V4070 EM MICROELECTRONIC-MARIN SA Crypto Contactless Identification Device Features • • • • • • • • • • • • • • On Chip Crypto-Algorithm Two Way Authentication protocol 96 bits of Secret-Key in EEPROM (unreadable) 32 bits of fix Device Identification 30 bits of USER_MEMORY (UM) with read access (OTP) Secret-Key programmable via CID-Interface Lock-Bits to inhibit programming Data Transmission performed by Amplitude Modulation Bit Period = 32 periods of carrier frequency 200 pF on chip Resonant Capacitor (untrimmed) -40 to +85°C Temperature range 115 kHz TO 135 kHz Field Frequency On chip Rectifier and Voltage Limiter No external supply buffer capacitance needed due to low power consumption Typical Operating Configuration Coil 1 V4070 L Coil 2 Typical value of inductance at 125 KHz is 8 mH Figure 1 Description The V4070 is a CMOS integrated circuit intended for use in electronic Read/Write RF Transponders. The chip contains an implementation of a crypto-algorithm with 96 Bits of user configurable secret-key contained in EEPROM. It also provides a unique Device Identification of 32 Bits that can never be modified as well as 30 Bits of freely programmable USER-MEMORY. Bits 15 and 14 of word 1 are used as Lock-Bits. The memory can only be accessed for writing or erasing if these two bits have the contents «10» as when they are delivered. The V4070 transmits data to the transceiver by modulating the amplitude of the electromagnetic field, and receives data and commands in a similar way. The coil of the tuned circuit is the only external component required, all remaining functions are integrated in the chip. Pin Assignment COIL 1 V4070 COIL 2 COIL1 COIL2 coil terminal / clock input coil terminal Figure 2 Applications • • High security automotive immobilizer High security hands-free access control 1 V4070 EM MICROELECTRONIC-MARIN SA Absolute Maximum Ratings Handling Procedures Parameter Symb. Min. M a x . Unit Supply voltage V DD -0.3 9.5 V Voltage at remaining Vpin VSS - 0.3 VDD + 0.3 V pins -55 125 °C Storage temp. Tstore Operating temp. Top -40 85 °C Maximum AC peak Current induced on ICOIL -30 30 mA COIL1 and COIL2 Table 1 This device has built-in protection against high static voltages or electric fields; however, anti-static precautions should be taken as for any other CMOS component. Unless otherwise specified, proper operation can only occur when all terminal voltages are kept within the supply voltage range. Stresses above these listed maximum ratings may cause permanent damage to the device. Exposure beyond specified electrical characteristics may affect device reliability or cause malfunction. System Principle Transceiver Data to be sent to transponder Transponder Modulator Coil 1 Antenna Driver Oscillator V4070 Data Decoder Filter & Gain Demodulator Coil 2 Data received from transponder RECEIVE MODE READ MODE Signal on Transponder coil Signal on Transceiver coil Signal on Transceiver coil Signal on Transponder coil RF Carrier Data RF Carrier Data Figure 3 2 V4070 EM MICROELECTRONIC-MARIN SA Electrical Characteristics Operating Conditions VDD = 2.5V VSS = 0V fcoil = 125 kHz Sine wave Parameter Supply voltage Vcoil = 1Vpp Symbol Conditions V DD Read Mode EEPROM write voltage VEE Supply current/read Supply current/read/H Supply current/write Ir d Ir d H Iw r Supply current/write/H Iw r H Modulator voltage drop VON Top = 25°C Min. 2 Typ. Max. 1) 3 Unit V V Read Mode VDD=2.0V Read Mode VDD=5.0V Write Mode VDD=3.0V -40°C<T<85°C Write Mode VDD=5.0V 5 10 50 µA µA µA 80 µA V(Coil1-VSS) & V(Coil2-VSS) Icoil = 100µA 0.5 V V(Coil1-VSS) & V(Coil2-VSS) Icoil = 5mA 2.5 V 230 75 2 2.8 pF ppm/K % V Vpp mVpp µs Resonance capacitor Capacitor temp. coeff Capacitor tolerance/wafer POR level high Clock extractor input min. Clock extractor input max. MONOFLOP delay Cr TKCr TOLCr V prh V clkmin V clkmax Tmono EEPROM data endurance N cy Erase all / Write all EEPROM retention Tret Top = 55°C after 1000 cycles -40°C to 85°C Rising supply Min for clock extraction Max for clock extraction 170 -75 -2 200 2.2 1 50 80 40 1000 cycles 10 years 1) Maximum voltage is defined by forcing 10mA on Coil1-Coil2 Table 2 Timing Characteristics