Infineon C166 Family  - Page 1
Forum section: electronics / general

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: December 19, 2019, 11:43:44 pm
content: So I am dealing with a semi unknown MCU but its in the c166 family. I believe its a C161CS, C161JC, C161JI it's the only one with Automotive certs from the early 2000's that seems to fit the pinout of the chip. Its marked Infineon 9399059 on the board. If you saw my last post about the ST MCU I had success there. the MCU's are on instrument clusters I work on. My goal is to dump the BIN off them and then flash them onto Replacements.So I have no idea where to start on Dumping this chip. It doesn't support JTAG it looks like. looking at the listed programmers are all well out of my budget. looking at the documentation from the Flashrunner by SMH technologies it looks like the MCU is flashed through Uart? I know the MCU has SPI lines but I not sure how to Slave Select the MCU to get it to dump if thats even possible with this MCU... Hopefully I am making sense here. Please let me know if I am not because I am still climbing mt stupid with working on the MCU's so please go easy on me.Am I asking the wrong questions? lolAttached is a link to the product info.https://www.infineon.com/cms/en/product/microcontroller/legacy-products-c500-c166-xc166-audo1-family/c166-family/c161cs-c161jc-c161ji/

author: rvalente
author_rank: Frequent Contributor
timestamp: December 23, 2019, 06:05:53 pm
content: I believe you're in the auto repair industry, right?Often these repair technicians have highly customized tools and equipment to dump read/flash, like x-prog tools.check the mhhauto forum, some nice guys there

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: December 23, 2019, 09:08:11 pm
content: Ill check out that forum thank you. I am familiar with these tools I've used some of them for the most part these tools wont work with blank MCUs they are mostly for reading the Eeprom to change odometer or reset crash data on airbag modules. Some will at least interact with the MCU but on a higher level. What I am trying to do is fix clusters that people have bricked by messing with some of those high level tools like a Tech2 and installing the wrong firmware(you lose class 2 data in that case and now you cant reprogram it anymore.) Sometimes people kill the mcu with static or the voltage regulator fails and send 12v to it and kills it. those tools just don't work for that kind of repair. I wish they did. even though these MCU are long obsoleted there are tons of them in china for pretty cheap. the boards are worth fixing.Plus I find fun because some of the established techs say it cant be done but I've already figured it out with the 07-14 soto them.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: December 30, 2019, 07:18:06 am
content: I’ve seen an UART boot mode on customized C166 long time ago (Siemens mobile phones CPUs). The idea was to wait for some sync byte (0x55?) from the phone at power on and send a very small primary boot code within some time window (the phone starts normally otherwise). Googling for “c166 uart boot” shows some discussions of something very similar on other C16xs, i.e. this:https://community.arm.com/developer/tools-software/tools/f/keil-forum/23915/download-a-routine-to-sram-and-run-itThey mention some files from Keil C166 dev tools, worth looking at.One small detail from Siemens phones: older phones had this mode available “as is”, but some newer models had it disabled for security and you needed to short some point on the pcb to gnd, so it looks like some CPU pin controls this mode. All this was so long time ago (mobiles with black and white displays), can’t find the files from that era anymore.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: December 31, 2019, 06:24:57 pm
content: So far what I have figured out is that it does seem to be Uart using infineon's Minimon software should talk to it. The pinout of this chip matches that of the C161CS. Ive checked and all the SPI pins match, oscillator pins match. VSS/VDDs match. SO the UARTs should match. When I run Minimon it says reset device now before it sends the signal to the the MCU. I am not sure how to reset this MCU. Ive attached links to the datasheets.http://www.keil.com/dd/docs/datashts/infineon/c161csjcji_ds.pdfhttps://www.infineon.com/dgdl/c161csr_um_v3.0_2001_02.pdf?fileId=db3a304412b407950112b41e42803238I am using a FTDI FT232RL to try to talk to the chip.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: December 31, 2019, 09:45:09 pm
content: Last night the pins I tried to use were 63 and 64. I see 53 54 are also uart. I checked and 63/64 run to the VFD driver for the odometer, pins 53/54 go to the vfd driver for PRNDL

