Preventing manufacturing service from copying hex code - Page 1
Forum section: electronics / general

author: matbob
author_rank: Contributor
timestamp: December 06, 2019, 10:16:00 pm
content: Hello All,I have a product with a Microchip PIC microcontroller in it. The components and PCB will be sourced, assembled and tested by an EMS (Electronics Manufacturing Service) which is located far from my facility. I have to give them the hex code for programming the microcontroller, may be as a PIC kit "Programmer To Go".I will be making all the legal agreements to prevent them from cloning my design but I know it is useless. Is there any way to prevent the EMS from copying my code and make clones of the product? I have the following constraints:1) I cannot be physically there at the EMS facility to do the programming myself.2) I cannot have the microcontrollers pre-programmed from Microchip because the EMS might have a preferred vendor.3) I cannot have the micro controllers shipped to my facility and then program it and send it back because this is a volume manufacturing and the EMS might prefer tape and reel packaging (the microcontroller is in SOIC package). So if I take out the microcontroller for programming, I cannot re-pack it.Is there a way out?Thanks for your help.

author: Kjelt
author_rank: Super Contributor
timestamp: December 06, 2019, 10:23:37 pm
content: Only with an indirect customer unfriendly activation scheme that also requires an interface to a gui or pc.What you would like to have and no cheap microcontroller has is a small secured area of rom where you can let the manufacturer custom program your special bootcode in. But alas that is expensive and some high iq hacker will eventually gain access to it anyway.

author: SiliconWizard
author_rank: Super Contributor
timestamp: December 06, 2019, 10:24:16 pm
content: I don't see one. If you're giving them means of programming the chips, whatever means you choose, they'll be able to do the same behind your back.So count on the legal agreements, and make sure you can defend them in case they are infringed.One possibility would be to add a final step that only your company can handle, like an activation step of some kind. So just producing the device, even with the full firmware, would not be enough to make it function (unless of course the activation system is cracked, but that would be more than just copying...) Downside is, adding a service to handle activations would have a cost.

author: langwadt
author_rank: Super Contributor
timestamp: December 06, 2019, 10:27:32 pm
content: Quote from: matbob on December 06, 2019, 10:16:00 pmsince the part you want use (preprogrammed PIC) isn't available from their preferred vendor, you buy it and supply them?

author: matbob
author_rank: Contributor
timestamp: December 06, 2019, 10:40:33 pm
content: @Kjelt,@SiliconWizard,The microcontroller is a cheap one and unfortunately all the pins have been used and I am close to 98% flash memory usage.@langwadt,This seems to be the only option. But, what if I find a bug on my code and want to change the code in between the production run. And also, I will have to deduct the extra cost of the microcontroller from my profit margin.Thanks for your replies.

author: Kjelt
author_rank: Super Contributor
timestamp: December 06, 2019, 10:46:02 pm
content: Quote from: matbob on December 06, 2019, 10:40:33 pmThen you are out of options.What you learned today is what I told professionals for years:Security should be designed in from the start, it can (almost) never be added at the end.

author: langwadt
author_rank: Super Contributor
timestamp: December 06, 2019, 10:48:32 pm
content: Quote from: matbob on December 06, 2019, 10:40:33 pmcan you give the EMS a software that only has what is needed to do the test and then reprogram them later yourself?

author: SiliconWizard
author_rank: Super Contributor
timestamp: December 06, 2019, 10:57:34 pm
content: One idea, close to the "activation" thing, but easier to deal with IMO, would be to write your own programming software and have EMS use it to program your devices instead of using Microchip tools. It's some work for sure, but definitely doable. There are open source projects for doing just that AFAIK that could serve as basis, and anyway, I think the programming protocols are documented.Said software could contain the object code for the firmware itself, so you wouldn't need to provide a hex file, and retrieving the code could be made at least significantly harder than just copying a file.Additionally, this software could add the functionality to generate (and program) a different serial number for each device. Make the software able to only generate unique serial numbers, and only for a predefined range. Once the total number of programmed devices has been reached, the software would not allow programming any further device, so you'd keep control over the number of "manufacturable" products.In the firmware, you could just add a basic check that the SN has been programmed - probably just a few more bytes of code - (so even if someone manages to somehow extract the code from your programming software, they would still have to understand this additional thing with the SN.) That step would be optional, just a simple additional roadblock. Some PICs can be configured at program time to prevent reading back Flash content as well, so enable this in the config bits.This way, the object code itself is never provided directly. If you ever need to update the firmware, just send EMS a new version of your programming software; likewise if the predefined number of devices has been reached. It would take a reasonably skilled software guy to do this, but it seems largely doable, and many manufacturing plants will accept using client-provided tools and software (sometimes you don't even have a choice when you use very specific/custom parts.)

author: ataradov
author_rank: Super Contributor
timestamp: December 06, 2019, 11:09:00 pm
content: There is no point in making a custom software. All they will have to do is put a logic analyzer on the programming pins and extract the firmware and any additional programming steps from that.

author: coppice
author_rank: Super Contributor
timestamp: December 06, 2019, 11:27:13 pm
content: Who is testing the completed boards? If its you, have you considered programming the parts after the board has been assembled?A lot of big production runs at EMS places use pre-programmed MCUs, and its a huge pain. Not only is it messy unpacking parts, programming them in jigs, and then repacking them suitable for the PnP machines on the EMS line, you also get a higher defect rate if the device has legs. There will always be some rate of leg bending with all that extra handling. QFNs might be a boon here.

author: SiliconWizard
author_rank: Super Contributor
timestamp: December 06, 2019, 11:29:35 pm
content: The whole point is to make things harder. Just like locking your door. Those manufacturing services must see hundreds of different products per year, they won't go into any effort getting to clone yours unless it's either VERY easy to do so (just copying a file for instance), or your device is hugely interesting and sells by the million.

