MAXIM DS1991 Technical data

DS1991

www.iButton.com

SPECIAL FEATURES

 1,152-bit secure read/write, nonvolatile

memory

 Secure memory cannot be deciphered

without matching 64-bit password

 Memory is partitioned into 3 blocks of

384 bits each

 64-bit password and ID fields for each

memory block

 512-bit scratchpad ensures data transfer

integrity

 Operating temperature range: -40°C to

+70°C

 Over 10 years of data retention

COMMON iButton FEATURES

MultiKey i

 Easily affixed with self-stick adhesive

backing, latched by its flange, or locked with
a ring pressed onto its rim

 Presence detector acknowledges when reader

first applies voltage

 Meets UL#913 (4th Edit.); Intrinsically Safe

Apparatus, Approved under Entity Concept
for use in Class I, Division 1, Group A, B, C
and D Locations

F5 MICROCAN

5.89

0.51

®

Button

16.25

 Unique, factory-lasered and tested 64-bit

registration number (8-bit family code +
48-bit serial number + 8-bit CRC tester)
assures absolute traceability because no two

A1 02

000000FBC52B

1-Wire

®

®

17.35

parts are alike

 Multidrop controller for MicroLAN
 Digital identification and information by

momentary contact

 Chip-based data carrier compactly stores

information

 Data can be accessed while affixed to object
 Economically communicates to bus master

with a single digital signal at 16.3 kbits per
second

 Standard 16 mm diameter and 1-Wire®

protocol ensure compatibility with iButton®
family

 Button shape is self-aligning with cup-

shaped probes

 Durable stainless steel case engraved with

registration number withstands harsh

IO GND

All dimension\s shown in millimeters

ORDERING INFORMATION

DS1991L-F5 F5 MicroCan

EXAMPLES OF ACCESSORIES

DS9096P Self-Stick Adhesive Pad
DS9101 Multi-Purpose Clip
DS9093RA Mounting Lock Ring
DS9093F Snap-In Fob
DS9092 i

Button Probe

environments

1-Wire and iButton are registered trademarks of Dallas Semiconductor.

1 of 15 012207

DS1991

iButton DESCRIPTION

The DS1991 MultiKey iButton is a rugged read/write data carrier that acts as three separate electronic
keys, offering 1,152 bits of secure, nonvolatile memory. Each key is 384 bits long with distinct 64-bit
password and public ID fields (Figure 1). The password field must be matched in order to access the
secure memory. Data is transferred serially via the 1-Wire protocol, which requires only a single data lead
and a ground return. The 512-bit scratchpad serves to ensure integrity of data transfers to secure memory.
Data should first be written to the scratchpad where it can be read back. After the data has been verified, a
copy scratchpad command will transfer the data to the secure memory. This process ensures data integrity
when modifying the memory. A 48-bit serial number is factory lasered into each DS1991 to provide a
guaranteed unique identity which allows for absolute traceability. The family code for the DS1991 is 02h.
The durable MicroCan package is highly resistant to environmental hazards such as dirt, moisture and
shock. Its compact button-shaped profile is self-aligning with mating receptacles, allowing the DS1991 to
be easily used by human operators. Accessories permit the DS1991 to be mounted on plastic key fobs,
photo-ID badges, printed-circuit boards or any smooth surface of an object. Applications include secure
access control, debit tokens, work-in-progress tracking, electronic travelers and proprietary data.

OPERATION

The DS1991 is accessed via a single data line using the 1-Wire protocol. The bus master must first
provide one of the four ROM Function Commands, 1) Read ROM, 2) Match ROM, 3) Search ROM, 4)
Skip ROM. These commands operate on the 64-bit lasered ROM portion of each device and can singulate
a specific device if many are present on the 1-Wire line as well as indicate to the bus master how many
and what types of devices are present. The protocol required for these ROM Function Commands is
described in Figure 9. After a ROM Function Command is successfully executed, the memory functions
that operate on the secure memory and the scratchpad become accessible and the bus master may issue
any one of the six Memory Function Commands specific to the DS1991. The protocol for these Memory
Function Commands is described in Figure 5. All data is read and written least significant bit first.

64-BIT LASERED ROM

Each DS1991 contains a unique ROM code that is 64 bits long. The first 8 bits are a 1-Wire family code.
The next 48 bits are a unique serial number. The last 8 bits are a CRC of the first 56 bits. (Figure 2.) The
1-Wire CRC is generated using a polynomial generator consisting of a shift register and XOR gates as
shown in Figure 3. The polynomial is X8 + X5 + X4 + 1. Additional information about the Dallas 1-Wire
Cyclic Redundancy Check is available in the Book of DS19xx i
are initialized to zero. Then starting with the least significant bit of the family code, 1 bit at a time is
shifted in. After the 8th bit of the family code has been entered, then the serial number is entered. After
the 48th bit of the serial number has been entered, the shift register contains the CRC value. Shifting in
the 8 bits of CRC should return the shift register to all zeros.

Button Standards. The shift register bits

MEMORY FUNCTION COMMANDS

The DS1991 has six device-specific commands. Three scratchpad commands: Write Scratchpad, Read
Scratchpad and Copy Scratchpad and three subkey commands: Write Password, Write Subkey and Read
Subkey. After the device is selected, the memory function command is written to the DS1991. The
command is comprised of three fields, each one byte long. The first byte is the function code field. This
field defines the six commands that can be executed. The second byte is the address field. The first 6 bits
of this field define the starting address of the command. The last 2 bits of this field are the subkey address
code. The third byte of the command is a complement of the second byte (Figure 4).

2 of 15

DS1991

For the first use, since the passwords actually stored in the device are unknown, the DS1991 needs to be
initialized. This is done by directly writing (i. e., not through the scratchpad) the new identifier and
password for the selected subkey using the Write Password command. As soon as the new identifier and
password are stored in the device, further updates should be done through the scratchpad.

MEMORY MAP Figure 1

* Each subkey or the scratchpad has its own unique address.

64-BIT LASERED ROM Figure 2

8-Bit CRC Code 48-Bit Serial Number 8-Bit Family Code (02H)

MSB LSB MSB LSB MSB LSB

1-WIRE CRC GENERATOR Figure 3

3 of 15

DS1991 COMMAND STRUCTURE Figure 4

DS1991

Command 1st byte

write

scratchpad

read

scratchpad

copy

scratchpad

read

SubKey

write

SubKey

write

password

B7 B6 B5 B4 B3 B2 B1 B0

96H

1 1

69H

3CH 0 0 0 0 0 0

66H

99H

5AH

Sub-Key

Nr.:

0 0

or

0 1

or

1 0

2nd byte 3rd byte

any value

00H to 3FH

ones complement

any value

10H to 3FH

0 0 0 0 0 0

of 2

nd

byte

SCRATCHPAD COMMANDS

The 64-byte read/write scratchpad of the DS1991 is not password-protected. Its normal use is to build up
a data structure to be verified and then copied to a secure subkey.

Write Scratchpad [96H]

The Write Scratchpad command is used to enter data into the scratchpad. The starting address for the
write sequence is specified in the command. Data can be continuously written until the end of the
scratchpad is reached or until the DS1991 is reset. The command sequence is shown in Figure 5, first
page, left column.

Read Scratchpad [69H]

The Read Scratchpad command is used to retrieve data from the scratchpad. The starting address is
specified in the command word. Data can be continuously read until the end of the scratchpad is reached
or until the DS1991 is reset. The command sequence is shown in Figure 5, first page, center column.

Copy Scratchpad [3CH]

The Copy Scratchpad command is used to transfer specified data blocks from the scratchpad to a selected
subkey. This command should be used when data verification is required before storage in a secure
subkey. Data can be transferred in single 8-byte blocks or in one large 64-byte block. There are nine valid
block selector codes that are used to specify which block is to be transferred (Figure 6). As a further
precaution against accidental erasure of secure data, the 8-byte password of the destination subkey must
be entered. If the password does not match, the operation is terminated. After the block of data is
transferred to the secure subkey, the original data in the corresponding block of the scratchpad is erased.
The command sequence is shown in Figure 5, first page, right column.

SUBKEY COMMANDS

Each of the subkeys within the DS1991 is accessed individually. Transactions to read and write data to a
secured subkey start at the address defined in the command and proceed until the device is reset or the
end of the subkey is reached.

4 of 15

DS1991

Write Password [5AH]

The Write Password command is used to enter the ID and password of the selected subkey. This
command will erase all of the data stored in the secure area as well as overwriting the ID and password
fields with the new data. The DS1991 has a built-in check to ensure that the proper subkey was selected.
The sequence begins by reading the ID field of the selected subkey; the ID of the subkey to be changed is
then written into the part. If the IDs do not match, the sequence is terminated. Otherwise, the subkey
contents are erased and 64 bits of new ID data are written followed by a new 64-bit password. The
command sequence is shown in Figure 5, 2nd page, right column.

MEMORY FUNCTIONS FLOW CHART Figure 5

5 of 15