ATMEL AT88SC1003 User Manual

Features

• Compatible with Many Existing Memory Card Applications

• 1-Kbit EEPROM User Memory

– Two256x1ApplicationZones – One512x1ApplicationZone – Protected by Security Logic – Vpp Internally Generated for Single Voltage Operation – 2 µs Read Access Time – 2 ms Write Cycle (Self-timed)

• Additional EEPROM Memory for Code Storage

– Three OTP Areas, 144 Bits Total – 64-bit Code-protected Zone

• Security Features

– Stores and Validates Security Codes – Maximum of Four Incorrect Security Code Attempts – Provides Security Code Protection During Transportation

• High Reliability

– Endurance: 100,000 Cycles – Data Retention: 10 Years – ESD Protection: 4,000V Minimum

• Manufactured Using Low-power CMOS Technology

• Temperature Range from −25°Cto+85°C

• ISO 7816-compliant Card Modules

Description

The AT88SC1003 is a low-cost synchronous integrated circuit, designed for use in prepaid and loyalty smart card applications. The AT88SC1003 provides 1024 bits of serial EEPROM (Electrically Erasable and Programmable Read Only Memory) within three application zones, plus 64 bits in a code-protected zone. Security logic provides access protection through use of a 16-bit security code.

Additional EEPROM memory is available to hold unalterable information about the card history. Separate zones are available for data written by the fabrication facility, card manufacturer and card issuer. After personalization of the memory by the issuer, an internal fuse is blown that secures critical memory areas of the device and configures the IC for use by the end customer. The action of blowing this fuse is irreversible. The AT88SC1003 is manufactured using low-power CMOS technology. EEPROM programming functions are accomplished using an internally generated high-voltage pump for single voltage supply operation. Program timing is controlled internally. Memory endurance is guaranteed to 100,000 erase/write cycles. Ten-year data retention is guaranteed.

Table 1. Pin Configuration

1K Secure EEPROM with Three Application Zones

AT88SC1003

Pad Description ISO Module Contact

VCC Supply Voltage C1

GND Ground C5

CLK Serial Clock Input C3

I/O Serial Data Input/Output C7

RST Reset Input C2

PGM Program Input C8

FUS Fuse Input C4

Rev. 2035A–SMEM–4/02

Figure 1. Card Module Contact

Figure 2. Block Diagram

GND

RST CLK

PGM

FUS

= C1

RST = C2

CLK = C3 FUS = C4

Power On

Reset

Address

Counter

C5 = GND

C6 = NC

C7 = I/O C8 = PGM

Security Logic

PROM

Memory

I/O

Pin Descriptions

Supply Voltage (VCC) The VCC input is a 4.5V to 5.5V positive voltage.

Serial Clock (CLK) The CLK input is used to positive edge clock data into the device and negative edge

clock data out of the device. There is an internal pull-down on CLK.

Serial Data (I/O) I/O is bidirectional for serial data transfer to and from the device.

Reset (RST) The RST input is used to reset the address counter. There is an internal pull-up on RST.

Program (PGM) The PGM input is used to determine the state of I/O as an input or output. There is an

internal pull-down on PGM.

Fuse (FUS) The FUS input is used during the personalization of the device. There is an internal pull-

down on FUS.

AT88SC1003

2035A–SMEM–4/02

AT88SC1003

Security Features The security features of Atmel’s AT88SC1003 include:

– Data access only after validation of the security code

– Permanent invalidation of device upon four consecutive false security code

presentations

– Read/write protection of certain memory zones

– Secure transport of devices using security code compare sequence.

Security Levels Access to the memory is controlled by the state of the issuer fuse and by the voltage

supply applied on the FUS pin.

FUS Pin Issuer Fuse Security Level

Logic “0” X 2

Logic “1” 1 1

Logic “1” 0 2

Level 1: Security During Personalization by the Card Issuer

Level 2: Security After Personalization (Customer Release)

AT88SC1003 die and modules are delivered with the issuer fuse intact. Issuer personalization is completed at this level. Security code validation is required to allow access to personalize the EEPROM memory. During personalization, the fab zone fuse may be blown to lock the fabrication zone. The manufacturer fuse may be blown to lock the manufacturer’s zone.

See “Memory Access Rules During Personalization” ( Table 2 on page 12).

Conditions:

Issuer fuse = “1” (not blown)

FUS pin = “1” (required)

EEPROM memory zones are protected by the various flags and passwords. After issuer personalization, Security Level 2 is implemented by blowing the issuer fuse. The device can also be placed in Security Level 2 by taking the FUS pin low, independent of the state of the issuer fuse. This function of the FUS pin enables the card issuer to simulate Security Level 2 during application development, without permanently blowing the issuer fuse.

See “Memory Access Rules After Personalization” ( Table 3 on page 13).

Conditions:

Issuer fuse = “0” (blown)

FUS pin = “X”

Issuer fuse = “1” (not blown)

FUS pin = “0”

2035A–SMEM–4/02

Memory Diagram

Bit Address Zone Bits Words

0–15 FZ – Fabrication Zone 16 Bits 1

16–79 IZ – Issuer Zone 64 Bits 4

80–95 SC – Security Code 16 Bits 1

96–111 SCAC – Security Code Attempts Counter (only first 4 bits used) 16 Bits 1

112–175 CPZ – Code Protected Zone 64 Bits 4

176–431 AZ1 – Application Zone 1 256 Bits 16

432–479 EZ1 – Application Zone 1 Erase Key 48 Bits 3

480–735 AZ2 – Application Zone 2 256 Bits 16

736–767 EZ2 – Application Zone 2 Erase Key 32 Bits 2

768–895 EC2 – Application Zone 2 Erase Counter 128 Bits 8

896–911 MTZ – Memory Test Zone 16 Bits 1

912–975 MFZ – Manufacturer’s Zone 64 Bits 4

992–1007 ISSUER FUSE 16 Bits 1

1012–1015 FAB ZO NE FUSE 4Bits

1016–1019 MANUF. FUSE – Manufacturer’s Fuse 4 Bits

1020–1023 EC2EN FUSE – Controls use of EC2 4 Bits

1024–1535 AZ3 – Application Zone 3 512 Bits 32

1536–1583 EZ3 – Application Zone 3 Erase Key 48 Bits 3

1584 EB3 – Application Zone 3 Erase Bit 1 Bit

1585–1599 Unused 16 Bits 1

AT88SC1003

2035A–SMEM–4/02

Memory Zone Descriptions

Zone Definition

AT88SC1003

Fabrication Zone FZ (16 bits)

Issuer Zone IZ (64 bits)

Security Code SC (16 bits)

Security Code Attempts Counter SCAC (4 bits plus 12 unused bits)

The 16-bit fabrication zone is initially programmed by Atmel. Prior to blowing the fab zone fuse, the fabrication zone may be rewritten by the card manufacturer. This area becomes read-only after the fab zone fuse is blown. Blowing the issuer fuse will also lock the data in the FZ.

The 64-bit issuer zone is programmed by the card issuer during the personalization phase. It will contain issuer-specific information, such as serial numbers and dates. This area becomes read-only after the issuer fuse has been blown. Read access is always allowed in the issuer zone.

The security code is initially set by Atmel to protect the product during transportation to the card issuer. During personalization, this code must be entered and verified by the AT88SC1003 to allow access to the changed in either security mode. The security code gives access to Application Zones 1, 2 and 3, and also gives access to the code-protected zone area for erase and write. Verification of the security code will set the internal flag SV to “1”. Atmel ships the device with a security code (transportation code) pre-programmed. This protects against the unauthorized use of an unpersonalized device, and should be written to a new value during initialization.

The protocol for verification of the security code requires that the user write one of the first four bits of the SCAC to a logic “0”. This allows the SCAC to count the number of consecutive incorrect presentations of the security code. After four consecutive incorrect security code presentations, the first four bits of the SCAC will all be written to “0”, and the user is permanently blocked from access to the application zones, as well as to other areas controlled by the security code. After a successful presentation of the security code, the entire 16-bit SCAC, including the four active bits, should be erased. This verifies that the correct security code has been presented, since an erase operation in this area is not allowed without SC verification. It also clears the SCAC bits in preparation for the next use of the card. This erase operation will also clear the remaining 12 bits of the 16-bit SCAC word. These 12 bits may be used in an application, although the entire 16-bit word will be erased if any bit in the SCAC is erased.

EEPROM memory. After the security code has been verified, the code itself may be

Code Protected Zone CPZ (64 bits)

Application Zone 1 AZ1 (256 bits)

ApplicationZone1Erase Key EZ1 (48 bits)

Read access to this area is always allowed and does not require SC validation. The security code must be correctly presented to allow write access to the code-protected zone.

AZ1 is intended to hold user application data. P1 (address 176) controls write access and R1 (address 177) controls read access within Zone 1. In Security Level 1, erasing AZ1 is accomplished by performing an erase operation on any bit within AZ1, after verification of the security code (SV flag = 1). This operation will erase the entire zone. In Security Level 2, erase operations are controlled by both the SV flag and the erase key EZ1. See the erase definition in the Device Functional Operation chart (page 16) for specific details. There is no limit to the number of erase operations performed in AZ1. In Security Level 1, write operations in AZ1 may be performed on single bits after verification of the security code. In Security Level 2, the P1 bit must also be set to “1” to allow single bit write operations. Read operations in Security Levels 1 and 2 are allowed if either R1 is set to “1” or the SV flag is set to “1” by validating the security code.

The erase keys are passwords used to control erase operations within the application zones, after the issuer fuse has been blown (Security Level 2). The erase key password is written during personalization (Security Level 1), after verification of the security code. EZ1 can not be changed after the issuer fuse is blown. In Security Level 2, AZ1 can be erased only after both the security code and the EZ1 password have been validated. Verification of EZ1 will set the internal flag E1 to “1”.

2035A–SMEM–4/02

Memory Zone Descriptions (Continued)

Zone Definition

Application Zone 2 AZ2 (256 bits)

AZ2 is intended to hold user application data. P2 (address 480) controls write access and R2 (address 481) controls read access within Zone 2. In Security Level 1, erasing AZ2 is accomplished by performing an erase operation on any bit within AZ2, after verification of the security code (SV flag = 1). This operation will erase the entire zone. In Security Level 2, erase operations are controlled by the erase key EZ2, the erase counter EC2 and the EC2EN fuse. If the EC2EN fuse is set to “1”, then the erase counter made for Application Zone 2 is enabled, and the user is limited to 128 erase operations on AZ2. If the EC2EN fuse is set to “0”, then the erase counter mode is disabled and there is no limit to the number of erase operations on AZ2. The EC2EN fuse must be written during the personalization phase (Security Level 1). After the issuer fuse is blown, the status of the EC2EN fuse cannot be changed. See the erase definition in the Device Functional Operation chart (page 16) for specific details about erase procedure. In Security Level 1, write operations in AZ2 may be performed on single bits after verification of the secure code. In Security Level 2, the P2 bit must also be set to “1” to allow single bit write operations. Read operations in Security Levels 1 and 2 are allowed if either R2 is set to “1” or the SV flag is set to “1” by validating the secure code.

Application Zone 2 Erase Key EZ2 (32 bits)

Application Zone 2 Erase Counter EC2 (128 bits)

Memory Test Zone MTZ (16 bits)

Manufacturer’s Zone

MFZ (64 bits)

EC2EN Fuse

(4 bits)

The erase keys are passwords used to control erase operations within application zones after the issuer fuse has been blown (Security Level 2). The erase key password is written during personalization (Security Level 1), after verification of the security code. EZ2 cannot be changed after the issuer fuse is blown. In Security Level 2, AZ2 can be erased only after both the security code and the EZ2 password have been validated. Verification of EZ2 will set the internal flag E2 to “1”.

The erase counter (EC2) is enabled only in Security Mode 2 and only when the EC2EN fuse is set to “1”. If both of these conditions are true, the user will be limited to 128 erase operations in Application Zone 2. EC2 is used to count these erase cycles. The erase protocol for AZ2 requires one bit in EC2 to be written to a “0”. After 128 erase operations in AZ2, all 128 bits in EC2 will be “0” and the user will be blocked from erasing AZ2. The erase counter is only writeable and cannot be erased. When the EC2EN fuse = “0”, the EC2 operation is disabled. In that case there is no limit to the number of times the AZ2 can be erased, and EC2 has no function.

All operations are allowed for this zone (write, erase, read). The purpose of this zone is to provide an area in the product memory that is not restricted by security logic. It is used for testing purposes during the manufacturing process and may also be used in the product application if desired, although no security protection exists for the MTZ.

The MFZ is intended to hold data specific to the smart card manufacturer (like assembly lot codes, dates, etc.). Read operations within this zone are always allowed. Write or erase operations within this zone are allowed after the security code has been verified. After the data is entered by the card manufacturer, the manufacturer’s fuse can be blown and the data within the MFZ will become readonly. Blowing the issuer fuse will also lock the data in the MFZ.

This single bit EEPROM fuse selects whether the EC2 counter is used to limit the number of AZ2 erases in Security Mode 2. If the EC2EN fuse is unblown (“1”), the number of erases of AZ2 is limited to 128. If the EC2EN fuse is blown (“0”), there is no limit to the number of erase operations in AZ2. After the issuer fuse is blown, the state of the EC2EN fuse is locked and cannot be changed.

