How to connect a PC to a Videocrypt decoder

How to connect a PC to a Videocrypt decoder
-------------------------------------------

Markus Kuhn -- 1994-06-19


The easiest way to connect your PC to a Videocrypt pay-TV decoder is to
use the card slot as an interface and connect it with a voltage
converter (MAX232) and a TTL open collector driver (74LS07) to the
RS-232 serial port. This way, you don't even have to open the decoder
and the PC can now act as a smart card.

WARNING: In order to build the adapter described below, you will at
         least require some basic hobby electronics experience. If
         you don't understand, how the described circuitry works,
         better don't use it! Although the described procedure is
         relatively secure, serious errors might in the worst case
         damage both your PC and your TV system.

The chip cards used by the Videocrypt pay-TV system follow exactly the
specification ISO 7816 (you might find this international standard in a
good library, if you are interested in more details). Also, the
protocol is the "asynchronous half duplex T=0 protocol" with "active
low reset" and "inverse convention" as defined in this standard. The
following description may also be used in order to connect computers to
other ISO 7816 compatible chip card systems (e.g. GSM mobile phones or
other pay-TV decoding systems) if they also use asynchronous
transmission. For smart card systems which use synchronous transmission
(e.g. most phone cards) the interface described here will need some
modifications.

According to ISO, a chip card is 85.60 mm long, 53.98 mm high, 0.76 mm
thick and the edges are rounded with a radius of 3.18 mm. It has eight
defined contact areas (C1 - C8 in the diagram below), each of which is
at least 2 mm wide and 1.7 mm heigh:


	   ______________________________________
	 /                                        \
	|                                          |
	|                                          |
	|    C1   C5                               |
	|    C2   C6                               |
	|    C3   C7                               |
	|    C4   C8                               |
	|                                          |
	|                                          |
	|                                          |
	 \________________________________________/



These contacts have the following purpose:


	C1	VCC	Supply voltage (+5 V, max. 200 mA)
	C2	RST	Reset signal
	C3	CLK	Clock signal
	C4	-	reserved
	C5	GND	Ground
	C6	VPP	Programming voltage (5-25 V)
	C7	I/O	Data input/output
	C8	-	reserved


The following table gives the precise location of the contact areas.
These areas are only minimum areas, the actual contacts might be larger
but must of course be properly isolated from each other.

In the following table,

	A	represents the maximum distance between the card's left
		edge and the contact area's left edge,
	B	represents the minimum distance between the card's left
		edge and the contact area's right edge,
	C	represents the maximum distance between the card's top
		edge and the contact area's upper edge,
	D	represents the minimum distance between the card's top
		edge and the contact area's lower edge.


		  A	  B	  C	  D
      -----------------------------------------
	C1	10.25	12.25	19.23	20.93
	C2	10.25	12.25	21.77	23.47
	C3	10.25	12.25	24.31	26.01
	C4	10.25	12.25	26.85	28.55
	C5	17.87	19.87	19.23	20.93
	C6	17.87	19.87	21.77	23.47
	C7	17.87	19.87	24.31	26.01
	C8	17.87	19.87	26.85	28.55


Older card systems (defined in a French AFNOR standard) had these
contacts located higher (distance from the top between 9.07 mm and
18.39 mm, distance from the left identical). As some decoders support
both contact area alternatives, make sure that this old contact area is
properly isolated or you'll produce a short circuit when inserting your
card. You may have noticed, that the contacts are arranged in the usual
1/10 inch (= 2.54 mm) system (i.e. like the pins of a 8-pin DIL chip).

You can produce your card adapter by making a PCB with contact areas at
the above listed locations. The PCB must have precisely the thickness
and width of a real card, but it may be longer, so that you can locate
the interface electronics on the part which remains outside the slot.
Cards are inserted in most decoders with the contacts on the bottom
side. Normal PCBs are about 1.3 mm think and won't fit into the slot.
Either you get a PCB which is about 0.8 mm thick or you make it
thinner, e.g. by using a sander machine. Perhaps you find also ready to
use test cards with connectors instead of producing your own or you
simply open the decoder, clamp contacts to the resistors near the card
slot and insert a normal plastic card in order to activate the
card-presence switch (this is NOT recommended: there are unisolated 230
V parts inside the decoder and they could kill you if you are not very
carefull!!!).

