dsPIC30F SMPS

dsPIC30F SMPSdsPIC30F SMPS Flash Programming Specification

1.0 OVERVIEW AND SCOPEThis document defines the programming specificationfor the dsPIC30F Switched Mode Power Supply(SMPS) and Digital Power Conversion family of DigitalSignal Controller (DSC) devices. The programmingspecification is required only for developers ofthird-party tools that are used to program dsPIC30FSMPS devices. Customers using dsPIC30F SMPSdevices should use development tools that alreadyprovide support for device programming.

This document includes programming specificationsfor the following devices:

� dsPIC30F1010� dsPIC30F2020� dsPIC30F2023

The dsPIC30F SMPS family enters programmingmodes via the 32-bit serial key sequence clocked intothe PGD line, similar to the dsPIC33F family. On theother hand, the programming operations themselvesare similar to the other dsPIC30F devices.

The dsPIC30F SMPS family does not contain dataEEPROM.

2.0 PROGRAMMING OVERVIEW OF THE dsPIC30F SMPS

The dsPIC30F SMPS family of DSCs contains a regionof on-chip memory used to simplify deviceprogramming. This memory region can store aprogramming executive, which allows the dsPIC30FSMPS to be programmed faster than the traditionalmethod. Once the programming executive is stored tomemory by an external programmer (such asMicrochip�s MPLAB® ICD 2 or PRO MATE® II), it canthen interact with the external programmer to efficientlyprogram devices.

The programmer and programming executive have amaster-slave relationship, where the programmer isthe master programming device and the programmingexecutive is the slave, as illustrated in Figure 2-1.

There are two different methods used to program thechip in the user�s system. One method uses theEnhanced In-Circuit Serial ProgrammingTM (EnhancedICSPTM) protocol and works with the programmingexecutive. The other method uses In-Circuit SerialProgramming (ICSP) protocol and does not use theprogramming executive.

The Enhanced ICSP protocol uses the faster,high-voltage method that takes advantage of theprogramming executive. The programming executiveprovides all the necessary functionality to erase,program and verify the chip through a small commandset. The command set allows the programmer toprogram the dsPIC30F without having to deal with thelow-level programming protocols of the chip.

FIGURE 2-1: OVERVIEW OF dsPIC30F SMPS FAMILY PROGRAMMING

The ICSP programming method does not use theprogramming executive. It provides native, low-levelprogramming capability to erase, program and verifythe chip. This method is significantly slower because ituses control codes to serially execute instructions onthe dsPIC30F SMPS device.

This specification describes both the Enhanced ICSPand ICSP programming methods. Section 3.0�Programming Executive Application� describesthe programming executive application andSection 5.0 �Device Programming� describes itsapplication programmer�s interface for the host.

Programmer

dsPIC30F

ProgrammingExecutive

On-chip Memory

2

© 2007 Microchip Technology Inc. DS70284B-page 1

dsPIC30F SMPS
2.1 Hardware RequirementsIn Enhanced ICSP mode, the dsPIC30F SMPSrequires a single programmable power supply for VDD.Refer to Section 13.0 �AC/DC Characteristics andTiming Requirements� for hardware parameters.
2.2 Pins Used During ProgrammingTable 2-2 lists the pins that are required forprogramming. Refer to the appropriate device datasheet for complete pin descriptions.

2.3 Program Memory MapThe program memory space extends from 0x0 to0xFFFFFE. Code storage is located at the base of thememory map and supports up to 12 Kbytes (4Kinstruction words). Table 2-1 shows the location andprogram memory size of each device variant.

TABLE 2-1: CODE MEMORY MAP AND SIZE

Locations 0x800000 through 0x8005BE are reservedfor executive code memory. This region stores eitherthe programming executive or the debuggingexecutive. The programming executive is used fordevice programming, while the debug executive isused for in-circuit debugging. This region of memorycannot be used to store user code.

Locations 0xF80000 through 0xF8000E are reservedfor the Configuration registers. The bits in theseregisters may be set to select various device options,and are described in Section 5.7 �Configuration BitsProgramming�. The Configuration bits read outnormally, even after code protection is applied.

Locations 0xFF0000 and 0xFF0002 are reserved forthe Device ID registers. These bits can be used by theprogrammer to identify which device type is beingprogrammed and are described in Section 10.0�Device ID�. The device ID reads out normally, evenafter code protection is applied.

Figure 2-2 shows the memory map for the dsPIC30FSMPS variants.

2.4 Data EEPROM MemoryThe dsPIC30F SMPS family has no data EEPROM.

TABLE 2-2: PIN DESCRIPTIONS (PINS USED DURING PROGRAMMING)

dsPIC30F SMPS Device

Code Memory Map(Size in Instruction Words)

dsPIC30F1010 0x000000-0x000FFE (2K)dsPIC30F2020 0x000000-0x001FFE (4K)dsPIC30F2023 0x000000-0x001FFE (4K)

Pin NameDuring Programming

Pin Name Pin Type Pin Description

MCLR MCLR P Programming Enable

VDD and AVDD(1) VDD P Power Supply

VSS and AVSS(1) VSS P Ground

PGC PGC I Primary Programming Pin Pair: Serial Clock

PGD PGD I/O Primary Programming Pin Pair: Serial Data

PGC1 PGC1 I Secondary Programming Pin Pair: Serial Clock

PGD1 PGD1 I/O Secondary Programming Pin Pair: Serial Data

PGC2 PGC2 I Tertiary Programming Pin Pair: Serial Clock

PGD2 PGD2 I/O Tertiary Programming Pin Pair: Serial Data

Legend: I = Input, O = Output, P = PowerNote 1: All power supply and ground pins must be connected, including analog supplies (AVDD) and ground

(AVSS).

DS70284B-page 2 © 2007 Microchip Technology Inc.

dsPIC30F SMPS
FIGURE 2-2: PROGRAM MEMORY MAP
Use

r Mem

ory

Spac

e

000000

Configuration Registers

User FlashCode Memory

018000017FFE

Con

figur

atio

n M

emor

ySp

ace

(48K x 24-bit)

800000

F80000(8 x 16-bit) F8000E

F80010

Device IDFEFFFEFF0000

FFFFFE

Reserved

F7FFFE

Reserved

8005BE8005C0

Executive Code Memory

7FFFFE

Reserved

FF0002FF0004Reserved

(2 x 16-bit)

(Reserved)

Note: The address boundaries for user Flash code memory are device specific.

Unit ID8005FE800600

(32 x 24-bit)


dsPIC30F SMPS

3.0 PROGRAMMING EXECUTIVE APPLICATION

3.1 Programming Executive OverviewThe programming executive resides in executivememory and is executed when Enhanced ICSPProgramming mode is entered. The programmingexecutive provides the mechanism for the programmer(host device) to program and verify the dsPIC30FSMPS, using a simple command set andcommunication protocol.

The following capabilities are provided by theprogramming executive:

� Read memory- Code memory- Configuration registers- Device ID

� Erase memory- Bulk Erase by segment- Code memory (by row)

� Program memory- Code memory- Configuration registers

� Query- Blank Device- Programming executive software version

The programming executive performs the low-leveltasks required for erasing and programming. Thisallows the programmer to program the device byissuing the appropriate commands and data.

The programming procedure is outlined in Section 5.0�Device Programming�.

3.2 Programming Executive Code Memory

The programming executive is stored in executive codememory and executes from this reserved region ofmemory. It requires no resources from user codememory.

3.3 Programming Executive Data RAMThe programming executive uses the device�s dataRAM for variable storage and program execution. Oncethe programming executive is run, no assumptionsshould be made about the contents of data RAM.

4.0 CONFIRMING THE CONTENTS OF EXECUTIVE MEMORY

The programmer must confirm that the programmingexecutive is stored in executive memory, before theprogramming is begun. The procedure for this task isshown in Figure 4-1.

First, In-Circuit Serial Programming mode (ICSP) isentered. The unique application ID word stored inexecutive memory is then read. If the programmingexecutive is resident, the application ID word is 0xBB,which means programming can resume as normal.However, if the application ID word is not 0xBB, theprogramming executive must be programmed toExecutive Code memory using the method described inSection 12.0 �Programming the ProgrammingExecutive to Memory�.

Section 11.0 �ICSP� Mode� describes the processfor the ICSP programming method. Section 11.11�Reading the Application ID Word� describes theprocedure to read the application ID word in ICSPmode.

FIGURE 4-1: CONFIRMING PRESENCE OF PROGRAMMING EXECUTIVE

Is

Start

Enter ICSP� Mode

Application ID0xBB?

Resident in Memory

Yes

No

Prog. Executive is

Application IDRead the

be ProgrammedProg. Executive must

from Address0x805BE

Finish


dsPIC30F SMPS

5.0 DEVICE PROGRAMMING

5.1 Overview of the Programming Process

Once the programming executive has been verifiedin memory (or loaded if not present), the dsPIC30FSMPS can be programmed using the command setshown in Table 5-1. A detailed description for eachcommand is provided in Section 8.0 �ProgrammingExecutive Commands�.

TABLE 5-1: COMMAND SET SUMMARY

A high-level overview of the programming process isshown in Figure 5-1. The process begins by enteringEnhanced ICSP mode. The chip is then bulk erased,which clears all memory to �1� and allows the device tobe programmed. The Chip Erase is verified beforeprogramming begins. Next, the code memory, dataFlash and Configuration bits are programmed. Asthese memories are programmed, they are eachverified to ensure that programming was successful. Ifno errors are detected, the programming is completeand Enhanced ICSP mode is exited. If any of theverifications fail, the procedure should be repeated,starting from the Chip Erase.

FIGURE 5-1: PROGRAMMING FLOW

Command Description

SCHECK Sanity checkREADD Read Configuration registers and

device IDREADP Read code memory PROGP Program one row of code memory and

verifyPROGC Program Configuration bits and verifyERASEB Bulk Erase or Segment EraseERASEP Erase code memoryQBLANK Query if the code memory is blankQVER Query the software version

Start

Program and

Program and

Program and verify Configuration bits

Finish

verify code

verify data

Enter Enhanced ICSP� Mode

Exit EnhancedICSP Mode

Perform chiperase

Program configregisters to default

value


dsPIC30F SMPS
5.2 Entering Enhanced ICSP ModeFigure 5-2 shows the three steps required to enterEnhanced ICSP Program/Verify mode:
1. The MCLR pin is briefly driven high, then low.2. A 32-bit key sequence is clocked into PGD.3. MCLR is then driven high within a specified

period of time and held.

The programming voltage applied to MCLR is VIH,which is essentially VDD in the case of dsPIC30FSMPS devices. There is no minimum time requirementfor holding at VIH. After VIH is removed, an interval of atleast P16 must elapse before presenting the keysequence on PGD.

The key sequence is a specific 32-bit pattern,�0100 1101 0100 0011 0100 1000 0101 0000�(more easily remembered as 0x4D434850 in

hexadecimal format). See Appendix A: �Hex FileFormat� for more information. The device entersProgram/Verify mode only if the key sequence is valid.The Most Significant bit (MSb) of the most significantnibble must be shifted in first.

The key data is clocked on the rising edge of the clockPGC. Once the key sequence is complete, VIH must beapplied to MCLR and held at that level for as long asProgram/Verify mode has to be maintained. An intervalof at least time P17 and P7 must elapse beforepresenting data on PGD. Signals appearing on PGDbefore P7 has elapsed will not be interpreted as valid.

On successful entry, the program memory can beaccessed and programmed in serial fashion. While inthe Program/Verify mode, all unused I/Os are placed inthe high-impedance state.

FIGURE 5-2: ENTERING ENHANCED ICSP� MODE

5.3 Exiting Enhanced ICSP ModeExiting Program/Verify mode is done by removing VIHfrom MCLR, as shown in Figure 5-3. The onlyrequirement for exit is that an interval P9b shouldelapse between the last clock and program signals onPGC and PGD before removing VIH.

FIGURE 5-3: EXITING ENHANCED ICSP� MODE

5.4 Chip EraseBefore a chip can be programmed, it must be erased.The Bulk Erase command (ERASEB) is used to performthis task. Executing this command with the MScommand field set to 0x3 erases all code memory andcode-protect Configuration bits. The Chip Eraseprocess sets all bits in these three memory regions to �1�.

