ISL6296A
®
Data Sheet
April 15, 2010
FN6567.3
FlexiHash™ For Battery Authentication
Features
The ISL6296A is a highly cost-effective fixed-secret hash
engine based on Intersil’s FlexiHash technology. The
device’s authentication is achieved through a challenge
response scheme, which is customized for low-cost
applications where cloning via eavesdropping without
knowledge of the device’s secret code is not economically
viable. When used for its intended applications, the
ISL6296A offers the same level of effectiveness as other
significantly more expensive high maintenance monetarygrade hash algorithm and authentication schemes.
• Challenge-response based authentication scheme using
32-Bit challenge code and 8-Bit authentication code.
The ISL6296A has a wide operating voltage range and is
suitable for direct powering from a 1-cell Li-ion/Li-Poly or a
3-cell series NiMH battery pack. The ISL6296A can also be
powered by the XSD bus when the bus pull-up voltage is
3.3V or higher. The device connects directly to the cell
terminals of a battery pack and includes on-chip voltage
regulation circuit, POR and a non-crystal based oscillator for
bus timing reference.
• Fast and flexible authentication process. Multi-pass
authentication can be used to achieve the highest security
level if necessary.
• 16x8 OTP ROM stores up to three sets of 32-Bit host
selectable secrets with additional programmable memory
for storage of up to 48-bits of ID code and/or pack
information.
• FlexiHash engine uses two sets of 32-Bit secrets for
authentication code generation.
• Non-unique mapping of the secret key to an 8-Bit
authentication code maximizes hacking difficulty due to
need for exhaustive key search (superior to SHA-1).
• Supports 1-cell Li-ion/Li-Poly and 3-cell series NiMH
battery packs (2.6V ~ 4.8V operation), or powered by the
XSD bus.
Communication with the host is achieved through a single-wire
XSD interface (a light-weight subset of Intersil’s ISD bus
interface). The XSD bus is compatible for use with serial ports
offered by all 8250 compatible UART’s or a single GPIO
(General Purpose Input and Output) pin of a microprocessor.
• XSD single-wire host bus interface communicates with all
8250-compatible UART’s or a single GPIO. Supports CRC
on read data and transfer bit-rate up to 23kbps.
A clone prevention solution utilizing the ISL6296A offers
safety and revenue protection at the lowest cost and power
and is suitable for protection against after-market
replacement for a wide variety of low-cost applications.
• 5 Ld SOT-23 and 8 Ld TDFN (2mmx3mm) packages
• True “Zero Power” Sleep mode - automatically entered
after a bus inactivity time-out period.
• -25°C to +85°C operating temperature range
• Pb-free (RoHS compliant)
Applications
Pinouts
ISL6296A
(5 LD SOT-23)
TOP VIEW
VSS 1
• Battery Pack Authentication
• Printer Cartridges
5 XSD
• Add-on Accessories
• Other Non-Monetary Authentication Applications
NC 2
VDD 3
Related Literature
4 TIO
• Application Note AN1165 “ISL6296 Evaluation Kit”
• Application Note AN1167 “Implementing XSD Host Using
a GPIO”
ISL6296A
(8 LD 2X3 TDFN)
TOP VIEW
8 XSD
VSS 1
NC 2
7 NC
NC 3
6 NC
VDD 4
5 TIO
1
• Technical Brief TB363 “Guidelines for Handling and
Processing Moisture Sensitive Surface Mount Devices
(SMDs)”
CAUTION: These devices are sensitive to electrostatic discharge; follow proper IC Handling Procedures.
1-888-INTERSIL or 1-888-468-3774 | Intersil (and design) is a registered trademark of Intersil Americas Inc.
Copyright © Intersil Americas Inc. 2007-2010. All Rights Reserved.
FlexiHash is a trademark of Intersil Americas Inc. All other trademarks mentioned are the property of their respective owners.
ISL6296A
Ordering Information
PART NUMBER
(Note)
PART
MARKING
TEMP. RANGE
(°C)
PACKAGE
Tape & Reel
(Pb-free)
PKG.
DWG. #
ISL6296ADHZ-T*
296A
-25 to +85
5 Ld SOT-23
P5.064
ISL6296ADRTZ-T*
96A
-25 to +85
8 Ld 2x3 TDFN
L8.2X3A
ISL6296EVAL1
ISL6296 Evaluation Kit
*Please refer to TB347 for details on reel specifications.
NOTE: These Intersil Pb-free plastic packaged products employ special Pb-free material sets, molding compounds/die attach materials, and 100%
matte tin plate plus anneal (e3 termination finish, which is RoHS compliant and compatible with both SnPb and Pb-free soldering operations).
Intersil Pb-free products are MSL classified at Pb-free peak reflow temperatures that meet or exceed the Pb-free requirements of IPC/JEDEC J
STD-020.
2
FN6567.3
April 15, 2010
ISL6296A
Absolute Maximum Ratings (Reference to GND)
Thermal Information
Supply Voltage (VDD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5V
All Other Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . -0.5 to VDD + 0.5V
Thermal Resistance (Typical)
θJA (°C/W)
θJC (°C/W)
SOT-23 Package (Note 1) . . . . . . . . . .
200
N/A
2x3 TDFN Package (Notes 2, 3) . . . . .
70
10.5
Maximum Junction Temperature (Plastic Package) . . . . . . . +125°C
Maximum Storage Temperature Range . . . . . . . . . .-40°C to +125°C
Pb-free Reflow Profile . . . . . . . . . . . . . . . . . . . . . . . . .see link below
http://www.intersil.com/pbfree/Pb-FreeReflow.asp
Recommended Operating Conditions
Ambient Temperature Range . . . . . . . . . . . . . . . . . . .-25°C to +85°C
CAUTION: Do not operate at or near the maximum ratings listed for extended periods of time. Exposure to such conditions may adversely impact product reliability and
result in failures not covered by warranty.
NOTES:
1. θJA is measured with the component mounted on a high effective thermal conductivity test board in free air. See Tech Brief TB379 for details.
2. θJA is measured in free air with the component mounted on a high effective thermal conductivity test board with “direct attach” features. See
Tech Brief TB379.
3. For θJC, the “case temp” location is the center of the exposed metal pad on the package underside.
Electrical Specifications
Unless otherwise noted, all parameters are established over the operational supply voltage and temperature
range of the device as follows: TA = -25°C to +85°C; VDD = 2.6V to 4.8V; Parameters with MIN and/or MAX
limits are 100% tested at +25°C, unless otherwise specified. Temperature limits established by characterization
and are not production tested.
PARAMETER
SYMBOL
TEST CONDITIONS
MIN
TYP
MAX
UNITS
During normal operation
2.6
-
4.8
V
During OTP ROM programming
2.8
-
4.8
V
VDD = 4.2V
-
38
55
µA
VDD = 4.8V
-
40
65
µA
DC CHARACTERISTICS
Supply Voltage
VDD
Run Mode Supply Current
(Exclude I/O Current)
IDD
Sleep Mode Supply Current
IDDS
VDD = 4.2V, XSD pin floating
-
0.15
0.5
µA
OTP Programming Mode Supply Current
IDDP
For ~ 1.8ms duration per write operation
-
250
500
µA
Internal Regulated Supply Voltage
VRG
Observable only in test mode
2.3
2.5
2.7
V
Internal OTP ROM Programming Voltage
VPP
Observable only in test mode
11
12
13
V
POR Release Threshold
VPOR+
1.9
2.2
2.4
V
POR Assertion Threshold
VPOR-
1.5
1.8
2.1
V
XSD Input Low Voltage
VIL
-0.4
-
0.5
V
XSD Input High Voltage
VIH
1.5
-
VDD + 0.4V
V
VHYS
-
400
-
mV
VDD = 2.6V
-
0.8
-
µA
VDD = 4.2V
-
1.2
2.0
µA
VDD = 4.8V
-
1.8
2.5
µA
IOL = 1mA
-
-
0.4
V
XSD PIN CHARACTERISTICS
XSD Input Hysteresis
XSD Internal Pull-Down Current
IPD
XSD Output Low Voltage
VOL
XSD Input Transition Time
tX
10% to 90% transition time
-
-
2
µs
XSD Output Fall Time
tF
90% to 10%, CLOAD = 12pF
-
-
50
ns
XSD Pin Capacitance
CPIN
-
6
-
pF
3
FN6567.3
April 15, 2010
ISL6296A
Electrical Specifications
Unless otherwise noted, all parameters are established over the operational supply voltage and temperature
range of the device as follows: TA = -25°C to +85°C; VDD = 2.6V to 4.8V; Parameters with MIN and/or MAX
limits are 100% tested at +25°C, unless otherwise specified. Temperature limits established by characterization
and are not production tested. (Continued)
PARAMETER
SYMBOL
TEST CONDITIONS
MIN
TYP
MAX
UNITS
2.89
-
23.12
kHz
7
-
20
µs
XSD BUS TIMING CHARACTERISTICS (Refer to XSD Bus Symbol Timing Definitions Tables on page 13)
Programming Bit Rate
x = 0.5 to 4
XSD Input Deglitch Time
tWDG
Pulse width narrower than the de-glitch time will not
cause the device to wake-up
Device Wake-Up Time
tWKE
From falling-edge of break command issued by host to
falling-edge of break command returned by device
130
160
210
µs
Device Sleep Wait Time
tSLP
From when the ‘11’ Opcode is detected to the shut-off
of the internal regulator
4
-
-
µs
Auto-Sleep Time-Out Period
tASLP
From the last transition detected on the XSD bus to the
device going into sleep mode
-
0.6
-
s
OTP ROM Write Time
tEEW
From the last BT of the 2nd write data frame to when
device is ready to accept the next instruction
-
1.8
1.9
ms
Hash Calculation Time
tHASH
From the last BT of the Challenge Code Word from the
host to the Authentication Code being available for read
-
1
-
BT
Soft-Reset Time
tSRST
From the last BT of the Soft-Reset instruction issued by
the host to the falling-edge of break command returned
by device
-
-
30
µs
Pin Descriptions
ISL6296ADHZ-T ISL6296ADRTZ-T
(5 LD SOT-23)
(8 LD TDFN)
PIN NAME
DESCRIPTION
1
1
VSS
System ground.
2
2, 3, 6, 7
NC
No connection.
3
4
VDD
Supply voltage.
4
5
TIO
Production test I/O pin. Used only during production testing. Must be left floating during
normal operation.
5
8
XSD
Communication bus with weak internal pull-down to VSS. This pin is a Schmitt-trigger input
and an open-drain output. An appropriate pull-up resistor is required on the host side.
4
FN6567.3
April 15, 2010
ISL6296A
Typical Applications
PACK+
XSD
R1
330Ω XSD
ISL6296A
D1
5.1V
VDD
R2
1.2kΩ
PROTECTION
C1
0.1µF
VSS
PACK-
FIGURE 1. TYPICAL APPLICATION WITH THE ISL6296A POWERED BY THE BATTERY
PACK+
XSD
R1
330Ω XSD
ISL6296A
D1
5.1V
VDD
PROTECTION
C1
0.1µF
VSS
PACK-
FIGURE 2. TYPICAL APPLICATION WITH THE ISL6296A POWERED BY THE XSD BUS
Block Diagram
ESD DIODE
VDD
POR/2.5V
REGULATOR
OSCILLATOR
ANALOG
DIGITAL
DCFG (1 BYTE)
XSD
COMM
INTERFACE
XSD
DTRM (1 BYTE)
SECRET #1
(4 BYTES)
SECRET #2
(4 BYTES)
AUTH
SECRET #3
(4 BYTES)
ESD DIODE
SESL
GENERAL PURPOSE
(2 BYTES)
CHLG
16 BYTES
FLEXIHASH+™
ENGINE
MSCR
OTPROM
STAT
CONTROL/STATUS/
TEST INTERFACE
TIO
VSS
FIGURE 3. FUNCTIONAL BLOCK DIAGRAM
5
FN6567.3
April 15, 2010
ISL6296A
Theory of Operation
The ISL6296A contains all circuitry required to support battery
pack authentication based on a challenge-response scheme.
It provides a 16-Byte One-Time Programmable Read-Only
Memory (OTPROM) space for the storage of up to 96 bits of
secret for the authentication and other user information. A
32-bit CRC-based hash engine (FlexiHash) calculates the
authentication result immediately after receiving a 32-bit
random challenge code. The communication between the
ISL6296A and the host is implemented through the XSD
single-wire communication bus.
ISL6296A is ready and waiting for a bus transaction from the
host.
HOST BREAK
DEVICE BREAK
60µs
TYP
1.391
BT D
XSD BUS
WAVEFORM
FIGURE 4A. WHEN THE HOST POWER-ON BREAK IS WIDER
THAN 60µs
Major functions within the ISL6296A include the following, as
shown in Figure 3:
• Power-on reset (POR) and a 2.5V regulator to power all
internal logic circuits.
• 16x8-Bit (16-Byte) OTP ROM as shown in Table 8. The
first part (two bytes) contains the device default
configuration (DCFG) information (such as the device
address and the XSD communication speed) and the
default trimming (DTRM) information (such as the internal
oscillator frequency trimming). The second part contains
two groups (12-Byte) of memory that can be
independently locked out for the storage of up to three
sets of secret codes. The last part provides two additional
bytes of space for general-purpose information.
• Control functions, including master control (MSCR) and
status (STAT) registers (as shown in Table 9), interrupt
generation, and the test-related interface.
• FlexiHash engine that includes the 32-Bit CRC-based
hash engine, secret selection register, challenge code
register and the authentication result register. Table 10
shows all the registers.
• XSD communication bus Interface. The XSD device
address and the communication speed are configured in
the DCFG address in the OTPROM, as given in Table 8.
• Time Base Reference.
The following explains in detail the operation of the
ISL6296A.
Power-On Reset (POR)
The ISL6296A powers up in Sleep mode. It remains in Sleep
mode until a power-on ‘break’ command is received from the
host through the XSD bus. The initial power-on ‘break’ can
be of any pulse width, as long as it is wider than the XSD
input de-glitch time (20µs). Once the ‘break’ command is
received, the internal regulator is powered up. About 20µs
after the falling edge of the power-on ‘break’, an internal
POR circuit releases the reset to the digital block, and a
POR sequence is started. During the POR sequence, the
ISL6296A initializes itself by loading the default device
configuration information from pre-assigned locations within
the OTP ROM memory. After initialization, a ‘break’
command is returned to the host to indicate that the
6
HOST BREAK
DEVICE BREAK
XSD BUS
WAVEFORM
FIGURE 4B. WHEN THE HOST POWER-ON BREAK IS
NARROWER THAN 60µs
FIGURE 4. POWER-ON BREAK SIGNAL TO WAKE-UP THE
ISL6296A FROM SLEEP MODE
Note that the ISL6296A will initiate the power-on sequence
without waiting for the power-on ‘break’ signal to return to the
high state. If the host sends an initial ‘break’ pulse wider than
60µs, the device-ready ‘break’ returned by the ISL6296A will
likely be merged with the pulse sent by the host and,
therefore, may not be detectable. Figure 4 illustrates the
waveforms during the Power-on Reset. Figure 4A represents
the case when the power-on ‘break’ rising edge occurs after
the device starts sending the ‘break’. Figure 4B represents the
case when the power-on ‘break’ finishes before the device
sends its ‘break’. The device break signal is always 1.391
times of the device bit-time (BT, see “XSD Host Bus Interface”
on page 10 for more details). Either case in Figure 4 will
wake-up the device successfully if the device is in the sleep
mode.
Note that It is important to keep in mind that a narrow ‘break’
signal will be taken as a normal bit signal and cause errors if
the device is not in the sleep mode. For this reason, the
narrow power-on ‘break’ signal should be used only if the
user has to see the returned ‘break’ signal.
Auto-Sleep
While the ISL6296A is powered up and there is no bus
activity for more than about 1s, the device will automatically
return to Sleep mode. Sleep mode can be entered
independent of whether the XSD bus is held high or low.
While the ISL6296A is in Sleep mode, it is recommended
that the XSD bus be held low to eliminate current drain
through the XSD-pin internal pull-down current.
FN6567.3
April 15, 2010
ISL6296A
Auto-Sleep mode can be disabled by clearing the ASLP bit
in the MSCR register. By default, Auto-Sleep is always
enabled at power-up and after a soft reset. Auto-sleep
function can be permanently disabled by clearing the 0-00[2]
bit (the ASLP bit in DCFG) during OTP ROM programming.
OTP ROM
The 16-Byte OTP ROM memory is based on EEPROM
technology and is incorporated into the ISL6296A for storage
of non-volatile information. OTP ROM contents (refer to
Table 8) can include, but are not limited to:
1. Device default settings (address 0-00)
2. Factory programmed trim parameters (address 0-01)
3. Device authentication secrets (address 0-02 to 0-0D)
4. Pack information and ID (address 0-0E and 0-0F)
Following a host-initiated power-on ‘break’ signal or soft
reset command, the ISL6296A will configure its default mode
of operation based on information stored within DCFG
address of the OTP ROM. The default configuration is
loaded into the master control (MSCR) and the status
(STAT) registers. Functions that are configured by OTP
ROM settings include:
1. Device address (DAB[1:0])
2. XSD bus speed (SPD[1:0])
3. Register default settings (eINT and ASLP)
4. ROM read/write lock-out (SLO[1:0])
The ISL6296A incorporates interrupt functions to allow the
host to be quickly informed of device status and error
conditions. Available interrupts are summarized in Table 1.
The memory can be written multiple times before two lock-out
bits (SLO[1:0] in DCFG, see Table 8) are set. The SLO[1] (bit 1)
locks out the memory between 0-02 and 0-09 and the SLO[0]
(bit 0) locks out the memory between 0-0A to 0-0D. These two
bits can be set independently. Prior to lock-out, the memory can
be written and read directly through the XSD bus interface.
After lock-out, writing to all ROM addresses and reading from
secret code locations will be permanently disabled after
performing a reset cycle.
When an interrupt enable bit is set, a ‘break’ command is
sent to the host whenever its corresponding interrupt status
bit is set. After this, the host should read the STAT register
immediately. If the following instruction frame from the host
does not access the STAT register, another ‘break’ will be
sent immediately after receiving the full instruction frame.
This process is repeated until the host reads from the STAT
register. Upon reading of the STAT register, all status bits will
be cleared.
Writing to the EEPROM requires the supply voltage at the VDD
pin be maintained at a minimum of 2.8V. Failure to do so may
result in unreliable ROM programming or total write failure.
Refer to the MSCR and STAT register descriptions on
page 15 for a detailed explanation of the interrupt functions.
The OTP ROM must be written two bytes at a time, but 2, 4
or 16-bytes of data can be read by the host in a single bus
transaction. Only even addresses are allowed in OTP ROM
read/write. A 16-Byte read with CRC allows the entire ROM
content to be quickly verified by simply checking the CRC
byte. The DTRM address stores the default trimming
parameters and is a read-only address. The DCFG and
DTRM (0-00 and 0-01 addresses) need to be written
simultaneously but the data to the DRTM address is ignored.
The OTP ROM writing process takes approximately 1.8ms
per two-Bytes. While the write process is taking place, no
bus transaction is allowed. Attempting to access the
ISL6296A during an on-going write process will result in the
device ignoring the access instruction and issuing an
interrupt to the host. The OTP ROM programming is registerbased and may be performed at the pack manufacturer’s
facility.
Device Control and Status
The ISL6296A has a control and a status register. The
control register can be read and written by the host but the
status register is read only. Both registers contain the device
configuration information (see Table 9). The status register
also contains the device status information that may lead to
an interrupt signal to the host.
7
FlexiHash Engine
The FlexiHash engine contains a 32-Bit CRC-based hash
engine and three registers. Table 10 lists the three registers.
The 1-byte secret selection (SESL) register selects two sets
of secret (32-bit each) from the OTP ROM to program the
hash engine. The 4-byte challenge code register (CHLG)
receives the challenge code from the host through the XSD
bus. Once the challenge code is received, the hash engine
generates a 1-Byte authentication result code and stores in
the AUTH register for the host to read. Figure 5 shows the
data flow of the authentication process. The following
sections describe the authentication process and FlexiHash
encoding scheme in detail.
THE DEVICE AUTHENTICATION PROCESS
To start an authentication process, the host sends a ‘break’
command to wake up the ISL6296A. Then the host writes to
the SESL register to select the two sets of secrets to be used
for authentication code generation. After that, the host
generates a pseudo-random 4-Byte challenge code to input
into the CHLG register to initiate the authentication process.
Upon receiving the fourth byte of the challenge code, the
ISL6296A immediately starts computing the authentication
code. Once the computation is complete, the 8-bit
authentication code is made available at the AUTH register
for the host to read out. The host reads this code and,
concurrently, calculates the correct authentication code
based on the challenge code it generated and the same
FN6567.3
April 15, 2010
ISL6296A
secrets chosen, and finally compares the result with the
authentication code read from the device. If the codes do not
match up, the device is a fake device and the host may shut
itself down. The flow chart in Figure 6 summarizes the
process that the host needs to execute.
It is recommended that device authentication be done once
in a while to maximize its effectiveness. Before a new
challenge code can be accepted by the device, the SESL
register must be re-written again to ensure that the original
seeds are re-loaded from the OTP ROM into the hash
engine prior to performing the next authentication code
calculation. Failure to follow the sequence will result is a bus
error, causing the sBER flag to be set in the STAT register.
32-BIT PSEUDO-RANDOM
CHALLENGE WORD FROM HOST
64-BIT SECRET
32-BIT HASH FUNCTION
FLEXIHASH
ENGINE
32-BIT HASH SEED
START
WAKE UP ISL6296A USING A
REGULAR BREAK SIGNAL
SELECT HASH FUNCTION AND SEED
BY WRITING TO SESL REGISTER
SEND A 32-BIT RANDOM
CHALLENGE TO CHLG REGISTER
READ THE AUTHENTICATION
RESULT FROM AUTH REGISTER,
AFTER WAITING FOR 1 BTD
CALCULATE THE EXPECTED
AUTHENTICATION RESULT
BASED ON THE SAME SECRETS
THE TWO RESULTS MATCH?
YES
8-BIT AUTHENTICATION
CODE
NO
SHUT DOWN
THE SYSTEM
FIGURE 5. AUTHENTICATION PROCESS FLOW DIAGRAM
END
SET-UP FOR DEVICE AUTHENTICATION SUPPORT
To configure the host and the ISL6296A to support device
authentication function, the pack manufacturer will need to
select at least 2 sets of 32-bit secret codes. For greater
security, a third set of 32-bit secret may be used. The
FlexiHash engine requires two sets of 32-bit secrets for use
in its hash calculation; the first set to define its hash function,
and the second set to initialize its seed for hash calculation.
