TSC80251G1
1
MA
TRA MHS
Rev
. B
– 27
May 1997
1.1. Internal ROM Features
The internal ROM of the TSC80251G1 derivatives contains five different areas:
D
Code Memory
DConfiguration Bytes
D
Lock Bits
DEncryption Array
D
Signature Bytes
1.1.1. EPROM/OTP Devices
All the Internal ROM but the Signature Bytes of the TSC87251G1 products is made of EPROM cells. The Signature
Bytes
of the TSC87251G1 products are made of Mask ROM.
The
TSC87251G1 products are programmed and verified in the same manner as Intel’
s 87C251Sx, using the same algo
-
rithm, which programs at VPP=12.75V using a series of five 100 µs pulses per bytes. This results in a programming
time of approximately 16 seconds for the 16 Kbyte on–chip code memory.
The EPROM of TSC87251G1 products in Window CQPJ is erasable by Ultra–Violet radiation (UV). UV erasure set
all
the EPROM memory cells to one and allows a reprogramming. The quartz window must be covered with an opaque
label when the device is in operation. This is not so much to protect the EPROM array from inadvertent erasure, as
to
protect the RAM and other on–chip logic. Allowing light to impinge on the silicon die during device operation may
cause a logical malfunction.
Note:
Erasure of the EPROM begins to occur when the chip is exposed to light wavelength shorter than 4000Å. Since sunlight and fluorescent light have
wavelength in this range, exposure to these light sources over an extended time (1 week in sunlight or 3 years in room–level fluorescent lighting)
could cause inadvertent erasure.
The TSC87251G1 products in plastic packages are One Time Programmable (OTP). Then an EPROM cell cannot be
reset by UV once programmed to zero.
1.1.2. Mask ROM Devices
All
the Internal ROM of TSC83251G1 products is made of Mask ROM cells. They can be verified using the same algo
-
rithm
as the EPROM/OTP devices.
1.1.3. ROMless Devices
The TSC80251G1 products include only Configuration Bytes and Signature Bytes made of Mask ROM cells. They
can be verified using the same algorithm as the EPROM/OTP devices.
These products do not include on–chip Code Memory, Lock Bits or Encryption Array.
EPROM Programming
TSC80251G1
2Rev.
B
– 27
May 1997
MA
TRA MHS
1.1.4. Security Features
In some microcontrollers applications, it is desirable that the user program code be secured from unauthorized access.
The TSC87251G1 and TSC83251G1 products offer two kinds of protection for program code stored in the on–chip
array:
DProgram
code in the on–chip Code Memory is encrypted when read out for verification if the Encryption Array is
Programmed.
DA
three–level lock bit system restricts external access to the on–chip code memory
.
1.1.5. Lock Bit System
The TSC87251G1 derivatives implement 3 levels of security for User’s program as described in T
able 1.
The first level locks the programming of the User’s internal Code Memory and the Encryption Array. The Configura-
tion
Bytes and the Lock Bits are always programmable.
The
second level locks the verifying of the User
’
s internal Code Memory
. It is always possible to verify the Configura
-
tion Bytes and the Lock Bits. It is never possible to verify the Encryption Array.
The third level locks the external execution.
T
able 1
Lock bits programming
Level Lock bits
LB[2:0] Internal
Execution External
Execution Verify Programmable External
PROM read
(MOVC)
0 000 Yes Yes Yes* Yes Yes**
1 001 Yes Yes Yes* No No
2 011 Yes Yes No No No
3111 Yes No No No No
Reserved Other x x x x x
Notes:
* returns encrypted data if Encryption Array is programmed.
** returns non encrypted data.
Level 1 should be set before programming Level 2; Level 2 should be set before programming Level 3.
The security level may be verified according to T
able 2.
