Infineon-How to operate my-d™ devices in NFC Forum™ Type 2 Tag infrastructures-AN-v01_00-EN

How to ope r a t e m y - d™ de v ic e s in
NFC F or um ™ Ty p e 2 Ta g
infr a s tru c tu re s
SLE 66R01P
SLE 66R01PN
SLE 66R16P
SLE 66R32P
SLE 66R01L
Ap p l i c a ti o n No te
2011-11-14
Ch i p C a rd & S e c u r i ty
Edition 2011-11-14
Published by
Infineon Technologies AG
81726 Munich, Germany
© 2011 Infineon Technologies AG
All Rights Reserved.
Legal Disclaimer
The information given in this document shall in no event be regarded as a guarantee of conditions or
characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any
information regarding the application of the device, Infineon Technologies hereby disclaims any and all warranties
and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual property rights
of any third party.
Information
For further information on technology, delivery terms and conditions and prices, please contact the nearest
Infineon Technologies Office (www.infineon.com).
Warnings
Due to technical requirements, components may contain dangerous substances. For information on the types in
question, please contact the nearest Infineon Technologies Office.
Infineon Technologies components may be used in life-support devices or systems only with the express written
approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure
of that life-support device or system or to affect the safety or effectiveness of that device or system. Life support
devices or systems are intended to be implanted in the human body or to support and/or maintain and sustain
and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may
be endangered.
SLE 66RxxP
Type 2 Tag Operation
my-d™ Type 2 Tag Operation - Application Note
The information in this document is subject to change without notice.
Revision History: Current Version 2011-11-14
Previous Release: 2011-10-06
Page
Subjects (major changes since last revision)
All
Added information about SLE 66R01PN (my-d™ move NFC)
Trademarks of Infineon Technologies AG
BlueMoon™, COMNEON™, C166™, CROSSAVE™, CanPAK™, CIPOS™, CoolMOS™, CoolSET™,
CORECONTROL™, DAVE™, EasyPIM™, EconoBRIDGE™, EconoDUAL™, EconoPACK™, EconoPIM™,
EiceDRIVER™, EUPEC™, FCOS™, HITFET™, HybridPACK™, ISOFACE™, I²RF™, IsoPACK™, MIPAQ™,
ModSTACK™, my-d™, NovalithIC™, OmniTune™, OptiMOS™, ORIGA™, PROFET™, PRO-SIL™,
PRIMARION™, PrimePACK™, RASIC™, ReverSave™, SatRIC™, SensoNor™, SIEGET™, SINDRION™,
SMARTi™, SmartLEWIS™, TEMPFET™, thinQ!™, TriCore™, TRENCHSTOP™, X-GOLD™, XMM™, X-PMU™,
XPOSYS™.
Other Trademarks
Advance Design System™ (ADS) of Agilent Technologies, AMBA™, ARM™, MULTI-ICE™, PRIMECELL™,
REALVIEW™, THUMB™ of ARM Limited, UK. AUTOSAR™ is licensed by AUTOSAR development partnership.
Bluetooth™ of Bluetooth SIG Inc. CAT-iq™ of DECT Forum. COLOSSUS™, FirstGPS™ of Trimble Navigation
Ltd. EMV™ of EMVCo, LLC (Visa Holdings Inc.). EPCOS™ of Epcos AG. FLEXGO™ of Microsoft Corporation.
FlexRay™ is licensed by FlexRay Consortium. HYPERTERMINAL™ of Hilgraeve Incorporated. IEC™ of
Commission Electrotechnique Internationale. IrDA™ of Infrared Data Association Corporation. ISO™ of
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. MATLAB™ of MathWorks, Inc. MAXIM™ of
Maxim Integrated Products, Inc. MICROTEC™, NFC Forum™ is trademark of Near Field Communication Forum,
NUCLEUS™ of Mentor Graphics Corporation. Mifare™ of NXP. MIPI™ of MIPI Alliance, Inc. MIPS™ of MIPS
Technologies, Inc., USA. muRata™ of MURATA MANUFACTURING CO., MICROWAVE OFFICE™ (MWO) of
Applied Wave Research Inc., OmniVision™ of OmniVision Technologies, Inc. Openwave™ Openwave Systems
Inc. RED HAT™ Red Hat, Inc. RFMD™ RF Micro Devices, Inc. SIRIUS™ of Sirius Sattelite Radio Inc. SOLARIS™
of Sun Microsystems, Inc. SPANSION™ of Spansion LLC Ltd. Symbian™ of Symbian Software Limited.
