Yesterday I locked the MCU in my Evalbot. It was a result of flashing a wrong configuration of clock sources and dividers. I must have set the crystal frequency wrong and JTAG was no longer responding. At first it seemed to be dead totally, but then I found a software from TI named LM Flash Programmer. It has an option to unlock the MCU by erasing flash of the device, after we put it into a state before the flash is executed by asserting a reset on power up.
So, off we go:
1. The markings on my chip are:
B1 here denotes the revision of the chip, what will be important later on.
2. Turn on LM Flash Programmer (it can be found here http://www.ti.com/tool/lmflashprogrammer). I used build 1381- the current one on the day of writing this post. When you choose the connection settings check what board do you have and even more important what crystal is on the board. When I chose “Lm3s9b92 Evaluation board” it specified 16Mhz crystal (the one on the board is 6MHz only), so I think that is a different board and there is no choice for evalbot. So the manual settings with ICDI, 1MHz Jtag, 6MHz crystal are fine.
3) The Port Unlock function that is of interest to us is located on Other Utilities tab. My MCU turned out to be (after a google search) to be a Tempest class, so this was the proper option to choose.
After clicking Unlock and reading the warning about erasing MAC address from flash (I think LM3S9B92 doesn’t come with any MAC programmed in, but either way there was no other choice) as well as all the other data located there, this window showed:
4) What that means is that according to the MCU data sheet “section 220.127.116.11 Recovering a “Locked” Microcontroller” we need to assert ~RST signal and then turn on the power (the specific pin could be different in other models). In this case it means to tie it to the ground (it is a negated pin). From the Evalbot schematics (www.ti.com/lit/ug/spmu167/spmu167.pdf) we can see that the ~RST pin has no information about the test point assigned to is (schematics are not complete, but still useful). The nice fact is that this pin is a part of JTAG, so most probably it should be also on the additional connection for this interface. After finding the pin on the pin layout in datasheet:
The connection to the ~RST pin is located on the JTAG on the top row, most left (looking in the way that you can read the JTAG label on the PCB. My board is a bit different then on the schematics and placement figure from TI, so this little investigation was necessary.
6) Remove batteries, unplug usb ( if you don’t have a diode connecting ICDI to power, remove both of the cables- one connected to USB DEVICE port, and other ICDI port ), Tie RST pin to the ground and then plug in the power (both usbs) and turn the EVALBOT with the ON button. This should result in putting the MCU in the state that is not dependent on the flash content (the proper pin assignments and proper clocking). Now you can click ok on the dialog in LM Flash programmer about asserting reset. It will tell you to remove the ground from reset- do it.
7) Now if you are lucky it may be enough to click ok and the MCU should be unlocked (what will be confirmed with a proper dialog window). If you have a defective revision (keep in mind that I have a B1) you may have to do some more witchcraft. This is the information I found on TI forum (written by “Stellaris David” on of TI employees):
Are you able to unlock the part using LM Flash Programmer? Please give it a try. After erasing the part, try and load the default example once more.
Be aware, with the LM3S9B92 Rev B1 you need to follow a slightly modified procedure to unlock the part. This is located in section 1.2 of the Rev B1 errata document:
1.2 The Recover Locked Device sequence does not work as expected
If software configures any of the JTAG/SWD pins as GPIO or loses the ability to communicate with the debugger, there is a debug sequence that can be used to recover the microcontroller, called the Recover Locked Device sequence. After reconfiguring the JTAG/SWD pins, using the Recover Locked Device sequence does not recover the device.
To get the device unlocked, follow these steps:
- Power cycle the board and run the debug port unlock procedure in LM Flash Programmer. DO NOT power cycle when LM Flash Programmer tells you to.
- Go to the Flash Utilities tab in LM Flash Programmer and do a mass erase operation (check ”Entire Flash” and then click the Erase button). This erase appears to have failed, but that is ok.
- Power cycle the board.
- Go to the Flash Utilities tab in LM Flash Programmer and do another mass erase operation (check “Entire Flash” and then click the Erase button).
If you are reading this David, thank you- it was a great information, which I didn’t catch when looking through Errata. In my case the initial unlock and erase seemed to work (there was no information about the error), but I still did double erase to be sure. Still the information is great in case you have B1 revision (mine is from the big promocode that was published on Hackaday and then turned out to be limited to Boston conference attendees).
Hope this info will help at least one person that locked their LuminaryMicro/TI microcontroller. Evalbot is a great way to learn some of the operation of LM’s and how to operate ethernet with mcu.