author: james_s
author_rank: Super Contributor
timestamp: December 06, 2019, 11:57:11 pm
content: I'm of the opinion that unless it's doing something really, really unique, there's no point. If the widget is worth copying then someone will invest a bit of time in writing their own firmware that does the same thing. If someone releases a commercial product that is running your own firmware then there are ways you can find this out and go after them legally.In the classic arcade game days it was common to implement easter eggs in the code that could be used to demonstrate that a competitor had copied it.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 07, 2019, 12:06:15 am
content: Given your constrains, there's absolutely no way you can prevent them from stealing your code.The only way is to put an ICSP header on the board and program only after you receive them from your manufacturer.You can give your manufacturer an alternative firmware which is only good for tests, but is harmless if stolen. They will do all the tests, and you will then re-program with real firmware in-house. Alternatively, you can move testing (or part of it) in-house too.At any rate, having an ability to re-program it at any time later is a good thing.On the positive note, how much code can you really have in a small PIC which cannot be re-written with relatively small effort? So, what's the point of protecting it?

author: matbob
author_rank: Contributor
timestamp: December 07, 2019, 12:47:17 am
content: Quote from: Kjelt on December 06, 2019, 10:46:02 pm@Kjelt,The initial plan was to do the production within our facility. So I did not think of any extra security measures other than setting the flash memory read lock bits. But now, our reseller/buyer wants a better quality and cost control and therefore we have to shift to their preferred EMS service.

author: matbob
author_rank: Contributor
timestamp: December 07, 2019, 12:49:07 am
content: Quote from: ataradov on December 06, 2019, 11:09:00 pm@ataradovYes, I agree to this. All you need is to monitor the programming pins.

author: matbob
author_rank: Contributor
timestamp: December 07, 2019, 01:15:29 am
content: @coppice@NorthGuyThe testing has to be done by the EMS. If there are rejects, they are responsible. If the board comes to my facility and if I find rejects, the EMS could blame the transportation or handling at my facility. And again, the rejects have to be send back to EMS for repair which is too much work and money. Also, after testing, the boards have to go directly to a reseller instead of me.@james_sI did consult a lawyer regarding IP protection and stuff. Their advice is to do something technical to avoid the software getting leaked at the first place. In the part of the world I plan to sell this product, it is too difficult to get a favourable judgement from court.

author: thm_w
author_rank: Super Contributor
timestamp: December 07, 2019, 02:13:07 am
content: Quote from: coppice on December 06, 2019, 11:27:13 pmmicrochip programs the parts for you, they aren't going to screw anything up..https://www.microchipdirect.com/programming/

author: coppice
author_rank: Super Contributor
timestamp: December 07, 2019, 02:25:13 am
content: Quote from: thm_w on December 07, 2019, 02:13:07 amVarious vendors will do the programming for you at the factory, and mark the chips with a customer specific code. They don't all mention this. You have to talk to the sales people, and you may need to be buying in considerable volume. However, this usually requires considerable setup time, and most people are trying to churn out some boards the moment they are happy with the design. The time issues means programming before the chip leaves the factory is not for everyone.

author: Bud
author_rank: Super Contributor
timestamp: December 07, 2019, 02:55:05 am
content: Digikey does it. In fact i can see a note added right under the microcontroller line item when i add one to the shopping cart, offering custom programming.

author: ejeffrey
author_rank: Super Contributor
timestamp: December 07, 2019, 04:40:52 am
content: Quote from: matbob on December 06, 2019, 10:40:33 pmIn volume, pre-programmed microcontrollers shouldn't cost much more.If you only buy enough for one production run at a time you don't have to worry as much about having a reel of useless parts. If the firmware changes during the manufacturing process then I guess you are screwed.

author: james_s
author_rank: Super Contributor
timestamp: December 07, 2019, 05:30:41 am
content: Like I said before, unless the code is doing something very clever and unique, if it's worth trying to steal then someone will either reverse engineer it and write new firmware that does the same thing, or they'll find a way to crack the chip and dump the code. If you use a reputable manufacture they're not going to risk stealing your code.

author: AG6QR
author_rank: Frequent Contributor
timestamp: December 07, 2019, 06:44:31 am
content: Perhaps you could hide some form of Easter Egg in your code that does something like blink your name in Morse code when a certain sequence of buttons is pressed. The idea is to make it easy to discover if a device in the field is using your pirated firmware, and make it so that nobody can plausibly claim that the firmware in question was not a copy but instead independently written to perform the same function as yours.That doesn't prevent copying, but at least gives you some chance of detecting and proving it after the fact. For whatever that's worth.

author: ejeffrey
author_rank: Super Contributor
timestamp: December 07, 2019, 07:07:17 am
content: Quote from: james_s on December 07, 2019, 05:30:41 amThat's a good point, although even a moderate cost to reverse engineer and replicate your software creates an upfront fixed cost which they have to expect on recouping via sales. Whereas just producing extra units in exactly the same way and selling them has almost no fixed costs, so any margin they can get is essentially free money.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 07, 2019, 09:11:15 am
content: Get the parts preprogrammed by Microchipdirect & direct shipped to the EMS Usually only a few cents to program, mark and re-reel.Also, put some hidden functionality in your code, to prove that a device is a copy and not a re-creation of the same functionality.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 07, 2019, 09:12:20 am
content: Quote from: ejeffrey on December 07, 2019, 04:40:52 amNot necessarily - your code can include a bootloader to allow subsequent reprogramming.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 07, 2019, 09:20:08 am
content: Quote from: coppice on December 07, 2019, 02:25:13 amIn the case of Microchip direct, I think the only up-front cost now $29 setup- ISTR they used to have a minimum order of either $150 or 150 parts, don't recall which, but can't see this mentioned any more

author: coppice
author_rank: Super Contributor
timestamp: December 07, 2019, 12:35:42 pm
content: Quote from: mikeselectricstuff on December 07, 2019, 09:20:08 amI was only thinking of the setup time, not the cost. What typical lead time do you see for pre-programmed devices from Microchip?

