BL7432SM Low voltage Intelligent 2K bits EEPROM Description BL7432SM is an IC for Chip Card made by 0.35um CMOS EERPOM process. It has 256 bytes EEPROM with write protect function .It can be operated at low voltage. With its contact configuration in accordance to ISO standard 7816.BL7432SM can be widely used in different types of IC memory cards. Figure 1 Features • • • • • • • • • • • 256 x 8 bit EEPROM organization Byte-wise addressing Irreversible byte-wise write protection of lowest 32 addresses (Byte 0 ……31) 32 x1 bit organization of protection memory Two-wire link protocol End of processing indicated at data output Answer-to-Reset according to ISO standard 7816-3 Programming time 2.5 ms per byte for both erasing and writing Minimum of 100,000 write/erase cycles Data retention time :>10 years Contacts configuration and serial interface according to ISO 7816 standard (synchronous transmission) Pin Description Pin No. 1 2 3 4 5 6 7 8 Parameter C1 C2 C3 C4 C5 C6 C7 C8 http://www.belling.com.cn Symbol Vdd RST CLK N.C. GND NC I/O NC -1Total 8 Pages Function Description Supply Voltage Reset signal Clock input Not connected Ground Not connected Bidirectional data line (open drain) Not connected 5/18/2010 Wrote by ICCD BL7432SM Low voltage Intelligent 2K bits EEPROM Function Description Block Diagram M a in m e m o ry P ro te c tio n m e m o ry 255 31 EEPROM 256X8 32 31 Area for perma nent da ta stora ge 0 0 D a ta A d d res s D a ta A d d ress 8 5 M e m o ry M ain /P rotection S ecu rity H V G e n e ra to r D e co d e r C u rre n t C olu m n S a m p lin g G e n e ra to r R eset B lock Logi c A d d . D a ta R e g is te r , C o m p a ra to r S e q ue nc e r A nd S e c urity P ro g ra m C o n tro l In terfac e L o g ic VCC I/O R S T C L K GND Figure 2 The BL7432SM consists of 256 x 8 bit EEPROM main memory (figure 2) and a 32-bit protection-memory with PROM functionality .The main memory is erased and written byte by byte. When erased, all 8 bits of a data byte are set to logical one. When written, the information in the individual EEPROM cells is to the input data, altered bit by bit to logical zeros (logical AND between the old and the new data in the EEPROM). Normally a data change consists of an erase and write procedure. It depends on the contents of the data byte in the main memory and the new data byte whether the EEPROM is really erased and/or written. If none of the 8 bits in the addressed byte requires a zero-to-one transition the erase access will be suppressed. Vice versa the write access will be suppressed if no one-to-zero transition is necessary. The write and the erase operation takes at least 2.5 ms each. The first 32 bytes can be irreversibly protected against data change by writing the corresponding bit in the protection memory. Each data byte in this address range is assigned to one bit of the protection memory and has the same address as the data byte in the main memory which it is assigned to. Once written the protection bit cannot be erased. Transmission Protocol The transmission protocol is a two wire link protocol between the interface device IFD and the integrated circuit IC. It is identical to the protocol type “S=10”. All data changes on I/O are initiated by the falling edge on CLK. http://www.belling.com.cn -2Total 8 Pages 5/18/2010 Wrote by ICCD BL7432SM Low voltage Intelligent 2K bits EEPROM The transmission protocol consists of the 4 modes: 1) Reset and Answer-to-Reset 2) Command Mode 3) Outgoing Data Mode 4) Processing Mode (1) Reset and Answer-to-Reset Answer-to-Reset takes place according to ISO standard 7816-3. The reset can be given at any time during operation. In the beginning, the address counter id set to zero together with a clock pulse and the first data bit (LSB) is output to I/O when RST is set from state H to state L. Under a continuous input of additional 31 clock pulses the contents of the first 4 EEPROM rd addresses can be read out. The 33 clock pulse switches I/O to state H (figure 3). During Answer-to-Reset any start and stop condition is ignored. VCC RST 1 2 3 4 1 2 3 ... 31 32 30 31 CLK ... 32 I/O RST td4 tH td4 tL CLK td2 td5 I/O Figure 3 Reset and Answer-to-Reset (2) Command Mode After the Answer-to-Reset the chip waits for a command. Every command begins with a start condition, includes a 3 bytes long command entry followed by an additional clock pulse and ends with a stop condition (figure 4). --Start condition: Falling edge on I/O during CLK in state H --Stop condition: Rising edge on I/O during CLK in state H IFD sets I/O to State L Command 1 2 3 4 23 24 CLK I/O START From IFD tL tF CLK td7 STOP From IFD tR td5 td1 td8 td3 tBUF I/O Figure 4 Command Mode http://www.belling.com.cn -3Total 8 Pages 5/18/2010 Wrote by ICCD BL7432SM Low voltage Intelligent 2K bits EEPROM After the reception of a command there are two possible modes: --Outgoing data mode for reading --Processing mode for writing and erasing (3) Outgoing Data Mode In this mode the IC sends data to the IFD. Figure 5 shows the timing diagram. The first bit becomes valid on I/O after the first falling edge on CLK. After the last data bit an additional clock pulse is necessary in order to set I/O to state H and to prepare the IC for a new command entry. During this mode any start and stop condition is discarded. IC sets I/O to State H Command CLK 1 2 3 1 I/O 4 2 n-1 3 n n-1 n Start of Outgoing Data Figure 5 Outgoing Data Mode (4) Processing Mode In this mode the IC processes internally. Figure 6 shows the timing diagram. The IC has to be clocked continuously until I/O which was switched to state L after the first falling edge of CLK is set to state H. Any start and stop condition id discarded during this mode. CLK 1 2 3 n-1 n I/O Start of Processing td2 td2 End of Processing Figure 6 Processing Mode Commands (1) Command Format Each command consists of three byte: MSB Control LSB B7 B6 B5 B4 B3 B2 B1 B0 http://www.belling.com.cn MSB Address LSB A7 A6 A5 A4 A3 A2 A1 A0 -4Total 8 Pages MSB Data LSB D7 D6 D5 D4 D3 D2 D1 D0 5/18/2010 Wrote by ICCD BL7432SM Low voltage Intelligent 2K bits EEPROM Beginning with the control byte LSB is transmitted first. B7 B6 B5 B4 B3 B2 B1 B0 Byte 2 Address A7~A0 Byte 3 Data D7~D0 0 0 1 1 0 0 0 0 Address No effect 0 0 1 1 1 0 0 0 Address Input data 0 0 1 1 0 1 0 0 No effect No effect 0 0 1 1 1 1 0 0 Address Input data Byte 1 Control Operation Read Main Memory Update Main Memory Read Protection Memory Write Procection Memory Mode Outgoing data Processing Outgoing Data Processing (2) Description of Command Read Main Memory The command reads out the contents of the main memory(with LSB first)starting at the given byte address(N) UP TO THE END MEMORY. After the command entry the IFD has to supply sufficient clock pulses. The number of clocks is m=(256-N)*8+1.The read access to the main memory is always possible. Read Protection Memory The command transfers the protection bits under a continuous input of 32 clock pulses to the output. I/O is switched to state H by an additional pulse. The protection memory can always be read. Update Main Memory The command programs the address EEPROM byte with the data byte transmitted. Depending on the old and new data, one of the following sequences will take place during the processing mode: -- erase and write (5.0ms) corresponding to m = 255 clock pulses -- write without erase (2.5ms) corresponding to m = 124 clock pulses -- erase without write (2.5ms) corresponding to m = 124 clock pulses (all values at 50 kHZ clock rate) Command Entry CLK I/O 1 2 3 1 2 Processing 1 24 2 3 m-2 m-1 m 24 RST Figure 7 Update Main Memory Write Protection Memory The execution of this command contains a comparison of the entered data byte with the assigned byte in the EEPROM .In case of identity the protection bit is written thus making the data information unchangeable. If the data comparison results in data differences writing of the protection bit will be suppressed. Execution times and required clock pulses see Update Main Memory. http://www.belling.com.cn -5Total 8 Pages 5/18/2010 Wrote by ICCD BL7432SM Low voltage Intelligent 2K bits EEPROM Reset Modes (1) Power-on-Reset After connecting the operating voltage to VCC ,I/O is state H. By all means, a read access to an address or an Answer-to-Reset must be carried out before data can be altered. (2) Break If RST is set to high during CLK in state L any operation is aborted and I/O is switched to state H. Minimum duration of Tres=5us is necessary to trigger a defined valid reset(figure 9).After Break the chip is ready for further operations. RST tRCS td9 CLK I/O Figure 9 Break Failures Behavior in case of failures: In case of one of the following failures, the chip sets the I/O to state H after 8 clock pulses at the latest. Possible failures: --Comparison unsuccessful --Wrong command --Wrong number of command clock pulses --Write/erase access to already protected bytes --Rewriting and erasing of a bit in the protection memory Coding of the Chip Due to security purposes every chip is irreversibly coded by a scheme. By this way fraud and misuse is excluded. As an example, figures 10 and 11 show ATR and Directory Data of structure 1.When delivered, ATR header, ICM and ICT are programmed. Depending on the agreement between the customer and Shanghai Belling CO. LTD. ICCF, the chip type and other content can be also programmed before delivery. ATR data ATR header H1 H2 H3 H4 TM LM ICM ICT DIR data ICCF ICCSN TT LT TA LA Application AID TD LD FILE AP LD LA LM LT AID:Application identifier ICCF:IC card fabricator identifier LM:Length of manufacturer data AP:Application personalizer identifier ICCSN:IC card serial number LT:Length of application template ATR:Answer-to-Reset ICM:IC manufacturer identifier TA:Tag of AID DIR:Directory H1,H2:ATR protocol bytes ICT:IC type LA:Length of AID TD:Tag of discretionary data TM:Tag of manufacturer data H3,H4:ATR historical bttes LD:Length of application template TT:Tag of application data Figure 10 Synchronous Transmission ATR and Directory Data of Structure1 http://www.belling.com.cn -6Total 8 Pages 5/18/2010 Wrote by ICCD BL7432SM Low voltage Intelligent 2K bits EEPROM Protocol bytes according to ISO 7816-3 Protocol type H1 Protocol parameter H2 Historical bytes acoording to ISO 7816-4 Category indicator H3 DIR data reference H4 b8 b7 b6 b5 b4 b3 b2 b1 b8 b7 b6 b5 b4 b3 b2 b1 b8 b7 b6 b5 b4 b3 b2 b1 b8 b7 b6 b5 b4 b3 b2 b1 1 0 1 0 0 0 1 0 0 0 0 1 0 0 1 1 0 0 0 1 0 0 0 0 1 0 0 1 0 0 0 1 Protocol type RFU Structure indentifier Number Length of of data data units x units in bits (2 x ) Category indicator according to ISO 7816-4 00= defined by ISO 10=structure 1 01=structure 2 11=structure 3 not defined by ISO b7-b1= reference of DIR data b8=0 b7-b1= Outside the scope RFU 0-7 =defined by ISO 8-E = notdel. by ISO 8= serial data access protocol 9=3 wire bus protocol A=2 wire bus protocol F=RFU b8=1 of 7816-4 000= no indication 001=128 010=256 011=512 100=1024 101=2048 110=4096 111=RFU 0: Read to end 1: 1: Read with defined length 0: DIR data reference specified DIR data reference not specified Figure 11 Answer-to-Reset for Synchronous Transmission Coding of Structure Chip and Package http://www.belling.com.cn -7Total 8 Pages 5/18/2010 Wrote by ICCD BL7432SM Low voltage Intelligent 2K bits EEPROM Electrical Parameter • Absolute Maximum Ratings Parameter Symbol Supply voltage Input voltage (any pin) Storage temperature Power comsumption Operation temperature • VCC VI TS PT Unit Max 6.0 6.0 125 70 70 Test Condition V V ℃ mw ℃ DC Characteristics min. 3.0 Limit Values typ. 5.0 3 Max 5.5 10 VIH VCC -1 - VCC +0.3 V VIL VGND-0.2 - VGND +0.8 V IH - - 50 µA IOL 1 - - mA VOL =0.4V,open drain IOH - - 50 A VOH = VCC,open drain CI - - 10 pF Parameter Symbol Supply voltage Supply current High-level input voltage (I/O,CLK,RST) Low-level input voltage (I/O,CLK,RST) High-level input current (I/O,CLK,RST) Low-level output current (I/O) High-level leakage current (I/O) Input capacitance VCC ICC • Limit Values typ. min. -0.3 -0.3 -40 -35 Unit Test Condition V mA AC Characteristics Parameter Clock frequency Clock high period Clock low period Rise time Fall time Hold time start condition Delay time Setup time for stop condition Setup time Hold time data Answer to reset Setup time data Setup time for start condition Reset Delay time Eraser time Write time Time before new start condition Symbol CLK tH tL tR tF td1 td2 td3 td4 td5 td6 td7 td78 tRES tdg TER tWR TBUF min. 7 9 9 Limit Values typ. Max 50 1 1 4 2.5 4 4 1 20 1 4 5 2.5 2.5* 2.5* 10 Unit Test Condition µs µs µs µs µs µs µs µs µs µs µs µs µs µs ms ms µs *f =50 kHz http://www.belling.com.cn -8Total 8 Pages 5/18/2010 Wrote by ICCD