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 08, 2020, 06:12:59 pm
content: From your C161 datasheet: “In particular, the bootstrap loader may be activated when P0L.4 is low”.Looks like you need to pull that pin low, start the minimon tool, pulse RESET to gnd when it asks (or just cycle the power). That was the sequence with Siemens also - turn off the phone, connect uart cable, start the software, press pwr on button when it asks.Edit: the second pdf contains a complete description of this mode, see section 16.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: January 20, 2020, 01:09:38 am
content: Thank you. I've been busy for a few weeks and haven't had a chance to try yet but looks like you are right looking at the datasheet. Thank you for looking at it for me. I am in over my head on this one... Hint I didn't find this myself when its right in the datasheet. I was not looking for bootloader info but obviously it was what I needed. I was search flash, uart and other keywords... I really like doing projects like this but they are hard because I am stupid lol.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 25, 2020, 05:29:44 pm
content: So I got busy I haven't worked on the project in while but I am back to revisiting it. Part of the problem I was having was that I though it was either or with POL.4 and RD. Pulling both down to ground got it into BSL. with an FTDI adapter on P3.10/TxD0 and P3.11/RxD0 I am not getting much action with it.I tried minimon and got this output:"Loader file Prepare*Minimon file Prepare*send Byte 0+ Loader + MinimonCore*RECEIVE - MC-Identifier: ED*ERROR: No Loader_ACK Byte received (MinimonCore not loaded)*ERROR: No Minimon Byte received (Minimon not successful)"It then sends the exit command and boots normallyI tried Flashit and got this output:"COM6 is activeReset targetNo effect by using autoreset. Please reset target CPU manualE104: Communication with target failed"Does not send exit command stays in BSLI really don't know what I am doing with either sets of software. I think its user error with the software.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 26, 2020, 12:37:51 am
content: Sorry to keep replying to myself but I want the info to be out there. I slowed down the baud rate in Flashit to 9600 and it worked flawlessly for reading it.Now I am not sure of the Internal flash size of this MCU. since its "Custom order chip for GM" Infineon won't tell me. I dumped it at 256KB its got a lot of what seems like repeating junk at the end I can tell it got a good read though because it has a bunch of strings I was expecting to see. I attached it if anyone care to look and help me guess the right size.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 26, 2020, 07:34:24 pm
content: Update- I contacted HSE. They made Flashit. Sounds like it will take a custom script to write to it. (sorry if this is getting kinda Spammy but it really helps me keep track of where I am at with the project)They were extremely helpful. So huge Thank you to them! they went above and beyond to help. Here is some of the traffic.Them:"You write “C161cs with onboard flash” - not the same as OnChip.On Board – is in FLASHit called “external Flash memory”.If you can see on the board you will find a chip with the name …29F… this is the flash memory.To work with flashit select “external flash memory” an press on “get info”.Now flashit should tell the name of the flash.But why is the CPU clock (2.2MHz) so low? Default is 20.0MHz.Did you make the clock by hand?Steering wheel controls.binWorking with binary files is not easy, because of they do not have Address info.You cannot use 0x0000 at start, because of there is system memory (Ports, SFR, RAM,…) in the area.For more info, please tell me you company name."Me:"I'm a student at X School so no company name.I could be using the wrong terminology but the Flash memory is on the Infineon itself. I have attached a photo of the circuit board. The other IC's are 2x Stepper drivers, 2 VFD drivers (one is hiding under the smaller vfd), on ST95020 eeprom (only stores stuff like the vin) and a J850 VPW transceiver. The Oscillator on the board is actually 4.19 MHz. The circuit board doesn't have any components on the back so no need to take a photo.The MCU isn't labeled c161cs Its labeled 9399059 and when I Email Infineon they tell me it was custom order for GM and to ask GM for details. When I email GM they never get back to me. All the pins match a C161cs. I checked the VSS, VDD, uart, j1850, oscillator, SPI pins. Everything matched the C161cs. The only thing custom order I can tell is the on chip memory. It's also not Masked ROM because it can be programmed with a dealership tool that you can't get public access to. They actually program it over the J1850 line not the BSL. If the dealership puts the wrong firmware on the MCU it bricks the whole cluster. That happens because it can no longer boot and use the J1850 line. These clusters can still respond to BSL so I believe they can be fixed.I wasn't sure where to start so I just did a much larger pull than I thought would be needed I started at 0000 and pulled 256k just so I could see what I get. I think it's actually 128k or less of memory I'm just not sure where to start my read at. 02FFFF seems to be the end but there is a middle chunk that is definitely not useful memory"Them"student is good. I was once too.labeled 9399059 = unknowed, but if flashit says C161 is ok.Did you make a detection of external flash memory?You can send me the debug log file.Menu -> Special function -> save debug log file as…Photo is good, but can you see at the bottom Layer?Info:If you read memory, the Chip cannot select intern/extern you just read anything .If there is no hardware you will read FF or so.OnChip MemoryInfineon build very very few c16x with internal Memory.The chips were never free to buy.FLASHit did never supported internal memory at C16x. (only XC16x and ST10F)"Me"I sent the requested attachments"Them"Oh – nothing on bottom side…Than the C161 must have OnChip memory.Something for the museum.I am sorry FLASHit will not help you at programming.Good luck"So again. Thank you to HSE for taking so much time to help.This means I will have to write a custom script I think to write to it but I am not sure where to start on that. Any suggestions? reading material lol

