Thx David:
I did more test, pls check the picture below.

My firmware will locked in IVOR6_Vector when i set data to location 0x0.
Erase seems to be the same, when i set 0xFFFFFFFF to location 0x0, it will be locked, but if i set 0xFFFFFFFF to other location, eg. 0x10, B0F0 block can be erased.
Is address (0x0) protected?
Do you have any other hints?
Thx again .
Hawk.