MC9S12GRMV1 Datasheet, PDF (1186/1292 Pages) Freescale Semiconductor, Inc – MC9S12G Family Reference Manual and Data Sheet

240 KByte Flash Module (S12FTMRG240K2V1)
reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the
contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration
field.
31.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM
A secured MCU can be unsecured in special single chip mode by using the following method to erase the
P-Flash and EEPROM memory:
1. Reset the MCU into special single chip mode
2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if
the P-Flash and EEPROM memories are erased
3. Send BDM commands to disable protection in the P-Flash and EEPROM memory
4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM
memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below
are skeeped.
5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the
MCU into special single chip mode
6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that
the P-Flash and EEPROM memory are erased
If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM
commands will now be enabled and the Flash security byte may be programmed to the unsecure state by
continuing with the following steps:
7. Send BDM commands to execute the Program P-Flash command write sequence to program the
Flash security byte to the unsecured state
8. Reset the MCU
31.5.3 Mode and Security Effects on Flash Command Availability
The availability of Flash module commands depends on the MCU operating mode and security state as
shown in Table 31-27.
31.6 Initialization
On each system reset the flash module executes an initialization sequence which establishes initial values
for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT
and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a
fully protected and secured state if errors are encountered during execution of the reset sequence. If a
double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set.
CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a
portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the
initialization sequence is marked by setting CCIF high which enables user commands.
1188
MC9S12G Family Reference Manual, Rev.1.23
Freescale Semiconductor