M41ST87W 5.0 and 3.3/3.0 V secure serial RTC and NVRAM supervisor with tamper detection and 128 bytes of clearable NVRAM Datasheet - production data • Two independent power-fail comparators (1.25 V reference) • Counters for tenths/hundredths of seconds, seconds, minutes, hours, day, date, month, 28-pin, (300 mil) year, and century SOX28, embedded crystal • 128 bytes of clearable, general purpose NVRAM • Programmable alarm and interrupt function (valid even during battery backup mode) • Programmable watchdog timer SSOP20 • Unique electronic serial number (8-byte) • 32 kHz frequency output available upon Features power-on • Microprocessor power-on reset output • 5.0, 3.3, or 3.0 V operation • 400 kHz I2C bus • Battery low flag • Ultra-low battery supply current of 500 nA • NVRAM supervisor to non-volatize external (typ) LPSRAM • 2.5 to 5.5 V oscillator operating voltage Security features • Automatic switchover and deselect circuitry • Choice of power-fail deselect voltages • Tamper indication circuits with timestamp − M41ST87Y: (not recommended for new and RAM clear design, contact ST sales office for • LPSRAM clear function (TP ) CLR availability) • Packaging includes a 28-lead, embedded THS = 1: VPFD≈ 4.63 V; crystal SOIC and a 20-lead SSOP VCC = 4.75 to 5.5 V • Oscillator stop detection THS = 0: V ≈ 4.37 V; PFD V = 4.5 to 5.5 V CC − M41ST87W: THS = 1: V ≈ 2.9 V; PFD V = 3.0 to 3.6 V CC THS = 0: V ≈ 2.63 V; PFD V = 2.7 to 3.6 V CC May 2016 DocID9497 Rev 11 1/54 This is information on a product in full production. www.st.com

Contents M41ST87W Contents 1 Description....................................................................................... 6 2 Operating modes ........................................................................... 12 2.1 2-wire bus characteristics ................................................................ 13 2.1.1 Bus not busy ..................................................................................... 13 2.1.2 Start data transfer ............................................................................. 13 2.1.3 Stop data transfer ............................................................................. 13 2.1.4 Data valid .......................................................................................... 13 2.1.5 Acknowledge .................................................................................... 13 2.2 READ mode .................................................................................... 15 2.3 WRITE mode ................................................................................... 17 2.4 Data retention mode ........................................................................ 17 2.5 Tamper detection circuit .................................................................. 18 2.6 Tamper register bits (tamper 1 and tamper 2) ................................. 18 2.6.1 Tamper enable bits (TEB1 and TEB2) ............................................. 18 2.6.2 Tamper bits (TB1 and TB2) .............................................................. 18 2.6.3 Tamper interrupt enable bits (TIE1 and TIE2) .................................. 19 2.6.4 Tamper connect mode bit (TCM1 and TCM2) ................................. 19 2.6.5 Tamper polarity mode bits (TPM1 and TPM2) ................................. 19 2.6.6 Tamper detect sampling (TDS1 and TDS2) ..................................... 21 2.6.7 Tamper current high/tamper current low (TCHI/ 1 and TCHI/ 2) .................................................................................................... 21 𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓 2.6.8 RAM clear (CLR1 and CLR2) ........................................................... 21 𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓 2.6.9 RAM clear external (CLR1 and CLR2 ) - available in SOX28 EXT EXT package only .................................................................................................... 21 2.7 Tamper detection operation ............................................................ 25 2.8 Sampling ......................................................................................... 25 2.9 Internal tamper pull-up/down current ............................................... 26 2.10 Avoiding inadvertent tampers (normally closed configuration) ........ 26 2.11 Tamper event time-stamp ............................................................... 27 3 Clock operation ............................................................................. 28 3.1 Power-down time-stamp ................................................................. 28 3.2 TIMEKEEPER® registers................................................................. 29 3.3 Calibrating the clock ........................................................................ 31 3.4 Setting alarm clock registers ........................................................... 32 3.5 Watchdog timer ............................................................................... 34 2/54 DocID9497 Rev 11

M41ST87W Contents 3.6 Square wave output ........................................................................ 35 3.7 Full-time 32 kHz square wave output .............................................. 36 3.8 Power-on reset ................................................................................ 36 3.9 Reset inputs ( and ) ................................................ 36 3.10 Power-fail comparators (1 and 2) .................................................... 37 𝐑𝐑𝐑𝐑𝐓𝐓𝐑𝐑𝐑𝐑𝐑𝐑 𝐑𝐑𝐑𝐑𝐓𝐓𝐑𝐑𝐑𝐑𝐑𝐑 3.11 Power-fail outputs ........................................................................... 37 3.12 Century bits ..................................................................................... 38 3.13 Output driver pin .............................................................................. 38 3.14 Battery low warning ......................................................................... 38 3.15 t bit ............................................................................................... 39 rec 3.16 Electronic serial number .................................................................. 39 3.17 Oscillator stop detection .................................................................. 39 3.18 Initial power-on defaults .................................................................. 40 4 Maximum ratings ........................................................................... 41 5 DC and AC parameters ................................................................. 42 6 Package information ..................................................................... 46 6.1 SOX28 package information ........................................................... 46 6.2 SSOP20 package information ......................................................... 48 7 Packing information ...................................................................... 49 7.1 SOX28 carrier tape ......................................................................... 49 7.2 SSOP20 carrier tape ....................................................................... 50 7.3 Reel information for SOX28 and SSOP20 ...................................... 51 8 Part numbering .............................................................................. 52 9 Revision history ............................................................................ 53 DocID9497 Rev 11 3/54

List of tables M41ST87W List of tables Table 1: Signal names ................................................................................................................................ 9 Table 2: I2C slave address ........................................................................................................................ 12 Table 3: AC characteristics ....................................................................................................................... 15 Table 4: Tamper detection truth table ....................................................................................................... 20 Table 5: Tamper detection current (normally closed - TCMX = '0') .......................................................... 22 Table 6: Tamper detect timing .................................................................................................................. 24 Table 7: Calculated cutoff frequency for typical capacitance and resistance values ............................... 26 Table 8: TIMEKEEPER® register map ...................................................................................................... 29 Table 9: Alarm repeat modes ................................................................................................................... 33 Table 10: Square wave output frequency ................................................................................................. 35 Table 11: Reset AC characteristics .......................................................................................................... 37 Table 12: Century bits examples .............................................................................................................. 38 Table 13: trec definitions ........................................................................................................................... 39 Table 14: Default values ........................................................................................................................... 40 Table 15: Default values ........................................................................................................................... 40 Table 16: Absolute maximum ratings ....................................................................................................... 41 Table 17: DC and AC measurement conditions ....................................................................................... 42 Table 18: Capacitance .............................................................................................................................. 42 Table 19: DC characteristics ..................................................................................................................... 43 Table 20: Crystal electrical characteristics ............................................................................................... 44 Table 21: Power down/up AC characteristics ........................................................................................... 45 Table 22: SOX28 – 28-lead plastic small outline, 300 mils, embedded crystal package mechanical data .................................................................................................................................................................. 47 Table 23: SSOP20 – 20-lead, shrink, small outline package mechanical data ........................................ 48 Table 24: Carrier tape dimensions for SOX28 package ........................................................................... 49 Table 25: Reel dimensions for 24 mm carrier tape (SOX28 package) and 16 mm carrier tape (SSOP20 package) ................................................................................................................................................... 51 Table 26: Ordering information scheme ................................................................................................... 52 Table 27: Document revision history ........................................................................................................ 53 4/54 DocID9497 Rev 11

M41ST87W List of figures List of figures Figure 1: Logic diagram .............................................................................................................................. 7 Figure 2: 28-pin, 300 mil SOIC connections ............................................................................................... 8 Figure 3: 20-pin, SSOP connections .......................................................................................................... 8 Figure 4: Block diagram ............................................................................................................................ 10 Figure 5: Hardware hookup ...................................................................................................................... 11 Figure 6: Serial bus data transfer sequence ............................................................................................. 14 Figure 7: Acknowledgement sequence..................................................................................................... 14 Figure 8: Bus timing requirements sequence ........................................................................................... 14 Figure 9: Slave address location .............................................................................................................. 16 Figure 10: READ mode sequence ............................................................................................................ 16 Figure 11: Alternate READ mode sequence ............................................................................................ 16 Figure 12: WRITE mode sequence .......................................................................................................... 17 Figure 13: WRITE cycle timing: RTC and external SRAM control signals ............................................... 17 Figure 14: Tamper detect connection options .......................................................................................... 19 Figure 15: Basic tamper detect options .................................................................................................... 20 Figure 16: Tamper detect output options .................................................................................................. 20 Figure 17: Tamper detect sampling options ............................................................................................. 22 Figure 18: Tamper current options ........................................................................................................... 23 Figure 19: Tamper output timing (with CLR1EXT or CLR2EXT = '1') - available in SOX28 package only .................................................................................................................................................................. 23 Figure 20: RAM clear hardware hookup (SOX28 package only) ............................................................. 24 Figure 21: Low-pass filter implementation for noise immunity.................................................................. 26 Figure 22: Crystal accuracy across temperature ...................................................................................... 32 Figure 23: Calibration waveform ............................................................................................................... 32 Figure 24: Alarm interrupt reset waveform ............................................................................................... 33 Figure 25: Backup mode alarm waveform ................................................................................................ 34 Figure 26: and timing waveforms .................................................................................. 36 Figure 27: AC testing input/output waveforms .......................................................................................... 42 Figure 28: P𝐑𝐑o𝐑𝐑𝐓𝐓w𝐑𝐑e𝐑𝐑r 𝐑𝐑down/𝐑𝐑up𝐑𝐑 𝐓𝐓m𝐑𝐑𝐑𝐑od𝐑𝐑e AC waveforms ..................................................................................... 45 Figure 29: SOX28 – 28-lead plastic small outline, 300 mils, embedded crystal package outline ............ 46 Figure 30: SSOP20 – 20-lead, shrink, small outline package outline ...................................................... 48 Figure 31: Carrier tape for SOX28 package ............................................................................................. 49 Figure 32: Carrier tape for SSOP20 package ........................................................................................... 50 Figure 33: Reel schematic ........................................................................................................................ 51 DocID9497 Rev 11 5/54

Description M41ST87W 1 Description The M41ST87Y/W secure serial RTC and NVRAM supervisor is a low power 1280-bit, static CMOS SRAM organized as 160 bytes by 8 bits. A built-in 32.768 kHz oscillator (internal crystal-controlled) and 8 bytes of the SRAM are used for the clock/calendar function and are configured in binary coded decimal (BCD) format. An additional 11 bytes of RAM provide calibration, status/control of alarm, watchdog, tamper, and square wave functions. 8 bytes of ROM and finally 128 bytes of user RAM are also provided. Addresses and data are transferred serially via a two line, bidirectional I2C interface. The built-in address register is incremented automatically after each WRITE or READ data byte. The M41ST87Y/W has a built-in power sense circuit which detects power failures and automatically switches to the battery supply when a power failure occurs. The energy needed to sustain the SRAM and clock operations can be supplied by a small lithium button-cell supply when a power failure occurs. Functions available to the user include a non-volatile, time-of-day clock/calendar, alarm interrupts, tamper detection, watchdog timer, and programmable square wave output. Other features include a power-on reset as well as two additional debounced inputs ( and ) which can also generate an output reset ( ). The eight clock address locations contain the century, year, month, date, day, hour, minute, second and teRnStThIsN/h1undreRdStThsIN o2f a second in 24-hour BCD format. CorrectioRnSsT for 28, 29 (leap year), 30 and 31 day months are made automatically. Security features Two fully independent tamper detection Inputs allow monitoring of multiple locations within the system. User programmable bits provide both normally open and normally closed switch monitoring. Time stamping of the tamper event is automatically provided. There is also an option allowing data stored in either internal memory (128 bytes), and/or external memory to be cleared, protecting sensitive information in the event tampering occurs. By embedding the 32 kHz crystal in the SOX28 package, the clock is completely isolated from external tampering. An oscillator fail bit (OF) is also provided to ensure correct operation of the oscillator. The M41ST87Y/W is supplied in a 28-pin, 300 mil SOIC package which includes an embedded 32 kHz crystal and a 20-pin SSOP package for use with an external crystal. The SOIC and SSOP packages are shipped in plastic anti-static tubes or in tape and reel form. The 300 mil, embedded crystal SOIC requires only a user-supplied battery to provide non- volatile operation. 6/54 DocID9497 Rev 11

