I'm trying to talk to a 68HC(9)12D60 (Motorola/Freescale/NXP) via BDM protocol. This chip is a 112-pin TQFP. On the PCB, there is a 6-pin header (which is not the standard BDM 2*3 pins header). The 6 pins are on one row, 2.54mm pitch.
With an ohmmeter, I've managed to identify each of the 6-pins. One is unused, one reads 0 ohm with Vss and Vssx (so it's the ground), one reads 0 ohm with Vdd and Vddx (so it's the positive terminal), one reads 0 ohm with the RST pin, one reads 0 ohm with the VFP pin and one reads 0 ohm with the BKGD pin.
So I have easy access of the needed MCU pins.
Now I want to talk to the MCU using an Arduino (to read the memory). Plugging BKGD, RST and VFP directly to digital pins 2, 3 and 4 and plugging Vss to GND pin and Vdd to +5V.
I've tried the simplest command which is a SYNC. A SYNC allows the target to reveal its clock without requiring the host to know it beforehand. I drive the BKGD line low for a long time, then release the line. The MCU should wait a few cycles, assert the line down during 128 BCLK and high again.
I've also tried the READ_WORD hardware command.
No matter what I try, after I release the BKGD line, I only read ones on the BKGD pin. It seems the MCU doesn't answer on its BKGD pin.
Things I've tried:
- Put the MCU into Single Chip Special Mode (I've checked pins MODA and MODB read 0, and I put the BKGD pin to 0 before powering on the MCU). I've tried this in case my MCU had the BDM Lockout feature enabled.
- I've tried a lot of frequencies. The main oscillator on the PCB (EXTAL) seems to be 4Mhz. It's not very clear for me when I read the datasheet what is the value for BCLK (BDM Clock). I've tried values from 32Hz to 8Mhz with no success, because the datasheet says BCLK values range from ECLK/128 to ECLK ; ECLK itself ranges from 0.004Mhz to 8Mhz).
- My Arduino is 16Mhz. Maybe the "frequency gradient" between the host and the target is to small? So I've also tried to talk to the MCU using the Raspberry Pi 1B CPU (700Mhz) which should be fast enough to sample at the correct timing. With the Raspberry Pi, it was only with 3V, but 3V is also within the operating range of the chip.
- At first I didn't connect the VFP pin to anything. But then I noticed VFP should be within VDD-0.35V to VDD+0.5V. Without connecting the VFP pin, it read VDD-0.5V, which was outside the range. So I also tried to connect VFP to a high 5V output pin on the Arduino.
No matter what I do, after I drive the BKGD line and change it to an input, the line always read 1. :( What am I doing wrong?
https://www.nxp.com/docs/en/data-sheet/MC68HC912D60.pdf
https://www.nxp.com/files/training_pdf/27642_HCS08_BDM_ICE_WBT.pdf
http://codecard.eu/files/Manuals/MCU/CARPROG%20Motorola%20HC12%20programmer%20manual.pdf
http://www.microcontroller-cafe.com.ua/products/doc/e912prog.pdf