AT88SC102-09GT-XX-2.7

Features

• 1K X 1 Serial EEPROM with Security Logic

• Two Application Zones

• Stores and Validates Security Codes

• Maximum of Eight Incorrect Security Code Attempts

• Provides Transport Code Security

• Low Voltage Operation: 2.7V to 5.5V

• Manufactured using Low Power CMOS Technology

• Supports ISO/IEC 7816-3 Synchronous Protocol

• V_PPInternally Generated

• 2 µs Read Access Time; 2 ms Write Cycle Time

• Temperature Range from -40°C to 85°C

• ESD Protection 4,000V Minimum.

• High Reliability:

1K EEPROM -

Security Logic

with Two

100,000 Program/Erase Cycles Guaranteed

Data Retention of 10 years

Application

Zones

Description

The AT88SC102 device is a low-cost, synchronous, secure memory integrated circuit,

designed for use in prepaid and loyalty smart card applications. The AT88SC102

provides 1024 bits of serial Electrically Erasable and Programmable Read Only

Memory (EEPROM) within two Application Zones, plus 64 bits in a code protected

zone. Additional EEPROM memory and security logic provide security for smart card

applications. Space is provided in the EEPROM memory for manufacturing records for

both the smart card manufacturer and card issuer. After personalization, these

records, and the state of the bit which enables the Erase Counter function, are locked

and protected from modification for the lifetime of the product.

AT88SC102

Card Module Contacts

ISO Card Contact Descriptions

ISO

Contact

VDD C1 C5 VSS

Pad Name

VCC

RST

Description

RST C2 C6 NC

CLK C3 C7 I/O

FUS C4 C8 PGM

C1

Operating Voltage

Address Reset

Clock and Address Control

Fuse

C2

C3

CLK

C4

FUS

C5

GND

NC

Ground

C6

No Connect

C7

I/O

Bidirectional Data

Programming Control

C8

PGM

Rev. 1419B–11/99

1

Terminology

The following terms have specific definitions for the

AT88SC102.

BYTE: Eight consecutive data bits. A byte boundary will

begin on an address that is evenly divisible by eight. The

AT88SC102 has no capability for byte write operations.

ERASE: A program operation which results in an EEPROM

data bit being set to a logic “1” state. Outside the

Application Zones, all erase operations are performed on

16-bit words. An erase operation performed on any bit

within a word will execute an erase of the entire word.

Inside the Application Zones, erase operations are

controlled by the SV Flag, EZ passwords and the EC2EN

fuse. These operations are defined in the “Device

Operation” section of the data sheet.

WORD: Sixteen consecutive data bits. A Word boundary

will begin on an address that is evenly divisible by 16.

Erase operations will always operate on 16-bit words when

applied to addresses outside the Application Zones. In

Security Level 1, erase operations within the Application

Zones also operate on 16-bit words. In Security Level 2,

erase operations within the Application Zones operate on

the entire zone. Write operations function on single bits, not

words, in both security levels.

WRITE: A program operation which results in an EEPROM

bit, or word being set to a logic “0” state. An unwritten bit is

defined as erased, or set to a logic “1” state. Write

operations in the AT88SC102 may be performed on

individual bits after security code validation. In Security

Level 2, write operations also require that the P1 or P2 bit

within the Application Zone is set to “1”.

BLOWN: In reference to an AT88SC102 internal EEPROM

fuse, the blown state is a logic “0”.

UNBLOWN: In reference to an AT88SC102 internal

EEPROM fuse, the unblown state is a logic “1”.

VERIFICATION: AT88SC102 operations are controlled by

the state of several internal flags. The flags SV, E1 and E2

are set after verification of an associated password

(security code or EZ1 or EZ2 respectively). Verification is

accomplished by executing an INC/CMP operation, which

correctly matches the password bit by bit as the CLK

increments the address through the password memory

addresses.

PROGRAM: An EEPROM function which activates

internally timed, high voltage circuitry and results in a data

bit, or word being set to either a logic “0” or “1” state.

BIT: A single data element set to either a logic “0” or “1”

state. All bit addresses within the Application Zones (AZ1,

AZ2) may be written individually.

Block Diagram

VDD

Power On

Reset

VSS

RST

Address

Counter

EEPROM

Memory

CLK

PGM

Security Logic

FUS

I/O

The AT88SC102 is manufactured using low-power CMOS

technology and features its own internal high-voltage pump

for single voltage supply operation. The devices are

guaranteed to 100,000 erase/write cycles and 10-year data

retention. The AT88SC102 supports the ISO/IEC 7816-3

synchronous protocol.

AT88SC102

2

AT88SC102

Security Features

The Security Features of Atmel’s AT88SC102 include:

• Secure transport of devices using transport code

• Data access only after validation of the Security Code.

compare sequence.

• Permanent invalidation of the device after eight

• Unique customer identification number written and

locked into every device for protection against

duplication or counterfeiting.

consecutive false Security Code presentations.

• Read/Write protection of certain memory zones.

Security Levels and Memory Access to AT88SC102

Access to the memory is controlled by the state of the

Issuer Fuse and by the voltage supply applied on the FUS

pad.

Level 2: (Security After Personalization)

Conditions:

ISSUER FUSE = “0” (blown)

FUS PIN = “X” (don’t care)

FUS Pad

Logic “0”

Logic “1”

Issuer Fuse

X

Security Level

Customer release. The EEPROM memory zone is

protected by the various flags and passwords. After issuer

personalization, Security Level 2 is implemented by

blowing the Issuer Fuse. The device can also be placed in

Security Level 2 by taking FUS pin low, independent of the

state of Issuer Fuse.

2

1

2

1 (unblown)

0 (unblown)

Level 1: (Security During Personalization)

Conditions:

See “Memory Access Rules After Personalization”.

ISSUER FUSE = “1” (not blown)

FUS PIN = “1” (required)

AT88SC102 die and modules are delivered with the Issuer

Fuse intact (unblown). Issuer personalization is completed

at this level. Security Code validation is required to allow

access to personalize the EEPROM memory. The FUS PIN

must be held at a logic “1” for Security Level 1. The function

of the FUS PIN enables the card issuer to simulate Security

Level 2 during application development, without

permanently blowing the Issuer fuse.