The adapter will only need the card contacts I/O, GND, RST and VCC. On
the RS-232 side, the following contacts will be used:

		   Sub-D 25-pin	   Sub-D 9-pin
      ---------------------------------------------------------
	TxD		2		3	transmit data
	RxD		3		2	receive data
	RTS		4		7	request to send
	CTS		5		8	clear to send
	DSR		6		6	data set ready
	GND		7		5	ground
	DCD		8		1	carrier detect (here: reset)
	DTR		20		4	data terminal ready


The pins DTR, DSR and CTS are not actually needed, they are just
connected together in the adapter, so that defined levels are available
on them because some software might need this. RTS is connected to an
unused MAX232 input and the corresponding TTL output might be used for
generating the reset signal if the adapter is used for connecting a PC
to a card instead of an decoder.

The following components are necessary for the adapter

	1 x	0.5-0.8 mm PCB single sided or test card
	1 x	IC Maxim MAX232CPE (or Linear Technology LT1081CN)
	1 x	IC 74LS07 (or 7407)
	5 x	capacitors 1 uF (or higher), 16 V
	1 x	female Sub-D connector (9 or 25-pin)
	1 x	card slot (optional)

These components cost together less than 20 DM.

The MAX232 converts the RS-232 levels (about +10 and -10 V) to TTL
voltage  (0 and +5 V) and vice versa without requiring anything else
than +5 V power supply. This chip contains two TTL->RS-232 and two
RS-232->TTL drivers and needs four external 1 uF capacitors in order
to generate the RS-232 voltage internally. The adapter electronic gets
its power supply from the decoder's VCC line or you can use an external
5 V supply if you wish.

The card slot's RST line is connected using one of the TTL->RS-232
drivers in the MAX232 to DCD, so that the software and the decoder can
easily resynchronize in case of a protocol error.

The I/O line is a bidirectional half-duplex asynchronous TTL level
serial port that is operated in a Videocrypt system with 9600 bits/s.
We can connect this line to a MAX232 TTL input driver (which is
connected to RxD and sends bytes to the PC) in order to receive data
from the decoder. The TxD signal is converted in the MAX232 to TTL
level and is connected with an open collector TTL driver to I/O. This
open collector driver (one of six in the 74LS07) has a high impedance
output during idle state and 1 and is connected to GND during a 0 on
it's input. As there is already a pull-up resistor to +5 V on I/O in
the decoder, this circuitry guarantees, that the adapter is in high
impedance state if the TxD line is idle and delivers the correct
voltage if the PC sends bytes and the decoder is in reception mode. As
we don't connect totem-pole or tristate outputs to I/O, a short circuit
should be impossible in the adapter.

The following diagram describes the whole interface:


              +-------------+  +             
  +-----------|1     V    16|---+---o +5V (VCC)
 +|          +|             |  ===
 === +5V o-||-|2  MAX232  15|---+---o GND (card & RS-232)
  |           |             |
  +-----------|3      +---14|----o DCD                    +-<-o DTR
           +  |       |     |                             |
     +---||---|4      | +-13|----o RTS                    +->-o DSR
     |        |       | v   |                             |
     +--------|5      | +-12|- (unused TTL output)        +->-o CTS
          +   |       |     |
     GND o-||-|6      +-<-11|----o RST
              |             |
     RxD o----|7  ---<--- 10|-------------------+----o I/O
              |             |              |\   |
     TxD o----|8  --->---  9|--------------| |--+
              +-------------+             1|/ 2
                                          74LS07
    At the MAX232, pin 2 delivers
    +10 V and pin 6 delivers -10 V.        (also connected to 74LS07:
                                           pin 7=GND, pin 14=VCC)


Pay attention to the polarity of the capacitors (marked with a + in the
diagram next to each capacitor)! The -->-- symbols in the AX232
diagram above indicate the voltage converters inside the chip. You
might want to add an LED and a resistor (between 220 and 1k ohm)
between VCC and GND so that you can see when the decoder activates the
interface. If you can't live without blinking bits, then add a LED and
a resistor from VCC to I/O. The capacitor between VCC and GND is not
absolutely necessary, but recommended especially if you add other
circuitry on the board (e.g. the quartz oscillator described below).