Issuer Fuse (16 bits)

This EEPROM bit functions as a fuse that is used to change the security mode of the AT88SC1003 from Security Mode 1 (“1”), to Security Mode 2 (“0”). Initialization of the IC for use by the end customer occurs in Security Mode 1. Access conditions in Security Mode 1 are described in Table 2 (page 12). Access conditions in Security Mode 2 are described in Table 3 (page 13).

AT88SC1003

2035A–SMEM–4/02

Memory Zone Descriptions (Continued)

Zone Definition

Application Zone 3 AZ3 (512 bits)

AZ3 is intended to hold user application data. P3 (address 1024) controls write access and R3 (address 1025) controls read access within Zone 3. In Security Level 1, erasing AZ3 is accomplished by performing an erase operation on any bit within AZ3, after verification of the security code (SV flag = 1). This operation will erase the entire zone. In Security Level 2, erase operations are controlled by both the SV flag and the erase key EZ3. See the device operation erase definition for specific details. There is no limit to the number of erase operations performed in AZ3. In Security Level 1, write operations in AZ3 may be performed on single bits after verification of the security code. In Security Level 2, the P3 bit must also be set to “1” to allow single bit write operations. Read operations in Securtiy Levels 1 and 2 are allowed if either R3 is set to “1” or the SV flag is set to “1” by validating the security code.

AT88SC1003

Application Zone 3 Erase key EZ3 (1 bit)

Application Zone 3 Erase Bit EB3 (1 bit)

Unused (16 bits)

The erase keys are passwords used to control erase operations within the application zones, after the issuer fuse has been blown (Security Level 2). The erase key password is written during personalization (Security Level 1), after verification of the security code. EZ3 can not be changed after the issuer fuse is blown. In Security Level 2, AZ3 can be erased only after both the security code and the EZ3 password have been validated. Verification of EZ3 will set the internal flag E3 to “1”.

Address location 1584 is designated as the erase bit for Application Zone 3. The erase protocol for an AT88SC1003 in Security Mode 2 requires that the erase key (EZ3) be verified, then an erase operation must be executed on the next bit following the erase key. This action will result in erasing the entire zone.

Address locations 1585–1599 are not functional in the AT88SC1003. If the address counter is incremented beyond address 1599, the counter will roll over to address 0. The counter can also be reset to “0” by executing a reset command.

Terminology The following terms have specific definitions for the AT88SC1003.

– A program operation that results in an EEPROM data bit being set to a logic “1”

Erase

state. Outside the application zones, all erase operations are performed on 16-bit words. An erase operation performed on any bit within a word will execute an erase of the entire word. Inside an application zone, erase operations are controlled by the SV flag, EZ passwords and the EC2EN fuse. These operations are defined in the

Functional Operation

– A program operation that results in an EEPROM bit or word being set to a logic

Write

“0” state. An unwritten bit is defined as erased, or set to a logic “1” state. Write operations in the AT88SC1003 may be performed on individual bits after security code validation. In Security Level 2, write operations also require that the P1, P2 or P3 bit within an application zone is set to “1”.

section of this data sheet (page 15).

Device

2035A–SMEM–4/02

Program

– An EEPROM function that activates internally timed, high-voltage circuitry

and results in a data bit or word being set to either a logic “0” or “1” state.

– A single data element set to either a logic “0” or “1” state. All bit addresses within

Bit

the application zones (AZ1, AZ2, AZ3) may be written individually.

– Eight consecutive data bits. A byte boundary will begin on an address that is

Byte

evenly divisible by 8. The AT88SC1003 has no capability for byte write operations.

– Sixteen consecutive data bits. A word boundary will begin on an address that is

Word

evenly divisible by 16. The AT88SC1003 will allow words to be written to a “0” during personalization (Security Level 1). Erase operations will always operate on 16-bit words when applied to addresses outside the application zones.

Blown – In reference to AT88SC1003 internal EEPROM fuses, the blown state is a logic

“0”.

Unblown

logic “1”.

Verification

flags. The flags SV, E1, E2 and E3 are set after verification of an associated password (security code; EZ1, EZ2 and EZ3 respectively). Verification is accomplished by executing an INC/CMP operation, which correctly matches the password bit by bit as the CLK increments the address through the password memory addresses.