author: OwO
author_rank: Super Contributor
timestamp: December 07, 2019, 12:56:06 pm
content: Quote from: matbob on December 07, 2019, 01:15:29 amIf you are trying to sell in China (or similar places) my advice would be to know the market well and price your product competitively. There is no bigger target for "replacements" or "clone" development than a foreign product with bloated sky-high margins (assuming there is demand for your product that is). See: FTDI. If multiple Chinese firms can develop from scratch stm32 compatibles then I don't see how they can't reimplement some simple PIC firmware. There used to be a TI INA199 Chinese clone, but that's being discontinued. Why? TI is now selling genuine INA199s at a lower price.

author: radiolistener
author_rank: Super Contributor
timestamp: December 07, 2019, 01:53:05 pm
content: You can use hardware lock to processor serial number. So, the manufacturer will send you serial number of processor and get firmware locked for specific instance of processor. But this solutions won't works with usual controllers such as PIC or STM32, just because code can be easily disassembled, analyzed and patched.Such solution can works with FPGA gateware, because it will be hard to disassemble and analyze gateware.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 07, 2019, 04:51:51 pm
content: Quote from: coppice on December 07, 2019, 12:35:42 pmIn my experience of a handful of orders, if you bypass the sample verification stage, it can be under a week from starting the process to delivery of few hundred parts. Up to a couple of weeks for a few thousand. Opting for verification samples adds maybe a week .

author: Marco
author_rank: Super Contributor
timestamp: December 07, 2019, 05:07:26 pm
content: Just curious, what does it cost to get the firmware extracted for your particular device?

author: ataradov
author_rank: Super Contributor
timestamp: December 07, 2019, 05:10:08 pm
content: This is a service that has been around for ages, so they may actually be legithttps://russiansemiresearch.com/They say that it costs $500 to extract almost any PIC. Some go to $1000.

author: luiHS
author_rank: Frequent Contributor
timestamp: December 07, 2019, 07:41:22 pm
content: Encrypted bootloader + Firmware with blacklist (to detect pirate boards by serial number). The blacklist is only possible with microcontrollers that have a unique factory serial number, virtually all ARMs.You can also use the NXP RT series with encrypted images, but that implies that the microcontrollers must have previously been initialized with the unique key, before attempting to record the firmware.In any case, by brute force, dissolving the encapsulation with acid, and deactivating the read protection bit, virtually any microcontroller can be read. Some manufacturers advertise protections against this type of illegal access, but the truth is that today almost all microcontrollers are broken by the Chinese and they give you the object code, for a few hundred dollars in cost.

author: KL27x
author_rank: Super Contributor
timestamp: December 09, 2019, 11:25:41 pm
content: What happens mid production cycle?Don't all you guys have a CNC chip flashing robot? You upload the firmware and stick your chips in one end, then you press a button and all your chips are flashed and come out the other end?That can only cost 10 square feet and $60K, right?What if i told you there was a fairly simple way to re-flash a ton of IC's with fairly minimal cost... I've had it for over a decade, and I've flashed probably over 100K chips with this method. But I still haven't found a way to make money from it, so it's just an inhouse tool for me. I'm sure lots of businesses use their own inhouse solutions for this kind of problem.Yeah, bootloader is fine. But it still costs. I think the minimum that Microchip will do it is around 10 cents per device, even if you ignore the setup fee per run. It costs 3-4 cents just for them to put a dot of paint on the part. That would be extra. Times 100K is like 10 grand, so far, I can say I saved. Plus having the flexibility and control of not giving out firmware.

author: I wanted a rude username
author_rank: Frequent Contributor
timestamp: December 10, 2019, 12:23:10 am
content: Quote from: matbob on December 07, 2019, 01:15:29 amYeah, trademarks can be a bigger threat.In China, it's a first-to-file system... doesn't matter if you have a trademark on the product in Canada, if someone files in China before you they get the trademark, they can start selling their copies, andthey can even sue to stop your production of devices that now infringe on their trademark.Like many have said, the firmware can be redeveloped. You have to know the threat model.

author: james_s
author_rank: Super Contributor
timestamp: December 10, 2019, 01:35:34 am
content: Quote from: KL27x on December 09, 2019, 11:25:41 pmA local manufacture I did some contract work for while I was between jobs would bring his kids in and set them to work doing this. I set up the programming jig and then one kid would load a PCB in the jig and hold it there while the other hit the program button on the laptop. It actually worked better than I'd have expected.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 10, 2019, 09:35:23 am
content: Quote from: KL27x on December 09, 2019, 11:25:41 pmISTR it's lower than that for the smallest parts, but if you're doing 100K units you can afford to spend a few grand on a streamlined production-line programming system, though even then it likely still adds some time, which may or may not be an issue.For a few thousand units, a few hundred to have your parts come in programmed and marked is very good value.

author: KL27x
author_rank: Super Contributor
timestamp: December 12, 2019, 07:53:06 pm
content: ^ That might be a good value. Depends on how much time it takes to flash them. Esp if you are only putting a short bootloader on there, you might be paying $450.00 for something that could take minutes of very low stress/attention labor. If you use the right equipment, flashing a chip could literally take the amount of time to flash plus a quarter of a second. For even higher volumes, automation is not difficult to add. Maybe your time is more valuable. But if I can save >$200 an hour while watching Youtube, AND gain flexibility to mid-production changes, I think it is worth it. This also saves money when sourcing of the IC might be an issue, and you might have to change to different variants of the IC. Microchip will give you a new setup fee and pricing for the smaller amounts you are temporarily using.QuoteAnd no, that's not what I'm talking about. But I guess if you have free labor, why not use it? Sure, sometime you have to deal with individual assembled PCBs, for JTAG testing or for repair or update, etc. But PCB's aren't all a uniform size and shape, so this often going to cost in manual labor.QuoteI agree, it is good to be a little paranoid, here. I have BT, too. Customer telling me the manufacturer needs the firmware, today, for testing the latest prototype. No discussion prior. But today, the protos have arrived from China, and the manufacturer in America needs it ASAP.Me: uh, no. You do not give your firmware to a fly by nite very small design and manufacture company under this kind of duress. Total BS. I wrote a firmware for testing-only, and gave him this. Later, public records show that the owner of this very young company has 3 prior companies all under litigation for exactly this kind of IP theft. We were both on site, at one point and he asked many times for firmware and even to regale to me how easy it is to lift the firmware off a chip, anyways. He enticed me of tales of a company he knows (unnamed) that will flash chips cheaper than Microchip. And he continued to ask for the firmware. He also asked me to modify some disassembled code because one of his other clients was having problems with unlicensed cloners, so his client wanted to make their code different. By paying him to pay me to alter a disassembly. LOL.I think that in many cases where firmware is lifted from a chip, the entire image is not lifted. There will be probably some configuration bits that are not readable. And possibly it takes overlap of many images to get a near complete picture. IOW, I think even if you pay for some service to get a firmware image, you might in many cases still have some work to do to fill in some blanks. And hopefully by then, the firmware is outdated and worthless, or less at least less valuable.Also for legal reasons, I think it is important to not give firmware to another company without some legal documentation of the purpose and limitations. There is a saying here. Possession is 90% of ownership. Despite what was said, the court will be happy to suck away your money to clarify what was the original agreement when you intentionally gave the other entity your firmware. They know you can sue if you catch them. But by the time that goes anywhere, this company can be long gone and they can make a new one. It's like if you let someone stay at your house for "a few days," that is legally where they live, and you have to go through an eviction if they decide to stay longer. The cops literally ask questions like "did you give him a key? Does he have any belongings here, even a toothbrush? Ok, then, he's your problem until you go through the legal process of evicting him. You can't deny him entry."

author: NorthGuy
author_rank: Super Contributor
timestamp: December 12, 2019, 08:54:25 pm
content: Quote from: mikeselectricstuff on December 10, 2019, 09:35:23 amBut you still give your firmware to Microchip, where dishonest employees or hackers can steal it. This is certainly not very likely, but still, this is not 100% protected neither.

author: KL27x
author_rank: Super Contributor
timestamp: December 12, 2019, 09:07:07 pm
content: Microchip is a very large company that depends on its reputation and history. It also does not do hardware design/manufacture/testing of the products these IC's go into. Unlike the manufacturing/testing/repair subcontractor who has all the other keys to cloning your product. Right now. And whenever your company spends money on advertising, they can potentially cash in on the wave and the worry about the wrist slap and court appearances, later, while you spend money to prove that the way he is using your firmware and hardware was not part of agreed compensation.Do you think the court and lawyers care about justice? They see cash. They don't care which side is right, just how much money they will get out of the mess.

author: Howardlong
author_rank: Super Contributor
timestamp: December 12, 2019, 09:31:15 pm
content: Quote from: NorthGuy on December 12, 2019, 08:54:25 pmI’ve used Microchip Direct for about a decade for mass programming my products, many tens of thousands of devices. They are dependable and get the job done.I will also reiterate and confirm all of Mikeselectricstuff’s comments, including bypassing the verification stage, and having them direct ship to your assembler.Regarding the verification bypass, I have had situations where Is a part shortage, but the next memory version up from the same family was available, so I issued the same firmware rebuilt for the larger chip, tested locally, and committed directly to Microchip Direct without verification, works a treat. Same applies if only extended temperature versions are available. Sure it might cost a few pennies, but it’s either that or it’s no product.Similarly, I have built my own jigs to manually bulk program chips, in extreme shortage situations. It’s not a career I can recommend.

author: KL27x
author_rank: Super Contributor
timestamp: December 12, 2019, 09:44:20 pm
content: Quote from: Howardlong on December 12, 2019, 09:31:15 pmBut you have to pay the setup fee again, and pay for the per unit price at what may be a much smaller quantity. Also, Microchip may be out of an IC for the next 12 weeks while there is a supply at Digikey.QuoteDepends how good you are at building jigs. I think I could sell my designs. I'm not that keen on the business aspect, though. Patents just don't seem to be useful to non-mega corporations.I'm pretty sure whatever "jigs" Microchip uses, they are not doing this at a net loss. They are managing to make it profitable. I don't think they are putting their kids to work manipulating individual chips for pennies. I imagine they use a bit of a better jig than you have thus far made.Not a career? Well, poo poo all you want. Even if I make $500.00 an hour to do some other aspect of my work, I will still take $200/hr to watch Youtube. Or give that job to someone I know, pay him less than $200/hr, and keep the difference. I could be pocketing this kind of money right now, while dicking around on the forum.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 12, 2019, 10:22:44 pm
content: Quote from: KL27x on December 12, 2019, 09:44:20 pmI don't think the programming comes at extra cost to them. They still need to power chip at some point, test it, program system flash etc. Adding the user program to the mix costs nothing to them.If they were doing it with stand-alone programming machines, it would cost more.

author: KL27x
author_rank: Super Contributor
timestamp: December 12, 2019, 10:28:43 pm
content: And you think they use children to do that part, too, picking up chips and putting them in a jig? Or do you think they have automated and simplified it with purposeful engineering?QuoteI would bet a house that they program the chips AFTER they have tested and stamped them with the QA seal of approval. I do not for a second believe they inject small batches of code from thousands of customers into their production line. The production line pumps out blank chips. They flash them from stock. Bet you a house.When the production line is up, it is to make one thing. They don't enter some code for 10,000 of them and package those up separately. When the production line is up, it is to spray out blank chips like out of a firehose. Custom programming is done separately, after the fact. They don't slow down the entire production line at a bottleneck because it takes 25 seconds per chip to flash some customer's firmware, the entire lot of which is a small fraction of a day's production. It is cheaper for them to take the blank ammo and then flash it, after the fact, in a separate and flexible and paralellable step utilizing multiple machines. I bet.Doing it during production just makes too many problems, just even with lead time. Well, yeah, you submitted your hex and paid the fee, but we.... aren't even making another run of these chip for another 3 months, so just wait.An IC manufacturer sets up the factory for one chip. Runs that for X time. The changes over to another product line, pumps those out. It's not sitting there waiting for orders to come in. Anything custom will happen after the fact, maybe months or years after the chip was originally produced and verified. There is not 9 billion semiconductor plants, one for each semiconductor in Digikey's catalogue.It is much more likely, IMO, they have several reprogrammable/configurable machines, at least a few for each package type, that they can use for these custom firmware orders if and when the come in.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 12, 2019, 11:16:52 pm
content: Quote from: KL27x on December 12, 2019, 10:28:43 pmWhy do you think it's done all at once. For example, there are device families where all the PICs from the same family are likely to have the same die, but then they're configured as different parts. They can produce bunch of pro-PICs and then do the configuration and engraving at a later date, depending on the demand.

author: KL27x
author_rank: Super Contributor
timestamp: December 12, 2019, 11:34:57 pm
content: ^Do you think Microchip has a single dedicated production line for every one of their products? That when you put in a custom order for specific PIC in specific package, it happens to be in this "verification, powerup, test it" stage, in parallel with every other single programmable part in Microchip' entire inventory?Do you think that equipment just sits around covered in dust until an order comes in, then someone walks over to the one out of thousands of PIC micro production lines and fires it up to complete your order?Or do you think they maintain a variety of unique products on a smaller number of machines? And they rotate through them, as needed? I bet you can custom order firmware for a PIC that hasn't been produced in decades. Do you think Microchip keeps a stockpile of raw untested stock, just in case someone custom orders firmware? Or do you think they might keep a single inventory of blank chips, ready to sell in either form? Once the candle is lit, you get as much done as possible. And custom orders aren't conducive to that.IMO, it seems more likely they have some number of flashing machines for each package type (to cover scores or hundreds of their products in this particular package size) which can be custom loaded and programmed per order (hopefully integrated into the online info you have to fill out and the hex you submit), to the tune of the $150.00 setup cost for the guy that has to load the machine with that particular chip and to push the right buttons in the right order. Of course that includes the machinery to package into tape and reel, if need be, which my machines do not do tape and reel.But this is my opinion. I don't know how Microchip operates.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 12, 2019, 11:48:13 pm
content: Quote from: KL27x on December 12, 2019, 11:34:57 pmNo. I don't think any of these things. I don't know how their process is organized. And neither do you.However, since they manufacture PICs, they are in position to find a better way to pre-program chips than a third-party vendor, such as DigiKey. I also think they have found it. Hence the excellent low cost programming service.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 12:08:18 am
content: Well, if you think Microchip only manages to charge "so little" (say around 10 cents per, depending on device and quantity) because they do it while making/testing the chip in the first place?I don't know how Microchip operates, but this part is wrong. It doesn't cost this much to flash microcontrollers. And I bet you can find companies to do it cheaper, even if you don't buy the chips from them. We have the technology that we don't need to use our kids to do this. This is definitely an add-on that is profitable to Microchip, even if they do it after the fact with finished-product, consumer-ready chips.But Microchip can charge what they do because of trust and convenience.

author: Bud
author_rank: Super Contributor
timestamp: December 13, 2019, 12:39:53 am
content: Quote from: NorthGuy on December 12, 2019, 10:22:44 pmI've seen how chip cards are made and it is similar process, the machine assembles a product from components, i.e. the chip itself, the card carrier, magnetic stripe where needed, hologram stickers, etc. When a batch is running you do not want to slow it down or God forbid to pause it for whatever reason. There are schedules for production with timing for each batch job. After being made the finished products are put in the vault. For custom programming the specified number of cards is taken from the vault and gets programmed on a separate much smaller scale and lower cost equipment.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 12:50:47 am
content: Yes. But NorthGuy's point is that these cards can be tested and programmed at the same time. Apparently before even capping them, since we're talking about "cards?"I agree this is technically possible, but it is highly impractical just due to the sheer number of unique products that a company like Microchip sells and supports. I think it will be cheapest for them to batch out ALL stages of the process to the finished product. And then programming is separate. But then I am supposing that this programming is a small part of their volume.Perhaps a company like Renasas does the programming in conjunction with some other stage, but Renasas might at any given time have 3 customers taking up 99% of their production across only a few scores of different products and hexes. It's not like making cars that are each made to order; making teensy eensy chips that are easy to transport and handle (by man and machine), it is probably cheaper to finish the jobs that have to eventually be finished then put them in a box until they're called upon.Just conjecture and opinion, but I agree this is likely:QuoteThe testing equipment for the various micros is likely very much more involved and taking a lot more time to switch/setup between different products; there has to be calibration and verification of settings, QA samples for destruction testing, blah blah. Any one mistake that slips by and goes for an hour might cost millions of dollars. So they will do just the one product for a period of time before switching to another. Can't just do any one on demand. OTOH, flashing is very easy. Package size is standardized. Just load the right chip, configure the software correctly, then push the buttons. Can be switched between different chips and hexes very quickly, and output speed not that critical*, cuz these devices will be relatively inexpensive and require a very low amount of human oversight to operate. One person can keep many of them fed and churning on his watch, keeping the hoppers fed and clearing the occasional jam.*As I suggested before, it could be essentially limited to the time it takes to flash a chip or set of chips plus w/e for the maintenance, operation, and setup.

