FTS64K datasheet(36/44 Pages) FREESCALE

36 / 44 page

FTS64K Block User Guide — Version V01.00

WARNING

As active commands are immediately aborted when the MCU enters STOP mode, it is strongly

recommended that the user does not use the STOP command during program and erase execution.

4.4 Background Debug Mode

In Background Debug Mode (BDM), the FPROT registers are writable. If the chip is unsecured then all

Flash commands listed in Table 4-1 can be executed. In special single chip mode if the chip is secured

then the only possible command to execute is Mass Erase.

4.5 Flash Security

The Flash module provides the necessary security information to the rest of the chip. After each reset, the

Flash module determines the security state of the microcontroller as defined in section 3.3.2.

The contents of the Flash Protection/Options byte at $FF0F in the Flash Protection/Options Field must be

changed directly by programming $FF0F when the device is unsecured and the higher address sector is

unprotected. If the Flash Protection/Options byte is left in the secure state, any reset will cause the

microcontroller to return to the secure operating mode

4.5.1 Unsecuring the Flash via the Backdoor Key Access

The microcontroller may only be unsecured by using the Backdoor Key Access feature. This requires

knowledge of the contents of the backdoor keys, four 16-bit words programmed in the Flash at addresses

$FF00 - $FF07. With the KEYEN and KEYACC bits set, a write to a backdoor key address triggers a

comparison between the written data and the backdoor key data stored in the Flash. If all four words of

data are written to the correct addresses in the correct order and the data matches the backdoor keys stored

in the Flash the microcontroller will be unsecured. The data must be written to the backdoor keys

sequentially staring with $FF00-1 and ending with $FF06-7.When the KEYACC bit is set reads of the

Flash array will return invalid data.

The user code stored in the Flash must have a method of receiving the backdoor key from an external

stimulus. This external stimulus would typically be through one of the on-chip serial ports.

If the KEYEN bit is set in the FCNFG register, the flash can be unsecured by the following Back Door

Access Sequence:

Set the KEYACC bit in the Flash Configuration Register FCNFG.

Write the correct four 16-bit words backdoor keys to Flash addresses $FF00 - $FF07 sequentially

starting with $FF00.

Clear the KEYACC bit.

4. If all four 16-bit words match the Flash content, the MCU is unsecured and bits SEC[1:0] in the

FSEC register are forced to the unsecure state, ‘10’.

Freescale Semiconductor, Inc.

For More Information On This Product,

Go to: www.freescale.com

FTS64K Datasheet(PDF) 36 Page - Freescale Semiconductor, Inc