SL3S1003_1013 UCODE G2iM and G2iM+ Rev. 3.7 — 21 May 2015 201237 Product data sheet COMPANY PUBLIC 1. General description NXP’s UCODE G2iM series transponder ICs offers in addition to the leading-edge read range features such as a Tag Tamper Alarm, Data Transfer, Digital Switch, advanced privacy-protection modes and a 640 bit configurable User Memory. Very high chip sensitivity (17.5 dBm) enables longer read ranges with simple, single-port antenna designs. In fashion and retail the UCODE G2iM series improve read rates and provide for theft deterrence. In the electronic device market, they are ideally suited for device configuration, activation, production control and PCB tagging. In authentication applications, they protect brands and guard against counterfeiting. They can also be used to tag containers, electronic vehicles, airline baggage, and more. In addition to the EPC specifications the UCODE G2iM offers an integrated Product Status Flag (PSF) feature and read protection of the memory content. The UCODE G2iM+ offers on top of the UCODE G2iM features an integrated tag tamper alarm, digital switch, external supply mode, data transfer mode and real read range reduction. A special feature is the conditional, automatic real read range reduction, where the activation condition can be defined by the user, is newly introduced in the UCODE G2iM+. When connected to a power supply, the READ as well as the WRITE range can be boosted to a sensitivity of 27 dBm. The UCODE G2iM+ also allows the segmentation of the 640 bit User Memory in up to three segments (open, protected, private) with different access levels (Access- and User Password). For applications which require a longer EPC number the UCODE G2iM+ offers the possibility of up to 448 bit. 2. Features and benefits 2.1 Key features UHF RFID Gen2 tag chip according EPCglobal v1.2.0 256 bit EPC for UCODE G2iM and up to 448 bit EPC for UCODE G2iM+ Up to 640 bit User Memory which can be segmented in the UCODE G2iM+ Private User Memory area protected by special User Password Memory read protection Integrated Product Status Flag (PSF) Tag tamper alarm Digital switch Data transfer mode SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Real Read Range Reduction (Privacy Mode) Conditional Real Read Range Reduction External supply mode Long read/write ranges due to extremely low power design Reliable operation of multiple tags due to advanced anti-collision Broad international operating frequency: from 840 MHz to 960 MHz Data retention: 20 years Wide specified temperature range: 40 C up to +85 C 2.1.1 Memory 256 bit of EPC memory / up to 448 bit in G2iM+ 96 bit Tag IDentifier (TID) including 48-bit factory locked unique serial number 112 bit User TID memory 32 bit Kill Password to permanently disable the tag 32 bit Access Password to allow a transition into the secured state 32 bit User Password to allow access to the private user memory segment Read protection BlockWrite (32 bit) Write Lock BlockPermalock 2.2 Key benefits 2.2.1 End user benefit Outstanding User Memory size of 640 bit Prevention of unauthorized memory access through different levels of read protection Indication of tag tampering attempt by use of the tag tamper alarm feature Electronic device configuration and / or activation by the use of the digital switch / data transfer mode Theft deterrence supported by the PSF feature (PSF alarm or EPC code) Small label sizes, long read ranges due to high chip sensitivity Product identification through unalterable TID range, including a 48 bit serial number Reliable operation in dense reader and noisy environments through high interference suppression 2.2.2 Antenna design benefits High sensitivity enables small and cost efficient antenna designs Low Q-Value eases broad band antenna design for global usage 2.2.3 Label manufacturer benefit Consistent performance on different materials due to low Q-factor Ease of assembly and high assembly yields through large chip input capacitance and Polyimide spacer Fast first WRITE or BLOCKWRITE of the EPC memory for fast label initialization SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 2 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 2.3 Custom commands PSF Alarm Built-in PSF (Product Status Flag), enables the UHF RFID tag to be used as EAS tag (Electronic Article Surveillance) tag without the need for a back-end data base. Read Protect Protects all memory content from unauthorized reading. ChangeConfig Configures the additional features of the chip like external supply mode, tamper alarm, digital switch, read range reduction, privacy mode activation condition or data transfer. The UCODE G2iM+ is equipped with a number of additional features. Nevertheless, the chip is designed in a way standard EPCglobal READ/WRITE/ACCESS commands can be used to operate the features. No custom commands are needed to take advantage of all the features in case of unlocked EPC memory. 3. Applications 3.1 Markets Fashion (apparel and footwear) Retail Electronics Fast moving consumer goods Asset management Electronic vehicle identification 3.2 Applications Supply chain management Item level tagging Pallet and case tracking Container identification Product authentication PCB tagging Cost efficient, low level seals Wireless firmware download Wireless product activation SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 3 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 4. Ordering information Table 1. Ordering information Type number Package Name IC type Description Version SL3S1003FUD/BG Wafer G2iM bumped G2iM die on sawn 8” 120 mm wafer, 7 mm Polyimide spacer not applicable SL3S1013FUD/BG Wafer G2iM+ bumped G2iM+ die on sawn 8” 120 mm wafer, not applicable 7 mm Polyimide spacer SL3S1013FTB0 XSON6 G2iM+ plastic extremely thin small outline package; SOT886F1 no leads; 6 terminals; body 1 1.45 0.5 mm 5. Marking Table 2. SL3S1003_1013 Product data sheet COMPANY PUBLIC Marking codes Type number Marking code Comment Version SL3S1013FTB0 US UCODE G2iM+ SOT886 All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 4 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 6. Block diagram The SL3S10x3 IC consists of three major blocks: - Analog Interface - Digital Control - EEPROM The analog part provides stable supply voltage and demodulates data received from the reader for being processed by the digital part. Further, the modulation transistor of the analog part transmits data back to the reader. The digital section includes the state machines, processes the protocol and handles communication with the EEPROM, which contains the EPC and the user data. ANALOG RF INTERFACE DIGITAL CONTROL EEPROM VREG PAD VDD RECT ANTICOLLISION DEMOD READ/WRITE CONTROL data in ANTENNA ACCESS CONTROL MOD PAD MEMORY data out EEPROM INTERFACE CONTROL R/W PAD VDD PAD I/O CONTROL OUT RF INTERFACE CONTROL I/O CONTROL SEQUENCER CHARGE PUMP 001aam226 Fig 1. SL3S1003_1013 Product data sheet COMPANY PUBLIC Block diagram of SL3S10x3 IC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 5 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 7. Pinning information SL3S10x3FTB0 OUT RFN RFP 1 6 VDD n.c. 2 5 n.c. RFN 3 4 OUT NXP trademark VDD RFP aaa-001689 Transparent top view 001aan572 Fig 2. Pinning bare die Fig 3. Pin configuration for SOT886 7.1 Pin description Table 3. Symbol Description OUT output pin RFN grounded antenna connector VDD external supply RFP ungrounded antenna connector Table 4. SL3S1003_1013 Product data sheet COMPANY PUBLIC Pin description bare die Pin description SOT886 Pin Symbol Description 1 RFP ungrounded antenna connector 2 n.c. not connected 3 RFN grounded antenna connector 4 OUT output pin 5 n.c. not connected 6 VDD external supply All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 6 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 8. Wafer layout 8.1 Wafer layout (1) (5) (9) OUT RFN Y (4) (6) X (7) VDD RFP (8) (2) (3) not to scale! 001aan642 (1) Die to Die distance (metal sealring - metal sealring) 21,4 m, (X-scribe line width: 15 m) (2) Die to Die distance (metal sealring - metal sealring) 21,4 m, (Y-scribe line width: 15 m) (3) Chip step, x-length: 615 m (4) Chip step, y-length: 475 m (5) Bump to bump distance X (OUT - RFN): 513 m (6) Bump to bump distance Y (RFN - RFP): 333 m (7) Distance bump to metal sealring X: 43,5 m (outer edge - top metal) (8) Distance bump to metal sealring (RFP, VDD) Y: 40,3 m (9) Distance bump to metal sealring (RFN, OUT) Y: 80,3 m Bump size X Y: 60 m ´ 60 m Remark: OUT and VDD are used with G2iM+ only Fig 4. SL3S1003_1013 Product data sheet COMPANY PUBLIC SL3S10x3 wafer layout All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 7 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 9. Mechanical specification The SL3S10x3 wafers are offered with 120 mm thickness and 7mm Polyimide spacer. This robust structure with the enhanced Polyimide spacer supports easy assembly due to low assembly variations. 9.1 Wafer specification See Ref. 20 “Data sheet - Delivery type description – General specification for 8” wafer on UV-tape with electronic fail die marking, BU-ID document number: 1093**”. 9.1.1 Wafer Table 5. Specifications Wafer Designation each wafer is scribed with batch number and wafer number Diameter 200 mm (8”) Thickness 120 m 15 m Number of pads 4 Pad location non diagonal/ placed in chip corners Distance pad to pad RFN-RFP 333.0 m Distance pad to pad OUT-RFN 513.0 m Process CMOS 0.14 mm Batch size 25 wafers Potential good dies per wafer 100544 Wafer backside Material Si Treatment ground and stress release Roughness Ra max. 0.5 m, Rt max. 5 m Chip dimensions Die size including scribe 0.615 mm 0.475 mm = 0.292 mm2 Scribe line width: x-dimension = 15 m y-dimension = 15 m Passivation on front Type Sandwich structure Material PE-Nitride (on top) Thickness 1.75 m total thickness of passivation Polyimide spacer 7 m Au bump Bump material > 99.9% pure Au Bump hardness 35 – 80 HV 0.005 Bump shear strength > 70 MPa Bump height 25 m[1] Bump height uniformity SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 8 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Table 5. Specifications …continued – within a die 2 m – within a wafer 3 m – wafer to wafer 4 m Bump flatness 1.5 m Bump size – RFP, RFN 60 60 m – OUT, VDD 60 60 m Bump size variation 5 m [1] Because of the 7 m spacer, the bump will measure 18 m relative height protruding the spacer. 9.1.2 Fail die identification No inkdots are applied to the wafer. Electronic wafer mapping (SECS II format) covers the electrical test results and additionally the results of mechanical/visual inspection. See Ref. 20 “Data sheet - Delivery type description – General specification for 8” wafer on UV-tape with electronic fail die marking, BU-ID document number: 1093**” 9.1.3 Map file distribution See Ref. 20 “Data sheet - Delivery type description – General specification for 8” wafer on UV-tape with electronic fail die marking, BU-ID document number: 1093**” SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 9 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10. Functional description 10.1 Air interface standards The UCODE G2iM fully supports all parts of the "Specification for RFID Air Interface EPCglobal, EPCTM Radio-Frequency Identity Protocols, Class-1 Generation-2 UHF RFID, Protocol for Communications at 860 MHz to 960 MHz, Version 1.2.0". 10.2 Power transfer The interrogator provides an RF field that powers the tag, equipped with a UCODE G2iM. The antenna transforms the impedance of free space to the chip input impedance in order to get the maximum possible power for the UCODE G2iM on the tag. The UCODE G2iM+ can also be supplied externally. The RF field, which is oscillating on the operating frequency provided by the interrogator, is rectified to provide a smoothed DC voltage to the analog and digital modules of the IC. The antenna attached to the chip may use a DC connection between the two antenna pads which also enables loop antenna design. 10.3 Data transfer 10.3.1 Reader to tag Link An interrogator transmits information to the UCODE G2iM by modulating an UHF RF signal. The UCODE G2iM receives both information and operating energy from this RF signal. Tags are passive, meaning that they receive all of their operating energy from the interrogator's RF waveform. In order to further improve the read range the UCODE G2iM can be externally supplied as well so the energy to operate the chip does not need to be transmitted by the reader. An interrogator is using a fixed modulation and data rate for the duration of at least one inventory round. It communicates to the UCODE G2iM by modulating an RF carrier using DSB-ASK with PIE encoding. For further details refer to Section 17, Ref. 1. Interrogator-to-tag (R=>T) communications. 10.3.2 Tag to reader Link An interrogator receives information from a UCODE G2iM by transmitting an unmodulated RF carrier and listening for a backscattered reply. The UCODE G2iM backscatters by switching the reflection coefficient of its antenna between two states in accordance with the data being sent. For further details refer to Section 17, Ref. 1, chapter 6.3.1.3. The UCODE G2iM communicates information by backscatter-modulating the amplitude and/or phase of the RF carrier. Interrogators shall be capable of demodulating either demodulation type. The encoding format, selected in response to interrogator commands, is either FM0 baseband or Miller-modulated subcarrier. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 10 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10.4 UCODE G2iM and UCODE G2iM+ differences The UCODE G2iM is tailored for application where EPC or TID number space, and User Memory is needed. The UCODE G2iM+ provides beside the segmented memory additional functionality such as tag tamper alarm, external supply operation to further boost read/write range (external supply mode), a privacy mode reducing the read range where the activation criteria (open or short) can be defined or I/O functionality (data transfer to externally connected devices) where required. The following table provides an overview of UCODE G2iM, UCODE G2iM+ special features. Table 6. Overview of UCODE G2iM and UCODE G2iM+ features Features UCODE G2iM UCODE G2iM+ Read protection (bankwise) yes yes PSF (Built-in Product Status Flag) yes yes Backscatter strength reduction yes yes BlockWrite (32 bit) yes yes BlockPermalock yes yes User TID (112 bit) yes yes Segmented user memory (open, protected, private) - yes Additional User Password for private memory - yes EPC size selectable (448bit max.) - yes Tag tamper alarm - yes Digital switch / Digital input - yes External supply mode - yes Data transfer - yes Real read range reduction - yes Conditional Real Read Range Reduction - yes 10.5 Supported commands The UCODE G2iM supports all mandatory EPCglobal V1.2.0 commands. In addition the UCODE G2iM supports the following optional commands: • ACCESS • BlockWrite (32 bit) • BlockPermalock The UCODE G2iM features the following custom commands described more in detail later: • • • • • SL3S1003_1013 Product data sheet COMPANY PUBLIC ResetReadProtect (backward compatible to UCODE G2X; UCODE G2iL) ReadProtect(backward compatible to UCODE G2X; UCODE G2iL) ChangeEAS (backward compatible to UCODE G2X; UCODE G2iL) EAS_Alarm(backward compatible to UCODE G2X; UCODE G2iL) ChangeConfig(backward compatible to UCODE G2iL) All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 11 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10.6 UCODE G2iM and UCODE G2iM+ memory The UCODE G2iM and UCODE G2iM+ memory is implemented according EPCglobal Class1Gen2 and organized in four banks: Table 7. UCODE G2iM and UCODE G2iM+ memory sections Name Size Bank Reserved memory (32 bit ACCESS and 32 bit KILL password) 64 bit 00b EPC (excluding 16 bit CRC-16 and 16 bit PC) (UCODE G2iM) 256 bit 01b EPC (excluding 16 bit CRC-16 and 16 bit PC) (UCODE G2iM+) 128 bit up to 448 bit G2iM Configuration Word (Config-Word) 16 bit 01b G2iM Memory Configuration Word (Mem-Config-Word) 16 bit 01b TID (including permalocked unique 48 bit serial number; 16bit unalterable 96 bit XTID-header) 10b User TID 112 bit 10b User memory (UCODE G2iM) 512 bit 11b User memory can be segmented and configured (UCODE G2iM+) 320 bit up to 640 bit The logical address of all memory banks begin at zero (00h). In addition to the four memory banks two configuration words are available. The first to handle the UCODE G2iM memory configuration (Mem-Config-Word) is available at EPC bank 01 address 1F0h and the second to handle UCODE G2iM specific features Config-Word) is available at EPC bank 01 address 200h. The configuration words are described in detail in Section 10.7.1 “ChangeConfig” and Section 10.7.3 “UCODE G2iM+ memory configuration control mechanism”. Memory pages (16 bit words) pre-programmed to zero will not execute an erase cycle before writing data to it. This approach accelerates initialization of the chip and enables faster programming of the memory. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 12 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10.6.1 UCODE G2iM and UCODE G2iM+ overall memory map Table 8. UCODE G2iM and UCODE G2iM+ overall memory map Bank address Memory address Type Content Initial Bank 00 00h to 1Fh reserved Kill Password all 00h unlocked memory 20h to 3Fh reserved Access Password all 00h unlocked memory 00h to 0Fh EPC CRC-16: refer to Ref. 16 Bank 01 EPC Bank 01 Config Word memory mapped calculated CRC 10h to 14h EPC backscatter length 00110b unlocked memory 15h EPC UMI 0b calculated according EPC 16h EPC reserved for future use 0b hardwired to 0 17h to 1Fh EPC numbering system indicator 00h unlocked memory unlocked memory EPC EPC [1] 1F0h to 1F3h EPC RFU 0000b hardwired to 0000b 1F4h to 1F7h EPC Number of EPC blocks 0h unlocked memory 1F8h to 1FBh EPC Number protected memory blocks 0h unlocked memory 1FCh to 1FFh EPC Number of private memory blocks 0h unlocked memory 200h tamper alarm flag 0b[4] indicator bit indicator bit 20h to 9Fh Bank 01 Memory Config Word Remark EPC 201h EPC external supply flag or input signal 0b[4] 202h EPC RFU 0b[4] locked memory RFU 0b[4] locked memory temporary bit 203h EPC 204h EPC invert digital output: 0b[4] 205h EPC transparent mode on/off 0b[4] temporary bit transparent mode data/raw 0b[4] temporary bit unlocked memory 206h EPC 207h EPC conditional read range reduction 0b[4] 208h EPC conditional read range reduction open/short 0b[4] unlocked memory 209h EPC max. backscatter strength 1b[4] unlocked memory 20Ah EPC digital output 0b[4] unlocked memory read range reduction on/off 0b[4] unlocked memory read protect User Memory 0b[4] locked memory unlocked memory 20Bh 20Ch EPC EPC 20Dh EPC read protect EPC Bank 0b[4] 20Eh EPC read protect TID 0b[4] unlocked memory PSF alarm flag 0b[4] unlocked memory 20Fh SL3S1003_1013 Product data sheet COMPANY PUBLIC EPC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 13 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Table 8. UCODE G2iM and UCODE G2iM+ overall memory map Bank address Memory address Type Content Initial Remark Bank 10 TID 00h to 07h TID allocation class identifier 1110 0010b locked memory 08h to 13h TID tag mask designer identifier 0000 0000 0110b locked memory locked memory Bank 11 USER 14h TIG config word indicator 1b[2] 14h to 1Fh TID tag model number TMNR[3] locked memory 20h to 2Fh TID XTID Header 00h locked memory 30h to 5Fh TID serial number SNR locked memory 60h to CFh TID User TID memory all ’0’ unlocked memory User Memory undefined unlocked memory 000h to 27Fh USER [1] UCODE G2iM: HEX E200 680A 0000 0000 0000 0000 (0000 0000) UCODE G2iM+: HEX E200 680B 0000 0000 0000 0000 (0000 0000) SL3S1003_1013 Product data sheet COMPANY PUBLIC [2] Indicates the existence of a Configuration Word at the end of the EPC number [3] See Figure 5 [4] See also Table 13 for further details. All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 14 of 43 xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx NXP Semiconductors SL3S1003_1013 Product data sheet COMPANY PUBLIC 10.6.2 UCODE G2iM and UCODE G2iM+ TID memory details Table 9. G2iM TID description Model number Type First 32 bit of TID memory Class ID Mask designer ID Config Word indicator Sub version number Version (Silicon) number UCODE G2iM E200680A E2h 006h 1 0000b 0001010 UCODE G2iM+ E200680B E2h 006h 1 0000b 0001011 Addresses 00h CFh TID All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 MS Byte MS Bit LS Byte LS Bit Addresses 00h 07h 08h Class Identifier Bits TID Example (UCODE G2iM) 7 13h 14h Mask-Designer Identifier 0 11 0 E2h (EAN.UCC) 1Fh 20h Model Number 11 006h (NXP) 0 0 3 47 0 112 0 1Fh 0 001aan573 0001010b (UCODE G2iM) G2iM TID memory structure UCODE G2iM and G2iM+ © NXP Semiconductors N.V. 2015. All rights reserved. 15 of 43 SL3S1003_1013 Fig 5. 0 CFh User TID Version Number 0 6 000b Serial Number 0000h 18h 19h Sub Version Number Bits 15 80Ah (UCODE G2iM) Addresses 14h 5Fh 60h 2Fh 30h XTID Header SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10.7 Custom commands The UCODE G2iM and UCODE G2iM+ supports a number of additional features and custom commands. Nevertheless, the chip is designed in a way standard EPCglobal READ/WRITE/ACCESS commands can be used to operate the features. The memory map stated in the previous section describes the Config-Word used to control the additional features located at address 200h as well as the Mem-Config-Word located at 1F0h of the EPC memory. For this reason the standard READ/WRITE commands of an UHF EPCglobal compliant reader can be used to select the flags, activate/deactivate features or define memory segments. The features can only be activated/deactivated (written) using standard EPC WRITE command as long the EPC is not locked. In case the EPC is locked either the bank needs to be unlocked to apply changes or the ChangeConfig custom command is used to change the settings. The UCODE G2iM products supports the complete UCODE G2iL command set for backward compatibility reasons. Bit 14h of the TID indicates the existence of a Configuration Word. This flag will enable selecting Config-Word enhanced transponders in mixed tag populations. 10.7.1 ChangeConfig Although UCODE G2iM is tailored for supply chain management, item level tagging and product authentication the UCODE G2iM+ version enables active interaction with products. Among the password protected features are the capability of download firmware to electronics, activate/deactivate electronics which can also be used as theft deterrence, a dedicated privacy mode by reducing the read range, integrated PSF (Product Status Flag) or Tag Tamper Alarm. In addition to the UCODE G2iL/G2iL+ the activation condition (open/short) for the Read Range Reduction can be defined by the user. The UCODE G2iM ChangeConfig custom command allows handling the special NXP Semiconductors features described in the following paragraph. Please also see the memory map in Section 10.6 “UCODE G2iM and UCODE G2iM+ memory” and “Section 10.7.2 “UCODE G2iM and UCODE G2iM+ special features control mechanism”. If the EPC memory is not write locked the standard EPC READ/WRITE command can be used to change the settings. UCODE G2iM and UCODE G2iM+ special features1 UCODE G2iM and UCODE G2iM+ common special features are: • Bank wise read protection (separate for EPC, TID and User Memory) EPC bank (except of configuration words), the serial number part of the TID as well as the User TID and the User Memory (open segment) can be read protected independently. When protected reading of the particular memory will return '0'. The flags of the Config-Word can be selected using the standard SELECT command. Only read protected parts will then participate an inventory round. 1. The features can only be manipulated (enabled/disabled) with unlocked EPC bank, otherwise the ChangeConfig command can be used. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 16 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ • Integrated PSF (Product Status Flag) The PSF is a general purpose flag that can be used as an EAS (Electronic Article Surveillance) flag, quality checked flag or similar. The UCODE G2iM offers two ways of detecting an activated PSF. In cases extremely fast detection is needed the EAS_Alarm command can be used. The UCODE G2iM will reply a 64 bit alarm code like described in section EAS_Alarm upon sending the command. As a second option the EPC SELECT command selecting the PSF flag of the Config-Word can be used. In the following inventory round only PSF enabled chips will reply their EPC number. • Backscatter strength reduction The UCODE G2iM features two levels of backscatter strengths. Per default maximum backscatter is enabled in order to enable maximum read rates. When clearing the flag the strength can be reduced if needed. UCODE G2iM+ specific special features are:1 • Real Read Range Reduction 4R (UCODE G2iM+ only) Some applications require the reduction of the read range to close proximity for privacy reasons. Setting the 4R flag will significantly reduce the chip sensitivity to +12 dBm. The +12 dBm have to be available at chip start up (slow increase of field strength is not applicable). For additional privacy, the read protection can be activated in the same configuration step. The related flag of the configuration word can be selected using the standard SELECT command so only chips with reduced read range will be part of an inventory. Remark: The attenuation will result in only a few centimeter of read range at 36 dBm EIRP! • Tag Tamper Alarm (UCODE G2iM+ only) The UCODE G2iM+ Tamper Alarm will flag the status of the VDD to OUT pad connection which can be designed as an predetermined breaking point (see Figure 6). RFN RFP OUT VDD 001aan668 Fig 6. Schematic of connecting VDD and OUT pad with a predetermined breaking point to turn a standard RFID label into a wireless safety seal The status of the pad connection (open/closed) can be read in the configuration register and/or selected using the EPC SELECT. This feature enables the design of a wireless RFID safety seal. When breaking the connection by peeling off the label or manipulating a lock an alarm can be triggered. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 17 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ • Conditional Real Read Range Reduction (UCODE G2iM+ only) In addition to the 4R and the Tag Tamper Alarm feature the UCODE G2iM+ offers a feature which combines both in one functionality. This feature allow the automatic activation of the 4R depending on the status of the VDD to OUT pad connection. To offer high flexibility for the applications the 4R activation can be done on short (bit 8 = ’1’) or open (bit 8 =’0’) of the VDD to OUT pad connection. For activation of this feature bit 7 and bit 11 of the Config-Word have to be set to ’1’. • Digital Switch (UCODE G2iM+ only) By connecting a supply voltage between RFN and VDD the OUT pin of the UCODE G2iM+ can be used as digital switch. Depending on the ‘Digital Output’ bit of the Config-Word register the state of the OUT pin can be switched to VDD or GND. The state of the OUT pin is persistent in the memory even after KILL or switching off the supply. In absence of external Vsupply, one cannot detect the difference in Ohmic resistance between OUT and VDD, regardless of whether ‘Digital Output’ bit is 0 or 1. The state of the OUT pin can also be changed temporary by toggling the 'Invert Digital Output' bit. This feature will allow activating/deactivating externally connected peripherals or can be used as theft deterrence of electronics. • Data transfer Mode (UCODE G2iM+ only) In applications where not switching the output like described in "Digital Switch" but external device communication is needed the UCODE G2iM+ Data Transfer Mode can be used by setting the according bit of the Config-Word register. When activated the air interface communication will be directly transferred to the OUT pad of the chip. Two modes of data transfer are available and can be switched using the Transparent Mode DATA/RAW bit. The default Transparent Mode DATA will remove the Frame Sync of the communication and toggle the output with every raising edge in the RF field. This will allow implementing a Manchester type of data transmission. The Transparent Mode RAW will switch the demodulated air interface communication to the OUT pad. • External Supply Indicator - Digital Input (UCODE G2iM+ only) The VDD pad of the UCODE G2iM+ can be used as a digital input pin. The state of the pad is directly associated with the External Supply Indicator bit of the configuration register. A simple return signaling (chip to reader) can be implemented by polling this Configuration Word register flag. RF reset is necessary for proper polling. • External Supply Mode (G2iM+ only) The UCODE G2iM+ can be supplied externally by connecting 1.85 V (Iout = 0 A) supply. When externally supplied less energy from the RF field is needed to operate the chip. This will not just enable further improved sensitivity and read ranges (up to -27 dBm) but also enable a write range that is equal to the read range. The figure schematically shows the supply connected to the UCODE G2iM+. Remark: When permanently externally supplied there will not be a power-on-reset. This will result in the following limitations: • When externally supplied session flag S0 will keep it’s state during RF-OFF phase. • When externally supplied session flag S2, S3, SL will have infinite persistence time and will behave similar to S0. • Session flag S1 will behave regular like in pure passive operation. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 18 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ RFN RFP OUT VDD Vsupply 001aan669 Fig 7. Schematic of external power supply Table 10. ChangeConfig custom command Command RFU Data RN CRC-16 No. of bits 16 8 16 16 16 Description 11100000 00000111 00000000 Toggle bits XOR RN 16 handle - The bits to be toggled in the configuration register need to be set to '1'. E.g. sending 0000 0000 0001 0001 XOR RN16 will activate the 4R and PSF. Sending the very same command a second time will disable the features again. The reply of the ChangeConfig will return the current register setting. Table 11. Header Status bits RN CRC-16 No. of bits 1 16 16 16 Description 0 Config-Word Handle - Table 12. Condition Response Next state ready all - ready arbitrate, reply, acknowledged all - arbitrate open valid handle Status word needs to change Backscatter unchanged Config-Word immediately open valid handle Status word does Backscatter Config-Word not need to change immediately open valid handle Status word needs to change Backscatter modified Config-Word, when done secured valid handle Status word does Backscatter Config-Word not need to change immediately secured all killed killed Product data sheet COMPANY PUBLIC ChangeConfig command-response table Starting state secured SL3S1003_1013 ChangeConfig custom command reply - All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 19 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ The features can only be activated/deactivated using standard EPC WRITE if the EPC bank is unlocked. The permanent and temporary bits of the Configuration Word can be toggled without the need for an Access Password in case the Access Password is set to zero. In case the EPC bank is locked the lock needs to be removed before applying changes or the ChangeConfig command has to be used. 10.7.2 UCODE G2iM and UCODE G2iM+ special features control mechanism Special features of the UCODE G2iM are managed using a configuration word (Config-Word) located at address 200h in the EPC memory bank. The entire Config-Word is selectable (using the standard EPC SELECT command), as well as single bits, and can be read using standard EPC READ command and modified using the standard EPC WRITE or ChangeConfig custom command in case the EPC memory is locked for writing. ChangeConfig can be executed from the OPEN and SECURED state. The chip will take all “Toggle Bits” for ’0’ if the chip is in the OPEN state or the ACCESS password is zero; therefore it will not alter any status bits, but report the current status only. The command will be ignored with an invalid CRC-16 or an invalid handle. The chip will then remain in the current state. The CRC-16 is calculated from the first command-code bit to the last handle bit. A ChangeConfig command without frame-sync and proceeding Req_RN will be ignored. The command will also be ignored if any of the RFU bits are toggled. In order to change the configuration, to activate/deactivate a feature a ’1’ has to be written to the corresponding register flag to toggle the status. E.g. sending 0x0002 to the register will activate the read protection of the TID. Sending the same command a second time will again clear the read protection of the TID. Invalid toggling on indicator or RFU bits are ignored. Executing the command with zero as payload or in the OPEN state will return the current register settings. The chip will reply to a successful ChangeStatus with an extended preamble regardless of the TRext value of the Query command. After sending a ChangeConfig an interrogator shall transmit CW for less than TReply or 20ms, where TReply is the time between the interrogator's ChangeConfig command and the chip’s backscattered reply. An interrogator may observe three possible responses after sending a ChangeConfig, depending on the success or failure of the operation • ChangeConfig succeeded: The chip will backscatter the reply shown above comprising a header (a 0-bit), the current Config-Word setting, the handle, and a CRC-16 calculated over the 0-bit, the Config-Word and the handle. If the interrogator observes this reply within 20 ms then the ChangeConfig completed successfully. • The chip encounters an error: The chip will backscatter an error code during the CW period rather than the reply shown below (see EPCglobal Spec for error-code definitions and for the reply format). • ChangeConfig does not succeed: If the interrogator does not observe a reply within 20 ms then the ChangeConfig did not complete successfully. The interrogator may issue a Req_RN command (containing the handle) to verify that the chip is still in the interrogator's field, and may reissue the ChangeConfig command. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 20 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ The UCODE G2iM configuration word (Config-Word) is located at address 200h of the EPC memory and is structured as following: Table 13. Address 200h to 207h Indicator bits Temporary bits Permanent bits Tamper indicator External supply indicator RFU RFU Invert Output Transparent mode on/off Data mode data/raw Conditional Read Range Reduction on/off 0 1 2 3 4 5 6 7 Table 14. Address 208h to 20Fh Permanent bits Conditional Read Range Reduction open/short max. backscatter strength Digital output Read Protect UM Range Reduction Protect EPC Protect TID PSF Alarm bit 8 9 10 11 13 14 15 12 The configuration word contains three different type of bits: • Indicator bits cannot be changed by command: Tag Tamper Alarm Indicator External Supply Indicator (digital input) • Temporary bits are reset at power up: Invert Output Transparent Mode on/off Data Mode data/raw • Permanent bits: permanently stored bits in the memory Conditional Read Range Reduction on/off Conditional Read Range Reduction short/open Max. Backscatter Strength Digital Output Read Range Reduction Read Protect User Memory Read Protect EPC Read Protect TID PSF Alarm SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 21 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10.7.3 UCODE G2iM+ memory configuration control mechanism The segmented user memory available in the UCODE G2iM+ enables a flexible configuration of the device with respect to EPC size and access rights to the User Memory. The standard configuration offers 256 bit EPC memory and 512 bit open User Memory for UCODE G2iM and 128 bit EPC memory and 640 bit open User Memory for UCODE G2iM+. For applications where more EPC memory is required the UCODE G2iM+ offers the flexibility to extend the 128 bit EPC up to 448 bit (in steps of 64 bit) by reducing the User Memory size accordingly. See Table 15 and Table 17. Table 15. EPC / User Memory Standard Configuration (UCODE G2iM) EPC Memory User Memory Open 256 bit Table 16. 512 bit EPC / User Memory Standard Configuration (UCODE G2iM+) EPC Memory User Memory Open 128 bit Table 17. 640 bit EPC / User Memory Max. EPC Configuration (UCODE G2iM+) EPC Memory User Memory Open 448 bit 320 bit Beside the possibility to extend the EPC memory the UCDOE G2iM+ offers the possibility to segment the User Memory in up to three areas with different access rights. • Open: no read/write protection • Protected: read/write protected by the Access Password • Private: read/write protected by the User Password (see Section 10.7.4) SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 22 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ The memory configuration can be defined one time, by programming the memory configuration word, at the initialization of the UCODE G2iM+. The UCODE G2iM+ Memory Configuration Word (Mem-Config-Word) is located at address 1F0h of the EPC memory and is structured as following: Table 18. Memory Configuration Word, Address 1F0h to 1FFh RFU 0 Number of EPC blocks 1 2 3 4 5 6 7 Number of Protected memory blocks Number of Private memory blocks 8 12 9 10 11 13 14 15 • RFU-Bits: The four RFU bits are fixed to 0000b. These four bits are ignored for access commands (e.g. WRITE). • Number of EPC blocks: The 4 bit of this region specify the number of blocks (max. 5) which should be added on top of the standard EPC Memory of 128bit. • Number of Protected memory blocks: The 4 bit of this region specify the number of blocks which should be used for the Protected memory region. • Number of Private memory blocks: The 4 bit of this region specify the number of blocks which should be used for the Private memory region. The total amount of User Memory is defined by the number of blocks for EPC-, Open-, Protected- and Private- memory area. Based on the total User Memory size (640 bit) and the defined block size of 64 bit, the overall number of blocks results in ten blocks. As described in the examples (Table 19 to Table 21) below the blocks used for the EPC-, Open-, Protected- or Private segment can be exchanged according to the application requirements as long as the overall block number is below ten. The number of blocks allocated to the Open Memory Area are defined by the number of blocks specified in the Mem-Config-Word, therefore the size of the Open Memory area is derived by subtracting the number of defined blocks (Mem-Config-Word) from the total available number of blocks of the User Memory (10 blocks). Undefined blocks are always added to the Open Memory area. In case an invalid total amount of blocks (exceeds ten) is written to the Mem-Config-Word, the configuration fails and the error code (Locked Memory) will be returned. The entire Mem-Config-Word is selectable (using the standard EPC SELECT command), as well as single bits, and can be read using standard EPC READ command and modified using the standard EPC WRITE command. NOTE: THE MEM-CONFIG-WORD IS ONE TIME PROGRAMMABLE. Programming has be performed in the secured state. In case no programming of the memory configuration word is done at the initialization of the UCODE G2iM+ it will be automatically locked upon a lock of any part of the memory. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 23 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ The following tables will provide a few examples for different memory configurations. • Standard EPC size, 4 blocks Protected and 3 blocks Private memory which results in 3 blocks Open memory. (Mem-Config-Word value: 0043h) See Table 19 Table 19. User Memory Configuration with 3 segments EPC Memory User Memory 128 bit Open Protected Private 192 bit 256 bit 192 bit • Standard EPC size, 3 blocks Protected memory which results in 7 blocks Open memory. (Mem-Config-Word value: 0030h). See Table 20 Table 20. User Memory Configuration with 2 segments (no Private segment) EPC Memory User Memory 128 bit Open Protected 448 bit 192 bit • 192 bit EPC (1 block EPC added), 6 blocks Private memory which results in 4 blocks Open memory. (Mem-Config-Word value: 0106h) See Table 21 Table 21. User Memory Configuration with 2 areas (no Access password protected area) EPC Memory User Memory 192 bit Open Private 192 bit 384 bit 10.7.4 Private Memory Segment The Private memory is a part of the User Memory which can be accessed out of the secured state only. Private regions will appear as non existent to not authorized users. The address of the location of the User Password is not fixed and has therefore to be calculated based on the applied memory configuration. The 32 bit User Password is located at the end of the User Memory. Since the UCODE G2iM+ memory is configurable and can be segmented the address location of the User Password depends on the Memory configuration done at the initialization. User Password address calculation: HEX[(Total number of memory blocks - blocks appointed to EPC)*Blocksize)] Example: EPC length: 192 This means that 1 block from the User Memory is required (128 bit + 64 bit) HEX[(101)*64]=HEX[9*64]=HEX[384]=240h Therefore the User Password for this configuration is located at address 240h to 25Fh SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 24 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10.7.5 ReadProtect2 The UCODE G2iM ReadProtect custom command enables reliable read protection of the entire UCODE G2iM memory. Executing ReadProtect from the Secured state will set the ProtectEPC and ProtectTID bits of the Configuration Word to '1'. With the ReadProtect-Bit set the UCODE G2iM will continue to work unaffected but veil its protected content. The read protection can be removed by executing Reset ReadProtect. The ReadProtect-Bits will than be cleared. Devices whose access password is zero will ignore the command. A frame-sync must be pre-pended the command. After sending the ReadProtect command an interrogator shall transmit CW for the lesser of TReply or 20 ms, where TReply is the time between the interrogator's ReadProtect command and the backscattered reply. An interrogator may observe three possible responses after sending a ReadProtect, depending on the success or failure of the operation: • ReadProtect succeeds: After completing the ReadProtect the UCODE G2iM shall backscatter the reply shown in Table 23 comprising a header (a 0-bit), the tag's handle, and a CRC-16 calculated over the 0-bit and handle. Immediately after this reply the UCODE G2iM will render itself to this ReadProtect mode. If the interrogator observes this reply within 20 ms then the ReadProtect completed successfully. • The UCODE G2iM encounters an error: The UCODE G2iM will backscatter an error code during the CW period rather than the reply shown in the EPCglobal Spec (see Annex I for error-code definitions and for the reply format). • ReadProtect does not succeed: If the interrogator does not observe a reply within 20 ms then the ReadProtect did not complete successfully. The interrogator may issue a Req_RN command (containing the handle) to verify that the UCODE G2iM is still in the interrogation zone, and may re-initiate the ReadProtect command. The UCODE G2iM reply to the ReadProtect command will use the extended preamble shown in EPCglobal Spec (Figure 6.11 or Figure 6.15), as appropriate (i.e. a Tag shall reply as if TRext=1) regardless of the TRext value in the Query that initiated the round. Table 22. Command RN CRC-16 # of bits 16 16 16 description 11100000 00000001 handle - Table 23. 2. ReadProtect command UCODE G2iM reply to a successful ReadProtect procedure Header RN CRC-16 # of bits 1 16 16 description 0 handle - Note: The ChangeConfig command can be used instead of “ReadProtect”, “ResetReadProtect”, “ChangeEAS”. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 25 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Table 24. ReadProtect command-response table Starting State Condition Response Next State ready all – ready arbitrate, reply, acknowledged all – arbitrate open all - open secured valid handle & invalid access password – arbitrate valid handle & valid non zero access password Backscatter handle, when done secured killed invalid handle – secured all – killed 10.7.6 Reset ReadProtect2 Reset ReadProtect allows an interrogator to clear the ProtectEPC and ProtectTID bits of the Configuration Word. This will re-enable reading of the related UCODE G2iM memory content. For details on the command response please refer to Table 25 “Reset ReadProtect command”. After sending a Reset ReadProtect an interrogator shall transmit CW for the lesser of TReply or 20 ms, where TReply is the time between the interrogator's Reset ReadProtect command and the UCODE G2iM backscattered reply. A Req_RN command prior to the Reset ReadProtect is necessary to successfully execute the command. A frame-sync must be pre-pended the command. An interrogator may observe three possible responses after sending a Reset ReadProtect, depending on the success or failure of the operation: • Reset ReadProtect succeeds: After completing the Reset ReadProtect a UCODE G2iM will backscatter the reply shown in Table 26 comprising a header (a 0-bit), the handle, and a CRC-16 calculated over the 0-bit and handle. If the interrogator observes this reply within 20 ms then the Reset ReadProtect completed successfully. • The UCODE G2iM encounters an error: The UCODE G2iM will backscatter an error code during the CW period rather than the reply shown in Table 26 (see EPCglobal Spec for error-code definitions and for the reply format). • Reset ReadProtect does not succeed: If the interrogator does not observe a reply within 20 ms then the Reset ReadProtect did not complete successfully. The interrogator may issue a Req_RN command (containing the handle) to verify that the G2iM is still in the interrogation zone, and may reissue the Reset ReadProtect command. The UCODE G2iM reply to the Reset ReadProtect command will use the extended preamble shown in EPCglobal Spec (Figure 6.11 or Figure 6.15), as appropriate (i.e. a UCODE G2iM will reply as if TRext=1 regardless of the TRext value in the Query that initiated the round. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 26 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ The Reset ReadProtect command is structured as following: • 16 bit command • Password: 32 bit Access-Password XOR with 2 times current RN16 Remark: To generate the 32 bit password the 16 bit RN16 is duplicated and used two times to generate the 32 bit (e.g. a RN16 of 1234 will result in 1234 1234). • 16 bit handle • CRC-16 calculate over the first command-code bit to the last handle bit Table 25. Command Password RN # of bits 16 32 16 16 description 11100000 00000010 (access password) 2*RN16 handle - Table 26. UCODE G2iM reply to a successful Reset ReadProtect command RN CRC-16 # of bits 1 16 16 description 0 handle - Reset ReadProtect command-response table Starting State Condition Response Next State ready all – ready arbitrate, reply, acknowledged all – arbitrate open valid handle & valid access password Backscatter handle, when done open valid handle & invalid access password – arbitrate invalid handle – open valid handle & valid access password Backscatter handle, when done secured valid handle & invalid access password – arbitrate invalid handle – secured all – killed secured killed Product data sheet COMPANY PUBLIC CRC-16 Header Table 27. SL3S1003_1013 Reset ReadProtect command All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 27 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 10.7.7 ChangeEAS2 UCODE G2iM equipped RFID tags will also feature a stand-alone operating EAS alarm mechanism for fast and offline electronic article surveillance. The PSF bit of the Config-Word directly relates to the EAS Alarm feature. With an PSF bit set to '1' the tag will reply to an EAS_Alarm command by backscattering a 64 bit alarm code without the need of a Select or Query. The EAS is a built-in solution so no connection to a backend database is required. In case the EAS_Alarm command is not implemented in the reader a standard EPC SELCET to the Config-Word and Query can be used. When using standard SELECT/QUERY the EPC will be returned during inventory. ChangeEAS can be executed from the Secured state only. The command will be ignored if the Access Password is zero, the command will also be ignored with an invalid CRC-16 or an invalid handle, the UCODE G2iM will than remain in the current state. The CRC-16 is calculated from the first command-code bit to the last handle bit. A frame-sync must be pre-pended the command. The UCODE G2iM reply to a successful ChangeEAS will use the extended preamble, as appropriate (i.e. a Tag shall reply as if TRext=1) regardless of the TRext value in the Query that initiated the round. After sending a ChangeEAS an interrogator shall transmit CW for less than TReply or 20 ms, where TReply is the time between the interrogator's ChangeEAS command and the UCODE G2iM backscattered reply. An interrogator may observe three possible responses after sending a ChangeEAS, depending on the success or failure of the operation • ChangeEAS succeeds: After completing the ChangeEAS a UCODE G2iM will backscatter the reply shown in Table 29 comprising a header (a 0-bit), the handle, and a CRC-16 calculated over the 0-bit and handle. If the interrogator observes this reply within 20 ms then the ChangeEAS completed successfully. • The UCODE G2iM encounters an error: The UCODE G2iM will backscatter an error code during the CW period rather than the reply shown in Table 29 (see EPCglobal Spec for error-code definitions and for the reply format). • ChangeEAS does not succeed: If the interrogator does not observe a reply within 20 ms then the ChangeEAS did not complete successfully. The interrogator may issue a Req_RN command (containing the handle) to verify that the G2iM is still in the interrogator's field, and may reissue the ChangeEAS command. Upon receiving a valid ChangeEAS command a G2iM will perform the commanded set/reset operation of the PSF bit of the Configuration Word. If PSF bit is set, the EAS_Alarm command will be available after the next power up and reply the 64 bit EAS code upon execution. Otherwise the EAS_Alarm command will be ignored. Table 28. SL3S1003_1013 Product data sheet COMPANY PUBLIC ChangeEAS command Command ChangeEas RN CRC-16 # of bits 16 1 16 16 description 11100000 00000011 1 ... set PSF bit 0 ... reset PSF bit handle All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 28 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Table 29. UCODE G2iM reply to a successful ChangeEAS command Header RN CRC-16 # of bits 1 16 16 description 0 handle - Table 30. ChangeEAS command-response table Starting State Condition Response Next state ready all – ready arbitrate, reply, acknowledged all – arbitrate open all – open secured valid handle backscatter handle, when done secured invalid handle – secured all – killed killed 10.7.8 EAS_Alarm Upon receiving an EAS_Alarm custom command the UCODE G2iM will immediately backscatter an EAS-Alarmcode in case the PSF bit of the Config-Word is set. The alarm code is returned without any delay caused by Select, Query and without the need for a backend database. The EAS feature of the UCODE G2iM is available after enabling it by sending a ChangeEAS command described in Section 10.7.7 “ChangeEAS2” or after setting the PSF bit of the Config-Word to ’1’. With the EAS-Alarm enabled the UCODE G2iM will reply to an EAS_Alarm command by backscattering a fixed 64 bit alarm code. A UCODE G2iM will reply to an EAS_Alarm command from the ready state only. As an alternative to the fast EAS_Alarm command a standard SELECT (upon the Config-Word) and QUERY can be used. If the PSF bit is reset to '0' by sending a ChangeEAS command in the password protected Secure state or clearing the PSF bit the UCODE G2iM will not reply to an EAS_Alarm command. The EAS_Alarm command is structured as following: • 16 bit command • 16 bit inverted command • DR (TRcal divide ratio) sets the T=>R link frequency as described in EPCglobal Spec. 6.3.1.2.8 and Table 6.9. • M (cycles per symbol) sets the T=>R data rate and modulation format as shown in EPCglobal Spec. Table 6.10. • TRext chooses whether the T=>R preamble is pre-pended with a pilot tone as described in EPCglobal Spec. 6.3.1.3. A preamble must be pre-pended the EAS_Alarm command according EPCglobal Spec, 6.3.1.2.8. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 29 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Upon receiving an EAS_Alarm command the tag loads the CRC5 register with 01001b and backscatters the 64 bit alarm code accordingly. The reader is now able to calculate the CRC5 over the backscattered 64 bits received to verify the received code. Table 31. EAS_Alarm command Command Inv_Command DR M TRext CRC-16 # of bits 16 16 1 2 1 16 description 11100000 00000100 00011111 0: DR=8 00: M=1 1: DR=64/3 01: M=2 0: no pilot tone - 11111011 1: use pilot tone 10: M=4 11: M=8 Table 32. Header EAS Code # of bits 1 64 description 0 CRC5 (MSB) Table 33. SL3S1003_1013 Product data sheet COMPANY PUBLIC UCODE G2iM reply to a successful EAS_Alarm command EAS_Alarm command-response table Starting State Condition Response Next state ready PSF bit is set backscatter alarm code ready PSF bit is cleard -- arbitrate, reply, acknowledged all – arbitrate open all – open secured all – secured killed all – killed All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 30 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 11. Limiting values Table 34. Limiting values[1][2] In accordance with the Absolute Maximum Rating System (IEC 60134). Voltages are referenced to RFN Symbol Parameter Conditions Min Max Unit 55 +125 C 40 +85 C - ±2 kV Bare die limitations Tstg storage temperature Tamb ambient temperature VESD electrostatic discharge voltage Human body model [3] Pad limitations SL3S1003_1013 Product data sheet COMPANY PUBLIC Vi input voltage absolute limits, VDD-OUT pad 0.5 +2.5 V Io output current absolute limits input/output current, VDD-OUT pad 0.5 +0.5 mA Pi input power maximum power dissipation, RFP pad - 100 mW [1] Stresses above those listed under Absolute Maximum Ratings may cause permanent damage to the device. This is a stress rating only and functional operation of the device at these or any conditions other than those described in the Operating Conditions and Electrical Characteristics section of this specification is not implied. [2] This product includes circuitry specifically designed for the protection of its internal devices from the damaging effects of excessive static charge. Nonetheless, it is suggested that conventional precautions be taken to avoid applying greater than the rated maxima. [3] For ESD measurement, the die chip has been mounted into a CDIP20 package. All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 31 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 12. Characteristics 12.1 UCODE G2iM and UCODE G2iM+ bare die characteristics Table 35. UCODE G2iM and UCODE G2iM+ RF interface characteristics (RFN, RFP) Symbol Parameter fi input frequency Conditions Min Typ Max Unit 840 - 960 MHz - 17.5 - dBm - 30 20 - % Normal mode - no external supply, read range reduction OFF [1][2][7] Pi(min) minimum input power READ sensitivity Pi(min) minimum input power WRITE, BLOCKWRITE sensitivity, (write range/read range ratio) Ci input capacitance parallel [3] - 0.77 - pF - - Q quality factor 915 MHz [3] - 9.2 Z impedance 866 MHz [3] - 27 j234 - 915 MHz [3] - 24 j222 - 953MHz [3] - 23 j213 - Ext. supplied READ [1][2] - 27 - dBm Ext. supplied WRITE [2] - 27 - dBm externally supplied, 915 MHz [3] - 8 -j228 - 4R on READ [1][2][4] - +10 - dBm 4R on WRITE [2][4] - +10 - dBm 4R on, 915 MHz [3] - 16 j1 - modulation resistance, max. backscatter = off [5] - 170 - modulation resistance, max. backscatter = on [6] - 55 - External supply mode - VDD pad supplied, read range reduction OFF Pi(min) Z minimum input power impedance Read range reduction ON - no external supply Pi(min) Z minimum input power impedance Modulation resistance R resistance [1] Power to process a Query command. [2] Measured with a 50 source impedance. [3] At minimum operating power. [4] It has to be assured the reader (system) is capable of providing enough field strength to give +10 dBm at the chip otherwise communication with the chip will not be possible. [5] Enables tag designs to be within ETSI limits for return link data rates of e.g. 320 kHz/M4. [6] Will result in up to 10 dB higher tag backscatter power at high field strength. [7] Results in approx. 18 dBm tag sensitivity on a 2 dBi gain antenna. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 32 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Table 36. VDD pin characteristics Symbol Parameter Conditions Minimum supply voltage/current - without assisted EEPROM WRITE Min Typ Max Unit [1][3][4] VDD supply voltage minimum voltage - - 1.8 V IDD supply current minimum current, Iout = 0 A - - 14 A - - 120 A minimum voltage, Iout = 0 A - 1.8 1.85 V Iout = 100 A - - 1.95 V minimum current, Iout = 0 A - - 135 A - - 265 A Iout = 100 A Minimum supply voltage/current - assisted EEPROM READ and WRITE VDD supply voltage supply current IDD [2][3][4] Iout = 100 A [3][5] Maximum supply voltage/current VDD supply voltage absolute maximum voltage 2.2 - - V Ii(max) maximum input current absolute maximum current 280 - - A [1] Activates Digital Output (OUT pin), increases read range (external supplied). [2] Activates Digital Output (OUT pin), increases read and write range (external supplied). [3] Operating the chip outside the specified voltage range may lead to undefined behavior. [4] Either the voltage or the current needs to be above given values to guarantee specified functionality. [5] No proper operation is guaranteed if both, voltage and current, limits are exceeded. Table 37. G2iM, G2iM+ VDD and OUT pin characteristics Symbol Parameter Conditions Min Typ Max Unit OUT pin characteristics VOL Low-level output voltage Isink = 1mA - - 100 mV VOH HIGH-level output voltage VDD = 1.8 V; Isource = 100A 1.5 - - V VDD/OUT pin characteristics load capacitance CL output voltage Vo VDD - OUT pin max. [1] - - 5 pF maximum RF peak voltage on VDD-OUT pins [2] - - 500 mV [3] VDD/OUT pin tamper alarm characteristics RL(max) RL(min) maximum load resistance minimum load resistance resistance range high [4] - - <2 M resistance range low [5] >20 - - M [1] Is the sum of the allowed capacitance of the VDD and OUT pin referenced to RFN. [2] Is the maximum allowed RF input voltage coupling to the VDD/OUT pin to guarantee undisturbed chip functionality. [3] Resistance between VDD and OUT pin in checked during power up only. [4] Resistance range to achieve tamper alarm flag = 1. [5] Resistance range to achieve tamper alarm flag = 0: SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 33 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Table 38. Symbol UCODE G2iM and UCODE G2iM+ memory characteristics Parameter Conditions Min Typ Max Unit 20 - - year 1000 10000[1] - cycle Typ Max Unit EEPROM characteristics tret retention time Nendu(W) write endurance [1] Tamb 55 C Tamb 25 C 12.2 UCODE G2iM+ SOT886 characteristics Table 39. G2iM+ RF interface characteristics (RFN, RFP) Symbol Parameter Conditions Min Normal mode - no external supply, read range reduction OFF Pi(min) minimum input power READ sensitivity [1][2] - 17.6 - dBm Z impedance 915 MHz [3] - 21.2 -j199.7 - - Normal mode - externally supply VDD = 1.8V, read range reduction OFF Z impedance 915 MHz [1] Power to process a Query command. [2] Measured with a 50 source impedance. [3] At minimum operating power. [3] - 6.9 -j205.5 Remark: For DC and memory characteristics refer to Table 36, Table 37 and Table 38. SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 34 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 13. Package outline SOT886 XSON6: plastic extremely thin small outline package; no leads; 6 terminals; body 1 x 1.45 x 0.5 mm b 1 2 3 4x (2) L L1 e 6 5 e1 4 e1 6x A (2) A1 D E terminal 1 index area 0 1 2 mm scale Dimensions (mm are the original dimensions) Unit max nom min mm A(1) 0.5 A1 b D E 0.04 0.25 1.50 1.05 0.20 1.45 1.00 0.17 1.40 0.95 e 0.6 e1 0.5 L L1 0.35 0.40 0.30 0.35 0.27 0.32 Notes 1. Including plating thickness. 2. Can be visible in some manufacturing processes. Outline version IEC SOT886 Fig 8. sot886_po References JEDEC JEITA European projection Issue date 04-07-22 12-01-05 MO-252 Package outline SOT886 SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 35 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 14. Handling information 14.1 Assembly conditions 14.1.1 General assembly recommendations While pads OUT and VDD are not used for UCODE G2iM (SL3S1003), they are still electrically active and therefore must not be connected to the antenna and the RFN and RFP pads. In case of any doubts, the customer is constrained to contact NXP Semiconductors for further clarification. 14.1.2 Label converting Generally, an optimization of the entire lamination process by label manufacturer is recommended in order to minimize the stress onto the module and guarantee high assembly yield. Roller diameter must not be smaller than 45 mm. 15. Packing information 15.1 Wafer See Ref. 20 “Data sheet - Delivery type description – General specification for 8” wafer on UV-tape with electronic fail die marking, BU-ID document number: 1093**” SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 36 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 16. Abbreviations Table 40. SL3S1003_1013 Product data sheet COMPANY PUBLIC Abbreviations Acronym Description CRC Cyclic Redundancy Check CW Continuous Wave DC Direct Current EAS Electronic Article Surveillance EEPROM Electrically Erasable Programmable Read Only Memory EPC Electronic Product Code (containing Header, Domain Manager, Object Class and Serial Number) ESD ElectroStatic Discharge FCS Flip Chip Strap FM0 Bi phase space modulation G2 Generation 2 HBM Human Body Model IC Integrated Circuit PSF Product Status Flag PCB Printed Circuit Board RF Radio Frequency UHF Ultra High Frequency TID Tag IDentifier All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 37 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 17. References [1] EPCglobal: EPC Radio-Frequency Identity Protocols Class-1 Generation-2 UHF RFID Protocol for Communications at 860 MHz – 960 MHz, Version 1.1.0 (December 17, 2005) [2] EPCglobal: EPC Tag Data Standards [3] EPCglobal (2004): FMCG RFID Physical Requirements Document (draft) [4] EPCglobal (2004): Class-1 Generation-2 UHF RFID Implementation Reference (draft) [5] European Telecommunications Standards Institute (ETSI), EN 302 208: Electromagnetic compatibility and radio spectrum matters (ERM) – Radio-frequency identification equipment operating in the band 865 MHz to 868 MHz with power levels up to 2 W, Part 1 – Technical characteristics and test methods [6] European Telecommunications Standards Institute (ETSI), EN 302 208: Electromagnetic compatibility and radio spectrum matters (ERM) – Radio-frequency identification equipment operating in the band 865 MHz to 868 MHz with power levels up to 2 W, Part 2 – Harmonized EN under article 3.2 of the R&TTE directive [7] [CEPT1]: CEPT REC 70-03 Annex 1 [8] [ETSI1]: ETSI EN 330 220-1, 2 [9] [ETSI3]: ETSI EN 302 208-1, 2 V<1.1.1> (2004-09-Electromagnetic compatibility And Radio spectrum Matters (ERM) Radio Frequency Identification Equipment operating in the band 865 - MHz to 868 MHz with power levels up to 2 W Part 1: Technical characteristics and test methods. [10] [FCC1]: FCC 47 Part 15 Section 247 [11] ISO/IEC Directives, Part 2: Rules for the structure and drafting of International Standards [12] ISO/IEC 3309: Information technology – Telecommunications and information exchange between systems – High-level data link control (HDLC) procedures – Frame structure [13] ISO/IEC 15961: Information technology, Automatic identification and data capture – Radio frequency identification (RFID) for item management – Data protocol: application interface [14] ISO/IEC 15962: Information technology, Automatic identification and data capture techniques – Radio frequency identification (RFID) for item management – Data protocol: data encoding rules and logical memory functions [15] ISO/IEC 15963: Information technology — Radio frequency identification for item management — Unique identification for RF tags [16] ISO/IEC 18000-1: Information technology — Radio frequency identification for item management — Part 1: Reference architecture and definition of parameters to be standardized [17] ISO/IEC 18000-6: Information technology automatic identification and data capture techniques — Radio frequency identification for item management air interface — Part 6: Parameters for air interface communications at 860–960 MHz [18] ISO/IEC 19762: Information technology AIDC techniques – Harmonized vocabulary – Part 3: radio-frequency identification (RFID) SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 38 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ [19] U.S. Code of Federal Regulations (CFR), Title 47, Chapter I, Part 15: Radio-frequency devices, U.S. Federal Communications Commission. [20] Data sheet - Delivery type description – General specification for 8” wafer on UV-tape with electronic fail die marking, BU-ID document number: 1093**3 3. ** ... document version number SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 39 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 18. Revision history Table 41. Revision history Document ID Release date Data sheet status Change notice Supersedes SL3S1003_1013 v. 3.7 20150521 Product data sheet - SL3S1003_1013 v. 3.6 Modifications: SL3S1003_1013 v. 3.6 Modifications: SL3S1003_1013 v. 3.5 Modifications: SL3S1003_1013 v. 3.4 Modifications: SL3S1003_1013 v. 3.3 Modifications: SL3S1003_1013 v. 3.2 Modifications: SL3S1003_1013 v. 3.1 Modifications: SL3S1003_1013 v. 3.0 Modifications: SL3S1003_1013 v. 2.0 SL3S1003_1013 Product data sheet COMPANY PUBLIC • • Table 36 “VDD pin characteristics”: current units corrected Section 10.7.1 “ChangeConfig”: “Digital Switch” updated 20141017 Product data sheet - SL3S1003_1013 v. 3.5 • Table 21 “User Memory Configuration with 2 areas (no Access password protected area)”: corrected • Table 39 “G2iM+ RF interface characteristics (RFN, RFP)”: corrected 20131107 • • • • Product data sheet Table 2 “Marking codes”: updated Section 2.2 “Key benefits”: title updated Table 39 “G2iM+ RF interface characteristics (RFN, RFP)”: title updated Product data sheet Product data sheet Product data sheet Product data sheet - SL3S1003_1013 v. 3.1 - SL3S1003_1013 v. 3.0 Security status changed into COMPANY PUBLIC Package delivery form SOT886 added Section 5 “Marking”, Section 13 “Package outline”: added 20110503 • • • SL3S1003_1013 v. 3.2 Section 8.1 “Wafer layout”: figure notes (1), (2), (8) and (9) updated 20111117 • • • SL3S1003_1013 v. 3.3 Section 14 “Handling information”: added 20120111 • - Figure 4 “SL3S10x3 wafer layout”: Figure notes (1) and (2) updated 20120130 • SL3S1003_1013 v. 3.4 Table 1 “Ordering information”: updated 20120227 • - Product data sheet - SL3S1003_1013 v. 2.0 - - Specification status changed into product Some EPC bit values changed Table 16 added 20110415 Preliminary data sheet All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 40 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ 19. Legal information 19.1 Data sheet status Document status[1][2] Product status[3] Definition Objective [short] data sheet Development This document contains data from the objective specification for product development. Preliminary [short] data sheet Qualification This document contains data from the preliminary specification. Product [short] data sheet Production This document contains the product specification. [1] Please consult the most recently issued document before initiating or completing a design. [2] The term ‘short data sheet’ is explained in section “Definitions”. [3] The product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple devices. The latest product status information is available on the Internet at URL http://www.nxp.com. 19.2 Definitions Draft — The document is a draft version only. The content is still under internal review and subject to formal approval, which may result in modifications or additions. NXP Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall have no liability for the consequences of use of such information. Short data sheet — A short data sheet is an extract from a full data sheet with the same product type number(s) and title. A short data sheet is intended for quick reference only and should not be relied upon to contain detailed and full information. For detailed and full information see the relevant full data sheet, which is available on request via the local NXP Semiconductors sales office. In case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail. Product specification — The information and data provided in a Product data sheet shall define the specification of the product as agreed between NXP Semiconductors and its customer, unless NXP Semiconductors and customer have explicitly agreed otherwise in writing. In no event however, shall an agreement be valid in which the NXP Semiconductors product is deemed to offer functions and qualities beyond those described in the Product data sheet. 19.3 Disclaimers Limited warranty and liability — Information in this document is believed to be accurate and reliable. However, NXP Semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information. NXP Semiconductors takes no responsibility for the content in this document if provided by an information source outside of NXP Semiconductors. In no event shall NXP Semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. Notwithstanding any damages that customer might incur for any reason whatsoever, NXP Semiconductors’ aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the Terms and conditions of commercial sale of NXP Semiconductors. Right to make changes — NXP Semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice. This document supersedes and replaces all information supplied prior to the publication hereof. SL3S1003_1013 Product data sheet COMPANY PUBLIC Suitability for use — NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an NXP Semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. NXP Semiconductors and its suppliers accept no liability for inclusion and/or use of NXP Semiconductors products in such equipment or applications and therefore such inclusion and/or use is at the customer’s own risk. Applications — Applications that are described herein for any of these products are for illustrative purposes only. NXP Semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. Customers are responsible for the design and operation of their applications and products using NXP Semiconductors products, and NXP Semiconductors accepts no liability for any assistance with applications or customer product design. It is customer’s sole responsibility to determine whether the NXP Semiconductors product is suitable and fit for the customer’s applications and products planned, as well as for the planned application and use of customer’s third party customer(s). Customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. NXP Semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer’s applications or products, or the application or use by customer’s third party customer(s). Customer is responsible for doing all necessary testing for the customer’s applications and products using NXP Semiconductors products in order to avoid a default of the applications and the products or of the application or use by customer’s third party customer(s). NXP does not accept any liability in this respect. Limiting values — Stress above one or more limiting values (as defined in the Absolute Maximum Ratings System of IEC 60134) will cause permanent damage to the device. Limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in the Recommended operating conditions section (if present) or the Characteristics sections of this document is not warranted. Constant or repeated exposure to limiting values will permanently and irreversibly affect the quality and reliability of the device. Terms and conditions of commercial sale — NXP Semiconductors products are sold subject to the general terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms, unless otherwise agreed in a valid written individual agreement. In case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. NXP Semiconductors hereby expressly objects to applying the customer’s general terms and conditions with regard to the purchase of NXP Semiconductors products by customer. No offer to sell or license — Nothing in this document may be interpreted or construed as an offer to sell products that is open for acceptance or the grant, conveyance or implication of any license under any copyrights, patents or other industrial or intellectual property rights. All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 41 of 43 SL3S1003_1013 NXP Semiconductors UCODE G2iM and G2iM+ Export control — This document as well as the item(s) described herein may be subject to export control regulations. Export might require a prior authorization from competent authorities. Quick reference data — The Quick reference data is an extract of the product data given in the Limiting values and Characteristics sections of this document, and as such is not complete, exhaustive or legally binding. Non-automotive qualified products — Unless this data sheet expressly states that this specific NXP Semiconductors product is automotive qualified, the product is not suitable for automotive use. It is neither qualified nor tested in accordance with automotive testing or application requirements. NXP Semiconductors accepts no liability for inclusion and/or use of non-automotive qualified products in automotive equipment or applications. In the event that customer uses the product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without NXP Semiconductors’ warranty of the product for such automotive applications, use and specifications, and (b) whenever customer uses the product for automotive applications beyond NXP Semiconductors’ specifications such use shall be solely at customer’s own risk, and (c) customer fully indemnifies NXP Semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive applications beyond NXP Semiconductors’ standard warranty and NXP Semiconductors’ product specifications. Translations — A non-English (translated) version of a document is for reference only. The English version shall prevail in case of any discrepancy between the translated and English versions. 19.4 Trademarks Notice: All referenced brands, product names, service names and trademarks are the property of their respective owners. UCODE — is a trademark of NXP Semiconductors N.V. 20. Contact information For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: [email protected] SL3S1003_1013 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.7 — 21 May 2015 201237 © NXP Semiconductors N.V. 2015. All rights reserved. 42 of 43 NXP Semiconductors SL3S1003_1013 UCODE G2iM and G2iM+ 21. Contents 1 2 2.1 2.1.1 2.2 2.2.1 2.2.2 2.2.3 2.3 3 3.1 3.2 4 5 6 7 7.1 8 8.1 9 9.1 9.1.1 9.1.2 9.1.3 10 10.1 10.2 10.3 10.3.1 10.3.2 10.4 10.5 10.6 10.6.1 General description . . . . . . . . . . . . . . . . . . . . . . 1 Features and benefits . . . . . . . . . . . . . . . . . . . . 1 Key features . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Key benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 End user benefit . . . . . . . . . . . . . . . . . . . . . . . . 2 Antenna design benefits . . . . . . . . . . . . . . . . . . 2 Label manufacturer benefit . . . . . . . . . . . . . . . . 2 Custom commands. . . . . . . . . . . . . . . . . . . . . . 3 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Markets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Ordering information . . . . . . . . . . . . . . . . . . . . . 4 Marking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Pinning information . . . . . . . . . . . . . . . . . . . . . . 6 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 6 Wafer layout . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Wafer layout . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Mechanical specification . . . . . . . . . . . . . . . . . 8 Wafer specification . . . . . . . . . . . . . . . . . . . . . . 8 Wafer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Fail die identification . . . . . . . . . . . . . . . . . . . . 9 Map file distribution. . . . . . . . . . . . . . . . . . . . . . 9 Functional description . . . . . . . . . . . . . . . . . . 10 Air interface standards . . . . . . . . . . . . . . . . . . 10 Power transfer . . . . . . . . . . . . . . . . . . . . . . . . 10 Data transfer . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Reader to tag Link . . . . . . . . . . . . . . . . . . . . . 10 Tag to reader Link . . . . . . . . . . . . . . . . . . . . . . 10 UCODE G2iM and UCODE G2iM+ differences 11 Supported commands . . . . . . . . . . . . . . . . . . 11 UCODE G2iM and UCODE G2iM+ memory . 12 UCODE G2iM and UCODE G2iM+ overall memory map. . . . . . . . . . . . . . . . . . . . . . . . . . 13 10.6.2 UCODE G2iM and UCODE G2iM+ TID memory details . . . . . . . . . . . . . . . . . . . . . . . . 15 10.7 Custom commands. . . . . . . . . . . . . . . . . . . . . 16 10.7.1 ChangeConfig. . . . . . . . . . . . . . . . . . . . . . . . . 16 UCODE G2iM and UCODE G2iM+ special features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16 10.7.2 UCODE G2iM and UCODE G2iM+ special features control mechanism . . . . . . . . . . . . . . 20 10.7.3 UCODE G2iM+ memory configuration control mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 10.7.4 Private Memory Segment . . . . . . . . . . . . . . . . 24 10.7.5 ReadProtect . . . . . . . . . . . . . . . . . . . . . . . . . . 10.7.6 Reset ReadProtect2 . . . . . . . . . . . . . . . . . . . . 10.7.7 ChangeEAS2 . . . . . . . . . . . . . . . . . . . . . . . . . 10.7.8 EAS_Alarm . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Limiting values . . . . . . . . . . . . . . . . . . . . . . . . 12 Characteristics . . . . . . . . . . . . . . . . . . . . . . . . 12.1 UCODE G2iM and UCODE G2iM+ bare die characteristics . . . . . . . . . . . . . . . . . . . . . . . . 12.2 UCODE G2iM+ SOT886 characteristics . . . . 13 Package outline. . . . . . . . . . . . . . . . . . . . . . . . 14 Handling information . . . . . . . . . . . . . . . . . . . 14.1 Assembly conditions . . . . . . . . . . . . . . . . . . . 14.1.1 General assembly recommendations . . . . . . 14.1.2 Label converting. . . . . . . . . . . . . . . . . . . . . . . 15 Packing information . . . . . . . . . . . . . . . . . . . . 15.1 Wafer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 17 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Revision history . . . . . . . . . . . . . . . . . . . . . . . 19 Legal information . . . . . . . . . . . . . . . . . . . . . . 19.1 Data sheet status . . . . . . . . . . . . . . . . . . . . . . 19.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.3 Disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . . 19.4 Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Contact information . . . . . . . . . . . . . . . . . . . . 21 Contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 26 28 29 31 32 32 34 35 36 36 36 36 36 36 37 38 40 41 41 41 41 42 42 43 Please be aware that important notices concerning this document and the product(s) described herein, have been included in section ‘Legal information’. © NXP Semiconductors N.V. 2015. All rights reserved. For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: [email protected] Date of release: 21 May 2015 201237