EM MICROELECTRONIC - MARIN SA
EM4423
DUAL FREQUENCY
NFC TYPE 2 & EPC GEN2 V2 TRANSPONDER IC
Description
EM4423 corresponds to the latest generation of EM
Microelectronic contactless devices, bringing innovative
features to the NFC and EPCTM worlds. The chip combines
two functionalities on one single die, the EPC technology
used for long range application purposes and the NFC used
to exchange data in a proximity range. Both protocols may
share a common unique ID.
Targeted applications and market segments include retail,
product authentication or smart NFC posters.
A tag or label based on the EM4423 provides multiple
benefits and usages via the EPC communication interface
like stock inventory, product returns, and data privacy. The
same tag or label also enables new marketing services like
product information or loyalty programs using an NFC
enabled smartphone.
The chip is a dual frequency device supporting
ISO/IEC14443 Type A, NFC ForumTM Type 2 specifications,
ISO/IEC18000-63 and EPC Gen2 V2. Additional features
have been added to provide chip privacy. For the NFC
interface, the smart counter increments its value each time
the NFC message has been read by the end-user.
Each chip is manufactured with a 96-bit unalterable unique
identifier (UID) to ensure full traceability. The same UID
number is used by both RF protocols. During an
ISO/IEC14443 anti-collision procedure, the 7 bytes which are
part of the 96-bit are sent back by the transponder IC.
The EM4423 offers two non-volatile memories which are
accessible by both RF air interfaces. The two memories are
segmented to implement multiple applications. Each chip is
delivered with a pre-programmed 96-bit EPC encoding
supporting Multi-vendor Chip-based Serialization (MCS).
EM4423 supports the optional BlockWrite command,
enabling the fast encoding of a 96-bit EPC. EM4423 also
supports the optional Untraceable command to hide portions
of memory of the tag or label.
NFC interface
ISO/IEC 14443A -3 compliant tag
NFC Forum Type 2 compatible
Enables NDEF data structure configurations
Communication baud rates at 106kbps
7 byte unique ID number using same serialization as
EPC interface
1920-bit user’s memory
Anti-tearing support for NFC capability container
(CC) and Static/Dynamic lock bytes
NFC Memory locking mechanism per block/page
ACCESS counter increased at first reading
Optional read-only locking function
Optional limit of unsuccessful LOGINs
Optional security timeout for unsuccessful LOGINs
Optional control of EPC privacy features
UHF power detection
17pF or 50pF NFC on-chip resonant capacitor
EPC interface
ISO/IEC 18000-63 compliant
EPC Gen2 V2 compliant
-
Alteration EAS compliant
-
Tag Alteration (Core) compliant
Supports multi-vendor chip-based serialization
128-bit or 224-bit UII/EPC encodings
96-bit TID using same serialization as NFC
interface
Features
Dual Frequency 1-step inlay manufacturing
Common unique ID
Shared memory
Minimum 100k write cycles endurance
Minimum 10 years data retention
Extended temperature range (-40C to +85C)
Sawn wafers, 3/6-mil thickness, gold bumps
160-bit or 64-bit USER memory
32-bit Access and Kill passwords
Fast writing using the BlockWrite command
Block permalock for USER memory
NFC field detection
NFC ACCESS counter is readable
NFC Forum and the NFC Forum logo are trademarks of the Near Field Communication Forum.
EPC is a trademark of EPCglobal Inc.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
1
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Applications
EPC
NFC
Product Information
Wifi, Bluetooth pairings
Smart posters, Advertisings
Coupons, loyalty programs
Supply chain management
Tracking and tracing
Container identification
Asset control
Typical operating application
HF+
UHF+
EM4423
HF‒
UHF‒
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
2
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Symbols, abbreviated terms and notation
AC
ATQA
BCC
BLF
CC
CRC_A
E
FDT
fa
fc
HLTA
lsb
LSB
msb
MSB
P
PCD
PICC
REQA
RFU
S
SAK
SEL
WUPA
Anticollision
Answer To reQuest, Type A
Block Check Character (UID CLn check byte), Type A
Backscatter Link Frequency (EPC)
Capability Container
Cyclic Redundancy Check error detection code, Type A
End of communication, Type A
Frame Delay Time PCD to PICC, Type A
UHF carrier frequency
HF carrier frequency
HaLT command, Type A
Least Significant Bit
Least Significant Byte
Most Significant Bit
Most Significant Byte
Odd Parity bit, Type A
Proximity Coupling Device
Proximity Card or object
REQuest command, Type A
Reserved for Future Use (always understood as ‘0’ if not mentioned differently)
Start of communication, Type A
Select AcKnowledge, Type A
SELect code, Type A
Wake-UP command, Type A
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
3
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
References
[ISO_14443_3]
ISO/IEC 14443-3 (Type A) – Initialization and anti-collision
[NFC_T2TOP]
NFC Forum Type 2 Operation Technical Specification, Version 1.1
[NFC_DIGITAL] NFC Forum Digital Protocol Technical Specification, Version 1.0
[NFC_NDEF]
NFC Forum Data Exchange Format Technical Specification, Version 1.0
[ISO_18000_63] ISO/IEC 18000-63 : Information technology – Radio frequency identification
for item management – Part 63: Parameters for air interface communications at 860 MHz to
960 MHz Type C
[EPC_Gen2v2] “EPCTM Radio-Frequency Identity Protocols, Generation-2 UHF RFID,
Specification for RFID Air Interface Protocol for Communications at 860 MHz - 960 MHz,
Version 2.0.1 Ratified” from EPCglobal Inc., April 2015
[EPC_TDS]
"EPC Tag Data Standard, GS1 Standard, Version 1.9, Ratified, Nov-2014"
from EPCglobal Inc.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
4
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
TABLE OF CONTENTS
Description........................................................................................................................................................................... 1
Features .............................................................................................................................................................................. 1
Applications ......................................................................................................................................................................... 2
Typical operating application ............................................................................................................................................... 2
Symbols, abbreviated terms and notation ........................................................................................................................... 3
References .......................................................................................................................................................................... 4
Block Diagram ..................................................................................................................................................................... 7
Absolute Maximum Ratings ................................................................................................................................................. 8
Handling Procedures ........................................................................................................................................................... 8
Operating Conditions ........................................................................................................................................................... 8
Electrical Characteristics – NFC Forum Type 2 Contactless Interface ................................................................................ 9
Electrical Characteristics – EPC Contactless Interface ....................................................................................................... 9
NVM Electrical Characteristics ............................................................................................................................................ 9
Timing Characteristics – NFC Forum Type 2 Contactless Interface .................................................................................. 10
Timing Characteristics - EPC Contactless Interface .......................................................................................................... 10
Overview (NFC) ................................................................................................................................................................. 11
Overview (EPC) ................................................................................................................................................................. 11
Memory Access Arbitration ................................................................................................................................................ 11
Functional Description ....................................................................................................................................................... 12
States and Transitions ........................................................................................................................ 12
State diagram ...................................................................................................................................... 12
States description................................................................................................................................ 12
NFC Functional Description ............................................................................................................................................... 13
Interface states and transitions ........................................................................................................... 13
NFC Memory organization ................................................................................................................................................. 16
EPC Memory Mapping for Small EPC ................................................................................................. 17
EPC Memory Mapping for Large EPC ................................................................................................ 17
Memory Content at Delivery ................................................................................................................ 18
Static Lock bytes ................................................................................................................................. 19
Capability container (CC) .................................................................................................................... 20
NFC User memory .............................................................................................................................. 20
EPC mapped memory ......................................................................................................................... 20
Gen2V2config Word ............................................................................................................................ 21
Dynamic Lock bytes ............................................................................................................................ 23
IC Configuration 0 word ...................................................................................................................... 24
IC Configuration 1 word ...................................................................................................................... 25
IC Configuration 2 word ...................................................................................................................... 26
IC Configuration 3 word ...................................................................................................................... 27
4 Byte Password ................................................................................................................................. 28
PACK
........................................................................................................................................... 28
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
5
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
2 Byte Password ................................................................................................................................. 28
32 Byte Signature................................................................................................................................ 28
NFC sharing “read” Lock Bytes ........................................................................................................... 29
NFC sharing “write” Lock Bytes ........................................................................................................... 30
EPC sharing “read” Lock Bytes ........................................................................................................... 31
EPC sharing “write” Lock Bytes ........................................................................................................... 32
NFC Command set ............................................................................................................................................................ 33
Summary of commands ...................................................................................................................... 33
Commands and states ........................................................................................................................ 33
Timing
........................................................................................................................................... 34
ISO14443-3 commands ...................................................................................................................... 34
ACK and NACK responses ................................................................................................................. 34
NFC commands .................................................................................................................................. 35
Proprietary commands ........................................................................................................................ 38
EPC functional description ................................................................................................................................................ 42
EPC memory organization .................................................................................................................. 42
EPC Gen2 V2 - Small EPC memory map ........................................................................................... 43
EPC Gen2 V2 - Large EPC memory map ........................................................................................... 44
NFC Memory Mapping ........................................................................................................................ 45
EPC Gen2 V2 Delivery State .............................................................................................................. 47
EPC Gen2 V2 Commands .................................................................................................................. 47
Write operations using the Tag Notification (TN) indicator .................................................................. 48
EPC Privacy Features ......................................................................................................................... 48
Pad location diagram ......................................................................................................................................................... 49
Pin description ................................................................................................................................................................... 49
Ordering Information.......................................................................................................................................................... 50
Versions ............................................................................................................................................................................ 50
Standard Versions and Samples ....................................................................................................................................... 50
Product Support................................................................................................................................................................. 51
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
6
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Block Diagram
Analog
Logic
NVM memories
UHF+
128/224-bit
EPC/UII
Modulator
Demodulator
Rectifier
ISO/IEC 18000-63
EPC Gen2 V2
160/64-bit
USER
Oscillator
UHFRNG
96-bit TID
7B UID Number
IC TEST
ACCESS
COUNTER
Power
management
ANTI-TEARING
LOCKING
MECHANISMS
HF+
Modulator
Demodulator
HF-
ISO/IEC 14443
NFC Forum
Type 2
CAPABILITY
CONTAINER
NDEF
MESSAGE
Rectifier
Clock extractor
EM4423
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
7
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Absolute Maximum Ratings
Parameters
Symbol
Min.
Max.
Unit
Storage temperature
TSTORE
-50
125
°C
VESD
-2000
2000
V
ESD hardness pad UHF+,
UHF-, HF+ and HF-2)
Note 1: IC impedance matched to antenna at read sensitivity (PRD_UHF)
Note 2: Human Body Model, all combinations between pins UHF+, UHF-, HF+, HF-.ESD measurements are made using die having VSS that is
mounted into CDIP packages.
Stresses above these listed maximum ratings may cause permanent damages to the device. Exposure beyond specified
operating conditions may affect device reliability or cause malfunction.
Handling Procedures
This device has built-in protection against high static voltages or electric fields; however, anti-static precautions must be taken
as for any other CMOS component. Unless otherwise specified, proper operation can only occur when all terminal voltages are
kept within the voltage range. Unused inputs must always be tied to a defined logic voltage level.
Operating Conditions
Parameters
Operating temperature
RF carrier frequency
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
Symbol
Min.
Max.
Unit
TOP
-40
+85
°C
fA
860
960
MHz
8
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Electrical Characteristics – NFC Forum Type 2 Contactless Interface
Operating conditions (unless otherwise specified): Vcoil = 4Vpp VSS = 0V, fc = 13.56MHz sine wave, Top=25°C
Parameters
Symbol
Resonance Capacitor – 17pF version
Cr17
Resonance Capacitor – 50pF version
Cr50
Operating frequency
Conditions
Min.
fc = 13.56MHz
U = 2Vrms
fc = 13.56MHz
U = 2Vrms
fc
-
Typ.
Max.
Unit
17
pF
50
pF
13.56
-
MHz
Electrical Characteristics – EPC Contactless Interface
Operating conditions (unless otherwise specified): TA=25°C.
Parameters
Symbol
Incoming RF carrier modulation
KM
Input impedance (between UHF+ and UHF-)
ZAB
Conditions
Min.
Typ.
65
Max.
Unit
100
%
28 –j370
22.5 – j349
fA = 866MHz
fA = 915MHz
NVM Electrical Characteristics
Parameters
Symbol
Conditions
Min.
Typ.
Max.
Unit
Erase / write endurance
TCYC
100k
Cycles
Retention
TRET
10
Years
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
9
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Timing Characteristics – NFC Forum Type 2 Contactless Interface
The time between the end of the last pause transmitted by PCD and the first modulation edge within the start bit transmitted
by PICC is defined as follows for data rate fc/128:
Last PCD bit = (1)b
(N x 128 + 84) / fc [ms]
Last PCD bit = (0)b
(N x 128 + 20) / fc [ms]
minimum time
[N]
maximum time
[N, ms]
TNACK
9
9
TREAD
9
≥ 9; ~5 ms
TWRITE
9
≥ 9; ~10 ms
TSECTOR_SELECT
9
9
TREAD_MULTIPLE_BLOCKS
9
≥ 9; ~5 ms
TREAD_COUNTER
9
≥ 9; ~5 ms
TEN_DIS_PRIVACY
9
≥ 9; ~10 ms
TLOGIN
9
≥ 9; ~5 ms
Symbol
Note: The NFC memory write operation timing can differ depending on the current content and data being written, it means
that PICC can reply in different timeslots.
Timing Characteristics - EPC Contactless Interface
The timings are according to [EPC_Gen2v2].
Note: The EPC memory write operation timing can differ depending on the current content and data being written.
Note: The EPC read operation for NFC memory is limited to a maximum data rate of 256Kbps. Using data rates above
256Kbps will result in read operations returning an error code.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
10
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Overview (NFC)
The EM4423 corresponds to the latest generation of NFC devices offering innovative and enriched features.
The EM4423 supports ISO/IEC 14443-3 Type A standard with data rate at 106kbps and complies with the NFC Forum
Type 2 specification.
The NFC memory offers R/W user’s memory structured by segments and memory pages. The NFC memory contains the
NFC capability container, the NDEF message and other proprietary data.
The EM4423 offers the maximum of flexibility in terms of security. The user has also the possibility to select a 4-byte
password with an optional and programmable limit of unsuccessful trials.
Each EM4423 chip is delivered with a unique 7-byte ID number programmed at wafer level.
The NFC memory is also accessible through EPC interface as specified later on.
The NFC specific mechanisms and features don’t influence EPC functionality excluding memory sharing and mechanisms
which are explicitly described.
Overview (EPC)
The EM4423 is an EPC RFID IC compliant with ISO/IEC 18000-63 and EPC Gen2 V2. It supports the core Tag Alteration
and Alteration EAS application requirements to provide data privacy and EAS capability.
Each chip is provided with a 96-bit inalterable unique identifier to ensure full traceability. The EM4423 is providing two
optional configurations of the memory. (128-bit EPC+160-bit USER or 224-bit EPC + 64-bit USER) In both cases also 16bit PC, 32-bit kill password, and 32-bit access password, and the support of ISO or EPC data structures. Each chip is
delivered with a pre-programmed 96-bit EPC encoding supporting Multi-vendor Chip-based Serialization (MCS).
EM4423 supports the optional BlockWrite command, enabling rapid EPC encoding.
The EPC memory is also accessible through NFC interface as specified later on.
The EPC specific mechanisms and features don’t influence NFC functionality excluding memory sharing and mechanisms
which are explicitly described.
Memory Access Arbitration
The NFC and EPC interfaces have access to both the NFC memory and the EPC memory. No priority is given to either air
interface. The memories cannot be accessed in parallel and memory access arbitration is performed on a per command
basis as they are received over the air interfaces.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
11
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Functional Description
States and Transitions
State diagram
Out of Both Fields
POWER-OFF
any RF
Field
entry
POWER-ON
POR_UHF
released
INITIALIZATION
HF RF field present
POR_HF released
&
not MUTED Mode
NFC
mode
s
UHF RF field present
EPC mode
NFC
COMMUNICATION
mode
NFC MUTED
mode
States description
As soon as the EM4423 enters RF operating field (HF or UHF), the energy from the operating field is
extracted to power the EM4423. It’s not distinguished if HF or UHF field is present. Also both fields can
be present at the same moment.
Firstly the Power-On is released and then the EM4423 initialization follows by reading initial values
from NVM memory during INITIALIZATION. The EM4423 stays quiet and ignores all incoming
communication.
If NFC MUTED mode is enabled (read during INITIALIZATION) then NFC interface stays quiet and
ignores all incoming NFC communication if some. HF field can support powering the chip and EPC can
work as expected.
If NFC MUTED mode is disabled (read during INITIALIZATION) then NFC interface is ready to execute
commands in NFC COMMUNICATION mode. HF field supports the chip powering and EPC can also
work as expected too.
EPC mode is always available (if not killed) after INITIALIZATION and EPC interface is ready to
execute commands.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
12
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
NFC Functional Description
Interface states and transitions
State diagram
the chip initialization DONE
NFC_QUIET
MUTED
mode
Privacy enabled
a) unexpected
command
LOGIN_OK
IDLE
b) unexpected
command
HALT
REQA,
WUPA
WUPA
READY
READ(0)
PRIVACY
PACK+2 Byte
Password
AC
SELECT CL2
HLTA
ACTIVE
LOGIN_OK
4 Byte
Password
HLTA
SECURE
Not mentioned transitions are described in the below text:
a) There is the transition to IDLE state if unexpected command is detected and the EM4423 is in
READY or ACTIVE or SECURE state and if EM4423 was never been before in the HALT state.
b) There is the transition to HALT state if unexpected command is detected and the EM4423 is in
READY or ACTIVE or SECURE state and if EM4423 was at least once in the HALT state.
The following symbols apply for the state diagram above:
AC
ANTICOLLISION command (matched UID)
SELECT CL2
SELECT Cascade Level 2 command (matched UID)
REQA, WUPA, HLTA
ISO/IEC 14443-3 commands
unexpected
transmission error detected or unexpected frame
READ(0)
NFC Forum Type 2 READ command from block address 0
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
13
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
States description
NFC_QUIET
The EM4423 is powered and after INITIALIZATION it listens for commands in this state.
IF the NFC MUTED mode is selected (depends on chip version) then no transition to other states
ELSIF privacy mode is selected then there is transition to PRIVACY state
ELSE transition to IDLE state.
PRIVACY
In the PRIVACY state it waits for successful LOGIN command and then there is transition to IDLE
state.
During PRIVACY the EM4423 is not replying to any ISO14443 communication during this state.
