TUCoPS :: Truly Miscellaneous :: howchips.txt

What You Need To Know About Electronic Telecards

===============================================================================

             What you need to know about electronics telecards

===============================================================================

                 Version 1.18 (Last revised: 08-09-1995)



                    (C) Stephane BAUSSON - (93,94,95)



                            4, Rue de Grand

                           F-88630 Chermisey

                                France





-------------------------------------------------------------------------------

>>> Any suggestions or comments about phonecards and smartcards are welcome <<<

-------------------------------------------------------------------------------



This file is archived at nic.funet.fi:/pub/doc/telecom/phonecard/chips



Thanks to the following people:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   Kimble

   XRed                   xxxxxx@etsit.upv.es

   Proux Jean-Philippe ## proux@idr
l@hut.fi

   Gerrit Telkamp      ## telkamp@eis.cs.tu-bs.de

   Martin Schulte      ## schulte@thp.Uni-Koeln.DE

   Georges Zotos       ## picard@hol.ath.forthnet.gr

   Ales "MCA" Markarov ## xmarkarov@sun.felkcvut.cz

   Toni Cebrian        ## acebrian@etsit.upv.es



Document History:

~~~~~~~~~~~~~~~~

   V1.18 : New coutries:  Argentina, Burkina Faso, Cameroon, Croatia,

           Djibouti, Gambia, Hungary, Mali, Mexico (Telmex), Morocco,

           French Polynesia, New Caledonia, St Maarten, Slovakia.

   V1.17 : Greek Serial Number added.

   V1.16 : German Telefonkarte Serial Number.

   V1.15 : New readers (Telecards+ISO7816 cards).

   V1.14 : New 512 bit Greek telecards + modification of Mexican cards.

   V1.13 : Checksums for french cards + modification for 'G+D' spanish cards.

   V1.12 : Chip builder code added.

   V1.11 : Croatian cards added.

   V1.10 : Romanian telecards added.

   V1.09 : Spanish card reading.

   V1.08
for greek cards.

   V1.07 : Modification of the 5 stage octal counter for 128 bit cards.

   V1.06 : Schematic of a new reader [DELETED].

   V1.02 : Introduction of the German cards.

   V1.00 : First version of the document.



Glossary of terms:

~~~~~~~~~~~~~~~~~~

   [TBC] : to be confirmed

   [TBD] : to be defined



   b(i) : Bit i

   B(I) : Byte I

   x^y  : x at the power y  (in mathematical expresssions)



-------------------------------------------------------------------------------



                               * Content *

                               ~~~~~~~~~~~



I ) The 1st generation Telecards:



   1.1 - Introduction:

   1.2 - SCHEMATICS of the chip:

   1.3 - PINOUT of the connector:

   1.4 - Main features:

   1.5 - TIME DIAGRAMS:

   1.6 - Memory Map for cards from FRANCE and MONACO:

   1.7 - Memory Map for cards from other countries:

   1.8 - Memory Map for cards from SPAIN, CROATIA and MEX




II ) The 2nd and 3rd generations Telecards:



   2.1 - Introduction:

   2.2 - Pinout:

   2.3 - Main features:

   2.4 - Time Diagrams:

   2.5 - Memory Map:



     2.5.1 - Memory Map for 5 satge octal unit counter:

     2.5.2 - Memory Map for 4 satge octal unit counter:

     2.5.3 - Memory Map for new 512 bit Greek telecards



   2.6 - Electrical features:





III) Schematics of Readers:



   3.1 - Reader 1 (very simple one, only for telecards)

   3.2 - Reader 2 (for telecards and ISO7816 cards too)





-------------------------------------------------------------------------------



I ) The 1st generation Telecards:

    ============================



   1.1 - Introduction:

         ~~~~~~~~~~~~



       Since the middle of 80's have appeared a new generation of cards  ( the

smart-cards  or  chip cards )  that have  replaced most of the magnetics cards

applications  notably  for  telecom payement an
e magnetics cards, and there are several kind

of  cards following  the application.  The simplier ones are the Simple Memory

cards  like the  one used as  Telecard  for the telecom payement in the public

phone-booths  ( Generaly all the memory content is  readable,  and there  is a

maker-area that is unwritable ) , then there are  more sofisticated  cards:

Memeory Cards with some area read protected by a key, these cards can  contain

some  private informations in  the read-protected area.   At the end there are

microprocessor-cards (cards working following the ISO-7816 protocol), that are

the safiest ones  since these cards  have their own internal  Operating System

that prevent  I/O  if the PIN (Personal Idenfication Number) has not been ent-

-ered in the cards before ( These cards are used  when confidentiality is

needed,  like in  credit cards (bank), crypted TV access cards, health cards,

SIM cards for GSM, etc ... ).





       About tele
 the less safe ones, don't think

that  you  are  going  to  phone freely for that, in fact no.  All the data are

readable since  there are  no confidential data inside, the cards are well done

enough to be  very secure for  the payement of telecom communications in public

booth.



