View DS2703GUC27_8688496.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

1 of 20 rev: 061307 note: some revisions of this device may incor porate deviations from published specifications known as erra ta. multiple revisions of any device may be simultaneously available through various sales channel s. for information about device errata, click here: www.maxim-ic.com/errata . general description the ds2703 provides a robust cryptographic solution to ensure the authenticity of li-ion battery packs for cell phone, pda, and portable computing devices. the ds2703 employs the secure hash algorithm (sha-1) specified in the federal information publication 180-1 and 180-2, and iso/iec 10118-3. sha-1 is designed for authentication ? just what is required for identifying battery packs manufactured by authorized sources. the devices sha-1 engine processes a host transmitted challenge using its stored 64-bit secret key and unique 64-bit rom id to produce a 160-bit response word for transmission back to the host. the secret key is securely stored on-chip and never transmitted between the battery and the host. a ds2703-based system produces a high degree of authentication security between a host system and its removable battery or other peripheral devices. the thermistor multiplexer feature allows a three contact battery pack configuration to support data and thermistor functions. when activated through 1-wire command, the thm pin presents the thermistor impedance on the data contact and disconnects internal loading from the node. typical operating circuit features ? secure challenge and response authentication using the sha-1 algorithm ? directly powered by the dallas 1-wire ? interface with 16kbps standard and 143kbps overdrive communication modes ? unique 64-bit serial number ? thermistor multiplexer ? operates with v pullup as low as 2.7v ? pb-free 8-pin max ? or 2mm x 3mm tdfn package pin configuration applications 2.5g/3g wireless handsets pdas handheld or notebook computers and terminals digital still and video cameras ordering information part temp range pin-package ds2703g+ -20 c to +70 c 2mm x 3mm tdfn ds2703g+t&r -20 c to +70 c ds2703g+ on tape-and-reel ds2703u+ -20 c to +70 c max-8 ds2703u+t&r -20 c to +70 c ds2703u+ on tape-and-reel + denotes lead-free package. ds2703 sha-1 battery pack a uthentication ic www.maxim-ic.com 1-wire is a registered trademark of dallas semiconductor. max is a registered trademark of maxim integrated products. downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 2 of 20 absolute maximum ratings voltage range on dq, thm pins relative to ground -0.3v to +18v voltage range on vb pin relative to ground -0.3v to +6v operating temperature range -40c to +85c storage temperature range -55c to +125c soldering temperature see ipc/jedec j-std-020a specification stresses beyond those listed under absolute maximum ratings may c ause permanent damage to the device. these are stress rating s only, and functional operation of the device at t hese or any other conditions beyond those indicated in the operational sections of t he specifications is not implied. exposure to the absolute maximum rati ng conditions for extended peri ods may affect device. recommended dc op erating conditions (t a = -20c to +70c.) parameter symbol conditions min typ max units communication mode 0 5.5 dq pullup voltage v pullup computation mode 2.7 5.5 v dq, thm relative voltage v dq-thm (note 1) -0.3 15 v dq to thm resistor r dq-thm (note 2) 5 500 k dc electrical characteristics (v pullup = 2.7v to 5.5v, t a = -20c to +70c.) parameter symbol conditions min typ max units i dq0 standby mode, v dq > v ih 1 2.5 a i dq1 communication mode (note 14) 75 a i dq2 computation mode, sha-1 computation active 0.25 ma i dq3 thermistor mux active, (note 3) 1 a i pp 14.5 < v dq < 15.0v 0 < t < 50 o c 10 ma dq load current i pp-idle (note 4) 60 a dq programming voltage v pp program pulse, (note 5, 6) 14.5 15.0 v input logic high: dq v ih (note 6) 0.8 v pullup v input logic low: dq v il (note 6) 0.5 v output logic low: dq v ol-dq i ol = 4ma, (note 6, 7) 0.4 v output logic low: thm v ol-thm i ol = 4ma, (note 6, 7, 8) 0.4 v hold-up current: vb pin i hu thm pin active, v b = 2.70v 3.2 a dq capacitance c dq (note 9) 50 pf eeprom reliability specification (v pullup = 2.7v to 5.5v, t a = -20c to +70c.) parameter symbol conditions min typ max units eeprom write endurance n eec 0 < t < 50 o c (note 10) 1000 cycles downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 3 of 20 ac electrical characteristics (v pullup = 2.7v to 5.5v, t a = -20c to +70c.) parameter symbol conditions min typ max units thm low delay t td (note 11) 15 s computation delay time t d (note 12) 100 s computation time t sha (note 12) 15 ms programming pulse width t ppw (note 5) 17 ms programming pulse rise time t ppr 0.5 5 s programming pulse fall time t ppf 0.5 5 s start-up delay time t strt (note 13) 100 ms ac electrical characterist ics: 1-wire interface (v pullup = 2.7v