2A 41

Product code is:

40h for 3.4
41h for 3.5
42h for 3.6 USB

2A 42 cc

0 = Nothing (hi impedance, C2 will be set to 5V with help of a pull-up resistor
1 = 0V
2 = 5V PIC, run mode…
3 = Set PIC programming mode
4 = 5V
5 = High VPP
6 = Set PIC programming mode, but sets 5V low while raising 13V
7 = Set Low Voltage PIC programming mode, only 5V is used on the C2 pin.

Response: ACK

Firmware 0.8 and newer has a built in short-circuit detect which will be run automatically when C=3 if command *{ (smart card reset). The test can give an false alarm if smartcard is programmed with RC oscillator (unprogrammed state) and C3 is used for programming data or clock. Firmware 0.12 (for MP34) and 1.2 (for MP35) and newer will not give any false alarm.

Option 6 is only available from firmware 3.0 and newer. This is used to comply with never programming specifications from Microchip were the MCLR signal should raised from 0V till 13V while the 5V power is still low, the programmer does this in the following way:

make sure that 5V and MCLR is low.
Turn MCLR to 13V
Turn on 5V supply voltage.

Option 7 is only available in firmware 5.1 and newer.

Bugfix in firmware 4.3 on *B3: The MCLR signal is now raised 100us after VDD is raised.

2A 43 nn

0=C3
1=C4
2=C7
3=C8
4=C6

NOTE: The Data/Clock pin C6 is not available in MP 3.5USB and MP 3.6USB

Response: ACK

2A 44 nn

0=C3
1=C4
2=C7
3=C8
4=C6

Response: ACK

To setup programming via DIL-socket and ICSP connectors use the following settings:

• 18-pin PIC chips in DIL-socket: *C 02 and *D 03
• 8-pin PIC chips in DIL-socket: *C 03 and *D 00
• serial eeproms like 24cnn series: *C 01 , *D 03 and *h 02
• ICSP connector: *C 02 and *D 03

The pin-out for the ICSP connector is:

1. MCLR

2. +5V, Only to be used for the chip itself, don't use it if your application supplies power the pic-chip.

3. GND

4. Data

5. Clock

6. Oscillator, don't connect for normal ICSP operation.

2A 46 nn nn cc bb .. .. ..

b= is the controlbyte which should be used for ack-polling.

C=
Bit0 1=send start
Bit1 1=send stop
Bit2 1=poll for acknowledge.

Response:

Error address (word) equals FFFFh if no error + ACK.

2A 47 nn nn cc

C=
Bit0 1=send stop, and send last ACK as a NACK

Response:

N bytes of data+erroroffset(word)+ack/nack

NOTE! N must not be greater than 255 on MP Basic with firmware revision 0.4 or earlier.

NOTE! Error offset is FFFFh if no error occurred, but on MP Basic with firmware revision 0.3 or earlier error offset can be unknown. Anyway the ack signals a successful operation.

2A 4E nn

where n is the ICSP command.

Response: ACK

2A 4F nn dd dd

n = the ICSP command

d = the 14 bit data, send as a word, leftshifted!

Firmware 2.0 or newer, this command also accepts 16 bit data for compability with PIC18Fxxx chips etc.

Response: ACK

2A 50

Response: word read. the result needs to be right shifted and or'ed with 3FFFh if it's an 14bit pic or or'ed with 0FFFh if it's an 12-bit pic.

2A 52 rr aa cc nn nn .. ..

R (byte) = Number of retries.

A (byte) = Extra programming cycles to be made after successful programming.

C (byte), bitmapped:
Bit 0 : 1=100us delay, 0=10ms delay.
Bit 1 : 1=Send endprog command after completed programming.
Bit 2 : 1=Multiply retry’s with additional prog cycles.
Bit 3 : 1=Program DATA-memory instead of PROGRAM-memory
Bit 4 : 1= An additional 10ms delay for PIC16F84A
Bit 5,6,7: Read back verification:

0=Normal
1=Zero (works only on MP 3.4 revision 0.3 and newer)
2=Ones (works only on MP 3.4 revision 0.3 and newer)
3=XNOR (works only on MP 3.4 revision 0.3 and newer)
4=No Verify.
5=RFU
6=RFU
7=Normal with Preverify (program only if data differ) (Only FW 1.5 and newer)

Response:

ErrorData(word)+ErrorOffset(word)+ack/nack

NOTE! All data is left-shifted one time!!! I.e.. 3FFF becomes 7FFE etc.

Bug fix in FW 1.5: Retries was never multiplied with additional progcycles. in earlier versions.

2A 53 nn nn

Response: ACK

2A 54 cc nn nn

C (byte), bitmapped:
Bit 3 : 1=Read DATA-memory instead of PROGRAM-memory.

Response:

N words of data.

