This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMDSCNCDH52C1: C28x system programming issue (Error -1156 @ 0x8050)

Part Number: TMDSCNCDH52C1
Other Parts Discussed in Thread: UNIFLASH, CONTROLSUITE

Hello,

I'm new to F28M35x series devices and I had been programming above Concerto control card hundred of times without any issue. Few weeks ago, loading program error occurred when programming C28x processor in flash mode. After that same error occurred and I used a new control card after that. Today the second one also gave the same error and not able to program C28x after that in any way.

Following are noted,

1. Arm-M3 processor work fine, without any issue and can be programmed

2. Attempted erasing flash of C28x using both CCS & UniFlash, both were unsuccessful

3. Always give the error code 1156 @ 0x8050, Device may be operating in low-power mode. Do you want to bring it out of this mode? Choose 'Yes' to force the device to wake up and retry the operation. Choose 'No' to retry the operation without waking the device.

It would be very helpful if you can provide a solution to this since total project is at stuck due to this

Thanks,

Tharindu

  • Tharindu,

    1) Did you get this error when you try to connect the debugger to the C28x core or when you try to erase or program the C28x Flash? 

    2) On the failing devices, if you are able to connect, can you check whether you are able to read the flash contents in the memory window or not?  

    3) Did you program any security settings in the Flash?  Check the map file to see if anything is allocated to the security fields in Flash.  If not as a part of the coff file, did you try to program any security fields in Flash via Flash Plugin GUI?

    Also, keep M3 connected and halted when you try C28x operations.

    Thanks and regards,
    Vamsi

  • Hello Vamsi,
    1.) I am able to connect to C28x after loading a program into Arm-M3 and hold it. However, I cannot load *.out to C28x or erase flash or C28x after that due to same error. I am able to erase Arm-M3 flash without any issue.
    2.) Can you tell me how to read the flash content using CCS?.In the Memory-Browser, program memory filled with all 0x0000 from address 0x0000 to 0x7ff and error shows 'Error:Memory map prevented reading' after address 0x7ff. However, for both IO & Peripheral memories there is an error shows 'Error:Memory map prevented reading' . Also, Data memory can be read without issue.
    3.) No, I didn't tamper with any security setting. I don't know how to check the map file. In the 'On-chip flash' section of C28x, all security settings are shown 0xFF... . I don't know whether they are the actual values in the flash or values to be programmed using GUI.

    Thanks,
    Tharindu

  • Tharindu,

    #2: Thank you for the RAM info. Can you check Flash memory as well?

    #3: Based on #2, I feel that the device is in secured state. When you compile the project, a map file gets generated along with the executable (.out file). If you open the map file, you will see the details like origin, length, used space and free space for each memory section that you defined in the linker command file. In that list, look for Flash security field address locations and see if something is allocated in that region.

    Security fields in the GUI show the values that are used to program.

    Do you use Flash API in your application? If yes, please check if you are programming any security fields by mistake using API.

    Thanks and regards,
    Vamsi
  • Hello Vamsi,

    No, I don't use flash API in my program.

    #3: I couldn't find any 'flash security field address locations' section in *.map file which is attached herewith. Can you look into that?

    #2. Can you tell me how to check flash memory? I was able to check RAM memories using 'Memory-browser' in debug mode. There is no flash section in the memory browser window. 

    cpu_timers_c28_map.zip

    Thanks,

    Tharindu

  • Tharindu,

    You should be able to enter any address in the memory window. What happens when you try to enter the Flash address?

    I will look in to map file sometime this week.

    Thanks and regards,
    Vamsi
  • Vamsi,

    I entered flash memory addresses and found these,
    1.) all memory contents are set to 0x000
    2.) in below addresses,
    ECSL_PWL_P0 : origin = 0x13FFF4, length = 0x000004 /* Part of FLASHA. ECSL password locations in FLASHA */
    CSM_PWL_P0 : origin = 0x13FFF8, length = 0x000008 /* Part of FLASHA. CSM password locations in FLASHA */
    memory content is 0x0000, which I think should be 0xFFFF since I didn't enable any security feature.