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 26, 2020, 10:14:48 pm
content: That’s a great progress! Having the dump opens a possibility to get the flash programming algorithm from it (it must be there since the firmware can reprogram itself). Going to try disassembling it.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 27, 2020, 12:11:27 am
content: Thank you. I am making progress with Minimon working connecting so I will work on getting it to do more than just connect tonight.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 27, 2020, 01:17:22 am
content: Ok I can read with Minimon. So I am pretty sure the flash size is 128kb and the addresses are 0000-7FF0 and 018000 - 02FFFF that comes out to 131,072. 128 * 1,024 and the result is 131,072 bytes.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 27, 2020, 11:13:27 am
content: So here it is:Code:-------- EraseSector -------------//start erasew = AAw = 55w = 80w = AAw = 55w = 30w = 30//wait for completiondo {w = FAstatus = w} while (status & 1)-------- ProgramPage -------------// start preloadw = 50w = wData// preloadfor(i=1; i<1F; i++) {w = wData}//confirmw = AAw = 55w = A0w = wDataw = wData//wait for completiondo {w = FAstatus = w} while (status & 1)

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 27, 2020, 03:45:43 pm
content: Quote from: abyrvalg on August 27, 2020, 11:13:27 amThank you for taking the time to do that. Can I ask one more favor? could you break that down as if I have no experience. Don't worry nothing will offend me. I have no background in programming.So I take like w = AA is setting address 2AAAA to a value of AA?My goal here is to take good firmware off working boards and put it on blank IC i get from china. I have a number of these with dead ICs and a good source for working ICs in china. I'm just a really determined repair Tech.Is this something I would be able to put into the setting in Minimon or would it take a custom script. I have a second board I was able to pull a bin off of if that would help.Attached are my settings in Minimon. Edit: I didn't mention Minimon is working for reading but It won't write just says Error: download no successful the moment you click.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 27, 2020, 04:24:05 pm
content: w = AA means "write AA to address 2AAAA as 16-bit word".But looks like you are luckier and don't need to program a new flash driver. I've checked flash driver sources packaged with MiniMon and there is exactly one device matching this algo and it's load address: C161JI.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 27, 2020, 06:07:42 pm
content: Still no success with Minimon. I have to have something wrong. I picked the controller type C161JI-32F. Used the same SYSCON, BUSCON as last time. I used the \C161JI\C161JI.HEX driver for the Programflash.It will still read it.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 27, 2020, 06:38:37 pm
content: Try switching the flash mapping to "contiguous from 0x10000" by setting bit ROMS1 (12) of SYSCON (OR the value with 0x1000) and define the flash area at 0x10000-0x2FFFF.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 27, 2020, 08:08:31 pm
content: Noticed that you have memory type set to FLASH instead of IFLASH for some reason. Try the following:- select target C161JI-16F- say Yes to all questions to load all defaults- edit CPU frequency to match yours- untick all "Initialize register"- edit "PROGRAMFLASH" area to change the driver to DRIVER/C161JI/C161JI.HEX- don't touch any other settings- try programming

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 27, 2020, 08:31:30 pm
content: OK set it how you said. It still reads it fine, does not write still. BTW I am going to owe you a few beers.Minimon Says Upload for Reading and download for writing.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 28, 2020, 01:20:16 pm
content: I have a feeling that Minimon just doesn’t like some setting and fails without actually trying to flash anything. Could you log the serial port activity (with some tool like Portmon, Wireshark etc) to see what’s going on exactly?