Since code protection Configuration bits are noterasable, they must be manually set to �1� usingmultiple PROGC commands. One PROGC commandmust be sent for each Configuration register (seeSection 5.7 �Configuration Bits Programming�).

MCLR

PGD

PGC

VDD

P6P12

b31 b30 b29 b28 b27 b2 b1 b0b3...

Program/Verify Entry Code = 0x4D434850

P2BP2A

P16

P17

0 1 0 0 1 0 0 0 0

P7VIH VIH

MCLR

P9b

PGD

PGD = Input

PGC

VDD

VIH

VIH

P15

Note: The Device ID registers cannot be erased.These registers remain intact after a ChipErase is performed.


dsPIC30F SMPS
5.5 Blank CheckThe term �Blank Check� means to verify whether thedevice has been successfully erased and has noprogrammed memory cells. A blank or erased memorycell reads as a �1�. The following memories must beblank checked: � All implemented code memory� All Configuration bits (for their default value)
The Device ID registers (0xFF0000:0xFF0002) can beignored by the Blank Check since this region storesdevice information that can not be erased. Additionally,all unimplemented memory space should be ignoredfrom the Blank Check.The QBLANK command is used for the Blank Check. Itdetermines if the code memory is erased by testingthese memory regions. A �BLANK� or �NOT BLANK�response is returned. The READD command is used toread the Configuration registers. If it is determined thatthe device is not blank, it must be erased (seeSection 5.4 �Chip Erase�) before attempting toprogram the chip.

5.6 Code Memory Programming5.6.1 OVERVIEWThe panel architecture for the Flash code memoryarray consists of up to 128 rows of thirty-two, 24-bitinstructions. Each panel stores up to 4K instructionwords. Each dsPIC30F SMPS variant has one memorypanel (see Table 5-2).

TABLE 5-2: DEVICE CODE MEMORY SIZE

5.6.2 PROGRAMMING METHODOLOGYCode memory is programmed with the PROGPcommand. PROGP programs one row of code memoryto the memory address specified in the command. Thenumber of PROGP commands required to program adevice depends on the number of rows that must beprogrammed in the device.A flowchart for programming of code memory is shownin Figure 5-4. In this example, all 4K instruction wordsof a dsPIC30F2020 device are programmed. First, thenumber of commands to send (called�RemainingCmds� in the flowchart) is set to 128 and thedestination address (called �BaseAddress�) is set to �0�. Next, one row in the device is programmed with a PROGPcommand. Each PROGP command contains data for onerow of code memory. After the first command isprocessed successfully, �RemainingCmds� is

decremented by �1� and compared to �0�. Since there aremore PROGP commands to send, �BaseAddress� isincremented by 0x40 to point to the next row of memory. On the second PROGP command, the second row of eachmemory panel is programmed. This process is repeateduntil the entire device is programmed. No specialhandling must be performed when a panel boundary iscrossed.

5.6.3 PROGRAMMING VERIFICATIONAfter programming the code memory, the contents ofmemory can be verified to ensure that programmingwas successful. Verification requires code memory tobe read back and compared against the copy held inthe programmer�s buffer. The READP command can be used to read back all theprogrammed code memory.Alternatively, you can have the programmer performthe verification once the entire device is programmedusing a checksum computation, as described inSection 6.6 �Checksum Computation�.

FIGURE 5-4: FLOWCHART FOR PROGRAMMING dsPIC30F SMPS CODE MEMORY

dsPIC30F SMPS Device

Code Size(24-bitWords)

Number of

Rows

Number of

Panels

dsPIC30F1010 2K 64 1dsPIC30F2020 4K 128 1dsPIC30F2023 4K 128 1

IsPROGP response

PASS?

IsRemainingCmds

�0�?

BaseAddress = 0x0RemainingCmds =128

RemainingCmds =RemainingCmds - 1

Finish

BaseAddress =BaseAddress

No

No

Yes

Yes

+ 0x40

Start

FailureReport Error

Send PROGPCommand To Program

BaseAddress


dsPIC30F SMPS
5.7 Configuration Bits Programming
5.7.1 OVERVIEWThe dsPIC30F SMPS has Configuration bits storedin seven 16-bit registers. These bits can be set orcleared to select various device configurations.There are two types of Configuration bits: systemoperation bits and code-protect bits. The systemoperation bits determine the power-on settings forsystem level components such as the oscillator andWatchdog Timer. The code-protect bits preventprogram memory from being read and written.

Table 5-3 shows the Configuration registers for theSMPS devices, and Table 5-4 describes the individualbits.

TABLE 5-3: dsPIC30F SMPS FAMILY DEVICE CONFIGURATION REGISTER MAP

Note: If user software performs an erase opera-tion on the configuration fuse, it must befollowed by a write operation to this fusewith the desired value, even if the desiredvalue is the same as the state of theerased fuse.

Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

0xF80000 FBS � BSS<2:0> BWRP

0xF80002 RESERVED �0xF80004 FGS � GSS<1:0> GWRP0xF80006 FOSCSEL � FNOSC<1:0>0xF80008 FOSC FCKSM<1:0> FRANGE � OSCIOFNC POSCMD<1:0>0xF8000A FWDT FWDTEN WINDIS � WDTPRE WDTPOST<3:0>0xF8000C FPOR � FPWRT<2:0>0xF8000E FICD BKBUG � ICS<1:0>

TABLE 5-4: dsPIC30F SMPS DEVICE CONFIGURATION BITS DESCRIPTIONBit Field Register Description

BSS<2:0> FBS Boot Segment Program Memory Code Protection111 = No Boot Segment110 = Standard security, Small-sized Boot Program Flash[Boot Segment ends at 0x0003FF] 101 = Standard security, Medium-sized Boot Program Flash[Boot Segment ends at 0x000FFFNote: This is for the dsPIC30F2020 and dsPIC30F2023 only.] 100 = No Boot Segment 011 = No Boot Segment010 = High security, Small-sized Boot Program Flash[Boot Segment ends at 0x0003FF]001 = High security, Medium-sized Boot Program Flash[Boot Segment ends at 0x000FFFNote: This is for the dsPIC30F2020 and dsPIC30F2023 only.]000 = No Boot Segment

BWRP FBS Boot Segment Program Memory Write Protection 1 = Boot Segment program memory is not write-protected0 = Boot program memory is write-protected

GSS<1:0> FGS General Segment Code-Protect bit11 = Code protection is disabled10 = Standard security code protection is enabled0x = Reserved

GWRP FGS General Segment Write-Protect bit1 = General Segment program memory is not write-protected0 = General Segment program memory is write-protected

FNOSC<1:0> FOSCSEL Initial Oscillator Source Selection bits11 = Primary (HS, EC) oscillator with PLL10 = Primary (HS, EC) oscillator01 = Internal Fast RC (FRC) oscillator with PLL00 = Internal Fast RC (FRC) oscillator


dsPIC30F SMPS

FCKSM<1:0> FOSC Clock Switching Mode bits1x = Clock switching is disabled, Fail-Safe Clock Monitor is disabled01 = Clock switching is enabled, Fail-Safe Clock Monitor is disabled00 = Clock switching is enabled, Fail-Safe Clock Monitor is enabled

FRANGE FOSC Frequency Range Selection for FRC oscillator1 = High Range: nominal FRC frequency is 14.1 MHz0 = Low Range: nominal FRC frequency is 9.7 MHz

OSCIOFNC FOSC OSC2 Pin Function bit (except in HS mode)1 = OSC2 is clock output0 = OSC2 is general purpose digital I/O pin

POSCMD<1:0> FOSC Primary Oscillator Mode Select bits11 = Primary oscillator disabled10 = HS crystal oscillator mode01 = Reserved00 = EC (external clock) mode

FWDTEN FWDT Watchdog Enable bit1 = Watchdog always enabled (LPRC oscillator cannot be disabled.

Clearing the SWDTEN bit in the RCON register will have no effect)0 = Watchdog enabled/disabled by user software (LPRC can be

disabled by clearing the SWDTEN bit in the RCON register)WINDIS FWDT Watchdog Timer Window Enable bit

1 = Watchdog Timer in Non-Window mode0 = Watchdog Timer in Window mode

WDTPRE FWDT Watchdog Timer Prescaler bit1 = 1:1280 = 1:32

WDTPOST<3:0> FWDT Watchdog Timer Postscaler bits1111 = 1:32,7681110 = 1:16,384� ��0001 = 1:20000 = 1:1

FPWRT<2:0> FPOR Power-on Reset Timer Value Select bits111 = PWRT = 128 ms110 = PWRT = 64 ms101 = PWRT = 32 ms100 = PWRT = 16 ms011 = PWRT = 8 ms010 = PWRT = 4 ms001 = PWRT = 2 ms000 = PWRT Disabled

BKBUG FICD Background Debug Enable bit1 = Device will reset in User mode0 = Device will reset in Debug mode

ICS<1:0> FICD ICD Communication Channel Select bits11 = Communicate on PGC/EMUC and PGD/EMUD10 = Communicate on PGC1/EMUC1 and PGD1/EMUD101 = Communicate on PGC2/EMUC2 and PGD2/EMUD200 = Reserved, do not use

� All Unimplemented (read as �0�, write as �0�)

TABLE 5-4: dsPIC30F SMPS DEVICE CONFIGURATION BITS DESCRIPTION (CONTINUED)Bit Field Register Description


dsPIC30F SMPS
5.7.2 PROGRAMMING METHODOLOGYSystem operation Configuration bits are inherentlydifferent than all other memory cells. Unlike codememory and code-protect Configuration bits, thesystem operation bits cannot be erased. If the chip iserased with the ERASEB command, the systemoperation bits retain their previous value.Consequently, you should make no assumption aboutthe value of the system operation bits. They shouldalways be programmed to their desired setting.
Configuration bits are programmed single word ata time using the PROGC command. The PROGCcommand specifies the configuration data andConfiguration register address. When Configurationbits are programmed, any unimplemented bits must beprogrammed with a �0�, and any reserved bits must beprogrammed with a �1�.

Four PROGC commands are required to program all theConfiguration bits. A flowchart for Configuration bitprogramming is shown in Figure 5-5.

5.7.3 PROGRAMMING VERIFICATIONOnce the Configuration bits are programmed, thecontents of memory should be verified to ensure thatthe programming is successful. Verification requiresthe Configuration bits to be read back and comparedagainst the copy held in the programmer�s buffer. TheREADD command reads back the programmedConfiguration bits and verifies that the programmingwas successful.

Any unimplemented Configuration bits are read-onlyand read as �0�.

5.7.4 CodeGuard� SECURITY CONFIGURATION BITS

The FBS and FGS Configuration registers are specialConfiguration registers that control the size and level ofcode protection for the Boot Segment and GeneralSegment, respectively. For each segment, two mainforms of code protection are provided. One formprevents code memory from being written (writeprotection), while the other prevents code memory frombeing read (read protection). The dsPIC30F SMPSfamily devices do not contain a Secure Segment.

BWRP and GWRP bits control write protection andBSS<2:0> and GSS<1:0> bits control read protection.The Chip Erase ERASEB command sets all the codeprotection bits to �1�, which allows the device to beprogrammed.

When write protection is enabled, any programmingoperation to code memory will fail. When readprotection is enabled, any read from code memory willcause a �0x0� to be read, regardless of the actualcontents of code memory. Since the programmingexecutive always verifies what it programs, attemptingto program code memory with read protection enabledwill also result in failure.

It is imperative that all code protection bits are �1� whilethe device is being programmed and verified. Only afterthe device is programmed and verified should any ofthe above bits be programmed to �0�.

Before performing any segment erase operation, theprogrammer must first determine whether thedsPIC30F device has defined a Boot Segment, andensure that a segment does not get overwritten byoperations on any other segment. Also, a Bulk Eraseshould not be performed if a Boot Segment has beendefined.

The BSS bit field in the FBS Configuration register canbe read to determine whether a Boot Segment hasbeen defined. If a Boot Segment has already beendefined (and has probably already been programmed),the user must be warned about this fact.

A Bulk Erase operation is the recommendedmechanism to allow a user to overwrite the BootSegment (if one chooses to do so).

