ICs for Chip Cards SLE 4432/42 Intelligent 256-Byte EEPROM SLE 4440 Intelligent 64-Byte EEPROM SLE 4441 Intelligent 128-Byte EEPROM Data Sheet 09.98 Extension SLE 4432/40/41/42 Data Sheet Extension Revision History: Original Version 09.98 Previous Releases: Page Subjects (changes since last revision) Important: For further information please contact: Siemens Semiconductor Group in Munich, Germany, Security & Chip Card ICs, Fax +49 89 636-22360 The supply of this component does not include a license for its use in smart card applications. This license is due to INNOVATRON Patents 137 Boulevard de Sébastopol, 75002 Paris, France, Fax +33 1 4013 3909 Published by Siemens AG, Bereich Halbleiter, HL CC Applications Group Balanstr. 73, D-81541 München © Siemens AG 1998. All Rights Reserved. Attention please! As far as patents or other rights of third parties are concerned, liability is only assumed for components, not for applications, processes and circuits implemented within components or assemblies. The information describes the type of component and shall not be considered as assured characteristics. Terms of delivery and rights to change design reserved. For questions on technology, delivery, and prices please contact the Semiconductor Group Offices in Germany or the Siemens Companies and Representatives world-wide (see address list). Due to technical requirements components may contain dangerous substances. For information on the types in question please contact your nearest Siemens Office, Semiconductor Group. Siemens AG is an approved CECC manufacturer. Packing Please use the recycling operators known to you. We can also help you – get in touch with your nearest sales office. By agreement we will take packing material back, if it is sorted. You must bear the costs of transport. For packing material that is returned to us unsorted or which we are not obliged to accept, we shall have to invoice you for any costs incurred. Components used in life-support devices or systems must be expressly authorized for such purpose! Critical components1) of the Semiconductor Group of Siemens AG, may only be used in life-support devices or systems2) with the express written approval of the Semiconductor Group of Siemens AG. 1) A critical component is a component used in a life-support device or system whose failure can reasonably be expected to cause the failure of that life-support device or system, or to affect its safety or effectiveness of that device or system. 2) Life support devices or systems are intended (a) to be implanted in the human body, or (b) to support and/or maintain and sustain human life. If they fail, it is reasonable to assume that the health of the user may be endangered. SLE 4432 SLE 4442 SLE 4440 SLE 4441 Intelligent 256-Byte EEPROM with Write Protect Function SLE 4432 Intelligent 256-Byte EEPROM with Write Protect Function and Programmable Security Code (PSC) SLE 4442 Features • 256 x 8-bit EEPROM organization • Byte-wise addressing • Irreversible byte-wise protection of lowest 32 addresses (Byte 0...31) • 32 x 1-bit organization of protection memory • Two-wire link protocol • End of processing indicated at data output • Ambient temperature TA -35... +80°C • Supply voltage 5 V −5 / +10 % • Supply current < 10 mA • EEPROM programming time 5 ms • ESD protection typical 4000 V • Endurance minimum 105 write/erase cycles / bit1) • Data retention for minimum of 10 years1) • Contact configuration and Answer-to-Reset (synchronous transmission) in accordance to ISO standard 7816 M3 Additional Feature of SLE 4442 • Data can only be changed after entry of the correct 3-byte programmable security code Type Ordering Code Package SLE 4432 M3 on request Wire-Bonded Module M3 SLE 4432 C on request Chip SLE 4442 M3 on request Wire-Bonded Module M3 SLE 4442 C on request Chip 1) Values are temperature dependent, for further information please refer to your Siemens Sales Office. Semiconductor Group 3 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 Intelligent 64-Byte EEPROM with Write Protect Function and Programmable Security Code (PSC) SLE 4440 Intelligent 128-Byte EEPROM with Write Protect Function and Programmable Security Code (PSC) SLE 4441 • 64 x 8-bit EEPROM organization (SLE 4440) • 128 x 8-bit EEPROM organization (SLE 4441) • Byte-wise addressing • Irreversible byte-wise protection of lowest 32 addresses (Byte 0...31) • 32 x 1-bit organization of protection memory • Two-wire link protocol • End of processing indicated at data output • Ambient temperature TA -35... +80°C • Supply voltage 5 V −5 / +10 % • Supply current < 10 mA • EEPROM programming time 