author: Howardlong
author_rank: Super Contributor
timestamp: December 13, 2019, 04:31:37 pm
content: Quote from: KL27x on December 12, 2019, 09:44:20 pmI think you’re misunderstanding. The reason I make a jig is precisely because of part shortages at Microchip. They’re hardly rocket science, just a zif socket, programming header, a programmable USB foot switch I made that sends the right keystroke(s), and me with a pair of tweezers and a metallic colour Sharpie. At a pinch I’ve done a thousand, but I get a bit of sense of humour failure after three hundred which might take me an hour. I’m a one man band, I don’t have random people milling around I can give the job to.My time is better spent doing other things, so all I’m doing is outsourcing that work.Judging from the programmed devices I get from Microchip, they have a loadable machine. The consistent nature of the optional marking says it’s not a human doing it.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 05:58:44 pm
content: QuoteExactly correct.QuoteYes. This is a smart way to save 150.00 setup fee for flashing at some hundreds of chips, esp if you have some children. And no, this is hardly rocket science. What Microchip uses is surely more advanced than this.If a socket and a pair of tweezers and a foot pedal is what you have to work with, surely it is better to pay Microchip for any quantity more than a couple hundred. You jerry-rigged a low cost jig for doing one off of a small quantity and yeah, I would also hope to never have to do that again.If you wanted to do it more like Microchip does it, perhaps you would figure out something better without spending tens or hundreds of $K. Perhaps you wouldn't. Perhaps you assume your ZIF socket is the pinnacle of technology without spending significant money. And that is completely understandable, because this is not an EE problem, at heart. This is more of an ME problem. Something that maybe Victorian age garage tinkerer will have an easier time to tackle than a modern EE. Someone has developed the technology to do this way faster and easier. But the modern commercial off-a-shelf version of this is probably too expensive unless you are doing millions a year.Why do you not see something cheaper for sale, then? At Mouser, or Alibaba? Perhaps it takes at least some knack for setting it up where the customer service cost, and the tiny market demand make this expensive in the end to support. And there are how many hundreds or thousands of different programmable parts? It would take some knowledge and equipment and customization (rewiring at least) for each specific one in order for a business to set this up and verify it to make it plug and play for the end customer. Thus, it is maybe something that ends up being made for in-house use more reasonably than to try an sell this kind of device for a profit. Because of all the customer service, you might as well keep it in the $50-100K range if you were to sell it.I'll suggest there is an ocean of possibility between a ZIF socket + tweezers and $100K CNC chip-flashing robot. And most EE probably don't have much experience in this kind of thing and are overcomplicating it. ... Or maybe I'm just particularly interested in this problem and have come up with a unique solution, which has received incremental improvements over many years, and which surely needs a patent.

author: Tomorokoshi
author_rank: Super Contributor
timestamp: December 13, 2019, 06:08:36 pm
content: Answer these questions for yourself; don't publicly post the results:1. What is the quote for your product at the off-shore facility?2. How much is security / traceability worth?3. Quote your design out to a place like Creation Technologies. They have both Toronto and Vancouver facilities:https://www.creationtech.com/locations/4. Is the extra cost of  worth +?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 13, 2019, 06:36:47 pm
content: Quote from: KL27x on December 12, 2019, 09:44:20 pmThey use automated programming systems from BP Microsystemshttps://bpmmicro.com/

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 07:02:15 pm
content: ^I think this qualifies as "a bit better of a jig" vs a ZIF socket and a pair of tweezers.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 13, 2019, 07:14:16 pm
content: Quote from: mikeselectricstuff on December 13, 2019, 06:36:47 pmSince you know everything about them, do they use the same sort of machines for testing and programming the system flash, or do they use totally separate devices?

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 07:29:03 pm
content: Mike never said he knew everything about it.I'm sure things change and perhaps only an insider would know exactly how things are done. But this website suggests that wafers receive electrical and optical testing and binning even before the wires are bonded.http://www.madehow.com/Volume-2/Integrated-Circuit.htmlQuoteI wonder if wafers have probe points for testing, the way we put test points on a PCB. Points that get used for tests during manufacturing before being encapsulated. I imagine after every layer grown and etched there could be additional testing. And wafers get X-out after each stage. At the price point we get these things, this all has to be extremely fast and automated.I doubt that even this $90K CNC chip flashing machine has enough speed and resolution of movement to do any type of economical probe testing on a wafer. Not to say that a micro doesn't get additional testing after the wires are bonded and packaged; after this point, when the IC is packaged, it can now be handled by crude caveman instrument like CNC flash robot. I suspect this IS the cheap machine for (just) flashing.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 13, 2019, 07:50:58 pm
content: Quote from: NorthGuy on December 13, 2019, 07:14:16 pmThat's all I know- I was enquiring about support for a new device, and they told me they were waiting for BP to add support for the part.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 07:59:56 pm
content: QuoteExactly one of the problems I have to try to commercialize my machine which can probably be otherwise manufactured for ONE specific micro family and package type for barely triple digits dollars. Maybe double digits, if made in China.A lot of the labor is in the setup. And unfortunately, the state of modern peoples' knowledge and experience, this would qualify skilled labor. Once setup, even I leave it alone. It's cheaper/easier to make a new one if I use a new package/micro rather than reconfigure the one back and forth. Since I have some basic fab skills and tools, it essentially only costs me an afternoon of time.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 13, 2019, 08:01:34 pm
content: Quote from: KL27x on December 13, 2019, 07:29:03 pmAnything can fail, and I'm sure wire bonding is not an exception. So, you cannot concentrate all your testing to the phase before wire bonding. Moreover, as you suggested, you need much less precision in your equipment to probe and test when wires are already bonded, so it'll be cheaper.Even if they don't manage to combine system flash programming with user programming, they can do user programming before the chips are packed into the tubes which is already a huge advantage. Others receive tubes from Microchip and must get the chips out of the tubes. Moreover, if they re-sell, they have to push chips back into the tubes. Which means more cost.If Mike is familiar with their processes or visited their factories, it would be interesting to know how it's all done.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 13, 2019, 08:08:59 pm
content: Quote from: mikeselectricstuff on December 13, 2019, 07:50:58 pmI see. Surprisingly, the machine can only program 1400 chips per hour. If the profit is 10 cents per chip, the machine must run 24/7 for the whole year just to pay for the purchase price. Microchip probably get huge discounts because they're volume customers.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 08:19:33 pm
content: ^I wonder if that is the max. That is pretty terrible if the hex is minimal, like a 1-2 seconds to flash a bootloader. I could do that pace. While watching ToT videos. But of course, Microchip surely has a dozen of these, at least, which can all be overseen by only one person.Yeah, Microchip probably does not pay retail. The retail price is high as it is, because for every new customer, the company has to support w/e they want to use. So you don't get just another sale; you get another workload. And another site you probably have to send actual people now and then. The support for any micro, using any programmer and system, is part of what makes it so expensive, I think.I think even a single large business or three such as Microchip is really bulk of business of this CNC flash robot company. Kinda like a specific company to make "super lube 9000" for aircraft industry. But then they may also offer this can of special snake oil to the public at a ridiculous price. This business doesn't want to sell one machine to one tiny random customer unless they are paying the high overhead to support their specific needs. The $90K is the price of opening a new can of headaches. Microchip has already paid that, once, and the additional support they need is minimal, year to year. They don't pay $90K for a machine, I bet.QuoteI don't know what you mean by "system flash programming?"

author: NorthGuy
author_rank: Super Contributor
timestamp: December 13, 2019, 08:59:58 pm
content: Quote from: KL27x on December 13, 2019, 08:19:33 pmPICs have flash areas which are not reachable from the user program. Some areas are programmable (for example areas designed for debug executive), others are not erasable and presumably used for calibration or to store system information. It comes from the factory pre-programmed in a certain way. Thus there must be a step in the production where it's done.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 09:13:02 pm
content: ^Oh, ok. If a calibration register is not accessible through pins, at all (perhaps through some sort of programming algorithm), then it would obviously have to be done before encapsulation.I suspect there is probably some sort of shelf life of the wafer before it has to be encapsulated, unless they want to spend ridiculous money to store bulk inventory in an argon, dust-free vault. I mean, do you want to store your inventory in a clean room, or stack it in a more or less ordinary warehouse with sealed bags and dessicant packs and basic dehumidifier and climate control?

author: NorthGuy
author_rank: Super Contributor
timestamp: December 13, 2019, 09:24:33 pm
content: Quote from: KL27x on December 13, 2019, 09:13:02 pmI'm sure it's all accessible through normal programming. It would be silly to have two flash controllers on the PIC when one is sufficient. Writing some parts of the flash may require some tricks to get to them, but they're certainly accessible somehow.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 09:30:24 pm
content: ^I'm sure that also takes less than 200 mS per to calibrate the chip, they way they do it. This is just one more station on the high speed production line (one of the scores that are kicking out bad wafers/chips into the garbage bin). Flashing entire program memory with user program might take 30+ seconds per.You seem convinced that custom programming happens during some sort of production/verification stage in order to save money. You ignore the logistics?I'm curious about this calibration and bandgap reference stuff that's on a modern say PIC, though. If it is accessible, then why is there no software tool to adjust these values using Microchip dev programmer? Or is there? (I know on the old chips there was the stupid osccal that always erased itself and made the chip useless for production use with internal oscillator. Well, unless you can recalibrate them cheaper than buying new ones.)

author: jhpadjustable
author_rank: Frequent Contributor
timestamp: December 13, 2019, 09:35:36 pm
content: Quote from: NorthGuy on December 13, 2019, 08:59:58 pmAccording to Microchip, MPLABadds that to your image when compiled.QuoteCome on. They're not that feeble. That stuff is part of every single component of the type, varies only according to a single set of standards according to the type, and can be most economically done during wafer probe-and-test.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 13, 2019, 09:54:44 pm
content: Quote from: jhpadjustable on December 13, 2019, 09:35:36 pmThe debugger in older PICs used to put debug executive into the user memory, but since about 10 years ago all PICs have dedicated flash for that.

author: josip
author_rank: Regular Contributor
timestamp: December 13, 2019, 10:10:22 pm
content: Quote from: KL27x on December 13, 2019, 08:19:33 pm1400 dev / hour ~ about 2.6 seconds per chip is way too slow for tank look like device. For example if my flasher take 2.8 seconds for 8 devices (bare chip) in parallel, than positioning system (that I don't know anything about) will have 18 seconds for connecting new 8 devices to another free 8 slots.Quote from: KL27x on December 13, 2019, 09:30:24 pmBTW, MSP430G2xx are with calibrated data from factory, unique for each device, stored in protected info flash memory segment. DCO and ADC related stuff. There is open source program for calibrating DCO, if it is erased.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 10:19:53 pm
content: QuoteThe chip flashing speed is not the entire equation.I think you can assume that 2.6 seconds per chip is what it can do if the flash time is approaching zero? The 2.6 seconds is the chip handling time. To take the chip from package/tray, and put it back in package/tray. That would get longer with longer flash time, but of course that relationship depends on how many it will do in parallel. So if it takes 2.6 seconds per chip to load 20 chips into parallel programming ports (say 52 seconds to load and unload and repackage the 20), then it is actually super fucking fast for a chip with a long flash time, and it would trounce my device, here. But for a short bootloader, I could beat this output rate, sustained, including chip handling, reloading, jams, and have more than 1400 flashed chips in the tube at the end of that hour. If you are using tweezers, you can't get close to this, even if your flash time is zero and 100% success rate with no "jams." And you certainly won't enjoy your ToT video while doing it. But I would have to mind the process with at least a couple brain cells and physical presence. I could automate it fairly easily, but as I said, it requires a separate device for each package and micro family, so this would only make sense if I had higher volumes of one type of chip where my throughput is not high enough and I needed to operate multiple machines in parallel.QuoteI would assume modern PICs have the same tools to do this; As Northguy says, it is most likely accessible with dev tools. It's just something I have not had to concern myself with since the old days of OSCCAL nonsense.

author: NorthGuy
author_rank: Super Contributor
timestamp: December 13, 2019, 10:49:35 pm
content: Quote from: josip on December 13, 2019, 10:10:22 pmBased on the video on their site, there are multiple slots. The machine load slots continuously in a round robin fashion. I would guess it starts programming right away and it's done by the time the machine needs to load the next chip into this slot. They have a table which shows that if the programming lasts 40 sec, they use 6 different sites, and the speed falls only a little - from 1400 to 1200 per hour.

author: KL27x
author_rank: Super Contributor
timestamp: December 13, 2019, 10:59:43 pm
content: ^And that is where the machine is actually blazing fast. Gatling gun style for long flash times. Mine is serial, only. But for the cost, I could have many operating in parallel with just some small additional automation.If anyone seriously wanted ability to flash your own chips, particularly a short bootloader or codes less than 10 seconds flash time, for like $hundreds rather than 10's of $K's, PM me with your needs. If there's a market for this, I want to make it happen. Maybe you have your own PnP and do your own production and use mainly one or two or three different micros in quantities of tens or hundreds K per year, this might be something you would find useful to keep things in house.

author: jnz
author_rank: Frequent Contributor
timestamp: December 14, 2019, 05:22:54 pm
content: LOLWhile it is a worthwhile discussion on supply chain security... you guys got lost in the weeds WAY fast.Most of the entire Microchip line has faulty security protections. You can just voltage glitch the chip and bypass the read protections. Who cares if the supply chain is secure when the product itself is so easy to dump?As to a closed supply chain... get a supplier you trust, program them in house, or connect them to the internet with a legitimate encryption scheme. All of that and I’m still looking at the firmware on chip as insecure and designing the product so that I could hand firmware over to hackers and still have a secure product.

author: KL27x
author_rank: Super Contributor
timestamp: December 15, 2019, 03:01:51 am
content: LOL. There are some really old chips that can be bypassed so simply by over voltage. That is mostly history. Any modern PIC is more secure.Sure you can get them decapped to obtain a hex.Locks can be bypassed. I can pick 90 percent of home locks in America. But I still lock my door.Some product is not big enough in price and volume and longevity to spend too much on security measures.When you are in court do you want the defendant to have to lie? Or to be able to honestly say you gave him the firmware.

author: Mr_Mxyzptlk
author_rank: Newbie
timestamp: December 17, 2019, 07:49:49 pm
content: If your product can communicate on the internet, you could have Microchip install a program of your devising that is capable of doing nothing but a selftest (to support 3rd-party assembly and test) and an over-the-internet software update. The user's first interaction with the system would be a software update that installs the product firmware.Have Microchip provide a file containing the serial number of every device they program for you, and set up a firmware update server that checks the serial number (a whitelist) and only delivers updates to those in your system. Your firmware update process will need to read the MCU serial number and securely sending it to the update server, as a serial number you include in memory would be copied in a clone.This method combined with cryptographically protecting your firmware updates would avoid the deliberate release of your product firmware to any third party, other than the forensic techniques noted here by others.

author: TomS_
author_rank: Frequent Contributor
timestamp: December 19, 2019, 10:33:00 pm
content: Quote from: matbob on December 06, 2019, 10:16:00 pmMy take: if you have a product that is popular enough, or perhaps its expensive but desireable, and there is a definite market for it, someone will probably try to copy it or produce some kind of low cost alternative, and you cant really stop that except through layers and layers of active protection (encryption, activation, periodic checkins etc).So, find a different provider if you are really that worried about them stealing your code and cloning your product.Or rely on your legal agreements if they start to do so. If you havent chosen a bargain basement provider, they may actually value their reputation and business and will respect them.Solutions? Perhaps you can embed something into your code, something along the lines of a date code and/or unique string that identifies the rough period of time, manufacturer, batch etc of product that the code was supplied for. Maybe with a hidden command that you can use to read such data.That or some kind of signature, perhaps a very obscure sequence of some commands that do absolutely nothing, or is a roundabout way of achieving some kind of legitimate result, but wouldnt gather attention if someone came across them in a disassembly. But without being able to read the code of the clones this would be hard to find yourself during legal proceedings.What to do if you start to see similar products popping up? Buy some, use your hidden command to read the data, or try to read the code off and work out if it is an unauthorised copy. The question then is whether the people cloning the product will bother to disassemble the code to try and find and remove such features, or if they will just blindly take it and stick it on their copies so they can get them out the door quicker.I believe Apple did something to this effect by embedding an image into one of their ROMs and were able to sue a company that produced unauthorised direct copies of it. I mean, thats just a rookie mistake.

author: Howardlong
author_rank: Super Contributor
timestamp: December 25, 2019, 10:47:28 am
content: Quote from: TomS_ on December 19, 2019, 10:33:00 pmIMHO, unless you have the resources and intention to execute legal proceedings, then this is a dead duck. The legal route doesn’t stop it from happening.Find an established CEM who has been personally recommended by someone you trust. Press the flesh, see the whites of their eyes. Second best is to employ the services of an recommended agent who you trust to establish and maintain the relationship for you.