AT88SC0404CA-SH Atmel, AT88SC0404CA-SH Datasheet
AT88SC0404CA-SH
Specifications of AT88SC0404CA-SH
Available stocks
Related parts for AT88SC0404CA-SH
AT88SC0404CA-SH Summary of contents
Page 1
... Synchronous two-wire serial interface for faster device initialization • Programmable 8-byte Answer-To-Reset (ATR) register • ISO 7816-2 compliant moduls • High Reliability • Endurance: 100,000 cycles • Data retention: 10 years • ESD protection: 2,000V AT88SC0404CA AT88SC0808CA ® patent) 8664E−CRYPTO−12/11 ...
Page 2
... Table of Contents 1. Pin Configuration and Package Information .................................................... 4 1.1 Pin Configuration ................................................................................................ 4 1.2 Package Information ........................................................................................... 4 2. Description ....................................................................................................... 5 2.1 Atmel AT88SCxxxxC Family of Products Differences ......................................... 5 2.2 Embedded Applications ...................................................................................... 5 2.3 Smart Card Applications ..................................................................................... 5 2.4 Scope 5 3. Block Diagram ................................................................................................. 6 4. Pin Description ................................................................................................ 7 4.1 Supply Voltage (V )........................................................................................... 7 CC 4.2 Clock (SCL/CLK) ................................................................................................. 7 4.3 Serial Data (SDA/IO) ........................................................................................... 7 4.4 Reset (RST) ........................................................................................................ 7 5. Configuration and User Zone Description ....................................................... 8 5 ...
Page 3
... Absolute Maximum Ratings* ......................................................................... 59 12.1 DC and AC Characteristics ............................................................................... 59 12.2 Timing Diagrams for Synchronous Communications ........................................ 60 13. POR and Tamper Conditions ........................................................................ 62 13.1 Power On Reset (POR) Delay .......................................................................... 62 13.2 Tamper Detection ............................................................................................. 62 14. Ordering Information ..................................................................................... 63 Appendix A. Errata .............................................................................................. 64 A.1 Send Checksum Command in TWI Mode ......................................................... 64 Appendix B. Revision History .............................................................................. 65 Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 3 8664E−CRYPTO−12/11 ...
Page 4
... Package Pin Configuration Pad Description V Supply Voltage CC GND Ground SCL/CLK Serial Clock Input SDA/IO Serial Data Input/Output RST Reset Input 1.2 Package Information Figure 1-1. Atmel CryptoMemory Packages Smart Card Module RST = C2 SCL/CLK = 8-lead TSSOP GND 8-Lead TSSOP SDA 3 NC ...
Page 5
... A configuration zone contains registers to define the security rights for each user zone and space for passwords and secret keys used by the security logic of Atmel CryptoMemory Through dynamic, symmetric-mutual authentication, data encryption, and the use of encrypted checksums, CryptoMemory provides a secure place for storage of sensitive information within a system ...
Page 6
... Block Diagram Figure 3-1. Block Diagram V Power CC GND Management Synchronous Interface SCL/CLK Asynchronous SDA/IO ISO Interface RST Reset Block Authentication, Encryption and Certification Unit Data Transfer EEPROM Password Verification Answer to Reset Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 6 8664E−CRYPTO−12/11 ...
Page 7
... CryptoMemory does not support a synchronous answer to reset sequence. The RST input is not available in the plastic package options for CryptoMemory. Figure 4-1. Connection Diagram 2.7v - 5.5v Microprocessor Note: While the Atmel CryptoMemory AT88SCXXXXCA is a low voltage device (2.7V to 3.6V) its I/O buffers are designed for standard high voltage applications (2.7V to 5.5V) 2.7v - 3.6v CryptoMemory SDA SCL ...
Page 8
... Unused memory space in the register region becomes reserved to ensure other components of the configuration memory remain at the same address location regardless of the number of user zones in a device. please see the examples in the protocol sections of this Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 8 8664E−CRYPTO−12/11 ...
Page 9
... Table 5-1. Atmel AT88SC0104CA/0204CA/0404CA Configuration Memory $ $00 $08 Fab Code MTZ $10 $18 DCR $20 AR0 PR0 AR1 $28 $30 $38 $40 $48 $50 AAC0 $58 Session Encryption Key S $60 AAC1 $68 Session Encryption Key S $70 AAC2 $78 Session Encryption Key S $80 AAC3 $88 Session Encryption Key S $90 $98 $A0 $A8 $B0 PAC ...
