View ISL6296ADHZ-T_2991320.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

1 ? fn6567.3 isl6296a flexihash? for battery authentication the isl6296a is a highly cost-effective fixed-secret hash engine based on intersil?s flexihash technology. the device?s authentication is ac hieved through a challenge response scheme, which is customized for low-cost applications where cloning via eavesdropping without knowledge of the device?s secr et code is not economically viable. when used for its intended applications, the isl6296a offers the same level of effectiveness as other significantly more expensive high maintenance monetary- grade hash algorithm and authentication schemes. the isl6296a has a wide operating voltage range and is suitable for direct powering from a 1-cell li-ion/li-poly or a 3-cell series nimh battery pack. the isl6296a can also be powered by the xsd bus when the bus pull-up voltage is 3.3v or higher. the device connects directly to the cell terminals of a battery pack and includes on-chip voltage regulation circuit, por and a no n-crystal based oscillator for bus timing reference. communication with the host is achieved through a single-wire xsd interface (a light-weight subset of intersil?s isd bus interface). the xsd bus is compatible for use with serial ports offered by all 8250 compatible uart?s or a single gpio (general purpose input and ou tput) pin of a microprocessor. a clone prevention solution ut ilizing the isl6296a offers safety and revenue protection at the lowest cost and power and is suitable for protec tion against after-market replacement for a wide variety of low-cost applications. features ? challenge-response based authentication scheme using 32-bit challenge code and 8-bit authentication code. ? fast and flexible authentic ation process. multi-pass authentication can be used to achieve the highest security level if necessary. ? 16x8 otp rom stores up to three sets of 32-bit host selectable secrets with additional programmable memory for storage of up to 48-bits of id code and/or pack information. ? flexihash engine uses two sets of 32-bit secrets for authentication code generation. ? non-unique mapping of the secret key to an 8-bit authentication code maximize s hacking difficulty due to need for exhaustive key search (superior to sha-1). ? supports 1-cell li-ion/li-poly and 3-cell series nimh battery packs (2.6v ~ 4.8v ope ration), or powered by the xsd bus. ? xsd single-wire host bus interface communicates with all 8250-compatible uart?s or a single gpio. supports crc on read data and transfer bit-rate up to 23kbps. ? true ?zero power? sleep mode - automatically entered after a bus inactivity time-out period. ? 5 ld sot-23 and 8 ld tdfn (2mmx3mm) packages ? -25c to +85c operating temperature range ? pb-free (rohs compliant) applications ? battery pack authentication ? printer cartridges ? add-on accessories ? other non-monetary authentication applications related literature ? application note an1165 ?isl6296 evaluation kit? ? application note an1167 ?implementing xsd host using a gpio? ? technical brief tb363 ?guidelines for handling and processing moisture sensit ive surface mount devices (smds)? pinouts isl6296a (5 ld sot-23) top view isl6296a (8 ld 2x3 tdfn) top view 1 2 3 5 4 xsd tio vss nc vdd 2 3 4 1 7 6 5 8 vss nc nc vdd xsd nc nc tio data sheet april 15, 2010 caution: these devices are sensitive to electrosta tic discharge; follow proper ic handling procedures. 1-888-intersil or 1-888-468-3774 | intersil (and design) is a registered trademark of intersil americas inc. copyright ? intersil americas inc. 2007-2010. all rights reserved. flexihash is a trademark of intersil americas inc. all other trademarks mentioned are the property of their respective owners.
2 fn6567.3 april 15, 2010 ordering information part number (note) part marking temp. range (c) package tape & reel (pb-free) pkg. dwg. # ISL6296ADHZ-T* 296a -25 to +85 5 ld sot-23 p5.064 isl6296adrtz-t* 96a -25 to +85 8 ld 2x3 tdfn l8.2x3a isl6296eval1 isl6296 evaluation kit *please refer to tb347 for detai ls on reel specifications. note: these intersil pb-free plastic packa ged products employ special pb-free material sets, molding compounds/die attach materi als, and 100% matte tin plate plus anneal (e3 termination fi nish, which is rohs compliant and compatible with both snpb and pb-free soldering operations). intersil pb-free products are msl classified at pb-free peak reflow temperatures that meet or exceed the pb-free requirements o f ipc/jedec j std-020. isl6296a
3 fn6567.3 april 15, 2010 absolute m aximum ratings (reference to gnd) thermal information supply voltage (v dd ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5v all other pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . -0.5 to v dd + 0.5v recommended operating conditions ambient temperature range . . . . . . . . . . . . . . . . . . .-25c to +85c thermal resistance (typical) ja (c/w) jc (c/w) sot-23 package (note 1) . . . . . . . . . . 200 n/a 2x3 tdfn package (notes 2, 3) . . . . . 70 10.5 maximum junction temperature (plastic package) . . . . . . . +125c maximum storage temperature range . . . . . . . . . .-40c to +125c pb-free reflow profile . . . . . . . . . . . . . . . . . . . . . . . . .see link below http://www.intersil.com/pbfree/pb-freereflow.asp caution: do not operate at or near the maximum ratings listed fo r extended periods of time. exposure to such conditions may adv ersely impact product reliability and result in failures not covered by warranty. notes: 1. ja is measured with the component mounted on a high effective therma l conductivity test board in free air. see tech brief tb379 f or details. 2. ja is measured in free air with the component mounted on a high ef fective thermal conductivity te st board with ?direct attach? fe atures. see tech brief tb379. 3. for jc , the ?case temp? location is the center of the exposed metal pad on the package underside. electrical specifications unless otherwise noted, all parameters are establis hed over the operational supply voltage and temperature range of the device as follows: t a = -25c to +85c; v dd = 2.6v to 4.8v; parameters with min and/or max limits are 100% tested at +25c, unless otherwise specif ied. temperature limits est ablished by characterization and are not production tested. parameter symbol test conditions min typ max units dc characteristics supply voltage v dd during normal operation 2.6 - 4.8 v during otp rom programming 2.8 - 4.8 v run mode supply current (exclude i/o current) i dd v dd = 4.2v - 38 55 a v dd = 4.8v - 40 65 a sleep mode supply current i dds v dd = 4.2v, xsd pin floating - 0.15 0.5 a otp programming mode supply current i ddp for ~ 1.8ms duration per write operation - 250 500 a internal regulated supply voltage v rg observable only in test mode 2.3 2.5 2.7 v internal otp rom programming voltage v pp observable only in test mode 11 12 13 v por release threshold v por+ 1.9 2.2 2.4 v por assertion threshold v por- 1.5 1.8 2.1 v xsd pin characteristics xsd input low voltage v il -0.4 - 0.5 v xsd input high voltage v ih 1.5 - v dd + 0.4v v xsd input hysteresis v hys -400 - mv xsd internal pull-down current i pd v dd = 2.6v - 0.8 - a v dd = 4.2v - 1.2 2.0 a v dd = 4.8v - 1.8 2.5 a xsd output low voltage v ol i ol = 1ma - - 0.4 v xsd input transition time t x 10% to 90% transition time - - 2 s xsd output fall time t f 90% to 10%, c load = 12pf - - 50 ns xsd pin capacitance c pin -6 - pf isl6296a
