FXTH87EH118T1 - NXP SEMICONDUCTORS

FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Rev. 4.0 — 29 November 2018 Reference manual

1 About this document

1.1 Purpose

This reference manual describes the features, architecture, and programming model of

the FXTH87E family of devices.

1.2 Audience

This document is primarily for system architects and software application developers who

are using or considering use of the FXTH87E in a system.

1.3 Related documentation

The FXTH87E device features and operations are described in a variety of reference

manuals, user guides, and application notes. To find the most-current versions of these

documents:

1. Go to the FXTH87E page on NXP.com at: http://www.nxp.com/FXTH87E

2. Select the documentation tab and review the related documentation.

Contact NXP sales representatives for performance attributes such as electrical,

mechanical, and time-based characteristics.

2 Product profile

2.1 General description

The FXTH87E is a small (7 x 7 mm), fully integrated tire pressure monitoring sensor

(TPMS). It also provides low transmitting power consumption, large customer memory

size and dual-axis accelerometer architecture. The FXTH87E TPMS solution integrates

an 8-bit microcontroller (MCU), pressure sensor, XZ-axis or Z-axis accelerometer and RF

transmitter.

2.2 Features and benefits

•Long battery service life

•Provided software for power optimization

•Pin for pin electrical connections compatible with FXTH87-based customer applications

•Included firmware subroutines compatible with FXTH87-based customer software

•Pressure sensor with one of three calibrated pressure ranges

•Temperature sensor

•Optional XZ- or Z-axis accelerometer with adjustable offset option

•Voltage reference measured by ADC10

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

2 / 182

•Six-channel, 10-bit analog-to-digital converter (ADC10) with two external

I/O inputs

•8-bit MCU

–S08 Core with SIM and interrupt

–512 RAM

–16 KB FLASH

–64-byte, low-power, parameter registers

•Dedicated state machines to sequence routine measurement and transmission

processes for reduced power consumption

•Internal 315-/434-MHz RF transmitter

–External crystal oscillator

–PLL-based output with fractional-n divider

–OOK and FSK modulation capability

–Programmable data rate generator

–Manchester, Bi-Phase or NRZ data encoding

–256-bit RF data buffer variable length interrupt

–Direct access to RF transmitter from MCU for unique formats

–Low-power consumption

•Differential input LF detector/decoder on independent signal pins

•Seven multipurpose GPIO pins

–Four pins can be connected to optional internal pullups/pulldowns and STOP4

wakeup interrupt

–Two of seven pins can be connected to a channel on the ADC10

–Two of seven pins can be connected to a channel on the TPM1

•Real-time Interrupt driven by LFO with interrupt intervals of 2, 4, 8, 16, 32, 64, or 128

•Free-running counter, low-power, wakeup timer and periodic reset driven by LFO

•Watchdog timeout with selectable times and clock sources

•Two-channel general purpose timer/PWM module (TPM1)

•Internal oscillators

–MCU bus clock of 0.5, 1, 2, and 4 MHz (1, 2, 4, and 8 MHz HFO)

–Low frequency, low power time clock (LFO) with 1 ms period

–Medium frequency, controller clock (MFO) of 8 μs period

•Low-voltage detection

•Normal temperature restart in hardware (over- or under-temperature detected by

software)

2.3 Configuration options

Table 1. Configuration options

Pressure range Accelerometer

configuration X-axis range Z-axis range Package

Z N/A –285 g to +400 g

–215 g to +305 g

100 to 500 kPa XZ –80 g to +90 g –285 g to +400 g

Z NA –285 g to +400 g

–215 g to +305 g

100 to 900 kPa XZ –80 g to +90 g –285 g to +400 g

98ASA00432D

(7 x 7 x 2.2 mm)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

3 / 182

2.4 Part number definition

a XTH87E b cc d T1

Table 2. Part number breakdown

Code Option Description

P a = P (Prototype)

aF a = F (Qualified)

G b = G (500 kPa range)

bH b = H (900 kPa range)

01 cc = 01 (Z-axis 300 g range)

02 cc = 02 (Z-axis 400 g range)

11 cc = 11 (X-axis 90 g range, Z-axis 300 g range)

12 cc = 12 (X-axis 90 g range, Z-axis 400 g range)

d Single

digit or

alphabetic

character

d = Number or letter marketing suffix (A-Z, a-z or 0-9)

2.5 Part marking definition

a 87E b c d

Table 3. Part marking breakdown

Code Option Description

P a = P (Prototype)

aF a = F (Qualified)

G b = G (500 kPa range)

bH b = H (900 kPa range)

E c = 01 (Z-axis 300 g range)

J c = 02 (Z-axis 400 g range)

H c = 11 (X-axis 90 g range, Z-axis 300 g range)

M c = 12 (X-axis 90 g range, Z-axis 400 g range)

d Single

digit or

alphabetic

character

d = Number or letter marketing suffix (A-Z, a-z or 0-9)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

4 / 182

3 General Information

3.1 Overall block diagram

The block diagram of the FXTH87E is shown in Figure 1. This diagram covers all the

main blocks mentioned above and their main signal interactions. Power management

controls and bus control signals are not shown in this block diagram for clarity.

USER

FLASH

MEMORY

RAM

MEMORY

512

TPM1

TIMER/PWM

2-CHAN

LVD

RTI

TIMER

MCU CORE

S08

AVDD

TEMP TEMP

SENSOR AVDD

AVSS

PRESS

SENSOR

LFA

PTA1

ADC10

10-BIT

6-CHAN

BKGD/

PTA4

LFB

64-BYTE

PARAMETER

MCU

TRANSDUCERS

TEMP

RESTART

OSC

BIT

RATE

GEN

256-BIT

DATA

BUFFER

DATA

ENCODE

XTAL

OSC

VOLT

REG

AMP

VCO/PLL

FRACTL

DIVIDER

PWU

TIMER

MFO

8 s

RESET

VSENS

VTP

BANDGAP

REF

LFO

1 ms

LFI

SMI

I/O

KBI

aaa-027989

KEYBOARD

WAKEUP

MFO

FIRMWARE

MEMORY

PTA0

(

)

F C

LFO

RECVR

(LFR)

RFM

VREG

PTA2

VDDVDD

VSS

RVSS

PTA3

RF LVD

AVDD

RFVDD

VREG

PTB0

PTB1

XZ Z

ACCEL

(OPTION)

ACCEL

(OPTION)

HFO

1, 2, 4,

or 8 MHZ

FREE-RUNNING

COUNTER

Figure 1. FXTH87E overall block diagram

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

5 / 182

3.2 Multi-chip interface

The FXTH87E contains two to three devices using the best process technology for each.

•Microcontroller with accelerometer and pressure sensor interfaces, and RF transmitter

(MCU)

•Optional ranges on pressure transducers

•Optional XZ- or Z-axis acceleration transducer

As shown in Figure 1, the MCU interfaces to the RF transmitter using a standard memory

mapped registers. The transducers connect to the MCU using custom analog interfaces

and inter-chip bonding wires.

3.3 System clock distribution

The various clock sources and their distribution are shown in Figure 2. All clock sources

except the low frequency oscillator, LFO, can be turned off by software control in order to

conserve power.

aaa-027990

BIT

RATE

GEN

RF STATE

MACHINE

DATA

BUFFER

PRESSURE

SENSOR

X-AXIS

SENSOR

Z-AXIS

SENSOR

MFO

OSC

8 s

XTL

OSC

26 MHz

LFO

OSC

1 ms

PERIOD

HFO OSC

1, 2, 4,

and 8 MHz

RTI ADC10

ADC10

PAR

REG RAM FLASH

ACD10

CLOCK

÷2

÷8

fBUS

fMFO

fLFO (1 kHz)

fOSC

SYSTEM

CONTROL

LOGIC

XI XO

TRANSDUCERS

MCU

RTICLKS

WATCH

DOG

COPCLKS

TPMI LFR

PTA3

PTA2

LFRO

OSCILL

CLSA, CLKSB

TCLKDIV

ADCCLK

LFOSEL

DX (500 kHz)

SENSOR MEASUREMENT

INTERFACE

4 kbps

(125 kHz)

CH0 CH1

RANDOM

(0 to 1 MHz)

RANDOM

(0 to 1 MHz)

41.67 kHz

sampling

41.67 kHz

sampling

41.67 kHz

sampling

fXCO

BUSCLKS[1:0]

CPU

BDC

PWU

FRC

VCOPLL

OUT

Figure 2. Clock distribution

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

6 / 182

3.4 Reference documents

The FXTH87E utilizes the standard product MC9S08 CPU core. For further details on the

full capabilities of this core, refer to the HCS08 Family Reference Manual (HCS08RMV1).

4 Pinning information

This section describes the pin layout and general function of each pin.

4.1 Pinning

The pinout for the FXTH87E device QFN package is shown in Figure 3 for the orientation

of the pressure port up. The orientation of the internal Z-axis accelerometer is shown in

Figure 4.

PTA3

LFA

LFB

BKGD/PTA4

PTB1

PTA2

PTA1

RESET

VDD

VDDA

VSSA

VREG

ID feature

on top lid

PTA0

VSS

RFVSS

Transparent top view

BKGD/PTA4

+X- X

aaa-027991

X-axis

orientation

- Y

Y-axis

orientation

N/C = No Connect: Do not connect PCB pads to signal traces, power/ground or multi-layer via.

Figure 3. FXTH87E QFN package pinout

aaa-027993

Z-axis

orientation

- Z

Side view

Pressure port

Positive acceleration moves mass

in +Z direction (value increases)

Figure 4. FXTH87E QFN optional Z-axis accelerometer orientation

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

7 / 182

4.2 Pin description

Table 4. Pin description

Symbol Pin Description

PTB1 1 General purpose I/O

PTA2 2 General purpose I/O

PTA1 3 General purpose I/O

PTA0 4 General purpose I/O

RESET 5 External reset

VSS 6 Digital circuit ground

VDD 7 Digital circuit supply voltage

VDDA 8 Analog circuit supply voltage

VSSA 9 Analog circuit ground

RFVSS 10 RF output amplifier ground

RF 11 RF energy data

VREG 12 External stabilization for analog circuits internal regulator

X1 13 External crystal

X0 14 External crystal

BKGD / PTA4 15 BACKGROUND DEBUG mode enable

LFB 16 LF receiver differential input channel B

LFA 17 LF receiver differential input channel A

PTA3 18 General purpose I/O

N/C 19, 20, 21,

22, 23

No Connect: Do not connect PCB pads to signal traces,

power/ground or multi-layer via.

PTB0 24 General purpose I/O

4.3 Recommended application

Example of a simple OOK/FSK tire pressure monitors using the internal PLL-based

RF output stage is shown in Figure 5. Any of the PTA[3:0] and PTB[1:0] pins can also

be used as general purpose I/O pins. Refer to Section 7 "Reset, interrupts and system

configuration" for details regarding pin multiplexing priorities. Any of the PTA[3:0] pins

that are not used in the application should be handled as described in Section 8.1

"Unused pin configuration".

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

8 / 182

FXTH8

VDD

VSS

coil

BKGD

/PT

LFB

RESE

genera

purpose I/O

R2 and

recom

mended for

highes

t EMC resis

tance

1 a

g n

d f

3 m

1 a

g n

e C

n h

(

)

d b

e m

o r

d e

g t

o a

s c

d f

d n

e u

d a

e t

e p

d b

e p

d b

e d

d n

aaa-027994

470 nF

0.1 F0.1 F

3.0 V

battery

C4*

antenna

Figure 5. FXTH87E example application

4.4 Signal properties

The following sections describe the general function of each pin.

4.4.1 VDD and VSS pins

The digital circuits operate from a single power supply connected to the FXTH87E

through the VDD and VSS pins. VDD is the positive supply and VSS is the ground. The

conductors to the power supply should be connected to the VDD and VSS pins and locally

decoupled as shown in Figure 6.

Care should be taken to reduce measurement signal noise by separating the VDD, VSS,

AVDD, AVSS and RVSS pins using a "star" connection such that each metal trace does not

share any load currents with other external devices as shown in Figure 6.

4.4.2 AVDD and AVSS pins

The analog circuits operate from a single power supply connected to the FXTH87E

through the AVDD and AVSS pins. AVDD is the positive supply and AVSS is the ground.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

9 / 182

The conductors to the power supply should be connected to the AVDD and AVSS pins and

locally decoupled as shown in Figure 6.

Care should be taken to reduce measurement signal noise by separating the VDD, VSS,

AVDD, AVSS and RVSS pins using a "star" connection such that each metal trace does not

share any load currents with other external devices as shown in Figure 6.

FXTH87E

Bypass capacitors

closely coupled to

the package pins

FXTH8

7E and oth

d c

star co

nnected to b

The decoupling de

drawn here as 0.1

may be any type of

e c

(

)

sufficient to block o

external radiated si

the power input pr

;

application tuning

IDD

ILOAD

to other loads

Battery

aaa-027995

0.1

Figure 6. Recommended power supply connections

4.4.3 VREG pin

The internal regulator for the analog circuits requires an external stabilization capacitor to

AVSS.

4.4.4 RVSS pin

Power in the RF output amplifier is returned to the supply through the RVSS pin. This

conductor should be connected to the power supply as shown in Figure 6 using a "star"

connection such that each metal trace does not share any load currents with other supply

pins.

4.4.5 RF pin

The RF pin is the RF energy data supplied by the FXTH87E to an external antenna.

4.4.6 XO, XI pins

The XO and XI pins are for an external crystal to be used by the internal PLL for creating

the carrier frequencies and data rates for the RF pin.

4.4.7 LF[A:B] pins

The LF[A:B] pins can be used by the LF receiver (LFR) as one differential input channel

for sensing low level signals from an external low frequency (LF) coil. The external LF

coil should be connected between the LFA and the LFB pins.

Signaling into the LFR pins can place the FXTH87E into various diagnostic or operational

modes. The LFR is comprised of the detector and the decoder.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

10 / 182

Each LF[A:B] pin will always have an impedance of approximately 500 kΩ to VSS due to

the LFR input circuitry. The LFA/LFB pins are used by the LFR when the LFEN control bit

is set and are not functional when the LFEN control bit is clear.

4.4.8 PTA[1:0] pins

The PTA[1:0] pins are general purpose I/O pins. These two pins can be configured

as normal bidirectional I/O pins with programmable pullup or pulldown devices and/or

wakeup interrupt capability; or one or both can be connected to the two input channels

of the A/D converter module. The pulldown devices can only be activated if the wakeup

interrupt capability is enabled. User software must configure the general purpose I/O

pins so that they do not result in "floating" inputs as described in Section 8.1 "Unused pin

configuration" PTA[1:02] map to keyboard Interrupt function bits [1:0].

4.4.9 PTA[3:2] pins

The PTA[3:2] pins are general purpose I/O pin. These two pins can be configured as

normal bidirectional I/O pin with programmable pullup or pulldown devices and/or wakeup

interrupt capability; or one or both can be connected to the two input channels of the

Timer Pulse Width (TPM1) module. The pulldown devices can only be activated if the

wakeup interrupt capability is enabled. User software must configure the general purpose

I/O pins so that they do not result in "floating" inputs as described in Section 8.1 "Unused

pin configuration". PTA[3:2] map to keyboard Interrupt function bits [3:2].

4.4.10 BKGD/PTA4 pin

The BKGD/PTA4 pin is used to place the FXTH87E in the BACKGROUND DEBUG

mode (BDM) to evaluate MCU code and to also transfer data to/from the internal

memories. If the BKGD/PTA4 pin is held low when the FXTH87E comes out of a power-

on reset the device will go into the ACTIVE BACKGROUND DEBUG mode (BDM).

The BKGD/PTA4 pin has an internal pullup device and can connected to VDD in the

application unless there is a need to enter BDM operation after the device as been

soldered into the PWB. If in-circuit BDM is desired the BKGD/PTA4 pin can be left

unconnected, but should be connected to VDD through a low impedance resistor

(< 10 kΩ) which can be over-driven by an external signal. This low impedance resistor

reduces the possibility of getting into the debug mode in the application due to an EMC

event. When the BDM is disabled, PTA4 can be used as an output-only GPIO.

4.4.11 RESET pin

The RESET pin is used for test and establishing the BDM condition and providing the

programming voltage source to the internal FLASH memory. This pin can also be used to

direct to the MCU to the reset vector as described in Section 7.2 "MCU reset".

The RESET pin has an internal pullup device and can connected to VDD in the application

unless there is a need to enter BDM operation after the device as been soldered to the

PWB. If in-circuit BDM is desired the RESET pin can be left unconnected; but should be

connected to VDD through a low impedance resistor (< 10 kΩ) which can be over-driven

by an external signal. This low impedance resistor reduces the possibility of getting into

the debug mode in the application due to an EMC event.

Activation of the external reset function occurs when the voltage on the RESET pin goes

below 0.3 x VDD for at least 100 ns before rising above 0.7 x VDD as shown in Figure 7.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

11 / 182

0.7 VDD

0.3 VDD

> 100 nsec

Reset

initiated

RESET

aaa-027996

Figure 7. RESET pin timing

4.4.12 PTB[1:0] pins

The PTB[1:0] pins are general purpose I/O pins. The PTB[1:0] pin functions become

high-impedance when the LF receiver has been enabled. These two pins can be

configured as nominal bidirectional I/O pins with programmable pullup. User software

must configure the general purpose I/O pins so that they do not result in "floating" inputs

as described in Section 8.1 "Unused pin configuration". Refer to Section 7 "Reset,

interrupts and system configuration" for details regarding pin multiplexing priorities.

5 Modes of operation

The operating modes of the FXTH87E are described in this section. Entry into each

mode, exit from each mode, and functionality while in each of the modes are described.

5.1 Features

•ACTIVE BACKGROUND DEBUG mode for code development

•STOP modes:

–System clocks stopped

–STOP1: Power down of most internal circuits, including RAM, for maximum power

savings; voltage regulator in standby

–STOP4: All internal circuits powered and full voltage regulation maintained for fastest

recovery

5.2 RUN mode

This is the normal operating mode for the FXTH87E. This mode is selected when the

BKGD/PTA4 pin is high at the rising edge of reset. In this mode, the CPU executes code

from internal memory following a reset with execution beginning at address specified by

the reset pseudo-vector ($DFFE and $DFFF).

5.3 WAIT mode

The WAIT mode is also present like other members of the NXP S08 family members; but

is not normally used by the FXTH87E firmware or typical TPMS applications.

5.4 ACTIVE BACKGROUND mode

The ACTIVE BACKGROUND mode functions are managed through the BACKGROUND

DEBUG controller (BDC) in the HCS08 core. The BDC provides the means for analyzing

MCU operation during software development.

ACTIVE BACKGROUND mode is entered in any of four ways:

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

12 / 182

•When the BKGD/PTA4 pin is low at the rising edge of a power up reset

•When a BACKGROUND command is received through the BKGD/PTA4 pin

•When a BGND instruction is executed by the CPU

•When encountering a BDC breakpoint

Once in ACTIVE BACKGROUND mode, the CPU is held in a suspended state waiting

for serial BACKGROUND commands rather than executing instructions from the user’s

application program. Background commands are of two types:

•Non-intrusive commands, defined as commands that can be issued while the user

program is running. Non-intrusive commands can be issued through the BKGD/PTA4

pin while the MCU is in RUN mode; non-intrusive commands can also be executed

when the MCU is in the ACTIVE BACKGROUND mode. Non-intrusive commands

include:

–Memory access commands

–Memory-access-with-status commands

–BDC register access commands

–The BACKGROUND command

•ACTIVE BACKGROUND commands, which can only be executed while the MCU

is in ACTIVE BACKGROUND mode. ACTIVE BACKGROUND commands include

commands to:

–Read or write CPU registers

–Trace one user program instruction at a time

–Leave ACTIVE BACKGROUND mode to return to the user’s application program

(GO)

The ACTIVE BACKGROUND mode is used to program a boot loader or user application

program into the FLASH program memory before the MCU is operated in RUN mode

for the first time. When the FXTH87E is shipped from the NXP factory, the FLASH

program memory is erased by default (unless specifically requested otherwise) so there

is no program that could be executed in RUN mode until the FLASH memory is initially

programmed.

The ACTIVE BACKGROUND mode can also be used to erase and reprogram the

FLASH memory after it has been previously programmed.

5.5 STOP Modes

One of two stop modes are entered upon execution of a STOP instruction when the

STOPE bit in the system option register is set. In all STOP modes, all internal clocks

are halted except for the low frequency 1 kHz oscillator (LFO) which runs continuously

whenever power is applied to the VDD and VSS pins. If the STOPE bit is not set when

the CPU executes a STOP instruction, the MCU will not enter any of the STOP modes

and an illegal opcode reset is forced. The STOP modes are selected by setting the

appropriate bits in SPMSC2. Table 5 summarizes the behavior of the MCU in each of the

STOP1 and STOP4 modes.

5.5.1 STOP1 Mode

The STOP1 mode provides the lowest possible standby power consumption by causing

the internal circuitry of the MCU to be powered down.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

13 / 182

When the MCU is in STOP1 mode, all internal circuits that are powered from the voltage

regulator are turned off. The voltage regulator is in a low-power standby state. STOP1 is

exited by asserting either a reset or an interrupt function to the MCU.

Entering STOP1 mode automatically asserts LVD. STOP1 cannot be exited until the VDD

is greater than VLVDH or VLV/DL rising (VDD must rise above the LVI re-arm voltage).

Upon wakeup from STOP1 mode, the MCU will start up as from a power-on reset (POR)

by taking the reset vector.

Note: If there are any pending interrupts that have yet to be serviced then the device will

not go into the STOP1 mode. Be certain that all interrupt flags have been cleared before

entry to STOP1 mode.

5.5.2 STOP4 LVD enabled in STOP mode

The LVD system is capable of generating either an interrupt or a reset when the supply

voltage drops below the LVD voltage. If the LVD is enabled by setting the LVDE and the

LVDSE bits in SPMSC1 when the CPU executes a STOP instruction, then the voltage

regulator remains active during STOP mode. If the user attempts to enter the STOP1

with the LVD enabled in STOP (LVDSE = 1), the MCU will enter STOP4 instead.

Table 5. STOP mode behavior

Mode STOP1 STOP4

LFO Oscillator, PWU Always On and Clocking

Free-Running Counter (FRC) Optionally On and Clocking

Real-Time Interrupt (RTI)[1] Always On if using LFO as Clock

MFO Oscillator [2] Optionally On Optionally On

HFO Oscillator Off Off

CPU Off Standby

RAM Off Standby

Parameter Registers On On

FLASH Off Standby

TPM1 2-Chan Timer/PWM Off Off

Digital I/O Disabled Standby

Sensor Measurement Interface (SMI) Off Optionally On

Pressure P-cell Off Optionally On

Optional Acceleration g-cell Off Optionally On

Temperature Sensor (in ADC10) Off Optionally On [3]

Normal Temperature Restart Optionally On Optionally On

Voltage Reference (in ADC10) Off Optionally On(3)

LFR Detector [4] Periodically On Periodically On

LFR Decoder Optionally On Optionally On

RF Controller, Data Buffer, Encoder Optionally On Optionally On

RF Transmitter [5] Optionally On Optionally On

ADC10 Off Optionally On(3)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

14 / 182

Mode STOP1 STOP4

Regulator Off On

I/O Pins Hi-Z States Held

Wakeup Methods Interrupts, resets Interrupts, resets

Computer Operating Properly (COP) watchdog Off Off

[1] The interrupt from RTI operates from all power modes, however the RTIF flag will not be set and the interrupt service

routine will not execute if the RTI is configured and STOP1 mode entered. RTIF flag and the interrupt service routine will

execute if in Run mode or if STOP4 is entered.

[2] MFO oscillator started if the LFR detectors are periodically sampled, the LFR detectors detect an input signal; a pressure

or acceleration reading is in progress or the RF state machine is sending data.

[3] Requires internal ADC10 clock to be enabled.

[4] Period of sampling set by MCU.

[5] RF data buffer may be set up to run while the CPU is in the STOP modes.

Specific to the tire pressure monitoring application the parameter registers and the LFO

with wakeup timer are powered up at all times whenever voltage is applied to the supply

pins. The LFR detector and MFO may be periodically powered up by the LFR decoder.

5.5.3 Active BDM enabled in STOP mode

Entry into the ACTIVE BACKGROUND DEBUG mode from RUN mode is enabled if

the ENBDM bit in BDCSCR is set. The BDCSCR register is not memory mapped so

it can only be accessed through the BDM interface by use of the BDM commands

READ_STATUS and WRITE_CONTROL. If ENBDM is set when the CPU executes a

STOP instruction, the system clocks to the BACKGROUND DEBUG logic remain active

when the MCU enters STOP mode so BACKGROUND DEBUG communication is still

possible. In addition, the voltage regulator does not enter its low-power standby state but

maintains full internal regulation. If the user attempts to enter the STOP1 with ENDBM

set, the MCU will instead enter this mode which is STOP4 with system clocks running.

Most BACKGROUND commands are not available in STOP mode. The memory-access-

with-status commands do not allow memory access, but they report an error indicating

that the MCU is in STOP mode. The BACKGROUND command can be used to wake the

MCU from stop and enter ACTIVE BACKGROUND mode if the ENDBM bit is set. Once

in BACKGROUND DEBUG mode, all BACKGROUND commands are available.

5.5.4 MCU on-chip peripheral modules in STOP modes

When the MCU enters any STOP mode, system clocks to the internal peripheral modules

except the wakeup timer and LFR detectors/decoder are stopped. Even in the exception

case (ENDBM = 1), where clocks are kept alive to the BACKGROUND debug logic,

clocks to the peripheral systems are halted to reduce power consumption.

5.5.4.1 I/O pins

If the MCU is configured to go into STOP1 mode, the I/O pins are forced to their default

reset state (Hi-Z) upon entry into stop. This means that the I/O input and output buffers

are turned off and the pullup is disconnected.

5.5.4.2 Memory

All module interface registers will be reset upon wakeup from STOP1 and the contents of

RAM are not preserved. The MCU must be initialized as upon reset. The contents of the

FLASH memory are non-volatile and are preserved in any of the STOP modes.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

15 / 182

5.5.4.3 Parameter registers

The 64 bytes of parameter registers are kept active in all modes of operation as long as

power is applied to the supply pins. The contents of the parameter registers behave like

RAM and are unaffected by any reset.

5.5.4.4 LFO

The LFO remains active regardless of any mode of operation.

5.5.4.5 FRC

The Free-Running Counter can be enabled or halted. Once enabled and not halted, the

FRC remains active regardless of any mode of operation.

5.5.4.6 MFO

The medium frequency oscillator (MFO) will remain powered up when the MCU enters

the STOP mode only when the SMI has been initiated to make a pressure or acceleration

measurement; or when the RF transmitter’s state machine is processing data.

5.5.4.7 HFO

The HFO is halted in all STOP modes.

5.5.4.8 PWU

The PWU remains active regardless of any mode of operation.

5.5.4.9 ADC10

The internal asynchronous ADC10 clock is always used as the conversion clock. The

ADC10 can continue operation during STOP4 mode. Conversions can be initiated while

the MCU is the STOP4 mode. All ADC10 module registers contain their reset values

following exit from STOP1 mode Section 14 "LF Receiver".

5.5.4.10 LFR

When the LFR is enabled and the MCU enters STOP mode, the detectors in the LFR will

remain powered up depending on the states of the bits selecting the periodic sampling.

Refer to Section 14 "LF Receiver" for more details.

5.5.4.11 Band gap reference

The band gap reference should be enabled whenever the sensor measurement interface

requires sensor or voltage measurements.

5.5.4.12 TPM1

When the MCU enters STOP mode, the clock to the TPM1 module stops and the module

halts operation. If the MCU is configured to go into STOP1 mode, the TPM1 module will

be reset upon wakeup from STOP and must be re-initialized.

5.5.4.13 Voltage regulator

The voltage regulator enters a low-power standby state when the MCU enters any of the

STOP modes except STOP4 (LVDSE = 1 or ENBDM = 1).

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

16 / 182

5.5.4.14 Temperature sensor

The temperature sensor is powered up on command from the MCU.

5.5.4.15 Temperature restart

When the MCU enters a STOP mode, the temperature restart will remain powered up if

the TRE bit is set. If the temperature restart level is reached, the MCU will restart from

the reset vector.

5.5.5 RFM module in STOP modes

The RFM’s external crystal oscillator (XCO), bit rate generator, PLL, VCO, RF data

buffer, data encoder, and RF output stage will remain powered up in STOP modes during

a transmission, or if the SEND bit has been set and DIRECT mode has been enabled.

5.5.5.1 RF output

When the RFM finishes a transmission sequence the external crystal oscillator (XCO), bit

rate generator, PLL, VCO, RF data buffer, data encoder, and RF output stage will remain

powered up if the SEND bit is set.

5.5.6 P-cell in STOP modes

The P-cell is powered up only during a measurement if scheduled by the sensor

measurement interface. Otherwise it is powered down.

5.5.7 Optional g-cell in STOP modes

The g-cell is powered up only during a measurement if scheduled by the sensor

measurement interface. Otherwise it is powered down.

6 Memory

The overall memory map of the FXTH87E resides on the MCU.

6.1 MCU memory map

As shown in Figure 8, MCU on-chip memory in the FXTH87E consists of parameter

registers, RAM, FLASH program memory for nonvolatile data storage, and I/O and

control/status registers. The registers are divided into four groups:

•Direct-page registers ($0000 through $004F)

•Parameter registers ($0050 through $008F)

•RAM ($0090 through $028F)

•High-page registers ($1800 through $182B)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

17 / 182

$0000

$004F

$0050

$008F

$1800

$17FF

$182B

$182C

$FDFF

$FE00

$FFAF

$FFB0

$FFFF

$0090

$C000

$BFFF

Direct page registers

RAM 512 bytes

Unimplemented

5488 bytes

High page registers

41964 bytes

$028F

$0290

Parameter registers

$DFE0

$DFDF

User flash

8160 bytes

User vectors

Firmware flash

7008 bytes

$E000

$DFFF

$E0A0

$E09F

Firmware jump table

$FBFF

$FC00

Protected coefficients

512 bytes

Firmware flash

432 bytes

Flash control and HW vectors

80 bytes

aaa-027997

Figure 8. FXTH87E MCU memory map

The total programmable FLASH memory map is 16K, but the upper 8K is used for

firmware and test software. Upon power up the firmware will initialize the device and

redirect all vectors to the user area from $DFE0 through $DFFF. Any calls to the

firmware subroutines are accessed through a jump table starting at location $E000 (see

Section 16 "Firmware").

6.2 Reset and interrupt vectors

Table 6 shows address assignments for jump table to the reset and interrupt vectors. The

vector names shown in this table are the labels used in the equate file provided by NXP

in the CodeWarrior project file.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

18 / 182

Table 6. Vector summary

User Vector Addr Vector Name Module Source

$DFE0:DFE1 Vkbi KBI

$DFE2:DFE3 reserved

$DFE4:DFE5 reserved

$DFE6:DFE7 Vrti Sys Ctrl - RTI

$DFE8:DFE9 Vlfrcvr LFR

$DFEA:DFEB Vadc1 ADC10

$DFEC:DFED Vrf RFM

$DFEE:DFEF Vsm SMI

$DFF0:DFF1 Vtpm1ovf TPM1

$DFF2:DFF3 Vtpm1ch1 TPM1

$DFF4:DFF5 Vtpm1ch0 TPM1

$DFF6:DFF7 Vwuktmr PWU

$DFF8:DFF9 Vlvd Sys Ctrl - LVD

$DFFA:DFFB reserved

$DFFC:DFFD Vswi SWI opcode

$DFFE:DFFF Vreset Sys Ctrl - POR, PRF, COP, LVD

Temp Restart, Illegal opcode or address

6.3 MCU register addresses and bit assignments

The registers in the FXTH87E are divided into these four groups:

•Direct-page registers are located in the first 80 locations in the memory map; these are

accessible with efficient direct addressing mode instructions.

•The parameter registers begin at address $0050; these are also accessible with

efficient direct addressing mode instructions.

•High-page registers are used less often, so they are located above $1800 in the

memory map. This leaves more room in the direct page for more frequently used

registers and variables.

•The nonvolatile register area consists of a block of 16 locations in FLASH memory at

$FFB0:FFBF. Nonvolatile register locations include:

–Three values that are loaded into working registers at reset

–An 8-byte back door comparison key that optionally allows the user to gain controlled

access to secure memory.

Because the nonvolatile register locations are FLASH memory, they must be erased and

programmed like other FLASH memory locations.

Direct page registers are located within the first 256 locations in the memory map, so

they are accessible with efficient direct addressing mode instructions, which requires

only the lower byte of the address. Bit manipulation instructions can be used to access

any bit in any direct-page register. Table 7 is a summary of all user-accessible direct-

page registers and control bits. Those related to the TPMS application and modules are

described in detail in this specification.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

19 / 182

Table 7. MCU direct page register summary

Cells that are not associated with named bits are shaded

•Shaded cell with a 0 indicate an unused bit that always reads as 0

•Shaded cells not containing a value indicate unused or reserved bit locations that could read as 1s or 0s

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$0000 PTAD PTAD[4:0]

$0001 PTAPE PTAPE[3:0]

$0002 Reserved

$0003 PTADD PTADD[3:0]

$0004 PTBD PTBD[1:0]

$0005 PTBPE PTBPE[1:0]

$0006 Reserved

$0007 PTBDD PTBDD[1:0]

$0008 Reserved

$0009 Reserved

$000A Reserved

$000B Reserved

$000C KBISC 0 0 0 0 KBF KBACK KBIE KBIMOD

$000D KBIPE KBIPE[3:0]

$000E KBIES KBEDG[3:0]

$000F Reserved

$0010 TPM1SC TOF TOIE CPWMS CLKSB CLKSA PS2 PS1 PS0

$0011 TPM1CNTH Bit [15:8]

$0012 TPM1CNTL Bit [7:0]

$0013 TPM1MODH Bit [15:8]

$0014 TPM1MODL Bit [7:0]

$0015 TPM1C0SC CH0F CH0IE MS0B MS0A ELS0B ELS0A 0 0

$0016 TPM1C0VH Bit [15:8]

$0017 TPM1C0VL Bit [7:0]

$0018 TPM1C1SC CH1F CH1IE MS1B MS1A ELS1B ELS1A 0 0

$0019 TPM1C1VH Bit [15:8]

$001A TPM1C1VL Bit [7:0]

$001B Reserved

$001C PWUDIV WDIV[5:0]

$001D PWUCS0 WUF WUFAK WUT[5:0]

$001E PWUCS1 PRF PRFAK PRST[5:0]

$001F PWUS PSEL 0 CSTAT[5:0]

$0020-27 LFR Registers LFR Registers, see Table 8 and Table 9

$0028 ADSC1 COCO AIEN ADCO ADCH[4:0]

$0029 ADSC2 ADACT ADTRG ACFE ADCFGT 0 0 0 0

$002A ADRH 0 0 0 0 ADR[11:8]

$002B ADRL ADR[7:0]

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

20 / 182

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$002C ADCVH 0 0 0 0 ADCV[11:8]

$002D ADCVL ADCV[7:0]

$002E ADCFG ADLPC ADIV[1:0] ADLSMP MODE[1:0] ADICLK[1:0]

$002F ADPCTL1 ADPC[7:0]

$0030-4F RFM Registers RFM Registers, see Table 10 and Table 11

$0050-8F Parameter Reg PARAM[63:0]

Note: Shaded bits are recommended to only be controlled by firmware or factory test.

= reserved

Table 8. LFR register summary - LPAGE = 0

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$0020 LFCTL1 LFEN SRES CARMOD LPAGE IDSEL[1:0] SENS[1:0]

$0021 LFCTL2 LFSTM[3:0] LFONTM[3:0]

$0022 LFCTL3 LFDO TOGMOD SYNC[1:0] LFCDTM[3:0]

$0023 LFCTL4 LFDRIE LFERIE LFCDIE LFIDIE DECEN VALEN TIMOUT[1:0]

$0024 LFS LFDRF LFERF LFCDF LFIDF LFOVF LFEOMF LPSM LFIAK

$0025 LFDATA RXDATA[7:0]

$0026 LFIDL ID[7:0]

$0027 LFIDH ID[15:8]

Table 9. LFR register summary - LPAGE = 1

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$0020 LFCTL1 LFEN SRES CARMOD LPAGE IDSEL[1:0] SENS[1:0]

$0021 LFCTRLE TRIMEE AZSC[2:0]

$0022 LFCTRLD AVFOF[1:0] DEQS AZDC[1:0] ONMODE CHK125[1:0]

$0023 LFCTRLC AMPGAIN[1:0] FINSEL[1:0] AZEN LOWQ[1:0] DEQEN

$0024 LFCTRLB HYST[1:0] LFFAF LFCAF LFPOL LFCPTAZ[2:0]

$0025 LFCTRLA TESTSEL[3:0] LFCC[3:0]

$0026 Reserved

$0027 Reserved

Note: Shaded bits are recommended to only be controlled by firmware or factory test.

Table 10. RFM register summary - RPAGE = 0

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$0030 RFCR0 BPS[7:0]

$0031 RFCR1 FRM[7:0]

$0032 RFCR2 SEND RPAGE EOM PWR[4:0]

$0033 RFCR3 DATA IFPD ISPC IFID FNUM[3:0]

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

21 / 182

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$0034 RFCR4 RFBT[7:0]

$0035 RFCR5 BOOST LFSR[6:0]

$0036 RFCR6 VCO_GAIN[1:0] RFFT[5:0]

$0037 RFCR7 RFIF RFEF RFVF RFIAK RFIEN RFLVDEN RCTS RFMRST

$0038 PLLCR0 AFREQ[12:5]

$0039 PLLCR1 AFREQ[4:0] POL CODE[1:0]

$003A PLLCR2 BFREQ[12:5]

$003B PLLCR3 BFREQ[4:0] CF MOD CKREF

$003C RFD0 RFD[7:0]

$003D RFD1 RFD[15:8]

$003E RFD2 RFD[23:16]

$003F RFD3 RFD[31:24]

$0040 RFD4 RFD[39:32]

$0041 RFD5 RFD[47:40]

$0042 RFD6 RFD[55:48]

$0043 RFD7 RFD[63:56]

$0044 RFD8 RFD[71:64]]

$0045 RFD9 RFD[79:72]

$0046 RFD10 RFD[87:80]

$0047 RFD11 RFD[95:88]

$0048 RFD12 RFD[103:96]

$0049 RFD13 RFD[111:104]

$004A RFD14 RFD[119:112]

$004B RFD15 RFD[127:120]

$004C Reserved

$004D Reserved

$004E Reserved

$004F Reserved

Note: Shaded bits are recommended to only be controlled by firmware or factory test.

Table 11. RFM register summary - RPAGE = 1

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$0030 RFCR0 BPS[7:0]

$0031 RFCR1 FRM[7:0]

$0032 RFCR2 SEND RPAGE EOM PWR[4:0]

$0033 RFCR3 DATA IFPD ISPC IFID FNUM[3:0]

$0034 RFCR4 RFBT[7:0]

$0035 RFCR5 BOOST LFSR[6:0]

$0036 RFCR6 VCO_GAIN[1:0] RFFT[5:0]

$0037 RFCR7 RFIF RFEF RFVF RFIAK RFIEN RFLVDEN RCTS RFMRST

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

22 / 182

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$0038 EPR —/VCD3 PLL_LPF_[2:0]/VCD[2:0] PA_

SLOPE

VCD_EN

$0039 Reserved

$003A Reserved

$003B Reserved

$003C RFD0 RFD[135:128]

$003D RFD1 RFD[143:136]

$003E RFD2 RFD[151:144]

$003F RFD3 RFD[159:152]

$0040 RFD4 RFD[167:160]

$0041 RFD5 RFD[175:168]

$0042 RFD6 RFD[183:176]

$0043 RFD7 RFD[191:184]

$0044 RFD8 RFD[199:192]

$0045 RFD9 RFD[207:200]

$0046 RFD10 RFD[215:208]

$0047 RFD11 RFD[223:216]

$0048 RFD12 RFD[231:224]

$0049 RFD13 RFD[239:232]

$004A RFD14 RFD[247:240]

$004B RFD15 RFD[255:248]

$004C Reserved

$004D Reserved

$004E Reserved

$004F Reserved

Note: Shaded bits are recommended to only be controlled by firmware or factory test.

6.4 High address registers

High-page registers are used much less often, so they are located above $1800 in

the memory map. This leaves more room in the direct page for more frequently used

registers and variables. The registers control system level features as given in Table 12.

Table 12. MCU high address register summary

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$1800 SRS POR PIN COP ILOP ILAD PWU LVD 0

$1801 SBDFR 0 0 0 0 0 0 0 BDFR

$1802 SIMOPT1 COPE COPCLKS STOPE RFEN TRE TRH BKGDPE

$1803 SIMOPT2 COPT[2:0] LFOSEL TCLKDIV BUSCLKS[1:0]

$1804 Reserved

$1805 Reserved

$1806 SDIDH REV[3:0] ID[11:8]

$1807 SDIDL ID[7:0]

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

23 / 182

Address Register Name Bit 7 6 5 4 3 2 1 Bit 0

$1808 SRTISC RTIF RTIACK RTICLKS RTIE 0 RTIS{2:0]

$1809 SPMSC1 LVDF LVDACK LVDIE LVDRE LVDSE LVDE 0 BGBE

$180A SPMSC2 0 0 0 PDF 0 PPDACK PDC 0

$180B FRC FRCLR FRCEN FPAGE

$180C SPMSC3 LVWF LVWACK LVDV LVWV 0 0 0 0

$180D SIMSES KBF IRQF TRF PWUF LFF RFF

$180E SOTRM SOTRM[7:0]

$180F SIMTST TRH[2:0] TRO

$1810-1F Reserved

$1820 FCDIV DIVLD PRDIV8 DIV[5:0]

$1821 FOPT KEYEN FNORED 0 0 0 0 SEC0[1:0]}

$1822 Reserved

$1823 FCNFG 0 0 KEYACC 0 0 0 0 0

$1824 FPROT FPS[7:1] FPDIS

$1825 FSTAT FCBEF FCCF FPVIOL FACCERR 0 FBLANK 0 0

$1826 FCMD FERASE FCMD[6:0]

$1827-3F Reserved

Note: Reserved bits shown as 0 must always be written to 0.

Note: Reserved bits shown as 1 must always be written to 1.

Note: Shaded bits are recommended to only be controlled by firmware or factory test.

6.5 MCU parameter registers

The 64 bytes of parameter registers are located at addresses $0050 through $008F.

These registers are powered up at all times and may be used to store temporary or

history data during the times that the MCU is in any of the STOP modes. The parameter

6.6 MCU RAM

The FXTH87E includes static RAM. The locations in RAM below $0100 can be accessed

using the more efficient direct addressing mode, and any single bit in this area can be

accessed with the bit-manipulation instructions (BCLR, BSET, BRCLR, and BRSET).

Locating the most frequently accessed program variables in this area of RAM is

preferred.

The RAM retains data when the MCU is in low-power WAIT, or STOP4 modes. At power-

on or after wakeup from STOP1, the contents of RAM are not initialized. RAM data

is unaffected by any reset provided that the supply voltage does not drop below the

minimum value for RAM retention (VRAM).

When security is enabled, the RAM is considered a secure memory resource and is

not accessible through BDM or through code executing from non-secure memory. See

Section 6.8 "Security" for a detailed description of the security feature.

None of the RAM locations are used directly by the firmware provided by NXP. The

firmware routines utilize RAM only through stack operations; and the user needs to be

aware of stack depth required by each routine as described in the CodeWarrior project

files supplied by NXP.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

24 / 182

6.7 FLASH

The FLASH memory is intended primarily for program storage. The operating program

can be loaded into the FLASH memory after final assembly of the application product

using the single-wire BACKGROUND DEBUG interface. Because no special voltages

are needed for FLASH erase and programming operations, in-application programming

is also possible through other software-controlled communication paths. For a more

detailed discussion of in-circuit and in-application programming, refer to the HCS08

Family Reference Manual, Volume I, NXP document number HCS08RMV1/D.

6.7.1 Features

Features of the FLASH memory include:

•User Program FLASH Size — 8192 bytes (16 pages of 512 bytes each)

•Single power supply program and erase

•Command interface for fast program and erase operation

•Up to 100,000 program/erase cycles at typical voltage and temperature

•Flexible FLASH protection

•Security feature for FLASH and RAM

•Auto power-down for low-frequency read accesses

6.7.2 Program and erase times

Before any program or erase command can be accepted, the FLASH clock divider

frequency (fFCLK) between 150 kHz and 200 kHz. This register can be written only once,

so normally this write is performed during reset initialization. FCDIV cannot be written if

the access error flag, FACCERR in FSTAT, is set. The user must ensure that FACCERR

is not set before writing to the FCDIV register. One period of the resulting clock (1/fFCLK)

is used by the command processor to time program and erase pulses. An integer number

of these timing pulses are used by the command processor to complete a program or

erase command.

Table 13 shows program and erase times. The bus clock frequency and FCDIV

determine the frequency of FCLK (fFCLK). The time for one cycle of FCLK is tFCLK = 1/

fFCLK. The times are shown as a number of cycles of FCLK and as an absolute time for

the case where tFCLK = 5 μs. Program and erase times shown include overhead for the

command state machine and enabling and disabling of program and erase voltages.

Table 13. Program and erase times

Parameter Cycles of FCLK Time if FCLK = 200 kHz

Byte program 9 45 μs

Byte program (burst) 4 20 μs [1]

Page erase 4000 20 ms

Mass erase 20,000 100 ms

[1] Excluding start/end overhead

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

25 / 182

6.7.3 Program and erase command execution

The steps for executing any of the commands are listed below. The FCDIV register must

be initialized and any error flags cleared before beginning command execution. The

command execution steps are:

1. Write a data value to an address in the FLASH array. The address and data

information from this write is latched into the FLASH interface. This write is a required

first step in any command sequence. For erase and blank check commands, the

value of the data is not important. For page erase commands, the address may be

any address in the 512-byte page of FLASH to be erased. For mass erase and blank

check commands, the address can be any address in the FLASH memory. Whole

pages of 512 bytes are the smallest block of FLASH that may be erased.

Do not program any byte in the FLASH more than once after a successful erase

operation. Reprogramming bits to a byte which is already programmed is not allowed

without first erasing the page in which the byte resides or mass erasing the entire

FLASH memory. Programming without first erasing may disturb data stored in the

FLASH.

2. Write the command code for the desired command to FCMD. The five valid

commands are blank check (0x05), byte program (0x20), burst program (0x25),

page erase (0x40), and mass erase (0x41). The command code is latched into the

command buffer.

3. Write a 1 to the FCBEF bit in FSTAT to clear FCBEF and launch the command

(including its address and data information).

A partial command sequence can be aborted manually by writing a 0 to FCBEF any

time after the write to the memory array and before writing the 1 that clears FCBEF and

launches the complete command. Aborting a command in this way sets the FACCERR

access error flag which must be cleared before starting a new command.

A strictly monitored procedure must be obeyed or the command will not be accepted.

This minimizes the possibility of any unintended changes to the FLASH memory

contents. The command complete flag (FCCF) indicates when a command is complete.

The command sequence must be completed by clearing FCBEF to launch the command.

Figure 9 is a flowchart for executing all of the commands except for burst programming.

The FCDIV register must be initialized before using any FLASH commands. This must be

done only once following a reset.

6.7.4 Burst program execution

The burst program command is used to program sequential bytes of data in less time

than would be required using the standard program command. This is possible because

the high voltage to the FLASH array does not need to be disabled between program

operations. Ordinarily, when a program or erase command is issued, an internal charge

pump associated with the FLASH memory must be enabled to supply high voltage to the

array. Upon completion of the command, the charge pump is turned off. When a burst

program command is issued, the charge pump is enabled and then remains enabled

after completion of the burst program operation if these two conditions are met:

•The next burst program command has been queued before the current program

operation has completed.

•The next sequential address selects a byte on the same physical row as the current

byte being programmed. A row of FLASH memory consists of 64 bytes. A byte within

a row is selected by addresses A5 through A0. A new row begins when addresses A5

through A0 are all zero.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

26 / 182

The first byte of a series of sequential bytes being programmed in burst mode will

take the same amount of time to program as a byte programmed in standard mode.

Subsequent bytes will program in the burst program time provided that the conditions

above are met. In the case the next sequential address is the beginning of a new row,

the program time for that byte will be the standard time instead of the burst time. This is

because the high voltage to the array must be disabled and then enabled again. If a new

burst command has not been queued before the current command completes, then the

charge pump will be disabled and high voltage removed from the array.

Start

Write to FLASH,

to buffer address, and data

Write command to FCMD

Yes

FPVIOL or

FACCERR?

Write 1 to FCBEF

to launch command

and clear FCBEF (2)

0FCCF?

ERROR exit

Done

Note 2: Wait at least four bus

cycles before checking

FCBEF or FCCF.

FACCERR?

Clear error

Write to FCDIV (1) Note 1: Required only once after reset.

aaa-027998

FLASH PROGRAM AND

ERASE FLOW

Figure 9. FLASH program and erase flowchart

Programming time for the FLASH through the BDM function is dependent on the

specific external BDM interface tool and software being used. Consult tool vendor for

programming times.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

27 / 182

Start

Write to FLASH,

to buffer address, and data

Write command ($25) to FCMD

Yes

FPVIO or

FACCERR?

Write 1 to FCBEF

to launch command

and clear FCBEF (2)

0FCCF?

ERROR exit

Done

Note 2: Wait at least four bus

cycles before checking

FCBEF or FCCF.

FACCERR?

Clear error

FCBEF?

Write to FCDIV (1) Note 1: Required only once after reset.

aaa-027999

FLASH BURST

PROGRAM FLOW

Yes New burst command?

Figure 10. FLASH burst program flowchart

6.7.5 Access errors

An access error occurs whenever the command execution protocol is violated.

Any of the following specific actions will cause the access error flag (FACCERR) in

FSTAT to be set. FACCERR must be cleared by writing a 1 to FACCERR in FSTAT

before any command can be processed.

•Writing to a FLASH address before the internal FLASH clock frequency has been set

by writing to the FCDIV register

•Writing to a FLASH address while FCBEF is not set (A new command cannot be

started until the command buffer is empty.)

•Writing a second time to a FLASH address before launching the previous command

(There is only one write to FLASH for every command.)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

28 / 182

•Writing a second time to FCMD before launching the previous command (There is only

one write to FCMD for every command.)

•Writing to any FLASH control register other than FCMD after writing to a FLASH

address

•Writing any command code other than the five allowed codes (0x05, 0x20, 0x25, 0x40,

or 0x41) to FCMD

•Accessing (read or write) any FLASH control register other than the write to FSTAT (to

clear FCBEF and launch the command) after writing the command to FCMD.