BUG! In firmware 0.8 and earlier this command would cause a Watchdog timeout if it takes more than 0.5 seconds. Workaround: don't read large memory blocks!

2A 5E cc

C is:
0 : Turns off oscillator (Only valid in MP 3.5)
1: Turns on oscillator, 3.58MHz on C3.
2: Turns on oscillator, 6.00MHz on C3. (only firmware 3.0 and newer)

2A 63

Response: <syserror>+<syserror2>+<syserror3>+<ack>

SysError0 =
Bit 0 : Programmer was restarted by MCLR (Only FW 0.8 and newer)
Bit 1 : Programmer was restarted due to a brown-out detect (Only FW 0.8 and newer)
Bit 2 : Programmer was restarted by Watchdog timeout (Only FW 0.8 and newer)
Bit 3 :
Bit 4 :
Bit 5 : FIFO input overrun.
Bit 6 : Framing error
Bit 7 :

SysError2 =
Bit 0 :
Bit 1 :
Bit 2 :
Bit 3 : I2C Ack-polling timeout
Bit 4 : I2C No Ack received
Bit 5 :
Bit 6 : ISO-pin short-circuit detected (Only FW 0.8 and newer)
Bit 7 :

SysError3 =
Bit 0 : 5V regulation error
Bit 1 : Parity detected in SendReceive command (2A A1) (only FW 4.2 and newer)
Bit 2 :
Bit 3 :
Bit 4 :
Bit 5 :
Bit 6 :
Bit 7 : Illegal parameter entered.

All undefined bits read zero's.

2A 64 nn nn

N is a word which tells how many bytes of test data to be sent.

This function is only to be used for testing the communication between the programmer and the computer.

2A 65 nn nn .. ..

N is a word which tells how many bytes of test data the programmer will receive.

2A 67

Not implemented in MP 3.5

2A 68 nn

2A 69 nn

2A 6A aa bb cc dd

Send ATMEL data, Sends 4 byte of data to the ATMEL AT90Sxxxx chip, Serial programming interface.

2A 6B

2A 6C

2A 7B

This function sets C3,C4,C6,C7,C8 to a input high state, turns off the 3.58MHz oscillator and sets C2 to 0V (reset state).

On firmware 1.0 and earlier (all MP 3.4) the C2 signal is not set to 0V, so it would be a good practice to send an *B1  2A 42 01 to force the C2 signal to 0V. Because this would prevent cards and chips to execute data if they are programmed to use an internal oscillator or RC-oscillator.

On firmware 3.0 and newer this command will also turn on the supply power to the card.

2A 7C

On Firmware 0.7 and newer, the Trans-through mode is not started until RTS is set active

On Firmware 0.8 and newer, no reset is given to smartcard if trans-through mode is started with active RTS.

2A 7D

2A 7E

2A 7F nn

2A 80

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 81

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 82

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 83

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 84

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 85

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 86

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 87

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 88

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 89

Not implemented in MP 35 firmware 1.7 and newer since a flash pic is used.

2A 8A

2A 8B

2A 8C nn

n is a byte.

Set programming delay in 100us/steps, this overrides the settings in *R if set to anything else than 0, default value is 0. Example, the setting of 100 gives 10ms programming delay.

This programming delay is also used for the Atmel programming command, Atmel chip should normally have 4ms programming delay at 5V (set this program delay to 40)

2A 8D p1 p2 nn nn s1 r1 cc .. ..

Atmel program command.

p1 and p2 is byte, if data is equal to p1 or p2 then the programming delay (specified by the command above) is used, otherwise data-polling is used.

n is a word, defining how many byte of data that should be programmed.

s1, is the first byte in the 4 byte atmel command to be sent for programming the chip.

r1, is the first byte in the 4 byte atmel command to be sent for reading/verifying the chip.

c: 
Bit 0 = 1=don't program if data equals to FFh
Bit 1 = 1=No verify  (Only implemented i FW 1.6 and later)

Response:

ErrorData(word)+ErrorOffset(word)+ack/nack

The following s1, r1 combinations should be used:

40h, 20h for 8515 low flash
48h, 28h for 8515 high flash
C0h, A0h for 8515 eeprom

p1 and p2:

7Fh, 7Fh for 8515 flash
80h, 7Fh for 8515 eeprom

2A 8E nn nn aa

Atmel read command

n is a word

a is the first byte in the 4 byte atmel command to be sent for reading the chip.

response:

n bytes of data +<ack>

example for the AT90S2323 chip: 
a should be set to 20h for reading low byte of the program memory, 28h for high byte program memory and A0h for the internal eeprom memory.

2A 8F cc

Set ICSP PIC programming command, default is 08h, which is the default "Begin Erase Programming cycle", but if you set it to 18h the programmer will do a "Begin Programming Only Cycle"  which can be used on bulk erased flash chips for faster programming.

This command is no longer needed in firmware 2.0 and newer, but it's still implemented for compability reasons.

2A 90

Only Firmware 1.5

2A 91 aa aa cc nn nn

a is a word, this is the data which the programmer should compair with the content on the pic-chip and the data should be left shifted once just as in the *R command

C (byte), bitmapped:
Bit 3 : 1=Verify DATA-memory instead of PROGRAM-memory.

n is word which tells the programmer how many addresses that should be checked.

Response:

The programmer returns FF FF 06 if all was blank or <index>21 if something was not equal. index is the pointer where an mismatch first was found.

NOTE! If no mismatch was detect the internal address pointer in the pic-chip will be placed after the checked memory area ( in other words it will be increased by one from the last checked address). However if a mismatch is detected, the internal address pointer will not be moved from the first detected mismatch. Then you can use the *T command to directly read the content of this address.

NOTE! Checking large memory areas, for example the entire program memory of the PIC16F876 chip which has 8192 words of memory takes around 4 seconds to perform, since it requires the programmer to send nearly a quarter of a million clock pulses to the chip.

Example:

2A 91 FE 7F 00 00 40

In this example the programmer checks for 3FFFh on 1024 addresses from the current position. The programmer will then return FF FF 06 if the entire memory are was blank or 00 00 21 if a missmatch was found on the first address.

Only Firmware 1.7 and newer.

2A 92 aa nn .. ..

N is a byte, telling how many bytes to write to address a (byte) and forwards.

Note: the first 16 bytes are write protected.

Only Firmware 1.7 and newer.

2A 93 aa nn

Reads n number of bytes starting from address a.

Response:

Number of requested bytes plus <ack>

The internal eeprom in the programmer is 128 bytes

Only Firmware 1.7 and newer.

2A 94 aa aa

A is a 16bit address pointer (word)

This command is useful when you want to start to write or read from a certain address, since normally the ATMEL write/read commands always start from address 0.

This command is also very useful when programming the ATmega chip's, since entire pages are programmed at once, example:

1. Set the address with this command
2. Use the Atmel write command with S1 set to "load program memory page" , turn off verify and set it to program one page, 64 bytes for the ATmega 163
3. Execute the "write program memory page".
4. Use polling by reading one memory address within the page which should not be FFh, continue polling until right value is read or report programming failure.
5. Proceed with next page, goto step 1

NOTE! Once this command has been sent to the programmer, it will always use the address-pointer sent by this command instead of the default 0 until the programmer is re-started.

Only Firmware 2.0 and newer.

2A 95 b1 b2 b3 b4 b5

This command can be used to change the default speed of 9600bps of the programmers serial port. there are 5 timing variables to set:

b1 = Startbit Sync, 230
b2 = Stopbit Sync, 200
b3 = Firstbit Sync, 178
b4 = Nextbit Sync, 165
b5 = TX_Sync, 167

This is how to change the speed:

1. Send this command with the 5 timing parameters
2. Wait for acknowledge (06) (at current bitrate)
3. Lower RTS
4. Change bitrate
5. Rise RTS again
6. New acknowledge should be received at new bitrate.
7. Done!

NOTE! The programmer will always return to it's default speed when it's restarted.

NOTE2! Remember to switch back to right speed when sending data through the programmer with the trans through command: *| 2A 7C

Only firmware 2.0 and newer.

2A 96 PP II LL RR EE NN MM

Set commands:

Other parameters:

NOTE! When M is set to 2 or more, be sure to turn of verifying during programming, the chip must be verified with the *T command once programming is completed

NOTE! When using this command, there is no need to use the *Å 2A 8F command!

Only firmware 2.0 and newer.

2A 97

Only firmware 2.0 and newer

2A 98 cc dd

cmd is the 4 bit command that should be sent

data is a byte of data that should be sent

Response:

1 byte of return data followed by ack.

Only firmware 2.0 and newer

2A 99 ss dd bb

The default for these commands is to use normal asynchron communication but for some cards a better timing is required between the computers bitrate and the oscillator supplied by the programmer.

for 9600bps a startbittiming delay is 216 and for 5726bps a timing of 181 is normal.

for 9600bps a databittiming delay of 152 is normal and for 5726bps a timing of 82 is normal.

Every increase/decrease in this value changes the timing by +/1us.

the startbit timing is calculated as follows:

The wanted timing is exactly haft the length of the bit to be transferred, for example: if you use 9600bps each bit-length is 104us And half of that is 52us, there is a built in delay of 12us in the firmware:

216=256-(52-12)

the databit timing is simply the wanted bitlength:

152=256-104

The "bits" value should normally be 10, since the stopbits are not included. When using normal ISO7816 compatible software data is sent with 1 startbit, 8 databits, 1 parity and 2 stopbits, this totals to 10bits when we exclude the stopbits.

