KW45B41Z83 Fuse Program Failed

[Xcj]

Hello, NXP Engineer
I am currently developing a program for burning FUSE and SB3 files via a serial tool. I encountered an issue: when burning FUSE(0x1F and 0x20) through the UART interface, after performing a voltage boost (SetProperty) and waiting for 1 second, I send the FUSE burning command, but the chip does not respond. At this point, the chip status is already abnormal. If I attempt to burn the FUSEs again, it may succeed or fail (the chip returns 0x01). What could be the possible causes of this problem?
Below is the waveform data when the failure occurs, as shown in the figure:

ALL:

1.SetProperty:

2.Send 0x5A,0xA6:

3.Write FUSE:

Thanks!

[luis_maravilla]

Hello

Fuses 0x1F [CUST_PROD_OEMFW_AUTH_PUK] and 0x20 [CUST_PROD_OEMFW_ENC_SK] are encryption keys, also known as RoTKTH and SB3KDK.

You can find this information in Chapter 15.2.1 and Table 55 in KW45 Refence Manual

The RoTKTH and SB3KDK fuses play a critical role in securing KW45 devices during the boot process.

Both fuses are one-time programmable and must be carefully configured during production, as incorrect values can permanently affect device behavior or prevent secure boot.

For the KW45B41Z-EVK board, NXP provides the default keys, However, for the KW45 chip received from the factory, by default, the SBKDK and RoTKTH keys in the fuse are null.

In the AN14158: Debug Authentication on KW45/K32W148 | NXP Semiconductors Chapter 7.2.1 you can see the command to program these fuses for enter OEM secure world closed state.

If you are trying to fuse KW45 chips from factory; I would strongly recommend following the instructions in AN14003: Programming the KW45 flash for Application and Radio firmware via Serial Wire Debug during ...

A very important question is; The KW45 chips are destined to operate same as the KW45B41Z-EVK? If that’s the case, you can use the default Keys for RoTKTH and SB3KDK described in chapter 5.2.1 [AN14003].

Best Regards

Luis

[Xcj]

Hi Luis

Could you first check if there is an issue with the method I am using to enter ISP mode?
My current procedure for entering ISP mode is as follows:
1.Supply 3.3V to VCC.
2.After maintaining power for 200ms, pull the Reset and PTA4 pins of the chip high.
3.After maintaining this for 5ms, pull the Reset pin low and maintain for 1000ms.
4.Pull the Reset pin high and maintain for 2000ms.
5.Use the tool to send 0x5A, 0xA6 three times consecutively. The chip returns correct responses for the latter two attempts.@luis_maravilla 

Best Regards

Xcj

[luis_maravilla]

Hello,

In the MCUXpresso SDK documentation indicates that the process for entering ISP mode in KW45 custom board is Short the BOOT_CFG pin[PTA4] to VDD while reset.

For more information about this please refer to: How to set the board to the Bootloader ISP mode — MCUXpresso SDK Documentation

Sending the 0x5A, 0xA6 [Also known as ping packet] is a way to confirm the UART transmission; After the bootloader detects the ping packet (0x5A 0xA6) on UARTn_RX, the bootloader firmware executes the autobaud sequence.

For more information about this please refer to: UART peripheral — MCUXpresso SDK Documentation

Best Regards

Luis

[Xcj]

Hi Luis
The RoTKTH and SB3KDK parameters I am using are set to their default values, which have been flashed onto the blank board. I have reviewed the document you mentioned, but found no information specifying the conditions under which the chip would become unresponsive when writing to the FUSE. As for the post-loading method via SWD, it has not been verified yet.
Currently, my solution is to program the FUSE via UART. Could you let me know which document contains the detailed programming process?
Best Regards
Xcj