Page 10
... Table 5-2. Atmel AT88SC0808CA Configuration Memory $ $00 $08 Fab Code MTZ $10 $18 DCR $20 AR0 PR0 AR1 $28 AR4 PR4 AR5 $30 $38 $40 $48 $50 AAC0 $58 Session Encryption Key S $60 AAC1 $68 Session Encryption Key S $70 AAC2 $78 Session Encryption Key S $80 AAC3 $88 Session Encryption Key S $90 $98 $A0 ...
Page 11
... When the same security requirements define access to multiple zones, the zones effectively serve as one large storage area albeit with the requirement to select each zone prior to access. User zone access is personalized by customer via the access registers. Table 5-3. Atmel AT88SC0104CA User Memory Zone $00 ─ ...
Page 12
... Table 5-4. Atmel AT88SC0204CA User Memory Zone $0 $00 ─ User 0 ─ $38 $00 ─ User 1 ─ $38 $00 ─ User 2 ─ $38 $00 ─ User 3 ─ $38 Note: Page size = 16 bytes $ bytes 64 bytes 64 bytes 64 bytes Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet 8664E−CRYPTO−12/11 ...
Page 13
... Table 5-5. Atmel AT88SC0404CA User Memory Zone $0 $00 ─ User 0 ─ $78 $00 ─ User 1 ─ $78 $00 ─ User 2 ─ $78 $00 ─ User 3 ─ $78 Note: Page size = 16 bytes Table 5-6. Atmel AT88SC0808CA User Memory Zone $0 $00 ─ User 0 ─ $78 $00 User 1 ─ ─ ─ ...
Page 14
... Figure 6-1. Password Verification CryptoMemory Device VERIFY Password Allow Access User Data clear clear clear clear clear encrypted Command/Communications Verify Password Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Passwords Data Integrity Check clear MDC encrypted MAC encrypted MAC Host Logic Send Password encrypted if performed after Mutual Authentication 8664E− ...
Page 15
... Read Config Zone Read Device Info, Cryptogram Compute Secret Seed Generate Random Number Verify Authentication Compute Challenge A Compute Challenge B Compute Session Key Read Config Zone Read Challenge B Verify Challenge B Allow Access Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Command Set). Host Logic 15 8664E−CRYPTO−12/11 ...
Page 16
... Command Set and Section 10.3, Command/Communications Session Key, Cryptogram Generate Random Number Verify Encryption Compute Challenge A Compute Challenge B Read Config Zone Read Challenge B Verify Challenge B Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Command Set) Host Logic 16 8664E−CRYPTO−12/11 ...
Page 17
... In the event that the device needs to carry out the data recovery process the host is required to perform ack polling for 18ms xxxx xxxx xxxx xxxx locked locked Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet xxxx xxxx xxxx xxxx xxxx xxxx locked 8664E−CRYPTO−12/11 ...
Page 18
... Factory Programmed Fields Device AT88SC0104CA AT88SC0204CA AT88SC0404CA AT88SC0808CA 6.3.2 Answer To Reset (ATR) This is an eight byte wide register with content that Atmel defines. This register is read/write accessible prior to blowing the FAB fuse, but becomes read-only after blowing the fuse ...
Page 19
... Values in the access registers take immediate effect after programming. The default value for each bit is “1”. Table 6-5. Access Register Bit 7 Bit 6 PM1 PM0 Bit 5 Bit 4 Bit 3 UAT ETA CS3 Bit 5 Bit 4 Bit 3 AM1 AM0 ER Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Bit 2 Bit 1 Bit 0 CS2 CS1 CS0 Bit 2 Bit 1 Bit 0 WLM MDF PGO 19 8664E−CRYPTO−12/11 ...
Page 20
... When ER = "0", the host is required to activate the encryption mode in order to read/write the corresponding user zone. No data read from or written to the zone may be transmitted in the clear "1", the host may activate the encryption mode, but isn't specifically required the device. Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 20 8664E−CRYPTO−12/11 ...
Page 21
... The customer may program an initial value for the cryptogram during personalization recommended that the initial values be random numbers. Bit 5 Bit 4 Bit 3 POK1 POK0 Res -G must be used in an authentication to allow access to the user zone Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Bit 2 Bit 1 Bit 0 PW2 PW1 PW0 - 8664E−CRYPTO−12/11 ...
Page 22
... Security Fuses CryptoMemory uses four fuses. The status of these fuses is given in a ‘fuse byte.’ A value of ‘0’ indicates that the fuse has been blown. Bits four to seven of this byte are not used as security fuses and are reserved for Atmel use. Table 6-9. ...
Page 23
... SEC, PER, CMA, and FAB are non-volatile fuses blown at the end of various steps in the manufacturing and personalization process. Once blown, these fuses can never be reset. Atmel blows the SEC fuse to lock the lot history code before the device leaves the factory. Blowing the remainder of the fuses must follow the sequence: • ...
Page 24
... The asynchronous mode is selected when RST is low on a rising edge of CLK. Once the asynchronous mode has been selected not possible to return to the synchronous mode other than by powering the device off and on again. due to the internal and/or external pull-up on RST. For embedded applications using Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 24 8664E−CRYPTO−12/11 ...
Page 25
... Table 7-1. ATR Codes for Lower Density CryptoMemory Atmel Device TS AT88SC0104CA $3B AT88SC0204CA $3B AT88SC0404CA $3B AT88SC0808CA $3B Figure 7-2. Power Up Sequence for Smart Card Mode V cc I/O-SDA RST CLK-SCL Smart card applications that support the two-wire protocol can also use CryptoMemory in the synchronous mode. ...
Page 26
... Power- • External pull-up resistor pulls I/O-SDA high with V • After stable pulses are applied to CLK-SCL CC • CLK-SCL and I/O-SDA may be driven Figure 8-1. Start-up Sequence V cc I/O-SDA 1 CLK-SCL Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 26 8664E−CRYPTO−12/11 ...
Page 27
... Address 1, Address 2, and N. The last byte, N, defines the number of any additional data bytes to be sent or received from the CryptoMemory device. In addition, the random read command is available the only one byte command but must be preceded by an aborted write command in order to set up the read address. Table 8-1. Atmel CryptoMemory Synchronous Command Set Command Description Normal Write User ...
Page 28
... Address 2 N 0a6-- ---a0 n7--- ---n0 d7--- --- Data Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet Data d7--- --- d7--- ---d0 Data x N 8664E−CRYPTO−12/11 ...
Page 29
... Verify commands: ACK polling required with commands only Random Read K T Address 2 N Command 0a6--- ---a0 n7--- ---n0 xxxx 0001 Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet d7--- ---d0 d7--- ---d0 A Data Data Data 8664E−CRYPTO−12/ ...
Page 30
... A specific device may be set to respond to another value ($0 to $F) in addition setting this value in the second nibble of the Device Configuration Register (DCR) in the configuration memory. The DCR is set to $FF at the Atmel factory and thus will respond to device address $B and $F unless the DCR is modified. For a device to respond only to $B the DCR should be set to $B also ...
Page 31
... Figure 8-6. Write User Zone Command Structure Command Address 1 T 1011 0000 xxxx xxxx Device Address 2 N xxxx xxxx xxxx xxxx d7--- --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet Data x N Data P d7--- --- 8664E−CRYPTO−12/11 31 ...
Page 32
... Device Data … Data Random Read R Address 0a6-- ---a0 n7--- --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] N data bytes A C Command K xxxx 0001 d7--- ---d0 d7--- ---d0 A Data Data 8664E−CRYPTO−12/ ...
Page 33
... A R Command Address 1 T 1011 0010 xxxx xxxx Device Data … N data bytes Data Address 2 N xxxx xxxx xxxx xxxx d7--- --- Data Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet d7--- ---d0 Data x N 8664E−CRYPTO−12/11 33 ...
Page 34
... In this case, the device will prevent the internal write cycle and no bytes will be written in the EEPROM. After this command the host must perform ACK polling. Device Command Addr 1 $B4 $00 $B4 $01 $B4 $02 $B4 $03 Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Addr 2 N Data (N) N ≤ $10 addr N bytes fuse ID $00 $00 $02 2 bytes zone ...
Page 35
... The fuses must be blown sequentially: FAB must be blown first, CMA may be blown only if FAB is ‘0’, and PER only if CMA is ‘0’. After this command the host must perform ACK polling. The SEC fuse is blown at the Atmel factory to protect lot history information. Table 8-4. ...
Page 36
... Read Fuse Byte Fuse data is returned in the form of a single byte. Bits zero to three represent the fuse states; a value of ‘0’ indicates the fuse has been blown. Bits four to seven are not used as security fuses and are reserved by Atmel. Table 8-7. Fuse Byte Definition ...
Page 37
... The checksum consists of two bytes, and the read checksum command must be sent with parameter Figure 8-14. System Read Command Address 1 T 1011 0110 0000 xxxx Address 2 N xxxx xxxx xxxx xxxx d7--- --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet d7--- ---d0 Data Data x N 8664E−CRYPTO−12/11 37 ...
Page 38
... Data : Q : Host random number, 8 bytes CH : Host challenge, 8 bytes Device , and secret seed, G (or session encryption key and S . The device utilizes the success or failure information of the Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] ). The device also decrements i 38 8664E−CRYPTO−12/11 ...
Page 39
... N=16 Data 0001 0000 d7--- --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 39 8664E−CRYPTO−12/11 ...
Page 40
... In order to know whether the inserted password was correct, the host can read the corresponding attempts counter and verify the value is zero. Device Parameter 2 N=3 Data x 3 xxxx xxxx 0000 0011 d7--- --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet 8664E−CRYPTO−12/11 ...
Page 41
... Write Data to User Zones In the default configuration from Atmel, all user zones have free access rights. Writing initial data into the user zones should be done before setting security configurations. Use the set user zone command and write user zone command to write initial data into the user zones ...
Page 42
... The following shows the two-wire commands sent to the CryptoMemory device for the purpose of initializing the device. The flow is consistent with the steps described above; comments have been added as indicated with an asterisk (*). *Atmel AT88SC0104CA Initialization Example *WRITE DATA TO USER ZONES *Set User Zone 0 ...
Page 43
... *SET SECURITY FUSES *Set FAB Fuse *Set CMA Fuse *Set PER Fuse *Read Fuse Byte = *Device Response Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 43 8664E−CRYPTO−12/11 ...
Page 44
... For all bytes transmitted by the device or by the host, including header, procedure, status and data bytes parity error is detected, the receiver requests that byte to be sent again (see character format) 8 data bits Parity bit Guard Time Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Next Start bit 8664E−CRYPTO−12/11 44 ...
Page 45
... Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Data (N) N bytes N bytes N bytes 2 bytes N bytes 8 random bytes + 8 challenge bytes X=key set (0-3) 8 random bytes + 8 challenge bytes X=key set (0-3) 3 byte password X=password set (0, 1 byte password X=password set (0, 1 8664E− ...
Page 46
... Address byte A2 = $02 $04 Four data bytes $B0 Device responds with INS code $04 Byte to be written at start address $02 $09 Byte to be written at address $03 $19 Byte to be written at address $04 $97 Byte to be written at address $05 ~5ms 90 Write operation successful $00 Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 46 8664E−CRYPTO−12/11 ...
Page 47
... If the host is not allowed to write in the zone, the device will return the "Command Unauthorized" code ($69 $00) after it has received the P3 byte. Table 10-3. Write User Zone Command Structure CLA INS : Command ** $B0 Device Command Header P1 : Address Address 2 0000 0000 0a -- ---a 000n 6 0 Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Data Sent Data(1) ... Data(N) --- n d --- ---d ... 8664E−CRYPTO−12/11 ...
Page 48
... Table 10-4. Read User Zone Command Structure CLA INS : Command ** $B2 Device Data … N data bytes Data Command Header P1 : Address Address 2 0000 0000 0a -- --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Data Returned Data(1) ... Data(N) n --- n d --- ---d ... 8664E−CRYPTO−12/11 --- ---d 7 ...
Page 49
... Command Description Write Config Zone w/ a-t Set User Zone w/ a-t Device CLA INS P1 $00 $B4 $00 $00 $B4 $01 $00 $B4 $02 $00 $B4 $03 CLA INS $00 $B4 $00 $B4 Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet Data(N) N ≤ $10 addr N bytes fuse ID $00 $00 $02 2 bytes zone $ Data(N) N ≤ $08 $08 addr N bytes $0B zone $00 8664E− ...
Page 50
... The fuses may only be "programmed", that is written from '1' to '0'. The write fuses operation is only allowed after successfully presenting the secure code (Write 7 password). The fuses must be blown sequentially: FAB must be blown first, CMA may be blown only if FAB is ‘0’, and PER only if CMA is ‘0’. The SEC fuse is blown at the Atmel factory to protect lot history information. ...
Page 51
... Read Fuse Byte Fuse data is returned in the form of a single byte. Bits represent the fuse states; a value of ‘0’ indicates the fuse has been blown. Bits are not used as security fuses and are reserved by Atmel. Table 10-10. Fuse Byte Definition ...
Page 52
... The checksum consists of two bytes, and the read checksum command must be sent with parameter Table 10-12. System READ CLA INS : Command ** $B6 Command Header --- p p --- System Read --- p p --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Data Returned P3 Data(1) ... Data(N) n --- n d --- ---d ... Data Returned P3 Data(1) ... Data(N) --- n d --- ---d ... ...
Page 53
... Q : Host random number, 8 bytes CH : Host challenge, 8 bytes Device and secret seed, G (or session encryption key and S . The device utilizes the success or failure information of the Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] ). The device also increments the i 53 8664E−CRYPTO−12/11 ...
Page 54
... If the maximum number of trials has been exceeded, the device will return $69 $00 instead of the INS code, after receiving the header, to indicate the command is unauthorized $10 d --- ---d d --- --- Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Data Sent CH1 CH8 d --- ---d d --- --- 8664E−CRYPTO−12/11 ...
Page 55
... If the password is wrong, the device simply returns $69 $00 after incrementing the attempts count. The Write 7 password is also known as the secure code and must be properly presented before access to the configuration zone is granted when personalizing the device. Device 000r $ Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Data Sent PW1 PW2 PW3 d --- ---d d --- ---d d --- --- 8664E− ...
Page 56
... Write Data to User Zones In the default configuration from Atmel, all user zones have free access rights. Writing initial data into the user zones should be done before setting security configurations. Use the set user zone command and write user zone command to write initial data into the user zones ...
Page 57
... The following shows the TPDU commands sent to the CryptoMemory device for the purpose of initializing the device. The flow is consistent with the steps described above; comments have been added as indicated with an asterisk (*). *Atmel AT88SC0104CA Initialization Example *WRITE DATA TO USER ZONES *Set User Zone 0 ...
Page 58
... *SET SECURITY FUSES *Set FAB Fuse *Set CMA Fuse *Set PER Fuse *Read Fuse Byte = *Device Response Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 58 8664E−CRYPTO−12/11 ...
Page 59
... 0.7 < V < 0.7 < V < 20K Ω external pull- 1mA For powering down, V must be removed before turning Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Min Typ Max 2.7 3 100 0.7 5 ...
Page 60
... SU.STA SDA IN SDA OUT Min 40 200 200 10 100 200 20 = 2. HIGH LOW LOW t t HD.STA HD.DAT t AA Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] Max Units 1 4 MHZ 0 1 MHZ 60 % µS 1 µS 1 µ period µ period 250 ...
Page 61
... The write cycle time t is the time from a valid stop condition of a write sequence to the end of the internal WR clear/write cycle Figure 12-3. Data Validity SDA SCL DATA STABLE CHANGE ALLOWED ( STOP CONDITION DATA STABLE DATA Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] START CONDITION 61 8664E−CRYPTO−12/11 ...
Page 62
... CryptoMemory contains tamper detection sensors to detect operation outside of specified limits. These sensors monitor the internal supply voltage and clock frequency. An additional sensor detects high intensity light attacks. The die is disabled and will not function when tampering is detected. STOP Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 62 8664E−CRYPTO−12/11 ...
Page 63
... M2 – P Module : ISO or TWI 8P3 8S1 8X 8MA2 Note: 1. Formal drawings may be obtained from an Atmel sales office 2. Both the J and P module packages are used for either ISO (T=0 / 2-wire mode) or TWI (2-wire mode only) Package Voltage Range M2 – J Module - ISO M2 – P Module - ISO 2.7V–5.5V M2 – ...
Page 64
... If the checksum is valid, CryptoMemory writes the data; if the checksum is incorrect the data is discarded and the cryptographic engine is reset. If there is any activity on the TWI bus between the write user zone command and the send checksum command the EEPROM write may be aborted and the data in the user zone will be unchanged." Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 64 8664E−CRYPTO−12/11 ...
Page 65
... Comments Update template Add ordering information Table 8-1, Atmel CryptoMemory Synchronous Command Set Correct value in “Verify Password, Addr 1, from $0X to $1X Convert to MS Word Update document Initial document release Atmel AT88SC0104CA/0204CA/0404CA/0808CA [Datasheet] 65 8664E−CRYPTO−12/11 ...
Page 66
... Disclaimer: The information in this document is provided in connection with Atmel products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Atmel products. EXCEPT AS SET FORTH IN THE ATMEL TERMS AND CONDITIONS OF SALES LOCATED ON THE ATMEL WEBSITE, ATMEL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT ...