Texas Instruments Serial Programming Adapter MSP430 User manual

1
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
User's Guide
SLAU550M–January 2014–Revised February 2018
MSP430™ FRAM Devices Bootloader (BSL)
The bootloader (BSL) on MSP430™ microcontrollers (MCUs) lets users communicate with embedded
memory in the MSP430 MCU during the prototyping phase, final production, and in service. Both the
programmable memory (FRAM memory) and the data memory (RAM) can be modified as required.
Do not confuse the bootloader with programs found in some digital signal processors (DSPs) that
automatically load program code (and data) from external memory to the internal memory of the DSP.
These programs are often referred to as bootloaders as well.
Contents
1 Introduction ................................................................................................................... 2
1.1 BSL Limitations ..................................................................................................... 2
1.2 Other Useful Documentation ...................................................................................... 2
2 Overview of BSL Features.................................................................................................. 4
3 BSL Architecture............................................................................................................. 5
3.1 Communication Interface .......................................................................................... 5
3.2 BSL Memory......................................................................................................... 5
3.3 BSL Invocation...................................................................................................... 6
3.4 BSL Time-out Feature.............................................................................................. 8
3.5 BSL Version Number............................................................................................... 8
4 BSL Protocol ................................................................................................................. 9
4.1 BSL Data Packet.................................................................................................... 9
4.2 BSL Security ....................................................................................................... 23
5 Common BSL Use Cases................................................................................................. 24
5.1 Overview and Flow Chart ........................................................................................ 24
5.2 Establishing a Connection ....................................................................................... 25
5.3 Erasing the Device................................................................................................ 25
5.4 Downloading the Application..................................................................................... 25
5.5 Verifying the Application.......................................................................................... 25
5.6 Executing the Application ........................................................................................ 26
6 Customizing the BSL ...................................................................................................... 26
7 Bootloader Versions ....................................................................................................... 27
7.1 FR2xx BSL Versions.............................................................................................. 27
7.2 FR4xx BSL Versions.............................................................................................. 27
7.3 FR57xx BSL Versions ............................................................................................ 28
7.4 FR58xx and FR59xx BSL Versions............................................................................. 28
7.5 FR6xx BSL Versions.............................................................................................. 29
List of Figures
1 Standard RESET Sequence ............................................................................................... 7
2 BSL Entry Sequence at Shared JTAG Pins.............................................................................. 7
3 Example BSL Version....................................................................................................... 9
4 Flowchart.................................................................................................................... 24
List of Tables
1 BSL Overview................................................................................................................ 4
2 BSL Data Packet............................................................................................................. 9

Introduction www.ti.com
2SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
3 UART BSL Command....................................................................................................... 9
4 UART BSL Response....................................................................................................... 9
5 I2C BSL Command......................................................................................................... 10
6 I2C BSL Response ......................................................................................................... 10
7 UART Error Messages .................................................................................................... 10
8 BSL Core Response Structure (Has the BSL Core Message Byte)................................................. 11
9 BSL Core Messages....................................................................................................... 11
10 BSL Core Commands ..................................................................................................... 12
Trademarks
MSP430 is a trademark of Texas Instruments.
All other trademarks are the property of their respective owners.
1 Introduction
The MSP430 BSL lets users communicate with embedded memory in the MSP430 microcontroller (MCU)
during the prototyping phase, final production, and in service. Both the programmable memory (FRAM
memory) and the data memory (RAM) can be modified as required. Do not confuse the bootloader with
programs found in some digital signal processors (DSPs) that automatically load program code (and data)
from external memory to the internal memory of the DSP. These programs are often referred to as
bootloaders as well.
To start the bootloader, a specific BSL entry sequence must be applied to dedicated pins. BSL is also
callable by the application code sets the PC pointer to the BSL start address in Z-area. On FR26xx,
FR24xx, and FR23xx MCUs, an empty reset vector (for example, as on a unprogrammed device) also
invokes the BSL. After the BSL has started, a sequence of commands can be sent to the BSL to execute
the desired functions (for example, unlocking the device, programming or reprogramming the memory,
and verifying the written data). The bootloader session can be exited by continuing operation at a defined
user program address or by the reset condition.
Even if the device is secured by disabling JTAG, it is still possible to use the BSL. To avoid accidental
overwriting of the BSL code, the code is stored in a secure ROM memory location. To prevent unwanted
memory readout, any BSL command that directly or indirectly allows data reading or writing is password
protected. Using this method, access to the device memory through the BSL is protected against misuse
by the BSL password. The BSL password is equal to the content of Interrupt Vector table on the device.
For more information about password-protected commands, see Section 4.2.
1.1 BSL Limitations
Compared to the BSL on MSP flash-based devices, the BSL on MSP FRAM-based devices bootlader is
programmed in the read-only memory (ROM). See MSP430FRBoot – Main Memory Bootloader and Over-
the-Air Updates for MSP430 FRAM for informaion on how to to customize a bootloader in FR5xx and
FR6xx devices. UART and I2C communication protocols are available. For FR4xx, FR21xx, and FR20xx
devices, only UART is available at a rate of 9600 baud.
1.2 Other Useful Documentation
The device-specific data sheets include information on the pins used for BSL communication and the
supported protocols.
Data Sheets
MSP430FR573x Mixed-Signal Microcontrollers
MSP430FR572x Mixed-Signal Microcontrollers
MSP430FR59xx Mixed-Signal Microcontrollers
MSP430FR58xx Mixed-Signal Microcontrollers
MSP430FR698x(1), MSP430FR598x(1) Mixed-Signal Microcontrollers
MSP430FR21xx, MSP430FR2000 Mixed-Signal Microcontrollers

www.ti.com Introduction
3
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
Family User Guides
MSP430FR58xx, MSP430FR59xx, and MSP430FR6xx Family User's Guide
MSP430FR57xx Family User's Guide
MSP430FR4xx and MSP430FR2xx Family User's Guide
Tools and Application Notes
MSP BSL Tool Folder
Training Videos
MSP BSL Overview
MSP BSL Options
MSP Crypto Bootlaoder Training Series

Overview of BSL Features www.ti.com
4SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
2 Overview of BSL Features
Table 1 summarizes the BSL features of the MSP devices, organized by device family.
(1) All BSL software collateral (application, examples, source code, and firmware images) is available in the BSL tool folder.
The MSP430 USB developers package includes additional USB BSL sample applications.
(2) BSL in flash memory allows to replace the BSL with a custom version.
(3) MSP-FET supports UART and I2C BSL communication only.
(4) F543x (non A) has a 16-byte password.
(5) Some devices can disable mass erase on incorrect password. See the device family user's guide.
(6) The decryption of the payload is performed by the device bootcode.
(7) Firmware validation through CRC.
Table 1. BSL Overview
MSP430 MSP432
G2xx0,
G2xx1,
G2xx2,
I20xx
F1xx,
F2xx,
F4xx,
G2xx3
F5xx, F6xx FR5xx, FR6xx FR2x33,
FR231x FR413x, FR211x P401R
Non-
USB USB Factory Crypto-
Boot-
loader(1)
General
BSL memory type No BSL ROM Flash(2) Flash(2) ROM FRAM ROM ROM Flash(2)
BSL memory size N/A 1 KB 2 KB 2 KB 2 KB 4 KB 3 KB 1 KB 8 KB
Peripheral configured by TLV ✔ ✔ ✔
User configuration ✔
UART ✔✔ ✔✔✔✔✔
I2C✔ ✔ ✔ ✔ ✔
SPI ✔
USB ✔
Protocol
'1xx, 2xx, 4xx' protocol ✔
'5xx, 6xx' protocol ✔✔✔✔✔✔✔
Invoke mechanism
Entry sequence
on I/Os
Sequence on TEST/RST ✔ ✔ ✔ ✔ ✔ ✔
PUR pin tied to VUSB ✔
Sequence on defined I/O ✔ ✔
Empty reset vector invokes BSL ✔ ✔ ✔ ✔
Calling BSL from software application ✔✔✔✔✔✔✔✔
Invalid or incomplete application ✔
Tools Support
Hardware
MSP-BSL 'Rocket' ✔✔ ✔✔✔✔✔
MSP-FET ✔ ✔ ✔ ✔ ✔ ✔ ✔(3)
USB cable ✔
Software(1)
BSL Scripter ✔✔✔✔✔✔✔
BSLDEMO ✔
MSPBSL library ✔UART
only ✔UART only ✔
Security
Password protection 32 byte 32 byte(4) 32 byte 32 byte 32 byte 32 byte 256 byte
Mass erase on incorrect password(5) ✔✔✔✔ ✔✔✔
Completely disable the BSL using signature or
erasing the BSL ✔✔✔✔✔✔✔
BSL payload encryption ✔ ✔(6)
Update of IP protected regions through boot
code ✔
Authenticated encryption ✔
Additional security ✔(7)

www.ti.com BSL Architecture
5
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
3 BSL Architecture
3.1 Communication Interface
As Table 1 shows, the communication protocols available for the BSL in FRAM devices are UART and
I2C. Information regarding the available communication protocol and the hardware pins used for the BSL is
available in the Bootloader (BSL) section of each device-specific data sheet.
3.1.1 UART BSL
UART protocol used by BSL is defined as:
• Baud rate is configured to start at 9600 baud. The FR4xx, FR21xx, and FR20xx devices work at 9600
baud only, while other devices can change the baud rate to a higher speed after initialization.
• Works in half-duplex mode (one sender at a time)
• Handshake is performed by an acknowledge character
• The minimum time delay before sending new character after characters have been received from the
MSP430 BSL is 1.2 ms.
NOTE: Applying a baud rate other than 9600 baud at initialization may result in communication
problems.
3.1.2 I2C BSL
I2C protocol used by BSL is defined as:
• The MSP430 BSL is the slave, and the master must request data from the BSL slave.
• 7-bit addressing mode is used, and the slave address is 0x48.
• Handshake is performed by an acknowledge character in addition to the hardware ACK.
• The minimum time delay before sending new character after characters have been received from
MSP430 BSL is 1.2 ms.
• Repeated starts are not required by the BSL but can be used.
3.2 BSL Memory
3.2.1 BSL Memory Layout
BSL application is factory programmed in the read-only memory area of the MSP430 devices and cannot
be customized. The size of the BSL application differs among the device families:
• FR4xx, FR21xx, and FR20xx BSL size is 1KB at address 0x1000 to 0x13FF.
• FR26xx, FR25xx, FR24xx, and FR23xx BSL size totals 3KB at address 0x1000 to 0x17FF for the first
2KB and 0xFFC00 to 0xFFFFF for the remaining 1KB.
• FR5xx and FR6xx BSL size is 2KB at address 0x1000 to 0x17FF.
3.2.2 BSL Z-Area
When protected, the BSL memory cannot be read or jumped into from a location external to BSL memory.
This makes the BSL more secure and prevents erroneous BSL execution. However, if the entire BSL
memory space were protected in this way, it would also mean that user application code could not call the
BSL in any way, such as an intentional BSL startup or using certain public BSL functions.
The Z-Area is a special section of memory designed to allow for a protected BSL to be publically
accessible in a controlled way. The Z-Area is a section of BSL memory between addresses 0x1000 and
0x100F that can be jumped to and read by external application code. It functions as a gateway from which
a jump can be performed to any location within the BSL memory. The default TI BSL uses this area for
jumps to the start of the BSL and for jumps into BSL public functions.

BSL Architecture www.ti.com
6SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
3.2.3 BSL Memory Consideration
The BSL partially clear RAM contents at the beginning of BSL initialization to prevent reading out any
application data or code that may reside there. After initialization, the BSL uses RAM for data buffer and
local variables. When invoking the BSL from a main application, any RAM contents may be lost. The
range of RAM that is cleared is listed in the tables in Section 7.
3.3 BSL Invocation
The following methods can be used to invoke the BSL application on the MSP430 FRAM devices:
• The BSL can be called by application software (see Section 3.3.1)
• The BSL can be called by the device boot code by applying a hardware entry sequence on TEST and
RESET pins on the device (see Section 3.3.2)
• The BSL can be invoked at start up if the device is blank (see Section 3.3.3). This is applicable only for
FR26xx, FR25xx, FR24xx, and FR23xx devices
3.3.1 Software BSL Invocation
The BSL Z-Area is a small section of memory that can be read and invoked from application code. It is
located at memory addresses 0x1000 to 0x100F.
3.3.1.1 Starting the BSL From an External Software Application
Memory location 0x1000 contains a jump instruction pointing to the BSL start and can be used to invoke
the BSL from a running application by setting the program counter to 0x1000. The stack is always reset,
and RAM is cleared. Interrupts are not disabled by the BSL and should be disabled by the application
before invoking the BSL.
TI recommends clearing the configuration of any module registers that are used in the BSL application,
because the configuration for the external application can interrupt the BSL application and cause
unexpected behavior. One example is that in the FR23xx and FR26xx MCUs, the Timer_B module
executes the time-out calculation of the BSL. If Timer_B is also used in the external application and is not
cleared before jumping to the BSL application, it could cause unexpected behavior.
The location 0x1000 may be called as a C function, as in the following example code:
__disable_interrupt(); // disable interrupts
((void (*)())0x1000)(); // jump to BSL
NOTE: The BSL on FR5xx and FR6xx devices must be executed with a maximum frequency of 8
MHz. If the device operates at frequencies higher than 8 MHz, the MCLK frequency must be
set to 8 MHz or lower before calling the BSL.
3.3.1.2 BSL Action
Memory location 0x1002 contains a jump to the "BSL Action" function. To invoke the action function, three
parameters are needed. The first parameter is a number describing which function, and the other two
parameters are known values that indicate that the function was called intentionally.
R12: The function number
R13: 0xDEAD
R14: 0xBEEF
The BSL on FR5xx and FR6xx devices always executes BSL Action function 2, regardless of the function
number argument.

Bootloader Starts
RST DTR/NMI ( )
TEST ( )RTS
tSBW,en
RST DTR/NMI ( )
TEST ( )RTS
User Program Starts
www.ti.com BSL Architecture
7
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
3.3.1.2.1 BSL Action Function 2
Function number: 2
Function Name: Return to BSL
Description: Any supplied function number calls the return to BSL function. This function can be
used if the BSL has written a program into FRAM or RAM, started that program by
"Set PC", and then the program needs to return to the BSL. This function executes
the following code:
RETURN_TO_BSL
POP.W RET_low ; remove first word from return addr
POP.W RET_high ; remove second word from return addr
RETA ; should now return to the BSL location
3.3.2 Hardware BSL Invocation
Applying an appropriate entry sequence on the RST/NMI and TEST pins forces the MSP430 to start
program execution at the BSL RESET vector instead of at the RESET vector located at address FFFEh.
If the application interfaces with a computer UART, these two pins may be driven by the DTR and RTS
signals of the serial communication port (RS232) after passing level shifters. See the Hardware
Description section of MSP430 Programming With the Bootloader (BSL) for hardware schematics. The
standard user reset vector at 0xFFFE is used if TEST is kept low while RST/NMI rises from low to high
(standard method, see Figure 1).
Figure 1. Standard RESET Sequence
The BSL program execution starts when the TEST pin has received a minimum of two positive transitions
and if TEST is high while RST/NMI rises from low to high (BSL entry method, see Figure 2). This level
transition triggering improves BSL startup reliability. The first high level of the TEST pin must be at least
tSBW, En (see device-specific data sheet for tSBW, En parameter).
NOTE: The recommended minimum time for pin states is 250 ns.
Figure 2. BSL Entry Sequence at Shared JTAG Pins
The TEST signal is typically used to switch the port pins between their application function and the JTAG
function. In devices with BSL functionality, the TEST and RST/NMI pins are also used to invoke the BSL.
To invoke the BSL, the RST/NMI pin must be configured as RST and must be kept low while pulling the
TEST pin high and while applying the next two edges (falling, rising) on the TEST pin. The BSL is started
after the TEST pin is held low after the RST/NMI pin is released (see Figure 2).

BSL Architecture www.ti.com
8SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
3.3.2.1 Factors That Prevent Hardware BSL Invocation
The BSL is not started by the BSL RESET vector if:
• There are fewer than two negative edges at TCK pin while RST/NMI is low.
• TCK is high if RST/NMI rises from low to high.
• JTAG has control over the MSP430 MCU resources.
• The supply voltage, VCC, drops below its threshold, and a power-on reset (POR) is executed.
• The RST/NMI pin is configured for NMI functionality (the NMI bit is set).
3.3.3 Blank Device Detection
The boot code on the FR26xx, FR25xx, FR24xx, and FR23xx MCUs supports blank device detection to
avoid the BSL entry sequence. This saves time and also eliminates the need for two additional wires
(TEST, RST) for the BSL invocation sequnce. The BSL entry sequence can be bypassed when the blank
detection is enabled. The device jumps directly to the BSL and bypasses the entry sequence only when
the reset vector has a value of 0xFFFF.
3.4 BSL Time-out Feature
The BSL on the FR26xx, FR25xx, FR24xx, and FR23xx MCUs implements a low-power time-out feature
for the automatic detection of the BSL interface. If no communication has been established within ten
seconds, the device enters LPM4 mode. To invoke the BSL again, the device power must be cycled, or a
reset or NMI must be received.
3.5 BSL Version Number
The BSL version number can be requested by a host programmer using the TX BSL Version command
(see Section 4.1.5.7 for more information).
Byte1: BSL Vendor information
TI BSL is always 0x00. Non-TI BSLs may use this area in another manner.
Byte 2: Command Interpreter Version
The version number for the section of code that interprets BSL core commands.
Byte 3: API Version
The version number for the section of code that reads and writes to MSP430 memory.
Reserved bits:
0x00 to 0x0F: Indicates that this BSL API interfaces with flash.
0x30 to 0x3F: Indicates that this BSL API interfaces with FRAM.
0x80 to 0x8F: Indicates that this BSL can execute only the following commands:
RX Data Block Fast (and can only write to RAM), RX Password, Set PC
Byte 4: Peripheral Interface Version
The version number for the section of code that manages communication.
Reserved numbers:
0x00 to 0x2F: Indicates a Timer_A-based UART
0x30 to 0x4F: Indicates USB
0x50 to 0x6F: Indicates USCI-based UART
0x70 to 0x8F: Indicates eUSCI-based UART
0x90 to 0x9F: Indicates USCI-based I2C
0xA0 to 0xAF: Indicates eUSCI-based I2C
0xB0 to 0xBF: Indicates combined eUSCI I2C and UART

00.07.34.B2
34
FRAM-based API
Version 4
00
TI BSL 07 Command Interpreter
Version 7
B2
Combined eUSCI-based
I2C and UART
Version 2
www.ti.com BSL Protocol
9
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
Figure 3. Example BSL Version
4 BSL Protocol
4.1 BSL Data Packet
The BSL data packet has a layered structure. The BSL core command contains the actual command data
to be processed by the BSL. In addition the standard BSL commands, there can be wrapper data before
and after each core command known as the peripheral interface code (PI Code). This wrapper data is
information that is specific to the peripheral and protocol being used, and it contains information that
allows for correct transmission of the BSL core command. Taken together, the wrapper and core
command constitute a BSL data packet (see Table 2). See Section 4.1.5 for details of the BSL Core
Commands.
Table 2. BSL Data Packet
PI Code BSL Core Command PI Code
The PI Code depends on the protocol in use, either UART or I2C. The following sections describe the
UART and I2C peripheral interface wrappers.
4.1.1 UART Peripheral Interface Wrapper
The UART BSL protocol interface is implemented in multiple packets. The first packet is transmitted to the
BSL device and contains the BSL Core Command and its wrapper. Table 3 summarizes the packet
format.
Table 3. UART BSL Command
Header Length Length BSL Core Command CKL CKH
0x80 NL NH See Section 4.1.5 CKL CKH
The second packet is received from the BSL device and contains the BSL acknowledgment and the BSL
Core Response. Table 4 lists the BSL response data packet structure.
(1) BSL Core Response is not always included.
Table 4. UART BSL Response
Acknowledgment Header Length Length BSL Core Response(1) CKL CKH
ACK from BSL 0x80 NL NH See Section 4.1.4 CKL CKH

BSL Protocol www.ti.com
10 SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.2 I2C Peripheral Interface Wrapper
The I2C BSL protocol interface is implemented in multiple packets. The first packet is sent as a write
request to the BSL slave address and contains the BSL Core Command and its wrapper. Table 5 shows
this format.
Table 5. I2C BSL Command
I2C Header Length Length BSL Core Command CKL CKH
S/A/W 0x80 NL NH See Section 4.1.5 CKL CKH
The second packet is sent as a read request to the BSL slave address and contains the BSL
acknowledgment and the BSL Core Response. Table 6 shows the format of this BSL response.
(1) BSL Core Response is not always included.
Table 6. I2C BSL Response
I2C ACK Header Length Length BSL Core Response(1) CKL CKH I2C
S/A/R ACK from
BSL 0x80 NL NH See Section 4.1.4 CKL CKH STOP
4.1.3 BSL Acknowledgment
The peripheral interface section of the BSL software parses the wrapper section of the BSL data packet. If
there are errors with the data transmission, an error message is sent immediately. An ACK is sent after all
data has been successfully received and does not mean that the command has been correctly executed
(or even that the command was valid) but, rather, that the data packet was formatted correctly and passed
on to the BSL core software for interpretation.
The BSL protocol dictates that every BSL data packet sent is responded to with a single byte
acknowledgment in addition to any BSL data packets that are sent. Table 7 lists the acknowledgment
responses from the BSL. If an acknowledgment byte other than ACK is sent, the BSL does not send any
BSL data packets. The host programmer needs to check the acknowledgment error and retry
transmission.
(1) Not supported for FR4xx, FR21xx, and FR20xx.
Table 7. UART Error Messages
Data Meaning
0x00 ACK
0x51 Header incorrect. The packet did not begin with the required value of 0x80.
0x52 Checksum incorrect. The packet did not have the correct checksum value.
0x53(1) Packet size zero. The size for the BSL core command was given as 0.
0x54(1) Packet size exceeds buffer. The packet size given is too big for the RX buffer.
0x55 Unknown error
0x56(1) Unknown baud rate. The supplied data for baud rate change is not a known value.
0x57 Packet Size Error.

www.ti.com BSL Protocol
11
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.4 BSL Core Response and BSL Core Message
For some commands, the BSL replies with certain BSL core response that contains single byte message
on it.This single byte message is defined as BSL Core Message. The details about which command has
the BSL core message on its respond, described under Section 4.1.5 BSL Core Commands section
examples.
Table 8. BSL Core Response Structure (Has the BSL
Core Message Byte)
CMD Byte BSL Core Message
0x3B Message (see Table 9)
Table 9. BSL Core Messages
Message Meaning
0x00 Operation successful
0x01 Memory (for example, flash or FRAM) write check failed. After programming, a CRC is run on the programmed
data. If the CRC does not match the expected result, this error is returned.
0x04 BSL locked. The correct password has not yet been supplied to unlock the BSL.
0x05 BSL password error. An incorrect password was supplied to the BSL when attempting an unlock.
0x07 Unknown command. The command given to the BSL was not recognized.

BSL Protocol www.ti.com
12 SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5 BSL Core Commands
Table 10 summarizes the BSL core commands.
(1) Not supported for FR4xx, FR21xx, and FR20xx
(2) Applicable for UART peripheral interface only
Table 10. BSL Core Commands
BSL Command Protected CMD AL AM AH Data BSL Core
Response Section
RX Data Block Yes 0x10 (AL) (AM) (AH) D1…Dn Yes Section
4.1.5.1
RX Password No 0x11 – – – D1…D32 Yes Section
4.1.5.2
Mass Erase(1) No 0x15 – – – – No Section
4.1.5.3
CRC Check(1) Yes 0x16 (AL) (AM) (AH) Length (low byte),
Length (high byte) Yes Section 4.1.5.4
Load PC Yes 0x17 (AL) (AM) (AH) – No Section
4.1.5.5
TX Data Block Yes 0x18 (AL) (AM) (AH) Length (low byte),
Length (high byte) Yes Section 4.1.5.6
TX BSL Version(1) Yes 0x19 – – – – Yes Section
4.1.5.7
RX Data Block Fast(1) Yes 0x1B (AL) (AM) (AH) D1...Dn No Section
4.1.5.8
Change Baud Rate(1)(2) No 0x52 – – – D1 No Section
4.1.5.9
AL, AM, AH
Address bytes. The low, middle, and upper bytes, respectively, of an address.
D1...Dn
Data bytes 1 through n (Note: n must be 4 less than the BSL buffer size.)
Length
A byte containing a value from 1 to 255 describing the number of bytes to be transmitted or used in a
CRC. In the case of multiple length bytes, they are combined together as described to form a larger
value describing the number of required bytes.

www.ti.com BSL Protocol
13
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5.1 RX Data Block
Structure BSL Core Command
BSL
Command Protected CMD AL AM AH Data BSL Core Response
RX Data Block Yes 0x10 (AL) (AM) (AH) D1…Dn Yes
Description
The BSL core writes bytes D1 through Dn starting from the location specified in the address fields. This
command differs from RX Data Block Fast in that it returns the status of the write operation.
NOTE: When a block is written partly outside the device's memory (for example, starting to write in
FRAM but exceeding the end of the memory) the whole data block will not be written.
Protection
This command is password protected and fails if the password has not been sent.
Command
0x10
Command Address
Address where the received data should be written.
Command Data
Command consists of the data D1 through Dn to be written. The command consists of n bytes, where
n has maximum 256.
Command Returns
BSL acknowledgment and a BSL core response with the status of the operation. See Section 4.1.4 for
more information on BSL core responses.
Example for UART PI
Write data 0x76543210 to address 0x010000:
Header Length Length CMD AL AM AH D1 D2 D3 D4 CKL CKH
0x80 0x08 0x00 0x10 0x00 0x00 0x01 0x10 0x32 0x54 0x76 0x93 0xCA
BSL response for a successful data write:
ACK Header Length Length CMD MSG CKL CKH
0x00 0x80 0x02 0x00 0x3B 0x00 0x60 0xC4
Example for I2C PI
Write data 0x76543210 to address 0x010000:
I2C Header Length Length CMD AL AM AH D1 D2 D3 D4 CKL CKH
S/A/W 0x80 0x08 0x00 0x10 0x00 0x00 0x01 0x10 0x32 0x54 0x76 0x93 0xCA
BSL response for a successful data write:
I2C ACK Header Length Length CMD MSG CKL CKH I2C
S/A/R 0x00 0x80 0x02 0x00 0x3B 0x00 0x60 0xC4 STOP

BSL Protocol www.ti.com
14 SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5.2 RX Password
Structure BSL Core Command
BSL
Command Protected CMD AL AM AH Data BSL Core Response
RX Password No 0x11 – – – D1…D32 Yes
Description
The BSL core receives the password contained in the packet and unlocks the BSL protected
commands if the password matches the top 16 words in the BSL interrupt vector table (located
between addresses 0xFFE0 and 0xFFFF).
When an incorrect password is given, a mass erase is initiated. This means all code FRAM is erased,
but not Information Memory. When a mass erase is performed, two conditions must be checked: the
password is always 0xFF for all bytes, this is commonly used to gain access to an empty device or to
load a new application to a locked device without password. The mass erase security feature can be
disabled by setting the BSL signatures as described in the corresponding family user's guide (see
Section 1.2).
Protection
This command is not password protected.
Command
0x11
Command Address
N/A
Command Data
The command data is 32 bytes long and contains the device password.
Command Returns
BSL acknowledgment and a BSL core response with the status of the operation.
See Section 4.1.4 for more information on BSL core responses.
Example for UART PI
Unlock a blank device:
Header Length Length CMD D1 D2 D3 D4 D5 D6
0x80 0x21 0x00 0x11 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
D7 D8 D9 D10 D11 D12 D13 D14 D15 D16
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
D17 D18 D19 D20 D21 D22 D23 D24 D25 D26
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
D27 D28 D29 D30 D31 D32 CKL CKH
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0x9E 0xE6
BSL response for a successful password:
ACK Header Length Length CMD MSG CKL CKH
0x00 0x80 0x02 0x00 0x3B 0x00 0x60 0xC4

www.ti.com BSL Protocol
15
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
Example for I2C PI
Unlock a blank device:
I2C Header Length Length CMD D1 D2 D3 D4 D5
S/A/W 0x80 0x33 0x00 0x11 0xFF 0xFF 0xFF 0xFF 0xFF
D6 D7 D8 D9 D10 D11 D12 D13 D14 D15
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
D16 D17 D18 D19 D20 D21 D22 D23 D24 D25
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
D26 D27 D28 D29 D30 D31 D32 CKL CKH
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0x9E 0xE6
BSL response for a successful password:
I2C ACK Header Length Length CMD MSG CKL CKH I2C
S/A/R 0x00 0x80 0x02 0x00 0x3B 0x00 0x60 0xC4 STOP

