BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 1 - 8/16/2006 total 10 pages description BL7442LV is a ic card chip (module) made by 1.2um cmos eerpom process. it has 256 byte eeprom with logical encryption and function. it can be operated at low voltage.BL7442LV has two types, type a and type b. figure 1 features 256 x 8 bit eeprom organization byte-wise addressing irreversible byte-wise write protection of lowest 3 2 addresses (byte 0 31) 32 x1 bit organization of protection memory two-wire link protocol end of processing indicated at data output answer-to-reset according to iso standard 7816-3(b type) eeprom programming time 2.5 ms per byte for both erasing and writing minimum of 100,000 write/erase cycles data retention time :>10 years contacts configuration and serial interface accordi ng to iso 7816 standard (synchronous transmission) BL7442LV a type: data can only be read(include ans wer-to-reset )and changed after entry of the correct 3-byte programmable security code BL7442LV b type: data can only be changed after en try of the correct 3-byte programmable security code pin description pin no. parameter symbol function description 1 c1 v dd supply voltage 2 c2 rst reset signal 3 c3 clk clock input 4 c4 n.c. not connected 5 c5 gnd ground 6 c6 nc not connected 7 c7 i/o bidirectional data line (open drain) 8 c8 nc not connected
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 2 - 8/16/2006 total 10 pages function description block diagram main memory protection memory eeprom 256x8 255 32 31 0 31 0 32 1 0 ref data ref data ref data psc address data 8 5 2lsb memory main/protection security ec security memory decoder column sampling program control interface sequencer and security logic reset block logi c add. data register , comparator v cc gnd i/o rst clk hv generator current generator data address data address area for permanent data storage figure 2 the BL7442LV consists of 256 x 8 bit eeprom main m emory (figure 2) and a 32-bit protection- memory with prom functionality .the main memory is erased and written byte by byte. when erased, all 8 bits of a data byte are set to logical one. when written, the information in the individual eeprom c ells is to the input data, altered bit by bit to logical ze ros (logical and between the old and the new data i n the eeprom). normally a data change consists of an erase and wri te procedure. it depends on the contents of the data byte in the main memory and the new data byte whether the eeprom is really erased and/or written. if none of the 8 bits in the addressed byte require s a zero-to-one transition the erase access will be suppressed. vice versa the write access will be sup pressed if no one-to-zero transition is necessary. the write and the erase operation takes at least 2.5 ms each. the first 32 bytes can be irreversibly prote cted against data change by writing the corresponding bi t in the protection memory. each data byte in this address range is assigned to one bit of the protect ion memory and has the same address as the data byt e in the main memory which it is assigned to. once writ ten the protection bit cannot be erased.
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 3 - 8/16/2006 total 10 pages additionally to the above functions the BL7442LV pr ovides a security code logic which controls the write/erase access to the memory. for this purpose ,the BL7442LV contains a 4-byte security memory with an error counter ec (bit 0 to bit 2) and 3 bytes reference data(figure 2).these 3 bytes as a whole are called programmable security code (psc). after power on the whole memory, except for the reference data, bl7442 lv type b can only be read. writing and erasing is only possible after a successful compari son of verification data with the internal reference data. after power on the whole memory,bl7 442lv type a is neither written, erased nor read. reading, writing and erasing is only possible after a successful comparison of verification data with the internal reference data. after three successive unsuccessful comparisons the error counter blocks any subsequent attempt, and hence an y possibility to write and erase. transmission protocol the transmission protocol is a two wire link protoc ol between the interface device ifd and the integrated circuit ic. it is identical to the p rotocol