•The MCU enters STOP mode while a program or erase command is in progress (The

command is aborted.)

•Writing the byte program, burst program, or page erase command code (0x20,

0x25, or 0x40) with a BACKGROUND DEBUG command while the MCU is secured

(the BACKGROUND DEBUG controller can only do blank check and mass erase

commands when the MCU is secure.)

•Writing 0 to FCBEF to cancel a partial command.

6.7.6 FLASH block protection

The block protection feature prevents the protected region of FLASH from program or

erase changes. Block protection is controlled through the FLASH Protection Register

(FPROT). When enabled, block protection begins at any 512-byte boundary below the

last address of FLASH, 0xFFFF. (see Section 6.9.4).

After exit from reset, FPROT is loaded with the contents of the NVPROT location which

is in the nonvolatile register block of the FLASH memory. FPROT cannot be changed

directly from application software so a runaway program cannot alter the block protection

settings. Because NVPROT is within the last 512 bytes of FLASH, if any amount of

memory is protected, NVPROT is itself protected and cannot be altered (intentionally or

unintentionally) by the application software. FPROT can be written through background

debug commands which allows a way to erase and reprogram a protected FLASH

memory.

The block protection mechanism is illustrated below. The FPS bits are used as the upper

bits of the last address of unprotected memory. This address is formed by concatenating

FPS7:FPS1 with logic 1 bits as shown. For example, in order to protect the last 8192

bytes of memory (addresses 0xE000 through 0xFFFF), the FPS bits must be set to 1101

111 which results in the value 0xDFFF as the last address of unprotected memory. In

addition to programming the FPS bits to the appropriate value, FPDIS (bit 0 of NVPROT)

must be programmed to logic 0 to enable block protection. Therefore the value 0xDE

must be programmed into NVPROT to protect addresses 0xE000 through 0xFFFF.

Figure 11. Block Protection Mechanism

FPS7 FPS6 FPS5 FPS4 FPS3 FPS2 FPS1

A15 A14 A13 A12 A11 A10 A9 A8

A7 A6 A5 A4 A3 A2 A1 A0

aaa-028493

11111111

One use for block protection is to block protect an area of FLASH memory for a boot

loader program. This boot loader program then can be used to erase the rest of the

FLASH memory and reprogram it. Because the boot loader is protected, it remains intact

even if MCU power is lost in the middle of an erase and reprogram operation.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

29 / 182

6.7.7 Vector redirection

Note: Not recommended for TPMS applications where NXP firmware has been included

in the final image.

Whenever any block protection is enabled, the reset and interrupt vectors will be

protected. Vector redirection allows users to modify interrupt vector information without

unprotecting boot loader and reset vector space. Vector redirection is enabled by

programming the FNORED bit in the NVOPT register located at address 0xFFBF to zero.

For redirection to occur, at least some portion but not all of the FLASH memory must be

block protected by programming the NVPROT register located at address 0xFFBD. All

of the interrupt vectors (memory locations 0xFFC0–0xFFFD) are redirected, though the

reset vector (0xFFFE:FFFF) is not.

For example, if 512 bytes of FLASH are protected, the protected address region is from

0xFE00 through 0xFFFF. The interrupt vectors (0xFFC0–0xFFFD) are redirected to the

locations 0xFDC0–0xFDFD. Now, if an SPI interrupt is taken for instance, the values in

the locations 0xFDE0:FDE1 are used for the vector instead of the values in the locations

0xFFE0:FFE1. This allows the user to reprogram the unprotected portion of the FLASH

with new program code including new interrupt vector values while leaving the protected

area, which includes the default vector locations, unchanged.

6.8 Security

The FXTH87E includes circuitry to prevent unauthorized access to the contents of

FLASH and RAM memory. When security is engaged, FLASH and RAM are considered

secure resources. Direct-page registers, high-page registers, and the BACKGROUND

DEBUG controller are considered unsecured resources. Programs executing within

secure memory have normal access to any MCU memory locations and resources.

Attempts to access a secure memory location with a program executing from an

unsecured memory space or through the BACKGROUND DEBUG interface are blocked

(writes are ignored and reads return all 0s).

Security is engaged or disengaged based on the state of nonvolatile register bits

SEC[1:0] in the FOPT register. During reset, the contents of the nonvolatile location

NVOPT are copied from FLASH into the working FOPT register in high-page register

space. A user engages security by programming the NVOPT location, which can be

done at the same time the FLASH memory is programmed. The SEC[1:0] = 1 0 state

disengages security and the 0 0, 0 1 and 1 1 states engage security. At production, NXP

programs the NVOPT SEC[1:0] = 1 0, which keeps the device unsecured. In this case,

note that SEC[0] is programmed to 0 and it is not possible to reprogram it to 1 without

first erasing the entire memory page. Notice the erased state of SEC[1:0] = 1 1 secures

the device. During development, whenever the FLASH is erased, it is good practice to

immediately program the NVOPT SEC[0] = 0, such that SEC[1:0] = 1 0. This would allow

the MCU to remain unsecured after a subsequent reset.

The on-chip debug module cannot be enabled while the MCU is secure. The separate

BACKGROUND DEBUG controller can still be used for background memory access

commands, but the MCU cannot enter ACTIVE BACKGROUND mode except by holding

BKGD/MS low at the rising edge of reset.

A user can choose to allow or disallow a security unlocking mechanism through an 8-byte

backdoor security key. If the nonvolatile KEYEN bit in NVOPT/FOPT is 0, the backdoor

key is disabled and there is no way to disengage security without completely erasing

all FLASH locations. If KEYEN is 1, a secure user program can temporarily disengage

security by:

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

30 / 182

1. Writing 1 to KEYACC in the FCNFG register. This makes the FLASH module interpret

writes to the backdoor comparison key locations (NVBACKKEY through NVBACKKEY

+7) as values to be compared against the key rather than as the first step in a FLASH

program or erase command.

2. Writing the user-entered key values to the NVBACKKEY through NVBACKKEY+7

locations. These writes must be done in order starting with the value for NVBACKKEY

and ending with NVBACKKEY+7. STHX must not be used for these writes because

these writes cannot be done on adjacent bus cycles. User software normally would

get the key codes from outside the MCU system through a communication interface

such as a serial I/O.

3. Writing 0 to KEYACC in the FCNFG register. If the 8-byte key that was just written

matches the key stored in the FLASH locations, SEC[1:0] are automatically changed

to 1 0 and security will be disengaged until the next reset.

The security key can be written only from secure memory (either RAM or FLASH), so

it cannot be entered through BACKGROUND commands without the cooperation of a

secure user program.

The backdoor comparison key (NVBACKKEY through NVBACKKEY+7) is located

in FLASH memory locations in the nonvolatile register space so users can program

these locations exactly as they would program any other FLASH memory location. The

nonvolatile registers are in the same 512-byte block of FLASH as the reset and interrupt

vectors, so block protecting that space also block protects the backdoor comparison key.

Block protects cannot be changed from user application programs, so if the vector space

is block protected, the backdoor security key mechanism cannot permanently change the

block protect, security settings, or the backdoor key.

Security can always be disengaged through the BACKGROUND DEBUG interface by

taking these steps:

1. Disable any block protections by writing FPROT. FPROT can be written only with

BACKGROUND DEBUG commands, not from application software.

2. Mass erase FLASH if necessary.

3. Blank check FLASH. Provided FLASH is completely erased, security is disengaged

until the next reset.

To avoid returning to secure mode after the next reset, program NVOPT so

SEC[1:0] = 1 0.

Note: Enabling the security feature disables NXP ability to perform failure analysis

without first completely erasing all flash memory contents. If the security feature is

implemented, customer shall be responsible for providing to NXP unsecured parts for any

failure analysis to begin or supplying the entire contents of the device flash memory data

as part of the return process, to allow NXP to erase and subsequently restore the device

to its original condition.

6.9 FLASH registers and control bits

The FLASH module has nine 8-bit registers in the high-page register space, three

locations in the nonvolatile register space in FLASH memory which are copied into three

corresponding high-page control registers at reset. There is also an 8-byte comparison

key in FLASH memory. Refer to Table 12 and Table 13 for the absolute address

assignments for all FLASH registers. This section refers to registers and control bits only

by their names. A NXP Semiconductor-provided equate or header file normally is used to

translate these names into the appropriate absolute addresses.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

31 / 182

6.9.1 FLASH clock divider register (FCDIV)

Bit 7 of this register is a read-only status flag. Bits 6 through 0 can be read at any time

but can be written only once. Before any erase or programming operations are possible,

write to this register to set the frequency of the clock for the nonvolatile memory system

within acceptable limits.

Table 14. FLASH clock divider register (FCDIV) (address $1820)

Bit76543210

WPRDIV8 DIV5 DIV4 DIV3 DIV2 DIV1 DIV0

Reset00000000

= Reserved

Table 15. FCDIV register field descriptions

Field Description

DIVLD

Divisor Loaded Status Flag — When set, this read-only status flag indicates that the FCDIV register has

been written since reset. Reset clears this bit and the first write to this register causes this bit to become

set regardless of the data written.

0 FCDIV has not been written since reset; erase and program operations disabled for FLASH

1 FCDIV has been written since reset; erase and program operations enabled for FLASH

PRDIV8

Prescale (Divide) FLASH Clock by 8

0 Clock input to the FLASH clock divider is the bus rate clock

1 Clock input to the FLASH clock divider is the bus rate clock divided by 8

5:0

DIV[5:0]

Divisor for FLASH Clock Divider — The FLASH clock divider divides the bus rate clock (or the bus

rate clock divided by 8 if PRDIV8 = 1) by the value in the 6-bit DIV5:DIV0 field plus one. The resulting

frequency of the internal FLASH clock must fall within the range of 200 kHz to 150 kHz for proper FLASH

operations. Program/Erase timing pulses are one cycle of this internal FLASH clock which corresponds to

a range of 5 μs to 6.7 μs. The automated programming logic uses an integer number of these pulses to

complete an erase or program operation.

•if PRDIV8 = 0 — fFCLK = fBUS ÷ ([DIV5:DIV0] + 1)

•if PRDIV8 = 1 — fFCLK = fBUS ÷ (8 × ([DIV5:DIV0] + 1))

Table 16 shows the appropriate values for PRDIV8 and DIV5:DIV0 for selected bus frequencies.

Table 16. FLASH clock divider settings

fBUS PRDIV8

(Binary)

DIV5:DIV0

(Decimal)

fFCLK Program/Erase Timing Pulse

(5 μs Min, 6.7 μs Max)

20 MHz 1 12 192.3 kHz 5.2 μs

10 MHz 0 49 200 kHz 5 μs

8 MHz 0 39 200 kHz 5 μs

4 MHz 0 19 200 kHz 5 μs

2 MHz 0 9 200 kHz 5 μs

1 MHz 0 4 200 kHz 5 μs

200 kHz 0 0 200 kHz 5 μs

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

32 / 182

fBUS PRDIV8

(Binary)

DIV5:DIV0

(Decimal)

fFCLK Program/Erase Timing Pulse

(5 μs Min, 6.7 μs Max)

150 kHz 0 0 150 kHz 6.7 μs

6.9.2 FLASH options register (FOPT and NVOPT)

During reset, the contents of the nonvolatile location NVOPT are copied from FLASH into

FOPT. Bits 5 through 2 are not used and always read 0. This register may be read at any

time, but writes have no meaning or effect. To change the value in this register, erase

and reprogram the NVOPT location in FLASH memory as usual and then issue a new

MCU reset.

Table 17. FLASH options register (FOPT) (address $1821)

Bit76543210

R KEYEN FNORED 0 0 0 0 SEC1 SEC0

Reset This register is loaded from nonvolatile location NVOPT during reset.

= Reserved

Table 18. FOPT register field descriptions

Field Description

KEYEN

Backdoor Key Mechanism Enable — When this bit is 0, the backdoor key mechanism cannot be used to

disengage security.

The backdoor key mechanism is accessible only from user (secured) firmware. BDM commands cannot

be used to write key comparison values that would unlock the backdoor key. For more detailed information

about the backdoor key mechanism, refer to Section 6.8 "Security".

0 No backdoor key access allowed

1 If user firmware writes an 8-byte value that matches the nonvolatile backdoor key (NVBACKKEY through

NVBACKKEY+7 in that order), security is temporarily disengaged until the next MCU reset

FNORED

Vector Redirection Disable — When this bit is 1, then vector redirection is disabled.

0 Vector redirection enabled

1 Vector redirection disabled

1:0

SEC[1:0]

Security State Code — This 2-bit field determines the security state of the MCU as shown in Table 19.

When the MCU is secure, the contents of RAM and FLASH memory cannot be accessed by instructions

from any unsecured source including the BACKGROUND DEBUG interface. For more detailed information

about security, refer to Section 6.8 "Security". SEC[1:0] changes to 1 0 after successful backdoor key entry

or a successful blank check of FLASH.

Table 19. Security states

SEC[1:0] Description

0 0 secure

0 1 secure

1 0 unsecured

1 1 secure

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

33 / 182

6.9.3 FLASH configuration register (FCNFG)

Bits 7 through 5 can be read or written at any time. Bits 4 through 0 always read 0 and

cannot be written.

Table 20. FLASH configuration register (FCNFG) (address $1823)

Bit76543210

R0 00000

WKEYACC

Reset00000000

= Reserved

Table 21. FCNFG register field descriptions

Field Description

KEYACC

Enable Writing of Access Key — This bit enables writing of the backdoor comparison key. For more detailed

information about the backdoor key mechanism, refer to Section 6.8 "Security".

0 Writes to 0xFFB0–0xFFB7 are interpreted as the start of a FLASH programming or erase command

1 Writes to NVBACKKEY (0xFFB0–0xFFB7) are interpreted as comparison key writes

6.9.4 FLASH protection register (FPROT and NVPROT)

During reset, the contents of the nonvolatile location NVPROT is copied from FLASH into

FPROT. Bits 0, 1, and 2 are not used and each always reads as 0. This register can be

read at any time, but user program writes have no meaning or effect. Background debug

commands can write to FPROT.

Table 22. FLASH protection register (FPROT) (address $1824)

Bit76543210

R FPS7 FPS6 FPS5 FPS4 FPS3 FPS2 FPS1 FPDIS

W[1] [1] [1] [1] [1] [1] [1] [1]

Reset This register is loaded from nonvolatile location NVPROT during reset.

[1] Background commands can be used to change the contents of these bits in FPROT.

Table 23. FPROT register field descriptions

Field Description

7:1

FPS[7:1]

FLASH Protect Select Bits — When FPDIS = 0, this 7-bit field determines the ending address of

unprotected FLASH locations at the high address end of the FLASH. Protected FLASH locations cannot be

erased or programmed.

FPDIS

FLASH Protection Disable

0 FLASH block specified by FPS[7:1] is block protected (program and erase not allowed)

1 No FLASH block is protected

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

34 / 182

6.9.5 FLASH status register (FSTAT)

Bits 3, 1, and 0 always read 0 and writes have no meaning or effect. The remaining

five bits are status bits that can be read at any time. Writes to these bits have special

meanings that are discussed in the bit descriptions.

Table 24. FLASH status register (FSTAT) (address $1825)

Bit76543210

R FCCF 0 FBLANK 0 0

WFCBEF FPVIOL FACCERR

Reset11000000

= Reserved

Table 25. FSTAT register field descriptions

Field Description

FCBEF

FLASH Command Buffer Empty Flag — The FCBEF bit is used to launch commands. It also indicates that

the command buffer is empty so that a new command sequence can be executed when performing burst

programming. The FCBEF bit is cleared by writing a 1 to it or when a burst program command is transferred

to the array for programming. Only burst program commands can be buffered.

0 Command buffer is full (not ready for additional commands)

1 A new burst program command can be written to the command buffer

FCCF

FLASH Command Complete Flag — FCCF is set automatically when the command buffer is empty and no

command is being processed. FCCF is cleared automatically when a new command is started (by writing 1

to FCBEF to register a command). Writing to FCCF has no meaning or effect.

0 Command in progress

1 All commands complete

FPVIOL

Protection Violation Flag — FPVIOL is set automatically when FCBEF is cleared to register a command that

attempts to erase or program a location in a protected block (the erroneous command is ignored). FPVIOL

is cleared by writing a 1 to FPVIOL.

0 No protection violation

1 An attempt was made to erase or program a protected location

FACCERR

Access Error Flag — FACCERR is set automatically when the proper command sequence is not obeyed

exactly (the erroneous command is ignored), if a program or erase operation is attempted before the FCDIV

detailed discussion of the exact actions that are considered access errors, see Section 6.7.5 "Access

errors". FACCERR is cleared by writing a 1 to FACCERR. Writing a 0 to FACCERR has no meaning or

effect.

0 No access error

1 An access error has occurred

FBLANK

FLASH Verified as All Blank (erased) Flag — FBLANK is set automatically at the conclusion of a blank

check command if the entire FLASH array was verified to be erased. FBLANK is cleared by clearing FCBEF

to write a new valid command. Writing to FBLANK has no meaning or effect.

0 After a blank check command is completed and FCCF = 1, FBLANK = 0 indicates the FLASH array is not

completely erased

1 After a blank check command is completed and FCCF = 1, FBLANK = 1 indicates the FLASH array is

completely erased (all 0xFF)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

35 / 182

6.9.6 FLASH command register (FCMD)

Only five command codes are recognized in normal user modes as shown in Table 27.

Refer to Section 6.7.2 "Program and erase times", for a detailed discussion of FLASH

programming and erase operations.

Table 26. FLASH command register (FCMD) (address $1826)

Bit76543210

R00000000

W FCMD7 FCMD6 FCMD5 FCMD4 FCMD3 FCMD2 FCMD1 FCMD0

Reset00000000

Table 27. FLASH commands

Command FCMD Equate File Label

Blank check 0x05 mBlank

Byte program 0x20 mByteProg

Byte program — burst mode 0x25 mBurstProg

Page erase (512 bytes/page) 0x40 mPageErase

Mass erase (all FLASH) 0x41 mMassErase

All other command codes are illegal and generate an access error.

It is not necessary to perform a blank check command after a mass erase operation.

Only blank check is required as part of the security unlocking mechanism.

7 Reset, interrupts and system configuration

This section discusses basic reset and interrupt mechanisms and the various sources of

reset and interrupts in the FXTH87E. Some interrupt sources from peripheral modules

are discussed in greater detail within other sections of this product specification. This

section gathers basic information about all reset and interrupt sources in one place for

easy reference. A few reset and interrupt sources, including the computer operating

properly (COP) watchdog and real-time interrupt (RTI), are not part of on-chip peripheral

systems, but are part of the system control logic.

7.1 Features

Reset and interrupt features include:

•Multiple sources of reset for flexible system configuration and reliable operation

•Reset status register (SRS) to indicate source of most recent reset

•Separate interrupt vectors for each module (reduces polling overhead)

7.2 MCU reset

Resetting the MCU provides a way to start processing from a known set of initial

conditions. During reset, most control and status registers are forced to initial values and

the program counter is loaded from the reset vector ($DFFE:$DFFF). On-chip peripheral

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

36 / 182

modules are disabled and any I/O pins are initially configured as general-purpose high-

impedance inputs with any pullup devices disabled. The I bit in the condition code

initialize the stack pointer (SP) and system control settings. The SP is forced to $00FF at

reset. The FXTH87E has seven sources for reset:

•Power-on reset (POR)

•Low-voltage detect (LVD)

•Computer operating properly (COP) timer

•Periodic hardware reset (PRST)

•Illegal opcode detect

•Illegal address detect

•BACKGROUND DEBUG forced reset

Each of these sources has an associated bit in the system reset status register with the

exception of the BACKGROUND DEBUG forced reset and the periodic hardware reset,

PRST, that is indicated by the PRF bit in the PWUCS1 register.

7.3 Computer Operating Properly (COP) Watchdog

The COP watchdog is intended to force a system reset when the application software

fails to execute as expected. To prevent a system reset from the COP timer (when it is

enabled), application software must reset the COP timer periodically. If the application

program gets lost and fails to reset the COP before it times out, a system reset is

generated to force the system back to a known starting point. The COP watchdog is

enabled by the COPE bit in SIMOPT1 register. The COP timer is reset by writing any

value to the address of SRS. This write does not affect the data in the read-only SRS.

Instead, the act of writing to this address is decoded and sends a reset signal to the COP

timer.

The timeout period can be selected by the COPCLKS and the COPT[2:0] bits as shown

in Table 28. The COPCLKS bit selects either the LFO or the CPU bus clock as the

clocking source and the COPT[2:0] bits select the clock count required for a timeout. The

tolerances of these timeout periods is dependent on the selected clock source (LFO or

HFO).

Table 28. COP watchdog timeout period

COPT

COPCLKS 210

Clock

Source

COP

Overflow

Count

COP Overflow Time

(ms, nominal)

0 0 0 0 LFO 2532

0 0 0 1 LFO 2664

0 0 1 0 LFO 27128

0 0 1 1 LFO 28256

0 1 0 0 LFO 29512

0 1 0 1 LFO 210 1024

0 1 1 0 LFO 211 2048

0 1 1 1 LFO 211 2048

BUSCLKS[1:0]

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

37 / 182

COPT

COPCLKS 210

Clock

Source

COP

Overflow

Count

COP Overflow Time

(ms, nominal)

1:1

(0.5 MHz)

1:0

(1 MHz)

0:1

(2 MHz)

0:0

(4MHz)

1 0 0 0 Bus Clock 213 16.384 8.192 4.096 2.048

1 0 0 1 Bus Clock 214 32.768 16.384 8.192 4.096

1 0 1 0 Bus Clock 215 65.536 32.768 16.384 8.192

1 0 1 1 Bus Clock 216 131.072 65.536 32.768 16.384

1 1 0 0 Bus Clock 217 262.144 131.072 65.536 32.768

1 1 0 1 Bus Clock 218 524.288 262.144 131.072 65.536

1 1 1 0 Bus Clock 219 1048.576 524.288 262.144 131.072

1 1 1 1 Bus Clock 219 1048.576 524.288 262.144 131.072

After any reset, the COP timer is enabled. This provides a reliable way to detect code

that is not executing as intended. If the COP watchdog is not used in an application, it

can be disabled by clearing the COPE bit in the write-once SIMOPT1 register. Even if

the application will use the reset default settings in COPE, COPCLKS and COPT[2:0],

the user should still write to write- once SIMOPT1 during reset initialization to lock in the

settings. That way, they cannot be changed accidentally if the application program gets

lost.

The write to SRS that services (clears) the COP timer should not be placed in an

interrupt service routine (ISR) because the ISR could continue to be executed

periodically even if the main application program fails. When the MCU is in ACTIVE

BACKGROUND DEBUG mode, or either Stop1 or Stop4 modes, the COP timer is

temporarily disabled. If enabled, the COP timer is reset at the time entering Stop1 and

Stop4 modes, and will restart after 3 cycles of the selected clock source upon exiting; RTI

may be used as a substitute.

7.4 SIM test register (SIMTST)

The output of the temperature monitor is available using the SIM Test register as shown

in Table 29.

Table 29. SIM test register (SIMTST) (address $180F)

Bit76543210

R TRO

WTRH

Reset00111001

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

38 / 182

Table 30. SIMTST register field descriptions

Field Description

reserved Reserved Bit — These bits are reserved for factory trim and should not be altered by the user.

6:4

TRH

Temperature Restart High threshold — Binary coded from 0x00 to 0x07; recommend applications overwrite

to 0x06 at each wakeup cycle.

3:1

reserved Reserved Bit — These bits are reserved for factory trim and should not be altered by the user.

TRO

Temperature Restart Outside

1 TR module is outside the TREARM temperature range and will restart the MCU if the TRE bit is set and

temperature falls back within the TRESET temperature range.

0 TR module is within the TRESET temperature range and the MCU cannot be armed to restart when

temperature falls back to the TRESET range. The TRE bit cannot be set.

7.5 Interrupts

Interrupts provide a way to save the current CPU status and registers, execute an

interrupt service routine (ISR), and then restore the CPU status so processing resumes

where it left off before the interrupt. Other than the software interrupt (SWI), which is a

program instruction, interrupts are caused by hardware events. The debug module can

also generate an SWI under certain circumstances.

If an event occurs in an enabled interrupt source, an associated read-only status flag

will become set. The CPU will not respond until and unless the local interrupt enable is a

logic 1 to enable the interrupt. The I bit in the CCR must be a logic 0 to allow interrupts.

The global interrupt mask (I bit) in the CCR is initially set after reset which masks

(prevents) all maskable interrupt sources. The user program initializes the stack pointer

and performs other system setup before clearing the I bit to allow the CPU to respond to

interrupts. When the CPU receives a qualified interrupt request, it completes the current

instruction before responding to the interrupt. The interrupt sequence follows the same

cycle-by-cycle sequence as the SWI instruction and consists of:

•Saving the CPU registers on the stack

•Setting the I bit in the CCR to mask further interrupts

•Fetching the interrupt vector for the highest-priority interrupt that is currently pending

•Filling the instruction queue with the first three bytes of program information starting

from the address fetched from the interrupt vector locations

While the CPU is responding to the interrupt, the I bit is automatically set to avoid

the possibility of another interrupt interrupting the ISR itself (this is called nesting of

interrupts). Normally, the I bit is restored to 0 when the CCR is restored from the value

stacked on entry to the ISR. In rare cases, the I bit may be cleared inside an ISR

(after clearing the status flag that generated the interrupt) so that other interrupts can

be serviced without waiting for the first service routine to finish. This practice is not

recommended for anyone other than the most experienced programmers because it can

lead to subtle program errors that are difficult to debug.

The interrupt service routine ends with a return-from-interrupt (RTI) instruction which

restores the CCR, A, X, and PC registers to their pre interrupt values by reading the

previously saved information off the stack.

When two or more interrupts are pending when the I bit is cleared, the highest priority

source is serviced first.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

39 / 182

For compatibility with the M68HC08, the H register is not automatically saved and

restored. It is good programming practice to push H onto the stack at the start of the

interrupt service routine (ISR) and restore it just before the RTI that is used to return from

the ISR.

7.5.1 Interrupt stack frame

Table 29 shows the contents and organization of a stack frame. Before the interrupt, the

stack pointer (SP) points at the next available byte location on the stack. The current

values of CPU registers are stored on the stack starting with the low-order byte of the

program counter (PCL) and ending with the CCR. After stacking, the SP points at the

next available location on the stack which is the address that is one less than the address

where the CCR was saved. The PC value that is stacked is the address of the instruction

in the main program that would have executed next if the interrupt had not occurred.

When an RTI instruction is executed, these values are recovered from the stack in

reverse order. As part of the RTI sequence, the CPU fills the instruction pipeline by

reading three bytes of program information, starting from the PC address just recovered

from the stack.

The status flag causing the interrupt must be acknowledged (cleared) before returning

from the ISR. Typically, the flag should be cleared at the beginning of the ISR so that

if another interrupt is generated by this same source, it will be registered so it can be

serviced after completion of the current ISR.

aaa-028000

Condition code register (CCR)

Accumulator

Index register* (low byte x)

Program counter high

Program counter low

Unstacking

order

Stacking

order

SP after

interrupt stacking

SP before

the interrupt

Towards HIGHER addresses

Towards LOWER addresses

7 0

* High byte (H) of index register is not automatically stacked.

Figure 12. Interrupt stack frame

7.5.2 Vector summary

Table 31 provides a summary of all interrupt sources. Higher-priority sources are located

toward the bottom of the table (at the higher vector addresses). All of these vectors are

a 2-byte address that the firmware uses as the destination address. This allows the

firmware to intercept all vectors and add additional processing as needed. The additional

process latency for each interrupt will be described in Section 16 "Firmware".

Therefore, the high-order byte of the address for the user’s interrupt service routine is

located at the lower address in the vector address column, and the low-order byte of

the address for the interrupt service routine is located at the higher address. When an

interrupt condition occurs, an associated flag bit becomes set. If the associated local

interrupt enable is set, an interrupt request is sent to the CPU. Within the CPU, if the

global interrupt mask (I bit in the CCR) is 0, the CPU will finish the current instruction,

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

40 / 182

stack the PCL, PCH, X, A, and CCR CPU registers, set the I bit, and then fetch the

interrupt vector for the highest priority pending interrupt. Processing then continues in the

interrupt service routine.

The triggering of any of these vector fetches will wake the MCU from any of the STOP

modes.

The LF, SMI, and ADC user interrupt vectors are not accessed when the prior function

under execution is a firmware function. See Firmware User Guide for additional details

regarding firmware and disabled interrupts.

Table 31. Vector summary

Vector

Priority

Vector

No.

Jump Table

Vector Addr

(High/Low)

Vector

Name

Module

Source Flags Enables Description

15 $DFE0 - $DFE1 Vkbi KBI KBF KBIE Keyboard interrupt pins PTA[3:0]

14 $DFE2 - $DFE3 Reserved

13 $DFE4 - $DFE5 Reserved

12 $DFE6 - $DFE7 Vrti Sys Ctrl RTIF RTIE

Interrupt from the RTI when in Run or

Stop4 mode and the periodic wakeup

timer has timed out.

LFIDF LFIDIE Interrupt from LFR in data mode when a

valid wake ID has been received.

LFCDF LFCDIE Interrupt from LFR in carrier mode when

a carrier present for the required time.

LFERF LFERIE Interrupt from LFR in the Manchester

decode mode when an error is detected.

11 $DFE8 - $DFE9 Vlfrcvr LFR

LFDRF LFDRIE

Interrupt from LFR in the Manchester

decode mode when an 8-bit data byte

has been successfully received.

10 $DFEA - $DFEB Reserved

RFIF Interrupt from the RFM when the data

buffer has been completely sent.

9 $DFEC - $DFED Vrf RFM

RFEF

RFIEN Interrupt from the RFM when

transmission error detected.

8 $DFEE - $DFEF Vsmi SMI SMIF SMIIE

Interrupt from the Sensor Measurement

Interface when the channel setting delay

has expired.

7 $DFF0 - $DFF1 Vtpm

1ovf TPM1 TOF TOIE Interrupt from the TPM1 when the timer

overflows.

6 $DFF2 - $DFF3 Vtpm

1ch1 TPM1 CH1F CH1IE Interrupt from the TPM1 when the

selected event for channel 1 occurs.

5 $DFF4 - $DFF5 Vtpm

1ch0 TPM1 CH0F CH0IE Interrupt from the TPM1 when the

selected event for channel 0 occurs.

4 $DFF6 - $DFF7 Vwu

ktmr PWU WUKI WUK[5:0] Interrupt from the PWU when the

wakeup time interval has elapsed.

Lower

Higher

3 $DFF8 - $DFF9 Vlvd Sys Ctrl LVDF LVDIE

Interrupt from the LVD when the supply

voltage has dropped below the LVD

threshold.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

41 / 182

Vector

Priority

Vector

No.

Jump Table

Vector Addr

(High/Low)

Vector

Name

Module

Source Flags Enables Description

2 $DFFA - $DFFB Reserved

1 $DFFC - $DFFD Vswi SWI

opcode — — Interrupt from the CPU when an SWI

instruction has been executed.

Sys Ctrl

- POR — — Reset from power on sequence.

Sys Ctrl

- PRF PRF PRST[5:0] Reset from PWU when the reset interval

elapsed.

Sys Ctrl

- COP — COPE Reset when COP watchdog times out.

Sys Ctrl

- LVD — LVDRE

Reset from the LVD when the supply

voltage

has dropped below the LVD threshold.

Temp

Restart — TRE Reset when the temperature falls below

the temperature restart threshold

Illegal

opcode — — Reset from the CPU when trying to

execute an illegal opcode.

0 $DFFE -$DFFF Vreset

Illegal

address — — Reset from the CPU when trying to

access an illegal address.

7.6 Low-Voltage Detect (LVD) System

The FXTH87E includes a system to detect low voltage conditions in order to protect

memory contents and control MCU system states during supply voltage variations. The

system is comprised of a power-on reset (POR) circuit and an LVD circuit with a user

selectable trip voltage, either high (VLVDH) or low (VLVDL). The LVD circuit is enabled

when LVDE in SPMSC1 is high and the trip voltage is selected by LVDV in SPMSC3.

The LVD is disabled upon entering any of the STOP modes unless the LVDSE bit is set.

If LVDSE and LVDE are both set, then the MCU cannot enter STOP1.

7.6.1 Power-on reset operation

When power is initially applied to the FXTH87E, or when the supply voltage drops

below the VPOR level, the POR circuit will cause a reset condition. As the supply voltage

rises, the LVD circuit will hold the chip in reset until the supply has risen above the level

determined by LVDV bit. Both the POR bit and the LVD bit in SRS are set following a

POR.

7.6.2 LVD reset operation

The LVD can be configured to generate a reset upon detection of a low voltage condition

has occurred by setting LVDRE to 1 when the supply voltage has fallen below the level

determined by LVDV bit. After an LVD reset has occurred, the LVD system will hold the

FXTH87E in reset until the supply voltage has risen above the level determined by LVDV

bit. The threshold for falling and rising differ by a small amount of hysteresis. The LVD bit

in the SRS register is set following either an LVD reset or POR.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

42 / 182

7.6.3 LVD interrupt operation

When a low voltage condition is detected and the LVD circuit is configured for interrupt

operation (LVDE set, LVDIE set, and LVDRE clear), then LVDF will be set and an LVD

interrupt will occur.

7.6.4 Low-Voltage Warning (LVW)

The LVD system has a low voltage warning flag, LVWF, to indicate to the user that the

supply voltage is approaching, but is still above, the LVD reset voltage. The LVWF can

be reset by writing a logical one to the LVWACK bit. The LVW does not have an interrupt

associated with it. There are two user selectable trip voltages for the LVW as selected

by LVWV in SPMSC3. The LVWF is set when the supply voltage falls below the selected

level and cannot be reset until the supply voltage has risen above the selected level. The

threshold for falling and rising differ by a small amount of hysteresis.

7.7 System clock control

Several clock rate selections are possible with the FXTH87E using the BUSCLKS[1:0]

control bits to select the clock frequency division of the HFO as given in Table 32. These

bits are cleared by any MCU reset.

Table 32. HFO frequency selections

BUSCLKS1 BUSCLKS0 HFO Frequency

(MHz)

CPU Bus

Frequency (MHz)

0 0 8 4

0 1 4 2

1 0 2 1

1 1 1 0.5

7.8 Keyboard interrupts

The keyboard interrupts can be used to wake the MCU. These are assigned to specific

general I/O pins as given in Table 33.

Note: Regarding wake-up from Stop1, the reset vector is accessed, taking precedence

over the interrupt vector.

Table 33. Keyboard interrupt assignments

KBI Pin Pin Function

0 PTA0 General I/O

1 PTA1 General I/O

2 PTA2 General I/O

3 PTA3 General I/O

7.9 Real-time interrupt

The RTI uses the internal low frequency oscillator (LFO) as its clock source. The RTI can

be used as a periodic interrupt in MCU RUN mode, or can be used as a periodic wakeup

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

43 / 182

from all low power modes. The LFO is always active and cannot be powered off by any

software control. The control bits for the RTI are shown in Table 34.

Note: Regarding wake-up from Stop1, the reset vector is accessed, taking precedence

over the interrupt vector.

Table 34. RTI Status/Control register (SRTISC) (address $1808)

Bit76543210

R RTIF 0

W RTIACK RTICLKS RTIE 0 RTIS[2:0]

Reset00000000

POR00000000

= Reserved

Table 35. SRTISC register field descriptions

Field Description

RTIF

RTI Interrupt Flag — The RTIF bit indicates when a wakeup interrupt has been generated by the RTI if

configured from Run or STOP4 modes. Writing a zero to this bit has no effect. Reset or exit from STOP1

clears this bit.

0 Wakeup interrupt not generated or was previously acknowledged.

1 Wakeup interrupt generated.

RTIACK

Acknowledge RTIF Interrupt Flag — The RTIACK bit clears the RTIF bit if written with a one. Writing a zero

to the RTIACK bit has no effect on the RTIF bit. Reading the RTIACK bit returns a zero. Reset has no effect

on this bit.

0 No effect.

1 Clear RTIF bit.

RTICLKS

RTI Interrupt Clock Select — This read-write bit selects the clock source for the real-time interrupt request

0 Real-time interrupt request clock source is the LFO.

1 Real-time interrupt request clock source is the HFO (MCU must be in the RUN mode).

RTIE

RTIF Interrupt Enable — The RTIE bit enables RTI interrupts if written with a one. Reset clears this bit.

0 Disable RTI interrupts.

1 Enable RTI interrupts.

Unused Unused

2:0

RTIS[2:0]

RTI Interrupt Delay Selects — The RTIS[2:0] bits select the timing of the RTI interrupts as given in Table 36.

Reset clears these bits.

Table 36. Real-time interrupt period

RTIS2 RTIS1 RTIS0 Delay Timing (ms)

(Dependent on 1-kHz LFO)

0 0 0 OFF

0 0 1 2

0 1 0 4

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

44 / 182

RTIS2 RTIS1 RTIS0 Delay Timing (ms)

(Dependent on 1-kHz LFO)

0 1 1 8

1 0 0 16

1 0 1 32

1 1 0 64

1 1 1 128

7.10 Temperature sensor and restart system

The FXTH87E has two temperature sensing mechanisms. The first is an accurate sensor

which is accessible through the ADC10 channel 1. The second is a less accurate, very

low power sensor which generates a wakeup from STOP1 when the temperature crosses

its threshold of detection. This is the temperature restart wakeup which is used as

follows:

1. The temperature restart wakeup is enabled by software following detection of an over

temperature condition using the temperature sensor connected to the ADC10.

2. User software enables the temperature restart detector and then instructs the MCU to

enter STOP1 mode to halt execution during the out-of-range temperature condition.

3. When the temperature crosses the temperature restart threshold back into the normal

range of operation, a wakeup is generated to wake the MCU. Exit from STOP1 will

reset the device.

The temperature sensor is enabled whenever the ADC10 is enabled. The temperature

restart wakeup is enabled by setting the TRE bit in SIMOPT1 register and whether the

detector interrupts the MCU from a very low or a very high temperature is determined by

the TRH bit in the SIMOPT1 register.

7.11 Reset, interrupt and system control registers and bits

One 8-bit register in the direct page register space and eight 8-bit registers in the high-

page register space are related to reset and interrupt systems.

7.11.1 System Reset Status Register (SRS)

The SRS register at $1800 includes seven read-only status flags to indicate the source

of the most recent reset. When a debug host forces reset by writing 1 to BDFR in the

SBDFR register, none of the status bits in SRS will be set. Writing any value to this

Table 37. System reset status register (SRS) (address $1800)

Bit76543210

R 0

WPOR PIN COP ILOP ILAD PWU LVD

POR Reset 1 0 0 0 0 0 1 0

LVD Reset 1 0 0 0 0 0 1 0

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

45 / 182

Bit76543210

Any Other

Reset 0[1] [1] [1] [1] 000

= Reserved

[1] Any of these reset sources that are active at the time of reset will cause the corresponding bit(s) to be set; bits corresponding to sources that are not

active at the time of reset will be cleared.

Table 38. SRS register field descriptions

Field Description

POR

Power-On Reset — This bit indicates reset was caused by the power-on detection logic. Because the

internal supply voltage was ramping up at the time, the low-voltage reset (LVR) status bit is also set to

indicate that the reset occurred while the internal supply was below the LVR threshold.

0 Reset not caused by POR

1 POR caused reset

External Reset Pin — This bit indicates reset was caused by an active-low level on the external reset pin if

the device was in either the STOP1 or RUN modes. This bit is not set if the external reset pin is pulled low

when the device is in the STOP1 mode.

0 Reset not caused by external reset pin

1 Reset came from external reset pin

COP

Computer Operating Properly (COP) Watchdog — This bit indicates that reset was caused by the COP

watchdog timer timing out. This reset source may be blocked by COPE = 0.

0 Reset not caused by COP timeout

1 Reset caused by COP timeout

ILOP

Illegal Opcode — This bit indicates reset was caused by an attempt to execute an unimplemented or illegal

opcode. The STOP instruction is considered illegal if STOP is disabled by STOPE = 0 in the SOPT register.

The BGND instruction is considered illegal if ACTIVE BACKGROUND mode is disabled by ENBDM = 0 in

the BDCSC register.

0 Reset not caused by an illegal opcode

1 Reset caused by an illegal opcode

ILAD

Illegal Address — This bit indicates reset was caused by an attempt to access either data or an instruction

at an unimplemented memory address.

0 Reset not caused by an illegal address

1 Reset caused by an illegal address

PWU

Programmable Wakeup — This bit indicates reset was caused by a PWU reset in RUN, WAIT, and STOP4.

After STOP1 exit, PRF in PWUCSI indicates PWU was the source of a wakeup.

0 Reset not caused by PWU.

1 Reset caused by PWU.

LVD

Low Voltage Detect — If the LVDRE and LVDSE bits are set and the supply drops below the LVD trip

voltage, an LVD reset will occur. This bit is also set by POR.

0 Reset not caused by LVD trip or POR.

1 Reset caused by LVD trip or POR.

Unused Unused Bit — This bit always reads as a logical zero.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

46 / 182

7.11.2 System Options Register 1 (SIMOPT1)

The following clock source and frequency selections are available using the system

option register 1 as shown in Table 39.

Table 39. System option register 1 (SIMOPT1) (address $1802)

Bit76543210

WCOPE COPCLKS STOPE RFEN TRE TRH BKGDPE

Reset 1 0 0 — 0 0 1 0

= Reserved

Table 40. SIMOPT1 register field descriptions

Field Description

COPE

COP Enable — This control bit enables the COP watchdog. This bit is a write-once bit so that only the first

write after reset is honored. Reset sets the COPE bit.

0 COP Watchdog disabled.

1 COP Watchdog enabled.

COPCLKS

COP Clock Select — This control bit selects the clock source for the COP watchdog timer. This bit is a

write-once bit so that only the first write after reset is honored. This bit is cleared by an MCU reset.

0 Select the LFO oscillator output.

1 Select the CPU bus clock.

STOPE

STOP Mode Select — This control bit enables/disables the STOP instruction to enter a STOP mode defined

by the SPMSCR2 register. This bit is a write-once bit so that only the first write after reset is honored. This

bit is cleared by an MCU reset.

0 Disable STOP modes.

1 Enable STOP modes.

RFEN

RF Module Enable — This bit enables or disables the RF module. This bit is not affected by any reset or

power on after STOP exit. It is only initialized at the first power up. This bit can be written anytime.

1 RF module enabled.

0 RF module disabled.

TRE

Temperature Restart Enable — This control bit enables the temperature restart circuit to interrupt the MCU

after being shutdown at either a very high or very low temperature. This bit is cleared by an MCU reset.

0 Temperature restart disabled.

1 Temperature restart enabled.

TRH

Temperature Restart Level — This control bit selects whether the temperature restart circuit will interrupt the

MCU after being shutdown on returning from either a very high or very low temperature. This bit is cleared

by an MCU reset.

0 Temperature restart interrupts MCU on return from a very low temperature.

1 Temperature restart interrupts MCU on return from a very high temperature.

BKGDPE

BKGD Pin Enable — BKGDPE can be used to allow the BKGD/PTA4 pin to be shared in applications as an

output-only general purpose I/O pin:

0 BKGD function disabled, PTA4 output-only enabled.

1 BKGD function enabled, PTA4 disabled.

Reserved Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

47 / 182

7.11.3 System Operation Register 2 (SIMOPT2)

The following clock source and frequency selections are available using the system

option register 2 as shown in Table 41.

Table 41. System option register 2 (SIMOPT2) (address $1803)

Bit76543210

WCOPT[2:0] LFOSEL TCLKDIV BUSCLKS[1:0]

Reset01110000

= Reserved

Table 42. SIMOPT2 register field descriptions

Field Description

Reserved Reserved

6:4

COPT[2:0]

COP Watchdog Time Out — These control bits select the timeout period for the COP watchdog timer

as given in Table 28. These bits are set by an MCU reset to select the longest watchdog timeout

period. These bits are write-once after power up.

LFOSEL

TPM1 Channel 0 Clock Source — This bit determines which signal is connected to the TPM1 Channel

0, see Section 11 "Timer Pulse-Width Module".

0 Select clock input driven by PTA2.

1 Select clock input driven by the LFO.

TCLKDIV

TPM1 Channel 0 Clock Source Divider — The divider for the clock source for TPM1 Channel 0, see

Section 11 "Timer Pulse-Width Module".

0 Select RFM Dx clock source divided by 1.

1 Select RFM Dx clock source divided by 8.

1:0

BUSCLKS[1:0]

Bus Clock Select — Bus clock frequency selection by changing HFO FLL ratio as shown in Figure 2.

The bus clock frequency is always the HFO frequency divided by two. These bits are cleared by a

reset and can be written at any time.

00 Bus Frequency = 4 MHz (HFO = 8 MHz)

01 Bus Frequency = 2 MHz (HFO = 4 MHz)

10 Bus Frequency = 1 MHz (HFO = 2 MHz)

11 Bus Frequency = 0.5 MHz (HFO = 1 MHz)

7.11.4 System Power Management Status and Control 1 Register (SPMSC1)

Table 43. System power management status and control 1 register (SPMSC1) (address $1809)

Bit 7 6 5 4 3 2 1[1] 0

R LVDF 0

W LVDACK LVDIE LVDRE[2] LVDSE LVDE[2] 0 BGBE

Reset00011100

= Reserved

[1] Bit 1 is a reserved bit that must always be written to 0.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

48 / 182

[2] This bit can be written only one time after reset. Additional writes are ignored.

Table 44. SPMSC1 register field descriptions

Field Description

LVDF

Low-Voltage Detect Flag — Provided LVDE = 1, this read-only status bit indicates a low-voltage detect

event.

LVDACK

Low-Voltage Detect Acknowledge — This write-only bit is used to acknowledge low voltage detection errors

(write 1 to clear LVDF). Reads always return logic 0.

LVDIE

Low-Voltage Detect Interrupt Enable — This read/write bit enables hardware interrupt requests for LVDF.

0 Hardware interrupt disabled (use polling)

1 Request a hardware interrupt when LVDF = 1

LVDRE

Low-Voltage Detect Reset Enable — This read/write bit enables LVDF events to generate a hardware reset

(provided LVDE = 1).

0 LVDF does not generate hardware resets

1 Force an MCU reset when LVDF = 1

LVDSE

Low-Voltage Detect Stop Enable — Provided LVDE = 1, this read/write bit determines whether the low-

voltage detect function operates when the MCU is in STOP mode.

0 Low-voltage detect disabled during STOP mode

1 Low-voltage detect enabled during STOP mode

LVDE

Low-Voltage Detect Enable — This read/write bit enables low-voltage detect logic and qualifies the

operation of other bits in this register.

0 LVD logic disabled

1 LVD logic enabled

Reserved

Reserved Bit — This bit is reserved should not be altered by the user. Any read returns a logical zero. Any

write should be a logical zero.

BGBE

Band gap Buffer Enable — The BGBE bit is used to enable an internal buffer for the band gap voltage

reference for use by the ADC module on one of its internal channels.

0 Band gap buffer disabled

1 Band gap buffer enabled

7.11.5 System Power Management Status and Control 2 Register (SPMSC2)

This register is used to configure the STOP mode behavior of the MCU.

Table 45. System power management status and control 2 register (SPMSC2) (address $180A)

Bit76543210

R 0 0 0 PDF 0 0

W PPDACK PDC[1] 0

Power-

on reset 00000000

Any other

reset 0 0 U U 0 0 0 0

= Reserved

[1] This bit can be written only one time after reset. Additional writes are ignored.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

49 / 182

Table 46. SPMSC2 register field descriptions

Field Description

7:5

Reserved Reserved Bits — These bits are reserved should not be altered by the user. Any read returns a logical zero.

PDF

Power Down Flag — This read-only status bit indicates the MCU has recovered from STOP1 mode.

0 MCU has not recovered from STOP1 mode

1 MCU recovered from STOP1 mode

Reserved Reserved Bit — This bit is reserved should not be altered by the user. Any read returns a logical zero.

PPDACK Partial Power Down Acknowledge — Writing a logic 1 to PPDACK clears the PDF bit.

PDC

Power Down Control — The PDC bit controls entry into the power down (STOP1) mode

0 Power down mode are disabled

1 Power down mode are enabled

Reserved

Reserved Bit — This bit is reserved should not be altered by the user. Any read returns a logical zero. Any

write should be a logical zero.

7.11.6 System Power Management Status and Control 3 Register (SPMSC3)

Table 47. System power management status and control 3 register (SPMSC3) (address $180C)

Bit76543210

R LVWF 0 0 0 0 0

W LVWACK LVDV LVWV

Power-

on reset 0[1] 0000000

LVD reset 0[1] 0 U U 0 0 0 0

Any other

reset 0[1] 0 U U 0 0 0 0

= Reserved U = Unaffected by reset

[1] LVWF will be set in the case when VSupply transitions below the trip point or after reset and VSupply is already below VLVW.

Table 48. SPMSC3 register field descriptions

Field Description

LVWF

Low-Voltage Warning Flag — The LVWF bit indicates the low voltage warning status.

0 Low-voltage warning not present

1 Low-voltage warning is present or was present

LVWACK

Low-Voltage Warning Acknowledge — The LVWF bit indicates the low voltage warning status.

Writing a logic 1 to LVWACK clears LVWF to a logic 0 if a low voltage warning is not present.

LVDV

Low-Voltage Detect Voltage Select — The LVDV bit selects the LVD trip point voltage (VLVD).

0 Low-trip point selected (VLVD = VLVDL)

1 High-trip point selected (VLVD = VLVDH)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

50 / 182

Field Description

LVWV

Low-Voltage Warning Voltage Select — The LVWV bit selects the LVW trip point voltage (VLVW).

0 Low-trip point selected (VLVW = VLVDL)

1 High-trip point selected (VLVW = VLVDH)

3:0

Reserved Reserved Bits — These bits are reserved should not be altered by the user. Any read returns a logical zero.

7.11.7 Free-Running Counter (FRC)

For additional information on the FRC, see Section 12.8 "Free-Running Counter (FRC)".

Once enabled, the FRC continues to increment (and subsequently rolls over) in RUN,

STOP4, STOP3, and STOP1 modes, unless halted as defined below.

Table 49. PMCT register (address $180B)

Bit76543210

W FRC_CLR

FRC_

EN_HALT FPAGE

Reset 0 — 0 — — — — 0

= Reserved

Table 50. PMCT register field descriptions

Field Description

FRC_CLR

FRC_CLR — Write-only, free-running counter clear control bit

0 No action taken.

1 Clears the counter value, for example, resets to 0x0000 (may also start at 0x0001 due to the inbound

clock incrementing the counter on both rising and falling edges to achieve ~2 kHz from the 1 kHz LFO

source).

FRC_

EN_HALT

FRC_EN_HALT— Read/Write, free-running-counter enable(d) / halt(ed) control bit

0 Free-running-counter is halted in place.

1 Free-running-counter is released and begins/continues to increment.

FPAGE

FPAGE — Write-only, free-running-counter control access bit

0 Addresses $1808 and $1809 revert to the PMCRSC and PMCSC1 registers and the FRC remains

functioning as last controlled while FPAGE had been 1.

1 PMCT bits 7 and 5 functions as described above, and addresses $1808 and $1809 become the FRC_

TIMER[15:0] result registers holding the 16-bit free-running-counter value.

Table 51. FRC_TIMER register, MSbyte and LSbyte (address $1808 and $1809)

Bit76543210

R FRC_TIMER[15:8]

Reset00000000

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

51 / 182

Bit76543210

R FRC_TIMER[7:0]

Reset00000000

= Reserved

7.11.7.1 Software handler requirements

Application developers should adhere to the following steps when entering and exiting

software handler for the FRC:

1. Disable all interrupt sources

2. Write PMCT[0] = 1

3. Control PMCT and/or read FRC_TIMER as needed

4. Write PMCT[0] = 0

5. Enable all interrupt sources.

7.11.7.2 Initialization recommendations

Due to being clocked by the LFO which operates contentiously while power is applied,

application developers that desire the FRC to start from 0x0000 may initialize the FRC by

the following process:

1. Disable all interrupt sources

2. Write PMCT[0] = 1

3. Write PMCT[5] = 0 and PMCT[7] = 1

4. Write PMCT[5] = 1

5. Write PMCT[0] = 0

6. Re-enable appropriate interrupt sources.

These steps can be ignored if the application does not require the FRC to start from

0x0000.

7.12 System STOP exit status register (SIMSES)

The SIMSES register at $180D can be used to determine the source of an MCU

wakeup from the STOP modes. The flags are as shown in Table 52. All of the flags are

automatically cleared when the MCU goes into a STOP mode. Writes to any of these bits

are ignored.

Table 52. SIM STOP exit status (SIMSES) (address $180D)

Bit76543210

R KBF IRQF TRF PWUF LFF RFF

Reset00000000

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

52 / 182

Table 53. SIMSES register field descriptions

Field Description

7-6

Reserved

Reserved Bits — These bits are reserved for NXP firmware control. Application software shall assure that

this bit is never overwritten.

KBF

Keyboard Flag — This bit indicates that any keyboard pin caused the last exit from STOP mode.

0 Keyboard pin did not cause the last exit from STOP mode

1 Keyboard pin caused the last exit from STOP mode

IRQF

IRQ Flag — This bit indicates that IRQ pin caused the last exit from STOP mode.

0 IRQ pin did not cause the last exit from STOP mode

1 IRQ pin caused the last exit from STOP mode

TRF

Temperature Restart Flag — This bit indicates that the temperature restart module caused the last exit from

STOP mode.

0 TR module did not cause the last exit from STOP mode

1 TR module caused the last exit from STOP mode

PWUF

PWU Flag — This bit indicates that the PWU module caused the last exit from STOP mode.

0 PWU module did not cause the last exit from STOP mode

1 PWU module caused the last exit from STOP mode

LFF

LFR Flag — This bit indicates that the LFR module caused the last exit from STOP mode.

0 LFR module did not cause the last exit from STOP mode

1 LFR module caused the last exit from STOP mode

RFF

RFM Flag — This bit indicates that the RFM module caused the last exit from STOP mode.

0 RFM module did not cause the last exit from STOP mode

1 RFM module caused the last exit from STOP mode

8 General Purpose I/O

This section explains software controls related to general purpose input/output (I/O) and

pin control. The FXTH87E has seven general-purpose I/O pins which are comprised of a

general use 5-bit port A and a 2-bit port B.

PTA[4:0] pins are shared with on-chip peripheral functions. PTB[1:0] pins are GPIO only

and are mutually exclusive with the LF receiver, such that PTB[1:0] pins become high

impedance when the LF is enabled (see Section 8.5 "Port B registers" for additional

details regarding mutually exclusive operations). The peripheral modules have priority

over the general purpose I/O so that when a peripheral is enabled, the general purpose

I/O functions associated with the shared pins are disabled. After reset, the shared

peripheral functions are disabled so that the pins are controlled by the general purpose

I/O. All of the general purpose I/O are configured as inputs (PTxDDn = 0) with pullup

devices disabled (PTxPEn = 0).

To avoid extra current drain from floating input pins, the user’s application software

must configure these pins so that they do not float (see Section 8.1 "Unused pin

configuration").

Reading and writing of general purpose I/O is performed through the port data registers.

The direction, either input or output, is controlled through the port data direction registers.

The general purpose I/O port function for an individual pin is illustrated in the block

diagram in Figure 13.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

53 / 182

Port read

data

PTxDn

PTxDDn

Output enable

Output data

Input data

aaa-028001

SYNCHRONIZER

BUSCLKS

Figure 13. General purpose I/O block diagram

RPD

RPU

PTx

PEn

PTxD

PTx

KBA

KBI int

KBM

KBED

aaa-028002

]

only

PTx

PEn

KBED

]

only

Read

Figure 14. General purpose I/O logic

Table 54. Truth table for pullup and pulldown resistors

PTAPE[3:0]

(pull enable)

PTADD[3:0]

(data direction)

KBIPE[3:0]

(KBI pin enable)

KBEDG[3:0]

(KBI Edge Select)

Pullup Pulldown

0 0 x x disabled disabled

1 0 0 x enabled disabled

x 1 x x disabled disabled

1 0 1 0 enabled disabled

1 0 1 1 disabled enabled

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

54 / 182

PTBPE[1:0]

(pull enable)

PTBDD[1:0]

(data direction)

KBIPE[3:0]

(KBI pin enable)

KBEDG[3:0]

(KBI Edge Select)

Pullup Pulldown

0 0 x x disabled x

1 0 x x enabled x

x 1 x x disabled x

The data direction control bit (PTxDDn) determines whether the output buffer for the

associated pin is enabled, and also controls the source for port data register reads. The

input buffer for the associated pin is always enabled unless the pin is enabled as an

analog function.

When a shared digital function is enabled for a pin, the output buffer is controlled by the

shared function. However, the data direction register bit still controls the source for reads

of the port data register.

When a shared analog function is enabled for a pin, both the input and output buffers

are disabled. A value of 0 is read for any port data bit where the bit is an input (PTxDDn

= 0) and the input buffer is disabled. In general, whenever a pin is shared with both an

alternate digital function and an analog function, the analog function has priority such that

if both the digital and analog functions are enabled, the analog function controls the pin.

It is a good programming practice to write to the port data register before changing the

direction of a port pin to become an output. This ensures that the pin will not be driven

momentarily with an old data value that happened to be in the port data register.

An internal pullup device can be enabled for each port pin by setting the corresponding

bit in one of the pullup enable registers (PTxPEn). The pullup device is disabled if the

pin is configured as an output by the general purpose I/O control logic or any shared

peripheral function regardless of the state of the corresponding pullup enable register bit.

The pullup device is also disabled if the pin is controlled by an analog function.

8.1 Unused pin configuration

Any general purpose I/O pins which are not used in the application must be properly

configured to avoid a floating input that could cause excessive supply current, IDD.

When the device comes out of the reset state the NXP supplied firmware will not

configure any of the general purpose I/O pins.

Recommended configuration methods are:

1. Configure the general purpose I/O pin as an input (PTxDDn = 0) with the pin

connected to the VDD source; use a pullup resistor of 10-51 kΩ to assure sufficient

noise immunity.

2. Configure the general purpose I/O pin as an input (PTxDDn = 0) with the internal

pullup activated (PTxPEn = 1) and leave the pin disconnected.

3. Configure the general purpose I/O pin as an output (PTxDDn = 1) and drive the pin

low (PTxDn = 0) and leave the pin disconnected.

In cases where GPIOs are directly connected to AVDD, VDD, AVSS, VSS or RVSS, user

application should configure the GPIO as an input with the internal pull-up disabled,

in order to prevent software code faults from causing excessive supply current states

should these pins become outputs.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

55 / 182

8.2 Pin behavior in STOP modes

Pin behavior following execution of a STOP instruction depends on the STOP mode that

is entered. An explanation of pin behavior for the various STOP modes follows:

•In STOP1 mode, all internal registers including general purpose I/O control and data

registers are powered off. Each of the pins assumes its default reset state (input buffer,

output buffer and internal pullup disabled). Upon exit from STOP1, all pins must be

reconfigured the same as if the MCU had been reset.

•In STOP4 mode, all pin states are maintained because internal logic stays powered up.

Upon recovery, all pin functions are the same as before entering STOP4.

8.3 General purpose I/O registers

This section provides information about the registers associated with the general purpose

I/O ports and pin control functions. These general purpose I/O registers are located in

page zero of the memory map and the pin control registers are located in the high page

8.4 Port A registers

Port A general purpose I/O function is controlled by the registers described in this

section.

Table 55. Port A data register (PTAD) (address $0000)

Bit76543210

WPTAD[4:0]

Reset00000000

= Reserved

Table 56. Port A data register field descriptions

Field Description

4:0

PTAD[4:0]

Port A Data Register Bit — For port A pins that are inputs, reads return the logic level on the pin. For port A

pins that are configured as outputs, reads return the last value written to this register.

Writes are latched into all bits of this register. For port A pins that are configured as outputs, the logic level

is driven out the corresponding MCU pin.

Reset forces PTAD to all 0s, but these 0s are not driven out the corresponding pins because reset also

configures all port pins as high-impedance inputs with pullups disabled.

Note: PTA4 can be used as output-only.

Table 57. Internal pullup enable for port A register (PTAPE) (address $0001)

Bit76543210

WPTAPE[3:0]

Reset00000000

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

56 / 182

= Reserved

Table 58. Port A register pullup enable field descriptions

Field Description

3:0

PTAPE[3:0]

Internal Pullup Enable for Port A Bit n — Each of these control bits determines if the internal pullup device is

enabled for the associated PTA pin. For port A pins that are configured as outputs, these bits have no effect

and the internal pullup devices are disabled.

0 Internal pullup device disabled for port A bit n.

1 Internal pullup device enabled for port A bit n.

Table 59. Data direction for port A register (PTADD) (address $0003)

Bit76543210

WPTADD[3:0]

Reset00000000

= Reserved

Table 60. Port A data direction field descriptions

Field Description

3:0

PTADD[3:0]

Data Direction for Port A Bit n — These read/write bits control the direction of port A pins and what is read

for PTADD reads.

0 Input (output driver disabled) and reads return the pin value.

1 Output driver enabled for port A bit n and PTADD reads return the contents of PTADDn. PTA4 is input-

only; therefore, bit 4 will always be 0.

8.5 Port B registers

Port B PTB[1:0] functions are multiplexed with the LF receiver block such that the port

B GPIOs become high impedance when the LF block has been enabled. When the LF

block is disabled, port B pins operate as described here.

Table 61. Port B data register (PTBD) (address $0004)

Bit76543210

WPTBD[1:0]

Reset00000000

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

57 / 182

Table 62. Port B data register field descriptions

Field Description

1:0

PTBD

[1:0]

Port B Data Register Bit n — For port B pins that are inputs, reads return the logic level on the pin. For port

B pins that are configured as outputs, reads return the last value written to this register.

Writes are latched into all bits of this register. For port B pins that are configured as outputs, the logic level

is driven out the corresponding MCU pin.

Reset forces PTBD to all 0s, but these 0s are not driven out the corresponding pins because reset also

configures all port pins as high-impedance inputs with pullups disabled.

Table 63. Internal pullup enable for port B register (PTBPE) (address $0005)

Bit76543210

WPTBPE[1:0]

Reset00000000

= Reserved

Table 64. Port B register pullup enable field descriptions

Field Description

1:0

PTBPE[1:0]

Internal Pullup Enable for Port B Bit n — Each of these control bits determines if the internal pullup device is

enabled for the associated PTB pin. For port B pins that are configured as outputs, these bits have no effect

and the internal pullup devices are disabled.

0 Internal pullup device disabled for port B bit n.

1 Internal pullup device enabled for port B bit n.

Table 65. Data direction for port B register (PTBDD) (address $0007)

Bit76543210

WPTBDD[1:0]

Reset00000000

= Reserved

Table 66. Port B data direction field descriptions

Field Description

1:0

PTBDD[1:0]

Data Direction for Port B Bit n — These read/write bits control the direction of port B pins and what is read

for PTBDD reads.

0 Input (output driver disabled) and reads return the pin value.

1 Output driver enabled for port B bit n and PTBDD reads return the contents of PTBDDn.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

58 / 182

9 Keyboard Interrupt

The FXTH87E has a KBI module with general purpose I/O pins.

9.1 Features

The KBI features include:

•Up to four keyboard interrupt pins with individual pin enable bits.

•Each keyboard interrupt pin is programmable as falling edge (or rising edge) only, or

both falling edge and low level (or both rising edge and high level) interrupt sensitivity.

•One software enabled keyboard interrupt.

•Exit from low-power modes.

9.2 Modes of operation

This section defines the KBI operation in WAIT, STOP, and BACKGROUND DEBUG

modes.

9.2.1 KBI in STOP modes

The KBI operates asynchronously in STOP4 mode if enabled before executing the STOP

instruction. Therefore, an enabled KBI pin (KBPE[3:0]) can be used to bring the MCU out

of STOP4 mode if the KBI interrupt is enabled (KBIE = 1).

During STOP1 mode, the KBI is disabled. In some systems, the pins associated with

the KBI may be sources of wakeup from STOP1, see the STOP modes section in the

Section 5 "Modes of operation". Upon wakeup from STOP1 mode, the reset vector is

taken but no interrupt is generated (even if interrupt enabled).

The wake up is triggered when the pin is low (even with no edge), whatever the settings

are (raising edge or falling edge). So in STOP1 as long as the pin is low the reset vector

will be taken.

9.2.2 KBI in ACTIVE BACKGROUND mode

When the microcontroller is in ACTIVE BACKGROUND mode, the KBI will continue to

operate normally.

9.3 Block diagram

The block diagram for the keyboard interrupt module is shown in Figure 15.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

59 / 182

CLR

SYNCHRONIZER

STOP BYPASS

STOP

KBACK

RESET KBF

KBF

aaa-02

8003

KBMOD

VDD BUSCLK

KBIPE0

KBEDG0

KBIPEn

KBEDGn

Figure 15. KBI block diagram

9.4 External signal description

The KBI input pins can be used to detect either falling edges, or both falling edge and low

level interrupt requests. The KBI input pins can also be used to detect either rising edges,

or both rising edge and high level interrupt requests. PTA[3:0] map to KBIPE and KBEDG

function bits [3:0].

The signal properties of KBI are shown in Table 67.

Table 67. Signal properties

Signal Function I/O

KBIPn Keyboard interrupt pins I

9.5 Register definitions

The KBI includes three registers:

•An 4-bit pin status and control register.

•An 4-bit pin enable register.

•An 4-bit edge select register.

9.5.1 KBI status and control register (KBISC)

KBISC contains the status flag and control bits, which are used to configure the KBI.

Table 68. KBI status and control register (address $000C)

Bit76543210

R 0 0 0 0 KBF 0

W KBACK KBIE KBMOD

Reset00000000

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

60 / 182

Table 69. KBISC register field descriptions

Field Description

7:4 Unused register bits, always read 0.

KBF

Keyboard Interrupt Flag — KBF indicates when a keyboard interrupt is detected. Writes have no effect on

KBF.

0 No keyboard interrupt detected.

1 Keyboard interrupt detected.

KBACK

Keyboard Acknowledge — Writing a 1 to KBACK is part of the flag clearing mechanism. KBACK always

reads as 0.

KBIE

Keyboard Interrupt Enable — KBIE determines whether a keyboard interrupt is requested.

0 Keyboard interrupt request not enabled.

1 Keyboard interrupt request enabled.

KBMOD

Keyboard Detection Mode — KBMOD (along with the KBEDG bits) controls the detection mode of the

keyboard interrupt pins.

0 Keyboard detects edges only.

1 Keyboard detects both edges and levels.

9.5.2 KBI pin enable register (KBIPE)

KBIPE contains the pin enable control bits.

Table 70. KBI pin enable register (address $000D)

Bit76543210

WKBIPE3 KBIPE2 KBIPE1 KBIPE0

Reset00000000

= Reserved

Table 71. KBIPE register field descriptions

Field Description

3:0

KBIPEn

Keyboard Pin Enables — Each of the KBIPEn bits enable the corresponding keyboard interrupt pin.

0 Pin not enabled as keyboard interrupt.

1 Pin enabled as keyboard interrupt.

9.5.3 KBI edge select register (KBIES)

KBIES contains the edge select control bits.

Table 72. KBI edge select register (address $000E)

Bit76543210

WKBEDG3 KBEDG2 KBEDG1 KBEDG0

Reset00000000

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

61 / 182

= Reserved

Table 73. KBIES register field descriptions

Field Description

3:0

KBEDGn

Keyboard Edge Selects — Each of the KBEDGn bits selects the falling edge/low level or rising edge/high

level function of the corresponding pin).

0 Falling edge/low level.

1 Rising edge/high level.

9.6 Functional description

This on-chip peripheral module is called a keyboard interrupt (KBI) module because

originally it was designed to simplify the connection and use of row-column matrices

of keyboard switches. However, these inputs are also useful as extra external interrupt

inputs and as an external means of waking the MCU from STOP or WAIT low-power

modes.

The KBI module allows up to eight pins to act as additional interrupt sources. Writing to

the KBIPE[3:0] bits in the keyboard interrupt pin enable register (KBIPE) independently

enables or disables each KBI pin. Each KBI pin can be configured as edge sensitive or

edge and level sensitive based on the KBMOD bit in the keyboard interrupt status and

control register (KBISC). Edge sensitive can be software programmed to be either falling

or rising; the level can be either low or high. The polarity of the edge or edge and level

sensitivity is selected using the KBEDG[3:0] bits in the keyboard interrupt edge select

Synchronous logic is used to detect edges. Prior to detecting an edge, enabled keyboard

inputs must be at the reset logic level. A falling edge is detected when an enabled

keyboard input signal is seen as a logic 1 (the reset level) during one bus cycle and then

a logic 0 (the asserted level) during the next cycle. A rising edge is detected when the

input signal is seen as a logic 0 during one bus cycle and then a logic 1 during the next

cycle.

9.6.1 Edge only sensitivity

A valid edge on an enabled KBI pin will set KBF in KBISC. If KBIE in KBISC is set, an

interrupt request will be presented to the CPU. Clearing of KBF is accomplished by

writing a 1 to KBACK in KBISC.

9.6.2 Edge and level sensitivity

A valid edge or level on an enabled KBI pin will set KBF in KBISC. If KBIE in KBISC is

set, an interrupt request will be presented to the CPU. Clearing of KBF is accomplished

by writing a 1 to KBACK in KBISC provided all enabled keyboard inputs are at their reset

levels. KBF will remain set if any enabled KBI pin is asserted while attempting to clear by

writing a 1 to KBACK.

9.6.3 KBI pullup/pulldown resistors

The KBI pins can be configured to use an internal pullup/pulldown resistor using the

associated I/O port pullup enable register. If an internal resistor is enabled, the KBIES

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

62 / 182

(KBEDG[3:0] = 1).

9.6.4 KBI initialization

When a keyboard interrupt pin is first enabled it is possible to get a false keyboard

interrupt flag. To prevent a false interrupt request during keyboard initialization, the user

should do the following:

1. Mask keyboard interrupts by clearing KBIE in KBISC.

2. Enable the KBI polarity by setting the appropriate KBEDGn bits in KBIES.

3. If using internal pullup/pulldown device, configure the associated pullup enable bits in

PTAPE[3:0].

4. Enable the KBI pins by setting the appropriate KBIPE[3:0] bits in KBIPE.

5. Write to KBACK in KBISC to clear any false interrupts.

6. Set KBIE in KBISC to enable interrupts.

10 Central processing unit

10.1 Introduction

This section provides summary information about the registers, addressing modes, and

instruction set of the CPU of the HCS08 Family. For a more detailed discussion, refer to

the HCS08 Family Reference Manual, volume 1, NXP Semiconductor document order

number HCS08RMV1/D.

The HCS08 CPU is fully source- and object-code-compatible with the M68HC08 CPU.

Several instructions and enhanced addressing modes were added to improve C compiler

efficiency and to support a new BACKGROUND DEBUG system which replaces the

monitor mode of earlier M68HC08 microcontrollers (MCU).

10.2 Features

Features of the HCS08 CPU include:

•Object code fully upward-compatible with M68HC05 and M68HC08 Families

•All registers and memory are mapped to a single 64-Kbyte address space

•16-bit stack pointer (any size stack anywhere in 64-Kbyte address space)

•16-bit index register (H:X) with powerful indexed addressing modes

•8-bit accumulator (A)

•Many instructions treat X as a second general-purpose 8-bit register

•Seven addressing modes:

–Inherent — Operands in internal registers

–Relative — 8-bit signed offset to branch destination

–Immediate — Operand in next object code byte(s)

–Direct — Operand in memory at 0x0000–0x00FF

–Extended — Operand anywhere in 64-Kbyte address space

–Indexed relative to H:X — Five submodes including auto-increment

–Indexed relative to SP — Improves C efficiency dramatically

•Memory-to-memory data move instructions with four address mode combinations

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

63 / 182

•Overflow, half-carry, negative, zero, and carry condition codes support conditional

branching on the results of signed, unsigned, and binary-coded decimal (BCD)

operations

•Efficient bit manipulation instructions

•Fast 8-bit by 8-bit multiply and 16-bit by 8-bit divide instructions

•STOP and WAIT instructions to invoke low-power operating modes

10.3 Programmer’s model and CPU registers

Figure 16 shows the five CPU registers. CPU registers are not part of the memory map.

aaa-028004

accumulator

index register (low)index register (high)

16-bit index register H:X

stack pointer

condition code register

V 1 1 H I N Z C

CCR

Carry

Zero

Interrupt mask

Two's complement overflow

Half-carry (from bit 3)

Negative

program counter pointer

Figure 16. CPU registers

10.3.1 Accumulator (A)

The A accumulator is a general-purpose 8-bit register. One operand input to the

arithmetic logic unit (ALU) is connected to the accumulator and the ALU results are often

stored into the A accumulator after arithmetic and logical operations. The accumulator

can be loaded from memory using various addressing modes to specify the address

where the loaded data comes from, or the contents of A can be stored to memory using

various addressing modes to specify the address where data from A will be stored.

Reset has no effect on the contents of the A accumulator.

10.3.2 Index register (H:X)

This 16-bit register is actually two separate 8-bit registers (H and X), which often work

together as a 16-bit address pointer where H holds the upper byte of an address and X

holds the lower byte of the address. All indexed addressing mode instructions use the

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

64 / 182

full 16-bit value in H:X as an index reference pointer; however, for compatibility with the

earlier M68HC05 Family, some instructions operate only on the low-order 8-bit half (X).

Many instructions treat X as a second general-purpose 8-bit register that can be used

to hold 8-bit data values. X can be cleared, incremented, decremented, complemented,

negated, shifted, or rotated. Transfer instructions allow data to be transferred from A or

transferred to A where arithmetic and logical operations can then be performed.

For compatibility with the earlier M68HC05 Family, H is forced to 0x00 during reset.

Reset has no effect on the contents of X.

10.3.3 Stack pointer (SP)

This 16-bit address pointer register points at the next available location on the automatic

last-in-first-out (LIFO) stack. The stack may be located anywhere in the 64-Kbyte address

space that has RAM and can be any size up to the amount of available RAM. The stack

is used to automatically save the return address for subroutine calls, the return address

and CPU registers during interrupts, and for local variables. The AIS (add immediate to

stack pointer) instruction adds an 8-bit signed immediate value to SP. This is most often

used to allocate or deallocate space for local variables on the stack.

SP is forced to 0x00FF at reset for compatibility with the earlier M68HC05 Family.

HCS08 programs normally change the value in SP to the address of the last location

(highest address) in on-chip RAM during reset initialization to free up direct page RAM

(from the end of the on-chip registers to 0x00FF).

The RSP (reset stack pointer) instruction was included for compatibility with the

M68HC05 Family and is seldom used in new HCS08 programs because it only affects

the low-order half of the stack pointer.

10.3.4 Program counter (PC)

The program counter is a 16-bit register that contains the address of the next instruction

or operand to be fetched.

During normal program execution, the program counter automatically increments to the

next sequential memory location every time an instruction or operand is fetched. Jump,

branch, interrupt, and return operations load the program counter with an address other

than that of the next sequential location. This is called a change-of-flow.

During reset, the program counter is loaded with the reset vector that is located at

0xFFFE and 0xFFFF. The vector stored there is the address of the first instruction that

will be executed after exiting the reset state.

10.3.5 Condition code register (CCR)

The 8-bit condition code register contains the interrupt mask (I) and five flags that

indicate the results of the instruction just executed. Bits 6 and 5 are set permanently to

1. The following paragraphs describe the functions of the condition code bits in general

terms. For a more detailed explanation of how each instruction sets the CCR bits, refer to

the HCS08 Family Reference Manual, volume 1, NXP Semiconductors document order

number HCS08RMv1.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

65 / 182

aaa-028005

condition code register

V 1 1 H I N Z C CCR

Carry

Zero

Interrupt mask

Two's complement overflow

Half-carry (from bit 3)

Negative

Figure 17. Condition code register

Table 74. CCR register field descriptions

Field Description

Two’s Complement Overflow Flag — The CPU sets the overflow flag when a two’s

complement overflow occurs. The signed branch instructions BGT, BGE, BLE, and

BLT use the overflow flag.

0 No overflow

1 Overflow

Half-Carry Flag — The CPU sets the half-carry flag when a carry occurs between

accumulator bits 3 and 4 during an add-without-carry (ADD) or add-with-carry

(ADC) operation. The half-carry flag is required for binary-coded decimal (BCD)

arithmetic operations. The DAA instruction uses the states of the H and C

condition code bits to automatically add a correction value to the result from a

previous ADD or ADC on BCD operands to correct the result to a valid BCD value.

0 No carry between bits 3 and 4

1 Carry between bits 3 and 4

Interrupt Mask Bit — When the interrupt mask is set, all maskable CPU interrupts

are disabled. CPU interrupts are enabled when the interrupt mask is cleared.

When a CPU interrupt occurs, the interrupt mask is set automatically after the CPU

registers are saved on the stack, but before the first instruction of the interrupt

service routine is executed.

Interrupts are not recognized at the instruction boundary after any instruction that

clears I (CLI or TAP). This ensures that the next instruction after a CLI or TAP will

always be executed without the possibility of an intervening interrupt, provided I

was set.

0 Interrupts enabled

1 Interrupts disabled

Negative Flag — The CPU sets the negative flag when an arithmetic operation,

logic operation, or data manipulation produces a negative result, setting bit 7 of the

result. Simply loading or storing an 8-bit or 16-bit value causes N to be set if the

most significant bit of the loaded or stored value was 1.

0 Non-negative result

1 Negative result

Zero Flag — The CPU sets the zero flag when an arithmetic operation, logic

operation, or data manipulation produces a result of 0x00 or 0x0000. Simply

loading or storing an 8-bit or 16-bit value causes Z to be set if the loaded or stored

value was all 0s.

0 Non-zero result

1 Zero result

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

66 / 182

Field Description

Carry/Borrow Flag — The CPU sets the carry/borrow flag when an addition

operation produces a carry out of bit 7 of the accumulator or when a subtraction

operation requires a borrow. Some instructions — such as bit test and branch,

shift, and rotate — also clear or set the carry/borrow flag.

0 No carry out of bit 7

1 Carry out of bit 7

10.4 Addressing modes

Addressing modes define the way the CPU accesses operands and data. In the HCS08,

all memory, status and control registers, and input/output (I/O) ports share a single 64-

Kbyte linear address space so a 16-bit binary address can uniquely identify any memory

location. This arrangement means that the same instructions that access variables in

RAM can also be used to access I/O and control registers or nonvolatile program space.

Some instructions use more than one addressing mode. For instance, move instructions

use one addressing mode to specify the source operand and a second addressing mode

to specify the destination address. Instructions such as BRCLR, BRSET, CBEQ, and

DBNZ use one addressing mode to specify the location of an operand for a test and then

use relative addressing mode to specify the branch destination address when the tested

condition is true. For BRCLR, BRSET, CBEQ, and DBNZ, the addressing mode listed

in the instruction set tables is the addressing mode needed to access the operand to be

tested, and relative addressing mode is implied for the branch destination.

10.4.1 Inherent addressing mode (INH)

In this addressing mode, operands needed to complete the instruction (if any) are located

within CPU registers so the CPU does not need to access memory to get any operands.

10.4.2 Relative addressing mode (REL)

Relative addressing mode is used to specify the destination location for branch

instructions. A signed 8-bit offset value is located in the memory location immediately

following the opcode. During execution, if the branch condition is true, the signed offset

is sign-extended to a 16-bit value and is added to the current contents of the program

counter, which causes program execution to continue at the branch destination address.

10.4.3 Immediate addressing mode (IMM)

In immediate addressing mode, the operand needed to complete the instruction is

included in the object code immediately following the instruction opcode in memory.

In the case of a 16-bit immediate operand, the high-order byte is located in the next

memory location after the opcode, and the low-order byte is located in the next memory

location after that.

10.4.4 Direct addressing mode (DIR)

In direct addressing mode, the instruction includes the low-order eight bits of an address

in the direct page (0x0000–0x00FF). During execution a 16-bit address is formed by

concatenating an implied 0x00 for the high-order half of the address and the direct

address from the instruction to get the 16-bit address where the desired operand is

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

67 / 182

located. This is faster and more memory efficient than specifying a complete 16-bit

address for the operand.

10.4.5 Extended addressing mode (EXT)

In extended addressing mode, the full 16-bit address of the operand is located in the next

two bytes of program memory after the opcode (high byte first).

10.4.6 Indexed addressing mode

Indexed addressing mode has seven variations including five that use the 16-bit H:X

index register pair and two that use the stack pointer as the base reference.

10.4.6.1 Indexed, No Offset (IX)

This variation of indexed addressing uses the 16-bit value in the H:X index register pair

as the address of the operand needed to complete the instruction.

10.4.6.2 Indexed, No Offset with Post Increment (IX+)

This variation of indexed addressing uses the 16-bit value in the H:X index register pair

as the address of the operand needed to complete the instruction. The index register

pair is then incremented (H:X = H:X + 0x0001) after the operand has been fetched. This

addressing mode is only used for MOV and CBEQ instructions.

10.4.6.3 Indexed, 8-Bit Offset (IX1)

This variation of indexed addressing uses the 16-bit value in the H:X index register pair

plus an unsigned 8-bit offset included in the instruction as the address of the operand

needed to complete the instruction.

10.4.6.4 Indexed, 8-Bit Offset with Post Increment (IX1+)

This variation of indexed addressing uses the 16-bit value in the H:X index register pair

plus an unsigned 8-bit offset included in the instruction as the address of the operand

needed to complete the instruction. The index register pair is then incremented (H:X =

H:X + 0x0001) after the operand has been fetched. This addressing mode is used only

for the CBEQ instruction.

10.4.6.5 Indexed, 16-Bit Offset (IX2)

This variation of indexed addressing uses the 16-bit value in the H:X index register pair

plus a 16-bit offset included in the instruction as the address of the operand needed to

complete the instruction.

10.4.6.6 SP-Relative, 8-Bit Offset (SP1)

This variation of indexed addressing uses the 16-bit value in the stack pointer (SP) plus

an unsigned 8-bit offset included in the instruction as the address of the operand needed

to complete the instruction.

10.4.6.7 SP-Relative, 16-Bit Offset (SP2)

This variation of indexed addressing uses the 16-bit value in the stack pointer (SP) plus a

16-bit offset included in the instruction as the address of the operand needed to complete

the instruction.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

68 / 182

10.5 Special operations

The CPU performs a few special operations that are similar to instructions but do not

have opcodes like other CPU instructions. In addition, a few instructions such as STOP

and WAIT directly affect other MCU circuitry. This section provides additional information

about these operations.

10.5.1 Reset sequence

Reset can be caused by a power-on-reset (POR) event, internal conditions such as the

COP (computer operating properly) watchdog, or by assertion of an external active-low

reset pin. When a reset event occurs, the CPU immediately stops whatever it is doing

(the MCU does not wait for an instruction boundary before responding to a reset event).

For a more detailed discussion about how the MCU recognizes resets and determines

the source, refer to Section 7 "Reset, interrupts and system configuration".

The reset event is considered concluded when the sequence to determine whether the

reset came from an internal source is done and when the reset pin is no longer asserted.

At the conclusion of a reset event, the CPU performs a 6-cycle sequence to fetch the

reset vector from 0xFFFE and 0xFFFF and to fill the instruction queue in preparation for

execution of the first program instruction.

10.5.2 Interrupt sequence

When an interrupt is requested, the CPU completes the current instruction before

responding to the interrupt. At this point, the program counter is pointing at the start of

the next instruction, which is where the CPU should return after servicing the interrupt.

The CPU responds to an interrupt by performing the same sequence of operations as

for a software interrupt (SWI) instruction, except the address used for the vector fetch is

determined by the highest priority interrupt that is pending when the interrupt sequence

started.

The CPU sequence for an interrupt is:

1. Store the contents of PCL, PCH, X, A, and CCR on the stack, in that order.

2. Set the I bit in the CCR.

3. Fetch the high-order half of the interrupt vector.

4. Fetch the low-order half of the interrupt vector.

5. Delay for one free bus cycle.

6. Fetch three bytes of program information starting at the address indicated by the

interrupt vector to fill the instruction queue in preparation for execution of the first

instruction in the interrupt service routine.

After the CCR contents are pushed onto the stack, the I bit in the CCR is set to prevent

other interrupts while in the interrupt service routine. Although it is possible to clear the I

bit with an instruction in the interrupt service routine, this would allow nesting of interrupts

(which is not recommended because it leads to programs that are difficult to debug and

maintain).

For compatibility with the earlier M68HC05 MCUs, the high-order half of the H:X index

must use a PSHH instruction at the beginning of the service routine to save H and then

use a PULH instruction just before the RTI that ends the interrupt service routine. It is not

necessary to save H if you are certain that the interrupt service routine does not use any

instructions or auto-increment addressing modes that might change the value of H.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

69 / 182

The software interrupt (SWI) instruction is like a hardware interrupt except that it is not

masked by the global I bit in the CCR and it is associated with an instruction opcode

within the program so it is not asynchronous to program execution.

10.5.3 WAIT mode operation

The WAIT instruction enables interrupts by clearing the I bit in the CCR. It then halts the

clocks to the CPU to reduce overall power consumption while the CPU is waiting for the

interrupt or reset event that will wake the CPU from WAIT mode. When an interrupt or

reset event occurs, the CPU clocks will resume and the interrupt or reset event will be

processed normally.

If a serial BACKGROUND command is issued to the MCU through the BACKGROUND

DEBUG interface while the CPU is in WAIT mode, CPU clocks will resume and the CPU

will enter ACTIVE BACKGROUND mode where other serial BACKGROUND commands

can be processed. This ensures that a host development system can still gain access to

a target MCU even if it is in WAIT mode.

10.5.4 STOP mode operation

Usually, all system clocks, including the crystal oscillator (when used), are halted during

STOP mode to minimize power consumption. In such systems, external circuitry is

needed to control the time spent in STOP mode and to issue a signal to wakeup the

target MCU when it is time to resume processing. Unlike the earlier M68HC05 and

M68HC08 MCUs, the HCS08 can be configured to keep a minimum set of clocks running

in STOP mode. This optionally allows an internal periodic signal to wake the target MCU

from STOP mode.

When a host debug system is connected to the BACKGROUND DEBUG pin (BKGD) and

the ENBDM control bit has been set by a serial command through the BACKGROUND

interface (or because the MCU was reset into ACTIVE BACKGROUND mode), the

oscillator is forced to remain active when the MCU enters STOP mode. In this case, if

a serial BACKGROUND command is issued to the MCU through the BACKGROUND

DEBUG interface while the CPU is in STOP mode, CPU clocks will resume and the CPU

will enter ACTIVE BACKGROUND mode where other serial BACKGROUND commands

can be processed. This ensures that a host development system can still gain access to

a target MCU even if it is in STOP mode.

Recovery from STOP mode depends on the particular HCS08 and whether the oscillator

was stopped in STOP mode. Refer to the Section 5 "Modes of operation" for more

details.

10.5.5 BGND instruction

The BGND instruction is new to the HCS08 compared to the M68HC08. BGND would

not be used in normal user programs because it forces the CPU to stop processing

user instructions and enter the ACTIVE BACKGROUND mode. The only way to resume

execution of the user program is through reset or by a host debug system issuing a GO,

TRACE1, or TAGGO serial command through the BACKGROUND DEBUG interface.

Software-based breakpoints can be set by replacing an opcode at the desired breakpoint

address with the BGND opcode. When the program reaches this breakpoint address, the

CPU is forced to ACTIVE BACKGROUND mode rather than continuing the user program.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

70 / 182

10.6 HCS08 instruction set summary

10.6.1 Instruction set summary nomenclature

The nomenclature listed here is used in the instruction descriptions in Table 75.

10.6.2 Operators

( ) = Contents of register or memory location shown inside parentheses

← = Is loaded with (read: "gets")

& = Boolean AND

| = Boolean OR

#= Boolean exclusive-OR

× = Multiply

÷ = Divide

: = Concatenate

+ = Add

– = Negate (two’s complement)

10.6.3 CPU registers

A = Accumulator

CCR = Condition code register

H = Index register, higher order (most significant) 8 bits

X = Index register, lower order (least significant) 8 bits

PC = Program counter

PCH = Program counter, higher order (most significant) 8 bits

PCL = Program counter, lower order (least significant) 8 bits

SP = Stack pointer

10.6.4 Memory and addressing

M = A memory location or absolute data, depending on addressing mode

M:M + 0x0001 = A 16-bit value in two consecutive memory locations. The higher-order

(most significant) 8 bits are located at the address of M, and the lower-order (least

significant) 8 bits are located at the next higher sequential address.

10.6.5 Condition code register (CCR) bits

V = Two’s complement overflow indicator, bit 7

H = Half carry, bit 4

I = Interrupt mask, bit 3

N = Negative indicator, bit 2

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

71 / 182

Z = Zero indicator, bit 1

C = Carry/borrow, bit 0 (carry out of bit 7)

10.6.6 CCR activity notation

– = Bit not affected

0 = Bit forced to 0

1 = Bit forced to 1

Þ = Bit set or cleared according to results of operation

U = Undefined after the operation

10.6.7 Machine coding notation

dd = Low-order 8 bits of a direct address 0x0000–0x00FF (high byte assumed to be 0x00)

ee = Upper 8 bits of 16-bit offset

ff = Lower 8 bits of 16-bit offset or 8-bit offset

ii = One byte of immediate data

jj = High-order byte of a 16-bit immediate data value

kk = Low-order byte of a 16-bit immediate data value

hh = High-order byte of 16-bit extended address

ll = Low-order byte of 16-bit extended address

rr = Relative offset

10.6.8 Source form

Everything in the source forms columns, except expressions in italic characters, is literal

information that must appear in the assembly source file exactly as shown. The initial

3- to 5-letter mnemonic is always a literal expression. All commas, pound signs (#),

parentheses, and plus signs (+) are literal characters.

n — Any label or expression that evaluates to a single integer in the range 0–7

opr8i — Any label or expression that evaluates to an 8-bit immediate value

opr16i — Any label or expression that evaluates to a 16-bit immediate value

opr8a — Any label or expression that evaluates to an 8-bit value. The instruction treats

this 8-bit value as the low order 8 bits of an address in the direct page of the 64-Kbyte

address space (0x00xx).

opr16a — Any label or expression that evaluates to a 16-bit value. The instruction treats

this value as an address in the 64-Kbyte address space.

oprx8 — Any label or expression that evaluates to an unsigned 8-bit value, used for

indexed addressing

oprx16 — Any label or expression that evaluates to a 16-bit value. Because the HCS08

has a 16-bit address bus, this can be either a signed or an unsigned value.

rel — Any label or expression that refers to an address that is within –128 to +127

locations from the next address after the last byte of object code for the current

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

72 / 182

instruction. The assembler will calculate the 8-bit signed offset and include it in the object

code for this instruction.

10.6.9 Address modes

INH = Inherent (no operands)

IMM = 8-bit or 16-bit immediate

DIR = 8-bit direct

EXT = 16-bit extended

IX = 16-bit indexed no offset

IX+ = 16-bit indexed no offset, post increment (CBEQ and MOV only)

IX1 = 16-bit indexed with 8-bit offset from H:X

IX1+ = 16-bit indexed with 8-bit offset, post increment (CBEQ only)

IX2 = 16-bit indexed with 16-bit offset from H:X

rel = 8-bit relative offset

SP1 = Stack pointer with 8-bit offset

SP2 = Stack pointer with 16-bit offset

Table 75. HCS08 instruction set summary

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

ADC #opr8i

ADC opr8a

ADC opr16a

ADC oprx16,X

ADC oprx8,X

ADC,X

ADC oprx16,SP

ADC oprx8,SP

Add with Carry A ← (A) + (M) + (C) Þ Þ – Þ Þ Þ

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED9

9EE9

hh ll

ee ff

ADD #opr8i

ADD opr8a

ADD opr16a

ADD oprx16,X

ADD oprx8,X

ADD ,X

ADD oprx16,SP

ADD oprx8,SP

Add without Carry A ← (A) + (M) Þ Þ – Þ Þ Þ

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9EDB

9EEB

hh ll

ee ff

AIS #opr8i

Add Immediate

Value (Signed) to

Stack Pointer

SP ← (SP) + (M)

M is sign extended

to a 16-bit value

– – – – – – IMM A7 ii

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

73 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

AIX #opr8i

Add Immediate

Value (Signed)

to Index Register

(H:X)

H:X ← (H:X) + (M)

M is sign extended

to a 16-bit value

– – – – – – IMM AF ii

AND #opr8i

AND opr8a

AND opr16a

AND oprx16,X

AND oprx8,X

AND ,X

AND oprx16,SP

AND oprx8,SP

Logical AND A ← (A) & (M) 0 – – Þ Þ –

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED4

9EE4

hh ll

ee ff

ASL opr8a

ASLA

ASLX

ASL oprx8,X

ASL ,X

ASL oprx8,SP

Arithmetic Shift

Left (Same as

LSL)

aaa-028006

Þ – – Þ Þ Þ

DIR

INH

IX1

SP1

9E68

ASR opr8a

ASRA

ASRX

ASR oprx8,X

ASR ,X

ASR oprx8,SP

Arithmetic Shift

Right

aaa-028007

Þ – – Þ Þ Þ

DIR

INH

IX1

SP1

9E67

BCC rel Branch if Carry

Bit Clear Branch if (C) = 0 – – – – – – rel 24 rr 3

BCLR n,opr8a Clear Bit n in

Memory Mn ← 0 – – – – – –

DIR (b0)

DIR (b1)

DIR (b2)

DIR (b3)

DIR (b4)

DIR (b5)

DIR (b6)

DIR (b7)

BCS rel

Branch if Carry

Bit Set (Same as

BLO)

Branch if (C) = 1 – – – – – – rel

25 rr 3

BEQ rel Branch if Equal Branch if (Z) = 1 – – – – – – rel 27 rr 3

BGE rel

Branch if Greater

Than or Equal

To (Signed

Operands)

Branch if (N # V) = 0 ––––––rel

90 rr 3

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

74 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

BGND

Enter ACTIVE

BACK-GROUND

if ENBDM = 1

Waits For and

Processes BDM

Commands Until

GO, TRACE1, or

TAGGO

––––––INH

82 5+

BGT rel

Branch if Greater

Than (Signed

Operands)

Branch if (Z) | (N #

V) = 0 ––––––rel

92 rr 3

BHCC rel Branch if Half

Carry Bit Clear Branch if (H) = 0 – – – – – – rel 28 rr 3

BHCS rel Branch if Half

Carry Bit Set Branch if (H) = 1 – – – – – – rel 29 rr 3

BHI rel Branch if Higher Branch if (C) | (Z) =

0––––––rel 22 rr 3

BHS rel

Branch if Higher

or Same (Same

as BCC)

Branch if (C) = 0 – – – – – – rel

24 rr 3

BIH rel Branch if IRQ Pin

High

Branch if IRQ pin =

1––––––rel 2F rr 3

BIL rel Branch if IRQ Pin

Low

Branch if IRQ pin =

0––––––rel 2E rr 3

BIT #opr8i

BIT opr8a

BIT opr16a

BIT oprx16,X

BIT oprx8,X

BIT ,X

BIT oprx16,SP

BIT oprx8,SP

Bit Test

(A) & (M)

(CCR Updated but

Operands

Not Changed)

0 – – Þ Þ –

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED5

9EE5

hh ll

ee ff

BLE rel

Branch if Less

Than or Equal

To (Signed

Operands)

Branch if (Z) | (N #

V) = 1 ––––––rel

93 rr 3

BLO rel Branch if Lower

(Same as BCS) Branch if (C) = 1 – – – – – – rel 25 rr 3

BLS rel Branch if Lower

or Same

Branch if (C) | (Z) =

1––––––rel 23 rr 3

BLT rel

Branch if Less

Than (Signed

Operands)

Branch if (N # V ) =

1––––––rel

91 rr 3

BMC rel Branch if Interrupt

Mask Clear Branch if (I) = 0 – – – – – – rel 2C rr 3

BMI rel Branch if Minus Branch if (N) = 1 – – – – – – rel 2B rr 3

BMS rel Branch if Interrupt

Mask Set Branch if (I) = 1 – – – – – – rel 2D rr 3

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

75 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

BNE rel Branch if Not

Equal Branch if (Z) = 0 – – – – – – rel 26 rr 3

BPL rel Branch if Plus Branch if (N) = 0 – – – – – – rel 2A rr 3

BRA rel Branch Always No Test – – – – – – rel 20 rr 3

BRCLR

n,opr8a,rel

Branch if Bit n in

Memory Clear Branch if (Mn) = 0 – – – – – Þ

DIR (b0)

DIR (b1)

DIR (b2)

DIR (b3)

DIR (b4)

DIR (b5)

DIR (b6)

DIR (b7)

dd rr

BRN rel Branch Never Uses 3 Bus Cycles – – – – – – rel 21 rr 3

BRSET n,opr8a,

rel

Branch if Bit n in

Memory Set Branch if (Mn) = 1 – – – – – Þ

DIR (b0)

DIR (b1)

DIR (b2)

DIR (b3)

DIR (b4)

DIR (b5)

DIR (b6)

DIR (b7)

dd rr

BSET n,opr8a Set Bit n in

Memory Mn ← 1 – – – – – –

DIR (b0)

DIR (b1)

DIR (b2)

DIR (b3)

DIR (b4)

DIR (b5)

DIR (b6)

DIR (b7)

BSR rel Branch to

Subroutine

PC ← (PC) +

0x0002

push (PCL); SP ←

(SP) – 0x0001

push (PCH); SP ←

(SP) – 0x0001

PC ← (PC) + rel

––––––rel

AD rr 5

CBEQ opr8a,rel

CBEQA #opr8i,rel

CBEQX #opr8i,rel

CBEQ oprx8,X+,

rel

CBEQ ,X+,rel

CBEQ oprx8,SP,

rel

Compare and

Branch if Equal

Branch if (A) = (M)

Branch if (X) = (M)

Branch if (A) = (M)

––––––

DIR

IMM

IX1+

IX+

SP1

9E61

dd rr

ii rr

ff rr

rr ff

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

76 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

CLC Clear Carry Bit C ← 0 – – – – – 0 INH 98 1

CLI Clear Interrupt

Mask Bit I ← 0 – – 0 – – – INH 9A 1

CLR opr8a

CLRA

CLRX

CLRH

CLR oprx8,X

CLR ,X

CLR oprx8,SP

Clear

M ← 0x00

A ← 0x00

X ← 0x00

H ← 0x00

M ← 0x00

0––01–

DIR

INH

IX1

SP1

9E6F

CMP #opr8i

CMP opr8a

CMP opr16a

CMP oprx16,X

CMP oprx8,X

CMP ,X

CMP oprx16,SP

CMP oprx8,SP

Compare

Accumulator with

Memory

(A) – (M)

(CCR Updated

But Operands Not

Changed)

Þ – – Þ Þ Þ

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED1

9EE1

hh ll

ee ff

COM opr8a

COMA

COMX

COM oprx8,X

COM ,X

COM oprx8,SP

Complement

(One’s

Complement)

M ← (M)= 0xFF –

(M)

A ← (A) = 0xFF –

(A)

X ← (X) = 0xFF –

(X)

M ← (M) = 0xFF –

(M)

M ← (M) = 0xFF –

(M)

M ← (M) = 0xFF –

(M)

0 – – Þ Þ 1

DIR

INH

IX1

SP1

9E63

CPHX opr16a

CPHX #opr16i

CPHX opr8a

CPHX oprx8,SP

Compare Index

with Memory

(H:X) – (M:M +

0x0001)

(CCR Updated

But Operands Not

Changed)

Þ – – Þ Þ Þ

EXT

IMM

DIR

SP1

9EF3

hh ll

jj kk

CPX #opr8i

CPX opr8a

CPX opr16a

CPX oprx16,X

CPX oprx8,X

CPX ,X

CPX oprx16,SP

CPX oprx8,SP

Compare X

(Index Register

Low) with

Memory

(X) – (M)

(CCR Updated

But Operands Not

Changed)

Þ – – Þ Þ Þ

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED3

9EE3

hh ll

ee ff

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

77 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

DAA

Decimal Adjust

Accumulator After

ADD or ADC of

BCD Values

(A)10 U – – Þ Þ Þ INH

72 1

DBNZ opr8a,rel

DBNZA rel

DBNZX rel

DBNZ oprx8,X,rel

DBNZ ,X,rel

DBNZ oprx8,SP,

rel

Decrement and

Branch if

Not Zero

Decrement A, X, or

Branch if (result) ≠ 0

DBNZX Affects X

Not H

––––––

DIR

INH

IX1

SP1

9E6B

dd rr

ff rr

DEC opr8a

DECA

DECX

DEC oprx8,X

DEC ,X

DEC oprx8,SP

Decrement

M ← (M) – 0x01

A ← (A) – 0x01

X ← (X) – 0x01

M ← (M) – 0x01

Þ – – Þ Þ –

DIR

INH

IX1

SP1

9E6A

DIV Divide A ← (H:A) ÷ (X)

H ← Remainder – – – – Þ Þ INH 52 6

EOR #opr8i

EOR opr8a

EOR opr16a

EOR oprx16,X

EOR oprx8,X

EOR ,X

EOR oprx16,SP

EOR oprx8,SP

Exclusive OR

Memory with

Accumulator

A ← (A # M) 0 – – Þ Þ –

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED8

9EE8

hh ll

ee ff

INC opr8a

INCA

INCX

INC oprx8,X

INC ,X

INC oprx8,SP

Increment

M ← (M) + 0x01

A ← (A) + 0x01

X ← (X) + 0x01

M ← (M) + 0x01

Þ – – Þ Þ –

DIR

INH

IX1

SP1

9E6C

JMP opr8a

JMP opr16a

JMP oprx16,X

JMP oprx8,X

JMP ,X

Jump PC ← Jump

Address ––––––

DIR

EXT

IX2

IX1

hh ll

ee ff

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

78 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

JSR opr8a

JSR opr16a

JSR oprx16,X

JSR oprx8,X

JSR ,X

Jump to

Subroutine

PC ← (PC) + n (n =

1, 2, or 3)

Push (PCL); SP ←

(SP) – 0x0001

Push (PCH); SP ←

(SP) – 0x0001

PC ← Unconditional

Address

––––––

DIR

EXT

IX2

IX1

hh ll

ee ff

LDA #opr8i

LDA opr8a

LDA opr16a

LDA oprx16,X

LDA oprx8,X

LDA ,X

LDA oprx16,SP

LDA oprx8,SP

Load

Accumulator from

Memory

A ← (M) 0 – – Þ Þ –

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED6

9EE6

hh ll

ee ff

LDHX #opr16i

LDHX opr8a

LDHX opr16a

LDHX ,X

LDHX oprx16,X

LDHX oprx8,X

LDHX oprx8,SP

Load Index

(H:X) from

Memory

H:X ← (M:M +

0x0001) 0 – – Þ Þ –

IMM

DIR

EXT

IX2

IX1

SP1

9EAE

9EBE

9ECE

9EFE

jj kk

hh ll

ee ff

LDX #opr8i

LDX opr8a

LDX opr16a

LDX oprx16,X

LDX oprx8,X

LDX ,X

LDX oprx16,SP

LDX oprx8,SP

Load X (Index

from Memory

X ← (M) 0 – – Þ Þ –

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9EDE

9EEE

hh ll

ee ff

LSL opr8a

LSLA

LSLX

LSL oprx8,X

LSL ,X

LSL oprx8,SP

Logical Shift Left

(Same as ASL)

aaa-028008

Þ – – Þ Þ Þ

DIR

INH

IX1

SP1

9E68

LSR opr8a

LSRA

LSRX

LSR oprx8,X

LSR ,X

LSR oprx8,SP

Logical Shift

Right

aaa-028009

Þ – – 0 Þ Þ

DIR

INH

IX1

SP1

9E64

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

79 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

MOV opr8a,opr8a

MOV opr8a,X+

MOV #opr8i,opr8

MOV ,X+,opr8a

Move

(M)destination ←

(M)source

H:X ← (H:X) +

0x0001 in

IX+/DIR and DIR/IX

+ Modes

0 – – Þ Þ –

DIR/DIR

DIR/IX+

IMM/DIR

IX+/DIR

dd dd

ii dd

MUL Unsigned multiply X:A ← (X) × (A) – 0 – – – 0 INH 42 5

NEG opr8a

NEGA

NEGX

NEG oprx8,X

NEG ,X

NEG oprx8,SP

Negate

(Two’s

Complement)

M ← – (M) = 0x00 –

(M)

A ← – (A) = 0x00 –

(A)

X ← – (X) = 0x00 –

(X)

M ← – (M) = 0x00 –

(M)

M ← – (M) = 0x00 –

(M)

M ← – (M) = 0x00 –

(M)

Þ – – Þ Þ Þ

DIR

INH

IX1

SP1

9E60

NOP No Operation Uses 1 Bus Cycle – – – – – – INH 9D 1

NSA Nibble Swap

Accumulator A ← (A[3:0]:A[7:4]) – – – – – – INH 62 1

ORA #opr8i

ORA opr8a

ORA opr16a

ORA oprx16,X

ORA oprx8,X

ORA ,X

ORA oprx16,SP

ORA oprx8,SP

Inclusive OR

Accumulator and

Memory

A ← (A) | (M) 0 – – Þ Þ –

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9EDA

9EEA

hh ll

ee ff

PSHA

Push

Accumulator onto

Stack

Push (A); SP ←

(SP) – 0x0001 ––––––INH

87 2

PSHH

Push H (Index

onto Stack

Push (H); SP ←

(SP) – 0x0001 ––––––INH

8B 2

PSHX

Push X (Index

onto Stack

Push (X); SP ←

(SP) – 0x0001 ––––––INH

89 2

PULA Pull Accumulator

from Stack

SP ← (SP +

0x0001); Pull (A) ––––––INH 86 3

PULH

Pull H (Index

from Stack

SP ← (SP +

0x0001); Pull (H) ––––––INH

8A 3

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

80 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

PULX

Pull X (Index

from Stack

SP ← (SP +

0x0001); Pull (X) ––––––INH

88 3

ROL opr8a

ROLA

ROLX

ROL oprx8,X

ROL ,X

ROL oprx8,SP

Rotate Left

through Carry

aaa-028011

Þ – – Þ Þ Þ

DIR

INH

IX1

SP1

9E69

ROR opr8a

RORA

RORX

ROR oprx8,X

ROR ,X

ROR oprx8,SP

Rotate Right

through Carry

aaa-028010

Þ – – Þ Þ Þ

DIR

INH

IX1

SP1

9E66

RSP Reset Stack

Pointer

SP ← 0xFF

(High Byte Not

Affected)

––––––INH

9C 1

RTI Return from

Interrupt

SP ← (SP) +

0x0001; Pull (CCR)

SP ← (SP) +

0x0001; Pull (A)

SP ← (SP) +

0x0001; Pull (X)

SP ← (SP) +

0x0001; Pull (PCH)

SP ← (SP) +

0x0001; Pull (PCL)

ÞÞÞÞÞÞINH

80 9

RTS Return from

Subroutine

SP ← SP + 0x0001;

Pull (PCH)

SP ← SP + 0x0001;

Pull (PCL)

––––––INH

81 6

SBC #opr8i

SBC opr8a

SBC opr16a

SBC oprx16,X

SBC oprx8,X

SBC ,X

SBC oprx16,SP

SBC oprx8,SP

Subtract with

Carry A ← (A) – (M) – (C) Þ – – Þ Þ Þ

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED2

9EE2

hh ll

ee ff

SEC Set Carry Bit C ← 1 – – – – – 1 INH 99 1

SEI Set Interrupt

Mask Bit I ← 1 – – 1 – – – INH 9B 1

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

81 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

STA opr8a

STA opr16a

STA oprx16,X

STA oprx8,X

STA ,X

STA oprx16,SP

STA oprx8,SP

Store

Accumulator in

Memory

M ← (A) 0 – – Þ Þ –

DIR

EXT

IX2

IX1

SP2

SP1

9ED7

9EE7

hh ll

ee ff

STHX opr8a

STHX opr16a

STHX oprx8,SP

Store H:X (Index

Reg.)