– In reference to AT88SC1003 internal EEPROM fuses, the unblown state is a

– AT88SC1003 operations are controlled by the state of several internal

AT88SC1003

2035A–SMEM–4/02

Definition of AT88SC1003 Internal Flags

Flag Definition

SV Security Validation flag

OPERATION:

The SV flag is set by correctly matching the 16-bit security code bit by bit from address 80 through 95, as pin CLK increments the address counter. The security code matching operation must be followed immediately by a validation operation within the Security Code Attempts Counter (SCAC). This validation operation requires the user to find a bit in the SCAC, Addresses 96–99, that is a logic “1”. A write is performed followed by an erase. The AT88SC1003 will validate that the comparison was correct by outputting a logic “1”, and SV will be set. After the erase, all 16 bits in the SCAC will also be erased. The flag remains set until power to the card is turned off. If the comparison was in error or part of the validation was not performed correctly, the AT88SC1003 will output a logic “0” showing that SV has not been set. After four consecutive incorrect security code presentations, the card is permanently locked.

FUNCTION:

This flag is the master protection for the memory zones. See Tables 1 and 2.

P1 Application Zone 1 write flag

OPERATION:

If Bit 176 has been programmed to a logic “1”, this flag is set after Bit 176 has been addressed. The flag remains set until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

P1 and SV must both be set in order to enable a write command in Application Zone 1 (Security Mode 2).

AT88SC1003

P2 Application Zone 2 write flag

OPERATION:

If Bit 480 has been programmed to a logic “1”, this flag is set after Bit 480 has been addressed. The flag remains set until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

P2 and SV must both be set in order to enable the write command in Application Zone 2 (Security Mode 2).

P3 Application Zone 3 write flag

OPERATION:

If Bit 1024 has been programmed to a logic “1”, this flag is set after Bit 1024 has been addressed. The flag remains set until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

P3 and SV must both be set in order to enable a write command in Application Zone 3 (Security Mode 2).

R1 Application Zone 1 read flag

OPERATION:

If Bit 177 has been programmed to a logic “1”, this flag is set after Bit 177 has been addressed. The flag remains set until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

R1 or SV must be set to “1” in order to enable Application Zone 1 bits to be read.

R2 Application Zone 2 read flag

OPERATION:

If Bit 481 has been programmed to a logic “1”, this flag is set after Bit 481 has been addressed. The flag remains set until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

R2 or SV must be set to “1” in order to enable Application Zone 2 bits to be read.

R3 Application Zone 3 read flag

OPERATION:

If Bit 1025 has been programmed to a logic “1”, this flag is set after Bit 1025 has been addressed. The flag remains set until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

R3 or SV must be set to “1” in order to enable Application Zone 3 bits to be read.

2035A–SMEM–4/02

Definition of AT88SC1003 Internal Flags (Continued)

Flag Definition

E1 Application Zone 1 erase flag

OPERATION:

E1 is set when the Application Zone 1 erase code comparison is valid. This flag is reset when the address counter = 0.

FUNCTION:

Application Zone 1 (Bits 176–431) is erased when E1 is set and an erase is performed on Bit 480. This operation erases all bits in Application Zone 1 but does not affect the word containing Bit 480.

E2 Application Zone 2 erase flag with erase counter operation enabled. (EC2EN FUSE = “1”)

OPERATION:

This flag is set by correctly matching the Application Zone 2 erase code (EZ2) bit by bit as CLK increments the address counter. A validation operation must then be completed. This operation requires the user to find a bit in the Application Zone 2 erase counter (EC2), Addresses 768–895, that is a logic “1”. A write must then be performed, followed by an erase. The part will validate that the comparison was correct and Application Zone 2 will be erased. It is reset when the address counter = 0.

FUNCTION:

Application Zone 2 (Bits 480–735) is erased when E2 is set and an erase is performed after the validation operation in EC2 described above. This operation erases all bits in Application Zone 2.

E2 Application Zone 2 erase flag with erase counter operation disabled. (EC2EN FUSE = “0”)

OPERATION:

E2 is set when the Application Zone 2 erase code comparison is valid. This flag is reset when the address counter = 0.

FUNCTION:

Application Zone 2 (Bits 480–735) is erased when E2 is set and an erase is performed on Bit 768. This operation erases all bits in Application Zone 2 but does not affect the word containing Bit 768.

E3 Application Zone 3 erase flag

OPERATION:

E3 is set when the Application Zone 3 erase code comparison is valid. This flag is reset when the address counter = 0.

FUNCTION:

Application Zone 3 (Bits 1024–1535) is erased when E3 is set and an erase is performed on Bit 1584. This operation erases all bits in Application Zone 3.

AT88SC1003

2035A–SMEM–4/02

+ 21 hidden pages