M41ST87W Description Figure 1: Logic diagram VCC VBAT (4) XI (4) VOUT XO (1) IRQ/OUT SCL (2) SDA SQW/FT (3) (3) EX ECON RSTIN1 (1) (3) RST RSTIN2 M41ST87Y (1) (3) M41ST87W F32k WDI (2) PFI1 PFO1 (2) PFI2 PFO2 TP1IN (3) TPCLR TP2IN VSS 1. Open drain output. 2. Programmable output (open drain or full-CMOS). Defaults to open drain on first power-up. 3. Available in SOX28 package only. 4. Available in SSOP package only. DocID9497 Rev 11 7/54

Description M41ST87W Figure 2: 28-pin, 300 mil SOIC connections NF 1 28 VCC NF 2 27 EX NF 3 26 IRQ/OUT NF 4 25 VOUT NC 5 24 TP2IN NC 6 23 PFI1 PFO 2 7 M41ST87Y 22 SCL SQW/FT 8 M41ST87W 21 F32k WDI 9 20 TP1IN RSTIN1 10 19 RST RSTIN2 11 18 TPCLR PFO 1 12 17 SDA PFI2 13 16 ECON VSS 14 15 VBAT Note: No function (NF) and no connect (NC) pins should be tied to V . Pins 1, 2, 3, and 4 SS are internally shorted together. Figure 3: 20-pin, SSOP connections VCC 1 20 IRQ/OUT XI 2 19 VOUT XO 3 18 TP2IN NC 4 17 PFI1 PFO2 5 M41ST87Y 16 SCL SQW/FT 6 M41ST87W 15 F32k RSTIN1 7 14 TP1IN PFO 1 8 13 RST PFI2 9 12 SDA VSS 10 11 VBAT Note: No connect (NC) pin should be tied to V . SS 8/54 DocID9497 Rev 11

M41ST87W Description Table 1: Signal names XI (1) Oscillator input XO(1) Oscillator output E̅ CON(2) Conditioned chip enable output (2) External chip enable EX /OUT (3) Interrupt/out output (open drain) IPRFQI1 Power fail input 1 PFI2 Power fail input 2 1(4) Power fail output 1 PFO2(4) Power fail output 2 PFO(3) Reset output (open drain) RST Reset 1 input RSTIN1(2) Reset 2 input SCL Serial clock input RSTIN2 SDA Serial data input/output SQW/FT(4) Square wave output/frequency test WDI(2) Watchdog input VCC Supply voltage VOUT Voltage output VSS Ground F32k(3) 32 kHz square wave output (open drain) TP1IN Tamper pin 1 input TP2IN Tamper pin 2 input TPCLR(2) Tamper pin RAM clear VBAT Positive battery pin input NF (5) No function NC(5) No connect Notes: (1)Available in SSOP package only. (2)Available in SOX28 package only. (3)Open drain output. (4)Programmable output (open drain or full-CMOS). (5)Should be connected to VSS. DocID9497 Rev 11 9/54

Description M41ST87W Figure 4: Block diagram REALTIME CLOCK CALENDAR 128 BYTES SDA USER RAM I2C 8 BYTESROM INTERFACE OFIE RTC w/ALARM SCL & CALIBRATION AFE Crystal(4) XI WATCHDOG WDS IRQ/OUT(1) 32KHz VOUT XO OSCILLATOR SQUAREWAVE SQW/FT(2) CLRX TIEX 2 WDI(3) TAMPER TPCLR(3) CLRXEXT TPXIN VCC VOUT VBAT F32k(1) BL VSS VBL COMPARE VSO COMPARE VPFD COMPARE POR RST(1) RSTIN1 (3) RSTIN2 EX(3) ECON(3) PFI1 COMPARE PFO1(2) 1.25V (Internal) PFI2 COMPARE PFO2(2) 1.25V (Internal) 1. Open drain output. 2. Programmable output (open drain or full-CMOS); if open drain option is selected and if pulled-up to supply other than V , this supply must be equal to, or less than V CC BAT when V = 0 V (during battery backup mode). CC 3. Available in SOX28 package only. 4. Crystal is external on SSOP package and internal for the SOX28 package. 10/54 DocID9497 Rev 11

M41ST87W Description Figure 5: Hardware hookup M41ST87Y/W Unregulated (1) Voltage VIN VCC VCC TPCLR 5V Regulator TP1IN VOUT VCC (1) TP2IN ECON E (1) EX VIN3.3VVCC SCL LoSwR-PAoMwer Regulator (1) WDI SDA For monitoring of additional RSTIN1 RST To Microprocessor voltage sources RSTIN2(1) SQW/FT To LED Display Pushbutton R1 R3 Reset PFO1 To NMI PFI1 PFO2 R2 PFI2 IRQ/OUT To INT VSS R4 VBAT F32k To 32kHz 1. Available in SOX28 package only. DocID9497 Rev 11 11/54

Operating modes M41ST87W 2 Operating modes The M41ST87Y/W clock operates as a slave device on the serial bus. Access is obtained by implementing a start condition followed by the correct slave address (D0h). Table 2: I2C slave address 7-bit I2C slave address 0x68 Write: 0xD0 8-bit I2C slave address Read: 0xD1 The 160 bytes contained in the device can then be accessed sequentially in the following order: 00h. Tenths/hundredths of a second register 01h. Seconds register 02h. Minutes register 03h. Century/hours register 04h. Day register 05h. Date register 06h. Month register 07h. Year register 08h. Control register 09h. Watchdog register 0Ah-0Eh. Alarm registers 0Fh. Flag register 10h-12h. Reserved 13h. Square wave 14h. Tamper register 1 15h. Tamper register 2 16h-1Dh. Serial number (8 bytes) 1Eh-1Fh. Reserved (2 bytes) 20h-9Fh. User RAM (128 bytes) The M41ST87Y/W clock continually monitors V for an out-of-tolerance condition. Should CC V fall below V , the device terminates an access in progress and resets the device CC PFD address counter. Inputs to the device will not be recognized at this time to prevent erroneous data from being written to the device from a an out-of-tolerance system. When V falls below V , the device automatically switches over to the battery and powers down CC SO into an ultra low current mode of operation to conserve battery life. As system power returns and V rises above V , the battery is disconnected, and the device is switched to CC SO external V . CC Write protection continues until t (min) elapses after V reaches V (min). rec CC PFD For more information on battery storage life refer to application note AN1012. 12/54 DocID9497 Rev 11

M41ST87W Operating modes 2.1 2-wire bus characteristics The bus is intended for communication between different ICs. It consists of two lines: a clock signal (SCL) and a bidirectional data signal (SDA). The SDA line must be connected to a positive supply voltage via a pull-up resistor. The following protocol has been defined: • Data transfer may be initiated only when the bus is not busy. • During data transfer, the data line must remain stable whenever the clock line is high. • Changes in the data line, while the clock line is high, will be interpreted as control signals. Accordingly, the following bus conditions have been defined: 2.1.1 Bus not busy Both data and clock lines remain high. 2.1.2 Start data transfer A change in the state of the data line, from high to low, while the clock is high, defines the START condition. 2.1.3 Stop data transfer A change in the state of the data line, from low to high, while the clock is high, defines the STOP condition. 2.1.4 Data valid The state of the data line represents valid data when, after a start condition, the data line is stable for the duration of the high period of the clock signal. The data on the line may be changed during the low period of the clock signal. There is one clock pulse per bit of data. Each data transfer is initiated with a start condition and terminated with a stop condition. The number of data bytes transferred between the start and stop conditions is not limited. The information is transmitted byte-wide and each receiver acknowledges with a ninth bit. By definition a device that gives out a message is called “transmitter,” the receiving device that gets the message is called “receiver.” The device that controls the message is called “master.” The devices that are controlled by the master are called “slaves.” 2.1.5 Acknowledge Each byte of eight bits is followed by one acknowledge bit. This acknowledge bit is a low level put on the bus by the receiver whereas the master generates an extra acknowledge related clock pulse. A slave receiver which is addressed is obliged to generate an acknowledge after the reception of each byte that has been clocked out of the transmitter. The device that acknowledges has to pull down the SDA line during the acknowledge clock pulse in such a way that the SDA line is a stable low during the high period of the acknowledge related clock pulse. Of course, setup and hold times must be taken into account. A master receiver must signal an end of data to the slave transmitter by not generating an acknowledge on the last byte that has been clocked out of the slave. In this case the transmitter must leave the data line high to enable the master to generate the STOP condition. DocID9497 Rev 11 13/54

Operating modes M41ST87W Figure 6: Serial bus data transfer sequence DATA LINE STABLE DATAVALID CLOCK DATA START CHANGE OF STOP CONDITION DATAALLOWED CONDITION Figure 7: Acknowledgement sequence CLOCK PULSE FOR START ACKNOWLEDGEMENT SCL FROM 1 2 8 9 MASTER DATA OUTPUT MSB LSB BY TRANSMITTER DATA OUTPUT BY RECEIVER Figure 8: Bus timing requirements sequence SDA tBUF tHD:STA tHD:STA tR tF SCL tHIGH tSU:DAT tSU:STA tSU:STO P S tLOW tHD:DAT SR P 14/54 DocID9497 Rev 11

M41ST87W Operating modes Table 3: AC characteristics Symbol Parameter (1) Min Max Unit f SCL SCL clock frequency 0 400 kHz tBUF Time the bus must be free before a new transmission can start 1.3 µs M41ST87Y 10 ns tEXPD(2) to E̅CON propagation delay M41ST87W 15 ns EX tF SDA and SCL fall time 300 ns tHD:DAT(3) Data hold time 0 µs START condition hold time tHD:STA (after this period the first clock pulse is generated) 600 ns tHIGH Clock high period 600 ns tLOW Clock low period 1.3 µs tR SDA and SCL rise time 300 ns tSU:DAT Data setup time 100 ns START condition setup time tSU:STA (only relevant for a repeated start condition) 600 ns tSU:STO STOP condition setup time 600 ns Notes: (1)Valid for ambient operating temperature: TA = –40 to 85 °C; VCC = 4.5 to 5.5 V or 2.7 to 3.6 V (except where noted). (2)Available in SOX28 package only. (3)Transmitter must internally provide a hold time to bridge the undefined region (300 ns max) of the falling edge of SCL. 2.2 READ mode In this mode the master reads the M41ST87Y/W slave after setting the slave address (see Figure 9: "Slave address location"). Following the WRITE mode control bit (R/W̅ =0) and the acknowledge bit, the word address 'An' is written to the on-chip address pointer. Next the START condition and slave address are repeated followed by the READ mode control bit (R/W̅ =1). At this point the master transmitter becomes the master receiver. The data byte which was addressed will be transmitted and the master receiver will send an acknowledge bit to the slave transmitter. The address pointer is only incremented on reception of an acknowledge clock. The M41ST87Y/W slave transmitter will now place the data byte at address An+1 on the bus, the master receiver reads and acknowledges the new byte and the address pointer is incremented to An+2. This cycle of reading consecutive addresses will continue until the master receiver sends a STOP condition to the slave transmitter (see Figure 10: "READ mode sequence"). The system-to-user transfer of clock data will be halted whenever the address being read is a clock address (00h to 07h). The update will resume either due to a stop condition or when the pointer increments to a non-clock or RAM address. Note: This is true both in READ mode and WRITE mode. An alternate READ mode may also be implemented whereby the master reads the M41ST87Y/W slave without first writing to the (volatile) address pointer. The first address that is read is the last one stored in the pointer (see Figure 11: "Alternate READ mode sequence"). DocID9497 Rev 11 15/54

