There are many types of smartcards. Phonecards are one type of smart-cards. Generally, a smart-card is any type of pocket-sized card (like credit cards) with an embedded chip on one side. This chip is actually a microcontroller with a non-volatile memory of specific size.
Pinout configuration of telecard smart-cards
First of all, let's see the pinout of those phonecards. If you take a closer look to the parallelogram chip, you will notice that there are lines which separates the surface into 6 or 8 areas:
Each one of these areas is a pin used either to provide power to the embedded microcontroller, or to interface this microcontroller with the outside world. For the telecards, these pins are:
1: VCC, the 5 volts supply for the microcontroller
4: Reserved for Future Use
6: VPP, programming voltage (5 or 21 volts if NMOS card)
7: I/O pin
8: Reserved for Future Use
Short description: Number 1 and 5 are for the chip's power supply, which is 5 volts. Number 3 and 7 are the clock and data pins for the interface: By providing pulses to the clock pin, the corresponding bit of the current memory position of the chip appears at the I/O pin, it is THAT simple. Finally, the Reset pin: This pin is used to reset the memory position counter.
The communication protocol
Like any other interface, smart cards have their own interface protocol. For the telecards, this protocol is very simple. One thing that I must mention is that this page talks about only the Greek second generation phonecards with 128 bits memory and 5-bytes octal counter! For more information regarding other types of phonecards, check out the references section of this circuit.
Let's take a look now the available 4 operations that we can do with a phonecard:
1 Reading the phonecard memory
During the reading operation, the reset pin must be held LOW. There is an internal memory position counter (MPC) which increases each time a pulse is applied to the clock pin. The MPC increases during the positive edge of the clock pulse. During the negative edge, the data of the memory position that the MPC points appears at the I/O pin. Here is the timing diagram of this operation:
2 Resetting the MPC (Memory Position Counter)
There is no direct method to define which memory position bit we want to perform a read operation. The only way is to reset the counter and start again reading from memory position #0. It is very important to run a cold reset sequence before start reading the phonecard, because there is no other reliable method to determine in which memory position the MPC points at. The sequence to do a cold-reset is this:
After this sequence, the Memory Position Counter will become 0, and the very first bit of the card memory (position 0) will appear at the I/O pin. You can immediately read this bit and go on reading the rest of the card memory as explained before.
Here is the timing diagram of the reset sequence:
3 Write to the memory card
With this command you can write to the octal counter in the card's memory position which holds the calling units. Later on we will discuss about the memory mapping of the phonecards. In short, the octal counter is a 4 or 5 bytes long counter which holds the calling units that a telecard has. I do not know for the other smartcards, but as far as the phonecards are concerned, you can only decrease this value. This makes absolute sense of course. Should the embedded microcontroller had allowed someone to increase this octal counter, then we could increase this counter whenever a phonecard ran out of calling units and refill it again. The octal counter can ONLY be decreased... No other operation is allowed.
Although the write sequence is common for all phone cards, the counter may differ from country to country. Go to the references section to get more info. I will only discuss about the 2nd generation Greek phonecards. These cards have a 5-byte long octal counter and a write command can only turn aces into zeros. Here is the write sequence:
After this sequence is ended, the unwritten memory position bit will be erased and the new value will automatically appear at the I/O pin. Here is a timing diagram of this sequence during which the ace (1) bit of the current memory position is written so that it becomes zero (0):