2024-07-14 05:42 PM
I have 2 x SMT Electric Feeders (Same Model --- HGWC Yamaha YMH-EF8-000 8mm) with STM32F030K6 MCU that are having issues with Core/CPU lock up.
NOTE: I know that when the STM32F030K6 chip is configured for either RDP Level 1 (Read Protection) or RDP Level 2(Chip Protection), *ANY* attempted access via JTAG/SWI/SWD will lock the core.
This is by design, and it is how RDP1/2 prevent outside access to FLASH and RAM.
The programmer is trying access the chip after reset, which triggers the lock.
This is normal behavior. You always need to power cycle after programming RDP1 or RDP2.
i have tried everything to unlock Core or CPU with STM32 Cube Programmer using ST-LINK V3 Set (Also tried ST-LINK V2 ) but in vain. I have several SMT electric Feeders which are working fine but i don't have the original .bin file from the manufacturer who seem to have gone out of business. No response from them anymore.
My intention is to extract or download the .bin file from the flash Memory from the working SMT Electric Feeders and use it to flash the 2 locked SMT Electric Feeders with STM32F030K6 Chip. so that i can get them working
Any Help on how to Unlock the Core and reflash the STM32F030K6 ?
Here some log
17:44:22 : UR connection mode is defined with the HWrst reset mode
17:44:24 : ST-LINK SN : B55B5A1A00000000B9A5EF01
17:44:24 : ST-LINK FW : V2J45S7
17:44:24 : Board : --
17:44:24 : Voltage : 3.29V
17:44:24 : SWD freq : 4000 KHz
17:44:24 : Connect mode: Normal
17:44:24 : Reset mode : Software reset
17:44:24 : Device ID : 0x444
17:44:24 : Revision ID : Rev 1.0
17:44:24 : Debug in Low Power mode is not supported for this device.
17:44:24 : UPLOADING OPTION BYTES DATA ...
17:44:24 : Bank : 0x00
17:44:24 : Address : 0x1ffff800
17:44:24 : Size : 16 Bytes
17:44:24 : UPLOADING ...
17:44:24 : Size : 1024 Bytes
17:44:24 : Address : 0x8000000
17:44:24 : Read progress:
17:44:24 : Data read successfully
17:44:24 : Time elapsed during the read operation is: 00:00:00.008
2024-08-19 05:57 AM
Hello @developeralgo222
According to the shared screenshots, the device is in RDP level 0 with full erase of the main flash.
This is expected if the device is initially in RDP level 1, because the regression from RDP level 1 to level 0 will cause a mass-erase of the device. This is described in RM0360 page 58 "the change to RDP level 0 (no protection) from RDP level1 is not possible without a main flash memory Mass erase operation. This Mass erase is generated as soon as 0xAA is programmed in the RDP byte."
Sorry, not possible to extract the binary file if the RDP level is not level 0!!
best regards