Operating modes M41ST87W Figure 9: Slave address location R/W START SLAVEADDRESS A B S B M S L 1 1 0 1 0 0 0 Figure 10: READ mode sequence T T R R MBUASSTAECRTIVITY: STA R/W STA R/W WORD SDA LINE S S DATA n DATA n+1 ADDRESS (An) K K K K K BUSACTIVITY: C C C C C A A A A A SLAVE SLAVE ADDRESS ADDRESS P O T S DATA n+X P K C A O N Figure 11: Alternate READ mode sequence T R P BMUASSTAECRTIVITY: STA R/W STO SDA LINE S DATA n DATA n+1 DATA n+X P K K K K K BUSACTIVITY: C C C C C A A A A A O N SLAVE ADDRESS 16/54 DocID9497 Rev 11

M41ST87W Operating modes 2.3 WRITE mode In this mode the master transmitter transmits to the M41ST87Y/W slave receiver. Bus protocol is shown in Figure 12: "WRITE mode sequence". Following the START condition and slave address, a logic '0' (R/W̅ = 0) is placed on the bus and indicates to the addressed device that word address An will follow and is to be written to the on-chip address pointer. The data word to be written to the memory is strobed in next and the internal address pointer is incremented to the next memory location within the RAM on the reception of an acknowledge clock. The M41ST87Y/W slave receiver will send an acknowledge clock to the master transmitter after it has received the slave address (see Figure 9: "Slave address location") and again after it has received the word address and each data byte. Figure 12: WRITE mode sequence RT P BMUASSTAECRTIVITY: STA R/W STO WORD SDA LINE S DATA n DATA n+1 DATA n+X P ADDRESS (An) K K K K K BUSACTIVITY: C C C C C A A A A A SLAVE ADDRESS Figure 13: WRITE cycle timing: RTC and external SRAM control signals (1) EX tEXPD tEXPD (1) ECON 1. Available in SOX28 package only. 2.4 Data retention mode With valid V applied, the M41ST87Y/W can be accessed as described above with READ CC or WRITE cycles. Should the supply voltage decay, the M41ST87Y/W will automatically deselect, write protecting itself (and any external SRAM) when V falls between V CC PFD (max) and V (min) (see Figure 28: "Power down/up mode AC waveforms", Table 21: PFD "Power down/up AC characteristics"). This is accomplished by internally inhibiting access to the clock registers. At this time, the reset pin ( ) is driven active and will remain active until V returns to nominal levels. External RAM access is inhibited in a similar manner by CC forcing E̅ to a high level. This level is within 0.R2S vTolts of the V . E̅ will remain at this CON BAT CON level as long as V remains at an out-of-tolerance condition. When V falls below the CC CC battery backup switchover voltage (V ), power input is switched from the V pin to the SO CC battery, and the clock registers and external SRAM are maintained from the attached battery supply. All signal outputs become high impedance. The V pin is capable of supplying 100 µA of OUT current to the attached memory with less than 0.3 volts drop under this condition. On power up, when V returns to a nominal value, write protection continues for t by inhibiting CC rec DocID9497 Rev 11 17/54

Operating modes M41ST87W E̅ . The signal also remains active during this time (see Figure 28: "Power down/up CON mode AC waveforms"). RST Note: Most low power SRAMs on the market today can be used with the M41ST87Y/W RTC SUPERVISOR. There are, however some criteria which should be used in making the final choice of an SRAM to use. The SRAM must be designed in a way where the chip enable input disables all other inputs to the SRAM. This allows inputs to the M41ST87Y/W and SRAMs to be “Don’t Care” once V falls below V (min). The SRAM should also CC PFD guarantee data retention down to V = 2.0 volts. The chip enable access time must be CC sufficient to meet the system needs with the chip enable output propagation delays included. If the SRAM includes a second chip enable pin (E2), this pin should be tied to V . OUT If data retention lifetime is a critical parameter for the system, it is important to review the data retention current specifications for the particular SRAMs being evaluated. Most SRAMs specify a data retention current at 3.0 volts. Manufacturers generally specify a typical condition for room temperature along with a worst case condition (generally at elevated temperatures). The system level requirements will determine the choice of which value to use. The data retention current value of the SRAMs can then be added to the I BAT value of the M41ST87Y/W to determine the total current requirements for data retention. The available battery capacity for the battery of your choice can then be divided by this current to determine the amount of data retention available. For a further more detailed review of lifetime calculations, please see application note AN1012. 2.5 Tamper detection circuit The M41ST87Y/W provides two independent input pins, the tamper pin 1 input (TP1 ) and IN tamper pin 2 input (TP2 ), which can be used to monitor two separate signals which can IN result in the associated setting of the tamper bits (TB1 and/or TB2, in flag register 0Fh) if the tamper enable bits (TEB1 and/or TEB2) are enabled, for the respective tamper 1 or tamper 2 channels. The TP1 pin or TP2 pin may be set to indicate a tamper event has IN IN occurred by either 1) closing a switch to ground or V (normally open), or by 2) opening a OUT switch that was previously closed to ground or V (normally closed), depending on the OUT state of the TCM bits and the TPM bits in the tamper register (14h and/or 15h). X X 2.6 Tamper register bits (tamper 1 and tamper 2) 2.6.1 Tamper enable bits (TEB1 and TEB2) When set to a logic '1,' this bit will enable the tamper detection circuit. This bit must be set to '0' in order to clear the associated tamper bits (TB , in 0Fh). X Note: TEB should be cleared then set again whenever the tamper detect condition is X modified. When servicing a tamper interrupt, the TEB bits must be cleared to clear the TB bits, then x x set to 1 to again enable the tamper detect circuits. 2.6.2 Tamper bits (TB1 and TB2) If the TEB bit is set, and a tamper condition occurs, the TB bit will be set to '1.' This bit is X X “Read-only” and is reset only by setting the TEB bit to '0.' These bits are located in the X flags register 0Fh. 18/54 DocID9497 Rev 11

M41ST87W Operating modes 2.6.3 Tamper interrupt enable bits (TIE1 and TIE2) If this bit is set to a logic '1,' the /OUT pin will be activated when a tamper event occurs. This function is also valid in battery backup if the ABE bit (alarm in battery backup) is also set to '1' (see Figure 15: "Basic tIaRmQper detect options"). Note: In order to avoid an inadvertent activation of the /OUT pin due to a prior tamper event, the flag register (0Fh) should be read prior to clearing and again setting the TEB X bit. IRQ 2.6.4 Tamper connect mode bit (TCM1 and TCM2) This bit indicates whether the position of the external switch selected by the user is in the normally open (TCM = '1') or normally closed (TCM = '0') position (see Figure 14: X X "Tamper detect connection options" and Figure 16: "Tamper detect output options"). 2.6.5 Tamper polarity mode bits (TPM1 and TPM2) The state of this bit indicates whether the tamper pin input will be taken high (to V if OUT TPM = '1') or low (to V if TPM = '0') to trigger a tamper event (see Figure 14: "Tamper X SS X detect connection options" and Figure 16: "Tamper detect output options"). Figure 14: Tamper detect connection options TAMPER LO TAMPER HI (TPMX = 0) (TPMX = 1) I. II. (1) NORMALLY VOUT OPEN TPIN (TCMX = 1) TPIN III. IV. VOUT(2) VCC VOUT (Int) TPIN (3) NORMALLY CLOSED TCHI/TCLO = 1 TCHI/TCLO = 0 TCHI/TCLO = 1 TCHI/TCLO = 0 (TCMX = 0) Note: These options are summarized in Table 4: "Tamper detection truth table". 1. If the CLRX bit is set, a second tamper to V (TPM2 = '1') during t will not be EXT OUT CLR detected. 2. If the CLRX bit is set, a second tamper to V (TPM2 = '1') will trigger EXT OUT automatically. 3. Optional external resistor to V allows the user to bypass sampling when power is CC “on.” DocID9497 Rev 11 19/54

Operating modes M41ST87W Table 4: Tamper detection truth table Option Mode TCMX TPMX I Normally open/tamper to GND (1) 1 0 II Normally open/tamper to VOUT(1) 1 1 III Normally closed/tamper to GND 0 0 IV Normally closed/tamper to VOUT 0 1 Notes: (1)No battery current drawn during battery backup. Figure 15: Basic tamper detect options Triggering Event Tamper Event Output VCC (VOUT) TCMX,TPMX= 1,1 IRQ - Interrupt the TIE processor on tamper TAMPER H,I X NORMALLY OPEN VCC (VOUT) TCMX,TPMX= 0,0 TP - Clearexternal TAMPER LO, ConfUigsuerration CLRX RACMLR on tamper(1) NORMALLY CLOSED EXT TCMX,TPMX= 1,0 CLRX NOTRAMMAPLELYR OLPOE,N VCC (VOUT) CRLARM -o Cnl etaamr ipneterrnal TCM,TPM X X Time stamp tamper TCMX,TPMX= 0,1 event TAMPER H,I NORMALLY, CLOSED 1. Available in SOX28 package only. Figure 16: Tamper detect output options User Configuration IRQ - Interrupt the TIE1 processor on tamper TPCLR - Clearexternal CLR1EXT RAM on tamper (1) RESET OUT TP1 (other reset sources) CLR1 TEB1 CLR - Clear 128 bytes internal RAM on tamper Time stamp tamper event (toRTC) TIE2 TP2 CLR2EXT TEB2 CLR2 1. Available in SOX28 package only. 20/54 DocID9497 Rev 11

M41ST87W Operating modes 2.6.6 Tamper detect sampling (TDS1 and TDS2) This bit selects between a 1 Hz sampling rate or constant monitoring of the tamper input pin(s) to detect a tamper event when the normally closed switch mode is selected. This allows the user to reduce the current drain when the TEB bit is enabled while the device is X in battery backup (see Table 5: "Tamper detection current (normally closed - TCMX = '0')" and Figure 17: "Tamper detect sampling options"). Sampling is disabled if the TCM bit is X set to logic '1' (Normally Open). In this case the state of the TDS bit is a “Don’t care.” X Note: The crystal oscillator must be “on” for sampling to function. If the oscillator is stopped, the tamper detect circuit will revert to continuous monitoring. 2.6.7 Tamper current high/tamper current low (TCHI/ 1 and TCHI/ 2) This bit selects the strength of the internal pull-up or pull-down used during the sampling of 𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓 𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓 the normally closed condition. The state of the TCHI/ bit is a “Don’t care” for normally X open (TCM = '1') mode (see Figure 18: "Tamper current options"). X TCLO 2.6.8 RAM clear (CLR1 and CLR2) When either CLR1 or CLR2 and the TEB bit are set to a logic '1,' the internal 128 bytes of X user RAM (see Figure 15: "Basic tamper detect options") will be cleared to all zeros in the event of a tamper condition. Furthermore, the 128 bytes of user RAM will be deselected (inaccessible) until the corresponding TEB bit is reset to '0.' Any data read during this time X will be invalid. (ie. the cleared RAM values cannot be accessed.) 2.6.9 RAM clear external (CLR1 and CLR2 ) - available in SOX28 EXT EXT package only When either CLR1 or CLR2 is set to a logic '1' and the TEB bit is also set to logic '1,' EXT EXT X the TP signal will be asserted for clearing external RAM, and the RST output asserted CLR upon detection of a tamper event (see Figure 15: "Basic tamper detect options" and Figure 20: "RAM clear hardware hookup (SOX28 package only)"). Note: The reset output resulting from a tamper event will be the same as a reset resulting from a power-down condition, a watchdog time-out, or a manual reset ( or ); the output will be asserted for t seconds. rec RSTIN1 RSTIN2 This is accomplished by forcing TP high, which if used to control the inhibit pin of the DC RST CLR regulator (see Figure 20: "RAM clear hardware hookup (SOX28 package only)") will also switch off V , depriving the external SRAM of power to the V pin. V will OUT CC OUT automatically be disconnected from the battery if the tamper occurs during battery back-up (see Figure 19: "Tamper output timing (with CLR1EXT or CLR2EXT = '1') - available in SOX28 package only"). By inhibiting the DC regulator, the user will also prevent other inputs from sourcing current to the external SRAM, which would allow it to retain data otherwise. The user may optionally connect an inverting charge pump to the V pin of the external CC SRAM (see Figure 20: "RAM clear hardware hookup (SOX28 package only)"). Depending on the process technology used for the manufacturing of the external SRAM, clearing the memory may require varying durations of negative potential on the V pin. This device CC configuration will allow the user to program the time needed for their particular application. Control Bits CLRPW0 and CLRPW1 determine the duration TP will be enabled (see CLR Figure 19: "Tamper output timing (with CLR1EXT or CLR2EXT = '1') - available in SOX28 package only" and Table 6: "Tamper detect timing"). Note: When using the inverting charge pump, the user must also provide isolation in the form of two additional small-signal power MOSFETs. These will isolate the V pin from OUT both the negative voltage generated by the charge pump during a tamper condition, and DocID9497 Rev 11 21/54

Operating modes M41ST87W from being pulled to ground by the output of the charge pump when it is in shut-down mode ( = logic low). The gates of both MOSFETs should be connected to TP as shown CLR in Figure 20: "RAM clear hardware hookup (SOX28 package only)". One n-channel eSnHhDaNncement MOSFET should be placed between the output of the inverting charge pump and the V of the M41ST87. The other MOSFET should be an enhancement mode p- OUT channel, and placed between V of the M41ST87 and V of the external SRAM. When OUT CC TP goes high after a tamper condition occurs, the n-channel MOSFET will turn on and CLR the p-channel will turn off. During normal operating conditions, TP will be low and the p- CLR channel will be on, while the n-channel will be off. Table 5: Tamper detection current (normally closed - TCMX = '0') TDSX TCHI/ X Tamper circuit mode Current at 3.0 V (typ) (1)(2) Unit 0 0𝐓𝐓 𝐓𝐓𝐓𝐓𝐓𝐓 Continuous monitoring / 10 MW pull-up/-down 0.3 µA 0 1 Continuous monitoring / 1 MW pull-up/-down 3.0 µA 1 0 Sampling (1 Hz) / 10 MW pull-up/-down 0.3 nA 1 1 Sampling (1 Hz) / 1 MW pull-up/-down 3.0 nA Notes: (1)Per tamper detect input (2)When calculating battery lifetime, this current should be added to IBAT current listed in Table 19: "DC characteristics". Figure 17: Tamper detect sampling options VCC (VOUT) CONTINUOUS MONITORING TAMPER HI, NORMALLY OPEN VCC (VOUT) CONTINUOUS TDSX = 0 MONITORING User Configuration SAMPLED NORTMAAMLPLEY,R C LLOO,SED MONITORING TDSX = 1 CONTINUOUS TCMX,TPMX MONITORING NOTRAMMAPLELYR OLOP,EN VCC (VOUT) CONTINUOUS TDSX = 0 MONITORING SAMPLED NORTMAAMLPLYE RC LHOI,SED MONITORING TDSX = 1 22/54 DocID9497 Rev 11

M41ST87W Operating modes Figure 18: Tamper current options VCC (VOUT) CONTINUOUS MONITORING TAMPER HI, NORMALLY OPEN VCC (VOUT) CONTINUOUS TDSX = 0 MONITORING User Configuration SAMPLED NORTMAAMLPLEYR C LLOO,SED TCHI/TCLO = 1 TCHI/TCLO = 0 MONITORING TDSX = 1 User Configuration TCMX,TPMX TPX (TP1,TP2) CONTINUOUS MONITORING TAMPER LO, VCC (VOUT) NORMALLY OPEN User Configuration TCHI/TCLO = 1 TCHI/TCLO = 0 CONTINUOUS TDSX = 0 MONITORING SAMPLED NORMTAAMLPLEYR C HLOI,SED MONITORING TDSX = 1 Figure 19: Tamper output timing (with CLR1EXT or CLR2EXT = '1') - available in SOX28 package only TPCLR tCLRD tCLR RST trec (1) (2) VOUT High-Z (3) IRQ/OUT (4) High-Z ECON Tamper Event (TB Bit set) 1. If connected to a negative charge pump device, this pin must be isolated from the charge pump by using both n-channel and p-channel MOSFETs as illustrated in Figure 20: "RAM clear hardware hookup (SOX28 package only)". 2. If the device is in battery back-up; NOT on V (see Section 2.6.9: "RAM clear CC external (CLR1EXT and CLR2EXT) - available in SOX28 package only"). V is OUT forced to GND during a tamper event when on V . CC 3. If TIE = '1.' X 4. If ABE = '1' and device is in battery backup mode. DocID9497 Rev 11 23/54

Operating modes M41ST87W Table 6: Tamper detect timing Symbol Parameter CLRPW1 CLRPW0 Min Typ Max Unit tCLRD(1) Tamper RAM clear ext delay X X 1.0 (2) 1.5 2.0 ms 0 0 1 s 0 1 4 s tCLR Tamper clear timing 1 0 8 s 1 1 16 s Notes: (1)With input capacitance = 70 pF and resistance = 50 Ω. (2)If the OF bit is set, tCLRD(min) = 0.5 ms. Figure 20: RAM clear hardware hookup (SOX28 package only) Inverting Charge Pump Negative Output IN OUT (–1 xVIN) SHDN (1) Inhibit M41ST87Y/W VIN VCC VCC TPCLR CAP+ CAP– 5V Regulator TP1IN TP2IN (2) VOUT VCC EX SCL ECON E Low-Power WDI SDA SRAM RSTIN1 RST To RST RSTIN2 SQW/FT To LED Display Pushbutton Reset PFO1 To NMI PFI1 PFO2 PFI2 IRQ/OUT To INT VSS VBAT F32k To 32kHz 1. Most inverting charge pumps drive OUT to ground when device shut down is enabled ( = logic low). Therefore, an n-channel enhancement mode MOSFET should be used to isolate the OUT pin from the V of the M41ST87. OUT 2. InSH oDrdNer to avoid turning on an on-chip parasitic diode when driving V negative, a p- OUT channel enhancement mode MOSFET should be used to isolate the V pin from the OUT negative voltage generated by the inverting charge pump. 24/54 DocID9497 Rev 11

M41ST87W Operating modes 2.7 Tamper detection operation The tamper pins are triggered based on the state of an external switch. Two switch mode options are available, normally open or normally closed, based on the setting of the tamper connect mode bit (TCM ). If the selected switch mode is normally open (TCM = '1'), the X X tamper pin will be triggered by being connected to V (if the TPM bit is set to '0') or to V SS X CC (if the TPM bit is set to '1'), through the closing of the external switch. When the external X switch is closed, the tamper bit (TB ) will be immediately set, allowing the user to determine x if the device has been physically tampered with. If the selected switch mode is normally closed (TCM = '0'), the tamper pin will be triggered by being pulled to V or to V X SS OUT (depending on the state of the TPM bit), through an internal pull-up/pull-down resistor as a X result of opening the external switch. When a tamper event occurs, the tamper bits (TB1 and/or TB2) will be immediately set if TEB = '1.' X If the tamper interrupt enable bit (TIE ) is set to a '1,' the /OUT pin will also be X activated. The /OUT output is cleared by a READ of the flags register (as seen in IRQ Figure 24: "Alarm interrupt reset waveform"), a reset of the TIE bit to '0,' or the output IRQ is asserted. RST Note: In order to avoid an inadvertent activation of the /OUT pin due to a prior tamper event, the flag register (0Fh) should be read prior to resetting the TEB bit. X IRQ The tamper bits are “read only” bits and are reset only by writing the tamper enable bit (TEB ) to '0.' Thus, when servicing a tamper interrupt, the user should read the flags X register to clear the pin, then clear the TEB bit to clear the TB flag, followed by setting x x TEB to again enable the tamper circuit. x IRQ The tamper detect function operates both under normal power, and in battery backup. Even if the trigger event occurs during a power-down condition, the tamper flag bit(s) will be set correctly. 2.8 Sampling As the switch mode normally closed (TCM = '0') requires a greater amount of current to X maintain constant monitoring, the M41ST87Y/W offers a programmable tamper detect sampling bit (TDS ) to reduce the current drawn on V or V (see Figure 17: "Tamper X CC BAT detect sampling options"). When enabled, the sampling frequency is once per second (1Hz), for a duration of approximately 1 ms. When TEB is disabled, no current will be drawn by the tamper detection circuit. After a X tamper event has been detected, no additional current will be drawn. Note: The oscillator must be running for tamper detection to operate in the sampling mode. If the oscillator is stopped, the tamper detection circuit will revert to constant monitoring. Note: Sampling in the tamper high mode (TPM = '1') may be bypassed while on V by X CC connecting the TPx pin to V through an external resistor. This will allow constant IN CC monitoring when V is “on” and revert to sampling when in battery backup (see Figure 14: CC "Tamper detect connection options"). DocID9497 Rev 11 25/54

Operating modes M41ST87W 2.9 Internal tamper pull-up/down current Depending on the capacitive and resistive loading of the tamper pin input (TP ), the user XIN may require more or less current from the internal pull-up/down used when monitoring the normally closed switch mode. The state of the tamper current hi/tamper current low bit (TCHI/ ) determines the sizing of the internal pull-up/-down. TCHI/ = '1' uses a X X 1 MΩ pull-up/-down resistor, while TCHI/ = '0' uses a 10 MΩ pull-up/-down resistor X TCLO TCLO (see Figure 18: "Tamper current options"). TCLO 2.10 Avoiding inadvertent tampers (normally closed configuration) In some applications it may be necessary to use a low pass filter to reduce electrical noise on the tamper input pin when the TCM bit = 0 (normally closed). This is especially true if X the tamper detect switch is located some distance (> 6”) from the tamper input pin. A low pass filter can prevent unwanted, higher frequency noise from inadvertently being detected as a tamper condition caused by the “antenna-effect” (produced by a longer signal wire or mesh). This low pass filter can be constructed using a series resistor (R) in conjunction with a capacitor (C) on the tamper input pin. The cut-off frequency f is determined according to the formula: c fc = 1/(2 • Pi • R • C) Figure 21: Low-pass filter implementation for noise immunity ToTamper Detect Switch TPIN R C Table 7: Calculated cutoff frequency for typical capacitance and resistance values R (Ω) C (F) fc 1/fc (s) 1000 1.00E-09 15.9 MHz 6.28 µs 1000 1.00E-06 159.2 Hz 6.28 ms 5000 1.00E-09 31.8 kHz 31.4 µs 5000 1.00E-06 31.8 Hz 31.4 ms 10000 1.00E-09 15.9 kHz 62.8 µs 10000 1.00E-06 15.9 Hz 62.8 ms 26/54 DocID9497 Rev 11

M41ST87W Operating modes 2.11 Tamper event time-stamp Regardless of which tamper occurs first, not only will the appropriate tamper bit be set, but the event will also be automatically time-stamped. This is accomplished by freezing the normal update of the clock registers (00h through 07h) immediately following a tamper event. Thus, when tampering occurs, the user may first read the time registers to determine exactly when the tamper event occurred, then re-enable the clock update to the current time (and reset the tamper bit, TB ) by resetting the tamper enable bit (TEB ). X X The time update will then resume and the clock can be read to determine the current time. Both tamper enable bits (TEB ) must always be set to '0' in order to read the current time. X In the event of multiple tampers, the time-stamp will reflect the initial tamper event. Note: If the TEB bit is set, the tamper event time-stamp will take precedence over the X power down time-stamp (see Section 3.1: "Power-down time-stamp") and the HT bit (halt update) will not be set during the power-down event. If both are needed, the power down time-stamp may be accomplished by writing the time into the general purpose RAM memory space when is asserted. PFO DocID9497 Rev 11 27/54

Clock operation M41ST87W 3 Clock operation The eight byte clock register (see Table 8: "TIMEKEEPER® register map") is used to both set the clock and to read the date and time from the clock, in a binary coded decimal format. Tenths/hundredths of seconds, seconds, minutes, and hours are contained within the first four registers. Note: A WRITE to any clock register (addresses 0 to 7h) will result in the tenths/hundredths of seconds being reset to “00.” Furthermore, the tenths/hundredths of seconds cannot be written to any value other than “00.” Bits D6 and D7 of clock register 03h (century/hours register) contain the CENTURY bit 0 (CB0) and CENTURY bit 1 (CB1). Bits D0 through D2 of register 04h contain the day (day of week). Registers 05h, 06h, and 07h contain the date (day of month), month, and years. The ninth clock register is the control register (this is described in the clock calibration section). Bit D7 of register 01h contains the STOP bit (ST). Setting this bit to a '1' will cause the oscillator to stop. If the device is expected to spend a significant amount of time on the shelf, the oscillator may be stopped to reduce current drain. When reset to a '0' the oscillator restarts within one second (typical). Note: A WRITE to ANY location within the first eight bytes of the clock register (00h-07h), including the OFIE bit, CLRPW0 bit, CLRPW1 bit, THS bit, and so forth, will result in an update of the system clock and a reset of the divider chain. This could result in a significant corruption of the current time, especially if the HT bit (see Section 3.1: "Power-down time- stamp") has not been previously reset. These non-clock related bits should be written prior to setting the clock, and remain unchanged until such time as a new clock time is also written. The eight clock registers may be read one byte at a time, or in a sequential block. The control register (address location 08h) may be accessed independently. The M41ST87 will periodically copy the time/date counters to the user registers thus updating them. This process is suspended when any of these 8 registers is being accessed. It is also suspended during backup mode. Suspending the updates ensures that the clock data being read does not change during the READ. 3.1 Power-down time-stamp Upon power-down following a power failure, the halt update bit (HT) will automatically be set to a '1.' This will prevent the clock from updating the user registers, and will allow the user to read the time of the power-down event. Note: When the HT bit is set or a tamper event occurs, the tenths/hundredths of a second register (00h) will automatically be reset to a value of “00.” All other date and time registers (01h - 07h) will retain the value last updated prior to the power-down or tamper event. The internal clock remains accurate and no time is lost as a result of the zeroing of the tenth/hundredths of a second register. When updates are resumed (due to resetting the HT bit or TEB bit), the correct time will be displayed. Resetting the HT bit to a '0' will allow the clock to update the user registers with the current time. Note: If the TEB bit is set, the power down time-stamp will be disabled, and the tamper event time-stamp will take precedence (see Section 2.7: "Tamper detection operation"). 28/54 DocID9497 Rev 11

M41ST87W Clock operation ® 3.2 TIMEKEEPER registers The M41ST87Y/W offers 22 internal registers which contain clock, control, alarm, watchdog, flag, square wave, and tamper data. The 8 clock registers are memory locations which contain external (user accessible) and internal copies of the data (usually referred to as BiPORT™ TIMEKEEPER cells). The external copies are independent of internal functions except that they are updated periodically by the simultaneous transfer of the incremented internal copy. The internal divider (or clock) chain will be reset upon the completion of a WRITE to any clock address (00h to 07h). The system-to-user transfer of clock data will be halted whenever the address being accessed is a clock address (00h to 07h). The updates will resume either due to a stop condition or when the pointer increments to a non-clock or RAM address. TIMEKEEPER and alarm registers store data in BCD format. Control, watchdog and square wave registers store data in binary format. Table 8: TIMEKEEPER® register map Data Function/range Addr D7 D6 D5 D4 D3 D2 D1 D0 BCD format 10s/100s 00h 0.1 seconds 0.01 seconds 00-99 seconds 01h ST 10 seconds Seconds Seconds 00-59 02h OFIE 10 minutes Minutes Minutes 00-59 Century/ 0-1/ 03h CB1 CB0 10 hours Hours (24-hour format) Hours 00-23 CLRP CLRP 04h TR THS 32kE Day of week Day 01-7 W1 W0 05h PFOD 0 10 date Date: day of month Date 01-31 06h 0 0 0 10M Month Month 01-12 07h 10 Years Year Year 00-99 08h OUT FT S Calibration Control 09h WDS BMB4 BMB3 BMB2 BMB1 BMB0 RB1 RB0 Watchdog 0Ah AFE SQWE ABE Al 10M Alarm month Al month 01-12 AI 10 Alarm 0Bh RPT4 RPT5 Al date 01-31 date date AI 10 0Ch RPT3 HT Alarm hour Al hour 00-23 hour 0Dh RPT2 Alarm 10 minutes Alarm minutes Al min 00-59 0Eh RPT1 Alarm 10 seconds Alarm seconds Al sec 00-59 0Fh WDF AF 0 BL 0 OF TB1 TB2 Flags 10h 0 0 0 0 0 0 0 0 Reserved 11h 0 0 0 0 0 0 0 0 Reserved 12h 0 0 0 0 0 0 0 0 Reserved 13h RS3 RS2 RS1 RS0 SQWOD 0 0 0 SQW TCHI/ CLR 14h TEB1 TIE1 TCM1 TPM1 TDS1 CLR1 Tamper1 1 1EXT TCLO DocID9497 Rev 11 29/54

Clock operation M41ST87W Data Function/range Addr D7 D6 D5 D4 D3 D2 D1 D0 BCD format TCHI/ CLR 15h TEB2 TIE2 TCM2 TPM2 TDS2 CLR2 Tamper2 2 2EXT 16h- TCLO ROM Serial number 8-byte 1Dh 1Eh- Reserved 2-byte 1Fh 20h- 128 user bytes 9Fh Keys: 0 = Must be set to zero RB0-RB1 = Watchdog resolution bits 32kE = 32 kHz output enable bit RPT1-RPT5 = Alarm repeat mode bits ABE = Alarm in battery backup mode enable bit RS0-RS3 = SQW frequency AF = Alarm flag (read only) S = Sign bit AFE = Alarm flag enable bit SQWE = Square wave enable BL = Battery low flag (read only) SQWOD = Square wave open drain bit BMB0-BMB4 = Watchdog multiplier bits ST = Stop bit CB0-CB1 = Century bits TB (1 and 2) = Tamper bits (read only) TCHI/ (1 and 2) = Tamper current hi/tamper CLR (1 and 2) = RAM clear bits current low bits TCLO CLR (1 and 2)EXT = RAM clear external bits TCM (1 and 2) = Tamper connect mode bits CLRPW0 = RAM clear pulse width 0 bit TDS (1 and 2) = Tamper detect sampling bits CLRPW1 = RAM clear pulse width 1 bit TEB (1 and 2) = Tamper enable bits FT = Frequency test bit THS = Threshold bit HT = Halt update bit TIE (1 and 2) = Tamper interrupt enable bits OF = Oscillator fail bit TPM (1 and 2) = Tamper polarity mode bits OFIE = Oscillator fail interrupt enable bit TR = trec bit OUT = Output level WDS = Watchdog steering bit PFOD = Power-fail output open drain bit WDF = Watchdog flag (read only) 30/54 DocID9497 Rev 11

M41ST87W Clock operation 3.3 Calibrating the clock The M41ST87Y/W is driven by a quartz controlled oscillator with a nominal frequency of 32,768 Hz. The devices are tested to not exceed ±35 ppm (parts per million) oscillator frequency error at 25 °C, with ±20 ppm crystals, which translates to about ±1.53 minutes per month. Even better accuracy can be achieved with higher accuracy crystals. When the calibration circuit is properly employed, accuracy can be improved to better than ±2 ppm at 25 °C. The oscillation rate of crystals changes with temperature (see Figure 22: "Crystal accuracy across temperature"). Therefore, the M41ST87Y/W design employs periodic counter correction. The calibration circuit adds or subtracts counts from the oscillator divider circuit at the divide by 256 stage, as shown in Figure 23: "Calibration waveform". The number of times pulses which are blanked (subtracted, negative calibration) or split (added, positive calibration) depends upon the value loaded into the five calibration bits found in the control register. Adding counts speeds the clock up, subtracting counts slows the clock down. The calibration bits occupy the five lower order bits (D4-D0) in the control register (08h). These bits can be set to represent any value between 0 and 31 in binary form. Bit D5 is a sign bit; '1' indicates positive calibration, '0' indicates negative calibration. Calibration occurs within a 64 minute cycle. The first 62 minutes in the cycle may, once per minute, have one second either shortened by 128 or lengthened by 256 oscillator cycles. If a binary '1' is loaded into the register, only the first 2 minutes in the 64 minute cycle will be modified; if a binary 6 is loaded, the first 12 will be affected, and so on. Therefore, each calibration step has the effect of adding 512 or subtracting 256 oscillator cycles for every 125,829,120 actual oscillator cycles, that is +4.068 or –2.034 ppm of adjustment per calibration step in the calibration register. Assuming that the oscillator is running at exactly 32,768 Hz, each of the 31 increments in the calibration byte would represent +10.7 or –5.35 seconds per month which corresponds to a total range of +5.5 or –2.75 minutes per month. Two methods are available for ascertaining how much calibration a given M41ST87Y/W may require. The first involves setting the clock, letting it run for a month and comparing it to a known accurate reference and recording deviation over a fixed period of time. Calibration values, including the number of seconds lost or gained in a given period, can be found in application note AN934, “TIMEKEEPER® calibration.” This allows the designer to give the end user the ability to calibrate the clock as the environment requires, even if the final product is packaged in a non-user serviceable enclosure. The designer could provide a simple utility that accesses the calibration byte. The second approach is better suited to a manufacturing environment, and involves the use of the SQW/FT pin. The pin will toggle at 512 Hz, when the stop bit (ST) is '0,' the frequency test bit (FT) is '1,' and SQWE is '0.' Any deviation from 512 Hz indicates the degree and direction of oscillator frequency shift at the test temperature. For example, a reading of 512.010124 Hz would indicate a +20 ppm oscillator frequency error, requiring a –10 (XX001010) to be loaded into the calibration byte for correction. Note that setting or changing the calibration byte does not affect the frequency test output frequency. If the SQWOD bit = '1,' the SQW/FT pin is an open drain output which requires a pull-up resistor to V for proper operation. A 500 to 10 kΩ resistor is recommended in order to CC control the rise time. The FT bit is cleared on power-down. DocID9497 Rev 11 31/54