4 fn6567.3 april 15, 2010 xsd bus timing characteristics (refer to xsd bus symbol timing definitions tables on page 13) programming bit rate x = 0.5 to 4 2.89 - 23.12 khz xsd input deglitch time t wdg pulse width narrower than the de-glitch time will not cause the device to wake-up 7- 20s device wake-up time t wke from falling-edge of break command issued by host to falling-edge of break command returned by device 130 160 210 s device sleep wait time t slp from when the ?11? opcode is detected to the shut-off of the internal regulator 4- - s auto-sleep time-out period t aslp from the last transition detected on the xsd bus to the device going into sleep mode -0.6 - s otp rom write time t eew from the last bt of the 2nd write data frame to when device is ready to accept the next instruction -1.8 1.9ms hash calculation time t hash from the last bt of the challenge code word from the host to the authentication code being available for read -1 - bt soft-reset time t srst from the last bt of the soft-reset instruction issued by the host to the falling-edge of break command returned by device -- 30s electrical specifications unless otherwise noted, all parameters are establis hed over the operational supply voltage and temperature range of the device as follows: t a = -25c to +85c; v dd = 2.6v to 4.8v; parameters with min and/or max limits are 100% tested at +25c, unless otherwise specif ied. temperature limits est ablished by characterization and are not production tested. (continued) parameter symbol test conditions min typ max units pin descriptions ISL6296ADHZ-T (5 ld sot-23) isl6296adrtz-t (8 ld tdfn) pin name description 1 1 vss system ground. 2 2, 3, 6, 7 nc no connection. 3 4 vdd supply voltage. 4 5 tio production test i/o pin. used only during production testing. must be left floating during normal operation. 5 8 xsd communication bus with weak internal pull-down to vss. this pin is a schmitt-trigger input and an open-drain output. an appropriate pull-up resistor is required on the host side. isl6296a
5 fn6567.3 april 15, 2010 typical applications block diagram figure 1. typical application with the isl6296a powered by the battery protection isl6296a vss vdd xsd r 1 r 2 c 1 d 1 pack+ pack- xsd 330 1.2k 5.1v 0.1 f figure 2. typical application with the isl6296a powered by the xsd bus protection isl6296a vss vdd xsd r 1 c 1 d 1 pack+ pack- xsd 330 5.1v 0.1 f figure 3. functional block diagram digital por/2.5v regulator oscillator xsd comm interface dcfg (1 byte) dtrm (1 byte) secret #1 (4 bytes) secret #2 (4 bytes) secret #3 (4 bytes) general purpose (2 bytes) 16 bytes otprom sesl auth chlg flexihash+? engine mscr stat control/status/ test interface vdd xsd tio vss esd diode esd diode analog isl6296a
6 fn6567.3 april 15, 2010 theory of operation the isl6296a contains all circui try required to support battery pack authentication based on a challenge-response scheme. it provides a 16-byte one-ti me programmable read-only memory (otprom) space for the storage of up to 96 bits of secret for the authentication and other user information. a 32-bit crc-based hash engine (flexihash) calculates the authentication result immediately after receiving a 32-bit random challenge code. the communication between the isl6296a and the host is im plemented through the xsd single-wire communication bus. major functions within the isl6296a include the following, as shown in figure 3: ? power-on reset (por) and a 2.5v regulator to power all internal logic circuits. ? 16x8-bit (16-byte) otp rom as shown in table 8. the first part (two bytes) contains the device default configuration (dcfg) information (such as the device address and the xsd communication speed) and the default trimming (dtrm) information (such as the internal oscillator frequency trimming). the second part contains two groups (12-byte) of memory that can be independently locked out for the storage of up to three sets of secret codes. the last part provides two additional bytes of space for general-purpose information. ? control functions, including master control (mscr) and status (stat) registers (as shown in table 9), interrupt generation, and the test-related interface. ? flexihash engine that includes the 32-bit crc-based hash engine, secret selection register, challenge code register and the authenticatio n result register. table 10 shows all the registers. ? xsd communication bus interface. the xsd device address and the communication speed are configured in the dcfg address in the otprom, as given in table 8. ? time base reference. the following explains in detail the operation of the isl6296a. power-on reset (por) the isl6296a powers up in sleep mode. it remains in sleep mode until a power-on ?break? command is received from the host through the xsd bus. the initial power-on ?break? can be of any pulse width, as long as it is wider than the xsd input de-glitch time (20s). once the ?break? command is received, the internal regulator is powered up. about 20s after the falling edge of the po wer-on ?break?, an internal por circuit releases the reset to the digital block, and a por sequence is started. during the por sequence, the isl6296a initializes itself by loading the default device configuration information from pre-assigned locations within the otp rom memory. after initialization, a ?break? command is returned to the host to indicate that the isl6296a is ready and waiting fo r a bus transaction from the host. note that the isl6296a will in itiate the power-on sequence without waiting for the power-on ?break? signal to return to the high state. if the host sends an initial ?break? pulse wider than 60s, the device-ready ?break? returned by the isl6296a will likely be merged with the pulse sent by the host and, therefore, may not be detect able. figure 4 illustrates the waveforms during the power-on reset. figure 4a represents the case when the power-on ?break? rising edge occurs after the device starts sending the ?bre ak?. figure 4b represents the case when the power-on ?break? finishes before the device sends its ?break?. the device break signal is always 1.391 times of the device bit-time (bt, see ?xsd host bus interface? on page 10 for more details). either case in figure 4 will wake-up the device successfully if the device is in the sleep mode. note that it is important to keep in mind that a narrow ?break? signal will be taken as a normal bit signal and cause errors if the device is not in the sleep mode. for this reason, the narrow power-on ?break? signal should be used only if the user has to see the returned ?break? signal. auto-sleep while the isl6296a is powered up and there is no bus activity for more than about 1s , the device will automatically return to sleep mode. sleep mode can be entered independent of whether the xsd bus is held high or low. while the isl6296a is in sleep mode, it is recommended that the xsd bus be held lo w to eliminate current drain through the xsd-pin internal pull-down current. figure 4a. when the host power-on break is wider than 60s figure 4b. when the host power-on break is narrower than 60s figure 4. power-on break signal to wake-up the isl6296a from sleep mode host break device break xsd bus waveform 60s typ 1.391 bt d host break device break xsd bus waveform isl6296a
7 fn6567.3 april 15, 2010 auto-sleep mode can be disabled by clearing the aslp bit in the mscr register. by default, auto-sleep is always enabled at power-up and after a soft reset. auto-sleep function can be permanently disabled by clearing the 0-00[2] bit (the aslp bit in dcfg) during otp rom programming. otp rom the 16-byte otp rom memory is based on eeprom technology and is incorporated into the isl6296a for storage of non-volatile information. otp rom contents (refer to table 8) can include, but are not limited to: 1. device default settings (address 0-00) 2. factory programmed trim parameters (address 0-01) 3. device authentication secrets (address 0-02 to 0-0d) 4. pack information and id (address 0-0e and 0-0f) the memory can be written mult iple times before two lock-out bits (slo[1:0] in dcfg, see table 8) are set. the slo[1] (bit 1) locks out the memory between 0- 02 and 0-09 an d the slo[0] (bit 0) locks out the memory bet ween 0-0a to 0-0d. th ese two bits can be set independently. prior to lock-out, the memory can be written and read directly th rough the xsd bus interface. after lock-out, writing to all rom addresses and reading from secret code locations will be permanently disabled after performing a reset cycle. writing to the eeprom requires the supply voltage at the vdd pin be maintained at a minimum of 2.8v. failure to do so may result in unreliable rom programming or total write failure. the otp rom must be written two bytes at a time, but 2, 4 or 16-bytes of data can be read by the host in a single bus transaction. only even addresses are allowed in otp rom read/write. a 16-byte read with crc allows the entire rom content to be quickly verified by simply checking the crc byte. the dtrm address stores the default trimming parameters and is a read-only address. the dcfg and dtrm (0-00 and 0-01 addresses) need to be written simultaneously but the data to the drtm address is ignored. the otp rom writing process takes approximately 1.8ms per two-bytes. while the write process is taking place, no bus transaction is allowed. attempting to access the isl6296a during an on-going write process will result in the device ignoring the access instruction and issuing an interrupt to the host. the otp rom programming is register- based and may be performed at the pack manufacturer?s facility. device control and status the isl6296a has a control and a status register. the control register can be read and written by the host but the status register is read only. both registers contain the device configuration information (see table 9). the status register also contains the device status information that may lead to an interrupt signal to the host. following a host-initiated power-on ?break? signal or soft reset command, the isl6296a will configure its default mode of operation based on information stored within dcfg address of the otp rom. the default configuration is loaded into the master control (mscr) and the status (stat) registers. functions that are configured by otp rom settings include: 1. device address (dab[1:0]) 2. xsd bus speed (spd[1:0]) 3. register default settings (eint and aslp) 4. rom read/write lock-out (slo[1:0]) the isl6296a incorporates interrupt functions to allow the host to be quickly informed of device status and error conditions. available interrupts are summarized in table 1. when an interrupt enable bit is set, a ?break? command is sent to the host whenever its corresponding interrupt status bit is set. after this, the hos t should read the stat register immediately. if the following in struction frame from the host does not access the stat register, another ?break? will be sent immediately after receiving the full instruction frame. this process is repeated until the host reads from the stat register. upon reading of the stat register, all status bits will be cleared. refer to the mscr and stat register descriptions on page 15 for a detailed explanation of the interrupt functions. flexihash engine the flexihash engine contains a 32-bit crc-based hash engine and three registers. table 10 lists the three registers. the 1-byte secret selection ( sesl) register selects two sets of secret (32-bit each) from the otp rom to program the hash engine. the 4-byte challenge code register (chlg) receives the challenge code from the host through the xsd bus. once the challenge code is received, the hash engine generates a 1-byte au thentication result code and stores in the auth register for the host to read. figure 5 shows the data flow of the authentication process. the following sections describe the authentication process and flexihash encoding scheme in detail. the device authentication process to start an authentication process, the host sends a ?break? command to wake up the isl6296a. then the host writes to the sesl register to select the tw o sets of secrets to be used for authentication code generat ion. after that, the host generates a pseudo-random 4-byte challenge code to input into the chlg register to initiate the authentication process. upon receiving the fourth byte of the challenge code, the isl6296a immediately starts computing the authentication code. once the computation is complete, the 8-bit authentication code is made available at the auth register for the host to read out. the host reads this code and, concurrently, calculates the correct authentication code based on the challenge code it generated and the same isl6296a