See “Memory Access Rules During Personalization”.

3

Memory Map

AT88SC102 Memory Diagram

Bit Address

Description

Bits

16

64

16

64

512

48

512

32

128

16

1

Words

0 - 15

Fabrication Zone (FZ)

1

4

16 - 79

Issuer Zone (IZ)

80 - 95

Security Code (SC)

1

96 - 111

Security Code Attempts counter (SCAC)

Code Protected Zone (CPZ)

Application Zone 1 (AZ1)

Application Zone 1 Erase Key (EZ1)

Application Zone 2 (AZ2)

Application Zone 2 Erase Key (EZ2)

Application Zone 2 Erase Counter (EC2)

Memory Test Zone (MTZ)

Manufacturer’s Zone (MFZ)

Block Write/Erase

1

112 - 175

176 - 687

688 - 735

736 - 1247

1248 - 1279

1280 - 1407

1408 - 1423

1424 - 1439

1440 - 1455

1456 - 1471

1529

4

32

3

32

2

8

1

MANUFACTURER’S FUSE

EC2EN FUSE (Controls use of EC2)

ISSUER FUSE

1

1552 - 1567

16

1

AT88SC102

4

AT88SC102

Memory Zones

Zone

Definition

Fabrication Zone

FZ (16 bits)

The 16-bit Fabrication Zone is programmed when the chip is manufactured and cannot be changed.

The data held in the Fabrication Zone is specific to each Atmel customer, and cannot be modified.

Application software may check this Fabrication Zone Code to assure that the device was

manufactured by Atmel specifically for the intended application. Devices containing codes assigned to

specific customers will not be sold to unauthorized customers. Fraudulent cards will not contain the

correct code.

Issuer Zone

IZ (64 bits)

The 64-bit Issuer Zone is programmed by the card issuer during the personalization phase. It will

contain issuer-specific information, such as serial numbers and dates. This area becomes read-only

after the ISSUER FUSE has been blown. Read access is always allowed in the Issuer Zone.

Security Code

SC (16 bits)

The card Security Code is initially set by Atmel, to protect the card during transportation to the card

issuer. During personalization, this code must be verified by the AT88SC102 to allow access to the

EEPROM memory. After the Security Code has been verified, the code itself may be changed in either

security mode. While in personalization mode (Security Level 1), the Security Code gives ERASE and

WRITE access to both the Application Zones and the Code Protected Zone. In Security Level 2, the

Security Code gives WRITE access to both the Application Zones and the Code Protected Zone.

ERASE access requires verification of both the Security Code and the Erase Key (EZ1 or EZ2).

Verification of the Security Code will set the internal flag SV to “1”. Atmel ships the device with a

Security Code (transportation code) pre-programmed. This protects against the unauthorized use of

an unpersonalized device, and should be written to a new value during initialization.

Security Code Attempts

Counter SCAC (16 bits)

The protocol for verification of the Security Code requires that the user write one of the first eight bits

of the SCAC to a logic “0”. This allows the SCAC to count the number of consecutive incorrect

presentations of the Security Code. After eight consecutive incorrect Security Code presentations, the

first eight bits of the SCAC will all be written to “0”, and the user is permanently blocked from access to

the Application Zones, as well as other areas controlled by the Security Code. After a successful

presentation of the Security Code, the entire 16-bit SCAC, including the eight active bits, should be

erased. This verifies that the correct Security Code has been presented, since an erase operation in

this area is not allowed without SC verification. It also clears the SCAC bits in preparation for the next

use of the card. This erase operation will also clear the remaining eight bits of the 16-bit SCAC word.

These eight bits may be used in an application, although the entire 16-bit word will be erased if any bit

in the SCAC is erased.

Code Protected Zone

CPZ (64 bits)

READ access to this area is always allowed, and does not require SC validation. The Security Code

must be correctly presented to allow WRITE or ERASE access to the Code Protected Zone.

Application Zones 1 and 2

AZ1 and AZ2

The Application Zones (AZ1 and AZ2) are intended to hold user application data. P1 (address 176)

controls WRITE access, and R1 (address 177) controls READ access within AZ1. P2 (address 736)

controls WRITE access and R2 (address 737) controls READ access within AZ2. In Security Level 1,

an entire 16-bit word will be erased if an erase is performed on any single bit within that word. In

Security Level 2, erase operations are controlled by both the SV flag and the Erase Keys (EZ1 and

EZ2). See the Device Operation ERASE definition for specific details. The number of erase operations

performed in AZ2 may be limited by leaving the EC2EN Fuse set to “1”. The AT88SC102 allows

unlimited erase operations of AZ1.

(512 bits each)

Application Zone

Erase Keys

EZ1 (48 bits)

(Enabled in Security Level 2 only.) The Erase Keys are passwords used to control ERASE operations

within the Application Zones, after the Issuer Fuse has been blown (Security Level 2). The Erase Key

passwords are written by the Issuer during personalization (Security Level 1), after verification of the

Security Code. EZ1 and EZ2 can not be changed after the Issuer Fuse is blown. In Security Level 2,

the AT88SC102 allows only block erasure of an entire Application Zone. AZ1 can be erased only after

both the Security Code and the EZ1 password have been validated. Verification of EZ1 will set the

internal flag E1 to “1”. AZ2 can be erased only after both the Security Code and the EZ2 password

have been validated. Verification of EZ1 will set the internal flag E1 to “1”. Verification of EZ2 will set

the internal flag E2 to “1”.

EZ2 (32 bits)

5

Memory Zones (Continued)

Zone

Definition

Application Zone 2

Erase Counter EC2

(128 bits)

(Enabled in Security Level 2 only) The Application Zone 2 Erase Counter (EC2) is enabled only in

Security Mode 2 and only when the EC2EN fuse is set to “1”. If both of these conditions are true, the

user will be limited to 128 erase operations in Application Zone 2. EC2 is used to count these erase

cycles. The erase protocol for the AT88SC102 Application Zone 2 requires one bit in EC2 to be written

to “0”. After 128 erase operations, all 128 bits in EC2 will be “0” and the user will be blocked from

erasing AZ2. The Erase Counter is only writeable and cannot be erased. When the EC2EN fuse = “0”,

the EC2 operation is disabled. In that case there is no limit to the number of times AZ2 can be erased,

and EC2 has no function.

Memory Test Zone

MTZ (16 bits)

All operations are allowed for this zone (WRITE, ERASE, READ). The purpose of this zone is to

provide an area in the product memory which is not restricted by security logic. It is used for testing

purposes during the manufacturing process, and may also be used in the product application if

desired, although no security protection exists for the MTZ.

Manufacturer’s Zone

MFZ (16 bits)

The MFZ is intended to hold data specific to the smart card manufacturer (like assembly lot codes,

dates, etc.). Read operations within this zone are always allowed. Write or Erase operations within this

zone are allowed after the Security Code has been verified. After the data is entered by the Card

Manufacturer, the Manufacturer’s Fuse can be blown and the data within the MFZ will become read-

only. Blowing the Issuer Fuse will also lock the data in the MFZ.

EC2EN Fuse

(1 bit)

This single bit EEPROM fuse selects whether the EC2 counter is used to limit the number of AZ2

erase operations in Security Mode 2. If the EC2EN Fuse is unblown (“1”), the number of erase

operations allowed in AZ2 is limited to 128. If the EC2EN Fuse is blown (“0”), there is no limit to the

number of erase operations in AZ2. After the Issuer Fuse is blown, the state of the EC2EN Fuse is

locked and cannot be changed.

Issuer Fuse

(16 bits)

This EEPROM fuse is used to change the security mode of the AT88SC102 from Security Mode 1

(“1”) to Security Mode 2 (“0”). Initialization of the AT88SC102 for use by the end customer occurs in

Security Mode 1. Access conditions in Security Mode 1 are described in Table 1. Access conditions in

Security Mode 2 are described in Table 2.

Manufacturer’s Fuse

This single bit EEPROM fuse is used to lock the data stored in the Manufacturer’s Zone after

(1 bit)

personalization has been completed.

AT88SC102

6

AT88SC102

Definition of AT88SC102 Internal Flags

Zone

Definition

SV

Security Validation Flag

OPERATION:

The SV flag is set by correctly matching the 16-bit Security Code bit-by-bit from address 80 through 95, as CLK

increments the address counter. The security code matching operation must be followed immediately by a validation

operation within the Security Code Attempts Counter (SCAC). This validation operation requires the user to find a bit

in the first eight bits of the SCAC (addresses 96 - 103) which is a logic “1”. A WRITE operation is performed, followed

by an ERASE. The AT88SC102 will validate that the comparison was correct by outputting a logic “1”, and SV will be

set. After the ERASE, all 16 bits in the SCAC will also be erased. The SV flag remains set until power to the card is

turned off. If the comparison was in error, or part of the validation was not performed correctly, the AT88SC102 will

output a logic “0”, showing that the SV flag has not been set. After eight consecutive incorrect Security Code

presentations, the card is permanently locked.

FUNCTION:

This flag is the master protection for the memory zones. See Tables 1 and 2.

P1

R1

Application Zone 1 Write Flag

OPERATION:

If bit 176 has been programmed to a logic “1” this flag is set after bit 176 has been addressed. The flag remains set

until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

P1 and SV must both be set in order to enable a WRITE command in the Application Zone (Security Mode 2).

Application Zone 1 Read Flag

OPERATION:

If bit 177 has been programmed to a logic “1” this flag is set after bit 177 has been addressed. The flag remains set

until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

R1 or SV must be set in order to enable Application Zone 1 to be read.

P2

R2

Application Zone 2 Write Flag

OPERATION:

If bit 736 has been programmed to a logic “1” this flag is set after bit 736 has been addressed. The flag remains set

until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

P2 and SV must both be set in order to enable a WRITE command in Application Zone 2 (Security Mode 2).

Application Zone 2 Read Flag

OPERATION:

If bit 737 has been programmed to a logic “1” this flag is set after bit 737 has been addressed. The flag remains set

until power to the device is turned off, even if this bit is written to “0” by a subsequent operation.

FUNCTION:

R2 or SV must be set in order to enable Application Zone 2 to be read.

7

Definition of AT88SC102 Internal Flags

Zone

Definition

E1

Application Zone 1 Erase Flag

OPERATION:

The E1 Flag is set by correctly matching the Application Zone 1 Erase Key (EZ1) bit by bit as pin CLK increments the

address counter. To complete an ERASE operation of AZ1 in Security Level 2, an ERASE operation must be

performed on bit 736 after E1 is set. The E1 Flag is reset when the address counter = 0.

FUNCTION:

Application Zone 1 (bits 176 - 687) will be erased when E1 is set and an ERASE is performed on bit 736. This

operation erases all bits in Application Zone 1. There is no limit to the number of erase operations which can be

performed on AZ1.

E2

Application Zone 2 Erase Flag with Erase Counter operation enabled. (EC2EN FUSE = “1”)

EC Enabled

OPERATION:

This flag is set by correctly matching the Application Zone 2 Erase Key (EZ2) bit by bit as pin CLK increments the

address counter. Then a validation operation must be completed. This operation requires the user to find a bit in

Application Zone 2 Erase Counter (EC2), addresses 1280 - 1407, which is a logic “1”. A WRITE must then be

performed, followed by an ERASE. The AT88SC102 will validate that the comparison was correct and Application

Zone 2 will be erased. This flag is also reset when the address counter = 0.

FUNCTION:

Application Zone 2 (bits 736 -1237) is erased when E2 is set and an ERASE is performed after the validation

operation in EC2 described above. This operation erases all bits in Application Zone 2.

E2

Application Zone 2 Erase Flag with Erase Counter operation disabled. (EC2EN FUSE = “0”)

EC Disabled

OPERATION:

E2 is set when the Application Zone 2 Erase Key comparison is valid. It is reset when the address counter = 0.

FUNCTION:

Application Zone 2 (bits 736 -1247) is erased when E2 is set and an ERASE is performed on bit 1280.

This operation erases all bits in Application Zone 2, but does not affect the word containing bit 1280.