5 ms • ESD protection typical 4000 V • Endurance minimum 105 write/erase cycles / bit1) M3 • Data retention for minimum of 10 years1) • Contact configuration and Answer-to-Reset (synchronous transmission) in accordance to ISO standard 7816 • Data can only be changed after entry of the correct 3-byte programmable security code Type Ordering Code Package SLE 4440 M3 on request Wire-Bonded Module M3 SLE 4440 C on request Chip SLE 4441 M3 on request Wire-Bonded Module M3 SLE 4441 C on request Chip 1) Values are temperature dependent, for further information please refer to your Siemens Sales Office. Semiconductor Group 4 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 Introduction This document describes changes and extensions of the Data Sheet 07.95 of SLE 4432 / SLE 4442. All information of the Data Sheet 07.95 are also valid for SLE 4440 and SLE 4441 (e.g. operational information) except the data mentioned in this document. In detail the following items are added or changed • Memory size SLE 4440 • Memory size SLE 4441 • Ambient temperature TA –35°C…+80°C • ESD protection min. 1500 V, typical 4000 V • Endurance minimum 100000 write/erase cycles / bit • Package: Module M3 • Coding information Especially the transmission protocol (2-wire) and commands are fully compatible for all chip types. 1. Memory Overview The memory is organized in a Main Memory of • 64 byte for SLE 4440 • 128 byte for SLE 4441 • 256 byte for SLE 4432 and SLE 4442 Each of the first 32 bytes of the Main Memory can be irreversibly protected against data change by writing the corresponding bit in the Protection Memory (32 bit). Dependent on the state of the protection bit the memory is read only (ROM) or may be erased and written again (EEPROM). Change of the manufacturer code is only possible by the chip manufacturer. Change of data of the Main Memory and write a bit of the Protection Memory is only possible after a correct verification of the Programmable Security Code (PSC) for SLE 4440, SLE 4441 and SLE 4442. Semiconductor Group 5 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 I/O 224 byte Read Main Memory Write Protection Memory Unprotected Data Memory Update Main Memory Protection Memory (PROM) Read Protection Memory Figure 1 32 byte Protectable Data memory 32 bit Application ID Chip Coding Memory Overview SLE 4432 I/O 224 byte Read Main Memory Write Protection Memory Unprotected Data Memory Security Logic Programmable Security Code 32 bit Error Counter Protection Memory (PROM) Read Protection Memory Figure 2 Update Main Memory 32 byte Protectable Data memory Application ID Chip Coding Memory Overview SLE 4442 Semiconductor Group 6 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 I/O 32 byte Read Main Memory Write Protection Memory Unprotected Data Memory Programmable Security Code 32 byte Protectable Data memory 32 bit Error Counter Protection Memory (PROM) Read Protection Memory Figure 3 Update Main Memory Security Logic Application ID Chip Coding Memory Overview SLE 4440 I/O 96 byte Read Main Memory Write Protection Memory Unprotected Data Memory Security Logic Programmable Security Code 32 bit Error Counter Protection Memory (PROM) Read Protection Memory Figure 4 Update Main Memory 32 byte Protectable Data memory Application ID Chip Coding Memory Overview SLE 4441 Semiconductor Group 7 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 2. Coding SLE 4432, SLE 4442, SLE 4440 and SLE 4441 are delivered with a customer related unique code in order to allow an unambiguous identification of the application. Thus a terminal can clearly accept or reject a card after reading the Answer-to-Reset and the identification data. The Answer-to-Reset (ATR) for synchronous IC cards according to ISO/IEC 7816 is a standardized procedure allowing to identify an IC card (ICC) supporting the synchronous Answer-to-Reset. The Answer-to-Reset data allow an interface device to select the appropriate chip type and operate the ICC according to the data sheet of the chip. Two different coding schemes apply • Extended coding using encoded BER-TLV data objects according to ISO/IEC 7816-4 • 16-bit manufacturer code registered at Pro Electron Both schemes identify the application by the registered application provider identifier RID according to ISO/IEC 7816-5 2.1. Registered Application Provider Identifier RID The application is generally identified by the customer specific 5-byte registered application provider identifier RID according to ISO/IEC 7816-5 using the registration category values ‘A’ and ‘D’. The RID is a part of the AID. Thus the AID is constructed as following: Application