NXP Semiconductors K22F series, Reference Manual, Page: 679 / 1407

Backdoor Access Key command as valid comparison values. While the Verify Backdoor
Access Key command is active, program flash memory is not available for read access
and returns invalid data.
The user code stored in the program flash memory must have a method of receiving the
backdoor keys from an external stimulus. This external stimulus would typically be
through one of the on-chip serial ports.
If the KEYEN bits are in the enabled state, the chip can be unsecured by the following
backdoor key access sequence:
1. Follow the command sequence for the Verify Backdoor Access Key command as
explained in Verify Backdoor Access Key Command
2. If the Verify Backdoor Access Key command is successful, the chip is unsecured and
the FSEC[SEC] bits are forced to the unsecure state
An illegal key provided to the Verify Backdoor Access Key command prohibits further
use of the Verify Backdoor Access Key command. A reset of the chip is the only method
to re-enable the Verify Backdoor Access Key command when a comparison fails.
After the backdoor keys have been correctly matched, the chip is unsecured by changing
the FSEC[SEC] bits. A successful execution of the Verify Backdoor Access Key
command changes the security in the FSEC register only. It does not alter the security
byte or the keys stored in the Flash Configuration Field (
Flash Configuration Field
Description ). After the next reset of the chip, the security state of the flash memory
module reverts back to the flash security byte in the Flash Configuration Field. The
Verify Backdoor Access Key command sequence has no effect on the program and erase
protections defined in the program flash protection registers.
If the backdoor keys successfully match, the unsecured chip has full control of the
contents of the Flash Configuration Field. The chip may erase the sector containing the
Flash Configuration Field and reprogram the flash security byte to the unsecure state and
change the backdoor keys to any desired value.
29.4.13 Reset Sequence
On each system reset the flash memory module executes a sequence which establishes
initial values for the flash block configuration parameters, FPROT, FOPT, FSEC,
FXACC, FSACC, and FACNFG registers.
Chapter 29 Flash Memory Module (FTFA)
K22F Sub-Family Reference Manual, Rev. 4, 08/2016
NXP Semiconductors 679