===============================================================================
What you need to know about electronics telecards
===============================================================================
(C) Stephane BAUSSON - (93,94,95)
Version 1.17 (Last revised: 22-08-1995)
4, Rue de Grand
F-88630 Chermisey
France
Tel: +33 29.06.09.89
-------------------------------------------------------------------------------
>>> Any suggestions or comments about phonecards and smartcards are welcome <<<
-------------------------------------------------------------------------------
This file is archived at nic.funet.fi:/pub/doc/telecom/phonecard/chips
Thanks to the following people:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
XRed xxxxxx@etsit.upv.es
Proux Jean-Philippe ## proux@idris.fr
Tomi Engdahl ## Tomi.Engdahl@hut.fi
Gerrit Telkamp ## telkamp@eis.cs.tu-bs.de
Martin Schulte ## schulte@thp.Uni-Koeln.DE
Georges Zotos ## picard@hol.ath.forthnet.gr
Ales "MCA" Markarov ## xmarkarov@sun.felkcvut.cz
Toni Cebrian ## acebrian@etsit.upv.es
Document History:
~~~~~~~~~~~~~~~~
Version 1.17 : Greek Serial Number added.
Version 1.16 : German Telefonkarte Serial Number.
Version 1.15 : New readers (Telecards+ISO7816 cards)
Version 1.14 : New 512 bit Greek telecards + modif's about Mexican cards.
Version 1.13 : Checksums for french cards + modif's for 'G+D' spanish cards.
Version 1.12 : Chip builder code added.
Version 1.11 : Croatian cards added.
Version 1.10 : Romanian telecards added.
Version 1.09 : Spanish card reading.
Version 1.08 : Modification of the octal stage counter for greek cards.
Version 1.07 : Modification of the 5 stage octal counter for 128 bit cards.
Version 1.06 : Schematic of a new reader [DELETED].
Version 1.02 : Introduction of the German cards.
Version 1.00 : First version of the document.
Glossary of terms:
~~~~~~~~~~~~~~~~~~
[TBC] : to be confirmed
[TBD] : to be defined
b(i) : Bit i
B(I) : Byte I
x^y : x at the power y (in mathematical expresssions)
-------------------------------------------------------------------------------
* Content *
~~~~~~~~~~~
I ) The 1st generation Telecards:
1.1 - Introduction:
1.2 - SCHEMATICS of the chip:
1.3 - PINOUT of the connector:
1.4 - Main features:
1.5 - TIME DIAGRAMS:
1.6 - Memory Map for cards from FRANCE and MONACO:
1.7 - Memory Map for cards from ANDORA, CZECH, FINLAND, GABON, IRELAND,
NORWAY, PORTUGAL, SWEDEN:
1.8 - Memory Map for cards from SPAIN, CROATIA and MEXICO:
II ) The 2nd and 3rd generations Telecards:
2.1 - Introduction:
2.2 - Pinout:
2.3 - Main features:
2.4 - Time Diagrams:
2.5 - Memory Map:
2.5.1 - Memory Map for 5 satge octal unit counter:
2.5.2 - Memory Map for 4 satge octal unit counter:
2.5.3 - Memory Map for new 512 bit Greek telecards
2.6 - Electrical features:
III) Schematics of Readers:
3.1 - Reader 1 (very simple one, only for telecards)
3.2 - Reader 2 (for telecards and ISO7816 cards too)
-------------------------------------------------------------------------------
I ) The 1st generation Telecards:
============================
1.1 - Introduction:
~~~~~~~~~~~~
Since the middle of 80's have appeared a new generation of cards ( the
smart-cards or chip cards ) that have replaced most of the magnetics cards
applications notably for telecom payement and also for credit cards. These
cards are far more secure than the magnetics cards, and there are several kind
of cards following the application. The simplier ones are the Simple Memory
cards like the one used as Telecard for the telecom payement in the public
phone-booths ( Generaly all the memory content is readable, and there is a
maker-area that is unwritable ) , then there are more sofisticated cards:
Memeory Cards with some area read protected by a key, these cards can contain
some private informations in the read-protected area. At the end there are
microprocessor-cards (cards working following the ISO-7816 protocol), that are
the safiest ones since these cards have their own internal Operating System
that prevent I/O if the PIN (Personal Idenfication Number) has not been ent-
-ered in the cards before ( These cards are used when confidentiality is
needed, like in credit cards (bank), crypted TV access cards, health cards,
SIM cards for GSM, etc ... ).
About telecards, even if these cards are the less safe ones, don't think
that you are going to phone freely for that, in fact no. All the data are
readable since there are no confidential data inside, the cards are well done
enough to be very secure for the payement of telecom communications in public
booth.