BSL Protocol www.ti.com
16 SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5.3 Mass Erase
Structure BSL Core Command
For FR23xx, FR25xx, and FR26xx:
BSL
Command Protected CMD AL AM AH Data BSL Core Response
Mass Erase No 0x15 – – – – Yes
For FR5xx and FR6xx:
BSL
Command Protected CMD AL AM AH Data BSL Core Response
Mass Erase No 0x15 – – – – No
Description
All code FRAM in the device is erased. This function does not erase Information Memory and RAM.
As the BSL on the FR4xx, FR21xx, and FR20xx MCUs does not support the Mass Erase command, a
RX Password command containing an incorrect password can be send instead to trigger a mass
erase.
Protection
This command is not password protected.
Command
0x15
Command Address
N/A
Command Data
N/A
Command Returns
BSL acknowledgment and a BSL core response with the status of the operation.
See Section 4.1.4 for more information on BSL core responses.
Example for UART PI
Initiate a mass erase:
Header Length Length CMD CKL CKH
0x80 0x01 0x00 0x15 0x64 0xA3
BSL response (successful operation):
ACK Header Length Length CMD MSG CKL CKH
0x00 0x80 0x02 0x00 0x3B 0x00 0x60 0xC4
Example for I2C PI
Initiate a mass erase:
I2C Header Length Length CMD CKL CKH
S/A/W 0x80 0x01 0x00 0x15 0x64 0xA3
BSL response (successful operation):
I2C ACK Header Length Length CMD MSG CKL CKH I2C
S/A/R 0x00 0x80 0x02 0x00 0x3B 0x00 0x60 0xC4 STOP

www.ti.com BSL Protocol
17
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5.4 CRC Check
Structure BSL Core Command
BSL
Command Protected CMD AL AM AH Data BSL Core Response
CRC Check Yes 0x16 (AL) (AM) (AH) Length (low byte), Length (high byte) Yes
Description
The MSP430 performs a 16-bit CRC check using the CCITT standard. The address given is the first
byte of the CRC check. Two bytes are used for the length. See the CRC chapter of each family user's
guide (see Section 1.2) for more details on the CRC hardware calculation that is used.
Protection
This command is password protected and fails if the password has not been sent.
Command
0x16
Command Address
Address to begin the CRC check.
Command Data
The 16-bit length of the CRC check. D1 is the low byte of the length, and D2 is the high byte of the
length.
Command Returns
BSL acknowledgment and a BSL core response with the CRC value. See Section 4.1.4 for more
information on BSL core responses.
Example for UART PI
Perform a CRC check from address 0x4400 to 0x4800 (size of 1024):
Header Length Length CMD AL AM AH D1 D2 CKL CKH
0x80 0x06 0x00 0x16 0x00 0x44 0x00 0x00 0x04 0x9C 0x7D
BSL response where 0x55 is the low byte of the calculated checksum and 0xAA is the high byte of the
calculated checksum:
ACK Header Length Length CMD D1 D2 CKL CKH
0x00 0x80 0x03 0x00 0x3A 0x55 0xAA 0x12 0x2B
Example for I2C PI
Perform a CRC check from address 0x4400 to 0x4800 (size of 1024):
I2C Header Length Length CMD AL AM AH D1 D2 CKL CKH
S/A/W 0x80 0x06 0x00 0x16 0x00 0x44 0x00 0x00 0x04 0x9C 0x7D
BSL response where 0x55 is the low byte of the calculated checksum and 0xAA is the high byte of the
calculated checksum:
I2C ACK Header Length Length CMD D1 D2 CKL CKH I2C
S/A/R 0x00 0x80 0x03 0x00 0x3A 0x55 0xAA 0x12 0x2B STOP

BSL Protocol www.ti.com
18 SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5.5 Load PC
Structure BSL Core Command
BSL
Command Protected CMD AL AM AH Data BSL Core Response
Load PC Yes 0x17 (AL) (AM) (AH) – No
Description
Causes the BSL to begin execution at the given address using a CALLA instruction. As BSL code is
immediately exited with this instruction, no core response can be expected. The BSL can be returned
to by the main application using the BSL Action function 2, Return to BSL. See Section 3.3.1.2 for
more information.
Be aware that password protection is not active at this time. Jumping to the user application does not
reset the device and, therefore, the register configuration from the BSL application is kept. This might
cause unexpected behavior in the user application. One example is the blink LED application, which
does not have any clock module configuration (so it uses the default 1-MHz clock) and will blink faster,
because the clock module is set by the BSL application to run at 8 MHz.
Protection
This command is password protected and fails if the password has not been sent.
Command
0x17
Command Address
Address to set the Program Counter.
Command Data
N/A
Command Returns
The BSL does not return acknowledgment.
Example for UART PI
Set program counter to 0x4400:
Header Length Length CMD AL AM AH CKL CKH
0x80 0x04 0x00 0x17 0x00 0x44 0x00 0x42 0x0F
The BSL does not respond after the application gains control.
Example for I2C PI
Set program counter to 0x4400:
I2C Header Length Length CMD AL AM AH CKL CKH I2C
S/A/R 0x80 0x04 0x00 0x17 0x00 0x44 0x00 0x42 0x0F STOP
The BSL does not respond once the application gains control.

J= ceiling lHAJCPD
>QBBAN OEVA F1p
www.ti.com BSL Protocol
19
SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5.6 TX Data Block
Structure BSL Core Command
BSL
Command Protected CMD AL AM AH Data BSL Core Response
TX Data
Block Yes 0x18 (AL) (AM) (AH) Length (low byte), Length (high byte) Yes
Description
The BSL transmits data starting at the command address and with size command data. This command
initiates multiple packets if the size is greater than or equal to the buffer size.
Protection
This command is password protected and fails if the password has not been sent.
Command
0x18
Command Address
Address to begin transmitting data from.
Command Data
The 16-bit length of the data to transmit. D1 is the low byte of the length, and D2 is the high byte of the
length.
Command Returns
BSL acknowledgment and a BSL core response with ndata packets where nis:
For example, if 512 bytes are requested with a buffer size of 260, the BSL sends two packets, the first
packet with a length of 259 and the second with a length of 253.
See Section 4.1.4 for more information on BSL core responses.
Example for UART PI
Transmit 4 bytes of data from RAM address 0x1C00:
Header Length Length CMD AL AM AH D1 D2 CKL CKH
0x80 0x06 0x00 0x18 0x00 0x1C 0x00 0x04 0x00 0x87 0x81
BSL response where D1..D4 are the data bytes requested:
ACK Header Length Length CMD D1 D2 D3 D4 CKL CKH
0x00 0x80 0x05 0x00 0x3A 0x11 0x33 0x55 0x77 0x90 0x55
Example for I2C PI
Transmit 4 bytes of data from RAM address 0x1C00:
I2C Header Length Length CMD AL AM AH D1 D2 CKL CKH
S/A/W 0x80 0x06 0x00 0x18 0x00 0x1C 0x00 0x04 0x00 0x87 0x81
BSL response where D1..D4 are the data bytes requested:
I2C ACK Header Length Length CMD D1 D2 D3 D4 CKL CKH I2C
S/A/R 0x00 0x80 0x05 0x00 0x3A 0x11 0x33 0x55 0x77 0x90 0x55 STOP

BSL Protocol www.ti.com
20 SLAU550M–January 2014–Revised February 2018
Submit Documentation Feedback
Copyright © 2014–2018, Texas Instruments Incorporated
MSP430™ FRAM Devices Bootloader (BSL)
4.1.5.7 TX BSL Version
Structure BSL Core Command
BSL Command Protected CMD AL AM AH Data BSL Core
Response
TX BSL Version Yes 0x19 – – – – Yes
Description
BSL transmits its version information (see Section 3.5 for more details).
Protection
This command is password protected and fails if the password has not been sent.
Command
0x19
Command Address
N/A
Command Data
N/A
Command Returns
BSL acknowledgment and a BSL core response with its version number. The data is transmitted as it
appears in memory with the following data bytes:
Version Byte Data Byte
BSL Vendor D1
Command Interpreter D2
API D3
Peripheral Interface D4
See Section 4.1.4 for more information on BSL core responses.
Example for UART PI
Request the BSL version:
Header Length Length CMD CKL CKH
0x80 0x01 0x00 0x19 0xE8 0x62
BSL response (version 00.07.34.B2 of the BSL):
ACK Header Length Length CMD D1 D2 D3 D4 CKL CKH
0x00 0x80 0x05 0x00 0x3A 0x00 0x07 0x34 0xB2 0x14 0x90
Example for I2C PI
Request the BSL version:
I2C Header Length Length CMD CKL CKH
S/A/W 0x80 0x01 0x00 0x19 0xE8 0x62
BSL response (version 00.07.34.B2 of the BSL):
I2C ACK Header Length Length CMD D1 D2 D3 D4 CKL CKH I2C
S/A/R 0x00 0x80 0x05 0x00 0x3A 0x00 0x07 0x34 0xB2 0x14 0x90 STOP