EM MICROELECTRONIC - MARIN SA EM4233SLIC 1k bit Read/Write ISO15693 Standard Compliant Smart Contactless Device General Description Features The EM4233SLIC is a long range passive CMOS integrated circuit intended for use in applications requiring a contactless read/write memory offering unsurpassed read range performance. The configurable 1k bit EEPROM memory included in the chip is organized as 32 blocks of 32 bits. The enhanced 32 bit password security feature permits a flexible administration of the memory access rights which makes it the right solution for advanced theft protection. This latest generation of EEPROM memory offers data retention of 60 years enabling solutions for long-term asset management applications like archives or long life books. The on-chip Electronic Article Surveillance (EAS) and the Application Field Identifier (AFI) features make the device compliant with all world wide library standards and infrastructures. The IC supports all the ISO15693 mandatory commands and many of the optional commands. Its command set is completed by unique custom commands which provide a higher degree of differentiation in terms of security, flexibility and data protection. ISO15693 / ISO18000-3 standard compliant Long range, low power vicinity transponder IC 64-bit ISO15693 Unique Identifier (UID) 1k bit user’s free EEPROM (32 blocks of 32 bits) 60 years memory data retention 32 bit password security to protect chip memory data and functionality Optional Password Protected Application Field Identifier Smart and flexible Electronic Article Surveillance feature Password protected Destroy function to deactivate the label forever Password Protected Privacy mode Data Storage Format Identifier (DSFID) EEPROM blocks/pages Locking mechanisms Support all mandatory and most optional ISO/IEC 15693 commands and a complete set of custom commands Fast read command for long data transactions using a double speed data rate On-chip resonant capacitor options: 23.5pF and 97pF -40 to +85˚C temperature range Bonding pads optimized for flip-chip assembly Applications Each EM4233SLIC contains a 64 bit unique serial number programmed at factory level which cannot be altered and guaranties the uniqueness of each device. Library management Archives and collections Long-term asset management Pharmaceutical Block Diagram L2 Lr VPOS Cr CBU F RECTIFIER R E G U L A T O R Vdd POWER MONITOR POR PCK L1 CLOCK EXTRACTOR AM DEMODULATOR RECEIVED CLOCK EEPROM PULSE LOGIC MOD MODULATOR LIMITER Figure 1 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 1 www.emmicroelectronic.com EM4233SLIC Definitions, abbreviations and symbols Abbreviations AFE Analog Front-End AFI Application family identifier ASK Amplitude shift keying CID Card IDentifier CRC Cyclic redundancy check DSFID Data storage format identifier EOF End of frame LSB Least significant bit MSB Most significant bit RF Radio Frequency RFU Reserved for future use SDB Segment Definition Block SOF Start of frame UID Unique identifier VCD Vicinity Coupling Device (reader) VICC Vicinity Integrated Circuit Card (tag) Terms and definitions downlink tag to reader communication link uplink reader to tag communication link modulation index index equal to [a-b]/[a+b] where a and b are the peak and minimum signal amplitude respectively. Note: The value of the index may be expressed as a percentage. subcarrier a signal of frequency fs used to modulate the carrier of frequency fc byte a byte consists of 8 bits of data designated b1 to b8, from the most significant bit (MSB,b8) to the least significant bit (LSB,b1) Symbols a Carrier amplitude without modulation b Carrier amplitude when modulated fc Frequency of operating field (carrier frequency) fs Frequency of subcarrier Anticollision loop Algorithm used to prepare for and handle a dialogue between a VCD and one or more VICCs in its energizing field. Absolute Maximum Ratings Parameter Symbol Supply Voltage Voltage at any other pin except L1,L2 Storage temperature Maximum AC current induced on L1, L2 Electrostatic discharge 1) VPOS Conditions -0.3 to 7V Vpin VSS-0.3 to 3.6V Tstore -55 to +125V Icoil_RMS 50mA VESD Handling Procedures This device has built-in protection against high static voltages or electric fields; however, anti-static precautions must be taken as for any other CMOS component. Unless otherwise stated, proper operation can only occur when all terminal voltages are kept within the specified voltage range. Unused inputs must always be tied to a defined logic voltage level. 2000V Table 1 Note 1: Human Body Model (HBM; 100pF, 1.5kohm) with reference to substrate VSS Operating Conditions Parameter AC peak current induced on L1, L2 in operating conditions Operating temperature Stresses above thelisted maximum ratings may cause permanent damages to the device. Exposure beyond specified operating conditions may affect device reliability or cause malfunction. Symbol Icoilop Min Max 30 Unit mA Top -40 85 °C Table 2 Electrical Characteristics Operating conditions (unless otherwise specified): Vcoil = 4Vpp VSS = 0V fcoil = 13.56MHz Sine Wave Parameter Symbol Top=25°C Conditions Resonance Capacitor Cr23 f = 13.56 MHz, U = 2Vrms Resonance Capacitor Cr97 f = 13.56 MHz, U = 2Vrms Coil limiting voltage VCLIM Min. Typ. Max. Unit 22.3 23.5 24.7 pF 92.1 97 101.8 pF 5.5 6.5 Icoil=10mA 4.5 EEPROM Cycling Endurance Ncy erase all/ write all 10 EEPROM Retention Tret Top=55°C after 10 cycles 5 5 60 V Cycles Years Table 3 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 2 www.emmicroelectronic.com EM4233SLIC 1. VICC to VCD timings All timings are derived from the field frequency (fc = 13.56MHz). Initialization (startup time) 400 s Tinit Table 4 Timings in the table below represent minimum execution time in case of commands writing to EEPROM. A VICC answer is sent in the appropriate following time slot specified by ISO/IEC 15693 (option_flag is not set) or after EOF reception (option_flag is set). Command Write Single Block Lock Block AFI Write AFI Lock DSFID write DSFID Lock Set EAS Reset EAS Lock EAS Protect EAS Write EAS ID Write EAScfg Write password Protect Page Destroy Enable Privacy Disable Privacy Symbol (1 of 4 mode) (1 of 16 mode) Execution time [ms] Execution time [ms] 4.6 4.7 3.6 3.7 6.2 6.3 3.6 3.7 6.2 6.3 3.6 3.7 2.2 2.3 4.2 4.3 2.2 2.3 3.6 3.7 4.9 5.0 4.9 5.0 4.6 4.7 4.9 5.0 3.6 3.7 6.2 6.3 6.2 6.3 Twr Tlock Twafi Tlafi Twdsfid Tldsfid Tseas Treas Tleas Tpeas Tweasid Tweascfg Tpassword Tprotect Tdestroy Tprivacyen Tprivacydis Table 5 In case of commands writing to EEPROM if option_flag is not set then downlink communication timings (VICC to VCD answer) are defined according to ISO/IEC15693 are specified by the formulae: t1nom + a multiple of 4096/fC with a total tolerance of ±32/ fC and latest after 20 ms upon detection of the rising edge of the EOF of the VCD request where t1nom = 4352/ fC (320,9 us) Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 3 www.emmicroelectronic.com EM4233SLIC 2. Fast Read Multiple Block command mode The Fast Read Multiple Block mode enables a double speed downlink data rate which corresponds to a two times faster data rate defined by the ISO/IEC 15693-3. This fast mode allows communication speeds of 53 kbit/s or 13 kbit/s depending on the selected Low / High data rate. The table below describes all timing combinations when the answer is sent in Fast mode. Fast mode timing [values are in number of clocks at the carrier frequency or defined in microseconds] SOF Single subcarrier High data rate Dual subcarrier Single subcarrier 28.32us Dual subcarrier DATA1 DATA=0 4 (fc/32) 9.44us DATA=1 9.44us 4 (fc/32) EOF DATA0 12 (fc/32) 28.32us SOF 14 (fc/28) 12 (fc/32) DATA1 DATA=0 4 (fc/32) DATA=1 5 (fc/28) 5 (fc/28) 4 (fc/32) EOF DATA0 12 (fc/32) SOF 113.28us 48 (fc/32) DATA=0 16 (fc/32) DATA=1 Low data rate 12 (fc/32) 14 (fc/28) DATA1 37.76us 37.76us 16 (fc/32) EOF DATA0 48 (fc/32) SOF 56 (fc/28) 48 (fc/32) 113.28us DATA1 DATA=0 16 (fc/32) 20 (fc/28) DATA=1 20 (fc/28) 16 (fc/32) EOF 28.32 us DATA0 12x (fc/32) 48 (fc/32) 9.44 us 56 (fc/28) Table 6 4x (fc/32) SOF 4x (fc/32) 9.44 us 9.44 us DATA=0 4x (fc/32) 9.44 us 4x (fc/32) DATA=1 12x (fc/32) 28.32 us EOF Figure 2: Fast mode timing example - (high data rate, single subcarrier) Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 4 www.emmicroelectronic.com EM4233SLIC 3. Memory organization The chip memory is composed of 2 areas: User’s data memory from Block 0 up to Block 31 Configuration area The 1k bit EEPROM user’s data memory is organized in 32 blocks of 32 bits. User’s free memory area starts at memory block 0. A memory block is composed of 4 bytes (32 bits). A memory page is composed of 4 blocks. Bit31 Bit0 Block User Block 0 0 User Block 1 1 User Block 2 2 User Block 3 3 Page 0 `````````` User Block 24 / EAS 24 User Block 25 / EAS 25 User Block 26 / EAS 26 User Block 27 / EAS 27 User Block 28 / EAS 28 User Block 29 / EAS 29 User Block 30 / EAS 30 User Block 31 / EAS 31 ```````` 6 User’s Data Memory 7 Memory configuration Area Figure 3 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 5 www.emmicroelectronic.com EM4233SLIC 4. EEPROM Memory Map description 4.2 4.1 User’s data Memory This memory area is accessible only by custom commands in accordance with the following description. At delivery, the user’s data memory is access free. No protection in Read or Write access is activated. Memory Configuration area 4.2.1 Unique Identifier (UID) In normal mode, the access to the user’s data memory depends on both Lock bits and Page protection bits. 64 bit length according to ISO/IEC 15693-3 and used to guaranty the uniqueness of each device. It is programmed by EM Microelectronic-Marin SA at wafer test level and cannot be changed afterwards. In Secure mode, the write access to the user’s data memory depends on Lock bits only. The UID is set by the IC manufacturer in accordance with the figure below: UID format MSB 63 LSB 56 ‘E0’ 1 bit CAP 55 48 IC Mfg Code 5 bit IC Id 47 0 IC manufacturer serial number 10 bit Customer Id 32 bit Unique Serial Number Figure 4 The UID comprises: The 8 MSB’s indicate the Allocation Class is 'E0' as defined in ISO/IEC 15963. Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 6 The 8 bit IC manufacturer code as defined in ISO/IEC 15963. In accordance with ISO/IEC 78166:1996/Amd.1, EM-Microelectronic is identified by hexadecimal code 0x16. The 48 bit IC manufacturer serial number as defined in ISO/IEC 15963 and assigned by the IC manufacturer. The EM manufacturer serial number consists of the following information, MSB to LSB: 1 bit capacitor value 5 bit IC Id (different for each member of the EM ISO 15693 / ISO 18000-3 family) 10 bit Customer Id 32 bit unique serial number IC Id: “0x0A” corresponds to EM4233SLIC CAP value is ‘0’ for 23.5pF version CAP value is ‘1’ for 97pF version www.emmicroelectronic.com EM4233SLIC 4.2.2 Lock Block Bits Defines which user’s data memory blocks are permanently locked against programming Lock block bits can be set by Lock Block command Changeable by Write Password command only in Secure Mode. 4.2.4 EAS Secure mode 5.2 Changeable by Write EAS ID command when LockEAS bit is not set 5.3 4.2.6 EAS CFG Changeable by Write LockEAS bit is not set EAScfg command Privacy mode When the privacy mode is enabled and after power-up occurs, the IC remains silent to any command received from the VCD except the Login command. As soon as device enters Secure mode, it accepts all commands as usual. 4.2.5 EAS ID 5.1 The VICC enters into Secure mode after a successful login command transaction using the valid 32 bit password. Defined by custom commands (Set EAS, Reset EAS) if LockEAS bit is not set Features and modes If the VICC is in the secure mode, the content of the Memory Configuration area and user memory area can be changed by using the commands executable in this mode. 4.2.3 32 bit Password 5. Electronic Article Surveillance (EAS) feature The EM4233SLIC integrates an EAS function for anti-theft purposes. It is activated by Set EAS command, deactivated by Reset EAS command, locked by Lock EAS command and can be securely protected by Protect EAS command. when 4.2.7 Page Protection bits If the EAS function is active, then the VICC answers to Active EAS command as follows: An EAS Telegram stored in User free memory ranging from User Block 24 to User Block 31 is sent to VCD. The data is always sent ending with User Block 31. The length of the EAS Telegram is programmable by Write EAScfg command. A pair of bits define the protection status of the corresponding user’s data memory page against reading and/or writing Protection bit status is not taken in account in secure mode Changeable in Secure mode by Protect Page command 5.4 Protection status of a page is defined according to the table below: Bit (n+1) Bit (n) The EM4233SLIC supports the AFI feature defined by the ISO/IEC15693 standard. Protection status 0 0 Memory page always readable and writable. 0 1 Memory page is Read protected. Writing is possible. 1 0 Memory page is Write protected. Reading is possible. 1 1 Memory page is Read and Write protected. Application Field identifier (AFI) For security aspects, required by some applications, the AFI can be optionally password protected. The optional AFI sub-families of a family (including proprietary sub-families) defined by ISO15693-3 are not supported by the IC. The application can program an AFI value using the Write AFI command. The AFI value can also be locked using the Lock AFI command. Table 7 After an AFI locking operation, it is still possible to change the AFI value by: o Sending a Login command using the 32 bit password in order to access the chip in secure mode o Writing a new AFI value. Note: n = 2 x page number When the EM4233SLIC exits the secure mode, the new AFI value is locked in the chip memory. This feature can be used in applications requiring security for check-in and check-out operations. Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 7 www.emmicroelectronic.com EM4233SLIC Mandatory Mandatory Inventory Stay Quiet 6.1 b1 b2 b3 b4 b5 b6 b7 b8 x x 1 0 x x 0 0 x x 0 0 0 1 0 0 Sub-carrier EM4233SLIC supports only error code 0x0Fh. Active Flags Command types Four sets of commands are defined: Mandatory, Optional, Custom and Proprietary. RFU ’01’ ’02’ Function Option Type Addressed Command Code Select For detailed information concerning protocol timings, modulation, bit-coding, data rates, transactions, anticollision process, device states etc. please refer to ISO15693-2 and ISO15693-3 standards. Mandatory commands Protocol ext. 6.3 Inventory ISO15693 Commands (Contactless interface) Data rate 6. Table 9 Command codes ‘2C’ ’A2’ ‘A3’ ‘A4’ ‘A5’ ‘A6’ ‘A7’ ‘A8’ ‘B4’ ‘B6’ ‘B8’ ‘B9’ ‘BA’ ‘BB’ ‘C3’ ’E4’ 0 x x x 0 x x 0 0 x x x 0 x x 0 0 x x x 0 x x 0 0 x x x 0 x x x x x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x 1 x x x x x 0 0 x x x x 0 0 0 0 0 0 x x 0 0 x x 0 0 x x 0 0 x x 0 0 x x x x x x x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x x x x x x x x x x x x x x x x 0 0 0 0 0 0 0 x x 0 0 x 0 x x 0 0 x x x 0 x x 0 0 x x 0 0 x x 0 0 0 1 x 0 x x 0 0 x x x 0 x x 0 0 x x x 0 x x 0 0 x x x 0 x x 0 0 x x 0 0 RFU ‘2B’ 0 Option ‘25’ ’26’ ‘27’ ‘28’ ‘29’ ‘2A’ x Select ’23’ x Addressed ‘22’ Write single Optional block Optional Lock block Read multiple Optional blocks Optional Select Optional Reset to ready Optional Write AFI Optional Lock AFI Optional Write DSFID Optional Lock DSFID Get System Optional Information Get Multiple Optional block security status Custom Set EAS Custom Reset EAS Custom Lock EAS Custom Active EAS Custom Protect EAS Custom Write EAS ID Custom Write EAScfg Write Custom Password Protect Custom Memory Page Get Multiple block Custom protection status Custom Destroy Custom Enable Privacy Custom Disable Privacy Custom Fast Read multiple blocks Proprietary Login Inventory ’21’ Read single Optional block Command code = ’01’ b1 b2 b3 b4 b5 b6 b7 b8 x x 1 0 x x 0 0 x x 0 0 0 1 0 0 Protocol ext. ‘20’ 6.3.1 Inventory Active Flags Data rate Command Type Function Code ’01’ Mandatory Inventory ’02’ Mandatory Stay Quiet Sub-carrier 6.2 x1 10 See ISO/IEC 15693-3 standard for detailed information. 6.3.2 Stay quiet Command code = ‘02’ See ISO/IEC 15693-3 standard for detailed information. Table 8 x means used flag, can be 0 or 1. Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 8 www.emmicroelectronic.com EM4233SLIC Optional Commands ’23’ Optional ‘25’ ’26’ ‘27’ ‘28’ ‘29’ ‘2A’ Optional Optional Optional Optional Optional Optional ‘2B’ Optional ‘2C’ Optional x x 0 0 x x x 0 See ISO/IEC 15693-3 standard for detailed information. Supported Option Flag 0 and Option Flag 1. x x 0 0 x x x 0 6.4.4 Read multiple blocks x x 0 0 x x x 0 Command code = ‘23’ x x 0 0 x x x 0 x x x x x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x 1 x x x x x 0 0 x x x x 0 0 0 0 0 0 x x 0 0 x x 0 0 x x 0 0 x x 0 0 See ISO/IEC 15693-3 standard for detailed information. Supported Option Flag 0. Supported Option Flag 1. If VCD in normal mode tries to read a block inside the page protected area and it is protected against reading. then the appropriate data will be masked by 0 values. 6.4.5 Select Command code = ‘25’ RFU Optional b1 b2 b3 b4 b5 b6 b7 b8 Option Optional ‘22’ Command code = '22' Addressed ’21’ Read single block Write single block Lock block Read multiple blocks Select Reset to ready Write AFI Lock AFI Write DSFID Lock DSFID Get System Information Get Multiple block security status Select Optional Active Flags Protocol ext. ‘20’ Function Inventory Type Sub-carrier Command Code 6.4.3 Lock block Data rate 6.4 See ISO/IEC 15693-3 standard for detailed information. 6.4.6 Reset to ready Table 10 6.4.1 Read single block Command code = ’26’ Command code = '20' See ISO/IEC 15693-3 standard for detailed information. See ISO/IEC 15693-3 standard for detailed information. 6.4.7 Write AFI Supported Option Flag 0 and Option Flag 1. Command code = '27' See ISO/IEC 15693-3 standard for detailed information. If VCD in normal mode tries to read a read protected memory block, the VICC returns back a 0 data value. Supported Option Flag 0. 6.4.2 Write single block Supported Option Flag 1. Command code = ‘21’ Note: It’s optional to allow rewriting of AFI value in the Secure mode if AFI is locked. See ISO/IEC 15693-3 standard for detailed information. Supported Option Flag 0 and Option Flag 1. 6.4.8 Lock AFI If VCD tries to write a block locked against writing then the Error_flag is set. Command code = '28' See ISO/IEC 15693-3 standard for detailed information. If VCD in normal mode tries to write a block inside the page protected area and it is protected against writing, then the Error_flag is set. Supported Option Flag 0. Supported Option Flag 1. Note: The internal VICC powercheck function guaranties the correct writing operation and detects any error that could occur. 6.4.9 Write DSFID Command code = '29' See ISO/IEC 15693-3 standard for detailed information. Supported Option Flag 0. Supported Option Flag 1. 6.4.10 Lock DSFID Command code = '2A' See ISO/IEC 15693-3 standard for detailed information. Supported Option Flag 0. Supported Option Flag 1. Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 9 www.emmicroelectronic.com EM4233SLIC 6.4.11 Get system information Command code = '2B' See ISO/IEC 15693-3 standard for detailed information. Response parameters description: Info flags field value is 0Fh UID code field on 64 bits DSFID value is present AFI value is present VICC memory size - the device provides 32 blocks (1Fh) of 4 bytes (03h) user’s data memory IC Reference value is 02h 6.4.12 Get multiple block security status Command code = '2C' See ISO/IEC 15693-3 standard for detailed information. Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 10 www.emmicroelectronic.com EM4233SLIC Custom commands Custom ‘B6’ Custom ‘B8’ Custom ‘B9’ ‘BA’ Custom Custom ‘BB’ Custom Custom b3 0 0 0 0 0 0 0 x x 0 x x 0 0 x x x 0 0 x x 0 x x 0 x x x x b4 0 0 0 0 0 0 0 b5 b6 x x x x x x x x x x x x x x x1 0 10 b7 x x x x x x x b8 0 0 0 0 0 0 0 This command activates the EAS features if the EAS feature is not locked. If EAS bit is locked then the Error_flag is set. x 0 x x 0 If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tseas and specified in Table 4. x x 0 0 0 0 1 x 0 0 x x x 0 0 0 x x x 0 0 0 x x x 0 If the EAS parameters are protected by a password (SecureEAS = ‘1’) then the command can only be executed in Secure mode. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. Set EAS request format SOF Flags 8 bits Sub-carrier ‘C3’ Write Password Protect Memory Page Get Multiple block protection status Destroy Enable Privacy Disable Privacy Fast Read multiple blocks b2 x x x x x x x Set EAS 8 bits IC Mfg code 8 bits UID (optional) 64 bits CRC 16 EOF 16 bits Figure 5 RFU ‘B4’ b1 x x x x x x x Option Set EAS Reset EAS Lock EAS Active EAS Protect EAS Write EAS ID Write EAScfg Select Custom Custom Custom Custom Custom Custom Custom Command Code = ‘A2’ Active Flags Addressed Function Inventory Type Protocol ext. Command Code ’A2’ ‘A3’ ‘A4’ ‘A5’ ‘A6’ ‘A7’ ‘A8’ 6.5.1 Set EAS Data rate 6.5 Set EAS response format when Error_flag is set SOF Table 11 Flags 8 bits Error Code 8 bits CRC16 16 bits EOF Figure 6 If IC Mfg Code is not correct VICC remains silent and the operation is not executed. Set EAS response format when Error_flag is NOT set SOF Flags 8 bits CRC16 16 bits EOF Figure 7 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 11 www.emmicroelectronic.com EM4233SLIC 6.5.2 Reset EAS 6.5.3 Lock EAS Command Code = ‘A3’ Command Code = ‘A4’ This command deactivates the EAS features if the EAS feature is not locked. If EAS bit is locked then the Error_flag is set. This command locks the current state of EAS parameters. If the EAS parameters are protected by a password (SecureEAS = ‘1’) then the command can be executed only in Secure mode. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Treas and specified in Table 4. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. If the EAS parameters are protected by a password (SecureEAS = ‘1’) then the command can be executed only in Secure mode. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tleas and specified in Table 4. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. Lock EAS request format Reset EAS request format SOF SOF Flags 8 bits Reset EAS 8 bits IC Mfg code 8 bits UID (optional) 64 bits CRC 16 EOF Flags 8 bits Lock EAS 8 bits IC Mfg code 8 bits UID (optional) 64 bits CRC 16 EOF 16 bits Figure 11 16 bits Figure 8 Lock EAS response format when Error_flag is set Reset EAS response format when Error_flag is set SOF SOF Flags 8 bits Error Code 8 bits CRC16 16 bits EOF Flags 8 bits Error Code 8 bits CRC16 16 bits EOF Figure 12 Figure 9 Lock EAS response format when Error_flag is NOT set Reset EAS response format when Error_flag is NOT set SOF SOF Flags 8 bits CRC16 16 bits EOF Flags 8 bits CRC16 16 bits EOF Figure 13 Figure 10 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 12 www.emmicroelectronic.com EM4233SLIC 6.5.4 Active EAS Active EAS response format when Error_flag is NOT set and the EAS Mask length is not equal to 0 Command Code = ‘A5’ SOF VICC answers to this command only if EAS is activated. If EAS is deactivated then VICC ignores this command and remains silent. 8 bits IC Mfg code 8 bits SOF UID (optional) 64 bits Flags 8 bits EAS Telegram See Note EAS ID 16 bits CRC16 16 bits EOF In case of an error, the device remains silent. EOF 16 bits Figure 14 6.5.5 CRC16 16 bits Protect EAS Command Code = ‘A6’ This command protects the EAS parameters. It sets SecureEAS to ‘1’. EOF Figure 15 The command can be executed only in Secure mode. Note: the EAS Telegram length depends on the EASCfg option bit settings. The EAS Telegram length could be comprised between 32 up to 256 bits, see Table 12. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tpeas and specified in Table 4. In case of an error, the device remains silent. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. If the Option Flag of the VCD request is set to 1: Active EAS request format S O F Flags 8 bits Figure 18 CRC 16 Active EAS response format when Error_flag is NOT set SOF EOF Active EAS response format when Error_flag is NOT set and the EAS Mask length is equal to 0 Active EAS request format Active EAS 8 bits CRC16 16 bits Note: The EAS Telegram length depends on the EASCfg option parameter settings. The EAS Telegram length could be comprised between 32 up to 256 bits. If the Option Flag of the VCD request is set to 0: Flags EAS Telegram See Note Figure 17 The EAS feature presents a high level of flexibility and permits a general or a selective EAS detection. To allow such operating mode, two types of configuration have been implemented in the device. SOF Flags 8 bits Protect EAS request format Flags Active EAS IC Mfg code UID (optional) EAS Mask length EAS ID CRC16 8 bits 8 bits 8 bits 64 bit 8 bits (Note1) See Note2 16 bits E O F SOF Flags 8 bits Figure 16 Note 1: Only EAS Mask length values 0, 8 and 16 are supported. Note 2: 0, 8 or 16 bits (optional). IC Mfg code 8 bits UID (optional) 64 bits CRC 16 EOF 16 bits Figure 19 Protect EAS response format when Error_flag is set SOF Request parameter: EAS Mask Length to identify how many bits of the EAS ID are valid (optional) EAS ID (optional) Protect EAS 8 bits Flags 8 bits Error code 8 bits CRC16 16 bits EOF Figure 20 Protect EAS response format when Error_flag is NOT set Only the device which has the corresponding EAS ID and the EAS feature activated responds to the VCD command. In this mode, the VCD performs a selective EAS SOF Flags 8 bits CRC16 16 bits EOF Figure 21 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 13 www.emmicroelectronic.com EM4233SLIC 6.5.6 Write EAS ID 6.5.7 Write EAScfg Command Code = ‘A7’ Command Code = ‘A8’ This command writes a new EAS Identifier Number. This command writes a new EAScfg. If the EAS parameters are protected by a password (SecureEAS = ‘1’) then the command can be executed only in Secure mode. If the EAS parameters are protected by a password (SecureEAS = ‘1’) then the command can only be executed in Secure mode. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Teasid and specified in Table 4. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Teascfg and specified in Table 4. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. Write EAS ID request format Write EAScfg request format S O F Flags Write EAS ID IC Mfg code UID (optional) 8 bits 8 bits 8 bits 64 bits EAS ID value 16 bits E O F CRC16 16 bit Figure 22 Write EAS ID response format when Error_flag is set SOF Flags 8 bits Error code 8 bits CRC16 16 bits EOF Figure 23 Write EAS ID response format when Error_flag is NOT set SOF Flags 8 bits CRC16 16 bits EOF S O F Flags Write EAScfg 8 bits 8 bits IC Mfg code 8 bits UID (optional) EAScfg value CRC16 64 bits 8 bits 16 bit E O F Figure 25 Note: only two LSB bits of EAScfg are used. EAScfg option bits bit 1 bit 0 EAS message length 0 0 256 bit EAS message (user block 24 to 31) 0 1 128 bit EAS message (user block 28 to 31) 1 0 64 bit EAS message (user block 30 to 31) 1 1 32 bit EAS message (user block 31) Table 12 Write EAScfg response format when Error_flag is set SOF Figure 24 Flags 8 bits Error code 8 bits CRC16 16 bits EOF Figure 26 Write EAScfg response format when Error_flag is NOT set SOF Flags 8 bits CRC16 16 bits EOF Figure 27 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 14 www.emmicroelectronic.com EM4233SLIC 6.5.8 Write Password 6.5.9 Protect Page Command Code = ‘B4’ Command Code = ‘B6’ This command changes the current Password value to a new one. The Protect Page command defines the protection condition of a user’s data memory page (1 page = 4 blocks = 128 bits). The command contains a data field (Password identifier) which indicates which item will be modified. The Write Password command can only be executed in Secured mode and when the device is in an addressed or selected mode. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tpassword and specified in Table 4. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. F l a g s Write Pass word IC Mfg code UID (optional) 8 bits 8 bits 8 bits 64 bits Pass word Identif ier New Password 8 bits 32 bits C R C 1 6 If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. Protect Page request format E O F Figure 28 Password identifier 00h If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tprotect and specified in Table 4. S O F Write Password request format S O F The command is password protected thus it can only be executed in Secure mode. Write Password response format when Error_flag is set CRC16 16 bits 8 bits 8 bits Protect Status 00h 01h 10h 11h Login Password Error Code 8 bits 8 bits UID (optional) Page Nb Protect Status 64 8 bits 8 bits C R C 1 6 16 bits E O F For the Protect Status definition, please, refer to the Page Protection bits in table below. Password Flags 8 bits IC Mfg code Figure 31 