ICs for Chip Cards SLE 4418 / SLE 4428 Intelligent 8-Kbi t EEPROM Data Sheet 04.94 Published by Semiconductor Group Siemens Aktiengesellschaft Ordering No. B116-H6447-G1-X-7600 Printed in Germany DA 04942. SLE 4418/SLE 4428 Revision History: 04.94 Previous Releases: 09.92 Page Subjects (changes since last revision) Update Data Classification Maximum Ratings Maximum ratings are absolute ratings; exceeding only one of these values may cause irreversible damage to the integrated circuit. Characteristics The listed characteristics are ensured over the operating range of the integrated circuit. Typical characteristics specify mean values expected over the production spread. If not otherwise specified, typical characteristics apply at T A = 25 °C and the given supply voltage. Operating Range In the operating range the functions given in the circuit description are fulfilled. Important: Important: Further information is confidential and on request. Please contact: Siemens Semiconductor Group in Munich, Germany, Marketing Chip Card ICs, Tel.: 089-4144-2058 or 4144-4362 The supply of this component does not include a licence for its use in smart card applications. This licence is due to: INNOVATRON Patents 137 Boulevard de Sébastopol, 75002 Paris, France, Fax 33 (1) 40 13 39 09 This edition was realized using the software system FrameMaker® Published by Siemens AG, Bereich Halbleiter, Marketing-Kommunikation, Balanstraße 73, D-81541 München. © Siemens AG 1994. All Rights Reserved. As far as patents or other rights of third parties are concerned, liability is only assumed for components, not for applications, processes and circuits implemented within components or assemblies. The information describes the type of component and shall not be considered as assured characteristics. Terms of delivery and rights to change design reserved. For questions on technology, delivery and prices please contact the Semiconductor Group Offices in Germany or the Siemens Companies and Representatives worldwide (see address list). Due to technical requirements components may contain dangerous substances. For information on the types in question please contact your nearest Siemens Office, Semiconductor Group. Siemens AG is an approved CECC manufacturer. Packing Please use the recycling operators known to you. We can also help you - get in touch with your nearest sales office. By agreement we will take packing material back, if it is sorted. You must bear the costs of transport. For packing material that is returned to us unsorted or which we are not obliged to accept, we shall have to invoice you for any costs incurred. Intelligent 1-KByte EEPROM with Write Protect Function SLE 4418 Intelligent 1-KByte EEPROM with Write Protect Function and Programmable Security Code (PSC) SLE 4428 Features ● ● ● ● ● ● ● ● ● 1024 x 8 bit EEPROM organization Byte-wise addressing Irreversible byte-wise write protection 1024 x 1 bit protection memory organization Serial three-wire bus End of programming indicated on data output Minimum of 104 write/erase cycles Data retention for minimum of ten years Contact configuration and serial interface in accordance to ISO standard 7816 (synchronous transmission) M2.2 Additional Feature of SLE 4428 ● Data can only be changed after entry of the correct 2-byte programmable security code (PSC) Type Ordering Code Package SLE 4418 C on request Chip SLE 4418 M2.2 on request Wire-Bonded Module M2.2 SLE 4428 C on request Chip SLE 4428 M2.2 on request Wire-Bonded Module M2.2 Semiconductor Group 1 04.94 SLE 4418 SLE 4428 M2 (Card Contacts) Pin Configurations (top view) Pin Definitions and Functions Pin Card Contact Symbol Function 1 C1 VCC Operating voltage 5 V 2 C2 RST Chip control 3 C3 CLK Clock 4 C4 N.C. Not connected 5 C5 GND Ground 6 C6 N.C. Not connected 7 C7 I/O Data line (open drain) 8 C8 N.C. Not connected SLE 4418/4428 comes out as a M2.2 wire-bonded module for embedding in plastic cards or as a die for customer packaging. Semiconductor Group 2 SLE 4418 SLE 4428 Figure 1 Block Diagram Semiconductor Group 3 SLE 4418 