       So, what is a phonecard exactly ? In fact generaly it's a 256 bits EPROM

( French likde cards ),  or a 128 bits EEPROM (German like cards) with a serial

output and some other control pins.



       Then why can it not be refilled ?   Well,  indeed to refill the card you

will  have to erase the cards with UV,  knowing that the cards is coated in  UV

opaqued resin that prevent  UV from reaching the silicium chip, and even if you

could  to erase the chip  you will have to program the manufactuer area that is

write-protected by a lock-out fuse that was fused after the card programming in

factory.



       Neithertheless it can be very interesting to study how
kind of data are inside and  how the data are maped  inside or to

see  how many units are left  inside for exemple.  Besides  there  are a  great

number of  applications of  these cards when there  are used (only for personal

use of course) , since  you can use them as key to open a door, or you can also

use them as key to secure a program, etc ....



       French Telecards have been created in 1984 and at this time constructors

decided to build these cards in NMOS technology but now, they plan to change by

1994 all readers  in the public booths  and use CMOS technology. Also they plan

to use  EEPROM to secure the cards and to add many usefull infornations in, and

you will perhaps use phone cards to buy you bread or any thing else.



These cards are called Second Generation Telecards.





   1.2 - SCHEMATICS of the chip:

         ~~~~~~~~~~~~~~~~~~~~~~



        .-----------------.

      --|>_ Clk           |

      --| R/W
   --| Fuse            |

      --| Vpp             |

        '-,             ,-'

        .-'-------------'-.

        |             Out |-- serial output

        '-----------------'





   1.3 - PINOUT of the connector:

         ~~~~~~~~~~~~~~~~~~~~~~~





                               AFNOR CHIP

                               ----------

        Afnor Position                              ISO position

   (in the left top corner)                     (in the middle left)



,-------------+-------------,               ,-------------+-------------,

|   8         |         4   |               |   1         |         5   |

+-------\     |     /-------+               +-------\     |     /-------+

|   7    +----+----+    3   |               |   2    +----+    +    6   |

+--------|         |--------+               +--------|         |--------+

|   6    +    +----+    2   |               |   3    +----+----+    7   |

+-------/     |
  \-------+

|   5         |         1   |               |   4         |         8   |

'-------------+-------------'               '-------------+-------------'



NB: only the position of the chip is ISO standardized and not the pinout.



PINOUT:   1 : Vcc = 5V     5 : Gnd

~~~~~~    2 : R/W          6 : Vpp = 21V   (*)

          3 : Clock        7 : I/O

          4 : RAS          8 : Fus         (*)



  (*) Not used with the new G+D cards compatible with the 256 bit memory

      Exemple: spannish G+D cards.





   1.4 - Main features:

         ~~~~~~~~~~~~~



       - Synchronous protocol.

       - N-MOS technology or CMOS for the new ones.

       - 256x1 bit organisation.

       - 96 written protected by a lock-out fuse.

       - Low power 85mW in read mode.

       - 21 V programming voltage.

       - Access time: 500ns

       - Operating range: -10øC +70øC

       - Ten year data rentention.





   1.5 - Tim
lumberger, Solaic, Gemplus

       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



+21V                                     _____________

+5V ____________________________________|             |_________________ VPP

                                        :             :

+5V                  ___________________:_____________:_________________ ___

0V  ________________|                   :             :                  RST

                    :                   :             :

+5V     ____        :      ____         :       ______:______

0V  ___|    |_______:_____|    |________:______|      :      |__________ CLK

       :    :       :     :    :        :      :      :      :

+5V    :    :       :     :    :        :______:______:      :           _

0V  ___:____:_______:_____:____:________|      :      |______:__________ R/W

       :    :       :     :    :        :      :      :      :

+5V    :    :       :_____:    :________:      :      :      :__
X_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ OUT

       :    :       :     :    :        :<-----><---->:      :

       :    :       :     :    :        :10 to   10 to       :

       :    :       :     :    :        :50 ms   50ms        :

        Reset        Bit 1        Bit2                           Bit 3

        card        reading      reading  Bit2 writing to 1     reading





NOTE: Vpp Idle state is 5V, thus Vpp will have to be connected to Vcc to read

      the card.





   b - Cards from G+D (Spanish cards labeled with the 5th byte = $30)

       ~~~~~~~~~~~~~~



+5V                  ___________________________________________________ ___

0V  ________________|                                                    RST



+5V     ____               ____                 _____________

0V  ___|    |_____________|    |_______________|             |__________ CLK

       :    :             :    :               :             :


_____:______       :           _

0V  ___:____:_____________:____:________|      :      |______:__________ R/W

       :    :             :    :               :      :      :

+5V    :____:_____________:____:_______________:______:______:__________

0V  XXXX    X_____________X    X_______________X      :      X__________ OUT

       :    :             :    :               :<---->:      :

       :    :             :    :               : 1 ms        :

       :    :             :    :               :             :

        Reset     Bit 1              Bit 2          Bit 2         Bit 2

        card     reading            reading      writing to 1    reading





   1.6 - Memory Map for cards from FRANCE, MONACO and St MAARTEN:

         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Byte (Bit)      Hexa



              +-----+

1 (1..8)      |     | --> Checksum for bytes 2, 3, 4 (*)

              +-----+

              | $03 |



              | $05 |     Serial Number (1st byte)

              + - - +

              | $80 | --> St Maarten

              +-----+

3 (17..24)    |     | --> Serial Number (2nd byte)

              +-----+

4 (25..32)    |     | --> Serial Number (3rd byte)

              +-----+

5 (33..40)    |     | --> checksum for bytes 6, 7, 8  (*)

              +-----+

6 (41..48)    |     | --> Serial Number (4th byte)

              +-----+

7 (49..56)    |     | --> Serial Number (5th byte)

              +-----+

8 (57..64)    |     | --> ? [TBD]

              | $FF | --> St Maarten

              +-----+

9 (65..72)    |     | --> checksum for byte 10, 11, 12 (*)

              +-----+

10 (73..80)   |     | --> ? [TBD]

              | $FF | --> St Maarten

              +-----+

11 (81..88)   | $10 | --> France and Monaco

              | $14 | --> St Maarten

              +-----+

12 (33..40)   | $13 | --> 120 units


0 units

              +-----+

13 (97..104)  |     | --> The units area: each time a unit is used

     .        |     |     then a bit is set to "1"; Usualy the 1st

     .        |     |     10 units are fused in factory for test.

     .        |     |

     .        |     |

     .        |     |

31 (241..248) |     |

              +-----+

32 (249..256) | $FF | --> $FF is set when all the units are used.

              +-----+



(*) checksum is calculated by the following expresion:



              max                | min=32*(j-1)+9

    $E3 - 4 * Sum b(i)     where | max=32*j

             i=min               | and j is the checksum number (1, 2 or 3)



NOTE: The card number is the concatenation in a single string of the 5 bytes

      written in hexadecimal.







   1.7 - Memory Map for cards from other countries:

         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~





Byte (Bit)     Hexa



              +--
 --> Check Sum Byte = 216 - Sum b(i)

              +-----+                             i=9

2 (9..16)     | $83 |  --> Telecard

              | $80 |  --> Other Applications (See below)

              | $9A |  --> PIAF card [TBC]

              | $C0 |  --> AVANT card [TBC]

              +-----+-----+

3-4 (17..32)  | $1x | $xx |  --> Units+2

              | $11 | $52 |  --> Exemple for 150u

              + - - - - - +

              | $C0 | $25 |  --> 120u (Hungary)

              | $3D | $13 |  -->  80u (Morocco)

              | $DB | $B5 |  -->  40u (Morocco)

              +-----+-----+

5 (33..40)    | $00 |  --> Schlumberger

              | $10 |  --> Solaic [TBC]

              | $30 |  --> Gemplus [TBC] (finnish cards)

              | $40 |  --> Gemplus

              +-----+

6 (41..48)    |     |

7 (49..56)    |     |

8 (57..64)    |     |  --> Serial Number

9 (65..72)    |     |

10 (73..80)   |     |


Djibouti

              |     | $16 |  --> French Polynesia

              | $11 | $1D |  --> French Cin‚carte [TBC]

              |     | $1E |  --> Sweden

              |     | $30 |  --> Norway

              |     | $31 |  --> New Caledonia

              |     | $32 |  --> Cameroon

              |     | $33 |  --> Andorra

              |     | $39 |  --> Luxembourg

              |     | $3C |  --> Ireland

              |     | $3D |  --> Gambia

              |     | $47 |  --> Portugal

              |     | $55 |  --> Czech Republic / Yougoslavia [TBC]

              |     | $5C |  --> Argentina

              |     | $5D |  --> Burkina Faso

              |     | $5E |  --> Mali

              |     | $5F |  --> Gabon

              |     | $65 |  --> Finland

              |     | $86 |  --> Slovakia

              |     | $E0 |  --> Hungary

              |     | $E1 |  --> Cameroon (CamTel)

              |     | $E2 |  --> Mor
.104)  |     |  --> The units area: each time a unit

     .        |     |      is used, then a bit is set to "1";

     .        |     |

     .        |     |      The first two units are fused in

     .        |     |      factory as test.

     .        |     |

32 (249..256) |     |

              +-----+





   1.8 - Memory Map for cards from Argentina, Spain, Croatia and Mexico:

         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   The spanish telecards are made from different manufacturers, and these cards

   should be read and written with a different protocol following the 5th byte

   of the memory (see subclause 1.6-a for the cards with the 5th byte=$90 and

   see the subclause 1.6-b for the cards with the 5th byte=$30).





Byte (Bit)       Binary    Hexa



              +-----------+-----+                            96

1 (1..8)      |           |     | ---> Checksum byte = 216 - Sum b(i)


         i=9

2 (9..16)     | 1000 0011 | $83 | ---> Telecard

              +-----------+-----+

3 (17..24)    | 1111 1111 | $FF |

              +-----------+-----+

4 (25..32)    | 1111 1111 | $FF |

              +-----------+-----+

5 (33..40)    | 1001 0000 | $90 | ---> Oberthur

              | 1001 1110 | $9E | ---> Oberthur (Argentina)

              | 0011 0000 | $30 | ---> G+D

              | 0101 1010 | $5A | ---> Gemplus

              +-----------+-----+

6 (41..48)    |           |     |

7 (49..56)    |           |     | ---> Serial Number (*)

8 (57..64)    |           |     |

              +-----------+-----+-----------+-----+

9-10 (65..80) | 0001 0100 | $14 | 1000 1010 | $8A | --> 1000 pesetas (spain)

              | 0010 0101 | $25 | 0000 0100 | $04 | --> 2000 pesetas (spain)

              | 0010 0101 | $25 | 0000 0110 | $06 | --> 2100 pesetas (spain)

              | 0001 0100 | $14 | 1100 1010 | $CA | --> N$ 25.00 (Mexico
000 0011 | $03 | --> 25 (Argentina)

              | 0000 0000 | $00 | 0000 1010 | $0A | --> 100u (Croatia)

              | 0010 1010 | $2A | 0010 0101 | $85 | --> 1000u (Croatia)

              +-----------+-----+-----------+-----+

11 (81..88)   | 0001 1110 | $1E |

              +-----------+-----+

12 (89..96)   | 0010 0010 | $22 | --> Spain

              | 0010 0100 | $24 | --> Mexico

              | 0010 0110 | $26 | --> Croatia

              | 0010 1000 | $28 | --> Argentina

              +-----------+-----+

13 (97..104)  | 1111 1111 | $FF | ---> the first 10 units are fused

    .         | 11xx xxxx | $xx |      in factory for testing.

    .         | xxxx xxxx | $xx |

    .         | xxxx xxxx | $xx | ---> Slow counter area

    .         | xxxx xxxx | $xx |

    .         +-----------+-----+

    .         | xxxx xxxx | $xx |

    .         | xxxx xxxx | $xx | ---> Fast counter area

32 (249..256) | xxxx xxxx | $xx |


counter area:

   ----------------------

       - Increment: counts units by an increment of 5 pesetas

       - size:

                o [b107 ... b206] for 1000 pesetas cards

                o [b127 ... b166] for 2000 pesetas cards

                o [b107 ... b166] for 2100 pesetas cards



   The Fast counter area:

   ----------------------

       - Increment: counts units by an increment of

                o 10 pesetas for the 1000 pesetas cards

                o 20 pesetas for the 2000 pesetas cards

                o 20 pesetas for the 2100 pesetas cards



       - size:

                o [b207 ... b256] for the 1000 pesetas cards

                o [b167 ... b256] for the 2000 pesetas cards

                o [b167 ... b256] for the 2100 pesetas cards



   Exemple of an fast units area: (1000 pesetas cards)

   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

                00 -,

         0000 0000  |

         0000 0000  |-> Unused uni


         0011 1110 ---> 14*10 pesetas are used

         1000 1110



   NB: Several units can be used, in this case only the last unit is set as

       used, like in the previous exemple, where some units are set to 0 but

       are nonetheless used.



   (*) Serial Number for spanish telecards: The serial number for G+D and

       Gemplus telecards is directly obtained by the following formula:



                 Byte[6]*$10000 + Byte[7]*$100 + Byte[8]



   1.9 - Memory Map for Mexican cards from Telmex:

         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Byte (Bit)     Hexa



              +-----+                              96

1 (1..8)      |     | ---> Check Sum Byte = 216 - Sum b(i)

              +-----+                             i=9

2 (9..16)     | $80 |

              +-----+

3 (17..24)    |     |

4 (25..32)    |     |     | --> Serial Number [TBC]

              +-----+

5 (33..40)    | $00 | --> Schlumber
       | $40 | --> Gemplus

              +-----+

6 (41..48)    |     |

7 (49..56)    |     | --> Serial Number [TBC]

8 (57..64)    |     |

              +-----+-----+

9-10 (65..80) | $41 | $4C | --> 20u

              | $82 | $8C | --> 40u

              +-----+-----+

11-12(81..96) | $32 | $59 | --> Mexico

              +-----+-----+

13 (97..104)  |     | ---> The units area: each time a unit

     .        |     |      is used, then a bit is set to "1";

     .        |     |

     .        |     |      The first two units are fused in

     .        |     |      factory as test.

     .        |     |

32 (249..256) |     |

              +-----+







II ) The 2nd and 3rd generation Telecards:

     =====================================



   2.1 - Introduction:

         ~~~~~~~~~~~~



   These cards are in fact 128 bit memory in NMOS technology, and the map of

   these cards are the following:



        64
t EEPROM (5x8 bits).

        24 bits set to "1".





   2.2 - Pinout:

         ~~~~~~



           ISO 7816-2



 ,-------------+-------------,

 |   1         |         5   |   Pinout:

 +-------\     |     /-------+   ~~~~~~

 |   2    +----+    +    6   |     1 : VCC=5V    5 : Gnd

 +--------|         |--------+     2 : Reset     6 : n.c.

 |   3    +----+----+    7   |     3 : Clock     7 : I/O

 +-------/     |     \-------+     4 : n.c.      8 : n.c.

 |   4         |         8   |

 '-------------+-------------'     (n.c. : not connected)





   2.3 - Main features:

         ~~~~~~~~~~~~~



        - ISO 7816- 1/2 compatible.

        - use a single 5V power supply.

        - low power consuption.

        - NMOS technology.



   2.4 - Time Diagrams:

         ~~~~~~~~~~~~~



Reset:

------

  The address counter is reset to 0 when the clock line CLK is raised while

the control line R is high. Note th
o 7.



      __________________

_____|                  |_____________________________________________ Reset

     :                  :

     :        _____     :  _____       _____       _____       _____

_____:_______|     |____:_|     |_____|     |_____|     |_____|     |_ Clk

     :       :          : :     :     :     :     :     :     :     :

_____:_______:__________:_:_____:_____:_____:_____:_____:_____:_____:_

_____:___n___|_____0____:_|_____1_____|_____2_____|_____3_____|___4_:_(Address)

     :                  :       :           :           :           :

_____:                  :_______:___________:___________:___________:_

_____XXXXXXXXXXXXXXXXXXXX_______|___________|___________|___________|_ Data

Bit n                      Bit 0    Bit 1        Bit2       Bit3



   The address counter is incremented by 1 with each rising edge of the clock

signal Clk, for as long as the control line R remains low. The data held in

each addresse
h time Clk falls. It is not

impossible to decrement the address counter, therefore to address an earlier

bit, the address counter must be reset then incremented to require value.





Write:

------

   All unwritten or erased bits in the address 64-104 may be unwritten to.

When a memory cell is unwritten, it is set to 0. The addressed cell is

unwritten to by the following sequence.



1- R is raised while Clk is low, to disable address counter increment for one

clock pulse.



2- Clk is then raised for a minimum of 10ms to write to the address bit.



When to write operation ends, and Clk falls, the address counter is unlocked,

and the content of the written cell, which is now 0, is output to I/O contact

if the operation is correct.

The next Clk pulse will increment the address by one, then the write sequence

can be repeated to write the next bit.



              _____                                _____

_____________|     |___
___  Reset

             :                                    :

     ___     :           _____           ___      :           _____

____|   |____:__________|     |_________|   |_____:__________|     |____  Clk

    :        :          :     :         :   :     :          :     :

____:________:__________:_____:_________:___:_____:__________:_____:_____

 n  |      n+1          |     n+2       |   :    n+3         |     :  (Address)

----'--------:----------'-----:---------'---:-----:----------'-----:-----

             :          :     :             :     :          :     :

_________   _:          :     : ____________:  ___:          :     :

_________XXX_XXXXXXXXXXXXXXXXXXX____________ XX___XXXXXXXXXXXXXXXXXXXXXXX  I/O

   n      n+1           :     :     n+1        n+2           :     :

                        :     :                              :     :

                         write                                write





WriteCarry:

------
 performing the WRITECARRY sequence on the stage of

the next highest weighing to that to be erased.



The writecarry sequence is as follows:



1 - Set the address counter to an unwritten bit in the next highest counter

stage to that to be erased.



2 - Increment is disabled on the following rising edge of R where Clk remains

low.



3 - Clk is then raised for a minimum of 10ms, while R is low, to write to the

next address bit.



4 - R is the raised again while Clk remains low to disable increment a second

time.



5 - Clk is the raised for a minimum of 1ms, while R is low, to write to the

addressed bit a second time, erasing the counter level immediately below that

the addressed bit.



       _____                      _____

______|     |____________________|     |_________________________________  Rst

      :                          :

      :            _______       :              _______        ___

______:___________
_____  Clk

      :           :       :      :             :       :      :   :

      :           :       :      :             :       :      :   :

<------------------------- address n ------------------------>:<--- n+1 ------

      :           :       :      :             :       :          :

      :           :       :      :             :       :          :

______:           :       :______:             :       :__________: _____

______XXXXXXXXXXXXXXXXXXXXX______XXXXXXXXXXXXXXXXXXXXXXX__________XX_____  I/O

                  :       :  n                 :       :     n        n+1

                  :       :                    :       :

                    Write                        Erase



   2.5 - Memory Map:

         ~~~~~~~~~~



      2.5.1 - Memory Map for 5 stage octal unit counter:

              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Byte (Bit)     Hexa



              +-----+-----+

1-2 (1..16)   | $F2 | $2F | -
             | $80 | $6F |

              + - - + - - +

              | $80 | $37 | --> Neitherlands

              | $80 | $77 |

              + - - + - - +

              | $10 | $2B | --> Romania [TBC]

              +-----+-----+

3 (17..24)    | $FF | --> Germany, Netherlands

              | $2F | --> Romania [TBC]

              +-----+

4 (25..32)    | $2A | --> Solaic

              | $4A | --> ODS

              | $8A | --> G+D

              | $CA | --> Gemplus

              +-----+

5 (33..40)    |     |

6 (41..48)    |     | --> Issuer area (written protected)

7 (49..56)    |     |      (See below)

8 (57..64)    |     |

              +-----+

9 (65..72)    |     | --> c4096  )

10 (73..80)   |     | -->  c512  )

11 (81..88)   |     | -->   c64  ) 5 stage octal counter

12 (89..96)   |     | -->    c8  )

13 (97..104   |     | -->    c0  )

              +-----+

14 (105..112) | $FF |

15 (113..120) | $FF | --> a
       +-----+











      2.5.2 - Memory Map for 4 satge octal unit counter:

              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Byte (Bit)        Binary    Hexa



              +-----------+-----+-----------+-----+

1-2 (1..16)   | 1001 0010 | $92 | 0011 1011 | $3B | ---> Greece

              | 1001 0100 | $94 | 0011 1011 | $3B |

              +-----------+-----+-----------+-----+

3 (17..24)    | 1111 1111 | $FF |

              +-----------+-----+

4 (25..32)    | 0111 1011 | $7B | ---> [TBC] (100 Units identifier?)

              +-----------+-----+

              |           |     | ---> Serial Number = B(8)*2^24 + B(7)*2^16 +

              |           |     |                      B(6)*2^8 + B(5)

5 (33..40)    |           |     |

6 (41..48)    |           |     |                  i=8

7 (49..56)    |           |     |      with B(I) = Sum {b((I-1)*8+j)}^(8-i)

8 (57..64)    |           |     |                  i=
    |           |     |      (Bytes reversed: MSB left, LSB right)

              +-----------+-----+

9 (65..72)    |           |     | ---> c512 )

10 (73..80)   |           |     | --->  c64 )

11 (81..88)   |           |     | --->   c8 ) 4 stage octal counter

12 (89..96)   |           |     | --->   c0 )

              +-----------+-----+

13 (97..104)  | 1111 1111 | $FF |

14 (105..112) | 1111 1111 | $FF |

15 (113..120) | 1111 1111 | $FF | ---> area of bits set to "1"

16 (120..128) | 1111 1111 | $FF |

              +-----------+-----+





      2.5.3 - Memory Map for new 512 bit Greek telecards

              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       For a little time have appeared new Greek telecards built by Gemplus,

these cards are 512 bit memory. And it is not clearly explained how the unit

area works (Informations are welcome).



Byte (Bit)      Hexa



              +-----+-----+

1-2 (1..16)   | $93 | $AB | --
24)    | $FF |

              +-----+

4 (25..32)    | $7B | --> [TBC] (100 Units Identifier?)

              +-----+

5 (33..40)    |     | --> Serial Number (See before)

6 (41..48)    |     |

7 (49..56)    |     |

8 (57..64)    |     |

              +-----+

9 (65..72)    | $00 | --> [TBC]

10 (73..80)   | $00 |

11 (81..88)   | $00 |

12 (89..96)   | $00 |

              +-----+

13 (97..104)  | $FF |

14 (105..112) | $FF | --> area of bits set to "1"

15 (113..120) | $FF |

16 (120..128) | $FF |

              +-----+

17 (129..136) | $xx | --> Unit area [TBD]

    .         |     |

    .         |     |

    .         |     |

64 (137..512) | $xx |

              +-----+



The Issuer area:

----------------



    This issuer consists of 40 bits. The contents of the issuer area are

specified by the card issuer, and are fixed during the manufacturing process.

The contents of the issuer area will include data such
area may only be read.





Serial Number for german telefonkarte:

-------------------------------------



     Byte 4         Byte 5          Byte 6          Byte 7          Byte 8

,------,------, ,------,------, ,------,------, ,------,------, ,------,------,

| <--- | 1010 | | <--- | <--- | | <--- | <--- | | <--- | <--- | | <--- | <--- |

'------'------' '------'------' '------'------' '------'------' '------'------'

   |                       |        |     |         |      |        |      |

   |                       |        |     |         |      |        |      |

1st S.N.                2nd S.N.    |  9th S.N.     |   7th S.N.    |   5th S.N.

 digit                   digit      |   digit       |    digit      |    digit

                                    |               |               |

                                 4th S.N.        8th S.N.         6th S.N.

                                  digit           digit            digit


 the digit is written in reverse binary

               (MSB right, LSB left)

NOTE 2: The Serial Number is the one printed on the back of the card.

        The last two digit are not coded in the memory [TBC].





The Counter area:

-----------------



   The counter area stores the card's units. Its initial value is specified by

the card issuer and set during manufacturing.



The counter area  is divided into a 5 stage abacus counter,  or 4 stage abacus

counter. The octal value of each stage is defined by the number of bits set to '1' and this stage value must

be weighted by the coeficient 8^n ( where n is among [4..0] or [3..0]).



    Exemple: For a 5 stage octal unit counter with 15818 units left.

    --------



