Monitor ROM (MON)
Upon power-on reset, if the received bytes of the security code do not match the data at locations
$FFF6–$FFFD, the host fails to bypass the security feature. The MCU remains in monitor mode, but
reading a FLASH location returns an invalid value and trying to execute code from FLASH causes an
illegal address reset. After receiving the eight security bytes from the host, the MCU transmits a break
character, signifying that it is ready to receive a command.
NOTE
The MCU does not transmit a break character until after the host sends the
eight security bits.
To determine whether the security code entered is correct, check to see if bit 6 of RAM address $60 is
set. If it is, then the correct security code has been entered and FLASH can be accessed.
If the security sequence fails, the device should be reset by a power-on reset and brought up in monitor
mode to attempt another entry. After failing the security sequence, the FLASH module can also be mass
erased by executing an erase routine that was downloaded into internal RAM. The mass erase operation
clears the security code locations so that all eight security bytes become $FF (blank).
8.5 ROM-Resident Routines
Seven routines stored in the monitor ROM area (thus ROM-resident) are provided for FLASH memory
manipulation. Five of the seven routines are intended to simplify FLASH program, erase, and load
operations. The other two routines are intended to simplify the use of the FLASH memory as EEPROM.
Table 8-10 shows a summary of the ROM-resident routines.
Table 8-10. Summary of ROM-Resident Routines
Stack Used
(bytes)
Routine Name
Routine Description
Call Address
PRGRNGE
ERARNGE
LDRNGE
Program a range of locations
$FC34
$FCE4
$FC00
15
9
Erase a page or the entire array
Loads data from a range of locations
7
Program a range of locations in monitor
mode
MON_PRGRNGE
MON_ERARNGE
EE_WRITE
$FF24
$FF28
$FF36
17
11
30
Erase a page or the entire array in
monitor mode
Emulated EEPROM write. Data size
ranges from 7 to 15 bytes at a time.
Emulated EEPROM read. Data size
ranges from 7 to 15 bytes at a time.
EE_READ
$FD5B
18
The routines are designed to be called as stand-alone subroutines in the user program or monitor mode.
The parameters that are passed to a routine are in the form of a contiguous data block, stored in RAM.
The index register (H:X) is loaded with the address of the first byte of the data block (acting as a pointer),
and the subroutine is called (JSR). Using the start address as a pointer, multiple data blocks can be used,
any area of RAM be used. A data block has the control and data bytes in a defined order, as shown in
Figure 8-9.
MC68HC908AP Family Data Sheet, Rev. 4
126
Freescale Semiconductor
FREESCALE [ Freescale ]