SLE 4428 1 Functional Description 1.1 SLE 4418 The chip contains an EEPROM organized 1024 x 8 bit offering the possibility of programmable write protection for each byte. Reading of the whole memory is always possible. The memory can be written and erased byte by byte. Input data and the contents of the adressed byte are compared so that only bits are written which were not written before. Erasing is only possible byte-wise, even if only one bit is to be erased, but bits may be written individually. Each byte can be write/eraseprotected individually by setting a protect bit (EEPROM → ROM). The protect bit is only one time programmable and cannot be erased. 1.2 SLE 4428 Additionally to the above functions this version has a PSC verification logic. All the memory, except for the PSC, can always be read. The memory can be written or erased only after PSC verification. The error counter can always be written. After eight successive incorrect entries the error counter will block any subsequent attempt at PSC verification and hence any possibility to write and erase. 2 Reset and Answer-to-Reset 2.1 Reset When the operating voltage is applied, the chip goes into the power-on reset (POR) state. POR is terminated by reset. Reset is started by RST changing from “0” to “1” and finished by CLK going from “0” to “1”. This reset operation aborts any currently active command. After POR a read operation must be performed before any change of data is possible. 2.2 Answer to Reset (ISO 7816) Answer to reset sets the address counter to “0” and the first data bit appears on the output. The contents of the following addresses can be read out with the following clock pulses. Answer to reset is executed by the following steps (Fig. 2) : – RST goes from “0” to “1”, – clock pulse is applied, – RST changes back from “1” to “0”. 3 Commands The state of RST defines the data direction on I/O. RST I/O 1 Command entry 0 Data output Semiconductor Group 4 SLE 4418 SLE 4428 Figure 2 Reset and Answer-to-Reset The possible commands are listed in table 1. Table 1 Control Words for Command Entry Byte 1 Byte 2 Byte 3 S0 S1 S2 S3 S4 S5 A8 A9 A0-A7 D0-D7 Input data Operation 1 0 0 0 1 1 1 1 0 0 1 1 0 0 0 0 1 1 Address Address Input data Write and erase without protect bit bit bit Comparison Write protect bit with data data comparison (verification) 0 0 1 1 0 0 8 and 9 0 1 1 1 0 0 0–7 Write and erase with protect bit No effect Read 9 bits, data with protect bit No effect Read 8 bits, data without protect bit Figure 3 shows the command entry, whereas the general timing is given in figure 4. Semiconductor Group 5 SLE 4418 SLE 4428 Figure 3 Command Entry Figure 4 General Timing for Data Input, Data Output and PSC Verification Semiconductor Group 6 SLE 4418 SLE 4428 3.1 Write/Erase Operations Write/Erase Data Byte without Protect Bit Remark: Erase means “0” →“1”, write means “1” → “0”. There are three kinds of write/erase operations which are automatically executed by the chip: – Erase and subsequent write (duration 203 clock pulses, f ≤ 20 kHz) (Fig.5) – Write only: This procedure is suitable if single bits of one byte shall be changed only from “1” to “0”. (duration 103 clock pulses, f ≤ 20 kHz) (Fig.6) – Erase only (= FF; duration 103 clock pulses, f ≤ 20 kHz) (Fig.6). Write/Erase Data Byte with Protect Bit The protect bit is erased at delivery, it can be written only once. Write procedure see above. Write Protect Bit with Data Comparison The data has to be entered a second time. The protect bit is only written if the old and the new data are identical. The execution of write/erase commands are terminated internally after a given number of clock cycles. The end of the operation is indicated by the transition from “1” to “0” on I/O. Only RST transition from “0” to “1” sets I/O to state “1”. Figure 5 Programming: Erase and Write Semiconductor Group 7 SLE 4418 SLE 4428 Figure 6 Programming: Only Erase or Only Write 3.2 Read Operations with Address Increment Read Data Byte (Read 8 Bits) (Fig.7) In this operation the output of the protect bit is suppressed. The address is incremented after the eighth clock pulse. Read Data Byte together with Protect Bit (Read 9 Bits) (Fig. 8) After command entry the eight data bits are read out by eight consecutive clock pulses, and the protect bit on the ninth pulse. After the ninth clock pulse the address counter is incremented. The read operation is terminated by a RST transition “0” to “1”. Semiconductor Group 8 SLE 4418 SLE 4428 Figure 7 Read Data Byte: Read 8 Bits, Data D0-D7 Figure 8 Read Data Byte together with Protect Bit: Read 9 Bits, Data D0-D7 and Protect Bit PB Semiconductor Group 9 SLE 4418 SLE 4428 4 Security Features SLE 4428 Extra Operation for User Identification (Fig. 9) Without a PSC entry only reading is possible. The contents of the PSC addresses cannot be read out. If reading is attempted, "00" will appear. The verification procedure of the chip must be performed in the following sequence (Table 1): – – – – write one not written error-counter bit, address "1021", enter first PSC-code byte, address "1022", enter second PSC-code byte, address "1023", after correct input the error counter can be erased. After the PSC verification, I/O goes from "1" to "0". It is switched back to “1” by RST transition “0” to “1”. The error counter is not automatically erased. Writing Error Counter Before PSC entry only writing of the error counter is possible. The number of erased bits of the error counter determines the number of possible attempts (max. 8). After successful access the error counter should be erased before disconnecting the supply voltage in order to reactivate the 8 attempts. Each error when entering the PSC requires the writing of a new counter bit. Entry of PSC The least-significant PSC byte beginning with the least significant bit must be entered first and then the most-significant one. If the internal data comparison proves correct, the EEPROM is enabled for erasing and writing as long as the operating voltage is applied. After enabling, the PSC may be altered as wished, except the corresponding protect bits are "0". Condition when supplied SLE 4428 is only supplied by the producer with a 2-byte PSC (transport code) which is agreed with the customer. Table 1 Control Words for Command Entry, User Identification Byte 1 Byte 2 Byte 3 S0 S1 S2 S3 S4 S5 A8A9 A0-A7 D0-D7 Operation 0 1 0 0 1 1 1 1 253 Bit mask Write error counter 1 0 1 1 0 0 1 1 254 PSC byte 1 Verify 1st PSC byte 1 0 1 1 0 0 1 1 255 PSC byte 2 Verify 2nd PSC byte Semiconductor Group 10 SLE 4418 SLE 4428 Figure 9 PSC Verification 5 Technical Data Absolute Maximum Ratings Parameter Symbol Limit Values min. typ. Unit max. Supply voltage VCC – 0.3 6 V Input voltage VI – 0.3 6 V Storage temperature Tstg – 40 125 °C Power dissipation Ptot 60 mW Operating Range Supply voltage VCC 4.5 5.5 V Ambient temperature TA – 35 100 °C Semiconductor Group 11 SLE 4418 SLE 4428 DC Characteristics Parameter Symbol Limit Values min. typ. max. Unit Supply Supply voltage VCC 4.5 5 5.5 V Supply current ICC – 3 10 mA H input voltage (I/O, CLK, RST) VH 3.5 – VCC V L input voltage (I/O, CLK, RST) VL 0 – 0.8 V H input current (I/O, CLK, RST) IH – – 10 µA L output current (VL = 0.4 V, open drain) IL 0.5 – – mA H leakage current (VH = VDD, open drain) IH – – 10 µA Input capacitance CI – – 10 pF Test pin T Clock frequency fC – 20 – kHz Reset time tRE 9 – – µs Answer to reset (RST) td6 20 50 – µs CLK (count, H level) tH 10 – – µs CLK (count, L level) tL 10 – – µs Write time (f = 20 kHz) tW 5 – – ms Erase time (f = 20 kHz) tE 5 – – ms Setup time (D/CLK) td1 4 – – µs Setup time (CLK/RST) td3 4 – – µs Setup time (RST/CLK) td4 4 – – µs Hold time (D/CLK) td5 4 – – µs Delay time (CLK/D) td2 6 – – µs Rise time (I/O, CLK, RST) tR – – 1 µs Fall time (I/O, CLK, RST) tF – – 1 µs Semiconductor Group 12 Data Input Data Output open or on VSS Pulse Duration AC Characteristics SLE 4418 SLE 4428 Wire-Bonded Module M2.2 Semiconductor Group 13 SLE 4418 SLE 4428 Scribe Line: 80 µm Pad Size: 110 x 110 µm2 Wafer Size: 5” Stepping Size: 2290 x 3220 µm Chip Dimensions Semiconductor Group 14