my- d™ mov e my- d™ mov e N FC S LE 66 R01 P S LE 66 R01 P N Intelligent 1216 bit EEPROM with Contactless Interface compliant to ISO/IEC 14443-3 Type A and support of NFC Forum™ Type 2 Tag Operation Da t a B o o k 2011-11-24 Ch i p C a rd & S e c u r i ty Edition 2011-11-24 Published by Infineon Technologies AG 81726 Munich, Germany © 2011 Infineon Technologies AG All Rights Reserved. Legal Disclaimer The information given in this document shall in no event be regarded as a guarantee of conditions or characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any information regarding the application of the device, Infineon Technologies hereby disclaims any and all warranties and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual property rights of any third party. Information For further information on technology, delivery terms and conditions and prices, please contact the nearest Infineon Technologies Office (www.infineon.com). Warnings Due to technical requirements, components may contain dangerous substances. For information on the types in question, please contact the nearest Infineon Technologies Office. Infineon Technologies components may be used in life-support devices or systems only with the express written approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure of that life-support device or system or to affect the safety or effectiveness of that device or system. Life support devices or systems are intended to be implanted in the human body or to support and/or maintain and sustain and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may be endangered. my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN my-d™ move / my-d™ move NFC - SLE 66R01P / SLE 66R01PN Data Book The information in this document is subject to change without notice. Revision History: Current Version 2011-11-24 Previous Release: Preliminary 2011-11-18 Page Subjects (major changes since last revision) All Editorial changes; removed “Preliminary” status; update of figures (memory organization) Trademarks of Infineon Technologies AG BlueMoon™, COMNEON™, C166™, CROSSAVE™, CanPAK™, CIPOS™, CoolMOS™, CoolSET™, CORECONTROL™, DAVE™, EasyPIM™, EconoBRIDGE™, EconoDUAL™, EconoPACK™, EconoPIM™, EiceDRIVER™, EUPEC™, FCOS™, HITFET™, HybridPACK™, ISOFACE™, I²RF™, IsoPACK™, MIPAQ™, ModSTACK™, my-d™, NovalithIC™, OmniTune™, OptiMOS™, ORIGA™, PROFET™, PRO-SIL™, PRIMARION™, PrimePACK™, RASIC™, ReverSave™, SatRIC™, SensoNor™, SIEGET™, SINDRION™, SMARTi™, SmartLEWIS™, TEMPFET™, thinQ!™, TriCore™, TRENCHSTOP™, X-GOLD™, XMM™, X-PMU™, XPOSYS™. Other Trademarks Advance Design System™ (ADS) of Agilent Technologies, AMBA™, ARM™, MULTI-ICE™, PRIMECELL™, REALVIEW™, THUMB™ of ARM Limited, UK. AUTOSAR™ is licensed by AUTOSAR development partnership. Bluetooth™ of Bluetooth SIG Inc. CAT-iq™ of DECT Forum. COLOSSUS™, FirstGPS™ of Trimble Navigation Ltd. EMV™ of EMVCo, LLC (Visa Holdings Inc.). EPCOS™ of Epcos AG. FLEXGO™ of Microsoft Corporation. FlexRay™ is licensed by FlexRay Consortium. HYPERTERMINAL™ of Hilgraeve Incorporated. IEC™ of Commission Electrotechnique Internationale. IrDA™ of Infrared Data Association Corporation. ISO™ of INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. MATLAB™ of MathWorks, Inc. MAXIM™ of Maxim Integrated Products, Inc. MICROTEC™, NFC Forum™ is trademark of Near Field Communication Forum, NUCLEUS™ of Mentor Graphics Corporation. Mifare™ of NXP. MIPI™ of MIPI Alliance, Inc. MIPS™ of MIPS Technologies, Inc., USA. muRata™ of MURATA MANUFACTURING CO., MICROWAVE OFFICE™ (MWO) of Applied Wave Research Inc., OmniVision™ of OmniVision Technologies, Inc. Openwave™ Openwave Systems Inc. RED HAT™ Red Hat, Inc. RFMD™ RF Micro Devices, Inc. SIRIUS™ of Sirius Sattelite Radio Inc. SOLARIS™ of Sun Microsystems, Inc. SPANSION™ of Spansion LLC Ltd. Symbian™ of Symbian Software Limited. TAIYO YUDEN™ of Taiyo Yuden Co. TEAKLITE™ of CEVA, Inc. TEKTRONIX™ of Tektronix Inc. TOKO™ of TOKO KABUSHIKI KAISHA TA. UNIX™ of X/Open Company Limited. VERILOG™, PALLADIUM™ of Cadence Design Systems, Inc. VLYNQ™ of Texas Instruments Incorporated. VXWORKS™, WIND RIVER™ of WIND RIVER SYSTEMS, INC. ZETEX™ of Diodes Zetex Limited. Data Book 3 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Table of Contents 1 1.1 Ordering and packaging information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2 2.1 2.2 my-d™ Product Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 my-d™ move and my-d™ move NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Application Segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3 3.1 3.2 3.2.1 3.2.2 3.2.3 3.2.4 3.3 3.4 3.5 3.6 3.7 Scope of my-d™ move / my-d™ move NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Circuit Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Memory Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Service Area 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User Area 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User Area 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Service Area 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Memory Principle for NFC Forum™ Type 2 Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . UID Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supported Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 12 13 14 14 14 14 15 16 17 17 17 4 4.1 4.2 4.2.1 4.2.2 4.2.2.1 4.2.3 4.2.4 4.2.5 4.3 4.3.1 4.3.2 4.4 4.4.1 4.4.2 Memory Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User Memory Area 1 and 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Service Area 1 and 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Unique Identifier (UID) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuration Byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Locking Mechanism for the Configuration Byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Locking mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . OTP Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Manufacturer Block (25H) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Memory Principle for NFC Forum™ Type 2 Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NFC Forum™ Static Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NFC Forum™ Dynamic Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transport Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transport Configuration my-d™ move . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transport Configuration my-d™ move NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 18 19 19 20 20 21 22 22 23 23 24 26 26 27 5 5.1 5.2 5.3 Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Password Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Password Retry Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Anti-tearing Mechanism for Password Retry Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 29 29 31 6 6.1 6.2 6.3 6.4 16-bit Value Counter Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Value Counter Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Loading and Reading of Value Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Decrementing Value Counter and Anti-Tearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Protection Mechanisms for the Value Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 32 33 34 34 7 7.1 7.2 7.2.1 7.2.2 Communication Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Communication between a card (PICC) and a reader (PCD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . State Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IDLE/HALT State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . READY1/READY1* State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 35 35 35 35 Data Book 4 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN 7.2.3 7.2.4 7.2.5 7.3 7.3.1 7.4 7.5 READY2/READY2* State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ACTIVE/ACTIVE* State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . HALT State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Start up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Start-up sequence of the SLE 66R01P and SLE 66R01PN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Frame Delay Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 36 36 37 37 37 38 8 8.1 8.2 8.2.1 8.2.2 8.2.3 8.2.4 8.2.5 8.2.6 8.2.7 8.2.8 8.2.9 8.3 8.3.1 8.3.2 Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supported ISO/IEC 14443-3 Type A Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Memory Access Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Read 4 Blocks (RD4B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write 1 Block (WR1B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Compatibility Write Command (CPTWR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Read 2 Blocks (RD2B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write 2 Blocks (WR2B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set Password (SPWD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Access (ACS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Decrement Command (DCR16) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . HLTA command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . my-d™ move and my-d™ move NFC responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Command responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . my-d™ move and my-d™ move NFC identification data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 39 39 41 42 43 44 45 46 47 49 51 52 52 52 9 9.1 9.2 Operational Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Data Book 5 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN List of Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 Figure 11 Figure 12 Figure 13 Figure 14 Figure 15 Figure 16 Figure 17 Figure 18 Figure 19 Figure 20 Figure 21 Figure 22 Figure 23 Figure 24 Figure 25 Figure 26 Figure 27 Figure 28 Figure 29 Data Book Pin configuration die . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Block Diagram of the SLE 66R01P and SLE 66R01PN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 SLE 66R01P and SLE 66R01PN memory principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 SLE 66R01P and SLE 66R01PN NFC Forum™ Type 2 Tag memory structure . . . . . . . . . . . . . . 15 SLE 66R01P and SLE 66R01PN Contactless System Overview. . . . . . . . . . . . . . . . . . . . . . . . . . 16 SLE 66R01P and SLE 66R01PN double-size UID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 my-d™ move and my-d™ move NFC memory organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Configuration Byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Locking and Block Locking Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Static Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Generic NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N)). . . . . . . 24 Example of a NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N)) . . 