Table 13 SOF Flags Protect Page Description memory page is readable and writable memory page is Read protected memory page is Write protected memory page is Read and Write protected Table 14 EOF Protect Page response format when Error_flag is set Figure 29 SOF Flags 8 bits Error Code 8 bits CRC16 16 bits Write Password response format when Error_flag is NOT set SOF Flags 8 bits CRC16 16 bits EOF EOF Figure 32 Protect Page response format when Error_flag is NOT set Figure 30 SOF Flags 8 bits CRC16 16 bits EOF Figure 33 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 15 www.emmicroelectronic.com EM4233SLIC 6.5.10 Get multiple block protection status 6.5.11 Destroy Command code = 'B8' Command Code = ‘B9’ When receiving the Get multiple block protection status command, the VICC sends back the block protection status. This command destroys the device. The Destroy bit is set and the device will no longer react to any command from a VCD. The number of blocks in the request is one less than the number of block protection status that the VICC returns in its response. The command is password protected thus it can only be executed in Secure mode and when the device is in an addressed or selected mode. Get multiple block protection status request format: If an error response is received by VCD, the destroy operation was not executed. S O F Get multiple Flags block protection status 8 bits 8 bits IC Mfg code 8 bits UID (optional) 64 bits First Block number E Number CRC16 O of block F 8 bits 16 bits Figure 34 8 bits If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tdestroy and specified in Table4. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. Destroy request format Request parameter: First block number Number of blocks S O F Flags Destroy IC Mfg code UID (optional) 8 bits 8 bits 8 bits 64 bits 16 bits Figure 37 Get multiple block protection status response when Error_Flag is set: SOF Flags 8 bits Error Code 8 bits CRC16 16 bits EOF E O F CRC 16 Destroy response format when Error_flag is set Figure 35 SOF Flags 8 bits Error Code 8 bits CRC16 16 bits EOF Figure 38 Get multiple block protection status response format when Error_Flag is NOT set: Destroy response format when Error_flag is NOT set SOF Flags Block protection status CRC 16 8 bits 8 bits 16 bits EOF SOF Flags 8 bits CRC16 16 bits EOF Figure 39 Repeated as needed Figure 36 Block protection status byte description bit 0 1 2 7-3 Description if ‘1’ then locked by Lock bit if ‘1’ then protected against reading by Read Page protection bit if ‘1’ then protected against writing by Write Page protection bit not used (always ‘0’) Table 15 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 16 www.emmicroelectronic.com EM4233SLIC 6.5.12 Enable Privacy 6.5.13 Disable Privacy Command Code = ‘BA’ Command Code = ‘BB’ The Enable Privacy command sets Privacy bit to ‘1’ and puts the device into a silent mode. Then, after power-On, the device always waits for a successful Login command. This command sets Privacy bit to ‘0’. The Enable Privacy command is password protected thus it is only executed in Secure mode. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tprivacyen and specified in Table 4. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. Enable Privacy request format SOF Flags 8 bits Enable Privacy 8 bits The command is password protected thus it is only executed in Secure mode. If the Option_flag is not set, the VICC returns its response when it has completed the write operation starting after time Tprivacydis and specified in Table 4. If Option_flag is set, the VICC waits for the reception of an EOF from the VCD and upon such reception returns its response. Disable Privacy request format SOF IC Mfg code UID (optional) 8 bits 64 bits CRC 16 EOF Flags 8 bits Disable Privacy 8 bits IC Mfg code UID (optional) 8 bits 64 bits CRC 16 EOF 16 bits Figure 43 16 bits Figure 40 Disable Privacy response format when Error_flag is set SOF Enable Privacy response format when Error_flag is set SOF Flags 8 bits Error Code 8 bits CRC16 16 bits EOF Flags 8 bits Error Code 8 bits CRC16 16 bits EOF Figure 44 Figure 41 Disable Privacy response format when Error_flag is NOT set Enable Privacy response format when Error_flag is NOT set SOF Flags 8 bits CRC16 16 bits SOF Flags 8 bits CRC16 16 bits EOF Figure 45 EOF Figure 42 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 17 www.emmicroelectronic.com EM4233SLIC 6.5.14 Fast Read Multiple blocks 6.6 Proprietary commands Command code = 'C3' S O F Flags Fast Read Multiple blocks IC Mfg code UID (optional) First Block number E Number CRC16 O of blocks F Table 16 If IC Mfg Code is not correct VICC remains silent and the operation is not executed. 