MM912H634DM1AER2 Freescale Semiconductor, MM912H634DM1AER2 Datasheet - Page 297

• Manufacturer Part Number: MM912H634DM1AER2
• Description: 16-bit Microcontrollers - MCU 64KS12 LIN2XLS/HS ISENSE
• Manufacturer: Freescale Semiconductor

Specifications of MM912H634DM1AER2

• Rohs: yes
• Core: HCS12
• Processor Series: MM912F634
• Data Bus Width: 16 bit
• Maximum Clock Frequency: 20 MHz
• Program Memory Size: 32 KB
• Data Ram Size: 2 KB
• On-chip Adc: Yes
• Operating Supply Voltage: 5.5 V to 18 V
• Operating Temperature Range: - 40 C to + 105 C
• Package / Case: LQFP-48
• Mounting Style: SMD/SMT
• A/d Bit Size: 10 bit
• A/d Channels Available: 15
• Interface Type: SPI
• Maximum Operating Temperature: + 105 C
• Minimum Operating Temperature: - 40 C
• Number Of Programmable I/os: 15
• Number Of Timers: 1
• Program Memory Type: Flash
• Supply Voltage - Max: 18 V
• Supply Voltage - Min: 5.5 V

Functional Description and Application Information
4.36.5.3
In background debug mode (BDM), the FPROT register is writable. If the MCU is unsecured, then all Flash commands listed in
Table 383
be executed.
4.36.6
The Flash module provides the necessary security information to the MCU. During each reset sequence, the Flash module
determines the security state of the MCU as defined in
The contents of the Flash security byte in the Flash configuration field (see
programming the Flash security byte location, when the MCU is unsecured and the sector containing the Flash security byte is
unprotected. If the Flash security byte is left in a secured state, any reset will cause the MCU to initialize into a secure operating
mode.
4.36.6.1
The MCU may be unsecured by using the backdoor key access feature, which requires knowledge of the contents of the
backdoor keys (see
bit is set, a write to a backdoor key address in the Flash memory triggers a comparison between the written data and the backdoor
key data stored in the Flash memory. If all backdoor keys are written to the correct addresses in the correct order, and the data
matches the backdoor keys stored in the Flash memory, the MCU will be unsecured. The data must be written to the backdoor
keys sequentially. Values 0x0000 and 0xFFFF are not permitted as backdoor keys. While the KEYACC bit is set, reads of the
Flash memory will return valid data.
The user code stored in the Flash memory must have a method of receiving the backdoor keys from an external stimulus. This
external stimulus would typically be through one of the on-chip serial ports.
If the KEYEN[1:0] bits are in the enabled state (see
key access sequence described below:
The backdoor key access sequence is monitored by an internal security state machine. An illegal operation during
the backdoor key access sequence will cause the security state machine to lock, leaving the MCU in the secured
state. A reset of the MCU will cause the security state machine to exit the lock state and allow a new backdoor key
access sequence to be attempted. The following operations during the backdoor key access sequence will lock the
security state machine:
After the backdoor keys have been correctly matched, the MCU will be unsecured. Once the MCU is unsecured, the Flash
security byte can be programmed to the unsecure state, if desired.
In the unsecure state, the user has full control of the contents of the backdoor keys by programming the associated addresses
in the Flash configuration field (see
Freescale Semiconductor
1.
2.
3.
4.
1.
2.
3.
4.
5.
6.
Set the KEYACC bit in the Flash configuration register (FCNFG).
Sequentially write the correct four words to the Flash addresses containing the backdoor keys.
Clear the KEYACC bit. Depending on the user code used to write the backdoor keys, a wait cycle (NOP) may be required
before clearing the KEYACC bit.
If all data written match the backdoor keys, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced
to an unsecured state.
If any of the keys written does not match the backdoor keys programmed in the Flash array.
If the keys are written in the wrong sequence.
If any of the keys written are all 0’s or all 1’s.
If the KEYACC bit does not remain set while the keys are written.
If any of the keys are written on successive MCU clock cycles.
Executing a STOP instruction before all keys have been written.
can be executed. If the MCU is secured and is in special mode, only the erase verify and mass erase commands can
Flash Module Security
Background Debug Mode
Unsecuring the MCU Using Backdoor Key Access
Section
4.36.3.1.1). If the KEYEN[1:0] bits are in the enabled state (see
Section
4.36.3.1.1).
Section 4.36.3.3.2, “Flash Security Register
Section
4.36.3.3.2), the MCU can be unsecured by the backdoor
Section
32 kbyte Flash Module (S12SFTSR32KV1)
4.36.3.1.1) must be changed directly by
Section
4.36.3.3.2) and the KEYACC
(FSEC)"”.
MM912F634
297