AnsweredAssumed Answered

Serial Boot Mode, RAppID BL Issues & Protocol

Question asked by Ken Woodruff on Apr 27, 2018



I'm still having issues getting serial boot mode to work on a MPC5605B device. When I write a very small piece of code, the RAppID BL Tool works fine, but anything over about 10K of code causes the boot loader to hang and time out before loading finishes. I thought I'd just write my own bootloader, but I seem to be missing some information. The protocol described in the RM doesn't match what the RAppID BL trace window displays. When I load the MCU using the same s-record file to blink the LED, it works when using RAppID BL and loading directly across the JTAG port, cut does not work using my custom bootloader. My bootloader follows the protocol defined in the reference manual, RAppID BL appears to use a different protocol.


From the Reference Manual:

Table 5-8. UART boot mode download protocol
step         Host sent message      BAM response      message      Action
1        64-bit password(MSB first)  64-bit password                Password checked for validity and compared against
                                                                                               stored password.
2       32-bit store address          32-bit store address             Load address is stored for future use.
3       VLE bit + 31-bit number of bytes(MSB first)
                                                   VLE bit + 31-bit number of bytes (MSB first)

                                                                                                 Size of download are stored for future use.

                                                                                                  Verify if VLE bit is set to 1
4       8 bits of raw binary data   8 bits of raw binary data      8-bit data are packed into a 32-bit word. This word is
                                                                                              saved into SRAM starting from the “Load address”.

                                                                                              “Load address” increments until the number of data
                                                                                               received and stored matches the size as specified in the
                                                                                               previous step.
5       None                               None                                       Branch to downloaded code


RAppID BL doesn't have an option to simply program SRAM. Erase and Program is the only option for loading code into the processor. Skipping past the section in the trace window that's doing "BTL"  (by the way - what's BTL?) the trace window has the following:

TX:   01 00 00 00 aa aa aa aa

RX:    ff  00 00  fe 00 00 00 00      Init

TX:   02 01 00 00 40 00 01 00

RX:    ff  00 01 fe  00 00 00 00      Erasing

TX:   10 02 00 00 02  e0 aa aa

RX:    ff  00 02 fe  00 00 00 00      Erasing

TX:     22 03 02 36 02 47 02 58   

                      ^ My code starts here and continues on the subsequent lines

RX:     ff  00 03 00 40  00 01 0C


The first two bytes transmitted by RAppID appear to be some sort of header, with the second byte being a counter that increments with each message. Is the first byte a command byte? If so, what does it mean? (All of the "command bytes" while the app is being uploaded are 22.)


The reference manual indicates that whatever the host sends to the MCU, is echoed back. This does not appear to be what is happening with the RAppID BL tool as can be seen in the records copied from the trace window above.


(From reference manual):

The communication is done in half duplex manner, whereby the transmission from the host is followed by the microcontroller transmission mirroring the transmission back to the host:

  • "Host sends data to the microcontroller and waits for a response.
  • "MCU echoes to host the data received.
  • "Host verifies if echo is correct:

— "If data is correct, the host can continue to send data.

— "If data is not correct, the host stops transmission and the microcontroller enters static mode.”


The last messages transmitted by the RAppID BL, copied from the trace window are here:

TX: 22 56 00 00 00 00 00 00 APP 99%
TX: 22 57 00 00 00 00 00 00 APP 99%
TX: 22 58 00 00 00 00 00 00 APP 100%
TX: 22 59 00 00 00 00 00 00 APP 100%
TX: 22 5A 00 00 FF FF FF FF APP 100%
TX: 20 5B 08 40 00 01 00 AA Start Application


I can't find any documentation for the last transmitted message that says "Start Application"  Where is information available about this? 


When my simple bootloader program executes, it transmits the data as described in the reference manual, and the data goes across and is reflected back, but it doesn't branch to the start address once the last data byte has been transmitted. 


Is there a document that describes what the RAppID BL tool is transmitting, the protocol it is using, and what the extra bytes (command? Counter?) transmitted are? Is more information available than what is in the reference manual about serial boot mode? I have and have read the manual embedded in RAppID BL tool.  I'd be happy to use the RAppID tool if it didn't crash (always with a timeout error message) before it finishes loading.


Here are my questions:


  1. Why does RAppID BL crash before it completes uploading my larger files?


  1. Why is does the RAppID BL transmit more than what is described in the MPC5605B Reference manual to the evaluation board?


  1. Why does my small program that loads memory (SRAM) not jump to the start address when upload is complete?  (My program to blink the led works fine fine when uploaded with RAppID BL or using the JTAG port.)
  2. The data below shows where the RAppID BL transitions from "BTL" to "App". Is there a document that gives more information about RAppID BL, how it works, and what it transmits?
  3. What is BTL?
  4. What is happening during the part of the trace window that says "Init"?
  5. What is happening when the trace window says "Erasing"?
  6. Are these two activities required for serial boot mode?
  7. Why does RAppID BL not appear to transmit all of the zeros I added to my Motorola S-record file (to make sure there were no “gaps” in the loaded memory)?
  8. Is there a "command" that needs to be issued after serial boot mode code is loaded to start the application? (see trace window snipp above)


The following was snipped from the RAppID BL trace window across the transition from "BTL" to loading the App:

 TX: 00 00 00 00 BTL 99%
TX: 00 00 00 00 BTL 99%
TX: 00 00 00 00 BTL 99%
TX: 00 00 00 00 BTL 100%
TX: 01 00 00 00 AA AA AA AA 
RX: FF 00 00 FE 00 00 00 00 Init
TX: 02 01 00 00 40 00 01 00 
RX: FF 00 01 FE 00 00 00 00 Erasing
TX: 10 02 00 00 02 E0 AA AA 
RX: FF 00 02 FE 00 00 00 00 Erasing
TX: 22 03 02 36 02 47 02 58 APP 0%
TX: 22 04 78 00 00 A7 78 00 APP 0%
TX: 22 05 01 19 18 21 06 F8 APP 0%
TX: 22 06 48 00 D0 01 2C 00 APP 1%
TX: 22 07 D1 01 78 00 00 AD APP 1%


I'm using an XPC56XX EVB Motherboard and an XPC560B daughtercard with an SPC5605B processor on it.