So, what is a phonecard exactly ? In fact generaly it's a 256 bits EPROM
( French likde cards ), or a 128 bits EEPROM (German like cards) with a serial
output and some other control pins.
Then why can it not be refilled ? Well, indeed to refill the card you
will have to erase the cards with UV, knowing that the cards is coated in UV
opaqued resin that prevent UV from reaching the silicium chip, and even if you
could to erase the chip you will have to program the manufactuer area that is
write-protected by a lock-out fuse that was fused after the card programming in
factory.
Neithertheless it can be very interesting to study how these cards work,
to see which kind of data are inside and how the data are maped inside or to
see how many units are left inside for exemple. Besides there are a great
number of applications of these cards when there are used (only for personal
use of course) , since you can use them as key to open a door, or you can also
use them as key to secure a program, etc ....
French Telecards have been created in 1984 and at this time constructors
decided to build these cards in NMOS technology but now, they plan to change by
1994 all readers in the public booths and use CMOS technology. Also they plan
to use EEPROM to secure the cards and to add many usefull infornations in, and
you will perhaps use phone cards to buy you bread or any thing else.
These cards are called Second Generation Telecards.
1.2 - SCHEMATICS of the chip:
~~~~~~~~~~~~~~~~~~~~~~
.-----------------.
--|>_ Clk |
--| R/W |
--| Reset |
--| Fuse |
--| Vpp |
'-, ,-'
.-'-------------'-.
| Out |-- serial output
'-----------------'
1.3 - PINOUT of the connector:
~~~~~~~~~~~~~~~~~~~~~~~
AFNOR CHIP
----------
Afnor Position ISO position
(in the left top corner) (in the middle left)
,-------------+-------------, ,-------------+-------------,
| 8 | 4 | | 1 | 5 |
+-------\ | /-------+ +-------\ | /-------+
| 7 +----+----+ 3 | | 2 +----+ + 6 |
+--------| |--------+ +--------| |--------+
| 6 + +----+ 2 | | 3 +----+----+ 7 |
+-------/ | \-------+ +-------/ | \-------+
| 5 | 1 | | 4 | 8 |
'-------------+-------------' '-------------+-------------'
NB: only the position of the chip is ISO standardized and not the pinout.
PINOUT: 1 : Vcc = 5V 5 : Gnd
~~~~~~ 2 : R/W 6 : Vpp = 21V (*)
3 : Clock 7 : I/O
4 : RAS 8 : Fus (*)
(*) Not used with the new G+D cards compatible with the 256 bit memory
Exemple: spannish G+D cards.
1.4 - Main features:
~~~~~~~~~~~~~
- Synchronous protocol.
- N-MOS technology or CMOS for the new ones.
- 256x1 bit organisation.
- 96 written protected by a lock-out fuse.
- Low power 85mW in read mode.
- 21 V programming voltage.
- Access time: 500ns
- Operating range: -10øC +70øC
- Ten year data rentention.
1.5 - Time diagrams:
~~~~~~~~~~~~~
a - Cards from Schlumberger, Solaic, Gemplus
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+21V _____________
+5V ____________________________________| |_________________ VPP
: :
+5V ___________________:_____________:_________________ ___
0V ________________| : : RST
: : :
+5V ____ : ____ : ______:______
0V ___| |_______:_____| |________:______| : |__________ CLK
: : : : : : : : :
+5V : : : : : :______:______: : _
0V ___:____:_______:_____:____:________| : |______:__________ R/W
: : : : : : : : :
+5V : : :_____: :________: : : :__________
0V XXXXXXXXXXXXXXXXX_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ OUT
: : : : : :<-----><---->: :
: : : : : :10 to 10 to :
: : : : : :50 ms 50ms :
Reset Bit 1 Bit2 Bit 3
card reading reading Bit2 writing to 1 reading
b - Cards from G+D (Spanish cards labeled with the 5th byte = $30)
~~~~~~~~~~~~~~
+5V ___________________________________________________ ___
0V ________________| RST
+5V ____ ____ _____________
0V ___| |_____________| |_______________| |__________ CLK
: : : : : :
+5V : : : : ______:______ : _
0V ___:____:_____________:____:________| : |______:__________ R/W
: : : : : : :