type s=10. all data changes on i/o are initiated by the falling edge on clk. the transmission protocol consists of the 4 modes: (1)reset and answer-to-reset (2)command mode (3)outgoing data mode (4)processing mode (1) reset and answer-to-reset (BL7442LV type b only ) answer-to-reset takes place according to iso standa rd 7816-3.the reset can be given at any time during operation. in the beginning, the address cou nter id set to zero together with a clock pulse and the first data bit (lsb) is output to i/o when rst is set fro m state h to state l. under a continuous input of a dditional 31 clock pulses the contents of the first 4 eeprom addresses can be read out. the 33 rd clock pulse switches i/o to state h (figure 3). during answer-t o-reset any start and stop condition is ignored. ... 31 32 2 3 4 1 ... 30 3 2 1 32 31 td4 td4 td2 th tl td5 vcc rst clk i/o rst clk i/o figure 3 reset and answer-to-reset (2) command mode after the answer-to-reset the chip waits for a comm and. every command begins with a start condition, includes a 3 bytes long command entry followed by a n additional clock pulse and ends with a stop condi tion (figure 4). --start condition: falling edge on i/o during clk i n state h --stop condition: rising edge on i/o during clk in state h
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 4 - 8/16/2006 total 10 pages ifd sets i/o to state l 23 24 1 3 4 2 start from ifd stop from ifd clk i/o command tbuf tf tr tl td1 td7 td5 td8 td3 clk i/o figure 4 command mode after the reception of a command there are two poss ible modes: --outgoing data mode for reading --processing mode for writing and erasing (3) outgoing data mode in this mode the ic sends data to the ifd. figure 5 shows the timing diagram. the first bit becomes valid on i/o after the first falling edge on clk. a fter the last data bit an additional clock pulse is necessary in order to set i/o to state h and to prepare the ic f or a new command entry. during this mode any start and stop condition is discarded. n n-1 2 3 1 2 3 1 4 n n-1 clk i/o command start of outgoing data ic sets i/o to state h figure 5 outgoing data mode (4) processing mode in this mode the ic processes internally. figure 6 shows the timing diagram. the ic has to be clocked continuously until i/o which was switched to state l after the first falling edge of clk is set to sta te h. any start and stop condition id discarded during this m ode. 2 3 1 n n-1 td2 td2 start of processing end of processing clk i/o figure 6 processing mode
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 5 - 8/16/2006 total 10 pages commands (1) command format each command consists of three byte: msb control lsb msb address lsb msb data lsb b7 b6 b5 b4 b3 b2 b1 b0 a7 a6 a5 a4 a3 a2 a1 a0 d7 d6 d5 d4 d3 d2 d1 d0 beginning with the control byte lsb is transmitted first. byte 1 control byte 2 address byte 3 data operation mode b7 b6 b5 b4 b3 b2 b1 b0 a7~a0 d7~d0 0 0 1 1 0 0 0 0 address no effect read main memory outgoing data 0 0 1 1 1 0 0 0 address input data update main memory processing 0 0 1 1 0 1 0 0 no effect no effect read protection memory outgoing data 0 0 1 1 1 1 0 0 address input data write procection memory processing 0 0 1 1 0 0 0 1 no effect no effect read security memory* outgoing data 0 0 1 1 1 0 0 1 address input data update security memory* processing 0 0 1 1 0 0 1 1 address input data compare verification data* processing (2) description of command read main memory the command reads out the contents of the main memo ry(with lsb first)starting at the given byte address(n) up to the end memory. after the command entry the ifd has to supply sufficient clock pulses. the number of clocks is m=(256-n)*8+1 .the read access to the main memory is always possible. read protection memory the command transfers the protection bits under a c ontinuous input of 32 clock pulses to the output. i/o is switched to state h by an additional pulse. the protection memory can always be read. read security memory similar to the read command for the protection memo ry this command reads out the 4 bytes of the security memory. the number of clock pulses dur ing the outgoing data mode is 32.i/o is switched to state h by an additional pulse. without a preceeding successful verification of the psc the output of the reference bytes is suppressed , that means i/o remains in state l. update main memory the command programs the address eeprom byte with t he data byte transmitted. depending on the old and new data, one of the following seque nces will take place during the processing mode: -- erase and write (5ms) correspondi ng to m = 255 clock pulses -- write without erase (2.5ms) corresponding to m = 124 clock pulses -- erase without write (2.5ms) corresponding to m =124 clock pulses
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 6 - 8/16/2006 total 10 pages (all values at 50 khz clock rate) 1 2 3 24 1 2 3 m-2 m-1 m 1 2 24 command entry processing clk i/o rst figure 7 update main memory update security memory regarding the reference data bytes this command wil l only be executed if a psc has been successfully verified before. otherwise only each b it of the error counter (address 0)can be written from 1 to 0.the execution times and the required clock pulses are the same as described under update main memory. write protection memory the execution of this command contains a comparison of the entered data byte with the assigned byte in the eeprom .in case of identity the protect ion bit is written thus making the data information unchangeable. if the data comparison re sults in data differences writing of the protection bit will be suppressed. execution times and required clock pulses see update main memory. compare verification data this command can only be executed in combination wi th an update procedure of the error counter(see usage of compare command).the command c ompares one byte of the entered verification data byte with the corresponding refer ence data byte. for this procedure clock pulses are necessary during the processing mode. a type: before data comparison , i/o pin is high impedance. because the data of error counter (ec) can not be read, the identification of ec is d ifferent from bl7442. after power on, whatever ec is in which state, it is considered to 111(07h), then the ec is written one bit and compared one time, after comparison is correct(can be read o ut the content of psc),it will be written back to 07h.if original data of ec is 07h, it is same as ty pe b. if original data of ec is not 07h,the security code verification is unsuccessful. althoug h security code is correct, ec operation is of no effect when ec is equal to 01h or 03h. both a and b type the internal operation is same. the difference between type a and type b is only type a can not be read out the content of ec. b type: it is same as bl7442. usage of the compare command the following procedure has to be carried out exact ly as described. any variation leads to a failure so that a write/erase access will not be ac hieved. as long as the procedure has not been successfully concluded the error counter bits can o nly be changed from 1 to 0 but not erased. all first an error counter bit has to be written to 0 by an update command (see figure 8)followed by three compare verification data comma nds beginning with byte 1 of the reference data. a successful conclusion of the whol e procedure can be recognized by being able to erase the error counter which is not automatical ly erased. now write/erase access to all memory areas is possible as long as the operating v oltage is applied. in case of error the whole procedure can be repeated as long as erased counter bits are available. having been enabled, the reference data are allowed to be altered like a ny other information in the eeprom. as shipped, the psc is programmed with a code accor ding to individual agreement with the customer. thus, knowledge of this code is indispens able to alter data.
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 7 - 8/16/2006 total 10 pages figure 8 verification procedure reset modes (1) power-on-reset after connecting the operating voltage to vcc ,i/o is state h. by all means, a read access to an address or an answer-to-reset must be carried out b efore data can be altered. (2) break if rst is set to high during clk in state l any ope ration is aborted and i/o is switched to state h. minimum duration of tres=5us is necessary to trigge r a defined valid reset(figure 9).after break the chip is ready for further operations. t rcs t d9 rst clk i/o figure 9 break failures behavior in case of failures: in case of one of the following failures, the chip sets the i/o to state h after 8 clock pulses at the latest. possible failures: --comparison unsuccessful --wrong command --wrong number of command clock pulses --write/erase access to already protected bytes
