MC9S12XDT256CAA Freescale Semiconductor, MC9S12XDT256CAA Datasheet - Page 1233

• Manufacturer Part Number: MC9S12XDT256CAA
• Description: IC MCU 256K FLASH 80-QFP
• Manufacturer: Freescale Semiconductor
• Series: HCS12r

Specifications of MC9S12XDT256CAA

• Core Processor: HCS12X
• Core Size: 16-Bit
• Speed: 80MHz
• Connectivity: CAN, EBI/EMI, I²C, IrDA, LIN, SCI, SPI
• Peripherals: LVD, POR, PWM, WDT
• Number Of I /o: 59
• Program Memory Size: 256KB (256K x 8)
• Program Memory Type: FLASH
• Eeprom Size: 4K x 8
• Ram Size: 16K x 8
• Voltage - Supply (vcc/vdd): 2.35 V ~ 5.5 V
• Data Converters: A/D 8x10b
• Oscillator Type: External
• Operating Temperature: -40°C ~ 85°C
• Package / Case: 80-QFP
• Processor Series: S12XD
• Core: HCS12
• Data Bus Width: 16 bit
• Data Ram Size: 16 KB
• Interface Type: CAN/I2C/SCI/SPI
• Maximum Clock Frequency: 40 MHz
• Number Of Programmable I/os: 59
• Number Of Timers: 12
• Maximum Operating Temperature: + 85 C
• Mounting Style: SMD/SMT
• 3rd Party Development Tools: EWHCS12
• Development Tools By Supplier: EVB9S12XDP512E
• Minimum Operating Temperature: - 40 C
• On-chip Adc: 8-ch x 10-bit
• Lead Free Status / RoHS Status: Lead free / RoHS Compliant

30.1.5
Unsecuring the microcontroller can be done by three different methods:
30.1.5.1
In normal modes (single chip and expanded), security can be temporarily disabled using the backdoor key
access method. This method requires that:
The backdoor key values themselves would not normally be stored within the application data, which
means the application program would have to be designed to receive the backdoor key values from an
external source (e.g. through a serial port). It is not possible to download the backdoor keys using
background debug mode.
The backdoor key access method allows debugging of a secured microcontroller without having to erase
the Flash. This is particularly useful for failure analysis.
30.1.5.2
These are the necessary steps for a successful backdoor key access sequence:
Freescale Semiconductor
1. Backdoor key access
2. Reprogramming the security bits
3. Complete memory erase (special modes)
•
•
•
1. Set the KEYACC bit in the Flash configuration register FCNFG.
2. Write the first 16-bit word of the backdoor key to 0xFF00 (0x7F_FF00).
3. Write the second 16-bit word of the backdoor key to 0xFF02 (0x7F_FF02).
4. Write the third 16-bit word of the backdoor key to 0xFF04 (0x7F_FF04).
5. Write the fourth 16-bit word of the backdoor key to 0xFF06 (0x7F_FF06).
6. Clear the KEYACC bit in the Flash Configuration register FCNFG.
The backdoor key at 0xFF00–0xFF07 (= global addresses 0x7F_FF00–0x7F_FF07) has been
programmed to a valid value.
The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’.
In single chip mode, the application program programmed into the microcontroller must be
designed to have the capability to write to the backdoor key locations.
Unsecuring the Microcontroller
Unsecuring the MCU Using the Backdoor Key Access
Backdoor Key Access Sequence
No word of the backdoor key is allowed to have the value 0x0000 or
0xFFFF.
Flash cannot be read while KEYACC is set. Therefore the code for the
backdoor key access sequence must execute from RAM.
MC9S12XDP512 Data Sheet, Rev. 2.21
NOTE
NOTE
Chapter 30 Security (S12X9SECV2)
1235