8 fn6567.3 april 15, 2010 secrets chosen, and finally compares the result with the authentication code read from t he device. if the codes do not match up, the device is a fake device and the host may shut itself down. the flow chart in figure 6 summarizes the process that the host needs to execute. it is recommended that device authentication be done once in a while to maximize its effectiveness. before a new challenge code can be accepted by the device, the sesl register must be re-written again to ensure that the original seeds are re-loaded from the otp rom into the hash engine prior to performing the next authentication code calculation. failure to follow the sequence will result is a bus error, causing the sber flag to be set in the stat register. set-up for device authentication support to configure the host and the isl6296a to support device authentication functi on, the pack manufacturer will need to select at least 2 sets of 32-bit secret codes. for greater security, a third set of 32-bit secret may be used. the flexihash engine requires two sets of 32-bit secrets for use in its hash calculation; the first set to define its hash function, and the second set to initialize its seed for hash calculation. these two sets can be selected from the same secret location. the chosen secret codes are to be kept by the pack manufacturer and maintained at utmost confidentiality. after the secrets have been determined, they are written into the device?s otp rom. after veri fication that the codes have been written in correctly, the rele vant secrets lock-out bits at rom address location 0-00 should be set. once set, the lock-out bits can no longer be cleared. thereafter, read/write access to the secret information will no longer be possible, and the secret codes are made available only to the flexihash engine for generat ion of authentication code based on a challenge code input from the host. on the host side, the same secret codes will need to be kept, and the same flexihash engine will have to be implemented in firmware. refer to application note an1166 for detailed information of firmware implementation. it is important that the secret codes be stored scrambled in the host?s non-volatile memory so that the secret information cannot be easily revealed by monitoring signal transfer on the host pcb. the hash engine the hash engine consists of 4 separate programmable 8-bit crc calculators. two sets of 32-bit secret codes are used by the hash engine for authent ication code generation. the first set is used to define the crc polynomial as well as the input selection for each of the crc calculators. the second is used as initial seeds for the crc calculations. outputs of the 4 crc calculators are logically combined to produce the 8-bit output of the overall flexihash engine. the block diagram of the flexihash engine is illustrated in figure 7. more detailed descriptions on the hash engine can be found in application note an1166 . figure 5. authentication process flow diagram flexihash engine 32-bit pseudo-random challenge word from host 64-bit secret 8-bit authentication code 32-bit hash function 32-bit hash seed figure 6. flow chart for authentication process start wake up isl6296a using a regular break signal select hash function and seed by writing to sesl register send a 32-bit random challenge to chlg register read the authentication result from auth register, after waiting for 1 bt d end calculate the expected authentication result based on the same secrets the two results match? shut down the system yes no isl6296a
9 fn6567.3 april 15, 2010 figure 7. block diagram of the flexihash engine 8-bit crc calculator xi bn cn dn an na[7:0] xa[7:0] ma[7:6] polynom = 1 + x ma[2:0] - x ma[5:3] + x 8 8 8 8-bit crc calculator an xi cn dn bn nb[7:0] xb[7:0] mb[7:6] polynom = 1 + x mb[2:0] - x mb[5:3] + x 8 8 8 8-bit crc calculator an bn xi dn cn nc[7:0] xc[7:0] mc[7:6] polynom = 1 + x mc[2:0] - x mc[5:3] + x 8 8 8 8-bit crc calculator an bn cn xi dan nd[7:0] xd[7:0] md[7:6] polynom = 1 + x md[2:0] - x md[5:3] + x 8 8 8 mux mux mux mux y[7:0] = xa[7:0] isl6296a
10 fn6567.3 april 15, 2010 xsd host bus interface communication with the host is achieved through xsd, a light-weight subset of intersil?s isd single-wire bus interface. xsd is a programmable-rate, pseudo-synchronous, bidirectional, host-initiated, instruction-based, serial communication interface that allows up to two slave devices to be attached and addressed separately. it includes features to enable quick and reliable communication. the communication protocol is optimized for efficient transfer of data between the device and the host. the following list outlines the features support ed by the xsd bus interface: ? programmable bit rate up to 23kbps ? up to 2 devices can be connected to the host and addressed separately ? 16-bit host instruction frame supports multi-byte register read and write ? built-in communicati on error detection ? crc generation capability ? supports interrupt signaling ? integrated bus inactivity detector for automatic activation of sleep mode xsd bus physical model the physical model of the xsd bus is shown in figure 8. the model shows a single-wire connection between the host and the device, not including the ground signal. the input logic on the device side is designed to be compatible with any voltage between 1.8v to 5.0v . the host interface should contain an open-drain or open-collector output. the pull-up resister r pu can be connected either to the host supply voltage v ddh or the device supply voltage v ddd . typically, the host supply voltage should be used for pull-up. data transfer protocol to initiate a transaction, the host first sends a 16-bit instruction frame to the device, followed by data byte frame(s) if the instruction is a write operation. the instruction frame consists of a chip-select code, operation code, register bank and address point er and number of data bytes information, as shown in figure 10. if the instruction is a read operation, the device will re turn 1 to 17 byte frames of data back to the host. the serial data transfer always takes place with the lsb first. the following explains the bus symbols. the transaction frames are introduced in later sections. bus signaling symbols the xsd bus is nominally held high. various bus symbols and commands are generated by active-low pulse width modulation. following are the set of valid bus signaling symbols supported by the xsd interface: break (issued by host) ? used to wake the device up from sleep mode (note: a narrow ?break? can also be used to wake up the device from the sleep mode, as described in ?power-on reset (por)? on page 6) ? used to reset the device?s xsd bit counters and time qualifiers ? used to signal a change in communication channel (from one slave device to another) break (issued by device) ? used as ?device-ready? indication to the host (after a soft-reset or wake-up from sleep mode) ? used as an interrupt indicator ?1? symbol ? used for instruction and data coding ?0? symbol ? used for instruction and data coding symbol timing definitions symbol timings are defined in terms of bit-time (bt), determined by the selected bus transfer bit-rate pre-programmed into the device?s otp rom location 0-00[5:4]. selectable bus speed s are: 2.89khz (x = 0.5), 5.78khz (x = 1), 11.56khz (x = 2) and 23.12khz (x = 4). an instruction or data frame co nsists of a sequence of ?1? and/or ?0? symbols. figure 9 illustrates the timing definitions. a ?1? symbol is nominally 0.3 bt wide while a ?0? symbol is nominally 0.7 bt wide. one ?1? or ?0? symbol is represented in each bt period. any detected pulse width less than 0.124 bt wide will be interpreted as a glitch and will result in a bus error. tables 2 and 3 summarize the timing definitions of all the supported symbols and bus signaling. table 1. interru pt event summary condition interrupt enable bit interrupt status flag interrupt event otp rom write-in-progress eeew (fixed) seew accessing the isl6296a during an on- going rom write process (used only during initial otp rom programming). xsd bus error eint sber xsd bus error or invalid in struction frame detected. improper authentication sequence detected. register access error eint sacc accessing protected registers. isl6296a
11 fn6567.3 april 15, 2010 table 2. host timing definition s of symbols and bus signaling parameter sym description min typ max unit bit time bt h x = 0.5, 1, 2, or 4 173.6/x s de-glitch period tg pw (pulse width) less th an this will result in a frame error 0.124 bt h ?1? pulse width t1 h pw in this range will be interpreted as a ?1? code 0.227 0.453 bt h ?0? pulse width t0 h pw in this range will be interpreted as a ?0? code 0.591 0.824 bt h ?break? time tb h pw in this range will be interpreted as a ?break? command 1 100 bt h note: unless otherwise stated, all pulse width (pw) referenced are with respect to an active-low pulse. table 3. device timing definitions of symbols and bus signaling parameter sym description min typ max unit bit time bt d x = 0.5, 1, 2, or 4 164.2/x 172.8/x 181.4/x s ?1? pulse width t1 d ?1? code transmit pulse width 0.304 bt d ?0? pulse width t0 d ?0? code transmit pulse width 0.696 bt d ?break? time tb d pw in this range will be interpreted as a ?break? command 1.391 bt d figure 8. the circuit model for the xsd serial bus v ddd v ddh r pu tx rx tx rx host device open-drain port pin 1.5 a esd diode esd diode 6pf open-drain port-pin esd diode esd diode figure 9. the bus signal timing diagram glitch t1 t0 tb tg xsd 10 break bt break glitch isl6296a
12 fn6567.3 april 15, 2010 access instruction frame the xsd access instruction frame is shown in figure 10. the instruction frame consists of 16-bits of digital signal with the contents described in the following. cs field the cs field is a 1-bit chip address selection. an initial 1-bit chip address code of ?0? is pre-programmed into the device?s otp rom address location 0-00[7:6] at the time of chip manufacture and may be re-programmed by the pack manufacturer if needed. if the cs code in the instruction does not match the device?s chip address code, the instruction, and any subsequent frames that follow, will be ignored until a break command is received. opcode field the opcode is a 2-bit field defines the operation of the transaction following the instru ction frame. th e operations are described in table 4. bank field the memories in the isl6296a are divided into four banks. the bank field is defined in table 5. address field the address field indicates the starting address of a memory or register read or write s equence. keep in mind that only odd starting addresses are allowed for the otp rom access. bytes field the bytes field indicates the number of data bytes to read or write, not including the crc byte. not all bytes field settings are supported. only settings marked with an ?x? are valid for a particular bus instruction, as indicated in table 6. attempting to read or write with an invalid bytes setting may yield unpredictable results. writing to otp rom can occur only two bytes at a time, but reading from otp rom can happen at 2, 4 or 16 bytes at a time. writing to and reading from otp rom in any other byte denomination will yield unpredictable results and should therefore be stri ctly prohibited. table 4. definition of the opcode field opcode description action 00 write operation write to device register 01 read operation (normal) read from device register 10 read operation (with crc) read from device register. append 1-byte crc to the end of the last read frame. 11 sleep mode activation immediately se ts the device in sleep mode. note: after detecting the ?11? opcode, the device immediately enters sleep mode. if more than 3 bits sent, subsequent pulses may wake the device up again. figure 10. the 16-bit instruction frame field definition 0 15 opcode bank address bytes cs 0 15 opcode bank address bytes cs 0 15 opcode bank address bytes cs table 5. bank field definition bank memory/register bank selection 00 otp rom 01 control and status registers 10 device authentication registers 11 test registers (reserved) table 6. definition of the bytes field bytes field data bytes to follow otp rom write otp rom read reg read or write chlg code write comments 0 0 invalid selection. causes a bus error. 1 1 x must use 1-byte read for clearing of the stat register. 22xxx 3 n/a invalid selection. causes a bus error. 44 x x 5 - 6 n/a invalid selectio n. causes a bus error. 7 16 x for reading from otp rom only (prior to lock-out). isl6296a
13 fn6567.3 april 15, 2010 bus transaction protocol the xsd bus for the isl6296a defines three types of bus transactions. figure 11 shows the bus transaction protocol. the blue color represents the signal sent by the host and the green color stands for the signal sent by the device. before the transaction starts, the host should make sure that the xsd device is not in the sleep mode. one method is to always send a ?break? signal before starting the transaction, as shown in figure 11. if the de vice is not in the sleep mode, the ?break? signal is not mandatory. the ?break? pulse width may appear to be wider than what the host sends out because of the reason explained in figure 4. the symbols in figure 11 are explained in table 7. passive crc support the crc feature only supports t he read transaction in the isl6296a. when the opcode in the instruction is ?10?, an 8-bit crc is automatically ca lculated for the data bytes being transferred out. the crc result is then appended after the last data byte is read out. crc is generated using the dow crc polynomial as determined in equation 1: the crc generation algorithm is logically illustrated in figure 12. prior to a new crc calculation, the lfsr (linear feedback shift register) is initialized to zero. the read data to be