AT88SC102

8

AT88SC102

Definition of AT88SC102 Passwords

Password

Definition

Security Code (SC)

bits 80-95

This password is used to set the SV (Security Validation) flag and is used in determining what

operations are allowed in each zone (see Tables 1 and 2).

(16 bits)

Application Zone 1 Erase Key (EZ1)

bits 688-735

This password must be programmed during issuer personalization. It is used to erase

Application Zone 1 in Security Level 2. Verification of EZ1 will set the internal flag E1 to “1”.

(48 bits)

Application Zone 2 Erase Key (EZ2)

bits 1248-1279

This password must be programmed during issuer personalization. It is used to erase

Application Zone 2 in Security Level 2. Verification of EZ2 will set the internal flag E2 to “1”.

(32 bits)

Definition of AT88SC102 Fuses

MANUFACTURER FUSE: This fuse is used to control

writes and erases of the Manufacturer Zone (MFZ). When

the security code has been validated and both the Issuer

Fuse and the Manufacturer Fuse are unblown, writes and

erases of the MFZ are allowed. Blowing the Issuer Fuse

will also disable the Manufacturer Fuse if it has not been

blown previously.

ISSUER FUSE: This fuse is used to personalize the

AT88SC102 for end use. It is an additional EEPROM bit

which can be programmed to a logic “0”. This is its “blown”

state. Security of the device when Issuer Fuse is a logic “1”

is described in Table 1. The device is in Security Level 2

when the Issuer Fuse is blown. The device can also be

placed in Security Level 2 by taking the FUS pin low inde-

pendent of the state of Issuer Fuse. Memory access rules

of the device in Security Level 2 are described in Table 2.

EC2EN FUSE: This fuse selects whether the EC2 counter

is used to limit the number of Application Zone 2 erases

allowed in security mode 2. If EC2EN FUSE is “unblown”,

then the Application Zone 2 erases are limited to 128. If the

EC2EN FUSE is “blown” the Application Zone erases are

unlimited. After the Issuer Fuse is blown the state of the

EC2EN FUSE is locked and cannot be changed.

9

Memory Access Rules During Personalization - Security Mode 1⁽¹⁾

Table 1. Access Conditions During Personalization (Issuer Fuse not blown).

Zone

SV⁽²⁾

R1⁽³⁾

R2⁽⁴⁾

MF⁽⁵⁾

Read

Erase

Write

Compare

FZ

x

yes

no

0

1

x

yes

no

yes

no

yes

no

IZ

SC

0

1

x

no

yes

no

yes

no

yes

no

0

1

x

yes

no

yes

no

SCAC

CPZ

0

1

x

yes

no

yes

no

yes

no

0

1

0

1

x

no

yes

no

yes

no

yes

no

AZ1

EZ1

AZ2

EZ2

0

1

x

no

yes

no

yes

no

yes

no

0

1

x

0

1

x

no

yes

no

yes

no

yes

no

0

1

x

no

yes

no

yes

no

yes

no

0

1

x

yes

no

yes

no

EC2

MTZ

x

yes

no

0

1

x

0

1

yes

no

yes

no

yes

no

MFZ

Notes: 1. Security Mode 1 Conditions:

EC2EN = “1” or “0”

ISSUER FUSE = “1”

FUS PIN = “1” (required)

2. SV: SV = “1” after validation of the security code

3. R1: 2nd bit of Application Zone 1 (bit 177)

4. R2: 2nd bit of Application Zone 2 (bit 737)

5. MF: MANUFACTURER FUSE = “0” when blown

AT88SC102

10

AT88SC102

Memory Access Rules After Personalization - Security Mode 2⁽¹⁾

Table 2. Access Conditions After Personalization (Issuer Fuse blown).

Zone

FZ

SV⁽²⁾

P1⁽³⁾

R1⁽⁴⁾

P2⁽⁵⁾

R2⁽⁶⁾

E1⁽⁷⁾

E2⁽⁸⁾

Read

yes

Erase

no

Write

no

Compare

x

no

IZ

yes

no

0

1

x

no

yes

no

yes

no

SC

SCAC

CPZ

0

1

x

yes

no

yes

no

0

1

x

yes

no

yes

no

yes

no

0

1

x

0

1

0

1

x

0

1

0

1

x

no

yes

no

yes

no

yes

no

yes

AZ1

EZ1

AZ2

x

no

yes

0

1

x

0

1

0

1

x

0

1

0

1

no

yes

no

yes

no

yes

no

yes

EZ2

EC2

MTZ

MFZ

x

no

yes

no

yes

no

yes

no

Notes: 1. Security Mode 2 Conditions:

MANUFACTURER FUSE = “X”

EC2EN FUSE = “1” or “0”

ISSUER FUSE = “0”

FUS PIN = “X”

2. SV: SV = “1” after validation of the security code

3. P1: 1st bit of Application Zone 1 (bit 176)

4. R1: 2nd bit of Application Zone 1 (bit 177)

5. P2: 1st bit of the Application Zone . (bit 736)

6. R2: 2nd bit of the Application Zone 2 (bit 737)

7. E1: E1 = “1” after a valid presentation of the Application Zone 1 Erase Key EZ1

8. E2: E2 = “1” after a valid presentation of the Application Zone 2 Erase Key EZ2

11

Micro Operations

The AT88SC102 circuit operation modes are selected by the input logic levels on the control pins PGM, CLK and RST and

by the internal address. Timing for these operations is specified in the AC Characteristics section.

Operation

PGM

RST

CLK

Definition

This operation will reset the internal address to 0. After the

falling edge of RST, the first bit of the Fabrication Zone

(Address 0) will be driven on the I/O contact. The erase

flags (E1 and E2) will be reset.

RESET

X

0

The address is incremented on the falling edge of CLK. If

READ operations are enabled, the addressed bit will be

driven on the I/O pin after the falling edge of CLK. When

READ operations are disabled, the I/O will be disabled and

pulled to a high state by the external system pull-up

resistor.

INC/READ

0

The INC/CMP operation will compare the value of the data

driven by the system host on the I/O pin, to the value of the

bit already written into the EEPROM memory at that

address location. This process is used during validation of

the AT88SC102 Security Code and Erase Keys. The data

must be stable on the I/O pin before the rising edge of CLK,

when the data will be latched internally. Comparison occurs

on the next falling edge of CLK. The internal address is also

incremented on the falling edge of CLK.

INC/CMP

0

The I/O pin must be driven to a “1” for an ERASE, and to a

“0” for a WRITE operation before the rising edge of CLK

ERASE/WRITE

STANDBY

1

0

1

(see t_DS

)

The device is placed in standby mode when FUS pin = “0”

and RST = “1”. The address will not increment when RST is

high.

X

Notes: 1. The output is disabled (hi-state) on all addresses where the READ operation is disabled.

2. The two instructions INC/READ and INC/CMP share the same control signal states.

3. The circuit will distinguish between the INC/READ and INC/CMP instructions by testing the internal address counter.

(CMP can only be done with the addresses corresponding to the Security Code or to an Erase Key).

4. The internal address counter counts up to 1567. An additional CLK pulse resets the address to 0.

AT88SC102

12

AT88SC102

Device Functional Operation

Function

Functional Operation Sequence

POR

OPERATION:

POR (power-on reset) is initiated as the device power supply ramps from 0V up to a valid operating voltage.

FUNCTION:

POR resets all flags, and the address is reset to 0.

RESET

OPERATION:

With CLK low, a falling edge on the RST pin will reset the address counter to address 0.

FUNCTION:

The address is reset to “0”, and the first bit of the memory is driven by the AT88SC102 on I/O after a reset. Only

E1 and E2 are reset when the address is reset to 0. The RESET operation has no affect on any of the other flags

(SV, P1, R1, P2, R2).

ADDRESSING

OPERATION:

Addressing is handled by an internal address counter. The address is incremented on the falling edge of CLK.

RESET must be low while incrementing the address. A falling edge of RESET clears the counter to address 0.

FUNCTION:

Addressing of the AT88SC102 is sequential. Specific bit addresses may be reached by completing a RESET, then

clocking the device (INC/READ) until the desired address is reached. The AT88SC102 will determine which

operations are allowed at specific address locations. These operations are specified in Tables 1 and 2.

EXAMPLE:

To address the Issuer Zone (IZ) execute a RESET operation, then clock the device 16 times. The device now

outputs the first bit of the Issuer Zone (IZ). After the address counter counts up to 1567 the next CLK pulse resets

the address to 0.

READ

OPERATION:

RST and PGM pins must be low. If a READ operation is allowed, the state of the memory bit which is being

addressed is output on the I/O pin. The I/O buffer is an open drain and the output of a logic “0” therefore causes

the device to pull the pin to ground. The output of a logic “1” causes the device to place the pin in a high

impedance state. Therefore in order to sense a logic “1”, an external pullup must be placed between the I/O pin

and VCC. The address counter is incremented on the falling edge of CLK.

FUNCTION:

NON-APPLICATION ZONES:

As the address counter is incremented, the contents of the memory are read out on the I/O pin. The READ

operation is inhibited for addresses where security prevents a READ operation (see Tables 1 and 2).

APPLICATION ZONES:

Application Zone 1 can be read when: SV = “1” or R1 = “1”.

Application Zone 2 can be read when: SV = “1” or R2 = “1”.

13

Device Functional Operation (Continued)

Function

Functional Operation Sequence

WRITE

A WRITE operation sets the bit(s) to a logic “0”

OPERATION:

CLK = “0”

^{PGM “0”}→ “1” (I/O switches to an input)

I/O = “0” (input = “0” for WRITE operation)

^{CLK “0”}→ “1” (rising edge of CLK starts the WRITE operation)

^{PGM “1”}→ “0”

^{I/O “0”}→ “Z” (high-impedance)

Wait t_CHP(see “AC Electrical Characteristics”)

^{CLK “1”}→ “0” (falling edge of CLK ends the WRITE operation).

Note: The falling edge of CLK which ends the WRITE operation does not increment the address counter.

FUNCTION:

NON-APPLICATION ZONES:

The WRITE operation is inhibited for addresses where security prevents a WRITE operation

(see Tables 1 and 2).

APPLICATION ZONES:

The Application Zones can be written when:

Security Level 1: SV = “1”

Security Level 2: SV = “1”and P1 = “1” for AZ1. SV = “1” and P2 = “1” for AZ2

ERASE

CLK = “0”

Operation

Sequence

^{PGM “0”}→ “1” (I/O switches to an input)

I/O = “1” (input = “1” for ERASE Operation)

^{CLK “0”}→ “1”(rising edge of CLK starts the ERASE operation.)

PGM “1” → “0”

^{I/O “1”}→ “Z” (high-impedance)

Wait t_CHP(see “AC Electrical Characteristics”)

CLK “1” → “0” (falling edge of CLK ends the ERASE operation.)

Note: The falling edge of CLK which ends the ERASE operation does not increment the address counter.

ERASE

(Non-

Application

Zones)

An ERASE operation sets the bits to logic “1”. The EEPROM memory is organized into 16 bit words. Although

erases are performed on single bits the ERASE operation clears an entire word in the memory (except for the

Application Zones in Security Level 2). Therefore, performing an ERASE on any bit in the word will clear ALL 16

bits of that word to logic “1”.

OPERATION:

Perform “ERASE Operation Sequence” as specified above.

FUNCTION:

The ERASE operation is inhibited for addresses where security prevents an ERASE operation.

(See Tables 1 and 2).

ERASE

Security level 1: (ISSUER FUSE = “1” and FUS pin = “0”)

The Application Zone can only be erased when SV = 1.

(Application

Zones)

OPERATION:

Increment address counter to any bit within AZ1 or AZ2. Perform “ERASE Operation Sequence” as specified

above.

Security Level 1

FUNCTION: This operation will erase the entire 16-bit word containing the bit.

AT88SC102

14

AT88SC102

Device Functional Operation (Continued)

Function

Functional Operation Sequence

ERASE

(Application

Zone 2)

Security level 2: (ISSUER FUSE = “0” or FUS pin = “0”)

EC Mode is Enabled. Erase Operations within AZ2 are limited to 128.

Application Zone 1 can only be erased when SV = “1” and E1 = “1”.

OPERATION:

Security Level 2

EC Mode

Enabled

Set SV = “1” by validating the Security Code (see definition of SV internal flag).

Increment address counter to the first bit of the Application Zone 2 Erase Key (EZ2 = bit 1248).

Execute 32 INC/CMP operations, correctly verifying each bit of the 32-bit Erase Key.

Increment the address counter through the Application Zone 2 Erase Counter (EC2 = bits 1280 - 1407) until a bit

is found which is set to “1”.

Perform a WRITE operation on this bit (this WRITE will not increment the address counter).

Perform an ERASE operation on the same bit.

FUNCTION:

This operation will erase the entire Application Zone. One additional bit of Erase Counter 2 will now be written to

“0”. The ERASE operation in EC2 will initiate the AZ2 erase, but will not affect the state of the bits within EC2.

ERASE

Security Level 2: (ISSUER FUSE = “0” or FUS pin = “0”)

(Application

Zone 1 or 2)

Security Level 2

EC Mode is disabled in AZ2. Unlimited Erase operations in AZ2. AZ1 always allows unlimited Erase operations.

Application Zone 1 can only be erased when SV = “1” and E1 = “1”.

Application Zone 2 can only be erased when SV = “1” and E2 = “1”.

OPERATION:

EC Mode

Disabled

Set SV = “1” by validating the Security Code (see definition of SV internal flag).

Increment address counter to the first bit of the Application Zone Erase Key (EZ1 = bit 688, EZ2 = bit 1248).

Execute 32 or 48 INC/CMP operations, correctly verifying each bit of the 32 or 48 bit Erase Key.

Increment the address counter to the next bit (bit 736, to erase AZ1, bit 1280 to erase AZ2).

Perform an ERASE operation on this bit.

FUNCTION:

This operation will erase the entire Application Zone, but does not affect the word containing bit 736 or 1280.

Block

Enabled in Security Level 1 only.

Write/Erase

OPERATION:

Set address counter between address 1440 and 1455.

SV must be set.

FUS pin must be high.

Perform a WRITE or ERASE operation.

FUNCTION:

The entire memory excluding the Fabrication Zone (FZ), Memory Test Zone (MTZ) and Manufacturer’s Zone

(MFZ) will be written to “0” (WRITE) or “1” (ERASE).

The BLOCK WRITE/ERASE modes are used to quickly personalize the device.

15

Device Functional Operation (Continued)

Function

Functional Operation Sequence

Blowing

Manufacturer

Fuse

Valid in Security Level 1.

OPERATION:

Set address counter between address 1456 and 1471.

SV must be set.

The FUS pin can be either a “0” or a “1”.

RST pin = “1”

Perform a WRITE operation.

FUNCTION:

The MANUFACTURER FUSE will be at a logic “0” state.

Note: The address will not change as long as RST is high. CLK should be low when RST is brought low.

This will reset the address counter to 0.

Blowing

Valid in Security Level 1.

EC2EN Fuse

The EC2EN FUSE must be blown before the ISSUER FUSE is blown.

OPERATION:

Set the address counter to address 1529.

FUS pin = “1”

RST pin = “1”

Perform a WRITE operation

FUNCTION:

EC2EN Fuse will be written to a logic “0” state.

Note: The address will not change as long as RST is high. CLK should be low when RST is brought low

This will reset the address counter to 0.

Blowing Issuer

Fuse

OPERATION:

Set address counter between address 1552 and 1567.

SV must be set.

The FUS pin can be either a “0” or a “1”.

RST pin = “1”

Perform a WRITE operation

FUNCTION:

ISSUER FUSE will be set to a logic “0” state. This operation will convert the AT88SC102 from Security Level 1 to

Security Level 2. The action is irreversible.

Note: The address will not change as long as RST is high. CLK should be low when RST is brought low.

This will reset the address counter to 0.

Function of FUS and RST Pin

FUS

Used for personalizing the device. FUS must be high to be able to personalize the device when ISSUER FUSE is

unblown. In Security Level 1, the FUS pin may be forced low to simulate Security Level 2. In Security Level 2, the

FUS pin has no function.

RST

This pin is used to reset the address counter address to 0. It is also used in writing the Issuer Fuse and the

EC2EN FUSE low. When the FUS pin is low and the RST pin is high, the part is in stand-by mode.

AT88SC102

16

AT88SC102

Absolute Maximum Ratings*

*NOTICE:

Stresses beyond those listed under “Absolute Maxi-

mum Ratings” may cause permanent damage to the

device. This is a stress rating only and functional

operation of the device at these or any other condi-

tions beyond those indicated in the operational sec-

tions of this specification is not implied. Exposure to

absolute maximum rating conditions for extended

periods may affect device reliability.

Operating Temperature ........................-55°C to +125°C

Storage Temperature............................-65°C to +150°C

Voltage on Any Pin

with Respect to Ground................... -0.3V to V_CC+ 0.7V

Maximum Operating Voltage .................................6.25V

DC Output Current................................................5.0 mA

DC Characteristics

Applicable over recommended operating range from: V_CC= 4.5V to 5.5V and T_A= -25°C to +85°C

(unless otherwise noted).

Symbol Characteristics

Min

Type

Max

2

Unit

mA

I_CC

Supply Current on V_CCduring Read (T_AMB= + 25°C)

I_CCP

Supply Current on V_CCduring Program (T_AMB= + 25°C)

5

Standby Current on VCC

I_SB

50

µA

(RST @ V_CC; FUS, CLK, PGM @ GND; I_OL= 0 µA; F_CLK= 0 kHz)

V_IL

V_IH

V_OL

I_IL

Input Low Level

-0.3

V_CCx 0.3

V

Input High Level

V

_CCx 0.7

V_CC+ 0.3

Output Low Level (I_OL= 1mA)

Input Leakage Current

0.4

V

20

µA

I_IH

I/O Leakage Current (V_OH= V_CCOpen Drain)

20

17

AC Characteristics

T_A= -25°C to +85°C, V_CC= 5V 10%, GND = 0V (unless otherwise noted).