T
able 2
Lock bits verification
Level Lock bits Data
0 xxxxx000
1 xxxxx001
2 xxxxx01x
3 xxxxx1xx
TSC80251G1
3
MATRA
MHS
Rev
. B
– 27
May 1997
1.1.6. Encryption Array
The TSC87251G1 and TSC83251G1 controllers include a 128–byte Encryption Array located in nonvolatile memory
outside the memory address space. During verification of the on–chip code memory, the seven low–order address bits
also address the Encryption Array. As the byte of the code memory is read, it is exclusive–NOR’ed (XNOR) with the
key byte from the Encryption Array. If the Encryption Array is not programmed (still all 1s), the user program code
is placed on the data bus in its original, unencrypted form. If the Encryption Array is programmed with key bytes, the
user program code is encrypted and cannot be used without knowledge of the key byte sequence.
To preserve the secrecy of the encryption key byte sequence, the Encryption Array can not be verified.
Caution:
When a MOVC instruction is executed the content of the ROM is not encrypted. In order to fully protect the user program code, the lock bit level 1
(see Table 1) must always be set when encryption is used.
Note:
The TSC83251G1 derivatives do not provide lock bit choice. However they always provide the protection of the lock bit level 1 (see Table 1) when
the encryption is used.
Caution:
If
the encryption featur
e is implemented, the portion of the on–chip code memory that does not contain pr
ogram code should be filled with “random”
byte values other than FFh to prevent the encryption key sequence from being revealed.
1.2. Signature Bytes
The TSC87251G1, TSC83251G1 and TSC80251G1 contain factory–programmed Signature Bytes. These bytes are
located in non–volatile memory outside the memory address space at 30h, 31h, 60h and 61h. To read the Signature
Bytes, perform the procedure described in section 1.4., “Verify Algorithm”, using the verify signature mode (see
Table 5). Signature byte values are listed in T
able 3.
T
able 3
Signatur
e Bytes (Electr
onic ID)
Signature Address Signature Data
Vendor TEMIC 30h 58h
Architecture C251 31h 40h
Memory 16K ROM 60h FBh
Revision
None (Intel core step A)
61h
FFh
Revision
None
(Intel
core
step
A)
First (Intel core step D) 61h
FFh
FEh
1.3. Programming Algorithm
Figure 1 shows the hardware setup needed to program the TSC87251G1 EPROM areas:
DThe chip has to be put under reset and maintained in this state until the completion of the programming sequence.
DThen PSEN# has to be to forced to a low level for 14 clock cycles before any other operation and it has to be
maintained in this state until the completion of the programming sequence.
DThe voltage on the EA# pin must be set to VCC.
DThe
programming mode is selected according to the code applied on Port 0. It has to be applied until the completion
of this programming operation.
DThe
programming address is applied on Ports 1 and 3 which are respectively the Most Significant Byte (MSB) and
the Least Significant Byte (LSB) of the address.
DThe programming data are applied on Port 2.
TSC80251G1
4Rev
. B
– 27
May 1997
MA
TRA MHS
DThe EPROM Programming is done by raising the voltage on the EA# pin to VPP, then by generating low level
pulses on ALE/PROG# pin (See Table 4).
DThe voltage on the EA# pin must be lowered to VCC before completing the programming operation.
DIt is possible to alternate programming and verification operation (See section 1.4.). Please make sure the voltage
on the EA# pin has actually been lowered to VCC before performing the verification operation.
RST
EA#/VPP
ALE/PROG#
PSEN#
VDD
P3[7:0]
P1[7:0]
VSS
XTAL1
P2[7:0]
P0[7:0]
VPP
5 x 100 µs
A[7:0]
A[14:8]
Mode
Data
VCC
TSC87251G1
VCC
4 to 6 MHz
Figure 1 Setup for EPROM Programming
T
able 4
EPROM Programming Modes
EPROM Mode RST EA# PSEN# ALE/PROG# P0 P2 P1(MSB) P3(LSB) Notes
On–chip Code Memory 1 VPP 0 5 Pulses 68h Data Address (16K)
0000h-3FFFh 1
Configuration Bytes 1 VPP 0 5 Pulses 69h Data CONFIG0: 0080h
CONFIG1: 0081h 1
Lock Bits 1 VPP 0 5 Pulses 6Bh X LB0: 0001h
LB1: 0002h
LB2: 0003h
1
Encryption Array 1 VPP 0 5 Pulses 6Ch Data 0000h-007Fh 1
Notes:
