Mitsubishi DS5000TK Bedienungsanleitung

T ABLE OF CONTENTS i SECURE MICROCONTROLLER USER’S GUIDE 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Section 1 Introduction 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Section 2 Selection Guide 6 . . . [...]

USER’S GUIDE 050396 1/173 2 SECTION 1: INTRODUCTION The Secure Microcontroller family is a line of 8051–compatible devices that utilize nonvolatile RAM (NV RAM) rather than ROM for program storage. The use of NV RAM allows the design of a “soft” microcon- troller which provides a number of unique features to embedded system designers. Forem[...]

USER’S GUIDE 050396 2/173 3 LARGE NONVOLA TILE MEMOR Y Soft Microprocessor chips provide nonvolatile memory control for standard CMOS SRAM. Modules combine the microprocessor chip with memory and lithium back- up. This includes conditionally write protected chip en- ables and a power supply output that switches between +5V and battery backup. The[...]

USER’S GUIDE 050396 3/173 4 PRODUCT DESCRIPTION All devices listed below have the standard 8051 family feature set listed once here for convenience, but not re- peated for each device. • 8051–compatible instruction set • Addresses 64K program and 64K data memory • Four 8–bit pseudo–bidirectional I/O ports • 128 bytes scratchpad RAM [...]

USER’S GUIDE 050396 4/173 5 DS2251T 128K Soft Microcontroller Module The DS2251T is a SIMM based on the DS5001. It pro- vides up to 128K bytes of on–board NV RAM and has the Byte–wide bus available at the connector . This is used with the decoded peripheral enables for memory mapped peripherals such as a UAR T or A/D converter . The real–ti[...]

USER’S GUIDE 050396 5/173 6 SECTION 2: SELECTION GUIDE The following configurations are available. Speeds are rated maximums, but all members of the Secure Micro- controller family are fully static and can be run as slow as desired. CHIP DESCRIPTION MAXIMUM SPEED P ART NUMBER DS5000FP–16 Soft Microprocessor Chip 16 MHz DS5000FP–16 DS5001FP–[...]

USER’S GUIDE 050396 6/173 7 SECTION 3: SECURE MICROCONTROLLER ARCHITECTURE Introduction The Secure Microcontroller family is based on an 8051 compatible core with a memory interface and I/O logic build around it. Many functions are identical to standard 8051s and are documented here for completeness. In general, most architecture features apply t[...]

USER’S GUIDE 050396 7/173 8 SECURE MICROCONTROLLER ARCHITECTURAL BLOCK DIAGRAM Figure 3–1 15 8 CE1 CE2 R/W ADDRESS ENCRYPTOR DA T A ENCRYPTOR TIMING AND CONTROL TA MCON SECURITY LOCK LOGIC PCON TIMED ACCESS LOGIC MEMORY ALLOCA TIONS CTL. LOGIC NONVOLA TILE CONTROL INTERRUPT CONTROL IP IE INTERNAL DA TA BUS ST ACK POINTER PSW IDR ADDR. REGISTER [...]

USER’S GUIDE 050396 8/173 9 Parallel I/O Four SFR’s provide access for the four parallel I/O port latches. These I/O ports are denoted as P0, P1, P2, and P3. A total of 32 bits of parallel I/O is available through these I/O ports. However , up to 16 bits are sacrificed when the Expanded Bus mode is used to interface to ex- ternal memory and up [...]

USER’S GUIDE 050396 9/173 10 W atchdog Timer When the user’s software is being executed, the W atch- dog T imer can be used to automatically restart the pro- cessor in the event that software control is lost. It is also used to generate an oscillator start–up delay to allow the clock frequency to stabilize. This occurs during reset cycles tha[...]

USER’S GUIDE 050396 10/173 11 SECTION 4: PROGRAMMER’S GUIDE The Secure Microcontroller uses nonvolatile RAM technology for both Program and Data memory . It uses NV SRAM in place of ROM by write protecting and de- coding memory segments that a user designates as Program memory . The remaining RAM area is used as nonvolatile data storage. One of[...]

7FH 2FH 2EH 2DH 2CH 2BH 2AH 29H 28H 27H 26H 25H 24H 23H 22H 21H 20H 1FH 18H 17H 10H 0FH 08H 07H 00H BANK 3 BANK 2 BANK 1 BANK 0 MSB LSB 7F 7E 7D 7C 7B 7A 79 78 77 76 75 74 73 72 71 70 6F 6E 6D 6C 6B 6A 69 68 67 66 65 64 63 62 61 60 5F 5E 5D 5C 5B 5A 59 58 57 56 55 54 53 52 51 50 4F 4E 4D 4C 4B 4A 49 48 47 46 45 44 43 42 41 40 3F 3E 3D 3C 3B 3A 39 3[...]

USER’S GUIDE 050396 12/173 13 The 8051 instruction set allows efficient (single cycle) access to variables when using the Working Registers. These are a group of four 8–byte banks of Scratchpad RAM. The active Working Registers are referred to as R0–R7. They reside between location 00h and 1Fh, de- pending on which bank is currently selected.[...]

USER’S GUIDE 050396 13/173 14 DS5000 Series Memory Organization As mentioned above, the DS5000 series consists of the DS5000FP chip and the DS5000(T) and DS2250T mod- ules. The programming model discussed in this section applies to all of these parts. The DS5000 series Byte– wide bus has 15 address lines, eight data lines, a R/W strobe, and two[...]

USER’S GUIDE 050396 14/173 15 DS5000 SERIES MEMOR Y MAP Figure 4–3 BYTE–WIDE ACCESS WITH CE2 (NONVOLA TILE RAM) FFFFh 7FFFh 1FFFh 0000 PROGRAM DA T A DA T A = NO MEMORY ACCESS LEGEND: MEMORY MEMORY MEMORY BYTE–WIDE BUS ACCESS 64K 32K 8K RANGE ADDR. BYTE–WIDE BUS ACCESS BYTE–WIDE BUS ACCESS P ARTITION ADDR. = = EXP ANDED BUS ACCESS ON PO[...]

USER’S GUIDE 050396 15/173 16 case is to select a Range of 8K, and to choose a Parti- tion of greater than 8K. This will result in the Range as the limiting factor . Addresses above the Range will auto- matically be deflected to the Expanded bus. No data memory will be allocated in NV RAM for this configura- tion. DS5000 Memory Map Control The Pa[...]

USER’S GUIDE 050396 16/173 17 MCON.3: RA32/8 “Range Address”: Sets the maximum usable address on the Byte–wide bus. RA32/8 = 0 sets Range Address = 1FFFH (8K); RA32/8 = 1 sets Range Ad- dress = 7FFFH (32K) Initialization: Set to a 1 on a No V LI Power On Reset and when the Security Lock bit (SL) is cleared to a 0 from a previous 1 state. Re[...]

USER’S GUIDE 050396 17/173 18 a Partitionable mode (PM=0), the DS5001 can use up to 64K x 8 SRAM for program and data on its Byte–wide bus. It can partition this area into program and data segments on 4K boundaries. The 64K memory space would consist of two 32K x 8 SRAMs. Each is accessed by a separate chip enable (CE1 and CE2 ), but the mi- cr[...]

USER’S GUIDE 050396 18/173 19 P ARTITIONABLE MEMORY MAP FOR DS5001/DS5002 SERIES Figure 4–5 FFFFh 0000 PROGRAM DA T A LEGEND: BYTE–WIDE BUS ACCESS BYTE–WIDE BUS ACCESS P ARTITION ADDR. = EXP ANDED BUS ACCESS ON PORTS 0 AND 2 BYTE–WIDE ACCESS (NONVOLA TILE RAM) = PES=0 64K RANGE ADDRESS MEMORY MEMORY The non–partitionable mode allows the[...]

USER’S GUIDE 050396 19/173 20 Any address that does not fall into the Byte–wide bus area is routed to the Expanded bus of Ports 0 and 2. This could only occur for the first two settings. Note that a single 128K device is the least expensive in terms of component cost and size. In this case, all memory ad- dressable by the DS5001 is stored in a [...]

USER’S GUIDE 050396 20/173 21 On occasion, a memory mapped peripheral is needed that interfaces directly to an 8051 multiplexed bus. When this occurs, MOVX instructions can be forced to use the Expanded bus in any mode with the EXBS bit (RPCTL.5). Setting this bit to a logic one forces all MOVX instructions to the Expanded bus. While EXBS=1, the [...]

USER’S GUIDE 050396 21/173 22 DS5001/DS5002 SERIES MCON REGISTER Figure 4–8 PA 3 PA 2 PA 1 PA 0 RG1 PES PM ––– Bit Description: MCON.7–4: P A3–0 Partition Address. When PM=0, this address specifies the boundary between program and data memory in a continuous space. Initialization: Unaffected by watchdog, external, or power–up resets[...]

USER’S GUIDE 050396 22/173 23 DS5001/DS5002 SERIES RPCTL REGISTER BITS AFFECTING MEMOR Y Figure 4–9 RNR ––– EXBS AE IBI DMA RPCON RG0 Bit Description: RPCTL.5: EXBS The Expanded Bus Select routes data memory access (MOVX) to the Expanded bus formed by ports 0 and 2 when set. Initialization: Cleared after all resets. Read Access: Can be re[...]

USER’S GUIDE 050396 23/173 24 Application software always has unrestricted read/write access to the nonvolatile RAM designated as data memory . This is the memory that lies above the Partition address and below the Range address (the non–parti- tionable configuration of the DS5001 will be addressed separately). Data memory is read or written us[...]

USER’S GUIDE 050396 24/173 25 MOV TA, #0AAh ; TIMED ACCESS MOV TA, #55h ; TIMED ACCESS 2 MOV MCON, #10001010b ; SET PAA BIT . ; USER’S CODE TO LOAD . ; RAM USING MOVX . . MOV TA, #0AAh ; TIMED ACCESS MOV TA, #55h ; TIMED ACCESS 2 MOV MCON, #11001000b ; LOAD NEW PARTITION AND CLEAR PAA BIT RELOADING PORTIONS OF A DS5000 SERIES DEVICE Figure 4–[...]

USER’S GUIDE 050396 25/173 26 SOFT RELOAD OF A DS5001/DS5002 When application software decides that it should repro- gram a portion of memory , the software must convert the target area into data memory . However , a Soft Re- load of a DS5001 series device has minor variations from the DS5000 version. First, there is no P AA bit in the DS5001. If[...]

USER’S GUIDE 050396 26/173 27 MOV TA, #0AAh ; TIMED ACCESS MOV TA, #55h ; TIMED ACCESS 2 MOV MCON, #00011000b ; SET PARTITION TO 1000h | ; USER’S CODE TO LOAD | ; RAM USING MOVX | | MOV TA, #0AAh ; TIMED ACCESS MOV TA, #55h ; TIMED ACCESS 2 MOV MCON, #10101000b ; LOAD NEW PARTITION OF A000h RELOADING A DS5001/DS5002 SERIES DEVICE Figure 4–1 1[...]

USER’S GUIDE 050396 27/173 28 Special Function Registers The Secure Microcontroller uses Special Function Reg- isters (SFRs) to control most functions. In many cases, an SFR will contain 8 bits, each of which control a func- tion or report status on a function. The SFRs reside in register locations 80–FFh. They can be accessed using MOV instruc[...]

F7 F6 F5 F4 F3 F2 F1 F0 E7 E6 E5 E4 E3 E2 E1 E0 C AC F0 RS1 RS0 OV P D7 D6 D5 D4 D3 D2 D1 D0 P A3 P A2 PA1 P A0 RA32/8 ECE2 PA A SL RWT PS PT1 PX1 PT0 PX0 BF – – BC BB BA B9 B8 B7 B6 B5 B4 B3 B2 B1 B0 EA ES ET1 EX1 ET0 EX0 AF – – AC AB AA A9 A8 A7 A6 A5 A4 A3 A2 A1 A0 SM0 SM1 SM2 REN TB8 RB8 TI RI 9F 9E 9D 9C 9B 9A 99 98 97 96 95 94 93 92 9[...]

C/T C/T C/T WTR POR DIRECT BYTE ADDRESS SPECIAL FUNCTION REGISTER SYMBOL (MSB) (LSB) BIT ADDRESS F7 F6 F5 F4 F3 F2 F1 F0 E7 E6 E5 E4 E3 E2 E1 E0 0F0H 0E0H NOT BIT ADDRESSABLE ST7 ST6 ST5 ST4 IA0 F0 IBF 0BF 0DAH B ACC RPS RNR ––– EXBS AE IBI DMA RPC RG0 0D8H RPCTL C AC F0 RS1 RS0 OV P 0D0H PSW NOT BIT ADDRESSABLE 0CFH RNR NOT BIT ADDRESSABLE 0[...]

USER’S GUIDE 050396 30/173 31 POWER CONTROL REGISTER Label: PCON Register Address: 087H D7 D6 D5 D4 D3 D2 D1 D0 SMOD POR PFW WTR EPFW EWT STOP IDL Bit Description: PCON.7 SMOD “Double Baud Rate”: When set to a 1, the baud rate is doubled when the serial port is being used in modes 1, 2, or 3. Initialization: Cleared to a 0 on any reset. Read [...]

USER’S GUIDE 050396 31/173 32 PCON.3: EPFW “Enable Power Fail Interrupt” : Used to enable or disable the Power Fail Interrupt. When EPFW is set to a 1, it will be enabled; it will be disabled when EPFW is cleared to a 0. Initialization: Cleared to a 0 on any type of reset. Read Access: Can be read normally anytime. Write Access: Can be writte[...]

USER’S GUIDE 050396 32/173 33 TIMER CONTROL REGISTER Label: TCON Register Address 088H D7 D6 D5 D4 D3 D2 D1 D0 TF1 TR1 TF0 TR0 IE1 IT1 IE0 IT0 Bit Description: TCON.7: TF1 “T imer 1 Overflow Flag”: Status bit set to 1 when T imer 1 overflows from a previous count value of all 1’s. Cleared to 0 when CPU vectors to T imer 1 interrupt service [...]

USER’S GUIDE 050396 33/173 34 TCON.0: IT0 “Interrupt 0 T ype Select”: When set to 1, 1–to–0 transitions on INT0 will be used to generate interrupt requests from this pin. When cleared to 0, INT0 is level–activated. Initialization: Cleared to a 0 on any type of reset. TIMER MODE REGISTER Label: TMOD Register Address: 089H D7 D6 D5 D4 D3 [...]

USER’S GUIDE 050396 34/173 35 SERIAL CONTROL REGISTER Label:SCON Register Address: 098H D7 D6 D5 D4 D3 D2 D1 D0 SM0 SM1 SM2 REN TB8 RB8 TI RI Bit Description: SCON.7, SCON.6: SM0, SM1 “Mode Select”: Used to select the operational mode of the serial I/O port as follows: SM0 SM1 MODE WORD FUNCTION BAUD LENGTH CLOCK PERIOD 0 0 Mode 0 SYNC 8–bi[...]

USER’S GUIDE 050396 35/173 36 Initialization: Cleared to a 0 on any type of reset. SCON.0: RI “Receive Interrupt”: Status bit used to signal that a serial data word has been received and loaded into the receive buf fer register . In mode 0, it is set at the end of the 8th bit time. It is set at the mid–bit time of the incoming stop bit in a[...]

USER’S GUIDE 050396 36/173 37 INTERRUPT PRIORITY REGISTER Label:IP Register Address: 0B8H D7 D6 D5 D4 D3 D2 D1 D0 RWT – – PS PT1 PX1 PT0 PX0 Bit Description: IP .7: RWT “Reset W atchdog T imer”: When set to a 1, the Watchdog Timer count will be reset and counting will begin again. The R WT bit will then automatically be cleared again to 0[...]

USER’S GUIDE 050396 37/173 38 DS5001 CRC REGISTER Label: CRC Register Address: 0C1H RNGE3 RNGE2 RNGE1 RNGE0 ––– ––– MDM CRC Bit Description: CRC.7–4 RNGE3–0 Determines the range over which a power–up CRC will be performed. Addresses are specified on 4K boundaries. Initialization: Reset to 0 on a No V LI reset. Read Access: Can b[...]

USER’S GUIDE 050396 38/173 39 DS5000 MEMOR Y CONTROL REGISTER Label:MCON Register Address: 0C6H D7 D6 D5 D4 D3 D2 D1 D0 PA 3 PA 2 PA 1 PA 0 RA32/8 ECE2 PA A SL Bit Description: MCON.7–4: P A3–0 “Partition Address”: Used to select the starting address of Data Memory on the Byte–wide bus. Program space lies below the partition address. P [...]

USER’S GUIDE 050396 39/173 40 Read Access: May be read normally anytime. Write Access: Cannot be modified by the application software; can only be written via the Bootstrap Loader . MCON.2: ECE2 “Enable Chip Enable 2”: Used to enable or disable the CE2 signal for the Byte–wide bus data memory . This bit should always be cleared to 0 in the [...]

USER’S GUIDE 050396 40/173 41 Write Access: T imed Access Protected. Cannot be written by the application software if set to 0000B by the serial loader . If a 0000B is written via the serial loader and the security lock is set, the Partition will become 1 1 1 1B. The same will occur if write access is available and application software writes a 0[...]

USER’S GUIDE 050396 41/173 42 PROGRAM ST A TUS WORD REGISTER Label:PSW Register Address: 0D0H D7 D6 D5 D4 D3 D2 D1 D0 C AC F0 RS1 RS0 OV P All of the bits in PSW except parity are read/write and are cleared to 0 on any type of reset. The Parity bit is read only and is cleared to 0 on any type of reset. Bit Description: PSW .7: C “Carry”: Set [...]

USER’S GUIDE 050396 42/173 43 DS5001/DS5002 RPC CONTROL REGISTER Label: RPCTL Register Address: 0D8H RNR ––– EXBS AE IBI DMA RPCON RG0 Bit Description: RPCTL.7 RNR When internal hardware sets this read–only bit to a 1, a new value may be read from the random number generator register of the DS5001/DS5002 (RNR;0CFh). This bit is cleared wh[...]