           Byte9      Byte10     Byte11     Byte12     Byte13

  --------------------------------------------------------------

          00000111 - 00111111 - 01111111 - 00000001 - 00000011

  ------------------------
      (3)octal   (6)octal   (7)octal   (1)octal   (2)octal

  --------------------------------------------------------------

   Value = 3*8^4   +  6*8^3   +  7*8^2   +  1*8^1   +  2*8^0

  --------------------------------------------------------------

   TOTAL = 15818 Units







Exemple of the WRITE and WRITECARRY sequences:

---------------------------------------------



        b65 ........................................... b104

        ----------------------------------------------------

        00000111 - 00111111 - 01111111 - 00000000 - 00000011

-1                                                        ^    WRITE(b103)

        00000111 - 00111111 - 01111111 - 00000000 - 00000001

-1                                                         ^   WRITE(b104)

        00000111 - 00111111 - 01111111 - 00000000 - 00000000

-1                             ^         ^          ^

        00000111 - 00111111 - 00111111 - 11111111 - 00000000 + W
11111 - 00111111 - 01111111 - 11111111 + WRITECARRY(b89)

        00000111 - 00111111 - 00111111 - 01111111 - 01111111 + WRITE(b97)

-1

        00000111 - 00111111 - 00111111 - 01111111 - 00111111 + WRITE(b98)

-1

        00000111 - 00111111 - 00111111 - 01111111 - 00011111 + WRITE(b99)



        Etc ....







Note that you can only decrease the counter and it is not authorised  to write

in the counter a value greater than the old value.



NB: In fact most of the card units don not represent telecom units,  but money

units, for exmeple in german cards each telecom unit represent 30 pfennigs.





   2.6 - Electrical features:

         ~~~~~~~~~~~~~~~~~~~~



Maximum ratings:

----------------



                     | Symbol   Min    Max  Unit

---------------------+---------------------------

 Supply voltage      | Vcc     -0.3     6     V

---------------------+---------------------------

 Input voltage       | Vss
-------------

 Storage temperature | Tstg     -20   +55    øC

---------------------+---------------------------

 Power dissipassion  | Pd        -     50    mW

-------------------------------------------------





DC caracteristics:

------------------

                           | Symbol  Min. Typ. Max. Unit

---------------------------+-----------------------------

 Suplly current            | Icc      -    -     5    mA

---------------------------+-----------------------------

 Input Voltage (low)       |  Vl      0    -   0.8    V

---------------------------+-----------------------------

 Input voltage (high)      |  Vh     3.5   -   Vcc    V

---------------------------+-----------------------------

 Input current R           |  Ih      -    -   100    uA

---------------------------+-----------------------------

 Input current Clk         |  Il      -    -   100    uA

---------------------------+-----------------------------


  -    10    uA

---------------------------+-----------------------------

 Output current (Voh=5V)   |  Ioh     -    -   0.5    mA

---------------------------------------------------------



AC caracteristics:

------------------

                       | Symbol | Min. | Max. | Unit |

+----------------------+--------+------+------+------+

| Pulse duration       |    tr  |   50 |   -  |  us  |

| R address reset      |        |      |      |      |

+----------------------+--------+------+------+------+

| Pulse duration       |    ts  |   10 |   -  |  us  |

| R write              |        |      |      |      |

+----------------------+--------+------+------+------+

| High level Clk       |    th  |    8 |   -  |  us  |

+----------------------+--------+------+------+------+

| Low level Clk        |    tl  |   12 |   -  |  us  |

+----------------------+--------+------+------+------+

| Write window         | Twrite |   10 |   -  |  ms  |

--+------+------+

| Erase window         | Terase |   10 |   -  |  ms  |

+----------------------+--------+------+------+------+

|                      |   tv1  |    5 |   -  |  us  |

+----------------------+--------+------+------+------+

|                      |   tv2  |  3.5 |   -  |  us  |

+----------------------+--------+------+------+------+

|                      |   tv3  |  3.5 |   -  |  us  |

+----------------------+--------+------+------+------+

|                      |   tv4  |  3.5 |   -  |  us  |

+----------------------+--------+------+------+------+

|                      |   tv5  |  3.5 |   -  |  us  |

+----------------------+--------+------+------+------+

|                      |   tv6  |    5 |   -  |  us  |

+----------------------+--------+------+------+------+

|                      |   tv7  |    5 |   -  |  us  |

+----------------------+--------+------+------+------+

|                      |   tv8  |   10 |   -  |  us
-------------------------







III) Schematics of Readers:

    =======================



     3.1 - Reader 1:

           ~~~~~~~~~

     The following schematics is a very simple one, which will enable you to

read all kind of telecards with a chip, and also other memory cards.





                         | +5V

                         |

 Centronic                 /

   Port                  ,/           C 100nF

             Presence of *---------------||--------------------,

              the card   |     ,-------------+-------------,   |

 Pin10 (Ack)  --<--------*-----|   1         |         5   |---*--,

               R/W | RST       +-------\     |     /-------+      |

 Pin4 (d2)    -->--------------|   2    +----+    +    6   |      |

               Clock           +--------|         |--------+      |

 Pin3 (d1)    -->--------------|   3    +----+----+    7   |---,  |

               RAZ | RFU       +-------/     |
---|   4         |         8   |   |  |

                               '-------------+-------------'   |  |