In general, the segments and CodeGuard Securityrelated Configuration registers should be programmedin the following order:

� FBS and Boot Segment� FGS and General Segment

5.7.5 USER UNIT IDThe dsPIC30F SMPS devices contain 32 instructionsof Unit ID. These are located at addresses 0x8005C0through 0x8005FF. The Unit ID can be used for storingproduct information such as serial numbers, systemmanufacturing dates, manufacturing lot numbers andother such application-specific information.Programming the UNIT ID is similar to programmingthe Programming Executive (see Section 12.0�Programming the Programming Executive toMemory� for details).

Note: If the General Code Segment CodeProtect (GCP) bit is programmed to �0�,code memory is code-protected andcannot be read. Code memory mustbe verified before enabling readprotection. See Section 5.7.4 �Code-Guard� Security Configuration Bits�for more information about code-protect Configuration bits.

Note: All bits in the FBS and FGS Configurationregisters can only be programmed to avalue of �0�. The ERASEB command is theonly way to reprogram code-protect bitsfrom ON (�0�) to OFF (�1�).


dsPIC30F SMPS
FIGURE 5-5: CONFIGURATION BIT PROGRAMMING FLOW
Send PROGCCommand

ConfigAddress = 0xF80000

IsPROGC Response

PASS?

No

Yes

No

FailureReport Error

Start

Finish

Yes

IsConfigAddress

0xF8000C?

ConfigAddress =ConfigAddress+2

Note: If any of the code-protect bits in FBS orFGS is clear, then the entire device mustbe erased before it can be reprogrammed.


dsPIC30F SMPS

6.0 OTHER PROGRAMMING FEATURES

6.1 Erasing MemoryMemory is erased by using an ERASEB or ERASEPcommand, as detailed in Section 8.5 �CommandDescriptions�. Code memory can be erased by rowusing the ERASEP command. When memory is erased,the affected memory locations are set to �1�s.

The ERASEB command provides several Bulk Eraseoptions. Performing a Chip Erase with the ERASEBcommand clears all code memory and code protectionregisters. Alternatively, the ERASEB command can beused to selectively erase individual program memorysegments.Table 6-1 summarizes the Erase options.

TABLE 6-1: ERASE OPTIONS

6.2 Modifying MemoryInstead of bulk-erasing the device before starting toprogram, it is possible that you may want to modify onlya section of an already programmed device. In thissituation, Chip Erase is not a realistic option.

Instead, you can erase selective rows of code memoryusing the ERASEP command. You can then reprogramthe modified rows with the PROGP command pairs.

In these cases, when code memory is programmed,single-panel programming must be specified in thePROGP command.

For modification of code-protect bits, the entire chipmust first be erased with the ERASEB command. Thecode-protect bits can be reprogrammed using thePROGC command.

6.3 Reading MemoryThe READD command reads the Configuration bits anddevice ID of the device. This command only returns 16-bit data and operates on 16-bit registers.

The READP command reads the code memory of thedevice. This command only returns 24-bit data packedas described in Section 8.3 �Packed Data Format�.The READP command can be used to read up to 32Kinstruction words of code memory (only 4K instructionwords are present on the dsPIC30F SMPS devices).

6.4 Programming Executive Software Version

At times, it may be necessary to determine the versionof programming executive stored in executive memory.The QVER command performs this function. SeeSection 8.5.9 �QVER Command� for details of QVERcommand.

Command Affected Region

ERASEB Entire chip(1) or all code memoryERASEP(2) Specified rows of code memoryNote 1: The system operation Configuration

registers and device ID registers are not erasable.

2: ERASEP can not be used to erase code-protect Configuration bits. These bits must be erased using ERASEB.

Note: If read or write code protection is enabled,no modifications can be made to anyregion of code memory until codeprotection is disabled. Code protectioncan only be disabled by performing a ChipErase with the ERASEB command.

Note: Reading an unimplemented memorylocation causes the programmingexecutive to reset. All READD and READPcommands must specify only validmemory locations.


dsPIC30F SMPS
6.5 Configuration Information in the
Hex FileTo allow portability of code, the programmer must readthe Configuration register locations from the hex file(see Appendix A: �Hex File Format�). If configurationinformation is not present in the hex file, a simplewarning message should be issued by theprogrammer. Similarly, while saving a hex file, allconfiguration information must be included. An optioncan be provided not to include the configurationinformation.

Microchip Technology Inc. feels strongly that thisfeature is important for the benefit of the end customer.

6.6 Checksum ComputationChecksums for the dsPIC30F SMPS are 16 bits in size.The checksum is calculated by summing the following:

� Contents of code memory locations� Contents of Configuration registers

All memory locations are summed one byte at a time,using only their native data size. More specifically,configuration and device ID registers are summed byadding the lower two bytes of these locations (theupper byte is ignored), while code memory is summedby adding all three bytes of code memory.

Table 6-2 shows how this 16-bit computation can bemade for each dsPIC30F SMPS device. Computationsfor read code protection are shown both enabled anddisabled. The checksum values assume that theConfiguration registers are also erased. However,when code protection is enabled, the value of the FGSregister is assumed to be 0x5.

Note: The checksum calculation differsdepending on the code-protect setting.Table 6-2 describes how to compute thechecksum for an unprotected device and aread-protected device. Regardless of thecode-protect setting, the Configurationregisters can always be read.

TABLE 6-2: CHECKSUM COMPUTATION

SMPS Device Read CodeProtection Checksum Computation Erased

Value

Value with0xAAAAAA at 0x0

and LastCode Address

dsPIC30F1010 Disabled CFGB + SUM(0:000FFF) 0xEA69 0xE86BEnabled CFGB 0x0267 0x0267

dsPIC30F2020 Disabled CFGB + SUM(0:001FFF) 0xD269 0xD06BEnabled CFGB 0x0267 0x0267

dsPIC30F2023 Disabled CFGB + SUM(0:001FFF) 0xD269 0xD06BEnabled CFGB 0x0267 0x0267

Item Description:SUM(a:b) = Byte sum of locations a to b inclusive (all 3 bytes of code memory)CFGB = Configuration Block (masked) = Byte sum of ((FBS & 0x000F) + (FGS & 0x0007) + (FOSCSEL &

0x0003) + (FOSC & 0x00E7) + (FWDT & 0x00DF) + (FPOR & 0x0007) + (FICD & 0x0083))


dsPIC30F SMPS

7.0 PROGRAMMER � PROGRAMMING EXECUTIVE COMMUNICATION

7.1 Communication OverviewThe programmer and programming executive have amaster-slave relationship, where the programmer isthe master programming device and the programmingexecutive is the slave.

All communication is initiated by the programmer in theform of a command. Only one command at a time canbe sent to the programming executive. In turn, theprogramming executive only sends one response tothe programmer after receiving and processing acommand. The programming executive command setis described in Section 8.0 �Programming ExecutiveCommands�. The response set is described inSection 9.0 �Programming Executive Responses�.

7.2 Communication Interface and Protocol

The Enhanced ICSP interface is a 2-wire SPI interfaceimplemented using the PGC and PGD pins. The PGCpin is used as a clock input pin, and the clock sourcemust be provided by the programmer. The PGD pin isused for sending command data to, and receivingresponse data from the programming executive. Allserial data is transmitted on the rising edge of PGC andis latched on the falling edge of PGC. All datatransmissions are sent to the Most Significant bit (MSb)first, using 16-bit mode (see Figure 7-1).

FIGURE 7-1: PROGRAMMING EXECUTIVE SERIAL TIMING

Since a 2-wire SPI interface is used, and datatransmissions are bidirectional, a simple protocol isused to control the direction of PGD. When theprogrammer completes a command transmission, itreleases the PGD line and allows the programmingexecutive to drive this line high. The programmingexecutive keeps the PGD line high to indicate that it isprocessing the command.

After the programming executive has processed thecommand, it brings PGD low for 15 μsec to indicate tothe programmer that the response is available to beclocked out. The programmer can begin to clock outthe response 20 μsec after PGD is brought low, and itmust provide the necessary amount of clock pulses toreceive the entire response from the programmingexecutive.

Once the entire response is clocked out, theprogrammer should terminate the clock on PGC until itis time to send another command to the programmingexecutive. This protocol is shown in Figure 7-2.

7.3 SPI RateIn Enhanced ICSP mode, the dsPIC30F SMPSoperates from the fast internal RC oscillator FRC,which has a nominal frequency of 10 or 15 MHz. Thisoscillator frequency yields an effective system clockfrequency of 2.5 or 3.75 MHz. Since the SPI moduleoperates in Slave mode, the programmer must limit theSPI clock rate to a frequency not greater than 1 MHz.

7.4 Time OutsThe programming executive uses no Watchdog Timeror time out for transmitting responses to theprogrammer. If the programmer does not follow theflow control mechanism using PGC, as described inSection 7.2 �Communication Interface and Proto-col�, it is possible that the programming executive willbehave unexpectedly while trying to send a responseto the programmer. Since the programming executivehas no time out, it is imperative that the programmercorrectly follow the described communication protocol.

As a safety measure, the programmer should use thecommand time outs identified in Table 8-1. If thecommand time out expires, the programmer shouldreset the programming executive and startprogramming the device again.

PGC

PGD

1 2 3 11 13 15 161412

LSb14 13 12 11

4 5 6

MSb 123... 45

P2

P3

P1

P1aP1b

Note: If the programmer provides the SPI with aclock faster than 1 MHz, the behavior ofthe programming executive will beunpredictable.


dsPIC30F SMPS
FIGURE 7-2: PROGRAMMING EXECUTIVE � PROGRAMMER COMMUNICATION PROTOCOL
1 2 15 16 1 2 15 16

PGC

PGD

PGC = Input PGC = Input (Idle)

Host TransmitsLast Command Word

PGD = Input PGD = Output

P8

1 2 15 16

MSB X X X LSB MSB X X X LSB MSB X X X LSB 1 0

P9b P10

PGC = InputPGD = Output

P9a

Programming ExecutiveProcesses Command Host Clocks Out Response

P11


dsPIC30F SMPS

8.0 PROGRAMMING EXECUTIVE COMMANDS

8.1 Command SetThe programming executive command set is shown inTable 8-1. This table contains the opcode, mnemonic,length, time out and description for each command.Functional details on each command are provided inthe command descriptions (Section 8.5 �CommandDescriptions�).

8.2 Command FormatAll programming executive commands have a generalformat consisting of a 16-bit header and any requireddata for the command (see Figure 8-1). The 16-bitheader consists of a 4-bit opcode field, which is used toidentify the command, followed by a 12-bit commandlength field.

FIGURE 8-1: COMMAND FORMAT

The command opcode must match one of those in thecommand set. Any command that is received whichdoes not match the list in Table 8-1 will return a �NACK�response (see Section 9.2.1 �Opcode Field�).

The command length is represented in 16-bit wordssince the SPI operates in 16-bit mode. Theprogramming executive uses the Command Lengthfield to determine the number of words to read from theSPI port. If the value of this field is incorrect, thecommand will not be properly received by theprogramming executive.

8.3 Packed Data FormatWhen 24-bit instruction words are transferred acrossthe 16-bit SPI interface, they are packed to conservespace using the format shown in Figure 8-2. Thisformat minimizes traffic over the SPI and provides theprogramming executive with data that is properlyaligned for performing table write operations.

FIGURE 8-2: PACKED INSTRUCTION WORD FORMAT

8.4 Programming Executive Error Handling

The programming executive will �NACK� allunsupported commands. Additionally, due to thememory constraints of the programming executive, nochecking is performed on the data contained in theprogrammer command. It is the responsibility of theprogrammer to command the programming executivewith valid command arguments, or the programmingoperation may fail. Additional information on errorhandling is provided in Section 9.2.3 �QE_CodeField�.

15 12 11 0Opcode Length

Command Data First Word (if required)��

Command Data Last Word (if required)

Note: When the number of instruction wordstransferred is odd, MSB2 is zero and lsw2can not be transmitted.

15 8 7 0lsw1

MSB2 MSB1lsw2

lswx: Least significant 16-bits of instruction wordMSBx: Most significant byte of instruction word


dsPIC30F SMPS
TABLE 8-1: PROGRAMMING EXECUTIVE COMMAND SET
Opcode MnemonicLength(16-bitwords)

Time Out Description

0x0 SCHECK 1 1 msec Sanity check.0x1 READD 4 1

msec/rowRead N 16-bit words of Configuration registers or device ID starting from specified address.

0x2 READP 4 1 msec/row

Read N 24-bit instruction words of code memory starting from specified address.

0x3 RESERVED N/A N/A This command is reserved. It will return a NACK.0x4 PROGD 19 5 msec Not implemented.0x5 PROGP(1) 51 5 msec Program one row of code memory at the specified address, then

verify. 0x6 PROGC 4 5 msec Write byte or 16-bit word to specified Configuration register.0x7 ERASEB 2 5 msec Bulk Erase (entire program memory), or erase by segment.0x8 ERASED 3 5

msec/rowNot Implemented.

0x9 ERASEP(1) 3 5 msec/row

Erase rows of code memory from specified address.

0xA QBLANK 3 300 msec Query if the code memory is blank.0xB QVER 1 1 msec Query the programming executive software version.Note 1: One row of code memory consists of thirty-two 24-bit words. Refer to Table 5-2 for device-specific

information.


dsPIC30F SMPS
8.5 Command Descriptions All commands supported by the programmingexecutive are described in Section 8.5.1 �SCHECKCommand� through Section 8.5.9 �QVERCommand�.
8.5.1 SCHECK COMMAND

The SCHECK command instructs the programmingexecutive to do nothing, but generate a response. Thiscommand is used as a �sanity check� to verify that theprogramming executive is operational.

Expected Response (2 words):0x10000x0002

8.5.2 READD COMMAND

The READD command instructs the programmingexecutive to read N 16-bit words of memory startingfrom the 24-bit address specified by Addr_MSB andAddr_LS. This command can only be used to read16-bit data. It can be used to read Configuration registers and the device ID.

Expected Response (2 + N words):0x1100N + 2Data word 1... Data word N


Field Description

Opcode 0x0Length 0x1

Note: This instruction is not required forprogramming, but is provided fordevelopment purposes only.

15 12 11 8 7 0Opcode Length

Reserved0 NReserved1 Addr_MSB

Addr_LS

Field Description

Opcode 0x1Length 0x4Reserved0 0x0N Number of 16-bit words to read

(max of 2048)Reserved1 0x0Addr_MSB MSB of 24-bit source addressAddr_LS LS 16 bits of 24-bit source address

Note: Reading unimplemented memory willcause the programming executive toReset.


dsPIC30F SMPS
8.5.3 READP COMMAND
The READP command instructs the programmingexecutive to read N 24-bit words of code memorystarting from the 24-bit address specified by Addr_MSBand Addr_LS. This command can only be used to read24-bit data. All data returned in response to thiscommand uses the packed data format described inSection 8.3 �Packed Data Format�.

Expected Response (2 + 3 * N/2 words for N even):0x12002 + 3 * N/2Least significant program memory word 1... Least significant data word N

Expected Response (4 + 3 * (N�1)/2 words for N odd):0x12004 + 3 * (N�1)/2Least significant program memory word 1... MSB of program memory word N (zero padded)

8.5.4 PROGP COMMAND

The PROGP command instructs the programmingexecutive to program one row of code memory (32instruction words) to the specified memory address.Programming begins with the row address specified inthe command. The destination address should be amultiple of 0x40.

The data to program memory, located in commandwords D_1 through D_48, must be arranged using thepacked instruction word format shown in Figure 8-2.

After all data has been programmed to code memory,the programming executive verifies the programmeddata against the data in the command.



NReserved Addr_MSB

Addr_LS

Field Description

Opcode 0x2Length 0x4N Number of 24-bit instructions to read

(max of 32768)Reserved 0x0Addr_MSB MSB of 24-bit source addressAddr_LS LS 16 bits of 24-bit source address

Note: Reading unimplemented memory willcause the programming executive toreset.


Reserved Addr_MSBAddr_LS

D_1D_2...

D_N

Field Description

Opcode 0x5Length 0x33Reserved 0x0Addr_MSB MSB of 24-bit destination addressAddr_LS LS 16 bits of 24-bit destination addressD_1 16-bit data word 1D_2 16-bit data word 2... 16-bit data word 3 through 47D_48 16-bit data word 48

Note: Refer to Table 5-2 for code memory sizeinformation.


dsPIC30F SMPS
8.5.5 PROGC COMMAND
The PROGC command programs data to the specifiedConfiguration register and verifies whether theprogramming. Configuration registers are 16 bits wide,and this command allows one Configuration register tobe programmed.


8.5.6 ERASEB COMMAND

The ERASEB command performs a Bulk Erase. The MSfield selects the memory to be bulk erased, with optionsfor erasing individual memory segments.

When Full Chip Erase is selected, the following memory regions are erased:

� All code memory (even if code-protected)� All code-protect Configuration registers, including

Unit ID

Only the executive code memory, device ID andConfiguration registers that are not code-protectedremain intact after a Full Chip Erase.



Reserved Addr_MSBAddr_LS

Data

Field Description

Opcode 0x6Length 0x4Reserved 0x0Addr_MSB MSB of 24-bit destination addressAddr_LS LS 16 bits of 24-bit destination

addressData Data to program

Note: This command can only be used forprogramming Configuration registers.

15 12 11 2 0Opcode Length

Reserved MS

Field Description

Opcode 0x7Length 0x2Reserved 0x0MS Select memory to erase:

0x0 = All Code in General Segment 0x1 = Reserved 0x2 = All Code in General Segment, interrupt vectors, and FGS Configuration register 0x3 = Full Chip Erase 0x4 = All Code in Boot and General Segments, and the FBS and FGS Configuration registers 0x5 = All Code in General Segment, and the FGS Configuration register 0x6 = Reserved 0x7 = Reserved


dsPIC30F SMPS
8.5.7 ERASEP COMMAND
The ERASEP command erases the specified number ofrows of code memory from the specified base address.The specified base address must be a multiple of 0x40.

Once the erase is performed, all targeted words ofcode memory contain 0xFFFFFF.


8.5.8 QBLANK COMMAND

The QBLANK command queries the programmingexecutive to determine whether the contents of codememory is blank (contains all �1�s). The size of codememory to check must be specified in the command.

The Blank Check for code memory begins at 0x0 andadvances toward larger addresses for the specifiednumber of instruction words.

The QBLANK command returns a QE_Code of 0xF0 ifthe specified code memory is blank. Otherwise,QBLANK returns a QE_Code of 0x0F.

Expected Response (2 words for blank device):0x1AF00x0002

Expected Response (2 words for non-blank device):0x1A0F0x0002


Num_Rows Addr_MSBAddr_LS

Field Description

Opcode 0x9Length 0x3Num_Rows Number of rows to eraseAddr_MSB MSB of 24-bit base addressAddr_LS LS 16 bits of 24-bit base address

Note: The ERASEP command cannot be used toerase the Configuration registers ordevice ID. CodeGuard Securitycode-protect Configuration registers canonly be erased with ERASEB, while thedevice ID is read-only.


PSizeReserved DSize

Field Description

Opcode 0xALength 0x3PSize Length of program memory to check

(in 24-bit words), max of 49152Reserved 0x0DSize Length of data memory to check

(in 16-bit words), max of 2048

Note: The QBLANK command does not checkthe system Configuration registers. TheREADD command must be used todetermine the state of the Configurationregisters.


dsPIC30F SMPS
8.5.9 QVER COMMAND
The QVER command queries the version of theprogramming executive software stored in testmemory. The �version.revision� information is returnedin the response�s QE_Code using a single byte with thefollowing format: main version in upper nibble andrevision in the lower nibble (i.e., 0x23 means version2.3 of programming executive software).

Expected Response (2 words):0x1BMN (where �MN� stands for version M.N)0x0002

9.0 PROGRAMMING EXECUTIVE RESPONSES

9.1 OverviewThe programming executive sends a response to theprogrammer for each command that it receives. Theresponse indicates if the command was processedcorrectly, and includes any required response, or error,data.

The programming executive response set is shown inTable 9-1. This table contains the opcode, mnemonicand description for each response. The responseformat is described in Section 9.2 �ResponseFormat�.

TABLE 9-1: PROGRAMMING EXECUTIVE RESPONSE SET

9.2 Response FormatAll programming executive responses have a generalformat consisting of a two-word header and anyrequired data for the command.

9.2.1 Opcode FIELDThe Opcode is a 4-bit field in the first word of theresponse. The Opcode indicates how the command isprocessed (see Table 9-1). If the command isprocessed successfully, the response opcode is PASS.If there is an error in processing the command, theresponse opcode is FAIL, and the QE_Code indicatesthe reason for the failure. If the command sent tothe programming executive is not identified, theprogramming executive returns a NACK response.

9.2.2 Last_Cmd FIELDThe Last_Cmd is a 4-bit field in the first word ofthe response and indicates the command that theprogramming executive processed. Since theprogramming executive can only process onecommand at a time, this field is technically not required.However, it can be used to verify that the programmingexecutive correctly received the command that theprogrammer transmitted.


Field Description

Opcode 0xBLength 0x1

Opcode Mnemonic Description

0x1 PASS Command successfully processed.

0x2 FAIL Command unsuccessfully processed.

0x3 NACK Command not known.

Field Description

Opcode Response opcode.Last_Cmd Programmer command that

generated the response.QE_Code Query code or Error code.Length Response length in 16-bit words

(includes 2 header words.)D_1 First 16-bit data word (if applicable).D_N Last 16-bit data word (if applicable).

15 12 11 8 7 0

Opcode Last_Cmd

QE_Code

Length

D_1 (if applicable)

...

D_N (if applicable)


dsPIC30F SMPS
9.2.3 QE_Code FIELDThe QE_Code is a byte in the first word of theresponse. This byte is used to return data for querycommands and error codes for all other commands.
When the programming executive processes one of thetwo query commands (QBLANK or QVER), the returnedopcode is always PASS and the QE_Code holds thequery response data. The format of the QE_Code forboth queries is shown in Table 9-2.

TABLE 9-2: QE_Code FOR QUERIES

When the programming executive processes anycommand other than a query, the QE_Code representsan error code. Supported error codes are shown inTable 9-3. If a command is successfully processed, thereturned QE_Code is set to 0x0, which indicates thatthere is no error in the command processing. If theverification of the programming for the PROGD, PROGPor PROGC command fails, the QE_Code is set to 0x1.For all other programming executive errors, theQE_Code is 0x2.

TABLE 9-3: QE_Code FOR NON-QUERY COMMANDS

9.2.4 RESPONSE LENGTHThe response length indicates the length of theprogramming executive�s response in 16-bit words.This field includes the 2 words of the response header.With the exception of the response for the READD andREADP commands, the length of each response is only2 words.

The response to the READD command is N + 2 words,where N is the number of words specified in the READDcommand.

The response to the READP command uses thepacked instruction word format described inSection 8.3 �Packed Data Format�. When readingan odd number of program memory words (N odd),the response to the READP command is (3 �(N + 1)/2 + 2) words. When reading an even numberof program memory words (N even), the response tothe READP command is (3 � N/2 + 2) words.

Query QE_Code

QBLANK 0x0F = Code memory is NOT blank0xF0 = Code memory is blank

QVER 0xMN, where programming executive software version = M.N(i.e., 0x32, means software version 3.2)

QE_Code Description

0x0 No error 0x1 Verify failed0x2 Other error


dsPIC30F SMPS

10.0 DEVICE IDThe device ID region of memory can be used todetermine mask, variant and manufacturinginformation about the chip. The device ID region is2 x 16 bits and can be read using the READD command.This region of memory is read-only and can also beread when code protection is enabled.

Table 10-1 shows the device ID for each device, Table10-2 shows the device ID registers and Table 10-3describes the bit field of each register.

TABLE 10-2: dsPIC30F SMPS DEVICE ID REGISTERS

TABLE 10-3: DEVICE ID BITS DESCRIPTION

TABLE 10-1: DEVICE IDSSMPS Device Mask Variant DEVID

dsPIC30F1010 0x010 0x4 0x0404dsPIC30F2020 0x010 0x0 0x0400dsPIC30F2023 0x010 0x3 0x0403

Address NameBit

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

0xFF0000 DEVID MASK<7:0> VARIANT<2:0>0xFF0002 DEVREV PROC<3:0> REV<2:0> DOT<2:0>

Bit Field Register Description

MASK<7:0> DEVID Encodes the MASKSET ID of the device.VARIANT<2:0> DEVID Encodes the VARIANT derived from MASKSET of the device.PROC<3:0> DEVREV Encodes the process of the device.REV<2:0> DEVREV Encodes the major revision number of the device.DOT<2:0> DEVREV Encodes the minor revision number of the device.


dsPIC30F SMPS

11.0 ICSP� MODE

11.1 ICSP ModeICSP mode is a special programming protocol thatallows you to read and write to dsPIC30F SMPSmemory. The ICSP mode is the second (and slower)method used to program the device. This mode alsohas the ability to read the contents of executivememory to determine if the programming executive ispresent. This capability is accomplished by applyingcontrol codes and instructions serially to the deviceusing pins PGC and PGD.

In ICSP mode, the system clock is taken from the PGCpin, regardless of the device�s oscillator Configurationbits. All instructions are first shifted serially into aninternal buffer, then loaded into the instruction registerand executed. No program fetching occurs frominternal memory. Instructions are fed in 24 bits at atime. PGD is used to shift data in, and PGC is used asboth the serial shift clock and the CPU execution clock.

Data is transmitted on the rising edge and latched onthe falling edge of PGC. For all data transmissions, theLeast Significant bit (LSb) is transmitted first.

11.2 ICSP OperationUpon entry into ICSP mode, the CPU is idle. Executionof the CPU is governed by an internal state machine. A4-bit control code is clocked in using PGC and PGD,and this control code is used to command the CPU(see Table 11-1).

The SIX control code is used to send instructions to theCPU for execution, while the REGOUT control code isused to read data out of the device via the VISI register.The operation details of ICSP mode are provided inSection 11.2.1 �Six Serial Instruction Execution�and Section 11.2.2 �REGOUT Serial InstructionExecution�.

TABLE 11-1: CPU CONTROL CODES IN ICSP� MODE

11.2.1 SIX SERIAL INSTRUCTION EXECUTION

The SIX control code allows execution of dsPIC30FSMPS assembly instructions. When the SIX code isreceived, the CPU is suspended for 24 clock cycles asthe instruction is then clocked into the internal buffer.Once the instruction is shifted in, the state machineallows it to be executed over the next four clock cycles.While the received instruction is executed, the statemachine simultaneously shifts in the next 4-bitcommand (see Figure 11-1).

11.2.2 REGOUT SERIAL INSTRUCTION EXECUTION

The REGOUT control code allows for data to beextracted from the device in ICSP mode. It is used toclock the contents of the VISI register out of the deviceover the PGD pin. Once the REGOUT control code isreceived, eight clock cycles are required to process thecommand. During this time, the CPU is held idle. Afterthese eight cycles, an additional 16 cycles are requiredto clock the data out (see Figure 11-2).

The REGOUT instruction is unique because the PGDpin is an input when the control code is transmitted tothe device. However, once the control code isprocessed, the PGD pin becomes an output as the VISIregister is shifted out. After the contents of the VISI areshifted out, PGD becomes an input again as the statemachine holds the CPU idle until the next 4-bit controlcode is shifted in.

Note 1: During ICSP operation, the operatingfrequency of PGC must not exceed5 MHz.

2: On the first serial word (in ICSP mode) tobe shifted into the device following aReset, an additional 5 clocks must be provided to the device on the PGC pin.

4-bitControl Code Mnemonic Description

0000b SIX Shift in 24-bit instruction and execute.

0001b REGOUT Shift out the VISIregister.

0010b-1111b N/A Reserved.

Note 1: Coming out of Reset, the first 4-bit controlcode is always forced to SIX, and a forcedNOP instruction is executed by the CPU.Once the forced SIX is clocked in, ICSPoperation resumes as normal (the next 24clock cycles load the first instruction wordto the CPU).

2: TBLRDH, TBLRDL, TBLWTH and TBLWTLinstructions must be followed by a NOPinstruction.

Note: Once the contents of VISI are shifted out,the dsPIC® DSC device maintains PGD asan output until the first rising edge of thenext clock is received.


dsPIC30F SMPS
FIGURE 11-1: SIX SERIAL EXECUTION
FIGURE 11-2: REGOUT SERIAL EXECUTION

11.3 Entering ICSP ModeFigure 11-3 shows the three required steps to enterthe ICSP Program/Verify mode:

1. MCLR is briefly driven high then low.2. A 32-bit key sequence is clocked into PGD.3. MCLR is then driven high within a specified

period of time and held.

The programming voltage applied to MCLR is VIH,which is essentially VDD in the case of dsPIC30FSMPS devices. There is no minimum time requirementfor holding at VIH. After VIH is removed, an interval of atleast P16 must elapse before presenting the keysequence on PGD.

The key sequence is a specific 32-bit pattern,�0100 1101 0100 0011 0100 1000 0101 0001�(more easily remembered as 0x4D434851 inhexadecimal). The device will enter Program/Verifymode only if the sequence is valid. The Most Significantbit (MSb) of the most significant nibble must be shiftedin first.

Once the key sequence is complete, VIH must beapplied to MCLR and held at that level for as long asProgram/Verify mode has to be maintained. An intervalof at least time P17 and P7 must elapse beforepresenting data on PGD. Signals appearing on PGDbefore P7 has elapsed will not be interpreted as valid.

On successful entry, the program memory can beaccessed and programmed in serial fashion. While inICSP mode, all unused I/Os are placed in the high-impedance state.

P4

2 3 1 2 3 23 24 1 2 3 4

P1

PGCP4a

PGD

24-bit Instruction Fetch Execute 24-bit Instruction,Execute PC-1,

1 4

0 0 0 0 0 0 0 0

Fetch SIX Control Code Fetch Next Control Code

4 5 6 7 8 18 19 20 21 2217

LSB X X X X X X X X X X X X X X MSB

PGD = Input

P2

P3P1a

P1b

1 2 3 4 1 2 7 8PGC

P4

PGD

PGD = Input

Execute Previous Instruction, CPU Held In Idle Shift Out VISI Register <15:0>

P5

PGD = Output

1 2 3 1 2 3 4

P4a

11 13 15 161412

No Execution Takes Place,Fetch Next Control Code

0 0 0 0 0

PGD = Input

MSb1 2 3 41

4 5 6

LSb 141312... 11100

Fetch REGOUT Control Code

0


dsPIC30F SMPS
FIGURE 11-3: ENTERING ICSP� MODE
11.4 Flash Memory Programming in ICSP Mode

Programming in ICSP mode is described inSection 11.4.1 �Programming Operations� throughSection 11.4.3 �Starting and Stopping aProgramming Cycle�.

Step-by-step procedures are described inSection 11.5 �Bulk Erasing Program Memory�through Section 11.11 �Reading the Application IDWord�.

All programming operations must use serial execution,as described in Section 11.2 �ICSP Operation�.

11.4.1 PROGRAMMING OPERATIONS Flash memory write and erase operations arecontrolled by the NVMCON register. Programming isperformed by setting NVMCON to select the type oferase operation (Table 11-2) or write operation (Table11-3), writing a key sequence to enable theprogramming and initiating the programming by settingthe WR control bit, NVMCON<15>.

In ICSP mode, all programming operations areexternally timed. An external 2 msec delay must beused between setting the WR control bit and clearingthe WR control bit to complete the programmingoperation.

TABLE 11-2: NVMCON ERASE OPERATIONS

TABLE 11-3: NVMCON WRITE OPERATIONS

MCLR

PGD

PGC

VDD

P6P12

b31 b30 b29 b28 b27 b2 b1 b0b3...

Program/Verify Entry Code = 0x4D434851

P2BP2A

P16

P17

0 1 0 0 1 0 0 0 1

P7VIH VIH

NVMCONValue Erase Operation

0x407F Erases all code memory, data memory, executive memory and code-protect bits (does not erase UNIT ID).

0x406E Erases Boot Segment, General Seg-ment and Interrupt Vector Table, then erase FBS and FGS Configuration registers.

0x404E Erases General Segment, then erase FGS Configuration register.

0x4042 Erases General Segment without eras-ing Interrupt Vector Table (when Boot Segment is not defined).

0x4072 Erases all executive memory.0x4071 Erases 1 row (32 instruction words)

from 1 panel of code memory.

NVMCONValue Write Operation

0x4008 Writes 1 word to configurationmemory.

0x4001 Writes 1 row (32 instruction words) into 1 panel of program memory.


dsPIC30F SMPS
11.4.2 UNLOCKING NVMCON FOR
PROGRAMMINGWrites to the WR bit (NVMCON<15>) are locked toprevent accidental programming from taking place.Writing a key sequence to the NVMKEY registerunlocks the WR bit and allows it to be written to. Theunlock sequence is performed as follows:

MOV #0x55, W8MOV W8, NVMKEYMOV #0xAA, W9MOV W9, NVMKEY

11.4.3 STARTING AND STOPPING A PROGRAMMING CYCLE

Once the unlock key sequence has been written to theNVMKEY register, the WR bit (NVMCON<15>) is usedto start and stop an erase or write cycle. Setting the WRbit initiates the programming cycle. Clearing the WR bitterminates the programming cycle.

All erase and write cycles must be externally timed. Anexternal delay must be used between setting andclearing the WR bit. Starting and stopping aprogramming cycle is performed as follows:

BSET NVMCON, #WR<Wait 2 msec>BCLR NVMCON, #WR

11.5 Bulk Erasing Program Memory The procedure for bulk erasing program memory (allcode memory, data memory, executive memory andcode-protect bits) consists of setting NVMCON to0x407F, unlocking NVMCON for erasing and thenexecuting the programming cycle.

Table 11-4 shows the ICSP programming process forbulk erasing program memory. This process includesthe ICSP command code, which must be transmitted(for each instruction) to the Least Significant bit firstusing the PGC and PGD pins (see Figure 11-1).

Note: Any working register or working registerpair can be used to write the unlocksequence.

Note: Program memory must be erased beforewriting any data to program memory.

TABLE 11-4: SERIAL INSTRUCTION EXECUTION FOR BULK ERASING PROGRAM MEMORYCommand

(Binary)Data(Hex) Description

Step 1: Exit the Reset vector.000000000000

040100040100000000

GOTO 0x100GOTO 0x100NOP

Step 2: Set the NVMCON to erase all Program Memory.000000000

2407FA883B0A

MOV #0x407F, W10 MOV W10, NVMCON

Step 3: Unlock the NVMCON for programming.0000000000000000

200558883B38200AA9883B39

MOV #0x55, W8 MOV W8, NVMKEY MOV #0xAA, W9 MOV W9, NVMKEY

Step 4: Initiate the erase cycle.00000000000000000000�00000000000000000000

A8E761000000000000000000000000�A9E761000000000000000000000000

BSET NVMCON, #WR NOPNOPNOPNOPExternally time 200 msecBCLR NVMCON, #WRNOPNOPNOPNOP


dsPIC30F SMPS
11.6 Row Erasing Program MemoryInstead of using a Bulk Erase operation, each region ofmemory can be individually erased by row. In this case,all of the code memory, executive memory andConfiguration registers must be erased one row at atime. The procedure for erasing individual rows ofprogram memory is quite different from the procedurefor erasing the entire chip. This procedure is detailed inTable 11-5. If a Segment Erase operation is required,Step 3 must be modified with the appropriate NVMCONvalue as per Table 11-2.
However, since this method is more time consumingand does not clear the code-protect bits, it is notrecommended in most cases.

Note 1: Program memory must be erased beforewriting any data to program memory.

2: To erase the first two rows of programmemory (the Reset vector and InterruptVector Table), ICSP Mode must be exitedand re-entered after erasing each ofthese two rows. Other rows of programmemory can only be erased if this procedure is followed.

TABLE 11-5: SERIAL INSTRUCTION EXECUTION FOR ROW ERASING PROGRAM MEMORYCommand



040100040100000000


Step 2: Initialize NVMADR and NVMADRU to erase code memory and initialize W7 for row address updates.0000000000000000

EB0300883B16883B26200407

CLR W6MOV W6, NVMADRMOV W6, NVMADRUMOV #0x40, W7

Step 3: Set NVMCON to erase 1 row of code memory. 00000000

24071A883B0A

MOV #0x4071, W10MOV W10, NVMCON

Step 4: Unlock the NVMCON to erase 1 row of code memory. 0000000000000000

200558883B38200AA9883B39



A8E761000000000000000000000000�A9E761000000000000000000000000



dsPIC30F SMPS

Step 6: Update the row address stored in NVMADRU:NVMADR. When W6 rolls over to 0x0, NVMADRU must be incremented.

0000000000000000

430307AF0042EC2764883B16

ADD W6, W7, W6 BTSC SR, #CINC NVMADRUMOV W6, NVMADR

Step 7: Reset device internal PC.00000000

040100000000

GOTO 0x100NOP

Step 8: Repeat Steps 3-7 until all rows of code memory are erased.Step 9: Initialize NVMADR and NVMADRU to erase executive memory and initialize W7 for row address updates.00000000000000000000

EB0300883B16200807883B27200407

CLR W6MOV W6, NVMADRMOV #0x80, W7MOV W7, NVMADRUMOV #0x40, W7

Step 10: Set NVMCON to erase 1 row of executive memory. 00000000

24071A883B0A


Step 11: Unlock the NVMCON to erase 1 row of executive memory.0000000000000000

200558883B38200AA9883B39



A8E761000000000000000000000000�A9E761000000000000000000000000


Step 13: Update the row address stored in NVMADR. 00000000

430307883B16

ADD W6, W7, W6 MOV W6, NVMADR


040100000000

GOTO 0x100NOP

Step 15: Repeat Steps 10-14 until all 24 rows of executive memory are erased.

TABLE 11-5: SERIAL INSTRUCTION EXECUTION FOR ROW ERASING PROGRAM MEMORY Command



dsPIC30F SMPS
11.7 Writing Configuration MemoryThe FOSC, FWDT, FPOR and FICD registers are noterasable. It is recommended that all Configurationregisters be set to a default value after erasing programmemory. The FWDT, FPOR and FICD registers can beset to a default all �1�s value by programming 0xFFFFto each register. Since these registers containunimplemented bits that read as �0�, the default valuesshown in Table 11-6 will be read instead of 0xFFFF.The recommended default FOSC value is 0xC100,which selects the FRC clock oscillator setting.
The FBS and FGS Configuration registers are specialsince they enable code protection for the device. Forsecurity purposes, once the bits in these registers areprogrammed to �0� (to enable code protection), theycan only be set back to �1� by performing a Bulk Eraseas described in Section 11.5 �Bulk Erasing ProgramMemory�, or by using a Segment Erase operation.Programming the FBS or FGS Configuration registerbits from a �0� to �1� is not possible, but they can be programmed from a �1� to a �0� to enable code protection.

Table 11-7 shows the ICSP programming details forclearing the Configuration registers. In Step 1, theReset vector is exited. In Step 2, the write pointer (W7)is loaded with 0x0000, which is the original destinationaddress (in TBLPAG 0xF8 of program memory). InStep 3, the NVMCON is set to program one

Configuration register. In Step 4, the TBLPAG registeris initialized to 0xF8 for writing to the Configurationregisters. In Step 5, the value to write to eachConfiguration register (0xFFFF) is loaded to W6. InStep 6, the Configuration register data is written to thewrite latch using the TBLWTL instruction. In Steps 7 and8, the NVMCON is unlocked for programming and theprogramming cycle is initiated, as described inSection 11.4 �Flash Memory Programming in ICSPMode�. In Step 9, the internal PC is set to 0x100 as asafety measure to prevent the PC from incrementinginto unimplemented memory. Finally, Steps 3-9 arerepeated six times until all seven Configurationregisters are programmed.

TABLE 11-6: DEFAULT CONFIGURATION REGISTER VALUES

Address Register Default Value

0xF80000 FBS 0x000F0xF80002 RESERVED 0x00000xF80004 FGS 0x00070xF80006 FOSCSEL 0x00030xF80008 FOSC 0x00E70xF8000A FWDT 0x00DF0xF8000C FPOR 0x00070xF8000E FICD 0x0083

TABLE 11-7: SERIAL INSTRUCTION EXECUTION FOR WRITING CONFIGURATION REGISTERSCommand



040100040100000000


Step 2: Initialize the write pointer (W7) for the TBLWT instruction.0000 200007 MOV #0x0000, W7

Step 3: Set the NVMCON to program 1 Configuration register.00000000

24008A883B0A


Step 4: Initialize the TBLPAG register.00000000

200F80880190

MOV #0xF8, W0MOV W0, TBLPAG

Step 5: Load the Configuration register data to W6.0000 2xxxx0 MOV #<CONFIG_VALUE>, W6


dsPIC30F SMPS

Step 6: Write the Configuration register data to the write latch and increment the write pointer.000000000000

BB1B86000000000000

TBLWTL W6, [W7++]NOPNOP


200558883B38200AA9883B39

MOV #0x55, W8MOV W8, NVMKEYMOV #0xAA, W9MOV W9, NVMKEY

Step 8: Initiate the write cycle.00000000000000000000�00000000000000000000

A8E761000000000000000000000000�A9E761000000000000000000000000

BSET NVMCON, #WRNOPNOPNOPNOPExternally time 2 msecBCLR NVMCON, #WRNOPNOPNOPNOP


040100000000

GOTO 0x100NOP

Step 10: Repeat steps 3-9 until all seven Configuration registers are programmed.

TABLE 11-7: SERIAL INSTRUCTION EXECUTION FOR WRITING CONFIGURATION REGISTERS Command



dsPIC30F SMPS
11.8 Writing Code MemoryThe procedure for writing code memory is similar to theprocedure for clearing the Configuration registers,except that 32 instruction words are programmed at atime. To facilitate this operation, working registersW0:W5 are used as temporary holding registers for thedata to be programmed.
Table 11-8 shows the ICSP programming details,including the serial pattern with the ICSP commandcode, which must be transmitted Least Significant bitfirst using the PGC and PGD pins (see Figure 11-1). InStep 1, the Reset vector is exited. In Step 2, theNVMCON register is initialized for single panelprogramming of code memory. In Step 3, the 24-bitstarting destination address for programming is loadedinto the TBLPAG register and W7 register. The upperbyte of the starting destination address is stored toTBLPAG, while the lower 16 bits of the destinationaddress are stored to W7.

To minimize the programming time, the same packedinstruction format that the programming executive usesis utilized (Figure 8-2). In Step 4, four packedinstruction words are stored to working registersW0:W5 using the MOV instruction and the read pointerW6 is initialized. The contents of W0:W5 holding thepacked instruction word data is shown in Figure 11-4.In Step 5, eight TBLWT instructions are used to copy thedata from W0:W5 to the write latches of code memory.

Since code memory is programmed 32 instructionwords at a time, Steps 4 and 5 are repeated eight timesto load all the write latches (Step 6).

After the write latches are loaded, programming isinitiated by writing to the NVMKEY and NVMCONregisters in Steps 7 and 8. In Step 9, the internal PC isreset to 0x100. This is a precautionary measure toprevent the PC from incrementing into unimplementedmemory when large devices are being programmed.Lastly, in Step 10, Steps 3-9 are repeated until all ofcode memory is programmed.

FIGURE 11-4: PACKED INSTRUCTION WORDS IN W0:W5

15 8 7 0W0 lsw0W1 MSB1 MSB0W2 lsw1W3 lsw2W4 MSB3 MSB2W5 lsw3

TABLE 11-8: SERIAL INSTRUCTION EXECUTION FOR WRITING CODE MEMORYCommand



040100040100000000


Step 2: Set the NVMCON to program 32 instruction words.00000000

24001A883B0A


Step 3: Initialize the write pointer (W7) for TBLWT instruction.000000000000

200xx08801902xxxx7

MOV #<DestinationAddress23:16>, W0MOV W0, TBLPAGMOV #<DestinationAddress15:0>, W7

Step 4: Initialize the read pointer (W6) and load W0:W5 with the next 4 instruction words to program.000000000000000000000000

2xxxx02xxxx12xxxx22xxxx32xxxx42xxxx5

MOV #<LSW0>, W0MOV #<MSB1:MSB0>, W1MOV #<LSW1>, W2MOV #<LSW2>, W3MOV #<MSB3:MSB2>, W4MOV #<LSW3>, W5


dsPIC30F SMPS

Step 5: Set the read pointer (W6) and load the (next set of) write latches.00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

EB0300000000BB0BB6000000000000BBDBB6000000000000BBEBB6000000000000BB1BB6000000000000BB0BB6000000000000BBDBB6000000000000BBEBB6000000000000BB1BB6000000000000

CLR W6NOPTBLWTL [W6++], [W7] NOPNOP TBLWTH.B [W6++], [W7++] NOPNOP TBLWTH.B [W6++], [++W7] NOPNOP TBLWTL [W6++], [W7++] NOP NOP TBLWTL [W6++], [W7] NOPNOP TBLWTH.B [W6++], [W7++] NOP NOP TBLWTH.B [W6++], [++W7] NOPNOPTBLWTL [W6++], [W7++] NOPNOP

Step 6: Repeat steps 3-5 eight times to load the write latches for 32 instructions.Step 7: Unlock the NVMCON for writing.0000000000000000

200558883B38200AA9883B39


Step 8: Initiate the write cycle.00000000000000000000�00000000000000000000

A8E761000000000000000000000000�A9E761000000000000000000000000



040100000000

GOTO 0x100 NOP

Step 10: Repeat steps 3-9 until all code memory is programmed.

TABLE 11-8: SERIAL INSTRUCTION EXECUTION FOR WRITING CODE MEMORY (CONTINUED)Command



dsPIC30F SMPS
11.9 Reading Code MemoryReading from code memory is performed by executinga series of TBLRD instructions and clocking-out thedata using the REGOUT command. To ensure efficientexecution and facilitate verification on the programmer,four instruction words are read from the device at atime.
Table 11-9 shows the ICSP programming details forreading code memory. In Step 1, the Reset vector isexited. In Step 2, the 24-bit starting source address forreading is loaded into the TBLPAG and W6 registers.The upper byte of the starting source address is storedto TBLPAG, while the lower 16 bits of the sourceaddress are stored to W6.

To minimize the reading time, the packed instructionword format that was utilized for writing is also used forreading (see Figure 11-4). In Step 3, the write pointerW7 is initialized, and four instruction words are readfrom code memory and stored to working registersW0:W5. In Step 4, the four instruction words areclocked out of the device from the VISI register usingthe REGOUT command. In Step 5, the internal PC isreset to 0x100, as a precautionary measure, to preventthe PC from incrementing into unimplemented memorywhen large devices are being read. Lastly, in Step 6,Steps 3-5 are repeated until the desired amount ofcode memory is read.

TABLE 11-9: SERIAL INSTRUCTION EXECUTION FOR READING CODE MEMORYCommand



040100040100000000


Step 2: Initialize TBLPAG and the read pointer (W6) for TBLRD instruction.000000000000

200xx08801902xxxx6

MOV #<SourceAddress23:16>, W0MOV W0, TBLPAGMOV #<SourceAddress15:0>, W6

Step 3: Initialize the write pointer (W7) and store the next four locations of code memory to W0:W5.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

EB0380BA1B96000000000000BADBB6000000000000BADBD6000000000000BA1BB6000000000000BA1B96000000000000BADBB6000000000000BADBD6000000000000BA0BB6000000000000

CLR W7 TBLRDL [W6], [W7++] NOPNOPTBLRDH.B [W6++], [W7++] NOPNOPTBLRDH.B [++W6], [W7++] NOPNOPTBLRDL [W6++], [W7++] NOPNOPTBLRDL [W6], [W7++] NOPNOPTBLRDH.B [W6++], [W7++] NOPNOPTBLRDH.B [++W6], [W7++] NOPNOPTBLRDL [W6++], [W7] NOPNOP


dsPIC30F SMPS

Step 4: Output W0:W5 using the VISI register and REGOUT command.000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000

883C20000000<VISI>000000883C21000000<VISI>000000883C22000000<VISI>000000883C23000000<VISI>000000883C24000000<VISI>000000883C25000000<VISI>000000

MOV W0, VISI NOPClock out contents of VISI registerNOPMOV W1, VISI NOPClock out contents of VISI registerNOPMOV W2, VISI NOPClock out contents of VISI registerNOPMOV W3, VISI NOPClock out contents of VISI registerNOPMOV W4, VISI NOPClock out contents of VISI registerNOPMOV W5, VISI NOPClock out contents of VISI registerNOP

Step 5: Reset the device internal PC.00000000

040100000000

GOTO 0x100 NOP

Step 6: Repeat steps 3-5 until all desired code memory is read.

TABLE 11-9: SERIAL INSTRUCTION EXECUTION FOR READING CODE MEMORY (CONTINUED)Command



dsPIC30F SMPS
11.10 Reading Configuration MemoryThe procedure for reading configuration memory issimilar to the procedure for reading code memory,except that 16-bit data words are read instead of 24-bitwords. Since there are seven Configuration registers,they are read one register at a time.
Table 11-10 shows the ICSP programming details forreading all of the configuration memory. Note that theTBLPAG register is hard-coded to 0xF8 (the upper byteaddress of configuration memory), and the read pointerW6 is initialized to 0x0000.

TABLE 11-10: SERIAL INSTRUCTION EXECUTION FOR READING ALL CONFIGURATION MEMORYCommand



040100040100000000


Step 2: Initialize TBLPAG, and the read pointer (W6) and the write pointer (W7) for TBLRD instruction.0000000000000000

200F80880190EB0300EB0380

MOV #0xF8, W0MOV W0, TBLPAGCLR W6CLR W7

Step 3: Read the Configuration register and write it to the VISI register (located at 0x784).00000000000000000000

BA0BB6000000000000883C20000000

TBLRDL [W6++], [W7] NOPNOPMOV W0, VISI NOP

Step 4: Output the VISI register using the REGOUT command.00010000

<VISI>000000

Clock out contents of VISI registerNOP


040100000000

GOTO 0x100 NOP

Step 6: Repeat steps 3-5 until all desired code memory is read.


dsPIC30F SMPS
11.11 Reading the Application ID WordThe application ID word is stored at address 0x8005BEin executive code memory. To read this memorylocation, you must use the SIX control code to movethis program memory location to the VISI register. TheREGOUT control code must then be used to clock thecontents of the VISI register out of the device. Thecorresponding control and instruction codes that mustbe serially transmitted to the device to perform thisoperation are shown in Table 11-11.
Once the programmer has clocked-out the applicationID word, it must be inspected. If the application ID hasthe value 0xBB, the programming executive is residentin memory and the device can be programmed usingthe mechanism described in Section 5.0 �DeviceProgramming�. However, if the application ID has anyother value, the programming executive is not residentin memory. It must be loaded to memory before thedevice can be programmed. The procedure for loadingthe programming executive to memory is described inSection 12.0 �Programming the ProgrammingExecutive to Memory�.

11.12 Exiting ICSP ModeTo exit from Program/Verify mode, remove VIH fromMCLR, as shown in Figure 11-5. The only requirementfor exit is that an interval P9b should elapse betweenthe last clock and program signals on PGC and PGDbefore removing VIH.

FIGURE 11-5: EXITING ICSP� MODE

MCLR

P9b

PGD

PGD = Input

PGC

VDD

VIH

VIH

P15

TABLE 11-11: SERIAL INSTRUCTION EXECUTION FOR READING THE APPLICATION ID WORDCommand



040100040100000000



200800880190205BE0207841BA0890000000000000

MOV #0x80, W0 MOV W0, TBLPAGMOV #0x5BE, W0 MOV VISI, W1 TBLRDL [W0], [W1] NOPNOP

Step 3: Output the VISI register using the REGOUT command.00010000

<VISI>000000

Clock out contents of the VISI registerNOP


dsPIC30F SMPS

12.0 PROGRAMMING THE PROGRAMMING EXECUTIVE TO MEMORY

12.1 OverviewIf it is determined that the programming executive doesnot reside in executive memory (as described inSection 4.0 �Confirming The Contents of ExecutiveMemory�), it must be programmed into executivememory using ICSP and the techniques described inSection 11.0 �ICSP� Mode�.

Storing the programming executive to executivememory is similar to normal programming of codememory. Namely, the executive memory must first beerased, and then the programming executive must beprogrammed 32 words at a time. This control flow issummarized in Table 12-1.

TABLE 12-1: PROGRAMMING THE PROGRAMMING EXECUTIVE Command


Step 1: Exit the Reset vector and erase executive memory.000000000000

040100040100000000


Step 2: Initialize the NVMCON to erase executive memory.00000000

24072A883B0A

MOV #0x4072, W10 MOV W10, NVMCON


200558883B38200AA9883B39

MOV #0x55, W8 MOV W8, NVMKEYMOV #0xAA, W9 MOV W9, NVMKEY


A8E761000000000000000000000000�A9E761000000000000000000000000

BSET NVMCON, #15 NOPNOPNOPNOPExternally time 2 msecBCLR NVMCON, #15NOPNOPNOPNOP

Step 5: Initialize the NVMCON to program 32 instruction words. 00000000

24001A883B0A

MOV #0x4001, W10 MOV W10, NVMCON

Step 6: Initialize TBLPAG and the write pointer (W7).00000000000000000000

200800880190EB0380000000000000

MOV #0x80, W0 MOV W0, TBLPAG CLR W7 NOPNOP


dsPIC30F SMPS

Step 7: Load W0:W5 with the next 4 words of packed programming executive code and initialize W6 for programming. Programming starts from the base of executive memory (0x800000) using W6 as a read pointer and W7 as a write pointer.

000000000000000000000000

2<LSW0>02<MSB1:MSB0>12<LSW1>22<LSW2>32<MSB3:MSB2>42<LSW3>5

MOV #<LSW0>, W0 MOV #<MSB1:MSB0>, W1 MOV #<LSW1>, W2 MOV #<LSW2>, W3 MOV #<MSB3:MSB2>, W4 MOV #<LSW3>, W5

Step 8: Set the read pointer (W6) and load the (next four write) latches.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

EB0300BB0BB6000000000000BBDBB6000000000000BBEBB6000000000000BB1BB6000000000000BB0BB6000000000000BBDBB6000000000000BBEBB6000000000000BB1BB6000000000000

CLR W6TBLWTL [W6++], [W7] NOPNOPTBLWTH.B [W6++], [W7++] NOPNOPTBLWTH.B [W6++], [++W7] NOPNOPTBLWTL [W6++], [W7++] NOPNOPTBLWTL [W6++], [W7] NOPNOPTBLWTH.B [W6++], [W7++] NOPNOPTBLWTH.B [W6++], [++W7] NOPNOPTBLWTL [W6++], [W7++] NOPNOP

Step 9: Repeat Steps 7-8 eight times to load the write latches for the 32 instructions.Step 10: Unlock the NVMCON for programming.0000000000000000

200558883B38200AA9883B39

MOV #0x55, W8 MOV W8, NVMKEYMOV #0xAA, W9 MOV W9, NVMKEY

Step 11: Initiate the programming cycle.00000000000000000000�000000000000

A8E761000000000000000000000000�A9E761000000000000

BSET NVMCON, #15 NOPNOPNOPNOPExternally time 2 msecBCLR NVMCON, #15NOPNOP


040100000000

GOTO 0x100 NOP

Step 13: Repeat Steps 7-12 until all 23 rows of executive memory are programmed.

TABLE 12-1: PROGRAMMING THE PROGRAMMING EXECUTIVE (CONTINUED)Command



dsPIC30F SMPS
12.2 Programming Verification After the programming executive has beenprogrammed to executive memory using ICSP, it mustbe verified. Verification is performed by reading out thecontents of executive memory and comparing it withthe image of the programming executive stored in theprogrammer.
Reading the contents of executive memory can beperformed using the similar technique described inSection 11.9 �Reading Code Memory�. A procedurefor reading executive memory is shown in Table 12-2.Note that, in Step 2, the TBLPAG register is set to 0x80such that executive memory may be read.

TABLE 12-2: READING EXECUTIVE MEMORYCommand



040100040100000000



200800880190EB0300

MOV #0x80, W0 MOV W0, TBLPAGCLR W6

Step 3: Initialize the write pointer (W7), and store the next four locations of executive memory to W0:W5. 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

EB0380BA1B96000000000000BADBB6000000000000BADBD6000000000000BA1BB6000000000000BA1B96000000000000BADBB6000000000000BADBD6000000000000BA1BB6000000000000

CLR W7TBLRDL [W6], [W7++]NOPNOPTBLRDH.B [W6++], [W7++]NOPNOPTBLRDH.B [++W6], [W7++]NOPNOPTBLRDL [W6++], [W7++]NOPNOPTBLRDL [W6], [W7++]NOPNOPTBLRDH.B [W6++], [W7++]NOPNOPTBLRDH.B [++W6], [W7++]NOPNOPTBLRDL [W6++], [W7]NOPNOP


dsPIC30F SMPS

Step 4: Output W0:W5 using the VISI register and REGOUT command.000000000001000000000001000000000001000000000001000000000001000000000001

883C20000000�883C21000000�883C22000000�883C23000000�883C24000000�883C25000000�

MOV W0, VISINOPClock out contents of VISI registerMOV W1, VISINOPClock out contents of VISI registerMOV W2, VISINOPClock out contents of VISI registerMOV W3, VISINOPClock out contents of VISI registerMOV W4, VISINOPClock out contents of VISI registerMOV W5, VISINOPClock out contents of VISI register


040100000000

GOTO 0x100 NOP

Step 6: Repeat Steps 3-5 until all 736 instruction words of executive memory are read.

TABLE 12-2: READING EXECUTIVE MEMORY (CONTINUED)Command



dsPIC30F SMPS

13.0 AC/DC CHARACTERISTICS AND TIMING REQUIREMENTS

Table 13-1 lists AC/DC characteristics and timingrequirements.

TABLE 13-1: AC/DC CHARACTERISTICS AND TIMING REQUIREMENTS

AC/DC CharacteristicsStandard Operating Conditions(unless otherwise stated)Operating Temperature: 25°C is recommended

Param. No. Sym Characteristic Min Max Units Conditions

D110 VIHH Programming Voltage on MCLR 0.8 VDD VDD V

D112 IPP Programming Current on MCLR � 5 mAD113 IDDP Supply Current during programming � 30 mA Row Erase

Program memory

� 30 mA Bulk EraseD001 VDD Supply voltage 3.0 5.5 VD002 VDDBULK Supply voltage for Bulk Erase

programming3.0 5.5 V

D031 VIL Input Low Voltage VSS 0.2 VSS VD041 VIH Input High Voltage 0.8 VDD VDD VD080 VOL Output Low Voltage � 0.6 V IOL = 8.5 mAD090 VOH Output High Voltage VDD � 0.7 � V IOH = -3.0 mAD012 CIO Capacitive Loading on I/O Pin (PGD) � 50 pF To meet AC

specificationsP1 TPGC Serial Clock (PGC) Period 100 � nsP1A TPGCL Serial Clock (PGC) Low Time 40 � nsP1B TPGCH Serial Clock (PGC) High Time 40 � nsP2 TSET1 Input Data Setup Time to Serial Clock ↓ 15 � nsP3 THLD1 Input Data Hold Time from PGC ↓ 15 � nsP4 TDLY1 Delay between 4-bit Command and

Command Operand40 � ns

P4A TDLY1A Delay between 4-bit Command Operand and Next 4-bit Command

40 � ns

P5 TDLY2 Delay between Last PGC ↓ of Command Byte to First PGC ↑ of Read of Data Word

20 � ns

P6 TSET2 VDD ↑ Setup Time to MCLR ↑ 100 � ns

P7 THLD2 Input Data Hold Time from MCLR ↑ 500 � nsP8 TDLY3 Delay between Last PGC ↓ of Command

Byte to PGD ↑ by Programming Executive

20 � ms

P9a TDLY4 Programming Executive Command Processing Time

10 � ms

P9b TDLY5 Delay between PGD ↓ by Programming Executive to PGD Released by Programming Executive

15 � ms

P10 TDLY6 PGC Low Time After Programming 400 � ns


dsPIC30F SMPS

P11 TDLY7 Delay to allow Bulk Erase to Occur 200 � ms

P12 TR MCLR Rise Time to Enter ICSP mode � 1.0 msP13 TVALID Data Out Valid from PGC ↑ 10 � ns

P14 TDLY8 Delay between Last PGC ↓ and MCLR ↓ 0 � s

P15 THLD3 MCLR ↓ to VDD ↓ � 100 ns

P16 TKEY1 Delay from First MCLR ↓ to First PGC ↑ for Key Sequence on PGD

40 � ns

P17 TKEY2 Delay from Last PGC ↓ for Key Sequence on PGD to Second MCLR ↑

40 � ns

P18 TPROG Programming cycle time 1 4 ms ICSP� modeP19 TERA Erase cycle time 1 4 ms ICSP mode

TABLE 13-1: AC/DC CHARACTERISTICS AND TIMING REQUIREMENTS (CONTINUED)

AC/DC CharacteristicsStandard Operating Conditions(unless otherwise stated)Operating Temperature: 25°C is recommended

Param. No. Sym Characteristic Min Max Units Conditions


dsPIC30F SMPS Flash Programming Specification

APPENDIX A: HEX FILE FORMATFlash programmers process the standard HEX formatused by the Microchip development tools. The formatsupported is the Intel® HEX 32 Format (INHX32).Please refer to Appendix A in the �MPASM�Assembler, MPLINK� Linker, MPLIB� ObjectLibrarian User�s Guide� (DS33014) for moreinformation about hex file formats.

The basic format of the hex file is:

:BBAAAATTHHHH...HHHHCC

Each data record begins with a 9-character prefix andalways ends with a 2-character checksum. All recordsbegin with ':' regardless of the format. The individualelements are described below.

� BB - is a two-digit hexadecimal byte count representing the number of data bytes that appear on the line. Divide this number by two to get the number of words per line.

� AAAA - is a four-digit hexadecimal address representing the starting address of the data record. Format is high byte first followed by low byte. The address is doubled because this format only supports 8-bits. Divide the value by two to find the real device address.

� TT - is a two-digit record type that will be '00' for data records, '01' for end-of-file records and '04' for extended-address record.

� HHHH - is a four-digit hexadecimal data word. Format is low byte followed by high byte. There will be BB/2 data words following TT.

� CC - is a two-digit hexadecimal checksum that is the two's complement of the sum of all the preceding bytes in the line record.

Because the Intel hex file format is byte-oriented, andthe 16-bit program counter is not, program memorysections require special treatment. Each 24-bitprogram word is extended to 32 bits by inserting a so-called �phantom byte�. Each program memoryaddress is multiplied by 2 to yield a byte address.

As an example, a section that is located at 0x100 inprogram memory will be represented in the hex file as0x200.

The hex file will be produced with the followingcontents:

:020000040000fa

:040200003322110096

:00000001FF

Notice that the data record (line 2) has a load addressof 0200, while the source code specified address0x100. Note also that the data is represented in �little-endian� format, meaning the least significant byteappears first. The phantom byte appears last, justbefore the checksum.


dsPIC30F SMPS Flash Programming Specification

APPENDIX B: REVISION HISTORYRevision A (February 2007)� Initial release of this document.

Revision B (September 2007)� Updated paragraph in Section 2.2 �Pins Used

During Programming� to include reference to location of complete pin diagrams

� Removed all pin diagrams� Modified the first sentence in Section 5.7.1

�Overview� to read as follows: The dsPIC30F SMPS has Configuration bits stored in seven 16-bit registers. Bold text denotes the change.

� Added the following note after the second paragraph in Section 5.7.1 �Overview�:

� Added the following sentence to the end of the paragraph in Section 5.7.5 �User Unit ID�: Programming the UNIT ID is similar to programming the Programming Executive (see Section 12.0 �Programming the Programming Executive to Memory� for details).

� Updated instructions in the following tables:- Table 11-4 (removed two NOPs before the GOTO instruction in Step 1 and added two NOPs after BSET and BCLR in Step 12)

- Table 11-5 (removed two NOPs before the GOTO instruction in Step 1 and added two NOPs after BSET and BCLR in Step 5 and Step 12)

- Table 11-7 (removed two NOPs before the GOTO instruction in Step 1, changed BB1B96 to BB1B86 in Step 6, added two NOPs after BSET and BCLR in Step 8, and changed 9 to seven in Step 10)

- Table 11-8 (removed two NOPs before the GOTO instruction in Step 1)




- Table 12-1 (removed two NOPs before the GOTO instruction in Step 1 and added two NOPs after BSET and BCLR in Step 4 and Step 11)


� Replaced the number 9 with the word seven in the last sentence of the last paragraph of Section 11.7 �Writing Configuration Memory�.

� Changed the max values for parameters TPROG and TERA in Table 13-11.

� Added Appendix A: �Hex File Format�.

Note: If user software performs an erase opera-tion on the configuration fuse, it must befollowed by a write operation to this fusewith the desired value, even if the desiredvalue is the same as the state of theerased fuse.


Note the following details of the code protection feature on Microchip devices:� Microchip products meet the specification contained in their particular Microchip Data Sheet.

� Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the intended manner and under normal conditions.

� There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip�s Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property.

� Microchip is willing to work with the customer who is concerned about the integrity of their code.

� Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as �unbreakable.�

Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of ourproducts. Attempts to break Microchip�s code protection feature may be a violation of the Digital Millennium Copyright Act. If such actsallow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act.

Information contained in this publication regarding deviceapplications and the like is provided only for your convenienceand may be superseded by updates. It is your responsibility toensure that your application meets with your specifications.MICROCHIP MAKES NO REPRESENTATIONS ORWARRANTIES OF ANY KIND WHETHER EXPRESS ORIMPLIED, WRITTEN OR ORAL, STATUTORY OROTHERWISE, RELATED TO THE INFORMATION,INCLUDING BUT NOT LIMITED TO ITS CONDITION,QUALITY, PERFORMANCE, MERCHANTABILITY ORFITNESS FOR PURPOSE. Microchip disclaims all liabilityarising from this information and its use. Use of Microchipdevices in life support and/or safety applications is entirely atthe buyer�s risk, and the buyer agrees to defend, indemnify andhold harmless Microchip from any and all damages, claims,suits, or expenses resulting from such use. No licenses areconveyed, implicitly or otherwise, under any Microchipintellectual property rights.

© 2007 Microchip Technology Inc.

Trademarks

The Microchip name and logo, the Microchip logo, Accuron, dsPIC, KEELOQ, KEELOQ logo, microID, MPLAB, PIC, PICmicro, PICSTART, PRO MATE, rfPIC and SmartShunt are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries.

AmpLab, FilterLab, Linear Active Thermistor, Migratable Memory, MXDEV, MXLAB, SEEVAL, SmartSensor and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A.

Analog-for-the-Digital Age, Application Maestro, CodeGuard, dsPICDEM, dsPICDEM.net, dsPICworks, dsSPEAK, ECAN, ECONOMONITOR, FanSense, FlexROM, fuzzyLAB, In-Circuit Serial Programming, ICSP, ICEPIC, Mindi, MiWi, MPASM, MPLAB Certified logo, MPLIB, MPLINK, PICkit, PICDEM, PICDEM.net, PICLAB, PICtail, PowerCal, PowerInfo, PowerMate, PowerTool, REAL ICE, rfLAB, Select Mode, Smart Serial, SmartTel, Total Endurance, UNI/O, WiperLock and ZENA are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries.

SQTP is a service mark of Microchip Technology Incorporated in the U.S.A.

All other trademarks mentioned herein are property of their respective companies.

© 2007, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved.

Printed on recycled paper.

DS70284B-page 47

Microchip received ISO/TS-16949:2002 certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona; Gresham, Oregon and design centers in California and India. The Company�s quality system processes and procedures are for its PIC® MCUs and dsPIC® DSCs, KEELOQ® code hopping devices, Serial EEPROMs, microperipherals, nonvolatile memory and analog products. In addition, Microchip�s quality system for the design and manufacture of development systems is ISO 9001:2000 certified.


AMERICASCorporate Office2355 West Chandler Blvd.Chandler, AZ 85224-6199Tel: 480-792-7200 Fax: 480-792-7277Technical Support: http://support.microchip.comWeb Address: www.microchip.comAtlantaDuluth, GA Tel: 678-957-9614 Fax: 678-957-1455BostonWestborough, MA Tel: 774-760-0087 Fax: 774-760-0088ChicagoItasca, IL Tel: 630-285-0071 Fax: 630-285-0075DallasAddison, TX Tel: 972-818-7423 Fax: 972-818-2924DetroitFarmington Hills, MI Tel: 248-538-2250Fax: 248-538-2260KokomoKokomo, IN Tel: 765-864-8360Fax: 765-864-8387Los AngelesMission Viejo, CA Tel: 949-462-9523 Fax: 949-462-9608Santa ClaraSanta Clara, CA Tel: 408-961-6444Fax: 408-961-6445TorontoMississauga, Ontario, CanadaTel: 905-673-0699 Fax: 905-673-6509

ASIA/PACIFICAsia Pacific OfficeSuites 3707-14, 37th FloorTower 6, The GatewayHarbour City, KowloonHong KongTel: 852-2401-1200Fax: 852-2401-3431Australia - SydneyTel: 61-2-9868-6733Fax: 61-2-9868-6755China - BeijingTel: 86-10-8528-2100 Fax: 86-10-8528-2104China - ChengduTel: 86-28-8665-5511Fax: 86-28-8665-7889China - FuzhouTel: 86-591-8750-3506 Fax: 86-591-8750-3521China - Hong Kong SARTel: 852-2401-1200 Fax: 852-2401-3431China - NanjingTel: 86-25-8473-2460Fax: 86-25-8473-2470China - QingdaoTel: 86-532-8502-7355Fax: 86-532-8502-7205China - ShanghaiTel: 86-21-5407-5533 Fax: 86-21-5407-5066China - ShenyangTel: 86-24-2334-2829Fax: 86-24-2334-2393China - ShenzhenTel: 86-755-8203-2660 Fax: 86-755-8203-1760China - ShundeTel: 86-757-2839-5507 Fax: 86-757-2839-5571China - WuhanTel: 86-27-5980-5300Fax: 86-27-5980-5118China - XianTel: 86-29-8833-7252Fax: 86-29-8833-7256

ASIA/PACIFICIndia - BangaloreTel: 91-80-4182-8400 Fax: 91-80-4182-8422India - New DelhiTel: 91-11-4160-8631Fax: 91-11-4160-8632India - PuneTel: 91-20-2566-1512Fax: 91-20-2566-1513Japan - YokohamaTel: 81-45-471- 6166 Fax: 81-45-471-6122Korea - DaeguTel: 82-53-744-4301Fax: 82-53-744-4302Korea - SeoulTel: 82-2-554-7200Fax: 82-2-558-5932 or 82-2-558-5934Malaysia - Kuala LumpurTel: 60-3-6201-9857Fax: 60-3-6201-9859Malaysia - PenangTel: 60-4-646-8870Fax: 60-4-646-5086Philippines - ManilaTel: 63-2-634-9065Fax: 63-2-634-9069SingaporeTel: 65-6334-8870Fax: 65-6334-8850Taiwan - Hsin ChuTel: 886-3-572-9526Fax: 886-3-572-6459Taiwan - KaohsiungTel: 886-7-536-4818Fax: 886-7-536-4803Taiwan - TaipeiTel: 886-2-2500-6610 Fax: 886-2-2508-0102Thailand - BangkokTel: 66-2-694-1351Fax: 66-2-694-1350

EUROPEAustria - WelsTel: 43-7242-2244-39Fax: 43-7242-2244-393Denmark - CopenhagenTel: 45-4450-2828 Fax: 45-4485-2829France - ParisTel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79Germany - MunichTel: 49-89-627-144-0 Fax: 49-89-627-144-44Italy - Milan Tel: 39-0331-742611 Fax: 39-0331-466781Netherlands - DrunenTel: 31-416-690399 Fax: 31-416-690340Spain - MadridTel: 34-91-708-08-90Fax: 34-91-708-08-91UK - WokinghamTel: 44-118-921-5869Fax: 44-118-921-5820

Worldwide Sales and Service

09/10/07

Documents

dsPIC30F SMPS