Anyone familiar with HC908?

[chupocro]

Hi all, I have a question about certain specifics of Motorola MC68HC908AZ60  mask 2J74Y microcontroller which are still not clear after reading the datasheet.

TLDR (very short description):

There are two important configuration registers in that microcontroller:

Code: [Select]

EEPROM nonvolatile register EENVR1    0xfe1c
EEPROM nonvolatile register EENVR2    0xfe18
According to the datasheet, there is EEPRTCT bit as bit 4 in both EENVR1 and EENVR2 registers which is used to protect 16 bytes at 0x08f0 - 0x08ff

Once programmed EEPRTCT bit to 0 the protection becomes permanent and can not be disabled.

The problem is - I've bought a few brand new MC68HC908AZ60 mask 2J74Y and they have EEPRTCT bit in EENVR1 programmed as high from the factory as it should be but EEPRTCT bit in EENVR2 is low which would normally mean "protected".

However, the datasheet doesn't mention what happens if EEPRTCT bit in EENVR1 is not the same as EEPRTCT bit in EENVR2 which is the case.

Detailed description:

All early MC68HC908AZ60 mask 2J74Y microcontrollers installed in CIM modules of Opel Vectra C have the problem with data retention where after certain ammount of time some of the flash locations could be read without error only when the microcontroller is hot. The consequence is when the temperature is low some instruction opcodes stored in flash are read with an error causing watchdog reset.

The problem could be solved by reading the flash while heating the microcontroller and then reprograming the flash - the microcontroller then works well for a few years until the same happens again. However, there is a chance some bytes would be read with an error even when the microcontroller is hot and if it is then reprogrammed with the wrong bytes the original flash contents is lost.

That's why I'd like to keep the original MC68HC908AZ60s from the device (there are two of them on the PCB) as a backup and to program the brand new ones with the correct flash + EEPROM data which as I read in some 15 years old forum posts could be done.

But the problem is, as I mentioned, I am not sure if the brand new MC68HC908AZ60s that I've bought will be usable because EEPRTCT bit in EENVR2 is not the same as EEPRTCT bit in EENVR1.
In the picture is how the EEPRTCT bit in EENVR1 is read by the programmer from the original mictrocontroller. The same is when reading the EENVR2. But when I read EENVR1 and EENVR2 from the brand new microcontrollers I've bought then EEPRTCT bit in EENVR2 is not checked.

Reprogramming or replacing MC68HC908AZ60s is my only option because there aren't new CIM modules on the market anymore and every module I can use will have or already has the same problem. CIM modules produced after year 2005 don't have the same problem because they changed the microcontroller type but with my car I can use only a module produced before year 2005.

[amyk]

However, the datasheet doesn't mention what happens if EEPRTCT bit in EENVR1 is not the same as EEPRTCT bit in EENVR2 which is the case.

There's two blocks of EEPROM. The *1 registers control the first block, and the *2 registers control the second. They're independent.

[chupocro]

Yes, there are two blocks of EEPROM - EEPROM-1 is 0x0800 - 0x09ff and EEPROM-2 is 0x0600 - 0x07ff but according to the datasheet EEPRTCT bits in both EENVR1 and EENVR2 are to protect the same 16 bytes at 0x08f0 - 0x08ff which is in EEPROM-1 block.

Maybe the datasheet is not correct?

https://www.nxp.com/docs/en/data-sheet/MC68HC908AZ60.pdf

Pages 71 and 74 are for EEPROM-1, pages 83 and 86 are for EEPROM-2.

[amyk]

I suspect that's a copy-paste error.

[chupocro]

Yes, EEPRTCT bit in EENVR2 is probably for protecting the range from 0x06f0 to 0x06ff.

I tried to program the "new" MC68HC908AZ60 mask 2J74Y processors I bought from Aliexpress that have EEPRTCT bit in EENVR2 programmed as LOW (locked) and I could't erase nor program neither flash nor EEPROM so they are useless.

Seems as only one EEPRTCT bit (from EENVR1 or from EENVR2) programmed as LOW disables bulk and block erase modes which are used by the programmer.

Seems as I have only two options:

a) Read the original processors while heating them and reprogram the flash with the same data

b) Read the original processors while heating them and reprogram the same processors removed from some other car electronics containing the same processors

The first option is quite risky because in case there will be read error(s) while reading - the original contents would be lost. In case of the second option I could still try to read the original data many times while heating the chip even more.

My plan is to read the original data while heating the chip many times anyway so I can compare the files and maybe reconstruct the correct data from many readings.