(M:M + 0x0001) ←

(H:X) 0 – – Þ Þ –

DIR

EXT

SP1

9EFF

hh ll

STOP

Enable Interrupts:

Stop Processing

Refer to MCU

Documentation

I bit ← 0; Stop

Processing ––0–––INH

8E 2+

STX opr8a

STX opr16a

STX oprx16,X

STX oprx8,X

STX ,X

STX oprx16,SP

STX oprx8,SP

Store X (Low

8 Bits of Index

in Memory

M ← (X) 0 – – Þ Þ –

DIR

EXT

IX2

IX1

SP2

SP1

9EDF

9EEF

hh ll

ee ff

SUB #opr8i

SUB opr8a

SUB opr16a

SUB oprx16,X

SUB oprx8,X

SUB ,X

SUB oprx16,SP

SUB oprx8,SP

Subtract A ← (A) – (M) Þ – – Þ Þ Þ

IMM

DIR

EXT

IX2

IX1

SP2

SP1

9ED0

9EE0

hh ll

ee ff

SWI Software Interrupt

PC ← (PC) +

0x0001

Push (PCL); SP ←

(SP) – 0x0001

Push (PCH); SP ←

(SP) – 0x0001

Push (X); SP ←

(SP) – 0x0001

Push (A); SP ←

(SP) – 0x0001

Push (CCR); SP ←

(SP) – 0x0001

I ← 1;

PCH ← Interrupt

Vector High Byte

PCL ← Interrupt

Vector Low Byte

––1–––INH

83 11

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

82 / 182

Effect

on CCR

Source Form Operation Description

V H I N Z C

Address

Mode Opcode Operand

Bus

Cycles

[1]

TAP

Transfer

Accumulator to

CCR

CCR ← (A) Þ Þ Þ Þ Þ Þ INH

84 1

TAX

Transfer

Accumulator to X

(Index Register

Low)

X ← (A) – – – – – – INH

97 1

TPA Transfer CCR to

Accumulator A ← (CCR) – – – – – – INH 85 1

TST opr8a

TSTA

TSTX

TST oprx8,X

TST ,X

TST oprx8,SP

Test for Negative

or Zero

(M) – 0x00

(A) – 0x00

(X) – 0x00

(M) – 0x00

0 – – Þ Þ –

DIR

INH

IX1

SP1

9E6D

TSX Transfer SP to

Index Reg.

H:X ← (SP) +

0x0001 ––––––INH 95 2

TXA

Transfer X (Index

Reg. Low) to

Accumulator

A ← (X) – – – – – – INH

9F 1

TXS Transfer Index

Reg. to SP

SP ← (H:X) –

0x0001 ––––––INH 94 2

WAIT Enable Interrupts;

Wait for Interrupt I bit ← 0; Halt CPU – – 0 – – – INH 8F 2+

[1] Bus clock frequency is one-half of the CPU clock frequency.

Table 76. Opcode map (Sheet 1 of 2)

Bit-Manipulation Branch Read-Modify-Write Control Register/Memory

00 5

BRSET0

DIR

10 5

BSET0

DIR

20 3

BRA

2 rel

30 5

NEG

DIR

40 1

NEGA

INH

50 1

NEGX

INH

60 5

NEG

2 IX1

70 4

NEG

1 IX

80 9

RTI

INH

90 3

BGE

2 rel

A0 2

SUB

IMM

B0 3

SUB

DIR

C0 4

SUB

EXT

D0 4

SUB

3 IX2

E0 3

SUB

2 IX1

F0 3

SUB

1 IX

01 5

BRCLR0

DIR

11 5

BCLR0

DIR

21 3

BRN

2 rel

31 5

CBEQ

DIR

41 4

CBEQA

IMM

51 4

CBEQX

IMM

61 5

CBEQ

3 IX1+

71 5

CBEQ

2 IX+

81 6

RTS

INH

91 3

BLT

2 rel

A1 2

CMP

IMM

B1 3

CMP

DIR

C1 4

CMP

EXT

D1 4

CMP

3 IX2

E1 3

CMP

2 IX1

F1 3

CMP

1 IX

02 5

BRSET1

DIR

12 5

BSET1

DIR

22 3

BHI

2 rel

32 5

LDHX

EXT

42 5

MUL

INH

52 6

DIV

INH

62 1

NSA

INH

72 1

DAA

INH

82 5+

BGND

INH

92 3

BGT

2 rel

A2 2

SBC

IMM

B2 3

SBC

DIR

C2 4

SBC

EXT

D2 4

SBC

3 IX2

E2 3

SBC

2 IX1

F2 3

SBC

1 IX

03 5

BRCLR1

DIR

13 5

BCLR1

DIR

23 3

BLS

2 rel

33 5

COM

DIR

43 1

COMA

INH

53 1

COMX

INH

63 5

COM

2 IX1

73 4

COM

1 IX

83 11

SWI

INH

93 3

BLE

2 rel

A3 2

CPX

IMM

B3 3

CPX

DIR

C3 4

CPX

EXT

D3 4

CPX

3 IX2

E3 3

CPX

2 IX1

F3 3

CPX

1 IX

04 5

BRSET2

DIR

14 5

BSET2

DIR

24 3

BCC

2 rel

34 5

LSR

DIR

44 1

LSRA

INH

54 1

LSRX

INH

64 5

LSR

2 IX1

74 4

LSR

1 IX

84 1

TAP

INH

94 2

TXS

INH

A4 2

AND

IMM

B4 3

AND

DIR

C4 4

AND

EXT

D4 4

AND

3 IX2

E4 3

AND

2 IX1

F4 3

AND

1 IX

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

83 / 182

Bit-Manipulation Branch Read-Modify-Write Control Register/Memory

05 5

BRCLR2

DIR

15 5

BCLR2

DIR

25 3

BCS

2 rel

35 4

STHX

DIR

45 3

LDHX

IMM

55 4

LDHX

DIR

65 3

CPHX

IMM

75 5

CPHX

DIR

85 1

TPA

INH

95 2

TSX

INH

A5 2

BIT

IMM

B5 3

BIT

DIR

C5 4

BIT

EXT

D5 4

BIT

3 IX2

E5 3

BIT

2 IX1

F5 3

BIT

1 IX

06 5

BRSET3

DIR

16 5

BSET3

DIR

26 3

BNE

2 rel

36 5

ROR

DIR

46 1

RORA

INH

56 1

RORX

INH

66 5

ROR

2 IX1

76 4

ROR

1 IX

86 3

PULA

INH

96 5

STHX

3 EXT

A6 2

LDA

IMM

B6 3

LDA

DIR

C6 4

LDA

EXT

D6 4

LDA

3 IX2

E6 3

LDA

2 IX1

F6 3

LDA

1 IX

07 5

BRCLR3

DIR

17 5

BCLR3

DIR

27 3

BEQ

2 rel

37 5

ASR

DIR

47 1

ASRA

INH

57 1

ASRX

INH

67 5

ASR

2 IX1

77 4

ASR

1 IX

87 2

PSHA

INH

97 1

TAX

INH

A7 2

AIS

IMM

B7 3

STA

DIR

C7 4

STA

EXT

D7 4

STA

3 IX2

E7 3

STA

2 IX1

F7 2

STA

1 IX

08 5

BRSET4

DIR

18 5

BSET4

DIR

28 3

BHCC

2 rel

38 5

LSL

DIR

48 1

LSLA

INH

58 1

LSLX

INH

68 5

LSL

2 IX1

78 4

LSL

1 IX

88 3

PULX

INH

98 1

CLC

INH

A8 2

EOR

IMM

B8 3

EOR

DIR

C8 4

EOR

EXT

D8 4

EOR

3 IX2

E8 3

EOR

2 IX1

F8 3

EOR

1 IX

09 5

BRCLR4

DIR

19 5

BCLR4

DIR

29 3

BHCS

2 rel

39 5

ROL

DIR

49 1

ROLA

INH

59 1

ROLX

INH

69 5

ROL

2 IX1

79 4

ROL

1 IX

89 2

PSHX

INH

99 1

SEC

INH

A9 2

ADC

IMM

B9 3

ADC

DIR

C9 4

ADC

EXT

D9 4

ADC

3 IX2

E9 3

ADC

2 IX1

F9 3

ADC

1 IX

0A 5

BRSET5

DIR

1A 5

BSET5

DIR

2A 3

BPL

2 rel

3A 5

DEC

DIR

4A 1

DECA

INH

5A 1

DECX

INH

6A 5

DEC

2 IX1

7A 4

DEC

1 IX

8A 3

PULH

INH

9A 1

CLI

INH

AA 2

ORA

IMM

BA 3

ORA

DIR

CA 4

ORA

EXT

DA 4

ORA

3 IX2

EA 3

ORA

2 IX1

FA 3

ORA

1 IX

0B 5

BRCLR5

DIR

1B 5

BCLR5

DIR

2B 3

BMI

2 rel

3B 7

DBNZ

DIR

4B 4

DBNZA

INH

5B 4

DBNZX

INH

6B 7

DBNZ

3 IX1

7B 6

DBNZ

2 IX

8B 2

PSHH

INH

9B 1

SEI

INH

AB 2

ADD

IMM

BB 3

ADD

DIR

CB 4

ADD

EXT

DB 4

ADD

3 IX2

EB 3

ADD

2 IX1

FB 3

ADD

1 IX

0C 5

BRSET6

DIR

1C 5

BSET6

DIR

2C 3

BMC

2 rel

3C 5

INC

DIR

4C 1

INCA

INH

5C 1

INCX

INH

6C 5

INC

2 IX1

7C 4

INC

1 IX

8C 1

CLRH

INH

9C 1

RSP

INH

BC 3

JMP

DIR

CC 4

JMP

EXT

DC 4

JMP

3 IX2

EC 3

JMP

2 IX1

FC 3

JMP

1 IX

0D 5

BRCLR6

DIR

1D 5

BCLR6

DIR

2D 3

BMS

2 rel

3D 4

TST

DIR

4D 1

TSTA

INH

5D 1

TSTX

INH

6D 4

TST

2 IX1

7D 3

TST

1 IX

9D 1

NOP

INH

AD 5

BSR

2 rel

BD 5

JSR

DIR

CD 6

JSR

EXT

DD 6

JSR

3 IX2

ED 5

JSR

2 IX1

FD 5

JSR

1 IX

0E 5

BRSET7

DIR

1E 5

BSET7

DIR

2E 3

BIL

2 rel

3E 6

CPHX

3 EXT

4E 5

MOV

3 DD

5E 5

MOV

DIX+

6E 4

MOV

IMD

7E 5

MOV

IX+D

STOP

INH

Page

AE 2

LDX

IMM

BE 3

LDX

DIR

CE 4

LDX

EXT

DE 4

LDX

3 IX2

EE 3

LDX

2 IX1

FE 3

LDX

1 IX

0F 5

BRCLR7

DIR

1F 5

BCLR7

DIR

2F 3

BIH

2 rel

3F 5

CLR

DIR

4F 1

CLRA

INH

5F 1

CLRX

INH

6F 5

CLR

2 IX1

7F 4

CLR

1 IX

WAIT

INH

9F 1

TXA

INH

AF 2

AIX

IMM

BF 3

STX

DIR

CF 4

STX

EXT

DF 4

STX

3 IX2

EF 3

STX

2 IX1

FF 2

STX

1 IX

INH Inherent rel relative SP1 Stack Pointer, 8-Bit Offset

IMM Immediate IX Indexed, no offset SP2 Stack Pointer, 16-Bit offset

DIR Direct IX1 Indexed, 8-Bit offset IX+ Indexed, No offset with post increment

EXT Extended IX2 Indexed, 16-Bit offset IX1+ Indexed, 1-Byte offset with post increment

DD DIR to DIR IMD IMM to DIR

IX+D IX+ to DIR DIX+ DIR to IX+

Opcode in Hexadecimal

Number of Bytes

F0 3

SUB

1 IX

HCS08 Cycles

Instruction Mnemonic

Addressing Mode

Table 77. Opcode map (Sheet 2 of 2)

Bit-Manipulation Branch Read-Modify-Write Control Register/Memory

9E60 6

NEG

SP1

9ED0

SUB

SP2

9EE0

SUB

SP1

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

84 / 182

Bit-Manipulation Branch Read-Modify-Write Control Register/Memory

9E61 6

CBEQ

4 SP1

9ED1 5

CMP

4 SP2

9EE1 4

CMP

3 SP1

9ED2 5

SBC

4 SP2

9EE2 4

SBC

3 SP1

9E63 6

COM

3 SP1

9ED3 5

CPX

4 SP2

9EE3 4

CPX

3 SP1

9EF3 6

CPHX

3 SP1

9E64 6

LSR

3 SP1

9ED4 5

AND

4 SP2

9EE4 4

AND

3 SP1

9ED5 5

BIT

4 SP2

9EE5 4

BIT

3 SP1

9E66 6

ROR

3 SP1

9ED6 5

LDA

4 SP2

9EE6 4

LDA

3 SP1

9E67 6

ASR

3 SP1

9ED7 5

STA

4 SP2

9EE7 4

STA

3 SP1

9E68 6

LSL

3 SP1

9ED8 5

EOR

4 SP2

9EE8 4

EOR

3 SP1

9E69 6

ROL

3 SP1

9ED9 5

ADC

4 SP2

9EE9 4

ADC

3 SP1

9E6A 6

DEC

3 SP1

9EDA 5

ORA

4 SP2

9EEA 4

ORA

3 SP1

9E6B 8

DBNZ

4 SP1

9EDB 5

ADD

4 SP2

9EEB 4

ADD

3 SP1

9E6C 6

INC

3 SP1

9E6D 5

TST

3 SP1

9EAE 5

LDHX

2 IX

9EBE 6

LDHX

4 IX2

9ECE 5

LDHX

3 IX1

9EDE 5

LDX

4 SP2

9EEE 4

LDX

3 SP1

9EFE 5

LDHX

3 SP1

9E6F 6

CLR

3 SP1

9EDF 5

STX

4 SP2

9EEF 4

STX

3 SP1

9EFF 5

STHX

3 SP1

INH Inherent REL relative SP1 Stack Pointer, 8-Bit Offset

IMM Immediate IX Indexed, no offset SP2 Stack Pointer, 16-Bit offset

DIR Direct IX1 Indexed, 8-Bit offset IX+ Indexed, No offset with post increment

EXT Extended IX2 Indexed, 16-Bit offset IX1+ Indexed, 1-Byte offset with post increment

DD DIR to DIR IMD IMM to DIR

IX+D IX+ to DIR DIX+ DIR to IX+

Note: All Sheet 2 Opcodes are Preceded by the Page 2 Prebyte (9E)

Prebyte (9E) and Opcode in Hexadecimal

Number of Bytes

9E60 6

SUB

3 SP1

HCS08 Cycles

Instruction Mnemonic

Addressing Mode

11 Timer Pulse-Width Module

The timer pulse-width module (TPM1) is a two channel timer system that supports

traditional input capture, output compare, or edge-aligned PWM on each channel. All

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

85 / 182

the features and functions of the TPM1 are as described in the MC9S08RC16 product

specification. The user has the option to connect the two timer channels to the PTA[3:2]

pins, if those pins are not needed for an LFR channel or other general purpose I/O

function. The following clock source and frequency selections are available using the

system option register 2 as shown in Table 41 and Table 42.

In addition one channel of the TPM1 can be connected to a 500 kHz clock (DX) derived

from the crystal oscillator on the RFM. This selection is made by setting the TPM1 to use

an external clock. This clock source allows time calibration of the LFO as described in the

Section 16 "Firmware".

11.1 Features

The TPM1 has the following features:

•May be configured for buffered, center-aligned pulse-width modulation (CPWM) on all

channels

•Clock sources independently selectable

•Selectable clock sources (device dependent): bus clock, fixed system clock

•Clock prescaler taps for divide by 1, 2, 4, 8, 16, 32, 64, or 128

•16-bit free-running or up/down (CPWM) count operation

•16-bit modulus register to control counter range

•Timer system enable

•One interrupt per channel plus a terminal count interrupt

•Channel features:

–Each channel may be input capture, output compare, or buffered edge-aligned PWM

–Rising-edge, falling-edge, or any-edge input capture trigger

–Set, clear, or toggle output compare action

–Selectable polarity on PWM outputs

11.2 TPM1 configuration information

The device provides one two-channel timer/pulse-width modulator (TPM1).

An easy way to measure the low frequency oscillator (LFO) is to connect the LFO directly

to TPM1 channel 0. The LFOSEL bit in the SOPTZ determines whether TPM1CH0 is

connected to PTAZ or the LFO.

TPM1 clock source selection for the TPM1 is shown in the following table.

Table 78. TPM1 clock source selection

CLKSB CLKSA Clock Source

0 0 No source; TPM1 disabled

0 1 BUSCLK

1 0 unused

1 1 Internal DX pin

11.2.1 Block diagram

Figure 18 shows the structure of a TPM1.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

86 / 182

16-BIT COMPARATOR

MAIN 16-BIT COUNTER

16-BIT COMPARATOR

16-BIT LATCH

16-BIT COMPARATOR

16-BIT LATCH

CHANNEL 0

CHANNEL 1

aaa-028012

INTERNAL BUS

PORT

LOGIC

PORT

LOGIC

COUNTER RESET

PRESCALE AND SELECT

DIVIDE BY

1, 2, 4, 8, 16, 32, 64, or 128

CLOCK SOURCE

SELECT

OFF, BUS, XCLK, EXT

BUSCLK

SYNC

INTERRUPT

LOGIC

INTERRUPT

LOGIC

INTERRUPT

LOGIC

Figure 18. TPM1 block diagram

The central component of the TPM1 is the 16-bit counter that can operate as a free-

running counter, a modulo counter, or an up- /down-counter when the TPM1 is

configured for center-aligned PWM. The TPM1 counter (when operating in normal

up-counting mode) provides the timing reference for the input capture, output

compare, and edge-aligned PWM functions. The timer counter modulo registers,

TPMMODH:TPMMODL, control the modulo value of the counter. (The values 0x0000

or 0xFFFF effectively make the counter free running.) Software can read the counter

value at any time without affecting the counting sequence. Any write to either byte of the

TPMCNT counter resets the counter regardless of the data value written.

All TPM1 channels are programmable independently as input capture, output compare,

or buffered edge-aligned PWM channels.

11.3 External signal description

When any pin associated with the timer is configured as a timer input, a passive pullup

can be enabled. After reset, the TPM1 modules are disabled and all pins default to

general-purpose inputs with the passive pullups disabled.

Each TPM1 channel is associated with an I/O pin on the MCU. The function of this pin

depends on the configuration of the channel. In some cases, no pin function is needed

so the pin reverts to being controlled by general-purpose I/O controls. When a timer has

control of a port pin, the port data and data direction registers do not affect the related

pin(s). See the Section 4 "Pinning information" for additional information about shared pin

functions.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

87 / 182

11.4 Register definition

The TPM1 includes:

•An 8-bit status and control register (TPMSC)

•A 16-bit counter (TPMCNTH:TPMCNTL)

•A 16-bit modulo register (TPMMODH:TPMMODL)

Each timer channel has:

•An 8-bit status and control register (TPMCnSC)

•A 16-bit channel value register (TPMCnVH:TPMCnVL)

11.4.1 Timer status and control register (TPM1SC)

TPM1SC contains the overflow status flag and control bits that are used to configure the

interrupt enable, TPM1 configuration, clock source, and prescale divisor. These controls

relate to all channels within this timer module.

Table 79. Timer status and control register (TPM1SC) (address $0010)

Bit76543210

R TOF

WTOIE CPWMS CLKSB CLKSA PS2 PS1 PS0

Reset00000000

= Reserved

Table 80. TPM1SC register field descriptions

Field Description

TOF

Timer Overflow Flag — This flag is set when the TPM1 counter changes to 0x0000 after reaching the

modulo value programmed in the TPM1 counter modulo registers. When the TPM1 is configured for CPWM,

TOF is set after the counter has reached the value in the modulo register, at the transition to the next lower

count value. Clear TOF by reading the TPM1 status and control register when TOF is set and then writing a

0 to TOF. If another TPM1 overflow occurs before the clearing sequence is complete, the sequence is reset

so TOF would remain set after the clear sequence was completed for the earlier TOF. Reset clears TOF.

Writing a 1 to TOF has no effect.

0 TPM1 counter has not reached modulo value or overflow

1 TPM1 counter has overflowed

TOIE

Timer Overflow Interrupt Enable — This read/write bit enables TPM1 overflow interrupts. If TOIE is set, an

interrupt is generated when TOF equals 1. Reset clears TOIE.

0 TOF interrupts inhibited (use software polling)

1 TOF interrupts enabled

CPWMS

Center-Aligned PWM Select — This read/write bit selects CPWM operating mode. Reset clears this bit

so the TPM1 operates in up-counting mode for input capture, output compare, and edge-aligned PWM

functions. Setting CPWMS reconfigures the TPM1 to operate in up-/down-counting mode for CPWM

functions. Reset clears CPWMS.

0 All TPM channels operate as input capture, output compare, or edge-aligned PWM mode as selected by

the MSnB:MSnA control bits in each channel’s status and control register

1 All TPM channels operate in center-aligned PWM mode

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

88 / 182

Field Description

4:3

CLKS[B:A]

Clock Source Select — As shown in Table 78, this 2-bit field is used to disable the TPM1 system or select

one of three clock sources to drive the counter prescaler. The internal DX source is synchronized to the bus

clock by an on-chip synchronization circuit.

2:0

PS[2:0]

Prescale Divisor Select — This 3-bit field selects one of eight divisors for the TPM1 clock input as shown

in Table 81. This prescaler is located after any clock source synchronization or clock source selection, so it

affects whatever clock source is selected to drive the TPM1 system.

Table 81. Prescale divisor selection

PS2:PS1:PS0 TPM1 Clock Source Divided-By

0:0:0 1

0:0:1 2

0:1:0 4

0:1:1 8

1:0:0 16

1:0:1 32

1:1:0 64

1:1:1 128

11.4.2 Timer counter registers (TPM1CNTH:TPM1CNTL)

The two read-only TPM1 counter registers contain the high and low bytes of the value in

the TPM1 counter. Reading either byte (TPM1CNTH or TPM1CNTL) latches the contents

of both bytes into a buffer where they remain latched until the other byte is read. This

allows coherent 16-bit reads in either order. The coherency mechanism is automatically

restarted by an MCU reset, a write of any value to TPM1CNTH or TPM1CNTL, or any

write to the timer status/control register (TPM1SC).

Reset clears the TPM1 counter registers.

Table 82. Timer counter register high (TPM1CNTH) (address $0011)

Bit76543210

R Bit 15 14 13 12 11 10 9 Bit 8

W Any write to TPMCNTH clears the 16-bit counter.

Reset00000000

Table 83. Timer counter register low (TPM1CNTL) (address $0012)

Bit76543210

R Bit 7 6 5 4 3 2 1 Bit 0

W Any write to TPMCNTL clears the 16-bit counter.

Reset00000000

When BACKGROUND mode is active, the timer counter and the coherency mechanism

are frozen such that the buffer latches remain in the state they were in when the

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

89 / 182

BACKGROUND mode became active even if one or both bytes of the counter are read

while BACKGROUND mode is active.

11.4.3 Timer counter modulo registers (TPM1MODH:TPM1MODL)

The read/write TPM1 modulo registers contain the modulo value for the TPM1 counter.

After the TPM1 counter reaches the modulo value, the TPM1 counter resumes counting

from 0x0000 at the next clock (CPWMS = 0) or starts counting down (CPWMS = 1), and

the overflow flag (TOF) becomes set. Writing to TPM1MODH or TPM1MODL inhibits

TOF and overflow interrupts until the other byte is written. Reset sets the TPM1 counter

modulo registers to 0x0000, which results in a free-running timer counter (modulo

disabled).

Table 84. Timer counter modulo register high (TPM1MODH) (address $0013)

Bit76543210

WBit 15 14 13 12 11 10 9 Bit 8

Reset00000000

Table 85. Timer counter modulo register low (TPM1MODL) (address $0014)

Bit76543210

WBit 7 6 5 4 3 2 1 Bit 0

Reset00000000

It is good practice to wait for an overflow interrupt so both bytes of the modulo register

can be written well before a new overflow. An alternative approach is to reset the TPM1

counter before writing to the TPM1 modulo registers to avoid confusion about when the

first counter overflow will occur.

11.4.4 Timer channel 0 status and control register (TPM1C0SC)

TPM1C0SC contains the channel interrupt status flag and control bits that are used to

configure the interrupt enable, channel configuration, and pin function.

Table 86. Timer channel 0 status and control register (TPM1C0SC) (address $0015)

Bit76543210

R 0 0

WCH0F CH0IE MS0B MS0A ELS0B ELS0A

Reset00000000

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

90 / 182

Table 87. TPM1C0SC register field descriptions

Field Description

CH0F

Channel 0 Flag — When channel n is configured for input capture, this flag bit is set when an active edge

occurs on the channel n pin. When channel 0 is an output compare or edge-aligned PWM channel, CH0F is

set when the value in the TPM1 counter registers matches the value in the TPM1 channel 0 value registers.

This flag is seldom used with center-aligned PWMs because it is set every time the counter matches the

channel value register, which correspond to both edges of the active duty cycle period.

A corresponding interrupt is requested when CH0F is set and interrupts are enabled (CH0IE = 1). Clear

CH0F by reading TPM1C0SC while CH0F is set and then writing a 0 to CH0F. If another interrupt request

occurs before the clearing sequence is complete, the sequence is reset so CH0F would remain set after the

clear sequence was completed for the earlier CH0F. This is done so a CH0F interrupt request cannot be

lost by clearing a previous CH0F. Reset clears CH0F. Writing a 1 to CH0F has no effect.

0 No input capture or output compare event occurred on channel 0

1 Input capture or output compare event occurred on channel 0

CH0IE

Channel 0 Interrupt Enable — This read/write bit enables interrupts from channel 0. Reset clears CH0IE.

0 Channel 0 interrupt requests disabled (use software polling)

1 Channel 0 interrupt requests enabled

MS0B

Mode Select B for TPM1 Channel 0 — When CPWMS = 0, MS0B = 1 configures TPM1 channel 0 for edge-

aligned PWM mode. For a summary of channel mode and setup controls, refer to Table 88.

MS0A

Mode Select A for TPM1 Channel 0 — When CPWMS = 0 and MS0B = 0, MS0A configures TPM1 channel

0 for input capture mode or output compare mode. Refer to Table 88 for a summary of channel mode and

setup controls.

3:2

ELS0[B:A]

Edge/Level Select Bits — Depending on the operating mode for the timer channel as set by

CPWMS:MS0B:MSnA and shown in Table 88, these bits select the polarity of the input edge that triggers

an input capture event, select the level that will be driven in response to an output compare match, or select

the polarity of the PWM output. Setting ELS0B:ELS0A to 0:0 configures the related timer pin as a general-

purpose I/O pin unrelated to any timer channel functions. This function is typically used to temporarily

disable an input capture channel or to make the timer pin available as a general-purpose I/O pin when the

associated timer channel is set up as a software timer that does not require the use of a pin.

Table 88. Mode, edge, and level selection

CPWMS MS0B:MS0A ELS0B:ELS0A Mode Configuration

X XX 00 Pin not used for TPM1 channel; use as an external clock for the

TPM1 or revert to general-purpose I/O

01 Capture on rising edge only

10 Capture on falling edge only00

Input capture

Capture on rising or falling edge

00 Software compare only

01 Toggle output on compare

10 Clear output on compare

Output compare

Set output on compare

10 High-true pulses (clear output on compare)

1x x1

Edge-

aligned PWM Low-true pulses (set output on compare)

10 High-true pulses (clear output on compare-up)

1 XX x1

Center-

aligned PWM Low-true pulses (set output on compare-up)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

91 / 182

If the associated port pin is not stable for at least two bus clock cycles before changing

to input capture mode, it is possible to get an unexpected indication of an edge trigger.

Typically, a program would clear status flags after changing channel configuration bits

and before enabling channel interrupts or using the status flags to avoid any unexpected

behavior.

11.4.5 Timer channel value registers (TPM1C0VH:TPM1C0VL)

These read/write registers contain the captured TPM1 counter value of the input capture

function or the output compare value for the output compare or PWM functions. The

channel value registers are cleared by reset.

Table 89. Timer channel 0 value register high (TPM1C0VH) (address $0016)

Bit76543210

WBit 15 14 13 12 11 10 9 Bit 8

Reset00000000

Table 90. Timer channel 0 value register low (TPM1C0VL) (address $0017)

Bit76543210

WBit 7 6 5 4 3 2 1 Bit 0

Reset00000000

In input capture mode, reading either byte (TPM1C0VH or TPM1C0VL) latches the

contents of both bytes into a buffer where they remain latched until the other byte is read.

This latching mechanism also resets (becomes unlatched) when the TPM1C0SC register

is written.

In output compare or PWM modes, writing to either byte (TPM1C0VH or TPM1C0VL)

latches the value into a buffer. When both bytes have been written, they are transferred

as a coherent 16-bit value into the timer channel value registers. This latching

mechanism may be manually reset by writing to the TPM1C0SC register.

This latching mechanism allows coherent 16-bit writes in either order, which is friendly to

various compiler implementations.

11.4.6 Timer channel 1 status and control register (TPM1C1SC)

TPM1C1SC contains the channel interrupt status flag and control bits that are used to

configure the interrupt enable, channel configuration, and pin function.

Table 91. Timer channel 1 status and control register (TPM1C1SC) (address $0018)

Bit76543210

R 0 0

WCH1F CH1IE MS1B MS1A ELS1B ELS1A

Reset00000000

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

92 / 182

= Reserved

Table 92. TPM1C1SC register field descriptions

Field Description

CH1F

Channel 1 Flag — When channel n is configured for input capture, this flag bit is set when an active edge

occurs on the channel n pin. When channel 1 is an output compare or edge-aligned PWM channel, CH1F is

set when the value in the TPM1 counter registers matches the value in the TPM1 channel 1 value registers.

This flag is seldom used with center-aligned PWMs because it is set every time the counter matches the

channel value register, which correspond to both edges of the active duty cycle period.

A corresponding interrupt is requested when CH1F is set and interrupts are enabled (CH1IE = 1). Clear

CH1F by reading TPM1C1SC while CH1F is set and then writing a 0 to CH1F. If another interrupt request

occurs before the clearing sequence is complete, the sequence is reset so CH1F would remain set after the

clear sequence was completed for the earlier CH1F. This is done so a CH1F interrupt request cannot be

lost by clearing a previous CH1F. Reset clears CH1F. Writing a 1 to CH1F has no effect.

0 No input capture or output compare event occurred on channel 1

1 Input capture or output compare event occurred on channel 1

CH1IE

Channel 1 Interrupt Enable — This read/write bit enables interrupts from channel 1. Reset clears CH1IE.

0 Channel 1 interrupt requests disabled (use software polling)

1 Channel 1 interrupt requests enabled

MS1B

Mode Select B for TPM1 Channel 1 — When CPWMS = 0, MS1B = 1 configures TPM1 channel 1 for edge-

aligned PWM mode. For a summary of channel mode and setup controls, refer to Table 88.

MS1A

Mode Select A for TPM1 Channel 1 — When CPWMS = 0 and MS1B = 0, MS1A configures TPM1 channel

1 for input capture mode or output compare mode. Refer to Table 88 for a summary of channel mode and

setup controls.

3:2

ELS1[B:A]

Edge/Level Select Bits — Depending on the operating mode for the timer channel as set by

CPWMS:MS1B:MS1A and shown in Table 88, these bits select the polarity of the input edge that triggers

an input capture event, select the level that will be driven in response to an output compare match, or select

the polarity of the PWM output.

Setting ELS1B:ELS1A to 0:0 configures the related timer pin as a general-purpose I/O pin unrelated to any

timer channel functions. This function is typically used to temporarily disable an input capture channel or to

make the timer pin available as a general-purpose I/O pin when the associated timer channel is set up as a

software timer that does not require the use of a pin.

Table 93. Mode, edge, and level selection

CPWMS MS1B:MS1A ELS1B:ELS1A Mode Configuration

X XX 00 Pin not used for TPM1 channel; use as an external clock for the

TPM1 or revert to general-purpose I/O

01 Capture on rising edge only

10 capture on falling edge only00

Input capture

capture on rising or falling edge

00 software compare only

01 toggle output on compare

10 Clear output on compare

output compare

set output on compare

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

93 / 182

CPWMS MS1B:MS1A ELS1B:ELS1A Mode Configuration

10 High-true pulses (clear output on compare)

1x x1

Edge-aligned

PWM low-true pulses (set output on compare)

10 High-true pulses (clear output on compare-up)

1 XX x1

Center-aligned

PWM low-true pulses (set output on compare-up)

If the associated port pin is not stable for at least two bus clock cycles before changing

to input capture mode, it is possible to get an unexpected indication of an edge trigger.

Typically, a program would clear status flags after changing channel configuration bits

and before enabling channel interrupts or using the status flags to avoid any unexpected

behavior.

11.4.7 Timer channel value registers (TPM1C1VH:TPM1C1VL)

These read/write registers contain the captured TPM1 counter value of the input capture

function or the output compare value for the output compare or PWM functions. The

channel value registers are cleared by reset.

Table 94. Timer channel 1 value register high (TPM1C1VH) (address $0019)

Bit76543210

WBit 15 14 13 12 11 10 9 Bit 8

Reset00000000

Table 95. Timer channel 1 value register low (TPM1C1VL) (address $001A)

Bit76543210

WBit 7 6 5 4 3 2 1 Bit 0

Reset00000000

In input capture mode, reading either byte (TPM1C1VH or TPM1C1VL) latches the

contents of both bytes into a buffer where they remain latched until the other byte is read.

This latching mechanism also resets (becomes unlatched) when the TPM1C1SC register

is written.

In output compare or PWM modes, writing to either byte (TPM1C1VH or TPM1C1VL)

latches the value into a buffer. When both bytes have been written, they are transferred

as a coherent 16-bit value into the timer channel value registers. This latching

mechanism may be manually reset by writing to the TPM1C1SC register.

This latching mechanism allows coherent 16-bit writes in either order, which is friendly to

various compiler implementations.

11.5 Functional description

All TPM1 functions are associated with a main 16-bit counter that allows flexible selection

of the clock source and prescale divisor. A 16-bit modulo register also is associated with

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

94 / 182

the main 16-bit counter in the TPM1. Each TPM1 channel is optionally associated with an

MCU pin and a maskable interrupt function.

The TPM1 has center-aligned PWM capabilities controlled by the CPWMS control bit in

TPM1SC. When CPWMS is set to 1, timer counter TPM1CNT changes to an up-/down-

counter and all channels in the associated TPM1 act as center-aligned PWM channels.

When CPWMS = 0, each channel can independently be configured to operate in input

capture, output compare, or buffered edge-aligned PWM mode.

The following sections describe the main 16-bit counter and each of the timer operating

modes (input capture, output compare, edge-aligned PWM, and center-aligned PWM).

Because details of pin operation and interrupt activity depend on the operating mode,

these topics are covered in the associated mode sections.

11.5.1 Counter

All timer functions are based on the main 16-bit counter (TPM1CNTH:TPM1CNTL). This

section discusses selection of the clock source, up-counting vs. up-/down-counting, end-

of-count overflow, and manual counter reset.

After any MCU reset, CLKSB:CLKSA = 0:0 so no clock source is selected and the TPM1

is inactive. Normally, CLKSB:CLKSA would be set to 0:1 so the bus clock drives the

timer counter. The clock source for the TPM1 can be selected to be off, the bus clock

(BUSCLK), the fixed system clock (XCLK), or an external input. The maximum frequency

allowed for the external clock option is one-fourth the bus rate. Refer to Section 11.4.1

"Timer status and control register (TPM1SC)" and Table 87 for more information about

clock source selection.

When the microcontroller is in ACTIVE BACKGROUND mode, the TPM1 temporarily

suspends all counting until the microcontroller returns to normal user operating mode.

During STOP mode, all TPM1 clocks are stopped; therefore, the TPM1 is effectively

disabled until clocks resume. During WAIT mode, the TPM1 continues to operate

normally.

The main 16-bit counter has two counting modes. When center-aligned PWM is selected

(CPWMS = 1), the counter operates in up-/down-counting mode. Otherwise, the counter

operates as a simple up-counter. As an up-counter, the main 16-bit counter counts from

0x0000 through its terminal count and then continues with 0x0000. The terminal count is

0xFFFF or a modulus value in TPM1MODH:TPM1MODL.

When center-aligned PWM operation is specified, the counter counts upward from

0x0000 through its terminal count and then counts downward to 0x0000 where

it returns to up-counting. Both 0x0000 and the terminal count value (value in

TPM1MODH:TPM1MODL) are normal length counts (one timer clock period long).

An interrupt flag and enable are associated with the main 16-bit counter. The timer

overflow flag (TOF) is a software-accessible indication that the timer counter has

overflowed. The enable signal selects between software polling (TOIE = 0) where no

hardware interrupt is generated, or interrupt-driven operation (TOIE = 1) where a static

hardware interrupt is automatically generated whenever the TOF flag is 1.

The conditions that cause TOF to become set depend on the counting mode (up or

up/down). In up-counting mode, the main 16- bit counter counts from 0x0000 through

0xFFFF and overflows to 0x0000 on the next counting clock. TOF becomes set at the

transition from 0xFFFF to 0x0000. When a modulus limit is set, TOF becomes set at the

transition from the value set in the modulus register to 0x0000. When the main 16-bit

counter is operating in up-/down-counting mode, the TOF flag gets set as the counter

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

95 / 182

changes direction at the transition from the value set in the modulus register and the next

lower count value. This corresponds to the end of a PWM period. (The 0x0000 count

value corresponds to the center of a period.)

Because the HCS08 MCU is an 8-bit architecture, a coherency mechanism is built

into the timer counter for read operations. Whenever either byte of the counter is read

(TPM1CNTH or TPM1CNTL), both bytes are captured into a buffer so when the other

byte is read, the value will represent the other byte of the count at the time the first byte

was read. The counter continues to count normally, but no new value can be read from

either byte until both bytes of the old count have been read.

The main timer counter can be reset manually at any time by writing any value to either

byte of the timer count TPM1CNTH or TPM1CNTL. Resetting the counter in this manner

also resets the coherency mechanism in case only one byte of the counter was read

before resetting the count.

11.5.2 Channel mode selection

Provided CPWMS = 0 (center-aligned PWM operation is not specified), the MSnB and

MSnA control bits in the channel n status and control registers determine the basic

mode of operation for the corresponding channel. Choices include input capture, output

compare, and buffered edge-aligned PWM.

11.5.2.1 Input capture mode

With the input capture function, the TPM1 can capture the time at which an external

event occurs. When an active edge occurs on the pin of an input capture channel,

the TPM1 latches the contents of the TPM1 counter into the channel value registers

(TPM1CnVH:TPM1CnVL). Rising edges, falling edges, or any edge may be chosen as

the active edge that triggers an input capture.

When either byte of the 16-bit capture register is read, both bytes are latched into a

buffer to support coherent 16-bit accesses regardless of order. The coherency sequence

can be manually reset by writing to the channel status/control register (TPM1CnSC).

An input capture event sets a flag bit (CHnF) that can optionally generate a CPU interrupt

request.

11.5.2.2 Output compare mode

With the output compare function, the TPM1 can generate timed pulses with

programmable position, polarity, duration, and frequency. When the counter reaches the

value in the channel value registers of an output compare channel, the TPM1 can set,

clear, or toggle the channel pin.

In output compare mode, values are transferred to the corresponding timer channel

value registers only after both 8-bit bytes of a 16-bit register have been written. This

coherency sequence can be manually reset by writing to the channel status/control

An output compare event sets a flag bit (CHnF) that can optionally generate a CPU

interrupt request.

11.5.2.3 Edge-aligned PWM mode

This type of PWM output uses the normal up-counting mode of the timer counter

(CPWMS = 0) and can be used when other channels in the same TPM1 are configured

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

96 / 182

for input capture or output compare functions. The period of this PWM signal is

determined by the setting in the modulus register (TPM1MODH:TPM1MODL).

The duty cycle is determined by the setting in the timer channel value register

(TPM1CnVH:TPM1CnVL). The polarity of this PWM signal is determined by the setting in

the ELSnA control bit. Duty cycle cases of 0 percent and 100 percent are possible.

As Figure 19 shows, the output compare value in the TPM1 channel registers determines

the pulse width (duty cycle) of the PWM signal. The time between the modulus overflow

and the output compare is the pulse width. If ELSnA = 0, the counter overflow forces the

PWM signal high and the output compare forces the PWM signal low. If ELSnA = 1, the

counter overflow forces the PWM signal low and the output compare forces the PWM

signal high.

aaa-028013

Period

Pulse

width

Overflow Overflow Overflow

Output

compare

Output

compare

Output

compare

Figure 19. PWM period and pulse width (ELSnA = 0)

When the channel value register is set to 0x0000, the duty cycle is 0 percent. By setting

the timer channel value register (TPMCnVH:TPMCnVL) to a value greater than the

modulus setting, 100% duty cycle can be achieved. This implies that the modulus setting

must be less than 0xFFFF to get 100% duty cycle.

Because the HCS08 is a family of 8-bit MCUs, the settings in the timer channel registers

are buffered to ensure coherent 16-bit updates and to avoid unexpected PWM pulse

widths. Writes to either register, TPM1CnVH or TPM1CnVL, write to buffer registers. In

edge-PWM mode, values are transferred to the corresponding timer channel registers

only after both 8-bit bytes of a 16-bit register have been written and the value in the

1TPMCNTH:TPM1CNTL counter is 0x0000. (The new duty cycle does not take effect

until the next full period.)

11.5.3 Center-aligned PWM mode

This type of PWM output uses the up-/down-counting mode of the timer counter

(CPWMS = 1). The output compare value in TPM1CnVH:TPM1CnVL determines the

pulse width (duty cycle) of the PWM signal and the period is determined by the value

in TPM1MODH:TPM1MODL. TPM1MODH:TPM1MODL should be kept in the range of

0x0001 to 0x7FFF because values outside this range can produce ambiguous results.

ELS0A will determine the polarity of the CPWM output.

pulse width = 2 x (TPM1CnVH:TPM1CnVL)

period = 2 x (TPM1MODH:TPM1MODL);

for TPM1MODH:TPM1MODL = 0x0001–0x7FFF

If the channel value register TPM1CnVH:TPM1CnVL is zero or negative (bit 15 set), the

duty cycle will be 0%. If TPM1CnVH:TPM1CnVL is a positive value (bit 15 clear) and

is greater than the (nonzero) modulus setting, the duty cycle will be 100% because the

duty cycle compare will never occur. This implies the usable range of periods set by the

modulus register is 0x0001 through 0x7FFE (0x7FFF if generation of 100% duty cycle is

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

97 / 182

not necessary). This is not a significant limitation because the resulting period is much

longer than required for normal applications.

TPM1MODH:TPM1MODL = 0x0000 is a special case that should not be used with

center-aligned PWM mode. When CPWMS = 0, this case corresponds to the counter

running free from 0x0000 through 0xFFFF, but when CPWMS = 1 the counter needs a

valid match to the modulus register somewhere other than at 0x0000 in order to change

directions from up-counting to down-counting.

Figure 20 shows the output compare value in the TPM1 channel registers (multiplied by

2), which determines the pulse width (duty cycle) of the CPWM signal. If ELSnA = 0, the

compare match while counting up forces the CPWM output signal low and a compare

match while counting down forces the output high. The counter counts up until it reaches

the modulo setting in TPM1MODH:TPM1MODL, then counts down until it reaches zero.