to 5.5v, t a = -20c to +70c.) parameter symbol conditions min typ max units 1-wire interface regular timing time slot t slot 60 120 s recovery time t rec 1 s write 0 low time t low0 60 120 s write 1 low time t low1 1 15 s read data valid time t rdv 15 s reset time high t rsth 480 s reset time low t rstl 480 960 s presence detect high t pdh 15 60 s presence detect low t pdl 60 240 s 1-wire interface overdrive timing time slot t slot 6 16 s recovery time t rec 1 s write 0 low time t low0 6 16 s write 1 low time t low1 1 2 s read data valid time t rdv 2 s reset time high t rsth 48 s reset time low t rstl 48 80 s presence detect high t pdh 2 6 s presence detect low t pdl 8 24 s note 1: v dq C v thm . the thm pin must not be driven to a higher voltage than the dq pin. note 2: the application thermistor cannot exceed the r dq-thm resistance range over operating temperature. if thermi stor mode is not used in the application, it is recommended that a 50k ? resistor be connected between dq and thm pins instead. note 3: maximum leakage of dq pin while in thermistor mode. note 4: when performing a lock secret (0x6a), set overdrive (0x8b) or clear overdrive (0x8d) operation, there will be an increased oper ating current of i pgm- idle during and after the program pulse until the next 1-wire bus reset. note 5: see figure 11 for definitionof t ppr , t ppw , and t ppf. note 6: all voltages referenced to vss. note 7: v dq must be at least 3.0v when the 1-wire bus is idle. note 8: drive strength at time=0 after activate thermistor command is sent to the ds2703. note 9: does not include capacitance referred from vb pin on initial power up. note 10: eeprom data read retention is four years at +50c note 11: time from msb of activate thermistor command until thm pin is driven low internally. note 12: time from msb of compute next secret or compute mac command. note 13: time after initial power up before the ds2703 will respond to communication. t strt specifications are valid only if the capacitor on vb (c vb ) is 0.22f. worst case 100ms delay based on maximum thermistor value of 500k ? . note 14: the average current measured in overdrive mode with minimum bus timings while the master issues: 1-wire reset, skip rom, write challenge, write 0's repeatedly unil the end of measurement. downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 4 of 20 pin description 8-pin max 2mm x 3mm tdfn name function 1 7 thm thermistor mux . connect a thermistor from thm to dq. optional. for temperature measurements only. if a thermistor is not used in the application, it is recommended thm be tied to dq with a 50k ? resistor instead. thm should never be left floating. 2 8 v ss device ground. connect directly to the negative terminal of the battery cell. 3 1 dq data input/output . 1-wire data line. open-drain output driver. connect this pin to the data terminal of the battery pack. th is pin has a weak internal pulldown (1a typical). 4 2 vb hold-up supply bypass input . internal power supply to the ds2703 while dq is logic low and during thermistor measurement periods. connect a 0.22f capacitor from vb to v ss . 5 3 n.c. no connection . pin not connected internally, float or connect to v ss . 6 4 n.c. no connection . pin not connected internally, float or connect to v ss . 7 5 n.c. no connection . pin not connected internally, float or connect to v ss . 8 6 n.c. no connection . pin not connected internally, float or connect to v ss . figure 1. block diagram downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 5 of 20 detailed description the ds2703 is comprised of a sha-1 au thentication function and thermistor mux control that are accessed via a 1- wire interface. the high voltage (hv) detection circuit r outes the externally supplied programming voltage to the eeprom array and enables the internal regulator to isolate portions of the ch ip from the programming voltage. the 1-wire interface controls access by a host system to the 64-bit net address (rom id ) and sha-1 authentication. the ds2703 operates in one of four operating modes: communication, computation, programming and thermistor access. most operations are performed in communicati on mode, with the host system addressing the ds2703 using net address commands and then setting up an authentication exchange and retrieving the results. in communication mode, the dq load current is no more than i dq0 maximum, and the ds2703 can be parasite powered via the dq pin through a high impedance pullup resistor during a communication transaction. power available while the 1-wire bus is at a logic high is rectified by the on chip diode and stored in an off chip capacitor connected to the vb pin. in computation mode, when a sha-1 verification is performed, the dq load current increases up to i dq2 , necessitating a lower impedance pullup resistor. the comput ation mode load current occurs after the host supplies the required challenge data and requests the computation using the proper function commands in communication mode. in this mode, the pullup supply and low impedance pullup resistor must be capable of keeping the dq pin above v pullup-min . the third operating mode is required when programming th e non-volatile memory portions of the ds2703. the programming mode is defined by the application of a high voltage programming pulse to the dq pin at the appropriate point during a compute secret command, load/ lock secret or clear/set overdrive timing command. the internal voltage regulator limits the internal voltage (v dd_int ) to isolate low voltage portions of the chip from the hv programming pulse. typically, programming mode is us ed during module or pack manufacture to configure the ds2703 and program the 64-bit secret. finally, thermistor mode allows the voltage on an exter nal thermistor to be measured from the dq line. the command sequence causes the ds2703 to internally disconnect its dq interface and drive the thm pin to vss allowing the measurement to be made. the ic remains in this mode until the vb pin capacitor is drained causing the ds2703 to power cycle back to communication mode. authentication authentication is performed using a fips-180 compli ant sha-1 one way hash algorithm on a 512 bit message block. the message block consists of a 64-bit secret, a 64-bit challenge and 384 bits of constant data. optionally, the 64-bit net address replaces 64 of t he 384 bits of constant data used in the hash operation. an authentication attempt is initiated by the host system providing a 64-bit random challenge then sending one of two compute command sequences. the host and the ds2703 both calculate the result based on the mutually known secret. the result data, known as the message authentication code (mac) or message digest, is returned by the ds2703 for comparison to the hosts result. note that the secret is never transmitted on the bus and thus cannot be captured by observing bus traffic. sha-1 based authentication is a cryptographically strong method in wide use for digitally signing encrypted files and secure transactions such as electronic cash and password exchange protocols. the fips 180 compliant input block, the 512-bit message block is organized as sixteen 32-bit words, w0-w15. the message block is initialized when a command is received to compute the mac. upon initialization, the 64-bit secret is loaded, and it is important to note that the sh a-1 algorithm has access to this data, but not the serial interface. the challenge data is received with the command just prior to the compute mac command. the challenge data is cleared during computation of the mac, so the host must write new challenge data prior to issuing each compute mac or compute next secret comma nd. additionally, the a, b, c, d and e variables used in the hash computation are initialized per fips 180 as shown in table 1. variable initiation. please contact the factory for memory map details. downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 6 of 20 table 1. variable initiation [31:0] [23:16] [15:8] [7:0] a 67h 45h 23h 01h b efh cdh abh 89h c 98h bah dch feh d 10h 32h 54h 76h e c3h d2h e1h f0h the 160-bit mac is computed per fips 180, including the addi tion of constants h0-h4. adding h0-h4 is necessary only to maintain compliance with fips 180. the computed mac is held in the a-e register memory and then returned as a 160-bit serial stream, beginning with the least significant bit of variable a. table 2. message authentication code (mac) return format a[31:24] a[23:16] a[15:8] a[7:0] b[31:24] b[23:16] b[15:8] b[7:0] c[31:24] c[23:16] c[15:8] c[7:0] d[31:24] d[23:16] d[15:8] d[7:0] e[31:24] e[23:16] e[15:8] e[7:0] sha-1 hash algorithm general definitions : this description of the sha computation is adapted from the secure hash standard sha-1 document. the algorithm takes as its input data 16, 32-bit words m t (0 t 15) as shown in the sha-1 input message format tables. the sha computation involves six 32-bit word variabl es labeled a, b, c, d, e, and tmp, five 32-bit word constants labeled h0, h1, h2, h3, and h4, a sequence of eighty 32-bit words called w t (0 t 79), a sequence of eighty 32-bit words called k t (0 t 79), and a boolean function f t (b,c,d) (0 t 79). the operations required for the sha computation are arithmetic addit ion without carry ("+"), logical invers ion or 1's complement ("\"), logical xor (" "), logical and ("^"), logical or ("v"), concatenation of 32-bit values (|), assignment (":=") and circular shifting within a 32-bit word. the expression s n (x) represents a circular shift of x by n positions to the left, with x being a 32-bit word. the function f t is defined as follows: f t (b,c,d) = (b^c)v((b\)^d) (0 t 19) = b c d (20 t 39) = (b^c)v(b^d)v(c^d) (40 t 59) = b c d (60 t 79) the sequence k t (0 t 79) is defined as follows: k t := 5a827999h (0 t 19) 6ed9eba1h (20 t 39) 8f1bbcdch (40 t 59) ca62c1d6h (60 t 79) the sequence w t (0 t 79) is defined as follows: w t := m t (see table, fips-180 compliant input block) (0 t 15) s 1 (w t-3 w t-8 w t-14 w t-16 ) (16 t 79) downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 7 of 20 sha computation the variables a, b, c, d, e and constants h0, h1, h2, h3, and h4 are initialized as follows: a := 67452301h h0 := 67452301h b := efcdab89h h1 := efcdab89h c := 98badcfeh h2 := 98badcfeh d := 10325476h h3 := 10325476h e := c3d2e1f0h h4 := c3d2e1f0h the final values of variables a, b, c, d, and e are gener ated by looping through the following set of computations for t = 0 to 79 (discarding any carry-out). finally, the h0 -h4 constants are added to the a-e variables respectively, which are then concatenated to form the 160-bit mac, abcde. for ( t = 0 to 79 ) { tmp := s 5 (a) + f t (b,c,d) + w t + k t + e e := d d := c c := s 30 (b) b := a a := tmp } 160-bit mac := (a+h0) | (b+h1) | (c+h2) | (d+h3) | (e+h4) ds2703 authentication commands write challenge [0ch]. this command writes 64 bits in the message block. the lsb of the 64-bit data can begin immediately after the msb of the command has been co mpleted. if more than 8 bytes are written, the final value in the challenge register will be indeterminate. t he compute mac and compute next secret (with or without rom id) function commands clear the challenge value. therefore the write challenge command must be issued prior to every compute mac or compute next secret command for reliable results. note : immediately after power-up, a du mmy compute mac command is required to initialize the ds2703. if the dummy command is not issued, the first authentication atte mpt is computed using a challenge value of 0. when issuing the dummy compute mac command, the command s equence can be terminated immediately following the 8th bit of the compute mac command byte. waiting for the sha-1 computation and re ading the results back are not required. compute mac without rom id [36h]. this command initiates a sha-1 computation on the 512 bit block comprised of words w0 - w15. the 64-bit secret and t he 64-bit challenge are loaded in the message block and the space in the message reserved for the rom id is filled with logical 1's. the ds2703 pauses at least 100us after receiving this command before mac computation begins. this gives the host ample time to connect the dq pin to a low impedance node prior to the high current demand computation. the dq pin must not fall below v pullup_min during the computation period, t comp . the host must release the dq pin for 1-wire data communications (i.e. terminate the low source impedance mode). after the dq pin has returned to normal impedance, the host must write eight write zero time slots and then issue 160 read time slots to get the ma c. the 32-bit regist ers a, b, c, d, and e are used during every cycle of the hash algorithm and their final values at calculation cycle t=79 are added to the values h0-h4 and stored in registers a-e. t he new word abcde is now the mac. after issuing the command and waiting a minimum of t comp , the host reads the 20-byte mac . this command allows the use of a master secret and message digest response independent of the rom id. compute mac with rom id [35h] this command is structured the same as the compute ma c without rom id, except that the rom id is loaded to the message block. including the rom id unique to each ds2703 in the mac computation allows the use of a unique secret in each token and a master secret in the ho st device. see application note white paper 4, available at http://www.maxim-ic.com , for more information. downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 8 of 20 sha-1 related commands used while authenticating a battery or peripheral device are summarized in table 3 for convenience. four additional commands for clearing, computing and locking of the secret are described in detail in the following section. table 3. authentication function commands command hex function write challenge 0c writes 64-bit challenge for sha-1 processing. required prior to either compute mac command. compute mac without rom id and return mac 36 computes hash with logical 1s in place of the rom_id compute mac with rom id and return mac 35 computes hash including the rom_id secret management function commands load secret [5ah]. this command changes the 64-bit secret to t he provided 64-bit data argument value. the host must apply a programming pulse afterwards to copy the new secret value to eeprom. compute next secret without rom id [30h]. this command initiates a sha-1 computation of the mac and uses a portion of the resulting mac as the next or new secret. the mac computation is performed with the current 64-bit secret and the 64-bit challenge. the space in the message reserved for the rom id is filled with logical 1's. two words (64 bits) of the output mac are used as the new secret value. the host must allow t comp after issuing this command for the sha calculation to complete, then apply a programming pulse to write the new secret value to eeprom. compute next secret with rom id [33h]. this command initiates a sha-1 computation of the mac and uses a portion of the resulting mac as the next or new se cret. the mac computation is performed with the current 64-bit secret, the 64-bit rom id, and the 64-bit challenge. tw o words (64 bits) of the out put mac are used as the new secret value. the host must allow t comp after issuing this command for the sha calculation to complete, then apply a programming pulse to write the new secret value to eeprom. note : please contact the factory for details about what in formation is used to construct the new secret in the compute next secret with rom id and compute next secret without rom id commands. lock secret [6ah]. this command write protects the 64-bit secret to prevent accidental or malicious overwrite of the secret value. the secret va lue stored in eeprom becomes "final." the host must apply a programming pulse to write the secret lock bit to eeprom. table 4. secret loading function commands command hex function load secret 5a loads the secret with 64-bit data argument compute next secret without rom id 30 generates new global secret compute next secret with rom id 33 generates new unique secret lock secret 6a sets lock bit to prevent changes to the secret 1-wire speed control function commands clear overdrive [8dh]. this command clears the 1-wire overdrive bi t to select the standard 1-wire timings shown in the electrical characteristics table. the over drive bit is stored in eeprom so that the programmed speed selection can be recalled on initial power up. the host must apply a programming pulse to complete the command. downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 9 of 20 set overdrive [8bh]. this command sets the 1-wire overdrive bi t to select the overdrive 1-wire timings shown in the electrical characteristics table. the over drive bit is stored in eeprom so that the programmed speed selection can be recalled on initial power up. the host must apply a programming pulse to complete the command. table 5. 1-wire speed control function commands command hex function clear overdrive 8d clears the overdrive 1-wire speed bit to select standard 1-wire timings set overdrive 8b sets the overdrive 1-wire speed bi t to select overdrive 1-wire timings thermistor measurement the ds2703s 1-wire interface allows a thermistor to be multiplexed on the dq line for thermal measurements of the cell pack without adding an additional pack connection. see the typical operating circuit, figure 5. the thermistor is connected between the dq and thm pins. thm is normally high impedance to prevent the thermistor from interfering with 1-wire communication. when an acti vate thm command is received, thm is internally driven to vss and the dq pin becomes high impedance allowing the thermistor resistance to be measured. see the timing diagram in figure 12. figure 2. thermistor mode duration when c vb is .22f 0 200 400 600 800 1000 2.7 3.1 3.5 3.9 4.3 4.7 5.1 5.5 normal mode of operation restored worst case quickest transition time worst case slowest transition typical transition time valid thermistor measurement period time (ms) dq pullup voltage (v) downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 10 of 20 the ds2703 will remain in thermistor measurement m ode until the stored charge on the vb pin capacitor is depleted causing the ic to power cycl e back to standard mode of operation. while in thermistor measurement mode, communication to the ds2703 is not possible. after measuring the thermistor, t he host must wait until the vb capacitor is depleted. figure 2 shows the typical and wors t case transition times over the full operating range when using .22f as the vb pin capacitor. thermistor measurements should be made within the first 100ms after issuing the command. the host system should then wait unt il at least 1000ms have passed before sending the next communication sequence to the ic. table 6. thermist or function command command hex function activate thermistor a9 activates the thm output for thermistor measurement. activation occurs within 50 s of command completion and continues until vb capacitor depleted. 1-wire bus system the 1-wire bus is a system that has a single bus master and one or more slaves. a multidrop bus is a 1-wire bus with multiple slaves, while a single-drop bus has only one slave device. in all instan ces, the ds2703 is a slave device. the bus master is typically a microprocessor in the host system. the discussion of this bus system consists of five topics: 64-bit net address, cr c generation, hardware configuration, transaction sequence, and 1-wire signaling. 64-bit net address (rom id) each ds2703 has a unique, factory-programmed 1-wire ne t address that is 64 bits in length. the term net address is synonymous with the rom id or rom code terms used in earlier dallas 1-wire product documentation. the first eight bits of the net address are the 1-wire family code, (34h) for the ds2703. the next 48 bits are a unique serial number. the last eight bits are a cyclic redu ndancy check (crc) of the firs t 56 bits (see figure 3.). the 64-bit net address and the 1-wire i/o circuitry built into the device enable the ds2703 to communicate through the 1-wire protocol detailed in this data sheet. figure 3. 1-wire net address format 8-bit crc 48-bit serial number 8-bit family code (34h) msb lsb crc generation the ds2703 has an 8-bit crc stored in the most significant byte of its 1-wi re net address. to ensure error-free transmission of the address, the host sy stem can compute a crc value from the first 56 bits of the address and compare it to the 8-bit crc from the ds2703. the host system is responsible for verifying the crc va lue and taking action as a result. the ds2703 does not compare crc values and does not prevent a command sequen ce from proceeding as a result of a crc mismatch. proper use of the crc can result in a communicati on channel with a very high level of integrity. the crc can be generated by the host using a circuit consis ting of a shift register and xor gates as shown in figure 4, or it can be generated in software using the polynomial x 8 + x 5 + x 4 + 1. additional information about the dallas 1-wire crc is available in application note 27: understanding and using cyclic redundancy checks with dallas semiconductor touch memory products (www.maxim-ic.com/appnoteindex ). in figure 4, the shift register bits are initialized to 0. t hen, starting with the least signifi cant bit of the family code, one bit at a time is shifted in. after the 8th bit of t he family code has been entered, then the serial number is entered. after the 48th bit of the serial number has been entered, the shift register contains the crc value. downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 11 of 20 figure 4. 1-wire crc generation block diagram hardware configuration the ds2703 uses an open-drain output driver as part of the bidirectional interface circuitry shown in figure 5. if a bidirectional pin is not available on the bus master, separ ate output and input pins can be connected together. for normal communication the 1-wire bus must have a pullup resi stor at the bus-master end of the bus. for short line lengths and/or v pullup 3.0v, a value of approximately 4.7k is recommended. for long line lengths and/or v pullup < 3.0v, a value of approximately 2k is recommended. the idle state for the 1-wire bus is high. if, for any reason, a bus transaction must be suspended, the bus must be left in the idle state to properly resume the transaction later. note that if the bus is left low for more than t low0 , slave devices on the bus begin to interpret the low period as a reset pulse, effectively terminating the transaction. when performing sha-1 computations with a low pullup voltage, the ds2703 may require a stronger pullup than 4.7k to maintain the minimum v pullup requirement. a p-fet in parallel with the standard pullup can be switched on during computation and then disabled to read t he result. when measuring the thermistor r thm , both the strong pullup and standard pullup should be disabled to allow a weak pullup to form a voltage divider with the thermistor. a voltage a/d connected directly to the 1-wire bus can then read the voltage drop of the thermistor. figure 5. 1-wire bu s interface circuitry msb xor xor lsb xor input v pullup bus master ds2703 rx tx 4.7k 50k 150 r thm ~100 ? mosfet ~1a rx tx activate thm pack- dq comp comm voltage a/d downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 12 of 20 transaction sequence the protocol for accessing the ds2703 th rough the 1-wire port is as follows: ? initialization ? net address command ? function command(s) ? data transfer (not all commands have data transfer) all transactions of the 1-wire bus begin with an initialization sequence consisting of a reset pulse transmitted by the bus master, followed by a presence pulse simultaneously transmitted by the ds2703 an d any other slaves on the bus. the presence pulse tells the bus master that one or more devices are on the bus and ready to operate. for more details, see the 1-wire signaling section below. net address commands once the bus master has detected the presence of one or more slaves, it can issue one of the net address commands described in the following paragraphs. the name of each net address command (rom command) is followed by the 8-bit opcode for that command in square br ackets. figure 6 presents a transaction flowchart of the net address commands. read net address [33h]. this command allows the bus master to r ead the ds2703s 1-wire net address. this command can only be used if there is a single slave on the bus. if more than one slave is present, a data collision occurs when all slaves try to transmit at the same time (open drain produces a wired-and result). match net address [55h]. this command allows the bus master to spec ifically address one ds2703 on the 1-wire bus. only the addressed ds2703 responds to any subsequent function command. all other slave devices ignore the function command and wait for a reset pulse. this command can be used with one or more slave devices on the bus. skip net address [cch]. this command saves time when there is only one ds2703 on the bus by allowing the bus master to issue a function command without specifyi ng the address of the slave. if more than one slave device is present on the bus, a su bsequent function command can cause a data collision when a ll slaves transmit data at the same time. search net address [f0h]. this command allows the bus master to use a process of elimination to identify the 1-wire net addresses of all slave devic es on the bus. the search process invo lves the repetition of a simple three- step routine: read a bit, read the complement of the bit, t hen write the desired value of that bit. the bus master performs this simple three-step routine on each bit location of the net address. after one complete pass through all 64 bits, the bus master knows the address of one devic e. the remaining devices can then be identified on additional iterations of the pr ocess. see chapter 5 of the book of ds19xx i button ? standards for a comprehensive discussion of a net address search, including an actual example (www.maxim-ic.com/ibuttonbook ). downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 13 of 20 figure 6. net addre ss command flow chart yes no yes yes yes yes no master tx net address command ds2703 tx presence pulse 33h read 55h match f0h search cch skip master tx reset pulse no no no ds2703 tx family code 1 byte ds2703 tx serial number 6 bytes ds2703 tx crc 1 byte master tx function command yes master tx bit 0 yes bit 0 match? master tx bit 1 no yes bit 1 match? ds2703 tx bit 1 master tx bit 1 bit 0 match? master tx bit 63 bit 63 match? ds2703 tx bit 1 ds2703 tx bit 63 master tx bit 63 ds2703 tx bit 63 ds2703 tx bit 0 master tx bit 0 ds2703 tx bit 0 master tx function command bit 1 match? no no no downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 14 of 20 i/o signaling the 1-wire bus requires strict signaling protocols to ensure data integrity. the four protocols used by the ds2703 are as follows: the initialization sequence (reset pulse followed by presence pu lse), write 0, write 1, and read data. the bus master initiates all these type s of signaling except the presence pulse. the initialization sequence required to begin any communica tion with the ds2703 is shown in figure 7. a presence pulse following a reset pulse indicates that the ds2703 is ready to accept a net addr ess command. the bus master transmits (tx) a reset pulse for t rstl . the bus master then releases the line and goes into receive mode (rx). the 1-wire bus line is then pulled high by the pullup resistor . after detecting the rising edge on the dq pin, the ds2703 waits for t pdh and then transmits the presence pulse for t pdl . figure 7. 1-wire initialization sequence write-time slots a write-time slot is initiated when the bus master pulls the 1-wire bus from a logic-high (inactive) level to a logic-low level. there are two types of write-time slots: write 1 and write 0. all write-time slots must be t slot in duration with a 1 s minimum recovery time, t rec , between cycles. the ds2703 samples the 1-wire bus line between t low1_max and t low0_min after the line falls. if the line is high when sampled, a write 1 occurs. if the line is low when sampled, a write 0 occurs. the sample window is illustrat ed in figure 8. 1-wire write and read time slots. for the bus master to generate a write 1 time slot, the bus line must be pulled low and then released, allowing the line to be pulled high less than t rdv after the start of the write time slot. for the hos t to generate a write 0 time slot, the bus line must be pulled low and held low for the duration of the write-time slot. caution : when communicating in standard mode, the number of consecutive write 0 time slots with t low0 = t low0_max and t rec = t rec_min is limited to 64. if more than 64 write 0 time slots with t low0 = t low0_max and t rec = t rec_min are issued, the internal supply (v dd_int ) can drop so low that the ds2703 resets. increasing t rec to 5 s allows vdd_int to recharge sufficiently each time slot. read-time slots a read-time slot is initiated when the bus master pulls the 1 -wire bus line from a logic-high level to a logic-low level. the bus master must keep the bus line low for at least 1 s and then release it to allow the ds2703 to present valid data. the bus master can then sample the data t rdv from the start of the read-t ime slot. by the end of the read- time slot, the ds2703 releases the bus line and allows it to be pulled high by the external pullup resistor. all read- time slots must be t slot in duration with a 1 s minimum recovery time, t rec , between cycles. see figure 8 and the timing specifications in the electrical ch aracteristics table for more information. t r s tl t pdl t r s th t pdh v pullup gnd- line type legend: bus master active low ds2703 active low resistor pullup both bus master and ds2703 active low dq downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 15 of 20 figure 8. 