Programming AT24RF08 and PCA24S08 - unlocking device APP register

Interesting examples and tutorials about REVELPROG-IS features and device programming
ArT
Posts: 962
Joined: Wed Mar 25, 2015 8:54 am
Location: Warsaw, Poland
Has thanked: 19 times
Been thanked: 94 times

Programming AT24RF08 and PCA24S08 - unlocking device APP register

Postby ArT » Fri Jun 16, 2017 2:41 pm

Reading and programming Atmel AT24RF08C and NXP PCA24S08 (P24S08 or PS08) may be tricky. These devices have additional APP (Access Protection Page) register located at device address 0xB8.

tl;dr: you can unlock these devices using custom scripts tool for REVELPROG-IS version v1.6.1+

First 9 bytes in APP register are configuration bytes with Protection Bits (PBx). When protection bit is 1, than assess is permitted in the block. When protection bits are 0, than read and write are NOT possible (block is read/write protected):
AT24RF08_Protection-Bits.jpg
AT24RF08_Protection-Bits.jpg (52.18 KiB) Viewed 7258 times


Here is an APP Memory Map:
AT24RF08_APP-memory-map.jpg
AT24RF08_APP-memory-map.jpg (114.08 KiB) Viewed 7258 times

All PBx bits should be set to 0 to unlock the device.
Additionally all WPx bits should be set to 0 to unlock write for all pages within block 0.

You can read more about APP register in device datasheet (Access Protection Chapter):
Atmel AT24RF08C datasheet
NXP PCA24S08 datasheet

If you try to read or write protected area of the memory than you will get communication error.

You can use custom scripts tool for REVELPROG-IS to read APP register and unlock it.

Tutorial in 3 simple steps:

1. Read APP register (only protection bytes) and make backup - you can use following script:
(Load it in "Tools -> Customs Scripts" and press "Execute")

Code: Select all

// I2C AT24RF08 Read APP protection bytes (0x400-0x409)
// datasheet page 6: https://www.reveltronics.com/downloads/datasheet/AT24RF08C.pdf

#SCRIPT HEADER;
SCRIPT:v1.6.1;
#HARDWARE SETTINGS;
HW:I2C,3.3V,SLOW;

// Read APP configuration register (byte by byte) protection bytes (0-9)
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,00;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,01;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,02;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,03;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,04;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,05;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,06;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,07;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,08;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,09;


2. Unlock the device (overwrite APP protection bytes) - you can use following script:

Code: Select all

// I2C AT24RF08 Unlock Device (overwrite APP protection bytes)
// datasheet page 6: https://www.reveltronics.com/downloads/datasheet/AT24RF08C.pdf
// PBx are protection bits in bytes 0..8

#SCRIPT HEADER;
SCRIPT:v1.6.1;
#HARDWARE SETTINGS;
HW:I2C,3.3V,SLOW;

// Unlock Block 0 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,00;
DATA:FF;

// Unlock Block 1 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,01;
DATA:FF;

// Unlock Block 2 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,02;
DATA:FF;

// Unlock Block 3 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,03;
DATA:FF;

// Unlock Block 4 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,04;
DATA:FF;

// Unlock Block 5 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,05;
DATA:FF;

// Unlock Block 6 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,06;
DATA:FF;

// Unlock Block 7 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,07;
DATA:FF;

// Unlock APP bytes (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,08;
DATA:FF;

// Unlock all pages within Block 0 (Write 0xFF)
#OPERATION;
SW:1,0,0,0,0,0,10,0,0,500;
INSTR:B8,09;
DATA:FF;

// Read APP protection bytes
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,00;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,01;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,02;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,03;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,04;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,05;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,06;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,07;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,08;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,09;

Please note that we are writing "0xFF" to first 10 bytes of APP register.

----
Now you can read and write device without troubles.
In REVELPROG-IS you can select AT24RF08 or PCA24S08 or P24S08 or PS08.
----


3. Restore APP register to previous values (restore configuration and lock the device) - you can use the same script as for unlocking but replace 0xFF data bytes with required values.

If you have unlocked device, than you can also read all APP configuration register (16 bytes). You can use following script for it:

Code: Select all

// I2C AT24RF08 Read APP register + ID (0x400-0x420)
// datasheet page 6: https://www.reveltronics.com/downloads/datasheet/AT24RF08C.pdf

#SCRIPT HEADER;
SCRIPT:v1.6.1;
#HARDWARE SETTINGS;
HW:I2C,3.3V,SLOW;

// Read APP configuration register (byte by byte)
// 0x400 - 0x40F
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,00;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,01;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,02;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,03;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,04;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,05;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,06;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,07;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,08;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,09;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,0A;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,0B;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,0C;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,0D;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,0E;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,0F;

// Read APP ID (byte by byte)
// 0x410 - 0x41F
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,10;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,11;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,12;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,13;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,14;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,15;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,16;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,17;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,18;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,19;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,1A;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,1B;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,1C;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,1D;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,1E;
#OPERATION;
SW:0,0,1,0,0,0,0,0,0,500;
INSTR:B8,1F;
Attachments
RPscript_I2C_AT24RF08_APP_ProtectionBytes_Read.txt
(831 Bytes) Downloaded 262 times
RPscript_I2C_AT24RF08_Unlock-Device.txt
(1.8 KiB) Downloaded 257 times
RPscript_I2C_AT24RF08_APP_Read.txt
(2.02 KiB) Downloaded 267 times

Return to “Tutorials and Examples”

Who is online

Users browsing this forum: No registered users and 1 guest