Sensor Boot Loader

Before starting the sensor program, a boot loader is activated allowing to update the sensor firmware over the serial line. The boot loader sends (in 9-bit mode as usual) an asterisk (*) with bit 9 set. It waits 17 ms for data from the host before it activates the main program. This has to begin just after the vector table (i.e. at address 0x0013)

17 ms may seem pretty short for this but the display has nothing else to do but wait for it so the time is more than enough!

Former versions of the boot loader were written for the AT90S2313 and jumped to 0x000b. In the current version this is no problem since all vectors above 0x000b point to 0x0013 but if future versions especially use the pin-change-interrupt the old boot loader will not work. Please consider this if you still use the old boot loader!

If the host wants to update the firmware it responds with a sharp (#) with bit 9 set. Any other responses cause the boot loader to terminate and activate the main program.

If the boot loader is activated, it will raise the timeout to 1.1 s. Under no circumstances, more than 1.1 s may pass else the boot loader will terminate.

In the following tables, bit 9 is marked by color. A set bit 9 is shown yellow, a cleared bit 9 is shown green.

The display is sending data in the following format:

The exclamation mark is the write command. The address is counted in bytes and has to be on a page boundary. Only one page can be written at once and at a whole.

The sensor writes the page and answers with + on success or - on error. A 0x00 follows to keep a uniform end-of-telegram. If you try to modify a page in the boot loader area the sensor will answer with P which stands for protected. The page will not be programmed then.

The answer of the sensor is reflected by the flags BOOTLDOK, BOOTLDERROR and BOOTLDPROTECTED in the display firmware. BOOTLDPROTECTED is ignored since the sensor.hex-file will also contain the boot loader.

During the page write the CPU is halted. The host therefore should not send any data until it receives the result.

The display can also read out the firmware of the sensor if it sends this telegram:

The address is in bytes, as usual, but in does not need to be a page boundary.

The sensor answers with this telegam:

Note that during the whole procedure the boot loader will never wait more than 1.1 s for a character. On timeout or telegram error the boot loader will terminate and execute the main program (or what has been written so far).

The boot loader cannot modify itself and will ignore write requests in its address range. This applies also to some subroutines like send and receive over the serial line! They have been transferred to the boot loader since they are considered well-tested and error-free. If page 0 is written, the reset vector is directed to the boot loader even if you specify a different address. The only way to modify the boot loader would be downloading an appropriate application.

In the system, this works really simple for the user. Just send the command update. The display will answer Waiting for Intel HEX file. Send the sensor.hex-File now and the rest will be done automatically.

The file must not contain lines starting with anything but a colon (not even empty lines) else the procedure will fail. AVR-studio creates this file perfectly and you can directly use it.

Do not use the boot loader if you experience communication problems with the sensor, fix this first. Although the boot loader cannot modify itself and therefore you will not end up with a dead sensor, it may be rendered useless if communication problems prevent you from programming it correctly.

This procedure somehow reminds me of that of a space probe that cannot be reached after launch. You cannot just fly there, open the gas cap and refuel ... or insert a new EPROM. But this was also the target here, you will not have to climb into the cistern having snow and rain around but you can do anything comfortably from your living room couch, if you only know what you are doing.

If you don't, you should have kept a copy of the sensor device, you can test the update and send it just down into the cistern if it really works...