ISO 7816 Compatible
4K
X76F400
Secure SerialFlash
DESCRIPTION
512 x 8 bit
FEATURES
• 64-bit Password Security
• One Array (496 Bytes) Two Passwords (16 Bytes)
—Read Password
—Write Password
• Programmable Passwords
• Retry Counter Register
—Allows 8 tries before clearing of the array
• 32-bit Response to Reset (RST Input)
• 8 byte Sector Write mode
• 1MHz Clock Rate
• 2 wire Serial Interface
• Low Power CMOS
—2.0 to 5.5V operation
—Standby current Less than 1µA
—Active current less than 3 mA
• High Reliability Endurance:
—100,000 Write Cycles
• Data Retention: 100 years
• Available in:
—8 lead PDIP, SOIC,TSSOP and Smart Card
Module
The X76F400 is a Password Access Security Supervisor,
containing one 3968-bit Secure SerialFlash array.
Access to the memory array can be controlled by two
64-bit passwords. These passwords protect read and
write operations of the memory array.
The X76F400 features a serial interface and software
protocol allowing operation on a popular two wire bus.
The bus signals are a clock Input (SCL) and a
bidirectional data input and output (SDA).
The X76F400 also features a synchronous response to
reset providing an automatic output of a hard-wired 32-bit
data stream conforming to the industry standard for
memory cards.
The X76F400 utilizes Xicor’s proprietary Direct Write
TM
cell, providing a minimum endurance of 100,000 cycles
and a minimum data retention of 100 years.
Functional Diagram
CS
SCL
INTERFACE
Interface
LOGIC
Logic
PASSWORD ARRAY
Password Array
AND PASSWORD
and Password
VERIFICATION LOGIC
CHIP ENABLE
DATA TRANSFER
Data Transfer
ARRAY ACCESS
Array Access
ENABLE
Enable
Retry Counter
8K BYTE
SerialFlash ARRAY
Erase Logic
ARRAY 0
(PASSWORD PROTECTED)
SCL
SDA
SDA
496 Byte
32 BYTE
SerialFlash ARRAY
EEPROM Array
ARRAY 1
(PASSWORD PROTECTED)
Verification Logic
RST
RESET
ISO Reset
RESPONSE REGISTER
Response Register
RETRY COUNTER
7025 FM 01
RST
Ó
Xicor, Inc. 1999 Patents Pending
9900-5004.4 2/12/99 EP
1
Characteristics subject to change without notice
X76F400
PIN DESCRIPTIONS
Serial Clock (SCL)
The SCL input is used to clock all data into and out of the
device.
Serial Data (SDA)
SDA is an open drain serial data input/output pin. During
a read cycle, data is shifted out on this pin. During a write
cycle, data is shifted in on this pin. In all other cases, this
pin is in a high impedance state.
Reset (RST)
RST is a device reset pin. When RST is pulsed high the
X76F400 will output 32 bits of fixed data which conforms
to the standard for “synchronous response to reset”. The
part must not be in a write cycle for the response to reset
to occur. See Figure 7. If there is power interrupted
during the Response to Reset, the response to reset will
be aborted and the part will return to the standby state.
The response to reset is "mask programmable" only!
DEVICE OPERATION
The X76F400 memory array consists of sixty-two 8-byte
sectors. Read or write access to the array always begins
at the first address of the sector. Read operations then
can continue indefinitely. Write operations must total 8
bytes.
There are two primary modes of operation for the
X76F400; Protected READ and protected WRITE.
Protected operations must be performed with one of two
8-byte passwords.
The basic method of communication for the device is
generating a start condition, then transmitting a
command, followed by the correct password. All parts will
be shipped from the factory with all passwords equal to
‘0’. The user must perform ACK Polling to determine the
validity of the password, before starting a data transfer
(see Acknowledge Polling.) Only after the correct
password is accepted and a ACK polling has been
performed, can the data transfer occur.
To ensure the correct communication, RST must remain
LOW under all conditions except when running a
“Response to Reset sequence”.
Data is transferred in 8-bit segments, with each transfer
being followed by an ACK, generated by the receiving
device.
If the X76F400 is in a nonvolatile write cycle a “no ACK”
(SDA=High) response will be issued in response to
loading of the command byte. If a stop is issued prior to
2
the nonvolatile write cycle the write operation will be
terminated and the part will reset and enter into a
standby mode.
The basic sequence is illustrated in Figure 1.
PIN NAMES
Symbol
SDA
SCL
RST
Vcc
Vss
NC
Description
Serial Data Input/Output
Serial Clock Input
Reset Input
Supply Voltage
Ground
No Connect
PIN CONFIGURATION
PDIP
V
CC
NC
NC
Vss
1
2
3
4
SOIC
V
SS
NC
SDA
NC
1
2
3
4
8
7
6
5
V
CC
RST
SCL
NC
V
CC
RST
SCL
NC
TSSOP
V
CC
NC
NC
V
SS
1
2
3
4
8
7
6
5
RST
SCL
SDA
NC
8
7
6
5
RST
SCL
SDA
NC
Smart Card Module
GND
NC
SDA
NC
After each transaction is completed, the X76F400 will
reset and enter into a standby mode. This will also be the
response if an unsuccessful attempt is made to access a
protected array.
X76F400
Figure 1. X76F400 Device Operation
LOAD COMMAND/ADDRESS BYTE
Start Condition
All commands are preceeded by the start condition,
which is a HIGH to LOW transition of SDA when SCL is
HIGH. The X76F400 continuously monitors the SDA and
SCL lines for the start condition and will not respond to
any command until this condition is met.
