use freedom board to program custom board

[thiagopalmieri]

Hi,

I am trying to use the freedom board (FRDM-KL43Z) as a debugger/programmer for a custom board.

For that, I have populated the SWD connector header (J11) and cut the trace on jumper J18, which is said to isolate the KL43 on the board from the SWD interface.

When I connect both boards through a cable on the SWD connector, initially I got the "device is secure, unsecure it" dialog. I have enabled the "allways mass erase" on the debug configurations and the dialog does not appear anymore. Now it seems that the board is not recognized by the P&E connection assistant. It recognizes the openSDA USB connection, but is unable to program the custom board.

I am using a test program that works just fine on the FRDM-KL43Z.

The chip on the custom board is brand new.

Cuting the J18 trace, only isolates the clock from the FRDM KL43 from the openSDA interface. May it be possible that the still connected SWD DIO pin is interfering with the communication? Do I need to cut any more traces for that to work? (Maybe the FRDM KL43 power headers J20 and J7, thus disabling the chip??)

Thx

[pgo]

Hi Thiago,

You can use the USBDM TCL interpreter to check the communication with the target and check the security state.

The following is the MDM-AP.Status result for a mass-erased chip.  This is what I would expect from a "factory-fresh" device.

The command prompt is the %

This is what I would expect from a secured device:

The above were done with a FRDM-KL43 since I do not have a separate chip to test with.

If the device is permanently secured the MASS_ERASE_EN option would be missing from the MDM-AP.Status result.

You can also try the unsecure script discussed in the following:

Kinetis KL05 secured ? How to unlock with USBDM ?

An updated script is attached.  Copy this to the USBDM installation directory (e.g. C:\Program Files (x86)\pgo\USBDM 4.11.1.60)

Start the USBDM TCL Interpreter and type the command source UnsecureKL.tcl.  I would expect this result from a secured device:

bye

[thiagopalmieri]

Hello pgo,

The second gif is exactly what I get:

Looking into the thread you have posted... nothing worked. However I have edited the Kinetis klxx flash scripts according to one of the comments and have got the following response:

With the "normal" script all runs equal, but the end....

It seems that for some reason the register is not changing....

QUESTION: Is it normal to wait for soo long for the mass erase??

I decided to measure the reset rise times, after some measurements, (using "reset s h") I can see the reset line starting High going to low and high again, so it seems to be working fine, it is taking 2ms to complete. I don't know if it is good or bad, but since the reset on the FRDM-KL43Z board has the same timing, and it works, I assume that reset is not the problem.

Even though the clock line is disconnected from the freedom board chip, the DIO line is still up... so I will try to completely disable the Chip by cutting J17 and removing R1 and R2 to see what happens.

Do you have any "less invasive" suggestion?

Thank you very much for your support.

[pgo]

Hi Thiago,

Could you run the attached slightly modified script and see it it does any better.

It sets the internal reset request and also reports the MD_AP-Status which might be useful.

The only time I have had anyway similar results was when the power to the chip was incorrect - The main Vdd was not connected properly and chip was actually getting power through the Analogue Vdd supply - It worked OK until the higher current was needed for erasing the Flash.  This is very much clutching at straws!

You have indicated that you have good supply by-pass and such but it still might be useful to put a oscilloscope on the Vdd and Ground pins while the erase is under way to see if anything exciting is happening :smileyhappy:.

The rise and fall time on the reset would not have much affect I would think - They are similar on the board I tested.

good luck

PS. You might want to read through AN4835 - In particular section 6 which mentions some reasons why the erase might fail.

http://cache.freescale.com/files/microcontrollers/doc/app_note/AN4835.pdf

bye

[thiagopalmieri]

No luck.....

The VDD line is rock solid it does not even oscilate during programming...

OMG, this is so frustrating....it doesn't matter what I do, that SECURE remains there.....

I have already looked into the document you mention, nothing there that could help....

I have found a image called OpenSDAMassEraseKinetis.sx, found a txt explaining how to use it and tried..... even though the MK20 LED blink on the pattern indicating success, according to the TXT (Long on, short off) the chip insists in staying on SECURE.

It looks like the chip is refusing to mass erase, even though SWD reports it as enabled.....

Next action, replace the Chip or prepare a new board !

[pgo]

Hi Thiago,

There is no need to cut any other track apart from the SWCLK associated with J18.

Cutting other tracks will render the board useless for its original purpose although that may not be important to you.

Do not cut the power to the target chip as it will still load the SWDIO and RESET pins.

However, it is important to program the on-board KL43 with a harmless program that does not have issues with the watchdog or illegal instructions.

An erased chip is NOT suitable as it will often have reset issues and affect the reset pin.

Program the dummy program with the link J18 jumpered.

I have tested a FRDM-KL43 board with USBDM and it seems to work fine.

There is one further issue - The original OpenSDA code was tied to the actual target CPU on the FRDM board - It could not be used to program an external target.  I am unsure if this limitation still applies.

You may use USBDM or, I believe OpenOCD but I have not used the latter.

USBDM: USBDM-FRDM - USBDM Debugger based on Freescale FRDM-xxxx board

A suitable dummy program for KL43 is attached.

bye

[thiagopalmieri]

Hello pgo,

I've tried your solution, but I am unable to do anything on the external Chip. The USBDM complains that it is SECURED..... on the FRDM-KL43Z chip it works as expected.

I have another topic covering this issue ( https://community.freescale.com/message/523225?et=watches.email.thread#523225 ) but so far I am unable to unsecure it with any tool I have here....

Tried with the OLIMEX JTAG, openSDA, USBDM.... none of them worked...

Is it possible that a brand new chip came secured with mass erase disabled??? What is the meaning for that?

Do you have any "special trick" with USBDM that I may try to unsecure it?

Freescale should rethink this whole kinetis secure procedure....

Thx

[pgo]

Hi Thiago,

Can you :

• Provide the circuit you are using with the external chip?
• Details about the cable being used
• What is the external chip? (KL43?)

For reference the following is an minimalistic circuit that I used to test an external KL05:

This worked OK with "factory fresh" chips.

There doesn't seem to be much room for error :smileyhappy:.

bye

[thiagopalmieri]

Hello pgo,

1. The circuit is exact the same as the freedom board for the KL43 MCU (page 3), I have just removed the touch interface, the two buttons and the LEDs/LCD. I have added a button to NMI, so I can boot in bootloader mode when needed and there is no reset button (reset has a 10k pull up with a grounded 100nF cap and is connected to SWD connector). USB interface is the same and all VDD caps are present.

2. I am using the cable from the OLIMEX JTAG, which is a ribbon cable with a 2x5 0.05'' connector on each side (pin 1 to pin 1 and so on...)

3. Yes it is for the same chip as FRDM-KL43Z, a MKL43Z256.

It is really frustrating, I replaced the Freedom board chip (it was burned) and it is working as expected, however this one appears as SECURED, doesn't matter what I do....

[VictorLorenzo]

Hi Thiago,

Yes, you will need to effectively isolate the SWD interface in the freedom board. This is done by cutting both the SWD_CLK and SWD_IO lines to the target Kinetis. MCU. Make sure you cut the lines AFTER the SWD header, NOT before.

You should also check for possible power source P3V3 contentions (local power supply on your board and freedom board power supply).

It could be a good idea to prepare a small adaptor board with 22R current limiting resistors in series for the SWD lines. If your board works with 5V0 you will definitively need a voltage limiting circuit in the SWD lines at freedom board's side (series resistor + reverse biased diode to P3V3 + reverse biased diode to GND).

Regards, Victor