How to read flash and EEPROM with USBDM from HCS08?

[chris02]

Hello,

my Name is Chris from Germany and I'm new at freescale µC, so pleace be patient. :smileywink:

My goal is to read eeprom and flash of a MC9S08AW48 and MC9S08AC48. EEPROM is definetly not fused, because error codes are stored in it, which need to be read for diagnostig. The flash part also shound't be locked, 'cos I read something about it on russian board (with google translation).

My sevice is based on JB16, I ordered it from china and didn't know before, that this is an old device. Yesterday I ordered a JS16 based one, but shipping will need about four weeks.

USBDM device is correctly installed and I'm able to detect chip with HCS08 programmer.

Now I don't know what to do anymore.Joel from http://myfreescalewebpage.free.fr told me that this could be possible with usbdmcript.exe but don't know if it is possible with JB16 and how to do.

Maybe someone can help me!

Best regards from Germany

Chris

[chris02]

Thanks for all your great answers.

I'l try it on Monday.

pgo

When will Version 40 released?

Can you also re-upload schematics and Bom's of programmers? They are offline.

Is pcb layout also included?

So man thank@all, i'l Post results. Also if it works with jb16 programmer.

[pgo · Accepted solution]

Hi Chris,

I have added the Gerbers for the JB16 design but they are VERY OBSOLETE and not recommended.

Provided for reference only.

The other designs e.g. JS16 are already available on Sourceforge:

USBDM download | SourceForge.net

bye

[chris02]

I already have a JB16 flasher (from china). I'll built JM programmer by my self and already ordered parts from mouser.

Which tool can I use to open gerber file? I tried GC-Prevue, but it won't work.

On your homepage BOMs are linked to a non existing dir at sourceforge, that's the reason why I didn't find it. :smileywink:

USBDM dumper seems to work pretty well. But I found a bug. If you will enter FFFFFF dumper crashes.

Now I'm trying to get adresses of MC9S08AW48.

(http://www.mouser.com/ds/2/161/MC9S08AW60-25823.pdf )

On page 40 in datasheet is an adressmap. To clone the µC I need to set end adress to 0xFFFF?

Width settings is for reading speed?

Sorry for all these questions!

[pgo]

Hi Chris,

The width is the width of the memory access - 1, 2 or 4 bytes at a time.  Some devices have memory regions that can only be accessed at a particular memory width.

The memory range must agree with the width i.e. be a multiple of the width.

For the MC9S08AW48 the ranges would be:

With the crash - can you provide more information?

• Target device
• Actual range and width

Note: The dumper does NOT support banked memory as used for HCS08/HCS12.  I will have to think how to do this.

It didn't crash when I did a quick test but that may be because of the device I was using.

I have used gerbv - A Free/Open Source Gerber Viewer to view Gerber files under windows.  I believe there is a Linux version.

bye

[Wuzhong]

Hi,

My chip is S9S12ZVL16F0MLC and why to writ and read data form FFE800~FFE80D?

is it right?

Thanks

Boone

[chris02]

Hey pgo,

thanks for your kindly replys and explainigng width.

The tool crashes if you enter 6 times F (FFFFFF). Maybe there is a buffer overflow? But it doesn't realy matter, because with normal AW48 Adress (0xFFFF) everything is working fine.

Today I got my replacment MC9S08WA48. HCS08 programmer detects the chip, but can't erase it. I get an error "unsecuring the device failed. Reason: Target is secured".

I checked soldering of new µC twice with microscope. Everything is ok. What I'm doing wrong?

PS: In china (at elecrow) I ordered some pcs of your JMxx PCB. Are you from europe? Do you need one and can I send one to you as a gift for supporting me?

[pgo]

Hi Chris,

I have fixed the crash on Memory Dump (I hope).

I suspect you are doing nothing wrong.

Sometimes the BDM will have trouble connecting, or rather, staying connected to a blank target.  This is due to the Watchdog timer resetting the target after an initial OK connection.  It tends to be a bit variable but usually it will eventually connect and disable the Watchdog.  I'm a bit puzzled why it is causing you problems.

I don't have a AW48 to test with.  The nearest I have is an AC60 which appears similar but may have a different watchdog timer interval.

It seems to connect reasonable reliably.

If you have access to an oscilloscope you can get some idea if the watchdog is causing the problem - You would observe the reset signal pulsing.

I would try the MassErase button and see what the result is.

bye

PS. The 4.11.1.50 version has improved connection sequence that would probably be worth testing.  I tried it with a JB16 BDM + and MC9S08AC60 and it handled both watchdog and illegal instruction resets.

[chris02]

Hi pgo,

I'm glad that you found the bug.

Today I tried again to flash/erase and I didn't get a secure error. Mass erasing is working now, somtimes (so I guess you are right with watchdog problem).

But if I try to flash a dump (made with your memory dumper) I get another error: "Program data not within target Flash Memory". For settings see my attached screenshot.

Thanks so much and best regards

Chris

[pgo]

Hi Chris,

The error means that the programmer has detected data that doesn't lie with valid Flash memory.

This may mean that you are saving an incorrect range of memory or I have incorrectly specified the memory range for the AW48 in the USBDM configuration file  hcs08_devices.xml.

Can you post information about the range you are saving so that I can check please?

If it is not confidential you could also post the image file so I can check if there is a bug in the memory dump program.

bye

PS. The range assumed in hcs08_devices.xml  is: 0x4000...0xFFFF based on the memory map in the AW48 manual (p40).

	<device family="HCS08" name="MC9S08AW48">
	<clock registerAddress="0x0048" type="S08ICGV4" />
	<memory type="ram">
	<memoryRange start="0x000070"  end="0x00086F"/>
	</memory>
	<memory registerAddress="0x1820" type="flash" securityAddress="0xFFB0">
	<securityEntryRef ref="HCS08-default-security" />
	<memoryRange start="0x004000" end="0x00FFFF" />
	</memory>
	<sdid value="0x008" />
	</device>

[pgo]

The latest version of USBDM (4.11.1.40) now includes a utility to dump the memory from an unsecured target device.

bye

[pgo]

If usbdmScript works with the JB16 (no guarantees) then it should be possible inspect the flash contents - but not in a particularly convenient fashion.

The following should work (assuming latest version)

• settarget hcs08
• openbdm
• reset sh
• connect
• rb start_address size

bye

[ChrisTango]

Hi Chris,

I had a similar question, see this post Read image from device​.

Perhaps that helps out already.

Regards,

Chris