← AXC-006

Circuit review & bench-test guide

AXC-006 — ATECC608B crypto element PMOD module

Document purpose#

This document explains the axc-006-crypto PMOD module at component level and turns the design evidence into a practical manual-review and bench-test plan. It is based on generate_design.py, README.md, and the ERC report in reports/.

This board has never been fabricated. Repository status is schematic generated, ERC clean (0 errors / 0 warnings), netlist reviewed; PCB layout not started; not released. There is no PCB, no BOM export, no DRC record, and no first-article bench result. Every number below is a target to verify against real hardware, not a proven result.

1. What the board does#

The board carries a Microchip ATECC608B CryptoAuthentication secure element as an I²C hardware root of trust: ECC P-256 private keys are generated on-die and never leave it. It signs telemetry before AXC-003 publishes it, verifies AruviOS boot images, and authenticates radio peers on AXC-001..004 — anchoring the security mini-curriculum. It is a PMOD Type 6 "extended I²C" module: SCL/SDA on pins 3/4, repeated on pins 9/10 for daisy-chaining, with the 4.7 k bus pull-ups behind cuttable solder jumpers.

Two facts dominate everything below:

• Address convention. The datasheet's 0xC0 is the 8-bit write address; as a 7-bit address (the convention AruviOS drivers use) the device answers at 0x60. Fixed — there is no address strap for this part.
• Wake-pulse quirk. The part sleeps hard. A plain START at 100 kHz does not wake it. The driver must hold SDA low for > 60 µs (tWLO), release, wait ~1.5 ms (tWHI), then poll — and the device answers with a 0x11 wake status word.

Functional block diagram#

PMOD host (3.3 V)              Module
┌────────────────┐   ┌──────────────────────────────────────────┐
│ 3 SCL ─────┬────┼──>│ JP2 ─ R2 4.7k PU ─┬─ U1 SCL (pin 6)     │
│ 4 SDA ─────│─┬──┼──>│ JP1 ─ R1 4.7k PU ─┴─ U1 SDA (pin 5)     │
│ 9 SCL ─────┘ │   │   │ U1 ATECC608B-SSHDA-T (SOIC-8)          │
│ 10 SDA ──────┘   │   │ 7-bit I2C 0x60  (8-bit write 0xC0)     │
│ 6/12 3V3 ────────┼──>│ VCC ─ C1 100n                          │
│ 5/11 GND ────────┼───│ GND    pins 1-3, 7 = true NC           │
└────────────────┘   └──────────────────────────────────────────┘

2. Safety and scope boundaries#

• Everything is 3.3 V; hazard to people is negligible. The real hazards here are to the device's usefulness, not to people: a mis-issued lock command is permanent and irreversible.
• PROVISIONING IS PERMANENT — the irreversible-lock warning. The ATECC608B has a Configuration zone and Data/OTP zones that are locked by the Lock command. Once LockConfig (config zone) or LockValue (data/OTP zone) is issued, that zone can never be unlocked, rewritten, or reset — there is no erase, no factory reset, no rework. A dev board whose config is locked with the wrong slot policy is scrap for that lesson. Do not send any Lock command during bring-up. Treat the provisioning walkthrough (an open README item) as a separate, deliberate, reviewed step — never part of casual bench poking.
• The supply is 3.3 V; never feed 5 V. There is no regulator on this board.
• Standalone I²C bench work is low-current (sub-mA idle, a few mA during a crypto op) — a normal 3.3 V supply is fine; no special current limit story.
• Bus pull-ups live on this board (JP1/JP2). When chaining multiple I²C modules, only one board should provide the pull-ups — cut JP1/JP2 here if another module already pulls the bus up, or the parallel pull-ups over-load the bus.
• ERC-clean is a schematic check only. The 20 × 25 mm outline and pull-up placement are layout promises.

3. Power and control sequence#

1. VCC (pin 8) comes from PMOD 3V3; C1 (100 nF) decouples it. The part powers up and, after a short time with no bus activity, drops into a low-power Sleep.
2. Wake sequence (the quirk): to talk to a sleeping device the host holds SDA low for > 60 µs (tWLO) — longer than any normal I²C bit — then releases SDA and waits ~1.5 ms (tWHI) for the internal oscillator to stabilise. A plain START condition at 100 kHz is too short to wake it.
3. After wake the device is addressable at 7-bit 0x60 and returns a wake status of 0x11 ("after wake, prior to first command") when its output buffer is read.
4. The host issues commands as an I²C write of a command packet, waits the command's execution time (tEXEC), then reads back the response. The first useful bring-up command is Info (Info/Revision mode), which returns the device revision bytes — a read-only, side-effect-free way to confirm a live, correctly-addressed part.
5. Real use (Nonce/GenKey/Sign/Verify/Read/Write) follows only after Info proves the part. Any Lock is out of scope for bring-up.

4. Interfaces#

There are no dedicated test points; bench probing is at J1 pins, JP1/JP2, and the SOIC-8 pins. SDA/SCL should be scoped for the wake-pulse capture.

5. Component-by-component review#

5.1 Secure element#

5.2 Bus pull-ups and jumpers#

5.3 Decoupling#

Every ref-des is covered: U1, J1, JP1, JP2, R1, R2, C1.

6. Datasheet summary and design interpretation#

Official reference: the ATECC608B summary datasheet (DS40002239). The full functional/command detail (wake timing, Info/Lock command formats) is in the NDA/full datasheet and the CryptoAuthLib source — consult those before writing the provisioning walkthrough.

7. Expected values before bench testing#

All values are design targets for a board that does not yet exist.

8. Manual schematic and assembly review checklist#

• Confirm U1 orientation and that pins 1–3 and 7 are unbridged NCs; verify SDA (pin 5) and SCL (pin 6) are not swapped, and VCC (8)/GND (4) polarity.
• Confirm JP1/JP2 are bridged for a standalone board; document the intent if either is cut for chaining.
• Verify R1/R2 are 4.7 k to 3V3 and reach SDA/SCL through JP1/JP2.
• Confirm the bus is genuinely repeated on PMOD pins 9/10 (chaining).
• Confirm C1 sits at the U1 VCC pin.
• Assembly-process note: confirm the bring-up firmware issues no Lock command. Provisioning/lock is a separate reviewed procedure, never part of first bring-up.

9. Ordered bench-test procedure#

Stop at the first abnormal result. Record board serial and device lot/marking. Do not issue any Lock command anywhere in this procedure.

A. Unpowered inspection and resistance tests#

1. Visual: SOIC-8 orientation, NC pins clear, jumper states, passives.
2. DMM: VCC-to-GND both polarities; SDA/SCL to 3V3 ≈ 4.7 k with JP1/JP2 bridged.

B. Power-on and bus idle#

1. Power at 3.3 V. Expect sub-mA idle, no heating.
2. Scope SDA/SCL idle high (~3.3 V). Confirm the pull-ups hold the bus.

C. Wake-pulse capture (the defining bring-up test)#

1. Scope SDA (and SCL) with enough record length to see a ~60 µs event.
2. Have the driver (or a manual GPIO routine) drive SDA low for > 60 µs (tWLO), release, and wait ~1.5 ms (tWHI). Capture the wide SDA-low pulse and confirm it exceeds 60 µs — this is the money shot; save it.
3. Immediately after tWHI, read the device output buffer and confirm the 0x11 wake status word.

D. Address ACK and Info bring-up#

1. Issue an I²C transaction to 7-bit address 0x60 after wake; confirm the device ACKs. A NAK means wake failed or the address is wrong.
2. Send the Info command (Revision mode), wait tEXEC, read the response; confirm plausible ATECC608B revision bytes. This proves a live, correctly-addressed, correctly-woken part without touching any zone.
3. Optionally read the (unlocked) Config zone read-only to inspect the factory default slot configuration — read only, no writes, no lock.

E. Host (PMOD) bring-up#

1. Repeat C–D through the FPGA fabric I²C (atecc_i2c core), which owns the wake sequence; compare against a logic-analyzer tap.
2. Verify the wake-then-Info sequence is repeatable across sleep cycles (device re-sleeps between transactions).
3. Chaining check: if used with another I²C module, cut JP1/JP2 and confirm the other module's pull-ups carry the bus; re-run C–D.

F. Provisioning (out of scope for this guide — do NOT lock here)#

Slot configuration and zone locking are permanent and irreversible. Perform them only under the deliberate provisioning walkthrough (an open README item), on boards explicitly designated for it, after a documented review of the intended slot policy. This bench guide stops before any Lock.

10. Troubleshooting map#

11. Bench record template#

12. Review conclusion#

The hardware is almost trivial — one SOIC-8, two pull-ups behind cuttable jumpers, one decoupling cap — but the operating discipline is not. Three things define this board: the address convention (0xC0 write → 0x60 7-bit), the wake quirk (SDA low > 60 µs, then 0x11), and the irreversible-lock warning (a mis-issued Lock permanently scraps the part's zone). The safe bring-up path is wake → confirm 0x11 → ACK at 0x60 → Info revision, with no zone writes and no Lock anywhere near the bench. The single most valuable capture is the scope trace of the > 60 µs wake pulse in 9.C, because a driver that gets that timing wrong makes a perfectly good part look permanently dead. Open risks: no PCB exists, the provisioning/lock walkthrough is unwritten (and dangerous until it is), and the wake/command timing must be validated against the full datasheet and CryptoAuthLib.