USER’S GUIDE 050396 43/173 44 Read Access: Can be read anytime. Write Access: Can be written when the RPC mode is enabled (RPCON=1). RPCTL.1 RPCON Enable the RPC 8042 I/O protocol. When set, port 0 becomes the data bus, and port 2 becomes the control signals. Initialization: Cleared on all resets. Read Access: Can be read at any time. Write Acces[...]

USER’S GUIDE 050396 44/173 45 Read Access: Can be read by DS5001/DS5002 and host CPU when in RPC mode. Write Access: Can be written by the DS5001/DS5002 when in RPC mode. RPS.1: IBF Input Buffer Full Flag is set following a write by the external host, and is cleared following a read of the DBBIN by the DS5001/DS5002. Initialization: Cleared when [...]

USER’S GUIDE 050396 45/173 46 INSTRUCTION SET Introduction The Secure Microcontroller executes an instruction set which is object code compatible with the industry stan- dard 8051 microcontroller . As a result, software tools written for the 8051 are compatible with the Secure Microcontroller , including cross–assemblers, compil- ers, and debug[...]

USER’S GUIDE 050396 46/173 47 The 16–bit DPTR register may be used to access any Data Memory location within the 64K byte space. MOVX @DPTR,A ; Load the Data Memory location ; pointed to by the contents of the ; DPTR register with the contents ; of the Accumulator . Immediate Addressing Immediate Addressing is used to access constants for use a[...]

USER’S GUIDE 050396 47/173 48 Program Status Flags All of the Program Status flags are contained in the PSW register . Instructions which affect the states of the flags are summarized below . INSTRUCTIONS THA T AFFECT FLAG SETTINGS INSTRUCTION FLAGS C OV AC INSTRUCTION FLAGS CO V A C ADD  CLR C 0 ADDC  CPL C  SUBB  A[...]

USER’S GUIDE 050396 48/173 49 SECTION 5: MEMOR Y INTERCONNECT The Secure Microcontroller family is divided between chips and modules. This sections illustrates the memory interconnect for the various chips and shows block diagrams of selected modules. The Soft Micropro- cessor chips are 80–pin QFP packages that connect to low power CMOS SRAM. T[...]

REAL TIME CLOCK (OPTION) 32K X 8 SRAM DS5000FP DS5000(T), DS2250(T) 40–PINS (8) (8) (8) (8) V CC PORT0 PORT1 PORT2 PORT3 ALE PSEN EA RST XT AL1 XT AL2 GND V CCO ADDR DA T A CE1 CE2 VLI +3V USER’S GUIDE 050396 49/173 50 MEMOR Y INTERCONNECT OF THE DS5000FP Figure 5–1 13 54 +3v +5v 12 10 74 28 27 20 22 14 73 78 +5v 52 DS5000FP V CC WE CS A14–[...]

V CCO R/W CE1 BA14–BA0 BD7–BD0 MSEL CE2 V CC V LI PORT0 PORT1 PORT2 PORT3 GND 28 27 20 14 V CC WE CS A14–A0 D7–D0 GND OE 32K x 8 SRAM VCC WE CS A14–A0 D7–D0 GND OE 32K x 8 SRAM 28 27 20 14 V CC WE CS A14–A0 D7–D0 GND OE 32K x 8 SRAM 22 22 +5V 14 2 12 10 74 13 54 +3V +5V 52 DS5001FP/DS5002FP USER’S GUIDE 050396 50/173 51 The DS5001[...]

28 27 20 14 28 27 20 14 28 27 20 14 28 27 20 14 22 22 22 22 12 10 74 2 63 62 14 +5V 13 54 +3V 52 DS5001FP/DS5002FP +5V VCC VLI PORT0 PORT1 PORT2 PORT3 GND V CCO R/W CE1 BA14–BA0 BD7–BD0 CE2 CE3 CE4 MSEL V CC WE CS A14–A0 D7–D0 GND OE 32K X 8 SRAM V CC WE CS A14–A0 D7–D0 GND OE 32K X 8 SRAM V CC WE CS A14–A0 D7–D0 GND OE 32K X 8 SRAM[...]

USER’S GUIDE 050396 52/173 53 MEMOR Y INTERCONNECT USING THE 128K SRAM Figure 5–5 13 54 +3v +5v 12 10 74 28 27 20 22 16 14 52 DS5001FP/DS5002FP V CC WE CS1 A16 A15 A14–A0 D7–D0 GND CS2 OE 128K x 8 SRAM V CCO R/W CE1 CE2 CE3 BA14–BA0 BD7–BD0 MSEL V CC V LI PORT0 PORT1 PORT2 PORT3 GND 2 63 30 2 31 In the 128K x 8 configuration, the microp[...]

USER’S GUIDE 050396 53/173 54 DS2251T–128 BLOCK DIAGRAM Figure 5–6 DS2251T DS5001FP 128K X 8 SRAM REAL TIME CLOCK BYTE–WIDE ADDRESS BUS BYTE–WIDE DA TA BUS (14) (8) (8) (8) (8) (8) R/W INT A INTB INTP SQW +3V V LI V CC PORT0 PORT1 PORT2 PORT3 ALE RST PSEN PROG PF VRST PE3 PE4 XT AL1 XT AL2 GND V CCO ADDR R/W DA T A CE1 PE1 72 PINS DS1283[...]

USER’S GUIDE 050396 54/173 55 DS2252T–32 BLOCK DIAGRAM Figure 5–7 DS2252T DS5002FP 32K X 8 SRAM REAL TIME CLOCK (8) (8) (8) (8) +3V V LI V CC PORT0 PORT1 PORT2 PORT3 ALE RST XT AL1 XT AL2 PROG SDI GND V CCO ADDR DA T A CE1 PE1 40 PINS[...]

USER’S GUIDE 050396 55/173 56 SECTION 6: LITHIUM/BA TTER Y BACKUP Soft Microcontroller devices are lithium backed for data retention in the absence of V CC . In the Soft Microcon- troller the state of the microcontroller is also maintained, unlike a conventional processor system using an exter- nal NV RAM. This section is a comprehensive discus- [...]

USER’S GUIDE 050396 56/173 57 POWER SUPPL Y SLEW RA TE Figure 6–1 40 µ s, 130 µ s V CC V CCMIN V LI LITHIUM CURRENT Each time V CC is restored, the lithium backed functions will remain as they were left. A result is that many of these values are not altered on a reset condition except for the ‘no battery reset’. In the documentation, this[...]

USER’S GUIDE 050396 57/173 58 10 years depending on the user’s actual environment and design goals. The system lifetime can be determined from three parameters: 1) Data retention current, 2) Lithium cell capacity , 3) Lithium self–discharge. Current production lithium cells have extremely good self–discharge per- formance. Manufacturer’s [...]

USER’S GUIDE 050396 58/173 59 LITHIUM BA TTER Y USAGE In the vast majority of applications, lithium batteries pro- vide a reliable means of backing up data and configura- tion. The voltage varies only slightly over its useful life, so it is difficult to measure capacity . A CR chemistry will begin life at 3.3V and drop to 2.9V near the end of lif[...]

USER’S GUIDE 050396 59/173 60 SECTION 7: POWER MANAGEMENT Introduction All Dallas Semiconductor microcontrollers are imple- mented using fully static CMOS circuitry for low power consumption. Power consumption is a linear function of crystal frequency . T wo software initiated modes are available for further power saving at times when proces- sin[...]

USER’S GUIDE 050396 60/173 61 Write Access: Cannot be written. PCON.3: EPFW “Enable Power Fail Interrupt”: Used to enable or disable the Power Fail Interrupt. When EPFW is set to a 1, it will be enabled; it will be disabled when EPFW is cleared to a 0. Initialization: Cleared to a 0 on any type of reset. Read Access: Can be read normally anyt[...]

USER’S GUIDE 050396 61/173 62 The original contents of those Special Function regis- ters that are initialized by a reset are lost. V oltage Monitoring Circuitry The on–chip voltage monitoring circuitry automatically places the microprocessor in its Data Retention state in the absence of V CC . It insures that the proper internal control signal[...]

USER’S GUIDE 050396 62/173 63 Power Fail Interrupt When V CC is stable, program execution proceeds as normal. If V CC should decay from its nominal operating voltage and drop to a level below the V PFW threshold, then the internal PFW status flag (PCON.5) will be set. In addition, a Power Fail W arning interrupt will be gener- ated if it has been[...]

USER’S GUIDE 050396 63/173 64 threshold, the Power On Reset cycle will be executed as before. As a result, no special processing is required in software to accommodate this case. In the case that V CC dips without going below V LI , the PFW flag will be set and a Power Fail W arning interrupt will still occur when V CC drops below the V PFW thres[...]

USER’S GUIDE 050396 64/173 65 SECTION 8: SOFTW ARE CONTROL Introduction Several features have been incorporated into the Secure Microcontroller to help insure the orderly execu- tion of the application software in the face of harsh elec- trical environments. Any microcontroller which is oper- ating in a particularly noisy environment is susceptib[...]

USER’S GUIDE 050396 65/173 66 This code allows the reset of the W atchdog Timer: MOV 0C7H,#0AAH ; 1st T A V alue MOV 0C7H,#055H ; 2nd T A V alue 2 Cycles SETB IP .7 ; Reset Watchdog T imer 1 Cycle The W atchdog T imer bit may have been set using ORL IP , #80H which takes two cycles. This code allows the reset of the W atchdog T imer using a diffe[...]

USER’S GUIDE 050396 66/173 67 T imed Access provides a statistical protection. It is unlikely that randomly generated states will correctly match the sequence and timing required to bypass the T imed Access logic. Presented below is a brief justifica- tion for each bit that is protected by T imed Access. The EWT bit is protected to prevent errant[...]

USER’S GUIDE 050396 67/173 68 During subsequent program execution, the W atchdog T imer can be reset by a T imed Access write operation which sets the RWT bit to a 1. This will cause the W atch- dog T imer to begin counting machine cycles again from an initial count of 0. The R WT bit itself is automatically cleared immediately after the W atchdo[...]

USER’S GUIDE 050396 68/173 69 W A TCHDOG TIMER CONTROL BITS Bit Description: PCON.4: WTR “W atchdog Timer Reset” Set to a 1 when a W atchdog Timer timeout occurs. If W atchdog Timer Reset is enabled, this will indicate the cause of the reset. Cleared to 0 immediately following a read of the PCON register . Initialization: Set to a 1 after a W[...]

USER’S GUIDE 050396 69/173 70 blocks over which the CRC calculation is performed. For example, if the nibble is set to 0001b, the CRC range is from 0000 to 0FFFh. Once the LSB of the CRC regis- ter is set, the loader “I” command will cause the CRC of the specified block to be computed. The result is auto- matically stored in the last two byte[...]

USER’S GUIDE 050396 70/173 71 CRC CODE EXAMPLE Figure 8–3 This routine tests the CRC–16 circuit in the DS5001FP crcmsb equ 0C3h crclsb equ 0C2h org 00h ;after reset, CRC regs = 0000 begin: mov p2,crcmsb ;p2=00 read crcmsb register mov p3,crclsb ;p3=00 read crclsb register mov crclsb, #075h ;check crc register operation ;data in = 75 result = [...]

USER’S GUIDE 050396 71/173 72 SECTION 9: FIRMW ARE SECURITY One of the most unique features of the Secure Micro- controller is its firmware security . The family far sur- passes the standard offering of ROM based microcon- trollers in keeping system attackers or competitors from viewing the contents of memory . In a standard EPROM based microcont[...]

USER’S GUIDE 050396 72/173 73 SECURITY LOCK Ordinarily , the easiest way to dump (view) the memory contents of a Secure Microcontroller is using the Boot- strap Loader . On request, the Loader will transfer the contents of memory to a host PC. This is prevented by the Security Lock. The lock is the minimal security fea- ture, available even in th[...]

USER’S GUIDE 050396 73/173 74 DS5000 SOFTW ARE ENCR YPTION BLOCK DIAGRAM Figure 9–1 PROGRAM COUNTER DA T A POINTER ADDRESS ENCRYPTOR EXTERNAL BYTEWIDE RAM 40–BIT ENCRYPTION KEY DA T A ENCRYPTOR SECURITY LOCK BOOTSTRAP LOADER SECURE INTERNAL DA T A BUS SECURE INTERNAL ADDRESS BUS ENCRYPTED BYTEWIDE DA T A BUS 8 ENCRYPTED BYTEWIDE DA T A BUS 15[...]

USER’S GUIDE 050396 74/173 75 In a DS5000 , the encryption feature is optional. A DS5000 can be locked irrespective of its encryption and encrypted irrespective of the lock. Neither makes much sense by itself. The encryption process is enabled by loading an Encryption Key for the first time. Prior to load- ing a Key , the DS5000 remains in a non?[...]

USER’S GUIDE 050396 75/173 76 Encryption Algorithm The Secure Microcontroller family uses a proprietary algorithm to encrypt memory . The DS5000FP and DS5002FP use dif ferent encryption algorithms. They are the result of improvements made over time in the proprietary encryptor circuits. The original DS5000FP (circa 1988) has the first version of [...]

CE1 ALE BA14–0 BD7–0 XXXXh YYYYh QQQQh RRRRh SINGLE CYCLE INSTRUCTION SINGLE CYCLE INSTRUCTION ENCRYPTED MEMOR Y ACCESS WITH DUMMY FETCHES Either XXXX or YYYY is real but encrpted, the other is pseudo–random. Either QQQQ or RRRR is real but encrypted, the other is pseudo–random. Either Byte1 or Byte2 is used, the other is a dummy fetch and [...]

USER’S GUIDE 050396 77/173 78 On–chip V ector RAM A 48–byte RAM area is incorporated inside the DS5000FP and DS5002FP . This area maps to the first 48 locations of program memory to store reset and interrupt vectors. Any other data stored in the first 48 locations will be contained in this V ector RAM. The prin- cipal reason for the V ector R[...]

USER’S GUIDE 050396 78/173 79 Security Summary by Part The preceding information outlined each of the security features. Their inclusion in various parts is shown in the table at the beginning of this chapter . For completeness, the following is a summary description of security fea- tures for each part in the Secure Microcontroller Family . DS50[...]

USER’S GUIDE 050396 79/173 80 APPLICA TION: ADV ANCED SECURITY TECHNIQUES The Secure Microcontroller family has been used for numerous applications requiring security . Different lev- els of security are required depending on the sensitivity of the application and the value of the protected informa- tion. As mentioned above, the goal of the micro[...]

USER’S GUIDE 050396 80/173 81 Change Code Perhaps most importantly , the user should reprogram portions of the Secure Microcontroller that deal with se- curity . For example, if the microprocessor is performing DES, the user can change DES keys. Any security sys- tem can be broken with enough time and resources. By altering the security features,[...]

USER’S GUIDE 050396 81/173 82 SECTION 10: RESET CONDITIONS Reset Sources The Secure Microcontroller family is designed to pro- vide proper reset operation with a minimum of external circuitry . In fact, for may applications, external reset cir- cuitry is not required. The possible sources of reset are as follows: a) Power On (operating voltage ap[...]

USER’S GUIDE 050396 82/173 83 SPECIAL FUNCTION REGISTER RESET ST A TES T able 10–1 REGISTER LOCA TION RESET CONDITION RESET TYPE PC N/A 0000h All ACC E0h 00h All B F0h 00h All PSW D0h 00h All SP 81h 07h All DPTR 83h, 82h 0000h All P0–P3 80h, 90h, A0h, B0h FFh All IP B8h 0XX00000b All IE A8h 0XX00000b All TMOD 89h 00h All TCON 88h 00h All TH0 [...]

USER’S GUIDE 050396 83/173 84 Power On Reset The Secure Microcontroller family provides an internal Power On Reset capability which requires no external components . When voltage is applied to the V CC pin from a power off condition, the device automatically per- forms an internal reset sequence to prepare the proces- sor for execution of the app[...]

USER’S GUIDE 050396 84/173 85 No–V LI Power On Reset During a Power On Reset cycle, a test is automatically performed by the internal control circuitry to measure the voltage of the lithium power source. This test deter- mines whether or not the voltage (V LI ) is above the mini- mum level required (V LImin ) to insure that the nonvolatile area[...]

USER’S GUIDE 050396 85/173 86 APPLICA TION: RESET ROUTINE EXAMPLE Like the 8051, Dallas Semiconductor Microcontrollers will begin execution at address 0000h. This is the Reset V ector , followed by other vector locations used for inter- rupts. These are discussed in the section covering inter- rupt operation. Since there are only three memory loc[...]

USER’S GUIDE 050396 86/173 87 A code example that initializes the memory map is as follows. It assumes that the DS5000FP user requires a Partition of 5800h. A DS5001FP using the same code would use a Partition of B000h. MCON EQU 0C6h Org 00h SJMP Start Org 30h Start : MOV TA, #0AAh ;Timed MOV TA, #55h ; Access ORL MCON, #02h ;Set PAA – DS5000 O[...]

USER’S GUIDE 050396 87/173 88 Timers The microprocessor disables timer activity (excluding the Watchdog) and serial port communication on a re- set. Therefore, each timer must be setup and enabled as part of the reset routine. The serial port mode must also be initialized if used. This is covered in detail in the User ’s Guide section on T imer[...]

USER’S GUIDE 050396 88/173 89 SECTION 1 1: INTERRUPTS The Secure Microcontroller family follows the standard 8051 convention for interrupts (with one extra) and is fully compatible. An interrupt stops the normal flow of processing and allows software to react to an event with special processing. This event can be external, time–re- lated, or th[...]

USER’S GUIDE 050396 89/173 90 External Interrupts The two external interrupts are INT0 and INT1 . They correspond to P3.2 and P3.3 respectively . These pins become interrupts when the respective interrupt is enabled. Otherwise, they are simply port pins. No other special action is required. Each pin is sampled once per machine cycle when the inte[...]

USER’S GUIDE 050396 90/173 91 global enable bit. It can only be enabled or disabled using the EPFW bit. Simulated Interrupts Except for PFW , any interrupt can be forced by setting the corresponding flag to a logic 1 in software. This causes the code to jump to the appropriate interrupt vector . Clearing the appropriate flag manually will clear a[...]

USER’S GUIDE 050396 91/173 92 INTERRUPT ENABLE CONTROL BITS Figure 1 1–2 Bit Description: All bits are read/write at any time and are cleared to 0 following any hardware reset. IE.7: EA “Enable All Interrupts”: When set to 1, each interrupt except for PFW may be individually enabled or disabled by setting or clearing the associated IE.x bit[...]

USER’S GUIDE 050396 92/173 93 INTERRUPT PRIORITIES The Secure Microcontroller provides a three priority interrupt scheme. Multiple priority levels allow higher priority sources to interrupt lower priority ISRs. The Power–fail W arning Interrupt automatically has the highest priority if enabled. The remaining interrupts can be programmed by the [...]

USER’S GUIDE 050396 93/173 94 INTERRUPT ACKNOWLEDGE The various interrupt flags are sampled an latched once every machine cycle, specifically during clock phase S5P2 (see CPU timing section) regardless of other in- terrupt related activity . Likewise, the latched states of the flags are polled once every machine cycle for the sampling which took [...]

USER’S GUIDE 050396 94/173 95 cycle. If the interrupt acknowledge does not take place for one of the reasons cited above, the request flag will become subsequently inactive and the interrupt will have been lost and will not be serviced. When an interrupt request is acknowledged, a long call is executed to the interrupt vector location and the 2?[...]

EXTERNAL ADDRESS CONTROL VCC ADDRESS/ DA T A POWER DOWN PORT 0.n INTERNAL DA T A BUS WRITE ENABLE READ ENABLE READ LA TCH/PIN DQ Q USER’S GUIDE 050396 95/173 96 SECTION 12: P ARALLEL I/O OVERVIEW The Secure Microcontroller provides four 8–bit bidirec- tional ports for general purpose I/O functions. Each port pin is bit and byte addressable usin[...]

USER’S GUIDE 050396 96/173 97 PORT 1 FUNCTIONAL CIRCUITR Y VCC POWER DOWN PORT 0.n INTERNAL DA T A BUS WRITE ENABLE READ ENABLE READ LA TCH/PIN DQ VCC VCC DELA Y = 2T clk Q PORT 2 FUNCTIONAL CIRCUITR Y VCC POWER DOWN PORT 2.n WRITE ENABLE READ ENABLE READ LA TCH/PIN DQ VCC VCC DELA Y = 2T clk ADDRESS CONTROL ADDRESS A8–A15 INTERNAL DA T A BUS Q[...]

USER’S GUIDE 050396 97/173 98 PORT 3 FUNCTIONAL CIRCUITR Y VCC POWER DOWN PORT 3.n WRITE ENABLE READ ENABLE READ LA TCH/PIN DQ VCC VCC SERIAL I/O AND EXTERNAL MEMORY CONTROL RXD, TXD WR , RD INPUTS INTERNAL DA T A BUS Q DELA Y = 2T clk SERIAL TIMER AND INTERRUPT INPUTS OUTPUT FUNCTIONS Slightly different output buf fer structures are implement- e[...]

USER’S GUIDE 050396 98/173 99 least significant eight bits of address and data. When 1’ s are output on Port 2 for address bits during these cycles, strong current drivers are employed. The information in the Port 2 SFR latch is unchanged during these cycles. Port 0 also employs strong output drivers for 1’s during these cycles. However , a v[...]

USER’S GUIDE 050396 99/173 100 READ–MODIFY–WRITE INSTRUCTIONS MNEMONIC DESCRIPTION ANL – Logical AND ORL – Logical OR XRL – Logical Exclusive OR JBC – Branch if Bit Set and Clear (bit) CPL – Complement Bit INC – Increment DEC – Decrement DJNZ – Decrement and Branch if not Zero MOV PX.n,C – Move Carry Bit to bit n of Port X C[...]

USER’S GUIDE 050396 100/173 101 USE OF THE RPC MODE Figure 12–3 P2.3/WR P2.2/RD P2.1/CE PORT 2 P2.0/A0 P2.7/DACK P2.6/DRQ P2.5/IBF P2.4/OBF CONTROL BUS PORT 0 P0.0/D0 DA T A BUS P0.1/D1 P0.2/D2 P0.3/D3 P0.4/D4 P0.5/D5 P0.6/D6 P0.7/D7 USE OF THE RPC MODE Figure 12–4 CS RD WR A0 REGISTER 0 0 1 0 DA T A OUT 0 0 1 1 ST A TUS 0 1 0 0 DA T A IN 0 1[...]

USER’S GUIDE 050396 101/173 102 RPC ST A TUS REGISTER – ST A TUS (ADDRESS 0DAH) Figure 12–5 ST7 ST6 ST5 ST4 IAO FO IBF OBF Bit Description: RPS.7–4: General purpose status bits that can be written by the DS5001/2 and can be read by the external host. Initialization: Cleared when RPCON=0. Read Access: Can be read by the DS5001/2 and host CPU[...]

USER’S GUIDE 050396 102/173 103 RPC PROTOCOL Data is written to the microprocessor by the host CPU and is placed in the DBBIN. At this time, the IBF flag is set in the RPC Status Register . If enabled by the IBI bit in the RPCTL register , an IBI interrupt will occur. No fur- ther updates of the DBBIN will be allowed until the buffer is read by t[...]

USER’S GUIDE 050396 103/173 104 RPC CONTROL REGISTER – RPCTL (ADDRESS 0D8H) Figure 12–6 RNR – EXBS AE IBI DMA RPCON RG0 Bit Description: RPCTL.3: IBI When using the RPC mode, an interrupt may be required for the Input Buf fer Flag. This interrupt is enabled by setting the Input Buffer Interrupt (IBI) bit. At this time, the timer 1 interrupt[...]

USER’S GUIDE 050396 104/173 105 SECTION 13: PROGRAMMABLE TIMERS FUNCTIONAL DESCRIPTION The Secure Microcontroller incorporates two 16–bit tim- ers called T imer 0 and Timer 1. Both can be used to gen- erate precise time intervals, measure external pulse widths, or count externally applied pulses. Each programmable timer operates either as a “[...]

USER’S GUIDE 050396 105/173 106 TMOD.5, TMOD.4: Timer 1 Mode Control “Mode Select” These bit select the operating mode of the associated timer/counter as fol- lows: M1 M0 0 0 Mode 0: Eight bits with 5–bit prescale 0 1 Mode 1: 16 bits with no prescale 1 0 Mode 2: Eight bits with auto–reload 1 1 Mode 3: T imer 1 – Stopped Initialization :[...]

USER’S GUIDE 050396 106/173 107 Mode 0 Figure 13–3 is a block diagram of a timer/counter oper- ating in Mode 0. Mode 0 configures either program- mable timer for operation as a 13–bit timer/counter . For T imer 0, selection of Mode 0 configures bit 4 – 0 of TL0 as bits 4 – 0 respectively of the 13–bit timer/counter reg- ister . In addit[...]

USER’S GUIDE 050396 107/173 108 Mode 1 Mode 1 for both programmable timers operates in an identical fashion described for Mode 0, except Mode 1 configures a 16–bit timer/counter register . In this case, for Timer 0, TH0 contains the most significant eight bits of the count value while TL0 holds the least significant eight bits. T imer 1 uses TH[...]

USER’S GUIDE 050396 108/173 109 Mode 3 When T imer 0 is selected for operation in Mode 3, both TH0 and TL0 are configured independently as an 8–bit timer/counter and as an 8–bit timer . Figure 13–5 illus- trates the function of T imer 0 for Mode 3 operation. For Timer 0 in Mode 3, TL0 becomes an 8–bit timer/ counter which is controlled by[...]

USER’S GUIDE 050396 109/173 11 0 SECTION 14: SERIAL I/O FUNCTION DESCRIPTION The Secure Microcontroller , like the 8051, includes a powerful Serial I/O (UART) port capable of both syn- chronous and asynchronous communication. The baud rate and time–base source is fully programmable. The serial port uses P3.0 as Receive Data (RXD) and P3.1 T ran[...]

USER’S GUIDE 050396 1 10/173 111 value that generates the required time interval at its overflow . This is the most common mode of communi- cating with a PC COM port or similar device. When talk- ing to a PC in Mode 1, the PC would be set to 8–N–1 ( 8 bits, no parity , 1 stop). Common baud rates are 2400, 9600, and 19200 bps, but it can commu[...]

USER’S GUIDE 050396 1 11/173 11 2 SCON.2: RB8 “Rcv . Bit 8”: Indicates the state of the 9th data bit received while in Mode 2 or 3 operation. If Mode 1 is selected with SM2=0, RB8 is the state of the stop bit which was received. RB8 is not used in Mode 0. Initialization: Cleared to a 0 on any type of reset. SCON.1: TI “Xmit Interrupt”: St[...]

USER’S GUIDE 050396 1 12/173 11 3 In most applications, T imer 1 will be configured as a tim- er which uses the internal clock oscillator frequency as its clock source. The baud rate will then be divided down from the time base applied to the XT AL1 and XT AL2 pins. In order to provide the most flexibility , Timer 1 should be programmed to operat[...]

USER’S GUIDE 050396 1 13/173 11 4 was originally written into bit position D8. During the final shift register operation, another 0 is shifted in from the left so that the T ransmit Shift register contains all 0’s. Also at this time, the T ransmit Interrupt flag (TI) is set and a serial interrupt will be generated if enabled. During serial data[...]

USER’S GUIDE 050396 1 14/173 11 5 MODE 0 BLOCK DIAGRAM AND TIMING Figure 14–2 T1 FLAG OUTPUT SHIFT REGISTER SI S0 LOAD CLK D7 D6 D5 D4 D3 D2 D1 D0 DA T A BUS P3.0 LA TCH RXD PIN LDSBUF RDSBUF R1 FLAG SERIAL INTERRUPT LDSBUF SI0 CONTROL SHIFT RDSBUF RBUFLD RD RCV BUFFER WR SI S0 INPUT SHIFT REGISTER CLK Q7 Q6 Q5 Q4 Q3 Q2 Q1 Q0 TXD PIN SHCLK DIV [...]

USER’S GUIDE 050396 1 15/173 11 6 ASYNCHRONOUS OPERA TION Mode 1, 2, and 3 provide asynchronous, full-duplex communication via the Serial I/O Port. The serial data word is either 10 or 1 1 bits long, depending on the mode selected. All three modes include one start bit, eight data bits, and one stop bit. Modes 2 and 3 include an additional, progr[...]

USER’S GUIDE 050396 1 16/173 11 7 ware. In an overrun condition with RI=1, the originally re- ceived word will remain in the Receive Data Buffer and all successively received data words will be lost. When SM2=1, received data words will be selectively discarded in a manner depending on the asynchronous mode selected. The operational details which[...]

USER’S GUIDE 050396 1 17/173 11 8 SERIAL PORT MODE 1 BLOCK DIAGRAM Figure 14–3 MUX TIMER 1 OVERFLOW 10 T1 FLAG BIT DETECTOR RXD PIN DIV . BY 16 f CLK /2 TRANSMIT TIMING: WRSBUF SHIFT TXD TI RXD BIT DETECTOR SAMPLING SHIFT RI RECEIVE TIMING: D0 D1 D2 D3 D4 D5 D6 D7 STOP D0 D1 D2 D3 D4 D5 D6 D7 STOP XMIT SHIFT REGISTER SI S0 LOAD CLK DA T A BUS P[...]

USER’S GUIDE 050396 1 18/173 11 9 MODE2 AND 3 BLOCK DIAGRAM Figure 14–4 T1 FLAG BIT DETECTOR RXD PIN DIV . BY 16 XMIT SHIFT REGISTER SI S0 LOAD CLK DA T A BUS P3.1 LA TCH TXD PIN WRSBUF RDSBUF DIVIDE BY 16 R1 FLAG SERIAL INTERRUPT WRSBUF SCLK RESET SI0 CONTROL SHIFT RDSBUF LOAD RD RCV DA TA BUFFER WR SI S0 RECEIVE SHIFT REGISTER CLK Q7 Q6 Q5 Q4[...]

USER’S GUIDE 050396 1 19/173 120 APPLICA TION: SERIAL PORT INITIALIZA TION The serial port can provide either synchronous or asynchronous serial communication. This note demon- strates how to initialize the serial port and includes an example showing how to perform asynchronous com- munication with a PC COM port. A typical goal of microcontroller[...]

USER’S GUIDE 050396 120/173 121 SM0 = 0 and SM1 = 1 corresponds to the value SCON.7 = 0 and SCON.6 = 1. In addition the since the applica- tion requires receiving data, the serial receiver must be enabled. This is done by setting the REN bit at SCON.4 to a logic 1. The remaining bits in SCON can be written to 0. Thus the value for SCON is 0101000[...]

USER’S GUIDE 050396 121/173 122 This formula solves as : TH1 + 256 * 2 SMOD 32 * 12 t CLK * BaudRate For 9600 = Baud rate, TH1 = FDh with SMOD = 0. T o create 19,200 baud, the SMOD bit should be set to a logic 1 with the same value for TH1. SMOD has the effect of doubling the baud rate for any time out value. The value for TH1 and SMOD have been [...]

USER’S GUIDE 050396 122/173 123 ;This code example shows how to initialize the serial port and transmit / ; receive code as described above. TA Equ 0C7h MCON Equ 0C6h Org 00h Reset : SJMP Start Org 23h Serial_ISR : CLR RI ;Clear receive flag CLR TI ;Clear transmit flag RETI ;No special processing, return to application Org 30h Start : MOV TA, #0A[...]

XT AL2 XT AL1 GND NC EXT . OSC. SIGNAL USER’S GUIDE 050396 123/173 124 SECTION 15: CPU TIMING OSCILLA TOR The Secure Microcontroller provides an on–chip oscilla- tor circuit which may be driven either by using an exter- nal crystal as a time base or from a TTL–compatible clock signal. The oscillator circuitry provides the internal clocking si[...]

USER’S GUIDE 050396 124/173 125 INSTRUCTION TIMING The internal clocking signals are divided to produce the necessary clock phases, state times, and machine cycles which define the sequential execution of instruc- tions. T wo clock oscillator periods define one state time. The first clock oscillator pulse period of a state time is called the Phas[...]

USER’S GUIDE 050396 125/173 126 BYTE–WIDE RAM INSTRUCTION EXECUTION TIMING Figure 15–3 S1 P1 P2 S2 P1 P2 S3 P1 P2 S4 P1 P2 S5 P1 P2 S6 P1 P2 S1 P1 P2 S2 P1 P2 S3 P1 P2 S4 P1 P2 S5 P1 P2 S6 P1 P2 S1 P1 P2 OPCODE FETCH NEXT OPCODE FETCH (DISCARD) NEXT OPCODE FETCH OPCODE FETCH READ 2ND BYTE (OPERAND) NEXT OPCODE FETCH OPCODE FETCH NEXT OPCODE F[...]

USER’S GUIDE 050396 126/173 127 Multiplexed address and data information appear on the Port 0 pins as Program Memory fetches are performed on the Expanded Bus. The falling edge of ALE can be used to signal when the lowest eight bits of valid ad- dress information are being output on Port 0 when such a fetch occurs. In addition, ALE is activated t[...]

USER’S GUIDE 050396 127/173 128 EXP ANDED DA T A MEMOR Y READ Figure 15–5 PSEN MACHINE CYCLE MACHINE CYCLE ALE PORT 0 PORT 2 PCH/P2 PCH/P2 DPH OR P2 OUT PCH/P2 PCL OUT DPL OR RI, OUT PCL OUT DA T A SAMPLED DA T A SAMPLED DA T A SAMPLED RD * PCL OUT if program memory also on Expanded Bus – float if not. **PCH OUT if program memory also on Expa[...]

USER’S GUIDE 050396 128/173 129 EXP ANDED DA T A MEMOR Y TIMING The timing for the Expanded Data Memory access cycle is illustrated in Figures 15–5 and 6. Accesses to Data Memory on the Expanded Bus will occur any time that a MOVX instruction is executed that references a Data Memory location that is mapped outside the area which has been assig[...]

USER’S GUIDE 050396 129/173 130 SECTION 16: PROGRAM LOADING INTRODUCTION Program loading is performed to initialize the contents of NV RAM and to configure the microcontroller . Load- ing is done using a Bootstrap ROM Loader built into all members of the Secure Microcontroller family . When this Bootstrap Loader is invoked, the user ’s NV RAM a[...]

USER’S GUIDE 050396 130/173 131 The indeterminate area contains various stacks and buffers used by the loader , and a given byte in this area may or may not be modified by the loader . As such the user should not rely on the bootstrap loader preserving any data in this area. In a like manner , because not all locations are used, the indeterminate[...]

USER’S GUIDE 050396 131/173 132 INVOKING AND EXITING THE LOADER ON THE DS5001/DS5002 SERIES Figure 16–1 AUTOBAUD Routine: Awaits input on 1 of 3 channels – 1) <CR> character on RXD of serial port 2) <CR> character written to RPC port 3) <CR> character received by 8250 UART causing interrupt on INT1 pin (MODEM=1) Power Up Res[...]

USER’S GUIDE 050396 132/173 133 SERIAL PROGRAM LOAD MODE The Serial Bootstrap Loader provides the easiest meth- od of initially loading application software into the non- volatile RAM. Communication can be performed over a standard asynchronous serial communications port us- ing a terminal emulator program with 8–N–1 (8 data bits, no parity ,[...]

USER’S GUIDE 050396 133/173 134 AUTO–BAUD RA TE DETECTION The Serial Bootstrap Loader has the capability of deter- mining which of the six supported baud rate frequencies is being used for communication and initializing its inter- nal hardware for communication at that frequency . When the Program Load mode is first invoked, the de- vice will w[...]

USER’S GUIDE 050396 134/173 135 BOOTSTRAP LOADER INITIALIZA TION When loader mode is invoked, the device will await an incoming <CR> character at a valid baud rate through either the serial port (in Serial Program Load mode) or via the parallel interface (in Parallel Program Load mode). At this point, the bootstrap loader will transmit a ba[...]

USER’S GUIDE 050396 135/173 136 An address will always be the right–most four digits of a hexadecimal number . For example, the following hexa- decimal numbers will result in the following addresses: A → 000AH AB → 00ABH ABC → 0ABCH ABCD → 0ABCDH ABCDE → 0BCDEH The D and F commands allow optional addresses to be entered. The syntax [B[...]

USER’S GUIDE 050396 136/173 137 F byte [begin–address [end–address]] Fill memory with the value of the specified byte. An op- tional address range may be specified. G Data is read from ports 0, 1, 2 and 3 and is printed as four pairs of hexadecimal digits. I A CRC–16 is computed from 0 to CRC_RANGE minus 2 and the computed CRC is put into C[...]

USER’S GUIDE 050396 137/173 138 unaf fected by this command. DS5001/DS5002: W [CRC/MCON/MSL/RPCTL] byte Writes byte to the requested register . The SL bit is unaf- fected by this command. This command is discussed in greater detail later in this section. Z Set the Security Lock. Only the U and Z commands may be given after the Security Lock is se[...]

USER’S GUIDE 050396 138/173 139 compared to the computed value for the record, and if different, the error message E:BADCKS is printed out. Unfortunately , the data bytes for this record will have been put to memory already . End of Data records (01) do not check for valid checksums. After a byte is put to memory , it is read back immediately to [...]

USER’S GUIDE 050396 139/173 140 INTEL HEX FILE FORMA T 8051–compatible assemblers produce an absolute out- put file in Intel Hex format. These files are composed of a series of records. Records in an Intel Hex file have the following format: <Header><Hex Information><Record T erminator> The specific record elements are detaile[...]

USER’S GUIDE 050396 140/173 141 P ARALLEL PROGRAM LOAD OPERA TION The DS5000 Parallel Program Load mode is compatible with the Program mode of the 87C51. The hardware configuration used for this mode of operation is shown in Figure 16–3. Dallas Semiconductor recommends the use of the serial Program Load Mode over the Parallel Program Load Mode [...]

USER’S GUIDE 050396 141/173 142 P ARALLEL PROGRAM LOAD MODE T able 16–3 summarizes the selection of the available Parallel Program Load cycles. Figure 16–4 illustrates the timing associated with these cycles. 8751–COMP A TIBLE PROGRAM LOAD CYCLES T able 16–3 MODE RST PSEN PROG EA P2.7 P2.6 P2.5 Program 1 0 0 V PP 10 X Security Set 1 0 0 V[...]

USER’S GUIDE 050396 142/173 143 P ARALLEL PROGRAMMING CONCERNS Dallas Semiconductor highly recommends using the serial load mode for programming the DS5000. It has proven highly reliable and easy to use. In the event that parallel programming is still desirable to some users, several incompatibilities have been discovered in con- ventional device[...]

USER’S GUIDE 050396 143/173 144 SECTION 17: REAL–TIME CLOCK Many user applications require a time–of–day clock. For this reason, all Secure Microcontroller modules have real–time clock (RTC) options. These include the DS5000T DIP and the DS2250T , DS2251T , and DS2252T SIMMs. In addition, users of the monolithic microprocessor chips will [...]

USER’S GUIDE 050396 144/173 145 The timekeeper contains a shift register with 128 loca- tions. The first 64 locations correspond to a pattern shown in Figure 17–2. The next 64 are time data. Be- fore access to time data may occur , the 64–bit pattern must be written. The incoming bits are checked by a pattern recognition circuit. As each corr[...]

USER’S GUIDE 050396 145/173 146 P A TTERN COMP ARISON REGISTER DESCRIPTION Figure 17–2 7 6 54 32 1 0 1 0 1 0 0 0 1 1 0 1 0 1 1 1 0 0 1 1 0 0 0 1 0 1 0 0 1 1 1 0 1 0 1 0 1 0 0 0 1 1 0 1 0 1 1 1 0 0 1 1 0 0 0 1 0 1 0 0 1 1 1 0 1 0 BYTE 0 BYTE 1 BYTE 2 BYTE 3 BYTE 4 BYTE 5 BYTE 6 BYTE 7 HEX CODE C5 3A A3 5C C5 3A A3 5C[...]

USER’S GUIDE 050396 146/173 147 DS1215 REGISTER ENTR Y FLOWCHART Figure 17–3 Set ECE2 bit in the MCON register to a logic 1 Perform a dummy read operation to reset clock pattern recognition circuit* T o open clock, write the 64–bit serial pattern by using A2 and A0 embedded address lines Are clock time registers to be read/written? Read time [...]

USER’S GUIDE 050396 147/173 148 DS1215 TIME REGISTERS DESCRIPTION Figure 17–4 OSC 7 6 54 32 1 0 0.1 SEC 0 0 HR 0 12/24 0 0 0 0 0 0 0 0 0 10 YEAR RANGE (BCD) 00–99 00–59 00–59 01–12 01–07 01–31 01–12 00–99 CLOCK 0 1 2 3 4 5 6 7 REGISTER # 0.01 SEC 10’s OF SECONDS SECONDS 10’s OF MINUTES MINUTES 10 A/P HOUR DA Y 10 DA TE DA TE[...]

USER’S GUIDE 050396 148/173 149 TIME REGISTER EXAMPLES Figure 17–5 7 6 54 32 1 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 RANGE (BCD) 00–99 00–59 00–59 01–12 01–07 01–31 01–12 00–99 CLOCK 0 1 2 3 4 5 6 7 REGISTER # 1 0 00 10 0 1 10 1 0 0 0 1 00 1 0 0 1 0 10 0 0 1 00 0 1 11 00 0 0 10 0 0 0 0 0 10 1 0 0 0 The time indicated is 1 1 o’clock PM[...]

USER’S GUIDE 050396 149/173 150 DS1283 W A TCHDOG TIMEKEEPER CHIP The DS2251T and DS2252T use the DS1283 Byte– wide RTC. This is also the clock of choice for users designing with the microprocessor chips (DS5000FP , DS5001FP , and DS5002FP). This clock gives perma- nently powered time–of–day monitoring. The clock runs from an internal 32 KH[...]

USER’S GUIDE 050396 150/173 151 DS2251T/DS2252T RTC BLOCK DIAGRAM Figure 17–6 DS5001 CPU DS1283 RTC DS2251T V CCO V CC PE1 CE R/W WE BA5–0 A5–0 BD7–0 INTB INT A INTP DS5002 CPU DS1283 RTC DS2252T V CCO V CC PE1 CE R/W WE BA5–0 A5–0 BD7–0 INTP P3.2 (INT0) MEMOR Y MAP In both the DS2251T and DS2252T , the R TC function is memory mappe[...]

USER’S GUIDE 050396 151/173 152 DS1283 REAL–TIME CLOCK MEMOR Y MAP Figure 17–7 0.1 SECONDS 0.01 SECONDS 0 10 SECONDS SECONDS MINUTES 10 MINUTES 0 M 10 MIN ALARM MIN ALARM 0 12–24 10 A/P HR HOURS M 12–24 10 A/P HR HR ALARM 0 000 0 D A Y S M 0 0 0 0 DAY ALARM INP O 10 DA TE DA TE EOSC ESQW 0 10 MO MONTHS 10 YEAR YEARS TE IPSW WAM TDM WAF TD[...]

USER’S GUIDE 050396 152/173 153 The time, calendar , and alarms are controlled by the information in these 14 registers. In particular , the Com- mand register controls most functions. This is described in Figure 17–8. There are two additional bits that deserve mention. These reside in the register at address 09h. Bit 7 is EOSC , which enables [...]

USER’S GUIDE 050396 153/173 154 DS1283 RTC INTERRUPTS The DS1283 provides two interrupt functions. They are time–of–day alarm and a watchdog alarm. The watch- dog alarm is a user programmed periodic interval time– out. It is programmed using registers 0Ch and 0Dh. The time–of–day alarm is controlled by the registers at loca- tions 03h, [...]

USER’S GUIDE 050396 154/173 155 APPLICA TION: USING THE DS5000T RTC (DS1215 EXAMPLE) The DS5000T and DS2250T use the DS1215 Phantom T ime Chip RTC. This clock is basically a serial device that uses a single address bit as an input and a single data bus bit as an output. The following program is an example of how to use this clock. It provides a s[...]

USER’S GUIDE 050396 155/173 156 lcall CLOSE ;Close date/time registers. mov IE, #0 mov TMOD, #20H ;Initialize the mov TH1, #0FAH ;serial port mov TL1, #0FAH ;for 9600 orl PCON, #80H ;baud using 11.0592 MHz crystal. mov SCON, #52H mov TCON, #40H L: jnb RI, L ;Wait for character. clr RI ;Clear the receiver. mov A, SBUF ;Load in the character. cjne [...]

USER’S GUIDE 050396 156/173 157 OPEN: LCALL CLOSE ;Make sure it is closed. MOV B,#4 ;Set pattern period count. MOV A,#0C5H ;Load first byte of pattern. OPENA: LCALL WBYTE ;Send out the byte. XRL A,#0FFH ;Generate next pattern byte. LCALL WBYTE ;Send out the byte. SWAP A ;Generate next pattern byte. DJNZ B,OPENA ;Repeat until 8 bytes sent. RET ;Re[...]

USER’S GUIDE 050396 157/173 158 POP DPH ;Restore the data POP DPL ; pointer from stack. RET ;Return. ; ;************************************ ;*** SUBROUTINE TO WRITE A DATA BYTE ;************************************ ; ; This subroutine performs a “context switch” to the CE2 data ; space and then writes one byte from the accumulator to the ; t[...]

USER’S GUIDE 050396 158/173 159 APPLICA TION: USING THE DS2251T RTC (DS1283 EXAMPLE) The DS2251T or DS2252T use the DS1283 Byte–wide type real–time clock (RTC). This clock is accessed in a parallel fashion like a RAM. The user simply writes to the registers to set the time and control functions. The fol- lowing program is an example of how to[...]

USER’S GUIDE 050396 159/173 160 ;Set Time CLR A MOV R0, #0Bh LCALL WBYTE ; Freeze the registers. MOV DPTR, #YEAR LCALL TEXT_OUT LCALL HEX_IN LCALL WBYTE ; Set the year. MOV DPTR, #MONTH LCALL TEXT_OUT LCALL HEX_IN LCALL WBYTE ; Set the month. MOV DPTR, #DAY LCALL TEXT_OUT LCALL HEX_IN LCALL WBYTE ; Set the day. DEC R0 MOV DPTR, #DAYW LCALL TEXT_O[...]

USER’S GUIDE 050396 160/173 161 LCALL RBYTE ; Read the day of month. ANL A, #3FH ; Isolate it. LCALL HEX_OUT ; Display day of month. MOV A, #’/’ LCALL CHAR_OUT MOV R0, #10 LCALL RBYTE ; Read the year. LCALL HEX_OUT ; Display the year. MOV DPTR, #TEXT2 LCALL TEXT_OUT MOV R0, #4 LCALL RBYTE ; Read the hour. DEC R0 LCALL HEX_OUT ; Display the ho[...]

USER’S GUIDE 050396 161/173 162 ORL A, B MOV B, A SJMP HEX_LP ; HEX_OUT: MOV B, #2 OUT_LP: SWAP A PUSH ACC ANL A, #0FH CJNE A, #10, $+3 JC HEX_OK ADD A, #7 HEX_OK: ADD A, #30H LCALL CHAR_OUT POP ACC DJNZ B, OUT_LP RET ; TEXT_OUT: PUSH ACC WT1: CLR A MOVC A, @A+DPTR INC DPTR JZ WT2 LCALL CHAR_OUT SJMP WT1 WT2: POP ACC RET ; CHAR_IN: JNB RI, CHAR_I[...]

USER’S GUIDE 050396 162/173 163 POP MCON ; Restore MCON register. RET ; Return. ; YEAR: DB CR,LF,’YEAR (0 – 99) : ’,0 MONTH: DB CR,LF,’MONTH (1 – 12) : ’,0 DAY: DB CR,LF,’DAY OF MONTH : ’,0 DAYW: DB CR,LF,’DAY OF WEEK : ’,0 HOUR: DB CR,LF,’HOUR (0 – 23) : ’,0 MINUTE: DB CR,LF,’MINUTE (0 – 59): ’,0 TRIGGER: DB CR,LF[...]

USER’S GUIDE 050396 163/173 164 SECTION 18: TROUBLESHOOTING Dallas Semiconductor’s Secure Microcontroller family has proven itself to be a reliable and easy–to–use prod- uct. As with any highly–integrated device, however , questions and or problems can arise during its use and development. Many of these stem from inadvertent at- tempts to[...]

USER’S GUIDE 050396 164/173 165 lithium batteries have a very long time constant. Putting the device on the shelf for one to two weeks may restore enough voltage to battery back the memory again. The lifetime of such a battery will be reduced, however . UNABLE TO INVOKE ST OP MODE Unlike the 8051, the STOP bit in the PCON register is T imed Acces[...]

USER’S GUIDE 050396 165/173 166 HIGH CURRENT DRAIN IN STOP MODE Secure Microcontrollers draw approximately 80 µ A of I CC in Stop mode. However , the EA pin has a resistive load of between 40K to 125K ohms. If EA is connected to +5V , this pin will draw between 40 µ A to 125 µ A. This current can be eliminated by grounding the EA pin and locki[...]

USER’S GUIDE 050396 166/173 167 Battery backed signals Do not connect lithium backed chip enables or signals to non–backed devices. This produces a drain on the lith- ium cell. On the DS5001 and DS5002, PE1 and PE2 as a well as CE1 – 4 are lithium backed. PE3 and PE4 are not backed and can be connected to normal circuits. On the DS5000FP , CE[...]

USER’S GUIDE 050396 167/173 168 SECTION 19: INSTRUCTION SET DET AILS MNEMONIC INSTRUCTION CODE HEX BYTE CYCLE EXPLANA TION MNEMONIC D 7 D 6 D 5 D 4 D 3 D 2 D 1 D 0 HEX BYTE CYCLE EXPLANA TION ADD A, Rn 0 0 1 0 1 n 2 n 1 n 0 28–2F 1 1 (A) = (A) + (Rn) ADD A, direct 0 a 7 0 a 6 1 a 5 0 a 4 0 a 3 1 a 2 0 a 1 1 a 0 25 Byte 2 2 1 (A) = (A) + (direct[...]

USER’S GUIDE 050396 168/173 169 EXPLANA TION CYCLE BYTE HEX INSTRUCTION CODE MNEMONIC EXPLANA TION CYCLE BYTE HEX D 0 D 1 D 2 D 3 D 4 D 5 D 6 D 7 MNEMONIC ARITHMETIC OPER. DA A 1 1 0 1 0 1 0 0 D4 1 1 Contents of Accu- mulator are BCD, IF [[(A 3–0 ) > 9] OR [(AC) = 1]] THEN (A 3–0 ) = (A 3–0 ) + 6 AND IF [[(A 7–4 ) > 9] OR [(C) = 1]][...]

USER’S GUIDE 050396 169/173 170 EXPLANA TION CYCLE BYTE HEX INSTRUCTION CODE MNEMONIC EXPLANA TION CYCLE BYTE HEX D 0 D 1 D 2 D 3 D 4 D 5 D 6 D 7 MNEMONIC RL A 0 0 1 0 0 0 1 1 23 1 1 A 1 A 7 A 6 A 5 A 4 A 3 A 2 A 0 The contents of the accumulator are ro- tated left by one bit. R A TION RLC A 0 0 1 1 0 0 1 1 33 1 1 A 1 A 7 A 6 A 5 A 4 A 3 A 2 A 0 [...]

USER’S GUIDE 050396 170/173 171 EXPLANA TION CYCLE BYTE HEX INSTRUCTION CODE MNEMONIC EXPLANA TION CYCLE BYTE HEX D 0 D 1 D 2 D 3 D 4 D 5 D 6 D 7 MNEMONIC MOV direct, #data 0 a 7 d 7 1 a 6 d 6 1 a 5 d 5 1 a 4 d 4 0 a 3 d 3 1 a 2 d 2 0 a 1 d 1 1 a 0 d 0 75 Byte 2 Byte 3 3 2 (direct) = #data MOV @Ri, A 1 1 1 1 0 1 1 i F6–F7 1 1 ((Ri)) = A MOV @Ri[...]

USER’S GUIDE 050396 171/173 172 EXPLANA TION CYCLE BYTE HEX INSTRUCTION CODE MNEMONIC EXPLANA TION CYCLE BYTE HEX D 0 D 1 D 2 D 3 D 4 D 5 D 6 D 7 MNEMONIC CLR C 1 1 0 0 0 0 1 1 C3 1 1 (C) = 0 CLR bit 1 b 7 1 b 6 0 b 5 0 b 4 0 b 3 0 b 2 1 b 1 0 b 0 C2 Byte 2 2 1 (bit) = 0 SETB C 1 1 0 1 0 0 1 1 D3 1 1 (C) = 1 P ULA TION SETB bit 1 b 7 1 b 6 0 b 5 [...]

USER’S GUIDE 050396 172/173 173 EXPLANA TION CYCLE BYTE HEX INSTRUCTION CODE MNEMONIC EXPLANA TION CYCLE BYTE HEX D 0 D 1 D 2 D 3 D 4 D 5 D 6 D 7 MNEMONIC ACALL addr 1 1 a 10 a 7 a 9 a 6 a 8 a 5 1 a 4 0 a 3 0 a 2 0 a 1 1 a 0 Byte 1 Byte 2 2 2 (PC) = (PC) + 2 (SP) = (SP) + 1 ((SP)) = (PC 7–0 ) (SP) = (SP) + 1 ((SP)) = (PC 15–8 ) (PC)=page addr[...]

USER’S GUIDE 050396 173/173 174 EXPLANA TION CYCLE BYTE HEX INSTRUCTION CODE MNEMONIC EXPLANA TION CYCLE BYTE HEX D 0 D 1 D 2 D 3 D 4 D 5 D 6 D 7 MNEMONIC JNB bit, rel 0 b 7 r 7 0 b 6 r 6 1 b 5 r 5 1 b 4 r 4 0 b 3 r 3 0 b 2 r 2 0 b 1 r 1 0 b 0 r 0 30 Byte 2 Byte 3 3 2 (PC) = (PC) + 3 IF (bit) = 0 THEN (PC) = (PC) + rel JBC bit, direct rel 0 b 7 r[...]