Clock operation M41ST87W Figure 22: Crystal accuracy across temperature Frequency (ppm) 20 0 –20 –40 –60 = K x(T – T )2 –80 F O K = –0.036 ppm/°C2 ± 0.006 ppm/°C2 –100 T = 25°C ± 5°C –120 O –140 –160 –40 –30 –20 –10 0 10 20 30 40 50 60 70 80 Temperature°C Figure 23: Calibration waveform NORMAL POSITIVE CALIBRATION NEGATIVE CALIBRATION 3.4 Setting alarm clock registers Address locations 0Ah-0Eh contain the alarm settings. The alarm can be configured to go off at a prescribed time on a specific month, date, hour, minute, or second, or repeat every year, month, day, hour, minute, or second. It can also be programmed to go off while the M41ST87Y/W is in the battery back-up to serve as a system wake-up call. Bits RPT5–RPT1 put the alarm in the repeat mode of operation. Table 9: "Alarm repeat modes" shows the possible configurations. Codes not listed in the table default to the once per second mode to quickly alert the user of an incorrect alarm setting. When the clock information matches the alarm clock settings based on the match criteria defined by RPT5–RPT1, the AF (alarm flag) is set. If AFE (alarm flag enable) is also set, the alarm condition activates the /OUT pin as shown in Figure 25: "Backup mode alarm waveform". To disable the alarm, write '0' to the alarm date register and to RPT5–RPT1. IRQ If the address pointer is allowed to increment to the flag register address, an alarm condition will not cause the interrupt/flag to occur until the address pointer is moved to a different address. It should also be noted that if the last address written is the “alarm seconds,” the address pointer will increment to the flag address, causing this situation to occur. Thus the user should not leave the address pointer at 0Fh if using the alarm 32/54 DocID9497 Rev 11

M41ST87W Clock operation interrupt function. This is easily handled by simply reading past the flags registers before teminating a read sequence. The /OUT output is cleared by a READ to the flags register. A subsequent READ of the flags register is necessary to see that the value of the alarm flag has been reset to '0.' IRQ The /OUT pin can also be activated in the battery backup mode. The /OUT will go low if an alarm occurs and both ABE (alarm in battery backup mode enable) and AFE are set. TIRhQe ABE and AFE bits are reset during power-up, therefore an alarmI RgQenerated during power-up will only set AF. The user can read the flag register at system boot-up to determine if an alarm was generated while the M41ST87Y/W was in the deselect mode during power-up. Figure 25: "Backup mode alarm waveform" illustrates the backup mode alarm timing. Figure 24: Alarm interrupt reset waveform ADDRESS POINTER 0Eh 0Fh 10h ACTIVE FLAG IRQ/OUT HIGH-Z Table 9: Alarm repeat modes RPT5 RPT4 RPT3 RPT2 RPT1 Alarm setting 1 1 1 1 1 Once per second 1 1 1 1 0 Once per minute 1 1 1 0 0 Once per hour 1 1 0 0 0 Once per day 1 0 0 0 0 Once per month 0 0 0 0 0 Once per year DocID9497 Rev 11 33/54

Clock operation M41ST87W Figure 25: Backup mode alarm waveform VCC VPFD VSO trec ABE, AFE Bits inInterruptRegister AF bit inFlagsRegister IRQ/OUT HIGH-Z HIGH-Z 3.5 Watchdog timer The watchdog timer can be used to detect an out-of-control microprocessor. The user programs the watchdog timer by setting the desired amount of time-out into the watchdog register, address 09h. Bits BMB4-BMB0 store a binary multiplier and the two lower order bits RB1-RB0 select the resolution, where 00=1/16 second, 01=1/4 second, 10=1 second, and 11=4 seconds. The amount of time-out is then determined to be the multiplication of the five-bit multiplier value with the resolution. (For example: writing 00001110 in the watchdog register = 3*1 or 3 seconds). Note: The accuracy of the timer is within ± the selected resolution. If the processor does not reset the timer within the specified period, the M41ST87Y/W sets the WDF (watchdog flag) and generates either a watchdog interrupt or a microprocessor reset. The most significant bit of the watchdog register is the watchdog steering bit (WDS). When set to a '0,' the watchdog will activate the /OUT pin when timed-out. When WDS is set to a '1,' the watchdog will output a negative pulse on the pin for t . The watchdog rec IRQ register, FT, AFE, ABE and SQWE bits will reset to a '0' at the end of a watchdog time-out when the WDS bit is set to a '1.' RST The watchdog timer can be reset by two methods: 1) a transition (high-to-low or low-to- high) can be applied to the watchdog input pin (WDI) or 2) the microprocessor can perform a WRITE of the watchdog register. The time-out period then starts over. Note: The WDI pin should be tied to V if not used and is only available in the SOX28 SS package. In order to perform a software reset of the watchdog timer, the original time-out period can be written into the watchdog register, effectively restarting the count-down cycle. Should the watchdog timer time-out, and the WDS bit is programmed to output an interrupt, either a transition of the WDI pin, or a value of 00h needs to be written to the watchdog register in order to clear the /OUT pin. This will also disable the watchdog function until IRQ 34/54 DocID9497 Rev 11

M41ST87W Clock operation it is again programmed correctly. A READ of the flags register will reset the watchdog flag (bit D7; register 0Fh) but does not clear the /OUT pin. The watchdog function is automatically disabled upon power-up and the watchdog register IRQ is cleared. 3.6 Square wave output The M41ST87Y/W offers the user a programmable square wave function which is output on the SQW/FT pin. RS3-RS0 bits located in 13h establish the square wave output frequency. These frequencies are listed in Table 10: "Square wave output frequency". Once the selection of the SQW frequency has been completed, the SQW/FT pin can be turned on and off under software control with the square wave enable bit (SQWE) located in register 0Ah. The SQW/FT output is programmable as an N-channel, open drain output driver, or a full- CMOS output driver. By setting the square wave open drain bit (SQWOD) to a '1,' the output will be configured as an open drain (with I as specified in Table 19: "DC OL characteristics"). When SQWOD is set to '0,' the output will be configured as full-CMOS (sink and source current as specified in Table 19: "DC characteristics"). Note: When configured as open drain (SQWOD = '1'), the SQW/FT pin requires an external pull-up resistor. Table 10: Square wave output frequency Square wave bits Square wave RS3 RS2 RS1 RS0 Frequency Units 0 0 0 0 None – 0 0 0 1 32.768 kHz 0 0 1 0 8.192 kHz 0 0 1 1 4.096 kHz 0 1 0 0 2.048 kHz 0 1 0 1 1.024 kHz 0 1 1 0 512 Hz 0 1 1 1 256 Hz 1 0 0 0 128 Hz 1 0 0 1 64 Hz 1 0 1 0 32 Hz 1 0 1 1 16 Hz 1 1 0 0 8 Hz 1 1 0 1 4 Hz 1 1 1 0 2 Hz 1 1 1 1 1 Hz DocID9497 Rev 11 35/54

Clock operation M41ST87W 3.7 Full-time 32 kHz square wave output The M41ST87Y/W offers the user a special 32 kHz square wave function which defaults to output on the F pin (pin 21) as long as V ≥ V , and the oscillator is running 32k CC SO (ST bit = '0'). This function is available within one second (typ) of initial power-up and can only be disabled by setting the 32 kE bit to '0' or the ST bit to '1.' If not used, the F pin 32k should be disconnected and allowed to float. Note: The F pin is an open drain which requires an external pull-up resistor. 32k 3.8 Power-on reset The M41ST87Y/W continuously monitors V . When V falls to the power fail detect trip CC CC point, the pulls low (open drain) and remains low on power-up for t after V passes rec CC V (max). The pin is an open drain output and an appropriate pull-up resistor should PFD RST be chosen to control rise time. RST Note: A power-on reset will result in resetting the following control bits to '0': OFIE, AFE, ABE, SQWE, FT, WDS, BMB0-BMB4, RB0, RB1, TIE1, and TIE2 (see ). 3.9 Reset inputs ( and ) The M41ST87Y/W provides two independent inputs which can generate an output reset. The function of these𝐑𝐑 re𝐑𝐑s𝐓𝐓ets𝐑𝐑 𝐑𝐑is 𝐑𝐑identical 𝐑𝐑to 𝐑𝐑a𝐓𝐓 re𝐑𝐑s𝐑𝐑et𝐑𝐑 generated by a power cycle. Table 11: "Reset AC characteristics" and Figure 26: "RSTIN1 and RSTIN2 timing waveforms" illustrate the AC reset characteristics of this function. Pulses shorter than t and t will not R1 R2 generate a reset condition. and are each internally pulled up to V CC through a 100 kΩ resistor. Note that triggers on the falling edge while RSTIN1 RSTIN2 triggers on the rising edge. RSTIN1 RSTIN2 Note: is available only in the SOX28 package. 𝑅𝑅𝑅𝑅𝑅𝑅𝑅𝑅𝑅𝑅2 Figure 26: and timing waveforms 𝐑𝐑𝐑𝐑𝐓𝐓𝐑𝐑𝐑𝐑𝐑𝐑 𝐑𝐑𝐑𝐑𝐓𝐓𝐑𝐑𝐑𝐑𝐑𝐑 RSTIN1 tR1 RSTIN2 tR2 Hi-Z Hi-Z RST trec trec 36/54 DocID9497 Rev 11

M41ST87W Clock operation Table 11: Reset AC characteristics Symbol Parameter (1) Min Max Unit tR1(2) low to low (min pulse width) 100 200 ns tR2(2) RSTIN1 low to RST high (min pulse width) 100 200 ns trec(3) RSTIN2 or RST IhNig2h to high 96 98(3) ms RSTIN1 RSTIN2 RST Notes: (1) Valid for ambient operating temperature: TA = –40 to 85 °C; VCC = 4.5 to 5.5 V or 2.7 to 3.6 V (except where noted). (2)Pulse widths of less than 100 ns will result in no RESET (for noise immunity). (3)Programmable (see Table 13: "trec definitions"). Same function as power-on reset. 3.10 Power-fail comparators (1 and 2) Two power-fail inputs (PFI and PFI ) are compared to an internal reference voltage (1.25 1 2 V). If either PFI or PFI is less than the power-fail threshold (V ), the associated power- 1 2 PFI fail output ( or ) will go low. This function is intended for use as an under-voltage 1 2 detector to signal a failing power supply. Typically PFI and PFI are connected through 1 2 external volPtaFgOe divPidFeOrs (see Figure 5: "Hardware hookup") to either the unregulated DC input (if it is available) or the regulated output of the V regulator. The voltage divider can CC be set up such that the voltage at PFI or PFI falls below V several milliseconds before 1 2 PFI the regulated V input to the M41ST87Y/W or the microprocessor drops below the CC minimum operating voltage, thus providing an early warning of power failure. During battery back-up, the power-fail comparator turns off and and go (or 1 2 remain) low. This occurs after V drops below V (min). When power returns, and CC PFD 1 PFO PFO are forced high, irrespective of V for the write protect time (t ), which is the time 2 PFI rec PFO from V (max) until the inputs are recognized. At the end of this time, the power-fail PFD PFO comparator is enabled and and follow PFI and PFI . If the comparator is 1 2 1 2 unused, PFI or PFI should be connected to V and the associated or left 1 2 SS 1 2 PFO PFO unconnected. PFO PFO 3.11 Power-fail outputs The and outputs are programmable as N-channel, open drain output drivers, or 1 2 full-CMOS output drivers. By setting the power-fail output open drain bit (PFOD) to a '1,' the outpuPtF wOill be cPoFnOfigured as open drain (with I as specified in Table 19: "DC OL characteristics"). When PFOD is set to '0,' the outputs will be configured as full-CMOS (sink and source current as specified in Table 19: "DC characteristics"). Note: When configured as open drain (PFOD = '1'), and will require an external 1 2 pull-up resistor. PFO PFO DocID9497 Rev 11 37/54

