A Post from March to July 2016 - recovered after an accidental deleting session!
Just over a month ago I talked about the MSP430 bootloader - commonly known as BSL - or bootstrap-loader.
Almost every MSP430 has the facility to load code via this ROM based bootloader - and when first introduced about 15 years ago, it was ahead of its time. The clever engineers at Texas Instruments wanted a simple "Backdoor" method of getting code into the device, using nothing more than a 9 pin serial com port, some trivial level shifting electronics and a modest program running on a PC.
Whilst the 9 pin serial port may have long since disappeared, the BSL is still present in almost every chip - and not just for a UART connection, but for I2C and SPI interfaces too.
With the advent of ferroelectric, non-volatile FRAM memory in the recent range of MSP430 mcus there is all the more reason to want to leverage on the strengths of the BSL and develop neat new means to get code into these often understated devices. With a wireless or Bluetooth connection - firmware over the air (FOTA) becomes practical, and also "self-replicating" gadgets - where one MSP430 equipped gadget can "clone itself" into another unprogramed device - ideal for kids sharing hardware around the playground.
What I have Learned this Month
I have now been using this bootloader on and off for a month, and wanted to share with you what I have learned - in the hope that things are easier for those that may wish to follow in my footsteps.
All the information is out there - it's just not all in one place, and a lot of time has been spent finding snippets here and there, and trying to make sense of it all. Like Captain Kirk said... "Our continuing, 5 year mission......"
To start off, you might wish to look at the following TI documentation
Main Bootloader Specification
MSP430FR4xx / MSP430FR2xx Users Manual
MSP430FR4xx and MSP430FR2xx Bootloader (BSL)
Hardware Initialisation
Almost every MSP430 has the facility to load code via this ROM based bootloader - and when first introduced about 15 years ago, it was ahead of its time. The clever engineers at Texas Instruments wanted a simple "Backdoor" method of getting code into the device, using nothing more than a 9 pin serial com port, some trivial level shifting electronics and a modest program running on a PC.
Whilst the 9 pin serial port may have long since disappeared, the BSL is still present in almost every chip - and not just for a UART connection, but for I2C and SPI interfaces too.
With the advent of ferroelectric, non-volatile FRAM memory in the recent range of MSP430 mcus there is all the more reason to want to leverage on the strengths of the BSL and develop neat new means to get code into these often understated devices. With a wireless or Bluetooth connection - firmware over the air (FOTA) becomes practical, and also "self-replicating" gadgets - where one MSP430 equipped gadget can "clone itself" into another unprogramed device - ideal for kids sharing hardware around the playground.
What I have Learned this Month
I have now been using this bootloader on and off for a month, and wanted to share with you what I have learned - in the hope that things are easier for those that may wish to follow in my footsteps.
All the information is out there - it's just not all in one place, and a lot of time has been spent finding snippets here and there, and trying to make sense of it all. Like Captain Kirk said... "Our continuing, 5 year mission......"
To start off, you might wish to look at the following TI documentation
Main Bootloader Specification
MSP430FR4xx / MSP430FR2xx Users Manual
MSP430FR4xx and MSP430FR2xx Bootloader (BSL)
Hardware Initialisation
The basic idea is that the PC uses the DTR line and the RTS line of the USB to Serial converter to create a pulse sequence which when recognised by internal state machine hardware, causes the MCU to enter Boot Mode.
 |
| The hardware sequence needed to invoke the Bootloader mode |
The key points are that there are 2 pulses on the RST/TEST line, the first is 10mS longs and the second is 20mS long. The RESET line (DTR) rises whilst the 2nd RST pulse is still high, and approximately at half way through its duration.
This sequence has been chosen because it uses both edges and levels to encode the BSL envoke command, and the hardware that responds to this sequence is unlikely to be falsely triggered by any spurious noise or other accidental stimulii.
In theory, any bit of hardware that can generate this pattern can be used to invoke BSL mode, all it does is cause the mcu to jump into the bootloader code and the /RESET and TEST lines have no further function within the body of the programming process that follows immediately after this pulse sequence.
After the BSL start sequence has been sent, the Tx and Rx lines become active as data and acknowledgements are sent between the PC and the MSP430. This can be at 9600 baud, with even parity, but some faster BSL programs begin at 9600 baud and request a step up to a faster baudrate for the duration of the programming.
At the end of the programming sequence, the PC returns the TEST line high - as shown on the right of the sketch above.
Ideally the reset line should go low and then high to issue a rest pulse - but this is dependent on the PC application and is not always the case.
This may seem simple so far - but then there is the old saying "If it can go wrong, it will go wrong".
The problem arises in that over the 6 generations of MSP430 - there have been several different start sequences, for the families of 1xx, 2xx, 4xx 5xx, 6xx and FRxx devices.
As the hardwware to drive the bootloader evolved from a simple 9 pin RS232 Comm port - where some of the handshaking lines are inverted, the original specification was aimed at what was easiest to implement from a standard serial port.
In addition, some MSP430 devices share their /RESET and TEST pins with JTAG functions - so to differentiate between JTAG commands and BSL commands sometimes one or both of RST and DTR shown above are inverted.
Here are a few pointers to get you up and running quickly
1. Make sure that /RESET connects to DTR and TEST connects to RTS - easily mixed up.
2. As a temporary hack, be prepared to add a P-FET to invert DTR line so that /RESET is active low. See picture below
3. Some PC applications allow you to swap or individually invert the RTS and DTR lines - but only available for 1xx, 2xx, 4xx.
 |
| A P-FET and 10K resistor were added to invert the DTR signal for /RESET |
PC Software
I have found at least 3 variations of PC BSL Scripting applications. Here are the links:
Open Source from FlyingCamp Design
FlyingCamp BSL Library
FlyingCamp BSL - Utility (1xx, 2xx, 4xx only)
There may be more available, but I struggled to find anything that gave me exactly what I needed.
In the end, despite the msp430-bsl-utility being almost exactly what I needed with the means to swap and individually invert RTS and DTR. However this utility was not compatible with 5xx and 6xx Bootloaders.
To make the bootloader work, I had to use the 5XX mode and invert the DTR (RESET) signal using a P- FETtransistor - in order to match the signal diagram above.
Once you can generate the correct boot sequence - the rest is fairly easy.
The script for the BSL is very short - use a filename such as script1.txt
MODE 5xx COM9 // Set 5XX mode with USB VCP on COM9
RX_PASSWORD // Use Default Password (optional)
MASS_ERASE // Erase the device
RX_DATA_BLOCK_FAST blink_2433.txt // Send the TI TXT file blink_2433.txt
SET_PC 0xC400 // Set the Program Counter to 0XC400 - ready to run
RX_PASSWORD // Use Default Password (optional)
MASS_ERASE // Erase the device
RX_DATA_BLOCK_FAST blink_2433.txt // Send the TI TXT file blink_2433.txt
SET_PC 0xC400 // Set the Program Counter to 0XC400 - ready to run
The comments are for explanatory purposes only - although if you include them in the script, comments should be on separate lines to any script instruction
To use this, put the bsl_scripter.exe, the script1.txt and the blink_2433.txt file all in the same directory.
Run by typing
bsl_scripter.exe script1.txt
 |
| Typical output session from BSL_scripter |
If all goes well, this takes a couple of seconds to run - after DTR has been allowed to go high again at the end of the programming.
Further work required - should be possible to invert DTR in software - so that it doesn't need the hardware hack with the transistor. The BSL utility GUI is the way to go, if someone with Python skills would just hack it to handle 5xx bootloader format
The programmer should be modified so that it releases DTR at the end of the programming sequence - so that the code autoruns after loading.
A neat way of programming a MSP430 with very simple USB-serial converter - just need 10% more effort in the PC software to allow it to handle the newer parts - without having to resort to command line and P-FETS!
I enjoyed reeading your post
ReplyDelete