DS1205S

DS1205S DALLAS | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 17

Technical content

FEATURES

• Three secure read/write data partitions of 384 bits each
• One non-secure read/write data partition of 512 bits
• Secure data cannot be deciphered by reverse engi- neering
• Guaranteed unique, 48-bit, laser etched serial number
• 64-bit password and I.D. fields provide positive identi- fication and security for each secure data partition
• Maximum data transfer rate of 2 million bits/second
• Low-power CMOS circuitry
• Access via 3-wire or 1-wire interface
• Applications include proprietary data, financial trans- actions, secure personnel areas, and systems ac- cess control

DESCRIPTION

The DS1205S MultiKey Chip is an enhanced version of the DS1204U Electronic Key which has both a standard 3-wire interface (data, clock, and reset) and a 1-wire in- terface. The DS1205S MultiKey has three secure read/ write subkeys which are each 384 bits in length. In addi- tion, there is a 512-bit read/write scratchpad which can be used as a non-secure data area or as a holding regis- ter for data transfer to one of the three subkeys. Each subkey within the part is uniquely addressable on byte boundaries. PIN ASSIGNMENT 8 9 16VCCI NC DQ NC CLK VCCO NC GND NC DQOE BAT NCNC GND I/ORST DS1205S 16-Pin SOIC (300 mil) See Mech. Drawings Section PIN DESCRIPTION VCCI – +5V Supply (Battery Backup Mode) RST – Reset (3-Wire) DQ – Data (3-Wire) CLK – Clock (3-Wire) GND – Ground BAT – Battery (+) (Battery Backup Mode) DQOE – Data Available (3-Wire) I/O – Data I/O (1-Wire) VCCO – Battery (+) (Battery Powered Mode) OPERATING MODES There are two modes of operation for powering the DS1205S MultiKey Chip. In the Normal Mode (Battery Backup), V CC power is supplied to the part on the VCCI pin, while the battery backup source is applied to the BAT pin. In this mode of operation, the chip supply is switched internally between VCCI and BAT (depending on which is higher) and this level is presented internally to the VCCO pin. In the Battery Operate Mode, the bat- tery supply is connected directly to the VCCO pin while the VCCI and BAT pins are grounded.

Two interfaces to the DS1205S are provided. The 1-wire interface requires a 1-wire I/O command for ad- dressing the device. An additional function command word is then passed through the 1-wire interface to ac- cess the various DS1205S functions. The 3-wire inter- face (data (DQ), reset (RST), and clock (CLK)) requires only the function command word. The four 1-wire I/O commands that deal with the unique lasered ROM are available only through the 1-wire interface. All other functions are available through either interface. FUNCTIONS A command word written written to the DS1205S Multi- Key specifies the operation to be performed and the partition to be operated on. There are two classes of functions available. One class includes operations on the read/write secure partitions. The other class in- cludes operations on the read/write scratchpad (Figure 1). COMMAND OPERATIONS Figure 1 COMMAND WORD SUBKEY 0 SUBKEY 1 SUBKEY 2 SECURE READ/WRITE SCRATCHPAD SCRATCHPAD (24 BITS) READ/WRITE The 24 bit function command word is organized into three fields of eight bits each. These one byte fields in- clude the function to be performed, the memory partition to be accessed and the starting byte address for the data transfer operation. The starting byte address and the partition codes are required to be given in both real and complement form. If these values do not match, ac- cess to the part will be denied (Figure 2). The function command word is presented to the DS1205S LSB first. The first byte contains the 8-bit function code that defines which of the six valid function codes is to be executed. Each function code is valid for only certain partition and starting address combina- tions. Figure 3 illustrates the valid partition code, start- ing address and function code combinations. The se- cond byte consists of the 2-bit partition code, identifying which partition is being accessed, and the 6-bit starting byte address, which specifies where to start the access of the given partition. The third byte consists of the com- plement of the 2-bit partition code and the complement of the 6-bit starting byte address.

