MC9S12E128CPV Freescale Semiconductor, MC9S12E128CPV Datasheet - Page 117

• Manufacturer Part Number: MC9S12E128CPV
• Description: Microcontrollers (MCU) 16 Bit 16MHz
• Manufacturer: Freescale Semiconductor

Specifications of MC9S12E128CPV

• Data Bus Width: 16 bit
• Program Memory Type: Flash
• Program Memory Size: 128 KB
• Data Ram Size: 8 KB
• Interface Type: SCI, SPI
• Maximum Clock Frequency: 25 MHz
• Number Of Programmable I/os: 92
• Number Of Timers: 16 bit
• Operating Supply Voltage: 3.135 V to 5.5 V
• Maximum Operating Temperature: + 85 C
• Mounting Style: SMD/SMT
• Package / Case: LQFP-112
• Minimum Operating Temperature: - 40 C
• On-chip Adc: 10 bit
• On-chip Dac: 8 bit, 2 Channel
• Lead Free Status / Rohs Status: No RoHS Version Available

addresses sequentially staring with 0xFF00-0xFF01 and ending with 0xFF06–0xFF07. The values 0x0000
and 0xFFFF are not permitted as keys. When the KEYACC bit is set, reads of the Flash array will return
invalid data.
The user code stored in the Flash array must have a method of receiving the backdoor key from an external
stimulus. This external stimulus would typically be through one of the on-chip serial ports.
If KEYEN[1:0] = 1:0 in the FSEC register, the MCU can be unsecured by the backdoor key access
sequence described below:
The backdoor key access sequence is monitored by the internal security state machine. An illegal operation
during the backdoor key access sequence will cause the security state machine to lock, leaving the MCU
in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and
allow a new backdoor key access sequence to be attempted. The following illegal operations will lock the
security state machine:
After the backdoor key access sequence has been correctly matched, the MCU will be unsecured. The
Flash security byte can be programmed to the unsecure state, if desired.
In the unsecure state, the user has full control of the contents of the four word backdoor key by
programming bytes 0xFF00–0xFF07 of the Flash configuration field.
The security as defined in the Flash security/options byte at address 0xFF0F is not changed by using the
backdoor key access sequence to unsecure. The backdoor key stored in addresses 0xFF00–0xFF07 is
unaffected by the backdoor key access sequence. After the next reset sequence, the security state of the
Flash module is determined by the Flash security/options byte at address 0xFF0F. The backdoor key access
sequence has no effect on the program and erase protection defined in the FPROT register.
It is not possible to unsecure the MCU in special single chip mode by executing the backdoor key access
sequence in background debug mode.
Freescale Semiconductor
1. Set the KEYACC bit in the FCNFG register
2. Write the correct four 16-bit words to Flash addresses 0xFF00–0xFF07 sequentially starting with
3. Clear the KEYACC bit in the FCNFG register
4. If all four 16-bit words match the backdoor key stored in Flash addresses 0xFF00–0xFF07, the
1. If any of the four 16-bit words does not match the backdoor key programmed in the Flash array
2. If the four 16-bit words are written in the wrong sequence
3. If more than four 16-bit words are written
4. If any of the four 16-bit words written are 0x0000 or 0xFFFF
5. If the KEYACC bit does not remain set while the four 16-bit words are written
0xFF00
MCU is unsecured and bits SEC[1:0] in the FSEC register are forced to the unsecure state of 1:0
MC9S12E128 Data Sheet, Rev. 1.07
Chapter 2 128 Kbyte Flash Module (FTS128K1V1)
117