Change Code, External Circuits | Mitsubishi DS5000TK, DS907x SIP

USER'S GUIDE

Change Code

Perhaps most importantly, the user should reprogram portions of the Secure Microcontroller that deal with se- curity. For example, if the microprocessor is performing DES, the user can change DES keys. Any security sys- tem can be broken with enough time and resources. By altering the security features, this threat can be mini- mized.

External Circuits

A variety of external circuits can support secure opera- tion. For example, the DS2400 is a unique 48±bit Silicon Serial Number. If it is installed with the microprocessor, it can be read when the system is first powered up, then

stored inside the Secure Microcontroller. This serializes the system. If the software ever finds a different serial number (or missing number) from the stored one, it can refuse to work. This would mean that the microproces- sor had been moved.

Tamper Protection

Using a variety of tamper sensors in conjunction with the DS5002 makes the system very difficult to crack. These circuits vary from simple switches to light, temperature, pressure, or oxygen sensors. When the physical secu- rity is violated, the SDI pin is activated and the memory contents are destroyed.

050396 80/173

81

Image 81

Mitsubishi DS5000TK, DS907x SIP manual Change Code, External Circuits, Tamper Protection

Contents

Table of Contents Introduction Software SecuritySeparate ADDRESS/DATA BUS IN±SYSTEM Loading Large Nonvolatile MemoryHigh Reliability Operation Module Description ON±BOARD Memory Package DS5000FP Soft Microprocessor Chip Product DescriptionDS5000T Soft Microcontroller Module DS2250T Soft Microcontroller Module DS2251T 128K Soft Microcontroller Module DS5002FP Secure Microprocessor ChipDS2252T Secure Microcontroller Module Chip Description Maximum Speed Part Number Selection GuideModule Description Speed Clock Part Number Secure Microcontroller Architecture Secure Microcontroller Architectural Block Diagram Figure Parallel I/O Timed Access LogicProgram/Data RAM Interface High±Reliability Circuitry Resident Loader ROM Watchdog Timer Secure Microcontroller Memory Organization Programmers GuideSecure Microcontroller Memory MAP ±1 Internal Registers Scratchpad Register MAP ±2 Program and Data Memory PSW.4±3 R1±R0 Register Bank SelectBank Starting Address R0 Important Application Note DS5000 Series Memory Organization DS5000 Series Memory MAP ±3 Memory map. The first is the EA pin. The second isOverrides the condition of the EA pin as well DS5000 Memory Map Control DS5000 Series Mcon Register ±4 Bit DescriptionPA3 MCON.3 DS5001/DS5002 Memory OrganizationRA32/8 MCON.2 ECE2 PA3 PA2 PA1 PA0 Partition BYTE±WIDE BUS Memory MAP RG1 RG0 Range CE1 Access CE2 Access Partitionable Memory MAP for DS5001/DS5002 Series ±5 Msel RG1 RG0 Program Data Program Access Data AccessCE1 CE3 CE4 CE1 CE2 CE3 DS5001/DS5002 Memory Mapped Peripherals NON±PARTITIONABLE Memory MAP for DS5001, DS5002 Series ±6 DS5001/DS5002 Memory Map Control Peripheral Enables in the Data Memory MAP ±7 PA3 PA2 PA1 PA0 RG1 PES DS5001/DS5002 Series Mcon Register ±8MCON.3 RG1 MCON.2 PES RPCTL.5 Exbs Loading and Reloading Program MemoryRPCTL.4 RPCTL.0 RG0 050396 23/173 Reloading Portions of a DS5000 Series Device ±10 Soft Reload of a DS5001/DS5002 Reloading a DS5001/DS5002 Series Device ±11 Special Function Registers ECE2 DS5000 Series Special Function Register MAP ±12 CRC DS5001/DS5002 Series Special Function Register MAP ±13 Label Pcon Register Address 087H Power Control Register PCON.2 EWT PCON.3EPFWPCON.1 Stop PCON.0 IDL Label Tcon Register Address 088H Timer Control Register Label Tmod Register Address 089H Timer Mode RegisterTCON.0 IT0 Gate LabelSCON Register Address 098H Serial Control Register LabelIE Register Address 0A8H Interrupt Enable RegisterSCON.0 ET1 LabelIP Register Address 0B8H Interrupt Priority Register Label CRC Register Address 0C1H DS5001 CRC RegisterRNGE3±0 CRC.1 MDM LabelMCON Register Address 0C6H DS5000 Memory Control RegisterPA3 PA2 PA1 PA0 RA32/8 DS5001 Mcon Register Label Mcon Register Address 0C6HMCON.0 Accessed by Movx instructions on the Byte±wide bus LabelPSW Register Address 0D0H Program Status Word Register Label Rpctl Register Address 0D8H DS5001/DS5002 RPC Control RegisterRPCTL.7 RNR RPCTL.3 IBI Label RPS Register Address 0DAH DS5001/DS5002 RPC Status RegisterRPCTL.1 Rpcon IA0 IBF RPS.1RPS.0 OBF Addressing Modes Instruction SETADD A, R4 Setb 00H Addressing ±20 Branch to the location PC+2 ±Acall 100H Call to the subroutine at Address Instructions That Affect Flag Settings Program Status FlagsFlags Instruction OV AC Recommended SRAMs for USE with Soft Microcontrollers ±1 Memory InterconnectData Reten Part Tion Current RAM Size Vendor 25C 40C 70C Memory Interconnect of the DS5000FP ±1 DS5000 Series Module Block Diagram ±2 Memory Interconnect of the Partitionable DS5001/DS5002 ±3 Óóóóóóóóó Ó Óóóóóóóó 52 14Ó GND Memory Interconnect Using the 128K Sram ±5 DS2251T±128 Block Diagram ±6 Ôôôôôô DS2252T±32 Block Diagram ±7 LITHIUM/BATTERY Backup Battery Backed CircuitsData Retention Battery Attach Procedure Power Supply Slew Rate ±1Battery Lifetime Battery attached 54 * 10±3 180 * 10±32400 + 75 * 10±9 * 24 21.68 * 10±3 Freshness Seal Lithium Battery Usage Idle Mode Power ManagementCONTROL/STATUS Bits for Power Control ±1 Bit Description ªPower On Resetº Mode Program ALE Psen Memory Stop ModePIN States in IDLE/STOP Modes ±1 PCON.3 Epfw Voltage Monitoring Circuitry Secure Microcontroller Power Cycling Timing ±2 Total Power Failure Power Fail InterruptPartial Power Failures Vpfw threshold is above the specified minimum Reset Vector Secure Microcontroller Power Management ±3 Timed Access Timed Access ±1Software Control BIT Name Micro Version Location Description Timed Access Protected Control Bits ±1 050396 66/173 Watchdog Timer ±2 0C7H, #055H 2nd TA ValueIP.7 CRC Memory Verification Watchdog Timer Control Bits Range 3±0 DS5001 CRC Register Address 0C1hCRC.1 CRC.0 This routine tests the CRC±16 circuit in the DS5001FP CRC Code Example ±3 Firmware Security FeatureSecurity Overview DS5001 DS5000 DS5002 Security Lock RAM MemoryEncrypted Memory DS5002 Software Encryption Block Diagram ±2 DS5000 Software Encryption Block Diagram ±1 050396 74/173 Encryption Algorithm Encryption KeyEncryption Key Selection and Loading Dummy BUS Access Timing ±3 Dummy Bus Access Self±Destruct Input On±chip Vector RAMMicroprobe/Die Top Coating Random Number Generator Security Summary by Part DS5000FP / DS5000T / DS2250TDS5001FP / DS2251T Application Advanced Security Techniques Change Code External CircuitsTamper Protection Reset Conditions Reset SourcesReset Status Bits ±1 Special Function Register Reset States ±1 Reset Condition Reset TypeRegister Power On Reset Power on Reset Timing ±2Chanical and some time is required to get the mass No±VLI Power On Reset External ResetWatchdog Timer Reset Application Reset Routine Example Memory Interrupts TIMERS/SERIAL ProtectionMemory Map Timed ± DS5000 only Interrupts Tively. Shown here is an example of Timer and Serial TimersMicroprocessor disables timer activity excluding Protection Interrupts Interrupt Source Enable BIT LocationInterrupt Sources Interrupt Source Vector Address Flag Flag Location Power±fail Warning Interrupt Timer InterruptsMachine cycle when the interrupts are enabled. INT0 is External Interrupts Interrupt Request Sources ±1 Simulated Interrupts Interrupt Enable Control Bits ±2 Bit Description ET0EX0 Interrupt Priority Control Bits ±3 Bit Description Interrupt PrioritiesPriority Flag Interrupt Source IP.4 Interrupt Acknowledge Interrupt Acknowledge Sequence ±4Flag Vector Address Interrupt Source 050396 94/173 Port 0 Functional Circuitry ±1 Parallel I/O OverviewPIN Name Function Port 2 Functional Circuitry Port 1 Functional Circuitry Output Functions Port 3 Functional Circuitry Input Function Parallel Port Output Buffers Ports 1, 2, and 3 ±2 Reprogrammable Peripheral Controller RPC READ±MODIFY±WRITE InstructionsMnemonic Description Port 0 D0±7 USE of the RPC Mode ±4 USE of the RPC Mode ±3Command RPC Interrupts ST7 ST6 ST5 ST4 IAO IBF OBF RPC Status Register ± Status Address 0DAH ±5 DMA Operation RPC ProtocolDbbout 103 RPC Control Register ± Rpctl Address 0D8H ±6 Port 2 becomes the control signals as shown in ±3RNR Exbs IBI DMA Rpcon RG0 Rpcon bit is set Programmable Timers Functional Description TMOD.6 Timer TMOD.2 TimerTmod Register Control BIT Summary ±1 Bit Description Tcon Register CONTROL/STATUS Bits ±2 TMOD.5, TMOD.4TMOD.1, TMOD.0 Mode TIMER/COUNTER Mode 0 and 1 Operation ±3Scribed for TR0, TF0, and INT0 107 108 TIMER/COUNTER Mode 2 Operation ±4 109 Timer 0 Mode 3 Operation ±5 Serial I/O Function Description Mode SYNC/ASYNC Baud ClockSerial Port Operating Modes ±1 START/STOP Mode Sync Bits CLK Async Timer 1 Overflow Mode Function Word Length PeriodSerial Port Control Register ±1 Bit Description ªXmit Bit 8º SCON.1 SCON.2 RB8SCON.0 Baud Rate Generation Synchronous Operation Mode Timer 1 Baud Rate Generation ±2Smod Timer TH1 Baud Rate BPS 114 115 Mode 0 Block Diagram and Timing ±2 116 Asynchronous Operation Mode 2 Smod BRG Clock117 118 Serial Port Mode 1 Block Diagram ±3 119 MODE2 and 3 Block Diagram ±4 Mode Function Word Length Baud Clock Application Serial Port InitializationSerial I/O Operating Modes TB8 RB8 SM0 SM1 SM2 RENET1 EX1 ET0 EX0 PT1 PX1 PT0 PX0 Smod POR PFW WTR Epfw EWT Stop IDL TF1 TR1 TF0 TR0IE1 IT1 IE0 123 Crystal Connection ±1 CPU Timing OscillatorClock Source Input ±2 XTAL1 125 Instruction Timing BYTE±WIDE RAM Instruction Execution Timing ±3 Expanded Program Memory Timing126 127 Expanded Program Memory Fetch ±4 Expanded Data Memory Read ±5 Expanded Data Memory Write ±6128 Expanded Data Memory Timing Complete RD cycle, including activation of ALE and RD129 Program Loading Introduction Invoking the Bootstrap LoaderDS5000FP DS5001/2FP 130 DS5001/DS5002 Series DS5000 SeriesExiting the Loader 131 MODEM=1 PROG=0 132 Serial Program Load Mode Serial Load Configuration ±2133 Baud Rate AUTO±BAUD Rate DetectionCrystal Freq MHz 300 1200 2400 57600 Command Line Interface Bootstrap Loader InitializationCommand Line Syntax Command Function Version Begin±address end±address Command Summaries→ 000AH AB → 00ABH ABC → 0ABCH Abcd → 0ABCDH Abcde → 0BCDEH Byte±1 byte±2 byte±3 byte±4 byte±5 Byte begin±address end±addressByte P0 value P1 value P2 value P3 value CRC/MCON/MSL/RPCTL byte Xon/XoffMcon MSL Eextarg Error Messages EargreqEillcmd Eillopt 140 Intel HEX File Format Parallel Program Load Operation Parallel Program Load Configuration ±3Parallel Program Load Cycles ±4 141 Mode RST Psen Prog Parallel Program Load Mode8751±COMPATIBLE Program Load Cycles ±3 P2.7 P2.6 P2.5 Parallel Programming Concerns RPC Program Mode OperationPulses specified, each with a low time of 90 to 143 REAL±TIME Clock DS5000T/DS2250T Functional Block Diagram ±1DS1215 Phantom Time Chip 144 145 146 Pattern Comparison Register Description ±2 147 DS1215 Register Entry Flowchart ±3 Registers DS1215 Time Registers Description ±4Special Bits 148 149 Time Register Examples ±5 150 DS1283 Watchdog Timekeeper Chip DS2251T/DS2252T RTC Block Diagram ±6 Memory MAP151 152 DS1283 REAL±TIME Clock Memory MAP ±7 DS1283 REAL±TIME Clock Command Register ±8 Alarm Condition Alarm Maskbit Operation ±9DS1283 RTC Interrupts Mask 155 Application Using the DS5000T RTC DS1215 Example 156 Wbyte 157 RET 158 159 Application Using the DS2251T RTC DS1283 Example 160 161 162 163 Unexplained Device Resets TroubleshootingRAM Loses Data When Powered Down Time Microcontroller Reads the Wrong Time Unable to Invoke Stop Mode Serial Port does not WorkProgram will not Execute Data is Lost or Corrupted High Current Drain in Stop ModeINT0 is Stuck LOW on DS2252T DS5000TK KIT does not Respond to KIT5K Software DOS Mnemonic Instruction Code HEX Byte Cycle Explanation Instruction SET Details CLR a CPL a DA a RLC a RL aRR a RRC a Mnemonic Instruction Code HEX Byte Setb bit Bit = CLR bit Bit =CPL bit Bit = bit ANL C, bit = C and bit RET RetiDptr NOP