8 bits 8 bits 8 bits 64 bits 8 bits 8 bits 16 bits Figure 46 Request parameters: First block number Number of blocks The command answer format and framing are the same as in the case of Read Multiple blocks command. However the command answer data rate is realized in Fast mode as described in Table 4. 6.6.1 Login Command Code = ‘E4’ The Login command enables Secure EM4233SLIC if the correct password is used. mode of The Login command is not successful if the password is incorrect, then the Error_flag is set and VICC returns to normal mode. After a successful Login, the VICC enters Secure mode and user has special rights defined in the specification. Secure mode is lost in case of: power on reset Login with wrong password value In all other cases, the Secure mode is kept. Even if an error occurs, Secure mode is not lost. Login request format S O F Flags Login IC Mfg code UID (optional) Password 8 bits 8 bits 8 bits 64 bits 32 bits E O F CRC 16 16 bits Figure 47 Login response format when Error_flag is set SOF Flags 8 bits Error Code 8 bits CRC16 16 bits EOF Figure 48 Login response format when Error_flag is NOT set SOF Flags 8 bits CRC16 16 bits EOF Figure 49 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 RFU Command request format: Option Login Addressed Proprietary Select ’E4’ Active Flags b1 b2 b3 b4 b5 b6 b7 b8 x x 0 0 x x 0 0 Protocol ext. Function Inventory Type Data rate Command Code Sub-carrier The command request format and framing are similar to the Read Multiple blocks command. 18 www.emmicroelectronic.com EM4233SLIC 7. EM4233SLIC Chip Floorplan – 23.5pF Cres version 80 80 3 5 4 122 536 829 1054 EM4233SLIC 751 114 1 2 142 Y 1034 X All dimensions in m Pad Opening : 86um X 86um Figure 50 Pin description Pin Name I/O Description 1 COIL1 ANA Antenna terminal 2 COIL2 ANA Antenna terminal 3 TEST_IO I/O Test purposes – non-active pad 4 TEST_IO I/O Test purposes – non-active pad 5 TEST_IO I/O Test purposes – non-active pad Table 17 Copyright 2012, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version 5.0, 5-Oct-12 19 www.emmicroelectronic.com CONFIDENTIAL EM4233SLIC 8. EM4233 Floorplan – 97pF Cres version 80 80 3 5 4 122 536 928 1152 EM4233SLIC 751 114 1 2 142 Y 1034 X All dimensions in m Pad Opening : 86um X 86um Figure 51 Pin description Pin Name I/O Description 1 COIL1 ANA Antenna terminal 2 COIL2 ANA Antenna terminal 3 TEST_IO I/O Test purposes – non-active pad 4 TEST_IO I/O Test purposes – non-active pad 5 TEST_IO I/O Test purposes – non-active pad Table 18 Copyright 2010, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version , 5-Oct-12 20 www.emmicroelectronic.com CONFIDENTIAL EM4233SLIC 9. Ordering Information From wafer from delivery, please refer to EM4233SLIC wafer specification document. 9.1 DIE Form: EM4233SLIC Vx WS 11 - %%% Circuit Nb: EM4233SLIC Customer Version: %%% = only for custom specific version Version: V1 = 23.5pF resonant capacitor V2 = 97pF resonant capacitor Die form: WW = Wafer WS = Sawn Wafer/Frame Thickness: 6 = 6 mils (152um) 7 = 7 mils (178um) 11 = 11 mils (280um) 29 = 29 mils (725um) Figure 52 9.2 Standard Versions: The versions below are considered standards and should be readily available. For other versions, please contact EM Microelectronic-Marin S.A. Please make sure to give the complete part number when ordering. Part Number EM4233SLICV1WW6E EM4233SLICV1WS6E EM4233SLICV2WW6E EM4233SLICV2WS6E Package / Die Form Unsawn wafer, 6 mils thickness Sawn wafer, 6 mils thickness Unsawn wafer, 6 mils thickness Sawn wafer, 6 mils thickness Delivery form / Bumping Gold bump Gold bump Gold bump Gold bump Table 19 EM Microelectronic-Marin SA (“EM”) makes no warranties for the use of EM products, other than those expressly contained in EM's applicable General Terms of Sale, located at http://www.emmicroelectronic.com. EM assumes no responsibility for any errors which may have crept into this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property rights of EM are granted in connection with the sale of EM products, neither expressly nor implicitly. In respect of the intended use of EM products by customer, customer is solely responsible for observing existing patents and other intellectual property rights of third parties and for obtaining, as the case may be, the necessary licenses. Important note: The use of EM products as components in medical devices and/or medical applications, including but not limited to, safety and life supporting systems, where malfunction of such EM products might result in damage to and/or injury or death of persons is expressly prohibited, as EM products are neither destined nor qualified for use as components in such medical devices and/or medical applications. The prohibited use of EM products in such medical devices and/or medical applications is exclusively at the risk of the customer Copyright 2010, EM Microelectronic-Marin SA 4233SLIC-DS.doc, Version , 5-Oct-12 21 www.emmicroelectronic.com