interrupt flag PAOVF in PAFLG (0x0021) is set. Fullcountregisteraccessshouldtakeplaceinoneclockcycle.Aseparateread/writeforhighbyteandlow byte will give a different result than accessing them as a word. NOTE Readingthepulseaccumulatorcounterregistersimmediatelyafteranactive edgeonthepulseaccumulatorinputpinmaymissthelastcountbecausethe input has to be synchronized with the bus clock first. 15.4 Functional Description ThissectionprovidesacompletefunctionaldescriptionofthetimerTIM16B8CV1block.Pleasereferto the detailed timer block diagram inFigure15-28 as necessary. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 457 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Bus Clock CLK[1:0] PR[2:1:0] channel 7 output PACLK compare PACLK/256 MUX PACLK/65536 PRESCALER TCRE CxI TCNT(hi):TCNT(lo) CxF CLEAR COUNTER 16-BIT COUNTER TOF INTERRUPT TE TOI LOGIC TOF CHANNEL 0 C0F 16-BIT COMPARATOR C0F CH. 0 CAPTURE OM:OL0 TC0 IOC0 PIN TOV0 LOGI C CH. 0COMPARE IOC0 PIN EDGE EDG0A EDG0B DETECT IOC0 CHANNEL 1 16-BIT COMPARATOR C1F C1F CH. 1 CAPTURE OM:OL1 TC1 IOC1 PIN IOC1 PIN EDG1A EDG1B EDGE TOV1 LOGI C CH. 1 COMPARE DETECT IOC1 CHANNEL2 CHANNEL7 16-BIT COMPARATOR C7F C7F CH.7 CAPTURE TC7 OM:O73 IOC7 PIN PA INPUT LOGIC IOC7 PIN EDG7A EDGE TOV7 CH. 7 COMPARE EDG7B DETECT IOC7 PAOVF PACNT(hi):PACNT(lo) PEDGE EDGE DETECT PAE PACLK/65536 16-BIT COUNTER PACLK PACLK/256 TEN INTERRUPT INTERRUPT PAIF REQUEST LOGIC DIVIDE-BY-64 Bus Clock PAOVI PAI PAOVF PAIF PAOVF PAOVI Figure15-28. Detailed Timer Block Diagram 15.4.1 Prescaler The prescaler divides the bus clock by 1,2,4,8,16,32,64 or 128. The prescaler select bits, PR[2:0], select the prescaler divisor. PR[2:0] are in timer system control register 2 (TSCR2). 458 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.4.2 Input Capture Clearing the I/O (input/output) select bit, IOSx, configures channel x as an input capture channel. The inputcapturefunctioncapturesthetimeatwhichanexternaleventoccurs.Whenanactiveedgeoccurson thepinofaninputcapturechannel,thetimertransfersthevalueinthetimercounterintothetimerchannel registers, TCx. The minimum pulse width for the input capture input is greater than two bus clocks. An input capture on channel x sets the CxF flag. The CxI bit enables the CxF flag to generate interrupt requests. Timer module must stay enabled (TEN bit of TSCR1 must be set to one) while clearing CxF (writing one to CxF). 15.4.3 Output Compare SettingtheI/Oselectbit,IOSx,configureschannelxasanoutputcomparechannel.Theoutputcompare function can generate a periodic pulse with a programmable polarity, duration, and frequency. When the timer counter reaches the value in the channel registers of an output compare channel, the timer can set, clear,ortogglethechannelpin.AnoutputcompareonchannelxsetstheCxFflag.TheCxIbitenablesthe CxFflagtogenerateinterruptrequests.Timermodulemuststayenabled(TENbitofTSCR1registermust be set to one) while clearing CxF (writing one to CxF). Theoutputmodeandlevelbits,OMxandOLx,selectset,clear,toggleonoutputcompare.Clearingboth OMx and OLx disconnects the pin from the output logic. Setting a force output compare bit, FOCx, causes an output compare on channel x. A forced output compare does not set the channel flag. A successful output compare on channel 7 overrides output compares on all other output compare channels. The output compare 7 mask register masks the bits in the output compare 7 data register. The timer counter reset enable bit, TCRE, enables channel 7 output compares to reset the timer counter. A channel 7 output compare can reset the timer counter even if the IOC7 pin is being used as the pulse accumulator input. Writing to the timer port bit of an output compare pin does not affect the pin state. The value written is stored in an internal latch. When the pin becomes available for general-purpose output, the last value written to the bit appears at the pin. WhenTCREissetandTC7isnotequalto0,thenTCNTwillcyclefrom0toTC7.WhenTCNTreaches TC7 value, it will last only one bus cycle then reset to 0. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 459 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description Note: inFigure15-29,if PR[2:0] is equal to 0, one prescaler counter equal to one bus clock Figure15-29. The TCNT cycle diagram under TCRE=1 condition prescaler 1 bus counter clock TC7 0 1 ----- TC7-1 TC7 0 TC7 event TC7 event 15.4.4 Pulse Accumulator The pulse accumulator (PACNT) is a 16-bit counter that can operate in two modes: Event counter mode — Counting edges of selected polarity on the pulse accumulator input pin, PAI. Gatedtimeaccumulationmode—Countingpulsesfromadivide-by-64clock.ThePAMODbitselectsthe mode of operation. The minimum pulse width for the PAI input is greater than two bus clocks. 15.4.5 Event Counter Mode ClearingthePAMODbitconfiguresthePACNTforeventcounteroperation.AnactiveedgeontheIOC7 pin increments the pulse accumulator counter. The PEDGE bit selects falling edges or rising edges to increment the count. NOTE The PACNT input and timer channel 7 use the same pin IOC7. To use the IOC7, disconnect it from the output logic by clearing the channel 7 output modeandoutputlevelbits,OM7andOL7.Alsoclearthechannel7output compare 7 mask bit, OC7M7. ThePulseAccumulatorcounterregisterreflectthenumberofactiveinputedgesonthePACNTinputpin since the last reset. The PAOVF bit is set when the accumulator rolls over from 0xFFFF to 0x0000. The pulse accumulator overflow interrupt enable bit, PAOVI, enables the PAOVF flag to generate interrupt requests. NOTE The pulse accumulator counter can operate in event counter mode even when the timer enable bit, TEN, is clear. 460 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.4.6 Gated Time Accumulation Mode SettingthePAMODbitconfiguresthepulseaccumulatorforgatedtimeaccumulationoperation.Anactive levelonthePACNTinputpinenablesadivided-by-64clocktodrivethepulseaccumulator.ThePEDGE bit selects low levels or high levels to enable the divided-by-64 clock. The trailing edge of the active level at the IOC7 pin sets the PAIF. The PAI bit enables the PAIF flag to generate interrupt requests. Thepulseaccumulatorcounterregisterreflectthenumberofpulsesfromthedivided-by-64clocksincethe last reset. NOTE The timer prescaler generates the divided-by-64 clock. If the timer is not active, there is no divided-by-64 clock. 15.5 Resets TheresetstateofeachindividualbitislistedwithinSection15.3,“MemoryMapandRegisterDefinition” which details the registers and their bit fields. 15.6 Interrupts This section describes interrupts originated by the TIM16B8CV1 block. Table15-23 lists the interrupts generated by the TIM16B8CV1 to communicate with the MCU. Table15-23. TIM16B8CV1 Interrupts Offset Interrupt Vector1 Priority1 Source Description (1) C[7:0]F — — — Timer Channel 7–0 Active high timer channel interrupts 7–0 PAOVI — — — Pulse Accumulator Active high pulse accumulator input interrupt Input PAOVF — — — Pulse Accumulator Pulse accumulator overflow interrupt Overflow TOF — — — Timer Overflow Timer Overflow interrupt 1. Chip Dependent. TheTIM16B8CV1usesatotalof11interruptvectors.Theinterruptvectoroffsetsandinterruptnumbers are chip dependent. 15.6.1 Channel [7:0] Interrupt (C[7:0]F) This active high outputs will be asserted by the module to request a timer channel 7 – 0 interrupt to be serviced by the system controller. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 461 Rev 01.24

Chapter15 Timer Module (TIM16B8CV1) Block Description 15.6.2 Pulse Accumulator Input Interrupt (PAOVI) Thisactivehighoutputwillbeassertedbythemoduletorequestatimerpulseaccumulatorinputinterrupt to be serviced by the system controller. 15.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) This active high output will be asserted by the module to request a timer pulse accumulator overflow interrupt to be serviced by the system controller. 15.6.4 Timer Overflow Interrupt (TOF) Thisactivehighoutputwillbeassertedbythemoduletorequestatimeroverflowinterrupttobeserviced by the system controller. 462 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.1 Introduction The VREG3V3V2 is a dual output voltage regulator providing two separate 2.5 V (typical) supplies differingintheamountofcurrentthatcanbesourced.Theregulatorinputvoltagerangeisfrom3.3Vup to 5 V (typical). 16.1.1 Features The block VREG3V3V2 includes these distinctive features: • Two parallel, linear voltage regulators — Bandgap reference • Low-voltage detect (LVD) with low-voltage interrupt (LVI) • Power-on reset (POR) • Low-voltage reset (LVR) 16.1.2 Modes of Operation There are three modes VREG3V3V2 can operate in: • Full-performance mode (FPM) (MCU is not in stop mode) The regulator is active, providing the nominal supply voltage of 2.5 V with full current sourcing capabilityatbothoutputs.FeaturesLVD(low-voltagedetect),LVR(low-voltagereset),andPOR (power-on reset) are available. • Reduced-power mode (RPM) (MCU is in stop mode) The purpose is to reduce power consumption of the device. The output voltage may degrade to a lower value than in full-performance mode, additionally the current sourcing capability is substantially reduced. Only the POR is available in this mode, LVD and LVR are disabled. • Shutdown mode Controlled by V (see device overview chapter for connectivity of V ). REGEN REGEN This mode is characterized by minimum power consumption. The regulator outputs are in a high impedance state, only the POR feature is available, LVD and LVR are disabled. This mode must be used to disable the chip internal regulator VREG3V3V2, i.e., to bypass the VREG3V3V2 to use external supplies. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 463 Rev 01.24

Chapter16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.1.3 Block Diagram Figure16-1 shows the function principle of VREG3V3V2 by means of a block diagram. The regulator core REG consists of two parallel sub-blocks, REG1 and REG2, providing two independent output voltages. V DDPLL REG2 V V DDR SSPLL G E V R DDA V DD REG1 LVD LVR LVR POR POR V V SSA SS V REGEN CTRL LVI REG: Regulator Core LVD: Low Voltage Detect CTRL: Regulator Control LVR: Low Voltage Reset POR: Power-on Reset PIN Figure16-1. VREG3V3 Block Diagram 464 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.2 External Signal Description Due to the nature of VREG3V3V2 being a voltage regulator providing the chip internal power supply voltages most signals are power supply signals connected to pads. Table16-1 shows all signals of VREG3V3V2 associated with pins. Table16-1. VREG3V3V2 — Signal Properties Name Port Function Reset State Pull Up V — VREG3V3V2 power input (positive supply) — — DDR V — VREG3V3V2 quiet input (positive supply) — — DDA V — VREG3V3V2 quiet input (ground) — — SSA V — VREG3V3V2 primary output (positive supply) — — DD V — VREG3V3V2 primary output (ground) — — SS V — VREG3V3V2 secondary output (positive supply) — — DDPLL V — VREG3V3V2 secondary output (ground) — — SSPLL V (optional) — VREG3V3V2 (Optional) Regulator Enable — — REGEN NOTE Check device overview chapter for connectivity of the signals. 16.2.1 V — Regulator Power Input DDR Signal V is the power input of VREG3V3V2. All currents sourced into the regulator loads flow DDR throughthispin.Achipexternaldecouplingcapacitor(100nF...220nF,X7Rceramic)betweenV and DDR V can smoothen ripple on V . SSR DDR For entering Shutdown Mode, pin V should also be tied to ground on devices without a V pin. DDR REGEN 16.2.2 V , V — Regulator Reference Supply DDA SSA Signals V /V which are supposed to be relatively quiet are used to supply the analog parts of the DDA SSA regulator.Internalprecisionreferencecircuitsaresuppliedfromthesesignals.Achipexternaldecoupling capacitor(100nF...220nF,X7Rceramic)betweenV andV canfurtherimprovethequalityofthis DDA SSA supply. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 465 Rev 01.24

Chapter16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.2.3 V , V — Regulator Output1 (Core Logic) DD SS Signals V /V are the primary outputs of VREG3V3V2 that provide the power supply for the core DD SS logic.Thesesignalsareconnectedtodevicepinstoallowexternaldecouplingcapacitors(100nF...220nF, X7R ceramic). In Shutdown Mode an external supply at V /V can replace the voltage regulator. DD SS 16.2.4 V , V — Regulator Output2 (PLL) DDPLL SSPLL SignalsV /V arethesecondaryoutputsofVREG3V3V2thatprovidethepowersupplyforthe DDPLL SSPLL PLL and oscillator. These signals are connected to device pins to allow external decoupling capacitors (100 nF...220 nF, X7R ceramic). In Shutdown Mode an external supply at V /V can replace the voltage regulator. DDPLL SSPLL 16.2.5 V — Optional Regulator Enable REGEN ThisoptionalsignalisusedtoshutdownVREG3V3V2.InthatcaseV /V andV /V must DD SS DDPLL SSPLL be provided externally. Shutdown Mode is entered with V being low. If V is high, the REGEN REGEN VREG3V3V2 is either in Full Performance Mode or in Reduced Power Mode. For the connectivity of V see device overview chapter. REGEN NOTE SwitchingfromFPMorRPMtoshutdownofVREG3V3V2andviceversa is not supported while the MCU is powered. 16.3 Memory Map and Register Definition This subsection provides a detailed description of all registers accessible in VREG3V3V2. 16.3.1 Module Memory Map Figure16-2 provides an overview of all used registers. Table16-2. VREG3V3V2 Memory Map Address Use Access Offset 0x0000 VREG3V3V2 Control Register (VREGCTRL) R/W 466 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.3.2 Register Descriptions The following paragraphs describe, in address order, all the VREG3V3V2 registers and their individual bits. 16.3.2.1 VREG3V3V2 — Control Register (VREGCTRL) The VREGCTRL register allows to separately enable features of VREG3V3V2. Module Base + 0x0000 7 6 5 4 3 2 1 0 R 0 0 0 0 0 LVDS LVIE LVIF W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure16-2. VREG3V3 — Control Register (VREGCTRL) Table16-3. MCCTL1 Field Descriptions Field Description 2 Low-Voltage Detect Status Bit — This read-only status bit reflects the input voltage. Writes have no effect. LVDS 0 Input voltage V is above level V or RPM or shutdown mode. DDA LVID 1 Input voltage V is below level V and FPM. DDA LVIA 1 Low-Voltage Interrupt Enable Bit LVIE 0 Interrupt request is disabled. 1 Interrupt will be requested whenever LVIF is set. 0 Low-VoltageInterruptFlag—LVIFissetto1whenLVDSstatusbitchanges.Thisflagcanonlybeclearedby LVIF writing a 1. Writing a 0 has no effect. If enabled (LVIE = 1), LVIF causes an interrupt request. 0 No change in LVDS bit. 1 LVDS bit has changed. NOTE On entering the Reduced Power Mode the LVIF is not cleared by the VREG3V3V2. 16.4 Functional Description Block VREG3V3V2 is a voltage regulator as depicted in Figure16-1. The regulator functional elements aretheregulatorcore(REG),alow-voltagedetectmodule(LVD),apower-onresetmodule(POR)anda low-voltage reset module (LVR). There is also the regulator control block (CTRL) which represents the interface to the digital core logic but also manages the operating modes of VREG3V3V2. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 467 Rev 01.24

Chapter16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.4.1 REG — Regulator Core VREG3V3V2, respectively its regulator core has two parallel, independent regulation loops (REG1 and REG2)thatdifferonlyintheamountofcurrentthatcanbesourcedtotheconnectedloads.Therefore,only REG1 providing the supply at V /V is explained. The principle is also valid for REG2. DD SS The regulator is a linear series regulator with a bandgap reference in its Full Performance Mode and a voltage clamp in Reduced Power Mode. All load currents flow from input V to V or V , the DDR SS SSPLL reference circuits are connected to V and V . DDA SSA 16.4.2 Full-Performance Mode In Full Performance Mode, a fraction of the output voltage (V ) and the bandgap reference voltage are DD fedtoanoperationalamplifier.Theamplifiedinputvoltagedifferencecontrolsthegateofanoutputdriver which basically is a large NMOS transistor connected to the output. 16.4.3 Reduced-Power Mode InReducedPowerMode,thedrivergateisconnectedtoabufferedfractionoftheinputvoltage(V ). DDR The operational amplifier and the bandgap are disabled to reduce power consumption. 16.4.4 LVD — Low-Voltage Detect sub-block LVD is responsible for generating the low-voltage interrupt (LVI). LVD monitors the input voltage(V –V )andcontinuouslyupdatesthestatusflagLVDS.InterruptflagLVIFissetwhenever DDA SSA statusflagLVDSchangesitsvalue.TheLVDisavailableinFPMandisinactiveinReducedPowerMode and Shutdown Mode. 16.4.5 POR — Power-On Reset This functional block monitors output V . If V is below V , signal POR is high, if it exceeds DD DD PORD V , the signal goes low. The transition to low forces the CPU in the power-on sequence. PORD Due to its role during chip power-up this module must be active in all operating modes of VREG3V3V2. 16.4.6 LVR — Low-Voltage Reset BlockLVRmonitorstheprimaryoutputvoltageV .Ifitdropsbelowtheassertionlevel(V )signal DD LVRA LVR asserts and when rising above the deassertion level (V ) signal LVR negates again. The LVR LVRD function is available only in Full Performance Mode. 16.4.7 CTRL — Regulator Control This part contains the register block of VREG3V3V2 and further digital functionality needed to control the operating modes. CTRL also represents the interface to the digital core logic. 468 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 16.5 Resets This subsection describes how VREG3V3V2 controls the reset of the MCU.The reset values of registers andsignalsareprovidedinSection16.3,“MemoryMapandRegisterDefinition”.Possibleresetsources are listed inTable 16-4. Table16-4. VREG3V3V2 — Reset Sources Reset Source Local Enable Power-on reset Always active Low-voltage reset Available only in Full Performance Mode 16.5.1 Power-On Reset During chip power-up the digital core may not work if its supply voltage V is below the POR DD deassertionlevel(V ).Therefore,signalPORwhichforcestheotherblocksofthedeviceintoresetis PORD kept high until V exceeds V . Then POR becomes low and the reset generator of the device DD PORD continues the start-up sequence. The power-on reset is active in all operation modes of VREG3V3V2. 16.5.2 Low-Voltage Reset For details on low-voltage reset seeSection16.4.6, “LVR — Low-Voltage Reset”. 16.6 Interrupts This subsection describes all interrupts originated by VREG3V3V2. TheinterruptvectorsrequestedbyVREG3V3V2arelistedinTable16-5.Vectoraddressesandinterrupt priorities are defined at MCU level. Table16-5. VREG3V3V2 — Interrupt Vectors Interrupt Source Local Enable Low Voltage Interrupt (LVI) LVIE = 1; Available only in Full Performance Mode 16.6.1 LVI — Low-Voltage Interrupt In FPM VREG3V3V2 monitors the input voltage V . Whenever V drops below level V the DDA DDA LVIA status bit LVDS is set to 1. Vice versa, LVDS is reset to 0 when V rises above level V . An DDA LVID interrupt,indicatedbyflagLVIF=1,istriggeredbyanychangeofthestatusbitLVDSifinterruptenable bit LVIE =1. NOTE On entering the Reduced Power Mode, the LVIF is not cleared by the VREG3V3V2. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 469 Rev 01.24

Chapter16 Dual Output Voltage Regulator (VREG3V3V2) Block Description 470 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 17 16 Kbyte Flash Module (S12FTS16KV1) 17.1 Introduction TheFTS16Kmoduleimplementsa16KbyteFlash(nonvolatile)memory.TheFlashmemorycontainsone arrayof16Kbytesorganizedas256rowsof64byteswithanerasesectorsizeofeightrows(512bytes). TheFlasharraymaybereadaseitherbytes,alignedwords,ormisalignedwords.Readaccesstimeisone bus cycle for byte and aligned word, and two bus cycles for misaligned words. The Flash array is ideal for program and data storage for single-supply applications allowing for field reprogramming without requiring external voltage sources for program or erase. Program and erase functionsarecontrolledbyacommanddriveninterface.TheFlashmodulesupportsbothmasseraseand sector erase. An erased bit reads 1 and a programmed bit reads 0. The high voltage required to program and erase is generated internally. It is not possible to read from a Flash array while it is being erased or programmed. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 17.1.1 Glossary CommandWriteSequence—Athree-stepMCUinstructionsequencetoprogram,erase,oreraseverify the Flash array memory. 17.1.2 Features • 16KbytesofFlashmemorycomprisedofone16Kbytearraydividedinto32sectorsof512bytes • Automated program and erase algorithm • Interrupts on Flash command completion and command buffer empty • Fast sector erase and word program operation • 2-stage command pipeline for faster multi-word program times • Flexible protection scheme to prevent accidental program or erase • Single power supply for Flash program and erase operations • Security feature to prevent unauthorized access to the Flash array memory Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 471 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.1.3 Modes of Operation See Section17.4.2, “Operating Modes” for a description of the Flash module operating modes. For program and erase operations, refer toSection17.4.1, “Flash Command Operations”. 17.1.4 Block Diagram Figure17-1 shows a block diagram of theFTS16K module. FTS16K Flash Interface Command Complete Command Pipeline Interrupt Flash Array cmd2 cmd1 addr2 addr1 8K * 16 Bits Command data2 data1 Buffer Empty sector 0 Interrupt sector 1 Registers Protection sector 31 Security Oscillator Clock Clock Divider FCLK Figure17-1. FTS16K Block Diagram 17.2 External Signal Description TheFTS16K module contains no signals that connect off-chip. 472 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.3 Memory Map and Registers This section describes the FTS16K memory map and registers. 17.3.1 Module Memory Map TheFTS16K memory map is shown in Figure17-2. The HCS12 architecture places the Flash array addresses between 0xC000 and 0xFFFF. The content of the HCS12 Core PPAGE register is used to map the logical page ranging from address 0x8000 to 0xBFFF to a physical 16K byte page in the Flash array memory.1 The FPROT register (see Section 17.3.2.5) can be set to globally protect the entire Flash array oronegrowingdownwardfromtheFlasharrayendaddress.Thehigheraddressareaismainlytargetedto hold the boot loader code since it covers the vector space. Default protection settings as well as security informationthatallowstheMCUtorestrictaccesstotheFlashmodulearestoredintheFlashconfiguration field described in Table17-1. Table17-1. Flash Configuration Field Size Flash Address Description (bytes) 0xFF00–0xFF07 8 Backdoor Key to unlock security 0xFF08–0xFF0C 5 Reserved 0xFF0D 1 Flash Protection byte Refer toSection17.3.2.5, “Flash Protection Register (FPROT)” 0xFF0E 1 Reserved 0xFF0F 1 Flash Security/Options byte Refer toSection17.3.2.2, “Flash Security Register (FSEC)” 1. By placing 0x3F in the HCS12 Core PPAGE register, the 16 Kbyte page can be seen twice in the MCU memory map. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 473 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) MODULE BASE + 0x0000 Flash Registers 16 bytes MODULE BASE + 0x000F 0x8000 16K PAGED Flash Array MEMORY 0x3F FLASH_START = 0xC000 Flash Protected High Sectors 0xE000 0x3F 2, 4, 8, 16 Kbytes 0xF000 0xF800 FLASH_END = 0xFFFF 0xFF00–0xFF0F (Flash Configuration Field) Note: 0x3F corresponds to the PPAGE register content Figure17-2. Flash Memory Map Table17-2. Flash Array Memory Map Summary MCU Address Protectable PPAGE Range Address Range 0x8000–0xBFFF 0x3F 0xB800–0xBFFF 0xB000–0xBFFF 0xA000–0xBFFF 0x8000–0xBFFF 0xC000–0xFFFF Unpaged 0xF800–0xFFFF (0x3F) 0xF000–0xFFFF 0xE000–0xFFFF 0xC000–0xFFFF 474 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.3.2 Register Descriptions TheFlashmodulecontainsasetof16controlandstatusregisterslocatedbetweenmodulebase+0x0000 and 0x000F. A summary of the Flash module registers is given in Figure17-3. Detailed descriptions of each register bit are provided. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 FCLKDIV W 0x0001 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 FSEC W 0x0002 R 0 0 0 0 0 0 0 0 RESERVED1 W (1) 0x0003 R 0 0 0 0 0 CBEIE CCIE KEYACC FCNFG W 0x0004 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 NV2 NV1 NV0 FPROT W 0x0005 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL FSTAT W 0x0006 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 FCMD W 0x0007 R 0 0 0 0 0 0 0 0 RESERVED21 W 0x0008 R 0 0 0 FABHI FADDRHI1 W 0x0009 R FABLO FADDRLO1 W 0x000A R FDHI FDATAHI1 W 0x000B R FDLO FDATALO1 W 0x000C R 0 0 0 0 0 0 0 0 RESERVED31 W 0x000D R 0 0 0 0 0 0 0 0 RESERVED41 W 0x000E R 0 0 0 0 0 0 0 0 RESERVED51 W 0x000F R 0 0 0 0 0 0 0 0 RESERVED61 W = Unimplemented or Reserved Figure17-3. Flash Register Summary 1. Intended for factory test purposes only. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 475 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Module Base + 0x0000 7 6 5 4 3 2 1 0 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-4. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table17-3. FCLKDIV Field Descriptions Field Description 7 Clock Divider Loaded FDIVLD 0 FCLKDIV register has not been written 1 FCLKDIV register has been written to since the last reset 6 Enable Prescalar by 8 PRDIV8 0 The oscillator clock is directly fed into the Flash clock divider 1 The oscillator clock is divided by 8 before feeding into the Flash clock divider 5–0 Clock Divider Bits— The combination of PRDIV8 and FDIV[5:0] must divide the oscillator clock down to a FDIV[5:0] frequency of 150 kHz – 200 kHz. The maximum divide ratio is 512. Refer toSection17.4.1.1, “Writing the FCLKDIV Register”for more information. 17.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Module Base + 0x0001 7 6 5 4 3 2 1 0 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 W Reset F F F F F F F F = Unimplemented or Reserved Figure17-5. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. The FSEC register is loaded from the Flash configuration field at 0xFF0F during the reset sequence, indicated by F inFigure17-5. 476 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Table17-4. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of the backdoor key access KEYEN[1:0] to the Flash module as shown inTable17-5. 5–2 Nonvolatile Flag Bits — The NV[5:2] bits are available to the user as nonvolatile flags. NV[5:2] 1–0 Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown inTable17-6. If the SEC[1:0] Flash module is unsecured using backdoor key access, the SEC[1:0] bits are forced to 1:0. Table17-5. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01(1) DISABLED 10 ENABLED 11 DISABLED 1. Preferred KEYEN state to disable Backdoor Key Access. Table17-6. Flash Security States SEC[1:0] Status of Security 00 Secured 01(1) Secured 10 Unsecured 11 Secured 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section17.4.3, “Flash Module Security”. 17.3.2.3 RESERVED1 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0002 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-6. RESERVED1 All bits read 0 and are not writable. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 477 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.3.2.4 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash interrupts and gates the security backdoor key writes. Module Base + 0x0003 7 6 5 4 3 2 1 0 R 0 0 0 0 0 CBEIE CCIE KEYACC W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-7. Flash Configuration Register (FCNFG) CBEIE,CCIE,andKEYACCarereadableandwritablewhileremainingbitsread0andarenotwritable. KEYACC is only writable if the KEYEN bit in the FSEC register is set to the enabled state (see Section 17.3.2.2). Table17-7. FCNFG Field Descriptions Field Description 7 Command Buffer Empty Interrupt Enable — The CBEIE bit enables the interrupts in case of an empty CBEIE command buffer in the Flash module. 0 Command Buffer Empty interrupts disabled 1 An interrupt will be requested whenever the CBEIF flag is set (seeSection 17.3.2.6) 6 Command Complete Interrupt Enable — The CCIE bit enables the interrupts in case of all commands being CCIE completed in the Flash module. 0 Command Complete interrupts disabled 1 An interrupt will be requested whenever the CCIF flag is set (seeSection 17.3.2.6) 5 Enable Security Key Writing. KEYACC 0 Flash writes are interpreted as the start of a command write sequence 1 Writes to the Flash array are interpreted as a backdoor key while reads of the Flash array return invalid data 17.3.2.5 Flash Protection Register (FPROT) The FPROT register defines which Flash sectors are protected against program or erase. Module Base + 0x0004 7 6 5 4 3 2 1 0 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 NV2 NV1 NV0 W Reset F F F F F F F F Figure17-8. Flash Protection Register (FPROT) TheFPROTregisterisreadableinnormalandspecialmodes.FPOPENcanonlybewrittenfroma1toa 0. FPHS[1:0] can be written anytime until FPHDIS is cleared. The FPROT register is loaded from Flash address 0xFF0D during the reset sequence, indicated by F in Figure17-8. 478 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) To change the Flash protection that will be loaded on reset, the upper sector of the Flash array must be unprotected, then the Flash protection byte located at Flash address 0xFF0D must be written to. A protected Flash sector is disabled by FPHDIS while the size of the protected sector is defined by FPHS[1:0] in the FPROT register. TryingtoalteranyoftheprotectedareaswillresultinaprotectviolationerrorandthePVIOLflagwillbe set in the FSTAT register (see Section 17.3.2.6). A mass erase of the whole Flash array is only possible when protection is fully disabled by setting the FPOPEN and FPHDIS bits. An attempt to mass erase a Flash array while protection is enabled will set the PVIOL flag in the FSTAT register. Table17-8. FPROT Field Descriptions Field Description 7 ProtectionFunctionforProgramorErase—TheFPOPENbitisusedtoeitherselectanaddressrangetobe FPOPEN protectedusingtheFPHDISandFPHS[1:0]bitsortoselectthesameaddressrangetobeunprotectedasshown inTable17-9. 0 The FPHDIS bit allows a Flash address range to be unprotected 1 The FPHDIS bit allows a Flash address range to be protected 6 Nonvolatile Flag Bit— The NV6 bit should remain in the erased state for future enhancements. NV6 5 Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a FPHDIS protected/unprotected area in the higher space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 4–3 FlashProtectionHigherAddressSize—TheFPHS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPHS[1:0] sector as shown inTable17-10. The FPHS[1:0] bits can only be written to while the FPHDIS bit is set. 2–0 Nonvolatile Flag Bits— The NV[2:0] bits should remain in the erased state for future enhancements. NV[2:0] Table17-9. Flash Protection Function FPOPEN FPHDIS FPHS1 FPHS0 Function(1) 1 1 x x No protection 1 0 x x Protect high range 0 1 x x Full Flash array protected 0 0 x x Unprotected high range 1. For range sizes refer toTable17-10. Table17-10. Flash Protection Higher Address Range FPHS[1:0] Address Range Range Size 00 0xF800–0xFFFF 2 Kbytes 01 0xF000–0xFFFF 4 Kbytes 10 0xE000–0xFFFF 8 Kbytes 11 0xC000–0xFFFF 16 Kbytes Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 479 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Figure17-9illustratesallpossibleprotectionscenarios.Althoughtheprotectionschemeisloadedfromthe Flash array after reset, it is allowed to change in normal modes. This protection scheme can be used by applicationsrequiringre-programminginsinglechipmodewhileprovidingasmuchprotectionaspossible if no re-programming is required. FPHDIS = 1 FPHDIS = 0 Scenario 3 2 1 = N E P O P 0] F 1: S[ H P 0xFFFF F Scenario 1 0 0 = N E P O P 0] F 1: S[ H 0xFFFF P F Protected Flash Figure17-9. Flash Protection Scenarios 17.3.2.5.1 Flash Protection Restrictions The general guideline is that protection can only be added, not removed. All valid transitions between Flash protection scenarios are specified inTable17-11. Any attempt to write an invalid scenario to the FPROT register will be ignored and the FPROT register will remain unchanged. The contents of the FPROT register reflect the active protection scenario. Table17-11. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 0 X X 1 X 2 X X 480 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Table17-11. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 3 X X X X 1. Allowed transitions marked with X. 17.3.2.6 Flash Status Register (FSTAT) The FSTAT register defines the status of the Flash command controller and the results of command execution. Module Base + 0x0005 7 6 5 4 3 2 1 0 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL W Reset 1 1 0 0 0 0 0 1 = Unimplemented or Reserved Figure17-10.Flash Status Register (FSTAT) In normal modes, bits CBEIF, PVIOL, and ACCERR are readable and writable, bits CCIF and BLANK arereadableandnotwritable,remainingbits,includingFAILandDONE,read0andarenotwritable.In specialmodes,FAILisreadableandwritablewhileDONEisreadablebutnotwritable.FAILmustbeclear in special modes when starting a command write sequence. Table17-12. FSTAT Field Descriptions Field Description 7 Command Buffer Empty Interrupt Flag — The CBEIF flag indicates that the address, data and command CBEIF buffersareemptysothatanewcommandwritesequencecanbestarted.TheCBEIFflagisclearedbywriting a1toCBEIF.Writinga0totheCBEIFflaghasnoeffectonCBEIF.Writinga0toCBEIFafterwritinganaligned word to the Flash address space but before CBEIF is cleared will abort a command write sequence and cause the ACCERR flag in the FSTAT register to be set. Writing a 0 to CBEIF outside of a command write sequence will not set the ACCERR flag. The CBEIF flag is used together with the CBEIE bit in the FCNFG register to generate an interrupt request (seeFigure17-26). 0 Buffers are full 1 Buffers are ready to accept a new command 6 CommandCompleteInterruptFlag—TheCCIFflagindicatesthattherearenomorecommandspending.The CCIF CCIF flag is cleared when CBEIF is clear and sets automatically upon completion of all active and pending commands. The CCIF flag does not set when an active commands completes and a pending command is fetchedfromthecommandbuffer.WritingtotheCCIFflaghasnoeffect.TheCCIFflagisusedtogetherwiththe CCIE bit in the FCNFG register to generate an interrupt request (seeFigure17-26). 0 Command in progress 1 All commands are completed Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 481 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Table17-12. FSTAT Field Descriptions Field Description 5 Protection Violation — The PVIOL flag indicates an attempt was made to program or erase an address in a PVIOL protectedFlasharraymemoryarea.ThePVIOLflagisclearedbywritinga1toPVIOL.Writinga0tothePVIOL flag has no effect on PVIOL. While PVIOL is set, it is not possible to launch another command. 0 No protection violation detected 1 Protection violation has occurred 4 AccessError—TheACCERRflagindicatesanillegalaccesstotheFlasharraycausedbyeitheraviolationof ACCERR thecommandwritesequence,issuinganillegalcommand(illegalcombinationoftheCMDBxbitsintheFCMD register)ortheexecutionofaCPUSTOPinstructionwhileacommandisexecuting(CCIF=0).TheACCERRflag isclearedbywritinga1toACCERR.Writinga0totheACCERRflaghasnoeffectonACCERR.WhileACCERR is set, it is not possible to launch another command. 0 No access error detected 1 Access error has occurred 2 Flash Array Has Been Verified as Erased — The BLANK flag indicates that an erase verify command has BLANK checked the Flash array and found it to be erased. The BLANK flag is cleared by hardware when CBEIF is cleared as part of a new valid command write sequence. Writing to the BLANK flag has no effect on BLANK. 0 If an erase verify command has been requested, and the CCIF flag is set, then a 0 in BLANK indicates the array is not erased 1 Flash array verifies as erased 1 FlagIndicatingaFailedFlashOperation—Inspecialmodes,theFAILflagwillsetiftheeraseverifyoperation FAIL fails(Flasharrayverifiedasnoterased).Writinga0totheFAILflaghasnoeffectonFAIL.TheFAILflagiscleared by writing a 1 to FAIL. While FAIL is set, it is not possible to launch another command. 0 Flash operation completed without error 1 Flash operation failed 0 Flag Indicating a Failed Operation is not Active— In special modes, the DONE flag will clear if a program, DONE erase, or erase verify operation is active. 0 Flash operation is active 1 Flash operation is not active 17.3.2.7 Flash Command Register (FCMD) The FCMD register defines the Flash commands. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-11. Flash Command Register (FCMD) Bits CMDB6, CMDB5, CMDB2, and CMDB0 are readable and writable during a command write sequence while bits 7, 4, 3, and 1 read 0 and are not writable. 482 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Table17-13. FCMD Field Descriptions Field Description 6, 5, 2, 0 ValidFlashcommandsareshowninTable17-14.Anattempttoexecuteanycommandotherthanthoselistedin CMDB[6:5] Table17-14 will set the ACCERR bit in the FSTAT register (seeSection 17.3.2.6). CMDB[2] CMDB[0] Table17-14. Valid Flash Command List CMDB NVM Command 0x05 Erase verify 0x20 Word program 0x40 Sector erase 0x41 Mass erase 17.3.2.8 RESERVED2 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-12. RESERVED2 All bits read 0 and are not writable. 17.3.2.9 Flash Address Register (FADDR) FADDRHI and FADDRLO are the Flash address registers. \ Module Base + 0x0008 7 6 5 4 3 2 1 0 R 0 0 0 FABHI W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-13. Flash Address High Register (FADDRHI) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 483 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Module Base + 0x0009 7 6 5 4 3 2 1 0 R FABLO W Reset 0 0 0 0 0 0 0 0 Figure17-14. Flash Address Low Register (FADDRLO) In normal modes, all FABHI and FABLO bits read 0 and are not writable. In special modes, the FABHI andFABLObitsarereadableandwritable.Forsectorerase,theMCUaddressbits[8:0]areignored.For mass erase, any address within the Flash array is valid to start the command. 17.3.2.10 Flash Data Register (FDATA) FDATAHI and FDATALO are the Flash data registers. Module Base + 0x000A 7 6 5 4 3 2 1 0 R FDHI W Reset 0 0 0 0 0 0 0 0 Figure17-15. Flash Data High Register (FDATAHI) Module Base + 0x000B 7 6 5 4 3 2 1 0 R FDLO W Reset 0 0 0 0 0 0 0 0 Figure17-16. Flash Data Low Register (FDATALO) In normal modes, all FDATAHI and FDATALO bits read 0 and are not writable. In special modes, all FDATAHI and FDATALO bits are readable and writable when writing to an address within the Flash address range. 17.3.2.11 RESERVED3 This register is reserved for factory testing and is not accessible to the user. 484 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Module Base + 0x000C 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-17. RESERVED3 All bits read 0 and are not writable. 17.3.2.12 RESERVED4 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-18. RESERVED4 All bits read 0 and are not writable. 17.3.2.13 RESERVED5 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000E 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-19. RESERVED5 All bits read 0 and are not writable. 17.3.2.14 RESERVED6 This register is reserved for factory testing and is not accessible to the user. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 485 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) Module Base + 0x000F 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure17-20. RESERVED6 All bits read 0 and are not writable. 17.4 Functional Description 17.4.1 Flash Command Operations Writeoperationsareusedfortheprogram,erase,anderaseverifyalgorithmsdescribedinthissection.The programanderasealgorithmsarecontrolledbyastatemachinewhosetimebaseFCLKisderivedfromthe oscillator clock via a programmable divider. The FCMD register as well as the associated FADDR and FDATAregistersoperateasabufferandaregister(2-stageFIFO)sothatanewcommandalongwiththe necessarydataandaddresscanbestoredtothebufferwhilethepreviouscommandisstillinprogress.This pipelinedoperationallowsatimeoptimizationwhenprogrammingmorethanonewordonaspecificrow, asthehighvoltagegenerationcanbekeptactiveinbetweentwoprogrammingcommands.Thepipelined operation also allows a simplification of command launching. Buffer empty as well as command completion are signalled by flags in the FSTAT register with corresponding interrupts generated, if enabled. The next sections describe: • How to write the FCLKDIV register • Command write sequence used to program, erase or erase verify the Flash array • Valid Flash commands • Errors resulting from illegal Flash operations 17.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash command after a reset, it is first necessary to write the FCLKDIV register to divide the oscillator clock down to within the 150-kHz to 200-kHz range. Since the program and erase timingsarealsoafunctionofthebusclock,theFCLKDIVdeterminationmusttakethisinformationinto account. If we define: • FCLK as the clock of the Flash timing control block • Tbus as the period of the bus clock • INT(x) as taking the integer part of x (e.g., INT(4.323) = 4), 486 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) then FCLKDIV register bits PRDIV8 and FDIV[5:0] are to be set as described in Figure 17-21. For example, if the oscillator clock frequency is 950 kHz and the bus clock is 10 MHz, FCLKDIV bits FDIV[5:0]shouldbesetto4(000100)andbitPRDIV8setto0.TheresultingFCLKisthen190kHz.As a result, the Flash algorithm timings are increased over optimum target by: (200–190)⁄200×100 = 5% Command execution time will increase proportionally with the period of FCLK. CAUTION Because of the impact of clock synchronization on the accuracy of the functional timings, programming or erasing the Flash array cannot be performedifthebusclockrunsatlessthan1MHz.Programmingorerasing the Flash array with an input clock < 150 kHz should be avoided. Setting FCLKDIVtoavaluesuchthatFCLK<150kHzcandestroytheFlasharray duetooverstress.SettingFCLKDIVtoavaluesuchthat(1/FCLK+Tbus) < 5µs can result in incomplete programming or erasure of the Flash array cells. If the FCLKDIV register is written, the bit FDIVLD is set automatically. If the FDIVLD bit is 0, the FCLKDIVregisterhasnotbeenwrittensincethelastreset.IftheFCLKDIVregisterhasnotbeenwritten to, the Flash command loaded during a command write sequence will not execute and the ACCERR flag in the FSTAT register will set. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 487 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) START no Tbus < 1µs? ALL COMMANDS IMPOSSIBLE yes PRDIV8=0 (reset) oscillator_clock no 12.8MHz? yes PRDIV8=1 PRDCLK=oscillator_clock PRDCLK=oscillator_clock/8 no PRDCLK[MHz]*(5+Tbus[µs]) an integer? FDIV[5:0]=INT(PRDCLK[MHz]*(5+Tbus[µs])) yes FDIV[5:0]=PRDCLK[MHz]*(5+Tbus[µs])-1 TRY TO DECREASE Tbus FCLK=(PRDCLK)/(1+FDIV[5:0]) yes 1/FCLK[MHz] + Tbus[µs] > 5 END AND FCLK > 0.15MHz ? no yes FDIV[5:0] > 4? no ALL COMMANDS IMPOSSIBLE Figure17-21. PRDIV8 and FDIV Bits Determination Procedure 488 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.1.2 Command Write Sequence The Flash command controller is used to supervise the command write sequence to execute program, erase, and erase verify algorithms. Beforestartingacommandwritesequence,theACCERRandPVIOLflagsintheFSTATregistermustbe clearandtheCBEIFflagshouldbetestedtodeterminethestateoftheaddress,data,andcommandbuffers. If the CBEIF flag is set, indicating the buffers are empty, a new command write sequence can be started. If the CBEIF flag is clear, indicating the buffers are not available, a new command write sequence will overwrite the contents of the address, data, and command buffers. A command write sequence consists of three steps which must be strictly adhered to with writes to the Flashmodulenotpermittedbetweenthesteps.However,Flashregisterandarrayreadsareallowedduring a command write sequence. The basic command write sequence is as follows: 1. Write to a valid address in the Flash array memory. 2. Write a valid command to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the command. The address written in step 1 will be stored in the FADDR registers and the data will be stored in the FDATAregisters.WhentheCBEIFflagisclearedinstep3,theCCIFflagisclearedbytheFlashcommand controllerindicatingthatthecommandwassuccessfullylaunched.Forallcommandwritesequences,the CBEIF flag will set after the CCIF flag is cleared indicating that the address, data, and command buffers are ready for a new command write sequence to begin. A buffered command will wait for the active operation to be completed before being launched. Once a command is launched, the completion of the commandoperationisindicatedbythesettingoftheCCIFflagintheFSTATregister.TheCCIFflagwill set upon completion of all active and buffered commands. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 489 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.1.3 Valid Flash Commands Table17-15 summarizes the valid Flash commands along with the effects of the commands on the Flash array. Table17-15. Valid Flash Commands FCMD Meaning Function on Flash Array 0x05 Erase Verify all bytes in the Flash array are erased. Verify IftheFlasharrayiserased,theBLANKbitwillsetintheFSTATregisteruponcommandcompletion. 0x20 Program Program a word (2 bytes) in the Flash array. 0x40 Sector Erase all512 bytes in a sector of the Flash array. Erase 0x41 Mass Erase all bytes in the Flash array. Erase AmasseraseofthefullFlasharrayisonlypossiblewhenFPHDISandFPOPENbitsintheFPROT register are set prior to launching the command. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 490 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.1.3.1 Erase Verify Command The erase verify operation will verify that a Flash array is erased. AnexampleflowtoexecutetheeraseverifyoperationisshowninFigure17-22.Theeraseverifycommand write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheeraseverifycommand. The address and data written will be ignored. 2. Write the erase verify command, 0x05, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the erase verify command. Afterlaunchingtheeraseverifycommand,theCCIFflagintheFSTATregisterwillsetaftertheoperation has completed unless a new command write sequence has been buffered. Upon completion of the erase verify operation, the BLANK flag in the FSTAT register will be set if all addresses in the Flash array are verifiedtobeerased.IfanyaddressintheFlasharrayisnoterased,theeraseverifyoperationwillterminate and the BLANK flag in the FSTAT register will remain clear. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 491 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Array Address 1. and Dummy Data Write: FCMD register 2. Erase Verify Command 0x05 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes Erase Verify BLANK no Status Set? yes Flash Array Flash Array EXIT EXIT Erased Not Erased Figure17-22. Example Erase Verify Command Flow 492 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.1.3.2 Program Command The program operation will program a previously erased word in the Flash array using an embedded algorithm. AnexampleflowtoexecutetheprogramoperationisshowninFigure17-23.Theprogramcommandwrite sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheprogramcommand.The data written will be programmed to the Flash array address written. 2. Write the program command, 0x20, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the program command. IfawordtobeprogrammedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister willsetandtheprogramcommandwillnotlaunch.Oncetheprogramcommandhassuccessfullylaunched, the CCIF flag in the FSTAT register will set after the program operation has completed unless a new command write sequence has been buffered. By executing a new program command write sequence on sequentialwordsaftertheCBEIFflagintheFSTATregisterhasbeenset,upto55%fasterprogramming time per word can be effectively achieved than by waiting for the CCIF flag to set after each program operation. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 493 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Address 1. and program Data Write: FCMD register 2. Program Command 0x20 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CBEIF no Buffer Empty Set? Check yes Sequential Programming Next yes Decision Word? no Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure17-23. Example Program Command Flow 494 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.1.3.3 Sector Erase Command The sector erase operation will erase all addresses in a 512 byte sector of the Flash array using an embedded algorithm. An example flow to execute the sector erase operation is shown in Figure 17-24. The sector erase command write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequenceforthesectorerasecommand. TheFlashaddresswrittendeterminesthesectortobeerasedwhileMCUaddressbits[8:0]andthe data written are ignored. 2. Write the sector erase command, 0x40, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the sector erase command. IfaFlashsectortobeerasedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister will set and the sector erase command will not launch. Once the sector erase command has successfully launched,theCCIFflagintheFSTATregisterwillsetafterthesectoreraseoperationhascompletedunless a new command write sequence has been buffered. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 495 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Sector Address 1. and Dummy Data Write: FCMD register 2. Sector Erase Command 0x40 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure17-24. Example Sector Erase Command Flow 496 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.1.3.4 Mass Erase Command The mass erase operation will erase all addresses in a Flash array using an embedded algorithm. AnexampleflowtoexecutethemasseraseoperationisshowninFigure 17-25.Themasserasecommand write sequence is as follows: 1. Write to a Flash array address to start the command write sequence for the mass erase command. The address and data written will be ignored. 2. Write the mass erase command, 0x41, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the mass erase command. IfaFlasharraytobeerasedcontainsanyprotectedarea,thePVIOLflagintheFSTATregisterwillsetand the mass erase command will not launch. Once the mass erase command has successfully launched, the CCIF flag in the FSTAT register will set after the mass erase operation has completed unless a new command write sequence has been buffered. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 497 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Block Address 1. and Dummy Data Write: FCMD register 2. Mass Erase Command 0x41 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure17-25. Example Mass Erase Command Flow 498 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.1.4 Illegal Flash Operations 17.4.1.4.1 Access Error The ACCERR flag in the FSTAT register will be set during the command write sequence if any of the following illegal Flash operations are performed causing the command write sequence to immediately abort: 1. Writing to the Flash address space before initializing the FCLKDIV register 2. Writing a misaligned word or a byte to the valid Flash address space 3. Writing to the Flash address space while CBEIF is not set 4. Writing a second word to the Flash address space before executing a program or erase command on the previously written word 5. Writing to any Flash register other than FCMD after writing a word to the Flash address space 6. Writing a second command to the FCMD register before executing the previously written command 7. Writing an invalid command to the FCMD register 8. WritingtoanyFlashregisterotherthanFSTAT(toclearCBEIF)afterwritingtotheFCMDregister 9. Thepartentersstopmodeandaprogramorerasecommandisinprogress.Thecommandisaborted and any pending command is killed 10.Whensecurityisenabled,acommandotherthanmasseraseoriginatingfromanon-securememory or from the background debug mode is written to the FCMD register 11.A 0 is written to the CBEIF bit in the FSTAT register to abort a command write sequence. TheACCERRflagwillnotbesetifanyFlashregisterisreadduringthecommandwritesequence.Ifthe Flash array is read during execution of an algorithm (CCIF=0), the Flash module will return invalid data andtheACCERRflagwillnotbeset.IfanACCERRflagissetintheFSTATregister,theFlashcommand controller is locked. It is not possible to launch another command until the ACCERR flag is cleared. 17.4.1.4.2 Protection Violation ThePVIOLflagintheFSTATregisterwillbesetduringthecommandwritesequenceafterthewordwrite to the Flash address space if any of the following illegal Flash operations are performed, causing the command write sequence to immediately abort: 1. Writing a Flash address to program in a protected area of the Flash array (seeSection 17.3.2.5). 2. Writing a Flash address to erase in a protected area of the Flash array. 3. Writing the mass erase command to the FCMD register while any protection is enabled. If the PVIOL flag is set, the Flash command controller is locked. It is not possible to launch another command until the PVIOL flag is cleared. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 499 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.2 Operating Modes 17.4.2.1 Wait Mode IftheMCUenterswaitmodewhileaFlashcommandisactive(CCIF=0),thatcommandandanybuffered command will be completed. TheFlashmodulecanrecovertheMCUfromwaitmodeiftheinterruptsareenabled(seeSection17.4.5). 17.4.2.2 Stop Mode IftheMCUentersstopmodewhileaFlashcommandisactive(CCIF=0),thatcommandwillbeaborted and the data being programmed or erased is lost. The high voltage circuitry to the Flash array will be switched off when entering stop mode. CCIF and ACCERR flags will be set. Upon exit from stop mode, the CBEIF flag will be set and any buffered command will not be executed. The ACCERR flag must be cleared before returning to normal operation. NOTE As active Flash commands are immediately aborted when the MCU enters stopmode,itisstronglyrecommendedthattheuserdoesnotusetheSTOP instruction during program and erase execution. 17.4.2.3 Background Debug Mode In background debug mode (BDM), the FPROT register is writable. If the MCU is unsecured, then all FlashcommandslistedinTable17-15canbeexecuted.IftheMCUissecuredandisinspecialsinglechip mode, the only possible command to execute is mass erase. 17.4.3 Flash Module Security The Flash module provides the necessary security information to the MCU. After each reset, the Flash moduledeterminesthesecuritystateoftheMCUasdefinedinSection17.3.2.2,“FlashSecurityRegister (FSEC)”. ThecontentsoftheFlashsecurity/optionsbyteataddress0xFF0FintheFlashconfigurationfieldmustbe changed directly by programming address 0xFF0F when the device is unsecured and the higher address sector is unprotected. If the Flash security/options byte is left in the secure state, any reset will cause the MCU to return to the secure operating mode. 17.4.3.1 Unsecuring the MCU using Backdoor Key Access TheMCUmayonlybeunsecuredbyusingthebackdoorkeyaccessfeaturewhichrequiresknowledgeof the contents of the backdoor key (four 16-bit words programmed at addresses 0xFF00–0xFF07). If KEYEN[1:0]= 1:0andtheKEYACCbitisset,awritetoabackdoorkeyaddressintheFlasharraytriggers acomparisonbetweenthewrittendataandthebackdoorkeydatastoredintheFlasharray.Ifallfourwords of data are written to the correct addresses in the correct order and the data matches the backdoor key stored in the Flash array, the MCU will be unsecured. The data must be written to the backdoor key 500 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) addressessequentiallystaringwith0xFF00-0xFF01andendingwith0xFF06–0xFF07.Thevalues0x0000 and 0xFFFF are not permitted as keys. When the KEYACC bit is set, reads of the Flash array will return invalid data. TheusercodestoredintheFlasharraymusthaveamethodofreceivingthebackdoorkeyfromanexternal stimulus. This external stimulus would typically be through one of the on-chip serial ports. If KEYEN[1:0] = 1:0 in the FSEC register, the MCU can be unsecured by the backdoor key access sequence described below: 1. Set the KEYACC bit in the FCNFG register 2. Writethecorrectfour16-bitwordstoFlashaddresses0xFF00–0xFF07sequentiallystartingwith 0xFF00 3. Clear the KEYACC bit in the FCNFG register 4. If all four 16-bit words match the backdoor key stored in Flash addresses 0xFF00–0xFF07, the MCU is unsecured and bits SEC[1:0] in the FSEC register are forced to the unsecure state of 1:0 Thebackdoorkeyaccesssequenceismonitoredbytheinternalsecuritystatemachine.Anillegaloperation duringthebackdoorkeyaccesssequencewill causethesecuritystatemachine tolock, leavingtheMCU in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and allowanewbackdoorkeyaccesssequencetobeattempted.Thefollowingillegaloperationswilllockthe security state machine: 1. If any of the four 16-bit words does not match the backdoor key programmed in the Flash array 2. If the four 16-bit words are written in the wrong sequence 3. If more than four 16-bit words are written 4. If any of the four 16-bit words written are 0x0000 or 0xFFFF 5. If the KEYACC bit does not remain set while the four 16-bit words are written After the backdoor key access sequence has been correctly matched, the MCU will be unsecured. The Flash security byte can be programmed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the four word backdoor key by programming bytes 0xFF00–0xFF07 of the Flash configuration field. The security as defined in the Flash security/options byte at address 0xFF0F is not changed by using the backdoor key access sequence to unsecure. The backdoor key stored in addresses 0xFF00–0xFF07 is unaffected by the backdoor key access sequence. After the next reset sequence, the security state of the FlashmoduleisdeterminedbytheFlashsecurity/optionsbyteataddress0xFF0F.Thebackdoorkeyaccess sequence has no effect on the program and erase protection defined in the FPROT register. ItisnotpossibletounsecuretheMCUinspecialsinglechipmodebyexecutingthebackdoorkeyaccess sequence in background debug mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 501 Rev 01.24

Chapter17 16 Kbyte Flash Module (S12FTS16KV1) 17.4.4 Flash Reset Sequence Oneachreset,theFlashmoduleexecutesaresetsequencetoholdCPUactivitywhileloadingthefollowing registers from the Flash array memory according to Table17-1: • FPROT — Flash Protection Register (see Section 17.3.2.5) • FSEC — Flash Security Register (see Section 17.3.2.2) 17.4.4.1 Reset While Flash Command Active IfaresetoccurswhileanyFlashcommandisinprogress,thatcommandwillbeimmediatelyaborted.The state of the word being programmed or the sector/array being erased is not guaranteed. 17.4.5 Interrupts The Flash module can generate an interrupt when all Flash commands have completed execution or the Flash address, data, and command buffers are empty. Table17-16. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Address, Data, and Command CBEIF CBEIE I Bit Buffers are empty (FSTAT register) All Flash commands have completed CCIF CCIE I Bit execution (FSTAT register) NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 17.4.5.1 Description of Interrupt Operation Figure17-26 shows the logic used for generating interrupts. TheFlashmoduleusestheCBEIFandCCIFflagsincombinationwiththeenablebitsCBIEandCCIEto discriminate for the generation of interrupts. CBEIF CBEIE FLASH INTERRUPT REQUEST CCIF CCIE Figure17-26. Flash Interrupt Implementation For a detailed description of these register bits, refer to Section17.3.2.4, “Flash Configuration Register (FCNFG)” andSection17.3.2.6, “Flash Status Register (FSTAT)”. 502 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 18 32 Kbyte Flash Module (S12FTS32KV1) 18.1 Introduction TheFTS32Kmoduleimplementsa32KbyteFlash(nonvolatile)memory.TheFlashmemorycontainsone arrayof32Kbytesorganizedas512rowsof64byteswithanerasesectorsizeofeightrows(512bytes). TheFlasharraymaybereadaseitherbytes,alignedwords,ormisalignedwords.Readaccesstimeisone bus cycle for byte and aligned word, and two bus cycles for misaligned words. The Flash array is ideal for program and data storage for single-supply applications allowing for field reprogramming without requiring external voltage sources for program or erase. Program and erase functionsarecontrolledbyacommanddriveninterface.TheFlashmodulesupportsbothmasseraseand sector erase. An erased bit reads 1 and a programmed bit reads 0. The high voltage required to program and erase is generated internally. It is not possible to read from a Flash array while it is being erased or programmed. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 18.1.1 Glossary CommandWriteSequence—Athree-stepMCUinstructionsequencetoprogram,erase,oreraseverify the Flash array memory. 18.1.2 Features • 32KbytesofFlashmemorycomprisedofone32Kbytearraydividedinto64sectorsof512bytes • Automated program and erase algorithm • Interrupts on Flash command completion and command buffer empty • Fast sector erase and word program operation • 2-stage command pipeline for faster multi-word program times • Flexible protection scheme to prevent accidental program or erase • Single power supply for Flash program and erase operations • Security feature to prevent unauthorized access to the Flash array memory Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 503 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.1.3 Modes of Operation See Section18.4.2, “Operating Modes” for a description of the Flash module operating modes. For program and erase operations, refer toSection18.4.1, “Flash Command Operations”. 18.1.4 Block Diagram Figure18-1 shows a block diagram of theFTS32K module. FTS32K Flash Interface Command Complete Command Pipeline Interrupt Flash Array cmd2 cmd1 addr2 addr1 16K * 16 Bits Command data2 data1 Buffer Empty sector 0 Interrupt sector 1 Registers Protection sector 63 Security Oscillator Clock Clock Divider FCLK Figure18-1. FTS32K Block Diagram 18.2 External Signal Description TheFTS32K module contains no signals that connect off-chip. 504 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.3 Memory Map and Registers This section describes the FTS32K memory map and registers. 18.3.1 Module Memory Map TheFTS32K memory map is shown in Figure18-2. The HCS12 architecture places the Flash array addresses between 0x4000 and 0xFFFF, which corresponds to three 16 Kbyte pages. The content of the HCS12 Core PPAGE register is used to map the logical middle page ranging from address 0x8000 to 0xBFFF to any physical 16K byte page in the Flash array memory.1 The FPROT register (seeSection 18.3.2.5) can be set to globally protect the entire Flash array. Three separate areas, one starting from the Flash array starting address (called lower) towards higher addresses, one growing downward from the Flasharrayendaddress(calledhigher),andtheremainingaddresses,canbeactivatedforprotection.The Flasharray addressescoveredbytheseprotectableregionsareshowninFigure18-2. Thehigheraddress areaismainlytargetedtoholdthebootloadercodesinceitcoversthevectorspace.Theloweraddressarea can be used for EEPROM emulation in an MCU without an EEPROM module since it can be left unprotected while the remaining addresses are protected from program or erase. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field described inTable18-1. Table18-1. Flash Configuration Field Size Flash Address Description (bytes) 0xFF00–0xFF07 8 Backdoor Key to unlock security 0xFF08–0xFF0C 5 Reserved 0xFF0D 1 Flash Protection byte Refer toSection18.3.2.5, “Flash Protection Register (FPROT)” 0xFF0E 1 Reserved 0xFF0F 1 Flash Security/Options byte Refer toSection18.3.2.2, “Flash Security Register (FSEC)” 1.Byplacing0x3E/0x3FintheHCS12CorePPAGEregister,thebottom/topfixed16KbytepagescanbeseentwiceintheMCU memory map. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 505 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) MODULE BASE + 0x0000 Flash Registers 16 bytes MODULE BASE + 0x000F FLASH_START = 0x4000 0x4200 0x4400 0x4800 Flash Protected Low Sectors 512 bytes, 1, 2, 4 Kbytes 0x5000 0x3E Flash Array 0x8000 16K PAGED MEMORY 003E 0x3F 0xC000 Flash Protected High Sectors 0xE000 0x3F 2, 4, 8, 16 Kbytes 0xF000 0xF800 FLASH_END = 0xFFFF 0xFF00–0xFF0F (Flash Configuration Field) Note: 0x3E–0x3F correspond to the PPAGE register content Figure18-2. Flash Memory Map 506 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Table18-2. Flash Array Memory Map Summary MCU Address Protectable Protectable Array Relative PPAGE Range Low Range High Range Address(1) 0x4000–0x7FFF Unpaged 0x4000–0x43FF N.A. 0x18000–0x1BFFF (0x3E) 0x4000–0x47FF 0x4000–0x4FFF 0x4000–0x5FFF 0x8000–0xBFFF 0x3E 0x8000–0x83FF N.A. 0x18000–0x1BFFF 0x8000–0x87FF 0x8000–0x8FFF 0x8000–0x9FFF 0x3F N.A. 0xB800–0xBFFF 0x1C000–0x1FFFF 0xB000–0xBFFF 0xA000–0xBFFF 0x8000–0xBFFF 0xC000–0xFFFF Unpaged N.A. 0xF800–0xFFFF 0x1C000–0x1FFFF (0x3F) 0xF000–0xFFFF 0xE000–0xFFFF 0xC000–0xFFFF 1. Inside Flash block. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 507 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.3.2 Register Descriptions TheFlashmodulecontainsasetof16controlandstatusregisterslocatedbetweenmodulebase+0x0000 and 0x000F. A summary of the Flash module registers is given in Figure18-3. Detailed descriptions of each register bit are provided. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 FCLKDIV W 0x0001 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 FSEC W 0x0002 R 0 0 0 0 0 0 0 0 RESERVED1 W (1) 0x0003 R 0 0 0 0 0 CBEIE CCIE KEYACC FCNFG W 0x0004 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 FPROT W 0x0005 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL FSTAT W 0x0006 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 FCMD W 0x0007 R 0 0 0 0 0 0 0 0 RESERVED21 W 0x0008 R 0 0 FABHI FADDRHI1 W 0x0009 R FABLO FADDRLO1 W 0x000A R FDHI FDATAHI1 W 0x000B R FDLO FDATALO1 W 0x000C R 0 0 0 0 0 0 0 0 RESERVED31 W 0x000D R 0 0 0 0 0 0 0 0 RESERVED41 W 0x000E R 0 0 0 0 0 0 0 0 RESERVED51 W 0x000F R 0 0 0 0 0 0 0 0 RESERVED61 W = Unimplemented or Reserved Figure18-3. Flash Register Summary 1. Intended for factory test purposes only. 508 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Module Base + 0x0000 7 6 5 4 3 2 1 0 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-4. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table18-3. FCLKDIV Field Descriptions Field Description 7 Clock Divider Loaded FDIVLD 0 FCLKDIV register has not been written 1 FCLKDIV register has been written to since the last reset 6 Enable Prescalar by 8 PRDIV8 0 The oscillator clock is directly fed into the Flash clock divider 1 The oscillator clock is divided by 8 before feeding into the Flash clock divider 5–0 Clock Divider Bits— The combination of PRDIV8 and FDIV[5:0] must divide the oscillator clock down to a FDIV[5:0] frequency of 150 kHz – 200 kHz. The maximum divide ratio is 512. Refer toSection18.4.1.1, “Writing the FCLKDIV Register”for more information. 18.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Module Base + 0x0001 7 6 5 4 3 2 1 0 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 W Reset F F F F F F F F = Unimplemented or Reserved Figure18-5. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. The FSEC register is loaded from the Flash configuration field at 0xFF0F during the reset sequence, indicated by F inFigure18-5. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 509 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Table18-4. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of the backdoor key access KEYEN[1:0] to the Flash module as shown inTable18-5. 5–2 Nonvolatile Flag Bits — The NV[5:2] bits are available to the user as nonvolatile flags. NV[5:2] 1–0 Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown inTable18-6. If the SEC[1:0] Flash module is unsecured using backdoor key access, the SEC[1:0] bits are forced to 1:0. Table18-5. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01(1) DISABLED 10 ENABLED 11 DISABLED 1. Preferred KEYEN state to disable Backdoor Key Access. Table18-6. Flash Security States SEC[1:0] Status of Security 00 Secured 01(1) Secured 10 Unsecured 11 Secured 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section18.4.3, “Flash Module Security”. 18.3.2.3 RESERVED1 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0002 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-6. RESERVED1 All bits read 0 and are not writable. 510 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.3.2.4 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash interrupts and gates the security backdoor key writes. Module Base + 0x0003 7 6 5 4 3 2 1 0 R 0 0 0 0 0 CBEIE CCIE KEYACC W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-7. Flash Configuration Register (FCNFG) CBEIE,CCIE,andKEYACCarereadableandwritablewhileremainingbitsread0andarenotwritable. KEYACC is only writable if the KEYEN bit in the FSEC register is set to the enabled state (see Section 18.3.2.2). Table18-7. FCNFG Field Descriptions Field Description 7 Command Buffer Empty Interrupt Enable — The CBEIE bit enables the interrupts in case of an empty CBEIE command buffer in the Flash module. 0 Command Buffer Empty interrupts disabled 1 An interrupt will be requested whenever the CBEIF flag is set (seeSection 18.3.2.6) 6 Command Complete Interrupt Enable — The CCIE bit enables the interrupts in case of all commands being CCIE completed in the Flash module. 0 Command Complete interrupts disabled 1 An interrupt will be requested whenever the CCIF flag is set (seeSection 18.3.2.6) 5 Enable Security Key Writing. KEYACC 0 Flash writes are interpreted as the start of a command write sequence 1 Writes to the Flash array are interpreted as a backdoor key while reads of the Flash array return invalid data 18.3.2.5 Flash Protection Register (FPROT) The FPROT register defines which Flash sectors are protected against program or erase. Module Base + 0x0004 7 6 5 4 3 2 1 0 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W Reset F F F F F F F F Figure18-8. Flash Protection Register (FPROT) TheFPROTregisterisreadableinnormalandspecialmodes.FPOPENcanonlybewrittenfroma1toa 0. FPLS[1:0] can be written anytime until FPLDIS is cleared. FPHS[1:0] can be written anytime until Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 511 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) FPHDISiscleared.TheFPROTregisterisloadedfromFlashaddress0xFF0Dduringtheresetsequence, indicated by F inFigure18-8. To change the Flash protection that will be loaded on reset, the upper sector of the Flash array must be unprotected, then the Flash protection byte located at Flash address 0xFF0D must be written to. A protected Flash sector is disabled by FPHDIS and FPLDIS while the size of the protected sector is defined by FPHS[1:0] and FPLS[1:0] in the FPROT register. TryingtoalteranyoftheprotectedareaswillresultinaprotectviolationerrorandthePVIOLflagwillbe set in the FSTAT register (see Section 18.3.2.6). A mass erase of the whole Flash array is only possible whenprotectionisfullydisabledbysettingtheFPOPEN,FPLDIS,andFPHDISbits.Anattempttomass erase a Flash array while protection is enabled will set the PVIOL flag in the FSTAT register. Table18-8. FPROT Field Descriptions Field Description 7 Protection Function for Program or Erase — It is possible using the FPOPEN bit to either select address FPOPEN ranges to be protected using FPHDIS, FPLDIS, FPHS[1:0] and FPLS[1:0] or to select the same ranges to be unprotected. When FPOPEN is set, FPxDIS enables the ranges to be protected, whereby clearing FPxDIS enables protection for the range specified by the corresponding FPxS[1:0] bits. When FPOPEN is cleared, FPxDIS defines unprotected ranges as specified by the corresponding FPxS[1:0] bits. In this case, setting FPxDIS enables protection. Thus the effective polarity of the FPxDIS bits is swapped by the FPOPEN bit as shown inTable18-9. This function allows the main part of the Flash array to be protected while a small range can remain unprotected for EEPROM emulation. 0 The FPHDIS and FPLDIS bits define Flash address ranges to be unprotected 1 The FPHDIS and FPLDIS bits define Flash address ranges to be protected 6 Nonvolatile Flag Bit— The NV6 bit should remain in the erased state for future enhancements. NV6 5 Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a FPHDIS protected/unprotected area in the higher space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 4–3 FlashProtectionHigherAddressSize—TheFPHS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPHS[1:0] sector as shown inTable18-10. The FPHS[1:0] bits can only be written to while the FPHDIS bit is set. 2 Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a FPLDIS protected/unprotected sector in the lower space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 1–0 FlashProtectionLowerAddressSize—TheFPLS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPLS[1:0] sector as shown inTable18-11. The FPLS[1:0] bits can only be written to while the FPLDIS bit is set. 512 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Table18-9. Flash Protection Function FPOPEN FPHDIS FPHS[1] FPHS[0] FPLDIS FPLS[1] FPLS[0] Function(1) 1 1 x x 1 x x No protection 1 1 x x 0 x x Protect low range 1 0 x x 1 x x Protect high range 1 0 x x 0 x x Protect high and low ranges 0 1 x x 1 x x Full Flash array protected 0 0 x x 1 x x Unprotected high range 0 1 x x 0 x x Unprotected low range 0 0 x x 0 x x Unprotected high and low ranges 1. For range sizes refer toTable18-10 and orTable18-11. Table18-10. Flash Protection Higher Address Range FPHS[1:0] Address Range Range Size 00 0xF800–0xFFFF 2 Kbytes 01 0xF000–0xFFFF 4 Kbytes 10 0xE000–0xFFFF 8 Kbytes 11 0xC000–0xFFFF 16 Kbytes Table18-11. Flash Protection Lower Address Range FPLS[1:0] Address Range Range Size 00 0x4000–0x41FF 512 bytes 01 0x4000–0x43FF 1 Kbyte 10 0x4000–0x47FF 2 Kbytes 11 0x4000–0x4FFF 4 Kbytes Figure18-9illustratesallpossibleprotectionscenarios.Althoughtheprotectionschemeisloadedfromthe Flash array after reset, it is allowed to change in normal modes. This protection scheme can be used by applicationsrequiringre-programminginsinglechipmodewhileprovidingasmuchprotectionaspossible if no re-programming is required. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 513 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) FPHDIS = 1 FPHDIS = 1 FPHDIS = 0 FPHDIS = 0 FPLDIS = 1 FPLDIS = 0 FPLDIS = 1 FPLDIS = 0 Scenario 7 6 5 4 0] 1: S[ L P F 1 = N E P O P 0] F 1: S[ H P 0xFFFF F Scenario 3 2 1 0 0] 1: S[ L P F 0 = N E P O P 0] F 1: S[ H P 0xFFFF F Protected Flash Figure18-9. Flash Protection Scenarios 18.3.2.5.1 Flash Protection Restrictions The general guideline is that protection can only be added, not removed. All valid transitions between Flash protection scenarios are specified inTable18-12. Any attempt to write an invalid scenario to the FPROT register will be ignored and the FPROT register will remain unchanged. The contents of the FPROT register reflect the active protection scenario. Table18-12. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 0 X X X X 1 X X 2 X X 3 X 4 X X 5 X X X X 514 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Table18-12. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 6 X X X X 7 X X X X X X X X 1. Allowed transitions marked with X. 18.3.2.6 Flash Status Register (FSTAT) The FSTAT register defines the status of the Flash command controller and the results of command execution. Module Base + 0x0005 7 6 5 4 3 2 1 0 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL W Reset 1 1 0 0 0 0 0 1 = Unimplemented or Reserved Figure18-10.Flash Status Register (FSTAT) In normal modes, bits CBEIF, PVIOL, and ACCERR are readable and writable, bits CCIF and BLANK arereadableandnotwritable,remainingbits,includingFAILandDONE,read0andarenotwritable.In specialmodes,FAILisreadableandwritablewhileDONEisreadablebutnotwritable.FAILmustbeclear in special modes when starting a command write sequence. Table18-13. FSTAT Field Descriptions Field Description 7 Command Buffer Empty Interrupt Flag — The CBEIF flag indicates that the address, data and command CBEIF buffersareemptysothatanewcommandwritesequencecanbestarted.TheCBEIFflagisclearedbywriting a1toCBEIF.Writinga0totheCBEIFflaghasnoeffectonCBEIF.Writinga0toCBEIFafterwritinganaligned word to the Flash address space but before CBEIF is cleared will abort a command write sequence and cause the ACCERR flag in the FSTAT register to be set. Writing a 0 to CBEIF outside of a command write sequence will not set the ACCERR flag. The CBEIF flag is used together with the CBEIE bit in the FCNFG register to generate an interrupt request (seeFigure18-26). 0 Buffers are full 1 Buffers are ready to accept a new command 6 CommandCompleteInterruptFlag—TheCCIFflagindicatesthattherearenomorecommandspending.The CCIF CCIF flag is cleared when CBEIF is clear and sets automatically upon completion of all active and pending commands. The CCIF flag does not set when an active commands completes and a pending command is fetchedfromthecommandbuffer.WritingtotheCCIFflaghasnoeffect.TheCCIFflagisusedtogetherwiththe CCIE bit in the FCNFG register to generate an interrupt request (seeFigure18-26). 0 Command in progress 1 All commands are completed Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 515 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Table18-13. FSTAT Field Descriptions Field Description 5 Protection Violation — The PVIOL flag indicates an attempt was made to program or erase an address in a PVIOL protectedFlasharraymemoryarea.ThePVIOLflagisclearedbywritinga1toPVIOL.Writinga0tothePVIOL flag has no effect on PVIOL. While PVIOL is set, it is not possible to launch another command. 0 No protection violation detected 1 Protection violation has occurred 4 AccessError—TheACCERRflagindicatesanillegalaccesstotheFlasharraycausedbyeitheraviolationof ACCERR thecommandwritesequence,issuinganillegalcommand(illegalcombinationoftheCMDBxbitsintheFCMD register)ortheexecutionofaCPUSTOPinstructionwhileacommandisexecuting(CCIF=0).TheACCERRflag isclearedbywritinga1toACCERR.Writinga0totheACCERRflaghasnoeffectonACCERR.WhileACCERR is set, it is not possible to launch another command. 0 No access error detected 1 Access error has occurred 2 Flash Array Has Been Verified as Erased — The BLANK flag indicates that an erase verify command has BLANK checked the Flash array and found it to be erased. The BLANK flag is cleared by hardware when CBEIF is cleared as part of a new valid command write sequence. Writing to the BLANK flag has no effect on BLANK. 0 If an erase verify command has been requested, and the CCIF flag is set, then a 0 in BLANK indicates the array is not erased 1 Flash array verifies as erased 1 FlagIndicatingaFailedFlashOperation—Inspecialmodes,theFAILflagwillsetiftheeraseverifyoperation FAIL fails(Flasharrayverifiedasnoterased).Writinga0totheFAILflaghasnoeffectonFAIL.TheFAILflagiscleared by writing a 1 to FAIL. While FAIL is set, it is not possible to launch another command. 0 Flash operation completed without error 1 Flash operation failed 0 Flag Indicating a Failed Operation is not Active— In special modes, the DONE flag will clear if a program, DONE erase, or erase verify operation is active. 0 Flash operation is active 1 Flash operation is not active 18.3.2.7 Flash Command Register (FCMD) The FCMD register defines the Flash commands. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-11. Flash Command Register (FCMD) Bits CMDB6, CMDB5, CMDB2, and CMDB0 are readable and writable during a command write sequence while bits 7, 4, 3, and 1 read 0 and are not writable. 516 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Table18-14. FCMD Field Descriptions Field Description 6, 5, 2, 0 ValidFlashcommandsareshowninTable18-15.Anattempttoexecuteanycommandotherthanthoselistedin CMDB[6:5] Table18-15 will set the ACCERR bit in the FSTAT register (seeSection 18.3.2.6). CMDB[2] CMDB[0] Table18-15. Valid Flash Command List CMDB NVM Command 0x05 Erase verify 0x20 Word program 0x40 Sector erase 0x41 Mass erase 18.3.2.8 RESERVED2 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-12. RESERVED2 All bits read 0 and are not writable. 18.3.2.9 Flash Address Register (FADDR) FADDRHI and FADDRLO are the Flash address registers. \ Module Base + 0x0008 7 6 5 4 3 2 1 0 R 0 0 FABHI W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-13. Flash Address High Register (FADDRHI) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 517 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Module Base + 0x0009 7 6 5 4 3 2 1 0 R FABLO W Reset 0 0 0 0 0 0 0 0 Figure18-14. Flash Address Low Register (FADDRLO) In normal modes, all FABHI and FABLO bits read 0 and are not writable. In special modes, the FABHI andFABLObitsarereadableandwritable.Forsectorerase,theMCUaddressbits[8:0]areignored.For mass erase, any address within the Flash array is valid to start the command. 18.3.2.10 Flash Data Register (FDATA) FDATAHI and FDATALO are the Flash data registers. Module Base + 0x000A 7 6 5 4 3 2 1 0 R FDHI W Reset 0 0 0 0 0 0 0 0 Figure18-15. Flash Data High Register (FDATAHI) Module Base + 0x000B 7 6 5 4 3 2 1 0 R FDLO W Reset 0 0 0 0 0 0 0 0 Figure18-16. Flash Data Low Register (FDATALO) In normal modes, all FDATAHI and FDATALO bits read 0 and are not writable. In special modes, all FDATAHI and FDATALO bits are readable and writable when writing to an address within the Flash address range. 18.3.2.11 RESERVED3 This register is reserved for factory testing and is not accessible to the user. 518 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Module Base + 0x000C 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-17. RESERVED3 All bits read 0 and are not writable. 18.3.2.12 RESERVED4 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-18. RESERVED4 All bits read 0 and are not writable. 18.3.2.13 RESERVED5 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000E 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-19. RESERVED5 All bits read 0 and are not writable. 18.3.2.14 RESERVED6 This register is reserved for factory testing and is not accessible to the user. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 519 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) Module Base + 0x000F 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure18-20. RESERVED6 All bits read 0 and are not writable. 18.4 Functional Description 18.4.1 Flash Command Operations Writeoperationsareusedfortheprogram,erase,anderaseverifyalgorithmsdescribedinthissection.The programanderasealgorithmsarecontrolledbyastatemachinewhosetimebaseFCLKisderivedfromthe oscillator clock via a programmable divider. The FCMD register as well as the associated FADDR and FDATAregistersoperateasabufferandaregister(2-stageFIFO)sothatanewcommandalongwiththe necessarydataandaddresscanbestoredtothebufferwhilethepreviouscommandisstillinprogress.This pipelinedoperationallowsatimeoptimizationwhenprogrammingmorethanonewordonaspecificrow, asthehighvoltagegenerationcanbekeptactiveinbetweentwoprogrammingcommands.Thepipelined operation also allows a simplification of command launching. Buffer empty as well as command completion are signalled by flags in the FSTAT register with corresponding interrupts generated, if enabled. The next sections describe: • How to write the FCLKDIV register • Command write sequence used to program, erase or erase verify the Flash array • Valid Flash commands • Errors resulting from illegal Flash operations 18.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash command after a reset, it is first necessary to write the FCLKDIV register to divide the oscillator clock down to within the 150-kHz to 200-kHz range. Since the program and erase timingsarealsoafunctionofthebusclock,theFCLKDIVdeterminationmusttakethisinformationinto account. If we define: • FCLK as the clock of the Flash timing control block • Tbus as the period of the bus clock • INT(x) as taking the integer part of x (e.g., INT(4.323) = 4), 520 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) then FCLKDIV register bits PRDIV8 and FDIV[5:0] are to be set as described in Figure 18-21. For example, if the oscillator clock frequency is 950 kHz and the bus clock is 10 MHz, FCLKDIV bits FDIV[5:0]shouldbesetto4(000100)andbitPRDIV8setto0.TheresultingFCLKisthen190kHz.As a result, the Flash algorithm timings are increased over optimum target by: (200–190)⁄200×100 = 5% Command execution time will increase proportionally with the period of FCLK. CAUTION Because of the impact of clock synchronization on the accuracy of the functional timings, programming or erasing the Flash array cannot be performedifthebusclockrunsatlessthan1MHz.Programmingorerasing the Flash array with an input clock < 150 kHz should be avoided. Setting FCLKDIVtoavaluesuchthatFCLK<150kHzcandestroytheFlasharray duetooverstress.SettingFCLKDIVtoavaluesuchthat(1/FCLK+Tbus) < 5µs can result in incomplete programming or erasure of the Flash array cells. If the FCLKDIV register is written, the bit FDIVLD is set automatically. If the FDIVLD bit is 0, the FCLKDIVregisterhasnotbeenwrittensincethelastreset.IftheFCLKDIVregisterhasnotbeenwritten to, the Flash command loaded during a command write sequence will not execute and the ACCERR flag in the FSTAT register will set. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 521 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) START no Tbus < 1ms? ALL COMMANDS IMPOSSIBLE yes PRDIV8=0 (reset) oscillator_clock no 12.8MHz? yes PRDIV8=1 PRDCLK=oscillator_clock PRDCLK=oscillator_clock/8 no PRDCLK[MHz]*(5+Tbus[ms]) an integer? FDIV[5:0]=INT(PRDCLK[MHz]*(5+Tbus[ms])) yes FDIV[5:0]=PRDCLK[MHz]*(5+Tbus[ms])-1 TRY TO DECREASE Tbus FCLK=(PRDCLK)/(1+FDIV[5:0]) yes 1/FCLK[MHz] + Tbus[ms] > 5 END AND FCLK > 0.15MHz ? no yes FDIV[5:0] > 4? no ALL COMMANDS IMPOSSIBLE Figure18-21. PRDIV8 and FDIV Bits Determination Procedure 522 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.1.2 Command Write Sequence The Flash command controller is used to supervise the command write sequence to execute program, erase, and erase verify algorithms. Beforestartingacommandwritesequence,theACCERRandPVIOLflagsintheFSTATregistermustbe clearandtheCBEIFflagshouldbetestedtodeterminethestateoftheaddress,data,andcommandbuffers. If the CBEIF flag is set, indicating the buffers are empty, a new command write sequence can be started. If the CBEIF flag is clear, indicating the buffers are not available, a new command write sequence will overwrite the contents of the address, data, and command buffers. A command write sequence consists of three steps which must be strictly adhered to with writes to the Flashmodulenotpermittedbetweenthesteps.However,Flashregisterandarrayreadsareallowedduring a command write sequence. The basic command write sequence is as follows: 1. Write to a valid address in the Flash array memory. 2. Write a valid command to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the command. The address written in step 1 will be stored in the FADDR registers and the data will be stored in the FDATAregisters.WhentheCBEIFflagisclearedinstep3,theCCIFflagisclearedbytheFlashcommand controllerindicatingthatthecommandwassuccessfullylaunched.Forallcommandwritesequences,the CBEIF flag will set after the CCIF flag is cleared indicating that the address, data, and command buffers are ready for a new command write sequence to begin. A buffered command will wait for the active operation to be completed before being launched. Once a command is launched, the completion of the commandoperationisindicatedbythesettingoftheCCIFflagintheFSTATregister.TheCCIFflagwill set upon completion of all active and buffered commands. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 523 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.1.3 Valid Flash Commands Table18-16 summarizes the valid Flash commands along with the effects of the commands on the Flash array. Table18-16. Valid Flash Commands FCMD Meaning Function on Flash Array 0x05 Erase Verify all bytes in the Flash array are erased. Verify IftheFlasharrayiserased,theBLANKbitwillsetintheFSTATregisteruponcommandcompletion. 0x20 Program Program a word (2 bytes) in the Flash array. 0x40 Sector Erase all512 bytes in a sector of the Flash array. Erase 0x41 Mass Erase all bytes in the Flash array. Erase A mass erase of the full Flash array is only possible whenFPLDIS,FPHDIS, and FPOPEN bits in the FPROT register are set prior to launching the command. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 524 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.1.3.1 Erase Verify Command The erase verify operation will verify that a Flash array is erased. AnexampleflowtoexecutetheeraseverifyoperationisshowninFigure18-22.Theeraseverifycommand write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheeraseverifycommand. The address and data written will be ignored. 2. Write the erase verify command, 0x05, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the erase verify command. Afterlaunchingtheeraseverifycommand,theCCIFflagintheFSTATregisterwillsetaftertheoperation has completed unless a new command write sequence has been buffered. Upon completion of the erase verify operation, the BLANK flag in the FSTAT register will be set if all addresses in the Flash array are verifiedtobeerased.IfanyaddressintheFlasharrayisnoterased,theeraseverifyoperationwillterminate and the BLANK flag in the FSTAT register will remain clear. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 525 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Array Address 1. and Dummy Data Write: FCMD register 2. Erase Verify Command 0x05 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes Erase Verify BLANK no Status Set? yes Flash Array Flash Array EXIT EXIT Erased Not Erased Figure18-22. Example Erase Verify Command Flow 526 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.1.3.2 Program Command The program operation will program a previously erased word in the Flash array using an embedded algorithm. AnexampleflowtoexecutetheprogramoperationisshowninFigure18-23.Theprogramcommandwrite sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheprogramcommand.The data written will be programmed to the Flash array address written. 2. Write the program command, 0x20, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the program command. IfawordtobeprogrammedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister willsetandtheprogramcommandwillnotlaunch.Oncetheprogramcommandhassuccessfullylaunched, the CCIF flag in the FSTAT register will set after the program operation has completed unless a new command write sequence has been buffered. By executing a new program command write sequence on sequentialwordsaftertheCBEIFflagintheFSTATregisterhasbeenset,upto55%fasterprogramming time per word can be effectively achieved than by waiting for the CCIF flag to set after each program operation. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 527 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Address 1. and program Data Write: FCMD register 2. Program Command 0x20 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CBEIF no Buffer Empty Set? Check yes Sequential Programming Next yes Decision Word? no Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure18-23. Example Program Command Flow 528 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.1.3.3 Sector Erase Command The sector erase operation will erase all addresses in a 512 byte sector of the Flash array using an embedded algorithm. An example flow to execute the sector erase operation is shown in Figure 18-24. The sector erase command write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequenceforthesectorerasecommand. TheFlashaddresswrittendeterminesthesectortobeerasedwhileMCUaddressbits[8:0]andthe data written are ignored. 2. Write the sector erase command, 0x40, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the sector erase command. IfaFlashsectortobeerasedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister will set and the sector erase command will not launch. Once the sector erase command has successfully launched,theCCIFflagintheFSTATregisterwillsetafterthesectoreraseoperationhascompletedunless a new command write sequence has been buffered. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 529 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Sector Address 1. and Dummy Data Write: FCMD register 2. Sector Erase Command 0x40 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure18-24. Example Sector Erase Command Flow 530 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.1.3.4 Mass Erase Command The mass erase operation will erase all addresses in a Flash array using an embedded algorithm. AnexampleflowtoexecutethemasseraseoperationisshowninFigure 18-25.Themasserasecommand write sequence is as follows: 1. Write to a Flash array address to start the command write sequence for the mass erase command. The address and data written will be ignored. 2. Write the mass erase command, 0x41, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the mass erase command. IfaFlasharraytobeerasedcontainsanyprotectedarea,thePVIOLflagintheFSTATregisterwillsetand the mass erase command will not launch. Once the mass erase command has successfully launched, the CCIF flag in the FSTAT register will set after the mass erase operation has completed unless a new command write sequence has been buffered. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 531 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Block Address 1. and Dummy Data Write: FCMD register 2. Mass Erase Command 0x41 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure18-25. Example Mass Erase Command Flow 532 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.1.4 Illegal Flash Operations 18.4.1.4.1 Access Error The ACCERR flag in the FSTAT register will be set during the command write sequence if any of the following illegal Flash operations are performed causing the command write sequence to immediately abort: 1. Writing to the Flash address space before initializing the FCLKDIV register 2. Writing a misaligned word or a byte to the valid Flash address space 3. Writing to the Flash address space while CBEIF is not set 4. Writing a second word to the Flash address space before executing a program or erase command on the previously written word 5. Writing to any Flash register other than FCMD after writing a word to the Flash address space 6. Writing a second command to the FCMD register before executing the previously written command 7. Writing an invalid command to the FCMD register 8. WritingtoanyFlashregisterotherthanFSTAT(toclearCBEIF)afterwritingtotheFCMDregister 9. Thepartentersstopmodeandaprogramorerasecommandisinprogress.Thecommandisaborted and any pending command is killed 10.Whensecurityisenabled,acommandotherthanmasseraseoriginatingfromanon-securememory or from the background debug mode is written to the FCMD register 11.A 0 is written to the CBEIF bit in the FSTAT register to abort a command write sequence. TheACCERRflagwillnotbesetifanyFlashregisterisreadduringthecommandwritesequence.Ifthe Flash array is read during execution of an algorithm (CCIF=0), the Flash module will return invalid data andtheACCERRflagwillnotbeset.IfanACCERRflagissetintheFSTATregister,theFlashcommand controller is locked. It is not possible to launch another command until the ACCERR flag is cleared. 18.4.1.4.2 Protection Violation ThePVIOLflagintheFSTATregisterwillbesetduringthecommandwritesequenceafterthewordwrite to the Flash address space if any of the following illegal Flash operations are performed, causing the command write sequence to immediately abort: 1. Writing a Flash address to program in a protected area of the Flash array (seeSection 18.3.2.5). 2. Writing a Flash address to erase in a protected area of the Flash array. 3. Writing the mass erase command to the FCMD register while any protection is enabled. If the PVIOL flag is set, the Flash command controller is locked. It is not possible to launch another command until the PVIOL flag is cleared. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 533 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.2 Operating Modes 18.4.2.1 Wait Mode IftheMCUenterswaitmodewhileaFlashcommandisactive(CCIF=0),thatcommandandanybuffered command will be completed. TheFlashmodulecanrecovertheMCUfromwaitmodeiftheinterruptsareenabled(seeSection18.4.5). 18.4.2.2 Stop Mode IftheMCUentersstopmodewhileaFlashcommandisactive(CCIF=0),thatcommandwillbeaborted and the data being programmed or erased is lost. The high voltage circuitry to the Flash array will be switched off when entering stop mode. CCIF and ACCERR flags will be set. Upon exit from stop mode, the CBEIF flag will be set and any buffered command will not be executed. The ACCERR flag must be cleared before returning to normal operation. NOTE As active Flash commands are immediately aborted when the MCU enters stopmode,itisstronglyrecommendedthattheuserdoesnotusetheSTOP instruction during program and erase execution. 18.4.2.3 Background Debug Mode In background debug mode (BDM), the FPROT register is writable. If the MCU is unsecured, then all FlashcommandslistedinTable18-16canbeexecuted.IftheMCUissecuredandisinspecialsinglechip mode, the only possible command to execute is mass erase. 18.4.3 Flash Module Security The Flash module provides the necessary security information to the MCU. After each reset, the Flash moduledeterminesthesecuritystateoftheMCUasdefinedinSection18.3.2.2,“FlashSecurityRegister (FSEC)”. ThecontentsoftheFlashsecurity/optionsbyteataddress0xFF0FintheFlashconfigurationfieldmustbe changed directly by programming address 0xFF0F when the device is unsecured and the higher address sector is unprotected. If the Flash security/options byte is left in the secure state, any reset will cause the MCU to return to the secure operating mode. 18.4.3.1 Unsecuring the MCU using Backdoor Key Access TheMCUmayonlybeunsecuredbyusingthebackdoorkeyaccessfeaturewhichrequiresknowledgeof the contents of the backdoor key (four 16-bit words programmed at addresses 0xFF00–0xFF07). If KEYEN[1:0]= 1:0andtheKEYACCbitisset,awritetoabackdoorkeyaddressintheFlasharraytriggers acomparisonbetweenthewrittendataandthebackdoorkeydatastoredintheFlasharray.Ifallfourwords of data are written to the correct addresses in the correct order and the data matches the backdoor key stored in the Flash array, the MCU will be unsecured. The data must be written to the backdoor key 534 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) addressessequentiallystaringwith0xFF00-0xFF01andendingwith0xFF06–0xFF07.Thevalues0x0000 and 0xFFFF are not permitted as keys. When the KEYACC bit is set, reads of the Flash array will return invalid data. TheusercodestoredintheFlasharraymusthaveamethodofreceivingthebackdoorkeyfromanexternal stimulus. This external stimulus would typically be through one of the on-chip serial ports. If KEYEN[1:0] = 1:0 in the FSEC register, the MCU can be unsecured by the backdoor key access sequence described below: 1. Set the KEYACC bit in the FCNFG register 2. Writethecorrectfour16-bitwordstoFlashaddresses0xFF00–0xFF07sequentiallystartingwith 0xFF00 3. Clear the KEYACC bit in the FCNFG register 4. If all four 16-bit words match the backdoor key stored in Flash addresses 0xFF00–0xFF07, the MCU is unsecured and bits SEC[1:0] in the FSEC register are forced to the unsecure state of 1:0 Thebackdoorkeyaccesssequenceismonitoredbytheinternalsecuritystatemachine.Anillegaloperation duringthebackdoorkeyaccesssequencewill causethesecuritystatemachine tolock, leavingtheMCU in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and allowanewbackdoorkeyaccesssequencetobeattempted.Thefollowingillegaloperationswilllockthe security state machine: 1. If any of the four 16-bit words does not match the backdoor key programmed in the Flash array 2. If the four 16-bit words are written in the wrong sequence 3. If more than four 16-bit words are written 4. If any of the four 16-bit words written are 0x0000 or 0xFFFF 5. If the KEYACC bit does not remain set while the four 16-bit words are written After the backdoor key access sequence has been correctly matched, the MCU will be unsecured. The Flash security byte can be programmed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the four word backdoor key by programming bytes 0xFF00–0xFF07 of the Flash configuration field. The security as defined in the Flash security/options byte at address 0xFF0F is not changed by using the backdoor key access sequence to unsecure. The backdoor key stored in addresses 0xFF00–0xFF07 is unaffected by the backdoor key access sequence. After the next reset sequence, the security state of the FlashmoduleisdeterminedbytheFlashsecurity/optionsbyteataddress0xFF0F.Thebackdoorkeyaccess sequence has no effect on the program and erase protection defined in the FPROT register. ItisnotpossibletounsecuretheMCUinspecialsinglechipmodebyexecutingthebackdoorkeyaccess sequence in background debug mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 535 Rev 01.24

Chapter18 32 Kbyte Flash Module (S12FTS32KV1) 18.4.4 Flash Reset Sequence Oneachreset,theFlashmoduleexecutesaresetsequencetoholdCPUactivitywhileloadingthefollowing registers from the Flash array memory according to Table18-1: • FPROT — Flash Protection Register (see Section 18.3.2.5) • FSEC — Flash Security Register (see Section 18.3.2.2) 18.4.4.1 Reset While Flash Command Active IfaresetoccurswhileanyFlashcommandisinprogress,thatcommandwillbeimmediatelyaborted.The state of the word being programmed or the sector/array being erased is not guaranteed. 18.4.5 Interrupts The Flash module can generate an interrupt when all Flash commands have completed execution or the Flash address, data, and command buffers are empty. Table18-17. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Address, Data, and Command CBEIF CBEIE I Bit Buffers are empty (FSTAT register) All Flash commands have completed CCIF CCIE I Bit execution (FSTAT register) NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 18.4.5.1 Description of Interrupt Operation Figure18-26 shows the logic used for generating interrupts. TheFlashmoduleusestheCBEIFandCCIFflagsincombinationwiththeenablebitsCBIEandCCIEto discriminate for the generation of interrupts. CBEIF CBEIE FLASH INTERRUPT REQUEST CCIF CCIE Figure18-26. Flash Interrupt Implementation For a detailed description of these register bits, refer to Section18.3.2.4, “Flash Configuration Register (FCNFG)” andSection18.3.2.6, “Flash Status Register (FSTAT)”. 536 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 19 64 Kbyte Flash Module (S12FTS64KV4) 19.1 Introduction TheFTS128K1FTS64K module implements a12864 Kbyte Flash (nonvolatile) memory. The Flash memory contains one array of12864 Kbytes organized as 1024512 rows of 128128 bytes with an erase sectorsizeofeightrows(10241024bytes).TheFlasharraymaybereadaseitherbytes,alignedwords,or misaligned words. Read access time is one bus cycle for byte and aligned word, and two bus cycles for misaligned words. The Flash array is ideal for program and data storage for single-supply applications allowing for field reprogramming without requiring external voltage sources for program or erase. Program and erase functionsarecontrolledbyacommanddriveninterface.TheFlashmodulesupportsbothmasseraseand sector erase. An erased bit reads 1 and a programmed bit reads 0. The high voltage required to program and erase is generated internally. It is not possible to read from a Flash array while it is being erased or programmed. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 19.1.1 Glossary CommandWriteSequence—Athree-stepMCUinstructionsequencetoprogram,erase,oreraseverify the Flash array memory. 19.1.2 Features • 12864KbytesofFlashmemorycomprisedofone12864Kbytearraydividedinto12864sectorsof 10241024 bytes • Automated program and erase algorithm • Interrupts on Flash command completion and command buffer empty • Fast sector erase and word program operation • 2-stage command pipeline for faster multi-word program times • Flexible protection scheme to prevent accidental program or erase • Single power supply for Flash program and erase operations • Security feature to prevent unauthorized access to the Flash array memory Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 537 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.1.3 Modes of Operation See Section19.4.2, “Operating Modes” for a description of the Flash module operating modes. For program and erase operations, refer toSection19.4.1, “Flash Command Operations”. 19.1.4 Block Diagram Figure19-1Figure19-2 shows a block diagram of the FTS128K1FTS64K module. FTS128K1 Flash Interface Command Complete Command Pipeline Interrupt Flash Array cmd2 cmd1 addr2 addr1 64K * 16 Bits Command data2 data1 Buffer Empty sector 0 Interrupt sector 1 Registers Protection sector 127 Security Oscillator Clock Clock Divider FCLK Figure19-1. FTS128K1 Block Diagram 538 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) FTS64K Flash Interface Command Complete Command Pipeline Interrupt Flash Array cmd2 cmd1 addr2 addr1 32K * 16 Bits Command data2 data1 Buffer Empty sector 0 Interrupt sector 1 Registers Protection sector 63 Security Oscillator Clock Clock Divider FCLK Figure19-2. FTS64K Block Diagram 19.2 External Signal Description TheFTS128K1FTS64K module contains no signals that connect off-chip. 19.3 Memory Map and Registers This section describes the FTS128K1FTS64K memory map and registers. 19.3.1 Module Memory Map TheFTS128K1FTS64KmemorymapisshowninFigure19-3Figure 19-4.TheHCS12architectureplaces the Flash array addresses between0x40000x4000 and 0xFFFF, which corresponds to three 16 Kbyte pages.ThecontentoftheHCS12CorePPAGEregisterisusedtomapthelogicalmiddlepagerangingfrom Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 539 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) address0x8000to0xBFFFtoanyphysical16KbytepageintheFlasharraymemory.1TheFPROTregister (seeSection19.3.2.5)canbesettogloballyprotecttheentireFlasharray.Threeseparateareas,onestarting fromtheFlasharraystartingaddress(calledlower)towardshigheraddresses,onegrowingdownwardfrom the Flash array end address (called higher), and the remaining addresses, can be activated for protection. TheFlasharrayaddressescoveredbytheseprotectableregionsareshowninFigure19-3Figure19-4.The higher address area is mainly targeted to hold the boot loader code since it covers the vector space. The loweraddressareacanbeusedforEEPROMemulationinanMCUwithoutanEEPROMmodulesinceit can be left unprotected while the remaining addresses are protected from program or erase. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field described in Table19-1. Table19-1. Flash Configuration Field Size Flash Address Description (bytes) 0xFF00–0xFF07 8 Backdoor Key to unlock security 0xFF08–0xFF0C 5 Reserved 0xFF0D 1 Flash Protection byte Refer toSection19.3.2.5, “Flash Protection Register (FPROT)” 0xFF0E 1 Reserved 0xFF0F 1 Flash Security/Options byte Refer toSection19.3.2.2, “Flash Security Register (FSEC)” 1.Byplacing0x3E/0x3FintheHCS12CorePPAGEregister,thebottom/topfixed16KbytepagescanbeseentwiceintheMCU memory map. 540 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) MODULE BASE + 0x0000 Flash Registers 16 bytes MODULE BASE + 0x000F FLASH_START = 0x4000 0x4400 0x4800 0x5000 Flash Protected Low Sectors 1, 2, 4, 8 Kbytes 0x6000 0x3E Flash Array 0x8000 16K PAGED MEMORY 0x38 0x39 0x3A 0x3B 0x3C 0x3D 003E 0x3F 0xC000 Flash Protected High Sectors 0xE000 0x3F 2, 4, 8, 16 Kbytes 0xF000 0xF800 FLASH_END = 0xFFFF 0xFF00–0xFF0F (Flash Configuration Field) Note: 0x38–0x3F correspond to the PPAGE register content Figure19-3. Flash Memory Map Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 541 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) MODULE BASE + 0x0000 Flash Registers 16 bytes MODULE BASE + 0x000F FLASH_START = 0x4000 0x4400 0x4800 0x5000 Flash Protected Low Sectors 1, 2, 4, 8 Kbytes 0x6000 0x3E Flash Array 0x8000 16K PAGED MEMORY 0x3C 0x3D 003E 0x3F 0xC000 Flash Protected High Sectors 0xE000 0x3F 2, 4, 8, 16 Kbytes 0xF000 0xF800 FLASH_END = 0xFFFF 0xFF00–0xFF0F (Flash Configuration Field) Note: 0x3C–0x3F correspond to the PPAGE register content Figure19-4. Flash Memory Map 542 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) Table19-2. Flash Array Memory Map Summary MCU Address Protectable Protectable Array Relative PPAGE Range Low Range High Range Address(1) 0x0000–0x3FFF(2) Unpaged N.A. N.A. 0x14000–0x17FFF (0x3D) 0x4000–0x7FFF Unpaged 0x4000–0x43FF N.A. 0x18000–0x1BFFF (0x3E) 0x4000–0x47FF 0x4000–0x4FFF 0x4000–0x5FFF 0x8000–0xBFFF 0x38 N.A. N.A. 0x00000–0x03FFF 0x39 N.A. N.A. 0x04000–0x07FFF 0x3A N.A. N.A. 0x08000–0x0BFFF 0x3B N.A. N.A. 0x0C000–0x0FFFF 0x3C N.A. N.A. 0x10000–0x13FFF 0x3D N.A. N.A. 0x14000–0x17FFF 0x3E 0x8000–0x83FF N.A. 0x18000–0x1BFFF 0x8000–0x87FF 0x8000–0x8FFF 0x8000–0x9FFF 0x3F N.A. 0xB800–0xBFFF 0x1C000–0x1FFFF 0xB000–0xBFFF 0xA000–0xBFFF 0x8000–0xBFFF 0xC000–0xFFFF Unpaged N.A. 0xF800–0xFFFF 0x1C000–0x1FFFF (0x3F) 0xF000–0xFFFF 0xE000–0xFFFF 0xC000–0xFFFF 1. Inside Flash block. 2. If allowed by MCU. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 543 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) Table19-3. Flash Array Memory Map Summary MCU Address Protectable Protectable Array Relative PPAGE Range Low Range High Range Address(1) 0x0000–0x3FFF(2) Unpaged N.A. N.A. 0x14000–0x17FFF (0x3D) 0x4000–0x7FFF Unpaged 0x4000–0x43FF N.A. 0x18000–0x1BFFF (0x3E) 0x4000–0x47FF 0x4000–0x4FFF 0x4000–0x5FFF 0x8000–0xBFFF 0x3C N.A. N.A. 0x10000–0x13FFF 0x3D N.A. N.A. 0x14000–0x17FFF 0x3E 0x8000–0x83FF N.A. 0x18000–0x1BFFF 0x8000–0x87FF 0x8000–0x8FFF 0x8000–0x9FFF 0x3F N.A. 0xB800–0xBFFF 0x1C000–0x1FFFF 0xB000–0xBFFF 0xA000–0xBFFF 0x8000–0xBFFF 0xC000–0xFFFF Unpaged N.A. 0xF800–0xFFFF 0x1C000–0x1FFFF (0x3F) 0xF000–0xFFFF 0xE000–0xFFFF 0xC000–0xFFFF 1. Inside Flash block. 2. If allowed by MCU. 544 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.3.2 Register Descriptions TheFlashmodulecontainsasetof16controlandstatusregisterslocatedbetweenmodulebase+0x0000 and 0x000F. A summary of the Flash module registers is given in Figure19-5. Detailed descriptions of each register bit are provided. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 FCLKDIV W 0x0001 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 FSEC W 0x0002 R 0 0 0 0 0 0 0 0 RESERVED1 W (1) 0x0003 R 0 0 0 0 0 CBEIE CCIE KEYACC FCNFG W 0x0004 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 FPROT W 0x0005 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL FSTAT W 0x0006 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 FCMD W 0x0007 R 0 0 0 0 0 0 0 0 RESERVED21 W 0x0008 R FABHI FADDRHI1 W 0x0008 R 0 FABHI FADDRHI1 W 0x0009 R FABLO FADDRLO1 W 0x000A R FDHI FDATAHI1 W 0x000B R FDLO FDATALO1 W 0x000C R 0 0 0 0 0 0 0 0 RESERVED31 W 0x000D R 0 0 0 0 0 0 0 0 RESERVED41 W 0x000E R 0 0 0 0 0 0 0 0 RESERVED51 W 0x000F R 0 0 0 0 0 0 0 0 RESERVED61 W = Unimplemented or Reserved Figure19-5. Flash Register Summary 1. Intended for factory test purposes only. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 545 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Module Base + 0x0000 7 6 5 4 3 2 1 0 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-6. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table19-4. FCLKDIV Field Descriptions Field Description 7 Clock Divider Loaded FDIVLD 0 FCLKDIV register has not been written 1 FCLKDIV register has been written to since the last reset 6 Enable Prescalar by 8 PRDIV8 0 The oscillator clock is directly fed into the Flash clock divider 1 The oscillator clock is divided by 8 before feeding into the Flash clock divider 5–0 Clock Divider Bits— The combination of PRDIV8 and FDIV[5:0] must divide the oscillator clock down to a FDIV[5:0] frequency of 150 kHz – 200 kHz. The maximum divide ratio is 512. Refer toSection19.4.1.1, “Writing the FCLKDIV Register”for more information. 19.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Module Base + 0x0001 7 6 5 4 3 2 1 0 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 W Reset F F F F F F F F = Unimplemented or Reserved Figure19-7. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. The FSEC register is loaded from the Flash configuration field at 0xFF0F during the reset sequence, indicated by F inFigure19-7. 546 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) Table19-5. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of the backdoor key access KEYEN[1:0] to the Flash module as shown inTable19-6. 5–2 Nonvolatile Flag Bits — The NV[5:2] bits are available to the user as nonvolatile flags. NV[5:2] 1–0 Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown inTable19-7. If the SEC[1:0] Flash module is unsecured using backdoor key access, the SEC[1:0] bits are forced to 1:0. Table19-6. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01(1) DISABLED 10 ENABLED 11 DISABLED 1. Preferred KEYEN state to disable Backdoor Key Access. Table19-7. Flash Security States SEC[1:0] Status of Security 00 Secured 01(1) Secured 10 Unsecured 11 Secured 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section19.4.3, “Flash Module Security”. 19.3.2.3 RESERVED1 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0002 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-8. RESERVED1 All bits read 0 and are not writable. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 547 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.3.2.4 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash interrupts and gates the security backdoor key writes. Module Base + 0x0003 7 6 5 4 3 2 1 0 R 0 0 0 0 0 CBEIE CCIE KEYACC W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-9. Flash Configuration Register (FCNFG) CBEIE,CCIE,andKEYACCarereadableandwritablewhileremainingbitsread0andarenotwritable. KEYACC is only writable if the KEYEN bit in the FSEC register is set to the enabled state (see Section 19.3.2.2). Table19-8. FCNFG Field Descriptions Field Description 7 Command Buffer Empty Interrupt Enable — The CBEIE bit enables the interrupts in case of an empty CBEIE command buffer in the Flash module. 0 Command Buffer Empty interrupts disabled 1 An interrupt will be requested whenever the CBEIF flag is set (seeSection 19.3.2.6) 6 Command Complete Interrupt Enable — The CCIE bit enables the interrupts in case of all commands being CCIE completed in the Flash module. 0 Command Complete interrupts disabled 1 An interrupt will be requested whenever the CCIF flag is set (seeSection 19.3.2.6) 5 Enable Security Key Writing. KEYACC 0 Flash writes are interpreted as the start of a command write sequence 1 Writes to the Flash array are interpreted as a backdoor key while reads of the Flash array return invalid data 19.3.2.5 Flash Protection Register (FPROT) The FPROT register defines which Flash sectors are protected against program or erase. Module Base + 0x0004 7 6 5 4 3 2 1 0 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W Reset F F F F F F F F Figure19-10. Flash Protection Register (FPROT) TheFPROTregisterisreadableinnormalandspecialmodes.FPOPENcanonlybewrittenfroma1toa 0. FPLS[1:0] can be written anytime until FPLDIS is cleared. FPHS[1:0] can be written anytime until 548 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) FPHDISiscleared.TheFPROTregisterisloadedfromFlashaddress0xFF0Dduringtheresetsequence, indicated by F inFigure19-10. To change the Flash protection that will be loaded on reset, the upper sector of the Flash array must be unprotected, then the Flash protection byte located at Flash address 0xFF0D must be written to. A protected Flash sector is disabled by FPHDIS and FPLDIS while the size of the protected sector is defined by FPHS[1:0] and FPLS[1:0] in the FPROT register. TryingtoalteranyoftheprotectedareaswillresultinaprotectviolationerrorandthePVIOLflagwillbe set in the FSTAT register (see Section 19.3.2.6). A mass erase of the whole Flash array is only possible whenprotectionisfullydisabledbysettingtheFPOPEN,FPLDIS,andFPHDISbits.Anattempttomass erase a Flash array while protection is enabled will set the PVIOL flag in the FSTAT register. Table19-9. FPROT Field Descriptions Field Description 7 Protection Function for Program or Erase — It is possible using the FPOPEN bit to either select address FPOPEN ranges to be protected using FPHDIS, FPLDIS, FPHS[1:0] and FPLS[1:0] or to select the same ranges to be unprotected. When FPOPEN is set, FPxDIS enables the ranges to be protected, whereby clearing FPxDIS enables protection for the range specified by the corresponding FPxS[1:0] bits. When FPOPEN is cleared, FPxDIS defines unprotected ranges as specified by the corresponding FPxS[1:0] bits. In this case, setting FPxDIS enables protection. Thus the effective polarity of the FPxDIS bits is swapped by the FPOPEN bit as shown inTable19-10. This function allows the main part of the Flash array to be protected while a small range can remain unprotected for EEPROM emulation. 0 The FPHDIS and FPLDIS bits define Flash address ranges to be unprotected 1 The FPHDIS and FPLDIS bits define Flash address ranges to be protected 6 Nonvolatile Flag Bit— The NV6 bit should remain in the erased state for future enhancements. NV6 5 Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a FPHDIS protected/unprotected area in the higher space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 4–3 FlashProtectionHigherAddressSize—TheFPHS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPHS[1:0] sector as shown inTable19-11. The FPHS[1:0] bits can only be written to while the FPHDIS bit is set. 2 Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a FPLDIS protected/unprotected sector in the lower space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 1–0 FlashProtectionLowerAddressSize—TheFPLS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPLS[1:0] sector as shown inTable19-12. The FPLS[1:0] bits can only be written to while the FPLDIS bit is set. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 549 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) Table19-10. Flash Protection Function FPOPEN FPHDIS FPHS[1] FPHS[0] FPLDIS FPLS[1] FPLS[0] Function(1) 1 1 x x 1 x x No protection 1 1 x x 0 x x Protect low range 1 0 x x 1 x x Protect high range 1 0 x x 0 x x Protect high and low ranges 0 1 x x 1 x x Full Flash array protected 0 0 x x 1 x x Unprotected high range 0 1 x x 0 x x Unprotected low range 0 0 x x 0 x x Unprotected high and low ranges 1. For range sizes refer toTable19-11 andTable19-12 or . Table19-11. Flash Protection Higher Address Range FPHS[1:0] Address Range Range Size 00 0xF800–0xFFFF 2 Kbytes 01 0xF000–0xFFFF 4 Kbytes 10 0xE000–0xFFFF 8 Kbytes 11 0xC000–0xFFFF 16 Kbytes Table19-12. Flash Protection Lower Address Range FPLS[1:0] Address Range Range Size 00 0x4000–0x43FF 1 Kbyte 01 0x4000–0x47FF 2 Kbytes 10 0x4000–0x4FFF 4 Kbytes 11 0x4000–0x5FFF 8 Kbytes Figure19-11 illustrates all possible protection scenarios. Although the protection scheme is loaded from theFlasharrayafterreset,itisallowedtochangeinnormalmodes.Thisprotectionschemecanbeusedby applicationsrequiringre-programminginsinglechipmodewhileprovidingasmuchprotectionaspossible if no re-programming is required. 550 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) FPHDIS = 1 FPHDIS = 1 FPHDIS = 0 FPHDIS = 0 FPLDIS = 1 FPLDIS = 0 FPLDIS = 1 FPLDIS = 0 Scenario 7 6 5 4 0] 1: S[ L P F 1 = N E P O P 0] F 1: S[ H P 0xFFFF F Scenario 3 2 1 0 0] 1: S[ L P F 0 = N E P O P 0] F 1: S[ H P 0xFFFF F Protected Flash Figure19-11. Flash Protection Scenarios 19.3.2.5.1 Flash Protection Restrictions The general guideline is that protection can only be added, not removed. All valid transitions between Flash protection scenarios are specified inTable19-13. Any attempt to write an invalid scenario to the FPROT register will be ignored and the FPROT register will remain unchanged. The contents of the FPROT register reflect the active protection scenario. Table19-13. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 0 X X X X 1 X X 2 X X 3 X 4 X X 5 X X X X Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 551 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) Table19-13. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 6 X X X X 7 X X X X X X X X 1. Allowed transitions marked with X. 19.3.2.6 Flash Status Register (FSTAT) The FSTAT register defines the status of the Flash command controller and the results of command execution. Module Base + 0x0005 7 6 5 4 3 2 1 0 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL W Reset 1 1 0 0 0 0 0 1 = Unimplemented or Reserved Figure19-12.Flash Status Register (FSTAT) In normal modes, bits CBEIF, PVIOL, and ACCERR are readable and writable, bits CCIF and BLANK arereadableandnotwritable,remainingbits,includingFAILandDONE,read0andarenotwritable.In specialmodes,FAILisreadableandwritablewhileDONEisreadablebutnotwritable.FAILmustbeclear in special modes when starting a command write sequence. Table19-14. FSTAT Field Descriptions Field Description 7 Command Buffer Empty Interrupt Flag — The CBEIF flag indicates that the address, data and command CBEIF buffersareemptysothatanewcommandwritesequencecanbestarted.TheCBEIFflagisclearedbywriting a1toCBEIF.Writinga0totheCBEIFflaghasnoeffectonCBEIF.Writinga0toCBEIFafterwritinganaligned word to the Flash address space but before CBEIF is cleared will abort a command write sequence and cause the ACCERR flag in the FSTAT register to be set. Writing a 0 to CBEIF outside of a command write sequence will not set the ACCERR flag. The CBEIF flag is used together with the CBEIE bit in the FCNFG register to generate an interrupt request (seeFigure19-29). 0 Buffers are full 1 Buffers are ready to accept a new command 6 CommandCompleteInterruptFlag—TheCCIFflagindicatesthattherearenomorecommandspending.The CCIF CCIF flag is cleared when CBEIF is clear and sets automatically upon completion of all active and pending commands. The CCIF flag does not set when an active commands completes and a pending command is fetchedfromthecommandbuffer.WritingtotheCCIFflaghasnoeffect.TheCCIFflagisusedtogetherwiththe CCIE bit in the FCNFG register to generate an interrupt request (seeFigure19-29). 0 Command in progress 1 All commands are completed 552 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) Table19-14. FSTAT Field Descriptions Field Description 5 Protection Violation — The PVIOL flag indicates an attempt was made to program or erase an address in a PVIOL protectedFlasharraymemoryarea.ThePVIOLflagisclearedbywritinga1toPVIOL.Writinga0tothePVIOL flag has no effect on PVIOL. While PVIOL is set, it is not possible to launch another command. 0 No protection violation detected 1 Protection violation has occurred 4 AccessError—TheACCERRflagindicatesanillegalaccesstotheFlasharraycausedbyeitheraviolationof ACCERR thecommandwritesequence,issuinganillegalcommand(illegalcombinationoftheCMDBxbitsintheFCMD register)ortheexecutionofaCPUSTOPinstructionwhileacommandisexecuting(CCIF=0).TheACCERRflag isclearedbywritinga1toACCERR.Writinga0totheACCERRflaghasnoeffectonACCERR.WhileACCERR is set, it is not possible to launch another command. 0 No access error detected 1 Access error has occurred 2 Flash Array Has Been Verified as Erased — The BLANK flag indicates that an erase verify command has BLANK checked the Flash array and found it to be erased. The BLANK flag is cleared by hardware when CBEIF is cleared as part of a new valid command write sequence. Writing to the BLANK flag has no effect on BLANK. 0 If an erase verify command has been requested, and the CCIF flag is set, then a 0 in BLANK indicates the array is not erased 1 Flash array verifies as erased 1 FlagIndicatingaFailedFlashOperation—Inspecialmodes,theFAILflagwillsetiftheeraseverifyoperation FAIL fails(Flasharrayverifiedasnoterased).Writinga0totheFAILflaghasnoeffectonFAIL.TheFAILflagiscleared by writing a 1 to FAIL. While FAIL is set, it is not possible to launch another command. 0 Flash operation completed without error 1 Flash operation failed 0 Flag Indicating a Failed Operation is not Active— In special modes, the DONE flag will clear if a program, DONE erase, or erase verify operation is active. 0 Flash operation is active 1 Flash operation is not active 19.3.2.7 Flash Command Register (FCMD) The FCMD register defines the Flash commands. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-13. Flash Command Register (FCMD) Bits CMDB6, CMDB5, CMDB2, and CMDB0 are readable and writable during a command write sequence while bits 7, 4, 3, and 1 read 0 and are not writable. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 553 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) Table19-15. FCMD Field Descriptions Field Description 6, 5, 2, 0 ValidFlashcommandsareshowninTable19-16.Anattempttoexecuteanycommandotherthanthoselistedin CMDB[6:5] Table19-16 will set the ACCERR bit in the FSTAT register (seeSection 19.3.2.6). CMDB[2] CMDB[0] Table19-16. Valid Flash Command List CMDB NVM Command 0x05 Erase verify 0x20 Word program 0x40 Sector erase 0x41 Mass erase 19.3.2.8 RESERVED2 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-14. RESERVED2 All bits read 0 and are not writable. 19.3.2.9 Flash Address Register (FADDR) FADDRHI and FADDRLO are the Flash address registers. \ Module Base + 0x0008 7 6 5 4 3 2 1 0 R FABHI W Reset 0 0 0 0 0 0 0 0 Figure19-15. Flash Address High Register (FADDRHI) 554 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) \ Module Base + 0x0008 7 6 5 4 3 2 1 0 R 0 FABHI W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-16. Flash Address High Register (FADDRHI) \\ Module Base + 0x0009 7 6 5 4 3 2 1 0 R FABLO W Reset 0 0 0 0 0 0 0 0 Figure19-17. Flash Address Low Register (FADDRLO) In normal modes, all FABHI and FABLO bits read 0 and are not writable. In special modes, the FABHI andFABLObitsarereadableandwritable.Forsectorerase,theMCUaddressbits[9:0]areignored.For mass erase, any address within the Flash array is valid to start the command. 19.3.2.10 Flash Data Register (FDATA) FDATAHI and FDATALO are the Flash data registers. Module Base + 0x000A 7 6 5 4 3 2 1 0 R FDHI W Reset 0 0 0 0 0 0 0 0 Figure19-18. Flash Data High Register (FDATAHI) Module Base + 0x000B 7 6 5 4 3 2 1 0 R FDLO W Reset 0 0 0 0 0 0 0 0 Figure19-19. Flash Data Low Register (FDATALO) In normal modes, all FDATAHI and FDATALO bits read 0 and are not writable. In special modes, all FDATAHI and FDATALO bits are readable and writable when writing to an address within the Flash address range. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 555 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.3.2.11 RESERVED3 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000C 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-20. RESERVED3 All bits read 0 and are not writable. 19.3.2.12 RESERVED4 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-21. RESERVED4 All bits read 0 and are not writable. 19.3.2.13 RESERVED5 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000E 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-22. RESERVED5 All bits read 0 and are not writable. 556 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.3.2.14 RESERVED6 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000F 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure19-23. RESERVED6 All bits read 0 and are not writable. 19.4 Functional Description 19.4.1 Flash Command Operations Writeoperationsareusedfortheprogram,erase,anderaseverifyalgorithmsdescribedinthissection.The programanderasealgorithmsarecontrolledbyastatemachinewhosetimebaseFCLKisderivedfromthe oscillator clock via a programmable divider. The FCMD register as well as the associated FADDR and FDATAregistersoperateasabufferandaregister(2-stageFIFO)sothatanewcommandalongwiththe necessarydataandaddresscanbestoredtothebufferwhilethepreviouscommandisstillinprogress.This pipelinedoperationallowsatimeoptimizationwhenprogrammingmorethanonewordonaspecificrow, asthehighvoltagegenerationcanbekeptactiveinbetweentwoprogrammingcommands.Thepipelined operation also allows a simplification of command launching. Buffer empty as well as command completion are signalled by flags in the FSTAT register with corresponding interrupts generated, if enabled. The next sections describe: • How to write the FCLKDIV register • Command write sequence used to program, erase or erase verify the Flash array • Valid Flash commands • Errors resulting from illegal Flash operations 19.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash command after a reset, it is first necessary to write the FCLKDIV register to divide the oscillator clock down to within the 150-kHz to 200-kHz range. Since the program and erase timingsarealsoafunctionofthebusclock,theFCLKDIVdeterminationmusttakethisinformationinto account. If we define: • FCLK as the clock of the Flash timing control block Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 557 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) • Tbus as the period of the bus clock • INT(x) as taking the integer part of x (e.g., INT(4.323) = 4), then FCLKDIV register bits PRDIV8 and FDIV[5:0] are to be set as described in Figure 19-24. For example, if the oscillator clock frequency is 950 kHz and the bus clock is 10 MHz, FCLKDIV bits FDIV[5:0]shouldbesetto4(000100)andbitPRDIV8setto0.TheresultingFCLKisthen190kHz.As a result, the Flash algorithm timings are increased over optimum target by: (200–190)⁄200×100 = 5% Command execution time will increase proportionally with the period of FCLK. CAUTION Because of the impact of clock synchronization on the accuracy of the functional timings, programming or erasing the Flash array cannot be performedifthebusclockrunsatlessthan1MHz.Programmingorerasing the Flash array with an input clock < 150 kHz should be avoided. Setting FCLKDIVtoavaluesuchthatFCLK<150kHzcandestroytheFlasharray duetooverstress.SettingFCLKDIVtoavaluesuchthat(1/FCLK+Tbus) < 5µs can result in incomplete programming or erasure of the Flash array cells. If the FCLKDIV register is written, the bit FDIVLD is set automatically. If the FDIVLD bit is 0, the FCLKDIVregisterhasnotbeenwrittensincethelastreset.IftheFCLKDIVregisterhasnotbeenwritten to, the Flash command loaded during a command write sequence will not execute and the ACCERR flag in the FSTAT register will set. 558 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) START no Tbus < 1µs? ALL COMMANDS IMPOSSIBLE yes PRDIV8=0 (reset) oscillator_clock no 12.8MHz? yes PRDIV8=1 PRDCLK=oscillator_clock PRDCLK=oscillator_clock/8 no PRDCLK[MHz]*(5+Tbus[µs]) an integer? FDIV[5:0]=INT(PRDCLK[MHz]*(5+Tbus[µs])) yes FDIV[5:0]=PRDCLK[MHz]*(5+Tbus[µs])-1 TRY TO DECREASE Tbus FCLK=(PRDCLK)/(1+FDIV[5:0]) yes 1/FCLK[MHz] + Tbus[µs] > 5 END AND FCLK > 0.15MHz ? no yes FDIV[5:0] > 4? no ALL COMMANDS IMPOSSIBLE Figure19-24. PRDIV8 and FDIV Bits Determination Procedure Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 559 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.1.2 Command Write Sequence The Flash command controller is used to supervise the command write sequence to execute program, erase, and erase verify algorithms. Beforestartingacommandwritesequence,theACCERRandPVIOLflagsintheFSTATregistermustbe clearandtheCBEIFflagshouldbetestedtodeterminethestateoftheaddress,data,andcommandbuffers. If the CBEIF flag is set, indicating the buffers are empty, a new command write sequence can be started. If the CBEIF flag is clear, indicating the buffers are not available, a new command write sequence will overwrite the contents of the address, data, and command buffers. A command write sequence consists of three steps which must be strictly adhered to with writes to the Flashmodulenotpermittedbetweenthesteps.However,Flashregisterandarrayreadsareallowedduring a command write sequence. The basic command write sequence is as follows: 1. Write to a valid address in the Flash array memory. 2. Write a valid command to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the command. The address written in step 1 will be stored in the FADDR registers and the data will be stored in the FDATAregisters.WhentheCBEIFflagisclearedinstep3,theCCIFflagisclearedbytheFlashcommand controllerindicatingthatthecommandwassuccessfullylaunched.Forallcommandwritesequences,the CBEIF flag will set after the CCIF flag is cleared indicating that the address, data, and command buffers are ready for a new command write sequence to begin. A buffered command will wait for the active operation to be completed before being launched. Once a command is launched, the completion of the commandoperationisindicatedbythesettingoftheCCIFflagintheFSTATregister.TheCCIFflagwill set upon completion of all active and buffered commands. 560 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.1.3 Valid Flash Commands Table19-17 summarizes the valid Flash commands along with the effects of the commands on the Flash array. Table19-17. Valid Flash Commands FCMD Meaning Function on Flash Array 0x05 Erase Verify all bytes in the Flash array are erased. Verify IftheFlasharrayiserased,theBLANKbitwillsetintheFSTATregisteruponcommandcompletion. 0x20 Program Program a word (2 bytes) in the Flash array. 0x40 Sector Erase all1024 bytes in a sector of the Flash array. Erase 0x41 Mass Erase all bytes in the Flash array. Erase A mass erase of the full Flash array is only possible whenFPLDIS,FPHDIS, and FPOPEN bits in the FPROT register are set prior to launching the command. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 561 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.1.3.1 Erase Verify Command The erase verify operation will verify that a Flash array is erased. AnexampleflowtoexecutetheeraseverifyoperationisshowninFigure19-25.Theeraseverifycommand write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheeraseverifycommand. The address and data written will be ignored. 2. Write the erase verify command, 0x05, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the erase verify command. Afterlaunchingtheeraseverifycommand,theCCIFflagintheFSTATregisterwillsetaftertheoperation has completed unless a new command write sequence has been buffered. Upon completion of the erase verify operation, the BLANK flag in the FSTAT register will be set if all addresses in the Flash array are verifiedtobeerased.IfanyaddressintheFlasharrayisnoterased,theeraseverifyoperationwillterminate and the BLANK flag in the FSTAT register will remain clear. 562 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Array Address 1. and Dummy Data Write: FCMD register 2. Erase Verify Command 0x05 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes Erase Verify BLANK no Status Set? yes Flash Array Flash Array EXIT EXIT Erased Not Erased Figure19-25. Example Erase Verify Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 563 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.1.3.2 Program Command The program operation will program a previously erased word in the Flash array using an embedded algorithm. AnexampleflowtoexecutetheprogramoperationisshowninFigure19-26.Theprogramcommandwrite sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheprogramcommand.The data written will be programmed to the Flash array address written. 2. Write the program command, 0x20, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the program command. IfawordtobeprogrammedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister willsetandtheprogramcommandwillnotlaunch.Oncetheprogramcommandhassuccessfullylaunched, the CCIF flag in the FSTAT register will set after the program operation has completed unless a new command write sequence has been buffered. By executing a new program command write sequence on sequentialwordsaftertheCBEIFflagintheFSTATregisterhasbeenset,upto55%fasterprogramming time per word can be effectively achieved than by waiting for the CCIF flag to set after each program operation. 564 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Address 1. and program Data Write: FCMD register 2. Program Command 0x20 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CBEIF no Buffer Empty Set? Check yes Sequential Programming Next yes Decision Word? no Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure19-26. Example Program Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 565 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.1.3.3 Sector Erase Command The sector erase operation will erase all addresses in a 1024 byte sector of the Flash array using an embedded algorithm. An example flow to execute the sector erase operation is shown in Figure 19-27. The sector erase command write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequenceforthesectorerasecommand. TheFlashaddresswrittendeterminesthesectortobeerasedwhileMCUaddressbits[9:0]andthe data written are ignored. 2. Write the sector erase command, 0x40, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the sector erase command. IfaFlashsectortobeerasedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister will set and the sector erase command will not launch. Once the sector erase command has successfully launched,theCCIFflagintheFSTATregisterwillsetafterthesectoreraseoperationhascompletedunless a new command write sequence has been buffered. 566 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Sector Address 1. and Dummy Data Write: FCMD register 2. Sector Erase Command 0x40 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure19-27. Example Sector Erase Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 567 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.1.3.4 Mass Erase Command The mass erase operation will erase all addresses in a Flash array using an embedded algorithm. AnexampleflowtoexecutethemasseraseoperationisshowninFigure 19-28.Themasserasecommand write sequence is as follows: 1. Write to a Flash array address to start the command write sequence for the mass erase command. The address and data written will be ignored. 2. Write the mass erase command, 0x41, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the mass erase command. IfaFlasharraytobeerasedcontainsanyprotectedarea,thePVIOLflagintheFSTATregisterwillsetand the mass erase command will not launch. Once the mass erase command has successfully launched, the CCIF flag in the FSTAT register will set after the mass erase operation has completed unless a new command write sequence has been buffered. 568 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Block Address 1. and Dummy Data Write: FCMD register 2. Mass Erase Command 0x41 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure19-28. Example Mass Erase Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 569 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.1.4 Illegal Flash Operations 19.4.1.4.1 Access Error The ACCERR flag in the FSTAT register will be set during the command write sequence if any of the following illegal Flash operations are performed causing the command write sequence to immediately abort: 1. Writing to the Flash address space before initializing the FCLKDIV register 2. Writing a misaligned word or a byte to the valid Flash address space 3. Writing to the Flash address space while CBEIF is not set 4. Writing a second word to the Flash address space before executing a program or erase command on the previously written word 5. Writing to any Flash register other than FCMD after writing a word to the Flash address space 6. Writing a second command to the FCMD register before executing the previously written command 7. Writing an invalid command to the FCMD register 8. WritingtoanyFlashregisterotherthanFSTAT(toclearCBEIF)afterwritingtotheFCMDregister 9. Thepartentersstopmodeandaprogramorerasecommandisinprogress.Thecommandisaborted and any pending command is killed 10.Whensecurityisenabled,acommandotherthanmasseraseoriginatingfromanon-securememory or from the background debug mode is written to the FCMD register 11.A 0 is written to the CBEIF bit in the FSTAT register to abort a command write sequence. TheACCERRflagwillnotbesetifanyFlashregisterisreadduringthecommandwritesequence.Ifthe Flash array is read during execution of an algorithm (CCIF=0), the Flash module will return invalid data andtheACCERRflagwillnotbeset.IfanACCERRflagissetintheFSTATregister,theFlashcommand controller is locked. It is not possible to launch another command until the ACCERR flag is cleared. 19.4.1.4.2 Protection Violation ThePVIOLflagintheFSTATregisterwillbesetduringthecommandwritesequenceafterthewordwrite to the Flash address space if any of the following illegal Flash operations are performed, causing the command write sequence to immediately abort: 1. Writing a Flash address to program in a protected area of the Flash array (seeSection 19.3.2.5). 2. Writing a Flash address to erase in a protected area of the Flash array. 3. Writing the mass erase command to the FCMD register while any protection is enabled. If the PVIOL flag is set, the Flash command controller is locked. It is not possible to launch another command until the PVIOL flag is cleared. 570 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.2 Operating Modes 19.4.2.1 Wait Mode IftheMCUenterswaitmodewhileaFlashcommandisactive(CCIF=0),thatcommandandanybuffered command will be completed. TheFlashmodulecanrecovertheMCUfromwaitmodeiftheinterruptsareenabled(seeSection19.4.5). 19.4.2.2 Stop Mode IftheMCUentersstopmodewhileaFlashcommandisactive(CCIF=0),thatcommandwillbeaborted and the data being programmed or erased is lost. The high voltage circuitry to the Flash array will be switched off when entering stop mode. CCIF and ACCERR flags will be set. Upon exit from stop mode, the CBEIF flag will be set and any buffered command will not be executed. The ACCERR flag must be cleared before returning to normal operation. NOTE As active Flash commands are immediately aborted when the MCU enters stopmode,itisstronglyrecommendedthattheuserdoesnotusetheSTOP instruction during program and erase execution. 19.4.2.3 Background Debug Mode In background debug mode (BDM), the FPROT register is writable. If the MCU is unsecured, then all FlashcommandslistedinTable19-17canbeexecuted.IftheMCUissecuredandisinspecialsinglechip mode, the only possible command to execute is mass erase. 19.4.3 Flash Module Security The Flash module provides the necessary security information to the MCU. After each reset, the Flash moduledeterminesthesecuritystateoftheMCUasdefinedinSection19.3.2.2,“FlashSecurityRegister (FSEC)”. ThecontentsoftheFlashsecurity/optionsbyteataddress0xFF0FintheFlashconfigurationfieldmustbe changed directly by programming address 0xFF0F when the device is unsecured and the higher address sector is unprotected. If the Flash security/options byte is left in the secure state, any reset will cause the MCU to return to the secure operating mode. 19.4.3.1 Unsecuring the MCU using Backdoor Key Access TheMCUmayonlybeunsecuredbyusingthebackdoorkeyaccessfeaturewhichrequiresknowledgeof the contents of the backdoor key (four 16-bit words programmed at addresses 0xFF00–0xFF07). If KEYEN[1:0]= 1:0andtheKEYACCbitisset,awritetoabackdoorkeyaddressintheFlasharraytriggers acomparisonbetweenthewrittendataandthebackdoorkeydatastoredintheFlasharray.Ifallfourwords of data are written to the correct addresses in the correct order and the data matches the backdoor key stored in the Flash array, the MCU will be unsecured. The data must be written to the backdoor key Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 571 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) addressessequentiallystaringwith0xFF00-0xFF01andendingwith0xFF06–0xFF07.Thevalues0x0000 and 0xFFFF are not permitted as keys. When the KEYACC bit is set, reads of the Flash array will return invalid data. TheusercodestoredintheFlasharraymusthaveamethodofreceivingthebackdoorkeyfromanexternal stimulus. This external stimulus would typically be through one of the on-chip serial ports. If KEYEN[1:0] = 1:0 in the FSEC register, the MCU can be unsecured by the backdoor key access sequence described below: 1. Set the KEYACC bit in the FCNFG register 2. Writethecorrectfour16-bitwordstoFlashaddresses0xFF00–0xFF07sequentiallystartingwith 0xFF00 3. Clear the KEYACC bit in the FCNFG register 4. If all four 16-bit words match the backdoor key stored in Flash addresses 0xFF00–0xFF07, the MCU is unsecured and bits SEC[1:0] in the FSEC register are forced to the unsecure state of 1:0 Thebackdoorkeyaccesssequenceismonitoredbytheinternalsecuritystatemachine.Anillegaloperation duringthebackdoorkeyaccesssequencewill causethesecuritystatemachine tolock, leavingtheMCU in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and allowanewbackdoorkeyaccesssequencetobeattempted.Thefollowingillegaloperationswilllockthe security state machine: 1. If any of the four 16-bit words does not match the backdoor key programmed in the Flash array 2. If the four 16-bit words are written in the wrong sequence 3. If more than four 16-bit words are written 4. If any of the four 16-bit words written are 0x0000 or 0xFFFF 5. If the KEYACC bit does not remain set while the four 16-bit words are written After the backdoor key access sequence has been correctly matched, the MCU will be unsecured. The Flash security byte can be programmed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the four word backdoor key by programming bytes 0xFF00–0xFF07 of the Flash configuration field. The security as defined in the Flash security/options byte at address 0xFF0F is not changed by using the backdoor key access sequence to unsecure. The backdoor key stored in addresses 0xFF00–0xFF07 is unaffected by the backdoor key access sequence. After the next reset sequence, the security state of the FlashmoduleisdeterminedbytheFlashsecurity/optionsbyteataddress0xFF0F.Thebackdoorkeyaccess sequence has no effect on the program and erase protection defined in the FPROT register. ItisnotpossibletounsecuretheMCUinspecialsinglechipmodebyexecutingthebackdoorkeyaccess sequence in background debug mode. 572 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 19.4.4 Flash Reset Sequence Oneachreset,theFlashmoduleexecutesaresetsequencetoholdCPUactivitywhileloadingthefollowing registers from the Flash array memory according to Table19-1: • FPROT — Flash Protection Register (see Section 19.3.2.5) • FSEC — Flash Security Register (see Section 19.3.2.2) 19.4.4.1 Reset While Flash Command Active IfaresetoccurswhileanyFlashcommandisinprogress,thatcommandwillbeimmediatelyaborted.The state of the word being programmed or the sector/array being erased is not guaranteed. 19.4.5 Interrupts The Flash module can generate an interrupt when all Flash commands have completed execution or the Flash address, data, and command buffers are empty. Table19-18. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Address, Data, and Command CBEIF CBEIE I Bit Buffers are empty (FSTAT register) All Flash commands have completed CCIF CCIE I Bit execution (FSTAT register) NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 19.4.5.1 Description of Interrupt Operation Figure19-29 shows the logic used for generating interrupts. TheFlashmoduleusestheCBEIFandCCIFflagsincombinationwiththeenablebitsCBIEandCCIEto discriminate for the generation of interrupts. CBEIF CBEIE FLASH INTERRUPT REQUEST CCIF CCIE Figure19-29. Flash Interrupt Implementation For a detailed description of these register bits, refer to Section19.3.2.4, “Flash Configuration Register (FCNFG)” andSection19.3.2.6, “Flash Status Register (FSTAT)”. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 573 Rev 01.24

Chapter19 64 Kbyte Flash Module (S12FTS64KV4) 574 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 20 96 Kbyte Flash Module (S12FTS96KV1) 20.1 Introduction TheFTS128K1FTS96K module implements a12896 Kbyte Flash (nonvolatile) memory. The Flash memory contains one array of12896 Kbytes organized as 1024768 rows of 128128 bytes with an erase sectorsizeofeightrows(10241024bytes).TheFlasharraymaybereadaseitherbytes,alignedwords,or misaligned words. Read access time is one bus cycle for byte and aligned word, and two bus cycles for misaligned words. The Flash array is ideal for program and data storage for single-supply applications allowing for field reprogramming without requiring external voltage sources for program or erase. Program and erase functionsarecontrolledbyacommanddriveninterface.TheFlashmodulesupportsbothmasseraseand sector erase. An erased bit reads 1 and a programmed bit reads 0. The high voltage required to program and erase is generated internally. It is not possible to read from a Flash array while it is being erased or programmed. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 20.1.1 Glossary CommandWriteSequence—Athree-stepMCUinstructionsequencetoprogram,erase,oreraseverify the Flash array memory. 20.1.2 Features • 12896KbytesofFlashmemorycomprisedofone12896Kbytearraydividedinto12896sectorsof 10241024 bytes • Automated program and erase algorithm • Interrupts on Flash command completion and command buffer empty • Fast sector erase and word program operation • 2-stage command pipeline for faster multi-word program times • Flexible protection scheme to prevent accidental program or erase • Single power supply for Flash program and erase operations • Security feature to prevent unauthorized access to the Flash array memory Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 575 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.1.3 Modes of Operation See Section20.4.2, “Operating Modes” for a description of the Flash module operating modes. For program and erase operations, refer toSection20.4.1, “Flash Command Operations”. 20.1.4 Block Diagram Figure20-1Figure20-2 shows a block diagram of the FTS128K1FTS96K module. FTS128K1 Flash Interface Command Complete Command Pipeline Interrupt Flash Array cmd2 cmd1 addr2 addr1 64K * 16 Bits Command data2 data1 Buffer Empty sector 0 Interrupt sector 1 Registers Protection sector 127 Security Oscillator Clock Clock Divider FCLK Figure20-1. FTS128K1 Block Diagram 576 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) FTS96K Flash Interface Command Complete Command Pipeline Interrupt Flash Array cmd2 cmd1 addr2 addr1 48K * 16 Bits Command data2 data1 Buffer Empty sector 0 Interrupt sector 1 Registers Protection sector 95 Security Oscillator Clock Clock Divider FCLK Figure20-2. FTS96K Block Diagram 20.2 External Signal Description TheFTS128K1FTS96K module contains no signals that connect off-chip. 20.3 Memory Map and Registers This section describes the FTS128K1FTS96K memory map and registers. 20.3.1 Module Memory Map TheFTS128K1FTS96KmemorymapisshowninFigure20-3Figure 20-4.TheHCS12architectureplaces the Flash array addresses between0x40000x4000 and 0xFFFF, which corresponds to three 16 Kbyte pages.ThecontentoftheHCS12CorePPAGEregisterisusedtomapthelogicalmiddlepagerangingfrom Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 577 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) address0x8000to0xBFFFtoanyphysical16KbytepageintheFlasharraymemory.1TheFPROTregister (seeSection20.3.2.5)canbesettogloballyprotecttheentireFlasharray.Threeseparateareas,onestarting fromtheFlasharraystartingaddress(calledlower)towardshigheraddresses,onegrowingdownwardfrom the Flash array end address (called higher), and the remaining addresses, can be activated for protection. TheFlasharrayaddressescoveredbytheseprotectableregionsareshowninFigure20-3Figure20-4.The higher address area is mainly targeted to hold the boot loader code since it covers the vector space. The loweraddressareacanbeusedforEEPROMemulationinanMCUwithoutanEEPROMmodulesinceit can be left unprotected while the remaining addresses are protected from program or erase. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field described in Table20-1. Table20-1. Flash Configuration Field Size Flash Address Description (bytes) 0xFF00–0xFF07 8 Backdoor Key to unlock security 0xFF08–0xFF0C 5 Reserved 0xFF0D 1 Flash Protection byte Refer toSection20.3.2.5, “Flash Protection Register (FPROT)” 0xFF0E 1 Reserved 0xFF0F 1 Flash Security/Options byte Refer toSection20.3.2.2, “Flash Security Register (FSEC)” 1.Byplacing0x3E/0x3FintheHCS12CorePPAGEregister,thebottom/topfixed16KbytepagescanbeseentwiceintheMCU memory map. 578 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) MODULE BASE + 0x0000 Flash Registers 16 bytes MODULE BASE + 0x000F FLASH_START = 0x4000 0x4400 0x4800 0x5000 Flash Protected Low Sectors 1, 2, 4, 8 Kbytes 0x6000 0x3E Flash Array 0x8000 16K PAGED MEMORY 0x38 0x39 0x3A 0x3B 0x3C 0x3D 003E 0x3F 0xC000 Flash Protected High Sectors 0xE000 0x3F 2, 4, 8, 16 Kbytes 0xF000 0xF800 FLASH_END = 0xFFFF 0xFF00–0xFF0F (Flash Configuration Field) Note: 0x38–0x3F correspond to the PPAGE register content Figure20-3. Flash Memory Map Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 579 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) MODULE BASE + 0x0000 Flash Registers 16 bytes MODULE BASE + 0x000F FLASH_START = 0x4000 0x4400 0x4800 0x5000 Flash Protected Low Sectors 1, 2, 4, 8 Kbytes 0x6000 0x3E Flash Array 0x8000 16K PAGED MEMORY 0x3A 0x3B 0x3C 0x3D 003E 0x3F 0xC000 Flash Protected High Sectors 0xE000 0x3F 2, 4, 8, 16 Kbytes 0xF000 0xF800 FLASH_END = 0xFFFF 0xFF00–0xFF0F (Flash Configuration Field) Note: 0x3A–0x3F correspond to the PPAGE register content Figure20-4. Flash Memory Map 580 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Table20-2. Flash Array Memory Map Summary MCU Address Protectable Protectable Array Relative PPAGE Range Low Range High Range Address(1) 0x0000–0x3FFF(2) Unpaged N.A. N.A. 0x14000–0x17FFF (0x3D) 0x4000–0x7FFF Unpaged 0x4000–0x43FF N.A. 0x18000–0x1BFFF (0x3E) 0x4000–0x47FF 0x4000–0x4FFF 0x4000–0x5FFF 0x8000–0xBFFF 0x38 N.A. N.A. 0x00000–0x03FFF 0x39 N.A. N.A. 0x04000–0x07FFF 0x3A N.A. N.A. 0x08000–0x0BFFF 0x3B N.A. N.A. 0x0C000–0x0FFFF 0x3C N.A. N.A. 0x10000–0x13FFF 0x3D N.A. N.A. 0x14000–0x17FFF 0x3E 0x8000–0x83FF N.A. 0x18000–0x1BFFF 0x8000–0x87FF 0x8000–0x8FFF 0x8000–0x9FFF 0x3F N.A. 0xB800–0xBFFF 0x1C000–0x1FFFF 0xB000–0xBFFF 0xA000–0xBFFF 0x8000–0xBFFF 0xC000–0xFFFF Unpaged N.A. 0xF800–0xFFFF 0x1C000–0x1FFFF (0x3F) 0xF000–0xFFFF 0xE000–0xFFFF 0xC000–0xFFFF 1. Inside Flash block. 2. If allowed by MCU. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 581 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Table20-3. Flash Array Memory Map Summary MCU Address Protectable Protectable Array Relative PPAGE Range Low Range High Range Address(1) 0x0000–0x3FFF(2) Unpaged N.A. N.A. 0x14000–0x17FFF (0x3D) 0x4000–0x7FFF Unpaged 0x4000–0x43FF N.A. 0x18000–0x1BFFF (0x3E) 0x4000–0x47FF 0x4000–0x4FFF 0x4000–0x5FFF 0x8000–0xBFFF 0x3A N.A. N.A. 0x08000–0x0BFFF 0x3B N.A. N.A. 0x0C000–0x0FFFF 0x3C N.A. N.A. 0x10000–0x13FFF 0x3D N.A. N.A. 0x14000–0x17FFF 0x3E 0x8000–0x83FF N.A. 0x18000–0x1BFFF 0x8000–0x87FF 0x8000–0x8FFF 0x8000–0x9FFF 0x3F N.A. 0xB800–0xBFFF 0x1C000–0x1FFFF 0xB000–0xBFFF 0xA000–0xBFFF 0x8000–0xBFFF 0xC000–0xFFFF Unpaged N.A. 0xF800–0xFFFF 0x1C000–0x1FFFF (0x3F) 0xF000–0xFFFF 0xE000–0xFFFF 0xC000–0xFFFF 1. Inside Flash block. 2. If allowed by MCU. 582 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.3.2 Register Descriptions TheFlashmodulecontainsasetof16controlandstatusregisterslocatedbetweenmodulebase+0x0000 and 0x000F. A summary of the Flash module registers is given in Figure20-5. Detailed descriptions of each register bit are provided. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 FCLKDIV W 0x0001 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 FSEC W 0x0002 R 0 0 0 0 0 0 0 0 RESERVED1 W (1) 0x0003 R 0 0 0 0 0 CBEIE CCIE KEYACC FCNFG W 0x0004 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 FPROT W 0x0005 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL FSTAT W 0x0006 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 FCMD W 0x0007 R 0 0 0 0 0 0 0 0 RESERVED21 W 0x0008 R FABHI FADDRHI1 W 0x0009 R FABLO FADDRLO1 W 0x000A R FDHI FDATAHI1 W 0x000B R FDLO FDATALO1 W 0x000C R 0 0 0 0 0 0 0 0 RESERVED31 W 0x000D R 0 0 0 0 0 0 0 0 RESERVED41 W 0x000E R 0 0 0 0 0 0 0 0 RESERVED51 W 0x000F R 0 0 0 0 0 0 0 0 RESERVED61 W = Unimplemented or Reserved Figure20-5. Flash Register Summary 1. Intended for factory test purposes only. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 583 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Module Base + 0x0000 7 6 5 4 3 2 1 0 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-6. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table20-4. FCLKDIV Field Descriptions Field Description 7 Clock Divider Loaded FDIVLD 0 FCLKDIV register has not been written 1 FCLKDIV register has been written to since the last reset 6 Enable Prescalar by 8 PRDIV8 0 The oscillator clock is directly fed into the Flash clock divider 1 The oscillator clock is divided by 8 before feeding into the Flash clock divider 5–0 Clock Divider Bits— The combination of PRDIV8 and FDIV[5:0] must divide the oscillator clock down to a FDIV[5:0] frequency of 150 kHz – 200 kHz. The maximum divide ratio is 512. Refer toSection20.4.1.1, “Writing the FCLKDIV Register”for more information. 20.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Module Base + 0x0001 7 6 5 4 3 2 1 0 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 W Reset F F F F F F F F = Unimplemented or Reserved Figure20-7. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. The FSEC register is loaded from the Flash configuration field at 0xFF0F during the reset sequence, indicated by F inFigure20-7. 584 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Table20-5. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of the backdoor key access KEYEN[1:0] to the Flash module as shown inTable20-6. 5–2 Nonvolatile Flag Bits — The NV[5:2] bits are available to the user as nonvolatile flags. NV[5:2] 1–0 Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown inTable20-7. If the SEC[1:0] Flash module is unsecured using backdoor key access, the SEC[1:0] bits are forced to 1:0. Table20-6. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01(1) DISABLED 10 ENABLED 11 DISABLED 1. Preferred KEYEN state to disable Backdoor Key Access. Table20-7. Flash Security States SEC[1:0] Status of Security 00 Secured 01(1) Secured 10 Unsecured 11 Secured 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section20.4.3, “Flash Module Security”. 20.3.2.3 RESERVED1 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0002 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-8. RESERVED1 All bits read 0 and are not writable. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 585 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.3.2.4 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash interrupts and gates the security backdoor key writes. Module Base + 0x0003 7 6 5 4 3 2 1 0 R 0 0 0 0 0 CBEIE CCIE KEYACC W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-9. Flash Configuration Register (FCNFG) CBEIE,CCIE,andKEYACCarereadableandwritablewhileremainingbitsread0andarenotwritable. KEYACC is only writable if the KEYEN bit in the FSEC register is set to the enabled state (see Section 20.3.2.2). Table20-8. FCNFG Field Descriptions Field Description 7 Command Buffer Empty Interrupt Enable — The CBEIE bit enables the interrupts in case of an empty CBEIE command buffer in the Flash module. 0 Command Buffer Empty interrupts disabled 1 An interrupt will be requested whenever the CBEIF flag is set (seeSection 20.3.2.6) 6 Command Complete Interrupt Enable — The CCIE bit enables the interrupts in case of all commands being CCIE completed in the Flash module. 0 Command Complete interrupts disabled 1 An interrupt will be requested whenever the CCIF flag is set (seeSection 20.3.2.6) 5 Enable Security Key Writing. KEYACC 0 Flash writes are interpreted as the start of a command write sequence 1 Writes to the Flash array are interpreted as a backdoor key while reads of the Flash array return invalid data 20.3.2.5 Flash Protection Register (FPROT) The FPROT register defines which Flash sectors are protected against program or erase. Module Base + 0x0004 7 6 5 4 3 2 1 0 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W Reset F F F F F F F F Figure20-10. Flash Protection Register (FPROT) TheFPROTregisterisreadableinnormalandspecialmodes.FPOPENcanonlybewrittenfroma1toa 0. FPLS[1:0] can be written anytime until FPLDIS is cleared. FPHS[1:0] can be written anytime until 586 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) FPHDISiscleared.TheFPROTregisterisloadedfromFlashaddress0xFF0Dduringtheresetsequence, indicated by F inFigure20-10. To change the Flash protection that will be loaded on reset, the upper sector of the Flash array must be unprotected, then the Flash protection byte located at Flash address 0xFF0D must be written to. A protected Flash sector is disabled by FPHDIS and FPLDIS while the size of the protected sector is defined by FPHS[1:0] and FPLS[1:0] in the FPROT register. TryingtoalteranyoftheprotectedareaswillresultinaprotectviolationerrorandthePVIOLflagwillbe set in the FSTAT register (see Section 20.3.2.6). A mass erase of the whole Flash array is only possible whenprotectionisfullydisabledbysettingtheFPOPEN,FPLDIS,andFPHDISbits.Anattempttomass erase a Flash array while protection is enabled will set the PVIOL flag in the FSTAT register. Table20-9. FPROT Field Descriptions Field Description 7 Protection Function for Program or Erase — It is possible using the FPOPEN bit to either select address FPOPEN ranges to be protected using FPHDIS, FPLDIS, FPHS[1:0] and FPLS[1:0] or to select the same ranges to be unprotected. When FPOPEN is set, FPxDIS enables the ranges to be protected, whereby clearing FPxDIS enables protection for the range specified by the corresponding FPxS[1:0] bits. When FPOPEN is cleared, FPxDIS defines unprotected ranges as specified by the corresponding FPxS[1:0] bits. In this case, setting FPxDIS enables protection. Thus the effective polarity of the FPxDIS bits is swapped by the FPOPEN bit as shown inTable20-10. This function allows the main part of the Flash array to be protected while a small range can remain unprotected for EEPROM emulation. 0 The FPHDIS and FPLDIS bits define Flash address ranges to be unprotected 1 The FPHDIS and FPLDIS bits define Flash address ranges to be protected 6 Nonvolatile Flag Bit— The NV6 bit should remain in the erased state for future enhancements. NV6 5 Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a FPHDIS protected/unprotected area in the higher space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 4–3 FlashProtectionHigherAddressSize—TheFPHS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPHS[1:0] sector as shown inTable20-11. The FPHS[1:0] bits can only be written to while the FPHDIS bit is set. 2 Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a FPLDIS protected/unprotected sector in the lower space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 1–0 FlashProtectionLowerAddressSize—TheFPLS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPLS[1:0] sector as shown inTable20-12. The FPLS[1:0] bits can only be written to while the FPLDIS bit is set. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 587 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Table20-10. Flash Protection Function FPOPEN FPHDIS FPHS[1] FPHS[0] FPLDIS FPLS[1] FPLS[0] Function(1) 1 1 x x 1 x x No protection 1 1 x x 0 x x Protect low range 1 0 x x 1 x x Protect high range 1 0 x x 0 x x Protect high and low ranges 0 1 x x 1 x x Full Flash array protected 0 0 x x 1 x x Unprotected high range 0 1 x x 0 x x Unprotected low range 0 0 x x 0 x x Unprotected high and low ranges 1. For range sizes refer toTable20-11 andTable20-12 or . Table20-11. Flash Protection Higher Address Range FPHS[1:0] Address Range Range Size 00 0xF800–0xFFFF 2 Kbytes 01 0xF000–0xFFFF 4 Kbytes 10 0xE000–0xFFFF 8 Kbytes 11 0xC000–0xFFFF 16 Kbytes Table20-12. Flash Protection Lower Address Range FPLS[1:0] Address Range Range Size 00 0x4000–0x43FF 1 Kbyte 01 0x4000–0x47FF 2 Kbytes 10 0x4000–0x4FFF 4 Kbytes 11 0x4000–0x5FFF 8 Kbytes Figure20-11 illustrates all possible protection scenarios. Although the protection scheme is loaded from theFlasharrayafterreset,itisallowedtochangeinnormalmodes.Thisprotectionschemecanbeusedby applicationsrequiringre-programminginsinglechipmodewhileprovidingasmuchprotectionaspossible if no re-programming is required. 588 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) FPHDIS = 1 FPHDIS = 1 FPHDIS = 0 FPHDIS = 0 FPLDIS = 1 FPLDIS = 0 FPLDIS = 1 FPLDIS = 0 Scenario 7 6 5 4 0] 1: S[ L P F 1 = N E P O P 0] F 1: S[ H P 0xFFFF F Scenario 3 2 1 0 0] 1: S[ L P F 0 = N E P O P 0] F 1: S[ H P 0xFFFF F Protected Flash Figure20-11. Flash Protection Scenarios 20.3.2.5.1 Flash Protection Restrictions The general guideline is that protection can only be added, not removed. All valid transitions between Flash protection scenarios are specified inTable20-13. Any attempt to write an invalid scenario to the FPROT register will be ignored and the FPROT register will remain unchanged. The contents of the FPROT register reflect the active protection scenario. Table20-13. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 0 X X X X 1 X X 2 X X 3 X 4 X X 5 X X X X Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 589 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Table20-13. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 6 X X X X 7 X X X X X X X X 1. Allowed transitions marked with X. 20.3.2.6 Flash Status Register (FSTAT) The FSTAT register defines the status of the Flash command controller and the results of command execution. Module Base + 0x0005 7 6 5 4 3 2 1 0 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL W Reset 1 1 0 0 0 0 0 1 = Unimplemented or Reserved Figure20-12.Flash Status Register (FSTAT) In normal modes, bits CBEIF, PVIOL, and ACCERR are readable and writable, bits CCIF and BLANK arereadableandnotwritable,remainingbits,includingFAILandDONE,read0andarenotwritable.In specialmodes,FAILisreadableandwritablewhileDONEisreadablebutnotwritable.FAILmustbeclear in special modes when starting a command write sequence. Table20-14. FSTAT Field Descriptions Field Description 7 Command Buffer Empty Interrupt Flag — The CBEIF flag indicates that the address, data and command CBEIF buffersareemptysothatanewcommandwritesequencecanbestarted.TheCBEIFflagisclearedbywriting a1toCBEIF.Writinga0totheCBEIFflaghasnoeffectonCBEIF.Writinga0toCBEIFafterwritinganaligned word to the Flash address space but before CBEIF is cleared will abort a command write sequence and cause the ACCERR flag in the FSTAT register to be set. Writing a 0 to CBEIF outside of a command write sequence will not set the ACCERR flag. The CBEIF flag is used together with the CBEIE bit in the FCNFG register to generate an interrupt request (seeFigure20-28). 0 Buffers are full 1 Buffers are ready to accept a new command 6 CommandCompleteInterruptFlag—TheCCIFflagindicatesthattherearenomorecommandspending.The CCIF CCIF flag is cleared when CBEIF is clear and sets automatically upon completion of all active and pending commands. The CCIF flag does not set when an active commands completes and a pending command is fetchedfromthecommandbuffer.WritingtotheCCIFflaghasnoeffect.TheCCIFflagisusedtogetherwiththe CCIE bit in the FCNFG register to generate an interrupt request (seeFigure20-28). 0 Command in progress 1 All commands are completed 590 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Table20-14. FSTAT Field Descriptions Field Description 5 Protection Violation — The PVIOL flag indicates an attempt was made to program or erase an address in a PVIOL protectedFlasharraymemoryarea.ThePVIOLflagisclearedbywritinga1toPVIOL.Writinga0tothePVIOL flag has no effect on PVIOL. While PVIOL is set, it is not possible to launch another command. 0 No protection violation detected 1 Protection violation has occurred 4 AccessError—TheACCERRflagindicatesanillegalaccesstotheFlasharraycausedbyeitheraviolationof ACCERR thecommandwritesequence,issuinganillegalcommand(illegalcombinationoftheCMDBxbitsintheFCMD register)ortheexecutionofaCPUSTOPinstructionwhileacommandisexecuting(CCIF=0).TheACCERRflag isclearedbywritinga1toACCERR.Writinga0totheACCERRflaghasnoeffectonACCERR.WhileACCERR is set, it is not possible to launch another command. 0 No access error detected 1 Access error has occurred 2 Flash Array Has Been Verified as Erased — The BLANK flag indicates that an erase verify command has BLANK checked the Flash array and found it to be erased. The BLANK flag is cleared by hardware when CBEIF is cleared as part of a new valid command write sequence. Writing to the BLANK flag has no effect on BLANK. 0 If an erase verify command has been requested, and the CCIF flag is set, then a 0 in BLANK indicates the array is not erased 1 Flash array verifies as erased 1 FlagIndicatingaFailedFlashOperation—Inspecialmodes,theFAILflagwillsetiftheeraseverifyoperation FAIL fails(Flasharrayverifiedasnoterased).Writinga0totheFAILflaghasnoeffectonFAIL.TheFAILflagiscleared by writing a 1 to FAIL. While FAIL is set, it is not possible to launch another command. 0 Flash operation completed without error 1 Flash operation failed 0 Flag Indicating a Failed Operation is not Active— In special modes, the DONE flag will clear if a program, DONE erase, or erase verify operation is active. 0 Flash operation is active 1 Flash operation is not active 20.3.2.7 Flash Command Register (FCMD) The FCMD register defines the Flash commands. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-13. Flash Command Register (FCMD) Bits CMDB6, CMDB5, CMDB2, and CMDB0 are readable and writable during a command write sequence while bits 7, 4, 3, and 1 read 0 and are not writable. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 591 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Table20-15. FCMD Field Descriptions Field Description 6, 5, 2, 0 ValidFlashcommandsareshowninTable20-16.Anattempttoexecuteanycommandotherthanthoselistedin CMDB[6:5] Table20-16 will set the ACCERR bit in the FSTAT register (seeSection 20.3.2.6). CMDB[2] CMDB[0] Table20-16. Valid Flash Command List CMDB NVM Command 0x05 Erase verify 0x20 Word program 0x40 Sector erase 0x41 Mass erase 20.3.2.8 RESERVED2 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-14. RESERVED2 All bits read 0 and are not writable. 20.3.2.9 Flash Address Register (FADDR) FADDRHI and FADDRLO are the Flash address registers. \ Module Base + 0x0008 7 6 5 4 3 2 1 0 R FABHI W Reset 0 0 0 0 0 0 0 0 Figure20-15. Flash Address High Register (FADDRHI) \\ 592 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Module Base + 0x0009 7 6 5 4 3 2 1 0 R FABLO W Reset 0 0 0 0 0 0 0 0 Figure20-16. Flash Address Low Register (FADDRLO) In normal modes, all FABHI and FABLO bits read 0 and are not writable. In special modes, the FABHI andFABLObitsarereadableandwritable.Forsectorerase,theMCUaddressbits[9:0]areignored.For mass erase, any address within the Flash array is valid to start the command. 20.3.2.10 Flash Data Register (FDATA) FDATAHI and FDATALO are the Flash data registers. Module Base + 0x000A 7 6 5 4 3 2 1 0 R FDHI W Reset 0 0 0 0 0 0 0 0 Figure20-17. Flash Data High Register (FDATAHI) Module Base + 0x000B 7 6 5 4 3 2 1 0 R FDLO W Reset 0 0 0 0 0 0 0 0 Figure20-18. Flash Data Low Register (FDATALO) In normal modes, all FDATAHI and FDATALO bits read 0 and are not writable. In special modes, all FDATAHI and FDATALO bits are readable and writable when writing to an address within the Flash address range. 20.3.2.11 RESERVED3 This register is reserved for factory testing and is not accessible to the user. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 593 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Module Base + 0x000C 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-19. RESERVED3 All bits read 0 and are not writable. 20.3.2.12 RESERVED4 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-20. RESERVED4 All bits read 0 and are not writable. 20.3.2.13 RESERVED5 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000E 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-21. RESERVED5 All bits read 0 and are not writable. 20.3.2.14 RESERVED6 This register is reserved for factory testing and is not accessible to the user. 594 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) Module Base + 0x000F 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure20-22. RESERVED6 All bits read 0 and are not writable. 20.4 Functional Description 20.4.1 Flash Command Operations Writeoperationsareusedfortheprogram,erase,anderaseverifyalgorithmsdescribedinthissection.The programanderasealgorithmsarecontrolledbyastatemachinewhosetimebaseFCLKisderivedfromthe oscillator clock via a programmable divider. The FCMD register as well as the associated FADDR and FDATAregistersoperateasabufferandaregister(2-stageFIFO)sothatanewcommandalongwiththe necessarydataandaddresscanbestoredtothebufferwhilethepreviouscommandisstillinprogress.This pipelinedoperationallowsatimeoptimizationwhenprogrammingmorethanonewordonaspecificrow, asthehighvoltagegenerationcanbekeptactiveinbetweentwoprogrammingcommands.Thepipelined operation also allows a simplification of command launching. Buffer empty as well as command completion are signalled by flags in the FSTAT register with corresponding interrupts generated, if enabled. The next sections describe: • How to write the FCLKDIV register • Command write sequence used to program, erase or erase verify the Flash array • Valid Flash commands • Errors resulting from illegal Flash operations 20.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash command after a reset, it is first necessary to write the FCLKDIV register to divide the oscillator clock down to within the 150-kHz to 200-kHz range. Since the program and erase timingsarealsoafunctionofthebusclock,theFCLKDIVdeterminationmusttakethisinformationinto account. If we define: • FCLK as the clock of the Flash timing control block • Tbus as the period of the bus clock • INT(x) as taking the integer part of x (e.g., INT(4.323) = 4), Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 595 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) then FCLKDIV register bits PRDIV8 and FDIV[5:0] are to be set as described in Figure 20-23. For example, if the oscillator clock frequency is 950 kHz and the bus clock is 10 MHz, FCLKDIV bits FDIV[5:0]shouldbesetto4(000100)andbitPRDIV8setto0.TheresultingFCLKisthen190kHz.As a result, the Flash algorithm timings are increased over optimum target by: (200–190)⁄200×100 = 5% Command execution time will increase proportionally with the period of FCLK. CAUTION Because of the impact of clock synchronization on the accuracy of the functional timings, programming or erasing the Flash array cannot be performedifthebusclockrunsatlessthan1MHz.Programmingorerasing the Flash array with an input clock < 150 kHz should be avoided. Setting FCLKDIVtoavaluesuchthatFCLK<150kHzcandestroytheFlasharray duetooverstress.SettingFCLKDIVtoavaluesuchthat(1/FCLK+Tbus) < 5µs can result in incomplete programming or erasure of the Flash array cells. If the FCLKDIV register is written, the bit FDIVLD is set automatically. If the FDIVLD bit is 0, the FCLKDIVregisterhasnotbeenwrittensincethelastreset.IftheFCLKDIVregisterhasnotbeenwritten to, the Flash command loaded during a command write sequence will not execute and the ACCERR flag in the FSTAT register will set. 596 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) START no Tbus < 1µs? ALL COMMANDS IMPOSSIBLE yes PRDIV8=0 (reset) oscillator_clock no 12.8MHz? yes PRDIV8=1 PRDCLK=oscillator_clock PRDCLK=oscillator_clock/8 no PRDCLK[MHz]*(5+Tbus[µs]) an integer? FDIV[5:0]=INT(PRDCLK[MHz]*(5+Tbus[µs])) yes FDIV[5:0]=PRDCLK[MHz]*(5+Tbus[µs])-1 TRY TO DECREASE Tbus FCLK=(PRDCLK)/(1+FDIV[5:0]) yes 1/FCLK[MHz] + Tbus[µs] > 5 END AND FCLK > 0.15MHz ? no yes FDIV[5:0] > 4? no ALL COMMANDS IMPOSSIBLE Figure20-23. PRDIV8 and FDIV Bits Determination Procedure Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 597 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.1.2 Command Write Sequence The Flash command controller is used to supervise the command write sequence to execute program, erase, and erase verify algorithms. Beforestartingacommandwritesequence,theACCERRandPVIOLflagsintheFSTATregistermustbe clearandtheCBEIFflagshouldbetestedtodeterminethestateoftheaddress,data,andcommandbuffers. If the CBEIF flag is set, indicating the buffers are empty, a new command write sequence can be started. If the CBEIF flag is clear, indicating the buffers are not available, a new command write sequence will overwrite the contents of the address, data, and command buffers. A command write sequence consists of three steps which must be strictly adhered to with writes to the Flashmodulenotpermittedbetweenthesteps.However,Flashregisterandarrayreadsareallowedduring a command write sequence. The basic command write sequence is as follows: 1. Write to a valid address in the Flash array memory. 2. Write a valid command to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the command. The address written in step 1 will be stored in the FADDR registers and the data will be stored in the FDATAregisters.WhentheCBEIFflagisclearedinstep3,theCCIFflagisclearedbytheFlashcommand controllerindicatingthatthecommandwassuccessfullylaunched.Forallcommandwritesequences,the CBEIF flag will set after the CCIF flag is cleared indicating that the address, data, and command buffers are ready for a new command write sequence to begin. A buffered command will wait for the active operation to be completed before being launched. Once a command is launched, the completion of the commandoperationisindicatedbythesettingoftheCCIFflagintheFSTATregister.TheCCIFflagwill set upon completion of all active and buffered commands. 598 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.1.3 Valid Flash Commands Table20-17 summarizes the valid Flash commands along with the effects of the commands on the Flash array. Table20-17. Valid Flash Commands FCMD Meaning Function on Flash Array 0x05 Erase Verify all bytes in the Flash array are erased. Verify IftheFlasharrayiserased,theBLANKbitwillsetintheFSTATregisteruponcommandcompletion. 0x20 Program Program a word (2 bytes) in the Flash array. 0x40 Sector Erase all1024 bytes in a sector of the Flash array. Erase 0x41 Mass Erase all bytes in the Flash array. Erase A mass erase of the full Flash array is only possible whenFPLDIS,FPHDIS, and FPOPEN bits in the FPROT register are set prior to launching the command. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 599 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.1.3.1 Erase Verify Command The erase verify operation will verify that a Flash array is erased. AnexampleflowtoexecutetheeraseverifyoperationisshowninFigure20-24.Theeraseverifycommand write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheeraseverifycommand. The address and data written will be ignored. 2. Write the erase verify command, 0x05, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the erase verify command. Afterlaunchingtheeraseverifycommand,theCCIFflagintheFSTATregisterwillsetaftertheoperation has completed unless a new command write sequence has been buffered. Upon completion of the erase verify operation, the BLANK flag in the FSTAT register will be set if all addresses in the Flash array are verifiedtobeerased.IfanyaddressintheFlasharrayisnoterased,theeraseverifyoperationwillterminate and the BLANK flag in the FSTAT register will remain clear. 600 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Array Address 1. and Dummy Data Write: FCMD register 2. Erase Verify Command 0x05 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes Erase Verify BLANK no Status Set? yes Flash Array Flash Array EXIT EXIT Erased Not Erased Figure20-24. Example Erase Verify Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 601 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.1.3.2 Program Command The program operation will program a previously erased word in the Flash array using an embedded algorithm. AnexampleflowtoexecutetheprogramoperationisshowninFigure20-25.Theprogramcommandwrite sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheprogramcommand.The data written will be programmed to the Flash array address written. 2. Write the program command, 0x20, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the program command. IfawordtobeprogrammedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister willsetandtheprogramcommandwillnotlaunch.Oncetheprogramcommandhassuccessfullylaunched, the CCIF flag in the FSTAT register will set after the program operation has completed unless a new command write sequence has been buffered. By executing a new program command write sequence on sequentialwordsaftertheCBEIFflagintheFSTATregisterhasbeenset,upto55%fasterprogramming time per word can be effectively achieved than by waiting for the CCIF flag to set after each program operation. 602 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Address 1. and program Data Write: FCMD register 2. Program Command 0x20 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CBEIF no Buffer Empty Set? Check yes Sequential Programming Next yes Decision Word? no Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure20-25. Example Program Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 603 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.1.3.3 Sector Erase Command The sector erase operation will erase all addresses in a 1024 byte sector of the Flash array using an embedded algorithm. An example flow to execute the sector erase operation is shown in Figure 20-26. The sector erase command write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequenceforthesectorerasecommand. TheFlashaddresswrittendeterminesthesectortobeerasedwhileMCUaddressbits[9:0]andthe data written are ignored. 2. Write the sector erase command, 0x40, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the sector erase command. IfaFlashsectortobeerasedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister will set and the sector erase command will not launch. Once the sector erase command has successfully launched,theCCIFflagintheFSTATregisterwillsetafterthesectoreraseoperationhascompletedunless a new command write sequence has been buffered. 604 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Sector Address 1. and Dummy Data Write: FCMD register 2. Sector Erase Command 0x40 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure20-26. Example Sector Erase Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 605 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.1.3.4 Mass Erase Command The mass erase operation will erase all addresses in a Flash array using an embedded algorithm. AnexampleflowtoexecutethemasseraseoperationisshowninFigure 20-27.Themasserasecommand write sequence is as follows: 1. Write to a Flash array address to start the command write sequence for the mass erase command. The address and data written will be ignored. 2. Write the mass erase command, 0x41, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the mass erase command. IfaFlasharraytobeerasedcontainsanyprotectedarea,thePVIOLflagintheFSTATregisterwillsetand the mass erase command will not launch. Once the mass erase command has successfully launched, the CCIF flag in the FSTAT register will set after the mass erase operation has completed unless a new command write sequence has been buffered. 606 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Block Address 1. and Dummy Data Write: FCMD register 2. Mass Erase Command 0x41 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure20-27. Example Mass Erase Command Flow Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 607 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.1.4 Illegal Flash Operations 20.4.1.4.1 Access Error The ACCERR flag in the FSTAT register will be set during the command write sequence if any of the following illegal Flash operations are performed causing the command write sequence to immediately abort: 1. Writing to the Flash address space before initializing the FCLKDIV register 2. Writing a misaligned word or a byte to the valid Flash address space 3. Writing to the Flash address space while CBEIF is not set 4. Writing a second word to the Flash address space before executing a program or erase command on the previously written word 5. Writing to any Flash register other than FCMD after writing a word to the Flash address space 6. Writing a second command to the FCMD register before executing the previously written command 7. Writing an invalid command to the FCMD register 8. WritingtoanyFlashregisterotherthanFSTAT(toclearCBEIF)afterwritingtotheFCMDregister 9. Thepartentersstopmodeandaprogramorerasecommandisinprogress.Thecommandisaborted and any pending command is killed 10.Whensecurityisenabled,acommandotherthanmasseraseoriginatingfromanon-securememory or from the background debug mode is written to the FCMD register 11.A 0 is written to the CBEIF bit in the FSTAT register to abort a command write sequence. TheACCERRflagwillnotbesetifanyFlashregisterisreadduringthecommandwritesequence.Ifthe Flash array is read during execution of an algorithm (CCIF=0), the Flash module will return invalid data andtheACCERRflagwillnotbeset.IfanACCERRflagissetintheFSTATregister,theFlashcommand controller is locked. It is not possible to launch another command until the ACCERR flag is cleared. 20.4.1.4.2 Protection Violation ThePVIOLflagintheFSTATregisterwillbesetduringthecommandwritesequenceafterthewordwrite to the Flash address space if any of the following illegal Flash operations are performed, causing the command write sequence to immediately abort: 1. Writing a Flash address to program in a protected area of the Flash array (seeSection 20.3.2.5). 2. Writing a Flash address to erase in a protected area of the Flash array. 3. Writing the mass erase command to the FCMD register while any protection is enabled. If the PVIOL flag is set, the Flash command controller is locked. It is not possible to launch another command until the PVIOL flag is cleared. 608 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.2 Operating Modes 20.4.2.1 Wait Mode IftheMCUenterswaitmodewhileaFlashcommandisactive(CCIF=0),thatcommandandanybuffered command will be completed. TheFlashmodulecanrecovertheMCUfromwaitmodeiftheinterruptsareenabled(seeSection20.4.5). 20.4.2.2 Stop Mode IftheMCUentersstopmodewhileaFlashcommandisactive(CCIF=0),thatcommandwillbeaborted and the data being programmed or erased is lost. The high voltage circuitry to the Flash array will be switched off when entering stop mode. CCIF and ACCERR flags will be set. Upon exit from stop mode, the CBEIF flag will be set and any buffered command will not be executed. The ACCERR flag must be cleared before returning to normal operation. NOTE As active Flash commands are immediately aborted when the MCU enters stopmode,itisstronglyrecommendedthattheuserdoesnotusetheSTOP instruction during program and erase execution. 20.4.2.3 Background Debug Mode In background debug mode (BDM), the FPROT register is writable. If the MCU is unsecured, then all FlashcommandslistedinTable20-17canbeexecuted.IftheMCUissecuredandisinspecialsinglechip mode, the only possible command to execute is mass erase. 20.4.3 Flash Module Security The Flash module provides the necessary security information to the MCU. After each reset, the Flash moduledeterminesthesecuritystateoftheMCUasdefinedinSection20.3.2.2,“FlashSecurityRegister (FSEC)”. ThecontentsoftheFlashsecurity/optionsbyteataddress0xFF0FintheFlashconfigurationfieldmustbe changed directly by programming address 0xFF0F when the device is unsecured and the higher address sector is unprotected. If the Flash security/options byte is left in the secure state, any reset will cause the MCU to return to the secure operating mode. 20.4.3.1 Unsecuring the MCU using Backdoor Key Access TheMCUmayonlybeunsecuredbyusingthebackdoorkeyaccessfeaturewhichrequiresknowledgeof the contents of the backdoor key (four 16-bit words programmed at addresses 0xFF00–0xFF07). If KEYEN[1:0]= 1:0andtheKEYACCbitisset,awritetoabackdoorkeyaddressintheFlasharraytriggers acomparisonbetweenthewrittendataandthebackdoorkeydatastoredintheFlasharray.Ifallfourwords of data are written to the correct addresses in the correct order and the data matches the backdoor key stored in the Flash array, the MCU will be unsecured. The data must be written to the backdoor key Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 609 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) addressessequentiallystaringwith0xFF00-0xFF01andendingwith0xFF06–0xFF07.Thevalues0x0000 and 0xFFFF are not permitted as keys. When the KEYACC bit is set, reads of the Flash array will return invalid data. TheusercodestoredintheFlasharraymusthaveamethodofreceivingthebackdoorkeyfromanexternal stimulus. This external stimulus would typically be through one of the on-chip serial ports. If KEYEN[1:0] = 1:0 in the FSEC register, the MCU can be unsecured by the backdoor key access sequence described below: 1. Set the KEYACC bit in the FCNFG register 2. Writethecorrectfour16-bitwordstoFlashaddresses0xFF00–0xFF07sequentiallystartingwith 0xFF00 3. Clear the KEYACC bit in the FCNFG register 4. If all four 16-bit words match the backdoor key stored in Flash addresses 0xFF00–0xFF07, the MCU is unsecured and bits SEC[1:0] in the FSEC register are forced to the unsecure state of 1:0 Thebackdoorkeyaccesssequenceismonitoredbytheinternalsecuritystatemachine.Anillegaloperation duringthebackdoorkeyaccesssequencewill causethesecuritystatemachine tolock, leavingtheMCU in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and allowanewbackdoorkeyaccesssequencetobeattempted.Thefollowingillegaloperationswilllockthe security state machine: 1. If any of the four 16-bit words does not match the backdoor key programmed in the Flash array 2. If the four 16-bit words are written in the wrong sequence 3. If more than four 16-bit words are written 4. If any of the four 16-bit words written are 0x0000 or 0xFFFF 5. If the KEYACC bit does not remain set while the four 16-bit words are written After the backdoor key access sequence has been correctly matched, the MCU will be unsecured. The Flash security byte can be programmed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the four word backdoor key by programming bytes 0xFF00–0xFF07 of the Flash configuration field. The security as defined in the Flash security/options byte at address 0xFF0F is not changed by using the backdoor key access sequence to unsecure. The backdoor key stored in addresses 0xFF00–0xFF07 is unaffected by the backdoor key access sequence. After the next reset sequence, the security state of the FlashmoduleisdeterminedbytheFlashsecurity/optionsbyteataddress0xFF0F.Thebackdoorkeyaccess sequence has no effect on the program and erase protection defined in the FPROT register. ItisnotpossibletounsecuretheMCUinspecialsinglechipmodebyexecutingthebackdoorkeyaccess sequence in background debug mode. 610 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 20.4.4 Flash Reset Sequence Oneachreset,theFlashmoduleexecutesaresetsequencetoholdCPUactivitywhileloadingthefollowing registers from the Flash array memory according to Table20-1: • FPROT — Flash Protection Register (see Section 20.3.2.5) • FSEC — Flash Security Register (see Section 20.3.2.2) 20.4.4.1 Reset While Flash Command Active IfaresetoccurswhileanyFlashcommandisinprogress,thatcommandwillbeimmediatelyaborted.The state of the word being programmed or the sector/array being erased is not guaranteed. 20.4.5 Interrupts The Flash module can generate an interrupt when all Flash commands have completed execution or the Flash address, data, and command buffers are empty. Table20-18. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Address, Data, and Command CBEIF CBEIE I Bit Buffers are empty (FSTAT register) All Flash commands have completed CCIF CCIE I Bit execution (FSTAT register) NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 20.4.5.1 Description of Interrupt Operation Figure20-28 shows the logic used for generating interrupts. TheFlashmoduleusestheCBEIFandCCIFflagsincombinationwiththeenablebitsCBIEandCCIEto discriminate for the generation of interrupts. CBEIF CBEIE FLASH INTERRUPT REQUEST CCIF CCIE Figure20-28. Flash Interrupt Implementation For a detailed description of these register bits, refer to Section20.3.2.4, “Flash Configuration Register (FCNFG)” andSection20.3.2.6, “Flash Status Register (FSTAT)”. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 611 Rev 01.24

Chapter20 96 Kbyte Flash Module (S12FTS96KV1) 612 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter 21 128 Kbyte Flash Module (S12FTS128K1V1) 21.1 Introduction TheFTS128K1moduleimplementsa128KbyteFlash(nonvolatile)memory.TheFlashmemorycontains onearrayof128Kbytesorganizedas1024rowsof128byteswithanerasesectorsizeofeightrows(1024 bytes).TheFlasharraymaybereadaseitherbytes,alignedwords,ormisalignedwords.Readaccesstime is one bus cycle for byte and aligned word, and two bus cycles for misaligned words. The Flash array is ideal for program and data storage for single-supply applications allowing for field reprogramming without requiring external voltage sources for program or erase. Program and erase functionsarecontrolledbyacommanddriveninterface.TheFlashmodulesupportsbothmasseraseand sector erase. An erased bit reads 1 and a programmed bit reads 0. The high voltage required to program and erase is generated internally. It is not possible to read from a Flash array while it is being erased or programmed. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 21.1.1 Glossary CommandWriteSequence—Athree-stepMCUinstructionsequencetoprogram,erase,oreraseverify the Flash array memory. 21.1.2 Features • 128 Kbytes of Flash memory comprised of one 128 Kbyte array divided into 128 sectors of1024 bytes • Automated program and erase algorithm • Interrupts on Flash command completion and command buffer empty • Fast sector erase and word program operation • 2-stage command pipeline for faster multi-word program times • Flexible protection scheme to prevent accidental program or erase • Single power supply for Flash program and erase operations • Security feature to prevent unauthorized access to the Flash array memory Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 613 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.1.3 Modes of Operation See Section21.4.2, “Operating Modes” for a description of the Flash module operating modes. For program and erase operations, refer toSection21.4.1, “Flash Command Operations”. 21.1.4 Block Diagram Figure21-1 shows a block diagram of theFTS128K1 module. FTS128K1 Flash Interface Command Complete Command Pipeline Interrupt Flash Array cmd2 cmd1 addr2 addr1 64K * 16 Bits Command data2 data1 Buffer Empty sector 0 Interrupt sector 1 Registers Protection sector 127 Security Oscillator Clock Clock Divider FCLK Figure21-1. FTS128K1 Block Diagram 21.2 External Signal Description TheFTS128K1 module contains no signals that connect off-chip. 614 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.3 Memory Map and Registers This section describes the FTS128K1 memory map and registers. 21.3.1 Module Memory Map TheFTS128K1 memory map is shown in Figure21-2. The HCS12 architecture places the Flash array addresses between 0x4000 and 0xFFFF, which corresponds to three 16 Kbyte pages. The content of the HCS12 Core PPAGE register is used to map the logical middle page ranging from address 0x8000 to 0xBFFF to any physical 16K byte page in the Flash array memory.1 The FPROT register (seeSection 21.3.2.5) can be set to globally protect the entire Flash array. Three separate areas, one starting from the Flash array starting address (called lower) towards higher addresses, one growing downward from the Flasharrayendaddress(calledhigher),andtheremainingaddresses,canbeactivatedforprotection.The Flasharray addressescoveredbytheseprotectableregionsareshowninFigure21-2. Thehigheraddress areaismainlytargetedtoholdthebootloadercodesinceitcoversthevectorspace.Theloweraddressarea can be used for EEPROM emulation in an MCU without an EEPROM module since it can be left unprotected while the remaining addresses are protected from program or erase. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field described inTable21-1. Table21-1. Flash Configuration Field Size Flash Address Description (bytes) 0xFF00–0xFF07 8 Backdoor Key to unlock security 0xFF08–0xFF0C 5 Reserved 0xFF0D 1 Flash Protection byte Refer toSection21.3.2.5, “Flash Protection Register (FPROT)” 0xFF0E 1 Reserved 0xFF0F 1 Flash Security/Options byte Refer toSection21.3.2.2, “Flash Security Register (FSEC)” 1.Byplacing0x3E/0x3FintheHCS12CorePPAGEregister,thebottom/topfixed16KbytepagescanbeseentwiceintheMCU memory map. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 615 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) MODULE BASE + 0x0000 Flash Registers 16 bytes MODULE BASE + 0x000F FLASH_START = 0x4000 0x4400 0x4800 0x5000 Flash Protected Low Sectors 1, 2, 4, 8 Kbytes 0x6000 0x3E Flash Array 0x8000 16K PAGED MEMORY 0x38 0x39 0x3A 0x3B 0x3C 0x3D 003E 0x3F 0xC000 Flash Protected High Sectors 0xE000 0x3F 2, 4, 8, 16 Kbytes 0xF000 0xF800 FLASH_END = 0xFFFF 0xFF00–0xFF0F (Flash Configuration Field) Note: 0x38–0x3F correspond to the PPAGE register content Figure21-2. Flash Memory Map 616 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Table21-2. Flash Array Memory Map Summary MCU Address Protectable Protectable Array Relative PPAGE Range Low Range High Range Address(1) 0x0000–0x3FFF(2) Unpaged N.A. N.A. 0x14000–0x17FFF (0x3D) 0x4000–0x7FFF Unpaged 0x4000–0x43FF N.A. 0x18000–0x1BFFF (0x3E) 0x4000–0x47FF 0x4000–0x4FFF 0x4000–0x5FFF 0x8000–0xBFFF 0x38 N.A. N.A. 0x00000–0x03FFF 0x39 N.A. N.A. 0x04000–0x07FFF 0x3A N.A. N.A. 0x08000–0x0BFFF 0x3B N.A. N.A. 0x0C000–0x0FFFF 0x3C N.A. N.A. 0x10000–0x13FFF 0x3D N.A. N.A. 0x14000–0x17FFF 0x3E 0x8000–0x83FF N.A. 0x18000–0x1BFFF 0x8000–0x87FF 0x8000–0x8FFF 0x8000–0x9FFF 0x3F N.A. 0xB800–0xBFFF 0x1C000–0x1FFFF 0xB000–0xBFFF 0xA000–0xBFFF 0x8000–0xBFFF 0xC000–0xFFFF Unpaged N.A. 0xF800–0xFFFF 0x1C000–0x1FFFF (0x3F) 0xF000–0xFFFF 0xE000–0xFFFF 0xC000–0xFFFF 1. Inside Flash block. 2. If allowed by MCU. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 617 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.3.2 Register Descriptions TheFlashmodulecontainsasetof16controlandstatusregisterslocatedbetweenmodulebase+0x0000 and 0x000F. A summary of the Flash module registers is given in Figure21-3. Detailed descriptions of each register bit are provided. Register Bit 7 6 5 4 3 2 1 Bit 0 Name 0x0000 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 FCLKDIV W 0x0001 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 FSEC W 0x0002 R 0 0 0 0 0 0 0 0 RESERVED1 W (1) 0x0003 R 0 0 0 0 0 CBEIE CCIE KEYACC FCNFG W 0x0004 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 FPROT W 0x0005 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL FSTAT W 0x0006 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 FCMD W 0x0007 R 0 0 0 0 0 0 0 0 RESERVED21 W 0x0008 R FABHI FADDRHI1 W 0x0009 R FABLO FADDRLO1 W 0x000A R FDHI FDATAHI1 W 0x000B R FDLO FDATALO1 W 0x000C R 0 0 0 0 0 0 0 0 RESERVED31 W 0x000D R 0 0 0 0 0 0 0 0 RESERVED41 W 0x000E R 0 0 0 0 0 0 0 0 RESERVED51 W 0x000F R 0 0 0 0 0 0 0 0 RESERVED61 W = Unimplemented or Reserved Figure21-3. Flash Register Summary 1. Intended for factory test purposes only. 618 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Module Base + 0x0000 7 6 5 4 3 2 1 0 R FDIVLD PRDIV8 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-4. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table21-3. FCLKDIV Field Descriptions Field Description 7 Clock Divider Loaded FDIVLD 0 FCLKDIV register has not been written 1 FCLKDIV register has been written to since the last reset 6 Enable Prescalar by 8 PRDIV8 0 The oscillator clock is directly fed into the Flash clock divider 1 The oscillator clock is divided by 8 before feeding into the Flash clock divider 5–0 Clock Divider Bits— The combination of PRDIV8 and FDIV[5:0] must divide the oscillator clock down to a FDIV[5:0] frequency of 150 kHz – 200 kHz. The maximum divide ratio is 512. Refer toSection21.4.1.1, “Writing the FCLKDIV Register”for more information. 21.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Module Base + 0x0001 7 6 5 4 3 2 1 0 R KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 W Reset F F F F F F F F = Unimplemented or Reserved Figure21-5. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. The FSEC register is loaded from the Flash configuration field at 0xFF0F during the reset sequence, indicated by F inFigure21-5. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 619 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Table21-4. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of the backdoor key access KEYEN[1:0] to the Flash module as shown inTable21-5. 5–2 Nonvolatile Flag Bits — The NV[5:2] bits are available to the user as nonvolatile flags. NV[5:2] 1–0 Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown inTable21-6. If the SEC[1:0] Flash module is unsecured using backdoor key access, the SEC[1:0] bits are forced to 1:0. Table21-5. Flash KEYEN States KEYEN[1:0] Status of Backdoor Key Access 00 DISABLED 01(1) DISABLED 10 ENABLED 11 DISABLED 1. Preferred KEYEN state to disable Backdoor Key Access. Table21-6. Flash Security States SEC[1:0] Status of Security 00 Secured 01(1) Secured 10 Unsecured 11 Secured 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section21.4.3, “Flash Module Security”. 21.3.2.3 RESERVED1 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0002 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-6. RESERVED1 All bits read 0 and are not writable. 620 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.3.2.4 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash interrupts and gates the security backdoor key writes. Module Base + 0x0003 7 6 5 4 3 2 1 0 R 0 0 0 0 0 CBEIE CCIE KEYACC W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-7. Flash Configuration Register (FCNFG) CBEIE,CCIE,andKEYACCarereadableandwritablewhileremainingbitsread0andarenotwritable. KEYACC is only writable if the KEYEN bit in the FSEC register is set to the enabled state (see Section 21.3.2.2). Table21-7. FCNFG Field Descriptions Field Description 7 Command Buffer Empty Interrupt Enable — The CBEIE bit enables the interrupts in case of an empty CBEIE command buffer in the Flash module. 0 Command Buffer Empty interrupts disabled 1 An interrupt will be requested whenever the CBEIF flag is set (seeSection 21.3.2.6) 6 Command Complete Interrupt Enable — The CCIE bit enables the interrupts in case of all commands being CCIE completed in the Flash module. 0 Command Complete interrupts disabled 1 An interrupt will be requested whenever the CCIF flag is set (seeSection 21.3.2.6) 5 Enable Security Key Writing. KEYACC 0 Flash writes are interpreted as the start of a command write sequence 1 Writes to the Flash array are interpreted as a backdoor key while reads of the Flash array return invalid data 21.3.2.5 Flash Protection Register (FPROT) The FPROT register defines which Flash sectors are protected against program or erase. Module Base + 0x0004 7 6 5 4 3 2 1 0 R FPOPEN NV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 W Reset F F F F F F F F Figure21-8. Flash Protection Register (FPROT) TheFPROTregisterisreadableinnormalandspecialmodes.FPOPENcanonlybewrittenfroma1toa 0. FPLS[1:0] can be written anytime until FPLDIS is cleared. FPHS[1:0] can be written anytime until Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 621 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) FPHDISiscleared.TheFPROTregisterisloadedfromFlashaddress0xFF0Dduringtheresetsequence, indicated by F inFigure21-8. To change the Flash protection that will be loaded on reset, the upper sector of the Flash array must be unprotected, then the Flash protection byte located at Flash address 0xFF0D must be written to. A protected Flash sector is disabled by FPHDIS and FPLDIS while the size of the protected sector is defined by FPHS[1:0] and FPLS[1:0] in the FPROT register. TryingtoalteranyoftheprotectedareaswillresultinaprotectviolationerrorandthePVIOLflagwillbe set in the FSTAT register (see Section 21.3.2.6). A mass erase of the whole Flash array is only possible whenprotectionisfullydisabledbysettingtheFPOPEN,FPLDIS,andFPHDISbits.Anattempttomass erase a Flash array while protection is enabled will set the PVIOL flag in the FSTAT register. Table21-8. FPROT Field Descriptions Field Description 7 Protection Function for Program or Erase — It is possible using the FPOPEN bit to either select address FPOPEN ranges to be protected using FPHDIS, FPLDIS, FPHS[1:0] and FPLS[1:0] or to select the same ranges to be unprotected. When FPOPEN is set, FPxDIS enables the ranges to be protected, whereby clearing FPxDIS enables protection for the range specified by the corresponding FPxS[1:0] bits. When FPOPEN is cleared, FPxDIS defines unprotected ranges as specified by the corresponding FPxS[1:0] bits. In this case, setting FPxDIS enables protection. Thus the effective polarity of the FPxDIS bits is swapped by the FPOPEN bit as shown inTable21-9. This function allows the main part of the Flash array to be protected while a small range can remain unprotected for EEPROM emulation. 0 The FPHDIS and FPLDIS bits define Flash address ranges to be unprotected 1 The FPHDIS and FPLDIS bits define Flash address ranges to be protected 6 Nonvolatile Flag Bit— The NV6 bit should remain in the erased state for future enhancements. NV6 5 Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a FPHDIS protected/unprotected area in the higher space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 4–3 FlashProtectionHigherAddressSize—TheFPHS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPHS[1:0] sector as shown inTable21-10. The FPHS[1:0] bits can only be written to while the FPHDIS bit is set. 2 Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a FPLDIS protected/unprotected sector in the lower space of the Flash address map. 0 Protection/unprotection enabled 1 Protection/unprotection disabled 1–0 FlashProtectionLowerAddressSize—TheFPLS[1:0]bitsdeterminethesizeoftheprotected/unprotected FPLS[1:0] sector as shown inTable21-11. The FPLS[1:0] bits can only be written to while the FPLDIS bit is set. 622 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Table21-9. Flash Protection Function FPOPEN FPHDIS FPHS[1] FPHS[0] FPLDIS FPLS[1] FPLS[0] Function(1) 1 1 x x 1 x x No protection 1 1 x x 0 x x Protect low range 1 0 x x 1 x x Protect high range 1 0 x x 0 x x Protect high and low ranges 0 1 x x 1 x x Full Flash array protected 0 0 x x 1 x x Unprotected high range 0 1 x x 0 x x Unprotected low range 0 0 x x 0 x x Unprotected high and low ranges 1. For range sizes refer toTable21-10 andTable21-11 or . Table21-10. Flash Protection Higher Address Range FPHS[1:0] Address Range Range Size 00 0xF800–0xFFFF 2 Kbytes 01 0xF000–0xFFFF 4 Kbytes 10 0xE000–0xFFFF 8 Kbytes 11 0xC000–0xFFFF 16 Kbytes Table21-11. Flash Protection Lower Address Range FPLS[1:0] Address Range Range Size 00 0x4000–0x43FF 1 Kbyte 01 0x4000–0x47FF 2 Kbytes 10 0x4000–0x4FFF 4 Kbytes 11 0x4000–0x5FFF 8 Kbytes Figure21-9illustratesallpossibleprotectionscenarios.Althoughtheprotectionschemeisloadedfromthe Flash array after reset, it is allowed to change in normal modes. This protection scheme can be used by applicationsrequiringre-programminginsinglechipmodewhileprovidingasmuchprotectionaspossible if no re-programming is required. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 623 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) FPHDIS = 1 FPHDIS = 1 FPHDIS = 0 FPHDIS = 0 FPLDIS = 1 FPLDIS = 0 FPLDIS = 1 FPLDIS = 0 Scenario 7 6 5 4 0] 1: S[ L P F 1 = N E P O P 0] F 1: S[ H P 0xFFFF F Scenario 3 2 1 0 0] 1: S[ L P F 0 = N E P O P 0] F 1: S[ H P 0xFFFF F Protected Flash Figure21-9. Flash Protection Scenarios 21.3.2.5.1 Flash Protection Restrictions The general guideline is that protection can only be added, not removed. All valid transitions between Flash protection scenarios are specified inTable21-12. Any attempt to write an invalid scenario to the FPROT register will be ignored and the FPROT register will remain unchanged. The contents of the FPROT register reflect the active protection scenario. Table21-12. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 0 X X X X 1 X X 2 X X 3 X 4 X X 5 X X X X 624 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Table21-12. Flash Protection Scenario Transitions From To Protection Scenario(1) Protection Scenario 0 1 2 3 4 5 6 7 6 X X X X 7 X X X X X X X X 1. Allowed transitions marked with X. 21.3.2.6 Flash Status Register (FSTAT) The FSTAT register defines the status of the Flash command controller and the results of command execution. Module Base + 0x0005 7 6 5 4 3 2 1 0 R CCIF 0 BLANK DONE CBEIF PVIOL ACCERR FAIL W Reset 1 1 0 0 0 0 0 1 = Unimplemented or Reserved Figure21-10.Flash Status Register (FSTAT) In normal modes, bits CBEIF, PVIOL, and ACCERR are readable and writable, bits CCIF and BLANK arereadableandnotwritable,remainingbits,includingFAILandDONE,read0andarenotwritable.In specialmodes,FAILisreadableandwritablewhileDONEisreadablebutnotwritable.FAILmustbeclear in special modes when starting a command write sequence. Table21-13. FSTAT Field Descriptions Field Description 7 Command Buffer Empty Interrupt Flag — The CBEIF flag indicates that the address, data and command CBEIF buffersareemptysothatanewcommandwritesequencecanbestarted.TheCBEIFflagisclearedbywriting a1toCBEIF.Writinga0totheCBEIFflaghasnoeffectonCBEIF.Writinga0toCBEIFafterwritinganaligned word to the Flash address space but before CBEIF is cleared will abort a command write sequence and cause the ACCERR flag in the FSTAT register to be set. Writing a 0 to CBEIF outside of a command write sequence will not set the ACCERR flag. The CBEIF flag is used together with the CBEIE bit in the FCNFG register to generate an interrupt request (seeFigure21-26). 0 Buffers are full 1 Buffers are ready to accept a new command 6 CommandCompleteInterruptFlag—TheCCIFflagindicatesthattherearenomorecommandspending.The CCIF CCIF flag is cleared when CBEIF is clear and sets automatically upon completion of all active and pending commands. The CCIF flag does not set when an active commands completes and a pending command is fetchedfromthecommandbuffer.WritingtotheCCIFflaghasnoeffect.TheCCIFflagisusedtogetherwiththe CCIE bit in the FCNFG register to generate an interrupt request (seeFigure21-26). 0 Command in progress 1 All commands are completed Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 625 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Table21-13. FSTAT Field Descriptions Field Description 5 Protection Violation — The PVIOL flag indicates an attempt was made to program or erase an address in a PVIOL protectedFlasharraymemoryarea.ThePVIOLflagisclearedbywritinga1toPVIOL.Writinga0tothePVIOL flag has no effect on PVIOL. While PVIOL is set, it is not possible to launch another command. 0 No protection violation detected 1 Protection violation has occurred 4 AccessError—TheACCERRflagindicatesanillegalaccesstotheFlasharraycausedbyeitheraviolationof ACCERR thecommandwritesequence,issuinganillegalcommand(illegalcombinationoftheCMDBxbitsintheFCMD register)ortheexecutionofaCPUSTOPinstructionwhileacommandisexecuting(CCIF=0).TheACCERRflag isclearedbywritinga1toACCERR.Writinga0totheACCERRflaghasnoeffectonACCERR.WhileACCERR is set, it is not possible to launch another command. 0 No access error detected 1 Access error has occurred 2 Flash Array Has Been Verified as Erased — The BLANK flag indicates that an erase verify command has BLANK checked the Flash array and found it to be erased. The BLANK flag is cleared by hardware when CBEIF is cleared as part of a new valid command write sequence. Writing to the BLANK flag has no effect on BLANK. 0 If an erase verify command has been requested, and the CCIF flag is set, then a 0 in BLANK indicates the array is not erased 1 Flash array verifies as erased 1 FlagIndicatingaFailedFlashOperation—Inspecialmodes,theFAILflagwillsetiftheeraseverifyoperation FAIL fails(Flasharrayverifiedasnoterased).Writinga0totheFAILflaghasnoeffectonFAIL.TheFAILflagiscleared by writing a 1 to FAIL. While FAIL is set, it is not possible to launch another command. 0 Flash operation completed without error 1 Flash operation failed 0 Flag Indicating a Failed Operation is not Active— In special modes, the DONE flag will clear if a program, DONE erase, or erase verify operation is active. 0 Flash operation is active 1 Flash operation is not active 21.3.2.7 Flash Command Register (FCMD) The FCMD register defines the Flash commands. Module Base + 0x0006 7 6 5 4 3 2 1 0 R 0 0 0 0 CMDB6 CMDB5 CMDB2 CMDB0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-11. Flash Command Register (FCMD) Bits CMDB6, CMDB5, CMDB2, and CMDB0 are readable and writable during a command write sequence while bits 7, 4, 3, and 1 read 0 and are not writable. 626 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Table21-14. FCMD Field Descriptions Field Description 6, 5, 2, 0 ValidFlashcommandsareshowninTable21-15.Anattempttoexecuteanycommandotherthanthoselistedin CMDB[6:5] Table21-15 will set the ACCERR bit in the FSTAT register (seeSection 21.3.2.6). CMDB[2] CMDB[0] Table21-15. Valid Flash Command List CMDB NVM Command 0x05 Erase verify 0x20 Word program 0x40 Sector erase 0x41 Mass erase 21.3.2.8 RESERVED2 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x0007 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-12. RESERVED2 All bits read 0 and are not writable. 21.3.2.9 Flash Address Register (FADDR) FADDRHI and FADDRLO are the Flash address registers. \ Module Base + 0x0008 7 6 5 4 3 2 1 0 R FABHI W Reset 0 0 0 0 0 0 0 0 Figure21-13. Flash Address High Register (FADDRHI) \\ Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 627 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Module Base + 0x0009 7 6 5 4 3 2 1 0 R FABLO W Reset 0 0 0 0 0 0 0 0 Figure21-14. Flash Address Low Register (FADDRLO) In normal modes, all FABHI and FABLO bits read 0 and are not writable. In special modes, the FABHI andFABLObitsarereadableandwritable.Forsectorerase,theMCUaddressbits[9:0]areignored.For mass erase, any address within the Flash array is valid to start the command. 21.3.2.10 Flash Data Register (FDATA) FDATAHI and FDATALO are the Flash data registers. Module Base + 0x000A 7 6 5 4 3 2 1 0 R FDHI W Reset 0 0 0 0 0 0 0 0 Figure21-15. Flash Data High Register (FDATAHI) Module Base + 0x000B 7 6 5 4 3 2 1 0 R FDLO W Reset 0 0 0 0 0 0 0 0 Figure21-16. Flash Data Low Register (FDATALO) In normal modes, all FDATAHI and FDATALO bits read 0 and are not writable. In special modes, all FDATAHI and FDATALO bits are readable and writable when writing to an address within the Flash address range. 21.3.2.11 RESERVED3 This register is reserved for factory testing and is not accessible to the user. 628 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Module Base + 0x000C 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-17. RESERVED3 All bits read 0 and are not writable. 21.3.2.12 RESERVED4 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000D 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-18. RESERVED4 All bits read 0 and are not writable. 21.3.2.13 RESERVED5 This register is reserved for factory testing and is not accessible to the user. Module Base + 0x000E 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-19. RESERVED5 All bits read 0 and are not writable. 21.3.2.14 RESERVED6 This register is reserved for factory testing and is not accessible to the user. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 629 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) Module Base + 0x000F 7 6 5 4 3 2 1 0 R 0 0 0 0 0 0 0 0 W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure21-20. RESERVED6 All bits read 0 and are not writable. 21.4 Functional Description 21.4.1 Flash Command Operations Writeoperationsareusedfortheprogram,erase,anderaseverifyalgorithmsdescribedinthissection.The programanderasealgorithmsarecontrolledbyastatemachinewhosetimebaseFCLKisderivedfromthe oscillator clock via a programmable divider. The FCMD register as well as the associated FADDR and FDATAregistersoperateasabufferandaregister(2-stageFIFO)sothatanewcommandalongwiththe necessarydataandaddresscanbestoredtothebufferwhilethepreviouscommandisstillinprogress.This pipelinedoperationallowsatimeoptimizationwhenprogrammingmorethanonewordonaspecificrow, asthehighvoltagegenerationcanbekeptactiveinbetweentwoprogrammingcommands.Thepipelined operation also allows a simplification of command launching. Buffer empty as well as command completion are signalled by flags in the FSTAT register with corresponding interrupts generated, if enabled. The next sections describe: • How to write the FCLKDIV register • Command write sequence used to program, erase or erase verify the Flash array • Valid Flash commands • Errors resulting from illegal Flash operations 21.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash command after a reset, it is first necessary to write the FCLKDIV register to divide the oscillator clock down to within the 150-kHz to 200-kHz range. Since the program and erase timingsarealsoafunctionofthebusclock,theFCLKDIVdeterminationmusttakethisinformationinto account. If we define: • FCLK as the clock of the Flash timing control block • Tbus as the period of the bus clock • INT(x) as taking the integer part of x (e.g., INT(4.323) = 4), 630 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) then FCLKDIV register bits PRDIV8 and FDIV[5:0] are to be set as described in Figure 21-21. For example, if the oscillator clock frequency is 950 kHz and the bus clock is 10 MHz, FCLKDIV bits FDIV[5:0]shouldbesetto4(000100)andbitPRDIV8setto0.TheresultingFCLKisthen190kHz.As a result, the Flash algorithm timings are increased over optimum target by: (200–190)⁄200×100 = 5% Command execution time will increase proportionally with the period of FCLK. CAUTION Because of the impact of clock synchronization on the accuracy of the functional timings, programming or erasing the Flash array cannot be performedifthebusclockrunsatlessthan1MHz.Programmingorerasing the Flash array with an input clock < 150 kHz should be avoided. Setting FCLKDIVtoavaluesuchthatFCLK<150kHzcandestroytheFlasharray duetooverstress.SettingFCLKDIVtoavaluesuchthat(1/FCLK+Tbus) < 5µs can result in incomplete programming or erasure of the Flash array cells. If the FCLKDIV register is written, the bit FDIVLD is set automatically. If the FDIVLD bit is 0, the FCLKDIVregisterhasnotbeenwrittensincethelastreset.IftheFCLKDIVregisterhasnotbeenwritten to, the Flash command loaded during a command write sequence will not execute and the ACCERR flag in the FSTAT register will set. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 631 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) START no Tbus < 1µs? ALL COMMANDS IMPOSSIBLE yes PRDIV8=0 (reset) oscillator_clock no 12.8MHz? yes PRDIV8=1 PRDCLK=oscillator_clock PRDCLK=oscillator_clock/8 no PRDCLK[MHz]*(5+Tbus[µs]) an integer? FDIV[5:0]=INT(PRDCLK[MHz]*(5+Tbus[µs])) yes FDIV[5:0]=PRDCLK[MHz]*(5+Tbus[µs])-1 TRY TO DECREASE Tbus FCLK=(PRDCLK)/(1+FDIV[5:0]) yes 1/FCLK[MHz] + Tbus[µs] > 5 END AND FCLK > 0.15MHz ? no yes FDIV[5:0] > 4? no ALL COMMANDS IMPOSSIBLE Figure21-21. PRDIV8 and FDIV Bits Determination Procedure 632 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.1.2 Command Write Sequence The Flash command controller is used to supervise the command write sequence to execute program, erase, and erase verify algorithms. Beforestartingacommandwritesequence,theACCERRandPVIOLflagsintheFSTATregistermustbe clearandtheCBEIFflagshouldbetestedtodeterminethestateoftheaddress,data,andcommandbuffers. If the CBEIF flag is set, indicating the buffers are empty, a new command write sequence can be started. If the CBEIF flag is clear, indicating the buffers are not available, a new command write sequence will overwrite the contents of the address, data, and command buffers. A command write sequence consists of three steps which must be strictly adhered to with writes to the Flashmodulenotpermittedbetweenthesteps.However,Flashregisterandarrayreadsareallowedduring a command write sequence. The basic command write sequence is as follows: 1. Write to a valid address in the Flash array memory. 2. Write a valid command to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the command. The address written in step 1 will be stored in the FADDR registers and the data will be stored in the FDATAregisters.WhentheCBEIFflagisclearedinstep3,theCCIFflagisclearedbytheFlashcommand controllerindicatingthatthecommandwassuccessfullylaunched.Forallcommandwritesequences,the CBEIF flag will set after the CCIF flag is cleared indicating that the address, data, and command buffers are ready for a new command write sequence to begin. A buffered command will wait for the active operation to be completed before being launched. Once a command is launched, the completion of the commandoperationisindicatedbythesettingoftheCCIFflagintheFSTATregister.TheCCIFflagwill set upon completion of all active and buffered commands. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 633 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.1.3 Valid Flash Commands Table21-16 summarizes the valid Flash commands along with the effects of the commands on the Flash array. Table21-16. Valid Flash Commands FCMD Meaning Function on Flash Array 0x05 Erase Verify all bytes in the Flash array are erased. Verify IftheFlasharrayiserased,theBLANKbitwillsetintheFSTATregisteruponcommandcompletion. 0x20 Program Program a word (2 bytes) in the Flash array. 0x40 Sector Erase all1024 bytes in a sector of the Flash array. Erase 0x41 Mass Erase all bytes in the Flash array. Erase A mass erase of the full Flash array is only possible whenFPLDIS,FPHDIS, and FPOPEN bits in the FPROT register are set prior to launching the command. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. 634 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.1.3.1 Erase Verify Command The erase verify operation will verify that a Flash array is erased. AnexampleflowtoexecutetheeraseverifyoperationisshowninFigure21-22.Theeraseverifycommand write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheeraseverifycommand. The address and data written will be ignored. 2. Write the erase verify command, 0x05, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the erase verify command. Afterlaunchingtheeraseverifycommand,theCCIFflagintheFSTATregisterwillsetaftertheoperation has completed unless a new command write sequence has been buffered. Upon completion of the erase verify operation, the BLANK flag in the FSTAT register will be set if all addresses in the Flash array are verifiedtobeerased.IfanyaddressintheFlasharrayisnoterased,theeraseverifyoperationwillterminate and the BLANK flag in the FSTAT register will remain clear. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 635 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Array Address 1. and Dummy Data Write: FCMD register 2. Erase Verify Command 0x05 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes Erase Verify BLANK no Status Set? yes Flash Array Flash Array EXIT EXIT Erased Not Erased Figure21-22. Example Erase Verify Command Flow 636 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.1.3.2 Program Command The program operation will program a previously erased word in the Flash array using an embedded algorithm. AnexampleflowtoexecutetheprogramoperationisshowninFigure21-23.Theprogramcommandwrite sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequencefortheprogramcommand.The data written will be programmed to the Flash array address written. 2. Write the program command, 0x20, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the program command. IfawordtobeprogrammedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister willsetandtheprogramcommandwillnotlaunch.Oncetheprogramcommandhassuccessfullylaunched, the CCIF flag in the FSTAT register will set after the program operation has completed unless a new command write sequence has been buffered. By executing a new program command write sequence on sequentialwordsaftertheCBEIFflagintheFSTATregisterhasbeenset,upto55%fasterprogramming time per word can be effectively achieved than by waiting for the CCIF flag to set after each program operation. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 637 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Address 1. and program Data Write: FCMD register 2. Program Command 0x20 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CBEIF no Buffer Empty Set? Check yes Sequential Programming Next yes Decision Word? no Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure21-23. Example Program Command Flow 638 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.1.3.3 Sector Erase Command The sector erase operation will erase all addresses in a 1024 byte sector of the Flash array using an embedded algorithm. An example flow to execute the sector erase operation is shown in Figure 21-24. The sector erase command write sequence is as follows: 1. WritetoaFlasharrayaddresstostartthecommandwritesequenceforthesectorerasecommand. TheFlashaddresswrittendeterminesthesectortobeerasedwhileMCUaddressbits[9:0]andthe data written are ignored. 2. Write the sector erase command, 0x40, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the sector erase command. IfaFlashsectortobeerasedisinaprotectedareaoftheFlasharray,thePVIOLflagintheFSTATregister will set and the sector erase command will not launch. Once the sector erase command has successfully launched,theCCIFflagintheFSTATregisterwillsetafterthesectoreraseoperationhascompletedunless a new command write sequence has been buffered. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 639 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Sector Address 1. and Dummy Data Write: FCMD register 2. Sector Erase Command 0x40 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure21-24. Example Sector Erase Command Flow 640 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.1.3.4 Mass Erase Command The mass erase operation will erase all addresses in a Flash array using an embedded algorithm. AnexampleflowtoexecutethemasseraseoperationisshowninFigure 21-25.Themasserasecommand write sequence is as follows: 1. Write to a Flash array address to start the command write sequence for the mass erase command. The address and data written will be ignored. 2. Write the mass erase command, 0x41, to the FCMD register. 3. Clear the CBEIF flag in the FSTAT register by writing a 1 to CBEIF to launch the mass erase command. IfaFlasharraytobeerasedcontainsanyprotectedarea,thePVIOLflagintheFSTATregisterwillsetand the mass erase command will not launch. Once the mass erase command has successfully launched, the CCIF flag in the FSTAT register will set after the mass erase operation has completed unless a new command write sequence has been buffered. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 641 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) START Read: FCLKDIV register CWloricttke nRegister FDSIeVtL?D no NbeO sTeEt :o FnCceL KaDfteIVr enaecehd sre tsoet. Check yes Write: FCLKDIV register Read: FSTAT register Address, Data, Command CBEIF no Set? Buffer Empty Check yes Access Error and ACCERR/ yes Write: FSTAT register Protection Violation PVIOL Clear ACCERR/PVIOL 0x30 Check Set? no Write: Flash Block Address 1. and Dummy Data Write: FCMD register 2. Mass Erase Command 0x41 Write: FSTAT register 3. Clear CBEIF 0x80 Read: FSTAT register Bit Polling for CCIF no Command Completion Set? Check yes EXIT Figure21-25. Example Mass Erase Command Flow 642 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.1.4 Illegal Flash Operations 21.4.1.4.1 Access Error The ACCERR flag in the FSTAT register will be set during the command write sequence if any of the following illegal Flash operations are performed causing the command write sequence to immediately abort: 1. Writing to the Flash address space before initializing the FCLKDIV register 2. Writing a misaligned word or a byte to the valid Flash address space 3. Writing to the Flash address space while CBEIF is not set 4. Writing a second word to the Flash address space before executing a program or erase command on the previously written word 5. Writing to any Flash register other than FCMD after writing a word to the Flash address space 6. Writing a second command to the FCMD register before executing the previously written command 7. Writing an invalid command to the FCMD register 8. WritingtoanyFlashregisterotherthanFSTAT(toclearCBEIF)afterwritingtotheFCMDregister 9. Thepartentersstopmodeandaprogramorerasecommandisinprogress.Thecommandisaborted and any pending command is killed 10.Whensecurityisenabled,acommandotherthanmasseraseoriginatingfromanon-securememory or from the background debug mode is written to the FCMD register 11.A 0 is written to the CBEIF bit in the FSTAT register to abort a command write sequence. TheACCERRflagwillnotbesetifanyFlashregisterisreadduringthecommandwritesequence.Ifthe Flash array is read during execution of an algorithm (CCIF=0), the Flash module will return invalid data andtheACCERRflagwillnotbeset.IfanACCERRflagissetintheFSTATregister,theFlashcommand controller is locked. It is not possible to launch another command until the ACCERR flag is cleared. 21.4.1.4.2 Protection Violation ThePVIOLflagintheFSTATregisterwillbesetduringthecommandwritesequenceafterthewordwrite to the Flash address space if any of the following illegal Flash operations are performed, causing the command write sequence to immediately abort: 1. Writing a Flash address to program in a protected area of the Flash array (seeSection 21.3.2.5). 2. Writing a Flash address to erase in a protected area of the Flash array. 3. Writing the mass erase command to the FCMD register while any protection is enabled. If the PVIOL flag is set, the Flash command controller is locked. It is not possible to launch another command until the PVIOL flag is cleared. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 643 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.2 Operating Modes 21.4.2.1 Wait Mode IftheMCUenterswaitmodewhileaFlashcommandisactive(CCIF=0),thatcommandandanybuffered command will be completed. TheFlashmodulecanrecovertheMCUfromwaitmodeiftheinterruptsareenabled(seeSection21.4.5). 21.4.2.2 Stop Mode IftheMCUentersstopmodewhileaFlashcommandisactive(CCIF=0),thatcommandwillbeaborted and the data being programmed or erased is lost. The high voltage circuitry to the Flash array will be switched off when entering stop mode. CCIF and ACCERR flags will be set. Upon exit from stop mode, the CBEIF flag will be set and any buffered command will not be executed. The ACCERR flag must be cleared before returning to normal operation. NOTE As active Flash commands are immediately aborted when the MCU enters stopmode,itisstronglyrecommendedthattheuserdoesnotusetheSTOP instruction during program and erase execution. 21.4.2.3 Background Debug Mode In background debug mode (BDM), the FPROT register is writable. If the MCU is unsecured, then all FlashcommandslistedinTable21-16canbeexecuted.IftheMCUissecuredandisinspecialsinglechip mode, the only possible command to execute is mass erase. 21.4.3 Flash Module Security The Flash module provides the necessary security information to the MCU. After each reset, the Flash moduledeterminesthesecuritystateoftheMCUasdefinedinSection21.3.2.2,“FlashSecurityRegister (FSEC)”. ThecontentsoftheFlashsecurity/optionsbyteataddress0xFF0FintheFlashconfigurationfieldmustbe changed directly by programming address 0xFF0F when the device is unsecured and the higher address sector is unprotected. If the Flash security/options byte is left in the secure state, any reset will cause the MCU to return to the secure operating mode. 21.4.3.1 Unsecuring the MCU using Backdoor Key Access TheMCUmayonlybeunsecuredbyusingthebackdoorkeyaccessfeaturewhichrequiresknowledgeof the contents of the backdoor key (four 16-bit words programmed at addresses 0xFF00–0xFF07). If KEYEN[1:0]= 1:0andtheKEYACCbitisset,awritetoabackdoorkeyaddressintheFlasharraytriggers acomparisonbetweenthewrittendataandthebackdoorkeydatastoredintheFlasharray.Ifallfourwords of data are written to the correct addresses in the correct order and the data matches the backdoor key stored in the Flash array, the MCU will be unsecured. The data must be written to the backdoor key 644 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) addressessequentiallystaringwith0xFF00-0xFF01andendingwith0xFF06–0xFF07.Thevalues0x0000 and 0xFFFF are not permitted as keys. When the KEYACC bit is set, reads of the Flash array will return invalid data. TheusercodestoredintheFlasharraymusthaveamethodofreceivingthebackdoorkeyfromanexternal stimulus. This external stimulus would typically be through one of the on-chip serial ports. If KEYEN[1:0] = 1:0 in the FSEC register, the MCU can be unsecured by the backdoor key access sequence described below: 1. Set the KEYACC bit in the FCNFG register 2. Writethecorrectfour16-bitwordstoFlashaddresses0xFF00–0xFF07sequentiallystartingwith 0xFF00 3. Clear the KEYACC bit in the FCNFG register 4. If all four 16-bit words match the backdoor key stored in Flash addresses 0xFF00–0xFF07, the MCU is unsecured and bits SEC[1:0] in the FSEC register are forced to the unsecure state of 1:0 Thebackdoorkeyaccesssequenceismonitoredbytheinternalsecuritystatemachine.Anillegaloperation duringthebackdoorkeyaccesssequencewill causethesecuritystatemachine tolock, leavingtheMCU in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and allowanewbackdoorkeyaccesssequencetobeattempted.Thefollowingillegaloperationswilllockthe security state machine: 1. If any of the four 16-bit words does not match the backdoor key programmed in the Flash array 2. If the four 16-bit words are written in the wrong sequence 3. If more than four 16-bit words are written 4. If any of the four 16-bit words written are 0x0000 or 0xFFFF 5. If the KEYACC bit does not remain set while the four 16-bit words are written After the backdoor key access sequence has been correctly matched, the MCU will be unsecured. The Flash security byte can be programmed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the four word backdoor key by programming bytes 0xFF00–0xFF07 of the Flash configuration field. The security as defined in the Flash security/options byte at address 0xFF0F is not changed by using the backdoor key access sequence to unsecure. The backdoor key stored in addresses 0xFF00–0xFF07 is unaffected by the backdoor key access sequence. After the next reset sequence, the security state of the FlashmoduleisdeterminedbytheFlashsecurity/optionsbyteataddress0xFF0F.Thebackdoorkeyaccess sequence has no effect on the program and erase protection defined in the FPROT register. ItisnotpossibletounsecuretheMCUinspecialsinglechipmodebyexecutingthebackdoorkeyaccess sequence in background debug mode. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 645 Rev 01.24

Chapter21 128 Kbyte Flash Module (S12FTS128K1V1) 21.4.4 Flash Reset Sequence Oneachreset,theFlashmoduleexecutesaresetsequencetoholdCPUactivitywhileloadingthefollowing registers from the Flash array memory according to Table21-1: • FPROT — Flash Protection Register (see Section 21.3.2.5) • FSEC — Flash Security Register (see Section 21.3.2.2) 21.4.4.1 Reset While Flash Command Active IfaresetoccurswhileanyFlashcommandisinprogress,thatcommandwillbeimmediatelyaborted.The state of the word being programmed or the sector/array being erased is not guaranteed. 21.4.5 Interrupts The Flash module can generate an interrupt when all Flash commands have completed execution or the Flash address, data, and command buffers are empty. Table21-17. Flash Interrupt Sources Interrupt Source Interrupt Flag Local Enable Global (CCR) Mask Flash Address, Data, and Command CBEIF CBEIE I Bit Buffers are empty (FSTAT register) All Flash commands have completed CCIF CCIE I Bit execution (FSTAT register) NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 21.4.5.1 Description of Interrupt Operation Figure21-26 shows the logic used for generating interrupts. TheFlashmoduleusestheCBEIFandCCIFflagsincombinationwiththeenablebitsCBIEandCCIEto discriminate for the generation of interrupts. CBEIF CBEIE FLASH INTERRUPT REQUEST CCIF CCIE Figure21-26. Flash Interrupt Implementation For a detailed description of these register bits, refer to Section21.3.2.4, “Flash Configuration Register (FCNFG)” andSection21.3.2.6, “Flash Status Register (FSTAT)”. 646 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics Appendix A Electrical Characteristics A.1 General NOTE The electrical characteristics given in this section are preliminary and should be used as a guide only. Values cannot be guaranteed by Freescale and are subject to change without notice. The parts are specified and tested over the 5V and 3.3V ranges. For the intermediaterange,generallytheelectricalspecificationsforthe3.3Vrange apply, but the parts are not tested in production test in the intermediate range. This supplement contains the most accurate electrical information for the MC9S12C-Family / MC9S12GC-Family microcontrollers available at the time of publication. The information should be consideredPRELIMINARY and is subject to change. This introduction is intended to give an overview on several common topics like power supply, current injection etc. A.1.1 Parameter Classification The electrical parameters shown in this supplement are guaranteed by various methods. To give the customer a better understanding the following classification is used and the parameters are tagged accordingly in the tables where appropriate. NOTE This classification will be added at a later release of the specification P: Those parameters are guaranteed during production testing on each individual device. C: Those parameters are achieved by the design characterization by measuring a statistically relevant sample size across process variations. They are regularly verified by production monitors. T: Those parameters are achieved by design characterization on a small sample size from typical devices. All values shown in the typical column are within this category. D: Those parameters are derived mainly from simulations. A.1.2 Power Supply The MC9S12C-Family / MC9S12GC-Family and MC9S12GC Family members utilize several pins to supply power to the I/O ports, A/D converter, oscillator and PLL as well as the internal logic. The V , V pair supplies the A/D converter. DDA SSA The V , V pair supplies the I/O pins DDX SSX The V , V pair supplies the internal voltage regulator. DDR SSR Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 647 Rev 01.24

AppendixA Electrical Characteristics V , V , V and V are the supply pins for the digital logic. DD1 SS1 DD2 SS2 V , V supply the oscillator and the PLL. DDPLL SSPLL V and V are internally connected by metal. SS1 SS2 V and V are internally connected by metal. DD1 DD2 V , V , V as well as V , V V are connected by anti-parallel diodes for ESD DDA DDX DDR SSA SSX, SSR protection. NOTE InthefollowingcontextVDD5isusedforeitherV ,V ,andV ; DDA DDR DDX V is used for either V , V , and V unless otherwise noted. SS5 SSA SSR SSX IDD5 denotes the sum of the currents flowing into the V , V , and DDA DDX V pins. DDR V isusedforV ,V ,andV ,V isusedforV ,V ,and DD DD1 DD2 DDPLL SS SS1 SS2 V . SSPLL I is used for the sum of the currents flowing into V and V . DD DD1 DD2 A.1.3 Pins There are four groups of functional pins. A.1.3.1 5V I/O Pins ThoseI/Opinshaveanominallevelof5V.ThisclassofpinsiscomprisedofallportI/Opins,theanalog inputs, BKGD pin, and the RESET inputs.The internal structure of all those pins is identical; however someofthefunctionalitymaybedisabled.Forexample,pull-upandpull-downresistorsmaybedisabled permanently. A.1.3.2 Analog Reference This class is made up by the two V and V pins. In 48- and 52-pin package versions the V pad is RH RL RL bonded to the V pin. SSA A.1.3.3 Oscillator ThepinsXFC,EXTAL,XTALdedicatedtotheoscillatorhaveanominal2.5Vlevel.Theyaresuppliedby V . DDPLL A.1.3.4 TEST This pin is used for production testing only. A.1.4 Current Injection Power supply must maintain regulation within operating V or V range during instantaneous and DD5 DD operatingmaximumcurrentconditions.Ifpositiveinjectioncurrent(V >V )isgreaterthanI ,the in DD5 DD5 648 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics injectioncurrentmayflowoutofV andcouldresultinexternalpowersupplygoingoutofregulation. DD5 Insure external V load will shunt current greater than maximum injection current. This will be the DD5 greatestriskwhentheMCUisnotconsumingpower;e.g.ifnosystemclockispresent,orifclockrateis very low which would reduce overall power consumption. A.1.5 Absolute Maximum Ratings Absolutemaximumratingsarestressratingsonly.Afunctionaloperationunderoroutsidethosemaxima isnotguaranteed.Stressbeyondthoselimitsmayaffectthereliabilityorcausepermanentdamageofthe device. This device contains circuitry protecting against damage due to high static voltage or electrical fields; however, it is advised that normal precautions be taken to avoid application of any voltages higher than maximum-rated voltages to this high-impedance circuit. Reliability of operation is enhanced if unused inputs are tied to an appropriate logic voltage level (e.g., either V or V ). SS5 DD5 TableA-1. Absolute Maximum Ratings Num Rating Symbol Min Max Unit 1 I/O, Regulator and Analog Supply Voltage V –0.3 6.5 V DD5 2 Digital Logic Supply Voltage(1) V –0.3 3.0 V DD 3 PLL Supply Voltage1 V –0.3 3.0 V DDPLL 4 Voltage difference V to V and V ∆ –0.3 0.3 V DDX DDR DDA VDDX 5 Voltage difference V to V and V ∆ –0.3 0.3 V SSX SSR SSA VSSX 6 Digital I/O Input Voltage V –0.3 6.5 V IN 7 Analog Reference V V –0.3 6.5 V RH, RL 8 XFC, EXTAL, XTAL inputs V –0.3 3.0 V ILV 9 TEST input V –0.3 10.0 V TEST Instantaneous Maximum Current 10 I –25 +25 mA Single pin limit for all digital I/O pins(2) D Instantaneous Maximum Current 11 I –25 +25 mA Single pin limit for XFC, EXTAL, XTAL(3) DL Instantaneous Maximum Current 12 I –0.25 0 mA Single pin limit for TEST(4) DT 13 Operating Temperature Range (packaged) T – 40 125 °C A 14 Operating Temperature Range (junction) T – 40 140 °C J 15 Storage Temperature Range T – 65 155 °C stg 1. The device contains an internal voltage regulator to generate the logic and PLL supply out of the I/O supply. The absolute maximum ratings apply when the device is powered from an external source. 2. All digital I/O pins are internally clamped to V and V , V and V or V and V . SSX DDX SSR DDR SSA DDA 3. These pins are internally clamped to V and V SSPLL DDPLL 4. This pin is clamped low to V , but not clamped high. This pin must be tied low in applications. SSX Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 649 Rev 01.24

AppendixA Electrical Characteristics A.1.6 ESD Protection and Latch-up Immunity All ESD testing is in conformity with CDF-AEC-Q100 Stress test qualification for Automotive Grade Integrated Circuits. During the device qualification ESD stresses were performed for the Human Body Model (HBM), the Machine Model (MM) and the Charge Device Model. AdevicewillbedefinedasafailureifafterexposuretoESDpulsesthedevicenolongermeetsthedevice specification. Complete DC parametric and functional testing is performed per the applicable device specification at room temperature followed by hot temperature, unless specified otherwise in the device specification. TableA-2. ESD and Latch-up Test Conditions Model Description Symbol Value Unit Human Body Series Resistance R1 1500 Ohm Storage Capacitance C 100 pF Number of Pulse per pin Positive — 3 Negative — 3 Machine Series Resistance R1 0 Ohm Storage Capacitance C 200 pF Number of Pulse per pin Positive — 3 Negative — 3 Latch-up Minimum input voltage limit — –2.5 V Maximum input voltage limit — 7.5 V TableA-3. ESD and Latch-Up Protection Characteristics Num C Rating Symbol Min Max Unit 1 C Human Body Model (HBM) V 2000 — V HBM 2 C Machine Model (MM) V 200 — V MM 3 C Charge Device Model (CDM) V 500 — V CDM Latch-up Current at 125°C 4 C Positive I +100 — mA LAT Negative –100 — Latch-up Current at 27°C 5 C Positive I +200 — mA LAT Negative –200 — 650 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics A.1.7 Operating Conditions This chapter describes the operating conditions of the devices. Unless otherwise noted those conditions apply to all the following data. NOTE Instead of specifying ambient temperature all parameters are specified for the more meaningful silicon junction temperature. For power dissipation calculations refer toSectionA.1.8, “Power Dissipation and Thermal Characteristics” . TableA-4. Operating Conditions Rating Symbol Min Typ Max Unit I/O, Regulator and Analog Supply Voltage V 2.97 5 5.5 V DD5 Digital Logic Supply Voltage(1) V 2.35 2.5 2.75 V DD PLL Supply Voltage1 V 2.35 2.5 2.75 V DDPLL Voltage Difference V to V ∆ –0.1 0 0.1 V DDX DDA VDDX Voltage Difference V to V and V ∆ –0.1 0 0.1 V SSX SSR SSA VSSX Bus Frequency f (2) 0.25 — 25 MHz bus Bus Frequency f (3) 0.25 — 16 MHz bus Operating Junction Temperature Range T –40 — 140 °C J 1. The device contains an internal voltage regulator to generate the logic and PLL supply out of the I/O supply. The operating conditions apply when this regulator is disabled and the device is powered from an external source. Using an external regulator, with the internal voltage regulator disabled, an external LVR must be provided. 2. Some blocks e.g. ATD (conversion) and NVMs (program/erase) require higher bus frequencies for proper operation. 3. Some blocks e.g. ATD (conversion) and NVMs (program/erase) require higher bus frequencies for proper operation. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 651 Rev 01.24

AppendixA Electrical Characteristics A.1.8 Power Dissipation and Thermal Characteristics Powerdissipationandthermalcharacteristicsarecloselyrelated.Theusermustassurethatthemaximum operating junction temperature is not exceeded. The average chip-junction temperature (T ) in°C can be J obtained from: T = T +(P •Θ ) J A D JA T = Junction Temperature, [°C] J T = Ambient Temperature, [°C] A P = Total Chip Power Dissipation, [W] D Θ = Package Thermal Resistance, [°C/W] JA The total power dissipation can be calculated from: P = P +P D INT IO P = Chip Internal Power Dissipation, [W] INT Two cases with internal voltage regulator enabled and disabled must be considered: 1. Internal Voltage Regulator disabled P = I ⋅V +I ⋅V +I ⋅V INT DD DD DDPLL DDPLL DDA DDA ∑ 2 P = R ⋅I IO DSON IO i i Which is the sum of all output currents on I/O ports associated with V and V . DDX DDM For R is valid: DSON V OL R = ------------;for outputs driven low DSON I OL respectively V –V DD5 OH R = ------------------------------------;for outputs driven high DSON I OH 2. Internal voltage regulator enabled P = I ⋅V +I ⋅V INT DDR DDR DDA DDA I is the current shown in TableA-8 and not the overall current flowing into VDDR, which DDR additionally contains the current flowing into the external loads with output high. ∑ 2 P = R ⋅I IO DSON IO i i Which is the sum of all output currents on I/O ports associated with V and V . DDX DDR 652 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics TableA-5. Thermal Package Characteristics(1) Num C Rating Symbol Min Typ Max Unit 1 T Thermal Resistance LQFP48, single layer PCB(2) θ — — 69 oC/W JA Thermal Resistance LQFP48, double sided PCB 2 T θ — — 53 oC/W with 2 internal planes(3) JA 3 T Junction to Board LQFP48 θ — — 30 oC/W JB 4 T Junction to Case LQFP48 θ — — 20 oC/W JC 5 T Junction to Package Top LQFP48 Ψ — — 4 oC/W JT 6 T Thermal Resistance LQFP52, single sided PCB θ — — 65 oC/W JA Thermal Resistance LQFP52, double sided PCB 7 T θ — — 49 oC/W with 2 internal planes JA 8 T Junction to Board LQFP52 θ — — 31 oC/W JB 9 T Junction to Case LQFP52 θ — — 17 oC/W JC 10 T Junction to Package Top LQFP52 Ψ — — 3 oC/W JT 11 T Thermal Resistance QFP 80, single sided PCB θ — — 52 oC/W JA Thermal Resistance QFP 80, double sided PCB 12 T θ — — 42 oC/W with 2 internal planes JA 13 T Junction to Board QFP80 θ — — 28 oC/W JB 14 T Junction to Case QFP80 θ — — 18 oC/W JC 15 T Junction to Package Top QFP80 Ψ — — 4 oC/W JT 1. The values for thermal resistance are achieved by package simulations 2. PC Board according to EIA/JEDEC Standard 51-2 3. PC Board according to EIA/JEDEC Standard 51-7 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 653 Rev 01.24

AppendixA Electrical Characteristics A.1.9 I/O Characteristics ThissectiondescribesthecharacteristicsofallI/Opins.Allparametersarenotalwaysapplicable,e.g.not all pins feature pull up/down resistances. TableA-6. 5V I/O Characteristics Conditions are 4.5< V <5.5V Temperature from –40˚C to +140˚C, unless otherwise noted DDX Num C Rating Symbol Min Typ Max Unit 1 P Input High Voltage V 0.65*V — — V IH DD5 T Input High Voltage V — — V + 0.3 V IH DD5 2 P Input Low Voltage V — — 0.35*V V IL DD5 T Input Low Voltage V V - 0.3 — — V IL SS5 3 C Input Hysteresis V 250 — mV HYS Input Leakage Current (pins in high ohmic input mode)(1) 4 P I — — 1 µA V = V or V in in DD5 SS5 Output High Voltage (pins in output mode) 5 C V V – 0.8 — — V Partial Drive IOH= –2mA OH DD5 Output High Voltage (pins in output mode) 6 P V V – 0.8 — — V Full Drive I = –10mA OH DD5 OH Output Low Voltage (pins in output mode) 7 C V — — 0.8 V Partial Drive I = +2mA OL OL Output Low Voltage (pins in output mode) 8 P V — — 0.8 V Full Drive IOL= +10mA OL Internal Pull Up Device Current, 9 P I — — –130 µA tested at V Max. PUL IL Internal Pull Up Device Current, 10 C I –10 — — µA tested at V Min. PUH IH Internal Pull Down Device Current, 11 P I — — 130 µA tested at V Min. PDH IH Internal Pull Down Device Current, 12 C I 10 — — µA tested at V Max. PDL IL 13 D Input Capacitance C — 7 — pf in Injection current(2) 14 T Single Pin limit I –2.5 — 2.5 mΑ ICS Total Device Limit. Sum of all injected currents I –25 — 25 ICP 15 P Port P, J Interrupt Input Pulse filtered(3) t — — 3 µs PIGN 16 P Port P, J Interrupt Input Pulse passed3 t 10 — — µs PVAL 1.Maximumleakagecurrentoccursatmaximumoperatingtemperature.Currentdecreasesbyapproximatelyone-halfforeach 8C to 12C in the tempearture range from 50C to 125C. 2. Refer toSectionA.1.4, “Current Injection”, for more details 3. Parameter only applies in STOP or Pseudo STOP mode. 654 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics TableA-7. 3.3V I/O Characteristics Conditions are V =3.3V +/-10%, Temperature from –40˚C to +140˚C, unless otherwise noted DDX Num C Rating Symbol Min Typ Max Unit 1 P Input High Voltage V 0.65*V — — V IH DD5 T Input High Voltage V — — V + 0.3 V IH DD5 2 P Input Low Voltage V — — 0.35*V V IL DD5 T Input Low Voltage V V – 0.3 — — V IL SS5 3 C Input Hysteresis V — 250 — mV HYS Input Leakage Current (pins in high ohmic input mode)(1) 4 P I –1 — 1 µA V = V or V in in DD5 SS5 Output High Voltage (pins in output mode) 5 C V V – 0.4 — — V Partial Drive IOH= –0.75mA OH DD5 Output High Voltage (pins in output mode) 6 P V V – 0.4 — — V Full Drive IOH= –4mA OH DD5 Output Low Voltage (pins in output mode) 7 C V — — 0.4 V Partial Drive IOL= +0.9mA OL Output Low Voltage (pins in output mode) 8 P V — — 0.4 V Full Drive IOL= +4.75mA OL 9 P Internal Pull Up Device Current, tested at V Max. I — — –60 µA IL PUL 10 C Internal Pull Up Device Current, tested at V Min. I -6 — — µA IH PUH 11 P Internal Pull Down Device Current, tested at V Min. I — — 60 µA IH PDH 12 C Internal Pull Down Device Current, tested at V Max. I 6 — — µA IL PDL 11 D Input Capacitance C — 7 — πΦ in Injection current(2) 12 T Single Pin limit I –2.5 — 2.5 µΑ ICS Total Device Limit. Sum of all injected currents I –25 25 ICP 13 P Port P, J Interrupt Input Pulse filtered(3) t — — 3 µs PIGN 14 P Port P, J Interrupt Input Pulse passed3 t 10 — — µs PVAL 1.Maximumleakagecurrentoccursatmaximumoperatingtemperature.Currentdecreasesbyapproximatelyone-halfforeach 8C to 12C in the tempearture range from 50C to 125C. 2. Refer toSectionA.1.4, “Current Injection”, for more details 3. Parameter only applies in STOP or Pseudo STOP mode. A.1.10 Supply Currents This section describes the current consumption characteristics of the device as well as the conditions for the measurements. A.1.10.1 Measurement Conditions All measurements are without output loads. Unless otherwise noted the currents are measured in single chip mode, internal voltage regulator enabled and at 25MHz bus frequency using a 4MHz oscillator. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 655 Rev 01.24

AppendixA Electrical Characteristics A.1.10.2 Additional Remarks Inexpandedmodesthecurrentsflowinginthesystemarehighlydependentontheloadattheaddress,data andcontrolsignalsaswellasonthedutycycleofthosesignals.Nogenerallyapplicablenumberscanbe given.Averygoodestimateistotakethesinglechipcurrentsandaddthecurrentsduetotheexternalloads. TableA-8. Supply Current Characteristics for MC9S12CG16 MC9S12C32 Conditions are shown inTableA-4 with internal regulator enabled unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 P Run Supply Current Single Chip I — — 35 mA DD5 Wait Supply current P All modules enabled — 30 2 I mA P V <4.9V, only RTI enabled2 DDW — 3.5 8 DDR C V >4.9V,onlyRTIenabled — 2.5 DDR Pseudo Stop Current (RTI and COP disabled)23 C –40°C — 340 — P 27°C — 360 450 C 85°C — 500 — 3 P "C" Temp Option 100˚C I (1) — 550 1450 µA DDPS C 105°C — 590 — P "V" Temp Option 120˚C — 720 1900 C 125°C — 780 — P "M" Temp Option 140°C — 1100 4500 Pseudo Stop Current (RTI and COP enabled)(2)(3) C –40°C — 540 — C 27°C — 700 — 4 I 1 µA C 85°C DDPS — 750 — C 105°C — 880 — C 125°C — 1300 — Stop Current3 C –40°C — 10 — P 27°C — 20 80 C 85°C — 100 — 5 P "C" Temp Option 100˚C I 1 — 140 1000 µA DDS C 105°C — 170 — P "V" Temp Option 120˚C — 300 1400 C 125°C — 350 — P "M" Temp Option 140°C — 520 4000 1. STOP current measured in production test at increased junction temperature, hence for Temp Option "C" the test is carried outat100˚CalthoughtheTemperaturespecificationis85˚C.Similarlyfor"v"and"M"optionsthetemperatureusedintestlies 15˚C above the temperature option specification. 2. PLL off 3. At those low power dissipation levels T = T can be assumed J A 656 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics TableA-9. Supply Current Characteristics for Other Family Members Conditions are shown inTableA-4 with internal regulator enabled unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 P Run Supply Current Single Chip, I — — 45 mA DD5 Wait Supply current P All modules enabled — — 33 2 I mA P VDDR<4.9V, only RTI enabled2 DDW — 2.5 8 C VDDR>4.9V,onlyRTIenabled — 3.5 — Pseudo Stop Current (RTI and COP disabled)23 C –40°C — 190 — P 27°C — 200 250 C 85°C — 300 — 6 P "C" Temp Option 100˚C I (1) — 400 1400 µA DDPS C 105°C — 450 — P "V" Temp Option 120˚C — 600 1900 C 125°C — 650 — P "M" Temp Option 140°C — 1000 4800 Pseudo Stop Current (RTI and COP enabled)(2)(3) C –40°C — 370 — C 27°C — 500 — 4 I 1 µA C 85°C DDPS — 590 — C 105°C — 780 — C 125°C — 1200 — Stop Current3 C –40°C — 12 — P 27°C — 25 100 C 85°C — 130 — 5 P "C" Temp Option 100˚C I 1 — 160 1200 µA DDS C 105°C — 200 — P "V" Temp Option 120˚C — 350 1700 C 125°C — 400 — P "M" Temp Option 140°C — 600 4500 1.STOPcurrentmeasuredinproductiontestatincreasedjunctiontemperature,henceforTempOption"C"thetestiscarriedout at 100˚C although the Temperature specification is 85˚C. Similarly for "v" and "M" options the temperature used in test lies 15˚C above the temperature option specification. 2. PLL off 3. At those low power dissipation levels T = T can be assumed J A Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 657 Rev 01.24

AppendixA Electrical Characteristics A.2 ATD Characteristics This section describes the characteristics of the analog-to-digital converter. V is not available as a separate pin in the 48- and 52-pin versions. In this case the internal V pad is RL RL bonded to the V pin. SSA TheATDisspecifiedandtestedforboththe3.3Vand5Vrange.Forrangesbetween3.3Vand5VtheATD accuracy is generally the same as in the 3.3V range but is not tested in this range in production test. A.2.1 ATD Operating Characteristics In 5V Range TheTableA-10 shows conditions under which the ATD operates. Thefollowingconstraintsexisttoobtainfull-scale,fullrangeresults:V ≤V ≤V ≤V ≤V . SSA RL IN RH DDA Thisconstraintexistssincethesamplebufferamplifiercannotdrivebeyondthepowersupplylevelsthat it ties to. If the input level goes outside of this range it will effectively be clipped. TableA-10. ATD Operating Characteristics Conditions are shown inTableA-4 unless otherwise noted. Supply Voltage 5V-10% <= V <=5V+10% DDA Num C Rating Symbol Min Typ Max Unit Reference Potential 1 D Low V V — V V RL SSA DDA/2 High V V — V V RH DDA/2 DDA 2 C Differential Reference Voltage(1) V -V 4.75 5.0 5.25 V RH RL 3 D ATD Clock Frequency f 0.5 — 2.0 MHz ATDCLK ATD 10-Bit Conversion Period 4 D Clock Cycles(2) N 14 — 28 Cycles CONV10 Conv, Time at 2.0MHz ATD Clock f T 7 — 14 µs ATDCLK CONV10 ATD 8-Bit Conversion Period 5 D ClockCycles2 N 12 — 26 Cycles CONV10 Conv, Time at 2.0MHz ATD Clock f T 6 — 13 µs ATDCLK CONV10 5 D Recovery Time (V =5.0 Volts) t — — 20 µs DDA REC 6 P Reference Supply current I — — 0.375 mA REF 1. Full accuracy is not guaranteed when differential voltage is less than 4.75V 2. The minimum time assumes a final sample period of 2 ATD clocks cycles while the maximum time assumes a final sample period of 16 ATD clocks. 658 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics A.2.2 ATD Operating Characteristics In 3.3V Range TheTableA-11 shows conditions under which the ATD operates. Thefollowingconstraintsexisttoobtainfull-scale,fullrangeresults:V ≤V ≤V ≤V ≤V . SSA RL IN RH DDA Thisconstraintexistssincethesamplebufferamplifiercannotdrivebeyondthepowersupplylevelsthat it ties to. If the input level goes outside of this range it will effectively be clipped TableA-11. ATD Operating Characteristics Conditions are shown inTableA-4 unless otherwise noted; Supply Voltage 3.3V-10% <= V <= 3.3V+10% DDA Num C Rating Symbol Min Typ Max Unit Reference Potential 1 D Low V V — V /2 V RL SSA DDA High V V /2 — V V RH DDA DDA 2 C Differential Reference Voltage V -V 3.0 3.3 3.6 V RH RL 3 D ATD Clock Frequency f 0.5 — 2.0 MHz ATDCLK ATD 10-Bit Conversion Period 4 D Clock Cycles(1) N 14 — 28 Cycles CONV10 Conv, Time at 2.0MHz ATD Clock f T 7 — 14 µs ATDCLK CONV10 ATD 8-Bit Conversion Period 5 D Clock Cycles1 N 12 — 26 Cycles CONV8 Conv, Time at 2.0MHz ATD Clock f T 6 — 13 µs ATDCLK CONV8 6 D Recovery Time (V =3.3 Volts) t — — 20 µs DDA REC 7 P Reference Supply current I — — 0.250 mA REF 1. The minimum time assumes a final sample period of 2 ATD clocks cycles while the maximum time assumes a final sample period of 16 ATD clocks. A.2.3 Factors Influencing Accuracy Three factors — source resistance, source capacitance and current injection — have an influence on the accuracy of the ATD. A.2.3.1 Source Resistance Due to the input pin leakage current as specified inTableA-6 in conjunction with the source resistance therewillbeavoltagedropfromthesignalsourcetotheATDinput.ThemaximumsourceresistanceR S specifies results in an error of less than 1/2 LSB (2.5mV) at the maximum leakage current. If device or operatingconditionsarelessthanworstcaseorleakage-inducederrorisacceptable,largervaluesofsource resistance is allowable. A.2.3.2 Source Capacitance Whensamplinganadditionalinternalcapacitorisswitchedtotheinput.Thiscancauseavoltagedropdue to charge sharing with the external and the pin capacitance. For a maximum sampling error of the input voltage ≤ 1LSB, then the external filter capacitor, C ≥ 1024 * (C – C ). f INS INN Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 659 Rev 01.24

AppendixA Electrical Characteristics A.2.3.3 Current Injection There are two cases to consider. 1. Acurrentisinjectedintothechannelbeingconverted.Thechannelbeingstressedhasconversion values of $3FF ($FF in 8-bit mode) for analog inputs greater than V and $000 for values less RH than V unless the current is higher than specified as disruptive conditions. RL 2. Currentisinjectedintopinsintheneighborhoodofthechannelbeingconverted.Aportionofthis currentispickedupbythechannel(couplingratioK),Thisadditionalcurrentimpactstheaccuracy of the conversion depending on the source resistance. TheadditionalinputvoltageerrorontheconvertedchannelcanbecalculatedasV =K*R * ERR S I , with I being the sum of the currents injected into the two pins adjacent to the converted INJ INJ channel. Table21-18. ATD Electrical Characteristics Conditions are shown inTableA-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 C Max input Source Resistance RS — — 1 KΩ Total Input Capacitance 2 T Non Sampling CINN — — 10 pF Sampling C — — 15 INS 3 C Disruptive Analog Input Current INA –2.5 — 2.5 mA 4 C Coupling Ratio positive current injection Kp — — 10-4 A/A 5 C Coupling Ratio negative current injection Kn — — 10-2 A/A A.2.4 ATD Accuracy (5V Range) TableA-12specifiestheATDconversionperformanceexcludinganyerrorsduetocurrentinjection,input capacitance and source resistance . TableA-12. ATD Conversion Performance Conditions are shown inTableA-4 unless otherwise noted V = V – V = 5.12V. Resulting to one 8 bit count = 20mV and one 10 bit count = 5mV REF RH RL f = 2.0MHz ATDCLK Num C Rating Symbol Min Typ Max Unit 1 P 10-Bit Resolution LSB — 5 — mV 2 P 10-Bit Differential Nonlinearity DNL –1 — 1 Counts 3 P 10-Bit Integral Nonlinearity INL –2 — 2 Counts 4 P 10-Bit Absolute Error(1) AE -2.5 — 2.5 Counts 5 P 8-Bit Resolution LSB — 20 — mV 6 P 8-Bit Differential Nonlinearity DNL –0.5 — 0.5 Counts 7 P 8-Bit Integral Nonlinearity INL –1.0 ±0.5 1.0 Counts 8 P 8-Bit Absolute Error1 AE -1.5 ±1 1.5 Counts 1. These values include quantization error which is inherently 1/2 count for any A/D converter. 660 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics A.2.5 ATD Accuracy (3.3V Range) TableA-13specifiestheATDconversionperformanceexcludinganyerrorsduetocurrentinjection,input capacitance and source resistance. TableA-13. ATD Conversion Performance Conditions are shown inTableA-4 unless otherwise noted V = V - V = 3.328V. Resulting to one 8 bit count = 13mV and one 10 bit count = 3.25mV REF RH RL f = 2.0MHz ATDCLK Num C Rating Symbol Min Typ Max Unit 1 P 10-Bit Resolution LSB — 3.25 — mV 2 P 10-Bit Differential Nonlinearity DNL –1.5 — 1.5 Counts 3 P 10-Bit Integral Nonlinearity INL –3.5 ±1.5 3.5 Counts 4 P 10-Bit Absolute Error(1) AE –5 ±2.5 5 Counts 5 P 8-Bit Resolution LSB — 13 — mV 6 P 8-Bit Differential Nonlinearity DNL –0.5 — 0.5 Counts 7 P 8-Bit Integral Nonlinearity INL –1.5 ±1 1.5 Counts 8 P 8-Bit Absolute Error1 AE –2.0 ±1.5 2.0 Counts 1. These values include the quantization error which is inherently 1/2 count for any A/D converter. For the following definitions see also FigureA-1. Differential Non-Linearity (DNL) is defined as the difference between two adjacent switching steps. Vi–Vi–1 DNL(i) = ---------------------------–1 1LSB The Integral Non-Linearity (INL) is defined as the sum of all DNLs: n ∑ Vn–V0 INL(n) = DNL(i) = ---------------------–n 1LSB i = 1 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 661 Rev 01.24

AppendixA Electrical Characteristics DNL 10-Bit Absolute Error Boundary LSB Vi-1 Vi $3FF 8-Bit Absolute Error Boundary $3FE $3FD $3FC $FF $3FB $3FA $3F9 $3F8 $FE $3F7 $3F6 $3F5 $3F4 $FD $3F3 n o ution soluti sol 9 Re Re Ideal Transfer Curve Bit Bit 8 2 8- 0- 1 7 10-Bit Transfer Curve 6 5 4 1 3 8-Bit Transfer Curve 2 1 0 3.25 6.5 9.75 13 16.2519.522.75 26 29.25 32863289329232953299330233053309331233153318332133243328 Vin mV FigureA-1. ATD Accuracy Definitions NOTE FigureA-1showsonlydefinitions,forspecificationvaluesrefertoTableA- 12. 662 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics A.3 MSCAN TableA-14. MSCAN Wake-up Pulse Characteristics Conditions are shown inTableA-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 P MSCAN Wake-up dominant pulse filtered t — — 2 us WUP 2 P MSCAN Wake-up dominant pulse pass t 5 — — us WUP A.4 Reset, Oscillator and PLL This section summarizes the electrical characteristics of the various startup scenarios for Oscillator and Phase-Locked-Loop (PLL). A.4.1 Startup TableA-15summarizesseveralstartupcharacteristicsexplainedinthissection.Detaileddescriptionofthe startup behavior can be found in the Clock and Reset Generator (CRG) Block User Guide. TableA-15. Startup Characteristics Conditions are shown inTableA-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 T POR release level V — — 2.07 V PORR 2 T POR assert level V 0.97 — — V PORA 3 D Reset input pulse width, minimum input time PW 2 — — t RSTL osc 4 D Startup from Reset n 192 — 196 n RST osc Interrupt pulse width,IRQ edge-sensitive 5 D PW 20 — — ns mode IRQ 6 D Wait recovery startup time t — — 14 t WRS cyc A.4.1.1 POR ThereleaselevelV andtheassertlevelV arederivedfromtheV supply.Theyarealsovalid PORR PORA DD ifthedeviceispoweredexternally.AfterreleasingthePORresettheoscillatorandtheclockqualitycheck arestarted.Ifafteratimet novalidoscillationisdetected,theMCUwillstartusingtheinternalself CQOUT clock. The fastest startup time possible is given by n . uposc A.4.1.2 LVR ThereleaselevelV andtheassertlevelV arederivedfromtheV supply.Theyarealsovalid LVRR LVRA DD ifthedeviceispoweredexternally.AfterreleasingtheLVRresettheoscillatorandtheclockqualitycheck arestarted.Ifafteratimet novalidoscillationisdetected,theMCUwillstartusingtheinternalself CQOUT clock. The fastest startup time possible is given by n . uposc Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 663 Rev 01.24

AppendixA Electrical Characteristics A.4.1.3 SRAM Data Retention Provided an appropriate external reset signal is applied to the MCU, preventing the CPU from executing codewhenV isoutofspecificationlimits,theSRAMcontentsintegrityisguaranteedifafterthereset DD5 the PORF bit in the CRG Flags Register has not been set. A.4.1.4 External Reset When external reset is asserted for a time greater than PW the CRG module generates an internal RSTL reset, and the CPU starts fetching the reset vector without doing a clock quality check, if there was an oscillation before reset. A.4.1.5 Stop Recovery OutofSTOPthecontrollercanbewokenupbyanexternalinterrupt.AclockqualitycheckasafterPOR is performed before releasing the clocks to the system. A.4.1.6 Pseudo Stop and Wait Recovery TherecoveryfromPseudoSTOPandWaitareessentiallythesamesincetheoscillatorwasnotstoppedin both modes. In Pseudo Stop Mode the voltage regulator is switched to reduced performance mode to reducepowerconsumption.Thereturningoutofpseudostoptofullperformancetakest .Thecontroller vup canbewokenupbyinternalorexternalinterrupts.Aftert inWaitort +t inPseudoStoptheCPU wrs vup wrs starts fetching the interrupt vector. A.4.2 Oscillator ThedevicefeaturesaninternalColpittsandPierceoscillator.TheselectionofColpittsoscillatororPierce oscillator/external clock depends on the XCLKS signal which is sampled during reset. Pierce oscillator/external clock mode allows the input of a square wave. Before asserting the oscillator to the internalsystemclocksthequalityoftheoscillationischeckedforeachstartfromeitherpower-on,STOP oroscillatorfail.t specifiesthemaximumtimebeforeswitchingtotheinternalselfclockmodeafter CQOUT POR or STOP if a proper oscillation is not detected. The quality check also determines the minimum oscillator start-up time t . The device also features a clock monitor. A Clock Monitor Failure is UPOSC asserted if the frequency of the incoming clock signal is below the Assert Frequency f CMFA. 664 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics TableA-16. Oscillator Characteristics Conditions are shown inTableA-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1a C Crystal oscillator range (Colpitts) f 0.5 — 16 MHz OSC 1b C Crystal oscillator range (Pierce)(1)4 f 0.5 — 40 MHz OSC 2 P Startup Current i 100 — — µA OSC 3 C Oscillator start-up time (Colpitts) t — 8(2) 100(3) ms UPOSC 4 D Clock Quality check time-out t 0.45 — 2.5 s CQOUT 5 P Clock Monitor Failure Assert Frequency f 50 100 200 KHz CMFA 6 P External square wave input frequency(4) f 0.5 — 50 MHz EXT 7 D External square wave pulse width low t 9.5 — — ns EXTL 8 D External square wave pulse width high t 9.5 — — ns EXTH 9 D External square wave rise time t — — 1 ns EXTR 10 D External square wave fall time t — — 1 ns EXTF 11 D Input Capacitance (EXTAL, XTAL pins) C — 7 — pF IN DC Operating Bias in Colpitts Configuration 12 C V — 1.1 — V on EXTAL Pin DCBIAS EXTAL Pin Input High Voltage4 0.75* 13 P V — — V IH,EXTAL V DDPLL T EXTAL Pin Input High Voltage4 V — — V +0.3 V IH,EXTAL DDPLL EXTAL Pin Input Low Voltage4 0.25* 14 P V — — V Il,EXTAL V DDPLL T EXTAL Pin Input Low Voltage4 V V -0.3 — — V Il,EXTAL SSPLL 15 C EXTAL Pin Input Hysteresis4 V — 250 — mV HYS,EXTAL 1. Depending on the crystal a damping series resistor might be necessary 2. f = 4MHz, C = 22pF. osc 3. Maximum value is for extreme cases using high Q, low frequency crystals 4.Only valid if Pierce Oscillator/external clock selected (XCLKS = 0 during reset) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 665 Rev 01.24

AppendixA Electrical Characteristics A.4.3 Phase Locked Loop TheoscillatorprovidesthereferenceclockforthePLL.ThePLL´sVoltageControlledOscillator(VCO) is also the system clock source in self clock mode. A.4.3.1 XFC Component Selection This section describes the selection of the XFC components to achieve a good filter characteristics. Cp V DDPLL R Cs XFC Pin Phase VCO fosc 1 fref fvco D KF KV refdv+1 Detector f cmp Loop Divider 1 1 synr+1 2 FigureA-2. Basic PLL Functional Diagram Thefollowingprocedurecanbeusedtocalculatetheresistanceandcapacitancevaluesusingtypicalvalues for K , f and i from TableA-17. 1 1 ch Thegreyboxesshowthecalculationforf =50MHzandf =1MHz.E.g.,thesefrequenciesareused VCO ref for f = 4MHz and a 25MHz bus clock. OSC The VCO Gain at the desired VCO frequency is approximated by: (f1 –fvco) (60–50) ----------------------- K = K ⋅ e K1⋅1V= –100 ⋅ e------–---1---0---0------=- -90.48MHz/V V 1 The phase detector relationship is given by: KΦ = – ich ⋅ KV = 316.7Hz/Ω i is the current in tracking mode. ch 666 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics Theloopbandwidthf shouldbechosentofulfilltheGardner’sstabilitycriteriabyatleastafactorof10, C typical values are 50. ζ = 0.9 ensures a good transient response. 2 ⋅ ζ ⋅ f 1 f ref ref f < ------------------------------------------ ⋅ ----- → f < -------------;(ζ = 0.9) C 10 C 4 ⋅ 10 ⎛ 2⎞ π ⋅ ⎝ζ + 1 + ζ ⎠ f < 25kHz C And finally the frequency relationship is defined as f VCO n = ------------- = 2 ⋅ (synr + 1) = 50 f ref With the above values the resistance can be calculated. The example is shown for a loop bandwidth f =10kHz: C 2 ⋅ π ⋅ n ⋅ f R = --------------------------C--- =2*π*50*10kHz/(316.7Hz/Ω)=9.9kΩ=~10kΩ K Φ The capacitance C can now be calculated as: s 2 2 ⋅ ζ 0.516 C = ---------------------- ≈ ---------------;(ζ = 0.9) = 5.19nF =~ 4.7nF s π ⋅ f ⋅ R f ⋅ R C C The capacitance C should be chosen in the range of: p C ⁄ 20 ≤ C ≤ C ⁄ 10 C = 470pF s p s p A.4.3.2 Jitter Information The basic functionality of the PLL is shown in FigureA-3. With each transition of the clock f , the cmp deviationfromthereferenceclockf ismeasuredandinputvoltagetotheVCOisadjustedaccordingly. ref Theadjustmentisdonecontinuouslywithnoabruptchangesintheclockoutputfrequency.Noise,voltage, temperatureandotherfactorscauseslightvariationsinthecontrolloopresultinginaclockjitter.Thisjitter affects the real minimum and maximum clock periods as illustrated in Figure A-4. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 667 Rev 01.24

AppendixA Electrical Characteristics 0 1 2 3 N-1 N t min1 t nom t max1 t minN t maxN FigureA-3. Jitter Definitions Therelativedeviationoft isatitsmaximumforoneclockperiod,anddecreasestowardszeroforlarger nom number of clock periods (N). Defining the jitter as: ⎛ t (N) t (N) ⎞ J(N) = max⎜ 1 – --m-----a---x----------- , 1 – ---m----i--n------------ ⎟ ⎝ N ⋅ t N ⋅ t ⎠ nom nom For N < 100, the following equation is a good fit for the maximum jitter: j 1 J(N) j = -------- + 2 N J(N) 1 5 10 20 N FigureA-4. Maximum Bus Clock Jitter Approximation Thisisveryimportanttonoticewithrespecttotimers,serialmoduleswhereapre-scalerwilleliminatethe effect of the jitter to a large extent. 668 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics TableA-17. PLL Characteristics Conditions are shown inTableA-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 P Self Clock Mode frequency f 1 — 5.5 MHz SCM 2 D VCO locking range f 8 — 50 MHz VCO LockDetectortransitionfromAcquisitiontoTracking 3 D |∆ 3 — 4 %(1) mode trk| 4 D Lock Detection |∆ 0 — 1.5 %1 Lock| 5 D Un-Lock Detection |∆ 0.5 — 2.5 %1 unl| LockDetectortransitionfromTrackingtoAcquisition 6 D |∆ 6 — 8 %1 mode unt| 7 C PLLON Total Stabilization delay (Auto Mode)(2) t — 0.5 — ms stab 8 D PLLON mode stabilization delay2 t — 0.3 — ms Acquisition acq 9 D PLLON Tracking mode stabilization delay2 t — 0.2 — ms al 10 D Fitting parameter VCO loop gain K — -100 — MHz/V 1 11 D Fitting parameter VCO loop frequency f — 60 — MHz 1 12 D Charge pump current acquisition mode | i | — 38.5 — µA ch 13 D Charge pump current tracking mode | i | — 3.5 — µA ch 14 C Jitter fit parameter 12 j — — 1.1 % 1 15 C Jitter fit parameter 22 j — — 0.13 % 2 1. % deviation from target frequency 2.f =4MHz,f =25MHzequivalentf =50MHz:REFDV=#$03,SYNR=#$018,Cs=4.7nF,Cp=470pF,Rs=10KΩ. OSC BUS VCO A.5 NVM, Flash, and EEPROM A.5.1 NVM Timing The time base for all NVM program or erase operations is derived from the oscillator. A minimum oscillatorfrequencyf isrequiredforperformingprogramoreraseoperations.TheNVMmodules NVMOSC do not have any means to monitor the frequency and will not prevent program or erase operation at frequenciesaboveorbelowthespecifiedminimum.AttemptingtoprogramorerasetheNVMmodulesat a lower frequency a full program or erase transition is not assured. The Flash program and erase operations are timed using a clock derived from the oscillator using the FCLKDIVandECLKDIVregistersrespectively.Thefrequencyofthisclockmustbesetwithinthelimits specified as f . NVMOP The minimum program and erase times shown in TableA-18 are calculated for maximum f and NVMOP maximum f . The maximum times are calculated for minimum f and a f of 2MHz. bus NVMOP bus Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 669 Rev 01.24

AppendixA Electrical Characteristics A.5.1.1 Single Word Programming Theprogrammingtimeforsinglewordprogrammingisdependantonthebusfrequencyasawellasonthe frequency f¨ and can be calculated according to the following formula. NVMOP 1 1 t = 9 ⋅ --------------------- + 25 ⋅ ---------- swpgm f f NVMOP bus A.5.1.2 Row Programming Generally the time to program a consecutive word can be calculated as: 1 1 t = 4 ⋅ --------------------- + 9 ⋅ ---------- bwpgm f f NVMOP bus FortheC16,GC16,C32andGC32deviceflasharrays,whereupto32wordsinarowcanbeprogrammed consecutively by keeping the command pipeline filled, the time to program a whole row is: t = t + 31 ⋅ t brpgm swpgm bwpgm For the C64, GC64, C96, C128 and GC128 device flash arrays, where up to 64 words in a row can be programmed consecutively by keeping the command pipeline filled, the time to program a whole row is: t = t + 63 ⋅ t brpgm swpgm bwpgm Row programming is more than 2 times faster than single word programming. A.5.1.3 Sector Erase Erasing either a 512 byte or 1024 byte Flash sector takes: 1 t ≈ 4000 ⋅ --------------------- era f NVMOP The setup times can be ignored for this operation. A.5.1.4 Mass Erase Erasing a NVM block takes: 1 t ≈ 20000 ⋅ --------------------- mass f NVMOP This is independent of sector size. The setup times can be ignored for this operation. 670 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics TableA-18. NVM Timing Characteristics Conditions are shown inTableA-4 unless otherwise noted Num C Rating Symbol Min Typ Max Unit 1 D External Oscillator Clock f 0.5 — 50(1) MHz NVMOSC 2 D BusfrequencyforProgrammingorEraseOperations f 1 — MHz NVMBUS 3 D Operating Frequency f 150 — 200 kHz NVMOP 4 P Single Word Programming Time t 46(2) — 74.5(3) µs swpgm 5 D Flash Burst Programming consecutive word t 20.42 — 313 µs bwpgm 6 D Flash Burst Programming Time for 32 Word row t 678.42 — 1035.53 µs brpgm 6 D Flash Burst Programming Time for 64 Word row t 1331.22 — 2027.53 µs brpgm 7 P Sector Erase Time t 20(4) — 26.73 ms era 8 P Mass Erase Time t 1004 — 1333 ms mass 9 D Blank Check Time Flash per block t 11(5) — 32778(6) (7)t check cyc 9 D Blank Check Time Flash per block t 11(8) — 65546(9) 7t check cyc 1. Restrictions for oscillator in crystal mode apply! 2.MinimumProgrammingtimesareachievedundermaximumNVMoperatingfrequencyf andmaximumbusfrequency NVMOP f . bus 3.MaximumEraseandProgrammingtimesareachievedunderparticularcombinationsoff andbusfrequencyfbus.Refer NVMOP to formulae in Sections A.3.1.1 - A.3.1.4 for guidance. 4. Minimum Erase times are achieved under maximum NVM operating frequency f . NVMOP 5. Minimum time, if first word in the array is not blank (512 byte sector size). 6. Maximum time to complete check on an erased block (512 byte sector size) 7. Where t is the system bus clock period. cyc 8. Minimum time, if first word in the array is not blank (1024 byte sector size) 9. Maximum time to complete check on an erased block (1024 byte sector size). Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 671 Rev 01.24

AppendixA Electrical Characteristics A.5.2 NVM Reliability The reliability of the NVM blocks is guaranteed by stress test during qualification, constant process monitors and burn-in to screen early life failures. The program/erase cycle count on the sector is incremented every time a sector or mass erase event is executed. TableA-19. NVM Reliability Characteristics(1) Conditions are shown in TableA-4. unless otherwise noted Num C Rating Symbol Min Typ Max Unit Flash Reliability Characteristics 1 C Data retention after 10,000 program/erase cycles at an t 15 100(2) — Years average junction temperature of T ≤ 85°C FLRET Javg 2 C Data retention with <100 program/erase cycles at an 20 1002 — average junction temperature T ≤ 85°C Javg 3 C Number of program/erase cycles n 10,000 — — Cycles (–40°C≤ T ≤ 0°C) FL J 4 C Number of program/erase cycles 10,000 100,000(3) — (0°C≤ T ≤ 140°C) J 1. T will not exeed 85°C considering a typical temperature profile over the lifetime of a consumer, industrial or automotive Javg application. 2.Typicaldataretentionvaluesarebasedonintrinsiccapabilityofthetechnologymeasuredathightemperatureandde-ratedto 25°CusingtheArrheniusequation.ForadditionalinformationonhowFreescaledefinesTypicalDataRetention,pleaserefer to Engineering Bulletin EB618. 3. Spec table quotes typical endurance evaluated at 25°C for this product family, typical endurance at various temperature can be estimated using the graph below. For additional information on how Freescale defines Typical Endurance, please refer to Engineering Bulletin EB619. 672 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics FigureA-5. Typical Endurance vs Temperature 500 450 s] 400 e l c y C 350 3 0 1 [ 300 e c n a 250 r u d n E 200 l a c i 150 p y T 100 50 0 -40 -20 0 20 40 60 80 100 120 140 Operating Temperature T [°C] J ------ Flash A.6 SPI This section provides electrical parametrics and ratings for the SPI. In TableA-20 the measurement conditions are listed. TableA-20. Measurement Conditions Description Value Unit Drive mode Full drive mode — Load capacitance C on all outputs 50 pF LOAD, Thresholds for delay measurement points (20% / 80%) V V DDX A.6.1 Master Mode In FigureA-6 the timing diagram for master mode with transmission format CPHA=0 is depicted. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 673 Rev 01.24

AppendixA Electrical Characteristics SS1 (OUTPUT) 2 1 12 13 3 SCK 4 (CPOL= 0) (OUTPUT) 4 12 13 SCK (CPOL= 1) (OUTPUT) 5 6 MISO (INPUT) MSB IN2 BIT 6 . . . 1 LSB IN 10 9 11 MOSI (OUTPUT) MSB OUT2 BIT 6 . . . 1 LSB OUT 1. If configured as an output. 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1, ..., bit 6, MSB. FigureA-6. SPI Master Timing (CPHA=0) In FigureA-7 the timing diagram for master mode with transmission format CPHA=1 is depicted. SS1 (OUTPUT) 1 2 12 13 3 SCK (CPOL= 0) (OUTPUT) 4 4 12 13 SCK (CPOL= 1) (OUTPUT) 5 6 MISO (INPUT) MSB IN2 BIT 6 . . . 1 LSB IN 9 11 MOSI PORT DATA MASTER MSB OUT2 BIT 6 . . . 1 MASTER LSB OUT PORT DATA (OUTPUT) 1. If configured as output 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1, ..., bit 6, MSB. FigureA-7. SPI Master Timing (CPHA=1) 674 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics In TableA-21 the timing characteristics for master mode are listed. TableA-21. SPI Master Mode Timing Characteristics Num C Characteristic Symbol Min Typ Max Unit 1 P SCK Frequency f 1/2048 — 1/2 f sck bus 1 P SCK Period t 2 — 2048 t sck bus 2 D Enable Lead Time t — 1/2 — t lead sck 3 D Enable Lag Time t — 1/2 — t lag sck 4 D Clock (SCK) High or Low Time t — 1/2 — t wsck sck 5 D Data Setup Time (Inputs) t 8 — — ns su 6 D Data Hold Time (Inputs) t 8 — — ns hi 9 D Data Valid after SCK Edge t — — 30 ns vsck 10 D Data Valid afterSS fall (CPHA=0) t — — 15 ns vss 11 D Data Hold Time (Outputs) t 20 — — ns ho 12 D Rise and Fall Time Inputs t — — 8 ns rfi 13 D Rise and Fall Time Outputs t — — 8 ns rfo A.6.2 Slave Mode In FigureA-8 the timing diagram for slave mode with transmission format CPHA=0 is depicted. SS (INPUT) 1 12 13 3 SCK (CPOL= 0) (INPUT) 2 4 4 12 13 SCK (CPOL= 1) (INPUT) 10 8 7 9 11 11 MISO see SEE (OUTPUT) note SLAVE MSB BIT 6 . . . 1 SLAVE LSB OUT NOTE 5 6 MOSI (INPUT) MSB IN BIT 6 . . . 1 LSB IN NOTE: Not defined! FigureA-8. SPI Slave Timing (CPHA=0) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 675 Rev 01.24

AppendixA Electrical Characteristics In FigureA-9 the timing diagram for slave mode with transmission format CPHA=1 is depicted. SS (INPUT) 1 3 2 12 13 SCK (CPOL= 0) (INPUT) 4 4 12 13 SCK (CPOL= 1) (INPUT) 9 11 8 MISO see (OUTPUT) note SLAVE MSB OUT BIT 6 . . . 1 SLAVE LSB OUT 7 5 6 MOSI (INPUT) MSB IN BIT 6 . . . 1 LSB IN NOTE: Not defined! FigureA-9. SPI Slave Timing (CPHA=1) In TableA-22 the timing characteristics for slave mode are listed. TableA-22. SPI Slave Mode Timing Characteristics Num C Characteristic Symbol Min Typ Max Unit 1 D SCK Frequency f DC — 1/4 f sck bus 1 P SCK Period t 4 — ∞ t sck bus 2 D Enable Lead Time t 4 — — t lead bus 3 D Enable Lag Time t 4 — — t lag bus 4 D Clock (SCK) High or Low Time t 4 — — t wsck bus 5 D Data Setup Time (Inputs) t 8 — — ns su 6 D Data Hold Time (Inputs) t 8 — — ns hi 7 D Slave Access Time (time to data active) t — — 20 a ns 8 D Slave MISO Disable Time t — — 22 dis ns Data Valid after SCK Edge 30 + t 9 D t — — bus ns vsck (1) 10 D Data Valid afterSS fall t — — 30 + t 1 ns vss bus 11 D Data Hold Time (Outputs) t 20 — — ns ho 12 D Rise and Fall Time Inputs t — — 8 ns rfi 13 D Rise and Fall Time Outputs t — — 8 ns rfo 1. t added due to internal synchronization delay bus 676 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixA Electrical Characteristics A.7 Voltage Regulator A.7.1 Voltage Regulator Operating Conditions TableA-23. Voltage Regulator Electrical Parameters Num C Characteristic Symbol Min Typ Max Unit 1 P Input Voltages V 2.97 — 5.5 V VDDR, A Output Voltage Core 3 P V 2.35 2.5 2.75 V Full Performance Mode DD Low Voltage Interrupt(1) Assert Level (xL45J mask set) V 4.30 4.53 4.77 V LVIA 4 P Assert Level (other mask sets) V 4.00 4.37 4.66 V LVIA Deassert Level (xL45J mask set) V 4.42 4.65 4.89 V LVID Deassert Level (other mask sets) V 4.15 4.52 4.77 V LVID Low Voltage Reset(2),(3) 5 P Assert Level (xL45J mask set) V 2.25 2.3 — V LVRA Assert Level (other mask sets) 2.25 2.35 — Power-on Reset(4) 7 C Assert Level V 0.97 — — V PORA Deassert Level V — — 2.05 V PORD 1.MonitorsV ,activeonlyinFullPerformanceMode.IndicatesI/O&ADCperformancedegradationduetolowsupplyvoltage. DDA 2. Monitors V , active only in Full Performance Mode. MCU is monitored by the POR in RPM (seeFigureA-10) DD 3. Digital functionality is guaranteed in the range between V (min) and V (min). DD LVRA 4. Monitors V . Active in all modes. DD A.7.2 Chip Power-up and LVI/LVR Graphical Explanation Voltage regulator sub modules LVI (low voltage interrupt), POR (power-on reset) and LVR (low voltage reset) handle chip power-up or drops of the supply voltage. Their function is described in FigureA-10. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 677 Rev 01.24

AppendixA Electrical Characteristics V V DDA V LVID V LVIA V DD V LVRD V LVRA V PORD t LVI LVI enabled LVI disabled due to LVR POR LVR FigureA-10. Voltage Regulator — Chip Power-up and Voltage Drops (not scaled) A.7.3 Output Loads A.7.3.1 Resistive Loads The on-chip voltage regulator is intended to supply the internal logic and oscillator circuits allows no external DC loads. A.7.3.2 Capacitive Loads ThecapacitiveloadsarespecifiedinTableA-24.CeramiccapacitorswithX7Rdielectricumarerequired. TableA-24. Voltage Regulator — Capacitive Loads Num Characteristic Symbol Min Typical Max Unit 1 V external capacitive load C 400 440 12000 nF DD DDext 2 V external capacitive load C 90 220 5000 nF DDPLL DDPLLext 678 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixB Emulation Information Appendix B Emulation Information B.1 General For emulation, external addressing of a 128K memory map is required. This is provided in a 112 LQFP packageversionoftheMC9S12C128whichincludesthe3necessaryextraexternaladdressbussignalsvia Port K. This package version is for emulation only and not provided as a general production package. E N O 4M 7 M WW W O PP4/KWP4/PPP5/KPW5/PNCPP7/KWP7/PNCVDDXVSSXPM0/RXCANPM1/TXCANPM2/MISPM3/SSPM4/MOSIPM5/SCKPJ6/KWJ6PJ7/KWJ7 NCNCPP6/KWP6/RNCNCPS3PS2PS1/TXDPS0/RXDNCNCVSSAVRL 2109876543210987654321098765 PW3/KWP3/PP3 11111111010101010101010101099999999998888884 VRH PW2/KWP2/PP2 2 83 VDDA PW1/KWP1/PP1 3 82 NC /PW0/KWP0/PP0 4 81 PAD07/AN07 NC 5 80 NC XADDR16/PK2 6 79 PAD06/AN06 XADDR15/PK1 7 78 NC XADDR14/PK0 8 77 PAD05/AN05 IOC0/PT0 9 76 NC IOC1/PT1 10 75 PAD04/AN04 IOC2/PT2 11 74 NC IOC3/PT3 12 73 PAD03/AN03 VDD1 13 72 NC MC9S12C128 VSS1 14 71 PAD02/AN02 IOC4/PT4 15 70 NC IOC5/PT5 16 69 PAD01/AN01 IOC6/PT6 17 68 NC IOC7/PT7 18 67 PAD00/AN00 NC 19 66 VSS2 NC 20 65 VDD2 NC 21 64 PA7/ADDR15/DATA15 NC 22 63 PA6/ADDR14/DATA14 MODC/TAGHI/BKGD 23 62 PA5/ADDR13/DATA13 ADDR0/DATA0/PB0 24 61 PA4/ADDR12/DATA12 ADDR1/DATA1/PB1 25 60 PA3/ADDR11/DATA11 ADDR2/DATA2/PB2 26 59 PA2/ADDR10/DATA10 ADDR3/DATA3/PB3 27 58 PA1/ADDR9/DATA9 ADDR4/DATA4/PB4 28 57 PA0/ADDR8/DATA8 9012345678901234567890123456 2333333333344444444445555555 567CCCC7654RRTLCLLLTCCCC3210 ADDR5/DATA5/PBADDR6/DATA6/PBADDR7/DATA7/PBNNNNXCLKS/NOACC/PEMODB/IPIPE1/PEMODA/IPIPE0/PEECLK/PEVSSVDDRESEVDDPLXFVSSPLEXTAXTATESNNNNLSTRB/TAGLO/PER/W/PEIRQ/PEXIRQ/PE Signals shown inBold are available only in the 112 Pin Package. Pins marked "NC" are not connected FigureB-1. Pin Assignments in 112-Pin LQFP Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 679 Rev 01.24

AppendixB Emulation Information B.1.1 PK[2:0] / XADDR[16:14] PK2-PK0 provide the expanded address XADDR[16:14] for the external bus. Refer to the S12 Core user guide for detailed information about external address page access. Internal Pull Resistor Pin Name Pin Name Power Domain Description Function 1 Function 2 Reset CTRL State PK[2:0] XADDR[16:14] V PUPKE Up Port K I/O Pins DDX The reset state of DDRK in the S12_CORE is $00, configuring the pins as inputs. The reset state of PUPKE in the PUCR register of the S12_CORE is "1" enabling the internal pullup resistors at PortK[2:0]. In this reset state the pull-up resistors provide a defined state and prevent a floating input, thereby preventing unnecessary current consumption at the input stage. 680 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixC Package Information Appendix C Package Information C.1 General This section provides the physical dimensions of the packages 48LQFP, 52LQFP, 80QFP. Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 681 Rev 01.24

AppendixC Package Information C.1.1 80-Pin QFP Package L 60 41 61 40 S S D D B S S P B -A- -B- B B A- A- L B V H C M D M 0 5 0 -A-,-B-,-D- 2 0 2 0. 0. 0. DETAIL A DETAIL A 21 80 F 1 -D- 20 A 0.20 M H A-B S D S 0.05 A-B J N S 0.20 M C A-B S D S D M E DETAIL C 0.20 M C A-B S D S SECTION B-B C -H- DPLAATUNME VIEW ROTATED 90° -C- 0.10 SEATING H PLANE M G NOTES: MILLIMETERS 1. DIMENSIONING AND TOLERANCING PER ANSI Y14.5M, 1982. DIM MIN MAX 2. CONTROLLING DIMENSION: MILLIMETER. A 13.90 14.10 3. DATUM PLANE -H- IS LOCATED AT BOTTOMOF B 13.90 14.10 U LEAD AND IS COINCIDENT WITH THE C 2.15 2.45 LEAD WHERE THE LEAD EXITS THE PLASTIC D 0.22 0.38 T BODY AT THE BOTTOM OF THE PARTING LINE. E 2.00 2.40 4. DATUMS -A-, -B- AND -D- TO BE F 0.22 0.33 DETERMINED AT DATUM PLANE -H-. G 0.65 BSC DATUM -H- 5. DIMENSIONS S AND V TO BE DETERMINED H --- 0.25 PLANE R AT SEATING PLANE -C-. J 0.13 0.23 6. DIMENSIONS A AND B DO NOT INCLUDE K 0.65 0.95 MOLD PROTRUSION. ALLOWABLE L 12.35 REF PROTRUSION IS 0.25 PER SIDE. DIMENSIONS M 5° 10° A AND B DO INCLUDE MOLD MISMATCH AND ARE DETERMINED AT DATUM PLANE -H-. N 0.13 0.17 K Q 7. PDRIMOETNRSUISOINO ND. DAOLLEOSW NAOBTL IEN DCALUMDBEA RDAMBAR QP 00.3°25 BSC7° W PROTRUSION SHALL BE 0.08 TOTAL IN R 0.13 0.30 X EXCESS OF THE D DIMENSION AT MAXIMUM S 16.95 17.45 MATERIAL CONDITION. DAMBAR CANNOT T 0.13 --- DETAIL C BE LOCATED ON THE LOWER RADIUS OR U 0° --- THE FOOT. V 16.95 17.45 W 0.35 0.45 X 1.6 REF FigureC-1. 80-Pin QFP Mechanical Dimensions (Case no. 841B) 682 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixC Package Information C.1.2 52-Pin LQFP Package 4X 4X 13 TIPS 0.20 (0.008) H L-M N 0.20 (0.008) T L-M N -X- X=L, M, N 52 40 C 1 39 L AB G 3X VIEW Y -L- -M- AB B V VIEW Y B1 F BASE METAL V1 PLATING 13 27 14 26 J U -N- D A1 0.13 (0.005) M T L-M S N S S1 A SECTION AB-AB ° ROTATED 90 CLOCKWISE S NOTES: 1. DIMENSIONING AND TOLERANCING PER ANSI Y14.5M, 1982. CONTROLLING DIMENSION: MILLIMETER DATUMPLANE-H-ISLOCATEDATBOTTOMOFLEADANDISCOINCIDENT 4X θ2 WITH THE LEAD WHERE THE LEAD EXITS THE PLASTIC BODY AT THE C BOTTOM OF THE PARTING LINE. 0.10 (0.004) T 2. DATUMS -L-, -M- AND -N- TO BE DETERMINED AT DATUM PLANE -H-. DIMENSIONS S AND V TO BE DETERMINED AT SEATING PLANE -T-. -H- DIMENSIONS A AND B DO NOT INCLUDE MOLD PROTRUSION. ALLOWABLEPROTRUSIONIS0.25(0.010)PERSIDE.DIMENSIONSAAND -T- B DO INCLUDE MOLD MISMATCH AND ARE DETERMINED AT DATUM SEATING 4Xθ3 PLANE -H- PLANE DIMENSION D DOES NOT INCLUDE DAMBAR PROTRUSION. DAMBAR PROTRUSION SHALL NOT CAUSE THE LEAD WIDTH TO EXCEED 0.46 VIEW AA (0.018).MINIMUMSPACEBETWEENPROTRUSIONANDADJACENTLEAD OR PROTRUSION 0.07 (0.003). 0.05 (0.002) S W 2X R R1 MILLIMETERS INCHES θ1 DIM MIN MAX MIN MAX A 10.00 BSC 0.394 BSC A1 5.00 BSC 0.197 BSC C2 0.25 (0.010) B 10.00 BSC 0.394 BSC θ B1 5.00 BSC 0.197 BSC C --- 1.70 --- 0.067 GAGE PLANE C1 0.05 0.20 0.002 0.008 C2 1.30 1.50 0.051 0.059 K D 0.20 0.40 0.008 0.016 E 0.45 0.75 0.018 0.030 C1 F 0.22 0.35 0.009 0.014 E G 0.65 BSC 0.026 BSC VIEW AA Z J 0.07 0.20 0.003 0.008 K 0.50 REF 0.020 REF R1 0.08 0.20 0.003 0.008 S 12.00 BSC 0.472 BSC S1 6.00 BSC 0.236 BSC U 0.09 0.16 0.004 0.006 V 12.00 BSC 0.472 BSC V1 6.00 BSC 0.236 BSC W 0.20 REF 0.008 REF Z 1.00 REF 0.039 REF θ 0° 7° 0° 7° θ1 0° --- 0° --- θ2 12°REF 12°REF θ3 12°REF 12°REF FigureC-2. 52-Pin LQFP Mechanical Dimensions (Case no. 848D-03) Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 683 Rev 01.24

AppendixC Package Information C.1.3 48-Pin LQFP Package 4X NOTES: 0.200 AB T-U Z 1. DIMENSIONING AND TOLERANCING PER ASME Y14.5M, 1994. DETAIL Y 2. CONTROLLING DIMENSION: MILLIMETER. 9 A P 3. DATUM PLANE AB IS LOCATED AT BOTTOM OF LEAD AND IS COINCIDENT WITH THE A1 LEADWHERETHELEADEXITSTHEPLASTIC BODY AT THE BOTTOM OF THE PARTING 48 37 LINE. 4. DATUMST,U,ANDZTOBEDETERMINEDAT DATUM PLANE AB. 1 36 5. DIMENSIONS S AND V TO BE DETERMINED AT SEATING PLANE AC. T U 6. DIMENSIONS A AND B DO NOT INCLUDE MOLD PROTRUSION. ALLOWABLE PROTRUSIONIS0.250PERSIDE.DIMENSIONS B V AANDBDOINCLUDEMOLDMISMATCHAND ARE DETERMINED AT DATUM PLANE AB. 7. DIMENSIONDDOESNOTINCLUDEDAMBAR AE AE PROTRUSION.DAMBARPROTRUSIONSHALL B1 NOT CAUSE THE D DIMENSION TO EXCEED V1 0.350. 12 25 13 24 MILLIMETERS Z DIM MIN MAX A 7.000 BSC S1 A1 3.500 BSC T, U, Z B 7.000 BSC B1 3.500 BSC S C 1.400 1.600 DETAIL Y D 0.170 0.270 4X E 1.350 1.450 0.200 AC T-U Z F 0.170 0.230 G 0.500 BSC H 0.050 0.150 J 0.090 0.200 K 0.500 0.700 L 0 ° 7° AB G 0.080 AC M 12 ° REF N 0.090 0.160 P 0.250 BSC R 0.150 0.250 S 9.000 BSC S1 4.500 BSC V 9.000 BSC AD V1 4.500 BSC AC W 0.200 REF AA 1.000 REF BASE METAL M° TOP & BOTTOM R E N A N J 0 L 5 P 0.2 GE U C E GA F D 0.080 M AC T-U Z SECTION AE-AE H W L° DETAIL AD K AA FigureC-3. 48-Pin LQFP Mechanical Dimensions (Case no. 932-03 issue F) 684 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixD Derivative Differences Appendix D Derivative Differences The Device User Guide provides information about the MC9S12C-Family and the MC9S12GC-Family. The C-Family and the GC-Family offer an extensive range of package, temperature and speed options. The members of the GC-Family are a subset of the C-family that do not feature a CAN module. TableD-1. shows a feature overview of the C and GC family members. TableD-1. List of MC9S12C and MC9S12GC Family members(1) Flash RAM Device CAN SCI SPI A/D PWM Timer MC9S12C128 1 1 1 8ch 6ch 8ch 128K 4K MC9S12GC128 — 1 1 8ch 6ch 8ch MC9S12C96 1 1 1 8ch 6ch 8ch 96K 4K MC9S12GC96 — 1 1 8ch 6ch 8ch MC9S12C64 1 1 1 8ch 6ch 8ch 64K 4K MC9S12GC64 — 1 1 8ch 6ch 8ch MC9S12C32 1 1 1 8ch 6ch 8ch 32K 2K MC9S12GC32 — 1 1 8ch 6ch 8ch 16K 1K MC9S12GC16 — 1 1 8ch 6ch 8ch 1.Allfamilymemebersareavailablein80QFP,52LQFPand48LQFPpackageoptions Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 685 Rev 01.24

AppendixE Ordering Information Appendix E Ordering Information MC9S12 C32 C FU(E) 25 Temperature Options C = -40˚C to 85˚C Speed Option V = -40˚C to 105˚C Environment Option M = -40˚C to 125˚C Package Option Package Options FU = 80QFP Temperature Option PB = 52LQFP Device Title FA = 48LQFP Speed Options Controller Family 25 = 25MHz bus 16 = 16MHz bus Environment Option E = Environmentally Preferred Package FigureE-1. Order Part number Coding TableE-1. lists C-family part number coding based on package, speed and temperature and die options. TableE-2.listsCG-familypartnumbercodingbasedonpackage,speedandtemperatureanddieoptions. TableE-1. MC9S12C-Family / MC9S12GC-Family Part Number Coding Mask(1) I/O(2), Part Number Temp. Package Speed Die Type Flash RAM set (3) MC9S12C128CFA XL09S/0M66G -40˚C, 85˚C 48LQFP 25MHz C128 die 128K 4K 31 MC9S12C128CPB XL09S/0M66G -40˚C, 85˚C 52LQFP 25MHz C128 die 128K 4K 35 MC9S12C128CFU XL09S/0M66G -40˚C, 85˚C 80QFP 25MHz C128 die 128K 4K 60 MC9S12C128VFA XL09S/0M66G -40˚C,105˚C 48LQFP 25MHz C128 die 128K 4K 31 MC9S12C128VPB XL09S/0M66G -40˚C,105˚C 52LQFP 25MHz C128 die 128K 4K 35 MC9S12C128VFU XL09S/0M66G -40˚C,105˚C 80QFP 25MHz C128 die 128K 4K 60 MC9S12C128MFA XL09S/0M66G -40˚C,125˚C 48LQFP 25MHz C128 die 128K 4K 31 MC9S12C128MPB XL09S/0M66G -40˚C,125˚C 52LQFP 25MHz C128 die 128K 4K 35 MC9S12C128MFU XL09S/0M66G -40˚C,125˚C 80QFP 25MHz C128 die 128K 4K 60 MC9S12C96CFA XL09S/0M66G -40˚C, 85˚C 48LQFP 25MHz C128 die 96K 4K 31 MC9S12C96CPB XL09S/0M66G -40˚C, 85˚C 52LQFP 25MHz C128 die 96K 4K 35 MC9S12C96CFU XL09S/0M66G -40˚C, 85˚C 80QFP 25MHz C128 die 96K 4K 60 MC9S12C96VFA XL09S/0M66G -40˚C,105˚C 48LQFP 25MHz C128 die 96K 4K 31 MC9S12C96VPB XL09S/0M66G -40˚C,105˚C 52LQFP 25MHz C128 die 96K 4K 35 MC9S12C96VFU XL09S/0M66G -40˚C,105˚C 80QFP 25MHz C128 die 96K 4K 60 MC9S12C96MFA XL09S/0M66G -40˚C,125˚C 48LQFP 25MHz C128 die 96K 4K 31 MC9S12C96MPB XL09S/0M66G -40˚C,125˚C 52LQFP 25MHz C128 die 96K 4K 35 MC9S12C96MFU XL09S/0M66G -40˚C,125˚C 80QFP 25MHz C128 die 96K 4K 60 MC9S12C64CFA XL09S/0M66G -40˚C, 85˚C 48LQFP 25MHz C128 die 64K 4K 31 MC9S12C64CPB XL09S/0M66G -40˚C, 85˚C 52LQFP 25MHz C128 die 64K 4K 35 686 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

AppendixE Ordering Information Mask(1) I/O(2), Part Number Temp. Package Speed Die Type Flash RAM set (3) MC9S12C64CFU XL09S/0M66G -40˚C, 85˚C 80QFP 25MHz C128 die 64K 4K 60 MC9S12C64VFA XL09S/0M66G -40˚C,105˚C 48LQFP 25MHz C128 die 64K 4K 31 MC9S12C64VPB XL09S/0M66G -40˚C,105˚C 52LQFP 25MHz C128 die 64K 4K 35 MC9S12C64VFU XL09S/0M66G -40˚C,105˚C 80QFP 25MHz C128 die 64K 4K 60 MC9S12C64MFA XL09S/0M66G -40˚C,125˚C 48LQFP 25MHz C128 die 64K 4K 31 MC9S12C64MPB XL09S/0M66G -40˚C,125˚C 52LQFP 25MHz C128 die 64K 4K 35 MC9S12C64MFU XL09S/0M66G -40˚C,125˚C 80QFP 25MHz C128 die 64K 4K 60 MC9S12C32CFA16 xL45J / xM34C -40˚C, 85˚C 48LQFP 16MHz C32 die 32K 2K 31 MC9S12C32CPB16 xL45J / xM34C -40˚C, 85˚C 52LQFP 16MHz C32 die 32K 2K 35 MC9S12C32CFU16 xL45J / xM34C -40˚C, 85˚C 80QFP 16MHz C32 die 32K 2K 60 MC9S12C32VFA16 xL45J / xM34C -40˚C,105˚C 48LQFP 16MHz C32 die 32K 2K 31 MC9S12C32VPB16 xL45J / xM34C -40˚C,105˚C 52LQFP 16MHz C32 die 32K 2K 35 MC9S12C32VFU16 xL45J / xM34C -40˚C,105˚C 80QFP 16MHz C32 die 32K 2K 60 MC9S12C32MFA16 xL45J / xM34C -40˚C,125˚C 48LQFP 16MHz C32 die 32K 2K 31 MC9S12C32MPB16 xL45J / xM34C -40˚C,125˚C 52LQFP 16MHz C32 die 32K 2K 35 MC9S12C32MFU16 xL45J / xM34C -40˚C,125˚C 80QFP 16MHz C32 die 32K 2K 60 MC9S12C32CFA25 xL45J / xM34C -40˚C, 85˚C 48LQFP 25MHz C32 die 32K 2K 31 MC9S12C32CPB25 xL45J / xM34C -40˚C, 85˚C 52LQFP 25MHz C32 die 32K 2K 35 MC9S12C32CFU25 xL45J / xM34C -40˚C, 85˚C 80QFP 25MHz C32 die 32K 2K 60 MC9S12C32VFA25 xL45J / xM34C -40˚C,105˚C 48LQFP 25MHz C32 die 32K 2K 31 MC9S12C32VPB25 xL45J / xM34C -40˚C,105˚C 52LQFP 25MHz C32 die 32K 2K 35 MC9S12C32VFU25 xL45J / xM34C -40˚C,105˚C 80QFP 25MHz C32 die 32K 2K 60 MC9S12C32MFA25 xL45J / xM34C -40˚C,125˚C 48LQFP 25MHz C32 die 32K 2K 31 MC9S12C32MPB25 xL45J / xM34C -40˚C,125˚C 52LQFP 25MHz C32 die 32K 2K 35 MC9S12C32MFU25 xL45J / xM34C -40˚C,125˚C 80QFP 25MHz C32 die 32K 2K 60 1. XL09S denotes all minor revisions of L09S maskset XL45J denotes all minor revisions of L45J maskset Maskset dependent errata can be accessed at http://e-www.motorola.com/wbapp/sps/site/prod_summary.jsp 2. All C-Family derivatives feature 1 CAN, 1 SCI, 1 SPI, an 8-channel A/D, a 6-channel PWM and an 8 channel timer. The GC-Family members do not have the CAN module 3. I/O is the sum of ports able to act as digital input or output. TableE-2. MC9S12GC-Family Part Number Coding Mask(1) I/O(2), Part Number Temp. Package Speed Die Type Flash RAM set (3) MC9S12GC32CFA xL45J / xM34C -40˚C, 85˚C 48LQFP 25MHz C32 die 32K 2K 31 MC9S12GC32CPB xL45J / xM34C -40˚C, 85˚C 52LQFP 25MHz C32 die 32K 2K 35 MC9S12GC32CFU xL45J / xM34C -40˚C, 85˚C 80QFP 25MHz C32 die 32K 2K 60 MC9S12GC32VFA xL45J / xM34C -40˚C,105˚C 48LQFP 25MHz C32 die 32K 2K 31 MC9S12GC32VPB xL45J / xM34C -40˚C,105˚C 52LQFP 25MHz C32 die 32K 2K 35 MC9S12GC32VFU xL45J / xM34C -40˚C,105˚C 80QFP 25MHz C32 die 32K 2K 60 MC9S12GC32MFA xL45J / xM34C -40˚C,125˚C 48LQFP 25MHz C32 die 32K 2K 31 MC9S12GC32MPB xL45J / xM34C -40˚C,125˚C 52LQFP 25MHz C32 die 32K 2K 35 Freescale Semiconductor MC9S12C-Family / MC9S12GC-Family 687 Rev 01.24

AppendixE Ordering Information Mask(1) I/O(2), Part Number Temp. Package Speed Die Type Flash RAM set (3) MC9S12GC32MFU xL45J / xM34C -40˚C,125˚C 80QFP 25MHz C32 die 32K 2K 60 MC9S12GC16CFA xL45J / xM34C -40˚C, 85˚C 48LQFP 25MHz C32 die 16K 1K 31 MC9S12GC16CPB xL45J / xM34C -40˚C, 85˚C 52LQFP 25MHz C32 die 16K 1K 35 MC9S12GC16CFU xL45J / xM34C -40˚C, 85˚C 80QFP 25MHz C32 die 16K 1K 60 MC9S12GC16VFA xL45J / xM34C -40˚C,105˚C 48LQFP 25MHz C32 die 16K 1K 31 MC9S12GC16VPB xL45J / xM34C -40˚C,105˚C 52LQFP 25MHz C32 die 16K 1K 35 MC9S12GC16VFU xL45J / xM34C -40˚C,105˚C 80QFP 25MHz C32 die 16K 1K 60 MC9S12GC16MFA xL45J / xM34C -40˚C,125˚C 48LQFP 25MHz C32 die 16K 1K 31 MC9S12GC16MPB xL45J / xM34C -40˚C,125˚C 52LQFP 25MHz C32 die 16K 1K 35 MC9S12GC16MFU xL45J / xM34C -40˚C,125˚C 80QFP 25MHz C32 die 16K 1K 60 1. XL09S denotes all minor revisions of L09S maskset XL45J denotes all minor revisions of L45J maskset Maskset dependent errata can be accessed at http://e-www.motorola.com/wbapp/sps/site/prod_summary.jsp 2.AllC-Familyderivativesfeature1CAN,1SCI,1SPI,an8-channelA/D,a6-channelPWMandan8channeltimer.The GC-Family members do not have the CAN module 3. I/O is the sum of ports capable to act as digital input or output. 688 MC9S12C-Family / MC9S12GC-Family Freescale Semiconductor Rev 01.24

None

How to Reach Us: Home Page: www.freescale.com USA/Europe or Locations Not Listed: Freescale Semiconductor Technical Information Center, CH370 1300 N. Alma School Road Chandler, Arizona 85224 1-800-521-6274 or 480-768-2130 Europe, Middle East, and Africa: +44 1296 380 456 (English) +46 8 52200080 (English) +49 89 92103 559 (German) +33 1 69 35 48 48 (French) Japan: Freescale Semiconductor Japan Ltd. Technical Information Center 3-20-1, Minami-Azabu, Minato-ku Tokyo 106-0047, Japan 0120-191014 or +81-3-3440-3569 Asia/Pacific: Freescale Semiconductor Hong Kong Ltd. Technical Information Center 2 Dai King Street Information in this document is provided solely to enable system and softwareimplementerstouseFreescaleSemiconductorproducts.Thereare Tai Po Industrial Estate no express or implied copyright licenses granted hereunder to design or Tai Po, N.T., Hong Kong fabricate any integrated circuits or integrated circuits based on the 852-26668334 information in this document. For Literature Requests Only: FreescaleSemiconductorreservestherighttomakechangeswithoutfurther Freescale Semiconductor Literature Distribution Center noticetoanyproductsherein.FreescaleSemiconductormakesnowarranty, P.O. Box 5405 representation or guarantee regarding the suitability of its products for any Denver, Colorado 80217 particular purpose, nor does Freescale Semiconductor assume any liability 1-800-441-2447 or 303-675-2140 arisingoutoftheapplicationoruseofanyproductorcircuit,andspecifically Fax: 303-675-2150 disclaims any and all liability, including without limitation consequential or incidentaldamages.“Typical”parametersthatmaybeprovidedinFreescale Semiconductordatasheetsand/orspecificationscananddovaryindifferent applications and actual performance may vary over time. All operating parameters, including “Typicals”, must be validated for each customer applicationbycustomer’stechnicalexperts.FreescaleSemiconductordoes not convey any license under its patent rights nor the rights of others. FreescaleSemiconductorproductsarenotdesigned,intended,orauthorized foruseascomponentsinsystemsintendedforsurgicalimplantintothebody, or other applications intended to support or sustain life, or for any other applicationinwhichthefailureoftheFreescaleSemiconductorproductcould create a situation where personal injury or death may occur. Should Buyer purchaseoruseFreescaleSemiconductorproductsforanysuchunintended or unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor and its officers, employees, subsidiaries, affiliates, and distributorsharmlessagainstallclaims,costs,damages,andexpenses,and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use,evenifsuchclaimallegesthatFreescaleSemiconductorwasnegligent regarding the design or manufacture of the part. Freescale™ and the Freescale logo are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners. . © Freescale Semiconductor, Inc. 2006. All rights reserved. MC9S12C128 Rev 01.24 05/2010

Mouser Electronics Authorized Distributor Click to View Pricing, Inventory, Delivery & Lifecycle Information: N XP: S9S12C128J2VFAE S9S12C128J2VFAER S9S12C64J2CFAE MC9S12C128MFAE MC9S12C64MFAE MC9S12C96MFUE MC9S12GC16MFAE MC9S12C32MFAE16 MC9S12GC96MFUE MC9S12GC64MPBE MC9S12GC64MFUE MC9S12C32MPBE25 MC9S12C128MFUE MC9S12GC64MFAE MC9S12GC96MFAE MC9S12C96MFAE MC9S12C128MPBE MC9S12C64MFUE MC9S12GC32MFAE MC9S12C32MFUE25 MC9S12C32MFAE25 MC9S12GC128MFUE MC9S12C128CFAE MC9S12C128CFUE MC9S12C128CPBE MC9S12C128VFAE MC9S12C128VFUE MC9S12C32CFAE16 MC9S12C32CFAE25 MC9S12C32CFUE16 MC9S12C32CFUE25 MC9S12C32CPBE25 MC9S12C32MFUE16 MC9S12C32MFUE25R MC9S12C32MPBE16 MC9S12C32VFAE16 MC9S12C32VFAE25 MC9S12C32VFUE16 MC9S12C32VFUE25 MC9S12C32VPBE16 MC9S12C64CFAE MC9S12C64CFAER MC9S12C64CFUE MC9S12C64CPBE MC9S12C64MPBE MC9S12C64VFAE MC9S12C64VFUE MC9S12C96CFAE MC9S12C96CFUE MC9S12C96CFUER MC9S12C96CPBE MC9S12C96VFUE MC9S12C96VPBE MC9S12GC128CFUE MC9S12GC128MFAE MC9S12GC16CFAE MC9S12GC16CFUE MC9S12GC16CPBE MC9S12GC16MFUE MC9S12GC16MPBE MC9S12GC16VFAE MC9S12GC32CFAE MC9S12GC32CFUE MC9S12GC32CPBE MC9S12GC32MFUE MC9S12GC32MPBE MC9S12GC32VFAE MC9S12GC64CFAE MC9S12GC64CFUE MC9S12GC96CFAE MC9S12GC96CFUE MCS12GC64CFUE MCS12GC64MFUE