my- d™ mov e my- d™ mov e N FC S LE 66 R01 P S LE 66 R01 P N Intelligent 1216 bit EEPROM with Contactless Interface compliant to ISO/IEC 14443-3 Type A and support of NFC Forum™ Type 2 Tag Operation Sh o rt P ro d u c t I n fo r m a ti o n 2011-11-24 Ch i p C a rd & S e c u r i ty Edition 2011-11-24 Published by Infineon Technologies AG 81726 Munich, Germany © 2011 Infineon Technologies AG All Rights Reserved. Legal Disclaimer The information given in this document shall in no event be regarded as a guarantee of conditions or characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any information regarding the application of the device, Infineon Technologies hereby disclaims any and all warranties and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual property rights of any third party. Information For further information on technology, delivery terms and conditions and prices, please contact the nearest Infineon Technologies Office (www.infineon.com). Warnings Due to technical requirements, components may contain dangerous substances. For information on the types in question, please contact the nearest Infineon Technologies Office. Infineon Technologies components may be used in life-support devices or systems only with the express written approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure of that life-support device or system or to affect the safety or effectiveness of that device or system. Life support devices or systems are intended to be implanted in the human body or to support and/or maintain and sustain and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may be endangered. my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN my-d™ move / my-d™ move NFC - SLE 66R01P / SLE 66R01PN Short Product Information The information in this document is subject to change without notice. Revision History: Current Version 2011-11-24 Previous Release: Preliminary 2011-11-18 Page Subjects (major changes since last revision) All Editorial changes; removed “Preliminary” status Trademarks of Infineon Technologies AG BlueMoon™, COMNEON™, C166™, CROSSAVE™, CanPAK™, CIPOS™, CoolMOS™, CoolSET™, CORECONTROL™, DAVE™, EasyPIM™, EconoBRIDGE™, EconoDUAL™, EconoPACK™, EconoPIM™, EiceDRIVER™, EUPEC™, FCOS™, HITFET™, HybridPACK™, ISOFACE™, I²RF™, IsoPACK™, MIPAQ™, ModSTACK™, my-d™, NovalithIC™, OmniTune™, OptiMOS™, ORIGA™, PROFET™, PRO-SIL™, PRIMARION™, PrimePACK™, RASIC™, ReverSave™, SatRIC™, SensoNor™, SIEGET™, SINDRION™, SMARTi™, SmartLEWIS™, TEMPFET™, thinQ!™, TriCore™, TRENCHSTOP™, X-GOLD™, XMM™, X-PMU™, XPOSYS™. Other Trademarks Advance Design System™ (ADS) of Agilent Technologies, AMBA™, ARM™, MULTI-ICE™, PRIMECELL™, REALVIEW™, THUMB™ of ARM Limited, UK. AUTOSAR™ is licensed by AUTOSAR development partnership. Bluetooth™ of Bluetooth SIG Inc. CAT-iq™ of DECT Forum. COLOSSUS™, FirstGPS™ of Trimble Navigation Ltd. EMV™ of EMVCo, LLC (Visa Holdings Inc.). EPCOS™ of Epcos AG. FLEXGO™ of Microsoft Corporation. FlexRay™ is licensed by FlexRay Consortium. HYPERTERMINAL™ of Hilgraeve Incorporated. IEC™ of Commission Electrotechnique Internationale. IrDA™ of Infrared Data Association Corporation. ISO™ of INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. MATLAB™ of MathWorks, Inc. MAXIM™ of Maxim Integrated Products, Inc. MICROTEC™, NFC Forum™ is trademark of Near Field Communication Forum, NUCLEUS™ of Mentor Graphics Corporation. Mifare™ of NXP. MIPI™ of MIPI Alliance, Inc. MIPS™ of MIPS Technologies, Inc., USA. muRata™ of MURATA MANUFACTURING CO., MICROWAVE OFFICE™ (MWO) of Applied Wave Research Inc., OmniVision™ of OmniVision Technologies, Inc. Openwave™ Openwave Systems Inc. RED HAT™ Red Hat, Inc. RFMD™ RF Micro Devices, Inc. SIRIUS™ of Sirius Sattelite Radio Inc. SOLARIS™ of Sun Microsystems, Inc. SPANSION™ of Spansion LLC Ltd. Symbian™ of Symbian Software Limited. TAIYO YUDEN™ of Taiyo Yuden Co. TEAKLITE™ of CEVA, Inc. TEKTRONIX™ of Tektronix Inc. TOKO™ of TOKO KABUSHIKI KAISHA TA. UNIX™ of X/Open Company Limited. VERILOG™, PALLADIUM™ of Cadence Design Systems, Inc. VLYNQ™ of Texas Instruments Incorporated. VXWORKS™, WIND RIVER™ of WIND RIVER SYSTEMS, INC. ZETEX™ of Diodes Zetex Limited. Short Product Information 3 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Features Intelligent 1216 bit EEPROM with Contactless Interface compliant to ISO/IEC 14443-3 Type A and support of NFC Forum™ Type 2 Tag Operation Contactless Interface • • • Physical Interface and Anticollision compliant to ISO/IEC 14443-3 Type A – Operation frequency 13.56 MHz – Data rate 106 kbit/s in both direction – Contactless transmission of data and supply energy – Anticollision logic: several cards may be operated in the field simultaneously Unique IDentification number (7-byte double-size UID) according to ISO/IEC 14443-3 Type A Read and Write Distance up to 10 cm and more (influenced by external circuitry i.e. reader and inlay design) 152 byte EEPROM • • • • • • • Organized in 38 blocks of 4 bytes each 128 bytes freely programmable User Memory 24 bytes of Service Area reserved for UID, Configuration, LOCK Bytes, OTP Block and Manufacturer Data Read and Write of 128 bytes of User Memory in less than 100 ms Programming time per block < 4 ms Endurance minimum 10,000 erase/write cycles1) Data Retention minimum 5 years1) Privacy Features • • • • • • 32 bit of One Time Programmable (OTP) memory area Locking mechanism for each block Block Lock mechanism Optional 32 bit Password for Read/Write or Write access Optional Password Retry Counter Optional 16 bit Value Counter Data Protection • • Data Integrity supported by 16 bit CRC, parity bit, command length check Anti-tearing mechanism for OTP, Password Retry Counter and Value Counter NFC Forum™ Operation • • • • Compliant to NFC Forum™ Type 2 Tag Operation Support of Static and Dynamic Memory Structure according to NFC Forum™ Type 2 Tag Operation SLE 66R01PN: pre-configured NFC memory with empty NDEF message (INITIALIZED state, non-reversible) SLE 66R01P: UNINITIALIZED state, may be configured to INITIALIZED state Electrical Characteristics • • • On-Chip capacitance 17 pF + 5% ESD protection minimum 2 kV Ambient Temperature -25°C … +70°C (for the chip) 1) Values are temperature dependent Short Product Information 4 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Ordering and packaging information 1 Ordering and packaging information Table 1 Ordering information Total Memory / User Memory1) Type Package SLE 66R01P C wafer sawn / unsawn SLE 66R01P NB NiAu Bumped (sawn wafer) Ordering code on request SP000911428 152 / 128 bytes SLE 66R01PN C wafer sawn / unsawn SLE 66R01PN NB NiAu Bumped (sawn wafer) on request SP000953914 1) Total memory size includes the service area whereas user memory size is freely programmable for user data. For more ordering information about the form of delivery please contact your local Infineon sales office. 1.1 Pin description LA my-d™ move (NFC) SLE 66R01P(N) LB Figure 1 Pin configuration die Table 2 Pin description and function Symbol Function LA Antenna Connection LB Antenna Connection Short Product Information 5 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN my-d™ Product Family 2 my-d™ Product Family my-d™ products are available both in plain mode with open memory access and in secure mode with memory access controlled by authentication procedures. The my-d™ product family provides users with different memory sizes, features NFC Forum™ Type 2 Tag functionality and incorporates security features to enable considerable flexibility in the application design. Flexible controls within the my-d™ devices start with plain mode operation featuring individual page locking; for more complex applications various settings in secure mode can be set for multi user / multi application configurations. In plain mode access to the memory is supported by both 4-byte block as well as 8-byte page structure. In secure mode a cryptographic algorithm based on a 64-bit key is available. Mutual authentication, message authentication codes (MAC) and customized access conditions protect the memory against unauthorized access. The functional architecture, meaning the memory organization and authentication of my-d™ products is the same for both my-d™ proximity (ISO/IEC 14443) and my-d™ vicinity (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693). This eases the system design and allows simple adaptation between applications. Configurable Value Counters featuring anti-tearing functionality are suitable for value token applications, such as limited use transportation tickets. Architectural interoperability of my-d™ products enables an easy migration from simple to more demanding applications. The my-d™ move family is designed for cost optimized applications and its implemented command set eases the usage in existing applications and infrastructures. In addition, the my-d™ light (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693) is part of the my-d™ family. Its optimized command set and memory expands the range of applications to cost sensitive segments. 2.1 my-d™ move and my-d™ move NFC The my-d™ move and my-d™ move NFC are part of Infineon’s my-d™ product family and are designed to meet the requirements of the increasing NFC market demanding smart memories. They are compliant to ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC Forum™ Type 2 Tag Operation. 128 Bytes of memory can be arranged in static or dynamic memory structures for NFC applications. my-d™ move and my-d™ move NFC products also feature configurable Value Counters which support antitearing protection. Privacy features like a password protection including password retry counter provide basic security to the applications. Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the INITIALIZED state according to the definition of the NFC Forum™ Type 2 Tag life cycle. Due to that the my-d™ move NFC is ready to be used in NFC infrastructures. my-d™ move and my-d™ move NFC products are suited for a broad range of applications like public transport, event ticketing or smart posters. Short Product Information 6 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN my-d™ Product Family 2.2 Application Segments my-d™ products are optimized for personal and object identification. Please find in the following table some dedicated examples Table 3 my-d™ family product overview Product Application my-d™ move - SLE 66R01P Public Transport, Smart Posters, NFC Device Pairing my-d™ move NFC - SLE 66R01PN Public Transport, Smart Posters, NFC Device Pairing, NFC INITIALIZED state my-d™ move lean - SLE 66R01L Public Transport, Smart Posters, NFC Device Pairing my-d™ NFC - SLE 66RxxP Smart Posters and Maps, NFC Device Pairing, Loyalty Schemes, Consumer Good Information, Healthcare Monitoring my-d™ proximity 2 - SLE 66RxxS Access Control, Entertainment, Public Transport, Customer Loyalty Schemes, Micro Payment my-d™ proximity enhanced - SLE 55RxxE Access Control, Gaming, Entertainment, Customer Loyalty Schemes my-d™ light - SRF 55V01P Libraries, Laundry, Factory Automation, Media Management, Event Ticketing, Leisure Park Access my-d™ vicinity plain - SRF 55VxxP Factory Automation, Healthcare, Ticketing, Access Control my-d™ vicinity plain HC - SRF 55VxxP HC Ticketing, Brand Protection, Loyalty Schemes, Ski passes my-d™ vicinity secure - SRF 55VxxS Ticketing, Brand protection, Loyalty Schemes, Access Control Short Product Information 7 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3 Scope of my-d™ move / my-d™ move NFC The SLE 66R01P and SLE 66R01PN are part of the Infineon my-d™ product family and support Infineon’s transport and ticketing strategy and are designed to meet the requirements of NFC applications. They are compliant to ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC Forum™ Type 2 Tag Operation. 3.1 Circuit Description The SLE 66R01P and SLE 66R01PN are made up of an EEPROM memory unit, an analog interface for contactless operation, a data transmission path and a control unit. The following diagram shows the main blocks of the SLE 66R01P and SLE 66R01PN. LA POWER Analog Contactless Interface Memory Unit CLOCK Antenna Power Circuit Rectifier Clock Extractor Voltage Regulator Power on Reset DATA Parallel Serial IO Command LB Anticollision Memory Access Control Unit Figure 2 Block Diagram of the SLE 66R01P and SLE 66R01PN The SLE 66R01P and SLE 66R01PN comprise the following three parts: • • • Analog Contactless Interface – The Analog Contactless Interface contains the voltage rectifier, voltage regulator and system clock to supply the IC with appropriate power. Additionally the data stream is modulated and demodulated. Memory Unit – The Memory Unit consists of 38 blocks of 4 bytes each. Control Unit – The Control Unit decodes and executes all commands. Additionally the control unit is responsible for the correct anticollision flow. Short Product Information 8 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3.2 Memory Principle The total amount of addressable memory is 152 bytes organized in blocks of 4 bytes each. The general structure comprises Service Areas as well as User Areas: • • 24 bytes of service and administration data (located in Service Area 1 and 2) reserved for – 7-byte double-size UID – configuration data – LOCKx bytes – OTP memory – Manufacturing Data 128 bytes of User memory (located in User Area 1 and 2) reserved for – User Data – Value Counter Additionally the Password and Password Retry Counter are available and accessible via dedicated commands. Service Area 1 Unique serial number (UID) User Area 1 Password protectable User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 3 SLE 66R01P and SLE 66R01PN memory principle Short Product Information 9 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3.2.1 Service Area 1 Service Area 1 contains • • • • the 7-byte UID which is programmed at manufacturing of the chip and cannot be changed CONFIG byte to enable the Password (incl. the Password Retry counter) and the Value Counter functionality LOCK0, LOCK1 bytes to enable an irreversible write-protection for the blocks located in User Area 1 32 bits of the One-Time-Programmable (OTP) memory block can irreversibly be programmed from 0B to 1B 3.2.2 User Area 1 48 bytes (12 blocks, 4 bytes each) of memory for user data. 3.2.3 User Area 2 User Area 2 contains • • 80 bytes (20 blocks, 4 bytes each) of user memory for user data. These memory blocks can be used to store user data. This portion of the memory may be protected with a 32 bit password. a 16-bit Value Counter may be activated providing a mechanism to store some value (points, trips, ...) on the my-d™ move and my-d™ move NFC chip. 3.2.4 Service Area 2 Service Area 2 contains • • lock bytes LOCK2 to LOCK5 to enable an irreversible write-protection for the blocks loacted in User Area 2 Manufacturing Data (programmed during manufacturing of the chip) which cannot be changed Short Product Information 10 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3.3 Memory Principle for NFC Forum™ Type 2 Tag The memory organization is configurable according to the NFC Forum™ Type 2 Tag Operation specification. Static or dynamic memory structures are supported. Figure 4 illustrates the principle of the SLE 66R01P and SLE 66R01PN as a NFC Forum™ Type 2 Tag compatible chip. The memory can be accessed with NFC Forum™ Type 2 Tag commands. Service Area 1 Unique serial number (UID) CAPABILITY CONTAINER Data Data User Area 1 Password protectable User Area 2 Data Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 4 SLE 66R01P and SLE 66R01PN NFC Forum™ Type 2 Tag memory structure Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the INITIALIZED state according to the definition of the NFC Forum™ Type 2 Tag life cycle. With this preconfiguration the my-d™ move NFC can be immediately used in NFC infrastructures. For details regarding the NFC initialization of my-d™ move and my-d™ move NFC please refer the the Application Note “How to operate my-d™ move and my-d™ move NFC devices in NFC Forum™ Type 2 Tag infrastructures” and the Data Book available at Chip Card & Security [email protected]. Attention: The pre-configuration of SLE 66R01PN is nonreversible and the my-d™ move NFC cannot be overwritten and used as plain, standard my-d™ move anymore. Short Product Information 11 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC 3.4 System Overview The system consists of a host system, one or more SLE 66R01P / SLE 66R01PN tags or other ISO/IEC 144433 Type A compliant cards and an ISO/IEC 14443-3 Type A compatible contactless reader. Alternatively, since the SLE 66R01P and SLE 66R01PN can be used in NFC Forum™ Type 2 Tag memory structures, a NFC Forum™ device in card reader/writer mode can be used to operate the chip. Host System PCD Micro Controller Analog Circuitry SLE 66R01P(N) my-dTM move (NFC) Energy Identification Terminal ISO/IEC14443 Type A or NFC Forum™ Device Figure 5 Clock PICC Antenna Data SLE 66R01P and SLE 66R01PN Contactless System Overview Short Product Information 12 / 14 2011-11-24 my-d™ move / my-d™ move NFC SLE 66R01P / SLE 66R01PN Scope of my-d™ move / my-d™ move NFC UID Coding 3.5 To identify a SLE 66R01P and SLE 66R01PN chip the manufacturer code and a chip family identifier are coded into the UID as described in the Table 4. The chip family identifier can be used to determine the basic command set for the chip. UID PCD size double PICC ’93' ’95' CT uid0 uid1 uid2 BCC ’05H’ uid3 uid4 uid5 uid6 BCC Chip Family ID Figure 6 SLE 66R01P and SLE 66R01PN double-size UID Table 4 UID Coding UID Field Value Description uid0 05H IC Manufacturer Code according to ISO/IEC 7816-6 uid1 3xH Chip Family Identifier Higher Nibble: 0011B: my-d™ move and my-d™ move NFC Lower Nibble: part of the UID number 3.6 Supported Standards the SLE 66R01P and SLE 66R01PN support the following standards: • • • ISO/IEC 14443 Type A (Parts 1, 2 and 3) tested according to ISO/IEC 10373-6 (PICC Test & Validation) ISO/IEC 14443-3 Type A NFC Forum™ Type 2 Tag Operation 3.7 Command Set The SLE 66R01P and SLE 66R01PN is compliant to the ISO/IEC 14443-3 Type A standard. A set of standard ISO/IEC 14443-3 Type A commands is implemented to operate the chip. Additionally NFC Forum™ Type 2 Tag commands and a my-d™ move and my-d™ move NFC specific command set is implemented. This facilitates the access to the on-chip integrated memory and supports the execution of password and counter functionality. Short Product Information 13 / 14 2011-11-24 w w w . i n f i n e o n . c o m Published by Infineon Technologies AG 14