    When I programming the device just before the failure, I think it erased all memory content. After that maybe something went wrong before programming. Can that be the issue?

    Also, I've tried filling above two addresses with 0xFFFF and it returned an error. Also, I've tried few other memory locations to fill with different values and seems to be not working.

    What can I do about this? Is there a factory reset mechanism for the chip?
  • Tharindu,

    If password locations are all zeros, the device is permanently locked. There is no way to recover it. You have to switch to a new device.

    It can happen if there is a power failure during erase/program (if not from your application).

    Thanks and regards,
    Vamsi
  • Vamsi,

    There was no power failure occurred during erase/program. Is there a possibility of the fault due to loosen JTAG cable?

    Is there a way to avoid this in future? Probably not to erase flash prior to programming will avoid this right? If so, is there a way to do that?

    Thanks,
    Tharindu
  • Tharindu,

    I don't think loose JTAG is the problem here - but you need to fix it for reliable connection/data transfer.

    A clean erase or program should not cause any issue - only a power failure can cause this kind of issues (if not your application loading something to security fields).

    I checked your map file.  You did not initialize the password - which is fine.  

                   name                       origin          length         used         unused     attr        fill

       ----------------------                  --------        ---------         --------        --------       ----       --------

    PAGE 0:

      FLASH_EXE_ONLY_P0       0013fff2   00000002  00000000  00000002  RWIX

     ECSL_PWL_P0                     0013fff4   00000004  00000000  00000004  RWIX

     CSM_PWL_P0                      0013fff8   00000008  00000000  00000008  RWIX

    Thanks and regards,

    Vamsi

  • Hello Vamsi,

    We have replaced two F28M35 chips from locked control cards and able to program few times. We have given a reliable power connection to the control card and changed the flash programming settings from 'Erase and Program' to 'Program only' and deselect all the flash sections so that non of them will be erased during programming. Even though I have select not to erase, while debugging C28x flash memories got erased (I saw the progress bar indicated erasing flash ...) and returned to program loading. Then the program loading got stuck in the previous fault(permanent lock). I'm pretty sure my code doesn't try to lock the device as we have checked the *.map file.

    1. Can this be due to possibly an automatic firmware upgrade of the XDS100V2 debugger in the control card? Since, I was using this without any issue for about a year.

    2. Is there any way to setup the optimum debugger settings in CCS so that this fault will not occur?

    3. We're currently designing a custom board for F28M35 by taking control card schematics as the reference without the debugger. Can replicate the XDS100V2 debugger from control card including the firmware of it?

    Thanks
  • Tharindu,

    I tried to use the F28M35x C28x CCS Flash Plugin selecting "Program Only" option and "Selected Sectors Only" option (deselected all the sectors).  And I did not see any erase happening (confirmed with console window messages as well) - Ofcourse, I erased entire Flash by clicking the Erase button before I did this, since I need to erase the existing content in the Flash before I can reprogram.

    You can select "Enable Verbose Output" available at the bottom of the CCS Flash Plugin and click on "Remember My Settings" button.  This will give you more details in the console window - you can check whether erase operation is performed or not.

    Can you try this and confirm?

    Also, which CCS version are you using?

    Regarding your questions:

    #1. I don't think the issue is due to emulator firmware upgrade - however, I did not use that emulator for checking this.  Can you check if there is any dip in the voltage lines (make sure it is in DS spec range) when you perform the Flash load?

    #2. Try with my above suggestions and see if that helps.

    #3: I will ask the corresponding expert to reply you on this.

    Based on your reply, I will ask our security expert to take a look at this.