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 8 - 8/16/2006 total 10 pages --rewriting and erasing of a bit in the protection memory coding of the chip due to security purposes every chip is irreversibly coded by a scheme. by this way fraud and misuse is excluded. as an example, figures 10 and 1 1 show atr and directory data of structure 1.when delivered, atr header, icm and ict are progr ammed. depending on the agreement between the customer and shanghai belling co. ltd. iccf, the chip type and other content can be also programmed before delivery. aid:application identifier ap:application personalizer identifier h1,h2:atr protocol bytes h3,h4:atr historical bttes ld:length of application template la:length of aid iccsn:ic card serial number iccf:ic card fabricator identifier tt:tag of application data tm:tag of manufacturer data td:tag of discretionary data ta:tag of aid lt:length of application template lm:length of manufacturer data dir:directory atr:answer-to-reset icm:ic manufacturer identifier ict:ic type atr header atr data dir data application h1 h2 h3 h4 tm lm icm ict iccf iccsn tt lt ta la aid td ld file ap lm lt la ld figure 10 synchronous transmission atr and director y data of structure1 figure 11 answer-to-reset for synchronous transmiss ion coding of structure b8 b7 b6 b5 b4 b3 b2 b1 b8 b7 b6 b5 b4 b3 b2 b1 b8 b7 b6 b5 b4 b3 b2 b1 b8 b7 b 6 b5 b4 b3 b2 b1 1 0 1 0 0 0 1 0 0 0 0 1 0 0 1 1 0 0 0 1 0 0 0 0 1 0 0 1 0 0 0 1 rfu (2 ) xx b8=1 b7-b1= b8=0 b7-b1= 00= 000= 001=128 010=256 011=512 100=1024 101=2048 110=4096 111=rfu 0: 1: 1: 0: protocol bytes according to iso 7816-3 historical by tes acoording to iso 7816-4 protocol type h1 protocol parameter h2 category indicator h3 dir data reference h4 protocol type rfu structure indentifier no indication number of data units length of data units in bits category indicator according to iso 7816-4 reference of dir data outside the scope of 7816-4 0-7 =defined by iso 8-e = notdel. by iso 8= serial data access protocol 9=3 wire bus protocol a=2 wire bus protocol f=rfu dir data reference specified dir data reference not specified read to end read with defined length defined by iso not defined by iso 10=structure 1 01=structure 2 11=structure 3
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 9 - 8/16/2006 total 10 pages electrical parameter absolute maximum ratings limit values parameter symbol min. typ. max unit test condition supply voltage v cc -0.3 6.0 v input voltage (any pin) v i -0.3 6.0 v storage temperature t s -40 125 power comsumption pt - 70 mw operation temperature -35 70 dc characteristics limit values parameter symbol min. typ. max unit test condition supply voltage v cc 3.0 5.0 5.5 v supply current i cc 3 10 ma high-level input voltage (i/o,clk,rst) v ih v cc -1 - v cc +0.3 v low-level input voltage (i/o,clk,rst) v il v gnd -0.2 - v gnd +0.8 v high-level input current (i/o,clk,rst) i h - - 50 m a low-level output current (i/o) i ol 1 - - ma v ol =0.4v,open drain high-level leakage current (i/o) i oh - - 50 a v oh = v cc ,open drain input capacitance c i - - 10 pf ac characteristics parameter limit values test condition symbol min. typ. max unit clock frequency clk 7 50 ??? clock high period t h 9 m s clock low period t l 9 m s rise time t r 1 m s fall time t f 1 m s hold time start condition t d1 4 m s delay time t d2 2.5 m s setup time for stop condition t d3 4 m s setup time t d4 4 m s hold time data t d5 1 m s answer to reset t d6 20 m s setup time data t d7 1 m s setup time for start condition t d78 4 m s reset t res 5 m s delay time t dg 2.5 m s eraser time t er 2.5* ms write time t wr 2.5* ms time before new start condition t buf 10 m s *f =50 khz
BL7442LV low voltage intelligent 2k bits eeprom http://www.belling.com.cn - 10 - 8/16/2006 total 10 pages chip and package gnd i/o BL7442LV v cc select* clk rst * note: select connecting to vcc or floating is a typ e connecting gnd is b type. 14 .2 31 .8 3 ? 35 ?. 15 4.75 11.8 1) 1.42?.05 14.25 i ndex marking c1 r2.2 1) 13 1) 0.58max 8. 9 m 0.16?.03 figure 12 chip and package outlines wire-bonded mod ule m2.2
|
