Programming CYBLE_013025 Module using HCI Commands - KBA229136

Version 2

    Author: AnjanaM_61       Version: **

     

    Translation - Japanese: HCIコマンドを使ったCYBLE_013025モジュールのプログラミング - KBA229136 - Community Translated (JA)

    Question:
    How can I program CYBLE_013025 BLE module (based on WICED SMART SDK) using HCI commands from an external host?

    Answer:

    As a pre-requisite, see the other programming options for CYBLE_01325 module here:

     

    CYBLE_013025 contains onboard serial flash memory. Follow these steps to program to CYBLE_013025 flash:

    Note: All byte sequences are shown in hexadecimal. If you do not receive any expected response, it is assumed that the download has failed.

     

    1. Recover

    Put the CYBLE_013025 module in recovery mode: Pull SDA to GND while resetting, and then release the signal.

     

    2. Initialize

    Once the serial connection is established, the host issues an HCI_RESET command and expects a proper response from the device.

    Host TX:
    01 03 0C 00

    Expected Response (within 100ms):

    04 0E 04 01 03 0C 00
    If successful, the host issues a DOWNLOAD_MINIDRIVER command.

    Host TX:

    01 2E FC 00

    Expected Response (within 100 ms):

    04 0E 04 01 2E FC 00

     

    3. Load the Minidriver

    Now the host starts sending the WRITE_RAM command to the device, passing N bytes of minidriver code at a time (where N ≤ 251 bytes).

    For the CYBLE_013025 module, Minidriver file is available here.

    Download CYBLE 013025.zip, extract the files, and open Platforms\CYBLE_013025_EVAL\uart_DISABLE_EEPROM_WP_PIN1.hex.

    Host TX:

    01 4C FC nn xx xx xx xx yy yy yy yy yy yy …
    Where,

    • xx xx xx xx bytes are the 32-bit destination device RAM absolute address, in little-endian order
    • yy yy yy … are the N payload bytes to be loaded into the device RAM
    • nn = 4+N (message size is the first four bytes for the address plus the payload size) 

    Expected Response (within 100 ms):
    04 0E 04 01 4C FC 00

    If all minidriver code bytes are successfully transferred, the host issues the LAUNCH_MINIDRIVER command at the first address of the minidriver code.

    Host TX:
    01 4E FC 04 xx xx xx xx

    Where,

    • xx xx xx xx are the 32-bit device RAM address (little-endian) where the minidriver must start executing.

    Expected Response (within 100 ms):

    04 0E 04 01 4E FC 00

    For reference, you can see the logs in the build folder of SDK of a previously downloaded project (for instance, C:\Users\...\Documents\WICED\WICED-Smart-SDK-2.2.3\WICED-Smart-SDK\build\find_me-CYBLE_013025_EVAL-rom-ram-Wiced-release\download.txt), or you can use chiplaod tool and see the download logs flow (Downloading into the CYBLE-013025-00 module – KBA222505).

     

    4. Erase

    At this point, the host is talking to the minidriver, and the first command that is issued is CHIP_ERASE to the first address of NVRAM. By the firmware convention, EEPROM and serial flash are assumed to start at address FF000000.

    Host TX:
    01 CE FF 04 00 00 00 FF

    Once the CHIP_ERASE command is issued, the host will need to wait for several seconds until the memory is erased.

    During this wait time, the device will keep sending periodic (about once a second) progress report messages made up of bytes FF 01 CE. This message is an indication that the erase process in progress.

    Once the erase is completed successfully, the device will send bytes:

    0E 04 01 CE FF 00

     

    5. Load the Firmware and Configuration Data
    This is the actual firmware update phase. The host will again write the WRITE_RAM records with bytes that comprise the new firmware or configuration data. Since the  destination is NVRAM, the destination addresses in these WRITE_RAM commands will be FF000000 and above.

    Use the hex file generated by the WICED SMART SDK for specific application. For the CYBLE_013025 module, to download to flash, use the address starting from 0xFF000000.

    Host TX:
        01 4C FC nn xx xx xx xx yy yy yy yy yy yy …

    Where,

    • xx xx xx xx bytes are the 32-bit destination device RAM absolute address, in little-endian order.
    • yy yy yy … are the N payload bytes to be loaded into the device RAM.
    • Nn = 4+N (message size is the first four bytes for the address plus the payload size).
      • For SFlash, N ≤ 251 bytes
      • For EEPROM, N ≤ 64 bytes

    Expected Response (within 200 ms):

    04 0E 04 01 4C FC 00

    If the firmware supports CRC32 verification, then after each completed contiguous block of loaded bytes, the host may issue a READ_CRC command to the firmware, and compare the returned CRC32 value with the value computed by the host code. Cyclic redundancy check (CRC) reading is done in the following way:

    Host TX:

    01 CC FC 08 xx xx xx xx yy yy yy yy

    Where,

    • xx xx xx xx bytes are the starting 32-bit device address, in little-endian order, of the memory range over which the CRC is to be computed.
    • yy yy yy yy is the length (little-endian) of that memory range.

    Expected Response (within 200 ms):

    04 0E 08 01 CC FC 00 zz zz zz zz

    Where,

    • zz zz zz zz bytes are CRC32 value (little-endian) computed by the firmware.

    The CRC32 computation is one of the standard computations (see http://en.wikipedia.org/wiki/Cyclic_redundancy_check with starting value 0xEDB88320).

     

    6. Verify the New Contents

    The verification phase is optional, but strongly recommended, if the CRC checking was not done during the download phase. Here, the host issues READ_RAM commands to the device, and compares the data from the device with the written value to make sure no corruption occurred during the writing phase.

    Host TX:

    01 4D FC 05 xx xx xx xx nn

    Where,

    • xx xx xx xx bytes are the 32-bit device RAM read address, in little-endian order
    • nn = N, is the number of bytes to read.

    Expected Response (within 200 ms):

    04 0E nn 01 4D FC 00 yy yy yy …

    Where,

    yy yy yy … are the N bytes that have been read, and nn=4+N

     

    7. After the host has written and validated all application and configuration data to RAM, it sends a LAUNCH_RAM command with the special destination address specifying reboot for the device. An example LAUNCH_RAM command is shown here:

    01 4E FC 04 xx xx xx xx

    Where,

    • xx xx xx xx bytes represent the destination address for the CPU branch. For CYBLE_013025 module, its 0x00000000.

    Expected Response (within 200 ms):

    04 0E 04 01 4E FC 00