    Thanks and regards,
    Vamsi

  • Also, you may have noticed below note in DS:

    It is important to maintain a stable power supply during the entire flash programming process. It is conceivable that device current consumption during flash programming could be higher than normal operating conditions. The power supply used should ensure VMIN on the supply rails at all times, as specified in the Recommended Operating Conditions of the data sheet. Any brown-out or interruption to power during erasing/programming could potentially corrupt the password locations and lock the device permanently. Powering a target board (during flash programming) through the USB port is not recommended, as the port may be unable to respond to the power demands placed during the programming process.

    Thanks and regards,

    Vamsi

  • Hello Vamsi,

    Yes, I understand it now. However, the buck converter IC in the control card is TPS62291DRVT which is capable of 1000mA maximum output current and we have given power from 5V 1A supply. Is it better to use a buck converter capable of giving more current in our custom PCB design?

    Thanks,
    Tharindu
  • Tharindu,

    I asked our board expert to help you.

    Thanks and regards,
    Vamsi
  • Tharindu,

    1) Did you try the Flash Plugin settings that I mentioned? Did you observe erase happening even after that?

    2) Did you check if the voltage lines are within DS spec range when it fails?

    3) Generating debug server logs might help for further debug. You can generate the logs via "CCS Help menu -> CCS Support -> Select Debug Server Log -> Click on Properties -> Select Enable Debug Server Logging + Choose a log file location -> Click Ok". Please generate and share them.

    4) Also, can you send the verbose output from console window?

    5) Instead of using Plugin, can you try the flash programming example from ControlSuite and see if that works for C28x?

    Thanks and regards,
    Vamsi
  • Vamsi,

    My CCS version is 6.2.0.00050 . Also, I couldn't find any 'Erase' button in my flash settings. I selected enable verbose o/p in the bottom of flash settings. However, I cannot program the C28x due flash permanent lock. If there is a verbose file generated, where can I find it/ how can I open it?

    Also, I was able to program to the RAM of the locked device and run the code. Is this possible on a permanent locked device?

    What did you meant by DS spec range and where can I find it?

    Thanks,
    Tharindu
  • Hello Vamsi,

    Also in the info sheet of the control card following boot mode configurations are given. 

    I found it hard to understand the difference of C28x boot mode since 'Master' & 'M3' is same in F28M35xx. Therefore what maybe the difference in 'Boot from M3' and 'Boot from Master' in the above table?

    Thanks

  • Tharindu,

    You will find erase button in the CCS Flash Plugin GUI (CCS Debug view -> Tools -> On-Chip Flash). Should be at the bottom of the list of sectors provided for select/deselect.

    When you enable verbose output, please take a look at the console window for the detailed messages. It is ok even if the flashing fails - just provide us the console window messages.

    Also, as I requested, please provide Debug server logs as well.

    Look at section 5.4 Recommended Operating Conditions in datasheet (www.ti.com/.../f28m35m52c.pdf) for operating voltage range.

    I believe you can load to unsecure RAM.

    Did you check for updates in CCS and install if any?

    Thanks and regards,
    Vamsi

  • Also, I will ask the boot expert to help you on your boot questions.

    By the way, can you check whether you are using WIR mode while programming or not?

    Thanks and regards,
    Vamsi
  • Tharindu,

    Also, I was able to program to the RAM of the locked device and run the code. Is this possible on a permanent locked device?

    Which RAMs you are using? If it's non-secure RAM then ok but secure RAM should be inaccessible if device is permanently locked.

    Regards,

    Vivek Singh

  • Tharindu,

    Control card infosheet will be updated. There should not be any difference between Master and M3.

    Please check TRM's BootROM chapter (look at Table 6-1 Master Subsystem Boot Mode selection).

    Thanks and regards,
    Vamsi
  • Tharindu,

    Can I consider this as closed?
    We had some debug conversation after the thread is resolved and hence want to make sure before I close this thread.

    Thanks and regards,
    Vamsi
  • Hello Vivek,

    I was able to program without using L0 & L1 RAMs which are inside the secured section. Also, I've used two shared RAMS (S0 & S1) after configuring C28x as master from M3 to put .pinit, .switch, .ebss, IQmath, ramfuncs & DPLib sections which I don't understand much. Is it okay to use shared rams for program & data sections? I've used them because memory requirements after CSM lockout.

