Most discussions of device access treat the flash programming interface as the only door. On an RX62T there is a second one, and for several kinds of job it is the better choice: the on-chip debug interface, which does not read memory as a mass transfer but attaches to the core, stops it, and looks.

The distinction matters because the two doors are locked differently. The programming interface is gated by an ID code and restricted by a protection setting. The debug interface is gated by nothing at all — until it is disabled, and then it is gone completely.

R5F562T6ADFF#V3 is an RX62T group part: hundred-megahertz core with an FPU, two twelve-bit converter units, six-channel motor timer, QFP-type package field. The version suffix identifies a shipping configuration rather than different silicon, which is worth repeating because the security behaviour of the device is a property of the group and the option bytes, not of the order suffix.

What the two routes give

The fourth row is what makes the debug route worth the trouble. A mass read tells you what the program is. A debug session tells you what it was doing.

Why this matters for a fault, not just a copy

A customer with a unit that fails in the field at one temperature, or after forty minutes, is not asking for the code. They already suspect the code. They want to know which branch was taken, what the converter readings were when it happened, and whether the watchdog fired.

None of that is in the flash. All of it is visible through the debug interface, provided the interface is enabled and the failure is reproducible on a bench.

The pattern that works is well established: attach, let the unit run, set a breakpoint on the fault handler or on the branch that should not be taken, and wait. When it triggers, the register set and the peripheral state are the evidence. That single session is often worth more than a complete disassembly, and it is why a supplier who can offer it is not interchangeable with one who can only deliver a hex file.

What closes the debug door

One setting in the option area disables the debug interface. It is placed there deliberately, because a product shipped with a live debug port can be examined by anyone with a fourteen-pin header and an adapter, and a design that has gone to the trouble of protecting its flash usually does not want that.

When the setting is active, the port does not respond and cannot be re-enabled without a chip erase — which, as on every flash device of this generation, also removes the content. The two mechanisms are the same mechanism viewed twice: the option area is written as part of the flash, so anything that changes it changes the flash.

Two consequences for a quotation. First, the debug route is either available or it is not, and that is determined by reading the option area, which takes a minute. Second, a job specified as “capture the fault” is a different job when the debug port is closed, because it becomes a die-level or an emulation exercise rather than a session.

When the debug route is worse than a mass read

Three situations, and they are not rare.

The unit will not run. A debug session needs a core that executes at least far enough to be halted. A device stuck in reset, or with a dead oscillator, offers nothing to attach to.

The failure is a hardware fault. A shorted output or a failed regulator looks, from the debug port, like a core reading implausible values. The instrument is right and the question was wrong.

The customer needs the image, not the behaviour. A mass read is faster and produces a file that can be compared against an archive; a debug session produces observations. Choosing the slower route because it is more interesting is a common way to spend a customer’s budget.

Recording a debug session

A session that is not recorded is an anecdote. Four items make it evidence.

The configuration, meaning the option-area state, the clock the device was running at, and the point at which the session attached. A failure captured at an unknown clock is not reproducible.

The breakpoint addresses and what they represent, in terms of function or of source line if a listing exists.

The register dump at the halt, complete, including the peripheral registers that the code had been reading.

And the sequence of events leading to the halt, with timestamps, because “it stopped here” is much less useful than “it passed this point eleven times and stopped on the twelfth”.

For the option-area state that decides whether the port is open, R5F562TABDFF program covers the configuration bundle. For the programming-interface route that remains when the debug port is closed, R5F562T6EDFF program deals with boot mode. And for a live-fault capture on a Renesas part of a different generation, RH850 R7F7010124AFP readout shows how the same question is answered there.

FAQ

Is the debug port protected by the ID code? No. The ID code gates the boot-mode protocol. The debug port is either enabled or disabled by a setting.

Can a disabled debug port be re-enabled without erasing? Not on this family. The setting lives in the option area, which is part of the flash.

Does attaching a debugger change the program? Halting the core changes the timing of everything around it. A fault that depends on a real-time deadline may not reproduce under a debugger at all.

The short version

Two doors, two locks. Read the option area first to learn which doors are open, then choose the route by the question: a mass read for an image, a debug session for a behaviour. Record the configuration and the halt state, because a session without them is a story rather than evidence.

Comments are closed.