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 28, 2020, 02:34:13 pm
content: I am on windows 10. It looks like wireshark doesn't support Com ports on windows and the stupid monitor everyone points to in the wireshark thread wont moitor an active port. I have another adapter on the way so I may have to wait for those to get here to read what its sending.It is trying to send something though the TX/RX lights light up on the FTDI adapter when you click send. and the more of the data you try to send the longer it stays on.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 28, 2020, 02:54:54 pm
content: Hmm, maybe you just need to erase the flash manually before trying to program it?

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 28, 2020, 03:52:24 pm
content: Ive got another one of the boards on the way to me that I am OK with bricking so when it gets here I will try manually erasing first. I guess that all puts the project on hold for a few days.Plus I think its time for me to get a cheap logic analyzer. I am getting into enough of these projects where the O-scope just isn't the best tool for the job.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: August 31, 2020, 09:06:14 pm
content: Today I got my logic analyzer in. So here is exactly whats being sent Top line is TX (from MCU, RX to pc) and bottom line is RX (for MCU Tx from PC)Minimon is trying to write to it. Here are 2 samples.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 01, 2020, 01:11:58 pm
content: I see the problem now: you are trying to "load to memory" instead of "program to flash". Use the blue "P" button.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: September 01, 2020, 04:23:29 pm
content: When I try the P I just get "*IProgram:0 bytes successfully programmed" It doesn't even try to send anything over uart. So Nothing to capture there.Edit: If I try the S I get an error "*ERROR: download not successful" and it doesn't try to send anything.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: September 01, 2020, 07:31:25 pm
content: I'm not sure what change got the status send status request. It returns 0000 for all of it. I played with what kernel it was loading and that seemed make make the status request to send. still nothing from program

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: September 20, 2020, 07:48:22 pm
content: I got some test boards in and can confirm erase works, Read works but program does nothing.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 21, 2020, 01:26:24 pm
content: So the flash driver is ok, but the problem is that sw thinks you are trying to program data of size 0 for some reason:Quote from: Fixed_Until_Broken on September 01, 2020, 04:23:29 pmTwo more ideas to try:1. The flash burst size is 0x40, maybe sw doesn't like data size not a multiple of that. Try selecting exactly 0x40 bytes, then hit P.2. The first part of flash is remapable (0x10000->0), maybe something is wrong with these addresses (i.e. you must use 0x10000 instead of 0). Try writing to nonremapable part first (at 0x18000).

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: September 21, 2020, 03:57:42 pm
content: Ok I had a little success last night. It it still wont program it but if remove the Activate for the program flash it will try to program it. It then has an X next program flash in the A column. When you click program it erases the section you are in and then tries to program it but then fails. attached is a capture of it on the signal analyzer its too long for screenshots. puslesview can open it.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 21, 2020, 05:50:42 pm
content: Pulseview UART decoder is buggy (decoding some bits to wrong values). Could you use some software-only "serial port monitor" instead? Extracting the comms bit by bit manually is too much.

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: September 23, 2020, 04:42:05 pm
content: OK you will probably find this annoying because of how its captured but I cant find any good software for capturing the com port on windows. I ended up using a second FTDI adapter and just captured it as it sends. I decided to capture both what gets TX'd for Erase and Program and its the same so Minimon still isn't actually tying to program it.Code:Program TX:8400C000440348803D5AF05AF06B66FDC0FF2892E6F3AAAAE6F45000D7000200B843DC0BA84A08A218B0DC0EB84D2892E6F3F2A0DC0BA84A08A218B0D7000200B843B0293DF7E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE6F4A000D7000200B843DC0BA84ADC0EB84DE6F3AAAAE6F4FA00D7000200B843E001D7000200A8918AF9F300F0A5F0B6E6F94000E00FDC0BA94ADC0EA95D08A118B008D118E041452D03E6FF1100DB00289148903DF0DB0046F820003D2CE6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F35E5EE6F45E00D7000200B843E6F35455E6F4AA00D7000200B843E6F3AAAAE6F45500D7000200B843E6F35A5AE6F45A00D7000200B843E00FDB0046F821003D2A9A8902C0E0170D01E007E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F33C3CE6F43C00D7000200B843E6F6F83F2892DC0BA85A08A218B0DC07B856DC07A8560862B0093DF5E00FDB0048813D37BB45E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE6F48000D7000200B843E6F35455E6F4AA00D7000200B843E6F3AAAAE6F45500D7000200B843E6F43000DC02B841E6F3AAAAE6F4FA00D7000200B843E001D7000200A8918AF9F300E00FDB0048863D52E018BB0BE6F3AAAAE6F4FA00D7000200B843DC02A891E00FDB0048E03D07E0019A8902C0E012CB00E002CB0048E13D06E6F100409A89F8C0E012CB0048E23D06E6F100609A89F0C0E012CB0048E33D04E6F10080E012CB0048E43D03E001E022CB0048E53D04E6F10080E022CB0048E63D03E001E032CB0048E73D04E6F10080E032CB0046FE08003D03E001E042CB0046FE09003D04E6F10080E042CB00E6FF3300CB0046F810003D28BBB7E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE0F4D7000200B843E6F35455E6F4AA00D7000200B843E6F3AAAAE6F45500D7000200B843E0A4DC02B841E00FDB0046F811003D2D9A8902C0E0170D01E007BB87E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE004D7000200B843E6F6F83F2892DC0BA85A08A218B0DC07B856DC07A8560862B0093DF5E054DC02B841E00FDB00E01FDB0033EraseTX:8400C000440348803D5AF05AF06B66FDC0FF2892E6F3AAAAE6F45000D7000200B843DC0BA84A08A218B0DC0EB84D2892E6F3F2A0DC0BA84A08A218B0D7000200B843B0293DF7E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE6F4A000D7000200B843DC0BA84ADC0EB84DE6F3AAAAE6F4FA00D7000200B843E001D7000200A8918AF9F300F0A5F0B6E6F94000E00FDC0BA94ADC0EA95D08A118B008D118E041452D03E6FF1100DB00289148903DF0DB0046F820003D2CE6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F35E5EE6F45E00D7000200B843E6F35455E6F4AA00D7000200B843E6F3AAAAE6F45500D7000200B843E6F35A5AE6F45A00D7000200B843E00FDB0046F821003D2A9A8902C0E0170D01E007E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F33C3CE6F43C00D7000200B843E6F6F83F2892DC0BA85A08A218B0DC07B856DC07A8560862B0093DF5E00FDB0048813D37BB45E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE6F48000D7000200B843E6F35455E6F4AA00D7000200B843E6F3AAAAE6F45500D7000200B843E6F43000DC02B841E6F3AAAAE6F4FA00D7000200B843E001D7000200A8918AF9F300E00FDB0048863D52E018BB0BE6F3AAAAE6F4FA00D7000200B843DC02A891E00FDB0048E03D07E0019A8902C0E012CB00E002CB0048E13D06E6F100409A89F8C0E012CB0048E23D06E6F100609A89F0C0E012CB0048E33D04E6F10080E012CB0048E43D03E001E022CB0048E53D04E6F10080E022CB0048E63D03E001E032CB0048E73D04E6F10080E032CB0046FE08003D03E001E042CB0046FE09003D04E6F10080E042CB00E6FF3300CB0046F810003D28BBB7E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE0F4D7000200B843E6F35455E6F4AA00D7000200B843E6F3AAAAE6F45500D7000200B843E0A4DC02B841E00FDB0046F811003D2D9A8902C0E0170D01E007BB87E6F3AAAAE6F4AA00D7000200B843E6F35455E6F45500D7000200B843E6F3AAAAE004D7000200B843E6F6F83F2892DC0BA85A08A218B0DC07B856DC07A8560862B0093DF5E054DC02B841E00FDB00E01FDB0033

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: October 05, 2020, 03:13:21 am
content: Not much of an update other than I have dumped a few more got the same results. I made a video and uploaded to youtube sharing whats been figured out so far and asking if anyone has any ideas.https://youtu.be/lvFUQ_b-JZo

author: Fixed_Until_Broken
author_rank: Regular Contributor
timestamp: October 11, 2020, 06:17:33 pm
content: Ok I got an email from some one this morning saying it will work if you program 768 bytes at a time. I figured out from there it will work up to 832 bytes It still gives an error that program failed but thats not the case it is successful. the really annoying part is that you have restart minimon and the MCU every 832 bytes you program so this is going to take all day to do the 128kb on the blank MCU I am working with.Edit you don't actually have to restart minimon its just the mcu. Is there a way to call reset with minimon? if so I could do a user script with minimon. Srst doesn't rest into BSL it goes into user program if you do that.

author: Larsoners
author_rank: Newbie
timestamp: November 02, 2020, 03:10:36 pm
content: Integrated On-Chip Memory• 2 KByte internal RAM for variables, register banks, system stack and code• 8 KByte on-chip high-speed XRAM for variables, user stack and code• 256 KByte on-chipProgram ROM(not for ROMless devices)