EM MICROELECTRONIC - MARIN SA EM4170 125kHz CRYPTO READ/WRITE Contactless Identification Device Description Features The EM4170 is a CMOS integrated circuit intended for use in electronic Read/Write RF Transponders. The chip contains an implementation of a crypto-algorithm with 96 Bits of user configurable secret-key contained in EEPROM. It also provides a unique Device Identification of 32 bits that can never be modified as well as 94 bits of freely programmable USER-MEMORY. Bits 15 and 14 of word 1 are used as Lock-Bits. The memory can only be accessed for writing or erasing if these two bits have the contents "x0" as when they are delivered. The memory can be unlocked by using the PIN-code command. In that case, the lock-bits are reset from the value "x1" to the value "x0". The EM4170 transmits data to the transceiver by modulating the amplitude of the electromagnetic field, and receives data and commands in a similar way. The coil of the tuned circuit is the only external component required, all remaining functions are integrated in the chip. • • • • • • • • • • • • • • • On Chip Crypto-Algorithm Two Way Authentication 96 bits of Secret-Key in EEPROM (unreadable) 32 bits of fix Device Identification 32 bits of PIN code (unreadable) 94 bits of USER_MEMORY (UM) with read access (OTP) Secret-Key programmable via CID-Interface Lock-Bits to inhibit programming Data Transmission performed by Amplitude Modulation Bit Period = 32 periods of carrier frequency 200pF on chip Resonant Capacitor (untrimmed) -40 to +85°C Temperature range 100 kHz to 150 kHz Field Frequency On chip Rectifier and Voltage Limiter No external supply buffer capacitance needed due to low power consumption Typical Applications • • Anti-counterfeiting High security hands-free access control Typical Operating Configuration COIL1 EM4170 L COIL2 Typical value for inductance L is 8mH at fO = 125 KHz Fig. 1 Copyright 2002, EM Microelectronic-Marin SA 1 www.emmicroelectronic.com EM4170 System Principle Tranceiver Data to be sent to transponder Modulator Transponder Coil1 Antenna Driver Oscillator EM4170 Coil2 Filter and Gain Demodulator Data decoder Data received from transponder RECEIVE MODE READ MODE Signal on Transceiver coil Signal on Transceiver coil Signal on Transponder coil Signal on Transponder coil RF Carrier RF Carrier Data Data Fig. 2 Block Diagram Modulator Encoder Serial Data VPOS_REG VDD Coil1 Cr AC/DC converter Power Control Cs Coil2 GND RESET PWR Clock Extractor Data Extractor Sequencer Control Logic EEPROM CryptoAlgorithm Command Decoder Fig. 3 Copyright 2002, EM Microelectronic-Marin SA 2 www.emmicroelectronic.com EM4170 Absolute Maximun Ratings Parameter Symbol Supply Voltage VPOS-REG (Unregulated) Supply Voltage (regulated) VDD Voltage at remaining pins Excepted COIL1, COIL2 Storage temperature VPIN Operating Conditions Parameter Symbol Min. Operating TOP -40 Temperature Min. -0.3 Max. 9.5 Units V -0.3 5.5 V Maximum coil current ICOIL -10 V Frequency on Coil inputs FCOIL 100 VSS - 0.3 VDD + 0.3 Tstore -55 Electrostatic discharge (Mil-STD-883 C method 3015) VESD 1000 Maximum Current induced on COIL1 and COIL2 ICOIL -30 + 125 Typ. +25 125 Max. Units +85 °C +10 mA 150 kHz °C V + 30 mA Handling Procedure Stresses above these listed maximum ratings may cause permanent damage to the device. Exposure beyond specified electrical characteristics may affect device reliability Electrical parameters and functionality are not guaranteed when the circuit is exposed to light. This device has built-in protection against high static voltages or electric fields; however, anti-static precautions should be taken as for any other CMOS component. Unless otherwise specified, proper operation can only occur when all terminal voltages are kept within the supply voltage range. Electrical Characteristics VDD = VPOS_REG = 2.5V, VSS = 0V, fcoil = 125 kHz Sine wave, Vcoil = 1Vpp, Top = 25°C unless otherwise specified. Parameter Supply Voltage(unregulated) Supply Voltage (regulated) EEPROM read voltage EEPROM write voltage Supply current / read Supply current /write @25°C Supply current / write Modulator voltage drop Resonnance Capacitor Capacitor temp. coeff Capacitor tolerance/wafer POR level high POR level low Symbol VPOS-REG VDD VRD Conditions VPOS_REG = max (note 1) Read Mode (note 2) VEE Ird Read Mode VDD =2.0V Write Mode, VDD =2.5V VON Cr Typ. 2.8 2.0 3.5 Write Mode, VDD =2.6V -40°C<T<85°C VCoil1 - VSS and VCoil2 - VSS Icoil = 100µA VCoil1 - VSS and VCoil2 - VSS Icoil = 5mA 0.30 10 kHz, 100 mVpp 170 -40°C to 85°C -75 -2 Vprl Units V V V V 30 TKCr TOLCr Vprh 0.45 5.0 µA 38 µA 70 µA 0.60 V 2.50 V 200 230 pF Rising Supply 2.0 +75 +2 2.4 ppm/K % V Falling Supply 1.8 2.2 V 50 mVpp Clock extractor input min Vclkmin Min for clock extraction Clock extractor input max Vclkmax Max for clock extraction EEPROM data endurance Ncy EEPROM retention Tret Erase all / Write all Top = 55°C after 100'000 cycles (note 3) Note 1 : Maximum voltage is defined by forcing 10mA on Coil1-Coil2 Note 2 : The circuit is not functional below the POR-level Note 3 : Based on 1000 hours at 150°C Copyright 2002, EM Microelectronic-Marin SA Max. 1) 4.2 2.5 Iwr25 Iwr Min. 3 0.6 0.36 Vpp 100000 cycles 10 years www.emmicroelectronic.com EM4170 Timing Characteristics Parameter Power on Reset Time Symbol tpor Conditions Min. Typ. Max. 600 Unit µs Read Bit Period LIW/ACK/NACK pattern Duration Duration of ID trdb 32 periods tpatt trID 160 1536 periods periods Divergency-Time Tdiv 224 periods Authentication-Time WRITE Access Time EEPROM write time WRITE Access Time of the Lock Bits tauth twa twee twalb 4224 128 3072 672 periods periods periods periods VDD=3V RF periods represent periods of the carrier frequency emitted by the transceiver unit. For example, if 125kHz is used, the Read bit period would be: 1/125'000*32 = 256µs. Functional Description The EM4170 is supplied by means of an electromagnetic field induced on the attached coil. The AC voltage is rectified in order to provide a DC internal supply voltage. When the DC voltage crosses the Power-On level, the chip will enter the Standby Mode and expect commands. In Standby Mode a continuous sequence of Listen Windows (LIW) is generated. During this time, the crypto-Chip will turn to the Receive Mode (RM) if it receives a valid RM pattern. The chip then expects a command to enter the desired mode of operation. Memory Organisation The 256 bits EEPROM are organised in 16 words of 16 bits. Words 0 and 1 contain the USER_MEMORY_1 and the Lock-Bits LB1 and LB0. Words 12, 13, 14 and 15 contain the USER_MEMORY_2. Write-Mode can only be entered if LB0 = "0" (LB1= "X"). Words 2 and 3 contain the ID that can never be modified. Words 4 through 9 contain the 96 bits of secret key. These bits influence the crypto-algorithm but cannot be read directly. Words 11 and 12 contain the 32 bits of PINCode. These two words can be written when the lock bits are in unlocked state. They cannot be read out as for the secret key. Copyright 2002, EM Microelectronic-Marin SA 4 www.emmicroelectronic.com EM4170 Memory Map Bit15 Bit0 word 15 UM2 63 UM2 48 14 Bit 31 UM2 47 Bit UM2 32 0 13 UM2 31 UM2 16 12 UM2 15 UM2 11 PIN PIN 16 10 PIN 15 PIN 9 Crypt Key 95 Crypt Key 80 8 Crypt Key 79 Crypt Key 64 7 Crypt Key 63 Crypt Key 48 6 Crypt Key 47 Crypt Key 32 5 Crypt Key 31 Crypt Key 16 4 Crypt Key 15 Crypt Key 0 3 ID 31 ID 16 2 ID 15 ID 0 1 LB1,LB0,UM1 29 UM1 16 0 UM1 15 UM1 0 31 0 0 Fig. 4 Standby Mode After a Power-On Reset and upon completion of a command, the chip will execute the Standby Mode, in which it will continuously send LIWs to allow the reader to issue commands. As every LIW has a duration of 160 periods of the RF field the reader can turn to Receive mode every 1.3ms at 125kHz. Receive Mode To change from Standby Mode to another operation the chip has to be brought into Receive Mode. To do this the Transceiver sends to the chip the RM pattern during the 32 clocks of modulated phase in a Listen Window (LIW). The EM4170 will stop sending data upon reception of a valid RM. The RM pattern consists of 2 bits "0" sent by the transceiver. The first "0" is to be detected during the 32 periods when the modulation is "ON" in the LIW. Next the EM4170 expects a command to specify the operation to be executed. Copyright 2002, EM Microelectronic-Marin SA 5 www.emmicroelectronic.com EM4170 Commands The commands are composed of 4 bits, divided into 3 data bits and 1 even parity bit (total amount of "1's" is even including the parity bit). There exist 6 different commands. Upon reception of an unknown command or a command with wrong parity the chip will immediately return into Standby Mode. Commands FUNCTION COMMAND BITS 001 1 010 1 011 0 ID-MODE UM-MODE-1 AUTHENTICATION 101 0 WRITE WORD 100 1 SEND PIN 111 1 UM-MODE-2 Parity bit First bit Recieved Fig. 5 ID Mode After reception of the command including the parity the chip sends a header consisting of 12 Manchester coded '1's followed by 4 Manchester coded '0's. Then the chip sends the 32 Bits of ID contained in words 3 and 2 of the EEPROM once without parity starting with the MSB of word 3. After completion the chip returns to Standby-Mode. trID Header OUTPUT INPUT 1111111111110000 LIW RM D31-D0 LIW Command 1 bit - 32 T0 periods Data Coded Data T0 = Period of RF carrier frequency Fig. 6 UM-MODE-1 In UM-MODE-1 the chip sends LB1 and LB0 followed by the 30 Bits of UM1 starting with the MSB following the same procedure as in ID-MODE. After completion the chip returns to Standby Mode Copyright 2002, EM Microelectronic-Marin SA 6 www.emmicroelectronic.com EM4170 Authentication In this mode the chip first receives the 56 bits of random number followed by a certain number of divergency bits that the reader should send as "0" followed by 28 Bits of cipher_1 (f(RN)) as authentication of the lock. The chip decides if the authentication is accepted. In this case the EM4170 sends a header (12 Manchester coded '1's followed by 4 Manchester coded '0's). Next 20 Bits of cipher_2 (g(RN)) are sent. Else it sends a single NAK. Upon completion of this command the EM4170 returns to Standby Mode. Begin Receive RN (56 Bits) f(RN) valid? N Y Divergency Send header Receive f(RN) (28 Bits) Send NAK Send g(RN) (20 Bits) End Fig. 7 Tauth Tdiv OUTPUT INPUT LIW RM Header Command RN “0000000” g(RN) LIW f(RN) Fig. 8 Write Word The Write Word command is followed by the address and data. The address consists of a 5 bit block containing 4 data bits and 1 even parity. The data consists of 4 times 5 bit blocks, each block consisting of 4 data bits and 1 associated even parity bit. One additional block consists of 4 column parity bits and a trailing zero (refer to fig 10). Address A3 A2 A1 A0 Padd First bit received Data D15 D14 D13 D12 P3 D11 D10 D09 D07 P2 D07 D06 D05 D04 P1 D03 D02 D01 D00 P0 PC3 PC2 CP1 PC0 "0" Fig. 9 Copyright 2002, EM Microelectronic-Marin SA 7 www.emmicroelectronic.com EM4170 Word Organisation Data First bit input Row Even Parity D15 D14 D13 D12 P3 D11 D10 D09 D08 P2 D07 D06 D05 D04 P1 D03 D02 D01 D00 P0 PC3 PC2 PC1 PC0 0 Column Even Parity Last bit input logic "0" Fig. 10 After reception of the write command, the address and the data, the EM4170 will check the parity and the Lock-Bits. If all the conditions are fulfilled, an Acknowledge pattern (ACK) will be issued, and the EEPROM writing process will start. At the end of programming the chip will send an Acknowledge pattern (ACK). If at least one of the checks fails, the chip will issue a No Acknowledge pattern (NAK) instead of ACK and return to the Standby Mode. The EM4170 might also return to the Standby Mode without sending back a NAK if the incoming data is corrupted and/or inconsistent. As there is no check of the power supply before writing, the system has to assure that there is enough power received by the tag (VDD≥2.6V), when performing the write command. Write word twee Twa OUTPUT INPUT LIW RM ACK WRITE WORD ADDRESS ACK LIW DATA Fig. 11 Write Word Begin Receive Command Receive Address Receive Data valid ? N Y Send ACK Write Data Send ACK Send NAK End Fig. 12 Copyright 2002, EM Microelectronic-Marin SA 8 www.emmicroelectronic.com EM4170 SEND PIN In this mode after reception of the command, the chip receives the 32 bits of the ID and the 32 bits of the PIN. If the received data are valid, the chip will answer an ACK and write the lock bit LB0 to 0; then it will send back the header (12 « 1 » and 4 « 0 ») followed by the ID. Then the chip returns to Stand-by Mode. If the ID or the PIN are not valid, the chip sends back a NACK and return to Stand-by Mode. The EM4170 might also return to Stand-by Mode without sending back a NAK if the incoming data is corrupted and / or inconsistent. As there is no check of the power supply before writing, the system has to assure that there is enough power received by the tag (VDD≥2.6V), when performing the send pin command. After a successful SEND PIN command, it is recommended to check the content of the word 1 with the UM1 command. Begin Receive Command valid ? N Y Receive ID Send ACK Receive PIN Write LB0=0 Send header Send NAK Send ID End End Twee Twalb OUTPUT INPUT LIW RM ACK command ID header ID LIW PIN Fig. 13 UM-MODE-2 In UM-Mode-2 the chip sends the 64 bits of UM2. It starts with MSB of Word 15 and finishes with LSB of Words 12. The chip is using the same procedure than in ID-Mode, by sending the header before the data bits. After completion the chip returns to Stand-by Mode. Copyright 2002, EM Microelectronic-Marin SA 9 www.emmicroelectronic.com EM4170 Power On Reset When the EM4170 with its attached coil will enter an electromagnetic field, the built in AC/DC converter will supply the chip. The DC voltage is monitored and a Reset signal is generated to initialise the logic. The power On Reset is also provided in order to make sure that the chip will start issuing LIWs and be ready to accept commands with a sufficient DC power level. An hysteresis is provided to avoid improper operation at limit level. AC/DC Converter and Voltage Limiter The AC/DC converter is fully integrated on chip and will extract the power from the incident RF field. The internal DC voltage will be clamped to avoid high internal DC voltage in strong RF fields. DC Output V AC Input Fig. 14 Clock Extractor The Clock extractor will generate a system clock with a frequency corresponding to the frequency of the RF field. The system clock is fed into a sequencer to generate all internal timings. The clock extractor is optimised for power-consumption, sensitivity and noise-suppression. As the input signal is subject to a large dynamic range due to the amplitude modulation, the clock-extractor may miss clocks or add spurious clocks close to the edges of the RF-envelope. This de-synchronisation will not be larger than ± 1 clocks per Bit and must be taken into account when developing reader software. Data Extractor The transceiver-generated field will be amplitude modulated to transmit data to the EM4170. The Data extractor demodulates the incoming signal to generate logic levels, and decodes the incoming data. Modulator The Data Modulator is driven by the serial data outputted from the memory or the Crypto-Logic which is Manchester encoded. The modulator will draw a large current from both coil terminals, thus amplitude modulating the RF field according to the memory data. Communication from Transponder to the Transceiver (READ MODE) The EM4170 modulates the amplitude of the RF field to transmit data to the transceiver. The data is output serially from the EEPROM and Manchester encoded. 1 bit 32 periods of RF field 1 bit 1 bit 1 bit 16 periods Data from EEPROM Coded Data Measured on the COIL Fig. 15 The EM4170 uses different patterns to send status information to the transceiver. Their structure cannot be confused with a bit pattern sequence. These patterns are the Listen Window (LIW) to inform the transceiver that data can be accepted, Copyright 2002, EM Microelectronic-Marin SA 10 www.emmicroelectronic.com EM4170 the Acknowledge (ACK) indicating proper communication and end of EEPROM write, and the No Acknowledge (NAK) when something is wrong. LIW 16 16 64 ACK 32 32 16 16 48 16 NAK 48 16 16 16 48 16 32 16 16 All numbers represent number of periods of RF field Fig. 16 a Fig. 16 b Fig. 16 c Communication from the Transceiver to the Transponder (RECEIVE MODE) The EM4170 can be switched to the Receive Mode ONLY DURING A LISTEN WINDOW. The Transceiver is synchronised with the incoming data from the transponder. During the phase when the chip has its modulator "ON" (32 periods of RF), the transceiver has to send a bit "0". At reception of the first "0", the chip stops immediately the LIW sequence and expects then another bit "0" to switch to receive mode. The transceiver and the chip are now synchronised and further data is sent with a bit rate of 32 periods of the RF field. The EM4170 turns "ON" its modulator at the beginning of each frame of 32 clock periods corresponding to one bit. To send a logic "1" bit, the transceiver continues to send clocks without modulation. After 16 clocks, the modulation device of the EM4170 is turned "OFF" allowing recharge of the internal supply capacitor. To send a logic "0" bit, the transceiver stops sending clocks (100% modulation) during the first half of a bit period (first 16 periods). The transceiver must not turn "OFF" the field earlier than clock 1 of a bit period. It is recommended to turn "OFF" the field after 4 clocks of the bit period. The field is stopped from clock 5 to 16 of the bit period, and then turned "ON" again for the remaining 16 periods. To ensure synchronisation between the transceiver and the transponder, a logic bit set to "0" has to be transmitted at regular intervals. The RM pattern consists of two bits set to "0" thus allowing initial synchronisation. While the transceiver is sending data to the transponder, two different modulations will be observed on both coils. During the first 16 clocks of a bit period, the EM4170 is switching "ON" its modulation device causing a modulation of the RF field. This modulation can also be observed on the transceiver's coil. The transceiver to send a bit "0" will switch "OFF" the field, and this 100% modulation will be observed on the transponder coil. Copyright 2002, EM Microelectronic-Marin SA 11 www.emmicroelectronic.com EM4170 Communication from the Transceiver to the Transponder Bit Period DATA : "1" "0" "0" "1" "0" "1" Transceiver Coil Transponder Coil Periods of RF field : 16 16 16 16 * Modulation induced by the Transceiver * Recommended : 4 periods Minimum : 1 period Modulation induced by the Transponder Fig. 17 Pad Assignment Pin Name 1 COIL1 2 VPOS 3 VDD 4 TEST_OUT 5 TEST 6 TEST_CLK 7 VSS 8 COIL2 Pad Location Description Coil connection Unregulated positive supply Positive supply Test pad output Test pad with pull down Test pad with pull down Negative supply coil connection Fig. 18 Copyright 2002, EM Microelectronic-Marin SA 12 www.emmicroelectronic.com EM4170 Packages CID Package PCB Package FRONT VIEW Y K J TOP VIEW B D Z MARKING AREA A SYMBOL A B D e F g J K R MIN 8.2 3.8 5.8 0.38 1.25 0.3 0.42 0.115 0.4 TYP 8.5 4.0 6.0 0.5 1.3 0.4 0.44 0.127 0.5 MAX 8.8 4.2 6.2 0.62 1.35 0.5 0.46 0.139 0.6 X C2 Dimensions are in mm R SYMBOL MIN TYP X 8.0 Y 4.0 Z Dimensions are in mm e C2 C1 F F C1 g Fig. 19 MAX 1.0 Fig. 20 Ordering Information Bit Coding Part Number EM4170A5WW11 EM4170A5WW11E EM4170A5WS7 EM4170A5WT11E EM4170A5CI2LB EM4170A5CB2RC Manchester Manchester Manchester Manchester Manchester Manchester Cycle Bit 32 32 32 32 32 32 Package / Die Form Delivery Form / Bumping unsawn wafer, 11mils thickness unsawn wafer, 11mils thickness sawn wafer on frame, 7mils thickness die on sticky tape, 11mils thickness CID package, 2 pins (length 2.5mm) PCB package No bump Gold bumps No bump Gold bumps Tape Bulk For other packages, please contact EM Sales Product Support Check our Web Site under Products/RF Identification section. Questions can be sent to [email protected] A special development kit exists with embedded co-crypt processor. command. This tool is mandatory to use authentication EM Microelectronic-Marin SA cannot assume responsibility for use of any circuitry described other than circuitry entirely embodied in an EM Microelectronic-Marin SA product. EM Microelectronic-Marin SA reserves the right to change the circuitry and specifications without notice at any time. You are strongly urged to ensure that the information given has not been superseded by a more up-to-date version. © EM Microelectronic-Marin SA, 03/02 Rev. B/424 Copyright 2002, EM Microelectronic-Marin SA 13 www.emmicroelectronic.com