COMMAND WORD STRUCTURE Figure 2 (KK) MSB LSB (AAAAAA) FFFFFFFF(KK)C (AAAAAA) C (KK) = Two-bit number specifying which partition is to be accessed. 00 specifies subkey 0. 01 specifies subkey 1. 10 specifies subkey 2. 11 specifies the scratchpad. (KK)C = Complement of (KK) on a bit-by-bit basis. If the numbers are not complements the command word is invalid and no action will be taken. (AAAAAA) = Address field containing address bits that define the starting byte address of the partition to be accessed. (AAAAAA) C = Complement of (AAAAAA) on a bit-by-bit basis. If the numbers are not complements the com- mand word is invalid and no action will be taken. FFFFFFFF = Function code field. Specifies the action to be taken. LOCATIONS, AND FUNCTION CODES FOR EACH COMMAND WORD Figure 3 COMMAND VALID PARTITION CODE KK VALID BYTE ADDRESS AAAAAA VALID FUNCTION CODE FFFF FFFF Set Scratchpad 11 0 - 63 1001 0110 Get Scratchpad 11 0 - 63 0110 1001 Set Secure Data 00, 01, 10 16 - 63 1001 1001 Get Secure Data 00, 01, 10 16 - 63 0110 0110 Set Security Match 00, 01, 10 000000 0101 1010 Move Block 00, 01, 10 000000 0011 1100 SECURE PARTITION COMMANDS Each of the three secure partitions within the DS1205S MultiKey is comprised of a 64-bit I.D. field, a 64-bit secu- rity match code and a 384-bit secure data field (Figure 4). The three commands that operate on the secure partitions are: 1) Set Security Match 2) Set Secure Data 3) Get Secure Data As a guard against attackers, the security match code can never be read. Similarly, tampering through repro- gramming will immediately clear the entire secure parti- tion. SECURE PARTITION ORGANIZATION Figure 4 ID FIELD SECURITY MATCH FIELD SECURE DATA FIELD

64 BITS 384 BITS64 BITS

SET SECURITY MATCH Figure 5 SET SECURE DATA Figure 6 WRITE SET PASSWORD IN COMMAND WORD (SPECIFY WHICH SECURE PARTITION) READ I.D. FIELD FROM SECURE PARTITION (64 BITS) WRITE 64 BITS OF DATA TO DS1205 (OLD I.D.) IS DATA = I.D? TERMINATE TRANSACTION NO YES WRITE 64 BITS OF DATA FOR NEW I.D. FIELD DATA WRITE 64 BITS OF DATA FOR NEW PASSWORD FIELD DATA TERMINATE TRANSACTION ERASE I.D. AND PASSWORD FIELD, SECURE DATA FIELD FOR SELECTED SECURE PARTITION. READ I.D. FIELD FROM SECURE PARTITION (64 BITS) TERMINATE TRANSACTION NO YES WRITE SET SECURE DATA IN COMMAND WORD (SPECIFY WHICH SECURE PARTITION AND STARTING BYTE ADDRESS) WRITE 64 BITS OF DATA TO DS1205 IS DATA = PASSWORD? TERMINATE TRANSACTION WRITE DATA TO SECURE DATA FIELD (STARTING ADDRESS SPECIFIED IN COMMAND WORD)* *Data is written to the DS1205S beginning at the specified address and continuing until either Bit 511 is written or the RST line is brought low.

GET SECURE DATA Figure 7 SET SCRATCHPAD Figure 8 READ I.D. FIELD FROM SECURE PARTITION (64 BITS) NO YES WRITE SET SECURE DATA IN COMMAND WORD (SPECIFY WHICH SECURE PARTITION AND STARTING BYTE ADDRESS) WRITE 64 BITS OF DATA TO DS1205 IS DATA = OUTPUT RANDOM DATA OUTPUT SECURE DATA FIELD CONTENTS* TERMINATE TRANSACTION NO YES WRITE SET SCRATCHPAD IN COMMAND WORD WRITE DATA BITS TO DS1205 (STARTING ADDRESS SPECIFIED IN COMMAND WORD) IS BYTE 63 WRITTEN YET? NO YES TERMINATE TRANSACTION HAS RST LINE GONE LOW? *Data is read from the DS1205S beginning at the specified address and continuing until either Bit 511 is read or the RST line is brought low. SECURITY MATCH?

(STARTING ADDRESS SPECIFIED IN COMMAND WORD) IS BYTE 63 READ YET? SET GET SCRATCHPAD PARTITION IN COMMAND WORD HAS RST LINE GONE LOW? BLOCK SELECTIONS Figure 10 BLOCK NUMBER BYTE ADDRESS SCRATCHPAD IN: SUBKEY 0 0-7 0-7(ID) 1 8-15 8-15 (PASSWORD) 2 16-23 16-23 (SECURED) 3 24-31 24-31 (SECURED) 4 32-39 32-39 (SECURED) 5 40-47 40-47 (SECURED) 6 48-55 48-55 (SECURED) 7 56-63 56-63 (SECURED) BLOCK SELECTOR CODES FOR MOVE BLOCK COMMAND Figure 11 BLOCK # SELECTOR CODE 0 4C69 6E64 9DB3 9A9A (H) 1 4C69 919B 624C 9A9A (H) 2 4C96 6E9B 62B3 659A (H) 3 4366 616B 6D43 6A6A (H)

4 BC99 9E94 92BC 9595 (H)

5 B369 9164 9D4C 9A65 (H)

6 B396 6E64 9DB3 6565 (H)

7 B396 919B 624C 6565 (H)

ALL BLOCKS 7F5A 5D57 517F 5656 (H)

WRITE 64–BIT PASSWORD OF DESTINATION SUBKEY TERMINATE TRANSACTION NO YES WRITE MOVE BLOCK IN COMMAND WORD IS DATA = PARTITION PASSWORD? TRANSFER SPECIFIED SCRATCHPAD DATA BLOCKS TO SPECIFIED PARTITION ERASE ALL SCRATCHPAD MEMORY TERMINATE TRANSACTION WRITE 64–BIT BLOCK SELECTOR CODE TO DS1205 *TRANSPARENT TO USER 3-WIRE BUS The 3-wire bus is comprised of three signals. These are the RST (reset) signal, the CLK (clock) signal, and the DQ (data) signal. All data transfers are initiated by driv- ing the RST input high. The RST signal provides a meth- od of terminating a data transfer. A clock cycle is a sequence of a falling edge followed by a rising edge. For data inputs, the data must be valid during the rising edge of a clock cycle. Command bits and data bits are input on the rising edge of the clock and data bits are output on the falling edge of the clock. All data transfers terminate if RST is low and the DQ pin goes to a high impedance state. When data transfers to the DS1205S are terminated by the RST signal going low, the transition of the RST going low must occur dur- ing a high level of the CLK signal. Failure to ensure that the CLK signal is high will result in the corruption of the last bit transferred. Data transfers are illustrated in Figure 13 and Figure 14 for normal modes of operation.

tion and transaction sequence. Figure 16. The value of the pull-up resistor should be than 560 µS, all components on the bus will be reset.

RESET/PRESENCE DETECT SEQUENCE Figure 17 IDLE FIRST BIT OF 1–WIRE PROTOCOL tRSTL tPDH tRSTH tPDL tSYC RESET PULSE DRIVEN LOW BY HOST PRESENCE DETECT DRIVEN BY 1–WIRE DEVICE STATE 1-Wire I/O Commands - Once the bus master has de- tected a presence, it can issue one of the four different 1-wire I/O commands. These commands deal with the laser-etched ROM code which has the following format. Type ID Unique Serial Number CRC 8 bits 48 bits 8 bits All 1-wire commands are eight bits long. A list of these commands are as follows: CCh Pass Thru Mode This command saves time by allowing direct ac- cess to the DS1205S without identifying it by ROM ID number. This command can only be used when there is a single slave on the bus. If more than one device is present, there will be bus con- tention. 33h Read ROM Data This command allows the bus master to read the DS1205S’s unique 48-bit ID number and CRC. This command can only be used if there is a single DS1205S on the bus. If more than one is present, there will be bus contention. 55H Match ROM Data This mode allows the bus master to single out a specific DS1205S on a multidrop bus. The bus master selects the specific slave by the ROM ID number for the transaction. This command can be used with a single or multiple device on the bus. F0h Search ROM Data When a system is initially brought up, the bus master might not know the number or types of de- vices on the bus. By invoking the Search ROM Data command the bus master can, by process of elimination, find the ID numbers of all the devices on the bus. Once this is known, the bus master can then go back and read the device type that corresponds to each ID number. The ROM search process is the repetition of a simple 3-step routine: read a bit, read the complement of the same bit, then write the desired value of that bit. The bus master performs this simple 3-step routine on each bit of the ROM. After one complete pass, the bus master knows the contents of the ROM in one device. The bus is reset and the process is repeated again, selecting a different set of bit values. The bus master controls the search according to what values are written as select bits. The following example of the ROM search process as- sumes four different devices are connected to the same 1-wire bus. The ROM data of the four devices is as shown: ROM1 00110101... ROM2 10101010... ROM3 11110101... ROM4 00010001... The search process is as follows: 1. The bus master begins by resetting all devices pres- ent on the 1-wire bus. After this, the bus master will attempt to read the family code, serial number, and CRC value for the part. 2. The bus master will then issue the Search ROM Data command on the 1-wire bus. 3. The bus master performs two reads and receives two 0 bits. This indicates that both 1 bits and 0 bits exist as the first bit of the devices on the bus.

1. The bus master writes a 0. This deselects ROM2 and ROM3 for the remainder of this search pass, leaving only ROM1 and ROM4 connected to the 1-wire bus. 5. The bus master performs two more reads and re- ceives a 0 bit followed by a 1 bit. This indicates that all devices still coupled to the bus have 0’s as their second ROM data bit. 6. The bus master then writes a 0 to keep both ROM1 and ROM4 coupled. 7. The bus master executes two reads and receives two 0 bits. This indicates that both 1 bits and 0 bits exist as the third bit of the ROM data of the attached devices. 8. The bus master writes a 0 bit. This deselects ROM1 leaving ROM4 as the only device still connected. 9. The bus master reads the remainder of the ROM bits for ROM4 and continues to access the part if de- sired. This completes the first pass and uniquely identifies one part on the 1-wire bus. At this point, the bus master repeats the process de- scribed above to determine the address of the remain- ing devices on the 1-wire bus by repeating steps 1 though 7. Note the following: The bus master learns the unique ID number (ROM data pattern) of one 1-wire device on each ROM Search op- eration. The time required to derive the part’s unique ID is: 960 µS + 3(8+64) X 0.06mS = 13.92mS The bus master is therefore capable of identifying 60 dif- ferent 1-wire devices per second. Additionally, the data obtained from the two reads of each set of three have the following interpretations: 00 - There are still devices attached which have conflicting bits in this position. 01 - All devices still coupled have a zero bit in this bit position. 10 - All devices still coupled have a one bit in this bit position. 11 - There are no devices attached to the 1-wire bus. Transmitting/Receiving Data - All communications on the 1-wire bus begin with the reset and presence detect sequence. This sequence ensures the DS1205S is in the listening mode. The bus master must then transmit the 1-wire command to the DS1205S. To transmit the first bit of the 1-wire I/O command, the master pulls the bus low for 1 µS. This low-going edge informs the DS1205S that the first bit is being sent. After 1 µS, the master does one of two things: 1. holds the line low for an additional 70 µS to output a 0 (write a 0) or, 2. lets the bus go high for an additional 70 µS (write a 1). The state of the bus during this 70 µS time phase deter- mines the value of the bit. The DS1205S will sense any rising edge during this 70 µS time phase as a one. After the 70 µS has lapsed, the bus master must then drive the bus high for 1 µS. This is the frame sync mentioned earlier. This process is repeated until all the eight bits are transmitted. Refer to the timing diagram in Figure 18. The bus master now reads the family code identifier, fol- lowed by the data and a CRC. The read cycle is similar to the write cycle. It is started with the bus master pulling the bus low for 1 µS. This informs the DS1205S that it should have data on the bus no later than the 1 µS from the falling edge. After the 1 µS, the bus master lets go of the bus and the DS1205S drives the bus. The slave must hold the data on the bus for an additional 14 µS minimum (59 µS maximum). During the DS1205S hold- ing time, the bus master reads the state of the bus. Ideal- ly, the bus master should read data from the bus 15 µs after the falling edge. The entire cycle time for one bit lasts a minimum of 70 µS (140 µS maximum) from the falling edge. At the end of the cycle, the bus master drives the bus high for 1 µS. Again, this is like a frame sync for the next bit. This read sequence is repeated un- til all the data has been read. See the timing diagram in Figure 19 for details. If for any reason the transaction needs to be terminated before all the data is read, the DS1205S must be reset. CRC Generation - To validate the transmitted data from the DS1205S, the bus master must generate a CRC val- ue for the data as it is received. This generated value is compared to the value stored in the last eight bits of the DS1205S. The bus master computes the CRC over the 8-bit family code and all 48 ID number data bits, but NOT over the stored CRC value itself. The CRC is calculated using the following polynomial. CRC = px3 + px2 + 1 If the two CRC values match, the transmission is error- free.

1-WIRE WRITE TIMING Figure 18 WRITE 1 WRITE 0 tSLOT tLOW1 tSYC tSYC tSLOT tLOW0 1-WIRE READ TIMING Figure 19 READ 1 READ 0 tRDV tSU tSYC tSYC tSLOT tSLOT tSU tRDV

A host connected to the 1-wire bus may send function commands directly to the DS1205S without preceding them with 1-wire I/O commands by using the pass-thru command (CCh). This command bypasses the serial number and consequently it can only be used when there is one DS1205S on the 1-wire bus. 1-WIRE/3-WIRE ARBITRATION The DS1205S can utilize both the 1-wire and the 3-wire busses simultaneously. Neither input bus has priority over the other. Instead, if both inputs are being used, the signal arriving first will take precedence. More simply, if the 1-wire interface becomes active before the 3-wire in- terface, all communications will take place on the 1-wire bus. The 3-wire bus will be ignored in this case. The same condition occurs for the 1-wire interface if the 3-wire interface becomes active first.

ABSOLUTE MAXIMUM RATINGS* Voltage on any Pin Relative to Ground -0.5V to +7.0V Operating Temperature -40 °C to +85°C Storage Temperature -55 °C to +125°C Soldering Temperature 260 °C for 10 seconds * This is a stress rating only and functional operation of the device at these or any other conditions above those indicated in the operation sections of this specification is not implied. Exposure to absolute maxi- mum rating conditions for extended periods of time may affect reliability. RECOMMENDED DC OPERATING CONDITIONS (0°C to 70°C) PARAMETER SYMBOL MIN TYP MAX UNITS NOTES Logic 1 VIH 2.0 V 1 Logic 0 VIL -0.3 +0.8 V 1 Supply VCC 4.5 5.0 5.5 V 1 DC ELECTRICAL CHARACTERISTICS (0°C to 70°C, VCC = 5V + 10%) PARAMETER SYMBOL MIN TYP MAX UNITS NOTES Input Leakage IIL +500 µA Output Leakage IOL +500 µA Output Current @ 2.4V IOH -1 mA Output Current @ 0.4V IOL +1 mA RST Input Resistance ZRST 100 1000 Kohm D/Q Input Resistance ZDQ 100 1000 Kohm CLK Input Resistance ZCLK 100 1000 Kohm Active Current ICC1 3 6 mA 5,6 Standby Current ICC2 100 µA 5,6 Batt. Operate Consumption IBAT 200 500 nC 7,8 Batt. Operate Standby Current IBATS 30 200 nA 7 Batt. Voltage VBAT 2.0 3.6 V 1 Output Supply Current ICCO 10 mA 11 CAPACITANCE (tA= 25°C) PARAMETER SYMBOL MIN TYP MAX UNITS NOTES Input Capacitance C IN 5 pF Output Capacitance C OUT 7 pF

AC ELECTRICAL CHARACTERISTICS (0°C to 70°C, VCC = 5V + 10%) PARAMETER SYMBOL MIN TYP MAX UNITS NOTES Data to CLK Setup tDC 35 ns 2 CLK to Data Hold tCDH 40 ns 2 CLK to Data Delay tCDD 200 ns 2,3,4 CLK Low Time tCL 250 ns 2 CLK High Time tCH 250 ns 2 CLK Frequency tCLK DC 2.0 MHz 2 CLK Rise & Fall tR ,tF 500 ns 2 RST to CLK Setup tCC 1 µs 2 CLK to RST Hold tCCH 40 ns 2 RST Inactive Time tCWH 250 ns 2 RST to I/O High Z tCDZ 50 ns 2 AC ELECTRICAL CHARACTERISTICS: 1-WIRE INTERFACE (0°C to 70°C, VCC = 5V+ 10%) PARAMETER SYMBOL MIN TYP MAX UNITS NOTES Time Slot Period tSLOT 70 140 µs Write 1 Low Time tLOW1 1 15 µs Write 0 Low Time tLOW0 70 140 µs Read Data Valid tRDV 15 µs Read Data Setup tSU 1 µs 10 Frame Sync tSYC 1 µs Reset Low Time tRSTL 560 µs Reset High Time tRSTH 560 µs 9 Presence Detect High tPDH 15 70 µs Presence Detect Low tPDL 70 280 µs

NOTES: 1. All voltages are referenced to ground. 2. VIH = 2.0V or VIL = 0.8V with 10 ns maximum rise and fall time. 3. VOH = 2.4V and VOL = 0.4V. 4. Load capacitance = 50 pF. 5. Measured with outputs open. 6. (Normal battery backup operation) V CC1 = 5.0 Volts + 10%; VBAT = 3.0 Volts. 7. (Battery operate mode) VCCO = 3.0 Volts. 8. Per transaction (512 bits + protocol). 9. An additional reset or communication sequence cannot begin until the reset high time has expired. 10. Read data setup time refers to the time the host must pull the 1-wire pin low to read a bit. Data is guaranteed to be valid within 1 µS of this falling edge and will remain valid for 14 µS minimum (15 µS total falling edge on 1-wire). 11. VCCO = VCCI - 0.3V