Data Book - my-d™ move NFC - SLE 66R01P / SLE66R01PN

my- d™ mov e
my- d™ mov e N FC
S LE 66 R01 P
S LE 66 R01 P N
Intelligent 1216 bit EEPROM with
Contactless Interface compliant to
ISO/IEC 14443-3 Type A and support of
NFC Forum™ Type 2 Tag Operation
Da t a B o o k
2011-11-24
Ch i p C a rd & S e c u r i ty
Edition 2011-11-24
Published by
Infineon Technologies AG
81726 Munich, Germany
© 2011 Infineon Technologies AG
All Rights Reserved.
Legal Disclaimer
The information given in this document shall in no event be regarded as a guarantee of conditions or
characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any
information regarding the application of the device, Infineon Technologies hereby disclaims any and all warranties
and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual property rights
of any third party.
Information
For further information on technology, delivery terms and conditions and prices, please contact the nearest
Infineon Technologies Office (www.infineon.com).
Warnings
Due to technical requirements, components may contain dangerous substances. For information on the types in
question, please contact the nearest Infineon Technologies Office.
Infineon Technologies components may be used in life-support devices or systems only with the express written
approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure
of that life-support device or system or to affect the safety or effectiveness of that device or system. Life support
devices or systems are intended to be implanted in the human body or to support and/or maintain and sustain
and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may
be endangered.
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
my-d™ move / my-d™ move NFC - SLE 66R01P / SLE 66R01PN Data Book
The information in this document is subject to change without notice.
Revision History: Current Version 2011-11-24
Previous Release: Preliminary 2011-11-18
Page
Subjects (major changes since last revision)
All
Editorial changes; removed “Preliminary” status; update of figures (memory organization)
Trademarks of Infineon Technologies AG
BlueMoon™, COMNEON™, C166™, CROSSAVE™, CanPAK™, CIPOS™, CoolMOS™, CoolSET™,
CORECONTROL™, DAVE™, EasyPIM™, EconoBRIDGE™, EconoDUAL™, EconoPACK™, EconoPIM™,
EiceDRIVER™, EUPEC™, FCOS™, HITFET™, HybridPACK™, ISOFACE™, I²RF™, IsoPACK™, MIPAQ™,
ModSTACK™, my-d™, NovalithIC™, OmniTune™, OptiMOS™, ORIGA™, PROFET™, PRO-SIL™,
PRIMARION™, PrimePACK™, RASIC™, ReverSave™, SatRIC™, SensoNor™, SIEGET™, SINDRION™,
SMARTi™, SmartLEWIS™, TEMPFET™, thinQ!™, TriCore™, TRENCHSTOP™, X-GOLD™, XMM™, X-PMU™,
XPOSYS™.
Other Trademarks
Advance Design System™ (ADS) of Agilent Technologies, AMBA™, ARM™, MULTI-ICE™, PRIMECELL™,
REALVIEW™, THUMB™ of ARM Limited, UK. AUTOSAR™ is licensed by AUTOSAR development partnership.
Bluetooth™ of Bluetooth SIG Inc. CAT-iq™ of DECT Forum. COLOSSUS™, FirstGPS™ of Trimble Navigation
Ltd. EMV™ of EMVCo, LLC (Visa Holdings Inc.). EPCOS™ of Epcos AG. FLEXGO™ of Microsoft Corporation.
FlexRay™ is licensed by FlexRay Consortium. HYPERTERMINAL™ of Hilgraeve Incorporated. IEC™ of
Commission Electrotechnique Internationale. IrDA™ of Infrared Data Association Corporation. ISO™ of
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. MATLAB™ of MathWorks, Inc. MAXIM™ of
Maxim Integrated Products, Inc. MICROTEC™, NFC Forum™ is trademark of Near Field Communication Forum,
NUCLEUS™ of Mentor Graphics Corporation. Mifare™ of NXP. MIPI™ of MIPI Alliance, Inc. MIPS™ of MIPS
Technologies, Inc., USA. muRata™ of MURATA MANUFACTURING CO., MICROWAVE OFFICE™ (MWO) of
Applied Wave Research Inc., OmniVision™ of OmniVision Technologies, Inc. Openwave™ Openwave Systems
Inc. RED HAT™ Red Hat, Inc. RFMD™ RF Micro Devices, Inc. SIRIUS™ of Sirius Sattelite Radio Inc. SOLARIS™
of Sun Microsystems, Inc. SPANSION™ of Spansion LLC Ltd. Symbian™ of Symbian Software Limited.
TAIYO YUDEN™ of Taiyo Yuden Co. TEAKLITE™ of CEVA, Inc. TEKTRONIX™ of Tektronix Inc. TOKO™ of
TOKO KABUSHIKI KAISHA TA. UNIX™ of X/Open Company Limited. VERILOG™, PALLADIUM™ of Cadence
Design Systems, Inc. VLYNQ™ of Texas Instruments Incorporated. VXWORKS™, WIND RIVER™ of WIND
RIVER SYSTEMS, INC. ZETEX™ of Diodes Zetex Limited.
Data Book
3 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Table of Contents
1
1.1
Ordering and packaging information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Pin description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2
2.1
2.2
my-d™ Product Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
my-d™ move and my-d™ move NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Application Segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3
3.1
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.3
3.4
3.5
3.6
3.7
Scope of my-d™ move / my-d™ move NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Circuit Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Memory Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Service Area 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
User Area 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
User Area 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Service Area 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Memory Principle for NFC Forum™ Type 2 Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
System Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
UID Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Supported Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
12
12
13
14
14
14
14
15
16
17
17
17
4
4.1
4.2
4.2.1
4.2.2
4.2.2.1
4.2.3
4.2.4
4.2.5
4.3
4.3.1
4.3.2
4.4
4.4.1
4.4.2
Memory Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
User Memory Area 1 and 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Service Area 1 and 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Unique Identifier (UID) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Configuration Byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Locking Mechanism for the Configuration Byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Locking mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
OTP Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Manufacturer Block (25H) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Memory Principle for NFC Forum™ Type 2 Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NFC Forum™ Static Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NFC Forum™ Dynamic Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Transport Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Transport Configuration my-d™ move . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Transport Configuration my-d™ move NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
18
18
19
19
20
20
21
22
22
23
23
24
26
26
27
5
5.1
5.2
5.3
Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Password Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Password Retry Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Anti-tearing Mechanism for Password Retry Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
29
29
29
31
6
6.1
6.2
6.3
6.4
16-bit Value Counter Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Value Counter Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Loading and Reading of Value Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Decrementing Value Counter and Anti-Tearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Protection Mechanisms for the Value Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
32
32
33
34
34
7
7.1
7.2
7.2.1
7.2.2
Communication Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Communication between a card (PICC) and a reader (PCD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
State Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
IDLE/HALT State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
READY1/READY1* State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
35
35
35
35
35
Data Book
4 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
7.2.3
7.2.4
7.2.5
7.3
7.3.1
7.4
7.5
READY2/READY2* State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ACTIVE/ACTIVE* State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
HALT State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Start up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Start-up sequence of the SLE 66R01P and SLE 66R01PN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Frame Delay Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
35
36
36
37
37
37
38
8
8.1
8.2
8.2.1
8.2.2
8.2.3
8.2.4
8.2.5
8.2.6
8.2.7
8.2.8
8.2.9
8.3
8.3.1
8.3.2
Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Supported ISO/IEC 14443-3 Type A Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Memory Access Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Read 4 Blocks (RD4B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Write 1 Block (WR1B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Compatibility Write Command (CPTWR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Read 2 Blocks (RD2B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Write 2 Blocks (WR2B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Set Password (SPWD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Access (ACS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Decrement Command (DCR16) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
HLTA command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ move and my-d™ move NFC responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Command responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ move and my-d™ move NFC identification data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
39
39
39
41
42
43
44
45
46
47
49
51
52
52
52
9
9.1
9.2
Operational Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Data Book
5 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
List of Figures
Figure 1
Figure 2
Figure 3
Figure 4
Figure 5
Figure 6
Figure 7
Figure 8
Figure 9
Figure 10
Figure 11
Figure 12
Figure 13
Figure 14
Figure 15
Figure 16
Figure 17
Figure 18
Figure 19
Figure 20
Figure 21
Figure 22
Figure 23
Figure 24
Figure 25
Figure 26
Figure 27
Figure 28
Figure 29
Data Book
Pin configuration die . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Block Diagram of the SLE 66R01P and SLE 66R01PN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
SLE 66R01P and SLE 66R01PN memory principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
SLE 66R01P and SLE 66R01PN NFC Forum™ Type 2 Tag memory structure . . . . . . . . . . . . . . 15
SLE 66R01P and SLE 66R01PN Contactless System Overview. . . . . . . . . . . . . . . . . . . . . . . . . . 16
SLE 66R01P and SLE 66R01PN double-size UID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
my-d™ move and my-d™ move NFC memory organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Configuration Byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Locking and Block Locking Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Static Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Generic NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N)). . . . . . . 24
Example of a NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N)) . . 25
my-d™ move Transport Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
my-d™ move NFC Transport Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Password and Password Retry Counter configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Value Counter - Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Value Counter decrement example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Start-up Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Read 4 Blocks Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Write 1 Block Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Compatibility Write Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Read 2 Blocks Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Write 2 Blocks Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Set Password Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Access Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Flow Diagram of the ACS Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Decrement Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Decrement Command flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
HLTA Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
6 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
List of Tables
Table 1
Table 2
Table 3
Table 4
Table 5
Table 6
Table 7
Table 8
Table 9
Table 10
Table 11
Table 12
Table 13
Table 14
Table 15
Table 16
Table 17
Table 18
Table 19
Table 20
Table 21
Table 22
Table 23
Table 24
Table 25
Table 26
Table 27
Table 28
Table 29
Table 30
Data Book
Ordering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Pin description and function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
my-d™ family product overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
UID Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
UID Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Configuration Byte Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Example for OTP Block Lock and Block Lock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Writing to OTP Block (block 03H) from the user point of view . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Capability Container settings for my-d™ move and my-d™ move NFC. . . . . . . . . . . . . . . . . . . . . 28
Empty NDEF message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Access Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Behavior in case of an Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
ISO/IEC 14443-3 Type A Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
my-d™ move and my-d™ move NFC memory access command set . . . . . . . . . . . . . . . . . . . . . . 39
Read 4 Blocks (RD4B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Write 1 Block (WR1B). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Compatibility Write (CPTWR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Read 2 Block (RD2B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Write 2 Block (WR2B). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Set Password (SPWD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
SPWD - behaviour in error case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Access (ACS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
ACS - behaviour in error case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Decrement (DCR16) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
DCR16 - behaviour in error case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Halt (HLTA). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
ACK and NACK as responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Summary of SLE 66R01P and SLE 66R01PN identification data . . . . . . . . . . . . . . . . . . . . . . . . . 52
Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
7 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Features
Intelligent 1216 bit EEPROM with Contactless Interface compliant to
ISO/IEC 14443-3 Type A and support of NFC Forum™ Type 2 Tag Operation
Contactless Interface
•
•
•
Physical Interface and Anticollision compliant to ISO/IEC 14443-3 Type A
– Operation frequency 13.56 MHz
– Data rate 106 kbit/s in both direction
– Contactless transmission of data and supply energy
– Anticollision logic: several cards may be operated in the field simultaneously
Unique IDentification number (7-byte double-size UID) according to ISO/IEC 14443-3 Type A
Read and Write Distance up to 10 cm and more (influenced by external circuitry i.e. reader and inlay design)
152 byte EEPROM
•
•
•
•
•
•
•
Organized in 38 blocks of 4 bytes each
128 bytes freely programmable User Memory
24 bytes of Service Area reserved for UID, Configuration, LOCK Bytes, OTP Block and Manufacturer Data
Read and Write of 128 bytes of User Memory in less than 100 ms
Programming time per block < 4 ms
Endurance minimum 10,000 erase/write cycles1)
Data Retention minimum 5 years1)
Privacy Features
•
•
•
•
•
•
32 bit of One Time Programmable (OTP) memory area
Locking mechanism for each block
Block Lock mechanism
Optional 32 bit Password for Read/Write or Write access
Optional Password Retry Counter
Optional 16 bit Value Counter
Data Protection
•
•
Data Integrity supported by 16 bit CRC, parity bit, command length check
Anti-tearing mechanism for OTP, Password Retry Counter and Value Counter
NFC Forum™ Operation
•
•
•
•
Compliant to NFC Forum™ Type 2 Tag Operation
Support of Static and Dynamic Memory Structure according to NFC Forum™ Type 2 Tag Operation
SLE 66R01PN: pre-configured NFC memory with empty NDEF message (INITIALIZED state, non-reversible)
SLE 66R01P: UNINITIALIZED state, may be configured to INITIALIZED state
Electrical Characteristics
•
•
•
On-Chip capacitance 17 pF + 5%
ESD protection minimum 2 kV
Ambient Temperature -25°C … +70°C (for the chip)
1) Values are temperature dependent
Data Book
8 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Ordering and packaging information
1
Ordering and packaging information
Table 1
Ordering information
Total Memory / User Memory1)
Type
Package
SLE 66R01P C
wafer sawn / unsawn
SLE 66R01P NB
NiAu Bumped (sawn wafer)
Ordering code
on request
SP000911428
152 / 128 bytes
SLE 66R01PN C
wafer sawn / unsawn
SLE 66R01PN NB
NiAu Bumped (sawn wafer)
on request
SP000953914
1) Total memory size includes the service area whereas user memory size is freely programmable for user data.