transmitted out is concu rrently shifted into the crc calculator. after the actual data is transmitted out, the final content of the lf sr is the resulting crc value. this value is transmitted out after the read data, with lsb being transmitted out first. table 7. symbols in the bus transaction protocol sym description min typ max ifg h host inter-frame gap 0 bt h 800ms ifg d device inter-frame gap 1 bt d ta h host turn-around time 1 bt h 800ms ta d device turn-around time 1 bt d polynom 1 x 4 x 5 x 8 +++ = (eq. 1) figure 11. xsd bus transaction protocol. the ?bre ak? signal is optional if the device is awake ifg h h write instruction frame data frame 1 data frame 2 ifg break t sd d ta d read instruction frame data frame 1 (output from slave) (output from slave) data frame 2 ifg d break t sd (output from slave) d h read instruction frame data frame next instruction frame ta ta h break t sd (a) multi-byte write instruction. (b) multi-byte read instruction. (c) back-to-back transaction (read followed by write). figure 12. the crc calculator for the passive crc support 1st stage 2nd stage 3rd stage 4th stage 5th stage 7th stage 8th stage serial output 6th stage lsb msb isl6296a
14 fn6567.3 april 15, 2010 analog biasing components and clock generation the analog section in the isl6296a mainly includes the time base generator and the internal regulator for powering the circuits in the isl6296a. time base generator a time base generator is included on-chip to provide timing reference for serial data encoding and decoding at the xsd bus interface. this eliminates the need for an external crystal. the time base oscillator is trimmed during manufacturing to a nominal frequency of 532.5khz. it has a frequency tolerance better than 5% over operating supply voltage and temperature range. internal voltage regulator the isl6296a incorporates an in ternal voltage regulator that maintains a nominal operating voltage of 2.5v within the device. the regulator draws power directly from the vdd input. no external component is required to regulate circuit voltage. the regulator is shut off during sleep mode. memory/operational register description the isl6296a memory and register structure is organized into 4 banks of 256 addressable locations. however, not all of the addressable registers are used nor implemented. accessing a non-implemented register will result in the access instruction being ignored. a bus error indication may or may not be flagged. bank 0 is dedicated for the otp rom. there are 16 memory locations implemented in the array. writing to the otp rom has no immediate effect on the chip operation until a power-on reset occurred, or a soft reset is issued. table 8 describes the otp rom memory assignment. the default factory setting for address [0:00] is given in table 11. bank 1 contains the control and status registers. only 2 registers are implemented. table 9 shows the register map of the bank 1 registers. deta iled descriptions of register settings are given in tables 14 and 15. bank 2 contains the authentication registers. only 3 registers are implemented. thes e registers are used during the battery pack authentication process. table 10 describes the mapping of the auth entication registers. bank 3 is reserved for intersil production testing only, and will not be accessible during normal operation. accessing the test and trim registers when not in test mode will result in a bus error. table 8. otp rom memory map (bank 0) address name description bit 7 bit 6 bit 5 bit 4 bit3 bit 2 bit 1 bit 0 0-00 dcfg default configuration dab[1:0] spd[1:0] eint aslp slo[1:0] 0-01 dtrm default trimming hsf tibb[2:0] tosc[3:0] 0-02 se1a auth secret #1a s1a[7:0] 0-03 se1b auth secret #1b s1b[7:0] 0-04 se1c auth secret #1c s1c[7:0] 0-05 se1d auth secret #1d s1d[7:0] 0-06 se2a auth secret #2a s2a[7:0] 0-07 se2b auth secret #2b s2b[7:0] 0-08 se2c auth secret #2c s2c[7:0] 0-09 se2d auth secret #2d s2d[7:0] 0-0a se3a auth secret #3a s3a[7:0] 0-0b se3b auth secret #3b s3b[7:0] 0-0c se3c auth secret #3c s3c[7:0] 0-0d se3d auth secret #3d s3d[7:0] 0-0e inf1 general purpose general purpose non-volatile me mory for storage of model id, date code, and other cell information 0-0f inf2 general purpose note: information stored in address 0-0e (inf1) and 0-0f (inf2) is for use by the host firmware only. actual content depends on the host firmware customization preference. isl6296a
15 fn6567.3 april 15, 2010 address 0-00: default configuration (dcfg) this address location stores the default configuration when the isl6296a is manufactured. ta ble 11 describes each bit in detail. the legend for the type column is given in table 13. address 0-01: default trim setting (dtrm) this address location is writable only when the device is in test mode. during normal operation, any data written to it will be ignored. table 12 describes the dtrm address in detail. address 0-02/03/04/05: authentication secret set #1 (se1a/b/c/d) these address locations store the first set of secrets to be used for hash calculation. reading and writing to this register can be disabled by setting the slo[1] bit at otp rom location 0-00[1]. table 9. control and status registers (bank 1) address name description bit 7 bit 6 bit 5 bit 4 bit3 bit 2 bit 1 bit 0 1-00 mscr master control eeew eint -- -- -- -- aslp srst 1-01 stat device status seew sber sacc -- dab[1:0] slo[1:0] table 10. authentication registers (bank 2) address name description bit 7 bit 6 bit 5 bit 4 bit3 bit 2 bit 1 bit 0 2-00 sesl secrets selection -- -- -- -- csl[1:0] ssl[1:0] 2-01 chlg challenge code register chlg[31:0] 2-05 auth authentication code register auth[7:0] table 11. default configuration (dcfg) register settings bit name type default description 7:6 dab[1:0] rw 00 device address bit setting: 00: device responds only when cs field in instruction frame is?0? 01: device responds to any cs field value in instruction frame 10: device responds to any cs field value in instruction frame 11: device responds only when cs field in instruction frame is ?1? 5:4 spd[1:0] rw 01 xsd bus speed setting: configures the bit rate of the xsd bus interface. 00: 0.5x (2.89kbps) 01: 1x (5.78kbps) 10: 2x (11.56kbps) 11: 4x (23.12kbps) 3eint rw 1 power-on default setting of eint bit in the mscr register. 2aslp rw 1 power-on default setting of aslp bit in the mscr register. 1:0 slo[1:0] rw 00 secrets lock-out bits: bit 1: read/write lock-out bit for address locations 0-02 to 0-09 (secret set #1 and #2) bit 0: read/write lock-out bit for addres s locations 0-0a to 0-0d (secret set #3) note: once bit 0 or bit 1 is set, writing to the otp rom will permanently be disabled (after a reset cycle). table 12. default trimming (dtrm) register settings bit name type default description 7hsf r 0unused 6:4 tibb[2:0] r -- reference current trim setting 3:0 tosc[3:0] r -- oscillator frequency trim setting table 13. legend for the type column type read action write action r read-only data read data ignored w write-only zeros read data written rw read/write data read data written rc clear after read data read, then cleared data ignored wc clear after write zeros read data written, then cleared <> default setting loaded from designated otp rom bit locations w writing disabled after lock-out isl6296a
16 fn6567.3 april 15, 2010 address 0-06/07/08/09: authentication secret set #2 (se2a/b/c/d) these address locations store the second set of secrets to be used for hash calculation. reading and writing to this register can be disabled by setting the slo[1] bit at otp rom location 0-00[1]. address 0-0a/0b/0c/0d: authentication secret set #3 (se3a/b/c/d) these address locations store the optional third set of secrets to be used for hash calculation. reading and writing to this register can be disabled by setting the slo[0] bit at otp rom location 0-00[0]. alternately, this memory space can be used to store additional cell information which can be accessed by the host. in this case, the sl o[0] bit should not be set. table 14. master control register (mscr) bit name type default description 7 eeew r 0 <1/0> otp rom write-in-progress interrupt enable: when enabled, it allows the seew bit to flag an interrupt whenever the seew bit is set by its interru pt event. the eeew bit is fixed at ?1? when none of the otp rom lock-out bits are set. when any or both of the lock-out bits are set, the eeew bit will become permanently ?0? after a reset. 6eint rw 0 <1> global interrupt enable: when enabled, it allows t he sber or sacc bit to flag an interrupt to the host whenever any of the respective interrupt events occurred. (default setting loaded from otp rom location 0-00[3]) 5:2 -- r 0 unused. 1aslp rw 0 <1> auto sleep mode enable: when set, the isl6296a will automatically enter sleep mode after about 1s of xsd bus inactivity. when cleared, th e device can only enter sleep mode on opcode command. (default setting loaded from otp rom location 0-00[2]) 0 srst wc 0 soft reset: when a ?1? is written and all register s are reset to their defaul t states, all bus counters and timers are reset to their start-up conditions and device configuration information is reloaded from otp rom. after the reset sequence is complete, a ?break? pulse is sent to the host. table 15. device status register (stat) bit name type default description 7 seew rc 0 otp rom write-in-progress flag: this bit is set when attempt is made by the host to read from or write to the isl6296a while the rom is still processing the previous write instruction. 6 sber rc 0 xsd bus error flag: this bit is set when one or more of the following occurs at the bus interface: a) an invalid pulse width is received b) bus activity is detected before the device completes its power-up sequence c) an invalid bytes field in the instruction frame d) improper authenticati on sequence is detected e) reading secret information after the corresponding lock-out bits are set 5 sacc rc 0 register access error flag: this bit is set whenever an instruction frame attempts to access a protected register as follows: a) writing to otp rom after the isl6296a has been locked out (any or both of the lock-out bits set) b) accessing the isl6296a is test and trim registers when the device is not in test mode 4-- r 0unused 3:2 dab[1:0] r 00 <00> device address bit setting: loaded from otp rom location 0-00[7:6] during power-up. 1:0 slo[1:0] r 00 <00> secrets lock-out bits setting: loaded from otp rom location 0-00[1:0] during power-up. isl6296a
17 fn6567.3 april 15, 2010 address 0-0e/0f: general purpose memory (inf1/2) these address locations can be used to store information like model id, date code, and other cell information, which can be read by the host. address 1-00: master control register (mscr) the master control register is defined in table 14. the mscr register can be both r ead or written by the host through the xsd bus. address 1-01: device status register (stat) the stat register is defined in table 15. all status bits will be cleared upon a read to this register. the stat is a read-only register. address 2-00: secrets selection register (sesl) this register must be written to re-load the hash engine with secrets stored in otp rom prior to presenting a new challenge code word input. address 2-01: challenge code input register (chlg) this register is used to input the 32-bit challenge code generated by the host for devic e authentication. all four bytes of the challenge code should be written sequentially to this register, starting with the least-significant byte. after the fourth challenge byte is received, the authentication code generation process will start. this chlg is a write-only register. address 2-05: authentication code output register (auth) this register is used to outp ut the 8-bit authentication code calculated from the 32-bit c hallenge code. the register content may be read only once after each challenge code word is written to the device. subsequent read to this register without a new challenge being input will result in an error condition. applications information xsd bus implementation there are two ways to implement the xsd host in a microprocessor. one way is to use a spare uart (universal asynchronous receiver/transmitter). a gpio (general purpose input/output) can be used if no uart is available for the xsd communication. refer to application note an1167 available from intersil for more information regarding how to implement the xsd bus within a microprocessor. pull-up resistor selection since there is an internal pu ll-down current on the xsd pin, (as shown in figure 8), it is important to choose a pull-up resistor value that is low enough so that the small amount of pull-down current through the resistor does not cause the bus voltage to droop below the v ih specification under any condition. 5k is a typical resistance used for pull-up. powered by xsd bus in applications where the device supply voltage is lower than 2.6v (such as an application powered by a single-cell nimh battery), or a device that has no power source at all, the isl6296a can be powered by the xsd bus. the application circuit is shown in figure 2. the condition for the application circuit to function properly is that the bus pull-up voltage is 3.3v or 5v. the bus pull-up voltage will charge the capacitor c 1 through an internal esd diode, as shown in figure 8. the esd diode has 0.4v drop typically. esd rating the isl6296a esd specification is rated at 4kv of the human body model. when the isl6296a is used in a handheld accessory, a higher esd rating is typically required. external components are required to enhance the esd performance. table 16. secrets selection register (sesl) bit name type default description 7:4 -- r 0000 unused 3:2 csl[1:0] rw 01 coefficient definition secret selection: selects the authentication secret code word stored in otp rom to be used as the coefficient definition code for the flexihash engine. 00: invalid selection 01: authentication secret set #1 10: authentication secret set #2 11: authentication secret set #3 1:0 ssl[1:0] rw 10 seed secret selection: selects the authentication secret code word stored in otp rom to be used as the secret seed for the flexihash engine. 00: invalid selection 01: authentication secret set #1 10: authentication secret set #2 11: authentication secret set #3 isl6296a
18 fn6567.3 april 15, 2010 xsd pin series re sistor selection a series resistor may be used to improve esd performance of the xsd input. in figure 13, resistor r1 and zener diode d1 provide esd protection for the isl6296a xsd pin. resistor r1 must be se lected to provide valid v il logic level at the host processor (point ?a? in figure 13) when the isl6296a is asserting the bus low by turning on q1. the maximum resistance value of r1 can be calculated if one knows the vdd host voltage, the v il requirements of th e host processor, the rpu resistor value, and the r ds(on) of q1. the maximum r ds(on) of q1 in figure 13 is 400 , as per the xsd pin vol specification in the ?electrical specifications? on page 3. poin t ?a? voltage, with q1 on, is given by equation 2. to be detected as a logic '0' by the host, voltage at point ?a? must be no greater than the host?s vil input voltage. therefore, for example, suppose the xsd pull-up voltage is 2.6v, a 4.7k pull-up is used, and the host?s vil threshold is 35% of its supply voltage. plugging these constants into equation 4: solving for r1: vdd pin series resi stor selection a series resistor may be used to improve esd performance of the vdd input as shown by r2 in figure 13. resistor r2 must be select ed to allow operation of the isl6296a at the minimum vbat voltage at which communication must be successful. the maximum resistance of r2 can be calculated if one knows the minimum vbat voltage, maximum isl6296a supply current, and minimum isl6296a supply voltage, using the formula in equation 10. for example, suppose the minimum vbat voltage in the application is 2.8v. the minimum isl6296a vdd voltage is 2.6v, and maximum supply current is 55 a, as per the ?electrical specifications? table on page 3. the maximum value for r2 can then be calculated. additional application information see ?related literature? on page 1 for additional application information. figure 13. typical application block diagram vdd host host processor rpu vbat isl6296a r1 logic logic q1 a r2 vdd xsd vss d1 v a vdd host r1 400 + () r1 400 rpu ++ () ---------------------------------------------------- = (eq. 2) v a v il (eq. 3) vdd host r1 400 + () r1 400 rpu ++ () ---------------------------------------------------- v il (eq. 4) vdd host 2.6v = (eq. 5) rpu 4.7k = (eq. 6) v il host () vdd host 35 %0.91v == (eq. 7) 2.6v r1 400 + () r1 400 4.7k ++ () --------------------------------------------------------- 0.91v (eq. 8) r1 2131 (eq. 9) r2 vbat min vdd min ? () idd max -------------------------------------------------------------- (eq. 10) r2 2.8v 2.6v ? () 55 a ----------------------------------- - (eq. 11) r2 3.636k (eq. 12) isl6296a
19 fn6567.3 april 15, 2010 isl6296a package outline drawing l8.2x3a 8 lead thin dual flat no-lead plastic package with e-pad rev 1, 06/09 located within the zone indicated. the pin #1 indentifier may be unless otherwise specified, tolerance : decimal 0.05 tiebar shown (if present) is a non-functional feature. the configuration of the pin #1 id entifier is optional, but must be between 0.20mm and 0.32mm from the terminal tip. dimension b applies to the metallized terminal and is measured dimensions in ( ) for reference only. dimensioning and tolerancing conform to amse y14.5m-1994. 6. either a mold or mark feature. 3. 5. 4. 2. dimensions are in millimeters. 1. notes: bottom view detail "x" side view typical recommended land pattern top view (4x) 0.15 index area pin 1 pin #1 index area c seating plane base plane 0.08 see detail "x" c c 5 6 6 a b 0.75 0.05 0.05 0.20 ref package 2.00 3.00 1.80 +0.1/ -0.15 1.65 + 0.1/ -0.15 0.50 0.25 2.20 1.65 1.80 (8x0.25) 3.00 2.00 (8x0.20) (8x0.40) (8x0.40) (6x0.50) outline
20 all intersil u.s. products are manufactured, asse mbled and tested utilizing iso9000 quality systems. intersil corporation?s quality certifications ca n be viewed at www.intersil.com/design/quality intersil products are sold by description only. intersil corpor ation reserves the right to make changes in circuit design, soft ware and/or specifications at any time without notice. accordingly, the reader is cautioned to verify that data sheets are current before placing orders. information furnishe d by intersil is believed to be accurate and reliable. however, no responsibility is assumed by intersil or its subsidiaries for its use; nor for any infringements of paten ts or other rights of third parties which may result from its use. no license is granted by implication or otherwise under any patent or patent rights of intersil or its subsidiari es. for information regarding intersil corporation and its products, see www.intersil.com fn6567.3 april 15, 2010 isl6296a small outline transistor plastic packages (sot23-5) d e 1 e e1 c l c c l e b c l a2 a a1 c l 0.20 (0.008) m 0.10 (0.004) c c -c- seating plane 4 5 123 view c view c l r1 r 4x 1 4x 1 gauge plane l1 seating l2 c plane c base metal with c1 b1 plating b p5.064 5 lead small outline transistor plastic package symbol inches millimeters notes min max min max a 0.036 0.057 0.90 1.45 - a1 0.000 0.0059 0.00 0.15 - a2 0.036 0.051 0.90 1.30 - b 0.012 0.020 0.30 0.50 - b1 0.012 0.018 0.30 0.45 c 0.003 0.009 0.08 0.22 6 c1 0.003 0.008 0.08 0.20 6 d 0.111 0.118 2.80 3.00 3 e 0.103 0.118 2.60 3.00 - e1 0.060 0.067 1.50 1.70 3 e 0.0374 ref 0.95 ref - e1 0.0748 ref 1.90 ref - l 0.014 0.022 0.35 0.55 4 l1 0.024 ref. 0.60 ref. l2 0.010 ref. 0.25 ref. n5 55 r 0.004 - 0.10 - r1 0.004 0.010 0.10 0.25 0 o 8 o 0 o 8 o - rev. 2 9/03 notes: 1. dimensioning and tolerance per asme y14.5m-1994. 2. package conforms to eiaj sc-74 and jedec mo178aa. 3. dimensions d and e1 are exclus ive of mold flash, protrusions, or gate burrs. 4. footlength l measured at reference to gauge plane. 5. ?n? is the number of terminal positions. 6. these dimensions apply to the fl at section of the lead between 0.08mm and 0.15mm from the lead tip. 7. controlling dimension: millimeter. converted inch dimen- sions are for reference only.

▲Up To Search▲

Price & Availability of ISL6296ADHZ-T

	To Download ISL6296ADHZ-T Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .