The DS1991 MultiKey iButton is a rugged read/write data carrier that acts as three separate electronic
keys, offering 1,152 bits of secure, nonvolatile memory. Each key is 384 bits long with distinct 64-bit
password and public ID fields (Figure 1). The password field must be matched in order to access the
secure memory. Data is transferred serially via the 1-Wire protocol, which requires only a single data lead
and a ground return. The 512-bit scratchpad serves to ensure integrity of data transfers to secure memory.
Data should first be written to the scratchpad where it can be read back. After the data has been verified, a
copy scratchpad command will transfer the data to the secure memory. This process ensures data integrity
when modifying the memory. A 48-bit serial number is factory lasered into each DS1991 to provide a
guaranteed unique identity which allows for absolute traceability. The family code for the DS1991 is 02h.
The durable MicroCan package is highly resistant to environmental hazards such as dirt, moisture and
shock. Its compact button-shaped profile is self-aligning with mating receptacles, allowing the DS1991 to
be easily used by human operators. Accessories permit the DS1991 to be mounted on plastic key fobs,
photo-ID badges, printed-circuit boards or any smooth surface of an object. Applications include secure
access control, debit tokens, work-in-progress tracking, electronic travelers and proprietary data.
The DS1991 is accessed via a single data line using the 1-Wire protocol. The bus master must first
provide one of the four ROM Function Commands, 1) Read ROM, 2) Match ROM, 3) Search ROM, 4)
Skip ROM. These commands operate on the 64-bit lasered ROM portion of each device and can singulate
a specific device if many are present on the 1-Wire line as well as indicate to the bus master how many
and what types of devices are present. The protocol required for these ROM Function Commands is
described in Figure 9. After a ROM Function Command is successfully executed, the memory functions
that operate on the secure memory and the scratchpad become accessible and the bus master may issue
any one of the six Memory Function Commands specific to the DS1991. The protocol for these Memory
Function Commands is described in Figure 5. All data is read and written least significant bit first.
64-BIT LASERED ROM
Each DS1991 contains a unique ROM code that is 64 bits long. The first eight bits are a 1-Wire family
code. The next 48 bits are a unique serial number. The last eight bits are a CRC of the first 56 bits.
(Figure 2.) The 1-Wire CRC is generated using a polynomial generator consisting of a shift register and
XOR gates as shown in Figure 3. The polynomial is X8 + X5 + X4 + 1. Additional information about the
Dallas 1-Wire Cyclic Redundancy Check is available in the Book of DS19xx iButton Standards. The shift
register bits are initialized to zero. Then starting with the least significant bit of the family code, one bit at
a time is shifted in. After the 8th bit of the family code has been entered, then the serial number is
entered. After the 48th bit of the serial number has been entered, the shift register contains the CRC
value. Shifting in the eight bits of CRC should return the shift register to all zeros.
MEMORY FUNCTION COMMANDS
The DS1991 has six device-specific commands. Three scratchpad commands: Write Scratchpad, Read
Scratchpad and Copy Scratchpad and three subkey commands: Write Password, Write Subkey and Read
Subkey. After the device is selected, the memory function command is written to the DS1991. The
command is comprised of three fields, each one byte long. The first byte is the function code field. This
field defines the six commands that can be executed. The second byte is the address field. The first six
bits of this field define the starting address of the command. The last two bits of this field are the subkey
address code. The third byte of the command is a complement of the second byte (Figure 4).
2 of 14