Symbol

t_CLK

t_RH

Characteristics

Min

3.3

0.1

Type

Max

2.0

Unit

µs

ms

µs

Clock Cycle time

RST Hold Time

t_DVR

t_CH

Data Valid Reset to address “0”

CLK Pulse Width (High)

CLK Pulse Width (Low)

Data Access

0.2

t_CL

t_DV

2.0

t_OH

Data Hold

0

t_SC

Data In Setup (CMP instruction)

Data In Hold (CMP instruction)

CLK Pulse Width (High in Programming)

Data In Setup

0

t_HC

0.2

2.0

0.2

0

t_CHP

t_DS

t_DH

Data In Hold

t_SPR

t_HPR

PGM Setup

2.2

0.2

PGM Hold

Conditions of Dynamic Tests

The circuit has an output with open drain. An external resistor is necessary between VCC and I/O in order to load the

output.

Pulse Levels of the Input

GND to V_CC

Reference Levels in Input

Reference Levels in Output

Rising and Falling Time of Signals

V_CCx 0.3 and V_CCx 0.7

1.5V

5 ns

AC Load Circuit

VCC

R_LOAD

CHIP

I/O

Test

Point

100 pF

Test Ckt.

Included

AT88SC102

18

AT88SC102

Timing Diagrams

Reset

0 (internal address counter)

Address

CLK

t_RH

RST

I/O

t_DVR

Output

Data Valid

Note: CLK should be low on the falling edge of RST. CLK may remain low while RST is pulsed.

Read

t_CLK

Address

t_CL

t_CH

CLK

I/O

t_OH

t_DV

Note: PGM and RST must both be low during a read cycle.

I/O should not be driven (except by the external pullup resistor).

19

Program

Erase/Write

Read

Erase/Write

Read

A

n+1

A

n

Address

CLK

A

n

n-1

t_CHP

t_HPR

t_SPR

t_DV

PGM

I/O

t_DV

t_DH

t_DS

Drive

t_OH

'1' (Erase)

or '0' (Write)

Valid

Output

Input

Output

Notes: During any Erase or Write operation, PGM must fall before the falling edge of CLK at the end of t_CHP

(recommend a minimum setup time of 1 µsec).

After the rising edge of PGM to initiate the Erase/write operation, delay at least t_DV(2 µsec) before

driving data on the I/O contact.

Compare

Address

CLK

A_n+1

A_n

A_n-1

t_SC

t_HC

t_SC

Input

I/O

Note: Input Data is latched on the rising edge of CLK. Comparison occurs on the next falling

edge of CLK. The address counter is incremented on the falling edge of CLK. During a

compare operation of the first bit following a read (i.e. the first bit of the SC, or erase keys),

data driven to the I/O may be delayed by t

after the the falling edge of CLK.

DV

AT88SC102

20

Erase Operation Application Zone 1 (AZ1)

Read

Reset

Compare EZ1

Erase

Read

(A)

(C)

(D)

(B)

A₂

A₆₈₇

A₆₈₈A₆₈₉

A₇₃₆

A₇₃₄

A_x

A₀

A₁

A₇₃₅

A₇₃₇

Address

RST

CLK

I/O

D_X

D₀

D₁

CD₆₈₈

CD₆₈₉

CD₇₃₅

D₇₃₆

1

Input

Output

PGM

E1 Flag

Notes:

1. A_n= Internal Address, D_n= Read data (output), CD_n= Compare data (input).

2. This diagram illustrates the protocol for setting the E1 flag in Security level 2 (Issuer Fuse blown).

Erase operations in Security level 1 within Application Zone 1 do not require setting of the E1 flag.

In Security level 1, an erase operation on any bit in Application Zone 1 will erase the entire 16-bit word

containing the bit.

A. Compare sequence of EZ1. If the comparison is valid, the EZ1 flag is set to "1", enabling erasure of AZ1.

B. If E1 is set to "1", an erase operation on bit 736 will erase bits 176 - 687 (AZ1) (Security Level 1).

C. After the falling edge of CLK, the device will drive the I/O contact to the logic state of the existing data in

bit 736. The state of this bit is not affected by the AZ1 erase operation.

D. After the falling edge of CLK, the address is incremented and the state of the next bit is driven on the I/O contact.

AT88SC102

22

AT88SC102

Erase Operation Application Zone 2 (AZ2), EC2 Function Disabled

Compare EZ2

Read

Reset

Erase

Read

(A)

(C)

(D)

(B)

A₂

A₁₂₄₇

A₁₂₄₈

A₁₂₈₀

A₁₂₈₁

A₁₂₇₈

A_x

A₀

A₁

A₁₂₇₉

Address

RST

CLK

I/O

D_X

D₀

D₁

CD₁₂₄₈CD₁₂₄₉

CD₁₂₇₉

D₁₂₈₀

1

Input

Output

PGM

E1 Flag

Notes:

1. A = Internal Address, D = Read data (output), CD = Compare data (input)

n

2. This diagram illustrates the protocol for setting the E2 flag in Security level 2 (Issuer Fuse blown).

Erase operations in Security Level 1 within Application Zone 2 do not require setting of the E2 flag.

In Security Level 1, an erase operation on any bit in the Application Zone will erase the

entire 16-bit word containing the bit.

3. EC2EN Fuse = "0" (disabled)

A. Compare sequence of EZ2. If the comparison is valid, the E2 flag is set to "1", enabling erasure of AZ2.

B. If E2 is set to "1", an erase operation on bit 1280 will erase bits 736 - 1247 (AZ2) (Security Level 1).

C. After the falling edge of CLK, the device will drive the I/O contact to the logic state of the existing data in

bit 1280. The state of this bit is not affected by the AZ2 erase operation.

D. After the falling edge of CLK, the address is incremented and the state of the next bit is driven on the I/O contact.

23

AT88SC102

Ordering Information

Ordering Code⁽¹⁾

Package⁽²⁾

Voltage Range

Temperature Range

AT88SC102 - 09AT - xx - 2.7

AT88SC102 - 09BT - xx - 2.7

AT88SC102 - 09CT - xx - 2.7

AT88SC102 - 09DT - xx - 2.7

AT88SC102 - 09ET - xx - 2.7

AT88SC102 - 09GT - xx - 2.7

AT88SC102 - 09HT - xx - 2.7

M2 - A Module

M2 - B Module

M4 - C Module

M4 - D Module

M2 - E Module

M3 - G Module

M3 - H Module

Commercial

2.7V to 3.3V

0°C to 70°C

AT88SC102 - 09AT - xx

AT88SC102 - 09BT - xx

AT88SC102 - 09CT - xx

AT88SC102 - 09DT - xx

AT88SC102 - 09ET - xx

AT88SC102 - 09GT - xx

AT88SC102 - 09HT - xx

M2 - A Module

M2 - B Module

M4 - C Module

M4 - D Module

M2 - E Module

M3 - G Module

M3 - H Module

Commercial

4.5V to 5.5V

0°C to 70°C

Package Type⁽²⁾

M2 ISO 7816 Smart Card Module

M2 - A Module

M2 - B Module

M4 - C Module

M4 - D Module

M2 - E Module

M3 - G Module

M3 - H Module

M2 ISO 7816 Smart Card Module with Atmel Logo

M4 ISO 7816 Smart Card Module

M4 ISO 7816 Smart Card Module with Atmel Logo

M2 ISO 7816 Smart Card Module

M3 ISO 7816 Smart Card Module

M3 ISO 7816 Smart Card Module with Atmel Logo

Notes: 1. “xx” must be replaced by a security code. Contact an Atmel Sales Office for the security code.

2. Formal drawings may be obtained from an Atmel Sales Office.

25

Smart Card Modules

M2 - A Module - Ordering Code: 09AT

M2 - E Module - Ordering Code: 09ET

Module Size: M2

Dimension⁽¹⁾: 12.6 x 11.4 mm

Glob Top: Black, Square: 8.6 x 8.6 mm

Thickness: 0.58 mm max.

Pitch: 14.25 mm

Dimension⁽¹⁾: 12.6 x 11.4 mm

Glob Top: Clear, Round: Ø 7.5 mm max.

Thickness: 0.58 mm max.

Pitch: 14.25 mm

M2 - B Module - Ordering Code: 09BT

M3 - G Module - Ordering Code: 09GT

Module Size: M3

Module Size: M2

Dimension⁽¹⁾: 10.6 x 8.0 mm

Glob Top: Clear, Round: Ø 6.5 mm max.

Thickness: 0.58 mm max.

Pitch: 9.5 mm

Dimension⁽¹⁾: 12.6 x 11.4 mm

Glob Top: Black, Square: 8.6 x 8.6 mm

Thickness: 0.58 mm max.

Pitch: 14.25 mm

M3 - H Module - Ordering Code: 09HT

M4 - C Module - Ordering Code: 09CT

Module Size: M3

Dimension⁽¹⁾: 10.6 x 8.0 mm

Glob Top: Clear, Round: Ø 6.5 mm max.

Thickness: 0.58 mm max.

Pitch: 9.5 mm

Module Size: M4

Dimension⁽¹⁾: 12.6 x 12.6 mm

Glob Top: Black, Square: 8.6 x 8.6 mm

Thickness: 0.58 mm

Pitch: 14.25 mm

Note:

The module dimensions listed refer to the dimensions of

the exposed metal contact area.

M4 - D Module - Ordering Code: 09DT

The actual dimensions of the module after excise or

punching from the carrier tape are generally 0.4 mm

greater in both directions (i.e. a punched M2 module will

yield 13.0 x 11.8 mm).

Module Size: M4

Dimension⁽¹⁾: 12.6 x 12.6 mm

Glob Top: Black, Square: 8.6 x 8.6 mm

Thickness: 0.58 mm max.

Pitch: 14.25 mm

AT88SC102

26

Atmel Headquarters

Atmel Operations

Corporate Headquarters

2325 Orchard Parkway

San Jose, CA 95131

TEL (408) 441-0311

FAX (408) 487-2600

Atmel Colorado Springs

1150 E. Cheyenne Mtn. Blvd.

Colorado Springs, CO 80906

TEL (719) 576-3300

FAX (719) 540-1759

Europe

Atmel Rousset

Zone Industrielle

13106 Rousset Cedex

France

Atmel U.K., Ltd.

Coliseum Business Centre

Riverside Way

Camberley, Surrey GU15 3YL

England

TEL (33) 4-4253-6000

FAX (33) 4-4253-6001

TEL (44) 1276-686-677

FAX (44) 1276-686-697

Asia

Atmel Asia, Ltd.

Room 1219

Chinachem Golden Plaza

77 Mody Road Tsimhatsui

East Kowloon

Hong Kong

TEL (852) 2721-9778

FAX (852) 2722-1369

Japan

Atmel Japan K.K.

9F, Tonetsu Shinkawa Bldg.

1-24-8 Shinkawa

Chuo-ku, Tokyo 104-0033

Japan

TEL (81) 3-3523-3551

FAX (81) 3-3523-7581

Fax-on-Demand

North America:

1-(800) 292-8635

International:

1-(408) 441-0732

e-mail

literature@atmel.com

Web Site

http://www.atmel.com

BBS

1-(408) 436-4309

Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company’s standard war-

ranty which is detailed in Atmel’s Terms and Conditions located on the Company’s web site. The Company assumes no responsibility for

any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without

notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual prop-

erty of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are

not authorized for use as critical components in life support devices or systems.

®

™

Marks bearing and/or are registered trademarks and trademarks of Atmel Corporation.

Terms and product names in this document may be trademarks of others.

Printed on recycled paper.

1419B–11/99/xM


型号：	AT88SC102-09GT-XX-2.7
厂家：	ETC
描述：	EEPROM EEPROM\n 可编程只读存储器电动程控只读存储器电可擦编程只读存储器
文件：	总27页 (文件大小：269K)
中文：	中文翻译
下载：	下载PDF数据表文档文件

AT88SC102-09GT-XX-2.7 [ETC]

相关型号：

AT88SC102-09HT-XX

AT88SC102-09HT-XX-2.7

AT88SC102-09PT-XX

AT88SC102-09PT-XX-2.7

AT88SC102-2JC

AT88SC102-2JI

AT88SC102-2PC

AT88SC102-2PI

AT88SC102-2SC

AT88SC102-2SI

AT88SC102-2W

AT88SC12816C