************************************************************************ ************************************************************************ ** ** ** Application notes for Atmel devices ** ** ** ** (Informal Document) ** ** ** ** To find the application notes for your device search for the ** ** 'core' part name. As an example using the 25HP512 8 pin SOIC ** ** you would search this document for the entry "25HP512" ** ** ** ************************************************************************ ************************************************************************ ************************************************************************ 25080A ---------- 25128A ---------- 25160A ---------- 25HP256 ---------- 25320A ---------- 25HP512 ---------- 25640A ---------- 25P1024 ---------- There are four levels of Block Protection that can be supported on these devices: Start/End Block (BP1), (BP0 Protection Addresses Security Fuse settings: SF2, SF1 25128A ------------------------------------ -------------------- 0, 0 None 0, 1 $3000->$3FFF 1, 0 $2000->$3FFF 1, 1 $0000->$3FFF ----------------------------------------------------------- Start/End Block (BP1), (BP0) Protection Addresses Security Fuse settings: SF2, SF1 25HP256 25HP512 ------------------------------------ ------------ ------------ 0, 0 None None 0, 1 $6000->$7FFF $C000->$FFFF 1, 0 $4000->$7FFF $8000->$FFFF 1, 1 $0000->$7FFF $0000->$FFFF ---------------------------------------------------------------- Start/End Block (BP1), (BP0) Protection Addresses Security Fuse settings: SF2, SF1 25080A 25160A ------------------------------------ ------------ ------------ 0, 0 None None 0, 1 $0300->$03FF $0600->$07FF 1, 0 $0200->$03FF $0400->$07FF 1, 1 $0000->$03FF $0000->$07FF ---------------------------------------------------------------- Start/End Block (BP1), (BP0) Protection Addresses Security Fuse settings: SF2, SF1 25320A 25640A ------------------------------------ ------------ ------------ 0, 0 None None 0, 1 $0C00->$0FFF $1800->$1FFF 1, 0 $0800->$0FFF $1000->$1FFF 1, 1 $0000->$0FFF $0000->$1FFF ---------------------------------------------------------------- Start/End Block (BP1), (BP0) Protection Addresses Security Fuse settings: SF2, SF1 25P1024 ------------------------------------ -------------------- 0, 0 None 0, 1 $18000->1FFFF 1, 0 $10000->1FFFF 1, 1 $00000->1FFFF --------------------------------------------------------------- Enabling the "Erase EE device" option will ONLY remove all block protection. NOTE: The "Erase EE device" option must be enabled when re-programming the device in order to remove the Block Protection. NOTE: The "Erase EE device" option will NOT Erase the device. To re-program the device you must disable Blank/Illegal Bit checks flags. To program the Hardware Write Protection option (WPEN) enable the "Program protect reg." flag. Performing a Load operation will also load the Status Register Protection Bits into the following address locations in User RAM: 25080A = Address $0400 25160A = Address $0800 25128A = Address $4000 25HP256 = Address $8000 25320A = Address $1000 25HP512 = Address $10000 25640A = Address $2000 25P1024 = Address $20000 The data format in the Programmer's User RAM will follow the same format as defined in the corresponding device's data sheet. Status Register Format in relation to the Protection Bits: ------------------------------------------------------- |Bit 7 |Bit 6 |Bit 5 |Bit 4 |Bit 3 |Bit 2 |Bit 1 |Bit 0 | |-------------------------------------------------------| | WPEN | X | X | X | BP1 | BP0 | X | X | ------------------------------------------------------- *********************************************************************** 25F512 ------- 25F1024 -------- 25F2048 --------- Four levels of "BLOCK PROTECT" can be implemented for these devices: Security Fuse Corresponding Settings Block Protect Addresses SF2 SF1 25F512 25F1024 25F2048 ------------- ------------ ------------ ----------- 0 0 None None None 0 1 $0->$FFFF $18000->$1FFFF $30000->3FFFF 1 0 $0->$FFFF $10000->$1FFFF $20000->3FFFF 1 1 $0->$FFFF $00000->$1FFFF $00000->3FFFF Enabling the "Erase EE device" option will remove all block protection. ************************************************************************ 88SC0104C ---------- 88SC0204C ---------- 88SC0404C ---------- 88SC0808C ---------- 88SC1616C ---------- 88SC3216C ---------- 88SC6416C ---------- 88SC12816C ---------- 88SC25616C ---------- ATM 88SCxxxx(Crypto Memory) --------------------------- The devices in this family have a structure defined into two parts: 1. The User memory. (this varies in size for every device) 2. The Configuration memory