Skip to main content

AN-CM-313 Tamper Detector

Contents

Terms and Definitions

DFF D flip flop
DI w/o ST Digital input without Schmidt trigger
EPG Extended pattern generator
IC Integrated Circuit
I2C Inter-integrated circuit (bus)
MS ACMP Multichannel Sampling Analog Comparator
OE Output Enable
SHR Shift register
SPI Serial peripheral interface

References

  1. SLG46811, Datasheet, Dialog Semiconductor
  2. https://en.wikipedia.org/wiki/DataFlash

Authors: Taras Repetylo, Bohdan Kholod

Introduction

Tamper detection is a function widely used within critical infrastructure systems such as power meters, water meters, security and fire panels, and any other products where a trigger input needs to be detected and the event recorded in non-volatile memory (Flash memory). The SLG46811 GreenPAK mixed-signal IC is ideally suited for this tamper-detection role when paired with the AT45DB161E Flash memory for recording the event.

Principle

Figure 1 shows the basic design of the tamper detector. The devices with low pin-count serial Data Flash® interface are the easiest to set up for a tamper detector as we can use the page erase and page write as one instruction while bypassing the Write Enable signal of the Flash before said command => one command Byte, 3 address Bytes and data Bytes (Figure 2 and Table 1). 0x82 is the command to program Main Memory Page through Buffer 1 with Built-In Erase.

CS, MOSI, and CLK pins are configured as Push Pull. Trigger sources that force SLG46811 to write data to flash memory are:

  • external signal from GPIO;
  • ACMP with low Vdd level detection. When Vdd < 3V, Trigger #1 occurs.

SLG46811 can operate with flash memory if enable EN input is HIGH.

Figure 1: Tamper Detector Basic Structure
Figure 2: Timing Diagram of Tamper Detector
Table 1: MOSI (SLG46811 as a master, Flash memory as a slave)

EPG OUTX

CMD

Addr

Addr

Addr

Data

EPG OUT0

0x82

F1

00

00

5A

EPG OUT1

0x82

F1

40

00

A5

The SLG46811 design (Figure 3) sets up the Extended Pattern Generator as a SPI master to generate the command sequence and the specific data for the trigger. While the signal at PIN10 (Trigger #2) goes HIGH and the signal at PIN2 (EN) is HIGH, a LOW-level signal is generated at PIN5 (CS). While CS is LOW the CLK signal is generated at PIN11 (CLK) to clock the command sequence out at PIN12 (MOSI).

DFF9 and DFF5 are used to generate a pulse passing through 4-bit LUT0 and 2-bit LUT2 to trigger one-shot (CNT0). A LOW level of the one-shot generates the CS signal (PIN5). Similarly, the Under-Voltage sequence is generated at MOSI when Vdd drops below the MS ACMP voltage reference.

When Vdd drops below the comparator voltage reference, DFF12 and DFF8 generate a pulse to the 4-bit LUT0, just as with Trigger #2.

DFF3 serves as a frequency divide by 2. DFF2 serves as CLK at PIN11 delayed by 1 clock pulse after CS signal. After data transition the PDLY and 2-bit LUT0 are used to set DFF2 (to 0), and 2-bit LUT1 used to reset DFF3 (to initial value) and EPG (to initial value).

3-bit LUT4, 3-bit LUT9 and 3-bit LUT12 are used for muxing EPG outputs according to trigger conditions.

EPG is used to store pre-programed data. EPG OUT0 generates data while Vdd voltage goes below threshold, and OUT1 generates data relative to the input pulse (at PIN10).

EPG can retain up to 92 bits of pre-programmed data for each output. To change the transaction data size it is necessary to set the CNT0 data (but CNT0 data cannot be more than 92).

Figure 3: Internal Design of tamper detector based on SLG46811 in GreenPAK Designer Software

Internal Blocks Configuration

MS ACMP Configuration

Figure 4: MS ACMP Configuration

Oscillator Configuration

Figure 5: Oscillator1 Configuration

EPG Configuration and Data

Figure 6: EPG Configuration
Figure 7: EPG Waveform

LUTs Configurations

Figure 8: LUTs Configurations

DFFs Configurations

Figure 9: DFFs Configurations

Filter / Edge Detector Configuration

Figure 10: Filter / Edge Detector Configuration

CNT/DLY0 Configuration

Figure 11: CNT/DLY0 (MF0) Configuration

P DLY Configuration

Figure 12: P DLY Configuration

IO Pins Configurations

Figure 13: IO Pins Configurations

I2C Macrocell Configuration

I2C Macrocell uses default settings.

Design Verification Using Hardware Prototype

The design was tested in hardware (SLG46811 + AT45DB161 flash), and Error! Reference source not found. - Figure 16 show the waveforms sent to the flash memory while hardware prototyping.

Figure 14: EPG OUT0. Data = 5Ah to be stored in Flash Memory
Figure 15: Zoomed EPG OUT0
Figure 16: EPG OUT1. Data = A5h to be stored in Flash

Conclusions

Dialog SLG46811 is a great solution for the development of a simple SPI master to drive flash memory. As usual with the GreenPAK family of products, the tamper and fault detection implementation described in this application is just one of many ways to perform this implementation. Additional advantages of "GreenPAK + AT45DB161E memory implementation" are quick design time, high level of configurability, low power consumption, small board area, and low cost.

Further Considerations

This design could be further enhanced by driving the Output pins to the Flash memory as Tristate when the EN input is driven low. This would allow a host microcontroller to access the Flash to read the Last Trigger results and to use the Flash for general storage. The host micro would need to tristate its CLK, MOSI and /CS pins when it drives the EN pin is high.