As a side effect of this simple interface design, every byte sent by
the PC is at the same time also received by the PC. Consequently, you
can test the circuit with a terminal emulator and external +5 V supply
by switching of local echo: if you still see every typed character
immediately on the screen, the interface should be all right. Software
must be capable of dealing with this echo from the interface. As
specified in the ISO standard, the decoder activates VCC only shortly
before a reset and deactivates VCC again if an answer-to-reset packet
isn't received from the card in time after the reset signal.

A few additional hints:

If you have a larger distance between the PC an the decoder, then
locate the adapter electronic near the decoder, because the RS-232
interface is much more suitable for long cables than the TTL signals. 
Cables of 12 m length have sucessfully been used and you shouldn't have
problems with RS-232 cables up to 25 m length and more.

You can also use this adapter circuit to allow a PC to listen to the
data traffic between a decoder and a real card. Just connect the real
card and the adapter parallel to the decoder and don't let the PC
software transmit anything. Suitable card slots are available for
little money from various manufacturers (see below for addresses).
Videocrypt uses the inverse convention data format, i.e., you have to
reverse and invert the bits in each byte in the PC software in order to
get the correct byte value. For more details about the protocol, check
ISO 7816-3.

There are many alternative ways to build this interface if you don't
have some of the components available. E.g. the MAX232 could be
replaced by the fully compatible LT1081 from Linear Technology. The
circuit still works fine if you use higher capacitors than 1 uF (e.g.
my prototype worked fine with 4 22 uF types which were left from a
previous project), but use equally sized capacitors. If you use the pin
compatible MAX220 (a low power version) instead of the MAX232, then use
capacitors with 10 uF or higher. The MAX232 should be the easiest
available one of these chips. If it is more convenient for your layout,
then you can use instead of the 1->2 driver in the 74LS07 one of the
remaining 5 drivers at the pins 3->4, 5->6, 9->8, 11->10 and 13->12. If
your local electronic store doesn't have a 74LS07 or 7407, then use
e.g. two of the six open collector inverters in a 74LS05 (same pin
assignment as the 74LS07) in series and a 2.2k pull-up resistor to VCC
between them. Peoples have also suggested quick-and-dirty designs where
the 74LS07 open-collector driver is replaced by a 100 ohm resistor and
the MAX232 by a CMOS inverter.

If you don't have the experience to etch your own PCB (it's not very
difficult) or don't know someone who does, then you could solder the
components in a universal raster PCB or plug them into an experimental
board. Then produce just a simple PCB with only the ISO card contacts
and connections to outside the decoder by mechanically removing the
thin copper layer with a good knive between the 4 contacts and lines.

Peoples have also suggested to use an empty German phone card, which
also has ISO contacts. Remove the integrated chip from the other
non-contact side, test whether the contacts are now isolated from each
other and use a special conductive ink you'll find in an electronics
store in order to draw connections to the end of the card were you
connect wires. I haven't tested this and don't know how well it works,
but you might also consider it. If you ask dealers who sell Videocrypt
clone cards, you might also get a suitable PCB with card contacts for
little money.

You can use the same circuit with a few modifications in order to
connect a PC to a smart card. This allows you to use the PC in order to
emulate a decoder from the card's point of view.

Just connect the card's RST input to pin 12 of the MAX232 so that you
can control the RST line with the RS-232 RTS signal. Add a 20k pull-
upresistor from the card's I/O line to VCC. In addition, you'll have to
generate a 3.57 MHz CLK signal for the card. If you use other
frequencies, remember that the time for one protocol bit is 372 CLK
periods and you'll have to adjust the bits/sec rate. Either you'll find
a complete 3.5 or 3.579545 MHz quartz oscillator which delivers a TTL
signal or you build one like the following circuit using a 3.579545 MHz
quartz (easily available, because each NTSC TV set contains one) and 2
of the 6 CMOS inverters in a 74HC04. I've also tried a 74HCT04 and a
4069, but they both are less suitable. And of course you'll need an
external regulated +5 V power supply (a decoder will give you only VCC
and CLK while it is talking to a card). In order to protect both the
card and the adapter, it might be a good idea to put a 10 ohm resistor
in all lines to the card (and perhaps even protection diodes to VCC and
GND). If you don't already have a VCC/GND capacitor near the 74HC04,
then add 0.1 uF between VCC and GND.

           
     1M         2.2k        3|\4            10
  +-/\/\/--+----/\/\/-----+--| o-----+-----/\/\/---o CLK
  |        |2             |  |/      |
  |       -o-             |          |100 pF
  |     /_____\           |         ===
  |        |1             |          |
  |        | 3.579545 MHz |          |
  |        |     +--+     |          -      (also connect to 74HC04:
  +--------+---| |  | |---+         GND     pin 5,7,9,11,13=GND,
           |     +--+     |                 pin 14=VCC=+5 V)
           |27pF          |27pF
          ===            ===
           |              |
           -              -
          GND            GND

You can easily build a universal device that can be operated in two
modes by changing the position of two jumpers:

  a) In the first mode, you have a PC<->decoder adapter. The PCB is plugged
     into the card slot of a decoder, and either you let the PC talk
     to the decoder or you put a card into the additional slot on your
     device and use the PC in order to listen to the traffic between
     card and decoder. Use the jumpers in order to connect pins CLK and
     RST of your card slot to those of the decoder.

  b) In the second mode of operation, you have a PC<->card adapter. The
     device is not connected with the decoder and you have to attach a
     +5 V power supply. The jumpers are switched, so that your card slot
     has its CLK pin connected to the output of the above quartz oscillator
     and the RST pin to pin 12 of the MAX232. As in this mode the PCB
     isn't plugged into the decoder, it is convenient to have tiny
     feets attached to the PCB so that you can put it on a table.

Now you've built a cheap and flexible debugging tool for all ISO 7816
compatible smart card systems that use an asynchronous protocol. Other
ideas are to add a chip socket for a microcontroller (e.g. a PIC16C84
from Microchip or a 8032+EPROM from Intel) parallel to the additional
card slot and to add pins where you can easily connect an oscilloscope.
This allows you to debug card software for microcontrollers easily.
Feel free to produce and sell such a device, but if you do it
commercially, please be nice and don't forget to send me a free one,
too. :-)

ISO 7816 chip card connectors are e.g. available from:

     Amphenol-Tuchel Electronics GmbH
     August-Haeusser-Str. 10
     D-74080 Heilbronn
     Germany

     phone +49 7131 486-0
     fax   +49 7131 486-323

A few final remarks about the security of the adapter:

Normally, both the RS-232 interface and the decoder slot should not be
harmed by short circuits, but be careful. Also try to avoid
electrostatic voltage (e.g. generated by walking on a suitable carpet)
near the interface, because discharges cause easily decoder or PC
crashes and could theoretically even harm the hardware (especially CMOS
chips like the 74HC04). Before connecting the decoder and the PC the
first time, you might want to check the voltage between the two GND
lines. In correct installations, the difference of the GND potentials
is very low (below 1 V), but someone has reported up to 50 V (high
impedance only). Most TV sets, VCRs, SAT receivers and decoders are not
connected with the earth line, so their GND potential is floating or
sometimes only defined by e.g. the shielding of the antenna cable. If
your antenna system is not correctly installed, the shield might also
not be grounded. One quick solution might be to switch off all
components and then connect first the RS-232 GND line to e.g. the GND
in the SCART connector or the GND at an audio connector of your decoder
before connecting anything else. You might also design the ISO contacts
on the PCB so that GND touches all pins at first when the PCB is
inserted in the card slot. The only really secure protection between
your PC and your decoder would be to use an isolating RS-232 driver
(e.g. you might want to check data sheets of Maxim's MAX250/251/252
chips which offer RS-232 protection up to 1500 V), but under normal
circumstances you won't need this.

Use this circuit at your own risk and please don't blame me if anything
doesn't work or produces only smoke and noise. Good luck ... ;-)