has fixed size of $100 bytes and is located after the user memory. All the locations from user memory are accessibly by programmer, but this is not true for configuration memory area. Few memory locations are reserved here. The configuration zone consists of EEPROM memory used for storing passwords, keys, codes and defining security levels to be used for each User Zone. The configuration memory has some programmable area and some system /reserved area (which is not accessible to the user). This configuration area is programmed partially with the User memory and some part is done with security or the fuses. This device has a unique feature the user has to write the password successfully in the device to enter in the configuration zone. If password does not match, the device allows for 4 retries. Else the device becomes inaccessible permenently. The device memory map and the sizes of the memories are as defined below.The Security code that should be read from the Comfiguration memory locations 0xE9, 0xEA, 0xEB is given in the last column. If this password presentations code does not match with the code in device, the attempts counter is decremented. Once the attempts counter reaches $00, the associated password set is permanently locked. Data in the programmer's User Memory is partitioned as follows: Device type User Memory Configuration User Memory Config. Memory Size Mem Size Map Map ----------------------------------- ------------ ---------------- 88SC0104C ox80 0x100 0-0x7f 0x80 - 0x17f 88SC0204C 0x100 0x100 0-0xff 0x100- 0x1ff 88SC0404C 0x200 0x100 0-0x1ff 0x200- 0x2ff 88SC0808C 0x400 0x100 0-0x3ff 0x400- 0x4ff 88SC1616C 0x800 0x100 0-0x7ff 0x800- 0x8ff 88SC3216C 0x1000 0x100 0-0xfff 0x1000- 0x10ff 88SC6416C 0x2000 0x100 0-0x1fff 0x2000- 0x20ff 88SC12816C 0x4000 0x100 0-0x3fff 0x4000- 0x40ff 88SC25616C 0x8000 0x100 0-0x7fff 0x8000- 0x80ff Device type Key to security Locations -E9,EA,EB ------------ ------------------- 88SC0104C 0xDD,0x42,0x97 88SC0204C 0xE5,0x47,0x47 88SC0404C 0x60,0x57,0x34 88SC0808C 0x22,0xE8,0x3F 88SC1616C 0x20,0x0C,0xE0 88SC3216C 0xCB,0x28,0x50 88SC6416C 0xF7,0x62,0x0B 88SC12816C 0x22,0xEF,0x67 88SC25616C 0x17,0xC3,0x3A Default Device Configuration is programmed along with the user memory. The configuration memory bytes programmed are as below. $00 - $ 0F - 10 bytes (ATR,FAB,MTZ,CMC) $19 - $ 1F - 07 bytes (Identification Number) $40 - $ 4F - 10 bytes (Issuer Code) Security Fuses Programming: --------------------------- To enable Security Fuses Programming set the respective fuse programming option to 'Y' Fuse 1 is 'FAB' - This fuse locks the Answer To Reset and Fab Code portions of the Configuration Zone. Fuse 2.is 'CMA' - This fuse locks the Card Manufacturer Code of the Configuration Zone. Fuse 3.is 'PER' - This fuse locks the remaining portions of the Configuration Zone. If any of these fuses is programmed, the following components of configuration memory are programmed along with it. $18 - $ 18 - $1 bytes DCR code ( 1 bytes ) $20 - $ 3F - $20 bytes Access registers $B0 - $ EF - $40 bytes PASSwords registers Please refer the manufacturers data sheet for more details. ************************************************************************ 26DF081A ---------- NOTE: The "Erase EE device" option MUST be enabled when re-programming the device! Block limits are not supported for this device. Device has an electronically erasable array. When re-programming the device, enable the "Erase EE Device" option. ************************************************************************ ATF18F002 ---------- ATF18F010 ---------- ATF18F040 ---------- ATF18F080 ---------- The device memory map corresponds directly to the User's RAM. Data in the programmer's User Memory is partitioned as follows: ATF18F002 ATF18F010 ATF18F040 ATF18F080 ------------ ------------ ------------ ------------ CONFIGURATION BITS : 0 - 1FFFFh 0 - 3FFFFh 0 - 7FFFFh 0 - DFFFFh USER ACCESSIBLE MEMORY: - - A0000 - DFFFFh - UES CODE :E0100h-E00103h E0100h-E00103h E0100h-E00103h E0100h-E00103h Enable Software Data Protection by enabling Program security fuse flag. Program Security fuse 1: Read Security Program Security fuse 2: Write Security 32-bit UES code can be placed starting at at E0100h as per the manufacturer memory map. The data at these location will get programmed by default as part of the programming operation. If you do not want to program this area fill the locations with FFh. ************************************************************************ ************************************************************************ ************************************************************************