1. The ALE/PROG# pulse waveform is shown in Figure 3.
TSC80251G1
5
MATRA
MHS
Rev
. B
– 27
May 1997
1.4. Verify Algorithm
Figure 2 shows the hardware setup needed to verify the internal ROM areas of the TSC80251G1 derivatives:
DThe chip has to be put under reset and maintained in this state until the completion of the verify sequence.
DThen PSEN# has to be to forced to a low level for 14 clock cycles before any other operation and it has to be
maintained in this state until the completion of the programming sequence.
DThe voltage on the EA# pin must be set to VCC and ALE must be set to an high level.
DThe
V
erify Mode is selected according to the code applied on Port 0. It has to be applied until the completion of this
verification.
DThe verification address is applied on Ports 1 and 3 which are respectively the MSB and the LSB of the address.
DThen device is driving the data on Port 2. It is valid 48 clock periods after the address is stable.
DIt is possible to alternate programming and verification operation (See section 1.3.). Please make sure the voltage
on the EA# pin has actually been lowered to VCC before performing the verification operation.
T
able 5 Verify Modes
Verify EPROM RST EA# PSEN# ALE P0 P2 P1(MSB) P3(LSB)
On–chip code memory 1 1 0 1 28h Data Address (16K)
0000h-3FFFh
Configuration Bytes 1 1 0 1 29h Data 0080h-0083h
Lock Bits 1 1 0 1 2Bh Data 0000h
Signature Bytes 1 1 0 1 29h Data 30h, 31h, 60h, 61h
ALE/PROG#
RST
EA#/VPP
PSEN#
VDD
P3[7:0]
P1[7:0]
VSS
P0[7:0]
A[7:0]
A[14:8]
Mode
VCC
TSC8x251G1
VCC
Data
XTAL1
P2[7:0]
4 to 6 MHz
Figure 2 Setup for Verification
TSC80251G1
6Rev
. B
– 27
May 1997
MA
TRA MHS
1.5. AC Characteristics
T
able 6
EPROM Programming & Verification Characteristics
( TA = 0 to 40°C ; VCC = 5V ± 10%)
Symbol Parameter Min Max Units
VPP Programming Supply Voltage 12,5 13 V
IPP Programming Supply Current 75 mA
TOSC Oscillator Frequency 167 250 ns
TAVGL Address Setup to PROG# low 48TOSC
TGHAX Address Hold after PROG# low 48TOSC
TDVGL Data Setup to PROG# low 48TOSC
TGHDX Data Hold after PROG# 48TOSC
TEHSH ENABLE High to VPP 48TOSC
TSHGL VPP Setup to PROG# low 10 ms
TGHSL VPP Hold after PROG# 10 ms
TGLGH PROG# Width 90 110 ms
TAVQV Address to Data Valid 48TOSC
TELQV ENABLE low to Data Valid 48TOSC
TEHQZ Data Float after ENABLE 0 48TOSC
TGHGL PROG high to PROG# low 10 ms
VDD
Mode = 68h, 69h, 6Bh or 6Ch
Data
Address
P1 = A14:8
P3 = A7:0
P2 = D7:0
ALE/PROG#
EA#/VPP
P0
TEHSH
TSHGL
TGLGH
TGHGL
TAVGL
TDVGL TGHDX
123 45
VPP
VSS
TGHAX
TGHSL
Figure 3
T
imings for EPROM Programming
TSC80251G1
7
MA
TRA MHS
Rev
. B
– 27
May 1997
TELQV TEHQZ
Address
Data
TAVQV
P1 = A14:8
P3 = A7:0
P2 = D7:0
P0 Mode = 28h, 29h or 2Bh
Figure 4
T
imings for EPROM Verification
