How to unlock the S32K144

[tpcom]

After power on, the reset pin of S32K144EVB-Q100 is always low. Then run the following command. Please suggest how to unlock this MCU.

========================================================

SEGGER J-Link Commander V7.80d (Compiled Oct 4 2022 16:42:18)
DLL version V7.80d, compiled Oct 4 2022 16:40:52

Connecting to J-Link via USB...O.K.
Firmware: J-Link V9 compiled Dec 13 2022 11:14:50
Hardware version: V9.20
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 25960721
License(s): RDI, GDB, FlashDL, FlashBP, JFlash
VTref=3.540V

Type "connect" to establish a target connection, '?' for help
J-Link>device S32K144
J-Link>si swd
Selecting SWD as current target interface.
J-Link>speed 4000
Selecting 4000 kHz as target interface speed
J-Link>connect
Device "S32K144" selected.

Connecting to target via SWD
InitTarget() start
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while unsecuring device. Erase never stops.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while unsecuring device. Erase never stops.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

InitTarget() start
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while unsecuring device. Erase never stops.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while unsecuring device. Erase never stops.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

Cannot connect to target.
J-Link>SWDWriteDP 2 0x010000F0
Write DP register 2 = 0x010000F0
J-Link>SWDReadAP 3
Read AP register 3 = 0x00000000
J-Link>SWDReadAP 3
Read AP register 3 = 0x001C0000
J-Link>SWDWriteDP 2 0x01000000
Write DP register 2 = 0x01000000
J-Link>SWDWriteAP 1 0x01000001
Write AP register 1 = 0x01000001
J-Link>SWDWriteDP 2 0x01000000
Write DP register 2 = 0x01000000
J-Link>SWDReadAP 0
Read AP register 0 = 0x001C0000
J-Link>SWDReadAP 0
Read AP register 0 = 0x00000024
J-Link>

========================================================

[Senlent]

Hi@tpcom

please refer the document below.

https://community.nxp.com/t5/S32K-Knowledge-Base/Tips-and-Links/ta-p/1113497 

S32K1xx系列MCU应用指南之芯片锁死(lockup)复位原因分析与恢复方法详解

[tpcom]

Thank you for your reply. I read the materials in detail and found that flash was occasionally ready（Read AP register 0 = 0x0000002E）, which made it impossible to erase and unlock. What causes flash to be unprepared?

SEGGER J-Link Commander V7.82 (Compiled Oct 13 2022 13:39:13)
DLL version V7.82, compiled Oct 13 2022 13:37:46

Connecting to J-Link via USB...O.K.
Firmware: J-Link V9 compiled Dec 13 2022 11:14:50
Hardware version: V9.20
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 25960721
License(s): RDI, GDB, FlashDL, FlashBP, JFlash
VTref=3.114V

Type "connect" to establish a target connection, '?' for help
J-Link>r0
J-Link>si 1
Selecting SWD as current target interface.
J-Link>swdselect
Select SWD by sending SWD switching sequence.
Found SWD-DP with ID 0x2BA01477
J-Link>swdwritedp 2, 0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 1
Read AP register 1 = 0x00000024
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x0000002E
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x0000002E
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x0000002E
J-Link>swdreadap 0
Read AP register 0 = 0x00000034
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>swdreadap 0
Read AP register 0 = 0x00000024
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...Timeout while unlocking device.
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...Timeout while unlocking device.
J-Link>

[Senlent]

我没有仔细比对你的AP寄存，不知道你有没有disable mass erase

最简单的方法测量一下复位波形，先确认可不可以恢复（可以参考文章最后），如果可以恢复，这种情形可以通过hold 复位引脚再执行mass erase,你可以找一下Kinetis_Recovery_Utility，论坛里面应该有，再执行mass erase. 

[tpcom]

非常感谢您的支持。