Only firmware 1.9 and newer

2A 9A

Only firmware 3.0 and newer

2A 9B

Only firmware 3.0 and newer

2A 9C aa

Baudrate=cpuspeed/16(a+1)

cpuspeed = 4000000 on MP 3.5
cpuspeed = 8000000 on MP 3.6

Set a to 25 for 9600bps and 12 for 19200bps.

Maximum speed for firmware 3 and 4 is currently 125000bps

This is done the following way:

Send the command *£ a and wait for ack.

Disable RTS

Set the speed to the desired baudrate

Enable RTS

receive another ACK, this time in the desired baudrate instead.

Only firmware 3.0 and newer

2A 9D TT MM CC

In order to compensate for the delays caused by a device connected to a USB port, this command can be used to adjust the reset pulse causing it to be delayed in order to avoid a timeout caused by a too long delay between the reset pulse and data sent after the reset pulse.

T is a byte, the default delay is set to 0, no delay. each digit represents a delay of 100us. For example a value of 107 decimal causes a delay of 10.7ms

If random mode is activated (see below) the value of T is replaced by a random value instead.

M is a byte, which can force the reset pulse lo for a certain minimum time, it is calculated as follows: delay in us = 256 - M. For example a value of 156 will cause a minimum reset pulse length of 100us.

C is a bitmapped byte:
Bit 0 : 0=normal mode, 1=random mode
Bit 1-7 : RFU, should be kept 0

This command is only supported by USB devices, firmware 4.1 and newer

2A 9E

Here is how to use it:

• Disable RTS
• Send the command 2A 9E
• Enable RTS (programmer starts measuring time)
• Disable RTS
• Send one byte of data (should be 00h for easy detection) programmer triggers on the startbit
• Enable RTS
• Programmer responds with a byte of the delay in 100us units between the enable RTS and the startbit of the byte sent by the programmer.
• Programmer finally sends an ACK of the command.

The value received by this command can be used as the T value of the 2A 9D command. But should be by 100 or 200us, since the programmer should have time to send the resetpulse and to have a small delay before the first data is transmitted

This command is only supported by USB devices, firmware 4.1 and newer

2A 9F TT DD CC

Sends the trapcode (byte) stored in T with a delay of D us (microseconds) the first time card is reseted in phoenix mode.

The wanted delay in microseconds is sent to D and is calculated as Delay = (256 - D)*4.

C is bitmapped byte:

Bit 0 : 0=Direct Mode 1=Inverse mode
Bit 1-7 : RFU, should be kept 0

Response: ACK

This command is only supported by USB devices, firmware 4.1 and newer

2A A0 D1 D2 BB BD RL RD

BitReg:

0 : 0=DirectMode 1=InverseMode
1 : 0=Parity enabled 1=No parity
2 : 0=Use internal sync 1=Sync with clock on C3 (Only firmware 5.0 and newer)

If internal sync is used then Delay1 and Delay2 is:

Delay1 = Bitdelay = 256 - number of us to wait between each bit. Example for 104us delay enter 256-104=152

Delay2 = Startbit delay = The delay between the moment when the falling flank of the start bit is detected until the middle of the first bit. (internal delay of the programmer is 10-16us). Example to get 156us delay for 9600bps: Delay2=256-(156-13)

if external sync on C3 is used, then Delay1 and Delay2 is a word which defines the ETU divided by 4 of each bit. Delay1 = ETU_LO, Delay2 = ETU_HI.
ETU = Number of clock cycles on oscillator (C3) for each bit. for 9600bps and 3.58MHz its 372/4=93

ByteDelay = Number of Bitdelays or ETU's to wait between each byte when sending data.

ResetLength = Time to keep reset (C2) low. Example, for a 100us long reset pulse:
Resetlength=256-100=156

ResetDelay = Time to wait before sending data after a reset pulse. Example: To wait 500us before sendning data: ResetDelay=256-(500/4)=131

2A A1 BB BS BR DD DD DD....

response:

DD DD DD.... NN ACK

BitReg:

0 : 0=Don't make resetpulse 1=Make reset pulse defined by ResetLength/ResetDelay

BytesToSend = Number of bytes to send to the smartcard

BytesToReceive = Number of bytes to receive from smartcard.

This command will send the bytes which should be sent to the smartcard (if any) then it will receive the specified number of bytes from the card. To abort from the receive operation you must disable the RTS signal.

The command will always respond with the number of bytes requested by the BytesToReceive variable but the actual number of bytes received by the card will be known by the NN byte sent by the command in response.

2A A2

response:

LL DD DD DD.... ACK

Receives data as a ascii text string from the programmer, the length of the string is given by the byte LL followed by the string followed by ACK