+5V :____:_____________:____:_______________:______:______:__________
0V XXXX X_____________X X_______________X : X__________ OUT
: : : : :<---->: :
: : : : : 1 ms :
: : : : : :
Reset Bit 1 Bit 2 Bit 2 Bit 2
card reading reading writing to 1 reading
1.6 - Memory Map for cards from FRANCE and MONACO:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Binary Hexa
+-----------+-----+
1 (1..8) | | | ---> Checksum for bytes 2, 3, 4 (*)
+-----------+-----+
| 0000 0011 | $03 |
| 0000 0100 | $04 | ---> French telecard
| 0000 0101 | $05 | Serial Number (1st byte)
+-----------+-----+
3 (17..24) | | | ---> Serial Number (2nd byte)
+-----------+-----+
4 (25..32) | | | ---> Serial Number (3rd byte)
+-----------+-----+
5 (33..40) | | | ---> checksum for bytes 6, 7, 8 (*)
+-----------+-----+
6 (41..48) | | | ---> Serial Number (4th byte)
+-----------+-----+
7 (49..56) | | | ---> Serial Number (5th byte)
+-----------+-----+
8 (57..64) | | | ---> ? [TBD]
+-----------+-----+
9 (65..72) | | | ---> checksum for byte 10, 11, 12 (*)
+-----------+-----+
10 (73..80) | | | ---> ? [TBD]
+-----------+-----+
11 (81..88) | 0001 0000 | $10 |
+-----------+-----+
12 (33..40) | 0001 0011 | $13 | ---> 120 units
| 0000 0110 | $06 | ---> 50 units
| 0000 0101 | $05 | ---> 40 units
+-----------+-----+
13 (97..104) | | | ---> The units area: each time a unit is used
. | | | then a bit is set to "1"; Usualy the 1st
. | | | 10 units are fused in factory for test.
. | | |
. | | |
. | | |
31 (241..248) | | |
+-----------+-----+
32 (249..256) | 1111 1111 | $FF | ---> $FF is set when all the units are used.
+-----------+-----+
(*) checksum is calculated by the following expresion:
max | min=32*(j-1)+9
$E3 - 4 * Sum b(i) where | max=32*j
i=min | and j is the checksum number (1, 2 or 3)
NOTE: The card number is the concatenation in a single string of the 5 bytes
written in hexadecimal.
1.7 - Memory Map for cards from ANDORA, CZECH, FINLAND, GABON, IRELAND,
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NORWAY, PORTUGAL, SWEDEN, LUXEMBOURG:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Binary Hexa
+-----------+-----+ 96
1 (1..8) | | | ---> Check Sum Byte = 216 - Sum b(i)
+-----------+-----+ i=9
2 (9..16) | 1000 0011 | $83 | ---> Telecard
| 1000 0000 | $80 | ---> Other Applications
| 1001 1010 | $9A | ---> PIAF card [TBC]
| 1100 0000 | $C0 | ---> AVANT card [TBC]
+-----------+-----+-----------+-----+
3-4 (17..32) | 0001 xxxx | $1x | xxxx xxxx | $xx | ---> Units+2
| 0001 0001 | $11 | 0101 0010 | $52 | ---> Exemple for 150u
+-----------+-----+-----------+-----+
5 (33..40) | 0000 0000 | $00 | ---> Schlumberger [TBC]
| 0100 0000 | $40 | ---> Gemplus [TBC]
+-----------+-----+
6 (41..48) | | |
7 (49..56) | | |
8 (57..64) | | | ---> Serial Number
9 (65..72) | | |
10 (73..80) | | |
+-----------+-----+
11 (81..88) | 0001 0001 | $11 | (Only for the following countries)
+-----------+-----+
12 (89..96) | 0001 1101 | $1D | ---> French Cin‚carte [TBC]
| 0001 1110 | $1E | ---> Sweden
| 0011 0000 | $30 | ---> Norway
| 0011 0011 | $33 | ---> Andorra
| 0011 1001 | $39 | ---> Luxembourg
| 0011 1100 | $3C | ---> Ireland
| 0100 0111 | $47 | ---> Portugal
| 0101 0101 | $55 | ---> Czech Republic / Yougoslavia [TBC]
| 0101 1111 | $5F | ---> Gabon
| 0110 0101 | $65 | ---> Finland
+-----------+-----+
13 (97..104) | | | ---> The units area: each time a unit
. | | | is used, then a bit is set to "1";
. | | |
. | | | The first two units are fused in
. | | | factory as test.
. | | |
32 (249..256) | | |
+-----------+-----+
1.8 - Memory Map for cards from Spain, Croatia and Mexico:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The spanish telecards are made from different manufacturers, and these cards
should be read and written with a different protocol following the 5th byte
of the memory (see subclause 1.6-a for the cards with the 5th byte=$90 and
see the subclause 1.6-b for the cards with the 5th byte=$30).