    Thanks,
    Tharindu
  • Hello Vamsi,
    I've checked the current consumption of the control card during flash programming (M3 flash programming). It was 170mA from 5V supply during both program running and flash programming. If there was sudden power bursts during flash programming, I'm pretty sure capacitor bank in 5V supply can give that. Therefore, what may cause permanent lock of the chip?

    Note that XDS100V2 isolated JTAG programmer in the control card is now obsolete and replaced or recommended with XDS110 as I know. Can this happen due to an issue with the XDS100V2 in ControlCards? (I've programmed those Cards for a year without any issue. Lockout occurred recently and happened three times after that in a very close time period)

    Also, can this cause due to wrong boot configuration selection from SW1 of ControlCard? However, according to my knowledge SW1 only controls M3 boot mode and C28x boot mode is selected by M3 code.

    Can we continue this thread until we find the real issue for lockout for sure?
  • Tharindu,

    Only two things can cause zeros to be programmed at password locations:
    1) Power loss during erase or Voltage lines are out of DS spec when Flashing is in progress
    2) Your application has zeros mapped to the password locations.

    XDS100V2 should still be fine - I can check and confirm.

    Below are few questions that I asked you earlier. Could you please answer them?
    A) Can you send the verbose output and DS logs that I requested earlier?
    B) Can you try the flash programming example from ControlSuite and see if that works for C28x or it also locks up your parts? Try few times since you said it happens to lock after few iterations.
    C) Did you check for updates in CCS and install if any?
    D) Can you check whether you are using WIR mode while programming or not?

    Few new questions to debug this further:
    1) What is M3 doing when you notice C28x locking up? Is it connected and halted or is it executing something?
    2) Can you probe the XRSn pin of device to see if there is toggle on this pin?
    3) Can you confirm that you don't have anything mapped to password locations?
    4) Are you monitoring the power supply with an external monitor?

    Thanks and regards,
    Vamsi
  • Vamsi,

    I cannot risk another ControlCard while trying to program flash. Therefore I've done following using locked one. Following are the steps I followed,

    * Note that I've used 'Erase & Program' flash setting in following tests.

    1. Load flash program to M3 and didn't run it.

    2. Connect to C28x in debug view

    3. Go to on chip flash menu and click 'Erase' button

    * I cannot copy the consol logs since CCS report Error 1156 and when respond to that CCS will crash. Therefore, I've attached a screenshot prior to crash and DS log also attached.

    DS_1.zip

    Following are the consol window messages and DS logs when I try to program blink example to C28x flash,