Parameter Power on Reset Time Symbol tpor Conditions Value 600 Unit µs Read Bit Period LIW/ACK/NACK pattern Duration Duration of ID t rdb RF periods 32 periods tpatt trID RF periods RF periods 160 1024 periods periods Divergence-Time Tdiv RF periods 224 periods Authentication-Time WRITE Access Time EEPROM write Time tauth tw a tw e e RF periods RF periods RF periods, VDD = 3V 3744 128 3072 periods periods periods Table 3 RF periods respresent periods of the carrier frequency emitted by the transceiver unit. For example, if 125 kHz is used, the Read bit period would be: 1/125’000*32 = 256µs. 3 V4070 EM MICROELECTRONIC-MARIN SA Block Diagram Serial Data Modulator Encoder +V Coil 1 AC/DC converter Cr Power Control Cs Coil 2 Reset GND Write Enable Clock Extractor Sequencer Data Extractor Command Decoder CryptoAlgorithm Functional Description Pad Name Description 1 3 4 5 6 7 8 COIL2 VSS TST1 TST2 TST3 VDD COIL1 Coil Terminal 2 Negative DC Supply Test 1 connection Test 2 connection Test 3 connection Positive DC Supply Coil Terminal 1 1 EEPROM Figure 4 Pad Description 8 Control Logic 7 6 5 4 3 General The V4070 is supplied by means of an electromagnetic field induced on the attached coil. The AC voltage is rectified in order to provide a DC internal supply voltage. When the DC voltage crosses the Power-On level, the chip will enter the Standby Mode and expect commands. In Standby Mode a continuous sequence of Listen Windows (LIW) is generated. During this time, the crypto-Chip will turn to the Receive Mode (RM) if it receives a valid RM pattern. The chip then expects a command to enter the desired mode of operation. Memory Organisation The 160 bits EEPROM are organised in 10 words of 16 bits. Words 0 and 1 contain the USER_MEMORY and the Lock-Bits LB1 and LB0. Write-Mode can only be entered if LB1=’1' and LB0=’0'. Words 2 and 3 contain the ID that can never be modified. Words 4 through 9 contain the 96 bits of secret key. These bits influence the crypto-algorithm but cannot be read directly. 4 V4070 EM MICROELECTRONIC-MARIN SA Memory Map Bit15 Commands Bit0 word 9 Crypt Key 95 Crypt Key 80 8 Bit 31 Crypt Key 79 Bit Crypt Key064 7 Crypt Key 63 Crypt Key 48 6 Crypt Key 47 Crypt Key 32 5 Crypt Key 31 Crypt Key 16 4 Crypt Key 15 Crypt Key 0 3 ID 31 ID 16 Figure 6 2 ID 15 ID 0 1 LB1,LB0,UM 29 0 UM 15 ID Mode After reception of the command including the parity the chip sends a header consisting of 12 manchester coded ‘1’s followed by 4 manchester coded ‘0’s. Then the chip sends the 32 Bits of ID contained in words 3 and 2 of the EEPROM once, without parity, starting with the MSB of word 3. After completion the chip returns to Standby-Mode. COMMAND BITS 001 1 010 1 011 0 FUNCTION ID-MODE UM-MODE AUTHENTICATION 101 0 WRITE WORD First bit Parity bit Recieved UM 16 UM 0 Figure 5 Standby Mode After a Power-On Reset and upon completion of a command, the chip will execute the Standby Mode, in which it will continuously send LIWs to allow the reader to issue commands. As every LIW has a duration of 160 periods of the RF field the reader can turn to Receive mode every 1.3ms at 125kHz. Receive Mode To change from Standby Mode to another operation the chip has to be brought into Receive Mode. To do this the Transceiver sends to the chip the RM pattern during the 32 clocks of modulated phase in a Listen Window (LIW). The V4070 will stop sending data upon reception of a valid RM. The RM pattern consists of 2 bits “0” sent by the transceiver. The first “0” is to be detected during the 32 periods when the modulation is “ON” in the LIW. Next the V4070 expects a command to specify the operation to be executed. Commands The commands are composed of 4 bits, divided into 3 data bits and 1 even parity bit (total amount of “1’s” is even including the parity bit). There exist 4 different commands. Upon reception of an unknown command or a command with wrong parity the chip will immediately return into Standby Mode. ID Mode t rID Header OUTPUT INPUT LIW 11111111111100D31-D LIW RM Comman 1 bit - 32 T0 periods Data Coded Data T0 = Period of RF carrier frequency Figure 7 UM-MODE In UM-MODE the chip sends LB1 and LB0 followed by the 30 Bits of UM starting with the MSB following the same procedure as in ID-MODE. After completion the chip returns to Standby Mode. 5 V4070 EM MICROELECTRONIC-MARIN SA Authentication In this mode the chip first receives the 56 bits of random number followed by seven bits of divergency bits that the reader should send as “0” followed by 28 Bits of cipher_1 (f(RN)) as authentication of the lock. The chip decides if the authentication is accepted. In this case the V4070 sends a header (12 manchester coded ‘1’s followed by 4 manchester coded ‘0’s). Next 20 Bits of cipher_2 (g(RN)) are sent. Else it sends a single NAK. Upon completion of this command the V4070 returns to Standby Mode. Begin Receive RN (56 Bits) f(RN) valid? N Y Divergency Send header Receive f(RN) (28 Bits) Send NAK Send g(RN) (20 Bits) End Figure 8 Authentication Tauth Tdiv OUTPUT LIW INPUT RM Header Command RN “0000000” g(RN) LIW f(RN) Figure 9 Write Word The Write Word command is followed by the address and data. The address consists of a 5 bit block containing 4 data bits and 1 even parity. The data consists of 4 times 5 bit blocks, each block consisting of 4 data bits and 1 associated even parity bit. One additional block consists of 4 column parity bits and a trailing zero (refer to fig 10). Word Organisation First bit input Data D15 D14 D13 D12 P3 D11 D10 D09 D08 P2 D07 D06 D05 D04 P1 D03 D02 D01 D00 P0 PC3 PC2 PC1 PC0 0 Column Even Parity Address A3 A2 A1 A0 Padd Row Even Parity Last bit input logic "0" Figure 11 First bit recieved Data D15 D14 D13 D12 P3 D11 D10 D09 D08 P2 D07 D06 D05 D04 P1 D03 D02 D01 D00 P0 PC3 PC2 PC1 PC0 "0" Figure 10 After reception of the write command, the address and the data, the V4070 will check the parity and the LockBits. If all the conditions are fullfilled, an Acknowledge pattern (ACK) will be issued, and the EEPROM writing process will start. At the end of programming the chip will send an Acknowledge pattern (ACK). If at least one of the checks fails, the chip will issue a No Acknowledge pattern (NAK) instead of ACK and return to the Standby Mode. The V4070 might also return to the Standby Mode without sending back a NAK if the incomming data is corrupted and/or inconsistent. 6 V4070 EM MICROELECTRONIC-MARIN SA Write Word twee Twa OUTPUT INPUT LIW ACK RM WRITE WORD ADDRESS ACK LIW DATA Figure 12 AC/DC Converter and Voltage Limiter The AC/DC converter is fully integrated on chip and will extract the power from the incident RF field. The internal DC voltage will be clamped to avoid high internal DC voltage in strong RF fields. Write Word Begin DC Output Receive Command Receive Address Receive Data valid ? N V Y Send ACK Write Data Send ACK AC Input Figure 14 Send NAK End Figure 13 Power On Reset When the V4070 with its attached coil will enter an electromagnetic field, the built in AC/DC converter will supply the chip. The DC voltage is monitored and a Reset signal is generated to initialise the logic. The power On Reset is also provided in order to make sure that the chip will start issuing LIWs and be ready to accept commands with a sufficient DC power level. A hysteresis is provided to avoid improper operation at limit level. Clock Extractor The Clock extractor will generate a system clock with a frequency corresponding to the frequency of the RF field. The system clock is fed into a sequencer to generate all internal timings. The clock extractor is optimized for power-consumption, sensitivity and noise-suppression. As the input signal is subject to a large dynamic range due to the amplitude modulation, the clock-extractor may miss clocks or add spurious clocks close to the edges of the RF-envelope. This desynchronisation will not be larger than ± 1 clocks per Bit and must be taken into account when developping reader software. Data Extractor The transceiver generated field will be amplitude modulated to transmit data to the V4070. The Data extractor demodulates the incomming signal to generate logic levels, and decodes the incomming data. Modulator The Data Modulator is driven by the serial data outputted from the memory or the Crypto-Logic which is Manchester encoded. The modulator will draw a large current from both coil terminals, thus amplitude modulating the RF field according to the memory data. 7 V4070 EM MICROELECTRONIC-MARIN SA Communication from Transponder to the Transceiver ( READ MODE) The V4070 modulates the amplitude of the RF field to transmit data to the transceiver. The data is output serially from the EEPROM and manchester encoded. 1 bit 32 periods of RF field 1 bit 1 bit 1 bit 16 periods Data from EEPROM Coded Data Measured on the COIL Figure 15 The V4070 uses different patterns to send status information to the transceiver. Their structure cannot be confused with a bit pattern sequence. These patterns are the Listen Window (LIW) to inform the transceiver that data can be accepted, the Acknowledge (ACK) indicating proper communication and end of EEPROM write, and the No Acknowledge (NAK) when something is wrong. LIW 16 16 64 ACK 32 32 16 16 48 16 NAK 48 16 16 16 48 16 32 16 16 All numbers represent number of periods of RF field Figure 16 Communication from the Transceiver to the Transponder (RECEIVE MODE) The V4070 can be switched to the Receive Mode ONLY DURING A LISTEN WINDOW. The Transceiver is synchronized with the incomming data from the transponder. During the phase when the chip has its modulator “ON” (32 periods of RF), the transceiver has to send a bit “0”. At reception of the first “0”, the chip stops immidiately the LIW sequence and expects then another bit “0” to switch to receive mode. The transceiver and the chip are now synchronized and further data is sent with a bit rate of 32 periods of the RF field. The V4070 turns “ON” its modulator at the beginning of each frame of 32 clock periods corresponding to one bit. To send a logic “1” bit, the transceiver continues to send clocks without modulation. After 16 clocks, the modulation device of the V4070 is turned “OFF” allowing recharge of the internal supply capacitor. To send a logic “0” bit, the transceiver stops sending clocks (100% modulation) during the first half of a bit period (first 16 periods). The transceiver must not turn “OFF” the field earlier than clock 1 of a bit period. It is recommended to turn “OFF” the field after 4 clocks of the bit period. The field is stopped from clock 5 to 16 of the bit period, and then turned “ON” again for the remaining 16 periods. To ensure synchronisation between the transceiver and the transponder, a logic bit set to “0” has to be transmitted at regular intervals. The RM pattern consists of two bits set to “0” thus allowing initial synchronisation. While the transceiver is sending data to the transponder, two different modulations will be observed on both coils. During the first 16 clocks of a bit period, the V4070 is switching “ON” its modulation device causing a modulation of the RF field. This modulation can also be observed on the transceiver’s coil. The transceiver to send a bit “0” will switch “OFF” the field, and this 100% modulation will be observed on the transponder coil. 8 V4070 EM MICROELECTRONIC-MARIN SA Bit Period DATA : "1" "0" "0" "0" "1" "1" Transceiver Coil Transponder Coil Periods of RF field : 16 16 16 16 Modulation induced by the Transponder Modulation induced by the Transceiver * * Recommended : 4 periods Minimum : 1 period Figure 17 Package and Ordering Information Dimensions of PCB Version Chip Dimensions 3556 V4070 528 8.0 COIL1 1289 V4070 1803 COIL2 181 IC Thickness : 280 µm ± 25 µm Dimensions in [µm] 1.0 4.0 Dimensions in [mm] Figure 18 Figure 19 Ordering Information The V4070 is available in chip form: without Bumps V4070 IC For sampling, the following version is available: PCB V4070 - PCB Other packages available on request. EM Microelectronic-Marin SA cannot assume responsibility for use of any circuitry described other than circuitry entirely embodied in an EM Microelectronic-Marin SA product. EM Microelectronic-Marin SA reserves the right to change the circuitry and specifications without notice at any time. You are strongly urged to ensure that the information given has not been superseded by a more up to date version. © 1997 EM Microelectronic-Marin SA, 10/97 Rev. A/188 EM Microelectronic-Marin SA CH-2074 Marin, Switzerland, Tel. +41 32 755 51 11, Fax. +41 32 755 54 03 9