KSEC Tagbase

Our RFID & NFC Knowledge Base

Version 1.3.1

Compatible SLE4442

Compatible SLE4442 Card,Compatible SLE5542 Card

Compatible SLE4442 Card, Compatible SLE5542 Card, ISSI4442 Card, IS23SC4442 Card.


• Standard CMOS process
• 256 x 8 bits EEPROM organization
• Byte-wise addressing
• Irreversible byte-wise write protection of lowest 32 address (Byte 0..31)
• 3-byte Programmable Security Code (PSC) for memory write/erase protection
• 2.7-5.5V power supply for read and write/erase
• Low power operation: 3 mA typical active current
• 2.5 ms programming time
• 2-wire serial interface
• End of processing indication
• ISO standard 7816 compatible
• High reliability:
– 1,000,000 erase/write cycles guaranteed
– 10 years data retention
• Wide operating temperature range –30oC to 75oC

IS23SC4442 contains 256 x 8 bits of EEPROM main memory and a 32 x 1 bit protection PROM memory. The main memory can be randomly accessed byte by byte. During memory erase, all 8 bits of a byte are set to logical one. During memory write, individual bit(s) are set to logical zeros depend on the data value to be written. Normally, a data change may consists of an erase and a write operation. The write or erase operation takes at least 2.5 ms to complete.

The first 32 bytes (Address: 0 to 31) in memory are irreversibly protected by the corresponding 32 protect bits in the 32 x 1 bit protection memory. The 32 protect bits are onetime programmable, and they cannot be erased once they are set to logical zero.

IS23SC4442 provides a 3-bit Error Counter (EC), and three bytes Programmable Security Code (PSC) to prevent unauthorized erase/write operation to the memory. All the memory, except the PSC, can be read after the chip is powered on. But, the memory can be written or erased only after the PSC is entered and verified correct. After three successive unsuccessful verifications of PSC, the Error Counter locks the chip from a further attempt, and the memory can never be erased or written.

The IS23SC4442 works on a 2-wire serial transmission protocol. Data is input or output from the chip through the I/O pin at the falling edge of CLK. The following are the four modes of operations:
– Reset and Answer-to-Reset
– Command Mode
– Outgoing Data Mode
– Processing Mode

Reset and Answer-to-Reset
The Answer-to-Reset operation conforms to ISO 7816-3 ATR standard. The reset action can be invoked at any time during the operation to terminate any active command operation. With RST High, the internal address counter is set to zero by the CLK pulse. The LSB of the first byte data in the memory will be output from I/O when RST goes from High to Low. By continuing to send pluses to CLK, the contents of the first four bytes will be output from I/O pin. After the ATR process completes, the I/O pin will be set to high impedance.

The IS23SC4442 contains 256 bytes of EEPROM main memory (see block diagram) and a 32 bit protection memory. The main memory is byte-wise erased and written. When the memory is erased, 8 bits of the data byte are all set to logic 1. When the memory is written, a data byte can be programmed bit by bit, and it is set to logic 0 according to the logic between the old and new data. Generally, updating data includes an erase and write procedure. When updated, new input data and the contents of the old data are compared. If none of the 8 bits requires a logic 0 to 1 change, the erase operation will be skipped. On the contrary, the write operation will be skipped if no logic 1 to 0 change is necessary. The write and erase operation takes at least 2.5 ms each.

The first 32 bytes can be protected individually by writing the corresponding bit in the protection memory. Each data byte in the address range and its assigned bit in the protection memory have the same address. Once the protection bit is written it cannot be erased.

The security memory of IS23SC4442 contains an error counter (bit 0-bit 2) and 3 bytes reference data. The three bytes reference data are as a whole called programmable security code (PSC). After power on, except for the PSC, the whole memory can always be read. The error counter can always be written. After three successive unsuccessful PSC verifications, the error counter will block the chip, and write and erase operation to the memory will be forbidden.

Transmission Mode
The transmission protocol is a two-wire link protocol between the interface device IFD and IC. The protocol type is “S = 10″. All data changes on I/O are triggered by the falling edge on CLK.
The transmission protocol is composed of the following four modes:
– Reset and answer- to-reset
– Command mode
– Data output mode
– Processing mode

Reset and Answer-To-Reset
According to IS07816-3, Answer-To-Reset takes place during operation. The reset can be implemented at any time. During reset, the address counter is set to zero. When RST is set from high level to low level, the lowest bit of the first byte is read on the I/O. Under continuous 31 clock pulses, the contents of the first 4 byte EEPROM addresses can be read out. The 33rd clock pulse sets the I/O to high impedance. During Answer-To-Reset, any start and stop condition is ignored.

