Permanent Device Lock of Freescale Kinetis K60Xxxx

Technical Note 77989



7/3/2013 1:17 PM


When you create a new project from scratch in IAR Embedded Workbench for ARM version 6.30.3 and older, for a Freescale Kinetis K60Xxxx device, using Target -> Core: "Cortex-M4", or Device -> "Freescale K60Xxxx", the default linker configuration file "generic_cortex.icf" will be selected.
This linker configuration file may cause a permanent device secure (i.e. the device is made impossible to re-program), when you download your code to the board.

In IAR Embedded Workbench for ARM version 6.30.4 and newer, another default linker configuration file (Freescale\MK60xxxx.icf) will automatically be selected, which prevents this issue.


IAR Embedded Workbench for ARM 6.30.3 and older:

Use the following linker configuration file for K60Xxxx devices:


IAR Embedded Workbench for ARM 6.30.4 and newer:

Use the default linker configuration file (automatically selected) located in:



The default linker configuration file for ARM Cortex in IAR Embedded Workbench IDE (version 6.30.3 and older) places code starting at location 0. The problem is that once the code grows to encompass address 0x40C, the NVFSEC register will be programmed.

There are two bits in the NVFSEC register that can permanently disable the mass erase functionality on the chip. These bits are called Mass Erase Enable Bits (MEEN). In this same register there are also two bits that controls the Flash security (SEC). When used in conjunction, they can permanently lock the device.

Note that when selecting Options -> Target -> Device: Freescale K60Xxxx in IAR Embedded Workbench for ARM version 6.30.3 and older, the option Linker -> Config -> "Linker configuration file" is set to "generic_cortex.icf" by default.

To change the settings, see the pictures.

Note 1:
All example projects included in the IAR K60N512 kit overrides the default linker configuration file with either "K60X_ram.icf" or "K60X_Flash.icf", and the device lock problem does not occur.

Note 2:
The example projects provided with Freescale MQX includes a vector table in "vector.c" that is extended to cover the flash config area and sets the proper values.

Note 3:
If the device has been locked with the Flash security bits only, you can unlock the device using the J-Link Commander (jlink.exe) command:

J-Link> unlock Kinetis

Note 4:
Since In Embedded Workbench for ARM version 6.60.1, it is possible to use I-Jet to unlock. Use the following command:

<installation dir>\arm\bin\jet\bin\Kinetis_unlock_swd.bat

Note 5:

In recent versions of IAR Embedded Workbench for ARM, the flash loader has a built-in write-protection of the NVFSEC register. To be able to write to this protected flash area, you will have to specify the following option in Project > Options > Debugger > Download > Override default .board file > Edit... > Extra parameters:


Parameter description:

Allow programming of 0x40C - 0x40F with user supplied data, in other case flashloader after erase of block 0 will write 0xFFFFFFFE (unsecure state).


All product names are trademarks or registered trademarks of their respective owners.

Related Tech Notes

© IAR Systems 1995-2016 - All rights reserved.