DS1961S-F5+ Datasheet DS1961S-F5+, DS1961S-F3+ | P7-P9

DS1961S

7 of 36

This indicates that all the data in the scratchpad is used for a subsequent copying into main memory or

secret. Bit 5 of the E/S register, called PF or partial byte flag, is a logic-1 if the number of data bits sent

by the master is not an integer multiple of eight or if the data in the scratchpad is not valid due to a loss of

power. A valid write to the scratchpad clears the PF bit. Bits 3, 4, and 6 have no function; they always

read 1. The partial flag supports the master checking the data integrity after a write command. The

highest valued bit of the E/S register is called the AA or authorization accepted flag, which indicates that

the data stored in the scratchpad has already been copied to the target memory address. Writing data to

the scratchpad clears this flag.

WRITING WITH VERIFICATION

To write data to the DS1961S, the scratchpad has to be used as intermediate storage. First the master

issues the write scratchpad command, which specifies the desired target address and the data to be written

to the scratchpad. Note that writes to data memory must be performed on 8-byte boundaries with the three

LSBs of the target address T2–T0 equal to 000b. Therefore, if T2–T0 are sent with non-zero values, the

device sets these bits to zero and uses the modified address as the target address. The master should

always send eight complete data bytes. After the eight bytes of data have been transmitted, the master can

elect to receive an inverted CRC16 of the write scratchpad command, the address as sent by the master,

and the data as sent by the master. The master can compare the CRC to the value it has calculated itself in

order to determine if the communication was successful. After the scratchpad has been written, the master

should always perform a read scratchpad to verify that the intended data was in fact written. During a

read scratchpad, the DS1961S repeats the target address TA1 and TA2 and sends the contents of the E/S

during a write scratchpad or refresh scratchpad command was incomplete, or if there was a loss of power

since data was last written to the scratchpad. The authorization-accepted (AA) flag (bit 7 of the E/S

indicates that the DS1961S did not understand the proceeding write (or refresh) scratchpad command. In

either of these cases, the master should rewrite the scratchpad. After the master receives the E/S register,

the scratchpad data is received. The descriptions of write scratchpad and refresh scratchpad provide

clarification of what changes can occur to the scratchpad data under certain conditions. An inverted CRC

of the read scratchpad command, target address, E/S register, and scratchpad data follows the scratchpad

data. As with the write scratchpad command, this CRC can be compared to the value the master has

calculated itself in order to determine if the communication was successful. After the master has verified

the data, it can send the copy scratchpad to copy the scratchpad to memory. Alternatively, the load first

secret or compute next secret command can be issued to change the secret. See the descriptions of these

commands for more information.

In a touch environment the quality of the electrical contact cannot be guaranteed. With poor or

intermittent contact it is possible for a copy scratchpad command to complete with insufficient energy,

leaving the floating gate voltage of an EEPROM bit in the area of the threshold between 0 and 1. When

this occurs, the logical value of the bit is not assured. Depending on voltage and/or temperature

conditions, the same bit can be read by the host as one polarity and then by the internal SHA-1 engine as

the opposite polarity. This becomes a fatal lockup mode because the host cannot formulate a proper SHA-

1 MAC to enable the bit to be rewritten. To repair poorly written bits and thereby restore the device to

functionality, the refresh scratchpad command was introduced. Combined with the load first secret

command, refresh scratchpad provides a means to restore the EEPROM bits to normal values, removing

lockup conditions and allowing the device to be written again.

To prevent the occurrence of poorly written bits, a refresh sequence should be performed after each copy

scratchpad command. A refresh sequence is defined as a refresh scratchpad (to the same target address as

the previous copy scratchpad), followed by a load first secret. The EN_LFS flag is set by the refresh

DS1961S

8 of 36

scratchpad command. The EN_LFS flag enables the use of load first secret to addresses 0000h–007Fh.

Using load first secret allows the master to copy the scratchpad to memory without the MAC computation

necessary during a copy scratchpad. If the master attempts any command after refresh scratchpad that

could change the scratchpad data or the target address, EN_LFS is reset to 0. This prevents the use of load

first secret to load any data other than the refreshed memory data to any location other than the one

specified during refresh scratchpad. Refresh scratchpad behaves exactly as write scratchpad does for

target addresses 0080h and above. In this case the EN_LFS flag is not set, so it is not possible to refresh

the data in the secret (0080h) or in the register page (0088h). This prevents the secret from being revealed

by a refresh scratchpad followed by a read scratchpad.

MEMORY AND SHA FUNCTION COMMANDS

Due to its design as a secure device, the DS1961S has to behave differently from other memory iButtons.

Although most of the memory of the DS1961S can be read the same way as any other memory iButton,

attempts to read the secret results in FFh-bytes rather than real data. The Memory and SHA Function

Flow Chart (Figure 7) describes the protocols necessary for accessing the memory and operating the SHA

engine. The communication between master and DS1961S takes place either at regular speed (default,

OD = 0) or at overdrive speed (OD = 1). If not explicitly set into overdrive mode the DS1961S assumes

regular speed.

Write Scratchpad [0Fh]

The write scratchpad command applies to the data memory, the secret and the writeable addresses in the

After issuing the write scratchpad command, the master must first provide the 2-byte target address,

followed by the data to be written to the scratchpad. The data is written to the scratchpad starting at the

beginning of the scratchpad. Note that the ending offset (E2..E0, see Figure 6) is always 111b regardless

of the number of bytes that the master has transmitted. For this reason the master should always send

eight bytes, especially if the data is to be loaded as a secret. If the master sends less than eight data bytes

and does not read back the scratchpad for verification, parts of the new secret can be random data that is

unknown to the master. Only full data bytes are accepted. If the last data byte is incomplete its content is

ignored and the partial byte flag (PF) is set.

When executing the write scratchpad command the CRC generator inside the DS1961S (see Figure 12)

calculates a CRC of the entire data stream, starting at the command code and ending at the last data byte

as sent by the master. This CRC is generated using the CRC16 polynomial by first clearing the CRC

generator and then shifting in the command code (0Fh) of the write scratchpad command, the target

addresses (TA1 and TA2), and all the data bytes. Note that the CRC16 calculation is performed with the

actual TA1 sent by the master even though the DS1961S sets TA1 bits T2..T0 to 000b for the actual write

scratchpad command. The master can end the write scratchpad command at any time. However, if the

scratchpad is filled to its capacity, the master can send 16 read-time slots and receives the CRC generated

by the DS1961S. If the master continues reading after the CRC all data is be FFh.

After receiving the target addresses (TA1 and TA2), the DS1961S clears the EN_LFS flag. If EPROM

mode is active and a write scratchpad is attempted within page 1 (0020h–003Fh), the scratchpad is loaded

with the logical AND of the scratchpad data sent by the master and the current content of the target

memory location. If a write scratchpad is attempted to the register page (0088h–008Fh), any bytes that

are write-protected overwrite the corresponding scratchpad data byte sent by the master with the existing

value. In all other cases, the data sent by the master is written to the scratchpad unaltered.

DS1961S

9 of 36

Read Scratchpad [AAh]

The read scratchpad command allows verifying the target address and the integrity of the scratchpad data.

After issuing the command code, the master begins reading. The first two bytes is the target address with

T2 to T0 = 0. The next byte is the ending offset/data status byte (E/S) followed by the scratchpad data,

which may be different from what the master has originally sent. This is of particular importance if the

target address is the secret, the register page, page 1 (in EPROM mode), or if refresh was used to load the

scratchpad. In these cases, the scratchpad can contain data other than that which was sent during either

the write scratchpad or refresh scratchpad commands. The master should read through the end of the

scratchpad after which it receives the inverted CRC that is computed with the data as sent by the

DS1961S. If the master continues reading after the CRC all data is FFh.

The scratchpad can be loaded using the write scratchpad or refresh scratchpad command. The data found

in the scratchpad depends on the command used, the target address, and whether or not EPROM mode is

active. See the descriptions of write scratchpad and refresh scratchpad for clarification.

Load First Secret [5Ah]

The load first secret command has two modes of operation, which are controlled by the EN_LFS flag.

With EN_LFS = 0, the command replaces the device’s current secret with the contents of the scratchpad,

provided that the secret is not write-protected. With EN_LFS = 1, the command allows to rewrite

memory data (addresses 0000h to 007Fh), bypassing the SHA-1 computation that is required when doing

the same through the copy scratchpad command. The EN_LFS flag is 0 unless it has been set to 1 by

executing the refresh scratchpad command prior to load first secret.

Case EN_LFS = 0

Before the load first secret command can be used in this mode, the master must have written the new

secret to the scratchpad using the starting address of the secret (0080h). After issuing the load first secret

command, the master must provide a 3-byte authorization pattern (TA1, TA2, E/S, in that order), that

should have been obtained by an immediately preceding read scratchpad command. This 3-byte pattern

must exactly match the data contained in the three address registers (see Figure 6). If the pattern matches

and the secret is not write-protected, the AA flag is set and the copy begins. All eight bytes of scratchpad

contents are copied to the secret’s memory location.

Case EN_LFS = 1

To use the load first secret command in this mode, the refresh scratchpad command must have been

executed to load eight bytes of memory data (address range 0000h to 007Fh) into the scratchpad, which

sets the EN_LFS flag to 1. After issuing the load first secret command, the master must provide a 3-byte

authorization pattern (TA1, TA2, E/S, in that order), that can be obtained by an immediately preceding

read scratchpad command without affecting the EN_LFS flag. This 3-byte pattern must exactly match the

data contained in the three address registers (see Figure 6). If the pattern matches and the memory is not

write-protected, the AA flag is set and the copy begins. All eight bytes of scratchpad contents are copied

to the memory location.

Regardless of the mode used, the duration of the copy operation is t

PROG

during which the voltage on the

1-Wire bus must not fall below 2.8V. The master should read at least one byte at the conclusion of the

copy delay. Reading AAh indicates that the copy was successful, while reading FFh indicates that the

copy was not successful. Instead of using load first secret with EN_LFS = 0, a new secret can

alternatively be loaded with the copy scratchpad command. However, this approach requires the

knowledge of the current secret and the computation of a 160-bit MAC.

P1-P3 P4-P6 P7-P9 P10-P12 P13-P15 P16-P18 P19-P21 P22-P24 P25-P27 P28-P30 P31-P33 P34-P36

DS1961S-F5+

Mfr. #:

Buy DS1961S-F5+

Manufacturer:

Maxim Integrated

Description:

iButtons & Accessories 1kb Protected EEPROM iButton w/SHA-1 Eng

Lifecycle:

New from this manufacturer.

Delivery:

DHL FedEx Ups TNT EMS

Payment:

T/T Paypal Visa MoneyGram Western Union

DS1961S-F5+

DS1961S-F5+

Products related to this Datasheet