STM32H750 can not read flash bank1 while not in read protection

[SandSwitch]

Hi,
I'm encountering an issue with my STM32H750 MCU.

I download my program to the flash via the UART interface using STM32CubeProgrammer. The MCU can work well for a few days, but suddenly crashed. This problem occurred randomly on 2 out of 15 boards with the same hardware and software design.

Here are diagnostic steps taken:

(1)Connecting via the SWD interface using J-link and found option bytes(0x52002000) is able to read, but flash bank 1(0x08000000)is unable to read 

Checked the read protection was set to level 0. J-link log:

SEGGER J-Link Commander V8.12a (Compiled Jan  9 2025 14:39:11)
DLL version V8.12a, compiled Jan  9 2025 14:38:21

Connecting to J-Link via USB...O.K.
Firmware: J-Link V9 compiled Dec 13 2022 11:14:50
Hardware version: V9.70
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 69730352
License(s): RDI, GDB, FlashDL, FlashBP, JFlash
VTref=3.296V


Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: STM32H750VB
Type '?' for selection dialog
Device>
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>S
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "STM32H750VB" selected.


Connecting to target via SWD
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 11us
InitTarget() start
SWD selected. Executing JTAG -> SWD switching sequence.
DAP initialized successfully.
InitTarget() end - Took 19.9ms
Found SW-DP with ID 0x6BA02477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[3]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x84770001, ADDR: 0x00000000)
AP[1]: AHB-AP (IDR: 0x84770001, ADDR: 0x01000000)
AP[2]: APB-AP (IDR: 0x54770002, ADDR: 0x02000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FE000
CPUID register: 0x411FC271. Implementer code: 0x41 (ARM)
Cache: L1 I/D-cache present
Found Cortex-M7 r1p1, Little endian.
FPUnit: 8 code (BP) slots and 0 literal slots
CoreSight components:
ROMTbl[0] @ E00FE000
[0][0]: E00FF000 CID B105100D PID 000BB4C7 ROM Table
ROMTbl[1] @ E00FF000
[1][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[1][1]: E0001000 CID B105E00D PID 000BB002 DWT
[1][2]: E0002000 CID B105E00D PID 000BB00E FPB-M7
[1][3]: E0000000 CID B105E00D PID 000BB001 ITM
[0][1]: E0041000 CID B105900D PID 001BB975 ETM-M7
[0][2]: E0043000 CID B105900D PID 004BB906 CTI
I-Cache L1: 16 KB, 256 Sets, 32 Bytes/Line, 2-Way
D-Cache L1: 16 KB, 128 Sets, 32 Bytes/Line, 4-Way
Memory zones:
  Zone: "Default" Description: Default access mode
Cortex-M7 identified.
J-Link>mem 0x52002000 148
52002000 = 34 00 00 00 00 00 00 00  00 00 00 00 31 00 00 00  4...........1...
52002010 = 00 00 00 00 00 00 00 00  01 00 00 00 F0 AA C6 1B  ................
52002020 = F0 AA C6 1B 00 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002030 = FF 00 00 00 FF 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002040 = 00 08 F0 1F 00 08 F0 1F  10 08 00 10 10 08 00 10  ................
52002050 = 00 00 1C 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002060 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002070 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002080 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002090 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020A0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020B0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020C0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020D0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020E0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020F0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002100 = 34 00 00 00 00 00 00 00  00 00 00 00 31 00 00 00  4...........1...
52002110 = 00 00 00 00 00 00 00 00  01 00 00 00 F0 AA C6 1B  ................
52002120 = F0 AA C6 1B 00 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002130 = FF 00 00 00 FF 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002140 = 00 08 F0 1F 00 08 F0 1F                           ........
J-Link>mem 0x08000000 10
Could not read memory.
J-Link>

(2) Connecting via the UART interface using STM32CubeProgrammer, but can‘t receive apply. Log:

16:45:32:961 : RTS low
16:45:32:961 : DTR low
16:45:32:996 : Serial Port COM12 is successfully opened.
16:45:32:996 : Port configuration: parity = even, baudrate = 115200, data-bit = 8,                     stop-bit = 1.0, flow-control = off
16:45:32:996 : No Init bits value is : 0 
16:45:32:996 : Sending init command: 
16:45:32:998 : byte 0x7F sent successfully to target
16:45:32:998 : Wait ends after 1 loop, dataready = 1, delay = 1
16:45:32:998 : Received response from target: 0x79
16:45:33:007 : Activating device: OK
16:45:33:007 : Sending GetID command and its XOR:
16:45:33:008 : byte 0x02 sent successfully to target
16:45:33:008 : byte 0xFD sent successfully to target
16:45:33:009 : Wait ends after 1 loop, dataready = 1, delay = 1
16:45:33:009 : Received response from target: 0x79
16:45:33:009 : Received 4 data bytes from target : 0x01045079
16:45:33:009 : Chip ID: 0x450 
16:45:33:009 : Sending Get command and its XOR:
16:45:33:009 : byte 0x00 sent successfully to target
16:45:33:009 : byte 0xFF sent successfully to target
16:45:33:012 : Wait ends after 1 loop, dataready = 1, delay = 2
16:45:33:012 : Received response from target: 0x79
16:45:33:012 : Received 1 data bytes from target : 0x0b
16:45:33:012 : size of bytes in the response: 11
16:45:33:012 : Received 13 data bytes from target
16:45:33:012 : Full received response: 0b31000102112131446373829279
16:45:33:012 : BootLoader protocol version: 3.1
16:45:33:012 : byte 0x11 sent successfully to target
16:45:33:012 : byte 0xEE sent successfully to target
16:45:33:112 : data sent successfully to target: 0x0800000008
16:45:33:113 : byte 0x00 sent successfully to target
16:45:33:115 : byte 0xFF sent successfully to target
16:45:34:115 : Sending GetID command and its XOR:
16:45:34:116 : byte 0x02 sent successfully to target
16:45:34:116 : byte 0xFD sent successfully to target
16:45:35:117 : Wait ends after 1 loop, dataready = 0, delay = 1001
16:45:35:117 : Timeout error occured while waiting for acknowledgement.
16:45:35:117 : No response from target received
16:45:35:117 : Error: GETID command not acknowledged!
16:45:35:117 : Reemission of GetID command
16:45:35:117 : Sending GetID command and its XOR:
16:45:35:118 : byte 0x02 sent successfully to target
16:45:35:118 : byte 0xFD sent successfully to target
16:45:36:118 : Wait ends after 1 loop, dataready = 0, delay = 1001
16:45:36:118 : Timeout error occured while waiting for acknowledgement.
16:45:36:118 : No response from target received
16:45:36:118 : Error: GETID command not acknowledged!
16:45:36:118 : Reemission of GetID command
16:45:36:118 : Sending GetID command and its XOR:
16:45:36:120 : byte 0x02 sent successfully to target
16:45:36:120 : byte 0xFD sent successfully to target
16:45:37:118 : Wait ends after 1 loop, dataready = 0, delay = 1000
16:45:37:118 : Timeout error occured while waiting for acknowledgement.
16:45:37:118 : No response from target received
16:45:37:118 : Error: GETID command not acknowledged!
16:45:37:119 : byte 0x11 sent successfully to target
16:45:37:119 : byte 0xEE sent successfully to target
16:45:38:240 :  UART PORT CLOSE 
16:45:38:279 : Disconnected from device.

(3)Erasing full chip  via the SWD interface using J-flash(J-flash->Target->Manual Programming->Erase Chip), and the MCU is back to normal.

Note: As there are 2 boards with the same problem, one has recovered to normal, while the other remains in the error state.

Given that the read protection is set to level 0 , I am puzzled as to why flash bank1 cannot be read.

Has anyone encountered a similar problem before? Any suggestions or advice would be greatly appreciated.

[SandSwitch]

Hi, Pavel A.

Thanks for your reply. I am checking my code to find potential bugs that may be causing this problem and will update my progress if I find any.

Thanks again for your help. Best Regards!