Product Folder Sample & Buy Support & Community Tools & Software Technical Documents bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 bq26100 SHA-1/HMAC Based Security and Authentication IC with SDQ Interface 1 Features 3 Description • The bq26100 device provides a method to authenticate battery packs, ensuring that only packs manufactured by authorized sub-contractors are used in the end application. The security is achieved using the SHA-1 hash function inside the widely adopted keyed-hash message authentication code (HMAC) construction. A unique 128-bit key is stored in each bq26100 device, allowing the host to authenticate each pack. 1 • • • • • • Provides Authentication of Battery Packs Through SHA-1 Engine Based HMAC 160-Bytes One Time Programmable (OTP), 16Bytes EEPROM Internal Time-Base Eliminates External Crystal Oscillator Low-Power Operating Modes: – Active: < 50 μA – Sleep: 8 μA Typical Single-Wire SDQ Interface Powers Directly From the Communication Bus 6-Lead VSON Package 2 Applications • • • • • • The bq26100 device communicates to the system over a simple one-wire bi-directional serial interface. The 5-kbits/s SDQ bus interface reduces communications overhead in the external microcontroller. The bq26100 device also derives power over the SDQ bus line via an external capacitor. Device Information(1) Cellular Phones PDA and Smart Phones MP3 Players Digital Cameras Internet Appliances Handheld Devices PART NUMBER bq26100 PACKAGE VSON (6) BODY SIZE (NOM) 3.00 mm × 3.00 mm (1) For all available packages, see the orderable addendum at the end of the data sheet. Typical Application Diagram P+ R1 4.7 kW + SDQ bq26100 C1 0.1 mF PWR SDQ VSS VSS VSS VSS Protector BAT VSS OC DO CO P– 1 An IMPORTANT NOTICE at the end of this data sheet addresses availability, warranty, changes, use in safety-critical applications, intellectual property matters and other important disclaimers. PRODUCTION DATA. bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com Table of Contents 1 2 3 4 5 6 7 Features .................................................................. Applications ........................................................... Description ............................................................. Revision History..................................................... Pin Configuration and Functions ......................... Specifications......................................................... 1 1 1 2 3 3 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 3 3 3 4 4 4 5 5 Absolute Maximum Ratings ...................................... ESD Ratings ............................................................ Recommended Operating Conditions....................... Thermal Information ................................................. Electrical Characteristics........................................... Standard Serial Communication (SDQ) Timing ....... OTP Programming Specifications ............................. Typical Characteristics .............................................. Detailed Description .............................................. 7 7.1 Overview ................................................................... 7 7.2 Functional Block Diagram ......................................... 7 7.3 7.4 7.5 7.6 8 Feature Description................................................... 8 Device Functional Modes.......................................... 9 Programming ............................................................ 9 Register Maps ......................................................... 18 Application and Implementation ........................ 20 8.1 Application Information............................................ 20 8.2 Typical Application ................................................. 20 9 Power Supply Recommendations...................... 21 10 Layout................................................................... 22 10.1 Layout Guidelines ................................................. 22 10.2 Layout Example .................................................... 22 11 Device and Documentation Support ................. 23 11.1 11.2 11.3 11.4 Community Resources.......................................... Trademarks ........................................................... Electrostatic Discharge Caution ............................ Glossary ................................................................ 23 23 23 23 12 Mechanical, Packaging, and Orderable Information ........................................................... 23 4 Revision History NOTE: Page numbers for previous revisions may differ from page numbers in the current version. Changes from Revision A (February 2007) to Revision B Page • Added ESD Rating table, Feature Description section, Device Functional Modes, Application and Implementation section, Power Supply Recommendations section, Layout section, Device and Documentation Support section, and Mechanical, Packaging, and Orderable Information section. ................................................................................................ 1 • Changed SON to VSON ........................................................................................................................................................ 1 • Changed formatting of code ................................................................................................................................................ 11 2 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 5 Pin Configuration and Functions DRP Package 6-Pin VSON Top View 1 2 3 1.6 mm Exposed Thermal Pad 3 mm 2.3 mm 6 5 3 mm 4 Pin Functions PIN NAME NO. I/O DESCRIPTION PWR 1 I/O Power capacitor connection SDQ 6 I/O Single wire SDQ interface to host VSS 2, 3, 4, 5 I Ground 6 Specifications 6.1 Absolute Maximum Ratings over operating free-air temperature range (unless otherwise noted) (1) Supply voltage (SDQ all with respect to VSS) MIN MAX –0.3 7.7 V 5 mA Output current (SDQ) UNIT TA Operating free-air temperature –40 85 °C TJ Junction temperature –40 150 °C Tstg Storage temperature –65 150 °C (1) Stresses beyond those listed under Absolute Maximum Ratings may cause permanent damage to the device. These are stress ratings only, which do not imply functional operation of the device at these or any other conditions beyond those indicated under Recommended Operating Conditions. Exposure to absolute-maximum-rated conditions for extended periods may affect device reliability. 