identifier AID Registered application provider identifier RID (5 byte) Proprietary application provider identifier extension PIX (≤11 byte) • Registered application provider identifier RID Customer specific RID provided by the registration authority to the applicant RID Meaning ‘A x xx xx xx xx’ International registration ‘D c cc xx xx xx’ National registration ‘c cc’ Country indicator ‘xx xx xx’ Application provider sequence no. Comment RID is registered by Tele Denmark RID is registered by a national authority Country code according to ISO 3166 Provided by national registration authority • Proprietary application provider identifier extension PIX Extension for the RID holder in order to diversify own applications Application forms for a RID are printed in the Annex A of ISO/IEC 7816-5. • For international registration one has to apply at the acting registration authority Tele Denmark for a RID indicated by ‘A’. The contact address is printed in ISO/IEC 7816-5 • For national registration one has to apply at the relevant national standardization body or its acting registration authority for a RID indicated by ‘D’ followed by the country code The RID is provided by the customer to Siemens. Semiconductor Group 8 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 2.2. Extended Coding Scheme Due to the available memory space the coding principle according to ISO/IEC 7816-4 applies for SLE 4432, SLE 4442, SLE 4440 and SLE 4441. Data are coded according to the ASN 1 data objects basic encoding rules using the structure Tag - Length - Value (BER TLV). ATR header ATR data DIR data RID H1 H2 H3 H4 TM LM ICM ICT . . . TA LA Figure 5 Application identifier Answer-to-Reset Directory ATR protocol bytes ATR historical bytes PIX TD LD AID LM AID ATR DIR H1,H2 H3,H4 APPLICATION data LD LA LA LD PIX RID TA TD ... Length of AID Length of application data area Proprietary appl. identifier extension Registered appl. provider identifier Tag of AID = ´4F´ Tag of application data area Structure of a Mono- Application Memory IC Card with a simple DIR-Structure Two coding principles apply • Extended Coding Scheme (Compressed) H1 H2 H3 H4 TM LM ICM ICT TA LA RID PIX • Extended Coding Scheme (according to German Health Insurance) H1 H2 H3 H4 TM LM ICM ICT … TT LT TA LA RID PIX The byte definition is explained in the following: ATR header Byte H1: Protocol type = ‘A2’ indicating two-wire link protocol Byte H2: Protocol parameter Byte H3: Historical byte “Category Indicator” = ‘10’ indicating that the following byte H4 will be a DIR data reference Byte H4: Historical byte “DIR data reference” = a pointer (byte address) to the first byte of the directory section (i.e. TA for Extended Coding Scheme - Compressed or TT for Extended Coding Scheme - according to German Health Insurance) Semiconductor Group 9 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 ATR data section Byte TM: Tag manufacturing data object (‘pre-issuing data’) = ‘46’ Byte LM: Length of manufacturing data Byte ICM: IC manufacturer = ‘05’. For existing applications ICM = ’81’ is still available Byte ICT: IC Type DIR data section The DIR data section contains according to ISO/IEC 7816-5 data objects for application selection. The following variants are possible: • The IC card is a mono application card and only the data object ‘application identifier’ (tag TA = ‘4F’) is present in the DIR data section. È Extended Coding Scheme (Compressed) • The IC card is a mono application card with the data object ‘application template’ (tag TT = ‘61’) in the DIR data section. The application template can contain along with the application identifier (tag TA = ‘4F’) further data objects (e.g. application label - tag ‘50’ or discretionary data - tag ’53’). È Extended Coding Scheme (according to German Health Insurance) Note: Bytes H1, H2, H3, H4, ICM, ICT and the customer specific RID are programmed by Siemens and protected against further changes. 2.3. 