Locked out Evalbot Stellaris lm3s9b92

Yesterday I locked the MCU in my Evalbot. It was a result of flashing a wrong configuration of clock sources and dividers. I must have set the crystal frequency wrong and JTAG was no longer responding. At first it seemed to be dead totally, but then I found a software from TI named LM Flash Programmer. It has an option to unlock the MCU by erasing flash of the device, after we put it into a state before the flash is executed by asserting a reset on power up.

So, off we go:

1. The markings on my chip are:


B1 here denotes the revision of the chip, what will be important later on.

2. Turn on LM Flash Programmer (it can be found here http://www.ti.com/tool/lmflashprogrammer). I used build 1381- the current one on the day of writing this post. When you choose the connection settings check what board do you have and even more important what crystal is on the board. When I chose “Lm3s9b92 Evaluation board” it specified 16Mhz crystal (the one on the board is 6MHz only), so I think that is a different board and there is no choice for evalbot. So the manual settings with ICDI, 1MHz Jtag, 6MHz crystal are fine.

3) The Port Unlock function that is of interest to us is located on Other Utilities tab. My MCU turned out to be (after a google search) to be a Tempest class, so this was the proper option to choose.

After clicking Unlock and reading the warning about erasing MAC address from flash (I think LM3S9B92 doesn’t come with any MAC programmed in, but either way there was no other choice) as well as all the other data located there, this window showed:

4) What that means is that according to the MCU data sheet “section Recovering a “Locked” Microcontroller” we need to assert ~RST signal and then turn on the power (the specific pin could be different in other models). In this case it means to tie it to the ground (it is a negated pin). From the Evalbot schematics (www.ti.com/lit/ug/spmu167/spmu167.pdf) we can see that the ~RST pin has no information about the test point assigned to is (schematics are not complete, but still useful). The nice fact is that this pin is a part of JTAG, so most probably it should be also on the additional connection for this interface. After finding the pin on the pin layout in datasheet:

5) We can locate the connection on the JTAG pins with the multimeter:

The connection to the ~RST pin is located on the JTAG on the top row, most left (looking in the way that you can read the JTAG label on the PCB. My board is a bit different then on the schematics and placement figure from TI, so this little investigation was necessary.

6) Remove batteries, unplug usb ( if you don’t have a diode connecting ICDI to power, remove both of the cables- one connected to USB DEVICE port, and other ICDI port ), Tie RST pin to the ground and then plug in the power (both usbs) and turn the EVALBOT with the ON button. This should result in putting the MCU in the state that is not dependent on the flash content (the proper pin assignments and proper clocking). Now you can click ok on the dialog in LM Flash programmer about asserting reset. It will tell you to remove the ground from reset- do it.

7) Now if you are lucky it may be enough to click ok and the MCU should be unlocked (what will be confirmed with a proper dialog window). If you have a defective revision (keep in mind that I have a B1) you may have to do some more witchcraft. This is the information I found on TI forum (written by “Stellaris David” on of TI employees):


Are you able to unlock the part using LM Flash Programmer?  Please give it a try.  After erasing the part, try and load the default example once more.

Be aware, with the LM3S9B92 Rev B1 you need to follow a slightly modified procedure to unlock the part.  This is located in section 1.2 of the Rev B1 errata document:

1.2 The Recover Locked Device sequence does not work as expected


If software configures any of the JTAG/SWD pins as GPIO or loses the ability to communicate with the debugger, there is a debug sequence that can be used to recover the microcontroller, called the Recover Locked Device sequence. After reconfiguring the JTAG/SWD pins, using the Recover Locked Device sequence does not recover the device.


To get the device unlocked, follow these steps:

  1. Power cycle the board and run the debug port unlock procedure in LM Flash Programmer. DO NOT power cycle when LM Flash Programmer tells you to.
  2. Go to the Flash Utilities tab in LM Flash Programmer and do a mass erase operation (check ”Entire Flash” and then click the Erase button). This erase appears to have failed, but that is ok.
  3. Power cycle the board.
  4. Go to the Flash Utilities tab in LM Flash Programmer and do another mass erase operation (check “Entire Flash” and then click the Erase button).


If you are reading this David, thank you- it was a great information, which I didn’t catch when looking through Errata. In my case the initial unlock and erase seemed to work (there was no information about the error), but I still did double erase to be sure. Still the information is great in case you have B1 revision (mine is from the big promocode that was published on Hackaday and then turned out to be limited to Boston conference attendees).

Hope this info will help at least one person that locked their LuminaryMicro/TI microcontroller. Evalbot is a great way to learn some of the operation of LM’s and how to operate ethernet with mcu.

Category(s): Uncategorized

14 Responses to Locked out Evalbot Stellaris lm3s9b92

    Alex Yu says:

    I performed the unlocking as per your procedure, but it shows “error:unable to initialize target -1″. Do you know what cause it. I have the same LM3S9B92 Rev B1 as yours.


      mikuslaw says:

      Hmm, it took me 2 years to respond, so I don’t think you need the help anymore. Sorry.
      Let me know if you still do want any help with that. If it may be helpful for others: I assume that the error you get is due to wrong initialization of the board into the “recovery” state. Did you connect the rst pin in a correct way? Maybe you set the wrong device family or quarts frequency? This error is not very accurate btw: it just means that you don’t get the communication to the MCU.

    Mike Goldberg says:

    Thanks! This worked for me on a Tiva C Series TM4C123G LuanchPad.

      mikuslaw says:

      That is great. I run this blog more like postit for me (my memory is terrible for such things), so I’m really glad that it helped anyone else.

  1. Badawcze spojrzenie na sytuację, każdy powinien przeczytać również zapoznać się z przedmiotem.

    my site :: pozycjonowanie stron gliwice

  2. Nadzwyczaj wartościowy tekst, zalecam ludziom
    Paintball Gliwice

  3. Badawcze teksty, dobra tematyka szlifierka do betonu.

    Review myy site … hotel zachodniopomorskie

  4. Nie sposób się z tym nie zgodzić.

    Lookk at my website – 505967 [http://www.cnc.info.pl]

  5. 逆向直销,震撼来袭:




  6. 不错,不错,看看了!

  7. Strona świadczy o dobrych zagadnieniach, namawiam do dyskusji gabinet stomatologiczny tychy Stomatologiczny gliwice

  8. 博客不错,嘎嘎!

  9. 受教了!呵呵!

2 Responses in other blogs

  1. [...] Development board unable to initialize and program Fault on TM4C123G processor Locked out Evalbot Stellaris lm3s9b92 Tiva TM4C123G LaunchPad Blink the RGB CLP Unbox TM4C Error connecting to the target: (Error -1063 @ [...]

  2. http://blog.cognitivedissidents.com/…

    Locked out Evalbot Stellaris lm3s9b92 | Mikuslaw's blog…

Leave a Reply

Your email address will not be published. Required fields are marked *



You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> <pre lang="" line="" escaped="" highlight="">