6.2 ESD Ratings VALUE V(ESD) (1) (2) Electrostatic discharge Human-body model (HBM), per ANSI/ESDA/JEDEC JS-001 (1) 2000 Charged-device model (CDM), per JEDEC specification JESD22-C101 (2) 1500 UNIT V JEDEC document JEP155 states that 500-V HBM allows safe manufacturing with a standard ESD control process. JEDEC document JEP157 states that 250-V CDM allows safe manufacturing with a standard ESD control process. 6.3 Recommended Operating Conditions over operating free-air temperature range (unless otherwise noted) MIN MAX UNIT Vsdq Pullup voltage 2.5 V TJ Operating free-air temperature range –40 °C Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 3 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com 6.4 Thermal Information BQ26100 THERMAL METRIC (1) DRP (VSON) UNIT 6 PINS RθJA Junction-to-ambient thermal resistance 51.7 °C/W RθJC(top) Junction-to-case (top) thermal resistance 68.9 °C/W RθJB Junction-to-board thermal resistance 24.9 °C/W ψJT Junction-to-top characterization parameter 1.7 °C/W ψJB Junction-to-board characterization parameter 25.1 °C/W RθJC(bot) Junction-to-case (bottom) thermal resistance 4.6 °C/W (1) For more information about traditional and new thermal metrics, see the Semiconductor and IC Package Thermal Metrics application report, SPRA953. 6.5 Electrical Characteristics all parameters over operating free-air temperature and supply voltage range (unless otherwise noted) (memory programming and authentication were tested with R1 = 4.7 kΩ, C1 = 0.1 μF over pullup voltage range) PARAMETER TEST CONDITIONS Power up communication delay Isleep Sleep current Isdq(Vsdq) Vsdq Current MIN Power capacitor charge time TYP UNIT 6.8 OTP Memory programming time EEPROM Programming current (peak current) EEPROM Peak current duration EEPROM Programming time ms 8 11 μA 50 μA 7 7.7 Vsdq ≥ Vsdq(min) OTP Memory programming voltage MAX 100 V 100 μs/byte 83 μA 100 μs 50 ms SDQ VIL Input low-level voltage IOL Output low sink current 0.63 VOL = 0.4 V V 1 mA 6.6 Standard Serial Communication (SDQ) Timing over recommended operating temperature and supply voltage range (unless otherwise noted) (See Figure 1) MIN NOM MAX UNIT tRSTL Reset time – low 480 μs tRSTH Reset time – high 480 μs tPDL Presence detect – low 60 240 μs tPDH Presence detect – high 15 60 μs tREC Recovery time tSLOT Host bit window tLOW1 Host sends 1 tLOW0 Host sends 0 tLOWR Host read bit start tSLOT bq26100 bit window tSU bq26100 data setup tRDV bq26100 data valid tRELEASE bq26100 data release 4 μs 1 120 μs 1 13 μs 60 120 μs 1 13 μs 60 120 μs 1 μs 60 μs exactly 15 0 Submit Documentation Feedback 15 45 μs Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 6.7 OTP Programming Specifications PARAMETER TEST CONDITIONS MIN tpon Program setup time 2 trise Pulse rise time 1 tprog Pulse high time tfall Pulse fall time Single byte programming TYP MAX UNIT μs μs 10 μs 300 Key programming μs 3 1 μs 10 tRSTL tPDL tPDH tRSTH (a) Reset and Presence Timing tLOW1 tREC tLOW0 & tSLOT tSU tREC tLOWR tRELEASE tRDV (b) Host Transmitted Bit Timing tSLOT (c) bq26100 Transmitted Bit Timing Figure 1. SDQ Timing Diagrams 6.8 Typical Characteristics 41.5 8.5 2.5 V 3.0 V 4.0 V 5.0 V 8.1 Sleep Current (PA) Active Current (PA) 41 2.5 V 3.0 V 4.0 V 5.0 V 8.3 40.5 40 7.9 7.7 7.5 7.3 39.5 7.1 39 -40 -20 0 20 40 Temperature (qC) 60 80 90 6.9 -40 D001 Figure 2. Active Current Across SDQ Voltage and Temperature (Not Authenticating) -20 0 20 40 Temperature (qC) 60 80 90 D002 Figure 3. Sleep Current Across SDQ Voltage and Temperature Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 5 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com Typical Characteristics (continued) 232 0.98 2.5 V 3.0 V 4.0 V 5.0 V 0.96 230 Active Current (PA) VIH (V) 0.94 0.92 0.9 0.88 228 226 224 0.86 0.84 -40 -20 0 20 40 Temperature (DC) 60 80 90 222 -40 -20 0 20 40 Temperature (DC) D003 Figure 4. VIH Across SDQ Voltage and Temperature 60 80 90 D004 Figure 5. Active Current Across Temperature (While Authenticating) 378 Peak Current (PA) 375 372 369 366 363 360 -40 -20 0 20 40 Temperature (DC) 60 80 90 D005 Figure 6. Peak Current Across Temperature (While Authenticating) 6 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 7 Detailed Description 7.1 Overview The bq26100 device is a small memory device for battery packs or accessories. The device contains a mix of One Time Programmable (OTP) and multi-write EEPROM non-volatile memory with authentication functions that can be used to validate the battery/accessory for usage in the host system. The memory consists of five 32-byte pages of general use OTP non-volatile memory and a 16-byte page of EEPROM to be used at the host system designer’s discretion. An external high voltage is required for programming the OTP, but is not necessary for programming the EEPROM. 7.2 Functional Block Diagram PWR EEPROM - Charge Pump Power Retification DTOP - SHA-1/HMAC - SDQ - Ctrl and Status Registers OTP ATOP - Oscillator - LDO - POR - OTP Power Comparator VSS SDQ Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 7 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com 7.3 Feature Description 7.3.1 Non-Volatile Memory The bq26100 device has a bq2022 compatible memory and command structure with new commands to access added memory. The bq26100 device uses a combination of non-volatile OTP and non-volatile EEPROM. The OTP should be programmed in the factory as an external voltage is required to program the bits; the EEPROM can be programmed in the field, with the programming voltage generated automatically by an internal-charge pump. Four pages of 32x8-bits OTP are accessed with the bq2022 compatible command set, while a fifth page of 32x8bits are accessed with a new command set. Each page of OTP can be locked once programmed, blocking further writes to the page. There is an additional provision to allow for page redirection at the host in the event that a page is programmed incorrectly. The redirection is not automatic, but a host system can determine where a page redirection is occurring and read the appropriate page for uncorrupted data. The EEPROM consists of 16x8-bits that can be written in the same way as for RAM-based volatile memory. The timing of the writes is different than writing to RAM to allow for the internal charge pump to create the voltage necessary to set the bit values. 7.3.2 Authentication The bq26100 device contains a SHA-1 engine to generate a modified version of the FIPS 180 HMAC. The authentication uses a challenge or public message transmitted from the host and a secret key stored on the bq26100 device to generate a 160-bit hash that will be unique. The contents of the challenge are unimportant, but each challenge should be generated randomly to improve the security of the authentication. To compute the HMAC, let H designate the SHA-1 hash function, M designate the message transmitted to the bq26100 device, and KD designate the unique 128 bit device key of the device. HMAC(M) is defined as: H[KD || H(KD || M)] where • || symbolizes an append operation (1) The message, M, is appended to the device key, KD, and padded to become the input to the SHA-1 hash. The output of this first calculation is then appended to the device key, KD, padded again, and cycled through the SHA-1 hash a second time. The output is the HMAC digest value. The secret key is stored in separate OTP available in bq26100. The key space is split into two 64-bit spaces that can be programmed and locked at separate times, providing an opportunity to split the key between two different programming entities to ensure that no key leak can occur from a single source. 7.3.3 Communication and Power The bq26100 device uses a single-wire communication protocol, SDQ, that allows for broadcast or targeted communication to a number of devices on the one-wire bus. Each device is programmed with a unique 64-bit address and the protocol consists of an automatic arbitration scheme that allows the host to determine the ID of every device on the bus. The bq26100 device takes advantage of the pullup on the SDQ line to power a capacitor connected to the PWR pin and the charge on this capacitor is used parasitically when the SDQ line is low. As a result, there is no need for additional power to be supplied to the device. 8 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 7.4 Device Functional Modes 7.4.1 Profile Command Pack manufacturers can use the profile command to determine how the device should be programmed. Profile M/F = 0x99 Master RX: 0x55 ROM Function Flow Figure 7. Profile Command Flow 7.4.2 Sleep Mode Description The bq26100 device enters sleep mode when the SDQ enters a stop state or when SDQ encounters an invalid ID. 7.5 Programming 7.5.1 Communicating with the bq26100 Device The bq26100 device communication protocol starts when the host pulls the bus low for reset time. All devices on the bus are to respond with a presence pulse, which is active low. The host can then transmit the ROM Function command, which is used to address the devices on the bus. The ROM functions include Match ID, Skip ID, Read ID, and Search ID. Match ID The host transmits the 64-bit ID of the 1-wire based device to communicate. Skip ID No ID is necessary for communication. Used only if one device is connected to the host. Read ID The 1-wire slave transmits its 64 bit address. This command is only useful if there is only one device connected to the host. Search ID Useful if there are multiple devices on the bus. This command initiates a communication with a single device, but it is more useful in allowing the host to determine the address of every device on the bus. The Match ID can then be used to communicate with a specific addressed device. Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 9 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com Programming (continued) ROM Function Flow Host Transmits Reset? YES NO bq26100 Transmits Presence Host Transmits R/F NO bq26100 Transmits 1 For Each Bit Start R/F = 0x55? Match ID YES Host Transmits ID (LSB to MSB) ID Match? YES NO R/F = 0xCC? Skip ID Memory Function Flow YES NO R/F = 0x33? Read ID bq26100 Transmits ID (LSB to MSB) YES NO R/F = 0xF0? Search ID n=0 YES NO bq26100 Transmits ID Bit n n=n+1 bq26100 Transmits ID Bit n Host Transmits ID Bit n NO n = 63? Bit n Match? YES YES NO Figure 8. ROM Function Flow Chart The 64-bit device ID is made up of an 8-bit family code, 48-bit random value, and a final 8-bit CRC (see Table 1). Table 1. Format of 64-bit Device ID ID MSB CRC (8 bits) ID LSB Random Data (48 bits) Family Code (8 bits, defaults to 0x09) Contact Texas Instruments if specific data should be programmed into the ID. After the ROM function command is issued and the bq26100 device is selected, a Memory Function command can be issued. The Memory Function commands are Read Memory, Read EEPROM, Read Status, Read Page, Read Page 4, Read Digest, Read Control, Write Memory, Write Page 4, Write EEPROM, Write Status, Write Message, Write Control, and Profile. Figure 9 shows the flow for the Memory Function selection. Figure 12 through Figure 15 illustrate the flow for each memory function. 