Home

This is a work in progress as of 3/17/2024.

In circuit programmer handshake sequence

Following sequence is sent to the device immediately after power on to activate ICP mode

i2c address	mode	ACK/NACK description
0x7e	w	NACK
0x7c	w	Keep sending until ACK
0x7d	w	NACK
0x2d	w	NACK
0x7e	r	ACK

i2c address	mode	description
0x7c	r	?? MCU Reset ??
0x7e	w	command register
0x7f	r/w	data register

Configuration/fuse bytes

commands	parameter(s)	description
0x02		?? Read back 0xfc ?? repeated 2 times, see blankcheck_08-20-2023, mcureset_08-20-2023, erasecode_08-20-2023; On my still locked flash it reads back 0xdc,; read_config_while_protected_fails_08-26-2023 returns 0xCC
0x03		erase flash
0x05	msb lsb	write flash (len = 0x80; write 2 times) padded with 0xff or 00
0x06	msb lsb	read flash 512 bytes
0x08	adr	write config byte (write 2 times)
0x09	adr	read config byte
??		blank check
??		verify
??		protect
??		mcu reset
??		eeprom read
??		eeprom write
??		eeprom erase

config byte(s)	parameter(s)	description
address	data
0x00	0x0A	chip type
0x01	0x0B	unknown
0x02	0x19	unknown
0x03	0xFF	unknown
0x04	0x0E	unknown
0x05	0x1C	unknown
0x10	0x00	chip protected
	0x55	chip unprotected
0x11	0xFF	system clock (default)
	0xF4	external crystal (xtal)
	0xF5	ext xtal / 2
	0xF6	ext xtal / 4
	0xE7	ext xtal=i/o
	0xFF	16 MHz
	0xF9	8 MHz
	0xFA	4 MHz
	0xFB	2 MHz
	0xFC	1 MHz

0x12	0xf9	pin func RESET + i/o (default)
	1111 1xxx	RESET
	0000 0xxx	bi-direction IO
		IO Mode
	xxxx xxx1	quasi-bidirection
	xxxx xxx0	input only
		deglitch: XTAL, IRC
	xxxx x00x	no
	xxxx x01x	14ns, 8ns
	xxxx x10x	17ns, 0ns
	xxxx x11x	20ns, 8ns

config byte(s)	parameter(s)	description
0x13	0xFF	reset time (default)
	0x06	200 ms
	0x05	100 ms
	0x04	50 ms
	0xFF	25 ms
	0x03	16 ms
	0x02	8 ms
	0x01	4 ms

0x14	0xff	ISP Start Address (default)
	0xFF	No ISP Code
	0x01	1f80
	0x02	1f00
	0x03	1e80
	0x04	1e00
	0x05	1d80
	0x06	1d00
	0x07	1c80
	0x08	1c00

0x15	0xff	ISP Entry Mech. (default)
	1xxx xxxx	Addr.($0000)=FFH Power On Disable = 1 / Enable = 0
	x1xx xxxx	Addr.($0000)=FFH Pad Reset Disable = 1 / Enable = 0
	xxxx 1xxx	P1.6=0 Power On Disable = 1 / Enable = 0
	xxxx x1xx	P1.6=0 Pad Reset Disable = 1 / Enable = 0
	xxxx xx1x	P1.1 inputs 2 clocks Power On Disable = 1 / Enable = 0
	xxxx xxx1	P1.1 inputs 2 clocks Pad Reset Disable = 1 / Enable = 0
	xx1x xxxx	Force Entry Disable = 1 / All resets = 0

0x16	0xff	Low Voltage Reset (default)
	0xFC	3.0V
	0xFD	2.4V
	0xFE	2.2V
	0xFF	2.0V

0x17	0xff	Op/Comparator (default)
	1111 xxxx	Type 0: GPIO
	1010 xxxx	Type 0: Comparator Input 0: Ext pin
	1001 xxxx	Type 0: Comparator Input 0: Int VBG
	xxxx 1111	Type 1: GPIO
	xxxx 1010	Type 1: Comparator Input 1: Ext pin
	xxxx 1001	Type 1: Comparator Input 0: Int VBG

unknown	unknown	unknown
0x28	0xFF	?
0x29	0xFF	?
0x2a	0xFF	?
0x2b	0xFF	?

address	example value	field
0x2c	0x00	unknown
0x2d	0x1F	Flash Checksum 2 (MSB)
0x2e	0x85	Flash Checksum 1
0x2f	0xDB	Flash Checksum 0 (LSB)

Checksum is calculated as a SUM of all FLASH bytes.
Remember that erased bytes are 0x00 or 0xFF when computing checksum.

Is EEPROM the SUM as well, does not appear to be?