25 my-d™ move Transport Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 my-d™ move NFC Transport Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Password and Password Retry Counter configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Value Counter - Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Value Counter decrement example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Start-up Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Read 4 Blocks Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Write 1 Block Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Compatibility Write Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Read 2 Blocks Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Write 2 Blocks Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Set Password Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Access Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Flow Diagram of the ACS Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Decrement Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Decrement Command flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 HLTA Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 6 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN List of Tables Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 Table 11 Table 12 Table 13 Table 14 Table 15 Table 16 Table 17 Table 18 Table 19 Table 20 Table 21 Table 22 Table 23 Table 24 Table 25 Table 26 Table 27 Table 28 Table 29 Table 30 Data Book Ordering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Pin description and function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 my-d™ family product overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 UID Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 UID Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Configuration Byte Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Example for OTP Block Lock and Block Lock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Writing to OTP Block (block 03H) from the user point of view . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Capability Container settings for my-d™ move and my-d™ move NFC. . . . . . . . . . . . . . . . . . . . . 28 Empty NDEF message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Access Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Behavior in case of an Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 ISO/IEC 14443-3 Type A Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 my-d™ move and my-d™ move NFC memory access command set . . . . . . . . . . . . . . . . . . . . . . 39 Read 4 Blocks (RD4B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Write 1 Block (WR1B). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Compatibility Write (CPTWR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Read 2 Block (RD2B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Write 2 Block (WR2B). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Set Password (SPWD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 SPWD - behaviour in error case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Access (ACS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 ACS - behaviour in error case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Decrement (DCR16) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 DCR16 - behaviour in error case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Halt (HLTA). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 ACK and NACK as responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Summary of SLE 66R01P and SLE 66R01PN identification data . . . . . . . . . . . . . . . . . . . . . . . . . 52 Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 7 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Features Intelligent 1216 bit EEPROM with Contactless Interface compliant to ISO/IEC 14443-3 Type A and support of NFC Forum™ Type 2 Tag Operation Contactless Interface • • • Physical Interface and Anticollision compliant to ISO/IEC 14443-3 Type A – Operation frequency 13.56 MHz – Data rate 106 kbit/s in both direction – Contactless transmission of data and supply energy – Anticollision logic: several cards may be operated in the field simultaneously Unique IDentification number (7-byte double-size UID) according to ISO/IEC 14443-3 Type A Read and Write Distance up to 10 cm and more (influenced by external circuitry i.e. reader and inlay design) 152 byte EEPROM • • • • • • • Organized in 38 blocks of 4 bytes each 128 bytes freely programmable User Memory 24 bytes of Service Area reserved for UID, Configuration, LOCK Bytes, OTP Block and Manufacturer Data Read and Write of 128 bytes of User Memory in less than 100 ms Programming time per block < 4 ms Endurance minimum 10,000 erase/write cycles1) Data Retention minimum 5 years1) Privacy Features • • • • • • 32 bit of One Time Programmable (OTP) memory area Locking mechanism for each block Block Lock mechanism Optional 32 bit Password for Read/Write or Write access Optional Password Retry Counter Optional 16 bit Value Counter Data Protection • • Data Integrity supported by 16 bit CRC, parity bit, command length check Anti-tearing mechanism for OTP, Password Retry Counter and Value Counter NFC Forum™ Operation • • • • Compliant to NFC Forum™ Type 2 Tag Operation Support of Static and Dynamic Memory Structure according to NFC Forum™ Type 2 Tag Operation SLE 66R01PN: pre-configured NFC memory with empty NDEF message (INITIALIZED state, non-reversible) SLE 66R01P: UNINITIALIZED state, may be configured to INITIALIZED state Electrical Characteristics • • • On-Chip capacitance 17 pF + 5% ESD protection minimum 2 kV Ambient Temperature -25°C … +70°C (for the chip) 1) Values are temperature dependent Data Book 8 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Ordering and packaging information 1 Ordering and packaging information Table 1 Ordering information Total Memory / User Memory1) Type Package SLE 66R01P C wafer sawn / unsawn SLE 66R01P NB NiAu Bumped (sawn wafer) Ordering code on request SP000911428 152 / 128 bytes SLE 66R01PN C wafer sawn / unsawn SLE 66R01PN NB NiAu Bumped (sawn wafer) on request SP000953914 1) Total memory size includes the service area whereas user memory size is freely programmable for user data. For more ordering information about the form of delivery please contact your local Infineon sales office. 1.1 Pin description LA my-d™ move (NFC) SLE 66R01P(N) LB Figure 1 Pin configuration die Table 2 Pin description and function Symbol Function LA Antenna Connection LB Antenna Connection Data Book 9 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN my-d™ Product Family 2 my-d™ Product Family my-d™ products are available both in plain mode with open memory access and in secure mode with memory access controlled by authentication procedures. The my-d™ product family provides users with different memory sizes, features NFC Forum™ Type 2 Tag functionality and incorporates security features to enable considerable flexibility in the application design. Flexible controls within the my-d™ devices start with plain mode operation featuring individual page locking; for more complex applications various settings in secure mode can be set for multi user / multi application configurations. In plain mode access to the memory is supported by both 4-byte block as well as 8-byte page structure. In secure mode a cryptographic algorithm based on a 64-bit key is available. Mutual authentication, message authentication codes (MAC) and customized access conditions protect the memory against unauthorized access. The functional architecture, meaning the memory organization and authentication of my-d™ products is the same for both my-d™ proximity (ISO/IEC 14443) and my-d™ vicinity (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693). This eases the system design and allows simple adaptation between applications. Configurable Value Counters featuring anti-tearing functionality are suitable for value token applications, such as limited use transportation tickets. Architectural interoperability of my-d™ products enables an easy migration from simple to more demanding applications. The my-d™ move family is designed for cost optimized applications and its implemented command set eases the usage in existing applications and infrastructures. In addition, the my-d™ light (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693) is part of the my-d™ family. Its optimized command set and memory expands the range of applications to cost sensitive segments. 2.1 my-d™ move and my-d™ move NFC The my-d™ move and my-d™ move NFC are part of Infineon’s my-d™ product family and are designed to meet the requirements of the increasing NFC market demanding smart memories. They are compliant to ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC Forum™ Type 2 Tag Operation. 128 Bytes of memory can be arranged in static or dynamic memory structures for NFC applications. my-d™ move and my-d™ move NFC products also feature configurable Value Counters which support antitearing protection. Privacy features like a password protection including password retry counter provide basic security to the applications. Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the INITIALIZED state according to the definition of the NFC Forum™ Type 2 Tag life cycle. Due to that the my-d™ move NFC is ready to be used in NFC infrastructures. my-d™ move and my-d™ move NFC products are suited for a broad range of applications like public transport, event ticketing or smart posters. Data Book 10 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN my-d™ Product Family 2.2 Application Segments my-d™ products are optimized for personal and object identification. Please find in the following table some dedicated examples Table 3 my-d™ family product overview Product Application my-d™ move - SLE 66R01P Public Transport, Smart Posters, NFC Device Pairing my-d™ move NFC - SLE 66R01PN Public Transport, Smart Posters, NFC Device Pairing, NFC INITIALIZED state my-d™ move lean - SLE 66R01L Public Transport, Smart Posters, NFC Device Pairing my-d™ NFC - SLE 66RxxP Smart Posters and Maps, NFC Device Pairing, Loyalty Schemes, Consumer Good Information, Healthcare Monitoring my-d™ proximity 2 - SLE 66RxxS Access Control, Entertainment, Public Transport, Customer Loyalty Schemes, Micro Payment my-d™ proximity enhanced - SLE 55RxxE Access Control, Gaming, Entertainment, Customer Loyalty Schemes my-d™ light - SRF 55V01P Libraries, Laundry, Factory Automation, Media Management, Event Ticketing, Leisure Park Access my-d™ vicinity plain - SRF 55VxxP Factory Automation, Healthcare, Ticketing, Access Control my-d™ vicinity plain HC - SRF 55VxxP HC Ticketing, Brand Protection, Loyalty Schemes, Ski passes my-d™ vicinity secure - SRF 55VxxS Ticketing, Brand protection, Loyalty Schemes, Access Control Data Book 11 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3 Scope of my-d™ move / my-d™ move NFC The SLE 66R01P and SLE 66R01PN are part of the Infineon my-d™ product family and support Infineon’s transport and ticketing strategy and are designed to meet the requirements of NFC applications. They are compliant to ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC Forum™ Type 2 Tag Operation. 3.1 Circuit Description The SLE 66R01P and SLE 66R01PN are made up of an EEPROM memory unit, an analog interface for contactless operation, a data transmission path and a control unit. The following diagram shows the main blocks of the SLE 66R01P and SLE 66R01PN. LA POWER Analog Contactless Interface Memory Unit CLOCK Antenna Power Circuit Rectifier Clock Extractor Voltage Regulator Power on Reset DATA Parallel Serial IO Command LB Anticollision Memory Access Control Unit Figure 2 Block Diagram of the SLE 66R01P and SLE 66R01PN The SLE 66R01P and SLE 66R01PN comprise the following three parts: • • • Analog Contactless Interface – The Analog Contactless Interface contains the voltage rectifier, voltage regulator and system clock to supply the IC with appropriate power. Additionally the data stream is modulated and demodulated. Memory Unit – The Memory Unit consists of 38 blocks of 4 bytes each. Control Unit – The Control Unit decodes and executes all commands. Additionally the control unit is responsible for the correct anticollision flow. Data Book 12 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3.2 Memory Principle The total amount of addressable memory is 152 bytes organized in blocks of 4 bytes each. The general structure comprises Service Areas as well as User Areas: • • 24 bytes of service and administration data (located in Service Area 1 and 2) reserved for – 7-byte double-size UID – configuration data – LOCKx bytes – OTP memory – Manufacturing Data 128 bytes of User memory (located in User Area 1 and 2) reserved for – User Data – Value Counter Additionally the Password and Password Retry Counter are available and accessible via dedicated commands. Service Area 1 Unique serial number (UID) User Area 1 Password protectable User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 3 Data Book SLE 66R01P and SLE 66R01PN memory principle 13 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3.2.1 Service Area 1 Service Area 1 contains • • • • the 7-byte UID which is programmed at manufacturing of the chip and cannot be changed CONFIG byte to enable the Password (incl. the Password Retry counter) and the Value Counter functionality LOCK0, LOCK1 bytes to enable an irreversible write-protection for the blocks located in User Area 1 32 bits of the One-Time-Programmable (OTP) memory block can irreversibly be programmed from 0B to 1B 3.2.2 User Area 1 48 bytes (12 blocks, 4 bytes each) of memory for user data. 3.2.3 User Area 2 User Area 2 contains • • 80 bytes (20 blocks, 4 bytes each) of user memory for user data. These memory blocks can be used to store user data. This portion of the memory may be protected with a 32 bit password. a 16-bit Value Counter may be activated providing a mechanism to store some value (points, trips, ...) on the my-d™ move and my-d™ move NFC chip. 3.2.4 Service Area 2 Service Area 2 contains • • lock bytes LOCK2 to LOCK5 to enable an irreversible write-protection for the blocks loacted in User Area 2 Manufacturing Data (programmed during manufacturing of the chip) which cannot be changed Data Book 14 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3.3 Memory Principle for NFC Forum™ Type 2 Tag The memory organization is configurable according to the NFC Forum™ Type 2 Tag Operation specification. Static or dynamic memory structures are supported. Figure 4 illustrates the principle of the SLE 66R01P and SLE 66R01PN as a NFC Forum™ Type 2 Tag compatible chip. The memory can be accessed with NFC Forum™ Type 2 Tag commands. Service Area 1 Unique serial number (UID) CAPABILITY CONTAINER Data Data User Area 1 Password protectable User Area 2 Data Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 4 SLE 66R01P and SLE 66R01PN NFC Forum™ Type 2 Tag memory structure Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the INITIALIZED state according to the definition of the NFC Forum™ Type 2 Tag life cycle. With this preconfiguration the my-d™ move NFC can be immediately used in NFC infrastructures. For details regarding the NFC initialization of my-d™ move and my-d™ move NFC please refer the the Application Note “How to operate my-d™ move and my-d™ move NFC devices in NFC Forum™ Type 2 Tag infrastructures” available at Chip Card & Security [email protected]. Attention: The pre-configuration of SLE 66R01PN is nonreversible and the my-d™ move NFC cannot be overwritten and used as plain, standard my-d™ move anymore. Data Book 15 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC System Overview 3.4 The system consists of a host system, one or more SLE 66R01P / SLE 66R01PN tags or other ISO/IEC 144433 Type A compliant cards and an ISO/IEC 14443-3 Type A compatible contactless reader. Alternatively, since the SLE 66R01P and SLE 66R01PN can be used in NFC Forum™ Type 2 Tag memory structures, a NFC Forum™ device in card reader/writer mode can be used to operate the chip. Host System PCD Micro Controller Analog Circuitry SLE 66R01P(N) my-dTM move (NFC) Energy Identification Terminal ISO/IEC14443 Type A or NFC Forum™ Device Figure 5 Data Book Clock PICC Antenna Data SLE 66R01P and SLE 66R01PN Contactless System Overview 16 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC UID Coding 3.5 To identify a SLE 66R01P and SLE 66R01PN chip the manufacturer code and a chip family identifier are coded into the UID as described in the Table 4. The chip family identifier can be used to determine the basic command set for the chip. UID PCD size double PICC ’93' ’95' CT uid0 uid1 uid2 BCC ’05H’ uid3 uid4 uid5 uid6 BCC Chip Family ID Figure 6 SLE 66R01P and SLE 66R01PN double-size UID Table 4 UID Coding UID Field Value Description uid0 05H IC Manufacturer Code according to ISO/IEC 7816-6 uid1 3xH Chip Family Identifier Higher Nibble: 0011B: my-d™ move and my-d™ move NFC Lower Nibble: part of the UID number 3.6 Supported Standards the SLE 66R01P and SLE 66R01PN support the following standards: • • • ISO/IEC 14443 Type A (Parts 1, 2 and 3) tested according to ISO/IEC 10373-6 (PICC Test & Validation) ISO/IEC 14443-3 Type A NFC Forum™ Type 2 Tag Operation 3.7 Command Set The SLE 66R01P and SLE 66R01PN is compliant to the ISO/IEC 14443-3 Type A standard. A set of standard ISO/IEC 14443-3 Type A commands is implemented to operate the chip. Additionally NFC Forum™ Type 2 Tag commands and a my-d™ move and my-d™ move NFC specific command set is implemented. This facilitates the access to the on-chip integrated memory and supports the execution of password and counter functionality. Data Book 17 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization 4 Memory Organization The total amount of user memory is 152 byte. It is organized in blocks of 4 bytes each. It comprises: • • 128 bytes for user data 24 bytes for UID, OTP, locking information, IC configuration and manufacturer information. Additionally the Password and Password Retry Counter are allocated in non-addresable part of the memory and are accessible via dedicated commands only. Password protectable Figure 7 shows the memory structure of the SLE 66R01P and SLE 66R01PN chip. Serial number 00 H uid0 uid1 uid2 BCC0 Serial number 01 H uid3 uid4 uid5 uid6 Configuration / Lock 02 H BCC1 CONFIG LOCK0 LOCK1 OTP 03 H OTP0 OTP1 OTP2 OTP3 User Data 04 H Data0 Data1 Data2 Data3 User Data 05 H Data4 Data5 Data6 Data7 User Data 06 H Data8 ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... User Data 0FH Data44 Data45 Data46 Data47 User Data 10 H Data48 Data49 Data50 Data51 User Data 11 H Data52 ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... User Data / Counter User Data / Counter 22 H 23 H Data120 / Counter Data124 / Counter Data121 / Counter Data125 / Counter Data122 / Counter Data126 / Counter Data123 / 00 H Data127 / 00 H Lock 24 H LOCK2 LOCK3 LOCK4 LOCK5 Manufacturer 25 H MAN0 MAN1 MAN2 MAN3 Service Area 1 User Area 1 User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 7 my-d™ move and my-d™ move NFC memory organization 4.1 User Memory Area 1 and 2 Blocks from address 04H to 23H belong to the User Memory Area (1 and 2). This part of the memory is readable / writable as well as lockable against unintentional overwriting using a locking mechanism. Moreover the User Memory Area 2 above the address 10H can be protected with a Password against unintentional reading or reading/writing. Data Book 18 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization 4.2 Service Area 1 and 2 The Service Area 1 (block address 00H to 03H) contains • • • • 7-byte double-size UID (plus two bytes of UID BCC information) Configuration Byte LOCK0 and LOCK1 to lock the OTP block and blocks in User Area 1 32 bit OTP memory The Service Area 2 (block address 24H to 25H) contains • • LOCK2 - LOCK5 to lock blocks in User Area 2 Manufacturer Data 4.2.1 Unique Identifier (UID) The 9 bytes of the UID (7 byte UID + 2 bytes BCC information) are allocated in Block 00H, Block 01H and Byte 1 of Block 02H of the my-d™ move and my-d™ move NFC memory. All bytes are programmed and locked during the manufacturing process. These bytes cannot be changed. For the content of the UID the following definitions apply: • SLE 66R01P and SLE 66R01PN support Cascade Level 2 UID according to the ISO/IEC 14443-3 Type A which is a 7 byte unique number The table below describes the content of the UID including the BCC information. Table 5 UID Description Cascade Level 2 - double-size UID UID Byte CT1) uid02) uid13) uid2 BCC04) uid3 uid4 uid5 uid6 BCC14) 1) CT is the Cascade Tag and designates CL2. It has a value of 88H. Please note that CT is hardwired and not stored in the memory. 2) uid0 is the Manufacturer Code: 05H according to ISO/IEC 7816-6 3) uid1 is the Chip Family Identifier. The higher significant nibble identifies a my-d™ move and my-d™ move NFC chip (0011B). The lower significant nibble of uid1 is part of the serial number. 4) BCCx are the UID CLn checkbytes calculated as Exclusive-OR over the four previous bytes (as described in ISO/IEC 14443-3 Type A). BCCx is stored in the memory and read-out during the anti-collision. Data Book 19 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization 4.2.2 Configuration Byte The Configuration Byte defines the configurable functionality of the my-d™ move and my-d™ move NFC. It is allocated in Byte 1 of Block 02H. At delivery all bits of the Configuration Byte are set to 0B. Note that the Configuration Byte is One Time Programmable (OTP) byte. Bits allocated in this byte can only be logically set to 1B, which is an irreversible process i.e. bits can not be reset to 0B afterwards. CONFIG 7 6 5 4 3 2 1 0 En_VC PCN2 PCN1 PCN0 RFU SP_RW SP_W CNF_BL Figure 8 Configuration Byte Table 6 Configuration Byte Definition Configuration Bit Configuration Byte Lock Set Password for Write access Set Password for Read and Write access RFU Abbreviation Description CNF_BL 0B ... Configuration Byte programmable 1B ... Configuration Byte locked SP-W 0B ... The Write Password is not active 1B ... The Write Password is active for Write Commands which are applied to all blocks starting from the address 10H SP_WR 0B ... The Read and Write Password is not active 1B ... The Read and Write Password is active for read, write and decrement commands for all blocks above address 0FH RFU Reserved for the future use Initial value of the Password Retry Counter PCN2 PCN1 PCN0 000B ... Default setting 111B ... Maximal initial value (7D) Password Retry Counter is only active if the initial value is different than 0D. 16-bit Value Counter En_VC 0B ... Value Counter is not configured, blocks 22H and 23H are User Data blocks 1B ... Value Counter is set, blocks 22H and 23H are reserved for the 16-bit Value Counter Note: The CNF_BL bit is active immediately active after writing. To activate the new configuration of SP-W, SPWR and VCRN16 bits the execution of REQA or WUPA commands is required. The new value of the Password Retry Counter (PCN2, PCN1 and PCN0 bits) is active immediately, i.e. is read each time the information is required (during the execution of the Access command). 