    C28x_blink_flash_program_consol.txt
    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    Cortex_M3_0: GEL Output: Memory Map Initialization Complete
    C28xx_0: GEL Output:
    Memory Map Initialization Complete
    C28xx_0: GEL Output:
    RAM Initialization Complete
    C28xx_0: Trouble Setting Breakpoint with the Action "Remain Halted" at 0x80e3: (Error -1066 @ 0x80E3) Unable to set/clear requested breakpoint. Verify that the breakpoint address is in valid memory. (Emulation package 6.0.407.3)
    C28xx_0: Breakpoint Manager: Retrying with a AET breakpoint
    C28xx_0: Can't Run Target CPU: (Error -1156 @ 0x8050) Device may be operating in low-power mode. Do you want to bring it out of this mode? Choose 'Yes' to force the device to wake up and retry the operation. Choose 'No' to retry the operation without waking the device. (Emulation package 6.0.407.3)
    C28xx_0: Error: (Error -2134 @ 0x0) Unable to control device execution state. Reset the device, and retry the operation. If error persists, confirm configuration, power-cycle the board, and/or try more reliable JTAG settings (e.g. lower TCLK). (Emulation package 6.0.407.3)
    C28xx_0: Trouble Halting Target CPU: (Error -1135 @ 0x8050) The debug probe reported an error. Confirm debug probe configuration and connections, reset the debug probe, and retry the operation. (Emulation package 6.0.407.3)
    C28xx_0: Error: (Error -1135 @ 0x8050) The debug probe reported an error. Confirm debug probe configuration and connections, reset the debug probe, and retry the operation. (Emulation package 6.0.407.3)
    C28xx_0: Unable to determine target status after 20 attempts
    C28xx_0: Failed to remove the debug state from the target before disconnecting. There may still be breakpoint op-codes embedded in program memory. It is recommended that you reset the emulator before you connect and reload your program before you continue debugging
    C28xx_0: Error occurred during flash operation: Cannot disable hardware breakpoint while the target is halted. Halt the target and try again
    C28xx_0: Error occurred during flash operation: Could not write 0x00000064@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not read 0x00004400@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not read 0x00004402@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not read 0x00004406@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not write 0x00000@Program: target is not connected
    C28xx_0: Error occurred during flash operation: Cannot enable while the target is disconnected
    C28xx_0: Error occurred during flash operation: Could not read 0x00000064@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not write 0x00000064@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Failed to run target while trying to execute pwrite_dis.alg
    C28xx_0: Flash operation timed out waiting for the algorithm to complete. Operation cancelled.
    C28xx_0: Error occurred during flash operation: Could not write 0x00000064@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not write 0x00004E26@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not read 0x04E26@Program: target is not connected
    C28xx_0: Flash Programmer: Unable to acquire the clock semaphore. The other core might still be accessing the clock registers. Operation Cancelled.
    C28xx_0: File Loader: Memory write failed: Unknown error
    C28xx_0: GEL: File: E:\TI_HybridInverter_Workspace\TI_Hybrid_Inv_Workspace_2\blinky_dc_c28\Flash\blinky_dc_c28.out: Load failed.
    C28xx_0: Error occurred during flash operation: Could not read register PC: target is not connected
    C28xx_0: Error occurred during flash operation: Could not write 0x00004000@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not write 0x00000@Program: target is not connected
    C28xx_0: Error occurred during flash operation: Cannot enable while the target is disconnected
    C28xx_0: Error occurred during flash operation: Could not read 0x00000064@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not write 0x00000064@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Failed to run target while trying to execute pwrite_en.alg
    C28xx_0: Flash operation timed out waiting for the algorithm to complete. Operation cancelled.
    C28xx_0: Error occurred during flash operation: Could not write 0x00000064@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not write 0x00004E26@Data: target is not connected
    C28xx_0: Error occurred during flash operation: Could not read 0x04E26@Program: target is not connected
    C28xx_0: Flash Programmer: Unable to acquire the clock semaphore. The other core might still be accessing the clock registers. Operation Cancelled.
    C28xx_0: Error occurred during flash operation: Could not write register PC: target is not connected
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    DS_2.zip

    Thanks,

    Tharindu

  • Tharindu,

    Thank you for the DS logs. We will review them. Since they are not taken when devices got locked, they may not have captured critical info - but it might be of some help to see what is going on.

    Could you answer my other questions #B, #C, #D, #1, #2, #3 and #4?
    It helps us to debug this further. Thank you.

    Before it started to fail for you (after 100 successful program operations), are there any other things that changed in your setup?
    5) Did you update CCS in between?
    6) Did you change your PC?
    7) Are you using a custom base board?

    Thanks and regards,
    Vamsi
  • Hello Vamsi,
    For the questions you asked,

    B.) I'm afraid we cannot risk only remaining board to lockout, therefore I'm not going to program that.

    C.) I didn't install any updates until two cards lockout. After that, I've reinstalled CCS, update it and tried to flash program locked cards. Since it was not a success, we have replaced the chips of cards from a soldering company and then one of them again get locked.