Clock operation M41ST87W 3.12 Century bits These two bits will increment in a binary fashion at the turn of the century, and handle leap years correctly. Refer to Table 12: "Century bits examples". These bits represent the next higher order bits of the years register (07h), and should be set accordingly. For example, for the year 2100, they would be set to 1 (D7 = 0 and D6 = 1), and for the year 2300, they would be set to 3 (D7 = 1 and D6 = 1). Once set, they will increment every 100 years. Provided they are set as described above, the date register (05h) will properly manage leap day at the turn of any century. Leap day does not occur in turn-of-century years except for those which are multiples of 400. Thus, with CB1 and CB0 properly set, the device will omit leap day from the appropriate turn-of-century years. Table 12: Century bits examples CB1 CB0 Leap year? Example (1) 0 0 Yes 2000 0 1 No 2100 1 0 No 2200 1 1 No 2300 Notes: (1) Leap year occurs every four years (for years evenly divisible by four), except for years evenly divisible by 100. The only exceptions are those years evenly divisible by 400 (the year 2000 was a leap year, year 2100 is not). 3.13 Output driver pin When the TIE bit, OFIE bit, AFE bit, and watchdog register are not set to generate an interrupt, the /OUT pin becomes an output driver that reflects the contents of D7 of the control register. In other words, when D7 (OUT bit) is a '0,' then the /OUT pin will be IRQ driven low. With the ABE bit set to '1,' the OUT pin will continue to be driven low in battery backup. IRQ Note: The /OUT pin is an open drain which requires an external pull-up resistor. IRQ 3.14 Battery low warning The M41ST87Y/W automatically performs battery voltage monitoring upon power-up and at factory-programmed time intervals of approximately 24 hours. The battery low (BL) bit, bit D4 of flags register 0Fh, will be set if the battery voltage is found to be less than approximately 2.5 V. The BL bit will remain set until completion of battery replacement and subsequent battery low monitoring tests, either during the next power-up sequence or the next scheduled 24-hour interval. If a battery low is generated during a power-up sequence, this indicates that the battery is below approximately 2.5 volts and may not be able to maintain data integrity in the SRAM. Data should be considered suspect and verified as correct. A fresh battery should be installed. If a battery low indication is generated during the 24-hour interval check, this indicates that the battery is near end of life. However, data is not compromised due to the fact that a nominal V is supplied. In order to ensure data integrity during subsequent periods of CC battery back-up mode, the battery should be replaced. The battery should be replaced while V is applied to the device. CC The M41ST87Y/W only monitors the battery when a nominal V is applied to the device. CC Thus applications which require extensive durations in the battery back-up mode should be 38/54 DocID9497 Rev 11

M41ST87W Clock operation powered-up periodically (at least once every few months) in order for this technique to be beneficial. Additionally, if a battery low is indicated, data integrity should be verified upon power-up via a checksum or other technique. 3.15 t bit rec Bit D7 of clock register 04h contains the t bit (TR). t refers to the automatic continuation rec rec of the deselect time after V reaches V . This allows for a voltage settling time before CC PFD WRITEs may again be performed to the device after a power-down condition. The t bit rec will allow the user to set the length of this deselect time as defined by Table 13: "trec definitions". Table 13: trec definitions trec time trec bit (TR) STOP bit (ST) Units Min Max 0 0 96 98 (1) ms 0 1 40 200 ms 1 X 50 2000 µs Notes: (1)Default setting. 3.16 Electronic serial number The M41ST87Y/W has a unique 8-byte lasered serial number with parity. This serial number is “read only” and is generated such that no two devices will contain an identical number. 3.17 Oscillator stop detection If the oscillator fail (OF) bit is internally set to a '1,' this indicates that the oscillator has either stopped, or was stopped for some period of time, and can be used to judge the validity of the clock and date data. This bit will be set to '1' any time the oscillator stops. The following conditions can cause the OF bit to be set: • The first time power is applied (defaults to a '1' on power-up). • The voltage present on V or battery is insufficient to support oscillation. CC • The ST bit is set to '1.' If the oscillator fail interrupt enable bit (OFIE) is set to a '1,' the /OUT pin will also be asserted. The /OUT output is cleared by resetting the OF bit to '0,' resetting the OFIE IRQ bit to '0,' or if the output is asserted (but is NOT cleared by reading the flag register). IRQ The OF bit will remain set to '1' until written to logic '0.' The oscillator must start and have RST run for at least 4 seconds before attempting to reset the OF bit to '0.' This function operates both under normal power and in battery backup. If the trigger event occurs during a power- down condition, this bit will be set correctly. Note: The ABE bit must be set to '1' for the /OUT pin to be activated in battery backup. IRQ DocID9497 Rev 11 39/54

Clock operation M41ST87W 3.18 Initial power-on defaults Table 14: Default values Condition TR ST OF OFIE HT(1) Out FT AFE ABE SQWE SQWOD PFOD Watchdog register(2) Initial power-up 0 0 1 0 1 1 0 0 0 0 1 1 0 Subsequent power-up (with battery backup)(3)(4) UC UC UC 0 ↑ 0 ↓ UC 0 ↓ 0 ↑ 0 ↑ 0 ↑ UC UC 0 ↓ Notes: (1)When TEBX is set to '1,' the HT bit will not be set on power-down (tamper time-stamp will have precedence). (2)WDS, BMB0-BMB4, RB0, RB1. (3)↑ = VCC rising; ↓ = VCC falling. (4)UC = unchanged. Table 15: Default values TCHI/ Condition 32kE THS TEB1 TCM1 TPM1 TDS1 1 and CLR1 TIE1 CLRPW0 CLRPW1 CLR1EXT and and 2 and 2 and 2 and 2 and 2 and 2 CLR2EXT 2 𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓 Initial power-up 1 (1) 0 0 0 0 0 0 0 0 0 0 0 Subsequent power-up (with battery backup)(2) UC UC UC UC UC UC UC UC 0 ↑ UC UC UC Notes: (1)32 kHz output valid only on VCC. (2)UC = unchanged. Note: All other control bits are undetermined. 40/54 DocID9497 Rev 11

M41ST87W Maximum ratings 4 Maximum ratings Stressing the device above the rating listed in the absolute maximum ratings table may cause permanent damage to the device. These are stress ratings only and operation of the device at these or any other conditions above those indicated in the operating sections of this specification is not implied. Exposure to absolute maximum rating conditions for extended periods may affect device reliability. Table 16: Absolute maximum ratings Symbol Parameter Value Unit TSTG Storage temperature (VCC off, oscillator off) –55 to 125 °C SSOP20 260 (1) °C TSLD Lead solder temperature for 10 seconds SOX28 240 (2) °C VIO Input or output voltage –0.3 to VCC+0.3 V M41ST87Y –0.3 to 7.0 V VCC Supply voltage M41ST87W –0.3 to 4.6 V IO Output current 20 mA PD Power dissipation 1 W SSOP20 83.0 °C/W θJA Thermal resistance, junction to ambient SOX28 °C/W SSOP20 Tj Max. operating junction temperature 125 °C SOX28 Notes: (1)Reflow at peak temperature of 260 °C. The time above 255 °C must not exceed 30 seconds. (2)Reflow at peak temperature of 240 °C. The time above 235°C must not exceed 20 seconds. Caution: Negative undershoots below –0.3 V are not allowed on any pin while in the battery backup mode. DocID9497 Rev 11 41/54

DC and AC parameters M41ST87W 5 DC and AC parameters This section summarizes the operating and measurement conditions, as well as the DC and AC characteristics of the device. The parameters in the following DC and AC characteristic tables are derived from tests performed under the measurement conditions listed in the relevant tables. Designers should check that the operating conditions in their projects match the measurement conditions when using the quoted parameters. Table 17: DC and AC measurement conditions Parameter M41ST87Y M41ST87W VCC supply voltage 4.5 to 5.5 V 2.7 to 3.6 V Ambient operating temperature –40 to 85 °C –40 to 85 °C Load capacitance (CL) 100 pF 50 pF Input rise and fall times ≤ 50 ns ≤ 50 ns Input pulse voltages 0.2 to 0.8VCC 0.2 to 0.8VCC Input and output timing ref. voltages 0.3 to 0.7VCC 0.3 to 0.7VCC Note: Output high Z is defined as the point where data is no longer driven. Figure 27: AC testing input/output waveforms 0.8VCC 0.7VCC 0.3VCC 0.2VCC Table 18: Capacitance Symbol Parameter (1)(2) Min Max Unit CIN Input capacitance 7 pF COUT(3) Output capacitance 10 pF tLP Low-pass filter input time constant (SDA and SCL) 50 ns Notes: (1)At 25 °C, f = 1 MHz. (2)Effective capacitance measured with power supply at 5 V. Sampled only, not 100% tested. (3)Outputs are deselected. 42/54 DocID9497 Rev 11

M41ST87W DC and AC parameters Table 19: DC characteristics M41ST87Y M41ST87W Test condition Sym Parameter (1) Min Typ Max Min Typ Max Unit Battery current OSC ON TA = 25 °C, 500 700 500 700 nA IBAT(2) VCC = 0 V, Battery current OSC VBAT = 3 V 50 50 nA OFF ICC1 Supply current f = 400 kHz 1.4 0.75 mA Supply current SCL, SDA ≥ ICC2 (standby) VCC– 0.3 V 1 0.50 mA Input leakage current 0V ≤ VIN ≤ VCC ±1 ±1 µA ILI(3) Input leakage current –25 2 25 –25 2 25 nA (PFI) ILO(4) Ocuurtrpeuntt leakage 0V ≤ VIN ≤ VCC ±1 ±1 µA IOUT1(5) VOUT current (active) VOUT01. 3> VV CC – 175 100 mA IOUT2 VbaOcUkT ucpu)r rent (battery VOUT02 .>3 VVB AT – 100 100 µA VIH Input high voltage 0.7VCC V0C.C3 + 0.7VCC V0C.C3 + V VIL Input low voltage –0.3 0.3VCC –0.3 0.3VCC V VBAT Battery voltage 2.5 3.0 VCC 2.5 3.0 VCC V VOH(6) Output high voltage IOH = –1.0 mA 2.4 2.4 V Pull-up supply voltage /OUT, , 5.5 3.6 V (open drain) F32k IRQ RST VOHB(7) VOH (battery backup) IOUT2 =( 8–) 1.0 µA 2.9 2.9 V Output low voltage IOL = 3.0 mA 0.4 0.4 V VOL Output low voltage (open drain)(9) IOL = 10 mA 0.4 0.4 V THS bit = 0 4.20 4.35 4.50 2.55 2.62 2.70 V VPFD Power fail deselect THS bit = 1 4.50 4.60 4.75 2.80 2.88 3.00 V VCC = 5 V (Y) 1.225 1.250 1.275 V VVPPFFII12, PFI input threshold VCC = 3 V (W) 1.2 25 1.2 50 1.2 75 V PFI hysteresis PFI rising 20 70 20 70 mV Battery backup VSO switchover 2.5 2.5 V External switch RSW resistance on tamper 500 500 Ω pin Notes: (1)Valid for ambient operating temperature: TA = –40 to 85 °C; VCC = 4.5 to 5.5 V or 2.7 to 3.6 V (except where noted). (2)Measured with VOUT and E̅CON open. Not including tamper detection current (see Table 5: "Tamper detection current (normally closed - TCMX = '0')"). DocID9497 Rev 11 43/54

DC and AC parameters M41ST87W (3) and internally pulled up to VCC through 100 kΩ resistor. WDI internally pulled-down to VSS through 100 kΩ resistor. (4)ROSuTtpIuNts1 dese RleScTteIdN.2 (5)External SRAM must match RTC supervisor chip VCC specification. (6)For 1 and 2 (if PFOD = '0'), SQW/FT (if SQWOD = '0'), and TPCLR pins (CMOS). (7) ConPdiFtiOoned ouPtpFuOt (E̅CON) can only sustain CMOS leakage current in the battery backup mode. Higher leakage currents will reduce battery life. (8)TPCLR output can source –300 µA (typ) for VBAT = 2.9 V. (9)For /OUT, SQW/FT (if SQWOD = '1'), 1 and 2 (if PFOD = '1'), , SDA, and F32k pins (open drain). IRQ PFO PFO RST Table 20: Crystal electrical characteristics Symbol Parameter (1) Min Typ Max Units fO Resonant frequency 32.768 kHz RS Series resistance 65 (2) kΩ CL Load capacitance 12.5 pF Notes: (1) Load capacitors are integrated within the M41ST87. Circuit board layout considerations for the 32.768 kHz crystal of minimum trace lengths and isolation from RF generating signals should be taken into account. (2)TA = –40 to 85 °C (guaranteed by design). Note: Crystal: user supplied for the 20-lead SSOP package. STMicroelectronics recommends the KDS DT-38 (3 x 8 mm) for thru-hole, or the KDS DMX-26S for surface- mount, tuning fork-type quartz crystals. 44/54 DocID9497 Rev 11

M41ST87W DC and AC parameters Figure 28: Power down/up mode AC waveforms VCC VPFD (max) VPFD (min) VSO tF tR tFB tRB tPD trec PFO VALID VALID INPUTS RECOGNIZED DON'T CARE RECOGNIZED RST HIGH-Z OUTPUTS VALID VALID (PER CONTROL INPUT) (PER CONTROL INPUT) (1) ECON 1. E̅ available in the SOX28 package only. CON Table 21: Power down/up AC characteristics Symbol Parameter (1) Min Typ Max Unit tF(2) VPFD(max) to VPFD(min) VCC fall time 300 µs tFB(3) VPFD(min) to VSS VCC fall time 10 µs tPD at VIH before power down 0 µs tPFD EPXFI to propagation delay 15 25 µs tR VPFD(mPinF)O to VPFD(max) VCC rise time 10 µs tRB VSS to VPFD(min) VCC rise time 1 µs trec Power-up deselect time 96 98 (4) ms Notes: (1)Valid for ambient operating temperature: TA = –40 to 85 °C; VCC = 4.5 to 5.5 V or 2.7 to 3.6 V (except where noted). (2) VPFD(max) to VPFD(min) fall time of less than tF may result in deselection/write protection not occurring until 200 µs after VCC passes VPFD(min). (3)VPFD(min) to VSS fall time of less than tFB may cause corruption of RAM data. (4)Programmable (see Table 13: "trec definitions") DocID9497 Rev 11 45/54

Package information M41ST87W 6 Package information In order to meet environmental requirements, ST offers these devices in different grades of ECOPACK® packages, depending on their level of environmental compliance. ECOPACK® specifications, grade definitions and product status are available at: www.st.com. ECOPACK® is an ST trademark. 6.1 SOX28 package information Figure 29: SOX28 – 28-lead plastic small outline, 300 mils, embedded crystal package outline 7456166_F Note: Drawing is not to scale. 46/54 DocID9497 Rev 11

M41ST87W Package information Table 22: SOX28 – 28-lead plastic small outline, 300 mils, embedded crystal package mechanical data millimeters inches Symbol Typ Min Max Typ Min Max A 2.44 2.69 0.096 0.106 A1 0.15 0.31 0.006 0.012 A2 2.29 2.39 0.090 0.094 B 0.41 0.51 0.016 0.020 c 0.20 0.31 0.008 0.012 D 17.91 18.01 0.705 0.709 E 7.57 7.67 0.298 0.302 e 1.27 – – 0.050 – – E1 10.16 10.52 0.400 0.414 L 0.51 0.81 0.020 0.032 α 0° 8° 0° 8° N 28 28 DocID9497 Rev 11 47/54

Package information M41ST87W 6.2 SSOP20 package information Figure 30: SSOP20 – 20-lead, shrink, small outline package outline 0061436_C Table 23: SSOP20 – 20-lead, shrink, small outline package mechanical data mm in Sym Min Typ Max Min Typ Max A 2.000 0.079 A1 0.050 0.002 A2 1.650 1.750 1.850 0.065 0.069 0.073 b 0.220 0.380 0.009 0.015 c 0.090 0.250 0.004 0.010 D 6.900 7.200 7.500 0.272 0.283 0.295 E 7.400 7.800 8.200 0.291 0.307 0.323 E1 5.000 5.300 5.600 0.197 0.209 0.220 e 0.650 0.026 L 0.550 0.750 0.950 0.022 0.030 0.037 L1 1.250 0.049 k 0d 4d 8d 0d 4d 8d ddd 0.100 0.004 48/54 DocID9497 Rev 11

M41ST87W Packing information 7 Packing information 7.1 SOX28 carrier tape Figure 31: Carrier tape for SOX28 package P0 E D P2 T A0 F TOP COVER TAPE W B0 CENTER LINES P1 OF CAVITY K0 USER DIRECTION OF FEED Table 24: Carrier tape dimensions for SOX28 package Bulk Package W D E P0 P2 F A0 B0 K0 P1 T Unit Qty 1.50 24.00 1.75 4.00 2.00 11.50 12.70 18.20 3.20 16.00 0.30 SOX28 +0.10/ mm 1000 ±0.30 ±0.10 ±0.10 ±0.10 ±0.10 ±0.10 ±0.10 ±0.10 ±0.10 ±0.05 –0.00 DocID9497 Rev 11 49/54

Packing information M41ST87W 7.2 SSOP20 carrier tape Figure 32: Carrier tape for SSOP20 package Note: All dimensions in millimeters. 50/54 DocID9497 Rev 11

M41ST87W Packing information 7.3 Reel information for SOX28 and SSOP20 Figure 33: Reel schematic T 40 mm min. access hole at slot location B D C N A G measured at hub Full radius Tape slot in core for tape start 2.5 mm min. width Table 25: Reel dimensions for 24 mm carrier tape (SOX28 package) and 16 mm carrier tape (SSOP20 package) A B D N T Carrier tape C G (max) (min) (min) (min) (max) 330 mm 13 mm 24.4 mm 24 mm (SOX28) 1.5 mm 20.2 mm 60 mm 30.4 mm (13-inch) ± 0.2 mm + 2/–0 mm 330 mm 13 mm 16.4 mm 16 mm (SSOP20) 1.5 mm 20.2 mm 60 mm 22.4 mm (13-inch) ± 0.2 mm + 2/–0 mm Note: The dimensions given in the table above incorporate tolerances that cover all variations on critical parameters. DocID9497 Rev 11 51/54

Part numbering M41ST87W 8 Part numbering Table 26: Ordering information scheme Example: M41ST 87Y MX 6 TR Device type M41ST Supply voltage and write protect voltage 87Y = VCC = 4.75 to 5.5 V (1) THS bit = '1': 4.50 V ≤ VPFD ≤ 4.75 V VCC = 4.5 to 5.5 V THS bit = '0': 4.20 V ≤ VPFD ≤ 4.50 V 87W = VCC = 3.0 to 3.6 V; THS bit = '1': 2.80 V ≤ VPFD ≤ 3.00 V VCC = 2.7 to 3.6 V; THS bit = '0': 2.55 V ≤ VPFD ≤ 2.70 V Package MX = SOX28 (2)(3) SS = SSOP20 (4) Temperature range 6 = –40 to 85 °C Shipping method For SOX28: Blank = ECOPACK® package, tubes (Not for new design - use TR)(1) TR = ECOPACK® package, tape and reel For SSOP20: F = ECOPACK® package, tape and reel Notes: (1)Not recommended for new design. Contact ST sales office for availability. (2)Lead-free second level interconnect and RoHS compliant (by exemption). (3)The SOX28 package includes an embedded 32,768 Hz crystal. (4)Available in 3.3 V (W) version only. For other options, or for more information on any aspect of this device, please contact the ST sales office nearest you. 52/54 DocID9497 Rev 11

M41ST87W Revision history 9 Revision history Table 27: Document revision history Date Revision Changes May-2002 1 First issue. 23-Apr-2003 2 Document promoted to preliminary data. 10-Jul-2003 2.1 Update tamper information (Figure 4, 5, 14, 15, 16; Table 17, 4, 12). Update electrical, charge pump, and clock information (Table 17; 11-Sep-2003 2.2 Figure 5, 19, 20). Reformatted; added lead-free information; updated characteristics 15-Jun-2004 3 (Figure 2; Table 1, 14, 17, 24). 7-Sep-2004 4 Update maximum ratings (Table 14). Clarify NC connections, add inadvertent tamper, update MX attribute 29-Jun-2005 5 (Figure 2, 21; Table 1, 6, 24). 28-Mar-2006 6 Update to “Avoiding inadvertent tamper paragraph“ paragraph. Reformatted document and title change; updated cover page, 10-Sep-2008 7 Figure 4, 15, 20, Section 6: Package mechanical data. Added SSOP 20-pin package (updated cover page, Section 1.1, Figure 1, 4, 5, 13, 28, Table 1, 2, Section 3.4, Section 3.8, added Figure 3, 30, Table 18, 21, Section 8); updated Table 11, 14, 17, 18, 24, Figure 10, 11, Figure 15.16, 19, 24, 27, 28, text in Section 1, Section 2, Section 2.1, Section 2.1.5, Section 2.4, Section 2.5, 31-Mar-2010 8 Section 2.6.1, Section 2.6.3, Section 2.6.5, Section 2.6.6, Section 2.6.8, Section 2.6.9, Section 2.7, Section 2.8, Section 3, Section 3.0.1, Section 3.1, Section 3.2, Section 3.3, Section 3.4, Section 3.8, Section 3.9, Section 3.11, Section 3.13, Section 3.16, Section 3.17, Section 6; reformatted document. 5.0 V version of device (M41ST87Y) is not recommended for new 25-Jan-2011 9 design (updated cover page, Table 24); added tape and reel specifications (Figure 31, 32, 33, Table 22, 23). Updated Table 24: Ordering information scheme as the shipping 03-Oct-2011 10 method in tubes is not recommended for new design. Updated Figure 3: "20-pin, SSOP connections" Added Table 2: "I2C slave address" 19-May-2016 11 Added Tj to Table 16: "Absolute maximum ratings" Revised presentation of Section 6.1: "SOX28 package information" Removed section entitled “References” DocID9497 Rev 11 53/54

M41ST87W IMPORTANT NOTICE – PLEASE READ CAREFULLY STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order acknowledgement. Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of Purchasers’ products. No license, express or implied, to any intellectual property right is granted by ST herein. Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product. ST and the ST logo are trademarks of ST. All other product or service names are the property of their respective owners. Information in this document supersedes and replaces information previously supplied in any prior versions of this document. © 2016 STMicroelectronics – All rights reserved 54/54 DocID9497 Rev 11