1) There are two ways how to program MCU with self made programmer – either via BDM or using bootloader. Of course, bootloader also requires its load via BDM.
If you use mass erase command then it is suitable immediately unsecure the mcu by rewriting the security byte in the flash. If it is not done then the MCU is secured after next reset.
You can also erase the flash sector by sector.
Bootloader is described here:
https://community.nxp.com/t5/S12-MagniV-Microcontrollers/S12Z-MagniV-Serial-Bootloader-Interface/m-p...
https://community.nxp.com/t5/S12-MagniV-Microcontrollers/Simple-Serial-Bootloader-for-S12Z-AN-draft/...
First of all you should read the data sheet to understand how the programming and erasing memory works.
2) If you mean you want to program the data into the EEPROM and FLASH by means your application SW, then it is another story.
In both cases it is necessary to switch off the memory window (or shift to the part which is not EW) because it reads flash and it is not allowed to read the flash while it is E/W.
My question is. Does the “self made programmer” means bootloader or debug interface or your application SW?
To find register values, the best way is to look into a header file.
I understand your code as a programming algorithm and commands you are sending via BDM to the MCU. Am I right?
So, once more. I ask for confirmation. You communicate with the MCU via your own BDM interface using BDM commands.
Am I right? If yes then it is relatively easy to port SW algorithm for E/W to BDM command flow. Of course this step by step programming algorithm is not fast but it is suitable for first approach to understand procedures.
You have been asking about addresses of register. => The data sheet.
One good note. After reset the MCU works on defined busclk with internal oscillator until you change it. If you want to use this clock then you do not have to touch PLL oscillator setup.
So, for example… prepared in one breath without checking…..There BDM COMMANDS are in the data sheet … it is just simply rewrites SW procedure to BDM procedure.
//MASSERASE FLASH
Send_cmd(ERASE_FLASH); // BDM_cmd=0x95
Wait(16); // d=delay 16 target BDCSI clock cycles (DLY)
//UNSECURE DEVICE AFTER MASS ERASE - WRITE SECURITY SECTOR
//WRITE_MEM.sz Non-intrusive Yes (0x10+4 x sz)/ad24/wd.sz/dack Write the appropriately-sized (sz) memory value to the location specified by the 24-bit address
Write_Mem(soByte, FSTAT, 0x30) // clear ACCERR and PVIOL: soByte= 0x10, FSTAT (0x386) = 0x380+0x0006, BDM_cmd=0x30
Wait(16 or 32); //based on protocol
//Write entire sector, size of flash sector = 512 bytes, write is performed via writing full phrase (must be erased) at once = 8bytes/4words
Write_Mem(soByte, FCCOBIX, 0x05) // clear ACCERR and PVIOL: soByte= 0x10, FCCOBIX (0x382) = 0x380+0x0006, data=0x05 … we will write command up to FCCOB5
Wait(16 or 32); //based on protocol
Write_Mem(soByte, FCCOB0Hi, 0x06) // soByte= 0x10, FCCOB0Hi (0x38C), flash_cmd=0x06 -> write


Wait(16 or 32); //based on protocol
Write_Mem(SoByte, FCCOB0Lo, AddrHi) // SoByte= 0x10, FCCOB0Lo(0x38D), 2nd byte of the address to be written AddrHi =(address & 0x00FF0000)>>16) = 0xFF …. Se table flash configuration field bellow
Wait(16 or 32); //based on protocol
Write_Mem(soWord, FCCOB1, AddrLo) // Word= 0x14, FCCOB1(0x38E), low word of the address to be written AddrLo= (address & 0x0000FFFF) = 0xFE08;
Wait(16 or 32); //based on protocol
// write flas security field data0=0xFFFF, data1=0xFFFF, data2=0xFFFF, data3=0xFFFE (unsecure the MCU after next reset)
// if you do not unsecure it then after next reset it will be secured again
Write_Mem(soWord, FCCOB2, data0) // soWord = 0x14, FCCOBIX (0x390), data0=zeroth data word from phrase
Wait(16 or 32); //based on protocol
Write_Mem(Word, FCCOB3, data1) // soWord= 0x14, FCCOBIX (0x392), data1=1st data word from phrase
Wait(16 or 32); //based on protocol
Write_Mem(soWord, FCCOB4, data2) // soWord = 0x14, FCCOBIX (0x394), data2=2nd data word from phrase
Wait(16 or 32); //based on protocol
Write_Mem(soWord, FCCOB5, data3) // soWord = 0x14, FCCOBIX (0x396), data3=3rd data word from phrase
Wait(16 or 32); //based on protocol
//Launch command
Write_Mem(soByte, FSTAT, 0x80) // soByte= 0x10, FSTAT (0x386), cmd=cler CCIF, start command
/*Waiting for CCIF …You can either load this code to RAM and execute waiting code or
You can read the FSTAT by BDM and chceck CCIF or
wait for given defined number of milliseconds defined in the flash data for write cycle
I am not going to do it here but it is suitable to be sure the operation has finished
As well as I am not going to check error messages for ACCER and PVIOL.
*/
ResetMCU(); // your own procedure to reset the MCU, after reset it will be in unsecured state
//now the device is prepared for loading entire memory except security “phrase” and its sector which should be erased individually and rewritten to the required value based on S19 record.
// of course you procedure can be different but is is up to your ideas and design.
/*** FCCOBIX - Flash CCOB Index Register; 0x00000382 ***/
/*** FSTAT - Flash Status Register; 0x00000386 ***/
/*** FCCOB0 - Flash Common Command Object Register; 0x0000038C ***/
/*** FCCOB0HI - Flash Common Command Object Register High; 0x0000038C ***/
/*** FCCOB0LO - Flash Common Command Object Register Low; 0x0000038D ***/
/*** FCCOB1 - Flash Common Command Object Register; 0x0000038E ***/
/*** FCCOB2 - Flash Common Command Object Register; 0x00000390 ***/
/*** FCCOB3 - Flash Common Command Object Register; 0x00000392 ***/
/*** FCCOB4 - Flash Common Command Object Register; 0x00000394 ***/
/*** FCCOB5 - Flash Common Command Object Register; 0x00000396 ***/
