Texas Instruments Serial Programming Adapter MSP430 User manual

MSP430™ Programming With the JTAG
Interface
User's Guide
Literature Number: SLAU320Z
July 2010–Revised July 2017

2SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Contents
Contents
Preface ........................................................................................................................................ 5
1 Programming Using the JTAG Interface.................................................................................. 6
1.1 Introduction ................................................................................................................... 6
1.1.1 MSP430 JTAG Restrictions (Noncompliance With IEEE Std 1149.1)....................................... 6
1.1.2 TAP Controller State Machine .................................................................................... 6
1.2 Interface and Instructions................................................................................................... 7
1.2.1 JTAG Interface Signals ............................................................................................ 7
1.2.2 JTAG Access Macros .............................................................................................. 8
1.2.3 Spy-Bi-Wire (SBW) Timing and Control ....................................................................... 11
1.2.4 JTAG Communication Instructions.............................................................................. 16
1.3 Memory Programming Control Sequences ............................................................................. 22
1.3.1 Start-Up............................................................................................................. 22
1.3.2 General Device (CPU) Control Functions...................................................................... 25
1.3.3 Accessing Non-Flash Memory Locations With JTAG ........................................................ 34
1.3.4 Programming the Flash Memory (Using the Onboard Flash Controller)................................... 39
1.3.5 Erasing the Flash Memory (Using the Onboard Flash Controller).......................................... 45
1.3.6 Reading From Flash Memory.................................................................................... 49
1.3.7 Verifying the Target Memory..................................................................................... 49
1.3.8 FRAM Memory Technology...................................................................................... 52
1.4 JTAG Access Protection .................................................................................................. 53
1.4.1 Burning the JTAG Fuse - Function Reference for 1xx, 2xx, 4xx Families................................. 54
1.4.2 Programming the JTAG Lock Key - Function Reference for 5xx, 6xx, and FRxx Families ............. 56
1.4.3 Testing for a Successfully Protected Device .................................................................. 57
1.4.4 Unlocking a Password-Protected Device ...................................................................... 58
1.4.5 Memory Protection Unit Handling............................................................................... 59
1.4.6 Intellectual Property Encapsulation (IPE) ...................................................................... 59
1.4.7 FRAM Write Protection........................................................................................... 59
1.5 JTAG Function Prototypes................................................................................................ 60
1.5.1 Low-Level JTAG Functions ...................................................................................... 60
1.5.2 High-Level JTAG Routines....................................................................................... 61
1.6 JTAG Features Across Device Families ................................................................................ 64
1.7 References.................................................................................................................. 75
2 JTAG Programming Hardware and Software Implementation................................................... 76
2.1 Implementation History .................................................................................................... 76
2.2 Implementation Overview ................................................................................................. 76
2.3 Software Operation ........................................................................................................ 77
2.4 Software Structure ......................................................................................................... 77
2.4.1 Programmer Firmware............................................................................................ 77
2.4.2 Target Code........................................................................................................ 79
2.5 Programmer Operation .................................................................................................... 80
2.6 Hardware Setup ............................................................................................................ 80
2.6.1 Host Controller..................................................................................................... 80
2.6.2 Target Connection................................................................................................. 80
2.6.3 Host Controller or Programmer Power Supply ................................................................ 83
2.6.4 Third-Party Support ............................................................................................... 83

www.ti.com
3
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Contents
A Errata and Revision Information........................................................................................... 84
A.1 Known Issues............................................................................................................... 84
A.2 Revisions and Errata from Previous Documents....................................................................... 84
Revision History.......................................................................................................................... 85

www.ti.com
4SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
List of Figures
List of Figures
1-1. TAP Controller State Machine ............................................................................................. 6
1-2. Spy-Bi-Wire Basic Concept................................................................................................. 8
1-3. Timing Example for IR_SHIFT (0x83) Instruction ....................................................................... 9
1-4. Data Register I/O: DR_SHIFT16 (0x158B) (TDO Output Is 0x55AA)............................................... 10
1-5. Address Register I/O: DR_SHIFT20 (0x12568) (TDO Output Is 0xA55AA)........................................ 10
1-6. SetTCLK..................................................................................................................... 11
1-7. ClrTCLK ..................................................................................................................... 11
1-8. Spy-Bi-Wire Timing Diagram ............................................................................................. 12
1-9. Detailed SBW Timing Diagram........................................................................................... 14
1-10. Synchronization of TDI and TCLK During Run-Test/Idle.............................................................. 15
1-11. Clocking TCLK Using TCLK Strobes .................................................................................... 16
1-12. JTAG Access Entry Sequences (for Devices That Support SBW) .................................................. 23
1-13. Fuse Check and TAP Controller Reset.................................................................................. 24
1-14. JTAG Entry Sequence for 430Xv2 Devices ............................................................................ 31
1-15. Accessing Flash Memory.................................................................................................. 43
1-16. Flash Access Code Binary Image Map.................................................................................. 44
1-17. Fuse Blow Timing .......................................................................................................... 56
2-1. Replicator Application Schematic ........................................................................................ 82
List of Tables
1-1. Pros and Cons of 2-Wire Spy-Bi-Wire ................................................................................... 7
1-2. Pros and Cons of 4-Wire JTAG............................................................................................ 7
1-3. Standard 4-Wire JTAG Signals ............................................................................................ 7
1-4. JTAG Communication Macros ............................................................................................. 9
1-5. Memory Access Instructions.............................................................................................. 16
1-6. JTAG Control Signal Register for 1xx, 2xx, 4xx Families............................................................. 19
1-7. JTAG Control Signal Register for 5xx and 6xx Families .............................................................. 20
1-8. Shared JTAG Device Pin Functions..................................................................................... 22
1-9. Erase and Program Minimum TCLK Clock Cycles .................................................................... 40
1-10. Flash Memory Parameters (fFTG = 450 kHz) ............................................................................ 46
1-11. Overview Of Memory Protection Mechanisms ......................................................................... 53
1-12. MSP430 Device JTAG Interface (Shared Pins)........................................................................ 54
1-13. MSP430 Device Dedicated JTAG Interface ............................................................................ 54
1-14. MSP430F1xx, MSP430F2xx, MSP430F4xx, MSP430Gxx JTAG Features ........................................ 64
1-15. MSP430F5xx, MSP430F6xx, CC430 JTAG Features................................................................. 66
1-16. MSP430FRxx JTAG Features............................................................................................ 72
1-17. MSP430ixx JTAG Features............................................................................................... 74
2-1. Programmer Firmware..................................................................................................... 78

5
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Read Me First
Preface
SLAU320Z–July 2010–Revised July 2017
Read Me First
About This Document
This document describes the functions that are required to erase, program, and verify the memory module
of the MSP430™ flash-based and FRAM-based microcontroller families using the JTAG communication
port. In addition, it describes how to program the JTAG access security fuse that is available on all
MSP430 devices. This document describes device access using both the standard 4-wire JTAG interface
and the 2-wire JTAG interface, which is also referred to as Spy-Bi-Wire (SBW).
An example programmer system, which includes software (source code is provided) and the
corresponding hardware, is described in Chapter 2. This example is intended as a reference for
understanding the concepts presented in this report and to aid in development of similar MSP430
programmer solutions. In that sense, it is not meant to be a fully featured programming tool but, rather, is
intended as a construction manual for such a tool. Those users who are looking for a ready-to-use tool
should see the complete programming tool solution from TI called MSP-GANG Production Programmer.
Four main topics are presented in this document:
Section 1.2,Interface and Instructions, describes the required JTAG signals and associated pin
functionality for programming the MSP430 family. In addition, this section includes the descriptions of
the provided software macro routines and JTAG instructions used to communicate with and control a
target MSP430 through the JTAG interface.
Section 1.3,Memory Programming Control Sequences, describes how to use the provided macros and
function prototypes in a software-flow format to control a target MSP430 device and program or erase
the memory.
Section 1.4,JTAG Access Protection, describes the mechanism that can disable memory access
through JTAG to the memory of the target device, which can eliminate undesired memory access for
security purposes.
Chapter 2,JTAG Programming Hardware and Software Implementation, describes how to develop an
example MSP430 flash programmer using an MSP430F5437 as the host controller. This chapter
includes a schematic and the required software and project files. A thorough description of how to use
the given implementation is also included, to provide an example system that can be referenced for
custom MSP430 programmer solutions.
Trademarks
MSP430 is a trademark of Texas Instruments.
All other trademarks are the property of their respective owners.

Select DR-Scan
Run-Test/IDLE
Test-Logic-Reset
0
1
0
1
1
Fuse Check
Power
On
Capture-DR
Shift-DR
Exit1-DR
Pause-DR
Exit2-DR
Update-DR
Select IR-Scan
Capture-IR
Shift-IR
Exit1-IR
Pause-IR
Exit2-IR
Update-IR
0
0
0
0
1 1
1
1
11
1
1
1
1
1
11
0
0
0
0
0
0
0
0
0
0
6SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
Chapter 1
SLAU320Z–July 2010–Revised July 2017
Programming Using the JTAG Interface
1.1 Introduction
This document provides an overview of how to program the memory module of an MSP430 flash-based or
FRAM-based device using the on-chip JTAG interface [4-wire or 2-wire Spy-Bi-Wire (SBW) interface]. A
focus is maintained on the high-level JTAG functions used to access and program the memory and the
required timing.
1.1.1 MSP430 JTAG Restrictions (Noncompliance With IEEE Std 1149.1)
• The JTAG pins are shared with port functions on all devices with a TEST pin. This includes the 5xx,
6xx, and FRxx families as well as certain device groups from the 2xx and 4xx families (see Table 1-
14). On these devices, a special entry sequence must be sent to enable 4-wire JTAG connection. This
sequence is described in Section 1.3.1.1.
• The MSP430 device must be the first device in the JTAG chain (because of clocking on TDI and JTAG
fuse check sequence).
• Only the BYPASS instruction is supported. There is no support for SAMPLE, PRELOAD, or EXTEST
instructions.
1.1.2 TAP Controller State Machine
The MSP430 JTAG interface implements the test access port state machine (TAP controller) as specified
by IEEE Std 1149.1. References to the TAP controller and specific JTAG states identified in IEEE Std
1149.1 are made throughout this document. Figure 1-1 shows the TAP state machine.
Figure 1-1. TAP Controller State Machine

www.ti.com Interface and Instructions
7
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
1.2 Interface and Instructions
This section describes the hardware connections to the JTAG interface of the MSP430 devices and the
associated pin functions that are used during programming. This section also describes the software
macro routines that are used to program a MSP430 target and the JTAG instructions that are used to
communicate with and control the target through the JTAG interface.
The Replicator example project detailed in Chapter 2 implements the following high-level flow to clarify the
minimum requirements for programming an MSP430 target memory.
• Enable JTAG Access (see Section 1.3.1.1)
• Erase Target Memory (see Section 1.3.5 and Section 1.3.8.2)
• Verify Target Memory (special case: Erase Check) (see Section 1.3.7)
• Write Target Memory (see Section 1.3.4 and Section 1.3.8.1)
• Verify Target Memory (see Section 1.3.7)
• Release Target from JTAG Control (see Section 1.3.2.1.6)
1.2.1 JTAG Interface Signals
The MSP430 family supports in-circuit programming of flash and FRAM memory through the JTAG port,
which is available on all MSP430 devices. All devices support the JTAG 4-wire interface. Some devices
also support the next-generation optimized 2-wire JTAG (Spy-Bi-Wire) interface. Using these protocols, an
interface connection that can access the MSP430 JTAG port using a PC or other controller can be
established. See the section Signal Connections for In-System Programming and Debugging, MSP-
FET430PIF, MSP-FET430UIF, GANG430, PRGS430 in the MSP430 Hardware Tools User's Guide.
1.2.1.1 Pros and Cons of 2-Wire Spy-Bi-Wire and 4-Wire JTAG
Table 1-1. Pros and Cons of 2-Wire Spy-Bi-Wire
Pros Cons
Only two pins are used (TEST and RST) Slower than 4-wire JTAG
No overlap between JTAG and IO pins
Table 1-2. Pros and Cons of 4-Wire JTAG
Pros Cons
Faster than 2-wire Spy-Bi-Wire Four GPIO pins are used
When using JTAG, other pin functions not usable
1.2.1.2 4-Wire JTAG Interface
The standard JTAG interface requires four signals for sending and receiving data. On larger MSP430
devices, these pins are dedicated for JTAG. Smaller devices with fewer total pins multiplex these JTAG
lines with general-purpose functions. On these smaller devices, one additional signal is required that is
used to define the state of the shared pins. This signal is applied to the TEST pin. The remaining
connections required are ground and VCC when powered by the programmer. These signals are described
in Table 1-3.
Table 1-3. Standard 4-Wire JTAG Signals
Pin Direction Description
TMS IN Signal to control the JTAG state machine
TCK IN JTAG clock input
TDI IN JTAG data input and TCLK input
TDO OUT JTAG data output
TEST IN Enable JTAG pins (shared JTAG devices only)

SBWTDIO
SBWTCK
Spy-Bi-Wire
Logic
JTAG
TAP Controller
RAM, Flash, or
FRAM
Core Logic
and
Emulation Logic
TDO
TDI
TMS
TCK
Interface and Instructions www.ti.com
8SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
The TEST input exists only on MSP430 devices with shared JTAG function, usually assigned to port 1.
For normal operation (non-JTAG mode), this pin is internally pulled down to ground, which enables the
shared pins as standard port I/O. To enable these pins for JTAG communication, refer to Section 1.3.1.1.
The TCLK signal is an input clock that must be provided to the target device from an external source. This
clock is used internally as the system clock of the target device, MCLK, to load data into memory locations
and to clock the CPU. There is no dedicated pin for TCLK; instead, the TDI pin is used as the TCLK input.
This occurs while the MSP430 TAP controller is in the Run-Test/Idle state.
NOTE: TCLK input support on the MSP430 XOUT pin exists but has been superseded by the TDI
pin on all current MSP430 flash-based and FRAM-based devices. Existing FET tools, as well
as the software provided with this document, implement TCLK on the TDI input pin.
1.2.1.3 2-Wire Spy-Bi-Wire (SBW) JTAG Interface
The core JTAG logic integrated into devices that support 2-wire mode is identical to 4-wire-only devices.
The fundamental difference is that 2-wire devices implement additional logic that is used to convert the 2-
wire communication into the standard 4-wire communication internally. In this way, the existing JTAG
emulation methodology of the MSP430 can be fully used.
Figure 1-2. Spy-Bi-Wire Basic Concept
The 2-wire interface is made up of the SBWTCK (Spy-Bi-Wire test clock) and SBWTDIO (Spy-Bi-Wire test
data input/output) pins. The SBWTCK signal is the clock signal and is a dedicated pin. In normal
operation, this pin is internally pulled to ground. The SBWTDIO signal represents the data and is a
bidirectional connection. To reduce the overhead of the 2-wire interface, the SBWTDIO line is shared with
the RST/NMI pin of the device.
Section 1.6 describes the MSP430 devices and their respective JTAG interface implementation.
1.2.2 JTAG Access Macros
To keep descriptions of the JTAG functions in the following sections simple, high-level macros have been
used to describe the JTAG access. This document does not detail the basic JTAG functionality; rather, it
focuses on the MSP430-specific implementation used for memory access and programming. For the
purpose of this document, it is important to show the instructions that must be loaded into the JTAG
instruction register, as well as when these instructions are required. Section 1.2.2.1 summarizes the
macros used throughout this document and their associated functionality. See the accompanying software
for more information.

TCK
TMS
TDI
TDO
TCLK
Instruction Input via TDI
1 1 10 0 0 0 0
Data to TDI LSB MSB
Save TDI value (= TCLK) Restore saved TDI value
www.ti.com Interface and Instructions
9
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
Table 1-4. JTAG Communication Macros
Macro Name Function
IR_SHIFT
(8-bit instruction) Shifts an 8-bit JTAG instruction into the JTAG instruction register. At the same time, the 8-bit value is shifted out through TDO.
DR_SHIFT16
(16-bit data) Shifts a 16-bit data word into a JTAG data register. At the same time, the 16-bit value is shifted out through TDO.
DR_SHIFT20
(20-bit address) Shifts a 20-bit address word into the JTAG Memory Address Bus register. At the same time, the 20-bit value is shifted out through TDO. Only applicable to MSP430X architecture devices.
MsDelay (time) Waits for the specified time in milliseconds
SetTCLK Sets TCLK to 1
ClrTCLK Sets TCLK to 0
TDOvalue Variable containing the last value shifted out on TDO
1.2.2.1 Macros for 4-Wire JTAG Interface
1.2.2.1.1 IR_SHIFT (8-Bit Instruction)
This macro loads a JTAG instruction into the JTAG instruction register (IR) of the target device. In the
MSP430, this register is eight bits wide with the least significant bit (LSB) shifted in first. The data output
from TDO during a write to the JTAG instruction register contains the version identifier of the JTAG
interface (or JTAG ID) that is implemented on the target device. Regardless of the 8-bit instruction sent
out on TDI, the return value on TDO is always the JTAG ID. Each instruction bit is captured from TDI by
the target MSP430 on the rising edge of TCK. TCLK should not change state while this macro is executed
(TCLK = TDI while the TAP controller is in the Run-Test/Idle state). Figure 1-3 shows how to load the
ADDR_16BIT instruction into the JTAG IR. See Section 1.2.4 for a complete list of the JTAG interface
communication instructions that are used to access the flash memory module of the target device.
Figure 1-3. Timing Example for IR_SHIFT (0x83) Instruction
1.2.2.1.2 DR_SHIFT16 (16-Bit Data)
This macro loads a 16-bit word into the JTAG data register (DR) (in the MSP430 devices, a data register
is 16 bits wide). The data word is shifted, most significant bit (MSB) first, into the TDI input of the target
MSP430 device. Each bit is captured from TDI on a rising edge of TCK. At the same time, TDO shifts out
the last captured and stored value in the addressed data register. A new bit is present at TDO with a
falling edge of TCK. TCLK should not change state while this macro is executing. Figure 1-4 shows how to
load a 16-bit word into the JTAG DR and read out a stored value through TDO.

TCK
TMS
TDI
TDO
TCLK
Data input via TDI and data output via TDO
1000 0 0 10100 101 1
0
1 1 1 1 1 1 1 1
0 0 0 0 0 00 0
Data from TDO:
Data to TDI LSB
Save TDI value (= TCLK)
Restore saved TDI value
1 1
0 0
010 0
Bit #: 14 12 10 875 3 1 15 964 2 1613 11 19 17 018
MSB
TCK
TMS
TDI
TDO
TCLK
Data input via TDI and data output via TDO
1 1
00 0 1 0 1 0 1 0 0 1 0 1
0
1 1 1 1 1 1 1 1
0 0 0 0 0 00 0Data from TDO
Data to TDI MSB LSB
Save TDI value (= TCLK)
Restore saved TDI value
Interface and Instructions www.ti.com
10 SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
Figure 1-4. Data Register I/O: DR_SHIFT16 (0x158B) (TDO Output Is 0x55AA)
1.2.2.1.3 DR_SHIFT20 (20-Bit Address) (Applies Only to MSP430X Devices)
The MSP430X architecture is based on a 20-bit memory address bus (MAB), to address up to 1 MB of
continuous memory. No new JTAG instructions are needed to control the 20-bit MAB (for details on
instructions, see Section 1.2.4.1), only the JTAG address register itself has been extended to 20 bits. This
macro loads a 20-bit address word into the 20-bit wide JTAG MAB register. The address word is shifted,
MSB first, into the TDI input of the target MSP430 device. Each bit is captured from TDI on a rising edge
of TCK. At the same time, TDO shifts out the last captured and stored value in the JTAG MAB register. A
new bit is present at TDO with a falling edge of TCK. TCLK should not change state while this macro is
executing. This macro should only be used when IR_ADDR_16BIT or IR_ADDR_CAPTURE has been
loaded into the JTAG instruction register before the MAB is manipulated through JTAG. On a 20-bit shift
access, the upper four bits (19:16) of the JTAG address register are shifted out last. Therefore, bit 15 of
the MAB is read first when the lower part of the MAB is accessed by performing a 16-bit shift. This
implementation ensures compatibility with the original MSP430 architecture and its JTAG MAB register
implementation.
NOTE: The DR_SHIFT20 (20-bit Address) macro in the associated C-code software example
application automatically reconstructs the swapped TDO (15:0) (19:16) output to a
continuous 20-bit address word (19:0) and simply returns a 32-bit LONG value.
Figure 1-5 shows how to load a 20-bit address word into the JTAG address register and read out a stored
value through TDO.
Figure 1-5. Address Register I/O: DR_SHIFT20 (0x12568) (TDO Output Is 0xA55AA)

TCLK
TDO
TCK
TMS
ClrTCLK
TCLK
TDO
TCK
TMS
SetTCLK
www.ti.com Interface and Instructions
11
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
1.2.2.1.4 MsDelay (Time)
This macro causes the programming interface software to wait for a specified amount of time in
milliseconds (ms). While this macro is executing, all signals to and from the target MSP430 must hold their
previous values.
1.2.2.1.5 SetTCLK
This macro sets the TCLK input clock (which is provided on the TDI signal input) high. TCK and TMS must
hold their last value while this macro is performed (see Section 1.2.3.5.1 and Figure 1-10 for SBW-specific
constraints).
Figure 1-6. SetTCLK
1.2.2.1.6 ClrTCLK
This macro resets the TCLK input clock low. TCK and TMS must hold their last value while this action is
performed (see Section 1.2.3.5.1 and Figure 1-10 for SBW-specific constraints).
Figure 1-7. ClrTCLK
1.2.2.2 Macros for Spy-Bi-Wire (SBW) Interface
All JTAG macros described in Section 1.2.2.1 also apply to the 2-wire interface and are provided as
software source along with this document.
1.2.3 Spy-Bi-Wire (SBW) Timing and Control
The following sections described the fundamentals of the SBW implementation as it relates to supporting
generation of the macro function timing signals. This is intended to enable development of custom
MSP430 programming solutions, rather than just relying on the example application code also provided.
1.2.3.1 Basic Timing
The SBW interface serial communication uses time-division multiplexing and allocates three time slots:
TMS_SLOT, TDI_SLOT, and TDO_SLOT. To clock TCLK through the SBW interface in a similar method
as it is clocked through TDI during 4-wire JTAG access, an alternative JTAG timing method is
implemented. This implementation makes use of the fact that the TDI and TMS signals are captured with
the falling edge of SBWTCK in their respective slots as shown in Figure 1-8.

TMS Slot TDI Slot TDO Slot
SBWTCK
TMS captured
as 0
SBWTDIO
TDI captured
as 1 Target device starts
driving output on TDO
< 7 µs
Interface and Instructions www.ti.com
12 SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
Figure 1-8. Spy-Bi-Wire Timing Diagram
1.2.3.2 TMS Slot
The TMS Slot is used to switch between states in the TAP Controller state machine (see Section 1.1.2) of
the JTAG module of the target device. The following macros are located in the LowLevelFunc header file
in the Replicator example project.
1.2.3.2.1 TMSH Macro
Sets SBWTDIO high for TMS slot (no special TDI preparation handling)
• Set SBWTDIO high
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK high
1.2.3.2.2 TMSL Macro
Sets SBWTDIO low for TMS slot (no special TDI preparation handling)
• Set SBWTDIO low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK high
1.2.3.2.3 TMSLDH Macro
Sets SBWTDIO low for TMS slot, but brings it back high after SBWTCK falling edge before TMS slot ends.
Used for some cases of ClrTCLK and SetTCLK.
• Set SBWTDIO low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTDIO high
• Set SBWTCK high

www.ti.com Interface and Instructions
13
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
1.2.3.3 TDI Slot
In most TAP Controller states (such as Shift-IR), TDI is used for shifting data into the target device. In
Run-Test/IDLE state, the TDI slot can also be used to clock the target CPU (see Section 1.2.3.5) The
following macros are located in the LowLevelFunc header file in the Replicator example project.
1.2.3.3.1 TDIH Macro
Sets SBWTDIO high for TDI slot.
• Set SBWTDIO high
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK high
1.2.3.3.2 TDIL Macro
Sets SBWTDIO low for TDI slot.
• Set SBWTDIO low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK high
1.2.3.4 TDO Slot
As shown in Figure 1-8, the TDO operation is allocated one time slot (see also the detailed timing shown
in Figure 1-9). The master should release control of the SBWTDIO line based off of the rising edge of
SBWTCK of the TDI cycle. After the master releases the SBWTDIO line, an internal bus keeper holds the
voltage on the line. The next falling edge of SBWTCK triggers the slave to start driving the bus. The slave
only drives the SBWTDIO line during the low time of the SBWTCK cycle. The master should not enable its
drivers until the slave has released the SBWTDIO line. Therefore, the master could use the rising edge of
the SBWTCK signal as a trigger point to enable its driver.
NOTE: The low phase of the clock signal supplied on SBWTCK must not be longer than 7 µs. If the
low phase is longer, the SBW logic is deactivated, and it must be activated again according
to Section 1.3.1.
When using the provided source code example, make sure that interrupts are disabled
during the SBWTCK low phase to ensure accurate timings.

SBWTCK
1 2
TDI_SLOT TDO_SLOT
TMSn-1 TMSn
JTAG TAP
STATE
TDIn-1 TDIn
TMS_SLOT
0 1 2
TDI_SLOTTMS_SLOT
0
10 2
SHIFT_COUNT
LOAD_JTAG_REG
JTAG_REG
TCLK
TMS
TDI
TCK
TAP STATEn–1 TAP STATEn
TDO_SLOT
TDI TDO
SBWTDIO
10 2
MASTER SLAVE MASTER SLAVE
TMS TDI TDOTMS
Interface and Instructions www.ti.com
14 SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
Figure 1-9. Detailed SBW Timing Diagram
The following macros are located in the LowLevelFunc header file in the Replicator example project.
1.2.3.4.1 TDO_RD Macro
TRSLDIR |= TDOI_DIR sets the SN74LVC1T45 transceiver on the board to Hi-Z, and
TRSLDR &= TDOI_DIR sets it back to being driven.
Used for reading TDO value during TDO slot.
• Set SBWTDIO Hi-Z
• NOP 5 cycles (delay at 18 MHz
• Set SBWTCK low
• NOP 5 cycles (delay at 18 MHz)
• Read SBWTDIO line
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK high
• Set SBWTDIO to driven again

TMS Slot TDI Slot TDO Slot
SBWTCK
(external clock signal)
ClrTCLK
TCLK
SetTCLK
SBWTDIO
latched at 1 in
last TDI slot
latched at 0 in
last TDI slot
latched at 0 in
last TDI slot
latched at 1 in
last TDI slot
SBWTDIO
SBWTDIO
SBWTDIO
TCLK
TCLK
TCLK
www.ti.com Interface and Instructions
15
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
1.2.3.4.2 TDOsbw Macro (No Read)
Used for clocking through TDO slot, when no read is required.
• Set SBWTDIO Hi-Z
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK low
• NOP 5 cycles (delay at 18 MHz)
• Set SBWTCK high
• Set SBWTDIO to driven again
1.2.3.5 TCLK Handling in Spy-Bi-Wire (SBW) Mode
1.2.3.5.1 SetTCLK and ClrTCLK
If the JTAG TAP controller is in the Run-Test/Idle state, the TDI slot can provide the TCLK signal (that is,
it can clock the target CPU). Following this implementation, the generation of a complete TCLK clock cycle
requires two TDI slots, one of which sets the TCLK signal and one of which clears it. In each case, the
SBWTDIO signal must be set low in the TMS slot to keep the TAP controller from leaving the Run-
Test/Idle state. To provide only a falling edge for ClrTCLK, the SBWTDIO signal must be set high before
entering the TDI slot. The corresponding rising edge must occur in the low phase of SBWTCK in the TMS
slot. Otherwise it would be interpreted as a trigger for TMS = 1 and the TAP controller would leave Run-
Test/Idle mode.
Figure 1-10 shows handling of TCLK in SBW mode. See the reference functions SetTCLK_sbw and
ClrTCLK_sbw in the MSP430 Replicator project (slau320.zip) for software implementation. The provided
code example for the MSP430Xv2 architecture uses preprocessor definitions to enable a better layered
software architecture. The upper software layers can simply reference the SetTCLK and ClrTCLK symbols
while the actual implementation symbols are SetTCLK_4wire and ClrTCLK_4wire for 4-wire JTAG and
SetTCLK_sbw and ClrTCLK_sbw for Spy-Bi-Wire (SBW).
Figure 1-10. Synchronization of TDI and TCLK During Run-Test/Idle

TMS Slot TDI Slot TDO Slot
SBWTCK
(external clock signal)
latched at 0 in
last TDI slot
latched at 1 in
last TDI slot
Strobes
TCLK
SBWTDIO
TCLK
SBWTDIO
Interface and Instructions www.ti.com
16 SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
1.2.3.5.2 TCLK Strobes
For MSP430 devices from the F1xx, F2xx, G2xx, and F4xx families, a custom number of TCLK clocks can
be provided within a single TDI slot as can be seen in the example projects Replicator430 and
Replicator430X. See reference function: TCLKstrobes(). This implementation is not applicable for any
newer devices from the MSP430F5xx or MSP430F6xx families. For those devices, the flash timing is
generated internally by the MODOSC.
Figure 1-11. Clocking TCLK Using TCLK Strobes
1.2.4 JTAG Communication Instructions
Selecting a JTAG register and controlling the CPU is done by shifting in a JTAG instruction using the
IR_SHIFT macro described in Section 1.2.2.1.1. The following instructions that can be written to the JTAG
IR are used to program the target memory. All instructions sent to the target MSP430 through the JTAG
register are transferred LSB first.
Table 1-5. Memory Access Instructions
Instruction Name 8-Bit Instruction Value
Controlling the Memory Address Bus (MAB)
IR_ADDR_16BIT 0x83
IR_ADDR_CAPTURE 0x84
Controlling the Memory Data Bus (MDB)
IR_DATA_TO_ADDR 0x85
IR_DATA_16BIT 0x41
IR_DATA_QUICK 0x43
IR_BYPASS 0xFF
Controlling the CPU
IR_CNTRL_SIG_16BIT 0x13
IR_CNTRL_SIG_CAPTURE 0x14
IR_CNTRL_SIG_RELEASE 0x15
Memory Verification by Pseudo Signature Analysis (PSA)
IR_DATA_PSA 0x44
IR_SHIFT_OUT_PSA 0x46
JTAG Access Security Fuse Programming
IR_Prepare_Blow 0x22
IR_Ex_Blow 0x24
JTAG Mailbox System
IR_JMB_EXCHANGE 0x61

www.ti.com Interface and Instructions
17
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
NOTE: Do not write any unlisted values to the JTAG instruction register. Instruction values written to
the MSP430 JTAG register other than those listed above may cause undesired device
behavior.
NOTE: When a new JTAG instruction is shifted into the JTAG instruction register, it takes effect with
the UPDATE-IR state of the TAP controller. When accessing a JTAG data register, the last
value written is captured with the CAPTURE-DR state, and the new value shifted in becomes
valid with the UPDATE-DR state. In other words, there is no need to go through Run-
Test/Idle state of the JTAG TAP controller to shift in instructions or data. Be aware of the fact
that clocking TCLK is only possible in the Run-Test/Idle state. This is why the provided
software example application exclusively makes use of the JTAG macros described in
Section 1.2.2, which always go through Run-Test/Idle state.
1.2.4.1 Controlling the Memory Address Bus (MAB)
The following instructions control the MAB of the target MSP430. To accomplish this, a 16-bit (or 20-bit in
MSP430X architectures) register, which is called the JTAG MAB register, is addressed. By using the
JTAG data path of the TAP controller, this register can be accessed and modified.
1.2.4.1.1 IR_ADDR_16BIT
This instruction enables setting of the MAB to a specific value, which is shifted in with the next JTAG 16-
bit data access using the DR_SHIFT16 (16-bit Data) macro or the next JTAG 20-bit address word access
using the DR_SHIFT (20-bit Address) macro. The MAB of the MSP430 CPU is set to the value written to
the JTAG MAB register. The previous value stored in the JTAG MAB register is simultaneously shifted out
on TDO while the new 16- or 20-bit address is shifted in through TDI.
NOTE: In MSP430X devices, a 16-bit shift to update the JTAG MAB register does not automatically
reset the upper four bits (19:16) of the JTAG MAB register. Always use the 20-bit shift macro
to ensure that the upper four bits (19:16) are set to a defined value.
1.2.4.1.2 IR_ADDR_CAPTURE
This instruction enables readout of the data on the MAB with the next 16- or 20-bit data access. The MAB
value is not changed during the 16- or 20-bit data access; that is, the 16- or 20-bit data sent on TDI with
this command is ignored (0 is sent as a default in the provided software).
In several places throughout the example code, the IR_ADDR_CAPTURE instruction is also used to set
the CPU to a defined state after accessing the data bus with the IR_DATA_16BIT instruction.
1.2.4.2 Controlling the Memory Data Bus (MDB)
The following instructions control the MDB of the MSP430 CPU. To accomplish this, a 16-bit register,
termed the JTAG MDB register, is addressed. By using the JTAG data path of the TAP controller, this
register can be accessed and modified.
1.2.4.2.1 IR_DATA_TO_ADDR
This instruction enables setting of the MSP430 MDB to a specific value shifted in with the next JTAG 16-
bit data access using the DR_SHIFT16 (16-bit Data) macro. The MDB of the MSP430 CPU is set to the
value written to the JTAG MDB register. As the new value is written into the MDB register, the prior value
in the MSP430 MDB is captured and shifted out on TDO. The MSP430 MAB is set by the value in the
JTAG MAB register during execution of the IR_DATA_TO_ADDR instruction. This instruction is used to
write to all memory locations of the MSP430.

Interface and Instructions www.ti.com
18 SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
1.2.4.2.2 IR_DATA_16BIT
This instruction enables setting of the MSP430 MDB to the specified 16-bit value shifted in with the next
16-bit JTAG data access. The complete MSP430 MDB is set to the value of the JTAG MDB register. At
the same time, the last value of the MSP430 MDB is captured and shifted out on TDO. In this situation,
the MAB is still controlled by the CPU. The program counter (PC) of the target CPU sets the MAB value.
1.2.4.2.3 IR_DATA_QUICK
This instruction enables setting of the MSP430 MDB to a specific value shifted in with the next 16-bit
JTAG data access. The 16-bit MSP430 MDB is set to the value written to the JTAG MDB register. During
the 16-bit data transfer, the previous MDB value is captured and shifted out on TDO. The MAB value is
set by the program counter (PC) of the CPU. This instruction auto-increments the program counter by two
on every falling edge of TCLK to automatically point to the next 16-bit memory location. The program
counter of the target CPU must be loaded with the starting memory address before execution of this
instruction, which can be used to quickly read or write to a memory array (see Section 1.3.2.1.3 for more
information on setting the PC).
NOTE: IR_DATA_QUICK cannot be used to write flash memory.
NOTE: IR_DATA_QUICK cannot be used to read or write USB RAM as this is dual ported RAM. It
needs to be accessed word by word.
1.2.4.2.4 IR_BYPASS
This instruction delivers the input to TDI as an output on TDO delayed by one TCK clock. When this
instruction is loaded, the IR_CNTRL_SIG_RELEASE instruction (see Section 1.2.4.3.3) is performed
simultaneously. After execution of the bypass instruction, the 16-bit data shifted out on TDI does not affect
any register of the JTAG control module of the target MSP430 device.

www.ti.com Interface and Instructions
19
SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
1.2.4.3 Controlling the CPU
The following instructions enable control of the MSP430 CPU through a 16-bit register accessed through
JTAG. This data register is called the JTAG control signal register. Table 1-6 describes the bit functions
making up the JTAG control signal register used for memory access.
Table 1-6. JTAG Control Signal Register for 1xx, 2xx, 4xx Families
Bit No. Name Description
0 R/W Controls the read/write (RW) signal of the CPU
1 = Read
0 = Write
1 (N/A) Always write 0
2 (N/A) Always write 0
3 HALT_JTAG Sets the CPU into a controlled halt state
1 = CPU stopped
0 = CPU operating normally
4 BYTE Controls the BYTE signal of the CPU used for memory access data length
1 = Byte (8-bit) access
0 = Word (16-bit) access
5 (N/A) Always write 0
6 (N/A) Always write 0
7 INSTR_LOAD Read only: Indicates the target CPU instruction state
1 = Instruction fetch state
0 = Instruction execution state
8 (N/A) Always write 0
9 TCE Indicates CPU synchronization
1 = Synchronized
0 = Not synchronized
10 TCE1 Establishes JTAG control over the CPU
1 = CPU under JTAG control
0 = CPU free running
11 POR Controls the power-on-reset (POR) signal
1 = Perform POR
0 = No reset
12 Release low byte Selects control source of the RW and BYTE bits
1 = CPU has control
0 = Control signal register has control
13 TAGFUNCSAT Sets flash module into JTAG access mode
1 = CPU has control (default)
0 = JTAG has control
14 SWITCH Enables TDO output as TDI input
1 = JTAG has control
0 = Normal operation
15 (N/A) Always write 0

Interface and Instructions www.ti.com
20 SLAU320Z–July 2010–Revised July 2017
Submit Documentation Feedback
Copyright © 2010–2017, Texas Instruments Incorporated
Programming Using the JTAG Interface
Table 1-7. JTAG Control Signal Register for 5xx and 6xx Families
Bit No. Name Description
0 R/W Controls the read/write (RW) signal of the CPU, same as previous families.
1 = Read
0 = Write
1 (N/A) Always write 0, same as previous families.
2 (N/A) Always write 0, same as previous families.
3 WAIT Wait signal to the CPU. Read only.
1 = CPU clock stopped - waiting for an operation to complete
0 = CPU clock not stopped
4 BYTE Controls the BYTE signal of the CPU used for memory access data length, same as previous families.
1 = Byte (8-bit) access
0 = Word (16-bit) access
5 (N/A) Always write 0
6 (N/A) Always write 0
7 INSTR_LOAD
Read only: Indicates the target CPU instruction state. The actual state is not the same as previous
families.
1 = Instruction fetch state
0 = Instruction execution state
8 CPUSUSP
Suspend CPU.
The CPU pipeline is emptied by asserting the CPUSUSP bit and driving a minimum number of clocks
required to complete the longest possible instructions. When CPUSUSP is high, no instructions are
fetched or executed. To execute a forced external instruction sequence through JTAG (for example, set
the Program Counter), the CPUSUSP bit must be zero.
0 = CPU active
1 = CPU suspended
Reading CPUSUSP (Bit 8) shows if pipeline is empty:
0 = Pipeline is not empty yet
1 = Pipeline is empty
9 TCE0 Indicates CPU synchronization, same as previous families.
1 = Synchronized
0 = Not synchronized
10 TCE1 Establishes JTAG control over the CPU, same as previous families.
1 = CPU under JTAG control
0 = CPU free running
11 POR Controls the power-on-reset (POR) signal, same as previous families.
1 = Perform POR
0 = No reset
12 RELEASE_LBYTE0 Release control bits in low byte from JTAG control.
00 = All bits are controlled by JTAG if TCE1 is 1
01 = RW (bit 0) and BYTE (bit 4) are released from JTAG control
10 = RW (bit 0), HALT (bit 1), INTREQ (bit 2), and BYTE (bit 4) are released from JTAG control
11 = Reserved
13 RELEASE_LBYTE1
14 INSTR_SEQ_NO0 Instruction sequence number. Read only.
Shows the instruction sequence number of the pipelined CPU currently using the CPU bus (there is a
maximum of three instructions in the pipe).
00 = CPU instruction sequence 0
01 = CPU instruction sequence 1
10 = CPU instruction sequence 2
11 = CPU generated "no-operation" cycle; data on buses is not used
15 INSTR_SEQ_NO1