![](http://datasheet.mmic.net.cn/370000/P9S12XEP100J1VVLR_datasheet_16728329/P9S12XEP100J1VVLR_914.png)
Chapter 23 1024 KByte Flash Module (S12XFTM1024K5V2)
MC9S12XE-Family Reference Manual , Rev. 1.07
914
Freescale Semiconductor
2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the
SEC[1:0] bits in the FSEC register are forced to the unsecure state of 1:0
TheVerifyBackdoorAccessKeycommandismonitoredbytheMemoryControllerandanillegalkeywill
prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method
to re-enable the Verify Backdoor Access Key command.
After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is
unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be
reprogrammed to the unsecure state, if desired.
In the unsecure state, the user has full control of the contents of the backdoor keys by programming
addresses 0x7F_FF00–0x7F_FF07 in the Flash configuration field.
The security as defined in the Flash security byte (0x7F_FF0F) is not changed by using the Verify
Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00 –
0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of
the MCU, the security state of the Flash module is determined by the Flash security byte (0x7F_FF0F).
The Verify Backdoor Access Key command sequence has no effect on the program and erase protections
defined in the Flash protection register.
23.5.4
Unsecuring the MCU in Special Single Chip Mode using BDM
The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by
one of the following methods:
Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM,
send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the
Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory.
Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash
memory and run code from external memory to execute the Erase All Blocks command write
sequence to erase the P-Flash and D-Flash memory.
After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into
special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to
verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as
erased and the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte
may be programmed to the unsecure state by the following method:
Send BDM commands to execute a word program sequence to program the Flash security byte to
the unsecured state and reset the MCU.
23.6
Initialization
On each system reset, the Flash module executes the Flash reset sequence, consisting of the core hold
phase followed by the core active phase, to initialize the Flash module. During the Flash reset sequence,
the D-Flash block and buffer RAM are not accessible until the CCIF flag in the FSTAT register is set.