Command Mode
After Answer-To-Reset, IS23SC4442 waits for a command entry. Each command begins with a start condition, which includes a three bytes command entry, and it ends with a stop condition.
– Start condition: during CLK in high level, a falling edge on I/O
– Stop condition: during CLK in high level, a rising edge on I/O
– After receiving a command, there are two possible modes:
– Processing mode for writing and erasing

Data Output Mode
When reading, the chip sends the data to IFD. The figure shows the timing diagram. After the first falling edge on CLK, the first bit on the I/O is valid. After the last data bit, an additional CLK pulse is necessary to set the I/O to a high level for receiving a new command. During this mode, any start and stop condition is ignored.

Processing Mode
During processing, the chip processes internally. The following Figure shows the timing diagram. The IFD sends clock to the chip continuously until the I/O us set to the high level that has been set to low level on the first falling edge of CLK. During this mode any start and stop condition is ignored.

Read Main Memory
The command reads out the memory contents from the given address (N) to the last address of the memory (with LSB first). After the command entry, the IFD has to provide sufficient clock pluses. The number of clock pulse = (256 – N) x 8+1. The main memory can always be read.

Read Protection Memory
The command reads out 32 bits to I/O on continuous 32 clock pulses. By an additional clock pulse, the I/O is set to high level. The protection memory can always be read.

Read Security Memory
The three bytes of reference data can only be read after successful PSC verification; otherwise, the output of the PSC will be suppressed and the I/O will be set to the low level. The error counter can always be read. The read out four bytes security memory requires 32 clock pulses, I/O is set to the high level by an additional pulse.

Update Main Memory
The command programs the addressed EEPROM byte with the given data byte. Depending on the old and the new data, one of the following operations will take place during processing mode.
– Erase and write (5 ms) corresponding to m = 255 clock pulses
– Write only (2.5 ms) corresponding to m=124 clock pulses
– Erase only (2.5ms) corresponding to m=124 clock pulses (frequency of clock = 50 kHz)

Update Security Memory
After the successful PSC verification, the reference data can be updated. Otherwise, only the error counter can be written. The processing time and the required clock pulses are the same as that of the update main memory.

Write Protection Memory
The execution of this command includes a comparison of the given data byte and the assigned byte in the main memory. If the result is data identity, the protection bit is written so the corresponding data byte in the main memory is unchangeable. If the result is differences, the protection bit cannot be written. The execution time and clock pulses are the same as that of the update main memory.

Compare Verification Data
Only after the error counter has written one bit, can the procedure and compare verification data be executed. The command compares the given verification data byte with the corresponding reference data byte.

Usage of the Compare Command
The following procedure must be completed exactly as described. Any variation to the procedure can results in a failure, so that a write and erase can not be accessed. If the procedure cannot successful complete, only the error counter can be written that means one to zero but it cannot be erased.

First of all, an error counter bit has to be written to zero by an update security memory command. Thereafter, a successful execution of three compare verification commands from byte 1 to byte 3 makes erasing the error counter possible. Write and erase access to all memory areas is possible; as long as, the operation voltage is applied. If an error takes place, the whole reference data can be updated like any other information in the main memory.

As transported, the PSC is coded with the individual agreement with the customer. Knowing the code is indispensable to alter data.

Reset and Answer-To-Reset
Power on Reset
After power on, the I/O is set to the high level. A read operation or an Answer-To-Reset command must be carried out before any data can be altered.

If RST is set on the high level while CLK is set on the low level, the operation is aborted and the I/O is switched to the high level. To trigger a defined valid reset, the necessary minimum duration is tRES = 5 ms. After break, the IC is ready for further operations.

Behavior of failures:
In case of one of the following failures, the chip sets the I/O to the high level after 8 clock pulses.
Possible failures:
- Comparison unsuccessful
- Wrong number of command clock pulses
- Write/erase access to already protected bytes
- Rewrite and erase a protection bit

Coding of the Chip
For security purposes, every chip is irreversibly coded by a scheme. This way fraud and misuse is excluded. For example, Figure a and Figure b show ATR and Directory Data of Structure 1. When transported, the ATR header, ICM and ICT are programmed. Shanghai Belling Microelectronics Mfg. CO., Ltd. programs the IC manufacturer identifier (ICM), IC type (ICT)… Belling programs other code depending on the customer agreement.