A start may be issued to terminate the input of a control
byte or the input data to be written. This will reset the
device and leave it ready to begin a new read or write
command. Because of the push/pull output, a start
cannot be generated while the part is outputting data.
Starts are inhibited while a write is in progress.
Stop Condition
All communications must be terminated by a stop
condition. The stop condition is a LOW to HIGH transition
of SDA when SCL is HIGH. The stop condition is also
used to reset the device during a command or data input
sequence and will leave the device in the standby power
mode. As with starts, stops are inhibited when outputting
data and while a write is in progress.
Acknowledge
Acknowledge is a software convention used to indicate
successful data transfer. The transmitting device, either
master or slave, will release the bus after transmitting
eight bits. During the ninth clock cycle the receiver will
pull the SDA line LOW to acknowledge that it received
the eight bits of data.
The X76F400 will respond with an acknowledge after
recognition of a start condition and its slave address. If
both the device and a write condition have been
selected, the X76F400 will respond with an acknowledge
after the receipt of each subsequent eight-bit word.
LOAD 8-BYTE
PASSWORD
VERIFY PASSWORD
ACCEPTANCE BY
USE OF ACK POLLING
READ/WRITE
DATA
BYTES
Retry Counter
The X76F400 contains a retry counter. The retry counter
allows 8 accesses with an invalid password before any
action is taken. The counter will increment with any
combination of incorrect passwords. If the retry counter
overflows, the memory area and both of the passwords
are cleared to "0". If a correct password is received prior
to retry counter overflow, the retry counter is reset and
access is granted.
Device Protocol
The X76F400 supports a bidirectional bus oriented
protocol. The protocol defines any device that sends data
onto the bus as a transmitter and the receiving device as
a receiver. The device controlling the transfer is a master
and the device being controlled is the slave. The master
will always initiate data transfers and provide the clock for
both transmit and receive operations. Therefore, the
X76F400 will be considered a slave in all applications.
Clock and Data Conventions
Data states on the SDA line can change only during SCL
LOW. SDA changes during SCL HIGH are reserved for
indicating start and stop conditions. Refer to Figure 2 and
Figure 3.
3
X76F400
Figure 2. Data Validity
SCL
SDA
Data Stable
Data
Change
Figure 3. Definition of Start and Stop Conditions
SCL
SDA
Start Condition
Stop Condition
Table 1. X76F400 Instruction Set
Command
after Start
1 S
5
S
4
S
3
S
2
S
1
S
0
0
1 S
5
S
4
S
3
S
2
S
1
S
0
1
1 1 1 1 1 1 0 0
1 1 1 1 1 1 1 0
0 1 0 1 0 1 0 1
Sector Write
Sector Read
Change Write Password
Change Read Password
Password ACK Command
Command Description
Password
used
Write
Read
Write
Write
None
Illegal command codes will be disregarded. The part will respond with a “no-ACK” to the illegal byte and then return to
the standby mode. All write/read operations require a password.
PROGRAM OPERATIONS
Sector Write
The sector write mode requires issuing the 8-bit write
command followed by the password and then the data
bytes transferred as illustrated in figure 4. The write
command byte contains the address of the sector to be
written. Data is written starting at the first address of a
sector and eight bytes must be transferred. After the last
byte to be transferred is acknowledged a stop condition is
issued which starts the nonvolatile write cycle. If more or
less than 8 bytes are transferred, the data in the sector
remains unchanged.
ACK Polling
Once a stop condition is issued to indicate the end of the
host’s write sequence, the X76F400 initiates the internal
nonvolatile write cycle. In order to take advantage of the
typical 5ms write cycle, ACK polling can begin
immediately. This involves issuing the start condition
4
X76F400
followed by the new command code of 8 bits (1st byte of
the protocol.) If the X76F400 is still busy with the
nonvolatile write operation, it will issue a “no-ACK” in
response. If the nonvolatile write operation has
completed, an “ACK” will be returned and the host can
then proceed with the rest of the protocol.
Data ACK Polling Sequence
WRITE SEQUENCE
COMPLETED
ENTER ACK POLLING
Password ACK Polling Sequence
PASSWORD LOAD
COMPLETED
ENTER ACK POLLING
ISSUE START
ISSUE
PASSWORD
ACK COMMAND
ISSUE START
ACK
RETURNED
?
YES
PROCEED
ACK
RETURNED
?
YES
PROCEED
NO
NO
ISSUE NEW
COMMAND
CODE
READ OPERATIONS
Read operations are initiated in the same manner as
write operations but with a different command code.
After the password sequence, there is always a
nonvolatile write cycle. This is done to discourage
random guesses of the password if the device is being
tampered with. In order to continue the transaction, the
X76F400 requires the master to perform a password
ACK polling sequence with the specific command code
of 55h. As with regular Acknowledge polling the user can
either time out for 10ms, and then issue the ACK polling
once, or continuously loop as described in the flow.
If the password that was inserted was correct, then an
“ACK” will be returned once the nonvolatile cycle in
response to the passwrod ACK polling sequence is over.
If the password that was inserted was incorrect, then a
“no ACK” will be returned even if the nonvolatile cycle is
over. Therefore, the user cannot be certain that the pass-
word is incorrect until the 10ms write cycle time has
elapsed.
Sector Read
With sector read, a sector address is supplied with the
read command. Once the password has been
acknowledged data may be read from the sector. An
acknowledge must follow each 8-bit data transfer. A read
operation always begins at the first byte in the sector, but
may stop at any time. Random accesses to the array are
not possible. Continuous reading from the array will
return data from successive sectors. After reading the
last sector in the array, the address is automatically set to
the first sector in the array and data can continue to be
read out. After the last bit has been read, a stop condition
is generated without sending a preceding acknowledge.
5