IDLE
In the IDLE state it listens for commands. The only REQA and WUPA commands are valid in this state
to reach READY state.
See also [ISO_14443_3].
READY
In the READY state, the bit frame anti-collision method shall be applied. Cascade levels are handled
inside this state to get the complete UID. If SELECT CL2 is completed then there is transition to
ACTIVE state.
The ACTIVE state is reached also after READ command with parameter addressing block 0. If more
PICCs are responding at the same moment to READ(0) then PCD can see the collision because as
part of the answer message is unique UID and PCD can continue accordingly. READ(0) can be
initiated by PCD in any stage inside READY state.
See also [ISO_14443_3].
HALT
This state is reached after HLTA command received in ACTIVE or SECURE states.
The only WUPA command can initiate the transition from HALT state to READY state. Any other
commands received in HALT state are interpreted as an error and EM4423 remains in HALT state.
During HALT the EM4423 stays quiet and ignores all incoming communication except WUPA
command.
See also [ISO_14443_3].
ACTIVE
In ACTIVE state the EM4423 is selected to communicate with PCD. Operations over memory are
performed with respect to lock bits.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
14
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
SECURE
The successful authentication by LOGIN provides the EM4423 to SECURE state. It enhances the
EM4423 to provide additional services which are not allowed in the ACTIVE state.
Following services are additionally specified in SECURE state:
o change password
o the PWD_PROT_ADDR address protection is ignored (like 7Fh set)
o PRIVACY
SECURE state is lost when:
o Power down
o Unexpected command
o HLTA command
Proprietary options and features
Privacy
This option is represented by PRIVACY state where the successful LOGIN command is expected.
The EM4423 replies only to the successful authentication by LOGIN command in this state.
It allows avoiding any chip tracking if needed. The chip is invisible for any reader.
The Privacy option can be enabled or disabled by the EN_DIS_PRIVACY command in SECURE state.
The new configuration is valid after next chip Power-up.
ACCESS counter
ACCESS counter represents a counter which is incremented once after Power-up when the first read
command is received (READ, READ_MULTIPLE_BLOCKS). This option can be enabled or disabled by
the appropriate configuration bit.
The ACCESS counter is anti-tearing mechanism proof.
If the ACCESS counter reaches maximum value (100 000 decimal) then next incrementations are
blocked.
A status of the counter can be read by READ_COUNTER command.
The ACCESS counter is available also through memory sharing via EPC interface.
Memory protection
The memory can be protected against writing and/or reading.
It is controlled by:
o Static Lock bits
o Dynamic lock bits
o Password protection address
o Sharing Lock Bytes
o SECURE vs ACTIVE state
Limit of unsuccessful LOGINs
The number of unsuccessful password authentications, in ACTIVE state, can be optionally limited.
When the limit specified by PWD_LIM is reached then a security timeout (100 ms typical) is initiated
and any following LOGIN is ignored until the security timeout has expired. If the unsuccessful LOGIN
counter is disabled then security timeout is ignored.
If the successful LOGIN is received before internal counter saturated then internal counter is cleared
and there is again available maximum number of attempts defined by PWD_LIM.
In PRIVACY state this feature is not available.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
15
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
NFC Memory organization
The memory is divided in blocks containing 4 bytes each.
NFC
Block
Address
(decimal)
0
1
2
3
4
5
…
63
64 to 79
80
81
82
83
84
85
86
87
…
94
95
96
97
98
Bytes Within a Block
MSB
Byte 0
Byte 1
LSB
Byte 3
Byte 2
UID0
UID3
BCC1
CC0
Data0
Data4
…
Data232
UID1
UID2
BCC0
UID4
UID5
UID6
RFU
Static Lock0
Static Lock1
CC1
CC2
CC3
Data1
Data2
Data3
Data5
Data6
Data7
…
…
…
Data233
Data234
Data235
EPC memory mapping (see tables below)
Dynamic
Dynamic
Dynamic
RFU
Lock0
Lock1
Lock Lock
RFU
RFU
RFU
IC Config 0
IC Config 1
IC Config 1
RFU
RFU
Config Locks
Config Locks
IC Config 2
RFU
RFU
RFU
IC Config 3
IC Config 3
EPC Privacy
RFU
EPC Privacy
RFU
Select
Set
4 Byte
4 Byte
4 Byte
4 Byte
Password0
Password1
Password2
Password3
2 Byte
2 Byte
PACK0
PACK1
Password0
Password1
32 Byte
32 Byte
32 Byte
32 Byte
Signature0
Signature1
Signature2
Signature3
…
…
…
…
32 Byte
32 Byte
32 Byte
32 Byte
Signature28
Signature29
Signature30
Signature31
NFC Sharing
NFC Sharing
NFC Sharing
NFC Sharing
Read Lock0
Read Lock1
Read Lock2
Read Lock3
NFC Sharing
NFC Sharing
NFC Sharing
NFC Sharing
Write Lock0
Write Lock1
Write Lock2
Write Lock3
EPC Sharing
EPC Sharing
RFU
RFU
Read Lock0
Read Lock1
EPC Sharing
EPC Sharing
RFU
RFU
Write Lock0
Write Lock1
Access
Type
(unless password
protected or
locked)
Memory
Type
Read Only
NVM NFC
Read & Write 1’s
Read & Write
NVM NFC
NVM NFC
Read & Write
NVM NFC
see below
NVM EPC
Read & Write 1’s
NVM NFC
Read & Write
NVM NFC
Read 0’s & Write
NVM EPC
Read 0’s & Write
NVM NFC
Read & Write
NVM NFC
Read & Write
NVM NFC
The NFC interface access to blocks 64 to 79 (EPC mapped memory) is controlled first by the NFC password
protection and locks used for the NFC User memory and subsequently by the EPC locks used by the EPC interface
unless stated otherwise in this document.
The NFC interface has read/write access to the EPC mapped memory but only as permitted by Gen2V2config word
byte0.
Block 64 is read/write from the NFC interface when Kill Pwd [1:0] = 00 2 or 012 and is both read and write protected
from the NFC interface when Kill Pwd [1:0] = 102 or 112.
Block 65 is read/write from the NFC interface when Access Pwd [1:0] = 00 2 or 012 and is both read and write
protected from the NFC interface when Access Pwd [1:0] = 10 2 or 112.
Blocks 66 to 68 can always be read but are always write protected from the NFC interface.
Blocks 69 to 78 can always be read but are write protected from the NFC interface when EPC [1:0] = 10 2 or 112.
Blocks 2, 3, 79, 80, 83, 84 are anti-tearing mechanism protected.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
16
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EPC Memory Mapping for Small EPC
NFC
Block
Address
(decimal)
64
65
66
67
68
EPC
MEMORY
BANK
RESERVED
TID
69
70
71
72
73
74
75
76
77
78
79
EPC/UII
USER
Bytes Within a Block
MSB
Byte 0
Byte 1
LSB
Byte 3
Byte 2
Word 0 : Kill Password MSW
Word 2 : Access Password MSW
Word 0
Word 2
Word 4
Word 1 : Kill Password LSW
Word 3 : Access Password LSW
Word 1
Word 3
Word 5
Word 0 : StoredCRC
Word 1 : StoredPC
Word 2 : SGTIN-96 MSW
Word 4
Word 6
Word 8
Word 0
Word 2
Word 4
Word 6
Word 8
Word 3
Word 5
Word 7 : SGTIN-96 LSW
Word 9
Word 1
Word 3
Word 5
Word 7
Word 9
N/A
Gen2V2 Configuration (see Gen2V2config Word)
Access
Type
(unless password
protected or
locked)
Memory
Type
Read & Write
NVM EPC
Read Only
ROM /
NVM EPC
Read & Write
Computed /
NVM EPC
Read & Write
NVM EPC
Read & Write
NVM EPC
Read & Write 1’s
Computed /
NVM EPC
Access
Type
(unless password
protected or
locked)
Memory
Type
NOTE: EPC Memory Bank example for SGTIN-96 encoding.
EPC Memory Mapping for Large EPC
NFC
Block
Address
(decimal)
64
65
66
67
68
EPC
MEMORY
BANK
Bytes Within a Block
MSB
Byte 0
Byte 1
LSB
Byte 3
Byte 2
Word 0 : Kill Password MSW
Word 2 : Access Password MSW
Word 0
Word 2
Word 4
Word 1 : Kill Password LSW
Word 3 : Access Password LSW
Word 1
Word 3
Word 5
69
Word 0 : StoredCRC
Word 1 : StoredPC
70
71
72
73
74
75
76
77
78
Word 2 : SGTIN-198 MSW
Word 4
Word 6
Word 8
Word 10
Word 12
Word 14 : SGTIN-198 LSW
Word 0
Word 2
Word 3
Word 5
Word 7
Word 9
Word 11
Word 13
Word 15
Word 1
Word 3
79
RESERVED
TID
EPC/UII
USER
N/A
Gen2V2 Configuration (see Gen2V2config Word)
Read & Write
NVM EPC
Read Only
ROM /
NVM EPC
Read & Write
Computed /
NVM EPC
Read & Write
NVM EPC
Read & Write
NVM EPC
Read & Write 1’s
Computed /
NVM EPC
NOTE: EPC Memory Bank example for SGTIN-198 encoding.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
17
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Memory Content at Delivery
At chip delivery, all memory is programmed to 00h if not stated differently.
The Capability Container (CC) is programmed during the IC production according to NFC Forum
Type 2 Tag specification as follows:
Capability Container (CC)
CC0
Value at
delivery
(Hex)
E1h
CC1
10h
CC2
1Eh
CC3
00h
Field name
Description
E1h indicates that NDEF data is present inside the tag
10h indicates support for version 1.0 of the
[NFC_T2TOP] specification
indicates 240 bytes of memory size assigned to the
data area (240/8)
indicates read and write access granted to User’s
memory and CC area without any security
At chip delivery, the byte PWD_PROT_EPC+PWD_PROT_ADDR value is programmed to FFh.
UID is programmed and write protected before delivery.
UID is defined as follows:
UID Number
Field name [bits range]
UID0
UID1 & UID2
Value at
delivery
(Hex)
16h
16h
001h
BCC0
calculated
UID3 & UID4 & UID5 & UID6
unique
BCC1
calculated
Description
IC manufacturer Code
6 bit IC ID 16h corresponds to EM4423
10 bit Customer ID (standard version)
in accordance with ISO/IEC 14443-3 defined as
CT UID0 UID1 UID2
CT – Cascade Tag Type A (= 88h)
32-bit Unique Serial Number (same as in EPC TID)
in accordance with ISO/IEC 14443-3 defined as
UID3 UID4 UID5 UID6
Lock Control TLV
Field name [bits range]
Data0
Data1
Data2
Data3
Data4
Value at
delivery
(Hex)
01h
03h
A0h
0Ch
45h
Description
Value at
delivery
(Hex)
03h
00h
Description
Value at
delivery
(Hex)
FEh
Description
T Field
L Field
V Field defining Lock Position
V Field defining Lock Size
V Field defining Lock Page Control
Empty NDEF message TLV
Field name [bits range]
Data5
Data6
T Field
L Field
Terminator TLV
Field name [bits range]
Data7
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
18
T Field
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Static Lock bytes
See [NFC_T2TOP] for bits functionality explanation.
The purpose of Static Lock bytes is to allow locking of blocks 2 to 15 against writing.
The setting of static lock bits is irreversible: if the appropriate bit of the lock bytes is set, it cannot be
reset to ‘0’.
If all bits are set to 0 then the Capability Container and User memory (Blocks 4 to 15) of the tag can be
read and written.
If all bits are set to 1 then the Capability Container and User memory (Blocks 4 to 15) of the tag can
only be read.
The Static Lock bytes have no effect on the EPC interface. The corresponding NFC_WLOCK
bits in the NFC sharing “write” lock bytes must be set = 1 to prevent the EPC interface from
writing the User data values. The NFC_WLOCK_CC bit in the NFC sharing “write” lock bytes
must be set = 1 to prevent the EPC interface from writing the Capability Container value.
It is also possible to lock individual blocks against writing as defined below:
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
19
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Static_Lock0 Byte
Field name
Value at
delivery
(Hex)
bit 7
0
bit 6
0
bit 5
0
bit 4
0
bit 3
0
bit 2
0
bit 1
0
bit 0
0
Description
if bit is zero then block 7 is writable otherwise it is
read-only protected
if bit is zero then block 6 is writable otherwise it is
read-only protected
if bit is zero then block 5 is writable otherwise it is
read-only protected
if bit is zero then block 4 is writable otherwise it is
read-only protected
if bit is zero then block CC is writable otherwise it is
read-only protected
if bit is set then Static_Lock1[7:2] can no longer be
changed
if bit is set then Static_Lock1[1:0] and
Static_Lock0[7:4] can no longer be changed
if bit is set then Static_Lock0[3] can no longer be
changed
Static_Lock1 Byte
Field name
Value at
delivery
(Hex)
bit 7
0
bit 6
0
bit 5
0
bit 4
0
bit 3
0
bit 2
0
bit 1
0
bit 0
0
Description
if bit is zero then block 15 is writable otherwise it is
read-only protected
if bit is zero then block 14 is writable otherwise it is
read-only protected
if bit is zero then block 13 is writable otherwise it is
read-only protected
if bit is zero then block 12 is writable otherwise it is
read-only protected
if bit is zero then block 11 is writable otherwise it is
read-only protected
if bit is zero then block 10 is writable otherwise it is
read-only protected
if bit is zero then block 9 is writable otherwise it is
read-only protected
if bit is zero then block 8 is writable otherwise it is
read-only protected
Capability container (CC)
See [NFC_T2TOP] for bits functionality explanation.
NFC User memory
The memory area available from block 4 to 63 is dedicated for NFC data. The protection by
Static Lock bytes or Dynamic Lock bytes may be applied to write protect the NFC data from
writing via the NFC interface.
The corresponding NFC_WLOCK bits in the NFC sharing “write” lock bytes must be set = 1 to
prevent the EPC interface from writing the User data values.
EPC mapped memory
The memory area available from block 64 to 79 is dedicated for the mapping of EPC
memory. The same memory protection rules can be applied as for NFC User memory.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
20
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Gen2V2config Word
The NFC interace may only write this word in SECURE state with PWD_LIM ≠ 0.
Byte 0
User 0
User 1
EPC 0
EPC 1
Access Pwd 0
Access Pwd 1
LSB
Kill Pwd 0
Kill Pwd 1
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
See [EPC_Gen2v2] LOCK command for bits functionality explanation.
Setting of bits in Byte 0 is irreversible by NFC interface.
If the appropriate pair of bits is not “00”, it cannot be changed.
Byte 1
0
0
0
0
0
0
LSB
0
Killed State
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
See [EPC_Gen2v2] Killed State for bits functionality explanation.
Byte 1 is READ ONLY.
Byte 2
Reduce Range
Hide User
Hide TID 0
Hide TID 1
Hide EPC
U
LSB
H
NR
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
See [EPC_Gen2v2] XPC_W1 Word and UNTRACEABLE command for bits functionality explanation.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
21
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Byte 3
if Short EPC memory
0
0
Block 4 Locked
Block 3 Locked
Block 2 Locked
Block 1 Locked
LSB
Block 0 Locked
UHF Power
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
if Large EPC memory
0
0
0
0
0
Block 1 Locked
LSB
Block 0 Locked
UHF Power
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
UHF_Power – can be used to indicate if the UHF rectifier is providing power when HF field is not
present
‘0’ – the indicator is reset when the chip goes to power down (powered neither from EPC nor NFC)
‘1’ – the indicator is set when Gen2V2config word is read by READ or READ_MULTIPLE_BLOCKS
command
See [EPC_Gen2v2] BLOCKPERMALOCK command for other bits functionality explanation.
Setting of bits in Byte 3 is irreversible by NFC interface: if the appropriate bit is set, it cannot be
changed back to 0.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
22
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Dynamic Lock bytes
See [NFC_T2TOP] for bits functionality explanation.
Setting of dynamic lock bits is irreversible: if the appropriate bit is set, it cannot be changed back to 0.
The Dynamic Lock bytes have no effect on the EPC interface. The corresponding NFC_WLOCK
bits in the NFC sharing “write” lock bytes must be set = 1 to prevent the EPC interface from
writing the User data values.
Byte 0
LOCK BLOCK 16-19
LOCK BLOCK 20-23
LOCK BLOCK 24-27
LOCK BLOCK 28-31
LOCK BLOCK 32-35
LOCK BLOCK 36-39
LSB
LOCK BLOCK 40-43
LOCK BLOCK 44-47
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
LOCK_BLOCK – if the bit is set then the appropriate memory block is write protected
Byte 1
LOCK BLOCK 48-51
LOCK BLOCK 52-55
LOCK BLOCK 56-59
LOCK BLOCK 60-63
LOCK BLOCK 64-67
LOCK BLOCK 68-71
LSB
LOCK BLOCK 72-75
LOCK BLOCK 76-79
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
LOCK_BLOCK – if the bit is set then the appropriate memory block is write protected
Byte 2
BL 16-23
BL 24-31
BL 32-39
BL 40-47
BL 48-55
BL 56-63
LSB
BL 64-71
BL 72-79
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
BL – if the bit is set then the appropriate memory LOCK_BLOCK bit is protected against update
Byte 3 – RFU
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
23
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
IC Configuration 0 word
When it is changed then the new value is accepted after Power-Up.
The ICCFG_LOCK bit in IC Configuration 1 word has no effect on the EPC interface. The NFC_WLOCK_81
bit in the NFC sharing “write” lock bytes must be set = 1 to prevent the EPC interface from writing the IC
Configuration 0 word value.
Byte 0, 1, 2 – RFU
Byte 3
PWD_PROT_EPC
MSB
LSB
PWD_PROT_ADDR
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
PWD_PROT_EPC – defines if the EPC mapped memory is protected by PWD_PROT_ADDR
‘0’ – protected by PWD_PROT_ADDR
‘1’ – no PWD_PROT_ADDR protection applied StartAddr, AddrBlock parameters of read/write
command has to address EPCmapped memory
PWD_PROT_ADDR – defines the start block address from which the memory protection is enabled
when not in SECURE state
Valid address range for PWD_PROT_ADDR byte is from 00h to 7Fh.
The memory protection type is defined by PROT_TYPE bit.
Password protection has no effect on the EPC interface. The corresponding NFC_RLOCK bits
and NFC_WLOCK bits in the NFC sharing “read” lock bytes and “write” lock bytes must be set
= 1 to prevent the EPC interface from reading and writing the User data values.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
24
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
IC Configuration 1 word
When it is changed then the new value is accepted after Power-Up.
The ICCFG_LOCK bit in IC Configuration 1 word has no effect on the EPC interface. The NFC_WLOCK_82
bit in the NFC sharing “write” lock bytes must be set = 1 to prevent the EPC interface from writing the IC
Configuration 1 word value.
Byte 0
PWD_LIM
ACCESS_PROT_TYPE
ACCESS_CNT_EN
ICCFG3_LOCK
LSB
ICCFG_LOCK
PROT_TYPE
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
PROT_TYPE – the memory protection type related to PWD_PROT_ADDR
‘0’ – write access is protected when not in SECURE states
‘1’ – read & write access is protected when not in SECURE states
ICCFG_LOCK
‘0’ – IC Configuration 0, 1, and 2 words unprotected
‘1’ – IC Configuration 0, 1, and 2 words permanently protected against update
ICCFG3_LOCK
‘0’ – IC Configuration 3 word unprotected
‘1’ – IC Configuration 3 word permanently protected against update
ACCESS_CNT_EN
‘0’ – ACCESS counter disabled (not incremented during the first read command)
‘1’ – ACCESS counter enabled
ACCESS_PROT_TYPE – defines readability of ACCESS counter (READ_COUNTER)
‘0’ – ACCESS counter readable in ACTIVE or SECURE states
‘1’ – ACCESS counter readable only in SECURE state
PWD_LIM
‘000’ – unsuccessful LOGIN counter disabled
‘001’-‘111’ – defines maximum number of unsuccessful LOGINs
Byte 1
0
0
0
0
0
0
LSB
0
SIG_LOCK
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
SIG_LOC
‘0’ – 32 Byte Signature memory is unprotected
‘1’ – 32 Byte Signature memory is permanently protected against update from both NFC and EPC.
Setting of SIG_LOCK bit is irreversible from both NFC and EPC interface: if the appropriate bit is set, it
cannot be changed back to 0.
Byte 2, 3 – RFU
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
25
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
IC Configuration 2 word
When it is changed then the new value is accepted after Power-Up.
The ICCFG_LOCK bit in IC Configuration 1 word has no effect on the EPC interface. The NFC_WLOCK_83
bit in the NFC sharing “write” lock bytes must be set = 1 to prevent the EPC interface from writing the IC
Configuration 2 word value.
Byte 0
0
0
0
0
0
0
LSB
0
PRIVACY_EN
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
PRIVACY_EN – selects in which state the NFC interface will go after INITIALIZATION; this bit can be
changed also by EN_DIS_PRIVACY custom command.
‘0’ – to IDLE NFC state
‘1’ – to PRIVACY state (answering only to LOGIN with correct 2 Byte Password)
Byte 1, 2, 3 – RFU
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
26
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
IC Configuration 3 word
This word is WRITE ONLY for the NFC interface and is as defined below.
The NFC interace may only write this word in SECURE state with PWD_LIM ≠ 0.
The ICCFG3_LOCK bit in IC Configuration 1 word is the only lock bit that prevents the NFC interface from writing
to the IC Configuration 3 word which updates either the StoredPC word or the Gen2V2config word in EPC memory.
This word is read and write protected for the EPC interface and error code is replied.
Byte 0
EPC Privacy
0
0
0
0
0
LSB
0
0
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
See section on EPC Privacy Features.
EPC Privacy – selects which of the EPC privacy settings are selected for write operations.
‘0’ – EPC privacy settings in the Gen2V2config word
‘1’ – EPC privacy settings in the StoredPC word
Byte 1 – RFU
Byte 2
EPC Privacy = 0
Reduce Range
Hide User
Hide TID 0
Hide TID 1
Hide EPC
U
LSB
0
0
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
EPC Privacy = 1
0
0
0
StoredPC L 0
StoredPC L 1
StoredPC L 2
LSB
StoredPC L 3
0
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
See [EPC_Gen2v2] StoredPC Word, XPC_W1 Word and UNTRACEABLE command for all other bits
functionality explanation.
Byte 3 – RFU
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
27
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
4 Byte Password
The 4 Byte Password is the data which is compared to password as part of the LOGIN command to
enter SECURE state from ACTIVE state.
The 4 Byte Password is permanently read protected (zeros are read) via the NFC interface.
The NFC_RLOCK_85 bit in the NFC sharing “read” lock bytes must be set = 1 to prevent the
EPC interface from reading the 4 Byte Password value. The NFC_WLOCK_85 bit in the NFC
sharing “write” lock bytes must be set = 1 to prevent the EPC interface from writing the 4 Byte
Password value.
PACK
The PACK is the 16-bit data which is compared to password as part of the LOGIN command to enter
IDLE state from PRIVACY state and the PACK is sent as response to LOGIN command.
The PACK is permanently read protected (zeros are read) via the NFC interface.
The NFC_RLOCK_86 bit in the NFC sharing “read” lock bytes must be set = 1 to prevent the
EPC interface from reading the PACK value. The NFC_WLOCK_86 bit in the NFC sharing “write”
lock bytes must be set = 1 to prevent the EPC interface from writing the PACK value.
2 Byte Password
The 2 Byte Password is the data which is compared to password as part of the LOGIN command to
enter IDLE state from PRIVACY state.
The 2 Byte Password is permanently read protected (zeros are read) via the NFC interface.
The NFC_RLOCK_86 bit in the NFC sharing “read” lock bytes must be set = 1 to prevent the
EPC interface from reading the 2 Byte Password value. The NFC_WLOCK_86 bit in the NFC
sharing “write” lock bytes must be set = 1 to prevent the EPC interface from writing the 2 Byte
Password value.
32 Byte Signature
The 32 Byte Signature is a 256-bit memory for a digital signature or for general use.
The NFC_RLOCK_32B bit in the NFC sharing “read” lock bytes must be set = 1 to prevent the
EPC interface from reading the Signature value. The NFC_WLOCK_32B bit in the NFC sharing
“write” lock bytes must be set = 1 to prevent the EPC interface from writing the Signature value.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
28
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
NFC sharing “read” Lock Bytes
The following bytes control sharing of NFC memory reading via the EPC interface.
NFC_RLOCK – if the bit is set then the appropriate memory block(s) is/are protected against reading
via the EPC interface.
Byte 0
HF_RLOCK_0 = 0
HF_RLOCK_1 = 0
HF_RLOCK_2 = 0
HF_RLOCK_CC = 0
NFC_RLOCK_4_7
NFC_RLOCK_8_11
LSB
NFC_RLOCK_12_15
NFC_RLOCK_16_19
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 1
NFC_RLOCK_20_23
NFC_RLOCK_24_27
NFC_RLOCK_28_31
NFC_RLOCK_32_35
NFC_RLOCK_36_39
NFC_RLOCK_40_43
LSB
NFC_RLOCK_44_47
NFC_RLOCK_48_51
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 2
NFC_RLOCK_52_55
NFC_RLOCK_56_59
NFC_RLOCK_60_63
NFC_RLOCK_80
NFC_RLOCK_81
NFC_RLOCK_82
LSB
NFC_RLOCK_83
NFC_RLOCK_84 = 1
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 3
NFC_RLOCK_85 = 1
NFC_RLOCK_86 = 1
0
NFC_RLOCK_32B
HF_RLOCK_95
HF_RLOCK_96
LSB
HF_RLOCK_97
HF_RLOCK_98
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
29
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
NFC sharing “write” Lock Bytes
The following bytes control sharing of NFC memory writing via the EPC interface.
NFC_WLOCK – if the bit is set then the appropriate memory block(s) is/are protected against writing
via the EPC interface.
Byte 0
HF_RLOCK_0 = 1
HF_RLOCK_1 = 1
NFC_WLOCK_2
NFC_WLOCK_CC
NFC_WLOCK_4_7
NFC_WLOCK_8_11
LSB
NFC_WLOCK_12_15
NFC_WLOCK_16_19
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 1
NFC_WLOCK_20_23
NFC_WLOCK_24_27
NFC_WLOCK_28_31
NFC_WLOCK_32_35
NFC_WLOCK_36_39
NFC_WLOCK_40_43
LSB
NFC_WLOCK_44_47
NFC_WLOCK_48_51
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 2
NFC_WLOCK_52_55
NFC_WLOCK_56_59
NFC_WLOCK_60_63
NFC_WLOCK_80
NFC_WLOCK_81
NFC_WLOCK_82
LSB
NFC_WLOCK_83
NFC_WLOCK_84 = 1
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 3
NFC_WLOCK_85
NFC_WLOCK_86
0
NFC_WLOCK_32B
NFC_WLOCK_95
NFC_WLOCK_96
LSB
NFC_WLOCK_97
NFC_WLOCK_98
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
30
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EPC sharing “read” Lock Bytes
The following bytes control sharing of EPC memory reading via the NFC interface.
EPC_RLOCK – if the bit is set then the appropriate memory block(s) is/are protected against reading
via the NFC interface. Zeros are read from the block when the appropriate bit is set.
Byte 0
UHF_RLOCK_64
UHF_RLOCK_65
UHF_RLOCK_66
UHF_RLOCK_67
UHF_RLOCK_68
UHF_RLOCK_69
LSB
UHF_RLOCK_70
UHF_RLOCK_71
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 1
UHF_RLOCK_72
UHF_RLOCK_73
UHF_RLOCK_74
UHF_RLOCK_75
UHF_RLOCK_76
UHF_RLOCK_77
LSB
UHF_RLOCK_78
UHF_RLOCK_79
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 2, 3 – RFU
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
31
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EPC sharing “write” Lock Bytes
The following bytes control sharing of EPC memory writing via the NFC interface.
EPC_WLOCK – if the bit is set then the appropriate memory block(s) is/are protected against writing
via the NFC interface.
Byte 0
UHF_WLOCK_64
UHF_WLOCK_65
UHF_WLOCK_66 = 1
UHF_WLOCK_67 = 1
UHF_WLOCK_68 = 1
UHF_WLOCK_69
LSB
UHF_WLOCK_70
UHF_WLOCK_71
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 1
UHF_WLOCK_72
UHF_WLOCK_73
UHF_WLOCK_74
UHF_WLOCK_75
UHF_WLOCK_76
UHF_WLOCK_77
LSB
UHF_WLOCK_78
UHF_WLOCK_79
MSB
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
Byte 2, 3 – RFU
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
32
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
NFC Command set
Summary of commands
Command
Command code
ISO/IEC 14443 Type A
NFC Forum Type 2
Request A
Wake-up A
Anti-collision Cascade Level 1
Select Cascade Level1
Anti-collision Cascade Level 2
Select Cascade Level2
'26h'
'52h'
'93h 20h'
'93h 70h'
'95h 20h'
'95h 70h'
REQA
WUPA
Anti-collision CL1
Select CL1
Anti-collision CL2
Select CL2
SENS_REQ
ALL_REQ
SDD_REQ CL1
SEL_REQ CL1
SDD_REQ CL2
SEL_REQ CL2
Halt A
READ
WRITE
SECTOR_SELECT
READ_MULTIPLE_BLOCKS
READ_COUNTER
EN_DIS_PRIVACY
LOGIN
'50h 00h'
'30h'
'A2h'
'C2h'
'3Ah'
'39h'
‘3Fh’
'1Bh'
HLTA
-
SLP_REQ
READ
WRITE
SECTOR SELECT
-
Commands and states
The table below shows which commands are supported in which states. If a command is not supported
then EM4423 doesn’t respond.
Command
PRIVACY
Request A
Wake-up A
Anti-collision Cascade Level 1
Select Cascade Level1
Anti-collision Cascade Level 2
Select Cascade Level2
Halt A
READ
WRITE
SECTOR_SELECT
READ_MULTIPLE_BLOCKS
READ_COUNTER
EN_DIS_PRIVACY
LOGIN
■
IDLE
HALT
■
■
■
READY
ACTIVE
SECURE
■
■
■
■
■
■
■
■
■
■
■
■
■
■
■
■
■
■
■ 5)
■ 6)
■ 7)
the command is supported in the appropriate state
Note 5): only reading from address 0 is supported in READY state
Note 6): PACK + 2 Byte Password LOGIN
Note 7): 4 Byte password LOGIN
If command is not supported in the appropriate state then the command is not executed and PICC
stays quiet and there is transition to IDLE or HALT state as explained in chapter “State diagram”.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
33
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Timing
The communication between PCD and EM4423 is composed of PCD command and EM4423 answer.
The communication is always initiated by PCD.
Any PCD command begins with Start of communication symbol and finishes with End of
communication symbol according to [ISO_14443_3].
ISO14443-3 commands
See [ISO_14443_3].
ACK and NACK responses
4 bits are used as a response if no data are return on a command.
“1010”
- ACK
“0000”
- NACK if wrong command argument(s)
“0001”
- NACK if parity or CRC error
“0100”
- NACK if addressed NVM is currently used by the second interface
“0101”
- NACK if writing to NVM is forbidden (a power is low)
{Bits order – 3210}
See also [NFC_T2TOP].
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
34
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
NFC commands
READ
The READ command is compliant to [NFC_DigitalSpec]
The command format is as below.
PCD command
EM4423 answer(s)
30h
AddrBlock
CRC
1 Byte
1 Byte
2 Bytes
TREAD
DATA
CRC
16 Bytes
2 Bytes
TNACK
NACK
4 bits
Command Code
AddrBlock
30h
first block’s address
DATA
16-byte read from memory
CRC
CRC according to [ISO_14443_3]
NACK
according to chapter “ACK and NACK responses”
For a command descriptions see also [NFC_T2TOP].
If PROT_TYPE = ‘1’
In ACTIVE state
If AddrBlock is equal or higher than PWD_PROT_ADDR address then there is NACK answer..
There is a roll-over mechanism implemented. It allows continuing reading from address 00h when the
(PWD_PROT_ADDR-1) address is reached.
In SECURE state
can be addressed the whole available memory.
If PROT_TYPE = ‘0’
PWD_PROT_ADDR is not cared and the whole memory is available.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
35
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
WRITE
The WRITE command is compliant to [NFC_DigitalSpec]
The command format is as below.
PCD command
IC answer(s)
A2h
AddrBlock
DATA
CRC
1 Byte
1 Byte
4 Bytes
2 Bytes
TWRITE
ACK
4 bits
TNACK
NACK
4 bits
Command Code
AddrBlock
A2h
the address of a block to be written
DATA
4-byte data
CRC
CRC according to [ISO_14443_3]
ACK
according to chapter “ACK and NACK responses”
NACK
according to chapter “ACK and NACK responses”
For a command descriptions see also [NFC_T2TOP].
In ACTIVE state
If AddrBlock is equal or higher than PWD_PROT_ADDR address then there is NACK answer.
In SECURE state
can be addressed the whole available memory.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
36
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
SECTOR_SELECT
The SECTOR_SELECT command is compliant to [NFC_DigitalSpec]
The command format is as below.
PCD command
EM4423 answer(s)
C2h
FFh
CRC
1 Byte
1 Byte
2 Bytes
TNACK
NACK
4 bits
Command Code
C2h
FFh
constant
CRC
CRC according to [ISO_14443_3]
NACK
according to chapter “ACK and NACK responses”
For a command descriptions see also [NFC_T2TOP].
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
37
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Proprietary commands
READ_MULTIPLE_BLOCKS
This command returns as an answer a content of the memory. The StartBlock and EndBlock
parameters are sent as part of the command by PCD as specified below.
The command format is as below.
PCD command
EM4423 answer(s)
3Ah
StartBlock
EndBlock
CRC
1 Byte
1 Byte
1 Byte
2 Bytes
TREAD_MULTIPLE_BLOCKS
DATA
CRC
4*nblocks
2 Bytes
TNACK
NACK
4 bits
Command Code
3Ah
StartBlock
an address of a first block to be read
EndBlock
an address of a last block to be read
DATA
CRC
NACK
a content of the memory (the size in bytes is 4*number of read blocks)
CRC according to [ISO_14443_3]
according to chapter “ACK and NACK responses”
The EndBlock must be always higher or equal than StartBlock address otherwise NACK is returned.
If PROT_TYPE = ‘1’
In ACTIVE state
If StartBlock or EndBlock is equal or higher than PWD_PROT_ADDR address then there is NACK
answer.
In SECURE state
can be addressed the whole available memory.
If PROT_TYPE = ‘0’
PWD_PROT_ADDR is not cared and the whole memory is available.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
38
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
READ_COUNTER
This command returns as an answer a content of 24-bit counter. The AddrCount is sent as part of the
command by PCD.
The command format is as below.
PCD command
EM4423 answer(s)
39h
AddrCnt
CRC
1 Byte
1 Byte
2 Bytes
TREAD_COUNTER
DATA
CRC
3 Bytes
2 Bytes
TNACK
NACK
4 bits
Command Code
AddrCnt
DATA
CRC
NACK
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
39h
the address of a counter (EM4423 offers just one counter ; any value in this field
is allowed)
3-byte counter content
CRC according to [ISO_14443_3]
according to chapter “ACK and NACK responses”
39
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EN_DIS_PRIVACY
This command enables or disables PRIVACY feature.
The command format is as below.
PCD command
IC answer(s)
3Fh
Action
RFU
CRC
1 Byte
1 Byte
4 Bytes
2 Bytes
TEN_DIS_PRIVACY
ACK
4 bits
TNACK
NACK
4 bits
Command Code
Action
3Fh
action selector
00h - disable PRIVACY
01h - enable PRIVACY
02h – FFh - RFU (NACK is returned as the response)
RFU
4 dummy bytes
CRC
CRC according to [ISO_14443_3]
ACK
according to chapter “ACK and NACK responses”
NACK
according to chapter “ACK and NACK responses”
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
40
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
LOGIN
This command transitions the EM4423 from PRIVACY to IDLE state or from ACTIVE to SECURE state
after successful password authentication.
The command format is as below.
PCD command
EM4423 answer(s)
1Bh
PWD
CRC
1 Byte
4 Bytes
2 Bytes
TLOGIN
PACK
CRC
2 Bytes
2 Bytes
TNACK
NACK
4 bits
Command Code
1Bh
PWD
4 Byte Password or PACK + 2 Byte Password
CRC
CRC according to [ISO_14443_3]
PACK
2-byte LOGIN acknowledge (PACK field in the NVM)
NACK
according to chapter “ACK and NACK responses”
PRIVACY to IDLE
If PWD field is equal to PACK + 2 Byte Password in the memory then the authentication is successful
and the EM4423 changes its state from PRIVACY to IDLE state. Then PACK + CRC are returned as
successful LOGIN acknowledge. NACK is never replied in PRIVACY state.
ACTIVE to SECURE
If PWD field is equal to 4 Byte Password in the memory then the authentication is successful and the
EM4423 changes its state from ACTIVE to SECURE state. Then PACK + CRC are returned as
successful LOGIN acknowledge. NACK is not replied if wrong PWD.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
41
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EPC functional description
EPC memory organization
The EPC Gen2 V2 memory is available in two configurations to support either small or large EPC encodings.
The small EPC memory configuration provides 128 bits for encoding and 160 bits of USER memory. This
supports the most commonly used tag encodings (e.g. SGTIN-96) as well as RFID based EAS solutions that
utilize USER memory.
The large EPC memory configuration provides 224 bits for encoding and 64 bits of USER memory. This supports
the larger tag encodings (e.g. SGTIN-198) as well as RFID based EAS solutions that utilize USER memory.
Both EPC memory configurations include the NFC memory as part of the USER memory.
The following memory maps are as seen in the application:
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
42
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EPC Gen2 V2 - Small EPC memory map
Word
Address
(decimal)
Memory Bank
002: RESERVED
012: EPC
102: TID
112: USER (File_0)
Content
0
1
2
3
0
Kill Password [31:16]
Kill Password [15:0]
Access Password [31:16]
Access Password [15:0]
StoredCRC [15:0]
1
StoredPC [15:0]
2
3
4
5
6
7
8
9
10 to 32
EPC [127:112]
EPC [111:96]
EPC [95:80]
EPC [79:64]
EPC [63:48]
EPC [47:32]
EPC [31:16]
EPC [15:0]
Unused address space
33
XPC_W1 [15:0] (see tablebelow)
0
1
2
3
4
5
0
1
2
3
4
5
6
7
8
9
10 to 31
32 to 255
TID [95:80]
TID [79:64]
TID [63:48]
TID [47:32]
TID [31:16]
TID [15:0]
USER [159:144]
USER [143:128]
USER [127:112]
USER [111:96]
USER [95:80]
USER [79:64]
USER [63:48]
USER [47:32]
USER [31:16]
USER [15:0]
Unused address space
NFC memory mapping (see table below)
Access Type
(unless
password
protected or
locked)
Memory Type
Read & Write
NVM EPC
Read & Write
Computed
Computed /
NVM EPC
Read & Write
Read & Write
NVM EPC
None
N/A
Computed /
NVM EPC
Read & Write
Read Only
ROM /
NVM EPC
Read & Write
NVM EPC
None
see below
N/A
NVM NFC
The EPC interface access to User Memory Bank words 32 to 255 (NFC mapped memory) is controlled first by the
EPC password protection and locks used for the User Memory Bank and subsequently by the NFC sharing
read/write lock bytes unless stated otherwise in this document.
The EPC interface has read/write access to the to NFC mapped memory but only as permitted by the NFC sharing
read/write lock bytes.
The EPC interface applies the untraceably hidden memory conditions to NFC mapped memory when the User
Memory Bank is hidden.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
43
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EPC Gen2 V2 - Large EPC memory map
Memory Bank
002: RESERVED
012: EPC
102: TID
112: USER (File_0)
Word
Address
(decimal)
Content
0
1
2
3
0
Kill Password [31:16]
Kill Password [15:0]
Access Password [31:16]
Access Password [15:0]
StoredCRC [15:0]
1
StoredPC [15:0]
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 to 32
EPC [223:208]
EPC [207:192]
EPC [191:176]
EPC [175:160]
EPC [159:144]
EPC [143:128]
EPC [127:112]
EPC [111:96]
EPC [95:80]
EPC [79:64]
EPC [63:48]
EPC [47:32]
EPC [31:16]
EPC [15:0]
Unused address space
33
XPC_W1 [15:0] (see table below)
0
1
2
3
4
5
0
1
2
3
4 to 31
32 to 255
TID [95:80]
TID [79:64]
TID [63:48]
TID [47:32]
TID [31:16]
TID [15:0]
USER [63:48]
USER [47:32]
USER [31:16]
USER [15:0]
Unused address space
NFC memory mapping (see table below)
Access Type
(unless
password
protected or
locked)
Memory Type
Read & Write
NVM EPC
Read & Write
Computed
Computed /
NVM EPC
Read & Write
Read & Write
NVM EPC
None
N/A
Computed /
NVM EPC
Read & Write
Read Only
ROM /
NVM EPC
Read & Write
NVM EPC
None
see below
N/A
NVM NFC
The EPC interface access to User Memory Bank words 32 to 255 (NFC mapped memory) is controlled first by the
EPC password protection and locks used for the User Memory Bank and subsequently by the NFC sharing
read/write lock bytes unless stated otherwise in this document.
The EPC interface has read/write access to the to NFC mapped memory but only as permitted by the NFC sharing
read/write lock bytes.
The EPC interface applies the untraceably hidden memory conditions to NFC mapped memory when the User
Memory Bank is hidden.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
44
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
The following table gives more details on the NFC memory mapping in the found User memory bank:
NFC Memory Mapping
Word
Address
(decimal)
Memory Bank
112: USER (File_0)
Access Type
(unless password
protected or
locked)
Read Only
Read & Write
Read & Write
Read & Write
None
Read & Write
Read & Write
None
Read & Write
Read & Write
Read & Write
Read & Write
None
Read Only
Content
32 to 36
37
38 to 39
40 to 159
160 to 191
192 to 193
194 to 199
200 to 201
202 to 205
206 to 221
222 to 225
226 to 229
230 to 253
254 to 255
NFC UID
NFC Static Lock Bytes
NFC Capability Container (CC)
NFC User Data (Blocks 4 to 63)
Unused address space
NFC Dynamic Lock Bytes
NFC IC Config Words 0, 1, 2
NFC IC Config Word 3
NFC Passwords
NFC Digital Signature (Blocks 87 to 94)
NFC Sharing Lock Bytes
EPC Sharing Lock Bytes
Unused address space
NFC ACCESS Counter
Memory Type
NVM NFC
N/A
NVM NFC
N/A
Computed
Word Address 37, 38, 39, 192, 193, 198, 199 are anti-tearing mechanism protected.
The following table gives more details on the XPC_W1 word, found in the EPC memory bank:
XPC_W1 word
Word
Address
(decimal)
Memory Bank
M
S
B
0 1
2
3
4
5
6
7
8
9
A
B
C
D
E
L
S
B
F
Memory Type
0
0
0
0
0
0
0
0
B
0
U
K
NR
33
TN
012: EPC
SLI
XPC_W1 [15:0]
H
Computed /
NVM EPC
B (Battery assisted passive indicator): This bit is used to indicate the device is in an HF field and may have sufficient
strength to power the Tag. If bit is 0 then the Tag is not detecting an HF field. If bit is 1 then the Tag is detecting an HF
field.
SLI (SL-flag indicator): If bit is 0 then a Tag has a deasserted SL flag. If bit is 1 then a Tag has an asserted SL flag.
Upon receiving a Query the Tag maps its SL flag into the SLI and retains this SLI setting until starting a subsequent
inventory round.
TN (Tag-notification indicator): This bit is used as a power check for NVM write operations. If bit is 0 then the power
level measured by the Tag may be insufficient to perform a NVM write operation. If bit is 1 then the power level measured
by the Tag is sufficient to perform an NVM NFC or NVM EPC write operation.
U (Untraceable indicator): If bit is 0 then a reader has not asserted the U bit. If bit is 1 then a reader has asserted the
U bit, typically for the purpose of indicating that the Tag is persistently reducing its operating range and/or is untraceably
hiding memory. A reader changes the value of the U bit via the Untraceable command.
K (Killable indicator): If bit is 0 then a Tag is not killable. If bit is 1 then a Tag is killable. Logically, K is defined as:
K = [(logical OR of all 32 bits of the kill password) OR (kill-pwd-read/write=0) OR (kill-pwd-permalock=0)].
o If any bits of the kill password are 1 then the Tag is killable
o If kill-pwd-read/write is 0 then the Tag is killable
o If kill-pwd-permalock is 0 then the Tag is killable
NR (Nonremovable indicator): If bit is 0 then a Tag is removable. If bit is 1 then a Tag is nonremovable. This bit is
always 0 unless changed by a reader via a Write or BlockWrite command.
H (Hazmat indicator): If bit is 0 then a Tag is not affixed to hazardous material. If bit is 1 then a Tag is affixed to
hazardous material. This bit is always 0 unless changed by a reader via a Write or BlockWrite command.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
45
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
The following table gives more details about the TID memory bank:
TID memory bank
Memory Bank
Word Address
(decimal)
0
1
102: TID
2
3
4
5
M
S
B
0 1
L
S
B
2
3
4
5
6
7
8
9
A
B
C D E
Memory Type
F
Allocation Class (E2h)
Tag MDID MSB’s (80h)
1 1 1 0 0 0 1 0 1 0 0 0 0 0 0 0
Tag MDID
Tag Model Number
LSB’s (Bh)
MCS
MCS Identifier
Config
Product
1 0 1 1 0 0 0 0 1 0 1 0 0 0 0 EPC6)
XTID
0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0
IC Serial Number [47:32]
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IC Serial Number [31:16] (same as in NFC UID)
IC Serial Number [15:0] (same as in NFC UID)
ROM
ROM
ROM
ROM
NVM EPC
NVM EPC
Note 6: EPC size, where 0 indicates small EPC memory and 1 indicates large EPC memory
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
46
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
EPC Gen2 V2 Delivery State
EPC Gen2 V2 delivery state has the following default product configuration:
Access Password and Kill Password are readable/writeable with a value 0000'0000'0000'0000h
Unique Identification number (UID / TID) is programmed and write-permalocked
A default 96-bit EPC Code value is 0000'0000'0000'0024'nnnn'nnnnh where nnnn’nnnn are the 32 LSB’s of serial
number found also in the TID memory (EPC memory is unlocked).
EPC Gen2 V2 Commands
The table below shows all implemented commands in EM4423. For the description of all mandatory and optional
commands, please refer to the EPCglobal Gen2 V2 standard. All mandatory commands of the EPCglobal Gen2 V2
standard are implemented.
Command
Command Code
Command Type
QueryRep
ACK
Query
QueryAdjust
'00'
'01'
'1000'
'1001'
'1010'
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
NAK
Req_RN
Read
Write
Kill
Lock
Access
BlockWrite
'11000000'
'11000001'
'11000010'
'11000011'
'11000100'
'11000101'
'11000110'
11000111'
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Optional7)
Optional
BlockPermalock
Untraceable
'11001001'
'1110001000000000'
Optional
Optional7)
Select
Comment
Memory matching on NFC memory is not supported and
results in a not-matching condition.
Failed Kill command sequence results in security timeout
Failed Access command sequence results in security timeout
Supports writing one or two 16-bits words. The address must
start on an even word number if two words are to be written.
USER memory block size is two words.
See EPC Privacy Features below.
Note 7: This command is normally optional but is mandatory for Alteration EAS and Tag Alteration (Core) compliance.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
47
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Write operations using the Tag Notification (TN) indicator
TN is a vendor defined indicator bit that is part of the XPC_W1 word that is reported to a reader as part of the reply to
an ACK command. If the XPC_W1 indicator (XI) = 1 in the PC Word then TN is reported as part of the XPC_W1 word.
If XI = 0 in the PC Word then TN is reported as part of the PC Word. EM4423 uses TN to indicate the power level seen
during inventory. TN = 1 indicates the power level is sufficient to perform NVM NFC write operation which by default
means the power level is also sufficient to perform a NVM EPC write operation. TN = 0 indicates the power level is
insufficient to perform a NVM NFC operation but it may be sufficient to perform a NVM EPC write operation.A reader
can attempt any supported command that performs a NVM write operation regardless of the TN value.
There are three scenarios for using TN:
1. EM4423 reports TN = 0 during inventory. If the reader proceeds to use an access command that writes to memory
then the tag will check the appropriate power level based on the NVM memory to be written. This provides the
maximum write sensitivity for the tag at the cost of a slightly longer write time to perform the power check.
2. EM4423 reports TN = 1 during inventory. If the reader proceeds to use an access command that writes to memory
then the tag does not check the appropriate level based on the NVM to be written. This provides the fastest write time
for the tag at the cost of slightly degraded write sensitivity for NVM EPC write operations.
3. If a reader uses a Select command on TN = 1 in the XPC_W1 word then only tags with sufficient power for NVM will
be selected for inventory. If the reader proceeds to use an access command that writes to memory then the tag will
check the appropriate power level based on the NVM memory to be written.
EPC Privacy Features
Support for EPC privacy is provided using the Untraceable command and it only applies to the EPC interface. The
Untraceable command may only be used by an Interrogator that asserts the Untraceable privilege. An Interrogator
must use a non-zero Access password to enter the Secured state in order to assert that it has the Untraceable
priviliege.
The Untraceable command allows an Interrogator to instruct the EM4423 to (a) alter the L and U bits in EPC memory,
(b) hide memory from Interrogators with a deasserted Untraceable privilege, and/or (c) reduce its operating range for
all Interrogators. The memory that a Tag may hide includes words of EPC memory, the Tag serialization in TID
memory, all of TID memory, and/or User memory. Note that the NFC memory is mapped into the the EPC User
memory space and therefore NFC memory is hidden from the EPC interface when User memory is hidden.
Untraceable and traceable Tags behave identically from a state-machine and command-response perspective; the
difference between them is (a) the memory the Tag exposes to an Interrogator with a deasserted Untraceable privilege
and/or (b) the Tag’s operating range.
The Untraceable command may be used to change the operational read range of a device. EM4423 supports this
feature in a manner that permits having either full read range (normal operation) or no read range (deactivated
operation). A deactivated device always remains in the Ready state and will not participate in any inventory operations.
The Range parameter in the Untraceable command is used to specify the persistent operational read range of the
device. If Range = 002 then the device persistently enables normal operation. If Range = 10 2 then the device
persistently enables deactivation and the device becomes deactivated immediately upon reply to the Untraceable
command. If Range = 012 then it has no effect on the device.
A deactivated device may be temporarily reactivated (normal operation) by any Interrogator using a Select command
with any of the assigned EM Microelectronic Mask Designer ID’s (MDID’s). The Select command parameters are
MemBank = 102, Pointer = 08h, Length = 0Ch, and matching Mask = 00Bh or = 40Bh or = 80Bh or = C0Bh. When a
device is temporarily reactivated, it remains in the normal operational mode until the device loses power.
The NFC interface may also be used to enable/disable the EPC privacy features via the Gen2V2conf word, the
StoredCRC + StoredPC word, and the IC Configuration 3 word.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
48
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Pad location diagram
853
179.93
505.57
167.5
61.62
61.535
UHF -
NC
NC
Φ=76
HF +
790
362
666.76
HF -
NC
NC
61.62
61.705
UHF +
110.105
65.93
The chip size is calculated including the scribe line.
Pin description
Pin
Name
Type
1
2
3
4
5
6
7
8
HF+
HFNC
NC
UHF+
UHFNC
NC
coil
coil
NC
NC
RF
RF
NC
NC
Description
antenna terminal for HF & test
antenna terminal for HF & test
antenna terminal for UHF
antenna terminal for UHF
NC: Not connected
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
49
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Ordering Information
EM4423
VXYZ WS 3
U - %%%
Circuit Nb:
EM4423
Customer Version:
Version:
Bumps
See table below
“ “ = No bumps
“U” = Gold bumps + Polyimide
Die form:
WW = Wafer
WS = Sawn Wafer/Frame
Thickness:
3 = 3 mils = 76um
6 = 6 mils = 152um
29 mils = ungrinded wafer
%%% = only for custom specific version
Versions
Versions are identified with “V” followed by a 3 digit code “XYZ” that are defined in the following tables.
X
1
2
3
4
EPC Memory Format / HF
Antenna Optimization
Small EPC / Big HF Antenna
Large EPC / Big HF Antenna
Small EPC / Small HF Antenna
Large EPC / Small HF Antenna
Y
NFC Resonant
Capacitor
Z
NFC MUTED
Mode
1
17 pF
1
disabled
2
50 pF
2
enabled
Please refer to the formula given in the Application notes 604011 (EM4423 di03 HF Coil Design Application Note)
to understand the mathematics behind. HF antennas are considered “Big” when the area of the HF antenna is
bigger or equal than 10000mm2/(Number of coil turns).
Remarks:
For ordering, please use table in “Standard Versions and Samples”.
For specifications of Delivery Form, including gold bumps, tape and bulk, as well as possible other delivery form or
packages, please contact EM Microelectronic-Marin S.A.
Standard Versions and Samples
The versions below are considered standard and should be readily available. For other versions or other delivery
form, please contact EM Microelectronic-Marin S.A. For samples, please order exclusively from the standard versions.
EPC
Memory
Format
NFC
options
Package / Die Form
Delivery Form
EM4423V121WS6U
Small
EPC
50 pF
Muted
Mode
disabled
Sawn wafer / Gold bumped +PI – thickness of 6 mils
Wafer on
frame
EM4423V221WS6U
Large
EPC
50 pF
Muted
Mode
disabled
Sawn wafer / Gold bumped +PI – thickness of 6 mils
Wafer on
frame
Part Number
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
50
www.emmicroelectronic.com
420005-A01, 2.0
EM4423
Product Support
Check our website at www.emmicroelectronic.com under Products/RF Identification section. Questions can be submitted to
[email protected] .
EM Microelectronic-Marin SA (“EM”) makes no warranties for the use of EM products, other than those expressly contained in EM's applicable
General Terms of Sale, located at http://www.emmicroelectronic.com. EM assumes no responsibility for any errors which may have crept into
this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any
commitment to update the information contained herein.
No licenses to patents or other intellectual property rights of EM are granted in connection with the sale of EM products, neither expressly nor
implicitly.
In respect of the intended use of EM products by customer, customer is solely responsible for observing existing patents and other intellectual
property rights of third parties and for obtaining, as the case may be, the necessary licenses.
Important note: The use of EM products as components in medical devices and/or medical applications, including but not limited to,
safety and life supporting systems, where malfunction of such EM products might result in damage to and/or injury or death of
persons is expressly prohibited, as EM products are neither destined nor qualified for use as components in such medical devices
and/or medical applications. The prohibited use of EM products in such medical devices and/or medical applications is exclusively at
the risk of the customer.
Copyright 2016, EM Microelectronic-Marin SA
4423-DS-02, Version 3.0, 13-May-16
51
www.emmicroelectronic.com
420005-A01, 2.0