10 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 Memory Function Flow NO M/F = 0xF0? YES Read Memory Flow NO M/F = 0x0F? Write Memory Flow YES NO YES Read Page Flow YES Read Digest Flow M/F = 0xC3? NO M/F = 0xDD? NO M/F = 0x22? Write Message Flow YES YES NO NO M/F = 0xFA? Read Status Flow M/F = 0xAA? YES YES Read Page 4 Flow NO NO M/F = 0x55? Profile Flow M/F = 0x99? Write Status Flow YES M/F = 0xAF? YES Write Page 4 Flow NO NO ROM Function Flow Read Control Flow M/F = 0x88? YES NO M/F = 0x77? Write Control Flow YES NO M/F = 0xE0? YES Read EEPROM Flow NO M/F = 0x0E? YES Write EEPROM Flow NO Figure 9. Memory Function Flow Chart The SDQ protocol requires a CRC calculation as part of the communication flow. The CRC, based on a polynomial of x8+x5+x4+1, is computed to determine data integrity and its use varies in the protocol. The Memory Function flows show what data are shifted through the CRC and when the value is transmitted from the slave. Each data byte used in the CRC calculation is pushed through the CRC shift register from LSB to MSB. The byte wide CRC computation is: for (i = 0; i < 8; i++) { if (crc[0] ^ input[i]) crc = (crc >> 1) ^ 0x8C; else crc = crc >> 1; } Where did the magic number 0x8C come from? CRC polynomials are defined such that the highest order simply shows the number of bits, so x8+x5+x4+1 defines an 8-bit value with a binary value of 00110001 (bits 0, 4, and 5 are 1 and all others are 0). Since the SDQ CRC is computed by shifting in the LSB, the polynomial must be used in reverse bit order – binary 10001100 or hexadecimal 0x8C. The CRC value is reset to 0 prior to the first byte being shifted through. The CRC is also reset when the CRC is shifted out as part of the SDQ protocol. Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 11 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com Vprog Last bit before programming pulse Vpull-up GND Programming Pulse tpon Figure 10. bq26100 Device Communication to OTP Programming Pulse Diagram trise tprog tfall Figure 11. OTP Programming Pulse Detail 7.5.2 Memory Descriptions The bq26100 device has a memory and command structure that is compatible with the bq2022, however additional memory and commands have been added. The bq26100 device uses a combination of non-volatile One-Time-Programmable (OTP), non-volatile EEPROM, and volatile registers. The memory is split into the following sections: 7.5.2.1 Non-Volatile OTP Memory The One Time Programmable (OTP) memory is intended for factory programming. Programming the OTP requires putting a 7-V pulse on the communication pin after writing the data to the intended address. 7.5.2.1.1 General Use – Memory Function Commands 0xF0 (Read) and 0x0F (Write) The general use space is erased to read 0x00. Data written to the general space is ORed with data already present at the address to be written. A bit can only be flipped from 0 to 1. Table 2. General Memory Space Addressing 12 ADDRESSES FUNCTION 0x007F – 0x0060 Page 3 – 32 bytes general use 0x005F – 0x0040 Page 2 – 32 bytes general use 0x003F – 0x0020 Page 1 – 32 bytes general use 0x001F – 0x0000 Page 0 – 32 bytes general use Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 Read Page Flow M/F = 0xC3 Read Memory Flow M/F = 0xF0 (1) Master TX: 16-bit address, A (1) Master TX: 16-bit address, A (1) Master RX: 8-bit data @ A A=A+1 Master TX: 16-bit address, A Master TX: 8-bit data, D Master RX: CRC of M/F cmd & A Master RX: CRC of M/F cmd & A A[4:0] = Last address of page Write Memory Flow M/F = 0x0F Master RX: 8-bit data @ A A=A+1 Master RX: CRC of M/F cmd, A & D Master TX: Programming Pulse A = 0x007F? YES Master RX: CRC of all data transmitted Master RX: CRC of all data transmitted CRC = A[7:0] Master RX: D A = A +1 A < 0x007F? ROM Function Flow YES NO NO YES ROM Function Flow ROM Function Flow (1) Master TX: 8-bit data, D NO NO YES A < 0x007F? Master RX: CRC of preloaded A[7:0] & shifted D 16-Bit address is sent with lower 8-bit address followed by higher 8-bit address with least significant bit first. Figure 12. General Memory OTP Write/Read Flows 7.5.2.1.2 General Use — Memory Function Commands 0xFA (Read) and 0xAF (Write) The general use space is erased to read 0x00. Data written to the general space is ORed with data already present at the address to be written. A bit can only be flipped from 0 to 1. Table 3. General Memory Space Addressing ADDRESSES FUNCTION 0x001F – 0x0000 Page 4 – 32 bytes general use Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 13 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com Write Page 4 M/F = 0xAF Read Page 4 M/F = 0xFA (1) (1) Master TX: 16-bit address, A Master TX: 16-bit address, A Master TX: 8-bit data, D Master RX: CRC of M/F cmd & A Master RX: 8-bit data @ A A=A+1 Master RX: CRC of M/F cmd, A & D Master RX: CRC of preloaded A[7:0] & shifted D Master TX: Programming Pulse A = 0x001F? Master TX: 8-bit data, D NO YES Master RX: CRC of all data transmitted CRC = A[7:0] Master RX: D A = A +1 A = 0x001F? ROM Function Flow NO YES ROM Function Flow (1) 16-Bit address is sent with lower 8-bit address followed by higher 8-bit address with least significant bit first. Figure 13. General Memory OTP Write/Read Flows 7.5.2.1.3 Status – Memory Function Commands 0xAA (Read) and 0x55 (Write) Unlike the general use pages, the status bytes read 0xFF when not programmed and a bit is programmed from 1 to 0. A zero represents the active state. Address 0x0007 Reserved Default value is 0xFF Address 0x0006 Key Index The host can determine which one of multiple keys was programmed into the bq26100 device by reading the key index value. Address 0x0005 – 0x0001 Page Redirection A pointer for alternative page information, these bytes can be used if information in the original page has been invalidated. The host can read these locations and direct reads and/or writes to the page pointed to by the value in the register. For example, if the data in page 2 is corrupted by an incorrectly written data value, and the corrected data is in page 1, the value written to address 0x0003 would be 0xFE (1’s complement value of 0x01). Upon reading address 0x0003, the host would receive 0xFE and would take the 1’s complement to determine that page 1 contains redirected data. Table 4. Page Redirection 14 ADDRESS PAGE REDIRECTED 0x0005 Page 4 0x0004 Page 3 0x0003 Page 2 0x0002 Page 1 0x0001 Page 0 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 There is no hardware mapping of the page redirection bytes. The host is responsible for sending the correct address for a redirected page. Figure 14. Address 0x0000 PAGE LOCK FUNCTION BIT 7 LOCKK1 BIT 6 LOCKK0 BIT 5 RSVD BIT 4 PAGE 4 BIT 3 PAGE 3 BIT 2 PAGE 2 BIT 1 PAGE 1 BIT 0 PAGE 0 LOCKK1 Programming this bit to 0 locks the upper 64 bits of the device key, preventing additional writes. This bit can only be written once. LOCKK0 Programming this bit to 0 locks the lower 64 bits of the device key, preventing additional writes. This bit can only be written once. PAGEx Programming this bit to 0 locks page designated by x, preventing additional writes. This bit can only be programmed once. Write Status Flow M/F = 0x55 Read Status Flow M/F = 0xAA (1) (1) Master TX: 16-bit address, A Master TX: 16-bit address, A Master TX: 8-bit data, D Master RX: CRC of M/F cmd & A Master RX: 8-bit data @ A A=A+1 Master RX: CRC of M/F cmd, A & D Master RX: CRC of preloaded A[7:0] & shifted D Master TX: 8-bit data, D Master TX: Programming Pulse A = 0x0007? NO YES CRC = A[7:0] Master RX: CRC of all data transmitted Master RX: D A = 0x0007? ROM Function Flow NO A = A +1 YES ROM Function Flow (1) 16-Bit address is sent with lower 8-bit address followed by higher 8-bit address with least significant bit first. Figure 15. Status OTP Write/Read Flows 7.5.2.2 Non-Volatile EEPROM Memory The EEPROM memory is intended for in-field programming. Programming the EEPROM is no different than writing to RAM or registers, but the timing between the write and read back is different. A bit can be written to 1 or cleared to 0 multiple times and the value is retained when power to the device is removed. 7.5.2.2.1 General Use – Memory Function Commands 0xE0 (Read) and 0x0E (Write) Table 5. General Memory Space Addressing ADDRESSES FUNCTION 0x000F – 0x0000 16 Bytes general use Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 15 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 (1) www.ti.com Read EEPROM Flow M/F = 0xE0 Write EEPROM Flow M/F = 0x0E Master TX: 16-bit address, A (1) Master TX: 16-bit address, A Master TX: 8-bit data, D Master RX: CRC of M/F cmd & A Master RX: 8-bit data @ A A=A+1 Master waits 100 ms Master waits 50 ms Master TX: 8-bit data, D Master RX: CRC of M/F cmd, A & D A = 0x00F? Master RX: CRC of preloaded A[7:0] & shifted D NO YES CRC = A[7:0] Master RX: D Master RX: CRC of all data transmitted A = A +1 A = 0x000F? ROM Function Flow NO YES ROM Function Flow (1) 16-Bit address is sent with lower 8-bit address followed by higher 8-bit address with least significant bit first. Figure 16. EEPROM Write/Read Flows 7.5.3 SHA-1 Description The SHA-1 is known as a one-way hash function, meaning there is no known mathematical method of computing the input given only the output. The specification of the SHA-1, as defined by FIPS 180-2, states that the input consists of 512 bit blocks with a total input length less than 264 bits. Inputs which do not conform to integer multiples of 512 bit blocks are padded before any block is input to the hash function. The SHA-1 algorithm outputs 160 bits, commonly referred to as the digest. The full SHA-1 specification and algorithm can be found at http://csrc.nist.gov/publications/fips under FIPS 180. (As of April 23, 2004, the latest revision is FIPS 180-2.) The bq26100 device generates an SHA-1 input block of 288 bits (total input = 160 bit message + 128 bit key). To complete the 512 bit block size requirement of the SHA-1, the bq26100 device pads the key and message with a 1, followed by 159 0’s, followed by the 64 bit value for 288 (000…00100100000), which conforms to the pad requirements specified by FIPS 180-2 9 (Figure 17). 159 bits 64 bits 1 000 . . . 000 000 . . . 0100100000 Figure 17. SHA-1 Message Padding Format Example 7.5.4 Key Programming Description The 128-bit key used in the HMAC calculation is built from two 64-bit key spaces on the bq26100 device. Each key can be programmed independently, allowing multiple parties to program part of the full 128-bit key without the knowledge necessary to reproduce the full 128-bit key. To further protect the 128-bit key, the value written to each 64-bit non-volatile key space is the output of a SHA-1 calculation on a 160-bit input. Figure 18 provides a flow for the programming of the 128-bit device key. Once KEYx has been programmed, the LOCKKx bit should be programmed to 0 in the status register, preventing another value from overwriting that key space. 16 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 Master TX: Reset & Write Message Command Master RX: CRC of Write Control Cmd, Address, and Data Master writes up to 160-bit message Master pulls SDQ line to VPROG for 3 ms Master TX: Reset & Write Control Command Master TX: Reset & Write Status command Master sets PROGK1/PROGK0 in CONTROL reg Master sets LOCKK1/LOCKK0 at Status address 0x0000 Figure 18. Key Programming Flow This flow is run twice, for KEY0 and KEY1. An external power source is required on the PWR pin during key programming. Figure 20 shows a typical connection for the external power source. Since there is no key pre-appended to the message, the key message is padded with a 1, followed by 287 0’s, followed by the 64-bit value for 160 (00..01010000), see Figure 19. 287 bits 64 bits 1 000 . . . 000 000 . . . 0010100000 Figure 19. Key Programming Message Format Example + 3.3V Power Supply 100 W SDQ Communication and Programming Pulse Control PWR VSS 0.1 mF Figure 20. External Power Source Connection Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 17 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com 7.6 Register Maps 7.6.1 Volatile Register Memory The register memory is intended for in-field programming. 7.6.1.1 Message and Digest Registers – Memory Function Command 0xDD (Read) and 0x22 (Write) The message is a 160-bit input to the HMAC calculation, and the digest is the 160-bit output of the HMAC calculation. The message and digest share the same memory space, meaning that the message cannot be read back once the digest has been computed. The MSB of the message should be written to address 0x0013, and the LSB written to address 0x0000. The digest overwrites the message in the following manner. Table 6. Message/Digest Space Addressing ADDRESS MESSAGE VALUE DIGEST VALUE A[31:0] 0x0013 – 0x0010 M[159:128] 0x000F – 0x000C M[127:96] B[31:0] 0x000B – 0x0008 M[95:64] C[31:0] 0x0007 – 0x0004 M[63:32] D[31:0] 0x0003 – 0x0000 M[31:0] E[31:0] spacer NOTE See the SHA-1 and HMAC descriptions for more information on the meaning of the variables in the above table. Read Digest Flow M/F = 0xDD Write Message Flow M/F = 0x22 (1) Master TX: 16-bit address, A (1) Master TX: 16-bit address, A Master TX: 8-bit data, D Master RX: CRC of M/F cmd & A Master TX: 8-bit data, D Master RX: 8-bit data @ A A=A+1 Master RX: CRC of M/F cmd, A & D Master RX: CRC of preloaded A[7:0] & shifted D CRC = A[7:0] Master RX: D A = 0x0013? NO A = A +1 YES Master RX: CRC of all data transmitted NO YES ROM Function Flow ROM Function Flow (1) A = 0x0013? 