Chapter 27 512 KByte Flash Module (S12XFTM512K3V1)
MC9S12XE-Family Reference Manual , Rev. 1.13
1142
Freescale Semiconductor
The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will
prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method
to re-enable the Verify Backdoor Access Key command.
After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is
unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be
reprogrammed to the unsecure state, if desired.
In the unsecure state, the user has full control of the contents of the backdoor keys by programming
addresses 0x7F_FF00–0x7F_FF07 in the Flash conguration eld.
The security as dened in the Flash security byte (0x7F_FF0F) is not changed by using the Verify
Backdoor Access Key command sequence. The backdoor keys stored in addresses
0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the
next reset of the MCU, the security state of the Flash module is determined by the Flash security byte
(0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and
erase protections dened in the Flash protection register, FPROT.
27.5.2
Unsecuring the MCU in Special Single Chip Mode using BDM
The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by
one of the following methods:
Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM,
send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the
Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory.
Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash
memory and run code from external memory to execute the Erase All Blocks command write
sequence to erase the P-Flash and D-Flash memory.
After the CCIF ag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into
special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to
verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as
erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may
be programmed to the unsecure state by the following method:
Send BDM commands to execute a word program sequence to program the Flash security byte to
the unsecured state and reset the MCU.
27.5.3
Mode and Security Effects on Flash Command Availability
The availability of Flash module commands depends on the MCU operating mode and security state as
27.6
Initialization
On each system reset the flash module executes an initialization sequence which establishes initial values
for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the
FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module