2405851_en-US

Yes

MPC5748G on SJA1105SMBEVM: code flash reads return address instead of data; RAM/peripherals OK

Hi,

I have an SJA1105SMBEVM evaluation board (MPC574xB/C/G + SJA1105P/Q/R/S Gateway Evaluation Kit, purchased via Digi-Key as 568-SJA1105SMBEVM-ND). The onboard MPC5748G appears to have non-functional code flash. I would like a sanity check on the diagnosis below, and to know whether there is a documented recovery procedure before I pursue an RMA.

SYMPTOM

The board has never executed its factory firmware since unboxing. The "Alive" LED D3 (AH1721 section 5.4) has never blinked, and in fact no LED on the board has ever blinked.

Programming the sja1105smbevm_tc10example example project with S32DS for Power Architecture v2.1 and a PEmicro USB Multilink Universal hangs indefinitely at:

Programming sequency is : erase, blank check, program, and verify {default}

CMD>VC

Verifying object file CRC-16 to device ranges ...

block 00FA0000-00FA0003 ...

It never advances past this point (observed for more than 14 minutes). Note that 00FA0000-00FA0003 is only 4 bytes (the RCHW), and CMD>VC is a pre-check that runs before erase, so this is failing on the very first flash read of the session.

ALREADY RULED OUT

- J6 jumper: board shipped with no jumper installed, so the regulators shut down about 21 s after power-up (AH1721 section 6.4). Fixed with a jumper on pins 2-3. The board now stays powered indefinitely. D3 still never blinks.

- PEmicro probe firmware: was configured for ARM rather than Qorivva MPC5xxx / ST SPC5xxx. Corrected with PEFirmwareConfig.exe, now firmware 11.52 with the correct architecture. This did resolve a separate "Error during blank check" dialog, which no longer occurs, but it did not resolve the flash read failure.

- Semihosting disabled in the launch configuration.

- Debug Shift Freq lowered from 5000 to 1000 KHz, reset delay raised to 500 ms, JTAG ribbon reseated on Port A / J10.

- Censorship: PEmicro reports no censorship and enters In-Circuit Debug mode normally.

DIAGNOSTICS WITH S32DS BYPASSED

Driving pegdbserver_power_console.exe directly and probing memory with powerpc-eabivle-gdb.

Connection is clean:

P&E Interface detected - Flash Version 11.52

Device IDCODE is $00000082

Starting reset script (s32e200_mpc574xg.mac) ...

Initializing RAM from $40000000 to $400BFFFF.

Reset script completed.

MPC574xG Device detected.

Device is mpc5748g.

Mode is In-Circuit Debug.

Memory probe results:

=== RAM write/readback @ 0x40001000 (wrote 0xDEADBEEF) ===

0x40001000: 0xdeadbeef <- OK

=== SIUL2 MIDR1 @ 0xFFFC0004 ===

0xfffc0004: 0x57483020 0x42004700 <- PARTNUM 0x5748, OK

=== code flash ===

0xfa0000: 0x00fa0000 0x00fa0004 0x00fa0008 0x00fa000c

0xfa0010: 0x00fa0010 0x00fa0014

0xf90000: 0x00f90000 0x00f90004 0x00f90008 0x00f9000c

0x1000000: 0x01000000 0x01000004

Every flash word reads back as its own address. That is not data, and not 0xFFFFFFFF as erased flash would read. RAM writes/reads, peripheral reads, and register reads all work correctly.

The addresses tested are the ones from the example project's own linker script (Project_Settings/Linker_Files/linker_flash.ld):

flash_rchw : org = 0x00FA0000, len = 0x4

FLASH_BASE_ADDR = 0x01000000

SRAM_BASE_ADDR = 0x40000000

This appears to explain both symptoms. At reset the BAM fetches the RCHW from 0x00FA0000 in hardware, with no debugger involved, reads garbage, finds no valid boot header, and never starts application code. And blank check / CMD>VC are both flash reads, so programming fails.

QUESTION

Is there a documented recovery procedure for an MPC5748G in this state, for example a mass erase or flash controller re-initialization that does not require a preceding flash read? S32DS always performs the verify read first, which is the operation that hangs, so I have not been able to attempt a bare erase. If a standalone tool is the correct approach (PROGPPCNEXUS?), please advise.

Otherwise, should this board be treated as defective?

Thanks.

Re: MPC5748G on SJA1105SMBEVM: code flash reads return address instead of data; RAM/peripherals OK

Hello,

Since you are able to read flash, I expect that device is good.

Try to load simple example and debug it. For example one of these:

https://community.nxp.com/t5/MPC5xxx-Knowledge-Base/MPC5-software-example-list/ta-p/1102445#MPC5748G

If no boot header is found in any of the locations mentioned above, the BAF determines
the Life Cycle status of the device. If the Life Cycle is in CUST_DELIV (Customer
Delivery) or MCU Production, it attempts a serial boot. Otherwise, the boot has failed
and BAF issues a destructive reset

Best regards,

Peter

Re: MPC5748G on SJA1105SMBEVM: code flash reads return address instead of data; RAM/peripherals OK

Unable to read flash.

Downloaded Example_MPC5748G_FlexCAN_RXFIFO_SDK303.zip, but the project fails to compile in S32DS.

Used Claude to setup a simple "blinky" project that runs from RAM. That loaded to the target board and ran just fine. Then created a debug config to run from flash. Launch stops at 98%. Same exact issue as "sja1105smbevm_tc10example". Debug launch hangs while trying to read from flash. Last messages in console tab:

Loading programming algorithm ...
Done.
Programming sequency is : erase, blank check, program, and verify {default}
CMD>VC
Verifying object file CRC-16 to device ranges ...
block 00FA0000-00FA0003 ...

Claude concludes:

You now have about as thorough a diagnosis as you can get without opening the chip:

- Probe, JTAG, reset, SRAM, clocks, pin mux, GPIO, UART, FreeRTOS scheduling, standalone RAM execution — all confirmed fully healthy (including running untethered from the debugger)
- Flash programming hangs at the exact same address (0x00FA0000), every time, regardless of image size or content
- Not a security/censorship lock (ruled out directly via PEmicro console — no secured-device warning)

My conclusion:

Hardware is defective. RETURNING.