               I/O                                             |  |

Pin 11 (Busy) --<----------------------------------------------'  |

               Gnd                                                |

Pin 25        ----------------------------------------------------'







     3.2 - Reader 2:

           ~~~~~~~~~



     This Reader which is indeed a reader/writter will enable you to read/write

most of the more current memory cards (and notably telecards), and also smart

cards working under ISO7816 protocol (Credit cards, SIM cards, Health cards,

Videocrypt TV cards, etc ...).





                     +5V o

                         |

                         *-----------------,

                         |                 |

                  ,-------------,          |

               +  |     Vcc     |  +       |


   K

RS 232    1æF === |             | === 1æF  |        /                 Smartcard

               '--|C1-   M   C2-|--'       |       /                  Connector

   RX             |      A      |          '-----o'   o----*---------------o 1

3 o---------------|TX1   X   In2|----------------*---------|---------------o 7

   TX             |             |                | ,-------|---------------o 4

2 o----------,   -|TX2   2   In1|-   1/3 7406    | | ,-----|---------------o 2

   Gnd       |    |      3      |  ,---,  ,---,  | | | ,---|---------------o 8

7 o-,        '----|RX1   2  Out1|--| 1 |o-| 1 |o-* | | | ,-|---------------o 3

    |             |             |  '---'  '---'  | | | | | *---|>|-*-------o 6

   """           -|RX2      Out2|-               | | | | | | ,-|>|-'   ,---o 5

                  |             |                | | | | | | | 2xD     |

          +5V   + |             |    +           | | | | | *-|----||---*

            o-||--
     | | | | | | |   100nF |

             1æF  '-------------' 1æF |          | | | | | | |        """

                         |            |          | | | | | | |

  SUBD 25               """          """         | | | | | | |c

PRINTER Port                                     | | | | | |  \ | PNP

                                                 | | | | | |   >|---,

   D0 - (4) RFU (RAZ)                            | | | | | |  / |  ,-,

2 o----------------------------------------------|-' | | | | |e    | | 10k

   D1 - (3) CLK       ,---,   ,---, 1/3 7406     |   | | | | |     | |

3 o-------------------| 1 |o--| 1 |o-------------|---|-|-* | |     '-'

   D2 - (2) RST (W)   '---'   '---'              |   | | | | |      |

4 o----------------------------------------------|---' | | | |     c \ | NPN

   D3 - (8) RFU (FUS)                            |     | | | |        >|----,

5 o----------------------------------------------|-----' | | |     e / |   ,-,
       ,---, 1/6 7406    |       | | |      |      | |

6 o----------------------------| 1 |o--*---------'       | | |     """     | |

   D5 (Desativate Oscillator)  '---'   |    2xD   ,---,  | | |         10k '-'

7 o------------------------------------|----|<|-*-| 1 |o-' | |              |

   D6 (Vpp Command)                    |  ,-|<|-' '---'    | |              |

8 o------------------------------------|--|----------------|-|--------------'

   D7                                  |  |                *-|--------,

9 o------x                             |  |                | |  ,-----'------,

   ACK (Presence of the card)          |  '----------------|-|--|Oscillator F|

10o------------------------------------|-------------------' |  '------------'

   BUSY (Synchronous Data Output)      |                     |        |

11o------------------------------------'                     |       """

   GND                                                       |
,                                                    |

        |       100uH            1N4935                      |

       """    ,-@@@@@--*-----------|>|--------*----*---------* +21V

              |        |                      |    |         |

              |        '---||  BUZ11 or       |    |         |

              |        ,->-||    IRF14        |    |         |

              |        |---|'--,             ,-,   | 1nF     |

              |        |       |         330k| |  ===        |

              |       """      |             | |   |         |

              |                |6            '-'   |         |

              |       ,------------------,    |    |        +| 220æF

              |      5| Vcut   Ext   Vfb |7   |    |        ===

+12V >--------*-------|      MAX 643     |----*----'         |

              |       | LB1   GND   COMP |    |              |

              |       '------------------'   ,-,             |


 |8      | |22k          |

              *----||----*-----*-----'       '-'             |

              |   10æF         |              |              |

              |               """            """            """

              |

              |       ,---------,

              '----*--|   7805  |--*----> +5V

                   |  '---------'  |

            100nF ===      |      === 100nF

                   '-------*-------'

                           |

                          """



                          Component List

                          ~~~~~~~~~~~~~~



   Integratyed Circuits

   --------------------

1xMAX232 (RS232<-->TTL Adapter)

1xMAX643 (12-->21V Converter Controler)

1x74LS06 (6 inverters)

1x7805   (5V regulator)



     Transistors                      Diodes

     -----------                      ------

1xBUZ11 or IRF14                 4x1N4148 or other

1xBC107 or antoher NPN           1x1N49
ther PNP





    Condensators        Resistors          Misc

    ------------        ---------          ----

     3x100nF              2x10k          100uH self

     1x1nF                1x330k         1xSmartcard connector

     1x10æF               1x22k          1xSUBD25 Female

     1x220æF                             1xSUBD25 Male

     4x1æF







   






TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH