SM2965MCU and its application in system programming

1 Introduction

The emergence of in-system programming (ISP) technology is a breakthrough in traditional programming methods. It refers to the technology of reprogramming devices in user-designed microcontroller systems to configure new system functions, and downloading program code (firmware) to the program memory online. After SST launched the FlashFlex51 [1] series of microcontrollers with ISP function, PHILIPS, WINBOND, LG, ATMEL, SynCMOS and other companies have successively launched the 51 series of microcontrollers with ISP/IAP (In-Application Programming) functions [2]. The performance enhancements of these devices are also reflected in: (1) the internal ROM uses Flash memory with a capacity of 32 to 64k bytes, and the internal RAM capacity reaches 512 to 1024 bytes; (2) special function registers are added, and the control function is further enhanced; (3) the internal watchdog timer reset circuit is configured; (4) the ALE output can be disabled to reduce EMI; (5) dual DPTR pointers, etc. These functions further simplify the external expansion of the microcontroller and form a true "monolithic" structure. In the POS payment terminal, the SM2965 of SynCMOS company is replaced as the main processor, and the ISP function can be conveniently realized by using the serial port of the microcontroller without modifying the hardware. This paper mainly analyzes the ISP function characteristics of SM2965 and the precautions in its use.

2 Features of SM2965

Compared with the standard 80C52, SM2965 has the following features: ① Programming voltage 5V; ② 64k bytes of on-chip Flash memory, divided into 128 pages, 512 bytes per page (including the download program space for implementing the ISP function); ③ The size of the download program space for implementing the ISP function can be set to N×200H (N=0~8); ④ 256 bytes of on-chip RAM + 768 bytes of on-chip extended RAM (ERAM); ⑤ Watchdog timer; ⑥ P4 port: P4.0~P4.3 is added to PLCC and QFP package models; ⑦ To reduce EMI, ALE signal output can be disabled when not necessary; ⑧ After reset, if the hardware detects that the program memory space 0000H address is empty (i.e. #0FFH), it will automatically jump to the ISP function program entry address.

3 SM2965 memory structure

3.1 Program Memory

The SM2965 has an internal 64k-byte Flash memory as program memory with an address range of 0000H to 0FFFFH, which is used to store the application program that executes the user program and the download program that executes the ISP function.

The download program space for executing the ISP function can be configured to a maximum of 4K bytes, the space size = N × 200H bytes, N = 0 means that the download program is not configured, and the 64K bytes of Flash memory are all used for the application program; N = 1 means that 0FE00H ~ 0FFFFH has a total of 200H bytes configured for the download program space, from 0000H ~ FDFFH for the application program; N = 8 means that the download program space reaches the maximum configuration, which is 4K bytes. The size of N can only be configured through a commercial programmer. Once it is configured as N ≠ 0 on the programmer, the configuration of the ISP space cannot be changed in the system. The composition of the SM2965 program space is shown in Figure 1. 0FFFFH-(N × 200H) is the entry address of the download program.

3.2 Data Storage

Based on the standard 80C52 core, SM2956 adds 8 special function registers to implement the functions added by SM2965 and 768 bytes of on-chip expanded data memory Expanded Ram (ERAM), making the total capacity of on-chip data memory reach 1K bytes. The composition of the data memory is shown in Figure 2. The special function registers added by SM2965 [3] are shown in Table 1.

4 Special function registers related to ISP function

4.1 Introduction to ISP Special Function Registers

The special function registers related to the ISP function are FAH, FAL, FDAT, SCONF and FCR, among which FAH×256+FAL is the target address in the programming state, and FDAT is the programming data. [page]

SCONF is the system control register. Bit 2 in SCONF is related to the ISP function. The definitions of each bit in SCONF are as follows:

WDR RRRR ISPE OME ALE1
MSB LSB
Bits 3 to 6 of SCONF are reserved and unused. The reset state of SCONF is 00000010B.
WDR: Watchdog timer overflow bit;
OME: On-chip extended data memory ERAM selection bit, 1 selects on-chip, 0 selects off-chip;
ALEI: ALE output disable bit;
ISPE: ISP function total enable/disable bit, 1 enables, 0 disables. Setting ISPE to 0 will mask all ISP functions. Setting ISPE=0 when executing the application program can effectively prevent the Flash memory content from being illegally rewritten.

The Flash control register FCR plays a key role in programming, and its bits are defined as follows:

MSB LSB
Among them, bits 2 to 6 of FCR are reserved and unused, and the reset state of FCR is 00000000B.
START: ISP function start bit;
START=1, start ISP function, the specific function is determined by F1 and F0; START=0, no ISP operation.

After the START bit is set to 1, the SM2965 hardware automatically latches the address and data and obtains control of the program pointer until the ISP function ends, and START is automatically reset to 0. There is no need to check the status of START during the download process.

F1～F0 ISP function selection bit

F1F0 ISP function
00 Byte Programming
01 Chip Write Protection
10 Page Erase
11 Whole Chip Erase
A page of Flash memory is 200H bytes. To execute the ISP function, you need to specify the Flash memory address; to execute the byte programming function, the Flash memory address is the target address of the programming byte; to execute the page erase function, the address is any address in the page; to execute the whole chip erase and chip write protection, it is any address in the range of 0000H to 0FFFFH; to execute the whole chip erase, SM2965 will erase all Flash memories outside the ISP download program space; to execute the chip write protection function, the contents read out of the SM2965 memory are all "00H".

4.2 Example of using ISP special function registers

Example 1: Byte programming, #2CH is programmed to address 2005H

MOV SCONF, #04H; open all ISP functions
MOV FAH, #20H; target address high address 20H
MOV FAL, #05H; target address low address 05H
MOV FDAT, #2CH; write data: 2CH
MOV FCON, #80H; set START bit to 1, start byte programming function, solidify 22H to 1005H, after ISP function ends, START automatically resets to 0, PC points to the next instruction
Example 2: erase Flash page, such as erasing the page corresponding to address 253CH Take
512 bytes as a page, 253CH is in the page address range of 2400H to 25FFH, after executing the following program, the page is all written to #0FFH.

MOV SCONF, #04H; open all ISP functions
MOV FAH, #25H; target address high address 25H or 24H
MOV FAL, #3CH; target address low address 3CH or any
MOV FDAT, #00H; write data: 00H or any
MOV FCON, #82H; set START bit to 1, start page erase function. After ISP function ends, START automatically resets to 0, PC points to the next instruction

5 Problems in Application

The ISP development of SM2965 is flexible and convenient. It does not require any auxiliary hardware accessories, and the application system circuit does not need to be changed. The designer can customize any programming communication protocol and send it to SM2965 through any I/O port or UART port via a computer or simple tools. It is not like other MCUs with ISP that must be implemented for specific pins and special TIMMING protocols. However, the following points should still be noted in different applications:

(1) The SM2965 program space can be divided into two parts: the download program for executing the ISP function and the application program for executing the user program. The size of the download program space can be configured on a commercial programmer. Once the configuration is written, the download program will remain unchanged in the system application. The download program space can be configured to a maximum of 4 kB. In addition to storing the download program, fixed applications (such as the main monitoring program) should also be placed in this space, and applications that need to be frequently updated should be placed in the online programmable application space.

(2) In the case of updating only part of the application in the application system, such as changing some important parameters during system operation or using the Flash of SM2965 as EEPROM, the chip write protection and whole chip erase functions cannot be executed in the system. At this time, the application in the chip can be read through the programmer. In order to prevent illegal reading, these important parameters can be converted into ciphertext through encryption algorithms (such as DES encryption algorithm) and then stored in the application space. The ciphertext is restored to plaintext in the application by downloading the encryption algorithm and key of the program space (which cannot be read).

(3) When updating all applications in the application system, attention should be paid to the order of writing the code at the address 0000H of the Flash space. This is because after the SM2965 chip is reset, the hardware detects that if the address 0000H of the Flash space is empty (i.e. #0FFH), it will automatically jump to the entry address of the download program. Otherwise, the application program will be executed from the address 0000H. Therefore, when updating all applications, first perform a full chip erase in the download program, then start programming from page 1, i.e. address 0200H, and finally program page 0, starting from address 0001H. When all address programming is confirmed (CRC check) to be correct, program address 0000H.

(4) When using the host to remotely download and update the program, in order to solve the problem of bit errors caused by interference, the application code can be divided into several short data packets, each with a CRC. The download program should first store the data packet in the buffer and then proceed with programming after the CRC is correctly determined.

(5) Before executing the download program, if the internal watchdog timer of SM2965 is enabled, the watchdog timer should be disabled first in the download program to prevent the download from failing due to hardware reset.

(6) When updating all applications, it is recommended to start the system through hardware watchdog reset after downloading is complete, rather than using jump instructions.

When SM2965 was first used, downloading failed frequently and the SM2965 had to be reprogrammed using a commercial programmer. After taking the above measures, there has not been a single case of downloading failure in the past two years.