Reprogamming MC9S08PA16 after issuing backdoor unlock sequence

[jonascalifornia]

Hi All,

My desired outcome is to reprogram a secure MC9S08PA16 without overwriting the data stored in EEPROM. To do so, I am first sending a backdoor key to temporarily unsecure the device, and I've verified that the MC9S08PA16 is successfully unlocked (NVM_FSEC = 190) after receiving the backdoor key. However, when I connect the USB Multilink and click program, I still get a "Device is Secure" Message. Any recommendations?

Jonas

[tonyp]

Backdoor unlocking only lasts until the next reset of the MCU.  Are you sure your programmer does not first reset the MCU before attempting to program it?  You need to find the mode (or other programmer) that allows hot syncing with the MCU while the app is running, and be able to program without causing any reset from start to finish.

But, a better approach is to have an always-present tiny bootloader that has the task of loading your application.  I think this approach is much easier and safer against 'bricking'.

[pablo_slavkin]

Hi Tony, Actually my case is not exactly the same problem as Jonas, but very similar. I'm developing my own bootloader to achive the setup you suggested. In the middle I tested my 'mass_erase' function, and it works! but now I've a bricked all erased uC and I can't program it anymore 'cose it's 'secured' . My function didn't program 0xFE at FF7F to unsecure the device until it 'died'...So my programmer connect the IC but when it try to save a byte in RAM (yes, not in flash, even in RAM) return error. I tried with codewarrior, Hiwave, and two different usb programmer, and other things like customize the flash algorithm...but nothing... I can't modify a bit in RAM. What do you said?? The flash algorithm try to un-secure the device modifying the RAM registers but apparently it don't care...thanks for your time

[tonyp]

Since I've never used this part, I don't know if there are any significant differences in the flash programming of the PA series as compared to most other S08 members, but IIRC (it's been a long while since I last visited my Flash programming code) you cannot mass-erase if any part of your Flash is protected.  So, if you already have a bootloader loaded, the Flash memory it occupies normally should be protected to avoid the possibility of the bootloader itself being erased, intentionally or accidentally.  Which, in turn, means that you can not use the mass-erase operation from within your application; rather, you must erase each of the remaining pages separately.  Or, use BDM to mass erase.

I do not understand why you cannot use a programmer (like USBDM, CyclonePRO, etc.) to completely reprogram your MCU.  A quick look at the PA manual shows the procedure to follow (see 4.5.2.7.2 Unsecuring the MCU using BDM).

If this is what you do (pay special attention to step #5), and it still doesn't work, then I'm afraid only Freescale can give you an answer, e.g., mask errata.

[pablo_slavkin]

Hi Tony: Yes, all the PA/PT series has a lot of differences with respect

to the others 9s08 members... in fact the flash module is completely

new... it's the same as the kinetis series or similar... so I'm having these

surprises..

by the way it's very superior in performance. take a look.

My bootloader has not any flash protection sector yet and it has the

'kill_myself" buttom.. so I do mass_erase from itself (after copy some

code to RAM) and after that I never could modify any bit even in RAM

using the USB p&E multilink ..

The bootloadr alsa can erase sector by sector and I do it alse, erase

all the app, to upload a new one and it works!, but I can't never

reprogram the bootloader!! becose I didn't made a function to unsecure

the IC.. I'm working in another IC to test that.. but I need to know how

to recover from a simple mass erase!!...

The programmer do enter in BKGD mode bu I could only monitor RAM and

registers, I can't modify anything, nor even RAM. So when I tried to

upload the flash algorithms tu upload the app, the HIWAVE / codewarrior

"flash image" fails...

I'm making support with David at Freescale, but I guess he don't know

how to solve that..or he could't interpret the problem at all...

Until now I guess you could support Frescale costumers better..

--

Saludos cordiales.

Pablo Slavkin

Dto. de ventas

(0054 11) 4962-6373

15-6243-3463

ventas@disenioconingenio.com.ar

www.disenioconingenio.com.ar

msn / skype:    pslavkin

[pablo_slavkin]

Hi, Jonas. I've the same problem. Two IC bricked. After made mass erase function from inside my code I'd not connect the IC anymore. I'm shuer the problem is that FF7F address have 0xFF, and it means secure.. I guess it needs to have 0xFE.. but if I can't connect it anymore, I can't solve it... so I guess it's dead.. but I can't receive an official answ from freescale.. if I figure it out, I'll post . bye