1-wire write and read time slots downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 16 of 20 table 7. all function commands command hex function write challenge 0c writes 64-bit challenge for sha-1 processing. required prior to all compute mac and compute next secret commands. compute mac without rom_id and return mac 36 computes hash of w0-w15 with logical 1s in place of the rom_id. compute mac with rom_id and return mac 35 computes hash of w0-w15 with the rom_id. load secret 5a writes the 64-bit secret to supplied data. requires programming voltage on dq. compute next secret without rom id 30 generates new global secret. requires programming pulse. compute next secret with rom id 33 generates new unique secret. requires programming pulse. lock secret 6a sets lock bit to prevent ch anges to the secret. requires programming pulse. set overdrive 8b sets 1-wire interface ti mings to overdrive. requires programming pulse. clear overdrive 8d sets 1-wire interface ti mings to standard. requires programming pulse. activate thermistor a9 activates the thm output for thermistor measurement. activation occurs within 50s of command completion and continues until the vb capacitor is discharged. reset bb resets ds2703 (software por). table 8. guide to function command requirements command strong pullup on dq issue 00h before read read/write time slots programming pulse write challenge write: 64 compute mac x x read: up to 160 compute next secret x x lock secret, set/clear overdrive x load secret write: 64 x reset downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 17 of 20 low-impedance dq du ring computation the sha-1 computation requires more current than the dq pullup resistor used during normal communication can supply. during the computation, the dq source impedance must be reduced to maintain power to the device under the higher load condition. the user must connect t he low impedance source to the dq line within t d of issuing any command to perform a computation, and return the dq source to normal settings before reading or writing to the one-wire interface. see figure 9. figure 9. compute m ac function command 8 write 0 time slots up to 160 read time slots (read 20-byte mac) skip rom cmd compute mac cmd 1-wire reset presence pulse t d t sha apply low impedance pull-up (if needed) downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 18 of 20 programming pulse a typical programming waveform is shown in figure 10. t he user issues a 1-wire reset followed by a skip romid command, match romid plus the romid, search or read net, the load secret command and then the two 32-bit words to be loaded into eeprom. the dq line is then pulled to v pp for t ppw milliseconds and then returned to nominal voltage. the fast rise and fall time require ments for the programming pulse are required to prevent damage during the transition between normal communication mode and programming mode. figure 10. lock secret, set/cl ear overdrive function commands downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 19 of 20 computation and programming the compute next secret operation waveform is shown in fi gure 11. the user issues a 1-wire reset followed by a skip romid command, match romid plus the romid, search or read net, foll owed by the compute next secret command. the system host must connect the low impedance source to the dq line within time t d and for a duration of time t sha . the dq line is then pulled to v pp for t ppw milliseconds and then returned to nominal voltage. the fast rise and fall time requirements for the programming pulse are required to prevent damage during the transition between normal communication mode and programming mode. figure 11. compute next secret function command downloaded from: http:///
ds2703 sha-1 battery pack authentication ic 20 of 20 high-impedance dq for thermistor measurement the user issues a 1-wire reset followed by a skip romid command, match romid plus the romid, search or read net, followed by the activate thermistor command. within the time period t td the ds2703 disables its dq input and internally drives the thm pi n low. immediately following the acti vate thermistor command, the host system should enable the weak pullup to vcc and then meas ure the thermistor by sampling the voltage level of the 1-wire bus within time t min . the ds2703 automatically reverts back to communication mode after t min . see figure 12. figure 12. activate thermistor command package information (the package drawing(s) in this data sheet may not reflect the most current specifications. for the latest package outline info rmation, go to www.maxim-ic.com/dallaspackinfo .) downloaded from: http:///

▲Up To Search▲

Price & Availability of DS2703GUC27

	To Download DS2703GUC27 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .