Recovering MCU from read out protection level set to 0xFF

[FWege.1]

Dear all

I’m not able to reset RDP to level 0

Custom board with STM32F732ZET6

Not sure, but something goes wrong and I think the information block was erased only – without programming afterwards

“The value of an option is automatically modified by first erasing the information block and then programming all the option bytes with the values contained in the FLASH_OPTCR register.”

RDP is now 0xFF and cannot be set to level 0 (no protection) again.

After reading a lot of forum entries here I also tried the re-program RDP by the command line interface

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>"C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" --connect port=swd mode=hotplug -r32 0x40023c14 1

0x40023C14 : C0FFFFFD

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>"C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" --connect port=swd mode=hotplug -w32 0x40023c08 0x08192A3B

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>"C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" --connect port=swd mode=hotplug -w32 0x40023c08 0x4C5D6E7F

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>"C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" --connect port=swd mode=hotplug -r32 0x40023c14 1

0x40023C14 : C0FFFFFC

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>"C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" --connect port=swd mode=hotplug -w8 0x40023C15 0xAA

Downloading 8-bit data failed...

If it's a Flash memory, it may be not erased or protected

Retried with a second hardware with RDP level 1. Works great and afterwards RDP was reset to level 0.

Similar problems are descripted here:

OH boy... I bricked my nucleo Error: Expected value for Option Byte "RDP": 0xAA, found: 0xFF 

Many thanks in advance,

Franz

[AScha.3]

Hi,

use CubeProgrammer, connect and reset the RDP level - except you set it to level 2 , then switch on soldering station and replace (now useless) chip.

first try:

otherwise...

And this not a "problem" , its just the state of protection you set to the chip.

[FWege.1]

Hi AScha.3

First of all – thanks for you answer.

Of course I have already tried to reset RDP level with STM32CubeProgrammer (v2.14.0).

As I have mentioned, RDP is programmed to 0xFF (erased state) actually.

Level 2 = 0xCC!

Unfortunately the answer did not help me - I am sorry.

[AScha.3]

So you wrote 0xAA - but nothing happens ?

[FWege.1]

Correct. I wrote 0xAA with STM32CubeProgrammer and CLI, but still 0xFF.

But all other bits cannot be written either (IWGD, ...). Watchdog isn't enabled.

[Pavel A.]

The RDP level reading as FF can mean that the chip is actually on level 2 and the CubeProgrammer cannot even read option bytes. CubeProgrammer tries to be optimistic and behave as if the level were 1. It this cannot recover to level 0, the level probably is 2. To the soldering station.

@Jocelyn RICARD  ?

[AScha.3]

Did you power cycle after writing option ? (Just an idea.)

+

Did you also try writing 0xA5 with cli ?

(No guarantee -- what will happen.)

[FWege.1]

I never tried it, but I don’t think it is possible to write OPTKEY1 and OPTKEY2 if protection level 2 is set (OPTLOCK will be cleared afterwards!).

I will try 0xA5 on Monday (home office today) – but I think this value is valid for other chip series only.

Power cycle was done!