Tamper Detector

Introduction

Tamper detection is a function widely used within critical infrastructure systems such as power meters, water meters, security and fire panels, and any other products where a trigger input needs to be detected and the event recorded in non-volatile memory (Flash memory). The SLG46811 GreenPAK™ mixed-signal IC is ideally suited for this tamper-detection role when paired with the AT45DB161E Flash memory for recording the event.

The complete design file is available here. It was programmed in the GreenPAK Designer software (a part of Go Configure™ Software Hub) that is a free-to-use GUI-based program aimed to create circuit designs.

1. Principle

Figure 1 shows the basic design of the tamper detector. The devices with low pin-count serial Data Flash® interface are the easiest to set up for a tamper detector as we can use the page erase and page write as one instruction while bypassing the Write Enable signal of the Flash before said command => one command Byte, 3 address Bytes and data Bytes (Figure 2 and Table 1). 0x82 is the command to program Main Memory Page through Buffer 1 with Built-In Erase.

CS, MOSI, and CLK pins are configured as Push Pull. Trigger sources that force SLG46811 to write data to flash memory are:

• external signal from GPIO;
• ACMP with low Vdd level detection. When Vdd < 3V, Trigger #1 occurs.

The SLG46811 can operate with flash memory if enable EN input is HIGH.

Figure 1: Tamper Detector Basic Structure

Figure 2: Timing Diagram of Tamper Detector

Table 1: MOSI (SLG46811 as a master, Flash memory as a slave)

The SLG46811 design (Figure 3) sets up the Extended Pattern Generator as a SPI master to generate the command sequence and the specific data for the trigger. While the signal at PIN10 (Trigger #2) goes HIGH and the signal at PIN2 (EN) is HIGH, a LOW-level signal is generated at PIN5 (CS). While CS is LOW the CLK signal is generated at PIN11 (CLK) to clock the command sequence out at PIN12 (MOSI).

DFF9 and DFF5 are used to generate a pulse passing through 4-bit LUT0 and 2-bit LUT2 to trigger one-shot (CNT0). A LOW level of the one-shot generates the CS signal (PIN5). Similarly, the Under-Voltage sequence is generated at MOSI when Vdd drops below the MS ACMP voltage reference.

When Vdd drops below the comparator voltage reference, DFF12 and DFF8 generate a pulse to the 4-bit LUT0, just as with Trigger #2.

DFF3 serves as a frequency divide by 2. DFF2 serves as CLK at PIN11 delayed by 1 clock pulse after CS signal. After data transition the PDLY and 2-bit LUT0 are used to set DFF2 (to 0), and 2-bit LUT1 used to reset DFF3 (to initial value) and EPG (to initial value).

3-bit LUT4, 3-bit LUT9 and 3-bit LUT12 are used for muxing EPG outputs according to trigger conditions.

EPG is used to store pre-programed data. EPG OUT0 generates data while Vdd voltage goes below threshold, and OUT1 generates data relative to the input pulse (at PIN10).

EPG can retain up to 92 bits of pre-programmed data for each output. To change the transaction data size it is necessary to set the CNT0 data (but CNT0 data cannot be more than 92).

Figure 3: Internal Design of tamper detector based on SLG46811 in GreenPAK Designer Software

2. Internal Blocks Configuration

2.1. MS ACMP Configuration

Figure 4: MS ACMP Configuration

2.2. Oscillator Configuration

Figure 5: Oscillator1 Configuration

2.3. EPG Configuration and Data

Figure 6: EPG Configuration

Figure 7: EPG Waveform

2.4. LUTs Configurations

Figure 8: LUTs Configurations

2.5. DFFs Configurations

Figure 9: DFFs Configurations

2.6. Filter / Edge Detector Configuration

Figure 10: Filter / Edge Detector Configuration

2.7. CNT/DLY0 Configuration

Figure 11: CNT/DLY0 (MF0) Configuration

2.8. P DLY Configuration

Figure 12: P DLY Configuration

2.9. IO Pins Configurations

Figure 13: IO Pins Configurations

2.10. I2C Macrocell Configuration

I2C Macrocell uses default settings.

3. Design Verification Using Hardware Prototype

The design was tested in hardware (SLG46811 + AT45DB161 flash), and Figure 14 — Figure 16 show the waveforms sent to the flash memory while hardware prototyping.

Figure 14: EPG OUT0. Data = 5Ah to be stored in Flash Memory

Figure 15: Zoomed EPG OUT0

Figure 16: EPG OUT1. Data = A5h to be stored in Flash

Conclusions

The SLG46811 is a great solution for the development of a simple SPI master to drive flash memory. As usual with the GreenPAK family of products, the tamper and fault detection implementation described in this application is just one of many ways to perform this implementation. Additional advantages of “GreenPAK + AT45DB161E memory implementation” are quick design time, high level of configurability, low power consumption, small board area, and low cost.

Further Considerations

This design could be further enhanced by driving the Output pins to the Flash memory as Tristate when the EN input is driven low. This would allow a host microcontroller to access the Flash to read the Last Trigger results and to use the Flash for general storage. The host micro would need to tristate its CLK, MOSI and /CS pins when it drives the EN pin is high.