For more ordering information about the form of delivery please contact your local Infineon sales office.
1.1
Pin description
LA
my-d™ move (NFC)
SLE 66R01P(N)
LB
Figure 1
Pin configuration die
Table 2
Pin description and function
Symbol
Function
LA
Antenna Connection
LB
Antenna Connection
Data Book
9 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
my-d™ Product Family
2
my-d™ Product Family
my-d™ products are available both in plain mode with open memory access and in secure mode with memory
access controlled by authentication procedures. The my-d™ product family provides users with different memory
sizes, features NFC Forum™ Type 2 Tag functionality and incorporates security features to enable considerable
flexibility in the application design.
Flexible controls within the my-d™ devices start with plain mode operation featuring individual page locking; for
more complex applications various settings in secure mode can be set for multi user / multi application
configurations.
In plain mode access to the memory is supported by both 4-byte block as well as 8-byte page structure.
In secure mode a cryptographic algorithm based on a 64-bit key is available. Mutual authentication, message
authentication codes (MAC) and customized access conditions protect the memory against unauthorized access.
The functional architecture, meaning the memory organization and authentication of my-d™ products is the same
for both my-d™ proximity (ISO/IEC 14443) and my-d™ vicinity (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693). This
eases the system design and allows simple adaptation between applications.
Configurable Value Counters featuring anti-tearing functionality are suitable for value token applications, such as
limited use transportation tickets.
Architectural interoperability of my-d™ products enables an easy migration from simple to more demanding
applications.
The my-d™ move family is designed for cost optimized applications and its implemented command set eases the
usage in existing applications and infrastructures.
In addition, the my-d™ light (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693) is part of the my-d™ family. Its optimized
command set and memory expands the range of applications to cost sensitive segments.
2.1
my-d™ move and my-d™ move NFC
The my-d™ move and my-d™ move NFC are part of Infineon’s my-d™ product family and are designed to meet
the requirements of the increasing NFC market demanding smart memories. They are compliant to
ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC Forum™ Type 2 Tag Operation.
128 Bytes of memory can be arranged in static or dynamic memory structures for NFC applications.
my-d™ move and my-d™ move NFC products also feature configurable Value Counters which support antitearing protection.
Privacy features like a password protection including password retry counter provide basic security to the
applications.
Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the
INITIALIZED state according to the definition of the NFC Forum™ Type 2 Tag life cycle. Due to that the
my-d™ move NFC is ready to be used in NFC infrastructures.
my-d™ move and my-d™ move NFC products are suited for a broad range of applications like public transport,
event ticketing or smart posters.
Data Book
10 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
my-d™ Product Family
2.2
Application Segments
my-d™ products are optimized for personal and object identification. Please find in the following table some
dedicated examples
Table 3
my-d™ family product overview
Product
Application
my-d™ move - SLE 66R01P
Public Transport, Smart Posters, NFC Device Pairing
my-d™ move NFC - SLE 66R01PN
Public Transport, Smart Posters, NFC Device Pairing,
NFC INITIALIZED state
my-d™ move lean - SLE 66R01L
Public Transport, Smart Posters, NFC Device Pairing
my-d™ NFC - SLE 66RxxP
Smart Posters and Maps, NFC Device Pairing, Loyalty
Schemes, Consumer Good Information, Healthcare
Monitoring
my-d™ proximity 2 - SLE 66RxxS
Access Control, Entertainment, Public Transport,
Customer Loyalty Schemes, Micro Payment
my-d™ proximity enhanced - SLE 55RxxE
Access Control, Gaming, Entertainment, Customer Loyalty
Schemes
my-d™ light - SRF 55V01P
Libraries, Laundry, Factory Automation, Media
Management, Event Ticketing, Leisure Park Access
my-d™ vicinity plain - SRF 55VxxP
Factory Automation, Healthcare, Ticketing, Access Control
my-d™ vicinity plain HC - SRF 55VxxP HC
Ticketing, Brand Protection, Loyalty Schemes, Ski passes
my-d™ vicinity secure - SRF 55VxxS
Ticketing, Brand protection, Loyalty Schemes, Access
Control
Data Book
11 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Scope of my-d™ move / my-d™ move NFC
3
Scope of my-d™ move / my-d™ move NFC
The SLE 66R01P and SLE 66R01PN are part of the Infineon my-d™ product family and support Infineon’s
transport and ticketing strategy and are designed to meet the requirements of NFC applications.
They are compliant to ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC Forum™ Type 2 Tag Operation.
3.1
Circuit Description
The SLE 66R01P and SLE 66R01PN are made up of an EEPROM memory unit, an analog interface for
contactless operation, a data transmission path and a control unit. The following diagram shows the main blocks
of the SLE 66R01P and SLE 66R01PN.
LA
POWER
Analog
Contactless
Interface
Memory Unit
CLOCK
Antenna
Power Circuit
Rectifier
Clock Extractor
Voltage Regulator
Power on Reset
DATA
Parallel
Serial
IO
Command
LB
Anticollision
Memory
Access
Control Unit
Figure 2
Block Diagram of the SLE 66R01P and SLE 66R01PN
The SLE 66R01P and SLE 66R01PN comprise the following three parts:
•
•
•
Analog Contactless Interface
– The Analog Contactless Interface contains the voltage rectifier, voltage regulator and system clock to supply
the IC with appropriate power. Additionally the data stream is modulated and demodulated.
Memory Unit
– The Memory Unit consists of 38 blocks of 4 bytes each.
Control Unit
– The Control Unit decodes and executes all commands. Additionally the control unit is responsible for the
correct anticollision flow.
Data Book
12 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Scope of my-d™ move / my-d™ move NFC
3.2
Memory Principle
The total amount of addressable memory is 152 bytes organized in blocks of 4 bytes each.
The general structure comprises Service Areas as well as User Areas:
•
•
24 bytes of service and administration data (located in Service Area 1 and 2) reserved for
– 7-byte double-size UID
– configuration data
– LOCKx bytes
– OTP memory
– Manufacturing Data
128 bytes of User memory (located in User Area 1 and 2) reserved for
– User Data
– Value Counter
Additionally the Password and Password Retry Counter are available and accessible via dedicated commands.
Service Area 1
Unique serial number (UID)
User Area 1
Password protectable
User Area 2
Service Area 2
PASSWORD
PASSWORD RETRY COUNTER
Figure 3
Data Book
SLE 66R01P and SLE 66R01PN memory principle
13 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Scope of my-d™ move / my-d™ move NFC
3.2.1
Service Area 1
Service Area 1 contains
•
•
•
•
the 7-byte UID which is programmed at manufacturing of the chip and cannot be changed
CONFIG byte to enable the Password (incl. the Password Retry counter) and the Value Counter functionality
LOCK0, LOCK1 bytes to enable an irreversible write-protection for the blocks located in User Area 1
32 bits of the One-Time-Programmable (OTP) memory block can irreversibly be programmed from 0B to 1B
3.2.2
User Area 1
48 bytes (12 blocks, 4 bytes each) of memory for user data.
3.2.3
User Area 2
User Area 2 contains
•
•
80 bytes (20 blocks, 4 bytes each) of user memory for user data. These memory blocks can be used to store
user data. This portion of the memory may be protected with a 32 bit password.
a 16-bit Value Counter may be activated providing a mechanism to store some value (points, trips, ...) on the
my-d™ move and my-d™ move NFC chip.
3.2.4
Service Area 2
Service Area 2 contains
•
•
lock bytes LOCK2 to LOCK5 to enable an irreversible write-protection for the blocks loacted in User Area 2
Manufacturing Data (programmed during manufacturing of the chip) which cannot be changed
Data Book
14 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Scope of my-d™ move / my-d™ move NFC
3.3
Memory Principle for NFC Forum™ Type 2 Tag
The memory organization is configurable according to the NFC Forum™ Type 2 Tag Operation specification.
Static or dynamic memory structures are supported.
Figure 4 illustrates the principle of the SLE 66R01P and SLE 66R01PN as a NFC Forum™ Type 2 Tag
compatible chip. The memory can be accessed with NFC Forum™ Type 2 Tag commands.
Service Area 1
Unique serial number (UID)
CAPABILITY CONTAINER
Data
Data
User Area 1
Password protectable
User Area 2
Data
Service Area 2
PASSWORD
PASSWORD RETRY COUNTER
Figure 4
SLE 66R01P and SLE 66R01PN NFC Forum™ Type 2 Tag memory structure
Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the
INITIALIZED state according to the definition of the NFC Forum™ Type 2 Tag life cycle. With this preconfiguration the my-d™ move NFC can be immediately used in NFC infrastructures.
For details regarding the NFC initialization of my-d™ move and my-d™ move NFC please refer the the Application
Note “How to operate my-d™ move and my-d™ move NFC devices in NFC Forum™ Type 2 Tag infrastructures”
available at Chip Card & Security [email protected].
Attention: The pre-configuration of SLE 66R01PN is nonreversible and the my-d™ move NFC cannot be
overwritten and used as plain, standard my-d™ move anymore.
Data Book
15 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Scope of my-d™ move / my-d™ move NFC
System Overview
3.4
The system consists of a host system, one or more SLE 66R01P / SLE 66R01PN tags or other ISO/IEC 144433 Type A compliant cards and an ISO/IEC 14443-3 Type A compatible contactless reader.
Alternatively, since the SLE 66R01P and SLE 66R01PN can be used in NFC Forum™ Type 2 Tag memory
structures, a NFC Forum™ device in card reader/writer mode can be used to operate the chip.
Host System
PCD
Micro
Controller
Analog
Circuitry
SLE 66R01P(N)
my-dTM move (NFC)
Energy
Identification Terminal
ISO/IEC14443 Type A
or
NFC Forum™ Device
Figure 5
Data Book
Clock
PICC
Antenna
Data
SLE 66R01P and SLE 66R01PN Contactless System Overview
16 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Scope of my-d™ move / my-d™ move NFC
UID Coding
3.5
To identify a SLE 66R01P and SLE 66R01PN chip the manufacturer code and a chip family identifier are coded
into the UID as described in the Table 4. The chip family identifier can be used to determine the basic command
set for the chip.
UID
PCD
size
double
PICC
’93'
’95'
CT
uid0 uid1 uid2 BCC
’05H’
uid3 uid4 uid5 uid6 BCC
Chip
Family ID
Figure 6
SLE 66R01P and SLE 66R01PN double-size UID
Table 4
UID Coding
UID Field
Value
Description
uid0
05H
IC Manufacturer Code according to ISO/IEC 7816-6
uid1
3xH
Chip Family Identifier
Higher Nibble: 0011B: my-d™ move and my-d™ move NFC
Lower Nibble: part of the UID number
3.6
Supported Standards
the SLE 66R01P and SLE 66R01PN support the following standards:
•
•
•
ISO/IEC 14443 Type A (Parts 1, 2 and 3)
tested according to ISO/IEC 10373-6 (PICC Test & Validation)
ISO/IEC 14443-3 Type A
NFC Forum™ Type 2 Tag Operation
3.7
Command Set
The SLE 66R01P and SLE 66R01PN is compliant to the ISO/IEC 14443-3 Type A standard.
A set of standard ISO/IEC 14443-3 Type A commands is implemented to operate the chip.
Additionally NFC Forum™ Type 2 Tag commands and a my-d™ move and my-d™ move NFC specific command
set is implemented. This facilitates the access to the on-chip integrated memory and supports the execution of
password and counter functionality.
Data Book
17 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
4
Memory Organization
The total amount of user memory is 152 byte. It is organized in blocks of 4 bytes each.
It comprises:
•
•
128 bytes for user data
24 bytes for UID, OTP, locking information, IC configuration and manufacturer information.
Additionally the Password and Password Retry Counter are allocated in non-addresable part of the memory and
are accessible via dedicated commands only.
Password protectable
Figure 7 shows the memory structure of the SLE 66R01P and SLE 66R01PN chip.
Serial number
00 H
uid0
uid1
uid2
BCC0
Serial number
01 H
uid3
uid4
uid5
uid6
Configuration /
Lock
02 H
BCC1
CONFIG
LOCK0
LOCK1
OTP
03 H
OTP0
OTP1
OTP2
OTP3
User Data
04 H
Data0
Data1
Data2
Data3
User Data
05 H
Data4
Data5
Data6
Data7
User Data
06 H
Data8
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
User Data
0FH
Data44
Data45
Data46
Data47
User Data
10 H
Data48
Data49
Data50
Data51
User Data
11 H
Data52
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
User Data /
Counter
User Data /
Counter
22 H
23 H
Data120 /
Counter
Data124 /
Counter
Data121 /
Counter
Data125 /
Counter
Data122 /
Counter
Data126 /
Counter
Data123 /
00 H
Data127 /
00 H
Lock
24 H
LOCK2
LOCK3
LOCK4
LOCK5
Manufacturer
25 H
MAN0
MAN1
MAN2
MAN3
Service
Area 1
User
Area 1
User
Area 2
Service
Area 2
PASSWORD
PASSWORD RETRY COUNTER
Figure 7
my-d™ move and my-d™ move NFC memory organization
4.1
User Memory Area 1 and 2
Blocks from address 04H to 23H belong to the User Memory Area (1 and 2). This part of the memory is readable /
writable as well as lockable against unintentional overwriting using a locking mechanism.
Moreover the User Memory Area 2 above the address 10H can be protected with a Password against unintentional
reading or reading/writing.
Data Book
18 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
4.2
Service Area 1 and 2
The Service Area 1 (block address 00H to 03H) contains
•
•
•
•
7-byte double-size UID (plus two bytes of UID BCC information)
Configuration Byte
LOCK0 and LOCK1 to lock the OTP block and blocks in User Area 1
32 bit OTP memory
The Service Area 2 (block address 24H to 25H) contains
•
•
LOCK2 - LOCK5 to lock blocks in User Area 2
Manufacturer Data
4.2.1
Unique Identifier (UID)
The 9 bytes of the UID (7 byte UID + 2 bytes BCC information) are allocated in Block 00H, Block 01H and Byte 1
of Block 02H of the my-d™ move and my-d™ move NFC memory. All bytes are programmed and locked during
the manufacturing process. These bytes cannot be changed.
For the content of the UID the following definitions apply:
•
SLE 66R01P and SLE 66R01PN support Cascade Level 2 UID according to the ISO/IEC 14443-3 Type A
which is a 7 byte unique number
The table below describes the content of the UID including the BCC information.
Table 5
UID Description
Cascade Level 2 - double-size UID
UID Byte
CT1)
uid02)
uid13)
uid2
BCC04)
uid3
uid4
uid5
uid6
BCC14)
1) CT is the Cascade Tag and designates CL2. It has a value of 88H. Please note that CT is hardwired and not stored in the
memory.
2) uid0 is the Manufacturer Code: 05H according to ISO/IEC 7816-6
3) uid1 is the Chip Family Identifier.
The higher significant nibble identifies a my-d™ move and my-d™ move NFC chip (0011B).
The lower significant nibble of uid1 is part of the serial number.
4) BCCx are the UID CLn checkbytes calculated as Exclusive-OR over the four previous bytes (as described in
ISO/IEC 14443-3 Type A). BCCx is stored in the memory and read-out during the anti-collision.
Data Book
19 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
4.2.2
Configuration Byte
The Configuration Byte defines the configurable functionality of the my-d™ move and my-d™ move NFC. It is
allocated in Byte 1 of Block 02H. At delivery all bits of the Configuration Byte are set to 0B. Note that the
Configuration Byte is One Time Programmable (OTP) byte. Bits allocated in this byte can only be logically set to
1B, which is an irreversible process i.e. bits can not be reset to 0B afterwards.
CONFIG
7
6
5
4
3
2
1
0
En_VC
PCN2
PCN1
PCN0
RFU
SP_RW
SP_W
CNF_BL
Figure 8
Configuration Byte
Table 6
Configuration Byte Definition
Configuration Bit
Configuration Byte Lock
Set Password for Write access
Set Password for Read and Write access
RFU
Abbreviation Description
CNF_BL
0B ... Configuration Byte programmable
1B ... Configuration Byte locked
SP-W
0B ... The Write Password is not active
1B ... The Write Password is active for Write
Commands which are applied to all blocks starting
from the address 10H
SP_WR
0B ... The Read and Write Password is not active
1B ... The Read and Write Password is active for
read, write and decrement commands for all
blocks above address 0FH
RFU
Reserved for the future use
Initial value of the Password Retry Counter
PCN2
PCN1
PCN0
000B ... Default setting
111B ... Maximal initial value (7D)
Password Retry Counter is only active if the initial
value is different than 0D.
16-bit Value Counter
En_VC
0B ... Value Counter is not configured, blocks 22H
and 23H are User Data blocks
1B ... Value Counter is set, blocks 22H and 23H are
reserved for the 16-bit Value Counter
Note: The CNF_BL bit is active immediately active after writing. To activate the new configuration of SP-W, SPWR and VCRN16 bits the execution of REQA or WUPA commands is required. The new value of the
Password Retry Counter (PCN2, PCN1 and PCN0 bits) is active immediately, i.e. is read each time the
information is required (during the execution of the Access command).
4.2.2.1
Locking Mechanism for the Configuration Byte
The my-d™ move and my-d™ move NFC is delivered with all bits of Configuration Byte set to 0B. The issuer
should define the functionality of a chip as required (set e.g. Write and/or Read/Write Password, the Password
Retry Counter, the 16-bit Value Counter etc.) and lock the Configuration Byte. Once the Configuration Byte is
locked no further changes to the Configuration Byte are possible.
Note: If all three BL Bits in the LOCK0 Byte are set to 1B, block 02H is locked. It is then not possible to change the
value of this particular block (02H) any more.
Data Book
20 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
4.2.3
Locking mechanism
Bytes LOCK0, LOCK1 allocated in Block 02H and LOCK2, LOCK3, LOCK4 and LOCK5 allocated in Block 24H
represent the one time field programmable bits which are used to lock the blocks in the specified address range
from block 03H (OTP Block) to 23H.
Each block in this range can be individually locked to prevent further write access. A locking mechanism of each
block is irreversible, i.e. once the locking information of a particular block (Lx) is set to 1B it can not be reset back
to 0B any more. Figure 9 illustrates the locking bytes with the corresponding locking bits.
Furthermore, it is possible to freeze the locking information of some memory areas by setting Block Locking (BL)
bits e.g. if the bit BL 15-10 is set to 1B then the locking information for the corresponding area (L10 to L15) is not
changeable any more. See the example in the Table 7 below.
Block 02H
Byte0
Byte1
Byte2
Byte3
BCC1
CONFIG
LOCK0
LOCK1
7
6
5
4
L
7
L
6
L
5
L
4
3
L
2
1
0
7
6
5
4
3
2
BL
BL
BL
9-4
OTP
L
15
L
14
L
13
L
12
L
11
L
10
7
6
5
4
3
2
1
0
0
L
35
L
34
L
33
L
32
2
1
0
OTP 15-10
7
6
5
4
3
2
1
0
L
31
L
30
L
29
L
28
L
27
L
26
L
25
L
24
Byte0
Byte1
Block 24H LOCK2 = 00H
0
0
Byte2
7
6
5
4
3
2
1
0
L
22
L
21
L
20
L
19
L
18
L
17
L
16
7
0
6
2
0
L
8
Byte3
LOCK3 = 00H LOCK4 = 00H
L
23
Figure 9
0
1
L
9
0
LOCK5 = 00H
5
1
0
4
0
0
3
BL
BL
BL
BL
35-31 30-26 25-21 20-16
Locking and Block Locking Mechanism
The Write One Block (WR1B) command should be used to set the locking or block locking information of a certain
block.
If WR1B is applied to Block 02H then:
•
•
the Byte 0 (BCC1) will not be changed
the Byte 1 (Configuration Byte) will be changed only if it is not locked
If WR1B is applied to Block 24H then:
•
•
the Byte2 [7..4] = Lock4[7..4] and
the Byte3 [7..4] = Lock5[7..4] will not be changed neither.
Data Book
21 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
The locking and block locking for a certain block is active immediately after writing. That means that it is not
necessary to execute the REQA or WUPA command in order to activate the locking.
Note: If all three BL bits in the LOCK0 byte are set to 1B then Block 02H is locked. It is not possible to change the
locking bits of this block any more. The same applies for block 24H. If BL bits of the LOCK5 byte are set to
1B then this block is locked. In this case the SLE 66R01P and SLE 66R01PN responds with NACK to a
corresponding Write command.
Table 7
Example for OTP Block Lock and Block Lock
BL OTP
L OTP
OTP BLOCK STATE
0B
0B
OTP Block Unlocked
0B
1B
OTP Block Locked
1B
0B
OTP Block Unlocked and can not be locked ever more
1B
1B
OTP Block Locked
An Anti-Tearing mechanism is implemented for Lock bytes on the SLE 66R01P and SLE 66R01PN. This
mechanism prevents a stored value to be lost in case of a tearing event. This increases the level of data integrity
and it is transparent to the customer.
4.2.4
OTP Block
The Block 03H is a One Time Programmable (OTP) Block. Bits allocated in this block can only be logically set to
1B, which is an irreversible process i.e. bits can not be reset to 0B afterwards.
The Write One Block (WR1B) command should be used to program a specific OTP value. Incoming data of the
WR1B command are bit-wise OR-ed with the current content of the OTP Block and the result is written back to the
OTP Block.
Table 8
Writing to OTP Block (block 03H) from the user point of view
OTP Block
Representation bit-wise
Description
Initial value
0000 0000 0000 0000 0000 0000 0000 0000B
Production setting
Write [55550003]H
0101 0101 0101 0101 0000 0000 0000 0011B
Bit-wise “OR” with previous content of
block 03H
Write [AA55001C]H
1111 1111 0101 0101 0000 0000 0001 1111B
Bit-wise “OR” with previous content of
block 03H
An Anti-Tearing mechanism is implemented for the OTP Block on the my-d™ move and my-d™ move NFC. This
mechanism prevents the stored value to be lost in case of a tearing event. This increases the level of data integrity
and is transparent to the customer.
4.2.5
Manufacturer Block (25H)
The Manufacturer Block is used to store the my-d™ move and my-d™ move NFC internal on-chip configuration
data and the manufacturing data such as Week and Year of production, Lot and Wafer Counter etc. This block is
programmed and locked at manufacturing.
Data Book
22 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
4.3
Memory Principle for NFC Forum™ Type 2 Tag
This section desribes how to map the my-d™ move and my-d™ move NFC memory into the memory structures
defined in the NFC Forum™ Type 2 Tag technical specification. This enables the usage of the my-d™ move and
my-d™ move NFC as a NFC Forum™ Type 2 Tag compatible chip.
4.3.1
NFC Forum™ Static Memory Structure
The Static Memory Structure is applied to a NFC Forum™ Type 2 Tag with a memory size equal to 64 bytes (see
Figure 10). Blocks 04H to 0FH are available to store user data.
Serial number
00 H
uid0
uid1
uid2
INTERNAL0
Serial number
01 H
uid3
uid4
uid5
uid6
Internal / Lock
02 H
INTERNAL1
INTERNAL2
LOCK0 = 00 H
LOCK1 = 00 H
Capability
Container
03 H
CC0 = E1 H
CC1 = 10 H
CC2 = 06H
CC3 = 00 H
NDEF TLV
Terminator TLV
04 H
NDEF message
TLV = 03 H
00 H
Terminator
TLV = FEH
Data3
User Data
05 H
...
...
...
...
User Data
06 H
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
User Data
0FH
...
...
Data46
Data47
Figure 10
Service
Area 1
User
Area 1
Static Memory Structure
The Static Memory Structure is characterized by the NDEF message TLV (03H) starting at block address 04H. The
NFC data shown in Figure 10 is an empty NDEF message (see Table 10).
Data Book
23 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
4.3.2
NFC Forum™ Dynamic Memory Structure
Password protectable
The Dynamic Memory Structure can be applied to NFC Forum™ Type 2 Tags with bigger memories than 64 bytes.
Figure 11 shows a generic memory layout with a Dynamic Memory Structure (based on the my-d™ move and
my-d™ move NFC chip).
Serial number
00 H
uid0
uid1
uid2
INTERNAL0
Serial number
01 H
uid3
uid4
uid5
uid6
Internal / Lock
02 H
INTERNAL1
INTERNAL2
LOCK0
LOCK1
Capability
Container
03 H
CC0
CC1
CC2
CC3
LockCtrl TLV2
LockCtrl TLV 3
LockCtrl TLV
04 H
LockCtrl TLV0
LockCtrl TLV 1
LockCtrl TLV /
MemCtrl TLV
MemCtrl TLV /
Empty NDEF
05 H
LockCtrl TLV4
MemCtrl TLV0
MemCtrl TLV1
MemCtrl TLV2
06 H
MemCtrl TLV3
MemCtrl TLV4
NDEF message
TLV
00 H
Terminator TLV
07 H
Terminator TLV
...
...
...
...
...
...
...
...
...
...
0FH
...
...
...
...
...
10 H
...
...
...
...
...
11 H
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
22 H
...
...
...
...
...
23 H
...
...
...
...
Lock
24 H
LOCK2
LOCK3
LOCK4
LOCK5
Reserved
25 H
Reserved
Reserved
Reserved
Reserved
Service
Area 1
User
Area 1
User
Area 2
Service
Area 2
PASSWORD
PASSWORD RETRY COUNTER
Figure 11
Generic NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N))
Compared to the Static Memory Structure the Dynamic Memory Structure is characterized by the NDEF message
TLV starting after the Lock Control TLV and Memory Control TLV (the Lock Control TLV starts at Block 04H).
Within a Dynamic Memory Structure dynamic lock bytes and reserved bytes might be located at any address in
the data area (see LOCK2 - LOCK5, Reserved shown in Figure 11). The location and the number of bytes used
for these purposes is defined by the settings of the Lock Control TLV respectively Memory Control TLV.
Following example for a Dynamic Memory Structure (shown in Figure 12) focusses on my-d™ move and
my-d™ move NFC.
Data Book
24 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Password protectable
Memory Organization
Serial number
00 H
uid0
uid1
uid2
INTERNAL0
Serial number
01 H
uid3
uid4
uid5
uid6
Internal / Lock
02 H
INTERNAL1
INTERNAL2
LOCK0 = 00 H
LOCK1 = 00 H
Capability
Container
03 H
CC0 = E1H
CC1 = 10 H
CC2 = 10 H
CC3 = 00 H
LockCtrl TLV
04 H
LockCtrl TLV /
MemCtrl TLV
MemCtrl TLV /
Empty NDEF
05 H
LockCtrl
TLV1 = 03 H
MemCtrl
TLV0 = 02 H
MemCtrl
TLV4 = 04 H
LockCtrl
TLV2 = 90 H
MemCtrl
TLV1 = 03 H
NDEF message
TLV = 03 H
LockCtrl
TLV3 = 14 H
MemCtrl
TLV2 = 93 H
Terminator TLV
07 H
LockCtrl
TLV0 = 01 H
LockCtrl
TLV4 = 24 H
MemCtrl
TLV3 = 05 H
Terminator
TLV = FE H
...
...
...
...
...
...
...
...
...
...
0FH
...
...
...
...
...
10 H
...
...
...
...
...
11 H
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
22 H
...
...
...
...
...
23 H
...
...
...
...
Lock /
Reserved
24 H
LOCK2
LOCK3
LOCK4
Reserved0
Reserved
25 H
Reserved1
Reserved2
Reserved3
Reserved4
06 H
00 H
Service
Area 1
User
Area 1
User
Area 2
Service
Area 2
PASSWORD
PASSWORD RETRY COUNTER
Figure 12
Example of a NFC Forum™ Type 2 Tag dynamic memory layout (based on SLE 66R01P(N))
If a NFC Forum™ Type 2 Tag compliant chip with Lock Control TLV and Memory Control TLV is required, NFC
Forum™ Type 2 Tag specific data such as Capability Container, Lock Control TLV, Memory Control TLV, NDEF
Message and Terminator TLV should be written to the memory according to the given hardware configuration.
Figure 12 holds valid Lock Control TLV and the Memory Control TLV settings within a Dynamic Memory Structure
specially suited for the my-d™ move and my-d™ move NFC devices. For my-d™ move and my-d™ move NFC
the position of the static and dynamic lock bytes is hard-wired and it is not possible to change their position in the
memory.
•
•
Static lock bytes LOCK0 and LOCK1 are allocated in block 2, bytes 2 and 3. LOCK0 and LOCK1 are used to
lock blocks from address 00H to 0FH.
Dynamic lock bytes LOCK2 to LOCK5 are allocated in block 24H. These LOCKx bytes are used to lock blocks
starting from address 10H. The position and the number of dynamic lock bits is coded into the Lock Control TLV
as shown above. In this example 20 lock bits are required to lock the User Memory blocks 10H to 23H.
Furthermore the Memory Control TLV defines the location and number of reserved bytes in the memory.
Data Book
25 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
4.4
Transport Configuration
Figure 11 shows the memory principle of SLE 66R01P and SLE 66R01PN. Following sections provide details
about the initial memory content of these devices.
4.4.1
Transport Configuration my-d™ move
Password protectable
The transport configuration of SLE 66R01P contains following information:
Serial number
00 H
uid0
uid1
uid2
BCC0
Serial number
01 H
uid3
uid4
uid5
uid6
Configuration /
Lock
02 H
BCC1
CONFIG = 00 H
LOCK0 = 00 H
LOCK1 = 00 H
OTP
03 H
OTP0 = 00 H
OTP1 = 00 H
OTP2 = 00 H
OTP3 = 00 H
User Data
04 H
00 H
00 H
00 H
00 H
...
05 H
...
...
...
...
...
06 H
...
...
...
...
...
07 H
...
...
...
...
...
...
...
...
...
...
User Data
0FH
...
...
...
...
User Data
10 H
...
...
...
...
...
11 H
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
22 H
...
...
...
...
User Data
23 H
...
...
...
...