16-bit Coding Scheme For applications requiring only a unique coding the following construction applies 2 byte Manufacturer Code 1 byte Manufacturer data 5 byte Registered application provider identifier RID • Manufacturer Code registered at Pro Electron 16-bit code provided by Siemens, fix for SLE 4432, SLE 4442, SLE 4440 and SLE 4441 • Manufacturer data Differentiation of chip types SLE 4432, SLE 4442, SLE 4440 and SLE 4441 • Registered application provider identifier RID Customer specific RID provided by the registration authority to the applicant Note: The above mentioned 8 bytes are programmed by Siemens and protected against further changes. Semiconductor Group 10 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 2.4. Codes Overview SLE 4432, SLE 4442, SLE 4440 and SLE 4441 are available with the coding schemes. Please note that according to ISO/IEC 7816-6 Amendment 1 ICM = ‘05’ for new implementations. For existing applications ICM = ’81’ is still available. It is recommended that terminals accept both IC manufacturer codes. Address Address Meaning Data Data Data Data 0 1 2 3 4 5 0 1 2 3 4 5 H1 H2 H3 H4 TM LM A2 13 10 88 46 02 A2 13 10 88 46 02 A2 03 10 88 46 02 A2 0B 10 88 46 02 Figure 6 Extended Coding Scheme (compressed) Address Address Meaning Data Data Data Data 0 0 H1 A2 A2 A2 A2 Figure 7 Extended Coding Scheme (according to German Health Insurance) Address Meaning Data Data Data Data Figure 8 1 1 H2 13 13 03 0B 2 2 H3 10 10 10 10 7 7 ICT 05 15 17 16 8 9 8 9 TA LA 4F 4F 4F 4F 10 A … 14 15 (dec) … E F (hex) RID PIX RID SLE 4432 RID SLE 4442 RID SLE 4440 RID SLE 4441 3 4 5 6 7 … 17 18 19 20 21 … 25 26 (dec) 3 4 5 6 7 … 11 12 13 14 15 … 19 1A (hex) H4 TM LM ICM ICT TT LT TA LA RID PIX RID 91 05 05 SLE 4432 RID 91 05 15 SLE 4442 RID 91 05 17 SLE 4440 RID 91 05 16 SLE 4441 0 1 Manufacturer Code 31 31 31 31 6 6 ICM 05 05 05 05 74 74 74 74 2 Manufacturer data 01 02 04 08 3 … 7 Registered application provider identifier RID RID RID RID RID SLE 4432 SLE 4442 SLE 4440 SLE 4441 16-bit Coding Scheme The shaded bytes are programmed by Siemens and protected against further changes. Semiconductor Group 11 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 3. Operational Information 3.1. Memory Map SLE 4440 Address (decimal) 64 : 32 31 : 4 3 2 1 0 Main Memory Protection Memory Security Memory Data Byte 64 (D7...D0) : Data Byte 32 (D7...D0) Data Byte 31 (D7...D0) : Data Byte 4 (D7...D0) Data Byte 3 (D7...D0) Data Byte 2 (D7...D0) Data Byte 1 (D7...D0) Data Byte 0 (D7...D0) Protection Bit 31 (D31) : Protection Bit 4 (D31) Protection Bit 3 (D3) Protection Bit 2 (D2) Protection Bit 1 (D1) Protection Bit 0 (D0) Reference Data Byte 3 (D7...D0) Reference Data Byte 2 (D7...D0) Reference Data Byte 1 (D7...D0) Error Counter The Data bytes 0 to 31 can be protected against further changes by programming the associated protection bit 0 to 31. The SLE 4440 allows data changing only after correct verification of the Reference Data bytes. Reading of the Data bytes and of the associated protection bits is always possible. 3.2. Address (decimal) 128 : 32 31 : 4 3 2 1 0 Memory Map SLE 4441 Main Memory Protection Memory Security Memory Data Byte 128 (D7...D0) : Data Byte 32 (D7...D0) Data Byte 31 (D7...D0) : Data Byte 4 (D7...D0) Data Byte 3 (D7...D0) Data Byte 2 (D7...D0) Data Byte 1 (D7...D0) Data Byte 0 (D7...D0) Protection Bit 31 (D31) : Protection Bit 4 (D31) Protection Bit 3 (D3) Protection Bit 2 (D2) Protection Bit 1 (D1) Protection Bit 0 (D0) Reference Data Byte 3 (D7...D0) Reference Data Byte 2 (D7...D0) Reference Data Byte 1 (D7...D0) Error Counter The Data bytes 0 to 31 can be protected against further changes by programming the associated protection bit 0 to 31. The SLE 4441 allows data changing only after correct verification of the Reference Data bytes. Reading of the Data bytes and of the associated protection bits is always possible. Semiconductor Group 12 Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 4. Electrical Characteristics The listed characteristics are ensured over the operating range of the integrated circuit. Typical characteristics specify mean values expected over the production spread. If not otherwise specified, typical characteristics apply at TA = 25°C and the give supply voltage. 4.1. Absolute Maximum Ratings Stresses above those listed may cause permanent damage to the device. This is a stress rating only and functional operation of the device at these or any other conditions above those indicated in the operational sections of this data sheet is not implied. Exposure to absolute maximum rating conditions for extended periods may effect device reliability, including EEPROM data retention and write/erase endurance. Parameter Symbol Limit Values min. ESD protection VS typ. 1500 4000 Unit Test Condition V ISO/IEC 7816-1 max. Endurance (write/erase cycles/bit) 5 10 — Data retention 1) 10 years — 1) 1) Values are temperature dependent, for further information please refer to your Siemens Sales Office. 4.2. Operation Range Parameter Symbol Ambient temperature TA Semiconductor Group Limit Values Unit min. typ. max. -35 +80 °C 13 Test Condition — Data Sheet Extension 09.98 SLE 4432 SLE 4442 SLE 4440 SLE 4441 5. Package Figure 9 Package Outlines Wire-Bonded Module M3 Semiconductor Group 14 Data Sheet Extension 09.98