    D.) How do I check whether I'm using wait in reset mode while programming? What are the effects of using/ not using WIR mode while programming?

    1.) During all three (3) lockouts M3 was executing a program. I didn't put M3 to debug mode, M3 was programmed to execute after loading from M3 flash. I've just simply upload the C28x program to the flash.

    2.)At what moment do you need to probe XRSn pin?

    3.)Yes, I can confirm as both of us checked the *.map file also. Can you tell me the all possible methods to check that(other than *.map file). Also note that I'm not using FlashAPI that you mentioned and I don't have any knowledge about that also. Also, I've never tampered with CMS and ECSL security locations in 'on-chip-flash' menu also.

    4.) Actually, I've supplied the power from external adjustable power supply and found out current consumption is about 170mA @ 5.0V. However, it may not actually captured sudden power bursts in the display, even though power supply can supply sudden current requirements from o/p capacitor.

    5.) Yes, I've reinstalled CCS after two lockout cards and installed updates as I mentioned in (C.)

    6.) No, I haven't changed my laptop.

    7.) No, we are using control cards bought from TI. We have one release1.0 card and two release2.0 cards. We stopped using release1.0 card due to analog noise issues some time ago. All the locked cards are release2.0 ones.

    Thanks,
    Tharindu
  • Tharindu,

    Thank you for the info.

    #D. Please see 1.4 WIR Mode in TRM (www.ti.com/.../spruh22h.pdf).

    #1. Is M3 executing fine when you see C28x getting locked? Or did M3 get in to any reset?

    #2. You can check on XRSn when you try to program an unlocked device. But you said, you can not try it on the control card anymore.

    #3. Only other possibility is from GUI, which you confirmed that it is not changed from default.

    I will be out of office up to August 21st. My colleagues will help you further on this.

    Thanks and regards,
    Vamsi
  • Tharindu,

    In page1 of the map file, I see below sections mapped to password locations and used. Can you confirm you did not modify the default 0xFFFFFFFF password in F28M35x_CSMPasswords.asm?

    FLASH_EXE_ONLY 0013fff2 00000002 00000002 00000000 RWIX
    ECSL_PWL 0013fff4 00000004 00000004 00000000 RWIX
    CSM_PWL 0013fff8 00000008 00000008 00000000 RWIX

    Thanks and regards,
    Vamsi
  • Vamsi,
    I've not changed any setting related to security settings. Where can I find the F28M35x_CSMPasswords.asm ? I haven't changed it. Also, in the on-chip-flash menu, all security logic fields were 0xFFFF prior to 3rd control card lockout. Is there any way to find which program section uses FLASH_EXE_ONLY, ECSL_PWL, CSM_PWL since *.map file mentioned it as used?

    Thanks
  • Tharindu,

    Sorry for the delay, I was out of office for couple of weeks.

    F28M35x_CSMPasswords.asm file can be found at C:\ti\controlSUITE\device_support\f28m35x\v220\F28M35x_common\source.

    Thanks and regards,
    Vamsi
  • Hello Vamsi,

    It's okay, I was working on some other issues. Also, I've found another thing. The F28M35x_CSMPasswords.asm linked with my project is v110 version and the *.cmd file I used seems to be taken from C:\ti\controlSUITE\development_kits\HV_SOLAR_DC_AC_v1.1\Solar_HV_DCAC_Concerto_SCI_Rev_0\c28\F28M35x_common\cmd .

    Can that be an issue?

    Also, I've currently programming the flash locked F28M35 control card using a modified version of v210 F28M35x_generic_C28_RAM.cmd which is attached herewith. Please note that I've used shared RAMs for some program sections. Can you check and tell me is it okay to use the modified *.cmd currently using?

    F28M35x_generic_C28_RAM.zip

    Thanks

  • Tharindu,

    I feel like you can start another thread since you are using RAM based linker now.

    It helps to support you better and also helps others that navigate through the forum.

    Please start a new thread.

    Thanks and regards,
    Vamsi