16-Bit address is sent with lower 8-bit address followed by higher 8-bit address with least significant bit first. Figure 21. Message/Digest Write/Read Flows 18 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 7.6.1.2 Control and Version Registers – Memory Function Command 0x88 (Read) and 0x77 (Write) The control register starts authentication, clears the message/digest values, and flags when the authentication process has completed. The version register is used to determine the silicon revision. Table 7. General Memory Space Addressing ADDRESSES FUNCTION 0x0001 Silicon Revision Number 0x0000 Control Register The bits of the Control register are as follows: Figure 22. Control Register NAME POR STATUS BIT 7 PROGK1 0 BIT 6 PROGK0 0 BIT 5 RSVD 0 BIT 4 CLEAR 0 BIT 3 RSVD 0 BIT 2 POR 1 BIT 1 DONE 0 BIT 0 AUTH 0 PROGK1 If LOCKK1 is 1 (see Status Register), writing this bit to 1 enables the programming of Device Key 1. Further information about the programming of the keys is found in the SHA-1 section. PROGK0 If the LOCKK0 bit is 1 (see Status Register), writing this bit to 1 enables the programming of Device Key 0. Further information about the programming of the keys is found in the SHA-1 section. RSVD These bits are reserved for future use. They should always be written to 0. CLEAR Writing this bit to 1 clears the message/digest registers. This can be done before the message is written to ensure that all data values are known or after the digest is read to clear the HMAC calculation output. The bq26100 device resets the bit back to 0. POR This bit is set when the device comes out of a POR condition. The bit can be written to 0 to clear the flag. Writing the bit to 1 has no effect on device operation. DONE This bit is set when the device completes the HMAC calculation. The host should poll for this bit to determine when the digest is available for reading. This bit is automatically cleared when the AUTH bit is written to 1. This bit is also cleared at POR. AUTH This bit is set to initiate the HMAC calculation. This bit is automatically cleared when the DONE bit is written to 1. Write Control Flow M/F = 0x77 Read Control Flow M/F = 0x88 (1) (1) Master TX: 16-bit address, A Master TX: 16-bit address, A Master TX: 8-bit data, D Master RX: CRC of M/F cmd & A Master RX: 8-bit data @ A A=A+1 Master TX: 8-bit data, D Master RX: CRC of M/F cmd, A & D Master RX: CRC of preloaded A[7:0] & shifted D CRC = 0x01 Master RX: D A = 0x0001? NO A = A +1 YES Master RX: CRC of all data transmitted ROM Function Flow (1) A = 0x0001? NO YES ROM Function Flow 16-Bit address is sent with lower 8-bit address followed by higher 8-bit address with least significant bit first. Figure 23. Control Register Write/Read Flows Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 19 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com 8 Application and Implementation NOTE Information in the following applications sections is not part of the TI component specification, and TI does not warrant its accuracy or completeness. TI’s customers are responsible for determining suitability of components for their purposes. Customers should validate and test their design implementation to confirm system functionality. 8.1 Application Information A typical application consists of a host microcontroller as the SDQ master and the bq26100 device as the SDQ slave. The SDQ I/O on the bq26100 device is an open-drain pin and the SDQ master should also be configured as open-drain to allow a pullup resistor to be connected to a voltage that is between 2.5 V and 5.0 V. 8.2 Typical Application P+ R1 4.7 kW + SDQ bq26100 C1 0.1 mF PWR SDQ VSS VSS VSS VSS Protector VSS BAT OC CO DO P– Figure 24. Sample Application 8.2.1 Design Requirements For this design example, use the parameters listed in Table 8. Table 8. Design Parameters DESIGN PARAMETER EXAMPLE VALUE Pullup Voltage 2.65 V to 5.0 V Pullup Resistor 4.7 kΩ 8.2.2 Detailed Design Procedure The bq26100 device requires a 12-V maximum-pulse signal to program the OTP memory. It is necessary to have a programming test setup for production. Figure 25 shows an example of what the circuit could be for such a setup. The Programming Module contains the microcontroller that acts as SDQ master and also controls the time of the programming pulse and its width. The 12-V supply is the source for the programming pulse. Only SDQ and VSS signals need to exit the test setup as the Application Circuit containing the bq26100 device under test is connected only for programming and verifying data. The Programming Module typically will connect to a PC using an interface such as USB. The diagram in Figure 25 does not include the interface to a PC, which can vary depending on the system designer's choice. 20 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 Programming Module 10 NŸ 12 V Supply 15 NŸ 3.3 V Application Circuit 10 NŸ Microcontroller 100 Ÿ 100 Ÿ bq26100 SDQ VSS 5.6 V Figure 25. Programming Circuit Example 9 Power Supply Recommendations The bq26100 device is a low-power device that only needs to be turned on when communicating. The device power comes from the digital I/O and the capacitor connected between the VCC and GND pins. The capacitor on VCC is charged when the SDQ I/O is high and parasitically discharged when the SDQ I/O is pulled low. Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 21 bq26100 SLUS696B – JUNE 2006 – REVISED AUGUST 2015 www.ti.com 10 Layout 10.1 Layout Guidelines The bq26100 device requires a single-signal trace for the SDQ line and the parasitic capacitor on the PWR input. The best practice is to place the PWR capacitor as close as possible to the device with no via between the capacitor and the PWR pin. There should be two vias connecting the ground plane to VSS pins at the capacitor and additional vias connecting the ground plane to the remainder of ground connection for the thermal pad. 10.2 Layout Example Figure 26. Board Layout Example 22 Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 bq26100 www.ti.com SLUS696B – JUNE 2006 – REVISED AUGUST 2015 11 Device and Documentation Support 11.1 Community Resources The following links connect to TI community resources. Linked contents are provided "AS IS" by the respective contributors. They do not constitute TI specifications and do not necessarily reflect TI's views; see TI's Terms of Use. TI E2E™ Online Community TI's Engineer-to-Engineer (E2E) Community. Created to foster collaboration among engineers. At e2e.ti.com, you can ask questions, share knowledge, explore ideas and help solve problems with fellow engineers. Design Support TI's Design Support Quickly find helpful E2E forums along with design support tools and contact information for technical support. 11.2 Trademarks E2E is a trademark of Texas Instruments. All other trademarks are the property of their respective owners. 11.3 Electrostatic Discharge Caution These devices have limited built-in ESD protection. The leads should be shorted together or the device placed in conductive foam during storage or handling to prevent electrostatic damage to the MOS gates. 11.4 Glossary SLYZ022 — TI Glossary. This glossary lists and explains terms, acronyms, and definitions. 12 Mechanical, Packaging, and Orderable Information The following pages include mechanical, packaging, and orderable information. This information is the most current data available for the designated devices. This data is subject to change without notice and revision of this document. For browser-based versions of this data sheet, refer to the left-hand navigation. Submit Documentation Feedback Copyright © 2006–2015, Texas Instruments Incorporated Product Folder Links: bq26100 23 PACKAGE OPTION ADDENDUM www.ti.com 11-Jun-2015 PACKAGING INFORMATION Orderable Device Status (1) BQ26100DRPR ACTIVE Package Type Package Pins Package Drawing Qty VSON DRP 6 3000 Eco Plan Lead/Ball Finish MSL Peak Temp (2) (6) (3) Green (RoHS & no Sb/Br) CU NIPDAU Level-2-260C-1 YEAR Op Temp (°C) Device Marking (4/5) -40 to 85 2610 (1) The marketing status values are defined as follows: ACTIVE: Product device recommended for new designs. LIFEBUY: TI has announced that the device will be discontinued, and a lifetime-buy period is in effect. NRND: Not recommended for new designs. Device is in production to support existing customers, but TI does not recommend using this part in a new design. PREVIEW: Device has been announced but is not in production. Samples may or may not be available. OBSOLETE: TI has discontinued the production of the device. (2) Eco Plan - The planned eco-friendly classification: Pb-Free (RoHS), Pb-Free (RoHS Exempt), or Green (RoHS & no Sb/Br) - please check http://www.ti.com/productcontent for the latest availability information and additional product content details. TBD: The Pb-Free/Green conversion plan has not been defined. Pb-Free (RoHS): TI's terms "Lead-Free" or "Pb-Free" mean semiconductor products that are compatible with the current RoHS requirements for all 6 substances, including the requirement that lead not exceed 0.1% by weight in homogeneous materials. Where designed to be soldered at high temperatures, TI Pb-Free products are suitable for use in specified lead-free processes. Pb-Free (RoHS Exempt): This component has a RoHS exemption for either 1) lead-based flip-chip solder bumps used between the die and package, or 2) lead-based die adhesive used between the die and leadframe. The component is otherwise considered Pb-Free (RoHS compatible) as defined above. Green (RoHS & no Sb/Br): TI defines "Green" to mean Pb-Free (RoHS compatible), and free of Bromine (Br) and Antimony (Sb) based flame retardants (Br or Sb do not exceed 0.1% by weight in homogeneous material) (3) MSL, Peak Temp. - The Moisture Sensitivity Level rating according to the JEDEC industry standard classifications, and peak solder temperature. (4) There may be additional marking, which relates to the logo, the lot trace code information, or the environmental category on the device. (5) Multiple Device Markings will be inside parentheses. Only one Device Marking contained in parentheses and separated by a "~" will appear on a device. If a line is indented then it is a continuation of the previous line and the two combined represent the entire Device Marking for that device. (6) Lead/Ball Finish - Orderable Devices may have multiple material finish options. Finish options are separated by a vertical ruled line. Lead/Ball Finish values may wrap to two lines if the finish value exceeds the maximum column width. Important Information and Disclaimer:The information provided on this page represents TI's knowledge and belief as of the date that it is provided. TI bases its knowledge and belief on information provided by third parties, and makes no representation or warranty as to the accuracy of such information. Efforts are underway to better integrate information from third parties. TI has taken and continues to take reasonable steps to provide representative and accurate information but may not have conducted destructive testing or chemical analysis on incoming materials and chemicals. TI and TI suppliers consider certain information to be proprietary, and thus CAS numbers and other limited information may not be available for release. In no event shall TI's liability arising out of such information exceed the total purchase price of the TI part(s) at issue in this document sold by TI to Customer on an annual basis. Addendum-Page 1 Samples PACKAGE OPTION ADDENDUM www.ti.com 11-Jun-2015 Addendum-Page 2 PACKAGE MATERIALS INFORMATION www.ti.com 11-Jun-2015 TAPE AND REEL INFORMATION *All dimensions are nominal Device BQ26100DRPR Package Package Pins Type Drawing VSON DRP 6 SPQ Reel Reel A0 Diameter Width (mm) (mm) W1 (mm) 3000 330.0 12.4 Pack Materials-Page 1 3.3 B0 (mm) K0 (mm) P1 (mm) 3.3 1.1 8.0 W Pin1 (mm) Quadrant 12.0 Q2 PACKAGE MATERIALS INFORMATION www.ti.com 11-Jun-2015 *All dimensions are nominal Device Package Type Package Drawing Pins SPQ Length (mm) Width (mm) Height (mm) BQ26100DRPR VSON DRP 6 3000 367.0 367.0 35.0 Pack Materials-Page 2 IMPORTANT NOTICE Texas Instruments Incorporated and its subsidiaries (TI) reserve the right to make corrections, enhancements, improvements and other changes to its semiconductor products and services per JESD46, latest issue, and to discontinue any product or service per JESD48, latest issue. Buyers should obtain the latest relevant information before placing orders and should verify that such information is current and complete. All semiconductor products (also referred to herein as “components”) are sold subject to TI’s terms and conditions of sale supplied at the time of order acknowledgment. TI warrants performance of its components to the specifications applicable at the time of sale, in accordance with the warranty in TI’s terms and conditions of sale of semiconductor products. Testing and other quality control techniques are used to the extent TI deems necessary to support this warranty. Except where mandated by applicable law, testing of all parameters of each component is not necessarily performed. TI assumes no liability for applications assistance or the design of Buyers’ products. Buyers are responsible for their products and applications using TI components. To minimize the risks associated with Buyers’ products and applications, Buyers should provide adequate design and operating safeguards. TI does not warrant or represent that any license, either express or implied, is granted under any patent right, copyright, mask work right, or other intellectual property right relating to any combination, machine, or process in which TI components or services are used. Information published by TI regarding third-party products or services does not constitute a license to use such products or services or a warranty or endorsement thereof. Use of such information may require a license from a third party under the patents or other intellectual property of the third party, or a license from TI under the patents or other intellectual property of TI. Reproduction of significant portions of TI information in TI data books or data sheets is permissible only if reproduction is without alteration and is accompanied by all associated warranties, conditions, limitations, and notices. TI is not responsible or liable for such altered documentation. Information of third parties may be subject to additional restrictions. Resale of TI components or services with statements different from or beyond the parameters stated by TI for that component or service voids all express and any implied warranties for the associated TI component or service and is an unfair and deceptive business practice. TI is not responsible or liable for any such statements. Buyer acknowledges and agrees that it is solely responsible for compliance with all legal, regulatory and safety-related requirements concerning its products, and any use of TI components in its applications, notwithstanding any applications-related information or support that may be provided by TI. Buyer represents and agrees that it has all the necessary expertise to create and implement safeguards which anticipate dangerous consequences of failures, monitor failures and their consequences, lessen the likelihood of failures that might cause harm and take appropriate remedial actions. Buyer will fully indemnify TI and its representatives against any damages arising out of the use of any TI components in safety-critical applications. In some cases, TI components may be promoted specifically to facilitate safety-related applications. With such components, TI’s goal is to help enable customers to design and create their own end-product solutions that meet applicable functional safety standards and requirements. Nonetheless, such components are subject to these terms. No TI components are authorized for use in FDA Class III (or similar life-critical medical equipment) unless authorized officers of the parties have executed a special agreement specifically governing such use. Only those TI components which TI has specifically designated as military grade or “enhanced plastic” are designed and intended for use in military/aerospace applications or environments. Buyer acknowledges and agrees that any military or aerospace use of TI components which have not been so designated is solely at the Buyer's risk, and that Buyer is solely responsible for compliance with all legal and regulatory requirements in connection with such use. TI has specifically designated certain components as meeting ISO/TS16949 requirements, mainly for automotive use. In any case of use of non-designated products, TI will not be responsible for any failure to meet ISO/TS16949. Products Applications Audio www.ti.com/audio Automotive and Transportation www.ti.com/automotive Amplifiers amplifier.ti.com Communications and Telecom www.ti.com/communications Data Converters dataconverter.ti.com Computers and Peripherals www.ti.com/computers DLP® Products www.dlp.com Consumer Electronics www.ti.com/consumer-apps DSP dsp.ti.com Energy and Lighting www.ti.com/energy Clocks and Timers www.ti.com/clocks Industrial www.ti.com/industrial Interface interface.ti.com Medical www.ti.com/medical Logic logic.ti.com Security www.ti.com/security Power Mgmt power.ti.com Space, Avionics and Defense www.ti.com/space-avionics-defense Microcontrollers microcontroller.ti.com Video and Imaging www.ti.com/video RFID www.ti-rfid.com OMAP Applications Processors www.ti.com/omap TI E2E Community e2e.ti.com Wireless Connectivity www.ti.com/wirelessconnectivity Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265 Copyright © 2015, Texas Instruments Incorporated