Byte (Bit) Binary Hexa
+-----------+-----+ 96
1 (1..8) | | | ---> Checksum byte = 216 - Sum b(i)
+-----------+-----+ i=9
2 (9..16) | 1000 0011 | $83 | ---> Telecard
+-----------+-----+
3 (17..24) | 1111 1111 | $FF |
+-----------+-----+
4 (25..32) | 1111 1111 | $FF |
+-----------+-----+
5 (33..40) | 1001 0000 | $90 | ---> Oberthur
| 0011 0000 | $30 | ---> G+D
| 0101 1010 | $5A | ---> Gemplus
+-----------+-----+
6 (41..48) | | |
7 (49..56) | | | ---> Serial Number (*)
8 (57..64) | | |
+-----------+-----+-----------+-----+
9-10 (65..80) | 0001 0100 | $14 | 1000 1010 | $8A | ---> 1000 pesetas (spain)
| 0010 0101 | $25 | 0000 0100 | $04 | ---> 2000 pesetas (spain)
| 0010 0101 | $25 | 0000 0110 | $06 | ---> 2100 pesetas (spain)
| 0001 0100 | $14 | 1100 1010 | $CA | ---> N$ 25.00 (Mexico)
| 0000 0000 | $00 | 0000 1010 | $0A | ---> ??? (Croatia)
+-----------+-----+-----------+-----+
11 (81..88) | 0001 1110 | $1E |
+-----------+-----+
12 (89..96) | 0010 0010 | $22 | ---> Spain
| 0010 0100 | $24 | ---> Mexico
| 0010 0110 | $26 | ---> Croatia
+-----------+-----+
13 (97..104) | 1111 1111 | $FF | ---> the first 10 units are fused
. | 11xx xxxx | $xx | in factory for testing.
. | xxxx xxxx | $xx |
. | xxxx xxxx | $xx | ---> Slow counter area
. | xxxx xxxx | $xx |
. +-----------+-----+
. | xxxx xxxx | $xx |
. | xxxx xxxx | $xx | ---> Fast counter area
32 (249..256) | xxxx xxxx | $xx |
+-----------+-----+
The slow counter area:
----------------------
- Increment: counts units by an increment of 5 pesetas
- size:
o [b107 ... b206] for 1000 pesetas cards
o [b127 ... b166] for 2000 pesetas cards
o [b107 ... b166] for 2100 pesetas cards
The Fast counter area:
----------------------
- Increment: counts units by an increment of
o 10 pesetas for the 1000 pesetas cards
o 20 pesetas for the 2000 pesetas cards
o 20 pesetas for the 2100 pesetas cards
- size:
o [b207 ... b256] for the 1000 pesetas cards
o [b167 ... b256] for the 2000 pesetas cards
o [b167 ... b256] for the 2100 pesetas cards
Exemple of an fast units area: (1000 pesetas cards)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
00 -,
0000 0000 |
0000 0000 |-> Unused units
0000 0000 |
0000 0000 -'
0011 1110 ---> 14*10 pesetas are used
1000 1110
NB: Several units can be used, in this case only the last unit is set as
used, like in the previous exemple, where some units are set to 0 but
are nonetheless used.
(*) Serial Number for spanish telecards: The serial number for G+D and
Gemplus telecards is directly obtained by the following formula:
Byte[6]*$10000 + Byte[7]*$100 + Byte[8]
II ) The 2nd and 3rd generation Telecards:
=====================================
2.1 - Introduction:
~~~~~~~~~~~~
These cards are in fact 128 bit memory in NMOS technology, and the map of
these cards are the following:
64 bit EPROM written protected (manufaturer area).
40 bit EEPROM (5x8 bits).
24 bits set to "1".
2.2 - Pinout:
~~~~~~
ISO 7816-2
,-------------+-------------,
| 1 | 5 | Pinout:
+-------\ | /-------+ ~~~~~~
| 2 +----+ + 6 | 1 : VCC=5V 5 : Gnd
+--------| |--------+ 2 : Reset 6 : n.c.
| 3 +----+----+ 7 | 3 : Clock 7 : I/O
+-------/ | \-------+ 4 : n.c. 8 : n.c.
| 4 | 8 |
'-------------+-------------' (n.c. : not connected)
2.3 - Main features:
~~~~~~~~~~~~~
- ISO 7816- 1/2 compatible.
- use a single 5V power supply.
- low power consuption.
- NMOS technology.
2.4 - Time Diagrams:
~~~~~~~~~~~~~
Reset:
------
The address counter is reset to 0 when the clock line CLK is raised while
the control line R is high. Note that the address counter can not be reset
when it is in the range 0 to 7.
__________________
_____| |_____________________________________________ Reset
: :
: _____ : _____ _____ _____ _____
_____:_______| |____:_| |_____| |_____| |_____| |_ Clk
: : : : : : : : : : :
_____:_______:__________:_:_____:_____:_____:_____:_____:_____:_____:_
_____:___n___|_____0____:_|_____1_____|_____2_____|_____3_____|___4_:_(Address)
: : : : : :
_____: :_______:___________:___________:___________:_
_____XXXXXXXXXXXXXXXXXXXX_______|___________|___________|___________|_ Data
Bit n Bit 0 Bit 1 Bit2 Bit3
The address counter is incremented by 1 with each rising edge of the clock
signal Clk, for as long as the control line R remains low. The data held in
each addressed bit is output to I/O contact each time Clk falls. It is not
impossible to decrement the address counter, therefore to address an earlier
bit, the address counter must be reset then incremented to require value.
Write:
------
All unwritten or erased bits in the address 64-104 may be unwritten to.
When a memory cell is unwritten, it is set to 0. The addressed cell is
unwritten to by the following sequence.
1- R is raised while Clk is low, to disable address counter increment for one
clock pulse.
2- Clk is then raised for a minimum of 10ms to write to the address bit.
When to write operation ends, and Clk falls, the address counter is unlocked,
and the content of the written cell, which is now 0, is output to I/O contact
if the operation is correct.
The next Clk pulse will increment the address by one, then the write sequence
can be repeated to write the next bit.
_____ _____
_____________| |______________________________| |_______________ Reset
: :
___ : _____ ___ : _____
____| |____:__________| |_________| |_____:__________| |____ Clk
: : : : : : : : :
____:________:__________:_____:_________:___:_____:__________:_____:_____
n | n+1 | n+2 | : n+3 | : (Address)
----'--------:----------'-----:---------'---:-----:----------'-----:-----
: : : : : : :
_________ _: : : ____________: ___: : :
_________XXX_XXXXXXXXXXXXXXXXXXX____________ XX___XXXXXXXXXXXXXXXXXXXXXXX I/O
n n+1 : : n+1 n+2 : :
: : : :
write write
WriteCarry:
-----------
A counter is erased by performing the WRITECARRY sequence on the stage of
the next highest weighing to that to be erased.
The writecarry sequence is as follows:
1 - Set the address counter to an unwritten bit in the next highest counter
stage to that to be erased.
2 - Increment is disabled on the following rising edge of R where Clk remains
low.
3 - Clk is then raised for a minimum of 10ms, while R is low, to write to the
next address bit.
4 - R is the raised again while Clk remains low to disable increment a second
time.
5 - Clk is the raised for a minimum of 1ms, while R is low, to write to the
addressed bit a second time, erasing the counter level immediately below that
the addressed bit.
_____ _____
______| |____________________| |_________________________________ Rst
: :
: _______ : _______ ___
______:___________| |______:_____________| |______| |______ Clk
: : : : : : : :
: : : : : : : :
<------------------------- address n ------------------------>:<--- n+1 ------
: : : : : : :
: : : : : : :
______: : :______: : :__________: _____
______XXXXXXXXXXXXXXXXXXXXX______XXXXXXXXXXXXXXXXXXXXXXX__________XX_____ I/O
: : n : : n n+1
: : : :
Write Erase
2.5 - Memory Map:
~~~~~~~~~~
2.5.1 - Memory Map for 5 stage octal unit counter:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Binary Hexa
+-----------+-----+-----------+-----+
1-2 (1..16) | 1111 0010 | $F2 | 0010 1111 | $2F | ---> Germany
| 1111 0100 | $F4 | 0010 1111 | $2F |
| 1000 0000 | $80 | 0110 1111 | $6F |
+ - - - - - + - - + - - - - - + - - +
| 1000 0000 | $80 | 0011 0111 | $37 | ---> Neitherlands
| 1000 0000 | $80 | 0111 0111 | $77 |
+ - - - - - + - - + - - - - - + - - +
| 0001 0000 | $10 | 0010 1011 | $2B | ---> Romania [TBC]
+-----------+-----+-----------+-----+
3 (17..24) | 1111 1111 | $FF | ---> Germany, Netherlands
| 0010 1111 | $2F | ---> Romania [TBC]
+-----------+-----+
4 (25..32) | 0010 1010 | $2A | ---> Solaic
| 0100 1010 | $4A | ---> ODS
| 1000 1010 | $8A | ---> G+D
| 1100 1010 | $CA | ---> Gemplus
+-----------+-----+
5 (33..40) | | |
6 (41..48) | | | ---> Issuer area (written protected)
7 (49..56) | | | (See below)
8 (57..64) | | |
+-----------+-----+
9 (65..72) | | | ---> c4096 )
10 (73..80) | | | ---> c512 )
11 (81..88) | | | ---> c64 ) 5 stage octal counter
12 (89..96) | | | ---> c8 )
13 (97..104 | | | ---> c0 )
+-----------+-----+
14 (105..112) | 1111 1111 | $FF |
15 (113..120) | 1111 1111 | $FF | ---> area of bits set to "1"
16 (120..128) | 1111 1111 | $FF |
+-----------+-----+
2.5.2 - Memory Map for 4 satge octal unit counter:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Binary Hexa
+-----------+-----+-----------+-----+
1-2 (1..16) | 1001 0010 | $92 | 0011 1011 | $3B | ---> Greece
| 1001 0100 | $94 | 0011 1011 | $3B |
+-----------+-----+-----------+-----+
3 (17..24) | 1111 1111 | $FF |
+-----------+-----+
4 (25..32) | 0111 1011 | $7B | ---> [TBC] (100 Units identifier?)
+-----------+-----+
| | | ---> Serial Number = B(8)*2^24 + B(7)*2^16 +
| | | B(6)*2^8 + B(5)
5 (33..40) | | |
6 (41..48) | | | i=8
7 (49..56) | | | with B(I) = Sum {b((I-1)*8+j)}^(8-i)
8 (57..64) | | | i=1
| | |
| | | (Bytes reversed: MSB left, LSB right)
+-----------+-----+
9 (65..72) | | | ---> c512 )
10 (73..80) | | | ---> c64 )
11 (81..88) | | | ---> c8 ) 4 stage octal counter
12 (89..96) | | | ---> c0 )
+-----------+-----+
13 (97..104) | 1111 1111 | $FF |
14 (105..112) | 1111 1111 | $FF |
15 (113..120) | 1111 1111 | $FF | ---> area of bits set to "1"
16 (120..128) | 1111 1111 | $FF |
+-----------+-----+
2.5.3 - Memory Map for new 512 bit Greek telecards
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
For a little time have appeared new Greek telecards built by Gemplus,
these cards are 512 bit memory. And it is not clearly explained how the unit
area works (Informations are welcome).
Byte (Bit) Binary Hexa
+-----------+-----+-----------+-----+
1-2 (1..16) | 1001 0011 | $93 | 1010 1011 | $AB | ---> Greece
+-----------+-----+-----------+-----+
3 (17..24) | 1111 1111 | $FF |
+-----------+-----+
4 (25..32) | | $7B | ---> [TBC] (100 Units Identifier?)
+-----------+-----+
5 (33..40) | | | ---> Serial Number (See before)
6 (41..48) | | |
7 (49..56) | | |
8 (57..64) | | |
+-----------+-----+
9 (65..72) | | $00 | ---> [TBC]
10 (73..80) | | $00 |
11 (81..88) | | $00 |
12 (89..96) | | $00 |
+-----------+-----+
13 (97..104) | 1111 1111 | $FF |
14 (105..112) | 1111 1111 | $FF | ---> area of bits set to "1"
15 (113..120) | 1111 1111 | $FF |
16 (120..128) | 1111 1111 | $FF |
+-----------+-----+
17 (129..136) | xxxx xxxx | $xx | ---> Unit area [TBD]
. | | |
. | | |
. | | |
64 (137..512) | xxxx xxxx | $xx |
+-----------+-----+
The Issuer area:
----------------
This issuer consists of 40 bits. The contents of the issuer area are
specified by the card issuer, and are fixed during the manufacturing process.
The contents of the issuer area will include data such as serial numbers,
dates, and distribution centers.
This area may only be read.
Serial Number for german telefonkarte:
-------------------------------------
Byte 4 Byte 5 Byte 6 Byte 7 Byte 8
,------,------, ,------,------, ,------,------, ,------,------, ,------,------,
| <--- | 1010 | | <--- | <--- | | <--- | <--- | | <--- | <--- | | <--- | <--- |
'------'------' '------'------' '------'------' '------'------' '------'------'
| | | | | | | |
| | | | | | | |
1st S.N. 2nd S.N. | 9th S.N. | 7th S.N. | 5th S.N.
digit digit | digit | digit | digit
| | |
4th S.N. 8th S.N. 6th S.N.
digit digit digit
NOTE 1: '<---' means that the digit is written in reverse binary
(MSB right, LSB left)
NOTE 2: The Serial Number is the one printed on the back of the card.
The last two digit are not coded in the memory [TBC].
The Counter area:
-----------------
The counter area stores the card's units. Its initial value is specified by
the card issuer and set during manufacturing.