4.2.2.1 Locking Mechanism for the Configuration Byte The my-d™ move and my-d™ move NFC is delivered with all bits of Configuration Byte set to 0B. The issuer should define the functionality of a chip as required (set e.g. Write and/or Read/Write Password, the Password Retry Counter, the 16-bit Value Counter etc.) and lock the Configuration Byte. Once the Configuration Byte is locked no further changes to the Configuration Byte are possible. Note: If all three BL Bits in the LOCK0 Byte are set to 1B, block 02H is locked. It is then not possible to change the value of this particular block (02H) any more. Data Book 20 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization 4.2.3 Locking mechanism Bytes LOCK0, LOCK1 allocated in Block 02H and LOCK2, LOCK3, LOCK4 and LOCK5 allocated in Block 24H represent the one time field programmable bits which are used to lock the blocks in the specified address range from block 03H (OTP Block) to 23H. Each block in this range can be individually locked to prevent further write access. A locking mechanism of each block is irreversible, i.e. once the locking information of a particular block (Lx) is set to 1B it can not be reset back to 0B any more. Figure 9 illustrates the locking bytes with the corresponding locking bits. Furthermore, it is possible to freeze the locking information of some memory areas by setting Block Locking (BL) bits e.g. if the bit BL 15-10 is set to 1B then the locking information for the corresponding area (L10 to L15) is not changeable any more. See the example in the Table 7 below. Block 02H Byte0 Byte1 Byte2 Byte3 BCC1 CONFIG LOCK0 LOCK1 7 6 5 4 L 7 L 6 L 5 L 4 3 L 2 1 0 7 6 5 4 3 2 BL BL BL 9-4 OTP L 15 L 14 L 13 L 12 L 11 L 10 7 6 5 4 3 2 1 0 0 L 35 L 34 L 33 L 32 2 1 0 OTP 15-10 7 6 5 4 3 2 1 0 L 31 L 30 L 29 L 28 L 27 L 26 L 25 L 24 Byte0 Byte1 Block 24H LOCK2 = 00H 0 0 Byte2 7 6 5 4 3 2 1 0 L 22 L 21 L 20 L 19 L 18 L 17 L 16 7 0 6 2 0 L 8 Byte3 LOCK3 = 00H LOCK4 = 00H L 23 Figure 9 0 1 L 9 0 LOCK5 = 00H 5 1 0 4 0 0 3 BL BL BL BL 35-31 30-26 25-21 20-16 Locking and Block Locking Mechanism The Write One Block (WR1B) command should be used to set the locking or block locking information of a certain block. If WR1B is applied to Block 02H then: • • the Byte 0 (BCC1) will not be changed the Byte 1 (Configuration Byte) will be changed only if it is not locked If WR1B is applied to Block 24H then: • • the Byte2 [7..4] = Lock4[7..4] and the Byte3 [7..4] = Lock5[7..4] will not be changed neither. Data Book 21 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization The locking and block locking for a certain block is active immediately after writing. That means that it is not necessary to execute the REQA or WUPA command in order to activate the locking. Note: If all three BL bits in the LOCK0 byte are set to 1B then Block 02H is locked. It is not possible to change the locking bits of this block any more. The same applies for block 24H. If BL bits of the LOCK5 byte are set to 1B then this block is locked. In this case the SLE 66R01P and SLE 66R01PN responds with NACK to a corresponding Write command. Table 7 Example for OTP Block Lock and Block Lock BL OTP L OTP OTP BLOCK STATE 0B 0B OTP Block Unlocked 0B 1B OTP Block Locked 1B 0B OTP Block Unlocked and can not be locked ever more 1B 1B OTP Block Locked An Anti-Tearing mechanism is implemented for Lock bytes on the SLE 66R01P and SLE 66R01PN. This mechanism prevents a stored value to be lost in case of a tearing event. This increases the level of data integrity and it is transparent to the customer. 4.2.4 OTP Block The Block 03H is a One Time Programmable (OTP) Block. Bits allocated in this block can only be logically set to 1B, which is an irreversible process i.e. bits can not be reset to 0B afterwards. The Write One Block (WR1B) command should be used to program a specific OTP value. Incoming data of the WR1B command are bit-wise OR-ed with the current content of the OTP Block and the result is written back to the OTP Block. Table 8 Writing to OTP Block (block 03H) from the user point of view OTP Block Representation bit-wise Description Initial value 0000 0000 0000 0000 0000 0000 0000 0000B Production setting Write [55550003]H 0101 0101 0101 0101 0000 0000 0000 0011B Bit-wise “OR” with previous content of block 03H Write [AA55001C]H 1111 1111 0101 0101 0000 0000 0001 1111B Bit-wise “OR” with previous content of block 03H An Anti-Tearing mechanism is implemented for the OTP Block on the my-d™ move and my-d™ move NFC. This mechanism prevents the stored value to be lost in case of a tearing event. This increases the level of data integrity and is transparent to the customer. 4.2.5 Manufacturer Block (25H) The Manufacturer Block is used to store the my-d™ move and my-d™ move NFC internal on-chip configuration data and the manufacturing data such as Week and Year of production, Lot and Wafer Counter etc. This block is programmed and locked at manufacturing. Data Book 22 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization 4.3 Memory Principle for NFC Forum™ Type 2 Tag This section desribes how to map the my-d™ move and my-d™ move NFC memory into the memory structures defined in the NFC Forum™ Type 2 Tag technical specification. This enables the usage of the my-d™ move and my-d™ move NFC as a NFC Forum™ Type 2 Tag compatible chip. 4.3.1 NFC Forum™ Static Memory Structure The Static Memory Structure is applied to a NFC Forum™ Type 2 Tag with a memory size equal to 64 bytes (see Figure 10). Blocks 04H to 0FH are available to store user data. Serial number 00 H uid0 uid1 uid2 INTERNAL0 Serial number 01 H uid3 uid4 uid5 uid6 Internal / Lock 02 H INTERNAL1 INTERNAL2 LOCK0 = 00 H LOCK1 = 00 H Capability Container 03 H CC0 = E1 H CC1 = 10 H CC2 = 06H CC3 = 00 H NDEF TLV Terminator TLV 04 H NDEF message TLV = 03 H 00 H Terminator TLV = FEH Data3 User Data 05 H ... ... ... ... User Data 06 H ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... User Data 0FH ... ... Data46 Data47 Figure 10 Service Area 1 User Area 1 Static Memory Structure The Static Memory Structure is characterized by the NDEF message TLV (03H) starting at block address 04H. The NFC data shown in Figure 10 is an empty NDEF message (see Table 10). Data Book 23 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization 4.3.2 NFC Forum™ Dynamic Memory Structure Password protectable The Dynamic Memory Structure can be applied to NFC Forum™ Type 2 Tags with bigger memories than 64 bytes. Figure 11 shows a generic memory layout with a Dynamic Memory Structure (based on the my-d™ move and my-d™ move NFC chip). Serial number 00 H uid0 uid1 uid2 INTERNAL0 Serial number 01 H uid3 uid4 uid5 uid6 Internal / Lock 02 H INTERNAL1 INTERNAL2 LOCK0 LOCK1 Capability Container 03 H CC0 CC1 CC2 CC3 LockCtrl TLV2 LockCtrl TLV 3 LockCtrl TLV 04 H LockCtrl TLV0 LockCtrl TLV 1 LockCtrl TLV / MemCtrl TLV MemCtrl TLV / Empty NDEF 05 H LockCtrl TLV4 MemCtrl TLV0 MemCtrl TLV1 MemCtrl TLV2 06 H MemCtrl TLV3 MemCtrl TLV4 NDEF message TLV 00 H Terminator TLV 07 H Terminator TLV ... ... ... ... ... ... ... ... ... ... 0FH ... ... ... ... ... 10 H ... ... ... ... ... 11 H ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... 22 H ... ... ... ... ... 23 H ... ... ... ... Lock 24 H LOCK2 LOCK3 LOCK4 LOCK5 Reserved 25 H Reserved Reserved Reserved Reserved Service Area 1 User Area 1 User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 11 Generic NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N)) Compared to the Static Memory Structure the Dynamic Memory Structure is characterized by the NDEF message TLV starting after the Lock Control TLV and Memory Control TLV (the Lock Control TLV starts at Block 04H). Within a Dynamic Memory Structure dynamic lock bytes and reserved bytes might be located at any address in the data area (see LOCK2 - LOCK5, Reserved shown in Figure 11). The location and the number of bytes used for these purposes is defined by the settings of the Lock Control TLV respectively Memory Control TLV. Following example for a Dynamic Memory Structure (shown in Figure 12) focusses on my-d™ move and my-d™ move NFC. Data Book 24 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Password protectable Memory Organization Serial number 00 H uid0 uid1 uid2 INTERNAL0 Serial number 01 H uid3 uid4 uid5 uid6 Internal / Lock 02 H INTERNAL1 INTERNAL2 LOCK0 = 00 H LOCK1 = 00 H Capability Container 03 H CC0 = E1H CC1 = 10 H CC2 = 10 H CC3 = 00 H LockCtrl TLV 04 H LockCtrl TLV / MemCtrl TLV MemCtrl TLV / Empty NDEF 05 H LockCtrl TLV1 = 03 H MemCtrl TLV0 = 02 H MemCtrl TLV4 = 04 H LockCtrl TLV2 = 90 H MemCtrl TLV1 = 03 H NDEF message TLV = 03 H LockCtrl TLV3 = 14 H MemCtrl TLV2 = 93 H Terminator TLV 07 H LockCtrl TLV0 = 01 H LockCtrl TLV4 = 24 H MemCtrl TLV3 = 05 H Terminator TLV = FE H ... ... ... ... ... ... ... ... ... ... 0FH ... ... ... ... ... 10 H ... ... ... ... ... 11 H ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... 22 H ... ... ... ... ... 23 H ... ... ... ... Lock / Reserved 24 H LOCK2 LOCK3 LOCK4 Reserved0 Reserved 25 H Reserved1 Reserved2 Reserved3 Reserved4 06 H 00 H Service Area 1 User Area 1 User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 12 Example of a NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N)) If a NFC Forum™ Type 2 Tag compliant chip with Lock Control TLV and Memory Control TLV is required, NFC Forum™ Type 2 Tag specific data such as Capability Container, Lock Control TLV, Memory Control TLV, NDEF Message and Terminator TLV should be written to the memory according to the given hardware configuration. Figure 12 holds valid Lock Control TLV and the Memory Control TLV settings within a Dynamic Memory Structure specially suited for the my-d™ move and my-d™ move NFC devices. For my-d™ move and my-d™ move NFC the position of the static and dynamic lock bytes is hard-wired and it is not possible to change their position in the memory. • • Static lock bytes LOCK0 and LOCK1 are allocated in block 2, bytes 2 and 3. LOCK0 and LOCK1 are used to lock blocks from address 00H to 0FH. Dynamic lock bytes LOCK2 to LOCK5 are allocated in block 24H. These LOCKx bytes are used to lock blocks starting from address 10H. The position and the number of dynamic lock bits is coded into the Lock Control TLV as shown above. In this example 20 lock bits are required to lock the User Memory blocks 10H to 23H. Furthermore the Memory Control TLV defines the location and number of reserved bytes in the memory. Data Book 25 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization 4.4 Transport Configuration Figure 11 shows the memory principle of SLE 66R01P and SLE 66R01PN. Following sections provide details about the initial memory content of these devices. 4.4.1 Transport Configuration my-d™ move Password protectable The transport configuration of SLE 66R01P contains following information: Serial number 00 H uid0 uid1 uid2 BCC0 Serial number 01 H uid3 uid4 uid5 uid6 Configuration / Lock 02 H BCC1 CONFIG = 00 H LOCK0 = 00 H LOCK1 = 00 H OTP 03 H OTP0 = 00 H OTP1 = 00 H OTP2 = 00 H OTP3 = 00 H User Data 04 H 00 H 00 H 00 H 00 H ... 05 H ... ... ... ... ... 06 H ... ... ... ... ... 07 H ... ... ... ... ... ... ... ... ... ... User Data 0FH ... ... ... ... User Data 10 H ... ... ... ... ... 11 H ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... 22 H ... ... ... ... User Data 23 H ... ... ... ... Lock 24 H LOCK2 = 00 H LOCK3 = 00 H LOCK4 = 00 H LOCK5 = 00 H Manufacturer 25 H MAN0 MAN1 MAN2 MAN3 Service Area 1 User Area 1 User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 13 • • • • my-d™ move Transport Configuration Service Area 1 contains – predefined UID (incl. BCC bytes); read-only – CONFIG, LOCK0, LOCK1 set to 00H – LOCK0, LOCK1 set to 00H – OTP0 - OTP3 set to 00H User Area 1 – all Data bytes set to 00H User Area 2 – all Data bytes set to 00H Service Area 2 contains Data Book 26 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization • • – LOCK2 - LOCK5 set to 00H – Manufacturer Data; read-only Password set to 00H 00H 00H 00H Password Retry Counter – deactivated by the setting of the CONFIG byte The SLE 66R01P may be configured to INITIALIZED state according to the definition to the NFC Forum™ Type 2 Tag life cycle by writing • • Capability Container bytes (see Table 9) to Block 03H empty NDEF message TLV incl. Terminator TLV (see Table 10) to Block 04H 4.4.2 Transport Configuration my-d™ move NFC Password protectable SLE 66R01PN is delivered in INITIALIZED state (life cycle) according to the NFC Forum™ Type 2 Tag specification. Serial number 00 H uid0 uid1 uid2 BCC0 Serial number 01 H uid3 uid4 uid5 uid6 Configuration / Lock Capability Container 02 H BCC1 CONFIG = 00 H LOCK0 = 00 H LOCK1 = 00 H 03 H CC0 = E1H CC1 = 10 H CC2 = 10 H CC3 = 00 H Empty NDEF / Terminator TLV 04 H NDEF message TLV = 03 H 00 H Terminator TLV = FE H 00 H ... 05 H 00 H 00 H 00 H 00 H ... 06 H ... ... ... ... ... 07 H ... ... ... ... ... ... ... ... ... ... ... 0FH ... ... ... ... ... 10 H ... ... ... ... ... 11 H ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... 22 H ... ... ... ... ... 23 H ... ... ... ... Lock 24 H LOCK2 = 00 H LOCK3 = 00 H LOCK4 = 00 H LOCK5 = 00 H Manufacturer 25 H MAN0 MAN1 MAN2 MAN3 Service Area 1 User Area 1 User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 14 • my-d™ move NFC Transport Configuration Service Area 1 contains – predefined UID, read-only – CONFIG, LOCK0 and LOCK1 set to 00H Data Book 27 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Memory Organization • • • • • – OTP0 - OTP3 contains the CAPABILITY CONTAINER (see Table 9) User Area 1: – contains empty NDEF message TLV including Terminator TLV (= FEH) as indicated in Table 10 – all other data bytes set to 00H User Area 2 – all data bytes set to 00H Service Area 2 contains – LOCK2 - LOCK5 set to 00H – Manufacturer Data; read-only Password set to 00H 00H 00H 00H Password Retry Counter – deactivated by the setting of the CONFIG byte Table 9 Capability Container settings for my-d™ move and my-d™ move NFC Chip Type CC0 SLE 66R01PN E1H CC11) CC22) CC3 10H 10H 00H (may be changed to 11H if needed) 1) my-d™ move and my-d™ move NFC also support Version 1.1 of the NFC Forum™ Type 2 Tag specification. 2) CC2 indicates the memory size of the data area of the Type 2 Tag; the given values represent the maximum values for the chips Table 10 defines the empty NDEF Message TLV (identified with the Tag field value of 03H). The Length field value is set to 00H; due to that the Value field is not present. The Terminator TLV (FEH) is the last TLV block in the data area. Table 10 Empty NDEF message NDEF Message TLV Terminator TLV Tag field Length field Value field Tag Field Length field Value field 03H 00H - FEH - - Note: The pre-configuration of SLE 66R01PN is nonreversible and the my-d™ move NFC cannot be overwritten and used as plain, standard my-d™ move anymore. Data Book 28 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Password 5 Password An issuer can protect the blocks above address 0FH with a 32 bit Write and/or Read/Write Password by enabling the password functionality. The issuer can enable the password functionality by setting the Bit 1 (SP-W) of the Configuration Byte1) for Write Password access and/or bit 2 (SP-WR) of the Configuration Byte for Read/Write Password access (see Chapter 4.2.2). The new configuration is activated after the next transition to IDLE/HALT state is executed. The my-d™ move and my-d™ move NFC is delivered without Password protection i.e. default value of the SP-W and SP-WR bits is 0B. Table 11 Access Rights SP-WR SP-W Access Right 0B 0B Read Plain / Write Plain (default setting) 0B 1B Read Plain / Write Protected 1B xB Read Protected / Write Protected There is only one 32-bit Password value for both read and/or read/write access. 5.1 Password Block The Password Block holds 32 bit of Password data and is stored in a memory location which is accessible with dedicated commands only. The initial value of the Password Block is 00H 00H 00H 00H and should be changed after delivery. The Set Password SPWD2) command is used to change the content of the Password Block. • • If the my-d™ move and my-d™ move NFC is not configured for a password protection i.e. bits for SP-W or SPWR are not set, the Password Block will be overwritten with new Password data. If the my-d™ move and my-d™ move NFC is configured for password protection i.e. if SP-W and/or SP-WR bits are set, the Password Block will be overwritten with new Password data only after the chip has been successfully verified with the Access ACS3) command. 5.2 Password Retry Counter A Password Retry Counter counts the number of incorrect accesses to a password protected my-d™ move and my-d™ move NFC. The number of incorrect accesses can be predefined by setting the bits [6:4] of the Configuration Byte. This number is called the initial value of the Password Retry Counter. The Password Retry Counter is active if the number of incorrect accesses is higher than 0D i.e. bit[6:4] of the Configuration Byte are NOT all set to zero. The Write One Block (WR1B) command should be used to overwrite the Password Retry Counter value. The Initial value of the Password Retry Counter is active immediately after it is written. To prevent any further changes on a predefined Password Retry Counter value it is recommended to lock the Configuration Byte. Once the Configuration Byte is locked, the status of an initial counter value is locked, i.e. are no further changes to these bits are possible. The my-d™ move and my-d™ move NFC is delivered with a disabled Password Retry Counter i.e. the Initial value of the Password Retry Counter is equal to 000b. The maximum value of the Password Retry Counter is 7D, and valid values which activate the usage of the Password Retry Counter are in the range from 1D to 7D. 1) For more information about Configuration Byte see Section 4.2.2. 2) For more information about SPWD command see Section 8.2.6 3) For more information about ACS command see Section 8.2.7 Data Book 29 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Password Figure 15 shows how to configure the Password functionality on the my-d™ move and my-d™ move NFC. IDLE/HALT IDLE/HALT Proceed with Anticollision and Selection and go to ACTIVE state Proceed with Anticollision and Selection and go to ACTIVE state ……... ……... Change the current Password (execute the command SET_PASSWORD ) Perform password authentication on the my-dTM move (execute the command ACCESS ) Set Read/Write and/or Write Password Configuration (SPWR and SPRWR bits) Change the current password (execute the command SET_PASSWORD ) Set the Inital Value of the Password Counter (PCN0, PCN1 & PCN2) Do session transaction if desired i.e. process the protected or unprotected data Lock the Configuration Byte (CNF_BL bit) to prevent any further configuration al changes To activate the new Password go back to IDLE/HALT mode ACTIVE To activate new configura tion go back to IDLE/HALT mode ACTIVE How to set the Password and the Password Configuration Figure 15 Data Book How to change a current Password in running session Password and Password Retry Counter configuration 30 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Password 5.3 Anti-tearing Mechanism for Password Retry Counter The Password Retry Counter block is stored in the non-directly accessible part of the memory and for data protection reasons stored redundantly (anti-tearing). This mechanism prevents a stored value of being lost in case of a tearing event. This increases the level of data integrity and is transparent to the customer. During the execution of the Access command the my-d™ move and my-d™ move NFC performs the following actions: • • compares the incoming Password and the Password stored in the my-d™ move and my-d™ move NFC Pass Retry Counter enabled: – resets the Password Retry Counter if the password matches. The my-d™ move and my-d™ move NFC responds with an ACK – increments the Password Retry Counter if the passwords do not match and if the Password Counter has not reached the highest possible value and my-d™ move and my-d™ move NFC responds with a NACK – if the Password Retry Counter has already reached the highest possible value (Initial Password Retry Counter value), then no further increase is done. The my-d™ move and my-d™ move NFC responds with a NACK. Depending on the setting of the access bits the access to the memory above block 0FH is granted: SP-W = 1B: read access only, no write access SP-RW = 1B: no read and no write access Data Book 31 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN 16-bit Value Counter Functionality 6 16-bit Value Counter Functionality The Value Counter is a 16-bit value, which provides a mechanism to store some value (points, money…) on a my-d™ move and my-d™ move NFC chip. Normally it is only possible to decrement this value, however if certain conditions are met it is also possible to reload the counter to an arbitrary 16-bit value. The availability of the Value Counter in the my-d™ move and my-d™ move NFC is configurable by setting the bit 7 of the Configuration Byte. 6.1 Value Counter Format If configured two 4-byte blocks, 22H and 23H, are reserved for the storage of the Value Counter value. The my-d™ move and my-d™ move NFC supports the detection of an interrupted or corrupted (teared) counter programming operation of the Value Counter. For the purpose the concept of redundant saving of the Value Counter as well as temporarily double saving of the Value Counter value during the programming process is implemented. The redundant saving means, that the Value Counter is represented in the dedicated block by a 3-byte value: Counter LSB, inverted Counter LSB and Counter MSB. The fourth byte of the block is not used for the counter and carries 00H data. Counter LSB carries the lower value and Counter MSB carries the higher value of the Value Counter in hexadecimal representation. Value Counter Format Counter LSB __________ Counter LSB Counter MSB 00H 1. Read counter blocks (RD2B command): valid Counter correct counter state FFH FFH FFH FFH 2. Decrement command Debit value 3. my-d™ move (NFC) response: FFH FFH FFH FFH valid Counter (new value) Figure 16 Data Book correct counter state Value Counter - Principle 32 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN 16-bit Value Counter Functionality For an example: the value 1000D = 03E8H -> Value Counter LS Byte = E8H and Value Counter MS Byte = 03H. The Value Counter block looks like: Byte3 .. Byte0 = 000317E8H; where 00H represents the data in byte3. The temporarily double saving means that Value Counter is stored twice in two different memory blocks. Figure 17 shows an example for the Value Counter representation and the decrementing of the value 1000D by 1D. During the programming process of the new Value Counter, one block holds the current valid value and the other block is used to write the new counter value. At the end of programming cycle the current valid value, becomes an invalid value while it is erased (all bytes set to FFH) and the other one holds the new valid value. Value Counter decrement example 1st step Block 22 H Block 23 H valid counter (start value) E8 H 17 H 03 H 00H FFH FFH FFH FFH E8 H 17 H 03 H 00H E7 H 18 H 03 H 00H FFH FFH FFH FFH erase E7H 18 H 03 H 00H valid counter (new value) 2nd step Block 22 H Block 23 H valid counter (start value) valid counter (new value) 3rd step Block 22 H Block 23 H Figure 17 Value Counter decrement example 6.2 Loading and Reading of Value Counter Loading of the Value Counter is done by either: • • • Using WR2B command to address 22H: – [A1H] [22H] [CNT0H, CNT0H, CNT1H, 00H, FFH, FFH, FFH, FFH] [CRC0H, CRC1H] Using two WR1B commands to address 22H and 23H: – [A2H] [22H] [CNT0H,CNT0H,CNT1H, 00H] [CRC0H, CRC1H] – [A2H] [23H] [FFH,FFH,FFH,FFH] [CRC0H, CRC1H] It is also possible to use Compatibility Write command to initialize the counter, but this is not recommended. It is crucial to initialize both Value Counter blocks for the correct counter operation. Reading of Value Counter is done by either: • • • Using RD2Bcommand to addresses 22H: – [31H] [22H] [CRC0H, CRC1H] Using RD4B command to addresses 22H: – [30H] [22H] [CRC0H, CRC1H] Using DCR16 command with parameter 0000H: – [D0H] [0000H] [CRC0H, CRC1H] Data Book 33 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN 16-bit Value Counter Functionality 6.3 Decrementing Value Counter and Anti-Tearing The DCR16 command is used to decrement the Value Counter value. For more details refer to the command description in the Chapter 8.2.8. During the execution of the DCR16 command the my-d™ move and my-d™ move NFC performs following actions: • • • Read both Value Counter blocks; Determine the correct valid Value Counter state. Therefore the values stored in blocks 22H and 23H are compared. – Normally one of the counter value blocks is erased or has an incorrect format and the other block holds the valid counter value. – If both counter values are correctly formatted, the higher value is chosen as the valid counter value. Note that at least one of the counters must be formatted correctly. Otherwise the Value Counter block is corrupted and no further decrement of the Value Counter is possible. – If both blocks carry invalid values (incorrect format) no further decrement of Value Counter is possible. The my-d™ move and my-d™ move NFC then responds with a NACK. Compares the received parameter and the valid counter value. – If the received parameter is equal or lower than the valid counter value the my-d™ move and my-d™ move NFC decrements the valid value by the received parameter, programs this value to the previous invalid value, erases the previous valid value and replies the new written value. – If the received parameter is higher then the valid value no decrement is possible and the my-d™ move and my-d™ move NFC responds with a NACK 6.4 Protection Mechanisms for the Value Counter The my-d™ move and my-d™ move NFC offers some methods to protect the Value Counter. Following measures should be considered to prevent unauthorized changes. • • • • The Password: – If a Write Password is configured i.e. the bit SP-W is set, then the execution of Write commands (WR1B, WR2B or CPTWR) on Value Counter blocks (22H and 23H) is possible only after password verification. – If a Read/Write Password is configured i.e. the bit SP-WR is set, then the execution of Read commands RD2B and RD4B and Decrement command DCR16 on Value Counter (blocks 22H and 23H) is possible only after password verification. The Locking Mechanism for Value Counter: – After the configuration of the Value Counter it is strongly recommended to lock both blocks 22H and 23H in order to prevent the any unauthorized changes. The locking of blocks 22H and 23H is done by changing the locking information of the LOCK4 byte. If the bits 2 and 3 of the Lock4 byte are set then both Value Counter blocks are locked. Writing of the Value Counter block: – If blocks 22H and 23H are locked then no further overwriting of their values with write commands is possible. Note that if one of the blocks is locked and the other one is not, then it is possible to change the data of the unlocked block by using WR1B command. For this reason it is important to lock both blocks in order to prevent unintentional harm to Value Counter (i.e. unintentional overwriting or setting an incorrect value or a value with an incorrect format). Reading and Decrement of the Value Counter block: – If blocks 22H and 23H are locked then reading and decrementing is still possible. Note that depending on the chip configuration, password verification may be required. Data Book 34 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Communication Principle 7 Communication Principle This chapter describes the functionality of the SLE 66R01P and SLE 66R01PN. 7.1 Communication between a card (PICC) and a reader (PCD) It is recommended to read the ISO/IEC 14443-3 Type A and NFC Forum™ Type 2 Tag specifications in conjunction with this document in order to understand the communication protocol as well as the functionality of the SLE 66R01P and SLE 66R01PN as it is based on these specifications. 7.2 State Diagram The SLE 66R01P and SLE 66R01PN is fully compliant to ISO/IEC 14443-3 Type A. All operations on this IC are initiated by an appropriate reader and controlled by the internal logic of the my-d™ move and my-d™ move NFC. Prior to any memory access the card has to be selected according to the ISO/IEC 14443-3 Type A. If the my-d™ move and my-d™ move NFC is configured to be password protected, a password verification is required to access the memory. The following figure presents the state diagram of SLE 66R01P and SLE 66R01PN. If an unexpected command is received, the chip always returns to IDLE or HALT state, depending from which path it came from (the red paths in the state diagram). 7.2.1 IDLE/HALT State After Power On, the SLE 66R01P and SLE 66R01PN is in IDLE state. If REQA or WUPA is executed in this state, the SLE 66R01P and SLE 66R01PN transits to READY1 state. Any other command is interpreted as an error and the chip stays in IDLE state without any response. If the HLTA command is executed in ACTIVE/ACTIVE* State, the SLE 66R01P and SLE 66R01PN will transit to HALT state. The HALT state can be left only if the chip receives a WUPA command. Any other command is interpreted as an error and the SLE 66R01P and SLE 66R01PN stays in the HALT state without any response. 7.2.2 READY1/READY1* State In READY1/READY1* state the first part of the UID can be resolved by using ISO/IEC 14443-3 Type A anticollision and/or Select commands. After the Select command is executed properly the IC transits to READY2/READY2* state in which the second part of the UID can be resolved. The answer to a Select command in READY1/READY1* state is Select Acknowledge (SAK) for cascade level 1, which indicates that the UID is incomplete and the next cascade level has to be started to resolve the whole UID (see also ISO/IEC 14443-3 Type A). However the SLE 66R01P and SLE 66R01PN can directly transit from READY1/ READY1* state to ACTIVE/ACTIVE* state if a read command RD2B or R4BD with a valid address is executed. Note if more than one SLE 66R01P and SLE 66R01PN is in the reader field, all ICs are selected after the execution of the read command, although all of them have different UIDs. Any other command or any other interruption is interpreted as an error and the SLE 66R01P and SLE 66R01PN returns back to IDLE or HALT state without any response, depending from which state it has come from. 7.2.3 READY2/READY2* State In READY2/READY2* state the second part of the UID can be resolved using ISO/IEC 14443-3 Type A anticollision and/or Select commands. After the Select command is executed properly the IC transits to ACTIVE/ACTIVE* state in which memory can be accessed. The answer to a Select command in READY2/READY2* state is SAK for cascade level 2, which indicates that the UID is complete and the selection process is finished. Data Book 35 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Communication Principle However the SLE 66R01P and SLE 66R01PN can directly transit from READY2/READY2* state to ACTIVE/ACTIVE* state if a read command RD2B or RD4B is executed. Any valid block address can be used in the read command. Note if more than one SLE 66R01P and SLE 66R01PN is in the reader field, all ICs are selected after the execution of the read command, although all of them have different UIDs. Any other command or any other interruption is interpreted as an error and the SLE 66R01P and SLE 66R01PN returns back to IDLE or HALT state without any response, depending from which part it has come from. 7.2.4 ACTIVE/ACTIVE* State In the ACTIVE/ACTIVE* state memory access commands can be executed. If a SLE 66R01P and SLE 66R01PN is configured to have read/write or write password protection, a password verification is required to access the protected memory pages. In case of a successful password verification, read/write access to the whole memory is possible. If no verification is done or the password verification fails, the memory area above block 0FH is locked according to the access rights in the Configuration Byte. The ACTIVE/ACTIVE* state is left if the HLTA command is executed properly; the SLE 66R01P and SLE 66R01PN then transits to HALT state and waits until a WUPA command is received. If any error command is received, the SLE 66R01P and SLE 66R01PN sends “No Response” (NR) or “Not Acknowledge” (NACK) and transits to IDLE or HALT state, depending from which state it has come from. 7.2.5 HALT State The HLTA command sets the SLE 66R01P and SLE 66R01PN in the HALT state. The SLE 66R01P and SLE 66R01PN sends no response to the HLTA command. In the HALT state the IC can be activated again by a Wake-UP command (WUPA). Any other data received is interpreted as an error, the SLE 66R01P and SLE 66R01PN sends no response and remains in HALT state. The exact behavior of a particular command in any of the states above is also described in the specific command description. Data Book 36 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Communication Principle 7.3 Start up 120 µs after entering the powering field (after the field reset) the SLE 66R01P and SLE 66R01PN is ready to receive a command. If a command is send earlier, the response to this command is not defined. 7.3.1 Start-up sequence of the SLE 66R01P and SLE 66R01PN Each time after the execution of a REQA or WUPA, the SLE 66R01P and SLE 66R01PN reads the Configuration Byte and sets its internal states accordingly, see also the Figure 18. This information is not updated until the next execution of REQA or WUPA commands in IDLE or HALT state even when the CONFIG byte is changed in the EEPROM. POWER ON Wait for 100µs HALT IDLE WUPA REQA, WUPA Read Configuration Byte (Block 2, Byte 1) READY1/READY1* Proceed with Anticollision and Selection Figure 18 Start-up Sequence 7.4 Frame Delay Time For information about Frame Delay Time (FDT), please refer to ISO/IEC 14443-3 Type A Specification. Generally the FDT is measured between the last rising edge of the pause transmitted by the PCD and the falling edge of the first load modulation within the start bit transmitted by the my-d™ move and my-d™ move NFC. If more then one ISO/IEC 14443-3 Type A compatible chip is in the operating field of the reader all of them must respond in a synchronous way which is needed for the anticollision procedure. For detailed timings see Table 1 of ISO/IEC 14443-3 Type A Specification. Data Book 37 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Communication Principle Note: The response timing of a particular SLE 66R01P and SLE 66R01PN command is given in the specific command description. However, the timing values are rounded and are not on a grid according the ISO/IEC 14443-3 Type A. 7.5 Error Handling The SLE 66R01P and SLE 66R01PN responds to valid frames only. The table below describes the behavior for different error cases. Table 12 Behavior in case of an Error Current States Command or Error Response SLE 66R01P and SLE 66R01PN Next State IDLE/HALT READY1/READY1* READY2/READY2* Invalid Opcode NR1) IDLE/HALT2) Parity, Miller Error, CRC NR IDLE/HALT Command too short or too long NR IDLE/HALT Invalid Address NR IDLE/HALT Other Errors NR IDLE/HALT Invalid Opcode NR IDLE/HALT Parity, Miller Error, CRC NACK1 IDLE/HALT ACTIVE/ACTIVE* Command too short or too long NR IDLE/HALT Invalid Address NACK0 IDLE/HALT Other Errors NACK0 IDLE/HALT 1) RD4B and RD2B commands in READY1/READY1* and READY2/READY2* exceptionally behave as in ACTIVE/ACTIVE* state. 2) The SLE 66R01P and SLE 66R01PN returns to IDLE or HALT state depending on the state where it has come from. Data Book 38 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8 Command Set 8.1 Supported ISO/IEC 14443-3 Type A Command Set The following table describes the ISO/IEC 14443-3 Type A command set which is supported by the SLE 66R01P and SLE 66R01PN. For a detailed command description refer to the ISO/IEC 14443-3 Type A functional specification. Table 13 ISO/IEC 14443-3 Type A Command Set Command Abbreviation Op-Code Description Request A REQA 26H Short Frame Command Type A request to all ISO/IEC 144433 Type A compatible chips in IDLE State Wake Up A WUPA 52H Short Frame Command,Type A Wake Up request to all ISO/IEC 14443-3 Type A compatible chips Anticollision AC 93H NVBH 95H NVBH Cascade level 1 with the Number of Valid Bits Cascade level 2 with the Number of Valid Bits Select SELA 93H 70H, 95H 70H Select the UID of Cascade level 1 Select the UID of Cascade level 2 HaltA HLTA 50H Set a chip to a HALT State Important remark: The parameter field of the HLTA command represents the valid address range which is 00H -25H. 8.2 Memory Access Command Set The command set of the SLE 66R01P and SLE 66R01PN comprises the NFC Forum™ Type 2 Tag commands as well as proprietary commands which are additionally implemented to increase data transaction time and increase the protection of the data stored in the memory. The following table lists the memory access command set of the SLE 66R01P and SLE 66R01PN. Table 14 my-d™ move and my-d™ move NFC memory access command set Command Abbreviation Op-Code Description 1) RD4B 30H This command reads 16 bytes data out of the memory starting from the specified address. A Roll-Back mechanism is implemented: - if block 0FH is reached the read continues from block 00H - if block 25H is reached the read continues from block 00H WR1B A2H If write access is granted, this command programs 4 bytes data to the specified memory address. Compatibility CPTWR Write Command A0H This command sends 16 bytes to the SLE 66R01P and SLE 66R01PN but writes only the first 4 bytes of the incoming data to the specified memory address. Read 2 Blocks3) RD2B 31H This command reads 8 bytes out of the memory, starting from the specified address. A Roll-Back mechanism is implemented: - if block 0FH is addressed, the read continues from block 00H - if block 25H is addressed, the read continues from block 00H Read 4 Blocks Write 1 Block2) Data Book 39 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set Table 14 my-d™ move and my-d™ move NFC memory access command set Command Abbreviation Op-Code Description Write 2 Blocks WR2B A1H If write access is granted, this command writes 8 bytes to the specified address memory. Note that the programming time is 4ms. Set Password SPWD B1H This command sets the 4 byte password to the my-d™ move and my-d™ move NFC. Access4) ACS B2H This command verifies the password of the my-d™ move my-d™ move NFC. Decrement DCR16 D0H This command decrements an existing Value Counter value to a lower value and writes the result to the Value Counter block. 1) NFC Forum™ Type 2 Tag Read Command 2) NFC Forum™ Type 2 Tag Write Command 3) By using RD2B and WR2B commands, total user memory of 128 bytes can be written and re-read within approximately 100 ms (excluding anti-collision and taking into account a short reader turnaround time, less then 100 µs). 4) If the my-d™ move and my-d™ move NFC is configured to use a write or read/write password, the appropriate memory access operations are possible only after password verification. Data Book 40 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.1 Read 4 Blocks (RD4B) RD4B command reads 16 bytes data out of the memory starting from the specified address. The Valid Address Range is 00H to 25H. If any other address is specified the SLE 66R01P and SLE 66R01PN responds with a NACK. A roll back mechanism is implemented: • • if e.g. block 0EH is addressed blocks 0EH, 0FH, 00H and 01H are replied if e.g. block 25H is addressed blocks 25H, 00H, 01H and 02H are replied Table 15 Read 4 Blocks (RD4B) Command Code Parameter Length 4 bytes 30H Data Integrity Mechanism Valid Address Range n.a. 00H - 25H ISO/IEC 14443 Type A Reader Response 2 bytes CRC 16 bytes data (1 parity bit per byte) + 2 bytes CRC or NACK or NR PICC Response Command ‚Read 4 Blocks’ 30H ADR CRC0 CRC1 D0 D1 … D15 CRC0 CRC1 NACK 56µs 358 µs min. 86µs 1550µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 19 Data Book Read 4 Blocks Command 41 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.2 Write 1 Block (WR1B) If the write access is granted the WR1B command is used to program 4 bytes of data to the specified address in the memory. This command should be used to program OTP block and Locking Bytes as well. The Valid Address Range is from 02H to 24H. If any other address is specified the SLE 66R01P and SLE 66R01PN responds with a NACK. Table 16 Write 1 Block (WR1B) Command Length Code Parameter 8 bytes A2H Data Integrity Mechanism Valid Address Range 4 bytes data 02H - 24H Response 2 bytes CRC ACK or (1 parity bit per byte) NACK or NR ISO/IEC 14443 Type A Reader PICC Response Command ‚Write 1 Block’ A2H ADR D0 D1 D2 D3 CRC0 CRC1 ACK NACK min. 86µs 708µs 56µs 4235 µs 56µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 20 Data Book Write 1 Block Command 42 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.3 Compatibility Write Command (CPTWR) If the write access is granted only the four least significant 4 bytes are written to the specified address. The remaining bytes will be ignored by the SLE 66R01P and SLE 66R01PN. It is recommended to set the remaining bytes 04H-0FH to 00H. Table 17 Compatibility Write (CPTWR) Command Length Code Parameter 20 bytes A0H Data Integrity Mechanism Valid Address Range 16 bytes data 02H - 24H Response 2 bytes CRC ACK or (1 parity bit per byte) NACK or NR ISO/IEC 14443 Type A Reader 2nd part of the command Command ‚Compatibility Write’ A0H ADR CRC0 CRC1 D0 D1 ... D15 CRC0 CRC1 PICC Response PICC Response ACK ACK 56µs NACK NACK 358µs min. 86µs min. 86µs 56µs 1550 µs 56µs 4235µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 21 Data Book Compatibility Write Command 43 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.4 Read 2 Blocks (RD2B) RD2B command reads 8 bytes out of the memory, starting from the specified address. The Valid Address Range is from 00H to 25H. If any other address is specified the SLE 66R01P and SLE 66R01PN responds with a NACK. A roll back mechanism is implemented: • • if e.g. block 0FH is addressed blocks 0FH and 00H are replied. if e.g. block 25H is addressed blocks 25H and 00H are replied. Table 18 Read 2 Block (RD2B) Command Code Parameter Length 4 bytes 31H Data Integrity Mechanism Valid Address Range n.a. 00H - 25H ISO/IEC 14443 Type A Reader Response 2 bytes CRC 8 bytes data (1 parity bit per byte) + 2 bytes data CRC or NACK PICC Response Command ‚Read 2 Blocks’ 31H ADR CRC0 CRC1 D0 D1 … D7 CRC0 CRC1 NACK 56µs 358 µs min. 86µs 868 µs Please note : Timing is rounded i .e. it is not exact grid timing Figure 22 Data Book Read 2 Blocks Command 44 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.5 Write 2 Blocks (WR2B) If write access is granted, i.e. if both addressed blocks are writable, the WR2B command is used to program two blocks (8 bytes of data) to the specified address in the memory. The Valid Address Range is 04H-22H. Only even start addresses are allowed. If any other address is specified, the SLE 66R01P and SLE 66R01PN responds with a NACK. The WR2B command has the same programming time (approximately 4ms) for writing 8 bytes as the WR1B command which writes 4 bytes of data to the specified memory. Table 19 Write 2 Block (WR2B) Command Code Parameter Length 12 bytes A1H Data Integrity Mechanism Valid Address Range 8 bytes data 04H - 22H; only even start addresses allowed Response 2 bytes CRC ACK or (1 parity bit per byte) NACK or NR ISO/IEC 14443 Type A Reader PICC Response Command ‚Write 2 Blocks’ A1H ADR D0 D1 ... D7 CRC0 CRC1 ACK NACK min. 86µs 1038 µs 56µs 4235 µs 56µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 23 Data Book Write 2 Blocks Command 45 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.6 Set Password (SPWD) The SPWD command writes a new 4 byte password to the dedicated password memory1). The new written value is transmitted in