S32K144 Board does not boot/cannot connect SWD after flashing with Cyclone image.

[lucianomoretti]

I have two S32K144 based boards that we've been working with for the past month and have flashed multiple times. We attempted to program a newly created image with a Cyclone programmer and both targets fail to boot after flash and we're unable to connect to them after the download.

Both targets appeared to program with the Cyclone but immediately after did not boot into the firmware as expected and we are unable to get a SWD connection to the boards using the Cyclone programmers, getting the error $00000007.

I've attempted to connect lowering the shift frequency and adding a delay after reset.

I've attempted to use the PE Micro Kinetis Recovery Tool with no success.

I'm not sure what caused the issues or how to recover. Any assistance isolating the cause and any potential recovery techniques would be appreciated.

[danielmartynek]

Hello @lucianomoretti,

Can you please scope the reset_b pin (PTA5)?

Does the MCU keep resetting?

If so, what is the period of the reset events?

Do you use CSEc in the application?

Thank you,

BR, Daniel

[lucianomoretti]

Wow! Yes, the reset line is pulsing every ~113us without a debugger attached when powered up.

As far as I know the application does not use CSEc. It does use the D-Flash region as an emulated EEPROM.

[lucianomoretti]

I scoped the reset line while trying to communicate with the debugger and while the probe is accessing the system the reset line remains low.

[danielmartynek]

Hi,

Can you please connect the reset_b pin to VSS and power cycle the MCU so that the MCU can stay in reset after POR?

Then read the MDM-AP Status register and try the Unlock Kinetis command in J-link commander.

If the unlock command is successful, try loading an S32K144 example from the S32DS IDE.

J-Link>r0                      // pull reset pin low

J-Link>swdwritedp 2,0x01000000 // MDM_AP status register

J-Link>swdreadap 0      // Read MDM_AP status register
J-Link>swdreadap 0      // Read MDM_AP status register (has to be done 2x) Flash memory ready and Mass erase enable bits should be set

J-Link>swdreadap 1      // Read MDM_AP control register
J-Link>swdreadap 1      // Read MDM_AP control register (has to be done 2x) 

J-Link>unlock Kinetis   // Erase and unsecure the MCU
 ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Thank you,

Daniel

[lucianomoretti]

Sorry, missed the jumper reset_b to VSS instruction.

Is the reset_b the same as reset (PTA5)? I couldn't find another reference to it in the IO signal Table.

When I do that I get the following:

J-Link>r0
RESET (pin 15) high, but should be low. Please check target hardware.
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000 ***ERROR
J-Link>

[danielmartynek]

Hi @lucianomoretti,

Yes, PTA5 is reset_b.

Did you connect it to VSS (ground) or VDD?

BR, Daniel

[lucianomoretti]

I connected to VDD, not VSS. I tried again connecting to VSS and got the following:

J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000 ***ERROR
J-Link>

[danielmartynek]

@lucianomoretti 

I haven't met this kind of error.

Can you show the whole log from the commander?

BR, Daniel

[lucianomoretti]

Unfortunately, as we needed to keep moving forward we swapped the dead chip out for a new one. So far we have been successfully programming the device with new images.

If you want the chip for analysis I could probably get it shipped to someone but it's currently not on a PCB.

[danielmartynek]

Hi @lucianomoretti,

Unfortunately, this is out of my responsibility.

The only option to initiate a failure analysis is to contact your point of sales.

https://www.nxp.com/company/about-nxp/quality/product-analysis:QUALITY_PRD_ANALYSIS

Regards,

Daniel

[lucianomoretti]

J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000 ***ERROR

Didn't like that.

[danielmartynek]

Hi @lucianomoretti,

That means the MCU is reset as soon as it is released from the previous reset.

The core probably detects an fault exception (leading to core_lookup reset) during the start_up routine.

It could be because the last loading failed and the flash was left blank or because a wrong image was loaded.

I'm not sure what the error code means, do you have any other debugger/programmer?

BR, Daniel

[lucianomoretti]

I've got a J-Link as well as the PE micro programmer (which can be used as a debugger).

I've tried connecting using the J-Link and J-Flash but it pulls up the popup stating that the "Protection bytes in flash addr. 0x400-0x40F indicate that readout protection is set" and trying to clear it does not work. 

Application log started
 - J-Flash V6.94d (J-Flash compiled Feb 12 2021 15:53:19)
 - JLinkARM.dll V6.94d (DLL compiled Feb 12 2021 15:52:57)
Reading flash device list [C:\Program Files (x86)\SEGGER\JLink\ETC/JFlash/Flash.csv] ...
 - List of flash devices read successfully (451 Devices)
Reading MCU device list ...
 - List of MCU devices read successfully (8145 Devices)
Opening project file [C:\Users\DEVELOP-LLC\MCM_S32.jflash] ...
 - Project opened successfully
No data file specified!
Failed to open data file [C:\Users\DEVELOP-LLC\]...
Connecting ...
 - Connecting via USB to probe/ programmer device 0
 - Probe/ Programmer firmware: J-Link V11 compiled Feb  4 2021 12:59:17
 - Device "S32K144 (ALLOW SECURITY)" selected.
 - Target interface speed: 4000 kHz (Fixed)
 - VTarget = 5.019V
 - InitTarget() start
 - InitTarget()
 - Device will be unsecured now.
 - Timeout while unsecuring device. Erase never stops.
 - InitTarget() end
 - Found SW-DP with ID 0x2BA01477
 - DPIDR: 0x2BA01477
 - Scanning AP map to find all available APs
 - AP[2]: Stopped AP scan as end of AP map has been reached
 - AP[0]: AHB-AP (IDR: 0x24770011)
 - AP[1]: JTAG-AP (IDR: 0x001C0000)
 - Iterating through AP map to find AHB-AP to use
 - AP[0]: Skipped. Could not read CPUID register
 - AP[1]: Skipped. Not an AHB-AP
 - InitTarget() start
 - InitTarget()
 - Device will be unsecured now.
 - Timeout while unsecuring device. Erase never stops.
 - InitTarget() end
 - Found SW-DP with ID 0x2BA01477
 - DPIDR: 0x2BA01477
 - Scanning AP map to find all available APs
 - AP[2]: Stopped AP scan as end of AP map has been reached
 - AP[0]: AHB-AP (IDR: 0x24770011)
 - AP[1]: JTAG-AP (IDR: 0x001C0000)
 - Iterating through AP map to find AHB-AP to use
 - AP[0]: Skipped. Could not read CPUID register
 - AP[1]: Skipped. Not an AHB-AP
 - ERROR: Could not find core in Coresight setup
 - ERROR: Failed to connect.
Could not establish a connection to target.