KL03 Mass erase dosen't work

[yasuyukiyamame]

Hello.

I am debugging KL03Z16VTG4 boards (original hardware) using the KDS3.2 and PE ML-UNIVERSAL.

Among the first, they are working correctly, after a while their security is locked, no longer respond to Mass Erase.

The VDD have been supplied  2.90V.
Before the operation becomes incorrect, address 0x400 had written ff, ff, ff, ff, ff, ff, ff, ff, ff, ff, ff, ff, fe, 3b, ff, ff.

I examined the MDM-AP in a different means (J-LINK).
as a result
I've set the "Flash Mass Erase in Progress" bit, but it was not cleared.
Meanwhile MDM-AP Status continues returns 0x36 (System Security = 1, Mass Erase Enable = 1).

I have a question.
In addition to the "Mass Erase Enable", or there is a factor that blocks Mass Erase?

[yasuyukiyamame]

Hi Jorge

I tried them.

1. erase command w/o connect command
-- Start the J-link commander, enter the "erase" command immediately after. --

J-Link>erase
Target connection not established yet but required for command.
Please specify device / core. <Default>: MKL03Z16XXX4
Type '?' for selection dialog
Device>
Please specify target interface:
  J) JTAG (Default)
  S) SWD
TIF>s
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "MKL03Z16XXX4" selected.

Found SWD-DP with ID 0x0BC11477

-- Here in "Protection bytes in flasha at addr..." dialog is open. --
-- When I answer "Yes", it returns the following. --

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never starts.
Kinetis (connect): Failed to unsecure Kinetis device.
Found SWD-DP with ID 0x0BC11477

-- It repeat 7 times. And then, --

ERROR: Erase returned with error code -1.

2. reset pin connection
The reset pin is connected directly to the SWD connector through about 10 mm trace. Any resistor or capacitor is not connected.
Therefore, if the debugger is not connected, the potential of the reset pin is set only by the internal pull-up device.
To make sure, I disconnect the reset pin from the debugger, and was tied directly to VSS. However, the result was the same, could not erase.

If it's a strange behavior as you say, I think these devices are irreversible damage.
For example, incorrect reset signal and, or runaway of the CPU will cause damage to the device (especially in FLASH)?

Yasuyuki

[bishwajeetsah]

Hi Yasuyuki,

Have you found the solution? I am facing the same problem.

Regards,

Bishwa

[jorge_a_vazquez]

Hi Yasuyuki Yamame

How do you have your debug interface?

Please check the next link: http://cache.nxp.com/files/32bit/doc/quick_ref_guide/KLQRUG.pdf , in the chapter 2.1.5 we provide the connections for Serial Wire debugging.

Also, the RESET_b pin, if enabled, should have a 100 nF capacitor close to the MCU for transient protection. The NMI_b pin, if enabled, must not have any capacitance connected to it. Each pin, when enabled as their default function, has a weak internal pullup, but an external 4.7 kΩ to 10 kΩ pullup is recommended.

Please check this and tell me any update of the case.

Have a great day,
Jorge Alcala

[yasuyukiyamame]

Hi Jorge

Yes, that dialog is what I saw.

When I answer "Yes", J-LINK commander returns the following.

-------------------------------------------------------------------------------------

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never starts.

Kinetis (connect): Failed to unsecure Kinetis device.

-------------------------------------------------------------------------------------

This is why I'm in trouble.

Best regards

Yasuyuki

[jorge_a_vazquez]

Hi Yasuyuki Yamame

According to Reference Manual, when mass erase is disabled, the erase request does not occur and the Flash Mass Erase in Progress bit continues assert until the nest system reset. This seems to be your case, because your Flash Mass Erase in Progress bit  doesn't clear, (or because you get a timeout with the unlock kinetis), but your statues says that you have the mass erase enabled. It is a strange behavior that I've never seen. Could you run the "erase" command after you launch the J-link commander (without  specific "connect") and tell me what you get?

Also, this could be a hardware related problem, caused by the reset that doesn't respond or by noise. Could you share the schematic of your Board?

Best Regards

Jorge Alcala

[yasuyukiyamame]

Hi Jorge

I have tried to access MDM-AP with J-Link commander.
The following are results.
-----------------------------------------

J-Link>device MKL03Z16xxx4
J-Link>si 1
Selecting SWD ad current target interface.
J-Link>connect
Device "MKL03Z16XXX4" selected.
Specify target interface speed [kHz]. <Default>: 4000kHz
Speed>
Device "MKL03Z16XXX4" selected.

Found SWD-DP with ID 0x0BC11477

            :
      Then, open dialog few times, it asks whether or not to release the security.
      As J-link Commander does not set the "Flash Mass Erase in Progreass bit", answer "No".
            :

****** Error: Kinetis (connect): Failed to unsecure Kinetis device.

J-Link>r0
J-Link>swdwritedp 2,0x01000000  <- select MDM
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000036  <- Mass Erase Enable (bit5) , SystemSecurity (bit2)
J-Link>swdreadap 1
Read AP register 1 = 0x00000036
J-Link>swdreadap 1
Read AP register 1 = 0x00000000  <- get MDM control
J-Link>swdwriteap 1,0x8
Write AP register 1 = 0x00000008
J-Link>swdwriteap 1,0x9   <- set Flash Mass Erase in Progress (bit0)
Write AP register 1 = 0x00000009
J-Link>swdreadap 1
Read AP register 1 = 0x00000009
J-Link>swdreadap 1
Read AP register 1 = 0x00000009
J-Link>swdreadap 1
Read AP register 1 = 0x00000009
J-Link>swdreadap 1
Read AP register 1 = 0x00000009
J-Link>swdreadap 1
Read AP register 1 = 0x00000009  <- Flash Mass Erase in Progress is never clear
J-Link>swdreadap 0
Read AP register 0 = 0x00000009
J-Link>swdreadap 0
Read AP register 1 = 0x00000036  <- Flash Mass Erase Acknowledge (bit0) is not set

--------------------------------------------------------------------

For reference, the following are results with a clean device.