the response. The SPWD command is always active independently of password configuration. If the SLE 66R01P and SLE 66R01PN is configured for password protection, then the SPWD command can be executed only after a successful password verification. Table 20 Set Password (SPWD) Command Code Parameter Length Data Integrity Mechanism 7 bytes 4 bytes data 2 bytes CRC 4 bytes data + 2 bytes (1 parity bit per byte) CRC or NACK or NR B1H n.a. ISO/IEC 14443 Type A Reader Response PICC Response Command ‚Set Password’ B1H P0 P1 P2 P3 CRC0 CRC1 P0 P1 P2 P3 CRC0 CRC1 NACK min. 86µs 613µs 56µs 4239 µs 528µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 24 Set Password Command Table 21 SPWD - behaviour in error case Error / State Idle/Halt Ready Active Protected Invalid Opcode NR NR NR NR Parity, Miller NR NR NACK1 NACK1 Command Length NR NR NR NR CRC NR NR NACK1 NACK1 The selected chip is protected by password NR NR NACK0 n.a. HV not OK NR NR NR NR 1) For more information about password please read Chapter 5. Data Book 46 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.7 Access (ACS) If the my-d™ move and my-d™ move NFC is configured for password protection1) the ACS command is used to perform a password verification. If the password verification is successful, memory access to blocks above block 0FH is granted according to the access rights given in the Configuration Byte. Additionally, if the password counter is enabled, the number of unsuccessful password verifications is counted. The ACS command is always active independently on the Password and the Password Retry Counter configuration. • • If the Password Retry Counter is not enabled, the my-d™ move responds with ACK or NACK depending on the result of password comparison. If the Password Retry Counter is enabled, then depending on the result of password comparison the my-d™ move and my-d™ move NFC performs the following actions: – If the passwords do not match and the Password Retry Counter holds a lower value than its Initial value, the my-d™ move increments the Password Retry Counter and responds with a NACK. – If the passwords match and the Password Retry Counter holds a lower value then its Initial value, the my-d™ move resets the Password Retry Counter and responds with a ACK. – In any other case the my-d™ move responds with a NACK and limits access to blocks above block 0FH according to access rights stored in the Configuration Byte. Table 22 Access (ACS) Command Code Parameter Length Data Integrity Mechanism 7 bytes 4 bytes data 2 bytes CRC ACK or (1 parity bit per byte) NACK or NR B2H n.a. ISO/IEC 14443 Type A Reader Response PICC Response Command ‚Access’ B2H P0 P1 P2 P3 CRC0 CRC1 min. 86µs 613µs ACK ACK NACK NACK 56µs 56µs 6505 µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 25 Access Command 1) For more information about password please read Chapter 5. Data Book 47 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set The figure below shows the flow diagram of the Access command. ACCESS Command YES Initial Password Couner = 0 Password Couner Limit exceeded NO YES NACK0 NO Passwords match? YES ACK Passwords match? YES NO NO Reset the Password Counter Increment the Password Counter NACK0 ACK NACK0 Figure 26 Flow Diagram of the ACS Command Table 23 ACS - behaviour in error case Error / State Idle/Halt Ready Active Protected Invalid Opcode NR NR NR NR Parity, Miller NR NR NACK1 NACK1 Command Length NR NR NR NR CRC NR NR NACK1 NACK1 Password Counter NR limit exceeded NR NACK0 NACK0 Passwords do not match NR NR NACK0 n.a. HV not OK NR NR NR NR Data Book 48 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.8 Decrement Command (DCR16) The DCR16 command decrements the current Value Counter value by the received parameter and writes the new value to the Value Counter block. If this command is executed properly, the my-d™ move and my-d™ move NFC responds the new written value. Note that the parameter has to be lower or equal to the current Value Counter value. Table 24 Decrement (DCR16) Command Code Parameter Length 5 bytes D0H Data Integrity Mechanism Response • 2 bytes CRC 1 parity bit per byte 2 bytes; n.a. LSByte = CNT0 MSByte = CNT1 • • ISO/IEC 14443 Type A Reader If the parameter is lower or equal to the current Value Counter Value, the response is the new decremented value: 2 bytes data + 2 bytes CRC If the parameter is 0000H the response is the current Value Counter value If the parameter is higher than the current Value Counter value the response is a NACK PICC Response Command ‚Decrement’ D0H CNT0 CNT1 CRC0 CRC1 CNT0 CNT1 CRC0 CRC1 NACK min. 86µs 442 µs 56µs 6505µs 340µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 27 Decrement Command After receiving the correct DCR16 command, the my-d™ move and my-d™ move NFC performs the following actions: • • • • • • checks the format of the current Value Counter by reading blocks 22H and 23H; determines the valid and the invalid Value Counter value; decrements the current valid value by the received parameter; expands the result to the correct Value Counter format; writes the new Value Counter value, in the correct format, to the previously determined invalid block erases the current valid Value Counter value to FFH FFH FFH FFH In case of a successful programming of a Value Counter value, the my-d™ move and my-d™ move NFC sends the new written value of the Value Counter block back. If the programming was unsuccessful (due to insufficient power) “No Response” is replied. Data Book 49 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set In case of any other logical error or if the Value Counter block is corrupted (i.e. both blocks have an incorrect format) a NACK is replied. Table 25 DCR16 - behaviour in error case Error / State Idle/Halt Ready Active Protected Invalid Opcode NR NR NR NR Parity, Miller NR NR NACK1 NACK1 Command Length NR NR NR NR CRC NR NR NACK1 NACK1 VCNTR16 not enabled NR NR NACK0 NACK0 The selected chip is protected by password NR NR NACK0 NACK0 Both counter blocks corrupted NR NR NACK0 NACK0 Current VCNTR16 to low NR NR NR NR HV not OK NR NR NR NR The figure below presents the flow diagram of the Decrement command. DCR16 Command VCNTR16 bit in ConfigByte enabled NO Both VCNTR16 blocks currupted NACK0 YES NACK0 NO YES Incoming Parameter is higer than valid VCNTR16? SPRWR bit in ConfigByte enabled YES NACK0 NO YES NO Decrement the valid VCNTR16 by the parameter value The password has been verified? NO NACK0 • YES • • • Figure 28 Data Book • Read blocks 22H and 23H Check the format of VCNTR16 blocks Determine the valid and invalid VCNTR16 block Erase/Program the invalid VCNTR16 Block with new VCNTR16 value Erase the old valid VCNTR16 Block Return the new written value Decrement Command flow 50 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.2.9 HLTA command The HLTA command is used to set the SLE 66R01P and SLE 66R01PN into the HALT state. The HALT State allows users to separate already identified chips. Contrary to the definition in the ISO/IEC 14443-3 Type A standard, the SLE 66R01P and SLE 66R01PN accept as a parameter the whole address range of 00H to 25H with correct CRC for a proper execution of a HLTA command. Table 26 Halt (HLTA) Command Length Code Parameter 4 bytes 50H Data Valid Address Range n.a. 00H - 25H ISO/IEC 14443 Type A Reader Integrity Mechanism Response 2 bytes CRC 1 parity bit per byte NACK or NR PICC Response Command ‚HLTA’ 50H PARAMETER CRC0 CRC1 Any response within this period will be treated as NACK 358µs 1000µs Please note: Timing is rounded i .e. it is not exact grid timing Figure 29 Data Book HLTA Command 51 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Command Set 8.3 my-d™ move and my-d™ move NFC responses Following sections list valid responses of the SLE 66R01P and SLE 66R01PN 8.3.1 Command responses The Acknowledge (ACK) and Not-Acknowledge (NACK) are command responses of the SLE 66R01P and SLE 66R01PN. Table 27 ACK and NACK as responses Response Code (4 bits) Integrity Mechanism ACK AH n.a. NACK0 0H n.a. NACK1 1H n.a. n.a. n.a. NR 1) 1) Depending on the current state, the SLE 66R01P and SLE 66R01PN does not respond to some errors. The response code is AH for ACK and 0H or 1H for NACK. The ACK and NACK are sent as 4 bit response with no CRC and/or parity. 8.3.2 my-d™ move and my-d™ move NFC identification data During the anti-collision the SLE 66R01P and SLE 66R01PN sends responses to the REQA and SEL commands. Table 28 Summary of SLE 66R01P and SLE 66R01PN identification data Code Data Description ATQA 0044H Answer to Request, response to REQA and WUPA command, hard coded 2 bytes. Indicates a double-size UID. SAK (cascade level 1) 04H Select Acknowledge answer to selection of 1st cascade level. Indicates that the UID is incomplete. SAK (cascade level 2) 00H Select Acknowledge answer to selection of 2nd cascade level. Indicates that the UID is complete. CT Cascade Tag Indicates that UID is not single size UID. Data Book 88H 52 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Operational Characteristics 9 Operational Characteristics The listed characteristics are ensured over the operating range of the integrated circuit. Typical characteristics specify mean values expected over the production spread. If not otherwise specified, typical characteristics apply at Tambient = 25° C and the given supply voltage. 9.1 Electrical Characteristics fCAR = 13.56 MHz sinusoidal waveform, voltages refer to VSS. Table 29 Electrical Characteristics Parameter Symbol Values Unit Min. Typ. Max. Note / Test Condition Chip input capacitance LA-LB CIN 16.15 17 17.85 pF VAB peak = 3.0 V, fCAR = 13.56 MHz, Tambient = 25 °C Chip load resistance LA-LB RIN 3 4.5 6 kΩ VAB peak = 3.0 V, fCAR = 13.56 MHz, Tambient = 25 °C Endurance (erase/write cycles)1) 104 Data retention1) – 5 years EEPROM Erase and Write time tprog 3.8 ESD Protection voltage (LA, LB pins) VESD Ambient temperature Tambient -25 Junction temperature Tjunction -25 ms Combined erase + write; excluding time for command / response transfer between interrogator and chip, Tambient = 25 °C kV JEDEC STD EIA / JESD22 A114-B +70 °C for chip +110 °C for chip 2 1) Values are temperature dependent Data Book 53 / 55 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Operational Characteristics 9.2 Absolute Maximum Ratings Stresses above the maximum values listed here may cause permanent damage to the device. Exposure to absolute maximum rating conditions for extended periods may affect device reliability, including EEPROM data retention and erase/write endurance. Maximum ratings are absolute ratings; exceeding only one of these values may cause irreversible damage to the integrated circuit. This is a stress rating only and functional operation of the device at these or any other conditions above those indicated in the operational sections of this data sheet is not implied. Table 30 Absolute Maximum Ratings Parameter Symbol Values Min. Typ. Unit Max. Input peak voltage between LA-LB VINpeak 6 Vpeak Input current through LA-LB IIN 30 mA Storage temperature Tstorage +125 °C Data Book -40 54 / 55 Note / Test Condition 2011-11-24 w w w . i n f i n e o n . c o m Published by Infineon Technologies AG 55