Lock
24 H
LOCK2 = 00 H
LOCK3 = 00 H
LOCK4 = 00 H
LOCK5 = 00 H
Manufacturer
25 H
MAN0
MAN1
MAN2
MAN3
Service
Area 1
User
Area 1
User
Area 2
Service
Area 2
PASSWORD
PASSWORD RETRY COUNTER
Figure 13
•
•
•
•
my-d™ move Transport Configuration
Service Area 1 contains
– predefined UID (incl. BCC bytes); read-only
– CONFIG, LOCK0, LOCK1 set to 00H
– LOCK0, LOCK1 set to 00H
– OTP0 - OTP3 set to 00H
User Area 1
– all Data bytes set to 00H
User Area 2
– all Data bytes set to 00H
Service Area 2 contains
Data Book
26 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
•
•
– LOCK2 - LOCK5 set to 00H
– Manufacturer Data; read-only
Password set to 00H 00H 00H 00H
Password Retry Counter
– deactivated by the setting of the CONFIG byte
The SLE 66R01P may be configured to INITIALIZED state according to the definition to the NFC Forum™ Type 2
Tag life cycle by writing
•
•
Capability Container bytes (see Table 9) to Block 03H
empty NDEF message TLV incl. Terminator TLV (see Table 10) to Block 04H
4.4.2
Transport Configuration my-d™ move NFC
Password protectable
SLE 66R01PN is delivered in INITIALIZED state (life cycle) according to the NFC Forum™ Type 2 Tag
specification.
Serial number
00 H
uid0
uid1
uid2
BCC0
Serial number
01 H
uid3
uid4
uid5
uid6
Configuration /
Lock
Capability
Container
02 H
BCC1
CONFIG = 00 H
LOCK0 = 00 H
LOCK1 = 00 H
03 H
CC0 = E1H
CC1 = 10 H
CC2 = 10 H
CC3 = 00 H
Empty NDEF /
Terminator TLV
04 H
NDEF message
TLV = 03 H
00 H
Terminator
TLV = FE H
00 H
...
05 H
00 H
00 H
00 H
00 H
...
06 H
...
...
...
...
...
07 H
...
...
...
...
...
...
...
...
...
...
...
0FH
...
...
...
...
...
10 H
...
...
...
...
...
11 H
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
22 H
...
...
...
...
...
23 H
...
...
...
...
Lock
24 H
LOCK2 = 00 H
LOCK3 = 00 H
LOCK4 = 00 H
LOCK5 = 00 H
Manufacturer
25 H
MAN0
MAN1
MAN2
MAN3
Service
Area 1
User
Area 1
User
Area 2
Service
Area 2
PASSWORD
PASSWORD RETRY COUNTER
Figure 14
•
my-d™ move NFC Transport Configuration
Service Area 1 contains
– predefined UID, read-only
– CONFIG, LOCK0 and LOCK1 set to 00H
Data Book
27 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Memory Organization
•
•
•
•
•
– OTP0 - OTP3 contains the CAPABILITY CONTAINER (see Table 9)
User Area 1:
– contains empty NDEF message TLV including Terminator TLV (= FEH) as indicated in Table 10
– all other data bytes set to 00H
User Area 2
– all data bytes set to 00H
Service Area 2 contains
– LOCK2 - LOCK5 set to 00H
– Manufacturer Data; read-only
Password set to 00H 00H 00H 00H
Password Retry Counter
– deactivated by the setting of the CONFIG byte
Table 9
Capability Container settings for my-d™ move and my-d™ move NFC
Chip Type
CC0
SLE 66R01PN
E1H
CC11)
CC22)
CC3
10H
10H
00H
(may be changed to
11H if needed)
1) my-d™ move and my-d™ move NFC also support Version 1.1 of the NFC Forum™ Type 2 Tag specification.
2) CC2 indicates the memory size of the data area of the Type 2 Tag; the given values represent the maximum values for the
chips
Table 10 defines the empty NDEF Message TLV (identified with the Tag field value of 03H). The Length field value
is set to 00H; due to that the Value field is not present.
The Terminator TLV (FEH) is the last TLV block in the data area.
Table 10
Empty NDEF message
NDEF Message TLV
Terminator TLV
Tag field
Length field
Value field
Tag Field
Length field
Value field
03H
00H
-
FEH
-
-
Note: The pre-configuration of SLE 66R01PN is nonreversible and the my-d™ move NFC cannot be overwritten
and used as plain, standard my-d™ move anymore.
Data Book
28 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Password
5
Password
An issuer can protect the blocks above address 0FH with a 32 bit Write and/or Read/Write Password by enabling
the password functionality.
The issuer can enable the password functionality by setting the Bit 1 (SP-W) of the Configuration Byte1) for Write
Password access and/or bit 2 (SP-WR) of the Configuration Byte for Read/Write Password access (see
Chapter 4.2.2).
The new configuration is activated after the next transition to IDLE/HALT state is executed.
The my-d™ move and my-d™ move NFC is delivered without Password protection i.e. default value of the SP-W
and SP-WR bits is 0B.
Table 11
Access Rights
SP-WR
SP-W
Access Right
0B
0B
Read Plain / Write Plain (default setting)
0B
1B
Read Plain / Write Protected
1B
xB
Read Protected / Write Protected
There is only one 32-bit Password value for both read and/or read/write access.
5.1
Password Block
The Password Block holds 32 bit of Password data and is stored in a memory location which is accessible with
dedicated commands only. The initial value of the Password Block is 00H 00H 00H 00H and should be changed after
delivery. The Set Password SPWD2) command is used to change the content of the Password Block.
•
•
If the my-d™ move and my-d™ move NFC is not configured for a password protection i.e. bits for SP-W or SPWR are not set, the Password Block will be overwritten with new Password data.
If the my-d™ move and my-d™ move NFC is configured for password protection i.e. if SP-W and/or SP-WR
bits are set, the Password Block will be overwritten with new Password data only after the chip has been
successfully verified with the Access ACS3) command.
5.2
Password Retry Counter
A Password Retry Counter counts the number of incorrect accesses to a password protected my-d™ move and
my-d™ move NFC. The number of incorrect accesses can be predefined by setting the bits [6:4] of the
Configuration Byte. This number is called the initial value of the Password Retry Counter.
The Password Retry Counter is active if the number of incorrect accesses is higher than 0D i.e. bit[6:4] of the
Configuration Byte are NOT all set to zero. The Write One Block (WR1B) command should be used to overwrite
the Password Retry Counter value. The Initial value of the Password Retry Counter is active immediately after it
is written.
To prevent any further changes on a predefined Password Retry Counter value it is recommended to lock the
Configuration Byte. Once the Configuration Byte is locked, the status of an initial counter value is locked, i.e. are
no further changes to these bits are possible.
The my-d™ move and my-d™ move NFC is delivered with a disabled Password Retry Counter i.e. the Initial value
of the Password Retry Counter is equal to 000b. The maximum value of the Password Retry Counter is 7D, and
valid values which activate the usage of the Password Retry Counter are in the range from 1D to 7D.
1) For more information about Configuration Byte see Section 4.2.2.
2) For more information about SPWD command see Section 8.2.6
3) For more information about ACS command see Section 8.2.7
Data Book
29 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Password
Figure 15 shows how to configure the Password functionality on the my-d™ move and my-d™ move NFC.
IDLE/HALT
IDLE/HALT
Proceed with Anticollision and
Selection and go to ACTIVE state
Proceed with Anticollision and
Selection and go to ACTIVE state
……...
……...
Change the current
Password (execute the
command
SET_PASSWORD )
Perform password
authentication on the
my-dTM move
(execute the command
ACCESS )
Set Read/Write and/or
Write Password
Configuration (SPWR
and SPRWR bits)
Change the current
password (execute the
command
SET_PASSWORD )
Set the Inital Value of
the Password Counter
(PCN0, PCN1 & PCN2)
Do session transaction if
desired i.e. process the
protected or unprotected
data
Lock the Configuration
Byte (CNF_BL bit) to
prevent any further
configuration al changes
To activate the new
Password go back to
IDLE/HALT mode
ACTIVE
To activate new
configura tion go back
to IDLE/HALT mode
ACTIVE
How to set the Password and the Password
Configuration
Figure 15
Data Book
How to change a current Password in running
session
Password and Password Retry Counter configuration
30 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Password
5.3
Anti-tearing Mechanism for Password Retry Counter
The Password Retry Counter block is stored in the non-directly accessible part of the memory and for data
protection reasons stored redundantly (anti-tearing). This mechanism prevents a stored value of being lost in case
of a tearing event. This increases the level of data integrity and is transparent to the customer.
During the execution of the Access command the my-d™ move and my-d™ move NFC performs the following
actions:
•
•
compares the incoming Password and the Password stored in the my-d™ move and my-d™ move NFC
Pass Retry Counter enabled:
– resets the Password Retry Counter if the password matches. The my-d™ move and my-d™ move NFC
responds with an ACK
– increments the Password Retry Counter if the passwords do not match and if the Password Counter has not
reached the highest possible value and my-d™ move and my-d™ move NFC responds with a NACK
– if the Password Retry Counter has already reached the highest possible value (Initial Password Retry
Counter value), then no further increase is done. The my-d™ move and my-d™ move NFC responds with
a NACK.
Depending on the setting of the access bits the access to the memory above block 0FH is granted:
SP-W = 1B: read access only, no write access
SP-RW = 1B: no read and no write access
Data Book
31 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
16-bit Value Counter Functionality
6
16-bit Value Counter Functionality
The Value Counter is a 16-bit value, which provides a mechanism to store some value (points, money…) on a
my-d™ move and my-d™ move NFC chip. Normally it is only possible to decrement this value, however if certain
conditions are met it is also possible to reload the counter to an arbitrary 16-bit value. The availability of the Value
Counter in the my-d™ move and my-d™ move NFC is configurable by setting the bit 7 of the Configuration Byte.
6.1
Value Counter Format
If configured two 4-byte blocks, 22H and 23H, are reserved for the storage of the Value Counter value. The
my-d™ move and my-d™ move NFC supports the detection of an interrupted or corrupted (teared) counter
programming operation of the Value Counter. For the purpose the concept of redundant saving of the Value
Counter as well as temporarily double saving of the Value Counter value during the programming process is
implemented.
The redundant saving means, that the Value Counter is represented in the dedicated block by a 3-byte value:
Counter LSB, inverted Counter LSB and Counter MSB. The fourth byte of the block is not used for the counter and
carries 00H data. Counter LSB carries the lower value and Counter MSB carries the higher value of the Value
Counter in hexadecimal representation.
Value Counter Format
Counter LSB
__________
Counter LSB
Counter MSB
00H
1. Read counter blocks (RD2B command):
valid Counter
correct
counter state
FFH FFH FFH FFH
2. Decrement command
Debit value
3. my-d™ move (NFC) response:
FFH FFH FFH FFH
valid Counter (new value)
Figure 16
Data Book
correct
counter state
Value Counter - Principle
32 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
16-bit Value Counter Functionality
For an example: the value 1000D = 03E8H -> Value Counter LS Byte = E8H and Value Counter MS Byte = 03H.
The Value Counter block looks like: Byte3 .. Byte0 = 000317E8H; where 00H represents the data in byte3.
The temporarily double saving means that Value Counter is stored twice in two different memory blocks. Figure 17
shows an example for the Value Counter representation and the decrementing of the value 1000D by 1D.
During the programming process of the new Value Counter, one block holds the current valid value and the other
block is used to write the new counter value. At the end of programming cycle the current valid value, becomes
an invalid value while it is erased (all bytes set to FFH) and the other one holds the new valid value.
Value Counter decrement example
1st step
Block
22 H
Block
23 H
valid counter
(start value)
E8 H
17 H
03 H
00H
FFH
FFH
FFH
FFH
E8 H
17 H
03 H
00H
E7 H
18 H
03 H
00H
FFH
FFH
FFH
FFH
erase
E7H
18 H
03 H
00H
valid counter
(new value)
2nd step
Block
22 H
Block
23 H
valid counter
(start value)
valid counter
(new value)
3rd step
Block
22 H
Block
23 H
Figure 17
Value Counter decrement example
6.2
Loading and Reading of Value Counter
Loading of the Value Counter is done by either:
•
•
•
Using WR2B command to address 22H:
– [A1H] [22H] [CNT0H, CNT0H, CNT1H, 00H, FFH, FFH, FFH, FFH] [CRC0H, CRC1H]
Using two WR1B commands to address 22H and 23H:
– [A2H] [22H] [CNT0H,CNT0H,CNT1H, 00H] [CRC0H, CRC1H]
– [A2H] [23H] [FFH,FFH,FFH,FFH] [CRC0H, CRC1H]
It is also possible to use Compatibility Write command to initialize the counter, but this is not recommended.
It is crucial to initialize both Value Counter blocks for the correct counter operation.
Reading of Value Counter is done by either:
•
•
•
Using RD2Bcommand to addresses 22H:
– [31H] [22H] [CRC0H, CRC1H]
Using RD4B command to addresses 22H:
– [30H] [22H] [CRC0H, CRC1H]
Using DCR16 command with parameter 0000H:
– [D0H] [0000H] [CRC0H, CRC1H]
Data Book
33 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
16-bit Value Counter Functionality
6.3
Decrementing Value Counter and Anti-Tearing
The DCR16 command is used to decrement the Value Counter value. For more details refer to the command
description in the Chapter 8.2.8.
During the execution of the DCR16 command the my-d™ move and my-d™ move NFC performs following
actions:
•
•
•
Read both Value Counter blocks;
Determine the correct valid Value Counter state. Therefore the values stored in blocks 22H and 23H are
compared.
– Normally one of the counter value blocks is erased or has an incorrect format and the other block holds the
valid counter value.
– If both counter values are correctly formatted, the higher value is chosen as the valid counter value.
Note that at least one of the counters must be formatted correctly. Otherwise the Value Counter block is
corrupted and no further decrement of the Value Counter is possible.
– If both blocks carry invalid values (incorrect format) no further decrement of Value Counter is possible. The
my-d™ move and my-d™ move NFC then responds with a NACK.
Compares the received parameter and the valid counter value.
– If the received parameter is equal or lower than the valid counter value the my-d™ move and my-d™ move
NFC decrements the valid value by the received parameter, programs this value to the previous invalid
value, erases the previous valid value and replies the new written value.
– If the received parameter is higher then the valid value no decrement is possible and the my-d™ move and
my-d™ move NFC responds with a NACK
6.4
Protection Mechanisms for the Value Counter
The my-d™ move and my-d™ move NFC offers some methods to protect the Value Counter. Following measures
should be considered to prevent unauthorized changes.
•
•
•
•
The Password:
– If a Write Password is configured i.e. the bit SP-W is set, then the execution of Write commands (WR1B,
WR2B or CPTWR) on Value Counter blocks (22H and 23H) is possible only after password verification.
– If a Read/Write Password is configured i.e. the bit SP-WR is set, then the execution of Read commands
RD2B and RD4B and Decrement command DCR16 on Value Counter (blocks 22H and 23H) is possible only
after password verification.
The Locking Mechanism for Value Counter:
– After the configuration of the Value Counter it is strongly recommended to lock both blocks 22H and 23H in
order to prevent the any unauthorized changes. The locking of blocks 22H and 23H is done by changing the
locking information of the LOCK4 byte. If the bits 2 and 3 of the Lock4 byte are set then both Value Counter
blocks are locked.
Writing of the Value Counter block:
– If blocks 22H and 23H are locked then no further overwriting of their values with write commands is possible.
Note that if one of the blocks is locked and the other one is not, then it is possible to change the data of the
unlocked block by using WR1B command. For this reason it is important to lock both blocks in order to
prevent unintentional harm to Value Counter (i.e. unintentional overwriting or setting an incorrect value or a
value with an incorrect format).
Reading and Decrement of the Value Counter block:
– If blocks 22H and 23H are locked then reading and decrementing is still possible. Note that depending on the
chip configuration, password verification may be required.
Data Book
34 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Communication Principle
7
Communication Principle
This chapter describes the functionality of the SLE 66R01P and SLE 66R01PN.
7.1
Communication between a card (PICC) and a reader (PCD)
It is recommended to read the ISO/IEC 14443-3 Type A and NFC Forum™ Type 2 Tag specifications in
conjunction with this document in order to understand the communication protocol as well as the functionality of
the SLE 66R01P and SLE 66R01PN as it is based on these specifications.
7.2
State Diagram
The SLE 66R01P and SLE 66R01PN is fully compliant to ISO/IEC 14443-3 Type A. All operations on this IC are
initiated by an appropriate reader and controlled by the internal logic of the my-d™ move and my-d™ move NFC.
Prior to any memory access the card has to be selected according to the ISO/IEC 14443-3 Type A. If the
my-d™ move and my-d™ move NFC is configured to be password protected, a password verification is required
to access the memory.
The following figure presents the state diagram of SLE 66R01P and SLE 66R01PN.
If an unexpected command is received, the chip always returns to IDLE or HALT state, depending from which path
it came from (the red paths in the state diagram).
7.2.1
IDLE/HALT State
After Power On, the SLE 66R01P and SLE 66R01PN is in IDLE state.
If REQA or WUPA is executed in this state, the SLE 66R01P and SLE 66R01PN transits to READY1 state. Any
other command is interpreted as an error and the chip stays in IDLE state without any response.
If the HLTA command is executed in ACTIVE/ACTIVE* State, the SLE 66R01P and SLE 66R01PN will transit to
HALT state. The HALT state can be left only if the chip receives a WUPA command. Any other command is
interpreted as an error and the SLE 66R01P and SLE 66R01PN stays in the HALT state without any response.
7.2.2
READY1/READY1* State
In READY1/READY1* state the first part of the UID can be resolved by using ISO/IEC 14443-3 Type A
anticollision and/or Select commands.
After the Select command is executed properly the IC transits to READY2/READY2* state in which the second
part of the UID can be resolved. The answer to a Select command in READY1/READY1* state is Select
Acknowledge (SAK) for cascade level 1, which indicates that the UID is incomplete and the next cascade level has
to be started to resolve the whole UID (see also ISO/IEC 14443-3 Type A).
However the SLE 66R01P and SLE 66R01PN can directly transit from READY1/ READY1* state to
ACTIVE/ACTIVE* state if a read command RD2B or R4BD with a valid address is executed. Note if more than one
SLE 66R01P and SLE 66R01PN is in the reader field, all ICs are selected after the execution of the read
command, although all of them have different UIDs.
Any other command or any other interruption is interpreted as an error and the SLE 66R01P and SLE 66R01PN
returns back to IDLE or HALT state without any response, depending from which state it has come from.
7.2.3
READY2/READY2* State
In READY2/READY2* state the second part of the UID can be resolved using ISO/IEC 14443-3 Type A
anticollision and/or Select commands.
After the Select command is executed properly the IC transits to ACTIVE/ACTIVE* state in which memory can be
accessed. The answer to a Select command in READY2/READY2* state is SAK for cascade level 2, which
indicates that the UID is complete and the selection process is finished.
Data Book
35 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Communication Principle
However the SLE 66R01P and SLE 66R01PN can directly transit from READY2/READY2* state to
ACTIVE/ACTIVE* state if a read command RD2B or RD4B is executed. Any valid block address can be used in
the read command. Note if more than one SLE 66R01P and SLE 66R01PN is in the reader field, all ICs are
selected after the execution of the read command, although all of them have different UIDs.
Any other command or any other interruption is interpreted as an error and the SLE 66R01P and SLE 66R01PN
returns back to IDLE or HALT state without any response, depending from which part it has come from.
7.2.4
ACTIVE/ACTIVE* State
In the ACTIVE/ACTIVE* state memory access commands can be executed.
If a SLE 66R01P and SLE 66R01PN is configured to have read/write or write password protection, a password
verification is required to access the protected memory pages. In case of a successful password verification,
read/write access to the whole memory is possible. If no verification is done or the password verification fails, the
memory area above block 0FH is locked according to the access rights in the Configuration Byte.
The ACTIVE/ACTIVE* state is left if the HLTA command is executed properly; the SLE 66R01P and
SLE 66R01PN then transits to HALT state and waits until a WUPA command is received.
If any error command is received, the SLE 66R01P and SLE 66R01PN sends “No Response” (NR) or “Not
Acknowledge” (NACK) and transits to IDLE or HALT state, depending from which state it has come from.
7.2.5
HALT State
The HLTA command sets the SLE 66R01P and SLE 66R01PN in the HALT state. The SLE 66R01P and
SLE 66R01PN sends no response to the HLTA command. In the HALT state the IC can be activated again by a
Wake-UP command (WUPA).
Any other data received is interpreted as an error, the SLE 66R01P and SLE 66R01PN sends no response and
remains in HALT state.
The exact behavior of a particular command in any of the states above is also described in the specific command
description.
Data Book
36 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Communication Principle
7.3
Start up
120 µs after entering the powering field (after the field reset) the SLE 66R01P and SLE 66R01PN is ready to
receive a command. If a command is send earlier, the response to this command is not defined.
7.3.1
Start-up sequence of the SLE 66R01P and SLE 66R01PN
Each time after the execution of a REQA or WUPA, the SLE 66R01P and SLE 66R01PN reads the Configuration
Byte and sets its internal states accordingly, see also the Figure 18. This information is not updated until the next
execution of REQA or WUPA commands in IDLE or HALT state even when the CONFIG byte is changed in the
EEPROM.
POWER ON
Wait for 100µs
HALT
IDLE
WUPA
REQA, WUPA
Read Configuration Byte
(Block 2, Byte 1)
READY1/READY1*
Proceed with Anticollision and
Selection
Figure 18
Start-up Sequence
7.4
Frame Delay Time
For information about Frame Delay Time (FDT), please refer to ISO/IEC 14443-3 Type A Specification.
Generally the FDT is measured between the last rising edge of the pause transmitted by the PCD and the falling
edge of the first load modulation within the start bit transmitted by the my-d™ move and my-d™ move NFC. If
more then one ISO/IEC 14443-3 Type A compatible chip is in the operating field of the reader all of them must
respond in a synchronous way which is needed for the anticollision procedure.
For detailed timings see Table 1 of ISO/IEC 14443-3 Type A Specification.
Data Book
37 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Communication Principle
Note: The response timing of a particular SLE 66R01P and SLE 66R01PN command is given in the specific
command description. However, the timing values are rounded and are not on a grid according the
ISO/IEC 14443-3 Type A.
7.5
Error Handling
The SLE 66R01P and SLE 66R01PN responds to valid frames only. The table below describes the behavior for
different error cases.
Table 12
Behavior in case of an Error
Current States
Command or Error
Response
SLE 66R01P and
SLE 66R01PN
Next State
IDLE/HALT
READY1/READY1*
READY2/READY2*
Invalid Opcode
NR1)
IDLE/HALT2)
Parity, Miller Error, CRC
NR
IDLE/HALT
Command too short or too long NR
IDLE/HALT
Invalid Address
NR
IDLE/HALT
Other Errors
NR
IDLE/HALT
Invalid Opcode
NR
IDLE/HALT
Parity, Miller Error, CRC
NACK1
IDLE/HALT
ACTIVE/ACTIVE*
Command too short or too long NR
IDLE/HALT
Invalid Address
NACK0
IDLE/HALT
Other Errors
NACK0
IDLE/HALT
1) RD4B and RD2B commands in READY1/READY1* and READY2/READY2* exceptionally behave as in
ACTIVE/ACTIVE* state.
2) The SLE 66R01P and SLE 66R01PN returns to IDLE or HALT state depending on the state where it has come
from.
Data Book
38 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8
Command Set
8.1
Supported ISO/IEC 14443-3 Type A Command Set
The following table describes the ISO/IEC 14443-3 Type A command set which is supported by the SLE 66R01P
and SLE 66R01PN.
For a detailed command description refer to the ISO/IEC 14443-3 Type A functional specification.
Table 13
ISO/IEC 14443-3 Type A Command Set
Command
Abbreviation Op-Code
Description
Request A
REQA
26H
Short Frame Command Type A request to all ISO/IEC 144433 Type A compatible chips in IDLE State
Wake Up A
WUPA
52H
Short Frame Command,Type A Wake Up request to all
ISO/IEC 14443-3 Type A compatible chips
Anticollision
AC
93H NVBH
95H NVBH
Cascade level 1 with the Number of Valid Bits
Cascade level 2 with the Number of Valid Bits
Select
SELA
93H 70H,
95H 70H
Select the UID of Cascade level 1
Select the UID of Cascade level 2
HaltA
HLTA
50H
Set a chip to a HALT State
Important remark: The parameter field of the HLTA command
represents the valid address range which is 00H -25H.
8.2
Memory Access Command Set
The command set of the SLE 66R01P and SLE 66R01PN comprises the NFC Forum™ Type 2 Tag commands
as well as proprietary commands which are additionally implemented to increase data transaction time and
increase the protection of the data stored in the memory.
The following table lists the memory access command set of the SLE 66R01P and SLE 66R01PN.
Table 14
my-d™ move and my-d™ move NFC memory access command set
Command
Abbreviation Op-Code Description
1)
RD4B
30H
This command reads 16 bytes data out of the memory starting from
the specified address.
A Roll-Back mechanism is implemented:
- if block 0FH is reached the read continues from block 00H
- if block 25H is reached the read continues from block 00H
WR1B
A2H
If write access is granted, this command programs 4 bytes data to
the specified memory address.
Compatibility
CPTWR
Write Command
A0H
This command sends 16 bytes to the SLE 66R01P and
SLE 66R01PN but writes only the first 4 bytes of the incoming data
to the specified memory address.
Read 2 Blocks3) RD2B
31H
This command reads 8 bytes out of the memory, starting from the
specified address. A Roll-Back mechanism is implemented:
- if block 0FH is addressed, the read continues from block 00H
- if block 25H is addressed, the read continues from block 00H
Read 4 Blocks
Write 1 Block2)
Data Book
39 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
Table 14
my-d™ move and my-d™ move NFC memory access command set
Command
Abbreviation Op-Code Description
Write 2 Blocks
WR2B
A1H
If write access is granted, this command writes 8 bytes to the
specified address memory. Note that the programming time is 4ms.
Set Password
SPWD
B1H
This command sets the 4 byte password to the my-d™ move and
my-d™ move NFC.
Access4)
ACS
B2H
This command verifies the password of the my-d™ move
my-d™ move NFC.
Decrement
DCR16
D0H
This command decrements an existing Value Counter value to a
lower value and writes the result to the Value Counter block.
1) NFC Forum™ Type 2 Tag Read Command
2) NFC Forum™ Type 2 Tag Write Command
3) By using RD2B and WR2B commands, total user memory of 128 bytes can be written and re-read within approximately 100
ms (excluding anti-collision and taking into account a short reader turnaround time, less then 100 µs).
4) If the my-d™ move and my-d™ move NFC is configured to use a write or read/write password, the appropriate memory
access operations are possible only after password verification.
Data Book
40 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.1
Read 4 Blocks (RD4B)
RD4B command reads 16 bytes data out of the memory starting from the specified address.
The Valid Address Range is 00H to 25H.
If any other address is specified the SLE 66R01P and SLE 66R01PN responds with a NACK. A roll back
mechanism is implemented:
•
•
if e.g. block 0EH is addressed blocks 0EH, 0FH, 00H and 01H are replied
if e.g. block 25H is addressed blocks 25H, 00H, 01H and 02H are replied
Table 15
Read 4 Blocks (RD4B)
Command Code Parameter
Length
4 bytes
30H
Data
Integrity
Mechanism
Valid Address Range n.a.
00H - 25H
ISO/IEC 14443 Type A Reader
Response
2 bytes CRC
16 bytes data
(1 parity bit per byte) + 2 bytes CRC or
NACK or NR
PICC Response
Command ‚Read 4 Blocks’
30H
ADR
CRC0 CRC1
D0
D1
…
D15
CRC0 CRC1
NACK
56µs
358 µs
min.
86µs
1550µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 19
Data Book
Read 4 Blocks Command
41 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.2
Write 1 Block (WR1B)
If the write access is granted the WR1B command is used to program 4 bytes of data to the specified address in
the memory. This command should be used to program OTP block and Locking Bytes as well.
The Valid Address Range is from 02H to 24H. If any other address is specified the SLE 66R01P and SLE 66R01PN
responds with a NACK.
Table 16
Write 1 Block (WR1B)
Command
Length
Code Parameter
8 bytes
A2H
Data
Integrity
Mechanism
Valid Address Range 4 bytes data
02H - 24H
Response
2 bytes CRC
ACK or
(1 parity bit per byte) NACK or
NR
ISO/IEC 14443 Type A Reader
PICC Response
Command ‚Write 1 Block’
A2H
ADR
D0
D1
D2
D3
CRC0 CRC1
ACK
NACK
min.
86µs
708µs
56µs
4235 µs
56µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 20
Data Book
Write 1 Block Command
42 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.3
Compatibility Write Command (CPTWR)
If the write access is granted only the four least significant 4 bytes are written to the specified address. The
remaining bytes will be ignored by the SLE 66R01P and SLE 66R01PN. It is recommended to set the remaining
bytes 04H-0FH to 00H.
Table 17
Compatibility Write (CPTWR)
Command
Length
Code Parameter
20 bytes
A0H
Data
Integrity
Mechanism
Valid Address Range 16 bytes data
02H - 24H
Response
2 bytes CRC
ACK or
(1 parity bit per byte) NACK or
NR
ISO/IEC 14443 Type A Reader
2nd part of the command
Command ‚Compatibility Write’
A0H
ADR
CRC0 CRC1
D0
D1
...
D15
CRC0 CRC1
PICC
Response
PICC
Response
ACK
ACK
56µs
NACK
NACK
358µs
min.
86µs
min.
86µs
56µs
1550 µs
56µs
4235µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 21
Data Book
Compatibility Write Command
43 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.4
Read 2 Blocks (RD2B)
RD2B command reads 8 bytes out of the memory, starting from the specified address.
The Valid Address Range is from 00H to 25H. If any other address is specified the SLE 66R01P and SLE 66R01PN
responds with a NACK. A roll back mechanism is implemented:
•
•
if e.g. block 0FH is addressed blocks 0FH and 00H are replied.
if e.g. block 25H is addressed blocks 25H and 00H are replied.
Table 18
Read 2 Block (RD2B)
Command Code Parameter
Length
4 bytes
31H
Data
Integrity
Mechanism
Valid Address Range n.a.
00H - 25H
ISO/IEC 14443 Type A Reader
Response
2 bytes CRC
8 bytes data
(1 parity bit per byte) + 2 bytes data CRC
or
NACK
PICC Response
Command ‚Read 2 Blocks’
31H
ADR
CRC0 CRC1
D0
D1
…
D7
CRC0 CRC1
NACK
56µs
358 µs
min.
86µs
868 µs
Please note : Timing is rounded i .e. it is not exact grid timing
Figure 22
Data Book
Read 2 Blocks Command
44 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.5
Write 2 Blocks (WR2B)
If write access is granted, i.e. if both addressed blocks are writable, the WR2B command is used to program two
blocks (8 bytes of data) to the specified address in the memory.
The Valid Address Range is 04H-22H. Only even start addresses are allowed. If any other address is specified, the
SLE 66R01P and SLE 66R01PN responds with a NACK.
The WR2B command has the same programming time (approximately 4ms) for writing 8 bytes as the WR1B
command which writes 4 bytes of data to the specified memory.
Table 19
Write 2 Block (WR2B)
Command Code Parameter
Length
12 bytes
A1H
Data
Integrity
Mechanism
Valid Address Range 8 bytes data
04H - 22H; only even
start addresses
allowed
Response
2 bytes CRC
ACK or
(1 parity bit per byte) NACK or
NR
ISO/IEC 14443 Type A Reader
PICC Response
Command ‚Write 2 Blocks’
A1H
ADR
D0
D1
...
D7
CRC0 CRC1
ACK
NACK
min.
86µs
1038 µs
56µs
4235 µs
56µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 23
Data Book
Write 2 Blocks Command
45 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.6
Set Password (SPWD)
The SPWD command writes a new 4 byte password to the dedicated password memory1). The new written value
is transmitted in the response.
The SPWD command is always active independently of password configuration. If the SLE 66R01P and
SLE 66R01PN is configured for password protection, then the SPWD command can be executed only after a
successful password verification.
Table 20
Set Password (SPWD)
Command Code Parameter
Length
Data
Integrity
Mechanism
7 bytes
4 bytes data
2 bytes CRC
4 bytes data + 2 bytes
(1 parity bit per byte) CRC or
NACK or
NR
B1H
n.a.
ISO/IEC 14443 Type A Reader
Response
PICC Response
Command ‚Set Password’
B1H
P0
P1
P2
P3
CRC0 CRC1
P0
P1
P2
P3
CRC0 CRC1
NACK
min.
86µs
613µs
56µs
4239 µs
528µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 24
Set Password Command
Table 21
SPWD - behaviour in error case
Error / State
Idle/Halt
Ready
Active
Protected
Invalid Opcode
NR
NR
NR
NR
Parity, Miller
NR
NR
NACK1
NACK1
Command Length
NR
NR
NR
NR
CRC
NR
NR
NACK1
NACK1
The selected chip
is protected by
password
NR
NR
NACK0
n.a.
HV not OK
NR
NR
NR
NR
1) For more information about password please read Chapter 5.
Data Book
46 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.7
Access (ACS)
If the my-d™ move and my-d™ move NFC is configured for password protection1) the ACS command is used to
perform a password verification. If the password verification is successful, memory access to blocks above block
0FH is granted according to the access rights given in the Configuration Byte.
Additionally, if the password counter is enabled, the number of unsuccessful password verifications is counted.
The ACS command is always active independently on the Password and the Password Retry Counter
configuration.
•
•
If the Password Retry Counter is not enabled, the my-d™ move responds with ACK or NACK depending on
the result of password comparison.
If the Password Retry Counter is enabled, then depending on the result of password comparison the
my-d™ move and my-d™ move NFC performs the following actions:
– If the passwords do not match and the Password Retry Counter holds a lower value than its Initial value, the
my-d™ move increments the Password Retry Counter and responds with a NACK.
– If the passwords match and the Password Retry Counter holds a lower value then its Initial value, the
my-d™ move resets the Password Retry Counter and responds with a ACK.
– In any other case the my-d™ move responds with a NACK and limits access to blocks above block 0FH
according to access rights stored in the Configuration Byte.
Table 22
Access (ACS)
Command Code Parameter
Length
Data
Integrity
Mechanism
7 bytes
4 bytes data
2 bytes CRC
ACK or
(1 parity bit per byte) NACK or
NR
B2H
n.a.
ISO/IEC 14443 Type A Reader
Response
PICC Response
Command ‚Access’
B2H
P0
P1
P2
P3
CRC0 CRC1
min.
86µs
613µs
ACK
ACK
NACK
NACK
56µs
56µs
6505 µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 25
Access Command
1) For more information about password please read Chapter 5.
Data Book
47 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
The figure below shows the flow diagram of the Access command.
ACCESS Command
YES
Initial Password
Couner = 0
Password
Couner Limit
exceeded
NO
YES
NACK0
NO
Passwords
match?
YES
ACK
Passwords
match?
YES
NO
NO
Reset the Password
Counter
Increment the Password
Counter
NACK0
ACK
NACK0
Figure 26
Flow Diagram of the ACS Command
Table 23
ACS - behaviour in error case
Error / State
Idle/Halt
Ready
Active
Protected
Invalid Opcode
NR
NR
NR
NR
Parity, Miller
NR
NR
NACK1
NACK1
Command Length
NR
NR
NR
NR
CRC
NR
NR
NACK1
NACK1
Password Counter NR
limit exceeded
NR
NACK0
NACK0
Passwords do not
match
NR
NR
NACK0
n.a.
HV not OK
NR
NR
NR
NR
Data Book
48 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.8
Decrement Command (DCR16)
The DCR16 command decrements the current Value Counter value by the received parameter and writes the new
value to the Value Counter block. If this command is executed properly, the my-d™ move and my-d™ move NFC
responds the new written value. Note that the parameter has to be lower or equal to the current Value Counter
value.
Table 24
Decrement (DCR16)
Command Code Parameter
Length
5 bytes
D0H
Data
Integrity
Mechanism
Response
•
2 bytes CRC
1 parity bit per byte
2 bytes;
n.a.
LSByte = CNT0
MSByte = CNT1
•
•
ISO/IEC 14443 Type A Reader
If the parameter is lower or equal to the
current Value Counter Value, the
response is the new decremented
value: 2 bytes data + 2 bytes CRC
If the parameter is 0000H the response
is the current Value Counter value
If the parameter is higher than the
current Value Counter value the
response is a NACK
PICC Response
Command ‚Decrement’
D0H
CNT0 CNT1 CRC0 CRC1
CNT0 CNT1 CRC0 CRC1
NACK
min.
86µs
442 µs
56µs
6505µs
340µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 27
Decrement Command
After receiving the correct DCR16 command, the my-d™ move and my-d™ move NFC performs the following
actions:
•
•
•
•
•
•
checks the format of the current Value Counter by reading blocks 22H and 23H;
determines the valid and the invalid Value Counter value;
decrements the current valid value by the received parameter;
expands the result to the correct Value Counter format;
writes the new Value Counter value, in the correct format, to the previously determined invalid block
erases the current valid Value Counter value to FFH FFH FFH FFH
In case of a successful programming of a Value Counter value, the my-d™ move and my-d™ move NFC sends
the new written value of the Value Counter block back. If the programming was unsuccessful (due to insufficient
power) “No Response” is replied.
Data Book
49 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
In case of any other logical error or if the Value Counter block is corrupted (i.e. both blocks have an incorrect
format) a NACK is replied.
Table 25
DCR16 - behaviour in error case
Error / State
Idle/Halt
Ready
Active
Protected
Invalid Opcode
NR
NR
NR
NR
Parity, Miller
NR
NR
NACK1
NACK1
Command Length
NR
NR
NR
NR
CRC
NR
NR
NACK1
NACK1
VCNTR16 not enabled
NR
NR
NACK0
NACK0
The selected chip is protected by password
NR
NR
NACK0
NACK0
Both counter blocks corrupted
NR
NR
NACK0
NACK0
Current VCNTR16 to low
NR
NR
NR
NR
HV not OK
NR
NR
NR
NR
The figure below presents the flow diagram of the Decrement command.
DCR16 Command
VCNTR16 bit in
ConfigByte enabled
NO
Both VCNTR16 blocks
currupted
NACK0
YES
NACK0
NO
YES
Incoming
Parameter is higer than
valid VCNTR16?
SPRWR bit in
ConfigByte enabled
YES
NACK0
NO
YES
NO
Decrement the valid VCNTR16 by
the parameter value
The password has
been verified?
NO
NACK0
•
YES
•
•
•
Figure 28
Data Book
•
Read blocks 22H and 23H
Check the format of VCNTR16
blocks
Determine the valid and invalid
VCNTR16 block
Erase/Program the invalid
VCNTR16 Block with new
VCNTR16 value
Erase the old valid VCNTR16
Block
Return the new written value
Decrement Command flow
50 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.2.9
HLTA command
The HLTA command is used to set the SLE 66R01P and SLE 66R01PN into the HALT state. The HALT State
allows users to separate already identified chips. Contrary to the definition in the ISO/IEC 14443-3 Type A
standard, the SLE 66R01P and SLE 66R01PN accept as a parameter the whole address range of 00H to 25H with
correct CRC for a proper execution of a HLTA command.
Table 26
Halt (HLTA)
Command
Length
Code Parameter
4 bytes
50H
Data
Valid Address Range n.a.
00H - 25H
ISO/IEC 14443 Type A Reader
Integrity
Mechanism
Response
2 bytes CRC
1 parity bit per byte
NACK
or NR
PICC Response
Command ‚HLTA’
50H
PARAMETER CRC0 CRC1
Any response within this period will be treated as
NACK
358µs
1000µs
Please note: Timing is rounded i .e. it is not exact grid timing
Figure 29
Data Book
HLTA Command
51 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Command Set
8.3
my-d™ move and my-d™ move NFC responses
Following sections list valid responses of the SLE 66R01P and SLE 66R01PN
8.3.1
Command responses
The Acknowledge (ACK) and Not-Acknowledge (NACK) are command responses of the SLE 66R01P and
SLE 66R01PN.
Table 27
ACK and NACK as responses
Response
Code (4 bits)
Integrity Mechanism
ACK
AH
n.a.
NACK0
0H
n.a.
NACK1
1H
n.a.
n.a.
n.a.
NR
1)
1) Depending on the current state, the SLE 66R01P and SLE 66R01PN does not respond to some errors.
The response code is AH for ACK and 0H or 1H for NACK. The ACK and NACK are sent as 4 bit response with no
CRC and/or parity.
8.3.2
my-d™ move and my-d™ move NFC identification data
During the anti-collision the SLE 66R01P and SLE 66R01PN sends responses to the REQA and SEL commands.
Table 28
Summary of SLE 66R01P and SLE 66R01PN identification data
Code
Data
Description
ATQA
0044H
Answer to Request, response to REQA and WUPA command, hard coded 2
bytes. Indicates a double-size UID.
SAK (cascade level 1) 04H
Select Acknowledge answer to selection of 1st cascade level.
Indicates that the UID is incomplete.
SAK (cascade level 2) 00H
Select Acknowledge answer to selection of 2nd cascade level.
Indicates that the UID is complete.
CT
Cascade Tag
Indicates that UID is not single size UID.
Data Book
88H
52 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Operational Characteristics
9
Operational Characteristics
The listed characteristics are ensured over the operating range of the integrated circuit. Typical characteristics
specify mean values expected over the production spread. If not otherwise specified, typical characteristics apply
at Tambient = 25° C and the given supply voltage.
9.1
Electrical Characteristics
fCAR = 13.56 MHz sinusoidal waveform, voltages refer to VSS.
Table 29
Electrical Characteristics
Parameter
Symbol
Values
Unit
Min.
Typ.
Max.
Note / Test Condition
Chip input capacitance LA-LB
CIN
16.15
17
17.85
pF
VAB peak = 3.0 V,
fCAR = 13.56 MHz,
Tambient = 25 °C
Chip load resistance LA-LB
RIN
3
4.5
6
kΩ
VAB peak = 3.0 V,
fCAR = 13.56 MHz,
Tambient = 25 °C
Endurance (erase/write cycles)1)
104
Data retention1)
–
5
years
EEPROM Erase and Write time
tprog
3.8
ESD Protection voltage
(LA, LB pins)
VESD
Ambient temperature
Tambient
-25
Junction temperature
Tjunction
-25
ms
Combined erase + write;
excluding time for
command / response
transfer between
interrogator and chip,
Tambient = 25 °C
kV
JEDEC STD EIA /
JESD22 A114-B
+70
°C
for chip
+110
°C
for chip
2
1) Values are temperature dependent
Data Book
53 / 55
2011-11-24
my-d™ move / my-d™ move NFC
SLE 66R01P / SLE 66R01PN
Operational Characteristics
9.2
Absolute Maximum Ratings
Stresses above the maximum values listed here may cause permanent damage to the device. Exposure to
absolute maximum rating conditions for extended periods may affect device reliability, including EEPROM data
retention and erase/write endurance. Maximum ratings are absolute ratings; exceeding only one of these values
may cause irreversible damage to the integrated circuit. This is a stress rating only and functional operation of the
device at these or any other conditions above those indicated in the operational sections of this data sheet is not
implied.
Table 30
Absolute Maximum Ratings
Parameter
Symbol
Values
Min.
Typ.
Unit
Max.
Input peak voltage between
LA-LB
VINpeak
6
Vpeak
Input current through LA-LB
IIN
30
mA
Storage temperature
Tstorage
+125
°C
Data Book
-40
54 / 55
Note / Test Condition
2011-11-24
w w w . i n f i n e o n . c o m
Published by Infineon Technologies AG
55