Paul Michaud January 13, 2014

How to Remove EEPROM Protection on an HCS12 Board Using D-Bug12
Paul Michaud
January 13, 2014
Symptom: The EEPROM cannot be modified because the EEPROM protection byte $FFD in the
EEPROM has been modified to turn on protection. This byte is copied to the EPROT register at $114
when the CPU is reset.
For example:
>mm 800 aa
Can't Write Target EEPROM. Check EEPROT Reg.
--------------------------------------------------------------------------------------Removing EEPOM Protection
To remove the EEPROM protection involves the following steps:
• Use one of the HCS12 boards in BDM pod mode to connect to the target system and enter active
background mode.
• Initialize the ECLKDIV register at $110.
• Modify the EPROT register at $114 to remove protection.
• Modify the EPROT register in the EEPRO module at $FFD to remove protection.
• Reset the target system
Detailed Steps
1. On the HCS12 board you are using as the BDM pod set the PAD1:0 jumpers to 1:0 and connect it
to your terminal’s RS232 port.
PAD1
PAD0
Operation Mode
0
0
D-Bug12:EVB
0
1
Jump-to-EEPROM
1
0
D-Bug12:POD
1
1
SerialBootloader
Jumper
Positions
Table 1 – JB3 (PAD1-0) Jumpers for operating modes
Figure 1 – Jumper location
2. Connect the PCB end of the BDM POD Transformer (available from Technological Arts) to the
H1 connector of the MCU board or the P5 connector on the demo board.
Figure 2 – DBM POD Transformer
Figure 3 – Transformer DBM POD
Figure 4 – Transformer Target Connector
3. Connect the other end of the BDM POD Transformer to the BDM In connector on the target board.
4. Power up the boards.
5. If the “Can't Communicate With Target CPU” message is displayed on the BDN Pod select 1 and
enter 16000 as the crystal frequency in KHz.
Can't Communicate With Target CPU
1.) Set Target Speed (48000 KHz)
2.) Reset Target
3.) Reattempt Communication
4.) Erase & Unsecure
5.) Enter BDM debugger
?1
Enter Target Crystal Frequency (kHz): 16000
S>
6. If the prompt is “R>”, indicating that the target is running a program, enter “reset” which will reset
the target into background BDM mode. E.g.,
R>reset
Target CPU Has Been Reset
7. Enter the Following commands.
S>mm 110 4a (Initialize ECLKDIV register at $110 for 16MHz Xtal/24MHz Eclock)
Can't Write Target Memory
(This error message is expected. Bit-7 (EDIVLD) is
automatically set)
S>md 110
(Verify that ECLKDIV has been set properly. Should read $CA)
0110 CA 00 00 00 - 72 C1 00 00 - 00 00 00 00 - E9 3F E9 3F
S>mm 114 ff
modified)
(Modify EPROT to remove all protection which will allow EEPROM to be
S>mm ffd ff
(Modify EPROT byte in EEPROM)
Now you can reset the target system. And the EEPROM protection will have been removed.