This sets the period equal to two times TPM1MODH:TPM1MODL.

aaa-028014

Period 2x

Pulse width 2x

Count = TPMMODH:TPMMODL

Output compare

(count down)

Output compare

(count up)

COUNT = 0

Count = TPMMODH:TPMMODL

TPM1CHn

Figure 20. CPWM period and pulse width (ELSnA = 0)

Center-aligned PWM outputs typically produce less noise than edge-aligned PWMs

because fewer I/O pin transitions are lined up at the same system clock edge. This type

of PWM is also required for some types of motor drives.

Because the HCS08 is a family of 8-bit MCUs, the settings in the timer channel registers

are buffered to ensure coherent 16-bit updates and to avoid unexpected PWM pulse

widths. Writes to any of the registers, TPM1MODH, TPM1MODL, TPM1CnVH, and

TPM1CnVL, actually write to buffer registers. Values are transferred to the corresponding

timer channel registers only after both 8-bit bytes of a 16-bit register have been written

and the timer counter overflows (reverses direction from up-counting to down- counting

at the end of the terminal count in the modulus register). This TPM1CNT overflow

requirement only applies to PWM channels, not output compares.

Optionally, when TPM1CNTH:TPM1CNTL = TPM1MODH:TPM1MODL, the TPM1 can

generate a TOF interrupt at the end of this count. The user can choose to reload any

number of the PWM buffers, and they will all update simultaneously at the start of a new

period.

Writing to TPM1SC cancels any values written to TPM1MODH and/or TPM1MODL and

resets the coherency mechanism for the modulo registers. Writing to TPM1C0SC cancels

any values written to the channel value registers and resets the coherency mechanism

for TPM1C0VH:TPM1C0VL.

11.6 TPM1 interrupts

The TPM1 generates an optional interrupt for the main counter overflow and an interrupt

for each channel. The meaning of channel interrupts depends on the mode of operation

for each channel. If the channel is configured for input capture, the interrupt flag is set

each time the selected input capture edge is recognized. If the channel is configured for

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

98 / 182

output compare or PWM modes, the interrupt flag is set each time the main timer counter

matches the value in the 16-bit channel value register. See Section 7 "Reset, interrupts

and system configuration" for absolute interrupt vector addresses, priority, and local

interrupt mask control bits.

For each interrupt source in the TPM1, a flag bit is set on recognition of the interrupt

condition such as timer overflow, channel input capture, or output compare events.

This flag may be read (polled) by software to verify that the action has occurred, or

an associated enable bit (TOIE or CHnIE) can be set to enable hardware interrupt

generation. While the interrupt enable bit is set, a static interrupt will be generated

whenever the associated interrupt flag equals 1. It is the responsibility of user software to

perform a sequence of steps to clear the interrupt flag before returning from the interrupt

service routine.

11.6.1 Clearing timer interrupt flags

TPM1 interrupt flags are cleared by a two-step process that includes a read of the flag

bit while it is set (1) followed by a write of 0 to the bit. If a new event is detected between

these two steps, the sequence is reset and the interrupt flag remains set after the second

step to avoid the possibility of missing the new event.

11.6.2 Timer overflow interrupt description

The conditions that cause TOF to become set depend on the counting mode (up or

up/down). In up-counting mode, the 16-bit timer counter counts from 0x0000 through

0xFFFF and overflows to 0x0000 on the next counting clock. TOF becomes set at the

transition from 0xFFFF to 0x0000. When a modulus limit is set, TOF becomes set at

the transition from the value set in the modulus register to 0x0000. When the counter

is operating in up-/down-counting mode, the TOF flag gets set as the counter changes

direction at the transition from the value set in the modulus register and the next lower

count value. This corresponds to the end of a PWM period. (The 0x0000 count value

corresponds to the center of a period.)

11.6.3 Channel event interrupt description

The meaning of channel interrupts depends on the current mode of the channel (input

capture, output compare, edge-aligned PWM, or center-aligned PWM).

When a channel is configured as an input capture channel, the ELSnB:ELSnA control

bits select rising edges, falling edges, any edge, or no edge (off) as the edge that triggers

an input capture event. When the selected edge is detected, the interrupt flag is set. The

flag is cleared by the two-step sequence described in Section 11.6.1 "Clearing timer

interrupt flags".

When a channel is configured as an output compare channel, the interrupt flag is set

each time the main timer counter matches the 16-bit value in the channel value register.

The flag is cleared by the two-step sequence described in Section 11.6.1 "Clearing timer

interrupt flags".

11.6.4 PWM end-of-duty-cycle events

For channels that are configured for PWM operation, there are two possibilities:

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

99 / 182

•When the channel is configured for edge-aligned PWM, the channel flag is set when

the timer counter matches the channel value register that marks the end of the active

duty cycle period.

•When the channel is configured for center-aligned PWM, the timer count matches the

channel value register twice during each PWM cycle. In this CPWM case, the channel

flag is set at the start and at the end of the active duty cycle, which are the times when

the timer counter matches the channel value register.

The flag is cleared by the two-step sequence described in Section 11.6.1 "Clearing timer

interrupt flags".

12 Other MCU resources

It is not intended that physical parameter measurements be made during the time that

LFR may be actively receiving/decoding LF signals; or during the time that the RFM

may be actively powered up and/or transmitting RF data. The resulting interactions will

degrade the accuracy of the measurements.

The FXTH87E measures six physical parameters for use in the tire pressure monitoring

application: pressure, temperature, battery voltage, two external voltages and an optional

X- and/or Z-axis acceleration. Each parameter is accessed in a different manner and all

use firmware subroutine calls as described in Section 16 "Firmware". These subroutines

initialize some control bits within the sensor measurement interface, SMI, and then place

the MCU into the STOP4 mode until the measurement is completed with an interrupt

back to the MCU.

The accuracy, power consumption and timing specified for any measurement provided

in the data sheet are only guaranteed if the user obtains a reading using the specified

firmware subroutine call in Section 16 "Firmware". For additional information, contact

your NXP sales representative.

The FXTH87E uses a 6-channel, 10-bit analog-to-digital converter (ADC10) module.

The ADC10 module is an analog-to-digital converter using a successive approximation

sensor readings is controlled by the sensor measurement interface (SMI) and capture of

temperature and voltage readings are controlled by the MCU.

When making measurements of the various analog voltages the individual blocks will

first be powered up long enough to stabilize their outputs before a conversion is started.

The ADC channels are connected in hardware. Conversions are started and ended

synchronously with the sampling of the voltages.

The accuracy, power consumption and timing specifications given in the data sheet are

based on using the assigned firmware subroutines in Section 16 "Firmware" to make

these measurements and convert them into an 8-bit, 9-bit or 10-bit transfer function.

These measurement accuracy specifications cannot be guaranteed if the user creates

custom software routines to convert these measurements. For additional information,

contact your NXP sales representative.

Table 96. ADC10 channel assignments

ADC10

Channel Input Select Firmware Call(s) Characteristic

Pressure Sensor TPMS_READ_COMP_PRESSURE PCODE

AD0 Optional X-axis Acceleration

Sensor

TPMS_READ_COMP_ACCEL_X AXCODE

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

100 / 182

ADC10

Channel Input Select Firmware Call(s) Characteristic

Optional Z-axis Acceleration

Sensor

TPMS_READ_COMP_ACCEL_Z AZCODE

AD1 Temperature Sensor TPMS_READ_COMP_TEMP_8 TCODE

AD2 Band gap Reference TPMS_READ_COMP_VOLTAGE VCODE

AD3 GPIO PTA0 TPMS_READ_V0 G0CODE

AD4 GPIO PTA1 TPMS_READ_V1 G1CODE

AD5 VREG Monitor TPMS_WIRE_CHECK

12.1 Pressure measurement

The pressure measurement consists of an interface to a pressure sensing element.

Control bits on the MCU operate the SMI to power up the P-Cell and capture a voltage

which is converted by the ADC10. The resulting pressure transfer equation for the

100-500 kPa range:

(1)

The transfer equation of the 100-900 kPa range is:

(2)

The transfer equation of the 100-1500 kPa range is:

(3)

Due to calibration routines and parameters stored in the FXTH87E, the pressure range is

selected at production and cannot be changed in the field.

Note: Lack of change of the pressure measurement over time may indicate the package

pressure port to be blocked or the internal section of the sensor to be contaminated.

User application should maintain either locally or at the system data receiver a record of

pressure measurements along with temperature and/or accelerometer measurements,

and possibly identify the pressure port as blocked or contaminated if no changes are

recorded over time.

12.2 Temperature measurements

The temperature is measured from a ΔVB sensor built into channel 1 of the ADC10 in the

same manner as is done in the FXTH87E devices with the resulting transfer equation:

(4)

12.3 Voltage measurements

Voltage measurements can be made on the internal band gap to estimate the supply

voltage on VDD.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

101 / 182

12.3.1 Internal band gap

An internal band gap voltage reference is provided to take measurements of the supply

voltage. The resulting transfer equation:

(5)

12.3.2 External voltages

Measurements of an external voltage on either the PTA0 or PTA1 pins can be made and

referenced to the internal band gap voltage. The resulting transfer equation:

(6)

where x = 0, 1 refers to PTA0 or PTA1.

12.4 Optional acceleration measurements

The acceleration measurement consists of an interface to an optional acceleration

sensing element. Control bits on the MCU operate the SMI to power up the g-Cell and

capture a voltage which is converted by the ADC10. The data from the ADC10 is then

pre-processed by a dynamic range firmware routine that will return the two values

necessary to calculate the acceleration, Ay, (y = X-axis or Z-axis, depending on selection)

in conjunction with values taken from the tables in the data sheet.

The first value from the firmware routine is the offset step identifier, STEP, with integer

values 0 to 15 (i.e. the 16 offset steps). The other value is the ADC10 data, AyCODE,

with integer values 0 to 511. AyCODE values 1 through 510 are usable; values 0 and

511 indicate fault conditions. The X-axis acceleration is scaled for ~20g range within

each of the 16 offset steps, ~10g per step. The Z-axis acceleration is scaled for ~80g

range within each of the 16 offset steps, ~80g or ~60g. The steps are at ~40g or ~30g

increments, allowing for adequate overlaps. The product data sheet provides tables of

acceleration values resulting from characterizations.

Acceleration sensitivity, ΔAMAX-MIN, varies between each offset step, and should be

calculated by dividing the range of g’s for each offset step by the usable AyCODE range

(i.e. 509):

(7)

Once the sensitivity ΔAMAX-MIN has been calculated, the acceleration Ay can be

calculated by the re-using the ARATE-MIN, 1 value of the offset step and the returned

AyCODE value with the following transfer function:

(8)

The pressure, and optional X or Z-axis accelerometer also share the same signal path in

the Transducer interface and all the sensors share the same ADC. Therefore, only one of

the sensors can be accessed at a given moment.

Note: The included accelerometers are designed with a self-test feature. Consult sales/

application support for information regarding the recommended use of the accelerometer

self-test features.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

102 / 182

12.5 Optional battery condition check

The condition of the battery can be periodically checked to determine the battery’s

internal impedance, RBATT, which is a function of both temperature and the remaining

battery capacity. This can be performed by user supplied software routine and an

external load resistor, RLOAD, connected from the PTA0 pin to VSS as shown in Figure 21

(any of the PTA[3:0] can be used for this purpose).

Port pin driven highPort pin driven low

aaa-028015

FXTH87E

VBATT

IDD

RLOAD

RBATT

VDD

VSS

PTA0

FXTH87E

VBATT

IDD + ILOAD

ILOAD

RLOAD

RBATT

VDD

VSS

PTA0

Figure 21. Battery check circuit

The battery voltage can first be checked using the method given in Section 12.3 "Voltage

measurements" with the selected PTA0 pin set as an output and driven low and then high

to determine VDD where only IDD flows or when IDD plus ILOAD flows. The resulting battery

impedance can then be calculated as:

(9)

If it is assumed that IDD0 and IDD1 are not appreciably different at the small change in

VDD, then the resulting battery impedance can be approximated as:

(10)

where:

•VDD0 is the voltage determined with the external load resistor connected to VSS

•VDD1 is the voltage determined with the external load resistor connected to VDD

•RLOAD is the resistance of the external load resistance in ohms

•RBATT is the implied battery impedance in ohms

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

103 / 182

It is recommended that this calculation be performed with a reasonable current load on

the battery of approximately 3 mA (RLOAD approximately 1000 ohms).

12.6 Measurement firmware

The firmware for making measurements is comprised of two function calls as described

in Section 16 "Firmware". Each measurement is a combination of a "read" that returns

the raw ADC output data and a "comp" routine which compensates that raw reading

based on information contained in the Universal Uncompensated Measurement Array

(UUMA) assigned in RAM memory.

The read routines fill specific locations in the UUMA with raw data; but the compensation

routines depend what is already present in the UUMA as shown in the data flow in

Figure 22.

The user, therefore, has the option to decide how often each measurement (and its

component terms) are made. The resulting power consumption is then the sum of using

these components are defined in the product data sheet.

A typical flow for a compensated pressure measurement would be:

1. Call the TPMS_READ_PRESSURE routine which yields a raw pressure value and fills

the UUMA with this data.

2. Call the TPMS_READ_TEMPERATURE routine which yields a raw temperature value

and fills the UUMA with this data.

3. Call the TPMS_READ_VOLTAGE routine which yields a raw voltage value and fills

the UUMA with this data.

4. Call the TPMS_COMP_PRESSURE routine which then takes the raw pressure,

temperature and voltage values from the UUMA and compensates to provide a true

pressure reading to the accuracy as specified in the product data sheet.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

104 / 182

READ_Z_ACCELERATION

READ_PRESSURE

READ_TEMPERATURE

READ_VOLTAGE

CALL

RESULTS

Universal Uncompensated

Measurement Array (UUMA)

aaa-026795

COMP Z

ACCEL

RAW Z

ACCEL

RAW

TEMP

RAW

VOLT

COMP

PRESS

COMP

TEMP

COMP

VOLT

RAW

PRESS

0 - Voltage (16-bit)

1 - Temperature (16-bit)

2 - Pressure (16-bit)

3 - Z Acceleration (16-bit)

Comp

Temperature

Comp

Pressure

Raw

Pressure

Comp Z

Acceleration

Raw Z

Acceleration

Comp

Voltage

Raw

Voltage

Raw

Temperature

COMP_PRESSURE

Input Raw Pressure

Input Raw Voltage

Input Raw Temperature

COMP_Z_ACCELERATION

Input Raw Z Acceleration

Input Raw Voltage

Input Raw Temperature

COMP_VOLTAGE

Input Raw Voltage

COMP_TEMPERATURE

Input Raw Temperature

Figure 22. Data flow for measurements

12.7 Thermal shutdown

When the package temperature becomes too low or too high the MCU can be placed

into a STOP mode to suspend operation and prevent transmission of RF signals which

may be corrupted at the temperature extremes. Return to normal operation after the

temperature falls back within the recovery temperature range. The presence of either the

low or high temperature shutdown will disable the PWU from causing either a periodic

wakeup or a periodic reset. The MCU, temperature sensor and ADC10 are all functional

over the full temperature range from TL to TH.

12.7.1 Low temperature shutdown

Low temperature shutdown is achieved using temperature readings taken by the ADC10

as described in Section 12.2 "Temperature measurements" and enabling the thermal

restart circuit by setting the TRE bit and selecting the low temperature threshold by

clearing the TRH bit. When the software programmed low temperature is reached the

MCU will turn off all operating functions and enter the STOP1 mode.

12.7.2 High temperature shutdown

The high temperature shutdown level is determined from a measurement of the

temperature sensor by the ADC10 as described in Section 12.2 "Temperature

measurements" and enabling the thermal restart circuit by setting the TRE bit and

selecting the high temperature threshold by setting the TRH bit. When the software

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

105 / 182

programmed high temperature is reached the MCU will turn off all operating functions

and enter the STOP1 mode.

12.7.3 Temperature shutdown recovery

The MCU can be restarted by the Temperature Restart (TR) module when the

temperature returns within the normal temperature range, TRESET. When this occurs the

MCU will be reset and begin execution from the reset vector located at $DFFE/$DFFF.

The TR module can be enabled using the TRE bit in the SIMOPT1 register. The TR

module can be powered on and off by setting or clearing the TRE bit located at bit 3 in

the SIMOPT1 register at address $1802. The TRE bit is cleared by an MCU reset.

When the TRE bit is set the TR module can then be set to detect a recovery from either a

high temperature or a low temperature using the TRH in the SIMOPT1 register. The TRH

bit is cleared by an MCU reset.

The TR module does not activate an MCU restart and reset unless it has first moved

outside the re-arming temperature range, TREARM, as shown in Figure 23. The status of

the TR can be checked by reading the TRO bit located at bit 0 in the SIMTST register at

address $180F. The TRO bit is set high by an MCU reset. The state of the TRO bit is as

follows:

1 =TR module is outside the TREARM temperature range and will restart the MCU if the

TRE bit is set and temperature falls back within the TRESET temperature range.

0 =TR module is within the TRESET temperature range and the MCU cannot be armed to

restart when temperature falls back to the TRESET range. The TRE bit cannot be set.

TRO = 1

TRO = 0

TRESET

TREARM

TRO

temperature

shutdown shutdown

TREARML TREARMHTRESETL TRESETH

TRH = 1TRH = 0

active

aaa-028016

Figure 23. Temperature restart response

As the temperature rises (lower arrow), TRO will transition from 0 to 1 when the

temperature crosses the TREARMH threshold. Then as the temperature falls (upper

arrow), TRO will transition transition from 1 to 0 when the temperature crosses the

TRESETH threshold.

This sequence is further explained by the user software flowchart in Figure 24.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

106 / 182

Reset

Yes

Firmware

initialization

after a reset

Check

temperature?

Firmware

configuration of

device

Load TR trim

bits from

FLASH

Execute user's

TPMS program

Set TRE bit

TRE bit cleared

and TR trim bits

enabled to be

written

Temp

>TREARMH?

Temp

<TREARML?

Delay

TRO

bit set

Enter STOP1

mode

Clear TRE bit

Wake up from

STOP1 mode TRO reset by

TR module

Read temperature

using

TPMS_COMP_TEMPERATURE

firmware

Yes

aaa-028017

Figure 24. Flowchart for using TR module

12.8 Free-Running Counter (FRC)

The Free-Running Counter (FRC) is a single channel up-counter, scaled to 2x of the

LFO (refer to the product data sheet for tolerances of fLFO), that supports enable, halt,

and clear functions. While the MCU is in the RUN mode, the FRC is controlled by first

writing a 1 to bit 0 of the PMCT register at address $180B, then by writing the defined

values to bits 7 and 5 of the same register. While the PMCT bit 0 is equal to 1, the 16-

bit counter value is available by reading addresses $1808 FRC_TIMER[7:0] and $1809

FRC_TIMER[15:8].

The two read-only FRC_TIMER registers contain the high and low bytes of the value in

the free-running counter. Reading either FRC_TIMER byte latches the contents of both

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

107 / 182

bytes into a buffer where they remain until a second byte is read ($1808 or $1809). This

allows coherent 16-bit reads in either order. The coherency mechanism is automatically

restarted by an MCU reset, exit of STOP1, or a write to the PMCT register at address

$180B bits 7 = 1, or bit 5 = 0.

Once enabled, the FRC continues to increment (and subsequently rolls over) in RUN,

STOP4, STOP3, and STOP1 modes, unless halted as defined below.

13 Periodic Wakeup Timer

The periodic wakeup timer (PWU) generates a periodic interrupt to wakeup the MCU

from any of the STOP modes. It also has an optional periodic reset to restart the MCU.

It is driven by the LFO oscillator in the RTI module which generates a clock at a nominal

one millisecond interval. The LFO and the wakeup timer are always active and cannot

be powered off by any software control. The control bits are set so that there is either a

periodic wakeup, a periodic reset, or both a wakeup interrupt and a periodic reset. No

combination of control bits will disable both the wakeup interrupt and the periodic reset.

In addition, there is no hardware control that can mask a wakeup interrupt once it is

generated by the PWU.

13.1 Block diagram

The block diagram of the wakeup timer is shown in Figure 25. This consists of a

programmable prescaler with 64 steps that can be used to adjust for variations in the

value of the LFO period. Finally there are two cascaded programmable 6-bit dividers to

set wakeup and/or reset time intervals.

CONTROL

LOGIC

LFO

WUF

PROGRAMMBLE

PRESCALER

WDIV[5:0]

WUT[5:0]

WUKI

PRST[5:0]

WCLK RCLK

PRF

PRST

aaa-028018

WUFAK

TRO

PRFAK

TRE

6-BIT

WAKEUP

DIVIDER

6-BIT

PERIODIC

RESET

DIVIDER

Figure 25. Wakeup timer block diagram

The wakeup divider (PWUDIV) register selects a division of the incoming 1 ms clock

to generate a wakeup clock, WCLK. The WCLK frequency can be calibrated against

the more precise external oscillator using the TPMS_LFOCOL firmware subroutine as

described in Section 16 "Firmware". This subroutine turns on the RFM crystal oscillator

and feeds a 500 kHz clock to the TPM1 for one cycle of the LFO. The measured time is

used to calculate the correct value for the WDIV[5:0] bits for a WCLK period of 1 second.

The TPMS_LFOCOL subroutine cannot be used while the RFM is transmitting or the

TPM1 is being used for another task.

The wakeup time register (PWUSC0) selects the number of WCLK pulses that are

needed to generate a wakeup interrupt to the MCU. The periodic reset register

(PWUSC1) selects the number of wakeup pulses that are needed to generate a periodic

reset of the MCU. Both the wakeup time counter and the periodic reset timer are

incrementing counters that generate their interrupt or reset when the desired count is

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

108 / 182

reached and are then reset to zero. Reading the status of either of these counters will

return a zero content if done immediately after the interrupt or reset is generated.

If both the reset and the interrupt occur on the same clock cycle the reset will have

precedence and the interrupt will not be generated.

In order to prevent wakeup or reset from an extreme temperature event both the wakeup

interrupt or periodic reset are disabled if the thermal restart is activated and the TRO bit

indicates that the device is still outside of the TRESET range. The wakeup and periodic

reset counters will still run. The state of these counters can be read using the PSEL bit in

the PWUS register.

The wakeup interrupt (WUKI) cannot be masked by clearing the I-bit.

13.2 Wakeup divider register — PWUDIV

The PWUDIV register contains six bits to select the division of the incoming 1 ms clock

period as described in Table 97.

Table 97. PWU divider register (PWUDIV) (address $0038)

Bit76543210

R 0 0

WWDIV[5:0]

Reset————————

POR00011111

= Reserved

Table 98. PWUDIV register field descriptions

Field Description

7:6

Unused Unused

5:0

WDIV[5:0]

Wakeup Divider Value — The WDIV[5:0] bits select an incoming prescaler for the incoming 1 ms clock

period from 504 to 1512.

This results in a clocking of the 6-bit wakeup divider at rates from a nominal 0.504 to 1.512 sec per wakeup

clock, WCLK. The user can use this prescaler to fine tune the wakeup time based on the variation in the

LFO frequency. The conversion from the decimal value of the WDIV bits to the nominal WCLK period is

given as:

A power on reset presets these bits to a value of $1F (decimal 31) which yields a nominal 1 second output

period for WCLK. Other resets have no effect on these bits.

13.3 PWU control/status register 0 — PWUCS0 (address $0039)

The PWUCS0 register contains six bits to select the division of the incoming WCLK clock

period and provide interrupt flag and acknowledge bits as described in Table 99. The

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

109 / 182

period of the resulting interrupt also generates the clock, RCLK, for the periodic reset

timing.

Table 99. PWU Control/Status register 0 (PWUCS0) (address $0039)

Bit76543210

R 0

WWUF WUFAK WUT[5:0]

Reset 0 — 1 1 1 1 1 1

Table 100. PWUSC0 register field descriptions

Field Description

WUF

Wakeup Interrupt Flag — The WUF bit indicates when a wakeup interrupt has been generated by the PWU.

This bit is cleared

by writing a one to the WUFAK bit. Writing a zero to this bit has no effect. Reset clears this bit.

0 Wakeup interrupt not generated or was previously acknowledged.

1 Wakeup interrupt generated.

WUFAK

Acknowledge WUF Interrupt Flag — The WUFAK bit clears the WUF bit if written with a one. Writing a zero

to the WUFAK bit has no effect on the WUF bit. Reading the WUFAK bit returns a zero. Reset has no effect

on this bit.

0 No effect.

1 Clear WUF bit.

5:0

WUT[5:0]

WUF Time Interval — These control bits select the number of WCLK clocks that are needed before the next

wakeup interrupt is generated. The count gives a range of wakeup times from 1 to 63 WCLK clocks.

Depending on the value of the bits for the WDIV[5:0] this time interval can nominally be from 1 to 63

seconds in 1 second steps.

Whenever the WUT[5:0] bits are changed the timeout period is restarted. Writing the same data to the

WUT[5:0] bits has no effect.

Writing zeros to all of the WUT[5:0] bits forces the wakeup divider to a value of $3F and disables the

wakeup interrupt. However,

writing all zeros to the WUT[5:0] bits is inhibited if all of the PRST[5:0] bits are already cleared to zero. This

prevents disabling both the periodic wakeup and the periodic reset at the same time. See Table 101.

The WUT[5:0] bits are preset to a value of $3F (decimal 63) by any resets.

Table 101. Limitations on clearing WUT/PRST

Control Bits State of Control

Bits

Control Bits to

be Cleared

Resulting

Action

Resulting

Wakeup

Interrupt

Resulting

Periodic Reset

non-zero Allowed Enabled [1] Disabled

WUT[5:0] all zero PRST[5:0] Inhibited Disabled [2] Enabled[1]

non-zero Allowed Disabled Enabled[1]

PRST[5:0] all zero WUT[5:0] Inhibited Enabled[1] Disabled

[1] Using previous values.

[2] Wakeup divider preset to $3F.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

110 / 182

13.4 PWU control/status register 1 — PWUCS1

The PWUSC1 register contains six bits to select the division of the incoming RCLK clock

period and provide interrupt flag and acknowledge bits as described in Table 102.

Table 102. PWU Control/Status register 1 (PWUCS1) (address $003A)

Bit76543210

R PRF 0

W PRFAK PRST[5:0]

Reset00111111

= Reserved

Table 103. PWUSC1 register field descriptions

Field Description

PRF

Periodic Reset Flag — The PRF bit indicates when a periodic reset has been generated by the PWU. MCU

writes to this bit have no effect. This bit is cleared by writing a one to the PRFAK bit. This bit is cleared by a

power on reset, but is unaffected by other resets.

0 Periodic reset not generated or previously acknowledged.

1 Periodic reset generated.

PRFAK

Acknowledge PRF Interrupt Flag — The PRFAK bit clears the PRF bit if written with a one. Writing a zero to

the PRFAK bit has no effect on the PRF bit. Reading the PRFAK bit returns a zero. Reset has no effect on

this bit.

0 No effect.

1 Clear PRF bit.

5:0

PRST[5:0]

Periodic Reset Time Interval — These control bits select the number of wakeup interrupts that are needed

before the next periodic reset is generated. The decimal count gives a range of periodic reset times from

1 to 63 wakeup interrupts. Depending on the value of the bits for the WDIV[5:0] and WUT[5:0] this time

interval can nominally be from 1 second to 66 minutes with steps from 1 to 63 seconds. Whenever the

PRST[5:0] bits are changed the timeout period is restarted. Writing the same data to the PRST[5:0] bits has

no effect.

Writing zeros to all of the PRST[5:0] bits forces the periodic reset to be disabled if at least one of the

WUT[5:0] bits is set to a one. This assures that there will be at least a wakeup interrupt. However, writing all

zeros to the PRST[5:0] bits is inhibited if all of the WUT[5:0] bits are already cleared to zero. This prevents

disabling both the periodic wakeup and the periodic reset at the same time. See Table 101. The PRST[5:0]

bits are preset to a value of 63 by any resets.

13.5 PWU wakeup status register — PWUS

The PWUS register shows the current status of the two PWU counters as described in

Table 102. The counter contents are captured when the register is read.

Table 104. PWU wakeup status register (PWUS) (address $001F)

Bit76543210

R 0

WPSEL CSTAT

Reset 0 — — — — — — —

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

111 / 182

= Reserved

Table 105. PWUS register field descriptions

Field Description

PSEL

Page Selection — The PSEL read/write bit selects whether the other bits are read from the WUT or PRST

counters. This bit is cleared by a power on reset that is not created by an exit from the STOP mode, but is

unaffected by other resets.

0 CSTAT = WUT counter status

1 CSTAT = PRST counter status

unused Unused — An unused bit that always reads as a logical zero.

5:0

CSTAT

Counter Status — These read-only bits show the status of the counter selected by the PSEL bit. The effects

of any reset on these bits depends on how the reset affects the selected counter. Reading these counters

immediately after a WUF or PRF generated flag will return zero contents.

13.6 Functional modes

PWU module will work in each of the MCU operating modes as follows:

13.6.1 RUN mode

If the module generates a wakeup interrupt the PC (Program Counter) will be redirected

to the wakeup timer interrupt vector. The WUF flag will be set to indicate wakeup timer

interrupt; write 1 to WUFACK to clear this flag.

If the module generates a reset the PC will be redirected to the reset vector. The PRF

flag will be set to indicate periodic reset; write 1 to PRFACK to clear this flag.

All registers will continue to hold their programmed values after interrupt or reset is taken.

13.6.2 STOP4 mode

If the module generates a wakeup interrupt the bus and core clocks will be restarted and

the PC will be redirected to the wakeup timer interrupt vector. The WUF flag will be set to

indicate wakeup timer interrupt, write 1 to WUFACK to clear this flag.

If the module generates a periodic reset the bus and core clocks will be restarted and

the PC will be redirected to the reset vector. The PRF flag will be set to indicate periodic

reset; write 1 to PRFACK to clear this flag.

All registers will continue to hold their programmed values after interrupt or reset is taken.

13.6.3 STOP1 mode

If the module generates a wakeup interrupt the module will cause the MCU to exit the

power saving mode as a POR. MCU will have the wakeup interrupt pending and once

CLI opcode is executed PC will be redirected to wakeup interrupt vector address. The

WUF flag will be set to indicate wakeup timer interrupt, write 1 to WUFACK to clear this

flag.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

112 / 182

If the module generates a periodic reset the module will cause the MCU to exit the power

saving mode as a POR. The PRF flag will be set to indicate periodic reset; write 1 to

PRFACK to clear this flag. The SRS register will have just the POR bit set.

In this STOP mode exit all registers will continue to hold their programmed values.

13.6.4 Active BDM/foreground commands

The PWU is frozen in ACTIVE BACKGROUND mode or executing foreground

commands, so PWU counters will also be stopped. Normal PWU operation will resume

as MCU exits BDM or foreground command is finished.

14 LF Receiver

The low-frequency receiver (LFR) is a very low-power, low-frequency, receiver system for

short-range communication in TPMS. The module allows an external coil to be connected

to two dedicated differential input pins. In TPMS systems a single coil may be oriented

for optimal coupling between the receiver in the tire or wheel and a transmitter coil on the

vehicle body or chassis.

This LFR system minimizes power consumption by allowing flexibility in choosing

the ratio of on to off times and by turning off power to blocks of circuitry until they are

needed during signal reception and protocol recognition. In addition, this LFR system

can autonomously listen for valid LF signals, check for protocol and ID information so the

main MCU can remain in a very low power standby mode until valid message data has

been received.

The LFR can be configured for various message protocols and telegrams to allow it to

be used in a broad range of applications. The message preamble must be a series of

Manchester coded bits at the nominal 3.906-kbps data rate. A synchronization pattern

is used to mark the boundary between the preamble and the beginning of Manchester

encoded information in the message body. The synchronization pattern is a non-

Manchester specific TPMS pattern. Messages can optionally include none, an 8-bit or

a 16- bit ID value. Messages may contain any number of data bytes with the end-of-

message indicated by detecting an illegal Manchester bit at a data byte boundary.

It is not intended that LFR may be actively receiving/decoding LF signals while physical

parameter measurements are being made; or during the time that the RFM may be

actively powered up and/or transmitting RF data. The resulting interactions will degrade

the accuracy of the LF detection.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

113 / 182

AMP1

LFA

LFB

BUFF1 AMP2

DATA SLICER

BUFF2 AMP3 BUFF3

Vref_sensitivity

aaa-028019

SENSITIVITY

CARRIER

DETECTOR

CLAMP

RECTIFIER0 RECTIFIER1 RECTIFIER2

SUMMATOR AVERAGE

FILTER

RECTIFIER3

LOGIC BLOCK 2

· DATA DECODING

129 kHz

typ

1 kHz_clock typ

LOGIC BLOCK 1

· ON/OFF CYCLING

· CARRIER DETECTION

Figure 26. Block diagram

For definitions of the acronyms and detailed descriptions of the bits and/or byte registers,

please refer to Section 14.17 "LFR register definition".

14.1 Features

Major features of the LFR module include:

•Differential input LF detector (two dedicated pins):

–Selectable sensitivity (two levels: Low Sens (LS) and High Sens (HS)).

–Thresholds trimmed at the factory with trim setting saved in nonvolatile memory.

–LFR has a reference oscillator (LFRO) trimmed at the factory with trim setting saved

in nonvolatile memory.

–Selectable signal sampling time interval and on-time.

–Sample interval and on times controlled by LFR state machine or directly by the

MCU.

•Configurable receive mode:

–Simple LF carrier detection/Telegram decode. (CARMOD)

•Configurable message protocol (telegram structure):

–Various SYNC decoding (SYNC[1:0])

6-bit time SYNC requirements

7.5-bit time SYNC requirements

9-bit time SYNC requirements

–Optional ID (ID[1:0])

8-bit or 16-bit ID

On or off

–0-n bytes of message data. End-of-data marked by loss of Manchester at a byte

boundary.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

114 / 182

•Optional continuous monitoring and decode of the LF detector.

•Selectable MCU interrupt when a received data byte is ready in an LFR buffer, when

a Manchester error is detected in the frame, when an ID is received or when a valid

carrier has been detected.

14.2 Modes of operation

The LFR is a peripheral module on an MCU. After being configured by application

software, the LFR can operate autonomously to detect and verify incoming LF messages.

When a valid message or carrier pulse is received and verified the LFR can wake the

MCU from standby modes to read received data or act upon a carrier detection.

The primary modes of operation for the LFR are:

•Disabled. Everything off and drawing minimal leakage current. LFR register contents

will be retained.

•Carrier detect/listen. Minimum circuitry enabled to detect any incoming LF signal, check

it for the appropriate signal level, frequency and duration.

•TPMS protocol verification.

•Data reception.

14.3 Power management

In addition to using low power circuit design techniques, the LFR module provides

system-level features to minimize system energy requirements. In an MCU that includes

the LFR module, all MCU circuitry except a very low current 1-kHz oscillator (LFO) and

minimum regulator circuitry can be disabled. After a reset, the MCU would initialize the

LFR module and then enter a very low power standby mode (depending upon the MCU,

this could be lower than 1 uA for the MCU portion). The LFR module includes everything

it needs to periodically listen for LF messages, perform Manchester decoding, verify the

message telegram, and assemble incoming data into 8-bit bytes. The LFR does not wake

the MCU unless a valid message is being received and a data byte is ready to be read.

The LFR cycles between an off state, where everything is disabled, and an on state,

where it listens for a carrier signal. The on time is controlled by LFONTM[3:0] control bits

in the LFCTL2 register. The time between the start of each sample on time is controlled

by LFSTM[3:0] control bits in the LFCTL2 register. Even lower duty cycles can be

achieved by using the MCU to wake once per second and maintain a software counter

to delay for an arbitrarily long time before enabling the LFR to perform a series of carrier

detect cycles.

Within the LFR, circuits remain disabled until they are needed. When the LFR is listening

for a carrier signal, only a 1-kHz clock source, a portion of the input amplifier and a

periodic auto-zero are running. After a carrier signal is detected, with high enough

amplitude, frequency and duration the LFRO oscillator is enabled so the LFR can begin

to decode the incoming information.

The LFR module has a power up settling time of 2-LFO period before any active

operations. In the ON/OFF cycle, those 2 ms are hidden in the sampling time during the

off time.

14.4 Input amplifier

The LFR module receives LF modulated signals through a dedicated differential pair of

inputs which is connected to an external coil. The enable control (LFEN) allows the user

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

115 / 182

to enable the LF input depending on the application requirements. The SENS[1:0] bits

in the LFCTL1 register allows the user to select one of two input sensitivity thresholds

which determines the signal level required before the input carrier will be detected. The

sensitivity setting is used during carrier detection but does not affect reception after

the carrier has been detected. When the CARMOD bit is cleared, after a carrier with

sufficient amplitude, frequency and duration has been detected the output stage of the

amplifier is turned on to allow data reception.

14.5 LFR data mode states

The modes of operation the LFR state machine will sequence as shown in Figure 27.

14.6 Carrier detect

Carrier detection includes a check for a certain number of edges on a signal that is

greater than the input sensitivity threshold. During the check for carrier edges, only the

1 kHz low frequency oscillator (LFO) clock source is running so power consumption

remains very low.

During carrier detection the incoming signal is amplified and passed through a sensitivity

threshold comparator. The SENS[1:0] bits in the LFCTL1 register selects two levels

of sensitivity and determines the signal amplitude that is needed to allow edges to be

seen at the output of the sensitivity threshold comparator. When a carrier is above this

threshold, a block is powered on and validates the carrier. This frequency and duration

check function can be disabled by clearing the VALEN bit. If VALEN is set, the block

checks for the carrier duration and the carrier frequency. The time needed to validate

a carrier is programmed by the LFCDTM register. The carrier frequency should be

125 kHz. If the signal above the threshold is not within the frequency range or not present

during enough time, then the carrier will not be validated and the validation block will turn

off.

If no carrier signal is validated within the on time of the LFR, the state machine returns

to the off state and the alternating cycle of on time and off time continues. Carrier edge

counts start at zero when a new on time begins.

In the data mode (CARMOD = 0), if the required number of carrier edges are detected

before the end of the ON time, the LFR will remain ON to complete the reception of a

message telegram.

In the carrier detect mode (CARMOD = 1) there is no need to enable other LFR circuitry

to evaluate any other message components after the required number of carrier edges

are detected. One or several consecutive carriers can be validated by this process

before the LFCDF flag is set. The LFCC control bits are used to program the number of

consecutive ON times where a complete carrier validation is needed before interrupting

the MCU. In this case, the LFCDF flag is set and, provided the LFCDIE interrupt enable

is also set, an interrupt is issued to wake the MCU. In carrier detect mode, the LFCDIE

control bit should always be set because the intended purpose of the carrier detect mode

is to wake the MCU when a carrier is detected. When LFCDF is set, the LFR waits until it

is cleared before it continues the alternating cycle of on time and off time, starting with an

off time.

In data mode, when a carrier is detected the averaging filter is powered on and the

LFR continues to the next state to look for the rest of a message telegram; and the LFR

module will search for valid SYNC word (with length programmed through the SYNC

bits in the LFCTL3 register depending on preamble type). If the external LF field is not

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

116 / 182

a TPMS frame, a timeout will turn off the LFR module. This timeout can be program

through TIMOUT bit the LFCTL4 register.

aaa-028020

Disabled

Analog powerup

Data ready flag

Continously ON

LFCDF

LFEN = 0 or SRES

(at any state)

LFEN = 1

Frequency error

Sniff for carrier

Increment carrier counter

Carrier counter = LFCC +1

Rise carrier detect flag

Carrier counter ?LFSCC +1

Carrier validated

yes

TOGMOD

No signal above

sensitivity threshold

LFCDTM

not reached

Signal above threshold

AND VALEN = 1

Signal above threshold

AND VALEN = 0 Frequency and

duration check

Rise carrier detect flag

Start analog demode chain

Start timeout

Start analog demod chain

Wait OFF time

(= Tsampling - Ton)

TPU = 2 LFO cycles

TDEC

CARMOD = 1

No SYNC detected

ON time completed

Continously ON

Search for SYNC

Decode ID

Rise ID flag

Rise error and EOM flag

Rise data, ready flag

Rise error flag

Rise OVF flags

Decode data

ON time completed

Frequency and

LFCDTM duration check

CARMOD = 0

AND DECEN = 1

CARMOD = 0

AND DECEN = 0

Invert CARMOD

yes

no no

yes

ONMODE

yes

ON time completed

yes

Tsampling completed

Switch off

yes

5 LFO cycles

yes

SYNC detected

Correct ID

Error in first bit Error Error

Error in first bit

Wrong ID

ID not complete Timeout

Figure 27. FXTH87E LFR state machine diagram

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

117 / 182

14.7 Auto-zero sequence

An auto-zero sequence is performed periodically on the input amplifier to cancel offset

errors. During reception of the SYNC pattern and body of the message, auto-zero

operations are synchronized to data edges of the incoming signal to avoid interfering

with normal reception. During the auto-zero sequence, the input amplifier is temporarily

disconnected from the external coil and connected to ground. The auto-zero sequence

takes roughly 64 μs. It is performed at each LFO period in carrier mode and on one over

four decoded data edges in data mode.

When the DECEN bit is cleared, the auto-zero sequence is performed at each LFO

period. During the 64 μs of the auto-zero sequence, the receiver is holding the state

"0" or "1" previously decoded. Since the LFR receiver is not active during this time, the

possible data-rate that the analog can detect is at least limited by this duration.

14.8 Data recovery

Rectified signals from the amplifier output are connected to the input of an averaging filter

and data slicer. The slicer thus compares the rectified signal with its own average value

to decode the data. When a carrier is present, the slicer output voltage rises and when

the carrier stops the slicer output voltage falls. The output of this comparator provides

a binary digital signal that indicates whether the carrier is present or not. This digital

signal is connected to the data clock recovery circuit, the SYNC detect circuit, and the

Manchester decoder circuit.

The Manchester decoder uses the digital output of the data slicer to detect the logic level

of each incoming data bit and to synchronize the decoder state machine. The LFPOL

polarity bit in the LFCTRLA register selects the expected encoding of the Manchester

data bit.

If a strong signal (above roughly 100 mV p-p differential) is entered into the LFR,

the input impedance will switch instantaneously to a lower programmed value (the

LOWQ[1:0] bits in the LFCTRLC) and be maintained during the current data packet if the

DEQEN bit is set. At the next ON time, the default high input impedance will be set again.

The strong signal detection and the automatic impedance change can be disabled by

clearing the DEQEN bit.

14.9 Data clock recovery and synchronization

Data clock recovery and synchronization takes place during the SYNC portion of an

incoming message. The preamble must be modulated Manchester data. The type

of required SYNC pattern determines the allowed preamble type depending on the

SYNC[1:0] control bits.

The design data rate is 3.906 kbps which gives a bit time equivalent to about 32 cycles of

the LF carrier frequency. In a Manchester encoded bit time, the carrier should be present

for either the first half or the second half of the bit time depending on whether the bit is a

logic zero or a logic one.

The LFRO clock source is 32 times the target data rate. The LFRO is used for decoding

data and also sequencing auto-zero operations.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

118 / 182

14.10 Manchester decode

When the LFPOL bit is clear, a logic one bit is defined as no LF carrier present for the

first half of the bit time; and a logic zero bit is defined as LF carrier present for the first

half of the bit time as shown in Figure 28. Another way to say this from the point of view

of the data slicer output is that a logic zero bit has a falling edge at the middle of the bit

time and a logic one bit has a rising edge at the middle of the bit time. The data slicer

threshold is dynamically adjusted to the midpoint between the carrier-present and no-

carrier levels at the summing node for the rectified output of the LF input amplifier.

logic 1

logic 0

0.5 T 0.5 T

aaa-028021

LF input

(shaded area

is LF carrier)

Data bit

(data slicer

output)

Data slicer threshold

T = 1 bit time at the data rate (ex. 256 s at data rate of 3.906 kbps)

Figure 28. Manchester encoded datagram for LFPOL = 0

When the LFPOL bit is set, a logic one bit is defined as LF carrier present for the first half

of the bit time; and a logic zero bit is defined as no LF carrier present for the first half of

the bit time as shown in Figure 28.

logic 0

logic 1

0.5 T 0.5 T

aaa-028022

LF input

(shaded area

is LF carrier)

Data bit

(data slicer

output)

Data slicer threshold

T = 1 bit time at the data rate (ex. 256 s at data rate of 3.906 kbps)

Figure 29. Manchester encoded datagram for LFPOL = 1

14.11 Duty-cycle for data mode

The definition of the duty-cycle for the Manchester encoded data depends on the relative

rise and fall times of the incoming LF carrier as shown in Figure 30.

1 0

aaa-028023

Figure 30. Definition of duty-cycle of 40%

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

119 / 182

Regarding the SYNC pattern which is non-Manchester coded, the duty cycle is applied

on all falling edges with the same proportion as a 1T Manchester symbol, as shown in

Figure 31.

aaa-028024

Figure 31. Impact of duty-cycle on SYNC pattern

14.12 Input signal envelope

The combination of the external LF antenna and any external components as shown

in Figure 32 should not significantly filter the envelope of the LF carrier as shown in

Figure 33. Excessive filtering will cause the received message error rate (MER) to

increase.

FXTH87E

· Antenna Q-factor acts as a 1st order

low-pass filter on the LF envelope

· Filter time constant: t = R.C.

· Recommended τ < 15 s

LFA

LFB

Antenna model

aaa-028025

C R

Figure 32. Antenna Q-factor equivalent model for the LF envelope

· Recommended τ < 15 s

· Ideal case: τ = 0 (Q-factor = 0)

· Use case: τ > 0 (Q-factor > 0)

aaa-028026

High state part of

Manchester symbol

Low state part of

Manchester symbol

Vpp

0.63 × Vpp

Figure 33. LF envelope filtering

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

120 / 182

14.13 Telegram verification

The LFR has control bits to allow flexibility in the telegram format and protocol to allow

the LFR to adapt to a variety of systems. The LFR can operate in a normal data receive

mode where it receives complete telegrams, or in a carrier detect mode where it only

checks for a carrier. In the carrier detect mode, as soon as a carrier is detected, the

LFCDF flag is set. If LFCDIE is also set, an interrupt request is sent to wake the MCU

The format of the complete Manchester encoded datagram is comprised of a Manchester

data preamble (series of Manchester 1s or 0s), a synchronization period, an optional ID,

and zero to n data bytes.

The synchronization period can be used for synchronizing the beginning of the data

packet. The SYNC pattern that follows the preamble can be either a 6-, 7.5- or 9 bit-time

non-Manchester pattern as shown in Figure 34.

aaa-028027

6-bit

(6 T)

pattern

SYNC[1:0] = 01

7.5-bit

(7.5 T)

pattern

SYNC[1:0] = 10

9-bit

(9 T)

pattern

SYNC[1:0] = 11

T T

2 T 2 T

T1.5 T

T T

T2 T 2 T

T3 T

1.5 T T T

T2 T 2 T

Figure 34. SYNC patterns

These patterns would normally not appear anywhere in the Manchester encoded portion

of a message so there is no possibility that the LFR could accidentally synchronize

to a message that was already in progress when the LFR started listening for a

message. These patterns are also complex enough so that it is very unlikely that noise

or interference could be mistaken for these SYNC patterns. In the data mode and after

the detection of a valid carrier, the LFR will decode the data stream waiting for the SYNC

word. Should this carrier not be an accepted TPMS type, no SYNC will be received and

the LFR module will stay in data receive mode forever. A timeout counter is thus started

after a carrier detection and will stop the receiver if reaching the programmed value

selected by the TIMOUT[1:0] bits in the LFCTL4 register. This timeout counter is clocked

by the internal LFRO clock.

The LFR can be configured to have an optional 0, 8-bit or 16-bit ID after the SYNC

pattern. If the ID value matches the received ID, the message is accepted. The ID value

can be used to identify a specific receiver, a message type, or some other identifier as

defined by application software.

Any number of data bytes can be included after the ID. The LFR begins to assemble

data bytes from the incoming signal as soon as the ID check is complete. If the first bit-

time after the last bit of the ID does not conform to Manchester coding requirements,

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

121 / 182

the LFR considers the message complete and terminates the LFR operation without

setting the data ready flag (LFDRF). If data follows the ID, it is serially received and when

8 bits have been received the LFR copies this byte into the LFDATA register and sets

the LFDRF flag. If the LFDRIE interrupt enable is also set (and it should be), an interrupt

request is sent to wake the MCU so it can read the data and process it according to the

instructions in the application program. Additional bytes are received until a bit time that

is not Manchester encoded is found. If a non-Manchester bit time is found, the LFERF bit

will be set and indicates a Manchester coding error. If this happens on the first bit of the

next byte of the message the LFEOMF bit will also be set.

The preamble is a period of Manchester bits before the SYNC pattern as shown in

Figure 35. The SYNC pattern will only be matched for the bit times specified by the

SYNC[1:0] control bits. Depending on the expected SYNC pattern the allowed preambles

is as described for the SYNC[1:0] bits in the LFCTL3 register.

aaa-028028

PREAMBLE SYNC HIGH ID DATA DATA

6, 7.5 or 9 T 0, 8 T or 16 T

IDSEL[1:0] 8 T

tLFPRE Repeat for 0-n bytes

LOW ID

Figure 35. Telegram format (carrier preamble)

14.14 Error detection and handling

When the DECEN bit is set, LFR messages are monitored for data rate or SYNC errors,

incorrect message ID, and Manchester coding errors. When an error is detected the LFR

goes back to sniff mode until the end of ON time completion, if ONMODE is set; or turns

off until the start of the next scheduled sampling interval, if ONMODE is cleared. Because

the MCU uses more power than the LFR module, it is desirable to keep the MCU in low

power standby modes as much as possible. Therefore, the handling of these errors will

be performed by the LFR and not require additional software processing by the MCU.

When the DECEN bit is clear, there is no monitoring on data. The MCU needs to poll

the state of the LFDO bit and create its own decoding scheme within software on the

detected signal. To be able to start the polling only when data are received, the carrier

detection flag is enabled in data mode when DECEN = 0. During data reception, the

auto-zero sequence is performed at each LFO period. The MCU needs also to determine

the end of the telegram and turn off the LFR (LFEN = 0) during two LFO cycles before

any other operations.

14.15 Continuous ON mode

In the Continuously ON mode, the LFR module will remain on continuously while the

LFEN bit is set. The Continuously ON mode is controlled by setting the LFSTM[3:0] bits.

In the Continuously ON mode, if a signal is successfully processed by the digital, the LFR

module will stop and restart automatically. The gap is 2-3 LFO periods. Also if TOGMOD

bit is set, the LFR module will stop after the ON time cycle and re- start automatically,

after having changed the CARMOD bit.

14.16 Initialization information

When power is applied to the MCU, the LFR must be initialized and configured before it

can begin to receive LF messages. Several systems in the LFR require factory trimming

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

122 / 182

to ensure operation within specified limits. After these trim values are written, they remain

constant until the next MCU reset.

The application program must set up control bits and registers to configure the LFR to

determine the structure of the message telegram, the input sensitivity, and other LFR

options. It is good practice to clear the flags in the LFS register before enabling interrupt

sources in order to avoid any immediate interrupt requests.

14.17 LFR register definition

The LFR module uses eight addresses in the MCU memory map for data, control, and

status registers. This section consists of register descriptions. Each control register

(LFCTLx) should be modify when the LF is off (LFEN = 0). Modification of the control

registers "on-the-fly" might lead to unknown state. Each turn off of the LFR (LFEN

= 0) should be followed by at least two LFO cycles before trying to restart the LFR

(LFEN = 1).

14.17.1 LF control register 1 (LFCTL1)

LFCTL1 contains the main LF enable control, detection protocol format controls, and

input sensitivity controls. The LFCTL1 register also contains a register select bit, LPAGE.

Table 106. LFR control register 1 (LFCTL1) (address $0020)

Bit76543210

R 0

WLFEN SRES CARMOD LPAGE IDSEL[1:0] SENS[1:0]

Reset00000000

Table 107. LFCTL1 register field descriptions

Field Description

LFEN

LF Enable — This read-write control bit is used to enable or disable the LF receiver. Once this bit is set

the LFR will go through a power-up sequence that starts on the next rising edge of the LFO clock. The first

complete cycle of the LFO is used to power up the LFR circuits. Following this startup time the auto-zero

sequence is performed for 64 μsec and then the LFR is ready to receive signals.

0 LF receiver in standby

1 LF receiver active

SRES

Soft Reset — This read/write bit controls the soft reset of the LFR. The bit is self reset and always reads as

a logical zero.

0 Reset completed

1 Start a soft reset

CARMOD

Carrier Mode — This read/write control bit selects the basic operating mode for the LFR.

0 Data receive mode

1 Carrier detect mode — wake the MCU when a carrier signal is detected if LFCDIE is set

LPAGE

LFR Page Select — This read/write bit is used is used to select the register page access. The LPAGE bit

has no effect on the LFCTL1 and LFCTL2 registers. This bit is cleared by LFR reset.

0 Access page 0

1 Access page 1

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

123 / 182

Field Description

3:2

IDSEL[1:0]

Wakeup ID Selection — Selects the existence and length of the wakeup ID. Reset clears these bits.

00 No ID expected

01 8-bit ID based on the contents of the LFIDL register

10 16-bit ID based on the contents of the LFIDH and LFIDL registers

11 8-bit ID matches the contents of either the LFIDH or LFIDL registers

1:0

SENS[1:0]

Sensitivity Control — These two read/write control bits select the sensitivity thresholds for the LFR input.

These thresholds apply to the detection portion of a message. If the input level is below the SNODET_x level,

no signal will be detected. If the level is above SDET_x, the signal will be detected. Sensitivity settings are

only used in the carrier detect path and do not affect reception of the message body.

00 Performance not specified

01 Low sensitivity (SDET_L; SNODET_L)

10 High sensitivity (SDET_H; SNODET_H)

11 Performance not specified

14.17.2 LF control register 2 (LFCTL2)

LFCTL2 contains the selection bits for the length of the LF sampling ON time and the

time interval between samples as shown in Table 108.

Table 108. LFR control register 2 (LFCTL2) (address $0021)

Bit76543210

WLFSTM[3:0] LFONTM[3:0]

Reset01100000

Table 109. LFCTL2 register field descriptions

Field Description

7:4

LFSTM[3:0]

LF Sampling Time Interval Select — These read/write control bits select the length of time between when

the LFR input detector is turned on as set by the LFONTM bits in LFCTL2 register. The initial sampling

interval starts with the LFO clock following a write to these bits. A reset of the LFR results in the value being

set to binary 0110.

0000 Continuous ON mode (see Section 14.15 "Continuous ON mode")

0001 Sampled decoding mode every 16 LFO clock periods (16 milliseconds nominal)

0010 Sampled decoding mode every 32 LFO clock periods (32 milliseconds nominal)

0011 Sampled decoding mode every 64 LFO clock periods (64 milliseconds nominal)

0100 Sampled decoding mode every 128 LFO clock periods (128 milliseconds nominal)

0101 Sampled decoding mode every 256 LFO clock periods (256 millisecond nominal)

0110 Sampled decoding mode every 512 LFO clock periods (512 milliseconds nominal)

0111 Sampled decoding mode every 1024 LFO clock periods (1024 milliseconds nominal)

1000 Sampled decoding mode every 2048 LFO clock periods (2048 milliseconds nominal)

1001 Sampled decoding mode every 4096 LFO clock periods (4096 milliseconds nominal)

1010-1xxx Continuous ON mode (see Section 14.15 "Continuous ON mode")

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

124 / 182

Field Description

3:0

LFONTM

[3:0]

LF Sampling ON Time Select — These read/write control bits select the length of time that the LFR input

detector is turned on at the beginning of each sampling interval set by the LFSTM bits. This ON time is

the net sampling time with any initialization time (maximum of 2 ms) included in the OFF time prior to the

sample ON time (see Figure 36). If a signal is successfully detected, the length of time the detector remains

ON depends on the operating mode. In carrier detect mode (CARMOD = 1) the detector will be turned off

early if the evaluation of the carrier signal is completed before the end of the scheduled ON time. In data

receive mode (CARMOD = 0) the detector will remain ON until the end of the message, an error is detected

or timeout occurrence. Reset forces the LFONTM bits to 0:0:0.

0000 1 LFO clock cycle (1 millisecond nominal)

0001 2 LFO clock cycle (2 milliseconds nominal)

0010 4 LFO clock cycle (4 milliseconds nominal)

0011 8 LFO clock cycle (8 milliseconds nominal)

0100 16 LFO clock cycle (16 milliseconds nominal)

0101 32 LFO clock cycle (32 milliseconds nominal)

0110 64 LFO clock cycle (64 milliseconds nominal)

0111 128 LFO clock cycle (128 milliseconds nominal)

1000 256 LFO clock cycle (256 milliseconds nominal)

1001 512 LFO clock cycle (512 milliseconds nominal)

1010 1024 LFO clock cycles (1024 milliseconds nominal)

1011 1024 LFO clock cycles (1024 milliseconds nominal)

11xx 1024 LFO clock cycles (1024 milliseconds nominal)

Note: The LFONTM selected time must be less than the LFSTM selected time, otherwise the Continuously

ON mode is present.

LFR detector active

LFONTM

LFSTM

Power up

settling time

Power up

settling time

LFONTM*

time segments not to scale

*LFONTM times will differ between LF wakeup and LF datagram reception.

tDEC

LF searching for

SYNC pattern

aaa-028029

Figure 36. LF detector sampling timing

14.17.3 LF control register 3 (LFCTL3)

LFCTL3 contains the control bits for the LF sampling interval and the minimum required

carrier detection time when using the carrier detect mode.

Table 110. LFR control register 3 (LFCTL3) (address ($0022)

Bit76543210

R LFDO

WTOGMOD SYNC[1:0] LFCDTM[3:0]

Reset — 0 0 1 0 0 0 0

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

125 / 182

Table 111. LFCTL3 register field descriptions

Field Description

LFDO

LF Detector Output — This read-only bit follows the bit slicer output signal that goes high during the

presence of a carrier. It may change at any time. This bit is read only and unaffected by any reset.

0 LF detector output low (no signal above threshold)

1 LF detector output high (received signal above threshold)

TOGMOD

LFR Mode Toggle — This read/write bit enables the toggling of the CARMOD bit at each new LFON

sequence. Reset clears this bit.

0 CARMOD bit does not change and determines detector mode.

1 CARMOD bit will be toggled every LFON detection sequence, starting by CARMOD selection.

Therefore, the reception chain will alternately look for a carrier frame or for a data frame.

5:4

SYNC[1:0]

LF SYNC Selection — Selects the type of SYNC pattern as described in Figure 34. Reset presets these

bits to the 01 (6T SYNC) option. Compatible with preamble consisting of minimum 2 ms Manchester data to

allow for proper averaging filter operation.

00 For factory test purposes, not intended for use in any application.

01 6T SYNC pattern

10 7.5T SYNC pattern

11 9T SYNC pattern

3:0

LFCDTM

[3:0]

LF Carrier Detect Time — These read/write control bits select the length of time which the LFR input

detector must detect a carrier before validating it. In carrier mode (CARMOD = 1), if the carrier is active

for at least the time selected by the LFCDTM[3:0] bits and the LFCC counter value is reached, the LFCDF

flag in the LFS register will be set; and if the LFCDIE control bit is also set, the MCU will be interrupted

(wakeup).

In the data receive mode (CARMOD = 0) the LFCDTM[3:0] bits select the length of time which the LFR

input detector must detect a carrier before the effective receive chain is powered on. Once the carrier has

been validated the LFCDTM[3:0] bits ignored during the decode of the rest of the data.

Reset of the LFR results in LFCDTM[3:0] being reset to 0:0:0:0. The resulting carrier detect times are

defined by the following number of carrier periods needed to validate the carrier, with the corresponding

time for a carrier at 125 kHz in parenthesis:

0000 Carrier detect = 8 (64 μsec) Data mode detect = 8 (64 μsec)

0001 Carrier detect = 16 (128 μsec) Data mode detect = 8 (64 μsec)

0010 Carrier detect = 32 (256 μsec) Data mode detect = 8 (64 μsec)

0011 Carrier detect = 64 (512 μsec) Data mode detect = 8 (64 μsec)

0100 Carrier detect = 128 (1024 μsec) Data mode detect = 8 (64 μsec)

0101 Carrier detect = 256 (2048 μsec) Data mode detect = 8 (64 μsec)

0110 Carrier detect = 512 (4096 μsec) Data mode detect = 8 (64 μsec)

0111 Carrier detect = 1024 (8192 μsec) Data mode detect = 8 (64 μsec)

1000 Carrier detect = 8 (64 μsec) Data mode detect = 8 (64 μsec)

1001 Carrier detect = 16 (128 μsec) Data mode detect = 16 (128 μsec)

1010 Carrier detect = 32 (256 μsec) Data mode detect = 32 (256 μsec)

1011 Carrier detect = 64 (512 μsec) Data mode detect = 64 (512 μsec)

1100 Carrier detect = 128 (1024 μsec) Data mode detect = 128 (1024 μsec) (see note)

1101 Carrier detect = 256 (2048 μsec) Data mode detect = 256 (2048 μsec) (see note)

1110 Carrier detect = 512 (4096 μsec) Data mode detect = 512 (4096 μsec) (see note)

1111 Carrier detect = 1024 (8192 μsec) Data mode detect = 1024 (8192 μsec) (see note)

Note: The auto-zero sequence needs to be performed every 1 ms. Therefore, LFR

detection times of 1024, 2048, 4096 and 8192 μsec the auto-zero sequence will be done

at each 1 ms interval. This auto-zero sequence lasts for 64 μsec. If the carrier is detected

again at the end of the auto-zero sequence it is assumed that the carrier was there for

the complete 64 μsec period of the auto-zero.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

126 / 182

14.17.4 LFR control register 4 (LFCTL4)

LFCTL4 contains local interrupt enable control bits. The provided I-interrupts are not

globally masked by the I bit in the CPU’s CCR, setting one or more of these interrupt

enable control bits will cause a CPU interrupt to be requested whenever the flag bit

associated with the corresponding LFR interrupt source becomes set. It is good practice

to clear any flag bits in the LFS register before setting interrupt enable bits in this register

in order to avoid an immediate interrupt request.

Table 112. LFR control register 4 (LFCTL4) (address $0023)

Bit76543210

WLFDRIE LFERIE LFCDIE LFIDIE DECEN VALEN TIMOUT[1:0]

Reset00001100

Table 113. LFCTL4 register field descriptions

Field Description

LFDRIE

LFR Data Register Full Interrupt Enable — This read/write bit enables interrupts to be requested when the

LFR data register is full. Reset clears LFDRIE.

0 LFDRF interrupts disabled. Use software polling.

1 LFR Data Register Full interrupts are enabled. If LFDRIE is set, then an interrupt is requested when

LFDRF = 1.

LFERIE

LFR Error Interrupt Enable — This read/write bit enables interrupts to be requested when the LFR detects

an error in reception of a non-Manchester encoded bit time following the SYNC time. Reset clears LFERIE.

0 LFERF interrupts disabled. Use software polling.

1 LFERF interrupts are enabled. If LFERIE is set, then an interrupt is requested when LFERF = 1.

LFCDIE

LFR Carrier Detect Interrupt Enable — This read/write bit enables the LFCDF interrupt when the LFR

detects the number of samples with an LF signal defined by the LFCDTM bits in the LFCTL3 register. The

LFCDIE is ignored when the LFR is operating in the data mode (CARMOD = 0), except when DECEN is

cleared. Reset clears LFCDIE.

0 LFCDF interrupts disabled.

1 LFR LFCDF interrupts are enabled. If LFCDIE is set, then an interrupt is requested when LFCDF = 1.

LFIDIE

LFR ID Detect Interrupt Enable — This read/write bit enables interrupts to be requested when the LFR

detects a match to the ID code selected in the LFIDH:L registers. Reset clears LFIDIE.

0 LFIDF interrupts disabled.

1 LFIDF interrupts are enabled. If LFIDIE is set, then an interrupt is requested when LFIDF = 1.

DECEN

LF Digital Decode Enable — This read/write bit enables the data processing by the digital decoder. When

disabled, the frame format (Manchester, data-rate, SYNC, data) is not checked. There is no more error flag

assertion (data, error, ID). The MCU should then poll the LFDO bit to extract from the analog detector the bit

stream. Reset sets the DECEN bit.

0 Digital decoder is disabled.

1 Digital decoder is enabled.

VALEN

LF Validation Enable — This read/write bit enables the carrier validation process. Reset sets this bit.

0 Carrier Validation disabled.

1 Carrier Validation enabled.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

127 / 182

Field Description

1:0

TIMOUT[1:0]

SYNC Time Out Select — These two read/write bits select the period of time that the LFR will search for

a SYNC pattern in the data mode. If the SYNC pattern is not detected the LFR will be turned off after this

delay time. These time intervals are clocked by the internal LFRO clock. Reset clears TIMOUT bit.

00 SYNC word is continuously searched — no timeout.

01 SYNC search time set to nominal 8 milliseconds.

10 SYNC search time set to nominal 24 milliseconds.

11 SYNC search time set to nominal 48 milliseconds.

14.17.5 LFR status register (LFS, LPAGE = 0)

LFS contains the data ready status flags. It is only accessible when the LPAGE bit is

clear.

Table 114. LFR status register (LFS, LPAGE = 0) (address $0024)

Bit76543210

R LFDRF LFERF LFCDF LFIDF LFOVF LFEOMF 0

WLPSM LFIAK

Reset00000010

= Reserved

Table 115. LFS register field descriptions

Field Description

LFDRF

LF Data Ready Flag — This read-only status flag is set when a complete byte of data has been received by

the LFR. An interrupt is sent to the MCU if the LFDRIE bit is set. Clear LFDRF by writing a one to the LFIAK

bit or reading the LFDATA register. LFDRF is also cleared by reset.

0 No new data in LFDATA register.

1 A new byte of data has been received and can be read from the LFDATA register.

LFERF

LF Receive Error Flag — In data receive mode, this read-only status flag is set when a non-standard bit

time is detected in the Manchester data mode. Any received data bits before the error occurs are placed in

the data buffer. In carrier detect mode, this read-only status flag is not used and remains clear. An interrupt

is sent to the MCU if the LFERIE bit is set. Clear LFERF by writing a one to the LFIAK bit. LFERF is also

cleared by reset.

0 Normal operation.

1 Error detected in the Manchester data mode.

LFCDF

LF Carrier Pulse Detect Flag — In carrier detect mode, this read-only status flag is set when the number

of consecutive carrier validations set by the LFCC bits in is reached. Note that the LFCC function is not

working if TOGMOD = 1. Clear LFCDF by writing a one to the LFIAK bit. LFCDF is also cleared by reset.

0 Normal operation.

1 Carrier detection has occurred.

LFIDF

LF ID Detect Flag — In data receive mode, this read-only status flag is set when the received ID matches

the stored value. This interrupt can be generated even if no data bits follow the ID. An interrupt is sent to the

MCU if the LFIDIE bit is set. Clear LFIDF by writing a one to the LFIAK bit. LFIDF is also cleared by reset.

0 Normal operation.

1 wakeup ID has been detected.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

128 / 182

Field Description

LFOVF

LF Receive Data Overflow Flag — In data receive mode, this read-only status flag is set when a complete

byte of data has been received and written into the LFDATA register, but the previously received byte was

not read from LFDATA register yet. This indicates that the MCU has lost the previously received data byte.

In carrier detect mode, this read-only status flag is not used and remains cleared. No separate interrupt

is generated by this specific flag bit because the LFDRF flag would serve that purpose. Clear LFOVF by

writing a one to the LFIAK bit. LFOVF is also cleared by reset.

0 Normal operation.

1 Previous data over-written before MCU read it.

LFEOMF

LF Receive Data EOM Flag — In data receive mode, this read-only status flag is set when a complete

byte of data has been received and written into the LFDATA register and an end-of-message Manchester

encoding error occurs. In carrier detect mode, this read-only status flag is not used and remains clear. No

interrupt is generated by this flag bit because the LFERF flag would serve that purpose. Clear LFEOMF by

writing a one to the LFIAK bit. LFEOMF is also cleared by reset.

0 No EOM detected.

1 EOM detected.

LPSM

Low Power Sniff Mode — This bit used to activate the low power consumption during SNIFF mode. It saves

approximately 1 μA with a trade-off of an additional 200 μs in transition from carrier to data mode. LPSM is

set by reset.

0 Low time transition from carrier to data mode

1 Low consumption during sniff mode

LFIAK

LF Interrupt Acknowledge — Writing a one to the LFIAK bit clears the LFDRF, LFERF, LFCDF, LFIDF,

LFOVF and LFEOMF flag bits. When a one is written to the LFIAK, it is automatically cleared at the next

positive edge of the MCU bus clock. Then, reading the LFIAK bit is allowed but will always return zero.

Writing a zero the LFIAK bit has no effect. Reset has no effect on this bit.

0 No effect.

1 Clears the LFDRF, LFERF, LFCDF, LFIDF, LFOVF and LFEOMF flag bits.

14.17.6 LFR data register (LFDATA, LPAGE = 0)

The LFDATA is a read-only register that contains the most recent received data value. It

is only accessible when the LPAGE bit is clear. As data is serially received by the LFR, it

is assembled into 8-bit values. When a new complete 8-bit value is received, it is moved

into the LFDATA register, over-writing any previous value, and the LFDRF data ready

flag is set to indicate a value is available for the MCU to read. If a previous value was

ready but was not read out of the LFDATA register before a new data byte is ready, the

LFOVF overflow flag is also set to indicate this overflow condition. Writes to LFDATA

have no meaning or effect.

Table 116. LFR data register (LFDATA) when LPAGE = 0 (address $0025)

Bit76543210

R RXDATA[7:0]

Reset00000000

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

129 / 182

Table 117. LFDATA register field descriptions

Field Description

7:0

RXDATA[7:0]

Receive Data [7:0] — This is the received data from the LFR when in the data mode. All bits are read-only

and any writes to these bits will be ignored. Reading this register will clear the LFDRF.

14.17.7 LFR ID registers (LFIDH:LFIDL, LPAGE = 0)

These two 8-bit read/write registers hold one of two ID values for LF messages. They are

only accessible when the LPAGE bit is clear. The type of ID checking can be selected

or disabled by using the IDSEL[1:0] bits in the LFCTL1 register. When ID checking is

enabled, the ID value received through the LFR must match the contents of the LFIDH

and/or LFIDL registers depending on the IDSEL bits or the message will be ignored and

the MCU will remain in standby mode to minimize power consumption. All these bits are

cleared by a reset.

Table 118. LFR ID low byte (LFIDL) (address $0026)

Bit76543210

WID[0:7]

Reset00000000

Table 119. LFR ID high byte (LFIDH) (address $0027)

Bit76543210

WID[15:8]

Reset00000000

Table 120. LFR ID register field description

Field Description

ID[15:0] ID bits 15 through 0 — These read/write bits contain bits 15 through 0 of the 16-bit ID value.

14.17.7.1 LF Control E — LFCTRLE

Table 121. LF control E (LFCTRLE) (address $0021)

Bit76543210

WAZSC2 AZSC1 AZSC0

Reset00000000

= Reserved

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

130 / 182

Table 122. LFCTRLE register field description

Field Description

7-3

Reserved Reserved bits — Not for user access.

2-0

AZSC

LOGAMP AZ Sequencer Control — Control bits for AZ and trim within the LOGAMP.

X00 Nominal AZ sequence — recommended setting

X01 Short amp output release, max delay with Rects

X10 Short amp output release, max delay with Amp input

X11 All short, max delay with end of AZ

0XX Nominal sensitivity trim — recommended setting

1XX Sensitivities shifted by — 4 trim steps

14.17.8 LFR control register D (LFCTRLD, LPAGE = 1)

The LFCTRLD register contains two control bits for the LF detector and decoder. It is

only accessible when the LPAGE bit is set.

Table 123. LFR control register D (LFCTRLD, LPAGE = 1) (address $0022)

Bit76543210

R DEQS

WAVFOF[1:0] AZDC[1:0] ONMODE CHK125[1:0]

Reset00000000

= Reserved

Table 124. LFCTRLD register field descriptions

Field Description

7-6

AVFOF[1:0]

SUM AZ release delay — Control the delay between falling edge of SUM d_az_en input and falling edge of

internal AZ control line.

00 No delay

01 No delay

10 One-half of 125 kHz clock period delay — recommended setting

11 One and one-half of 125 kHz clock periods delay

DEQS

DeQing status register — This read-only status bit allows the reading of the effective activation of the

DeQing System.

0 DeQing system not activated

1 DeQing system activated

4-3

AZDC[1:0]

AZ Digital Control of AZ triggering — In data receive mode, this bits control the triggering of AZ sequence

with respect to both LFCPTAZ value (ref. LFCTRLB register) and the state of the demodulation input data

state.

00 AZ starts after LFCPTAZ numbers of input data edges.

01 Z starts randomly adding –1, 0 or 1 to LFCPTAZ value between each AZ.

10 AZ starts after LFCPTAZ numbers of input data edges and when the input data (d_data) state is 0.

11 AZ starts after LFCPTAZ numbers of input data edges and when the input data (d_data) state is 1 —

recommended setting.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

131 / 182

Field Description

ONMODE

ON Behavior Mode — This read/write bit selects how an error will affect the ON time. This bit is cleared by

reset.

0 Any error will stop the ON time.

1 If remaining ON time, the LFR will go back to sniff mode at any error — recommended setting.

1-0

CHK125[1:0]

Accurate 125 kHz Check — The bit controls the CARVAL frequency check method.

00 CARVAL validates on n (2*32 μs packets), n depending on LFCDTM value — recommended setting for

Low Sensitivity mode.

01 Same as 10.

10 CARVAL validates on n (8*8 μs packet), n depending on LFCDTM value — recommended setting for

High Sensitivity mode.

11 Same as 00.

Note: Setting CHK125[1:0] to either 0x01 or 0x10 increases the immunity to noise and

therefore carries the side effect of narrowing the 125 kHz carrier bandwidth tolerance.

14.17.9 LFR control register C (LFCTRLC, LPAGE = 1)

The LFCTRLC register contains control bits for the LF detector and decoder. It is only

accessible when the LPAGE bit is set.

Table 125. LFR control register C (LFCTRLC, LPAGE = 1) (address $0023)

Bit76543210

WAMPGAIN[1:0] FINSEL[1:0] AZEN LOWQ[1:0] DEQEN

Reset11001000

Table 126. LFCTRLC register field descriptions

Field Description

7-6

AMPG

AIN[1:0]

3rd Amplifier gain — These bits controls the 3rd amplifier gain.

00 Gain of 2 — recommended setting

01 Gain of 3

10 Gain of 4

11 Gain of 6

5-4

FINSEL[1:0]

Final stage select — These bits select the final stage of the LOGAMP.

00 Continuous time biasing — Fixed Gain 6

01 Continuous time biasing — Programmable Gain — recommended setting

10 4th rectifier disabled

11 4th rectifier disabled

AZEN

Data AZ enable — This bit allows the AZ sequence during data frame.

0 AZ during data disabled

1 AZ during data enabled — recommended setting

2-1

LOWQ[1:0]

DeQing Resistor — These bits select the resistor added in parallel to the input network.

00 4 kΩ

01 2 kΩ

10 1 kΩ

11 500 Ω

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

132 / 182

Field Description

DEQEN

DeQing System enable — The bit controls the DeQing system.

0 DeQing disabled.

1 DeQing enabled.

14.17.10 LFR control register B (LFCTRLB, LPAGE = 1)

The LFCTRLB register contains control bits for the LF detector and decoder. It is only

accessible when the LPAGE bit is set.

Table 127. LFR control register B (LFCTRLB, LPAGE = 1) (address $0024)

Bit76543210

WHYST[1:0] LFFAF LFCAF LFPOL LCPTAZ[2:0]

Reset11000100

Table 128. LFCTRLB register field descriptions

Field Description

7-6

HYST[1:0]

Control slicer hysteresis

00 20 mV hysteresis

01 40 mV hysteresis

10 50 mV hysteresis

11 30 mV hysteresis — recommended setting

5-4

LFFAF;

LFCAF

Average filter bi-phase filtering control — Activates bi-phase filtering and control offset value

00 Standard low pass filtering activated — recommended setting

01 Standard low pass filtering activated

10 Bi-phase filtering activated — Low offset from input signal low level

11 Bi-phase filtering activated — High offset from input signal low level

LFPOL

LF Manchester Polarity Select — This read/write bit selects the polarity of the transition in the middle of the

bit time. The LFPOL is not used in Carrier mode. Reset clears LFPOL bit.

0 Zero is falling edge in middle of a bit time, one is a rising edge in the middle of bit time.

1 Zero is rising edge in middle of a bit time, one is a falling edge in the middle of bit time.

2-0

LFCPT

AZ[2:0]

LF auto-zero counter — Applications to set these bits to 0x06 for proper LF operation. These bits tune the

minimum number of data edges between two auto-zero requests during a data frame.

14.17.11 LFR control register A (LFCTRLA, LPAGE = 1)

The LFCTRLA register contains control bits for the LF detector and factory test selects. It

is only accessible when the LPAGE bit is set.

Table 129. LFR control register A (LFCTRLA, LPAGE = 1) (address $0025)

Bit76543210

WLFCC[3:0]

Reset00000000

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

133 / 182

= Reserved

Table 130. LFCTRLA register field descriptions

Field Description

7-4

Reserved Reserved bits — Not for user access.

3-0

LFCC[3:0]

LF Successive Carrier Validations Counter — The value of the LFCC[3:0] bits define how many times the

carrier detect sample ON time detected an LF carrier signal before the LFCDF flag bit set. The flag will be

risen when the number of ON samples with a detected carrier greater than the LFCDTM[3:0] reaches the

value of the LFCC[3:0] bits plus one. The internal count of detected carrier pulses will increment the count

as long as they are consecutive samples. When a sample is encountered without any detected carrier the

count will be reset.

The LFCC register is considered reset in data mode. The first carrier validation will lead to start up of the

receiver chain.

This feature allows the user to define a number of consecutive carrier detections are required before the

flag is risen; and is useful in detecting long duration carrier pulses.

This counter is disabled if TOGMOD = 1.

15 RF module

It is not intended that the RFM may be actively powered up and/or transmitting RF data

while physical parameter measurements are being made; or during the time that the LFR

may be actively receiving/decoding LF signals. The resulting interactions will degrade the

performance of the RF output spectrum.

The FXTH87E consists of an RF module (RFM) with external crystal-driven oscillator,

VCO, fractal-n PLL and RF output amplifier (PA) for an antenna. It also contains a small

state machine controller, random time generator and hardware data buffer for automated

output or direct control from the MCU. The overall block diagram is shown in Figure 37.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

134 / 182

CRYSTAL

OSCILLATOR

CONTROL

REGISTERS

AND LOGIC

AMP

VCO

PHASE

DETECTOR

LOW-PASS

FILTER

FRACTIONAL-N

DIVIDER

256-BIT

DATA BUFFER

MODULATION

CONTROL

STATE

MACHINE

MCU

AVDD

aaa-028030

AVSS

VREG

RINT LFSR

RANDOM

GEN

MFO

500 kHz

VOLT

REG

AVDD

LVD

Figure 37. RF transmitter block diagram

15.1 RF data modes

There are two modes of operation in using the RF output in either the data buffer mode

or MCU direct mode.

15.1.1 RF data buffer mode

In the RF data buffer mode the transmissions are sent by dedicated logic hardware while

the MCU can be put into a low power mode until the transmission is completed. This RF

state machine is clocked by the MFO which is enabled when the SEND bit is set and

when any of the LFR, SMI or MCU are operating.

The RF data buffer consists of a dedicated RFM state machine and a 256-bit data buffer.

The RF data buffer is loaded with whatever data pattern the user software creates. The

number of data bits to be sent is selected by the FRM[7:0] control bits. The control logic

is triggered by the SEND control bit when it is time to transmit the data which is sent to

the RF stage after being encoded as either Manchester, Bi-Phase or NRZ data according

to the method selected by the CODE[1:0] bits as described in Section 15.17 "PLL control

registers A - PLLCR[1:0], RPAGE = 0".

Before the data can be transmitted the RFM control logic enables the external crystal

oscillator and phase-locked-loop to initialize before the RF output stage can begin

transmission.

The external crystal connected to the X0 and XI pins provides the carrier frequency as

well as the data rate clock needed for the data rates associated with the OOK or FSK

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

135 / 182

modulation. Therefore, the tolerance on the data rate will depend on the characteristics of

the external crystal.

Once the data buffer is emptied the data transfer stops; the RF output stage is turned off;

and the SEND control bit is cleared and an interrupt of the MCU may be generated to

wake it from the STOP1 mode. The user can test that the transmission has completed by

reading back the state of the SEND control bit or the RFIF status bit.

There is also the option to send the same data frame from 1 to 16 times with interlaced

time intervals when the RF transmitter PA output stage is off. If multiple frames of data

are to be transmitted within a datagram the spacing before the first frame and between

subsequent frames can be controlled by the RFM state machine in several ways:

1. Use of a programmable timer (random, base time, time adder).

2. No time delays.

In addition, the RFM crystal oscillator, VCO and PLL can be turned off during any

interframe timing by use of the IFPD bit.

When using the data buffer mode the user’s software should not change any bits in the

RFM registers after the SEND has been set and the transmission is still in progress.

Changing RFM register contents during a transmission can lead to data faults or errors.

15.1.2 MCU direct mode

When the CODE[1:0] bits are both set the encoding is controlled directly by the MCU

where the data to the RF output depends on the state of the DATA bit and the selected

modulation scheme. In this mode the user software must control the RF output stage to

power up (using the SEND control bit), WAIT for the RF output stage to stabilize (monitor

the RCTS status bit) and clock the DATA to the RF output stage. In this mode the data

rate and its stability will depend on the internal HFO oscillator.

Any transfers of data from the MCU will use the DATA bit which will be reflected as

modulated data on the RF pin once the RF output stage is set up to transmit. The

maximum data rate in this mode will depend on the complexity of the user software and

the MCU clock rate.

The POL bit in this case simply inverts the state of the DATA bit before it drives the RF

output stage.

The accuracy of the data rate in the MCU direct mode is directly dependant on the HFO

accuracy.

15.2 RF output buffer data frame

When using the RF data buffer mode each frame of data is sent as 2 to 256 bits per

frame with a possible two trailing bits for an end-of-message, EOM, as shown in

Figure 38. The actual data being transmitted in a given data frame and any combinations

of data frames into a single datagram is dependent on the user software.

The number of frames sent in a given datagram can be from 1 to 16 based on the

FNUM[3:0] bits in the RFCR3. The 256-bit buffer is divided into two pages of 128 bits as

selected by the RPAGE bit in the RFCR2.

The data buffer is unloaded to the RF output starting with the least significant bit (RFD0)

in the least significant byte (RFB0) up through the most significant bit (RFD127) in the

most significant byte (RFB15). This is often referred to as "little-endian" data ordering.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

136 / 182

256

Maximum

258-bit format

Minimum

2-bit format

80-bit format

53-bit format optional EOM

with all byte lengths

data in each byte defined by user software

RFBA

RFB0 RFB1 RFB2 RFB3 RFB4 RFB5 RFB6 RFB7 RFB8 RFB9

RFB0

bits [1:0]

RFB6

bits [2:0]

RFB0 RFB1 RFB2 RFB3 RFB4 RFB5 RFBB RFBC RFBD RFBE RFBF

aaa-028031

RFB0 RFB1 RFB2 RFB3 RFB4 RFB5

EOM

Figure 38. Data frame formats

15.2.1 Data buffer length

The number of bits sent in a given transmission frame is selected by the FRM[7:0]

control bits encoded as a direct binary number plus one. This gives a range of 2

through 256 bits. Data written to data buffer bits above the highest bit number will be

ignored. Transmission always begins with the data written in the RFB0 location. When

the requested number of bits have been transmitted an interrupt to the MCU can be

generated if the RFIE bit is set.

15.2.2 End of Message (EOM)

If the EOM control bit is set, then at the end of the data frame there will be carrier for

a period of two bit times at level high for the OOK modulation modes or fDATA1 for the

FSK modulation modes. Following the EOM period there will be no carrier for either the

OOK or FSK modes. If the EOM control bit is clear, no EOM period will be added to the

transmission.

15.3 Transmission randomization

When there are two or more different transmitters, the clock rates of each may drift into

synchronism with each other; and there is the possibility of RF data collisions and the

loss of data from both transmitters. In order to reduce possible RF data collisions each

transmission will contain from 1 to 16 frames of data. Each frame may be spaced at after

the initially timed transmission start time and between any two data frames as shown in

Figure 39.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

137 / 182

time not to scale

aaa-028032

Space intervals have no carrier frequency output, equivalent to data = 0 and may have the

RFM crystal oscillator, VCO and PLL turned off by the IFPD bit.

SPACESPACE SPACE

Interframe intervals

1 to 16 data frames

with identical data

Start of time

interval for

datagram

DATA FRAME DATA FRAME DATA FRAME

tDATA

Initial interval

Figure 39. Datagram overview

The generation of the initial and interframe time intervals can be done with a combination

of a programmable counter, a pseudo- random interval generator and a frame counter as

shown in Figure 40. The initial time interval can be done by adjusting the start time using

the MCU or using this interval timing generator.

time not to scale

aaa-028033

Interframe interval 1 Interframe interval 2

Start of time

interval for

datagram

Initial interval

tBASE 40 × tRAND tRAND tFN tRAND

tBASE, tRAND and tFN may be all zero in the initial interval.

tBASE, tRAND and tFN may be all zero in an interframe interval.

All interframe intervals may have different tBASE, tRAND and tFN times.

tBASE tBASE tFN

Figure 40. Initial and interframe timing

Note: If tBASE and tFN are both set to non-zero, and tRAND is set to 0, the system

will decrement both tBASE and tFN simultaneously rather than serially, such that the

effective Interframe Interval will be equal to the larger of tBASE or tFN settings.

15.3.1 Initial time interval

When generating an initial time interval the MCU loads the RFM interval generator

variables and then goes into the STOP1 mode. When the initial time interval ends the

data in the RFM data buffer is automatically sent and the MCU will wake at the end of the

transmission. The initial time interval is made up of two components:

(11)

where:

•tINIT = Total time interval before first frame is transmitted in ms

•tBASE = Base time in ms; ≤ 5 ms not recommended

•tRAND = Pseudo-random time in ms based on a Galois 7-bit LFSR

The components of this time are described in the following sections.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

138 / 182

15.3.2 Interframe time intervals

When generating an interframe time interval the MCU loads the RFM interval generator

variables and then goes to the STOP1 mode. When the interframe time interval ends the

data in the RFM data buffer is automatically sent and the MCU will wake at the end of the

transmission. The interframe time interval is made up of three components:

(12)

where:

•tIFRM = Total time interval between each transmitted frame in ms

•tBASE = Base time in ms; ≤ 5 ms not recommended

•tFN = Time adder in ms for frame number

•tRAND = Pseudo-random time in ms based on a Galois 7-bit LFSR

The components of this time are described in the following sections.

15.3.3 Base time interval

The base time interval, tBASE, is used in the initial time interval and in datagram

transmissions with two or more frames. The programmable frame space interval is based

on a simple 8-bit, count-down timer as described by the RFBT[7:0] control bits in the

RFCR4 register. This time interval is forced to zero when the RFBT[7:0] are all clear.

The range of the base time must be set to 0 or between 5 and 255 ms using a clock

generated from the MFO divided by 125.

15.3.4 Pseudo-random time interval

The pseudo-random time interval, tRAND, is used both in the initial and the interframe

time intervals if the LFSR[6;0] bits are set to something other than all zeros. When the

ISPC bit is set the pseudo-random initial time interval before the first data frame will be

40 times the value of tRAND.

When the LFSR[6:0] bits are used the tRAND time will vary based on a pseudo-

random generated binary number using a Galois linear feedback shift register (LFSR)

implemented using the primitive polynomial for a 7-stage register as shown in Figure 41.

This LFSR creates a sequence of 127 binary numbers including $01 through $3F which

are each repeated only once in each sequence of 127 clocks of the shift register. The

LFSR is initialized to $40 during power up of the device. When a random interval is

to be determined the contents of the LFSR are sampled as the "random number" for

calculating the required interval time. Following the use of the random interval the LFSR

is clocked once to advance it to the next pseudo-random number.

Note: The LFSR bits in RFCR5 are the seed and not the current LFSR random number,

which is not accessible.

The range of the pseudo-random time is 1 to 127 ms using a clock generated from the

MFO divided by 125. The current value of the LFSR can be changed and/or read by the

LFSR[6:0] bits in the RFCR5 register.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

139 / 182

aaa-028034

D Q

S0 S1 S2 S3 S4 S5 S6

CLK

RFMRST

7-bit random number

Galois primitive polynomial = X7 + X3 + 1

Figure 41. LFSR implementation

A value of all zeros in the LFSR will remain unchanged with every clock input and cannot

be used as a starting "seed."

The resulting range of times for the initial and interframe pseudo-random time will be

as given in Table 131 for both the design center and the variation resulting from the

tolerance of the MFO clock.

Table 131. Randomization interval times

Time Interval Including MFO Tolerance (ms)

Time

Interval

Randomization

Number Ideal Time Interval (ms) Minimum Maximum

1 40 37.2 42.8Initial

127 5080 4347.2 5434.6

1 1 0.93 1.07Interframe

127 127 118.1 135.9

15.3.5 Frame number time

The frame number time, tFN, is only used between frames and is based on a selectable

time from 0 to 63 ms and the number of the frame that was just transmitted as given in

Table 132. If the frame number time is not used, the value of the selected time should be

set to zero. The maximum number of frames is defined by the FNUM[3:0] control bits.

The range of the frame number time is a multiple of 0 to 63 ms using a clock generated

from the MFO divided by 125. The value of this time multiple can be changed by the

RFFT[5:0] bits in the RFCR6 register.

Table 132. Frame number interval times

Nominal frame number

time interval added (ms)

Value of

FNUM[3:0]

Number

of frames

Frame

interval where

time added Minimum Maximum

0 1 None n/a n/a

1 2 1 - 2 1 63

2 3 2 - 3 2 126

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

140 / 182

Nominal frame number

time interval added (ms)

Value of

FNUM[3:0]

Number

of frames

Frame

interval where

time added Minimum Maximum

3 4 3 - 4 3 189

4 5 4 - 5 4 252

5 6 5 - 6 5 315

6 7 6 - 7 6 378

7 8 7 - 8 7 441

8 9 8 - 9 8 504

9 10 9 - 10 9 567

10 11 10 - 11 10 630

11 12 11 - 12 11 693

12 13 12 - 13 12 756

13 14 13 - 14 13 819

14 15 14 - 15 14 882

15 16 15 - 16 15 945

15.4 RFM in STOP1 mode

The entire RF transmitter digital section can remain powered up, if enabled by the RFEN

bit (see Section 7.3 "Computer Operating Properly (COP) Watchdog"), when the MCU

goes into the STOP1 mode.

15.5 Data encoding

The CODE[1:0] control bits select either Manchester, Bi-Phase, NRZ or MCU direct data

encoding of each data bit being transferred from the RF data buffer to the RF output

stage. Further, the polarity of the selected encoding method can be inverted using the

POL control bit.

15.5.1 Manchester encoding

When the CODE[1:0] bits are both clear the data is Manchester encoded format, with

data transmitted as a transition in voltage occurring in the middle of the bit time. The

polarity of this transition is selected by the POL bit. When the POL bit is cleared, then a

logical LOW is defined as an increase in signal in the middle of a bit time and a logical

HIGH is defined as a decrease in signal in the middle of a bit time as shown in Figure 42.

When the POL bit is set, then a logical LOW is defined as an decrease in signal in the

middle of a bit time and a logical HIGH is defined as a increase in signal in the middle of

a bit time as shown in Figure 43. Since there is always a transition in the middle of the bit

time there must also be a transition at the start of a bit time if consecutive "1" or "0" data

are present.

15.5.2 Bi-Phase encoding

When the CODE[1:0] bits are 0:1 then the data is Bi-Phase encoded format, with data

transmitted as the presence or absence of a transition in signal in the middle of the bit

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

141 / 182

time. The polarity of this transition is selected by the POL bit. Unlike Manchester coding

there is always a signal transition at the boundaries of each bit time. When the POL bit

is cleared, then a logical HIGH is defined as no change in signal in the middle of a bit

time and a logical LOW is defined as a change in the signal in the middle of a bit time as

shown in Figure 44. When the POL bit is set, then a logical HIGH is defined as a change

in signal in the middle of a bit time and a logical LOW is defined as no change in the

signal in the middle of a bit time as shown in Figure 45. Since there is always a transition

at the ends of the bit time consecutive bits of the same state may have two signal states

(high or low) during the middle of the bit time.

15.5.3 NRZ encoding

When the CODE[1:0] bits are 1:0 then the data is NRZ encoded format, with data

transmitted as either a high or low for the complete bit time. The polarity of this state is

selected by the POL bit. The Manchester and Bi-Phase encoding can actually be created

using NRZ encoding running at twice the desired data rate.

aaa-028035

low

bit

high

bit

FSK = fRF + f

FSK = fRF - f

OOK = fRF

OOK = OFF

bit time

Consecutive “0

data bits

Consecutive “1

data bits

“001101

data bits

bit time

Figure 42. Manchester data bit encoding (POL = 0)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

142 / 182

aaa-028036

low

bit

high

bit

FSK = fRF + f

FSK = fRF - f

OOK = fRF

OOK = OFF

bit time

Consecutive “0

data bits

Consecutive “1

data bits

“001101

data bits

bit time

Figure 43. Manchester data bit encoding (POL = 1)

aaa-028037

low

bit

low

bit

FSK = fRF + f

FSK = fRF - f

OOK = fRF

OOK = OFF

bit time

Consecutive “0

data bits

Consecutive “1

data bits

“001101

data bits

bit time

high

bit

bit time

high

bit

bit time

Figure 44. Bi-Phase data bit encoding (POL = 0)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

143 / 182

aaa-028038

low

bit

low

bit

FSK = fRF + f

FSK = fRF - f

OOK = fRF

OOK = OFF

bit time

Consecutive “0

data bits

Consecutive “1

data bits

“001101

data bits

bit time

high

bit

bit time

high

bit

bit time

Figure 45. Bi-Phase data bit encoding (POL = 1)

15.6 RF output stage

The RF output stage consists of a PLL, control logic and an output RF amplifier. Data is

sent to the RF output stage from either the RF data buffer or the DATA bit in the RFCR3

depending on the selected mode of operation as described in Section 15.1 "RF data

modes".

The RF output stage is enabled by the state of the SEND control bit. The PLL in the RF

output stage will signal back via the RCTS status bit when the PLL is locked and ready to

transmit.

15.6.1 Modulation method

The modulation control bit, MOD, described in Section 15.18 "PLL control registers B -

PLLCR[3:2], RPAGE = 0", sets the modulation of the RF signal will be either amplitude

shift keying (OOK) or frequency shift keying (FSK) with several options for the frequency

shift.

When operating in the FSK mode the internal, fractional-n PLL divider will be used to

create the two carrier frequencies for data zero and data one. This method is more

effective and robust than "pulling" the external crystal in order to shift the carrier

frequency.

15.6.2 Carrier frequency

The carrier frequency is established mainly by the external crystal used, but a centering

of the fractional-n PLL provides more precise control. If the CF control bit is clear the PLL

will be configured for a carrier center frequency of the 315 MHz. If the CF control bit is set

the PLL will be configured for a carrier center frequency of the 434 MHz.

15.6.3 RF power output

The maximum power output from the RF pin can be adjusted to one of 21 levels using

the PWR[4:0] bits.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

144 / 182

15.6.4 Transmission error

Any transmission will be aborted if one of the following occurs:

1. The RCTS signal does not become active within the tLOCK time.

2. The PLL falls out of lock after once being set and the SEND bit is still active.

3. The XCO monitor output falls.

If either of these cases occurs the RF output will be turned off; the SEND control bit

will be cleared; and the transmission error status flag, RFEF, will be set. The RFEF bit

triggers an interrupt of the MCU if the RFIEN is set. The RFEF bit is cleared by writing a

logical one to the RFIAK bit.

15.6.5 Supply voltage check during RF transmission

A separate low voltage detector can be enabled during the RF transmission and a status

bit checked for low voltage drops due to a weak battery during the higher transmission

currents. This RF LVD can be enabled by setting the RFLVDEN bit and the resulting

status is reported on the RFVF bit. The RFVF bit can be cleared by writing a logical one

to the RFIAK bit if the supply voltage has risen above the detect threshold. Further, if the

voltage falls far enough for the VCO and PLL to fall out-of-lock, then the RF output will be

turned off and the transmission will be terminated.

15.6.6 RF Reset (RFMRST)

The RF state machine, crystal oscillator, PLL and VCO can be reset to the initial off state

by the RFMRST signal generated by one of the following methods:

1. Internal RFM power-on reset (RFPOR).

2. Writing a one to the RFMRST bit in the RFCR7.

Any of these reset methods will not alter any data stored in the data buffer.

15.7 RF interrupt

The RFM will interrupt the MCU when the SEND bit is cleared at the end of a data buffer

transmission. This interrupt occurs at the end of a programmed set of frames. If the

number of frame count FNUM[3:0] is set to zero, then only one frame is sent and the

interrupt occurs at the end of that first frame transmitted. If the number of the frame count

is greater than zero, then the interrupt will be generated depending on the state of the

IFID bit.

The interrupt will also create a flag bit, RFIF, which can be cleared by writing a logical

one to the RFIAK bit. The interrupt can be enabled/disabled by the RFIEN bit.

15.8 Datagram transmission times

In order to comply with FCC requirements in the US market the periodically transmitted

datagram must be less than 1 second in length and be separated by an off time that is

at least 10 seconds or at least 30 times longer than the transmission time, whichever

is longer. The user software must adhere to this ruling for products intended for the US

market.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

145 / 182

15.9 RFM registers

The RFM contains twelve registers to control its functions and 32 registers to provide

access to the output data buffer.

15.9.1 RFM Control Register 0 — RFCR0

The RFCR0 register contains eight control bits for setting the output data rate of the RFM

as described in Table 133.

Table 133. RFM control register 0 (RFCR0) (address $0030)

Bit76543210

WBPS[7:0]

Reset00110100

Table 134. RFCR0 field descriptions

Field Description

7–0

BPS[7:0]

Data Rate — The BPS[7:0] control bits select the data rate for the transmitted datagrams as described by

the following equation:

where:

fDATA = Data rate in bits/second

fXTAL = External crystal frequency in Hz = 26 MHz

BPS = Value of data rate code (BPS[7:0])

Examples of the value for common data rates are given in Table 135. The BPS[7:0] control bits are set to

$34 by the RFMRST signal which results in a default data rate of 9600 bits/sec.

Table 135. Data rate option examples

Data Rate BPS[7:0]

Decimal Value Data Rate BPS[7:0] Decimal

Value

Target Nominal fXTAL = 26 MHz Target Nominal fXTAL = 26 MHz

2000 bps 2000.0 249 4800 bps 4807.7 103

2400 bps 2403.8 207 5000 bps 5000.0 99

4000 bps 4000.0 124 9600 bps 9615.4 51

4500 bps 4504.5 110 19200 bps 19230.8 25

The BPS[7:0] bits are set to $34 by an RFMRST signal which results in a default data

rate of approximately 9600 bps.

15.10 RFM control register 1 — RFCR1

The RFCR1 register contains eight control bits for the RFM as described in Table 136.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

146 / 182

Table 136. RFM control register 1 (RFCR1) (address $0031)

Bit76543210

WFRM[7:0]

Reset00000000

Table 137. RFCR1 field descriptions

Field Description

7-0

FRM[7:0]

Frame Bit Length — The FRM[7:0] control bits select the number of bits in each datagram. The number of

bits is determined by the binary value of the FRM[7:0] bits plus one. This makes the range of bits from 2 to

256. A value of $00 for the FRM[7:0] control bits will result in no frames being sent. The FRM[7:0] control

bits are cleared by RFMRST signal.

15.11 RFM control register 2 — RFCR2

The RFCR2 register contains eight control bits for the RFM as described in Table 138.

Table 138. RFM control register 2 (RFCR2) (address $0032)

Bit76543210

WSEND RPAGE EOM PWR[4:0]

Reset00000000

Table 139. RFCR2 field descriptions

Field Description

SEND

Transmission Start Control — The SEND control bit starts the transmission of data held in the RFM data

buffer according to the bit length specified by the FRM[7:0] bits. The SEND control bit is automatically

cleared when the data buffer transmission has ended or by the RFMRST signal. A transmission can be

prematurely interrupted by writing a logical zero to the SEND bit.

0 Data transmission ended or transmission not in progress.

1 Start data transmission or transmission in progress.

RPAGE

Buffer Page Select — The RPAGE bit will select the lower or upper 16 bytes of the RFM data buffer when

writing/reading to the RFD0-RD15 registers. This bit also selects between the lower and upper banks of

RFM registers at addresses $0038 through $003B. This bit is cleared by a reset of the MCU.

0 Select the lower 16 bytes of the RFM data buffer.

1 Select the upper 16 bytes of the RFM data buffer.

EOM

End Of Message — The EOM control bit selects whether there will be two data bit times of data 1 carrier

state at the end of each datagram. The EOM control bit is cleared by a RFMRST.

0 EOM bit times not added.

1 EOM bit times added.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

147 / 182

Field Description

4:0

PWR[4:0]

RF Amplifier Power Level — The PWR[4:0] control bits select the optimum power output of the RF power

amplifier. These power output levels assume optimal matching network to the RF pin. The PWR[4:0] control

bits are cleared a RFM reset. The PWR control bits are initially set to 0x00. This setting targets –10 dBm

typical power output. The PWR control bits scale the typical output power level from –1.5 to 8 dBm in steps

of 0.5 dB and fixes the low power level mode to –10 dBm, The power control range is defined as follows:

00000 set output power level to –10 dBm (Default Value)

00001 set output power level to –1.5 dBm

00010 set output power level to –1.0 dBm

00011 set output power level to –0.5 dBm

00100 set output power level to 0.0 dBm

00101 set output power level to 0.5 dBm

00110 set output power level to 1.0 dBm

00111 set output power level to 1.5 dBm

01000 set output power level to 2.0 dBm

01001 set output power level to 2.5 dBm

01010 set output power level to 3.0 dBm

01011 set output power level to 3.5 dBm

01100 set output power level to 4.0 dBm

01101 set output power level to 4.5 dBm

01110 set output power level to 5.0 dBm

01111 set output power level to 5.5 dBm

10000 set output power level to 6.0 dBm

10001 set output power level to 6.5 dBm

10010 set output power level to 7.0 dBm

10011 set output power level to 7.5 dBm

10100 set output power level to 8.0 dBm

Codes greater than 10100 are reserved for test purposes and should not be used.

15.11.1 Power working domains

The working areas of the RF transmitter are divided into several domains as defined in

Figure 46.

15.11.1.1 PTYP

TA = 25 °C to 60 °C and VDD = 2.5 V to 3.6 V

PTYP is where the power step is adjusted to guarantee 5 dBm. The power consumption in

this domain is specified at 5 dBm output power step at nominal conditions of TA = 25 °C

and VDD = 3 VDC.

15.11.1.2 PMIN

PMIN is where the power step is adjusted to guarantee a minimum of 3 dBm as shown in

Figure 46. The power consumption in this domain is given as the maximum consumption

at whatever temperature of supply voltage condition. The PMIN domain is subdivided into

two areas according to the lowest supply voltage encountered (1.8 or 2.5 VDC).

PMIN_COLD

•TA = –40 °C to 0 °C and VDD = 1.8 V to 3.6 V

PMIN_HOT

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

148 / 182

•TA = 0 °C to 25 °C and VDD = 2.5 V to 3.6 V

•TA = 60 °C to 125 °C and VDD = 2.5 V to 3.6 V

aaa-028039

VDD = 3.6 V

VDD = 3.0 V

PMIN_COLD PMIN_HOT

PTYP PMIN_HOT

VDD = 2.5 V

VDD = 1.8 V

TA= -40 °C TA= 0 °C TA= 25 °C TA= 60°C TA= 105 °C

Typical consumption

Figure 46. RF power domains

15.12 RFM control register 3 — RFCR3

The RFCR3 register contains eight control bits for the RFM as described in Table 140

which sets the number of frames in each RF datagram.

Table 140. RFM control register 3 (RFCR3) (address $0033)

Bit76543210

WDATA IFPD ISPC IFID FNUM[3:0

Reset00000000

Table 141. RFCR3 field descriptions

Field Description

DATA

Data State — The DATA bit determines the output state of the RF power amplifier when the RFM is in the

MCU direct control mode (CODE[1:0] = 11)

0 RF output state low.

1 RF output state high.

IFPD

Interframe Power Down — The IFPD control bit selects whether the XCO and associated analog blocks are

powered down during interframe timing caused by the RFM. The IFPD control bit is cleared by the RFMRST

signal.

0 The XCO remains powered up as long as the SEND bit is set.

1 The XCO is powered down during RFM controlled interframe timing events.

The restart of these functions will start 1 ms before the end of the timing interval if another frame is to be

transmitted.

ISPC

Initial Random Space — When the ISPC bit is set the initial time delay before the first frame will be enabled.

This bit is cleared by an RFM reset.

0 No initial time interval.

1 Initial time interval enabled.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

149 / 182

Field Description

IFID

Interframe Interrupt Delay — The IFID control bit selects when the RFIF bit is set and the MCU is

interrupted. The IFID control bit is cleared by the RFMRST signal.

0 The RFIF bit is set and the MCU interrupted if the RFIEN bit is set, after the last frame transmitted.

1 The RFIF bit is set and the MCU interrupted if the RFIEN bit is set, only after the last frame plus an

additional interframe message is transmitted.

3-0

FNUM

[3:0]

FNUM[3:0] — The FNUM[3:0] bits set the number of frames transmitted in each RF datagram. The frames

will be randomly spaced apart as described in Section 15.3 "Transmission randomization".These bits are

cleared by an RFM reset. The number of frame transmitted is the binary number plus one.

15.13 RFM control register 4 — RFCR4

The RFCR4 register contains eight control bits to set the initial and interframe timing

base timing variable as described in Table 142. A RFMRST signal clears the RFBT[7:0]

bits.

Table 142. RFCR4 register — base time variable (address $0034)

Bit76543210

WRFBT[7:0]

Reset10000000

Table 143. RFCR4 field descriptions

Field Description

7:0

RFBT

[7:0]

Base Timer — The RFBT[7:0] control bits select the interframe timing between multiple frames of

transmission. The base time\ value is equal to a nominal one millisecond for each count of the RFBT[7:0]

bits. The RFBT[7:0] control bits are cleared by the RFMRST signal and must be set to either 0 or between 5

and 255.

15.14 RFM control register 5 — RFCR5

The RFCR5 register contains eight control bits to set the initial and interframe random

timing variable as described in Table 144. A RFMRST signal clears the LFSR[6:0] bits

causing the random time variable to be ignored.

Table 144. RFCR5 register — pseudo-random time variable (address $0035)

Bit76543210

WBOOST LFSR[6:0]

Reset00000000

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

150 / 182

Table 145. RFCR5 field descriptions

Field Description

BOOST

BOOST — This bit controls the VCO power consumption in order to decrease the phase noise required by

the Japanese regulation. The BOOST control bit is cleared by the RFMRST signal.

0 The VCO runs at its lower power consumption level (higher phase noise).

1 The VCO runs at its higher power consumption level (lower phase noise).

6:0

LFSR[6:0]

Pseudo-Random Timer — The LFSR[6:0] bits select the current seed value of the LFSR when enabling

pseudo-random timing intervals when any of the LFSR[6:0] bits are set. The value written to this register is

loaded into the actual LFSR when the SEND bit is set. The time value is equal to a nominal one millisecond

for each count of the resulting LFSR[6:0] bits.

A value of $00 placed in the LFSR causes the LFSR to stay at the $00 state on each clocking of the LFSR.

To cause the LFSR to cycle through its pseudo-random number sequence requires that any value other

than $00 be written to the LFSR[6:0] bits.

Note: If RFBT[7:0] and RFFT[5:0] are both set to non-zero, and LFSR[6:0] is set to 0x00,

the system will decrement both RFBT and RFFT simultaneously rather than serially, such

that the effective Interframe Interval will be equal to the larger of RFBT or RFFT settings.

15.15 RFM control register 6 — RFCR6

The RFCR6 register contains eight control bits to set the initial and interframe frame

number timing variable as described in Table 146. A RFMRST signal clears the

RFFT[5:0] bits.

Table 146. RFCR6 register — frame number time — RFTS[1:0] = 1:0 (address $0036)

Bit76543210

WVCO_GAIN[1:0] RFFT[5:0]

Reset10000000

Table 147. RFCR6 field descriptions

Field Description

7:6

VCO_

GAIN[1:0]

VCO Gain Selection — These bits control the VCO gain. The VCO_GAIN[1] bit is set and the VCO_GAIN[0]

bit is cleared by the RFMRST signal. Not normally need to be adjusted by the end user.

5:0

RFFT[5:0]

Frame Number Timer — The RFFT[5:0] control bits select the interframe timing between multiple frames

of transmission. The time value is equal to a nominal one millisecond for each count of the RFFT[5:0] bits

multiplied by the frame number of the last transmitted frame. The RFFT[5:0] control bits are cleared by the

RFMRST signal.

15.16 RFM control register 7 — RFCR7

The RFCR7 register contains four control bits and four status bits for the RFM as

described in Table 148.

Table 148. RFM transmit control registers (RFCR7) (address $0037)

Bit76543210

R RFIF RFEF RFVF 0 RFIEN RFLVDEN RCTS 0

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

151 / 182

Bit76543210

W RFIAK RFMRST

Reset00000000

= Reserved

Table 149. RFCR7 field descriptions

Field Description

RFIF

RF Interrupt Flag— The read-only RFIF status bit indicates if the RF transmission has ended properly when

using the data buffer mode and the SEND bit has been cleared. Writes to this bit will be ignored. The RFIF

status bit is cleared by writing a logical one to the RFIAK bit or the RFMRST bit. RFMRST signal clears this

bit.

0 RF transmission in progress or not in the data buffer mode.

1 RF transmission completed in the data buffer mode.

RFEF

RF Transmission Error Flag— The read-only RFEF status bit indicates if there was an error in the current or

prior RF transmission as described in Section 15.6.4 "Transmission error". Writes to this bit will be ignored.

The RFEF status bit is cleared by writing a logical one to the RFIAK bit or the RFMRST bit. RFMRST signal

clears this bit.

0 No RF transmission error occurred.

1 RF transmission error occurred.

RFVF

RF LVD Trigger Flag— When the RF LVD is enabled and the supply voltage falls below the threshold, the

read-only RFVF flag will be set if the RFLVDEN bit is set. Writes to this bit will be ignored. The RFVF status

bit is cleared by writing a logical one to the RFIAK bit or the RFMRST bit. RFMRST signal clears this bit

0 Voltage is and has been above RF LVD rising threshold or the RF LVD is disabled.

1 Voltage has dropped below the RF LVD falling threshold since last reset of this bit.

RFIAK

Acknowledge RF Interrupt Flags— Writing a one to the RFIAK bit clears the RFIF, RFEF and RFVF flag

bits. Writing a zero to the RFIAK bit has no effect on the RFIF, RFEF and RFVF flag bits. The RFMRST

signal has no effect on this bit.

0 No effect.

1 Clear the RFIF, RFEF, and RFVF bits.

RFIEN

RF Interrupt Enable— The RFIEN bit enables the RFIF, the RFEF and the RFVF bits to generate an

interrupt to the MCU. The RFMRST signal clears this bit.

0 RF interrupts disabled.

1 RF interrupts enabled.

RFLVDEN

RF LVD Enable — When the RFLVDEN bit is set, the RF LVD circuit will be enabled, and the RF LVD

events are routed to the RF LVD Trigger Flag. This bit is cleared by the RFMRST signal.

0 RF LVD disabled.

1 RF LVD enabled.

RCTS

RF Clear To Send Status— When the RCTS bit is set the RF XCO, VCO and PLL have started and locked

and the RFM is ready to send data. This bit is cleared by the RFMRST signal.

0 RFM not ready to send.

1 RFM ready to send.

RFMRST

RFM Reset — Writing a one to the RFMRST bit will completely reset the RFM and its registers. This bit is

not affected by a reset of the MCU. This bit will always read as a zero.

0 No effect.

1 Reset RFM.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

152 / 182

15.17 PLL control registers A - PLLCR[1:0], RPAGE = 0

The PLLCR[1:0] registers contain 16 control bits for the RFM as described in Table 150

and Table 151. These bits are only accessible when the RPAGE bit is cleared.

Table 150. PLL control registers A (PLLCR[1:0], RPAGE = 0) (address ($0038)

Bit76543210

WAFREQ[12:5]

Reset00000000

Table 151. PLL control registers A (PLLCR[1:0], RPAGE = 0) (address ($0039)

Bit76543210

WAFREQ[4:0] POL CODE

Reset00000000

Table 152. PLLCR[1:0] field descriptions

Field Description

AFREQ[12:0]

(PLLCR0[7:0],

PLLCR1[7:3])

PLL Divider Ratio A — The AFREQ[12:0] control bits select the PLL divider ratio for a data zero in the

FSK mode of modulation as described by the following equation:

where:

fDATA0 = RF Carrier frequency for a data zero in MHz

fXTAL = External crystal frequency in MHz, 26 MHz

CF = State of the CF carrier select bit

AFREQ = Decimal value of the AFREQ[12:0] binary weighted bits

The AFREQ[12:0] control bits are cleared by the RFMRST signal. 1 LSB of AFREQ[12:0] = 3.17 kHz.

POL

Data Polarity — The POL control bit selects the polarity of the data encoding selected by the

CODE[1:0] bits. The POL control bit is cleared by the RFMRST signal.

0 NRZ and MCU direct DATA bit data non-inverted and Manchester encoding polarity as in Figure 42

and Bi-Phase encoding polarity as in Figure 44.

1 NRZ and MCU direct DATA bit data inverted and Manchester encoding polarity as in Figure 43 and

Bi-Phase encoding polarity as in Figure 45.

1:0

CODE[1:0]

Data Encoding and Source — The CODE[1:0] control bits select the type of data encoding and

source of data for the RF output.

The CODE[1:0] control bits are cleared by the RFMRST signal.

00 Manchester encoded data from the RFM data buffer.

01 Bi-Phase encoded data from the RFM data buffer.

10 NRZ direct data from the RFM data buffer (can be mixed NRZ and Manchester at 2X the data

rate).

11 MCU direct mode with RF output driven by the state of the DATA bit.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

153 / 182

15.18 PLL control registers B - PLLCR[3:2], RPAGE = 0

The PLLCR[3:2] registers contain 16 control bits for the RFM as described in Table 153

and Table 154. These bits are only accessible when the RPAGE bit is cleared.

Table 153. PLL control registers B (PLLCR[3:2], RPAGE = 0) (address $003A)

Bit76543210

WBFREQ[12:5]

RFMRST 0 0 0 0 0 0 0 0

Table 154. PLL control registers B (PLLCR[3:2], RPAGE = 0) (address $003B)

Bit76543210

WBFREQ[4:0] CF MOD CKREF

RFMRST 0 0 0 0 0 0 0 0

Table 155. PLLCR[3:2] field descriptions

Field Description

BFREQ[12:0]

(PLLCR2[7:0],

PLLCR3[7:3])

PLL Divider Ratio B- The BFREQ[12:0] control bits select the PLL divider ratio for a data one in either

the OOK or FSK modes of modulation as described by the following equation:

where:

fCARRIER = RF Carrier frequency in MHz

fXTAL = External crystal frequency in MHz

CF = State of the CF carrier select bit

BFREQ = Decimal value of the BFREQ[12:0] binary weighted bits

The BFREQ[12:0] control bits are cleared by the RFMRST signal. 1 LSB of BFREQ[12:0] = 3.17 kHz.

Carrier Frequency — The CF control bit selects the optimal VCO setup and correct divider for the 500

kHz reference clock to the MCU on DX based on the external crystals required for the desired carrier

frequency. The CF control bit is cleared by the RFMRST signal.

0 Configured for 315 MHz, 12.1154 PLL divider using a 26.000 MHz external crystal.

1 Configured for 434 MHz, 16.6923 PLL divider using a 26.000 MHz external crystal.

MOD

RF Modulation Method — The MOD control bit selects the method of modulating the RF. The MOD

control bit is cleared by the RFMRST signal.

0 Configured for OOK.

1 Configured for FSK.

CKREF

Generated Clock Reference — Generates the DX signal to the TPM1 module for determining the

other clock frequencies:

0 DX signal not generated.

1 DX 500 kHz signal connected to the TPM1 module.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

154 / 182

15.19 EPR register — EPR (RPAGE = 1)

The EPR register contains eight control bits for the RFM as described in Table 156. The

function of the upper 4 bits depends on the state of the VCD_EN bit.

Table 156. RFM EPR registers (EPR, RPAGE = 1, VCD_EN = 0) (address $0038)

Bit76543210

WPLL_LPF_[2:0] PA_SLOPE VCD_EN

RFMRST 0 0 1 1 0 0 1 0

= Reserved

Table 157. RFM EPR registers (EPR, RPAGE = 1, VCD_EN = 1) (address $0038)

Bit76543210

R VCD[3:0]

WPA_SLOPE VCD_EN

RFMRST — — — — 0 0 1 0

= Reserved

Table 158. EPR field descriptions

Field Description

Reserved Reserved bit — Not for user access if the VCD_EN bit is clear.

6-4

PLL_

LPF_[2:0]

Low Pass Filter Selection — These read/write bits select the PLL low pass filter. A reset sets these bits to

$03. These bits are only accessible if the VCD_EN bit is clear.

7-4

VCD[3:0]

VCO Calibration Count Difference — These read-only bits show the count difference from "ideal" when the

VCO\ calibration machine is finished (see Section 15.21 "VCO calibration machine"). These bits are only

accessible when the VCD_EN bit is set. Writing to these bits when the VCD_EN bit is set has no effect. The

reset state is undefined.

3-2

Reserved Reserved bits — Not for user access.

PA_SLOPE

PA Output Slope Selection — This read/write bit controls the output slope of the RFM PA output. This bit is

set by the RFMRST signal.

VCD_EN

VCD Enable bit — This bit allows access to the VCD[3:0] bits. This bit is cleared by the RFMRST signal.

0 PLL_LPF_[2:0] bits accessed.

1 VCD[3:0] bits accessed.

15.20 RF DATA registers — RFD[31:0]

The RFD registers contain 256 read/write bits for the RFM to use when outputting

data as described in Section 15.2 "RF output buffer data frame". The 256- bit buffer is

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

155 / 182

divided into two pages of 128 bits as selected by the RPAGE bit in the RFCR2. These as

described in Table 159. These bits are unaffected by any reset.

The data buffer is unloaded to the RF output starting with the least significant bit (RFD0)

in the least significant byte (RFB0) up through the most significant bit (RFD255) in the

most significant byte (RFB31). This is often referred to as "little-endian" data ordering.

The output of this data by the RFM in all 256 bits locations is not dependent on the state

of the RPAGE bit.

Table 159. RF data registers (RFD[31:0])

Bit 7 6 5 4 3 2 1 Bit 0

$003C RFD[7:0] for RPAGE = 0, RFD[135:128] for RPAGE = 1

$003D RFD[15:8] for RPAGE = 0, RFD[143:136] for RPAGE = 1

$003E RFD[23:16] for RPAGE = 0, RFD[151:144] for RPAGE = 1

$003F RFD[31:24] for RPAGE = 0, RFD[159:152] for RPAGE = 1

$0040 RFD[39:32] for RPAGE = 0, RFD[167:160] for RPAGE = 1

$0041 RFD[47:40] for RPAGE = 0, RFD[175:168] for RPAGE = 1

$0042 RFD[55:48] for RPAGE = 0, RFD[183:176] for RPAGE = 1

$0043 RFD[63:56] for RPAGE = 0, RFD[191:184] for RPAGE = 1

$0044 RFD[71:64] for RPAGE = 0, RFD[199:192] for RPAGE = 1

$0045 RFD[79:72] for RPAGE = 0, RFD[207:200] for RPAGE = 1

$0046 RFD[87:80] for RPAGE = 0, RFD[215:208] for RPAGE = 1

$0047 RFD[95:88] for RPAGE = 0, RFD[223:216] for RPAGE = 1

$0048 RFD[103:96] for RPAGE = 0, RFD[231:224] for RPAGE = 1

$0049 RFD[111:104] for RPAGE = 0, RFD[239:232] for RPAGE = 1

$004A RFD[119:112] for RPAGE = 0, RFD[247:240] for RPAGE = 1

$004B RFD[127:120] for RPAGE = 0, RFD[255:248] for RPAGE = 1

Table 160. RFD[31:0] field descriptions

Field Description

RFD[127:0]

(RFD[15:0],

RPAGE = 0)

RF Data Registers Lower 128 bits — These are read/write bits that hold the lower 128 bits of possible

data to be sent by the RFM. Access to the lower 128 bits occurs when the RPAGE bit is clear. These

bits are unaffected by any reset.

RFD[255:128]

(RFD[31:16]

, RPAGE = 1)

RF Data Registers Upper 128 bits — These are read/write bits that hold the upper 128 bits of

possible data to be sent by the RFM. Access to the lower 128 bits occurs when the RPAGE bit is

clear. These bits are unaffected by any reset.

15.21 VCO calibration machine

The RFM incorporates a VCO calibration machine which works in conjunction with the

VCO. The calibration machine selects the optimal VCO sub-band with respect to a

predefined reference voltage applied to the VCO.

•Calibration supports maxband VCO sub-bands. Maxband corresponds to the band

where the VCO frequency is maximum.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

156 / 182

•A successive approximation algorithm is used to calculate the optimum sub-band.

•Fc, the Center Frequency (AFREQ+BFREQ)/2 is used as the reference frequency for

the VCO calibration in FSK mode (MOD = 1).

•BFREQ is used as the reference frequency for the VCO calibration in OOK mode

(MOD = 0).

•Calibration occurs every time the VCO is enabled.

•The calibration takes approximately 5 μs.

The state machine of the calibration is shown in Figure 47.

Count the number of

cycles of the VCO

Compare

VCOcount and Targetedcount

VCOband = maxband/2

Bestband = maxband/2

Difference = maxband/4

VCOband = VCOband - Difference

Difference = Difference/2

VCOband = VCOband + Difference

Bestband = VCOband

VCOband = VCOband - Difference

Difference = 1?

yes

Bestband is first best band found

or the closest band found

· Maxband is the number

of sub-band of the VCO

· Bestband is the band which

is going to be chosen

· Difference is an internal variable.

VCOcount = Targetedcount

VCOcount < TargetedcountVCOcount > Targetedcount

aaa-028040

Figure 47. VCO calibration state machine

16 Firmware

This section describes the software subroutines contained in the firmware section of

the FLASH memory that the user can call for various tasks and to reduce the software

development time for the main internal operations.

16.1 Software jump table

All subroutines are accessed through a jump table located at the bottom of the firmware

FLASH memory as described in Table 161. This allows upgrades in firmware without

changing the software code of the user. All subroutines should be accessed with the JSR

instruction.

16.2 Function documentation

The following subsections describe the details of the firmware routines. Further details

can be found in the latest version of the FXTH87E Embedded Firmware User Guide.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

157 / 182

16.2.1 General rules

1. No output parameter can use the extreme codes (all zero’s or all one’s).

2. The all zero’s output code will always indicate a fault and the status byte will indicate

the source of the error.

3. While firmware is processing, CPU resources are unavailable for application.

4. Each measured parameter will return a limit code ($00, $FF or $1FF) if an error

occurs in its acquisition, except for the external ADC voltage measurements on the

PTA[1:0] pins.

5. External ADC voltage measurements on the PTA[1:0] pins will return a full range code

that is ratiometric to the supply voltage.

16.2.1.1 FXTH87E single Z-axis firmware routines

The details on the use and execution of each firmware routine is documented in the

CodeWarrior project file that is supplied by NXP. Any future updates to these firmware

routines will be contained in that file. A summary of the firmware routines available is

given in Table 161.

The firmware table is comprised of 3-byte entries where the first byte is the operational

code for the JMP instruction, and the following two bytes are the absolute address

pointing to the location of the firmware function.

Table 161. FXTH87Ex02 single Z-axis firmware summary and jump routines

Address Routine Description

E000 TPMS_RESET Master reset of complete device

E003 TPMS_READ_VOLTAGE 10-bit uncompensated band gap voltage reading

E006 TPMS_COMP_VOLTAGE 8-bit compensation of 10-bit voltage reading

E009 TPMS_READ_TEMPERATURE 10-bit uncompensated temperature reading

E00C TPMS_COMP_TEMPERATURE 8-bit compensation of 10-bit temperature reading

E00F TPMS_READ_PRESSURE 10-bit uncompensated pressure reading

E012 TPMS_COMP_PRESSURE 9-bit compensation of 10-bit pressure reading

E015 TPMS_READ_ACCELERATION 10-bit uncompensated acceleration reading

E018 TPMS_COMP_ACCELERATION 9-bit compensation of 10-bit acceleration reading

E01B TPMS_READ_V0 10-bit uncompensated voltage reading on PTA0 pin

E01E TPMS_READ_V1 10-bit uncompensated voltage reading on PTA1 pin

E021 TPMS_LFOCAL LFO clock calibration

E024 TPMS_MFOCAL MFO clock calibration

E027 TPMS_WAVG Weighted average (2, 4, 8, 16 or 32)

E02A TPMS_RF_RESET Master reset of RFM

E02D TPMS_RF_READ_DATA Read RFM data buffer

E030 TPMS_RF_READ_DATA_REVERSE Read RFM data buffer in reverse bit order

E033 TPMS_RF_WRITE_DATA Write RFM data buffer

E036 TPMS_RF_WRITE_DATA_REVERSE Write RFM data buffer in reverse bit order

E039 TPMS_RF_CONFIG_DATA Configure RFM

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

158 / 182

Address Routine Description

E03C Reserved Reserved

E03F TPMS_RF_SET_TX Initiate RF transmission

E042 TPMS_RF_DYNAMIC_POWER Adjusts PA for uniform power output

E045 TPMS_MSG_INIT Initialization of the emulated serial communication

E048 TPMS_MSG_READ Reading data from emulated serial interface

E04B TPMS_MSG_WRITE Writing data on emulated serial interface

E04E TPMS_CHECKSUM_XOR Calculates a checksum for given buffer in XOR

E051 TPMS_CRC8 Calculates CRC8 on portion of memory

E054 TPMS_CRC16 Calculates CRC16 on portion of memory

E057 TPMS_SQUARE_ROOT Calculates square root

E05A TPMS_READ_ID Reads device ID stored in FLASH

E05D TPMS_LF_ENABLE Enable/Disable LF for Carrier or Data

E060 TPMS_LF_READ_DATA Reading LF data

E063[1] TPMS_WIRE_AND_ADC_CHECK Performs checks of internal bond wires

E066 TPMS_FLASH_WRITE Write to FLASH

E069 TPMS_FLASH_CHECK Performs checksum on NXP firmware FLASH

E06C TPMS_FLASH_ERASE Erases one page (512 bytes) of FLASH at a time

E06F TPMS_READ_DYNAMIC_ACCEL Offsets Z-axis acceleration with one of 15 steps

E072 TPMS_RF_ENABLE Enable RFM

E075 TPMS_FLASH_PROTECTION Lock out FLASH

E078 Reserved Reserved

E07B TPMS_MULT_SIGN_INT16 Multiple two signed 16-bit numbers together

E07E TPMS_VREG_CHECK Verify that external capacitor connected to VREG pin

E081 TPMS_PRECHARGE_VREG Precharge external capacitor on VREG pin

E084 Reserved Reserved

E087 TPMS_READ_ACCEL_CONT_START Enable the TPMS_READ_ACCEL_CONT function.

E08A TPMS_READ_ACCEL_CONT Take continuous acceleration readings and store to assigned

location.

E08D TPMS_READ_ACCEL_CONT_STOP Disable the TPMS_READ_ACCEL_CONT function.

[1] The Wire and ADC Check firmware routine is designed to return a conversion value of 0x00. In cases of combined elevated temperature and low battery

voltage, noise in the ADC system may result in a value above just above 0x00. Under these conditions, a false error result may be possible. Users are

advised to call the Wire and ADC Check in conditions of minimal noise in order to minimize the possibility of false error results. Characterizations indicate

the probability of false errors is minimized when the battery voltage is above 2.7V at any rated temperature, or when the battery voltage falls below 2.7V,

the temperature is below 85oC. It is recommended that when needed, the application call the Wire and ADC Check when the temperature is below 85oC

and battery voltage is above 2.2V at minimum.

16.2.1.2 FXTH87E dual XZ-axis firmware routines

The details on the use and execution of each firmware routine is documented in the

CodeWarrior project file that is supplied by NXP. Any future updates to these firmware

routines will be contained in that file. A summary of the firmware routines available is

given in Table 162.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

159 / 182

The firmware table is comprised of 3-byte entries where the first byte is the operational

code for the JMP instruction, and the following two bytes are the absolute address

pointing to the location of the firmware function.

Table 162. FXTH87Ex1x dual XZ-axis firmware summary and jump routines

Address Routine Description

E000 TPMS_RESET Master reset of complete device

E003 TPMS_READ_VOLTAGE 10-bit uncompensated band gap voltage reading

E006 TPMS_COMP_VOLTAGE 8-bit compensation of 10-bit voltage reading

E009 TPMS_READ_TEMPERATURE 10-bit uncompensated temperature reading

E00C TPMS_COMP_TEMPERATURE 8-bit compensation of 10-bit temperature reading

E00F TPMS_READ_PRESSURE 10-bit uncompensated pressure reading

E012 TPMS_COMP_PRESSURE 9-bit compensation of 10-bit pressure reading

E015 TPMS_READ_ACCELERATION_X 10-bit uncompensated X-axis accel reading

E018 TPMS_READ_DYNAMIC_ACCEL_X 10-bit uncompensated X-axis accel reading

with dynamic offset adjustment.

E01B TPMS_COMP_ACCELERATION_X 9-bit compensation of 10-bit X-axis accel reading

E01E TPMS_READ_ACCELERATION_Z 10-bit uncompensated Z-axis accel reading

E021 TPMS_READ_DYNAMIC_ACCEL_Z 10-bit uncompensated Z-axis accel reading with dynamic

offset adjustment.

E024 TPMS_COMP_ACCELERATION_Z 9-bit compensation of 10-bit Z-axis accel reading

E027 TPMS_READ_ACCELERATION_XZ 10-bit uncompensated X-axis and Z-axis accel readings

E02A TPMS_READ_DYNAMIC_ACCEL_XZ 10-bit uncompensated X-axis and Z-axis accel readings with

dynamic offset adjustment.

E02D TPMS_COMP_ACCELERATION_XZ 9-bit compensation of 10-bit X-axis and Z-axis accel

readings

E030 TPMS_READ_V0 10-bit uncompensated voltage reading on PTA0 pin

E033 TPMS_READ_V1 10-bit uncompensated voltage reading on PTA1 pin

E036 TPMS_LFOCAL LFO clock calibration

E039 TPMS_MFOCAL MFO clock calibration

E03C TPMS_RF_ENABLE Enable and set up RFM

E03F TPMS_RF_RESET Master reset of RFM

E042 TPMS_RF_READ_DATA Read RFM data buffer

E045 TPMS_RF_READ_DATA_REVERSE Read RFM data buffer in reverse bit order

E048 TPMS_RF_WRITE_DATA Write RFM data buffer

E04B TPMS_RF_WRITE_DATA_REVERSE Write RFM data buffer in reverse bit order

E04E TPMS_RF_CONFIG_DATA Configure RFM

E051 Reserved Reserved

E054 TPMS_RF_SET_TX Initiate RF transmission

E057 TPMS_RF_DYNAMIC_POWER Adjusts PA for uniform power output

E05A TPMS_MSG_INIT Initialization of the emulated serial communication

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

160 / 182

Address Routine Description

E05D TPMS_MSG_READ Reading data from emulated serial interface

E060 TPMS_MSG_WRITE Writing data on emulated serial interface

E063 TPMS_CHECKSUM_XOR Calculates a checksum for given buffer in XOR

E066 TPMS_CRC8 Calculates CRC8 on portion of memory

E069 TPMS_CRC16 Calculates CRC16 on portion of memory

E06C TPMS_SQUARE_ROOT Calculates square root

E06F TPMS_READ_ID Reads device ID stored in FLASH

E072 TPMS_LF_ENABLE Enable/Disable LF for Carrier or Data

E075 TPMS_LF_READ_DATA Reading LF data

E078[1] TPMS_WIRE_AND_ADC_CHECK Performs checks of internal bond wires

E07B TPMS_FLASH_WRITE Write to FLASH

E07E TPMS_FLASH_CHECK Performs checksum on NXP firmware FLASH

E081 TPMS_FLASH_ERASE Erases one page (512 bytes) of FLASH at a time

E084 TPMS_FLASH_PROTECTION Lock out FLASH

E087 Reserved Reserved

E08A TPMS_MULT_SIGN_INT16 Multiple two signed 16-bit numbers together

E08D TPMS_WAVG Weighted average

E090 Reserved Reserved

[1] The Wire and ADC Check firmware routine is designed to return a conversion value of 0x00. In cases of combined elevated temperature and low battery

voltage, noise in the ADC system may result in a value above just above 0x00. Under these conditions, a false error result may be possible. Users are

advised to call the Wire and ADC Check in conditions of minimal noise in order to minimize the possibility of false error results. Characterizations indicate

the probability of false errors is minimized when the battery voltage is above 2.7V at any rated temperature, or when the battery voltage falls below 2.7V,

the temperature is below 85oC. It is recommended that when needed, the application call the Wire and ADC Check when the temperature is below 85oC

and battery voltage is above 2.2V at minimum.

16.2.2 Device identification

The bytes assigned to identify the device and its options are described below. This data

can be read by use of the TPMS_READ_ID routine.

Table 163. Device ID coding summary

BIT

ID Address Register

Name Address 76543210

00 CODE0 $E0A0 Reserved — Firmware Revision/Software Information

01 CODE1 $FDF2 ES2 ES1 ES0 PRESS ACC1 ACC0 SPCLA SPCLP

02 CODE2 $FDF3 ID7 ID6 ID5 ID4 ID3 ID2 ID1 ID0

03 CODE3 $FDF4 ID15 ID14 ID13 ID12 ID11 ID10 ID9 ID8

04 CODE4 $FDF5 ID23 ID22 ID21 ID20 ID19 ID18 ID17 ID16

05 CODE5 $FDF6 ID31 ID30 ID29 ID28 ID27 ID26 ID25 ID24

ID13:0 — Device ID within each assembly lot - 16k devices in each lot

ID26:14 — Lower 13 bits of assembly lot ID - 32k lots

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

161 / 182

ID27 — 0 to identify FXTH87E family

ID28:29 — Upper 2 bits of assembly lot ID

ID30 — 0x1 to identify sub-con B, 0x0 to identify sub-con A

ID31 — 0x1 to identify NXP as device supplier

Note: Prior to erasing the flash memory, users are advised to first copy the contents of

the CODE0 through CODE5 data into a secure and retrievable database. The contents

of CODE0 through CODE5 are unique to each part number, configuration of pressure

and accelerometer ranges, and serial numbers, and must be replaced as part of the user

flash programming processes.

Table 164. Device ID coding descriptions

Field Description

CODE0

7:0

Reserved

Reserved for NXP firmware description.

CODE1

7:5

Revision number for the multiple-chip-module silicon.

0x3 up to 0x7

CODE1

PRESS-H

Calibrated range for pressure. The range is a combination of this bit and the PRESS-L bit, below.

bit 0 = 0, bit 4 = 0 indicates a 100-500 kPa range

bit 0 = 0, bit 4 = 1 indicates a 100-900 kPa range

bit 0 = 1, bit 4 = 1 indicates a 100-1500 kPa range

CODE1

3:2

ACC

Type of accelerometer.

00 - None

01 - One accelerometer with X-axis orientation

10 - One accelerometer with Z-axis orientation

11 - Two accelerometers with X- and Z-axis orientations

CODE1

Special calibration for accelerometer.

0 = standard -215 to +305 g Z-axis

1 = extended -285 to +400 g Z-axis

CODE1

PRESS-L

Calibrated range for pressure. The range is a combination of this bit and the PRESS-H bit, above.

bit 0 = 0, bit 4 = 0 indicates a 100-500 kPa range

bit 0 = 0, bit 4 = 1 indicates a 100-900 kPa range

bit 0 = 1, bit 4 = 1 indicates a 100-1500 kPa range.

CODE2:4

7:0

CODE5

3:0

ID27:0

28-bit serial number for each device. All numbers to be unique with numbering sequence being a

sequential counter for each product type.

CODE5

7:4

ID31:28

4-bit number assigned to vendor type.

If these 4 bits are unspecified as part of the complete FLASH programming by the customer, then these 4

bits are programmed as described above at Table 163.

16.2.3 Definition of signal ranges

Each measured parameter (pressure, voltage, temperature, acceleration) results from

an ADC10 conversion of an analog signal. This ADC10 result may then be passed

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

162 / 182

by the firmware to the application software as either the raw ADC10 result or further

compensated and scaled for an output between one and the maximum digital value

minus one. The minimum digital value of zero and the maximum digital value are

reserved as error codes.

The signal ranges and their significant data points are shown in Figure 48. In this

definition the signal source would normally output a signal between SINLO and SINHI.

Due to process, temperature and voltage variations this signal may increase its range

to SINMIN to SINMAX. In all cases the signal will be between the supply rails, so that the

ADC10 will convert it to a range of digital numbers between 0 and 1023. These digital

numbers will have corresponding DINMIN, DINLO, DINHI, DINMAX values. The ADC10 digital

value is taken by the firmware and compensated and scaled to give the required output

code range.

SENSOR

ANALOG

VOLTAGE

ADC10 RAW

DIGITAL

(10-BIT CONVERSION)

CALCULATED

DIGITAL

(9-BIT EXAMPLE)

SIGNAL

SOURCE ADC10 FIRMWARE

ROUTINE

511

510

256

1023

512

VDD/2

VDD

SINMAX

SINHI

SINMIN

SINLO

DINMAX

DINHI

DINLO

DINMIN

NORMAL CASE

UNDERFLOW

LOWER ERROR CASE

CASE

OVERFLOW

CASE

FORCE

OUTPUT

TO 511

FORCE

OUTPUT

TO ZERO

UPPER ERROR CASE

aaa-028041

Figure 48. Measurement signal range definitions

Digital input values below DINMIN and above DINMAX are immediately flagged as being out

of range and generate error bits and the output is forced to the 0 value.

Digital values below DINLO (but above DINMIN) or above DINHI (but not DINMAX) will most

likely cause an output that would be less than 1 or greater than 510, respectively. These

cases are considered underflow or overflow, respectively. Underflow results will be forced

to a value of 1. Overflow results will be forced to a value of 510.

Digital values between DINLO and DINHI will normally produce an output between 1 to

510 (for a 9-bit result). In some isolated cases due to compensation calculations and

rounding the result may be less than 1 or greater than 510, in which case the underflow

and overflow rule mentioned above is used.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

163 / 182

16.3 Memory resource usage

The firmware uses the top 8192 bytes of the FLASH memory map. At address $FC00,

1024 bytes are protected from erasure, containing the sensitivity and offset coefficients

for the transducers and clocks.

The firmware uses no specific bytes of the RAM but will cause additional stacking of

temporary values.

The firmware uses two bytes ($008E and $008F) of the Parameter Registers for global

flags for all routines.

16.3.1 Software stack

The RESET firmware function sets the SP register to the last address in the RAM. The

user can change the default stack location to meet its own application needs.

17 Development support

17.1 Introduction

This chapter describes the single-wire BACKGROUND DEBUG mode (BDM), which uses

the on-chip BACKGROUND DEBUG controller (BDC) module.

17.1.1 Features

Features of the BDC module include:

•Single pin for mode selection and background communications

•BDC registers are not located in the memory map

•SYNC command to determine target communications rate

•Non-intrusive commands for memory access

•ACTIVE BACKGROUND mode commands for CPU register access

•GO and TRACE1 commands

•BACKGROUND command can wake CPU from STOP or WAIT modes

•One hardware address breakpoint built into BDC

•Oscillator runs in STOP mode, if BDC enabled

•COP watchdog disabled while in ACTIVE BACKGROUND mode

17.2 Background debug controller (BDC)

All MCUs in the HCS08 Family contain a single-wire BACKGROUND DEBUG interface

that supports in-circuit programming of on-chip nonvolatile memory and sophisticated

non-intrusive debug capabilities. Unlike debug interfaces on earlier 8-bit MCUs, this

system does not interfere with normal application resources. It does not use any user

memory or locations in the memory map and does not share any on-chip peripherals.

BDC commands are divided into two groups:

•ACTIVE BACKGROUND mode commands require that the target MCU is in ACTIVE

BACKGROUND mode (the user program is not running). ACTIVE BACKGROUND

mode commands allow the CPU registers to be read or written, and allow the user

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

164 / 182

to trace one user instruction at a time, or GO to the user program from ACTIVE

BACKGROUND mode.

•Non-intrusive commands can be executed at any time even while the user’s program is

running. Non-intrusive commands allow a user to read or write MCU memory locations

or access status and control registers within the BACKGROUND DEBUG controller.

Typically, a relatively simple interface pod is used to translate commands from a

host computer into commands for the custom serial interface to the single-wire

BACKGROUND DEBUG system. Depending on the development tool vendor, this

interface pod may use a standard RS-232 serial port, a parallel printer port, or some

other type of communications such as a universal serial bus (USB) to communicate

between the host PC and the pod. The pod typically connects to the target system with

ground, the BKGD/PTA4 pin, RESET, and sometimes VDD. An open-drain connection to

reset allows the host to force a target system reset, which is useful to regain control of a

lost target system or to control startup of a target system before the on-chip nonvolatile

memory has been programmed. Sometimes VDD can be used to allow the pod to use

power from the target system to avoid the need for a separate power supply. However,

if the pod is powered separately, it can be connected to a running target system without

forcing a target system reset or otherwise disturbing the running application program.

NO CONNECT

NO CONNECT RESET

BKGD GND

VDD

aaa-028042

Figure 49. BDM tool connector

17.2.1 BKGD/PTA4 pin description

BKGD/PTA4 is the single-wire BACKGROUND DEBUG interface pin. The primary

function of this pin is for bidirectional serial communication of ACTIVE BACKGROUND

mode commands and data. During reset, this pin is used to select between starting

in ACTIVE BACKGROUND mode or starting the user’s application program. This

pin is also used to request a timed sync response pulse to allow a host development

tool to determine the correct clock frequency for BACKGROUND DEBUG serial

communications.

BDC serial communications use a custom serial protocol first introduced on the

M68HC12 Family of microcontrollers. This protocol assumes the host knows the

communication clock rate that is determined by the target BDC clock rate. All

communication is initiated and controlled by the host that drives a high-to-low edge to

signal the beginning of each bit time. Commands and data are sent most significant

bit first (MSB first). For a detailed description of the communications protocol, refer to

Section 17.2.2 "Communication details".

If a host is attempting to communicate with a target MCU that has an unknown BDC

clock rate, a SYNC command may be sent to the target MCU to request a timed sync

response signal from which the host can determine the correct communication speed.

BKGD/PTA4 is a pseudo-open-drain pin and there is an on-chip pullup so no external

pullup resistor is required. Unlike typical open-drain pins, the external RC time constant

on this pin, which is influenced by external capacitance, plays almost no role in signal

rise time. The custom protocol provides for brief, actively driven speedup pulses to force

rapid rise times on this pin without risking harmful drive level conflicts. Refer to Figure 48,

for more detail.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

165 / 182

When no debugger pod is connected to the 6-pin BDM interface connector, the internal

pullup on BKGD/PTA4 chooses normal operating mode. When a debug pod is connected

to BKGD/PTA4 it is possible to force the MCU into ACTIVE BACKGROUND mode after

reset. The specific conditions for forcing ACTIVE BACKGROUND depend upon the

HCS08 derivative (refer to the introduction to this Development Support section). It is not

necessary to reset the target MCU to communicate with it through the BACKGROUND

DEBUG interface.

17.2.2 Communication details

The BDC serial interface requires the external controller to generate a falling edge on the

BKGD/PTA4 pin to indicate the start of each bit time. The external controller provides this

falling edge whether data is transmitted or received.

BKGD/PTA4 is a pseudo-open-drain pin that can be driven either by an external

controller or by the MCU. Data is transferred MSB first at 16 BDC clock cycles per bit

(nominal speed). The interface times out if 512 BDC clock cycles occur between falling

edges from the host. Any BDC command that was in progress when this timeout occurs

is aborted without affecting the memory or operating mode of the target MCU system.

The custom serial protocol requires the debug pod to know the target BDC

communication clock speed.

The clock switch (CLKSW) control bit in the BDC status and control register allows the

user to select the BDC clock source. The BDC clock source can either be the bus or the

alternate BDC clock source.

The BKGD/PTA4 pin can receive a high or low level or transmit a high or low level. The

following diagrams show timing for each of these cases. Interface timing is synchronous

to clocks in the target BDC, but asynchronous to the external host. The internal BDC

clock signal is shown for reference in counting cycles.

Figure 50 shows an external host transmitting a logic 1 or 0 to the BKGD/PTA4 pin of

a target HCS08 MCU. The host is asynchronous to the target so there is a 0-to-1 cycle

delay from the host-generated falling edge to where the target perceives the beginning

of the bit time. Ten target BDC clock cycles later, the target senses the bit level on the

BKGD/PTA4 pin. Typically, the host actively drives the pseudo-open-drain BKGD/PTA4

pin during host-to-target transmissions to speed up rising edges. Because the target

does not drive the BKGD/PTA4 pin during the host-to-target transmission period, there is

no need to treat the line as an open-drain signal during this period.

Earliest start of next bit

Target senses bit level

aaa-028043

10 cycles

Synchronization

uncertinity

BDC clock

(target MCU)

Host

transmit 1

Host

transmit 0

Perceived start

of bit time

Figure 50. BDC host-to-target serial bit timing

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

166 / 182

Figure 51 shows the host receiving a logic 1 from the target HCS08 MCU. Because the

host is asynchronous to the target MCU, there is a 0-to-1 cycle delay from the host-

generated falling edge on BKGD/PTA4 to the perceived start of the bit time in the target

MCU. The host holds the BKGD/PTA4 pin low long enough for the target to recognize it

(at least two target BDC cycles). The host must release the low drive before the target

MCU drives a brief active-high speedup pulse seven cycles after the perceived start of

the bit time. The host should sample the bit level about 10 cycles after it started the bit

time.

Earliest start of next bit

aaa-028044

Host samples BKGD PTA4 pin

10 cycles

BDC clock

(target MCU)

Host drive to

BKGD/PTA4 pin

Target MCU

speedup pulse

Perceived start

of bit time

10 cycles

High-impedance High-impedance

High-impedance

R-C rise

Figure 51. BDC target-to-host serial bit timing (Logic 1)

Figure 52 shows the host receiving a logic 0 from the target HCS08 MCU. Because the

host is asynchronous to the target MCU, there is a 0-to-1 cycle delay from the host-

generated falling edge on BKGD/PTA4 to the start of the bit time as perceived by the

target MCU. The host initiates the bit time but the target HCS08 finishes it. Because the

target wants the host to receive a logic 0, it drives the BKGD/PTA4 pin low for 13 BDC

clock cycles, then briefly drives it high to speed up the rising edge. The host samples the

bit level about 10 cycles after starting the bit time.

Earliest start of next bit

aaa-028045

Host samples BKGD PTA4 pin

10 cycles

BDC clock

(target MCU)

Host drive to

BKGD/PTA4 pin

Target MCU

drive and

speedup pulse

Perceived start

of bit time

10 cycles

High-impedance

Speedup

pulse

Figure 52. BDM target-to-host serial bit timing (Logic 0)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

167 / 182

17.2.3 BDC commands

BDC commands are sent serially from a host computer to the BKGD/PTA4 pin of

the target HCS08 MCU. All commands and data are sent MSB-first using a custom

BDC communications protocol. ACTIVE BACKGROUND mode commands require

that the target MCU is currently in the ACTIVE BACKGROUND mode while non-

intrusive commands may be issued at any time whether the target MCU is in ACTIVE

BACKGROUND mode or running a user application program. Table 165 shows all

HCS08 BDC commands, a shorthand description of their coding structure, and the

meaning of each command.

17.2.3.1 Coding structure nomenclature

This nomenclature is used in Table 165 to describe the coding structure of the BDC

commands. Commands begin with an 8-bit hexadecimal command code in the host-to-

target direction (most significant bit first)

/ = separates parts of the command

d = delay 16 target BDC clock cycles

AAAA = a 16-bit address in the host-to-target direction

RD = 8 bits of read data in the target-to-host direction

WD = 8 bits of write data in the host-to-target direction

RD16 = 16 bits of read data in the target-to-host direction

WD16 = 16 bits of write data in the host-to-target direction

SS = the contents of BDCSCR in the target-to-host direction (STATUS)

CC = 8 bits of write data for BDCSCR in the host-to-target direction (CONTROL)

RBKP = 16 bits of read data in the target-to-host direction (from BDCBKPT breakpoint

WBKP = 16 bits of write data in the host-to-target direction (for BDCBKPT breakpoint

Table 165. BDC command summary

Command Mnemonic Active BDM/

Non-intrusive Coding Structure Description

SYNC Non-intrusive n/a [1] Request a timed reference pulse to determine

target BDC communication speed

ACK_ENABLE Non-intrusive D5/d Enable acknowledge protocol. Refer to NXP

document order no. HCS08RMv1/D.

ACK_DISABLE Non-intrusive D6/d Disable acknowledge protocol. Refer to NXP

document order no. HCS08RMv1/D.

BACKGROUND Non-intrusive 90/d Enter ACTIVE BACKGROUND mode if enabled

(ignore if ENBDM bit equals 0)

READ_STATUS Non-intrusive E4/SS Read BDC status from BDCSCR

WRITE_CONTROL Non-intrusive C4/CC Write BDC controls in BDCSCR

READ_BYTE Non-intrusive E0/AAAA/d/RD Read a byte from target memory

READ_BYTE_WS Non-intrusive E1/AAAA/d/SS/RD Read a byte and report status

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

168 / 182

Command Mnemonic Active BDM/

Non-intrusive Coding Structure Description

READ_LAST Non-intrusive E8/SS/RD Re-read byte from address just read and report

status

WRITE_BYTE Non-intrusive C0/AAAA/WD/d Write a byte to target memory

WRITE_BYTE_WS Non-intrusive C1/AAAA/WD/d/SS Write a byte and report status

READ_BKPT Non-intrusive E2/RBKP Read BDCBKPT breakpoint register

WRITE_BKPT Non-intrusive C2/WBKP Write BDCBKPT breakpoint register

GO Active BDM 08/d Go to execute the user application program

starting at the address currently in the PC

TRACE1 Active BDM 10/d

Trace 1 user instruction at the address in the

PC, then return to ACTIVE BACKGROUND

mode

TAGGO Active BDM 18/d Same as GO but enable external tagging

(HCS08 devices have no external tagging pin)

READ_A Active BDM 68/d/RD Read accumulator (A)

READ_CCR Active BDM 69/d/RD Read condition code register (CCR)

READ_PC Active BDM 6B/d/RD16 Read program counter (PC)

READ_HX Active BDM 6C/d/RD16 Read H and X register pair (H:X)

READ_SP Active BDM 6F/d/RD16 Read stack pointer (SP)

READ_NEXT Active BDM 70/d/RD Increment H:X by one then read memory byte

located at H:X

READ_NEXT_WS Active BDM 71/d/SS/RD Increment H:X by one then read memory byte

located at H:X. Report status and data.

WRITE_A Active BDM 48/WD/d Write accumulator (A)

WRITE_CCR Active BDM 49/WD/d Write condition code register (CCR)

WRITE_PC Active BDM 4B/WD16/d Write program counter (PC)

WRITE_HX Active BDM 4C/WD16/d Write H and X register pair (H:X)

WRITE_SP Active BDM 4F/WD16/d Write stack pointer (SP)

WRITE_NEXT Active BDM 50/WD/d Increment H:X by one, then write memory byte

located at H:X

WRITE_NEXT_WS Active BDM 51/WD/d/SS Increment H:X by one, then write memory byte

located at H:X. Also report status.

[1] The SYNC command is a special operation that does not have a command code.

The SYNC command is unlike other BDC commands because the host does not

necessarily know the correct communications speed to use for BDC communications

until after it has analyzed the response to the SYNC command.

To issue a SYNC command, the host:

•Drives the BKGD/PTA4 pin low for at least 128 cycles of the slowest possible BDC

clock (The slowest clock is normally the reference oscillator/64 or the self-clocked

rate/64.)

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

169 / 182

•Drives BKGD/PTA4 high for a brief speedup pulse to get a fast rise time (This speedup

pulse is typically one cycle of the fastest clock in the system.)

•Removes all drive to the BKGD/PTA4 pin so it reverts to high impedance

•Monitors the BKGD/PTA4 pin for the sync response pulse

The target, upon detecting the SYNC request from the host (which is a much longer low

time than would ever occur during normal BDC communications):

•Waits for BKGD/PTA4 to return to a logic high

•Delays 16 cycles to allow the host to STOP driving the high speedup pulse

•Drives BKGD/PTA4 low for 128 BDC clock cycles

•Drives a 1-cycle high speedup pulse to force a fast rise time on BKGD/PTA4

•Removes all drive to the BKGD/PTA4 pin so it reverts to high impedance

The host measures the low time of this 128-cycle sync response pulse and determines

the correct speed for subsequent BDC communications. Typically, the host can

determine the correct communication speed within a few percent of the actual target

speed and the communication protocol can easily tolerate speed errors of several

percent.

17.2.4 BDC hardware breakpoint

The BDC includes one relatively simple hardware breakpoint that compares the CPU

address bus to a 16-bit match value in the BDCBKPT register. This breakpoint can

generate a forced breakpoint or a tagged breakpoint. A forced breakpoint causes the

CPU to enter ACTIVE BACKGROUND mode at the first instruction boundary following

any access to the breakpoint address. The tagged breakpoint causes the instruction

opcode at the breakpoint address to be tagged so that the CPU will enter ACTIVE

BACKGROUND mode rather than executing that instruction if and when it reaches the

end of the instruction queue. This implies that tagged breakpoints can only be placed at

the address of an instruction opcode while forced breakpoints can be set at any address.

The breakpoint enable (BKPTEN) control bit in the BDC status and control register

(BDCSCR) is used to enable the breakpoint logic (BKPTEN = 1). When BKPTEN = 0,

its default value after reset, the breakpoint logic is disabled and no BDC breakpoints are

requested regardless of the values in other BDC breakpoint registers and control bits.

The force/tag select (FTS) control bit in BDCSCR is used to select forced (FTS = 1) or

tagged (FTS = 0) type breakpoints.

17.3 Register definition

This section contains the descriptions of the BDC registers and control bits.

This section refers to registers and control bits only by their names. A NXP-provided

equate or header file is used to translate these names into the appropriate absolute

addresses.

17.3.1 BDC registers and control bits

The BDC has two registers:

•The BDC status and control register (BDCSCR) is an 8-bit register containing control

and status bits for the BACKGROUND DEBUG controller.

•The BDC breakpoint match register (BDCBKPT) holds a 16-bit breakpoint match

address.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

170 / 182

These registers are accessed with dedicated serial BDC commands and are not located

in the memory space of the target MCU (so they do not have addresses and cannot be

accessed by user programs).

Some of the bits in the BDCSCR have write limitations; otherwise, these registers may be

read or written at any time. For example, the ENBDM control bit may not be written while

the MCU is in ACTIVE BACKGROUND mode. (This prevents the ambiguous condition

of the control bit forbidding ACTIVE BACKGROUND mode while the MCU is already in

ACTIVE BACKGROUND mode.) Also, the four status bits (BDMACT, WS, WSF, and

DVF) are read-only status indicators and can never be written by the WRITE_CONTROL

serial BDC command. The clock switch (CLKSW) control bit may be read or written at

any time.

17.3.2 BDC status and control register (BDCSCR)

This register can be read or written by serial BDC commands (READ_STATUS and

WRITE_CONTROL) but is not accessible to user programs because it is not located in

the normal memory map of the MCU.

Table 166. BDC status and control register (BDCSCR)

Bit 76543210

R BDMACT WS WSF DVF

WENBDM BKPTEN FTS CLKSW

Normal Reset 0 0 0 0 0 0 0 0

Reset in Active BDM 1 1 0 0 1 0 0 0

= Reserved

Table 167. BDCSCR register field descriptions

Field Description

ENBDM

Enable BDM (Permit ACTIVE BACKGROUND Mode) — Typically, this bit is written to 1 by the debug host

shortly after the beginning of a debug session or whenever the debug host resets the target and remains 1

until a normal reset clears it.

0 BDM cannot be made active (non-intrusive commands still allowed)

1 BDM can be made active to allow ACTIVE BACKGROUND mode commands

BDMACT

BACKGROUND Mode Active Status — This is a read-only status bit.

0 BDM not active (user application program running)

1 BDM active and waiting for serial commands

BKPTEN

BDC Breakpoint Enable — If this bit is clear, the BDC breakpoint is disabled and the FTS (force tag select)

control bit and BDCBKPT match register are ignored.

0 BDC breakpoint disabled

1 BDC breakpoint enabled

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

171 / 182

Field Description

FTS

Force/Tag Select — When FTS = 1, a breakpoint is requested whenever the CPU address bus matches

the BDCBKPT match register. When FTS = 0, a match between the CPU address bus and the BDCBKPT

instruction queue, the CPU enters ACTIVE BACKGROUND mode rather than executing the tagged opcode.

0 Tag opcode at breakpoint address and enter ACTIVE BACKGROUND mode if CPU attempts to execute

that instruction

1 Breakpoint match forces ACTIVE BACKGROUND mode at next instruction boundary (address need not

be an opcode)

CLKSW

Select Source for BDC Communications Clock — CLKSW defaults to 0, which selects the alternate BDC

clock source.

0 Alternate BDC clock source

1 MCU bus clock

WAIT or STOP Status — When the target CPU is in WAIT or STOP mode, most BDC commands cannot

function. However, the BACKGROUND command can be used to force the target CPU out of WAIT or STOP

and into ACTIVE BACKGROUND mode where all BDC commands work. Whenever the host forces the

target MCU into ACTIVE BACKGROUND mode, the host should issue a READ_STATUS command to check

that BDMACT = 1 before attempting other BDC commands.

0 Target CPU is running user application code or in ACTIVE BACKGROUND mode (was not in WAIT or

STOP mode when BACKGROUND became active)

1 Target CPU is in WAIT or STOP mode, or a BACKGROUND command was used to change from WAIT or

STOP to ACTIVE BACKGROUND mode

WSF

WAIT or STOP Failure Status — This status bit is set if a memory access command failed due to the target

CPU executing a WAIT or STOP instruction at or about the same time. The usual recovery strategy is to

issue a BACKGROUND command to get out of WAIT or STOP mode into ACTIVE BACKGROUND mode,

repeat the command that failed, then return to the user program. (Typically, the host would restore CPU

registers and stack values and re-execute the WAIT or STOP instruction.)

0 Memory access did not conflict with a WAIT or STOP instruction

1 Memory access command failed because the CPU entered WAIT or STOP mode

DVF

Data Valid Failure Status — This status bit is not used in the MC9S08RA16 because it does not have any

slow access memory.

0 Memory access did not conflict with a slow memory access

1 Memory access command failed because CPU was not finished with a slow memory access

17.3.3 BDC breakpoint match register (BDCBKPT)

This 16-bit register holds the address for the hardware breakpoint in the BDC. The

BKPTEN and FTS control bits in BDCSCR are used to enable and configure the

breakpoint logic. Dedicated serial BDC commands (READ_BKPT and WRITE_BKPT)

are used to read and write the BDCBKPT register but is not accessible to user programs

because it is not located in the normal memory map of the MCU. Breakpoints are

normally set while the target MCU is in ACTIVE BACKGROUND mode before running

the user application program. For additional information about setup and use of

the hardware breakpoint logic in the BDC, refer to Section 17.2.4 "BDC hardware

breakpoint".

17.3.4 System background debug force reset register (SBDFR)

This register contains a single write-only control bit. A serial BACKGROUND mode

command such as WRITE_BYTE must be used to write to SBDFR. Attempts to write this

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

172 / 182

Table 168. System background debug force reset register (SBDFR)

Bit76543210

R00000000

W BDFR[1]

Reset00000000

= Reserved

[1] BDFR is writable only through serial BACKGROUND mode debug commands, not from user programs.

Table 169. SBDFR register field description

Field Description

BDFR

Background Debug Force Reset — A serial ACTIVE BACKGROUND mode command such as WRITE_

BYTE allows an external debug host to force a target system reset. Writing 1 to this bit forces an MCU

reset. This bit cannot be written from a user program.

18 Battery charge consumption modeling

The supply current consumed by the FXTH87E can be estimated using the following

basic model.

18.1 Standby current

The overall charge consumed by the standby features is:

(13)

where:

•QSTDBY = Standby charge over lifetime, tTOT, in mA-hr

•tTOT = Total lifetime in hours

•ISTDBY = General standby current in μA

•ILF = LFR detector (if used) current in μA

18.2 Measurement events

The overall charge consumed by the measurements is:

(14)

where:

•QMEAS = Total measurement charge over lifetime in mA-sec

•QPRESS = Measurement charge per pressure measurement in μA-sec

•QTEMP = Measurement charge per temperature measurement in μA-sec

•QVOLT = Measurement charge per voltage measurement in μA-sec

•nPRESS = Total number of pressure measurements over lifetime

•nTEMP = Total number of temperature measurements over lifetime

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

173 / 182

•nVOLT = Total number of voltage measurements over lifetime

18.3 Transmission events

The overall charge consumed by the transmissions is:

(15)

where:

•QXMT = Transmit charge over lifetime, tTOT, in mA-hr

•QFRM = Transmit charge per frame of data in μA-sec

•nXMT = Number of transmissions over lifetime

•F = Frames transmitted during each datagram

18.4 Total consumption

The overall charge consumed is:

(16)

where:

•QTOT = Total charge over lifetime, tTOT, in mA-hr

•QSTDBY = Standby charge over lifetime in mA-hr

•QMEAS = Measurement charge over lifetime in mA-hr

QXMT = Transmit charge over lifetime in mA-hr

Y = Lifetime in years

•SD = Battery self-discharge rate in%/year

Additional margin in battery capacity can be added to the calculated value of QTOT.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

174 / 182

19 Revision history

Table 170. Revision history

Document ID Release date Description

FXTH87ERM v.4.0 20181129 •Performed minor corrections throughout the narrative to conform with

NXP guidelines.

•Section 1.3 "Related documentation": Revised the steps providing a

direct link to the FXTH87E page on NXP.com.

•Section 2.2 "Features and benefits": Added "Optional XZ- or" before

the feature "Z-axis accelerometer with adjustable offset option".

•Section 2.4 "Part number definition": Added Section 2.4 to document

part numbering.

•Section 2.5 "Part marking definition": Added Section 2.5 to document

part marking.

•Section 3.1 "Overall block diagram": Revised the title from "Block

diagram" to "Overall block diagram".

•Section 4 "Pinning information": Added "This section describes the

pin layout and general function of each pin." as the first paragraph in

Section 4

•Section 4.3, Figure 5: Minor updates to text within the image and in

the paragraphs below the image.

•Section 16.2.2 "Device identification", Table 164: Revised the

description "special calibration for accelerometer" for "Field CODE1, 1"

as follows:

–Changed "0 = standard –240 to +270 g Z-axis" to "0 = standard -215

to +305 g Z-axis"

–Changed "1 = extended –270 to +400 g Z-axis" to "1 = extended

-285 to +400 g Z-axis"

FXTH87ERM v.3.0 20180305 •Section 2.2 "Features and benefits": Revised bullet "Real-Time

Interrupt driven by LFO with interrupt intervals of 8, 16, 32, 64, 128,

256, 512 or 1024 ms" to "Real-Time Interrupt driven by LFO with

interrupt intervals of 2, 4, 8, 16, 32, 64, or 128 ms."

•Figure 5: Added second paragraph.

•Section 4.4.10: Added content to second paragraph.

•Table 5: Updated Note 1.

•Section 6.1 "MCU memory map": Corrected paragraph following

graphic, sentence "... vectors to the user area from $DFC0 through

$DFFF" to "... vectors to the user area from $DFE0 through $DFFF".

•Figure 8: Updated graphic.

•Section 6.8 "Security": Corrected second paragraph sentence "...state

of SEC[1:0] = 1 1 unsecures the device" to "...state of SEC[1:0] = 1 1

secures the device".

•Table 31: Updated description for Vector 12.

•Table 35: Updated description for Field 7, RTIF.

•Table 40: Corrected Field 1 BKGDPE description "... applications

as an input-only" to ... application as an output-only" and "0 BKGD

function disabled, PTA4 enabled" to "0 BKGD function disabled, PTA4

output-only enabled".

•Table 56: Added note to description.

•Table 125: Corrected DEQEN bit reset value from "1" to "0".

•Table 152: Corrected figure links in Field 2, POL.

FXTH87ERM v.2.0 20170919 •Product data sheet

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

175 / 182

20 Legal information

20.1 Definitions

Draft — The document is a draft version only. The content is still under

internal review and subject to formal approval, which may result in

modifications or additions. NXP Semiconductors does not give any

representations or warranties as to the accuracy or completeness of

information included herein and shall have no liability for the consequences

of use of such information.

20.2 Disclaimers

Limited warranty and liability — Information in this document is believed

to be accurate and reliable. However, NXP Semiconductors does not

give any representations or warranties, expressed or implied, as to the

accuracy or completeness of such information and shall have no liability

for the consequences of use of such information. NXP Semiconductors

takes no responsibility for the content in this document if provided by an

information source outside of NXP Semiconductors. In no event shall NXP

Semiconductors be liable for any indirect, incidental, punitive, special or

consequential damages (including - without limitation - lost profits, lost

savings, business interruption, costs related to the removal or replacement

of any products or rework charges) whether or not such damages are based

on tort (including negligence), warranty, breach of contract or any other

legal theory. Notwithstanding any damages that customer might incur for

any reason whatsoever, NXP Semiconductors’ aggregate and cumulative

liability towards customer for the products described herein shall be limited

in accordance with the Terms and conditions of commercial sale of NXP

Semiconductors.

Right to make changes — NXP Semiconductors reserves the right to

make changes to information published in this document, including without

limitation specifications and product descriptions, at any time and without

notice. This document supersedes and replaces all information supplied prior

to the publication hereof.

Applications — Applications that are described herein for any of these

products are for illustrative purposes only. NXP Semiconductors makes

no representation or warranty that such applications will be suitable

for the specified use without further testing or modification. Customers

are responsible for the design and operation of their applications and

products using NXP Semiconductors products, and NXP Semiconductors

accepts no liability for any assistance with applications or customer product

design. It is customer’s sole responsibility to determine whether the NXP

Semiconductors product is suitable and fit for the customer’s applications

and products planned, as well as for the planned application and use of

customer’s third party customer(s). Customers should provide appropriate

design and operating safeguards to minimize the risks associated with

their applications and products. NXP Semiconductors does not accept any

liability related to any default, damage, costs or problem which is based

on any weakness or default in the customer’s applications or products, or

the application or use by customer’s third party customer(s). Customer is

responsible for doing all necessary testing for the customer’s applications

and products using NXP Semiconductors products in order to avoid a

default of the applications and the products or of the application or use by

customer’s third party customer(s). NXP does not accept any liability in this

respect.

Suitability for use in automotive applications — This NXP

Semiconductors product has been qualified for use in automotive

applications. Unless otherwise agreed in writing, the product is not designed,

authorized or warranted to be suitable for use in life support, life-critical or

safety-critical systems or equipment, nor in applications where failure or

malfunction of an NXP Semiconductors product can reasonably be expected

to result in personal injury, death or severe property or environmental

damage. NXP Semiconductors and its suppliers accept no liability for

inclusion and/or use of NXP Semiconductors products in such equipment or

applications and therefore such inclusion and/or use is at the customer's own

risk.

Quick reference data — The Quick reference data is an extract of the

product data given in the Limiting values and Characteristics sections of this

document, and as such is not complete, exhaustive or legally binding.

Export control — This document as well as the item(s) described herein

may be subject to export control regulations. Export might require a prior

authorization from competent authorities.

Translations — A non-English (translated) version of a document is for

reference only. The English version shall prevail in case of any discrepancy

between the translated and English versions.

20.3 Trademarks

Notice: All referenced brands, product names, service names and

trademarks are the property of their respective owners.

CodeWarrior — is a trademark of NXP B.V.

NXP — is a trademark of NXP B.V.

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

176 / 182

Tables

Tab. 1. Configuration options ........................................ 2

Tab. 2. Part number breakdown ....................................3

Tab. 3. Part marking breakdown ................................... 3

Tab. 4. Pin description ...................................................7

Tab. 5. STOP mode behavior ......................................13

Tab. 6. Vector summary .............................................. 18

Tab. 7. MCU direct page register summary .................19

Tab. 8. LFR register summary - LPAGE = 0 ............... 20

Tab. 9. LFR register summary - LPAGE = 1 ............... 20

Tab. 10. RFM register summary - RPAGE = 0 ..............20

Tab. 11. RFM register summary - RPAGE = 1 ..............21

Tab. 12. MCU high address register summary ..............22

Tab. 13. Program and erase times ................................24

Tab. 14. FLASH clock divider register (FCDIV)

(address $1820) .............................................. 31

Tab. 15. FCDIV register field descriptions .....................31

Tab. 16. FLASH clock divider settings .......................... 31

Tab. 17. FLASH options register (FOPT) (address

$1821) ............................................................. 32

Tab. 18. FOPT register field descriptions ...................... 32

Tab. 19. Security states .................................................32

Tab. 20. FLASH configuration register (FCNFG)

(address $1823) .............................................. 33

Tab. 21. FCNFG register field descriptions ................... 33

Tab. 22. FLASH protection register (FPROT)

(address $1824) .............................................. 33

Tab. 23. FPROT register field descriptions ................... 33

Tab. 24. FLASH status register (FSTAT) (address

$1825) ............................................................. 34

Tab. 25. FSTAT register field descriptions .................... 34

Tab. 26. FLASH command register (FCMD) (address

$1826) ............................................................. 35

Tab. 27. FLASH commands .......................................... 35

Tab. 28. COP watchdog timeout period ........................ 36

Tab. 29. SIM test register (SIMTST) (address $180F) ... 37

Tab. 30. SIMTST register field descriptions .................. 38

Tab. 31. Vector summary .............................................. 40

Tab. 32. HFO frequency selections ...............................42

Tab. 33. Keyboard interrupt assignments ......................42

Tab. 34. RTI Status/Control register (SRTISC)

(address $1808) .............................................. 43

Tab. 35. SRTISC register field descriptions .................. 43

Tab. 36. Real-time interrupt period ................................43

Tab. 37. System reset status register (SRS) (address

$1800) ............................................................. 44

Tab. 38. SRS register field descriptions ........................ 45

Tab. 39. System option register 1 (SIMOPT1)

(address $1802) .............................................. 46

Tab. 40. SIMOPT1 register field descriptions ................46

Tab. 41. System option register 2 (SIMOPT2)

(address $1803) .............................................. 47

Tab. 42. SIMOPT2 register field descriptions ................47

Tab. 43. System power management status and

control 1 register (SPMSC1) (address

$1809) ............................................................. 47

Tab. 44. SPMSC1 register field descriptions .................48

Tab. 45. System power management status and

control 2 register (SPMSC2) (address

$180A) ............................................................. 48

Tab. 46. SPMSC2 register field descriptions .................49

Tab. 47. System power management status and

control 3 register (SPMSC3) (address

$180C) .............................................................49

Tab. 48. SPMSC3 register field descriptions .................49

Tab. 49. PMCT register (address $180B) ......................50

Tab. 50. PMCT register field descriptions ..................... 50

Tab. 51. FRC_TIMER register, MSbyte and LSbyte

(address $1808 and $1809) ............................50

Tab. 52. SIM STOP exit status (SIMSES) (address

$180D) .............................................................51

Tab. 53. SIMSES register field descriptions .................. 52

Tab. 54. Truth table for pullup and pulldown resistors ... 53

Tab. 55. Port A data register (PTAD) (address $0000) .. 55

Tab. 56. Port A data register field descriptions ..............55

Tab. 57. Internal pullup enable for port A register

(PTAPE) (address $0001) ...............................55

Tab. 58. Port A register pullup enable field

descriptions ..................................................... 56

Tab. 59. Data direction for port A register (PTADD)

(address $0003) .............................................. 56

Tab. 60. Port A data direction field descriptions ............ 56

Tab. 61. Port B data register (PTBD) (address $0004) .. 56

Tab. 62. Port B data register field descriptions ..............57

Tab. 63. Internal pullup enable for port B register

(PTBPE) (address $0005) ...............................57

Tab. 64. Port B register pullup enable field

descriptions ..................................................... 57

Tab. 65. Data direction for port B register (PTBDD)

(address $0007) .............................................. 57

Tab. 66. Port B data direction field descriptions ............ 57

Tab. 67. Signal properties ............................................. 59

Tab. 68. KBI status and control register (address

$000C) .............................................................59

Tab. 69. KBISC register field descriptions .....................60

Tab. 70. KBI pin enable register (address $000D) ........ 60

Tab. 71. KBIPE register field descriptions ..................... 60

Tab. 72. KBI edge select register (address $000E) .......60

Tab. 73. KBIES register field descriptions ..................... 61

Tab. 74. CCR register field descriptions ........................65

Tab. 75. HCS08 instruction set summary ......................72

Tab. 76. Opcode map (Sheet 1 of 2) ............................ 82

Tab. 77. Opcode map (Sheet 2 of 2) ............................ 83

Tab. 78. TPM1 clock source selection .......................... 85

Tab. 79. Timer status and control register (TPM1SC)

(address $0010) .............................................. 87

Tab. 80. TPM1SC register field descriptions ................. 87

Tab. 81. Prescale divisor selection ................................88

Tab. 82. Timer counter register high (TPM1CNTH)

(address $0011) .............................................. 88

Tab. 83. Timer counter register low (TPM1CNTL)

(address $0012) .............................................. 88

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

177 / 182

Tab. 84. Timer counter modulo register high

(TPM1MODH) (address $0013) ...................... 89

Tab. 85. Timer counter modulo register low

(TPM1MODL) (address $0014) .......................89

Tab. 86. Timer channel 0 status and control register

(TPM1C0SC) (address $0015) ........................89

Tab. 87. TPM1C0SC register field descriptions .............90

Tab. 88. Mode, edge, and level selection ......................90

Tab. 89. Timer channel 0 value register high

(TPM1C0VH) (address $0016) ........................91

Tab. 90. Timer channel 0 value register low

(TPM1C0VL) (address $0017) ........................ 91

Tab. 91. Timer channel 1 status and control register

(TPM1C1SC) (address $0018) ........................91

Tab. 92. TPM1C1SC register field descriptions .............92

Tab. 93. Mode, edge, and level selection ......................92

Tab. 94. Timer channel 1 value register high

(TPM1C1VH) (address $0019) ........................93

Tab. 95. Timer channel 1 value register low

(TPM1C1VL) (address $001A) ........................93

Tab. 96. ADC10 channel assignments .......................... 99

Tab. 97. PWU divider register (PWUDIV) (address

$0038) ........................................................... 108

Tab. 98. PWUDIV register field descriptions ............... 108

Tab. 99. PWU Control/Status register 0 (PWUCS0)

(address $0039) ............................................ 109

Tab. 100. PWUSC0 register field descriptions .............. 109

Tab. 101. Limitations on clearing WUT/PRST ............... 109

Tab. 102. PWU Control/Status register 1 (PWUCS1)

(address $003A) ............................................110

Tab. 103. PWUSC1 register field descriptions .............. 110

Tab. 104. PWU wakeup status register (PWUS)

(address $001F) ............................................110

Tab. 105. PWUS register field descriptions ...................111

Tab. 106. LFR control register 1 (LFCTL1) (address

$0020) ........................................................... 122

Tab. 107. LFCTL1 register field descriptions .................122

Tab. 108. LFR control register 2 (LFCTL2) (address

$0021) ........................................................... 123

Tab. 109. LFCTL2 register field descriptions .................123

Tab. 110. LFR control register 3 (LFCTL3) (address

($0022) .......................................................... 124

Tab. 111. LFCTL3 register field descriptions .................125

Tab. 112. LFR control register 4 (LFCTL4) (address

$0023) ........................................................... 126

Tab. 113. LFCTL4 register field descriptions .................126

Tab. 114. LFR status register (LFS, LPAGE = 0)

(address $0024) ............................................ 127

Tab. 115. LFS register field descriptions .......................127

Tab. 116. LFR data register (LFDATA) when LPAGE =

0 (address $0025) .........................................128

Tab. 117. LFDATA register field descriptions ................ 129

Tab. 118. LFR ID low byte (LFIDL) (address $0026) .....129

Tab. 119. LFR ID high byte (LFIDH) (address $0027) ... 129

Tab. 120. LFR ID register field description ....................129

Tab. 121. LF control E (LFCTRLE) (address $0021) .....129

Tab. 122. LFCTRLE register field description ............... 130

Tab. 123. LFR control register D (LFCTRLD, LPAGE =

1) (address $0022) ........................................130

Tab. 124. LFCTRLD register field descriptions ..............130

Tab. 125. LFR control register C (LFCTRLC, LPAGE =

1) (address $0023) ........................................131

Tab. 126. LFCTRLC register field descriptions ..............131

Tab. 127. LFR control register B (LFCTRLB, LPAGE =

1) (address $0024) ........................................132

Tab. 128. LFCTRLB register field descriptions ..............132

Tab. 129. LFR control register A (LFCTRLA, LPAGE =

1) (address $0025) ........................................132

Tab. 130. LFCTRLA register field descriptions ..............133

Tab. 131. Randomization interval times ........................ 139

Tab. 132. Frame number interval times ........................ 139

Tab. 133. RFM control register 0 (RFCR0) (address

$0030) ........................................................... 145

Tab. 134. RFCR0 field descriptions .............................. 145

Tab. 135. Data rate option examples ............................ 145

Tab. 136. RFM control register 1 (RFCR1) (address

$0031) ........................................................... 146

Tab. 137. RFCR1 field descriptions .............................. 146

Tab. 138. RFM control register 2 (RFCR2) (address

$0032) ........................................................... 146

Tab. 139. RFCR2 field descriptions .............................. 146

Tab. 140. RFM control register 3 (RFCR3) (address

$0033) ........................................................... 148

Tab. 141. RFCR3 field descriptions .............................. 148

Tab. 142. RFCR4 register — base time variable

(address $0034) ............................................ 149

Tab. 143. RFCR4 field descriptions .............................. 149

Tab. 144. RFCR5 register — pseudo-random time

variable (address $0035) .............................. 149

Tab. 145. RFCR5 field descriptions .............................. 150

Tab. 146. RFCR6 register — frame number time —

RFTS[1:0] = 1:0 (address $0036) ..................150

Tab. 147. RFCR6 field descriptions .............................. 150

Tab. 148. RFM transmit control registers (RFCR7)

(address $0037) ............................................ 150

Tab. 149. RFCR7 field descriptions .............................. 151

Tab. 150. PLL control registers A (PLLCR[1:0],

RPAGE = 0) (address ($0038) ...................... 152

Tab. 151. PLL control registers A (PLLCR[1:0],

RPAGE = 0) (address ($0039) ...................... 152

Tab. 152. PLLCR[1:0] field descriptions ........................ 152

Tab. 153. PLL control registers B (PLLCR[3:2],

RPAGE = 0) (address $003A) .......................153

Tab. 154. PLL control registers B (PLLCR[3:2],

RPAGE = 0) (address $003B) .......................153

Tab. 155. PLLCR[3:2] field descriptions ........................ 153

Tab. 156. RFM EPR registers (EPR, RPAGE = 1,

VCD_EN = 0) (address $0038) ..................... 154

Tab. 157. RFM EPR registers (EPR, RPAGE = 1,

VCD_EN = 1) (address $0038) ..................... 154

Tab. 158. EPR field descriptions ................................... 154

Tab. 159. RF data registers (RFD[31:0]) .......................155

Tab. 160. RFD[31:0] field descriptions .......................... 155

Tab. 161. FXTH87Ex02 single Z-axis firmware

summary and jump routines ..........................157

Tab. 162. FXTH87Ex1x dual XZ-axis firmware

summary and jump routines ..........................159

Tab. 163. Device ID coding summary ........................... 160

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

178 / 182

Tab. 164. Device ID coding descriptions .......................161

Tab. 165. BDC command summary .............................. 167

Tab. 166. BDC status and control register (BDCSCR) ...170

Tab. 167. BDCSCR register field descriptions ...............170

Tab. 168. System background debug force reset

Tab. 169. SBDFR register field description ................... 172

Tab. 170. Revision history .............................................174

Figures

Fig. 1. FXTH87E overall block diagram ....................... 4

Fig. 2. Clock distribution ...............................................5

Fig. 3. FXTH87E QFN package pinout ........................ 6

Fig. 4. FXTH87E QFN optional Z-axis

accelerometer orientation ..................................6

Fig. 5. FXTH87E example application ..........................8

Fig. 6. Recommended power supply connections ........9

Fig. 7. RESET pin timing ............................................11

Fig. 8. FXTH87E MCU memory map ......................... 17

Fig. 9. FLASH program and erase flowchart .............. 26

Fig. 10. FLASH burst program flowchart ...................... 27

Fig. 11. Block Protection Mechanism ........................... 28

Fig. 12. Interrupt stack frame ....................................... 39

Fig. 13. General purpose I/O block diagram ................ 53

Fig. 14. General purpose I/O logic ............................... 53

Fig. 15. KBI block diagram ...........................................59

Fig. 16. CPU registers ..................................................63

Fig. 17. Condition code register ................................... 65

Fig. 18. TPM1 block diagram ....................................... 86

Fig. 19. PWM period and pulse width (ELSnA = 0) ...... 96

Fig. 20. CPWM period and pulse width (ELSnA = 0) ....97

Fig. 21. Battery check circuit ...................................... 102

Fig. 22. Data flow for measurements ......................... 104

Fig. 23. Temperature restart response .......................105

Fig. 24. Flowchart for using TR module ..................... 106

Fig. 25. Wakeup timer block diagram .........................107

Fig. 26. Block diagram ............................................... 113

Fig. 27. FXTH87E LFR state machine diagram ..........116

Fig. 28. Manchester encoded datagram for LFPOL =

0 .................................................................... 118

Fig. 29. Manchester encoded datagram for LFPOL =

1 .................................................................... 118

Fig. 30. Definition of duty-cycle of 40% ......................118

Fig. 31. Impact of duty-cycle on SYNC pattern .......... 119

Fig. 32. Antenna Q-factor equivalent model for the

LF envelope .................................................. 119

Fig. 33. LF envelope filtering ......................................119

Fig. 34. SYNC patterns .............................................. 120

Fig. 35. Telegram format (carrier preamble) ...............121

Fig. 36. LF detector sampling timing .......................... 124

Fig. 37. RF transmitter block diagram ........................ 134

Fig. 38. Data frame formats ....................................... 136

Fig. 39. Datagram overview ....................................... 137

Fig. 40. Initial and interframe timing ........................... 137

Fig. 41. LFSR implementation ....................................139

Fig. 42. Manchester data bit encoding (POL = 0) .......141

Fig. 43. Manchester data bit encoding (POL = 1) .......142

Fig. 44. Bi-Phase data bit encoding (POL = 0) ...........142

Fig. 45. Bi-Phase data bit encoding (POL = 1) ...........143

Fig. 46. RF power domains ........................................148

Fig. 47. VCO calibration state machine ......................156

Fig. 48. Measurement signal range definitions ...........162

Fig. 49. BDM tool connector ...................................... 164

Fig. 50. BDC host-to-target serial bit timing ............... 165

Fig. 51. BDC target-to-host serial bit timing (Logic 1) ..166

Fig. 52. BDM target-to-host serial bit timing (Logic 0) ..166

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

179 / 182

Contents

1 About this document .......................................... 1

1.1 Purpose ..............................................................1

1.2 Audience ............................................................ 1

1.3 Related documentation ......................................1

2 Product profile .................................................... 1

2.1 General description ............................................1

2.2 Features and benefits ........................................1

2.3 Configuration options .........................................2

2.4 Part number definition ....................................... 3

2.5 Part marking definition .......................................3

3 General Information ............................................ 4

3.1 Overall block diagram ........................................4

3.2 Multi-chip interface .............................................5

3.3 System clock distribution ................................... 5

3.4 Reference documents ........................................6

4 Pinning information ............................................ 6

4.1 Pinning ...............................................................6

4.2 Pin description ................................................... 7

4.3 Recommended application ................................ 7

4.4 Signal properties ................................................8

4.4.1 VDD and VSS pins ............................................8

4.4.2 AVDD and AVSS pins ....................................... 8

4.4.3 VREG pin ...........................................................9

4.4.4 RVSS pin ........................................................... 9

4.4.5 RF pin ................................................................9

4.4.6 XO, XI pins ........................................................ 9

4.4.7 LF[A:B] pins ....................................................... 9

4.4.8 PTA[1:0] pins ................................................... 10

4.4.9 PTA[3:2] pins ................................................... 10

4.4.10 BKGD/PTA4 pin ...............................................10

4.4.11 RESET pin .......................................................10

4.4.12 PTB[1:0] pins ................................................... 11

5 Modes of operation ...........................................11

5.1 Features ...........................................................11

5.2 RUN mode .......................................................11

5.3 WAIT mode ......................................................11

5.4 ACTIVE BACKGROUND mode ....................... 11

5.5 STOP Modes ................................................... 12

5.5.1 STOP1 Mode ...................................................12

5.5.2 STOP4 LVD enabled in STOP mode ...............13

5.5.3 Active BDM enabled in STOP mode ................14

5.5.4 MCU on-chip peripheral modules in STOP

modes .............................................................. 14

5.5.4.1 I/O pins ............................................................ 14

5.5.4.2 Memory ............................................................ 14

5.5.4.3 Parameter registers ......................................... 15

5.5.4.4 LFO .................................................................. 15

5.5.4.5 FRC ..................................................................15

5.5.4.6 MFO ................................................................. 15

5.5.4.7 HFO ................................................................. 15

5.5.4.8 PWU .................................................................15

5.5.4.9 ADC10 ............................................................. 15

5.5.4.10 LFR .................................................................. 15

5.5.4.11 Band gap reference .........................................15

5.5.4.12 TPM1 ............................................................... 15

5.5.4.13 Voltage regulator ............................................. 15

5.5.4.14 Temperature sensor ........................................ 16

5.5.4.15 Temperature restart .........................................16

5.5.5 RFM module in STOP modes ......................... 16

5.5.5.1 RF output .........................................................16

5.5.6 P-cell in STOP modes .....................................16

5.5.7 Optional g-cell in STOP modes ....................... 16

6 Memory ...............................................................16

6.1 MCU memory map .......................................... 16

6.2 Reset and interrupt vectors ............................. 17

6.3 MCU register addresses and bit

assignments .....................................................18

6.4 High address registers .....................................22

6.5 MCU parameter registers ................................ 23

6.6 MCU RAM ....................................................... 23

6.7 FLASH ............................................................. 24

6.7.1 Features ...........................................................24

6.7.2 Program and erase times ................................ 24

6.7.3 Program and erase command execution ......... 25

6.7.4 Burst program execution ................................. 25

6.7.5 Access errors ...................................................27

6.7.6 FLASH block protection ...................................28

6.7.7 Vector redirection .............................................29

6.8 Security ............................................................ 29

6.9 FLASH registers and control bits .....................30

6.9.1 FLASH clock divider register (FCDIV) ............. 31

6.9.2 FLASH options register (FOPT and NVOPT) ... 32

6.9.3 FLASH configuration register (FCNFG) ........... 33

6.9.4 FLASH protection register (FPROT and

NVPROT) .........................................................33

6.9.5 FLASH status register (FSTAT) .......................34

6.9.6 FLASH command register (FCMD) ..................35

7 Reset, interrupts and system configuration ....35

7.1 Features ...........................................................35

7.2 MCU reset ....................................................... 35

7.3 Computer Operating Properly (COP)

Watchdog .........................................................36

7.4 SIM test register (SIMTST) ..............................37

7.5 Interrupts ..........................................................38

7.5.1 Interrupt stack frame ........................................39

7.5.2 Vector summary .............................................. 39

7.6 Low-Voltage Detect (LVD) System .................. 41

7.6.1 Power-on reset operation ................................ 41

7.6.2 LVD reset operation ........................................ 41

7.6.3 LVD interrupt operation ................................... 42

7.6.4 Low-Voltage Warning (LVW) ........................... 42

7.7 System clock control ........................................42

7.8 Keyboard interrupts ......................................... 42

7.9 Real-time interrupt ........................................... 42

7.10 Temperature sensor and restart system .......... 44

7.11 Reset, interrupt and system control registers

and bits ............................................................44

7.11.1 System Reset Status Register (SRS) .............. 44

7.11.2 System Options Register 1 (SIMOPT1) ........... 46

7.11.3 System Operation Register 2 (SIMOPT2) ........47

7.11.4 System Power Management Status and

Control 1 Register (SPMSC1) ......................... 47

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

180 / 182

7.11.5 System Power Management Status and

Control 2 Register (SPMSC2) ......................... 48

7.11.6 System Power Management Status and

Control 3 Register (SPMSC3) ......................... 49

7.11.7 Free-Running Counter (FRC) .......................... 50

7.11.7.1 Software handler requirements ........................51

7.11.7.2 Initialization recommendations .........................51

7.12 System STOP exit status register (SIMSES) ....51

8 General Purpose I/O ......................................... 52

8.1 Unused pin configuration .................................54

8.2 Pin behavior in STOP modes .......................... 55

8.3 General purpose I/O registers ......................... 55

8.4 Port A registers ................................................55

8.5 Port B registers ................................................56

9 Keyboard Interrupt ............................................58

9.1 Features ...........................................................58

9.2 Modes of operation ..........................................58

9.2.1 KBI in STOP modes ........................................ 58

9.2.2 KBI in ACTIVE BACKGROUND mode .............58

9.3 Block diagram ..................................................58

9.4 External signal description ...............................59

9.5 Register definitions .......................................... 59

9.5.1 KBI status and control register (KBISC) ...........59

9.5.2 KBI pin enable register (KBIPE) ...................... 60

9.5.3 KBI edge select register (KBIES) .................... 60

9.6 Functional description ......................................61

9.6.1 Edge only sensitivity ........................................61

9.6.2 Edge and level sensitivity ................................ 61

9.6.3 KBI pullup/pulldown resistors ...........................61

9.6.4 KBI initialization ............................................... 62

10 Central processing unit ....................................62

10.1 Introduction ...................................................... 62

10.2 Features ...........................................................62

10.3 Programmer’s model and CPU registers ......... 63

10.3.1 Accumulator (A) ...............................................63

10.3.2 Index register (H:X) ......................................... 63

10.3.3 Stack pointer (SP) ........................................... 64

10.3.4 Program counter (PC) ..................................... 64

10.3.5 Condition code register (CCR) ........................ 64

10.4 Addressing modes ........................................... 66

10.4.1 Inherent addressing mode (INH) ..................... 66

10.4.2 Relative addressing mode (REL) .....................66

10.4.3 Immediate addressing mode (IMM) ................. 66

10.4.4 Direct addressing mode (DIR) ......................... 66

10.4.5 Extended addressing mode (EXT) ...................67

10.4.6 Indexed addressing mode ............................... 67

10.4.6.1 Indexed, No Offset (IX) ....................................67

10.4.6.2 Indexed, No Offset with Post Increment (IX+) ...67

10.4.6.3 Indexed, 8-Bit Offset (IX1) ...............................67

10.4.6.4 Indexed, 8-Bit Offset with Post Increment

(IX1+) ............................................................... 67

10.4.6.5 Indexed, 16-Bit Offset (IX2) ............................. 67

10.4.6.6 SP-Relative, 8-Bit Offset (SP1) ........................67

10.4.6.7 SP-Relative, 16-Bit Offset (SP2) ......................67

10.5 Special operations ........................................... 68

10.5.1 Reset sequence ...............................................68

10.5.2 Interrupt sequence ...........................................68

10.5.3 WAIT mode operation ......................................69

10.5.4 STOP mode operation .....................................69

10.5.5 BGND instruction .............................................69

10.6 HCS08 instruction set summary ...................... 70

10.6.1 Instruction set summary nomenclature ............ 70

10.6.2 Operators ......................................................... 70

10.6.3 CPU registers .................................................. 70

10.6.4 Memory and addressing .................................. 70

10.6.5 Condition code register (CCR) bits ..................70

10.6.6 CCR activity notation ....................................... 71

10.6.7 Machine coding notation ..................................71

10.6.8 Source form ..................................................... 71

10.6.9 Address modes ................................................72

11 Timer Pulse-Width Module ............................... 84

11.1 Features ...........................................................85

11.2 TPM1 configuration information .......................85

11.2.1 Block diagram ..................................................85

11.3 External signal description ...............................86

11.4 Register definition ............................................ 87

11.4.1 Timer status and control register (TPM1SC) ....87

11.4.2 Timer counter registers

(TPM1CNTH:TPM1CNTL) ............................... 88

11.4.3 Timer counter modulo registers

(TPM1MODH:TPM1MODL) ............................. 89

11.4.4 Timer channel 0 status and control register

(TPM1C0SC) ................................................... 89

11.4.5 Timer channel value registers

(TPM1C0VH:TPM1C0VL) ................................ 91

11.4.6 Timer channel 1 status and control register

(TPM1C1SC) ................................................... 91

11.4.7 Timer channel value registers

(TPM1C1VH:TPM1C1VL) ................................ 93

11.5 Functional description ......................................93

11.5.1 Counter ............................................................ 94

11.5.2 Channel mode selection .................................. 95

11.5.2.1 Input capture mode ......................................... 95

11.5.2.2 Output compare mode .....................................95

11.5.2.3 Edge-aligned PWM mode ................................95

11.5.3 Center-aligned PWM mode ............................. 96

11.6 TPM1 interrupts ............................................... 97

11.6.1 Clearing timer interrupt flags ........................... 98

11.6.2 Timer overflow interrupt description .................98

11.6.3 Channel event interrupt description ................. 98

11.6.4 PWM end-of-duty-cycle events ........................98

12 Other MCU resources ....................................... 99

12.1 Pressure measurement ................................. 100

12.2 Temperature measurements ..........................100

12.3 Voltage measurements ..................................100

12.3.1 Internal band gap .......................................... 101

12.3.2 External voltages ........................................... 101

12.4 Optional acceleration measurements ............ 101

12.5 Optional battery condition check ....................102

12.6 Measurement firmware .................................. 103

12.7 Thermal shutdown ......................................... 104

12.7.1 Low temperature shutdown ........................... 104

12.7.2 High temperature shutdown ...........................104

12.7.3 Temperature shutdown recovery ................... 105

12.8 Free-Running Counter (FRC) ........................ 106

13 Periodic Wakeup Timer .................................. 107

13.1 Block diagram ................................................107

13.2 Wakeup divider register — PWUDIV ............. 108

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Reference manual Rev. 4.0 — 29 November 2018

181 / 182

13.3 PWU control/status register 0 — PWUCS0

(address $0039) ............................................ 108

13.4 PWU control/status register 1 — PWUCS1 ....110

13.5 PWU wakeup status register — PWUS ......... 110

13.6 Functional modes .......................................... 111

13.6.1 RUN mode .....................................................111

13.6.2 STOP4 mode .................................................111

13.6.3 STOP1 mode .................................................111

13.6.4 Active BDM/foreground commands ............... 112

14 LF Receiver ......................................................112

14.1 Features .........................................................113

14.2 Modes of operation ........................................114

14.3 Power management .......................................114

14.4 Input amplifier ................................................ 114

14.5 LFR data mode states ................................... 115

14.6 Carrier detect .................................................115

14.7 Auto-zero sequence .......................................117

14.8 Data recovery ................................................ 117

14.9 Data clock recovery and synchronization .......117

14.10 Manchester decode ....................................... 118

14.11 Duty-cycle for data mode .............................. 118

14.12 Input signal envelope .....................................119

14.13 Telegram verification ..................................... 120

14.14 Error detection and handling ......................... 121

14.15 Continuous ON mode .................................... 121

14.16 Initialization information ................................. 121

14.17 LFR register definition ................................... 122

14.17.1 LF control register 1 (LFCTL1) ...................... 122

14.17.2 LF control register 2 (LFCTL2) ...................... 123

14.17.3 LF control register 3 (LFCTL3) ...................... 124

14.17.4 LFR control register 4 (LFCTL4) ....................126

14.17.5 LFR status register (LFS, LPAGE = 0) .......... 127

14.17.6 LFR data register (LFDATA, LPAGE = 0) ...... 128

14.17.7 LFR ID registers (LFIDH:LFIDL, LPAGE = 0) ..129

14.17.7.1 LF Control E — LFCTRLE .............................129

14.17.8 LFR control register D (LFCTRLD, LPAGE =

1) ....................................................................130

14.17.9 LFR control register C (LFCTRLC, LPAGE =

1) ....................................................................131

14.17.10 LFR control register B (LFCTRLB, LPAGE =

1) ....................................................................132

14.17.11 LFR control register A (LFCTRLA, LPAGE =

1) ....................................................................132

15 RF module ....................................................... 133

15.1 RF data modes ..............................................134

15.1.1 RF data buffer mode ..................................... 134

15.1.2 MCU direct mode .......................................... 135

15.2 RF output buffer data frame .......................... 135

15.2.1 Data buffer length ..........................................136

15.2.2 End of Message (EOM) .................................136

15.3 Transmission randomization .......................... 136

15.3.1 Initial time interval ..........................................137

15.3.2 Interframe time intervals ................................ 138

15.3.3 Base time interval ..........................................138

15.3.4 Pseudo-random time interval .........................138

15.3.5 Frame number time ....................................... 139

15.4 RFM in STOP1 mode .................................... 140

15.5 Data encoding ............................................... 140

15.5.1 Manchester encoding .................................... 140

15.5.2 Bi-Phase encoding .........................................140

15.5.3 NRZ encoding ................................................141

15.6 RF output stage .............................................143

15.6.1 Modulation method ........................................ 143

15.6.2 Carrier frequency ........................................... 143

15.6.3 RF power output ............................................143

15.6.4 Transmission error .........................................144

15.6.5 Supply voltage check during RF

transmission ...................................................144

15.6.6 RF Reset (RFMRST) ..................................... 144

15.7 RF interrupt ....................................................144

15.8 Datagram transmission times ........................ 144

15.9 RFM registers ................................................ 145

15.9.1 RFM Control Register 0 — RFCR0 ............... 145

15.10 RFM control register 1 — RFCR1 ................. 145

15.11 RFM control register 2 — RFCR2 ................. 146

15.11.1 Power working domains ................................ 147

15.11.1.1 PTYP ..............................................................147

15.11.1.2 PMIN .............................................................. 147

15.12 RFM control register 3 — RFCR3 ................. 148

15.13 RFM control register 4 — RFCR4 ................. 149

15.14 RFM control register 5 — RFCR5 ................. 149

15.15 RFM control register 6 — RFCR6 ................. 150

15.16 RFM control register 7 — RFCR7 ................. 150

15.17 PLL control registers A - PLLCR[1:0],

RPAGE = 0 ....................................................152

15.18 PLL control registers B - PLLCR[3:2],

RPAGE = 0 ....................................................153

15.19 EPR register — EPR (RPAGE = 1) ............... 154

15.20 RF DATA registers — RFD[31:0] ...................154

15.21 VCO calibration machine ...............................155

16 Firmware .......................................................... 156

16.1 Software jump table .......................................156

16.2 Function documentation ................................ 156

16.2.1 General rules ................................................. 157

16.2.1.1 FXTH87E single Z-axis firmware routines ......157

16.2.1.2 FXTH87E dual XZ-axis firmware routines ......158

16.2.2 Device identification .......................................160

16.2.3 Definition of signal ranges ............................. 161

16.3 Memory resource usage ................................163

16.3.1 Software stack ............................................... 163

17 Development support ..................................... 163

17.1 Introduction .................................................... 163

17.1.1 Features .........................................................163

17.2 Background debug controller (BDC) .............. 163

17.2.1 BKGD/PTA4 pin description .......................... 164

17.2.2 Communication details .................................. 165

17.2.3 BDC commands .............................................167

17.2.3.1 Coding structure nomenclature ......................167

17.2.4 BDC hardware breakpoint ............................. 169

17.3 Register definition .......................................... 169

17.3.1 BDC registers and control bits .......................169

17.3.2 BDC status and control register (BDCSCR) ... 170

17.3.3 BDC breakpoint match register (BDCBKPT) .. 171

17.3.4 System background debug force reset

18 Battery charge consumption modeling .........172

18.1 Standby current ............................................. 172

18.2 Measurement events ..................................... 172

NXP Semiconductors FXTH87E

FXTH87E, Family of Tire Pressure Monitor Sensors

Please be aware that important notices concerning this document and the product(s)

described herein, have been included in section 'Legal information'.

For more information, please visit: http://www.nxp.com

For sales office addresses, please send an email to: salesaddresses@nxp.com

Date of release: 29 November 2018

Document identifier: FXTH87ERM

18.3 Transmission events ......................................173

18.4 Total consumption ......................................... 173

19 Revision history .............................................. 174

20 Legal information ............................................ 175