--------------------------------------------------------------------

J-Link>device MKL03Z16xxx4
J-Link>si 1
Selecting SWD ad current target interface.
J-Link>connect
Device "MKL03Z16XXX4" selected.
Specify target interface speed [kHz]. <Default>: 4000kHz
Speed>
Device "MKL03Z16XXX4" selected.

Found SWD-DP with ID 0x0BC11477
Found SWD-DP with ID 0x0BC11477
Found Cortex-M0 r0p1, Little endian.

     :

     :

     :

Cortex-M0 identified.
J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000032
J-Link>swdreadap 1
Read AP register 1 = 0x00000032
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdwriteap 1,0x8
Write AP register 1 = 0x00000008
J-Link>swdwriteap 1,0x9
Write AP register 1 = 0x00000009
J-Link>swdreadap 1
Read AP register 1 = 0x00000009
J-Link>swdreadap 1
Read AP register 1 = 0x00000008  <- Flash Mass Erase in Progress is clear
J-Link>swdreadap 0
Read AP register 0 = 0x00000008
J-Link>swdreadap 0
Read AP register 0 = 0x00000033  <- Flash Mass Erase Acknowledge (bit0) is set

--------------------------------------------------------------------

I'm sorry, I can not upload my project here.

I've create this project as kinetis 1.x SDK project.
As mentioned above, flash configuration 0x40d was changed to 0x3b.
Macro "CLOCK_SETUP" are left undefined.
PORTA_PCR0..2 remains of default. Other port settings are below.

PORTA_PCR3 = PORT_PCR_MUX (1); // EXTAL0 -> PTA3
PORTA_PCR4 = PORT_PCR_MUX (1); // XTAL0 -> PTA4
PORTA_PCR5 = PORT_PCR_MUX (2); // TPM_CH1
PORTA_PCR6 = PORT_PCR_MUX (1); // PTA6
PORTA_PCR7 = PORT_PCR_MUX (1) | PORT_PCR_PE (1); // PTA7
PORTB_PCR0 = PORT_PCR_MUX (0); // ADC0_SE9 same as default
PORTB_PCR1 = PORT_PCR_MUX (1); // ADC0_SE8 -> PTB1
PORTB_PCR2 = PORT_PCR_MUX (1); // VREF_OUT -> PTB2
PORTB_PCR3 = PORT_PCR_MUX (3); // UART0_TX
PORTB_PCR4 = PORT_PCR_MUX (3); // IART0_RX
PORTB_PCR5 = PORT_PCR_MUX (0); // NMIb -> ADC0_SE1

Best regards

Yasuyuki

[jorge_a_vazquez]

Hi Yasuyuki Yamame

When  "open dialog few times, it asks whether or not to release the security", what exactly is the dialog that appears? It is like this:

If so, please click Yes at the first attend, because it will try to mass erase the internal flash and it should unsecure your device. You don't need to try to trigger a mass erase writing to the  "Flash Mass Erase in Progress" because if you click Yes it will automatically do all of this. Note: you need to click yes in the first attend because if you don't it will cause a error with the communication.

The flash configuration at 0x40D is related with the Flash nonvolatile option register and it shouldn't affect the secure byte, but the 0x40C is the Flash security byte, but you have it with 0xFE value that is mass erase enabled and MCU unsecure.

Please give it a try and let me know any update.
Have a great day
Jorge Alcala

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[jorge_a_vazquez]

Hi Yasuyuki Yamame

Have you tried the Unlock kinetis command and erase the whole device? Segger has a utility named ‘J-Link Commander’, The binary ‘jlink.exe’ is a command line utility.

To unlock the device use the command line "unlock kinetis" and if you want to erase the whole flash you can use the erase command line. Alternatively you can check the link: https://mcuoneclipse.com/2014/10/05/unlocking-and-erasing-flash-with-segger-j-link/

Please give it a try and tell me if you have any question
Have a great day.
Jorge Alcala

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[yasuyukiyamame]

Hi Jorge

Thank you for your fast reply.

I had tried "J-link commander", but unlock Kenetis command returned with...

"Found SWD-DP with 0x0BC11477
Unlocking device...Timeout while unlocking device."

I want to know that, in device specification, whether the possible may not respond to set Flash Mass Erase in Progress bit, when Mass Erase Enable bit has been set.
Because in order to determine whether my devices are broken.

Best regards

Yasuyuki

[jorge_a_vazquez]

Hi Yasuyuki Yamame

You need to have your Mass Erase Enable bit set in order to cause a mass erase with "Flash Mass Erase in Progress". What do you get when you try the "erase" command?

When you said that "I've set the "Flash Mass Erase in Progress" bit, but it was not cleared." How did you check this?

The timeout while unlocking device could be related with a hardware issue, have you checked the pins functions of your interface? Could you share the last project that you load to the device?

Please let me know any update of your issue.
Have a great day
Jorge Alcala

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------