BQ27546-G1 Datasheet, PDF (12/38 Pages) Texas Instruments – nullSingle-Cell Li-Ion Battery Fuel Gauge

bq27546-G1
SLUSC53A – MAY 2015 – REVISED DECEMBER 2015
www.ti.com
9.3.5 Communications
9.3.5.1 Authentication
The bq27546-G1 device can act as a SHA-1/HMAC authentication slave by using its internal engine. Sending a
160-bit SHA-1 challenge message to the bq27546-G1 fuel gauge causes the gauge to return a 160-bit digest,
based upon the challenge message and a hidden, 128-bit plain-text authentication key. If this digest matches an
identical one generated by a host or dedicated authentication master, and when operating on the same challenge
message and using the same plain text keys, the authentication process is successful.
9.3.5.2 Key Programming (Data Flash Key)
By default, the bq27546-G1 contains a default plain-text authentication key of
0x0123456789ABCDEFFEDCBA9876543210. This default key is intended for development purposes. It should
be changed to a secret key and the part should be immediately sealed before putting a pack into operation. Once
written, a new plain-text key cannot be read again from the fuel gauge while in SEALED mode.
Once the bq27546-G1 is UNSEALED, the authentication key can be changed from its default value by writing to
the Authenticate() Extended Data Command locations. A 0x00 is written to BlockDataControl() to enable the
authentication data commands. The DataFlashClass() is issued 112 (0x70) to set the Security class. Up to 32
bytes of data can be read directly from the BlockData() (0x40...0x5F) and the authentication key is located at
0x48 (0x40 + 0x08 offset) to 0x57 (0x40 + 0x17 offset). The new authentication key can be written to the
corresponding locations (0x48 to 0x57) using the BlockData() command. The data is transferred to the data flash
when the correct checksum for the whole block (0x40 to 0x5F) is written to BlockDataChecksum() (0x60). The
checksum is (255 – x) where x is the 8-bit summation of the BlockData() (0x40 to 0x5F) on a byte-by-byte basis.
Once the authentication key is written, the gauge can then be sealed again.
9.3.5.3 Key Programming (Secure Memory Key)
The bq27546-G1 secure-memory authentication key is stored in the secure memory of the bq27546-G1 device. If
a secure-memory key has been established, only this key can be used for authentication challenges (the
programmable data flash key is not available). The selected key can only be established/programmed by special
arrangements with TI, using TI’s Secure B-to-B Protocol. The secure-memory key can never be changed or read
from the bq27546-G1 fuel gauge.
9.3.5.4 Executing an Authentication Query
To execute an authentication query in UNSEALED mode, a host must first write 0x01 to the BlockDataControl()
command to enable the authentication data commands. If in SEALED mode, 0x00 must be written to
DataFlashBlock() instead.
Next, the host writes a 20-byte authentication challenge to the Authenticate() address locations (0x40 through
0x53). After a valid checksum for the challenge is written to AuthenticateChecksum(), the bq27546-G1 uses the
challenge to perform the SHA-1/HMAC computation in conjunction with the programmed key. The bq27546-G1
completes the SHA-1/HMAC computation and writes the resulting digest to Authenticate(), overwriting the pre-
existing challenge. The host should wait at least 45 ms to read the resulting digest. The host may then read this
response and compare it against the result created by its own parallel computation.
9.3.5.5 HDQ Single-Pin Serial Interface
The HDQ interface is an asynchronous return-to-one protocol where a processor sends the command code to
the bq27546-G1 device. With HDQ, the least significant bit (LSB) of a data byte (command) or word (data) is
transmitted first. Note that the DATA signal on pin 12 is open-drain and requires an external pull-up resistor. The
8-bit command code consists of two fields: the 7-bit HDQ command code (bits 0–6) and the 1-bit R/W field (MSB
bit 7). The R/W field directs the bq27546-G1 either to
• Store the next 8 or 16 bits of data to a specified register or
• Output 8 bits of data from the specified register.
The HDQ peripheral can transmit and receive data as either an HDQ master or slave.
12
Submit Documentation Feedback
Product Folder Links: bq27546-G1
Copyright © 2015, Texas Instruments Incorporated