These two sets can be selected from the same secret
location. The chosen secret codes are to be kept by the pack
manufacturer and maintained at utmost confidentiality.
After the secrets have been determined, they are written into
the device’s OTP ROM. After verification that the codes have
been written in correctly, the relevant secrets lock-out bits at
ROM address location 0-00 should be set. Once set, the
lock-out bits can no longer be cleared. Thereafter, read/write
access to the secret information will no longer be possible,
and the secret codes are made available only to the
FlexiHash engine for generation of authentication code
based on a challenge code input from the host.
FIGURE 6. FLOW CHART FOR AUTHENTICATION PROCESS
THE HASH ENGINE
The hash engine consists of 4 separate programmable 8-bit
CRC calculators. Two sets of 32-bit secret codes are used
by the hash engine for authentication code generation. The
first set is used to define the CRC polynomial as well as the
input selection for each of the CRC calculators. The second
is used as initial seeds for the CRC calculations. Outputs of
the 4 CRC calculators are logically combined to produce the
8-Bit output of the overall FlexiHash engine. The Block
Diagram of the FlexiHash engine is illustrated in Figure 7.
More detailed descriptions on the hash engine can be found
in Application Note AN1166.
On the host side, the same secret codes will need to be kept,
and the same FlexiHash engine will have to be implemented in
firmware. Refer to Application Note AN1166 for detailed
information of firmware implementation. It is important that the
secret codes be stored scrambled in the host’s non-volatile
memory so that the secret information cannot be easily
revealed by monitoring signal transfer on the host PCB.
8
FN6567.3
April 15, 2010
ISL6296A
NA[7:0]
8
CN
MUX
XI
BN
8-BIT CRC CALCULATOR
DN
AN
8
XA[7:0]
POLYNOM = 1 + XMA[2:0] - XMA[5:3] + X8
MA[7:6]
NB[7:0]
8
XI
CN
MUX
AN
8-BIT CRC CALCULATOR
DN
BN
8
XB[7:0]
POLYNOM = 1 + XMB[2:0] - XMB[5:3] + X8
MB[7:6]
NC[7:0]
8
BN
XI
MUX
AN
8-BIT CRC CALCULATOR
DN
CN
8
XC[7:0]
POLYNOM = 1 + XMC[2:0] - XMC[5:3] + X8
MC[7:6]
ND[7:0]
8
BN
CN
MUX
AN
8-BIT CRC CALCULATOR
XI
DAN
8
XD[7:0]
POLYNOM = 1 + XMD[2:0] - XMD[5:3] + X8
MD[7:6]
Y[7:0] = XA[7:0] ⊕ S2R{XB[7:0]} ⊕ S4R{XC[7:0]} ⊕ S6R{XD[7:0]}
LEGEND:
XI
AN, BN, CN, DN
XA, XB, XC, XD
MA, MB, MC, MD
NA, NB, NC, ND
SNR{ }
Y[7:0]
32-BIT CHALLENGE CODE WORD SERIAL BIT-STREAM
CRC CALCULATOR SERIAL OUTPUTS
CRC CALCULATOR 8-BIT PARALLEL OUTPUTS
CRC POLYNOMIAL AND INPUT SELECTION CODES
CRC REGISTER INITIALIZATION SEEDS
N-BIT CYCLICAL RIGHT SHIFT FUNCTION
8-BIT AUTHENTICATION CODE OUTPUT
FIGURE 7. BLOCK DIAGRAM OF THE FLEXIHASH ENGINE
9
FN6567.3
April 15, 2010
ISL6296A
XSD Host Bus Interface
BUS SIGNALING SYMBOLS
Communication with the host is achieved through XSD, a
light-weight subset of Intersil’s ISD single-wire bus interface.
XSD is a programmable-rate, pseudo-synchronous,
bidirectional, host-initiated, instruction-based, serial
communication interface that allows up to two slave devices
to be attached and addressed separately. It includes
features to enable quick and reliable communication. The
communication protocol is optimized for efficient transfer of
data between the device and the host. The following list
outlines the features supported by the XSD bus interface:
The XSD bus is nominally held high. Various bus symbols
and commands are generated by active-low pulse width
modulation. Following are the set of valid bus signaling
symbols supported by the XSD interface:
Break (Issued by Host)
• Used to wake the device up from Sleep mode (Note: a
narrow ‘break’ can also be used to wake up the device
from the Sleep mode, as described in “Power-On Reset
(POR)” on page 6)
• Programmable bit rate up to 23kbps
• Used to reset the device’s XSD bit counters and time
qualifiers
• Up to 2 devices can be connected to the host and
addressed separately
• Used to signal a change in communication channel (from
one slave device to another)
• 16-Bit host instruction frame supports multi-Byte register
read and write
Break (Issued by Device)
• Built-in communication error detection
• Used as ‘device-ready’ indication to the host (after a
Soft-reset or wake-up from Sleep mode)
• CRC generation capability
• Used as an interrupt indicator
• Supports interrupt signaling
‘1’ Symbol
• Integrated bus inactivity detector for automatic activation
of Sleep mode
• Used for instruction and data coding
XSD BUS PHYSICAL MODEL
• Used for instruction and data coding
‘0’ Symbol
The physical model of the XSD bus is shown in Figure 8.
The model shows a single-wire connection between the host
and the device, not including the ground signal. The input
logic on the device side is designed to be compatible with
any voltage between 1.8V to 5.0V. The host interface should
contain an open-drain or open-collector output. The pull-up
resister RPU can be connected either to the host supply
voltage VDDH or the device supply voltage VDDD. Typically,
the host supply voltage should be used for pull-up.
DATA TRANSFER PROTOCOL
To initiate a transaction, the host first sends a 16-bit
instruction frame to the device, followed by data byte
frame(s) if the instruction is a write operation. The instruction
frame consists of a chip-select code, operation code,
register bank and address pointer and number of data bytes
information, as shown in Figure 10. If the instruction is a
read operation, the device will return 1 to 17 byte frames of
data back to the host. The serial data transfer always takes
place with the LSB first. The following explains the bus
symbols. The transaction frames are introduced in later
sections.
SYMBOL TIMING DEFINITIONS
Symbol timings are defined in terms of bit-time (BT),
determined by the selected bus transfer bit-rate
pre-programmed into the device’s OTP ROM location
0-00[5:4]. Selectable bus speeds are: 2.89kHz (x = 0.5),
5.78kHz (x = 1), 11.56kHz (x = 2) and 23.12kHz (x = 4).
An instruction or data frame consists of a sequence of ‘1’
and/or ‘0’ symbols. Figure 9 illustrates the timing definitions.
A ‘1’ symbol is nominally 0.3 BT wide while a ‘0’ symbol is
nominally 0.7 BT wide. One ‘1’ or ‘0’ symbol is represented
in each BT period. Any detected pulse width less than 0.124
BT wide will be interpreted as a glitch and will result in a bus
error. Tables 2 and 3 summarize the timing definitions of all
the supported symbols and bus signaling.
TABLE 1. INTERRUPT EVENT SUMMARY
INTERRUPT
ENABLE BIT
INTERRUPT
STATUS FLAG
eEEW
(fixed)
sEEW
Accessing the ISL6296A during an on-going ROM write process (used only
during initial OTP ROM programming).
XSD Bus Error
eINT
sBER
XSD bus error or invalid instruction frame detected. Improper authentication
sequence detected.
Register Access Error
eINT
sACC
Accessing protected registers.
CONDITION
OTP ROM Write-in-Progress
10
INTERRUPT EVENT
FN6567.3
April 15, 2010
ISL6296A
VDDD
VDDH
DEVICE
HOST
TX
ESD
Diode
DIODE
RPU
OPEN-DRAIN
Open-Drain
PORT-PIN
Port Pin
RX
1.5μA
ESD
ESD
DIODE
Diode
RX
6pF
TX
FIGURE 8. THE CIRCUIT MODEL FOR THE XSD SERIAL BUS
tb
t0
t1
tg
XSD
glitch
GLITCH
1
0
BREAK
Break
BT
FIGURE 9. THE BUS SIGNAL TIMING DIAGRAM
TABLE 2. HOST TIMING DEFINITIONS OF SYMBOLS AND BUS SIGNALING
PARAMETER
Bit Time
SYM
BTH
DESCRIPTION
MIN
x = 0.5, 1, 2, or 4
TYP
MAX
173.6/x
De-glitch Period
tg
PW (Pulse Width) less than this will result in a frame error
‘1’ Pulse Width
t1H
PW in this range will be interpreted as a ‘1’ code
‘0’ Pulse Width
t0H
PW in this range will be interpreted as a ‘0’ code
‘Break’ Time
tbH
PW in this range will be interpreted as a ‘break’ command
UNIT
µs
0.124
BTH
0.227
0.453
BTH
0.591
0.824
BTH
1
100
BTH
NOTE: Unless otherwise stated, all pulse width (PW) referenced are with respect to an active-low pulse.
TABLE 3. DEVICE TIMING DEFINITIONS OF SYMBOLS AND BUS SIGNALING
PARAMETER
SYM
DESCRIPTION
Bit Time
BTD
x = 0.5, 1, 2, or 4
‘1’ Pulse Width
t1D
‘1’ code transmit pulse width
0.304
BTD
‘0’ Pulse Width
t0D
‘0’ code transmit pulse width
0.696
BTD
‘Break’ Time
tbD
PW in this range will be interpreted as a ‘break’ command
1.391
BTD
11
MIN
TYP
MAX
UNIT
164.2/x
172.8/x
181.4/x
µs
FN6567.3
April 15, 2010
ISL6296A
15
0
BYTES
ADDRESS
BANK
OPCODE CS
FIGURE 10. THE 16-BIT INSTRUCTION FRAME FIELD DEFINITION
TABLE 4. DEFINITION OF THE OPCODE FIELD
OPCODE
DESCRIPTION
ACTION
00
Write Operation
Write to device register
01
Read Operation (normal)
Read from device register
10
Read Operation (with CRC) Read from device register. Append 1-Byte CRC to the end of the last read frame.
11
Sleep Mode Activation
Immediately sets the device in Sleep mode.
Note: After detecting the ‘11’ Opcode, the device immediately enters Sleep mode. If more than 3
bits sent, subsequent pulses may wake the device up again.
Access Instruction Frame
TABLE 5. BANK FIELD DEFINITION
The XSD access instruction frame is shown in Figure 10.
The instruction frame consists of 16-bits of digital signal with
the contents described in the following.
BANK
CS FIELD
The CS field is a 1-Bit Chip Address Selection. An initial
1-Bit Chip Address code of ‘0’ is pre-programmed into the
device’s OTP ROM address location 0-00[7:6] at the time of
chip manufacture and may be re-programmed by the pack
manufacturer if needed. If the CS code in the instruction
does not match the device’s Chip Address code, the
instruction, and any subsequent frames that follow, will be
ignored until a break command is received.
OPCODE FIELD
The OPCODE is a 2-Bit field defines the operation of the
transaction following the instruction frame. The operations
are described in Table 4.
BANK FIELD
The memories in the ISL6296A are divided into four banks.
The BANK field is defined in Table 5.
MEMORY/REGISTER BANK SELECTION
00
OTP ROM
01
Control and Status Registers
10
Device Authentication Registers
11
Test Registers (Reserved)
ADDRESS FIELD
The address field indicates the starting address of a memory
or register read or write sequence. Keep in mind that only odd
starting addresses are allowed for the OTP ROM access.
BYTES FIELD
The bytes field indicates the number of data bytes to read or
write, not including the CRC byte. Not all BYTES Field
settings are supported. Only settings marked with an ‘X’ are
valid for a particular bus instruction, as indicated in Table 6.
Attempting to read or write with an invalid BYTES setting
may yield unpredictable results.
Writing to OTP ROM can occur only two bytes at a time, but
reading from OTP ROM can happen at 2, 4 or 16 bytes at a
time. Writing to and reading from OTP ROM in any other
byte denomination will yield unpredictable results and should
therefore be strictly prohibited.
TABLE 6. DEFINITION OF THE BYTES FIELD
BYTES
FIELD
DATA BYTES
TO FOLLOW
0
0
1
1
2
2
3
N/A
4
4
5-6
N/A
7
16
OTP ROM
WRITE
OTP ROM
READ
REG READ
OR WRITE
CHLG CODE
WRITE
COMMENTS
Invalid selection. Causes a bus error.
X
X
X
Must use 1-Byte read for clearing of the STAT register.
X
Invalid selection. Causes a bus error.
X
X
Invalid selection. Causes a bus error.
X
12
For reading from OTP ROM only (prior to lock-out).
FN6567.3
April 15, 2010
ISL6296A
Bus Transaction Protocol
Passive CRC Support
The XSD bus for the ISL6296A defines three types of bus
transactions. Figure 11 shows the bus transaction protocol.
The blue color represents the signal sent by the host and the
green color stands for the signal sent by the device. Before
the transaction starts, the host should make sure that the
XSD device is not in the sleep mode. One method is to
always send a ‘break’ signal before starting the transaction,
as shown in Figure 11. If the device is not in the sleep mode,
the ‘break’ signal is not mandatory. The ‘break’ pulse width
may appear to be wider than what the host sends out
because of the reason explained in Figure 4. The symbols in
Figure 11 are explained in Table 7.
The CRC feature only supports the read transaction in the
ISL6296A. When the OPCODE in the instruction is ‘10’, an
8-bit CRC is automatically calculated for the data bytes
being transferred out. The CRC result is then appended after
the last data byte is read out.
CRC is generated using the DOW CRC polynomial as
determined in Equation 1:
4
DESCRIPTION
MIN
IFGH Host inter-frame gap
TYP
0 BTH
IFGD Device inter-frame gap
MAX
800ms
1 BTD
TAH
Host turn-around time
1 BTH
TAD
Device turn-around time
8
(EQ. 1)
The CRC generation algorithm is logically illustrated in
Figure 12. Prior to a new CRC calculation, the LFSR (linear
feedback shift register) is initialized to zero. The read data to
be transmitted out is concurrently shifted into the CRC
calculator. After the actual data is transmitted out, the final
content of the LFSR is the resulting CRC value. This value is
transmitted out after the read data, with LSB being
transmitted out first.
TABLE 7. SYMBOLS IN THE BUS TRANSACTION PROTOCOL
SYM
5
POLYNOM = 1 + X + X + X
800ms
1 BTD
(A) Multi-Byte Write Instruction.
break
TSD
IFGH
Write Instruction Frame
Data Frame 1
IFGH
Data Frame 2
(B) Multi-Byte Read Instruction.
break
TSD
TA D
Read Instruction Frame
(C) Back-to-Back Transaction (Read Followed by Write).
break
TSD
Read Instruction Frame
TA D
Data Frame 1
(output from slave)
Data Frame
(output from slave)
IFG D
TA H
Data Frame 2
(output from slave)
Next Instruction
Frame
FIGURE 11. XSD BUS TRANSACTION PROTOCOL. THE ‘BREAK’ SIGNAL IS OPTIONAL IF THE DEVICE IS AWAKE
Serial
Output
1st
Stage
2nd
Stage
3rd
Stage
4th
Stage
5th
Stage
6th
Stage
7th
Stage
LSB
8th
Stage
MSB
FIGURE 12. THE CRC CALCULATOR FOR THE PASSIVE CRC SUPPORT
13
FN6567.3
April 15, 2010
ISL6296A
Analog Biasing Components and Clock
Generation
of the addressable registers are used nor implemented.
Accessing a non-implemented register will result in the
access instruction being ignored. A bus error indication may
or may not be flagged.
The analog section in the ISL6296A mainly includes the
Time Base Generator and the internal regulator for powering
the circuits in the ISL6296A.
Bank 0 is dedicated for the OTP ROM. There are 16 memory
locations implemented in the array. Writing to the OTP ROM
has no immediate effect on the chip operation until a
Power-on Reset occurred, or a soft reset is issued. Table 8
describes the OTP ROM memory assignment. The default
factory setting for address [0:00] is given in Table 11.
TIME BASE GENERATOR
A time base generator is included on-chip to provide timing
reference for serial data encoding and decoding at the XSD
bus interface. This eliminates the need for an external
crystal. The time base oscillator is trimmed during
manufacturing to a nominal frequency of 532.5kHz. It has a
frequency tolerance better than 5% over operating supply
voltage and temperature range.
Bank 1 contains the Control and Status registers. Only 2
registers are implemented. Table 9 shows the register map
of the Bank 1 registers. Detailed descriptions of register
settings are given in Tables 14 and 15.
INTERNAL VOLTAGE REGULATOR
Bank 2 contains the Authentication registers. Only 3
registers are implemented. These registers are used during
the battery pack authentication process. Table 10 describes
the mapping of the Authentication registers.
The ISL6296A incorporates an internal voltage regulator that
maintains a nominal operating voltage of 2.5V within the
device. The regulator draws power directly from the VDD
input. No external component is required to regulate circuit
voltage. The regulator is shut off during Sleep mode.
Bank 3 is reserved for Intersil production testing only, and
will not be accessible during normal operation. Accessing
the Test and Trim Registers when not in test mode will result
in a bus error.
Memory/Operational Register Description
The ISL6296A memory and register structure is organized
into 4 banks of 256 addressable locations. However, not all
TABLE 8. OTP ROM MEMORY MAP (BANK 0)
ADDRESS
NAME
DESCRIPTION
BIT 7
BIT 6
0-00
DCFG
Default Configuration
0-01
DTRM
Default Trimming
0-02
SE1A
Auth Secret #1A
S1A[7:0]
0-03
SE1B
Auth Secret #1B
S1B[7:0]
0-04
SE1C
Auth Secret #1C
S1C[7:0]
0-05
SE1D
Auth Secret #1D
S1D[7:0]
0-06
SE2A
Auth Secret #2A
S2A[7:0]
0-07
SE2B
Auth Secret #2B
S2B[7:0]
0-08
SE2C
Auth Secret #2C
S2C[7:0]
0-09
SE2D
Auth Secret #2D
S2D[7:0]
0-0A
SE3A
Auth Secret #3A
S3A[7:0]
0-0B
SE3B
Auth Secret #3B
S3B[7:0]
0-0C
SE3C
Auth Secret #3C
S3C[7:0]
0-0D
SE3D
Auth Secret #3D
S3D[7:0]
0-0E
INF1
General Purpose
0-0F
INF2
General Purpose
DAB[1:0]
HSF
BIT 5
BIT 4
SPD[1:0]
BIT3
BIT 2
eINT
ASLP
TIBB[2:0]
BIT 1
BIT 0
SLO[1:0]
TOSC[3:0]
General purpose non-volatile memory for storage of model ID, date code, and other
cell information
NOTE: Information stored in address 0-0E (INF1) and 0-0F (INF2) is for use by the host firmware only. Actual content depends on the host firmware
customization preference.
14
FN6567.3
April 15, 2010
ISL6296A
TABLE 9. CONTROL AND STATUS REGISTERS (BANK 1)
ADDRESS
NAME
DESCRIPTION
BIT 7
BIT 6
BIT 5
BIT 4
BIT3
BIT 2
BIT 1
BIT 0
1-00
MSCR
Master Control
eEEW
eINT
--
--
--
--
ASLP
SRST
1-01
STAT
Device Status
sEEW
sBER
sACC
--
DAB[1:0]
SLO[1:0]
TABLE 10. AUTHENTICATION REGISTERS (BANK 2)
ADDRESS
NAME
DESCRIPTION
BIT 7
BIT 6
BIT 5
BIT 4
BIT3
2-00
SESL
Secrets Selection
--
--
--
--
2-01
CHLG
Challenge Code Register
CHLG[31:0]
2-05
AUTH
Authentication Code Register
AUTH[7:0]
BIT 2
CSL[1:0]
BIT 1
BIT 0
SSL[1:0]
TABLE 11. DEFAULT CONFIGURATION (DCFG) REGISTER SETTINGS
BIT
NAME
TYPE
DEFAULT
DESCRIPTION
7:6
DAB[1:0]
RW
00
Device Address Bit Setting:
00: device responds only when CS field in instruction frame is’0’
01: device responds to any CS field value in instruction frame
10: device responds to any CS field value in instruction frame
11: device responds only when CS field in instruction frame is ‘1’
5:4
SPD[1:0]
RW
01
XSD Bus Speed Setting: Configures the bit rate of the XSD bus interface.
00: 0.5x (2.89kbps)
01: 1x (5.78kbps)
10: 2x (11.56kbps)
11: 4x (23.12kbps)
3
eINT
RW
1
Power-on default setting of eINT bit in the MSCR register.
2
ASLP
RW
1
Power-on default setting of ASLP bit in the MSCR register.
1:0
SLO[1:0]
RW
00
Secrets Lock-out Bits:
Bit 1: Read/Write lock-out bit for address locations 0-02 to 0-09 (Secret Set #1 and #2)
Bit 0: Read/Write lock-out bit for address locations 0-0A to 0-0D (Secret Set #3)
NOTE: Once Bit 0 or Bit 1 is set, writing to the OTP ROM will permanently be disabled
(after a reset cycle).
TABLE 12. DEFAULT TRIMMING (DTRM) REGISTER SETTINGS
BIT
NAME
TYPE
DEFAULT
DESCRIPTION
7
HSF
R
0
Unused
6:4
TIBB[2:0]
R
--
Reference Current Trim Setting
3:0
TOSC[3:0]
R
--
Oscillator Frequency Trim Setting
TABLE 13. LEGEND FOR THE TYPE COLUMN
ADDRESS 0-00: DEFAULT CONFIGURATION (DCFG)
TYPE
This address location stores the default configuration when
the ISL6296A is manufactured. Table 11 describes each bit in
detail. The legend for the TYPE column is given in Table 13.
READ ACTION
WRITE ACTION
R
Read-only
Data read
Data ignored
W
Write-only
Zeros read
Data written
RW Read/Write
Data read
Data written
RC Clear after read
Data read, then
cleared
Data ignored
WC Clear after write
Zeros read
Data written, then
cleared
<> Default setting loaded from designated OTP ROM bit
locations
W
Writing disabled after lock-out
15
ADDRESS 0-01: DEFAULT TRIM SETTING (DTRM)
This address location is writable only when the device is in
test mode. During normal operation, any data written to it will
be ignored. Table 12 describes the DTRM address in detail.
ADDRESS 0-02/03/04/05: AUTHENTICATION SECRET
SET #1 (SE1A/B/C/D)
These address locations store the first set of secrets to be
used for hash calculation. Reading and writing to this
register can be disabled by setting the SLO[1] bit at OTP
ROM location 0-00[1].
FN6567.3
April 15, 2010
ISL6296A
ADDRESS 0-06/07/08/09: AUTHENTICATION SECRET
SET #2 (SE2A/B/C/D)
ADDRESS 0-0A/0B/0C/0D: AUTHENTICATION SECRET
SET #3 (SE3A/B/C/D)
These address locations store the second set of secrets to
be used for hash calculation. Reading and writing to this
register can be disabled by setting the SLO[1] bit at OTP
ROM location 0-00[1].
These address locations store the optional third set of
secrets to be used for hash calculation. Reading and writing
to this register can be disabled by setting the SLO[0] bit at
OTP ROM location 0-00[0].
Alternately, this memory space can be used to store
additional cell information which can be accessed by the
host. In this case, the SLO[0] bit should not be set.
TABLE 14. MASTER CONTROL REGISTER (MSCR)
BIT
NAME
TYPE
DEFAULT
DESCRIPTION
7
eEEW
R
0
<1/0>
OTP ROM Write-in-Progress Interrupt Enable: When enabled, it allows the sEEW bit to flag an
interrupt whenever the sEEW bit is set by its interrupt event. The eEEW bit is fixed at ‘1’ when none
of the OTP ROM lock-out bits are set. When any or both of the lock-out bits are set, the eEEW bit
will become permanently ‘0’ after a reset.
6
eINT
RW
0
<1>
Global Interrupt Enable: When enabled, it allows the sBER or sACC bit to flag an interrupt to the
host whenever any of the respective interrupt events occurred.
(Default setting loaded from OTP ROM location 0-00[3])
5:2
--
R
0
1
ASLP
RW
0
<1>
Auto Sleep Mode enable: When set, the ISL6296A will automatically enter Sleep mode after about
1s of XSD bus inactivity. When cleared, the device can only enter Sleep mode on Opcode
command.
(Default setting loaded from OTP ROM location 0-00[2])
0
SRST
WC
0
Soft Reset: When a ‘1’ is written and all registers are reset to their default states, all bus counters
and timers are reset to their start-up conditions and device configuration information is reloaded
from OTP ROM. After the reset sequence is complete, a ‘break’ pulse is sent to the host.
Unused.
TABLE 15. DEVICE STATUS REGISTER (STAT)
BIT
NAME
TYPE
DEFAULT
DESCRIPTION
7
sEEW
RC
0
OTP ROM Write-in-Progress Flag: This bit is set when attempt is made by the host to read from or
write to the ISL6296A while the ROM is still processing the previous write instruction.
6
sBER
RC
0
XSD Bus Error Flag: This bit is set when one or more of the following occurs at the bus interface:
a) An invalid pulse width is received
b) Bus activity is detected before the device completes its power-up sequence
c) An invalid BYTES field in the instruction frame
d) Improper authentication sequence is detected
e) Reading secret information after the corresponding lock-out bits are set
5
sACC
RC
0
Register Access Error Flag: This bit is set whenever an instruction frame attempts to access a
protected register as follows:
a) Writing to OTP ROM after the ISL6296A has been locked out (any or both of the lock-out bits set)
b) Accessing the ISL6296A is Test and Trim Registers when the device is not in test mode
4
--
R
0
Unused
3:2
DAB[1:0]
R
00
<00>
Device Address Bit Setting:
Loaded from OTP ROM location 0-00[7:6] during power-up.
1:0
SLO[1:0]
R
00
<00>
Secrets Lock-out Bits Setting:
Loaded from OTP ROM location 0-00[1:0] during power-up.
16
FN6567.3
April 15, 2010
ISL6296A
TABLE 16. SECRETS SELECTION REGISTER (SESL)
BIT
NAME
TYPE
DEFAULT
DESCRIPTION
7:4
--
R
0000
3:2
CSL[1:0]
RW
01
Coefficient Definition Secret Selection: Selects the authentication secret code word stored in
OTP ROM to be used as the coefficient definition code for the FlexiHash engine.
00: invalid selection
01: Authentication Secret Set #1
10: Authentication Secret Set #2
11: Authentication Secret Set #3
1:0
SSL[1:0]
RW
10
Seed Secret Selection: Selects the authentication secret code word stored in OTP ROM to be
used as the secret seed for the FlexiHash engine.
00: invalid selection
01: Authentication Secret Set #1
10: Authentication Secret Set #2
11: Authentication Secret Set #3
Unused
ADDRESS 0-0E/0F: GENERAL PURPOSE MEMORY
(INF1/2)
These address locations can be used to store information
like model ID, date code, and other cell information, which
can be read by the host.
ADDRESS 1-00: MASTER CONTROL REGISTER (MSCR)
The Master Control Register is defined in Table 14. The
MSCR register can be both read or written by the host
through the XSD bus.
ADDRESS 1-01: DEVICE STATUS REGISTER (STAT)
The STAT register is defined in Table 15. All status bits will
be cleared upon a read to this register. The STAT is a
read-only register.
ADDRESS 2-00: SECRETS SELECTION REGISTER
(SESL)
This register must be written to re-load the hash engine with
secrets stored in OTP ROM prior to presenting a new
challenge code word input.
ADDRESS 2-01: CHALLENGE CODE INPUT REGISTER
(CHLG)
This register is used to input the 32-Bit challenge code
generated by the host for device authentication. All four
bytes of the challenge code should be written sequentially to
this register, starting with the least-significant byte. After the
fourth challenge byte is received, the authentication code
generation process will start. This CHLG is a write-only
register.
ADDRESS 2-05: AUTHENTICATION CODE OUTPUT
REGISTER (AUTH)
This register is used to output the 8-Bit authentication code
calculated from the 32-Bit challenge code. The register
content may be read only once after each challenge code
word is written to the device. Subsequent read to this
register without a new challenge being input will result in an
error condition.
17
Applications Information
XSD Bus Implementation
There are two ways to implement the XSD host in a
microprocessor. One way is to use a spare UART (Universal
Asynchronous Receiver/Transmitter). A GPIO (General
Purpose Input/Output) can be used if no UART is available
for the XSD communication. Refer to Application Note
AN1167 available from Intersil for more information
regarding how to implement the XSD bus within a
microprocessor.
Pull-Up Resistor Selection
Since there is an internal pull-down current on the XSD pin,
(as shown in Figure 8), it is important to choose a pull-up
resistor value that is low enough so that the small amount of
pull-down current through the resistor does not cause the
bus voltage to droop below the VIH specification under any
condition. 5kΩ is a typical resistance used for pull-up.
Powered by XSD Bus
In applications where the device supply voltage is lower than
2.6V (such as an application powered by a single-cell NiMH
battery), or a device that has no power source at all, the
ISL6296A can be powered by the XSD bus. The application
circuit is shown in Figure 2. The condition for the application
circuit to function properly is that the bus pull-up voltage is
3.3V or 5V. The bus pull-up voltage will charge the capacitor
C1 through an internal ESD diode, as shown in Figure 8. The
ESD diode has 0.4V drop typically.
ESD Rating
The ISL6296A ESD specification is rated at 4kV of the
human body model. When the ISL6296A is used in a
handheld accessory, a higher ESD rating is typically
required. External components are required to enhance the
ESD performance.
FN6567.3
April 15, 2010
ISL6296A
VBAT
VDDHOST
R2
VDD
ISL6296A
HOST PROCESSOR
Rpu
R1
XSD
LOGIC
LOGIC
D1
A
Q1
VSS
FIGURE 13. TYPICAL APPLICATION BLOCK DIAGRAM
XSD Pin Series Resistor Selection
Solving for R1:
A series resistor may be used to improve ESD performance
of the XSD input. In Figure 13, resistor R1 and zener diode
D1 provide ESD protection for the ISL6296A XSD pin.
R1 ≤ 2131 Ω
Resistor R1 must be selected to provide valid VIL logic level at
the host processor (point ‘A’ in Figure 13) when the ISL6296A is
asserting the bus low by turning on Q1. The maximum
resistance value of R1 can be calculated if one knows the
VDDHOST voltage, the VIL requirements of the host processor,
the Rpu resistor value, and the RDS(ON) of Q1.
The maximum RDS(ON) of Q1 in Figure 13 is 400Ω, as per
the XSD pin VOL specification in the “Electrical
Specifications” on page 3. Point ‘A’ voltage, with Q1 on, is
given by Equation 2.
( R1 + 400 Ω )
V A = VDDHOST ---------------------------------------------------( R1 + 400 Ω + Rpu )
(EQ. 2)
To be detected as a logic '0' by the host, voltage at point ‘A’
must be no greater than the host’s VIL input voltage.
V A ≤ V IL
(EQ. 3)
Therefore,
( R1 + 400 Ω )
VDD HOST ---------------------------------------------------- ≤ V IL
( R1 + 400 Ω + Rpu )
(EQ. 4)
For example, suppose the XSD pull-up voltage is 2.6V, a
4.7kΩ pull-up is used, and the host’s VIL threshold is 35% of
its supply voltage.
VDD HOST = 2.6V
(EQ. 5)
Rpu = 4.7k Ω
(EQ. 6)
V IL ( HOST ) = VDDHOST × 35 % = 0.91V
(EQ. 7)
(EQ. 9)
VDD Pin Series Resistor Selection
A series resistor may be used to improve ESD performance
of the VDD input as shown by R2 in Figure 13.
Resistor R2 must be selected to allow operation of the
ISL6296A at the minimum VBAT voltage at which
communication must be successful. The maximum
resistance of R2 can be calculated if one knows the
minimum VBAT voltage, maximum ISL6296A supply current,
and minimum ISL6296A supply voltage, using the formula in
Equation 10.
( VBATMIN – VDD MIN )
R2 ≤ -------------------------------------------------------------IDD MAX
(EQ. 10)
For example, suppose the minimum VBAT voltage in the
application is 2.8V. The minimum ISL6296A VDD voltage is
2.6V, and maximum supply current is 55µA, as per the
“Electrical Specifications” table on page 3. The maximum
value for R2 can then be calculated.
( 2.8V – 2.6V )
R2 ≤ -----------------------------------55 μ A
(EQ. 11)
R2 ≤ 3.636k Ω
(EQ. 12)
Additional Application Information
See “Related Literature” on page 1 for additional application
information.
Plugging these constants into Equation 4:
( R1 + 400 Ω )
2.6V --------------------------------------------------------- ≤ 0.91V
( R1 + 400 Ω + 4.7k Ω )
18
(EQ. 8)
FN6567.3
April 15, 2010
ISL6296A
Package Outline Drawing
L8.2x3A
8 LEAD THIN DUAL FLAT NO-LEAD PLASTIC PACKAGE WITH E-PAD
Rev 1, 06/09
0.25
B
0.50
2.20
6
PIN 1
INDEX AREA
(4X)
6
PIN #1 INDEX AREA
3.00
A
1.80 +0.1/ -0.15
2.00
0.15
(8x0.40)
1.65 +0.1/ -0.15
TOP VIEW
BOTTOM VIEW
(8x0.25)
PACKAGE
OUTLINE
(6x0.50)
0.75
SEE DETAIL "X"
SIDE VIEW
1.80
3.00
0.05
(8x0.40)
1.65
C
0.20 REF
C
BASE PLANE
SEATING PLANE
0.08 C
5
(8x0.20)
0.05
2.00
TYPICAL RECOMMENDED LAND PATTERN
DETAIL "X"
NOTES:
1.
Dimensions are in millimeters.
Dimensions in ( ) for Reference Only.
2.
Dimensioning and tolerancing conform to AMSE Y14.5m-1994.
3.
Unless otherwise specified, tolerance : Decimal ± 0.05
4.
Dimension b applies to the metallized terminal and is measured
between 0.20mm and 0.32mm from the terminal tip.
5.
Tiebar shown (if present) is a non-functional feature.
6.
The configuration of the pin #1 identifier is optional, but must be
located within the zone indicated. The pin #1 indentifier may be
either a mold or mark feature.
19
FN6567.3
April 15, 2010
ISL6296A
Small Outline Transistor Plastic Packages (SOT23-5)
P5.064
D
VIEW C
e1
5 LEAD SMALL OUTLINE TRANSISTOR PLASTIC PACKAGE
INCHES
5
SYMBOL
4
E
CL
1
2
CL
3
e
E1
b
CL
α
0.20 (0.008) M
C
C
CL
A
A2
SEATING
PLANE
A1
-C-
WITH
b
PLATING
b1
c
c1
MILLIMETERS
MAX
MIN
MAX
NOTES
A
0.036
0.057
0.90
1.45
-
A1
0.000
0.0059
0.00
0.15
-
A2
0.036
0.051
0.90
1.30
-
b
0.012
0.020
0.30
0.50
-
b1
0.012
0.018
0.30
0.45
c
0.003
0.009
0.08
0.22
6
c1
0.003
0.008
0.08
0.20
6
D
0.111
0.118
2.80
3.00
3
E
0.103
0.118
2.60
3.00
-
E1
0.060
0.067
1.50
1.70
3
e
0.0374 Ref
0.95 Ref
-
e1
0.0748 Ref
1.90 Ref
-
L
0.10 (0.004) C
MIN
0.014
0.022
0.35
0.55
L1
0.024 Ref.
0.60 Ref.
L2
0.010 Ref.
0.25 Ref.
N
5
5
4
5
R
0.004
-
0.10
-
R1
0.004
0.010
0.10
0.25
α
0o
8o
0o
8o
Rev. 2 9/03
NOTES:
BASE METAL
1. Dimensioning and tolerance per ASME Y14.5M-1994.
2. Package conforms to EIAJ SC-74 and JEDEC MO178AA.
4X θ1
3. Dimensions D and E1 are exclusive of mold flash, protrusions,
or gate burrs.
R1
4. Footlength L measured at reference to gauge plane.
5. “N” is the number of terminal positions.
R
GAUGE PLANE
SEATING
PLANE
L
C
L1
α
L2
6. These Dimensions apply to the flat section of the lead between
0.08mm and 0.15mm from the lead tip.
7. Controlling dimension: MILLIMETER. Converted inch dimensions are for reference only.
4X θ1
VIEW C
All Intersil U.S. products are manufactured, assembled and tested utilizing ISO9000 quality systems.
Intersil Corporation’s quality certifications can be viewed at www.intersil.com/design/quality
Intersil products are sold by description only. Intersil Corporation reserves the right to make changes in circuit design, software and/or specifications at any time without
notice. Accordingly, the reader is cautioned to verify that data sheets are current before placing orders. Information furnished by Intersil is believed to be accurate and
reliable. However, no responsibility is assumed by Intersil or its subsidiaries for its use; nor for any infringements of patents or other rights of third parties which may result
from its use. No license is granted by implication or otherwise under any patent or patent rights of Intersil or its subsidiaries.
For information regarding Intersil Corporation and its products, see www.intersil.com
20
FN6567.3
April 15, 2010