The counter area is divided into a 5 stage abacus counter, or 4 stage abacus
counter. The octal value of each stage is defined by the number of bits set to '1' and this stage value must
be weighted by the coeficient 8^n ( where n is among [4..0] or [3..0]).
Exemple: For a 5 stage octal unit counter with 15818 units left.
--------
Byte9 Byte10 Byte11 Byte12 Byte13
--------------------------------------------------------------
00000111 - 00111111 - 01111111 - 00000001 - 00000011
--------------------------------------------------------------
(3)octal (6)octal (7)octal (1)octal (2)octal
--------------------------------------------------------------
Value = 3*8^4 + 6*8^3 + 7*8^2 + 1*8^1 + 2*8^0
--------------------------------------------------------------
TOTAL = 15818 Units
Exemple of the WRITE and WRITECARRY sequences:
---------------------------------------------
b65 ........................................... b104
----------------------------------------------------
00000111 - 00111111 - 01111111 - 00000000 - 00000011
-1 ^ WRITE(b103)
00000111 - 00111111 - 01111111 - 00000000 - 00000001
-1 ^ WRITE(b104)
00000111 - 00111111 - 01111111 - 00000000 - 00000000
-1 ^ ^ ^
00000111 - 00111111 - 00111111 - 11111111 - 00000000 + WRITECARRY(b82)
00000111 - 00111111 - 00111111 - 01111111 - 11111111 + WRITECARRY(b89)
00000111 - 00111111 - 00111111 - 01111111 - 01111111 + WRITE(b97)
-1
00000111 - 00111111 - 00111111 - 01111111 - 00111111 + WRITE(b98)
-1
00000111 - 00111111 - 00111111 - 01111111 - 00011111 + WRITE(b99)
Etc ....
Note that you can only decrease the counter and it is not authorised to write
in the counter a value greater than the old value.
NB: In fact most of the card units don not represent telecom units, but money
units, for exmeple in german cards each telecom unit represent 30 pfennigs.
2.6 - Electrical features:
~~~~~~~~~~~~~~~~~~~~
Maximum ratings:
----------------
| Symbol Min Max Unit
---------------------+---------------------------
Supply voltage | Vcc -0.3 6 V
---------------------+---------------------------
Input voltage | Vss -0.3 6 V
---------------------+---------------------------
Storage temperature | Tstg -20 +55 øC
---------------------+---------------------------
Power dissipassion | Pd - 50 mW
-------------------------------------------------
DC caracteristics:
------------------
| Symbol Min. Typ. Max. Unit
---------------------------+-----------------------------
Suplly current | Icc - - 5 mA
---------------------------+-----------------------------
Input Voltage (low) | Vl 0 - 0.8 V
---------------------------+-----------------------------
Input voltage (high) | Vh 3.5 - Vcc V
---------------------------+-----------------------------
Input current R | Ih - - 100 uA
---------------------------+-----------------------------
Input current Clk | Il - - 100 uA
---------------------------+-----------------------------
Output current (Vol=0.5V) | Iol - - 10 uA
---------------------------+-----------------------------
Output current (Voh=5V) | Ioh - - 0.5 mA
---------------------------------------------------------
AC caracteristics:
------------------
| Symbol | Min. | Max. | Unit |
+----------------------+--------+------+------+------+
| Pulse duration | tr | 50 | - | us |
| R address reset | | | | |
+----------------------+--------+------+------+------+
| Pulse duration | ts | 10 | - | us |
| R write | | | | |
+----------------------+--------+------+------+------+
| High level Clk | th | 8 | - | us |
+----------------------+--------+------+------+------+
| Low level Clk | tl | 12 | - | us |
+----------------------+--------+------+------+------+
| Write window | Twrite | 10 | - | ms |
+----------------------+--------+------+------+------+
| Erase window | Terase | 10 | - | ms |
+----------------------+--------+------+------+------+
| | tv1 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv2 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv3 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv4 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv5 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv6 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv7 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv8 | 10 | - | us |
------------------------------------------------------
III) Schematics of Readers:
=======================
3.1 - Reader 1:
~~~~~~~~~
The following schematics is a very simple one, which will enable you to
read all kind of telecards with a chip, and also other memory cards.
| +5V
|
Centronic /
Port ,/ C 100nF
Presence of *---------------||--------------------,
the card | ,-------------+-------------, |
Pin10 (Ack) --<--------*-----| 1 | 5 |---*--,
R/W | RST +-------\ | /-------+ |
Pin4 (d2) -->--------------| 2 +----+ + 6 | |
Clock +--------| |--------+ |
Pin3 (d1) -->--------------| 3 +----+----+ 7 |---, |
RAZ | RFU +-------/ | \-------+ | |
Pin2 (d0) -->--------------| 4 | 8 | | |
'-------------+-------------' | |
I/O | |
Pin 11 (Busy) --<----------------------------------------------' |
Gnd |
Pin 25 ----------------------------------------------------'
3.2 - Reader 2:
~~~~~~~~~
This Reader which is indeed a reader/writter will enable you to read/write
most of the more current memory cards (and notably telecards), and also smart
cards working under ISO7816 protocol (Credit cards, SIM cards, Health cards,
Videocrypt TV cards, etc ...).
+5V o
|
*-----------------,
| |
,-------------, |
+ | Vcc | + |
SUBD25 ,--|C1+ C2+|--, | K
RS 232 1æF === | | === 1æF | / Smartcard
'--|C1- M C2-|--' | / Connector
RX | A | '-----o' o----*---------------o 1
3 o---------------|TX1 X In2|----------------*---------|---------------o 7
TX | | | ,-------|---------------o 4
2 o----------, -|TX2 2 In1|- 1/3 7406 | | ,-----|---------------o 2
Gnd | | 3 | ,---, ,---, | | | ,---|---------------o 8
7 o-, '----|RX1 2 Out1|--| 1 |o-| 1 |o-* | | | ,-|---------------o 3
| | | '---' '---' | | | | | *---|>|-*-------o 6
""" -|RX2 Out2|- | | | | | | ,-|>|-' ,---o 5
| | | | | | | | | 2xD |
+5V + | | + | | | | | *-|----||---*
o-||--|CV+ Gnd CV-|--||-, | | | | | | | 100nF |
1æF '-------------' 1æF | | | | | | | | """
| | | | | | | | |
SUBD 25 """ """ | | | | | | |c
PRINTER Port | | | | | | \ | PNP
| | | | | | >|---,
D0 - (4) RFU (RAZ) | | | | | | / | ,-,
2 o----------------------------------------------|-' | | | | |e | | 10k
D1 - (3) CLK ,---, ,---, 1/3 7406 | | | | | | | |
3 o-------------------| 1 |o--| 1 |o-------------|---|-|-* | | '-'
D2 - (2) RST (W) '---' '---' | | | | | | |
4 o----------------------------------------------|---' | | | | c \ | NPN
D3 - (8) RFU (FUS) | | | | | >|----,
5 o----------------------------------------------|-----' | | | e / | ,-,
D4 - (7) I/O ,---, 1/6 7406 | | | | | | |
6 o----------------------------| 1 |o--*---------' | | | """ | |
D5 (Desativate Oscillator) '---' | 2xD ,---, | | | 10k '-'
7 o------------------------------------|----|<|-*-| 1 |o-' | | |
D6 (Vpp Command) | ,-|<|-' '---' | | |
8 o------------------------------------|--|----------------|-|--------------'
D7 | | *-|--------,
9 o------x | | | | ,-----'------,
ACK (Presence of the card) | '----------------|-|--|Oscillator F|
10o------------------------------------|-------------------' | '------------'
BUSY (Synchronous Data Output) | | |
11o------------------------------------' | """
GND | F=3.6864MHz
25o-----, |
| 100uH 1N4935 |
""" ,-@@@@@--*-----------|>|--------*----*---------* +21V
| | | | |
| '---|| BUZ11 or | | |
| ,->-|| IRF14 | | |
| |---|'--, ,-, | 1nF |
| | | 330k| | === |
| """ | | | | |
| |6 '-' | |
| ,------------------, | | +| 220æF
| 5| Vcut Ext Vfb |7 | | ===
+12V >--------*-------| MAX 643 |----*----' |
| | LB1 GND COMP | | |
| '------------------' ,-, |
| + |1 |3 |8 | |22k |
*----||----*-----*-----' '-' |
| 10æF | | |
| """ """ """
|
| ,---------,
'----*--| 7805 |--*----> +5V
| '---------' |
100nF === | === 100nF
'-------*-------'
|
"""
Component List
~~~~~~~~~~~~~~
Integratyed Circuits
--------------------
1xMAX232 (RS232<-->TTL Adapter)
1xMAX643 (12-->21V Converter Controler)
1x74LS06 (6 inverters)
1x7805 (5V regulator)
Transistors Diodes
----------- ------
1xBUZ11 or IRF14 4x1N4148 or other
1xBC107 or antoher NPN 1x1N4935 or another fast commutation diode
1xBC177 or another PNP
Condensators Resistors Misc
------------ --------- ----
3x100nF 2x10k 100uH self
1x1nF 1x330k 1xSmartcard connector
1x10æF 1x22k 1xSUBD25 Female
1x220æF 1xSUBD25 Male
4x1æF