This Community site is new! Please help us build a community around the JNIOR.
Sign up, and help share your knowledge. Please sign-up even if you do not plan to post as a sign of support.
If there is evidence of a demand we will continue to develop the content here.

Renesas RX63N JTAG Interface

When its not software, it must be hardware. This is the place to talk about what makes the JNIOR tick.
Post Reply
bscloutier
Posts: 401
Joined: Thu Sep 14, 2017 12:55 pm

Renesas RX63N JTAG Interface

Post by bscloutier » Mon Feb 26, 2018 2:30 pm

Preface

The JNIOR product line presently consists of a series of 4 models each based upon the RX63N microcontroller. The processor is programmed with our own JANOS operating system. In the field JANOS can update itself using a rather sophisticated fault-tolerant procedure. However initially the processor must be programmed through another interface provided for that purpose. When we build JNIORs they are initially programmed through the JTAG (Joint Test Action Group, IEEE Std. 1149.1) interface.

We used the 144-pin LQFP package for its convenience during prototyping and test. Our JTAG interface consumes 8 of the 144 available pins for the signals: /RES, TDO, TDI, TMS, TCK, /TRST, MD and EMLE. These pins are exposed through a 2x7 0.100" header which lets us use the Renesas E1 Debugger for development. We did not utilize the FINE (two-line debugging interface) or the USB bootstrap loader.

For efficient volume production we needed to develop a single Build Station that can program, test and configure each JNIOR. We also needed to be able to build several JNIORs at a time. We ended up developing a two-board system with standard INTEG PCBs that would build a JNIOR one-on-one. We created several of these builders. Given the flexibility and convenience in the high-level capabilities of a JNIOR, we ended up using the JNIOR to build JNIORs.

Those of you who are familiar with the JNIOR are also familiar with the small set of I/O expansion modules that are available for use with the product. Each of these expansion modules are based upon the TI MSP430 which communicates with the JNIOR through the Sensor Port. The circuit board that is supplied with our rack-mounted control panel (one of the expansion options) proved to be a great host for a JTAG programmer. This small board contains sufficient Flash memory, which is itself configured as a file system, to hold the initial image of JANOS. I/O is presented at a convenient connector. We have successfully utilized this board as a JTAG programmer.

Unfortunately the hardware documentation for the RX63N provided just a rudimentary description of the interface. This falling far short of describing what is required to program and verify the internal Flash and ROM areas. A search of the Internet failed to turn up any suitable documentation for this. Our request to Renesas for the specification through our local support channels left us empty-handed. The option of purchasing an off-the-shelf JTAG programmer and building a Windows PC based building station was far more expensive, limiting and just did not excite us. This left me no real option but to reverse engineer. I will avoid an obvious rant at this point regarding our commitment to the processor and the withholding of secrets limiting our ability to actually integrate the device.

What will follow is a description of the JTAG interface from a reverse engineering standpoint (describing the interface from my perspective). Through this interface we can fully program the internal Flash and initialize the Data ROM; We can utilize the boundary scan to the point of testing the JNIOR digital I/O; We can execute code on the processor without actually booting the installed operating system; And, we have discovered some undocumented registers begging exploration.

Doubtless that some of you have the necessary specifications. With my luck this information may be publicly available and I just couldn't persevere through the marketing smoke screen that Google puts up. Or perhaps some of you have also reverse engineered this interface and will chuckle where it becomes obvious that I have missed something. In all cases I would be happy now that all is said and done to be corrected.

bscloutier
Posts: 401
Joined: Thu Sep 14, 2017 12:55 pm

Re: Renesas RX63N JTAG Interface

Post by bscloutier » Mon Feb 26, 2018 3:30 pm

Overview

I would like to provide an overview of the Builder we use in production just as a reference before digging into the lowest-level details of the JTAG programming interface involved. As mentioned the Builder consists of a two-board system. One being the standard JNIOR Model 410 and the other the standard PCB removed from our Control Panel. The intention at some point is to lay out a new PCB merging the circuits and perhaps incorporating more of a bed-of-nails approach to the build station.

The JNIOR very easily provides a browser-based user interface. It also lets us update the Builder itself through the network. It provides us with two serial ports which are employed to test and verify the corresponding serial ports on the newly programmed PCA (Printed Circuit Assembly). Through the LAN we can communicate with the PCA both to verify its network function and to configure the new system. Built-in FTP tools allow us to transfer the initial file system content from the Builder to the PCA. And the managed programming environment provided by Java makes it easy to sequence the events. The JNIOR also has the Sensor Port through which we communicate with the expansion board liberated from another product and redeployed as a JTAG programmer.

A freshly assembled JNIOR board is brought to the Builder. A custom harness is connected which applies power to the PCA and interconnects all of the relay outputs and digital inputs in a fashion letting us test those I/O points regardless of model (I/O mix). The PCA is connected to the local network and the two serial ports are connected to those on the Builder. A test expansion module is connected to the PCA's Sensor Port so we can verify the functionality there. And finally a JTAG cable from our programmer is connected to the header on the PCA. At this point the PCA is powered up and the Power LED (blue) illuminated but the PCA's mind is blank.

The operator enters the Serial Number on the Builder's page and clicks Start. The Builder then triggers the JTAG Programmer and monitors its status providing reports to the browser page. Our little MSP430 based programmer board then checks for the presence of the Renesas JTAG serial hardware. If it encounters any error it is reported to the Builder and then to the operator. Here's where we begin to use an emulator in the RX63N which I will describe later to perform any necessary login. The JTAG interface will eventually be secured. To allow us to rebuild a unit we need to detect the security and enter the correct code to regain access. This login is handled before anything else can be done.

The programmer then sets the endianess for the new PCA which if we are rebuilding may not need to be altered. This involves programming or reprogramming the last 4K of internal Flash. When this is changed we need to reboot the emulator before continuing.

The procedure continues and involves many steps most of which we will get into in detail later. These program a unique MAC address and Serial Number, initializing the E2 DataFlash, and program the initial JANOS image. Our JTAG programmer then cycles the digital I/O to close relays and sample inputs verifying the I/O points. Once all of this is successful JANOS will boot for the first time (birth) and the JTAG programmer will pass control back to the Builder's Java routine.

The Builder then communicates through the COM diagnostic port to both confirm the function of this serial port and the error-free JANOS (POR #1) boot. The File System is then initialized (formatted) and the initial file content transferred via FTP. This verifies the LAN port and File System (memory/flash operation). The Builder uses the MANIFEST command to verify each and every file on the newly built PCA. The Builder also verifies the presence of the test expansion module and the AUX port communications.

When all is successful the browser window goes GREEN. The operator removes the competed PCA. The JTAG programmer notes the that PCA has been removed and signals the Builder to advance the Serial Number and MAC address. The operation takes about 3 to 4 minutes and fully tests and configures the new JNIOR ready for a customer.

Using the JNIOR to build JNIORs is a testament to its flexibility and functionality. It is also clear that we can achieve a lot through the JTAG interface. I will try to provide the specifics in the following posts.

bscloutier
Posts: 401
Joined: Thu Sep 14, 2017 12:55 pm

Re: Renesas RX63N JTAG Interface

Post by bscloutier » Tue Feb 27, 2018 8:45 am

Hardware

The JTAG interface from a hardware perspective is documented well enough. You can find numerous descriptions with a simple search. It doesn't make sense for me to spend time trying to describe it yet again. There were several documents that I found useful. The following application note and simple introduction by Amontec is fairly well done and is a good place to start. At the time of this writing however their website (http://www.amontec.com) is not present.

amt_ann004.pdf
(384.84 KiB) Downloaded 18 times

There are 4 signals that control the interface: TCK, TMS, TDI and TDO. These four signals control the TAP Controller (Test Access Port Controller) which coordinates loading and reading the content of a Data Register and an Instruction Register. The TAP Controller is a 16-state finite state machine. Figure 2 in the application note above is key. Here is another version of it.

tap_state_machine.gif
tap_state_machine.gif (17.34 KiB) Viewed 217 times

Basically the TCK signal is the clock. With each rising edge of the clock the TMS signal is sampled and the state machine proceeds as diagrammed. When in a Capture or Shift state data is shifted into the appropriate register by sampling the TDI data signal while simultaneously the existing content of the register is presented for reading on TDO. This all occurs with the rising edge of TCK.

Note that if you hold TMS high (1) and toggle TCK (5 or more times) the state machine no matter where it is runs to the top and enters the Test Logic Reset state. This is the starting point. You need to get there to synchronize with the state machine. Setting TMS low (0) and toggling TCK moves to the Run-Test/Idle state where the machine remains until TMS becomes high.

Attached are some additional descriptions and application notes. Some of these contain useful examples. You can use these to augment what detail Renesas does provide in the RX63N hardware manual.
Attachments
slau320r.pdf
(880.86 KiB) Downloaded 17 times
AN3283.pdf
(503.76 KiB) Downloaded 23 times
jtag.pdf
(456.61 KiB) Downloaded 17 times
an105.pdf
(689.68 KiB) Downloaded 18 times

Post Reply