TAIYO YUDEN™ of Taiyo Yuden Co. TEAKLITE™ of CEVA, Inc. TEKTRONIX™ of Tektronix Inc. TOKO™ of
TOKO KABUSHIKI KAISHA TA. UNIX™ of X/Open Company Limited. VERILOG™, PALLADIUM™ of Cadence
Design Systems, Inc. VLYNQ™ of Texas Instruments Incorporated. VXWORKS™, WIND RIVER™ of WIND
RIVER SYSTEMS, INC. ZETEX™ of Diodes Zetex Limited.
Application Note
3 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Table of Contents
1
1.1
1.2
1.2.1
1.2.1.1
1.2.1.2
1.2.2
1.2.3
1.2.4
1.2.4.1
1.2.4.2
1.2.4.3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
my-d™ Variants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
NFC Forum™ Type 2 Tag Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Static Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Dynamic Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
TLV Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Life Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Sector Select Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Read Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Write Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2
2.1
2.2
2.3
Setting up my-d™ to support NFC Forum™ Type 2 Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ Memory Configuration at Delivery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ move and my-d™ move lean . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
15
15
15
17
3
3.1
3.1.1
3.1.2
3.1.3
3.2
3.2.1
3.2.1.1
3.2.1.2
3.2.1.3
3.2.1.4
3.2.2
NFC Forum™ Type 2 Tag Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Static Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Empty NDEF message in Static Memory Structure: State INITIALIZED . . . . . . . . . . . . . . . . . . . . .
NDEF message in Static Memory Structure: State READ / WRITE, CC3 = 00H . . . . . . . . . . . . . . .
NDEF message in Static Memory Structure: State READ-ONLY, CC3 = 0FH . . . . . . . . . . . . . . . .
Dynamic Memory Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Empty NDEF message in Dynamic Memory Structure: State INITIALIZED . . . . . . . . . . . . . . . . . .
Lock Control TLV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Memory Control TLV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NDEF Message TLV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Terminator TLV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NDEF message in Dynamic Memory Structure: State READ / WRITE, CC3 = 00H . . . . . . . . . . . .
18
18
18
19
20
21
21
22
23
23
23
24
4
4.1
4.2
4.2.1
4.3
4.3.1
4.3.2
4.3.3
4.4
4.5
Details about my-d™ NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ NFC Derivatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ NFC Memory Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ NFC Service Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
my-d™ Write Byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Block locking with my-d™ NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Important Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
25
25
25
28
29
30
31
32
33
35
Application Note
4 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
List of Tables
Table 1
Table 2
Table 3
Table 4
Table 5
Table 6
Table 7
Table 8
Table 9
Table 10
Table 11
Table 12
Table 13
Table 14
Table 15
Table 16
Table 17
Table 18
Table 19
Table 20
Table 21
Table 22
Table 23
Table 24
Table 25
Table 26
Table 27
Table 28
Table 29
Table 30
Table 31
Table 32
Table 33
Table 34
Table 35
Table 36
Table 37
Table 38
Table 39
Table 40
Table 41
Table 42
Table 43
Table 44
Table 45
Chip variants of my-d™ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
NFC Forum™ Type 2 Tag memory organization (based on memory size 1024 bytes ) . . . . . . . . . 7
TLV Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
NFC Forum™ Type 2 Tag INITIALIZED state (based on memory size of 1024 bytes) . . . . . . . . . . 9
NFC Forum™ Type 2 Tag READ / WRITE state (based on memory size of 1024 bytes) . . . . . . . 10
NFC Forum™ Type 2 Tag READ ONLY state (based on memory size of 1024 bytes) . . . . . . . . . 10
NFC Forum™ Type 2 Tag command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
‘Sector Select’ command parameters (packet 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
‘Sector Select’ command response parameters (packet 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
‘Sector Select’ command parameters (packet 2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
‘Sector Select’ command response parameters (packet 2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
‘Read’ command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
‘Read’ command response parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
‘Write’ command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
‘Write’ command response parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
my-d™ move - SLE 66R01P in UNINITIALIZED state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Capability Container settings for my-d™ move lean and my-d™ move (NFC) . . . . . . . . . . . . . . . 16
Empty NDEF message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
my-d™ move NFC - SLE 66R01PN in INITIALIZED state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
my-d™ NFC - SLE 66R16P in UNINITIALIZED state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Capability Container settings for my-d™ NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
my-d™ NFC - SLE 66R16P in INITIALIZED state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Static Memory Structure - INITIALIZED State (based on my-d™ move) . . . . . . . . . . . . . . . . . . . . 18
Static Memory Structure - READ / WRITE State (based on my-d™ move) . . . . . . . . . . . . . . . . . . 19
Static Memory Structure - READ-ONLY State (based on my-d™ move) . . . . . . . . . . . . . . . . . . . . 20
Dynamic Memory Structure - INITIALIZED State (based on SLE 66R16P) . . . . . . . . . . . . . . . . . . 21
Dynamic Memory Structure - READ/WRITE State (based on SLE 66R16P) . . . . . . . . . . . . . . . . . 24
Chip variants of my-d™ NFC (memory sizes in bytes). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
my-d™ NFC SLE 66R16P memory configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
my-d™ NFC SLE 66R32P memory configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
NFC Forum™ Type 2 Tag memory mapping (based on SLE 66R32P) . . . . . . . . . . . . . . . . . . . . . 27
my-d™ NFC Service Area Content. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Chip Family Identification my-d™ NFC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Issuer Tag (IT) of my-d™ NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Chip Information (CI) of my-d™ NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
NFC Forum™ Type 2 Tag command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
my-d™ NFC command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
‘my-d™ Read’ command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
‘my-d™ Read’ command response parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
‘my-d™ Write’ command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
‘my-d™ Write’ command response parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
‘my-d™ Write Byte’ command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
‘my-d™ Write Byte’ command response parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
NFC Forum™ Type 2 Tag memory mapping (based on SLE 66R16P) . . . . . . . . . . . . . . . . . . . . . 34
Access Conditions and access rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Application Note
5 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
1
Introduction
This document gives details on
•
•
•
•
the available my-d™ devices offering NFC Forum™ Type 2 Tag functionality
default settings of my-d™ devices at delivery
state transitions
command sets of my-d™ products
Furthermore, some examples are given describing how to use the NFC memory block within the my-d™ devices.
This application note shall be used together with:
•
•
•
•
ISO/IEC 14443-3 Type A Standard
NFC Forum™ Type 2 Tag Specification
my-d™ NFC Data Book
my-d™ move Data Book
Please contact Chip Card & Security [email protected] to request the appropriate Data Books.
1.1
my-d™ Variants
Following my-d™ variants are available supporting NFC Forum™ Type 2 Tag functionality.
NFC commands allow to address data space listed in column ‘NFC memory size’, whereas ‘NFC User Data size’
indicates the amount of memory available for user purpose. The difference is reserved for administrative data such
as Internal bytes and Capability Container.
Table 1
Chip variants of my-d™
Device name
Type
NFC memory size [bytes]
NFC User Data size [bytes]
my-d™ move lean
SLE 66R01L
64
48
SLE 66R01P
152
128
SLE 66R01PN
152
128
SLE 66R16P
1024
my-d™ move
my-d™ move NFC
my-d™ NFC
my-d™ NFC
1)
SLE 66R32P
1008
2)
2048
2032
1) Delivered in NFC INITIALIZED state
2) Two NFC memory sectors of 1 kByte
Application Note
6 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
1.2
NFC Forum™ Type 2 Tag Characteristics
1.2.1
Memory Structure
Table 2 illustrates a 1024 byte memory area allocated to a Type 2 Tag. These 1024 bytes are organized in 256
blocks of 4 bytes each.
Type 2 Tag address range
Table 2
NFC Forum™ Type 2 Tag memory organization (based on memory size 1024 bytes )
NFC Block
address
Byte Number within a block
Description
0
1
2
3
00H
internal0
internal1
internal2
internal3
Internal
01H
internal4
internal5
internal6
internal7
Internal
02H
internal8
internal9
LOCK0
LOCK1
Internal / Lock
03H
CC0
CC1
CC2
CC3
04H
D0
D1
D2
D3
Data
05H
D4
D5
D6
D7
Data
Capability Container
...
...
Data
...
...
Data
FEH
D1000
D1001
D1002
D1003
Data
FFH
D1004
D1005
D1006
D1007
Data
The given address range (from 00H to FFH) represents a NFC Forum™ Type 2 Tag with 1 kByte of memory.
NFC block addresses 00H to 03H hold
•
•
•
Internal Bytes: internal0 - internal9
– these bytes are reserved for manufacturing use and shall not be used to store information data.
Static Lock Bytes: LOCK0 - LOCK1
– read-only locking bits (Note: does not imply physical locking!)
Capability Containers: CC0 - CC3
– manage the information about the Type 2 Tag
Block addresses higher than 03H belong to the NFC Forum™ Type 2 Tag Data Area (D0 to D1007) and are
available to the user. The Type 2 Tag memory structure required by an application can be arranged within this
memory area.
The memory structure depends on the available memory on the Type 2 Tag platform.
1.2.1.1
Static Memory Structure
The Static Memory Structure may be applied to Type 2 Tag platforms with a physical memory size equal to 64
bytes or if the application requires small amounts of user memory (up to 48 bytes).
1.2.1.2
Dynamic Memory Structure
The Dynamic Memory Structure is used for Type 2 Tag platforms with memories bigger than 64 bytes. This
memory layout contains optional configuration information (Lock Control TLV and Memory Control TLV) to identify
reserved memory areas within the data area.
Application Note
7 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
1.2.2
TLV Blocks
Encoding of data on a NFC Forum™ Type 2 Tag is realized with TLV blocks:
•
•
•
T (tag field) identifies the type of TLV block
L (length field) provides the size of the value field
V (value field) indicates the value field
Table 3 lists defined TLV Blocks used to encode data. The NFC Forum™ device shall use these TLV Blocks to
write data to the data area of the NFC Forum™ Type 2 Tag.
Table 3
TLV Blocks
TLV Block Name
Tag Field Value
Description
NULL TLV
00H
used for padding memory areas
Lock Control TLV
01H
defines details of the lock bits
Memory Control TLV
02H
identifies reserved memory areas
NDEF Message TLV
03H
contains an NDEF message
Proprietary TLV
FDH
Proprietary Information
Terminator TLV
FEH
Last TLV Block in the data area
The order of the TLV Blocks is specified as listed:
•
•
•
•
if present: Lock Control TLV(s)
if present: Memory Control TLV(s)
NDEF Message TLV(s) and Proprietary TLV(s)
Terminator TLV
Note: For more detailed information about the NFC Forum™ Type 2 Tag memory structures and TLV Blocks
please refer to the NFC Forum™ Type 2 Tag Specification.
Application Note
8 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
1.2.3
Life Cycle
A NFC Forum™ Type 2 Tag device may be in different states. The current state is identified by the content of the
Type 2 Tag memory.
Figure 1
UNINITIALIZED
Capability Container not initialized
and no NDEF message TLV
INITIALIZED
Capability Container set and empty
NDEF message TLV programmed
READ / WRITE
NDEF message TLV stored
in the data area
READ ONLY
Access rights for the whole data
area set to read-only
Type 2 Tag Life Cycle
In UNINITIALIZED state the memory is not prepared to be immediately used in a NFC Forum™ Type 2 Tag
infrastructure. The chip supports the NFC Forum™ Type 2 Tag command set but the NFC Forum™ device may
ignore the Type 2 Tag platform as it is not in a valid state.
The valid states within a NFC Forum™ Type 2 Tag infrastructure are
•
INITIALIZED
– the NFC Forum™ Type 2 Tag Capability Container bytes are set and allow read/write access (CC3 = 00H)
– the data area contains an NDEF message TLV with the length field set to 00H (empty NDEF)
– Terminator TLV
– the NFC Forum™ device may then modify the data stored in the NFC Forum™ Type 2 Tag
Type 2 Tag address range
Table 4
NFC Forum™ Type 2 Tag INITIALIZED state (based on memory size of 1024 bytes)
NFC Block
address
Byte Number within a block
Description
0
1
2
3
00H
internal0
internal1
internal2
internal3
Internal
01H
internal4
internal5
internal6
internal7
Internal
02H
internal8
internal9
03H
CC0 = E1H
CC1 = 10H
CC2 = 7EH
CC3 = 00H
04H
03H
00H
FEH
D3
Empty NDEF
05H
D4
D5
D6
D7
Data
LOCK0 = 00H LOCK1 = 00H Internal / Lock
Capability Container
...
...
Data
...
...
Data
FEH
D1000
D1001
D1002
D1003
Data
FFH
D1004
D1005
D1006
D1007
Data
Application Note
9 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
•
WRITE / READ
– the NFC Forum™ Type 2 Tag Capability Container bytes are set and allow read/write access (CC3 = 00H)
– the data area contains an NDEF message TLV with the length value equal to the length of the NDEF
message stored in the value field
Type 2 Tag address range
Table 5
•
NFC Forum™ Type 2 Tag READ / WRITE state (based on memory size of 1024 bytes)
NFC Block
address
Byte Number within a block
0
1
2
3
00H
internal0
internal1
internal2
internal3
Internal
01H
internal4
internal5
internal6
internal7
Internal
02H
internal8
internal9
03H
CC0 = E1H
CC1 = 10H
CC2 = 7EH
CC3 = 00H
04H
03H
0BH
D1H
01H
NDEF message
05H
07H
54H
02H
65H
NDEF message
06H
6EH
4EH
44H
45H
NDEF message
07H
46H
FEH
D14
D15
NDEF message
...
Description
LOCK0 = 00H LOCK1 = 00H Internal / Lock
...
Capability Container
Data
FEH
D1000
D1001
D1002
D1003
Data
FFH
D1004
D1005
D1006
D1007
Data
READ ONLY
– the NFC Forum™ Type 2 Tag Capability Container bytes are set and allow read access only (CC3 = 0FH)
– the data area contains an NDEF message TLV with the length value equal to the length of the NDEF
message stored in the value field.
Type 2 Tag address range
Table 6
NFC Forum™ Type 2 Tag READ ONLY state (based on memory size of 1024 bytes)
NFC Block
address
Byte Number within a block
0
1
2
3
00H
internal0
internal1
internal2
internal3
Internal
01H
internal4
internal5
internal6
internal7
Internal
02H
internal8
internal9
03H
CC0 = E1H
CC1 = 10H
CC2 = 7EH
CC3 = 0FH
04H
03H
0BH
D1H
01H
NDEF message
05H
07H
54H
02H
65H
NDEF message
06H
6EH
4EH
44H
45H
NDEF message
07H
46H
FEH
D14
D15
NDEF message
...
Description
LOCK0 = 00H LOCK1 = 00H Internal / Lock
...
Capability Container
Data
FEH
D1000
D1001
D1002
D1003
Data
FFH
D1004
D1005
D1006
D1007
Data
Note: Please note that CC3 = 0FH indicates a “soft-lock” only and does not physically lock the memory.
Application Note
10 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
1.2.4
Command set
Table 7 lists the NFC Forum™ Type 2 Tag commands available with the my-d™ devices.
Table 7
NFC Forum™ Type 2 Tag command set
1)
Command
Op-Code
Comment
Address range
Sector Select
C2H
Sector selection
-
Read
30H
Reads 16 bytes of data
00H - FFH
Write
A2H
Writes 4 byte of data
00H - FFH
2)
1) Please refer to the NFC Forum™ Type 2 Tag specification for detailed command descriptions.
2) For variants with more than 1 kByte of Type 2 Tag memory.
1.2.4.1
Sector Select Command
The Sector Select command supports the access to NFC Forum™ Type 2 Tag platforms with physical memories
bigger than 1 kByte. The sector size is 1 kByte.
The Sector Select command is divided into two command packets.
•
packet 1 contains the command code and a single byte parameter (set to FFH). Valid responses are:
– ACK for Type 2 Tag platforms with bigger memories than 1 kByte
– NACK for Type 2 Tag platforms with smaller memories than 1 kByte
NFC Forum™ device
NFC Forum™ Type 2 Tag platform response
Command ‚Sector Select’, packet 1
SectSel
(C2H)
FFH
CRC
ACK
or ...
NACK
Figure 2
Sector Select Command, packet 1
Table 8
‘Sector Select’ command parameters (packet 1)
Length1)
Name
Remark
SectSel
1
command opcode: C2H
FFH
1
fixed value for packet 1
CRC
2
CRC
1) length of parameter field in [byte(s)]
Table 9
‘Sector Select’ command response parameters (packet 1)
Name
Length
Remark
ACK
1
Replied without CRC
NACK
1
Error on Sector Select command; replied without CRC
Application Note
11 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
Packet 2 will be skipped if the response to packet 1 was NACK.
•
packet 2 contains the sector number and three additional bytes which are reserved for future use and set to 00H
– passive ACK (= no response) if the sector number is valid
– NACK if the addressable data memory space is exceeded
NFC Forum™ Type 2 Tag
platform response
NFC Forum™ device
Command ‚Sector Select’, packet 2
Sector
Number
00H
00H
00H
CRC
passive ACK /
NR
or ...
NACK
Figure 3
Sector Select Command, packet 2
Table 10
‘Sector Select’ command parameters (packet 2)
Length1)
Name
Remark
Sector Number
1
Valid range for Sector Number: 00H to FEH
FFH is RFU
00H
3
RFU
CRC
2
CRC
1) length of parameter field in [byte(s)]
Table 11
‘Sector Select’ command response parameters (packet 2)
Name
Length
Remark
passive ACK - NR
0
no reply
NACK
1
Error on Sector Select command; replied without CRC
Application Note
12 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
1.2.4.2
Read Command
The Read command reads 16 bytes data out of the memory starting from the specified address.
The valid address range is 00H to FFH and depends on the available memory. If an address outside the chipspecific address range is specified the my-d™ chip responds with a NACK.
NFC Forum™ device
NFC Forum™ Type 2 Tag platform response
Command ‚Read’
Read
(30H)
ADR
CRC
DATA
CRC
or ...
NACK
Figure 4
Read Command
Table 12
‘Read’ command parameters
Length1)
Name
Remark
Read
1
command opcode: 30H
ADR
1
Block address to be read
The valid address range is from 00H to FFH (depending on the available memory)
CRC
2
CRC
1) length of parameter field in [byte(s)]
Table 13
‘Read’ command response parameters
Name
Length
Remark
DATA
16
Content of four blocks
CRC
2
CRC
1
Error on Read command; replied without CRC
or
NACK
Application Note
13 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Introduction
1.2.4.3
Write Command
If the write access is granted the Write command is used to program 4 bytes of data to the specified address in
the memory. This command should be used to program the OTP block and LOCKx bytes as well.
The valid address range is from 00H to FFH and depends on the available memory. If an address outside the chipspecific address range is specified the my-d™ chip responds with a NACK.
NFC Forum™ Type 2 Tag
platform response
NFC Forum™ device
Command ‚Write’
Write
(A2H)
ADR
DATA
CRC
ACK
or ...
NACK
Figure 5
Write Command
Table 14
‘Write’ command parameters
Length1)
Name
Remark
Write
1
command opcode: A2H
ADR
1
Block address to be written
The valid address range is from 00H to FFH (depending on the available memory)
DATA
4
Data to be written
CRC
2
CRC
1) length of parameter field in [byte(s)]
Table 15
‘Write’ command response parameters
Name
Length
Remark
ACK
1
Write successful; replied without CRC
NACK
1
Error on Write command; replied without CRC
Application Note
14 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Setting up my-d™ to support NFC Forum™ Type 2 Tags
2
Setting up my-d™ to support NFC Forum™ Type 2 Tags
The following section describes the recommended procedure to set up a NFC Forum™ Type 2 Tag memory on a
my-d™ device.
2.1
my-d™ Memory Configuration at Delivery
Depending on the application and order form my-d™ devices could be delivered in UNINITIALIZED or
INITIALIZED state.
In UNINITIALIZED state the my-d™ devices are delivered with the memory set to 00H. The NFC Forum™ Type 2
Tag platform needs to be initialized prior to be used in a NFC Forum™ Type 2 Tag infrastructure.
In INITIALIZED state the necessary memory content has already been programmed to the my-d™ devices and
they can be used in NFC Forum™ Type 2 Tag infrastructures immediately.
Table 16 and Table 20 show the default memory configuration of the my-d™ devices at delivery.
2.2
my-d™ move and my-d™ move lean
These chips come with
•
•
•
•
•
•
•
a 7-byte UID including two BCC bytes programmed during manufacturing (uid0-uid6, BCC0 and BCC1); these
bytes are internal bytes. This UID is used during the ISO/IEC 14443-3 Type A anti-collision.
INT2 set to 00H
LOCK0 and LOCK1 set to 00H1) (Lock bytes for Block 00H - 0FH)
LOCK2 to LOCK5 set to 00H (my-d™ move only: Lock bytes for Block 10H - 23H)
OTP memory in block 03H set to 00H (Capability Container)
complete data area set to 00H
address range: my-d™ move lean: 00H - 0FH; my-d™ move: 00H - 25H
Type 2 Tag address range
Table 16
my-d™ move - SLE 66R01P in UNINITIALIZED state
NFC Block
address
Byte Number within a block
Description
0
1
2
3
00H
uid0
uid1
uid2
BCC0
01H
uid3
uid4
uid5
uid6
02H
BCC1
INT2 = 00H
03H
00H
00H
00H
00H
OTP
04H
00H
00H
00H
00H
Data
Serial Number / BCC
Serial Number
LOCK0 = 00H LOCK1 = 00H BCC1 / Internal / Lock
...
...
Data
0FH
...
Data
10H
...
Data
...
...
Data
23H
24H
00H
00H
00H
00H
Data
LOCK2 = 00H LOCK3 = 00H LOCK4 = 00H LOCK5 = 00H Lock
25H
Manufacturing Data
Reserved
In order to initialize my-d™ move variants the Capability Container bytes (Block 03H) and an empty NDEF
message (Block 04H) need to programmed.
1) 00H indicates Block Read / Write access.
Application Note
15 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Setting up my-d™ to support NFC Forum™ Type 2 Tags
Table 17 defines settings of the Capability Container bytes to address the NFC memory.
Table 17
Capability Container settings for my-d™ move lean and my-d™ move (NFC)
Chip Type
CC01)
CC12)
CC23)
CC34)
SLE 66R01L
E1H
10H or 11H
06H
00H
SLE 66R01P
E1H
10H or 11H
10H
00H
SLE 66R01PN
E1H
10H or 11H
10H
00H
1) Magic Number defines that NFC Forum™ defined data is stored in the data area
2) Version number of the supported specification
3) CC2 indicates the memory size of the data area of the Type 2 Tag; the given values represent the maximum values for the
chips
4) Indicates read and write access capabilities of the data area
Table 18 defines the empty NDEF Message TLV (identified with the Tag field value of 03H). The Length field value
is set to 00H; due to that the Value field is not present.
The Terminator TLV is the last TLV block in the data area.
Table 18
Empty NDEF message
NDEF Message TLV
Terminator TLV
Tag field
Length field
Value field
Tag Field
Length field
Value field
03H
00H
-
FEH
-
-
The programming of this information (CCx and empty NDEF) has to be done with the NFC Forum™ Type 2 Tag
Write command. After that the my-d™ move is in INITIALIZED state.
Table 19 shows a my-d™ move device in INITIALIZED state (correlates with the SLE 66R01PN memory content
at delivery).
Type 2 Tag address range
Table 19
my-d™ move NFC - SLE 66R01PN in INITIALIZED state
NFC Block
address
Byte Number within a block
Description
0
1
2
3
00H
uid0
uid1
uid2
BCC0
01H
uid3
uid4
uid5
uid6
02H
BCC1
INT2 = 00H
03H
E1H
10H
10H
00H
04H
03H
00H
FEH
...
Serial Number / BCC
Serial Number
LOCK0 = 00H LOCK1 = 00H BCC1 / Internal / Lock
Capability Container
Empty NDEF
05H
...
Data
...
...
Data
23H
...
Data
24H
25H
LOCK2 = 00H LOCK3 = 00H LOCK4 = 00H LOCK5 = 00H Lock
Manufacturing Data
Reserved
Note: Please note that the configuration of the different my-d™ move devices to INITIALIZED state is nonreversible; the Capability Containers (located in the OTP memory block 03H) cannot be overwritten to use
the my-d™ move as plain, standard device anymore.
Application Note
16 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Setting up my-d™ to support NFC Forum™ Type 2 Tags
2.3
my-d™ NFC
The my-d™ NFC chip in UNINITIALIZED state comes with the whole NFC memory set to 00H; they need to be
initialized before being used in an NFC Forum™ Type 2 Tag infrastructure.
my-d™ NFC - SLE 66R16P in UNINITIALIZED state
NFC Block
address
0
1
2
3
00H
00
00
00
00
Data
01H
00
00
00
00
Data
02H
00
00
00
00
Data
03H
00
00
00
00
Data
Type 2 Tag
address range
Table 20
Byte Number within a block
...
Description
...
Data
FEH
00
00
00
00
Data
FFH
00
00
00
00
Data
In order to enable the INITIALIZED state at least the Capability Containers and the Empty NDEF have to be
programmed to the memory.
If the application requires some internal information Block 00H, Block 01H and the first two bytes of Block 02H may
be used (internal0 - internal9).
•
•
•
Block 02H, byte 2 and 3: Static Lock bytes
Block 03H: Capability Containers
Block 04H: start of data area
Table 21 defines valid settings of the Capability Container bytes.
Table 21
Capability Container settings for my-d™ NFC
Chip Type
CC0
CC1
CC21)
CC3
SLE 66R16P
E1H
10H or 11H
7EH
00H
SLE 66R32P
E1H
10H or 11H
FEH
00H
1) CC2 indicates the memory size of the data area of the Type 2 Tag; the given values represent the maximum values for the
chips
Type 2 Tag address range
Table 22
my-d™ NFC - SLE 66R16P in INITIALIZED state
NFC Block
address
Byte Number within a block
Description
0
1
2
3
00H
internal0
internal1
internal2
internal3
Internal
01H
internal4
internal5
internal6
internal7
Internal
02H
internal8
internal9
03H
E1H
10H
7EH
00H
Capability Container
04H
03H
00H
FEH
00H
Empty NDEF
LOCK0 = 00H LOCK1 = 00H Internal / Lock
05H
...
Data
...
...
Data
FEH
...
Data
FFH
Application Note
00H
00H
00H
17 / 36
00H
Data
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
NFC Forum™ Type 2 Tag Examples
3
NFC Forum™ Type 2 Tag Examples
Following examples show the Type 2 Tag memory on a my-d™ chip in two different memory structures (static and
dynamic) as defined in the NFC Forum™ Type 2 Tag specification.
3.1
Static Memory Structure
The Static Memory Structure may be applied to Type 2 Tag platforms with a physical memory size equal to 64
bytes or if the application requires small amounts of user memory (up to 48 bytes).
3.1.1
Empty NDEF message in Static Memory Structure: State INITIALIZED
The example shows a my-d™ move chip in INITIALIZED state with a static memory structure, an empty NDEF
message TLV and the Terminator TLV. The 48 bytes of NFC Forum™ Type 2 Tag data memory are located in the
address range from 04H to 0FH.
Table 23
Static Memory Structure - INITIALIZED State (based on my-d™ move)
Byte Number within a block
NFC Block
address
(hex)
0
1
2
3
00H
uid0
uid1
uid2
INT0
01H
uid3
uid4
uid5
uid6
02H
INT1
INT2
LOCK0 = 00H
1)
CC1 = 10H
LOCK1 = 00H
03H
CC0 = E1H
04H
03H3)
00H
05H
...
...
...
...
...
...
...
...
...
...
...
...
...
...
0FH
D44
D45
D46
D47
10H
...
...
...
...
...
...
...
...
...
23H
...
...
....
...
24H
LOCK2 = 00H
LOCK3 = 00H
LOCK4 = 00H
LOCK5 = 00H
25H
CC2 = 06H
2)
FEH
4)
CC3 = 00H
...
Manufacturing Data
1) E1H = ‘Magic Number’
2) NFC Data memory size is 48 bytes (highest block address 0FH). The whole memory may
be used for an NFC application with the CC2 set to 10H (highest block address 23H).
3) NDEF message TLV (here: empty NDEF)
4) Terminator TLV
The Static Lock bytes LOCK0 and LOCK1 are set to 00H indicating that the memory blocks are not locked.
The Capability Containers indicate:
•
•
•
•
CC0 = E1H: present NDEF data inside the tag
CC1 = 10H: support of Version 1.0 of the NFC Forum™ Type 2 Tag specification
CC2 = 06H: 48 bytes of memory for data
CC3 = 00H: read and write access is granted without any security
Application Note
18 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
NFC Forum™ Type 2 Tag Examples
The data area starts at Block 04H and holds two TLV blocks:
•
•
NDEF message TLV
– T: 03H indicates the NDEF message
– L: 00H defines the length of the stored NDEF message (here: empty NDEF)
– V: not present
Terminator TLV
3.1.2
NDEF message in Static Memory Structure: State READ / WRITE, CC3 = 00H
Based on the INITIALIZED NFC Forum™ Type 2 Tag configuration given in Chapter 3.1.1 following example
shows a NFC Forum™ Type 2 Tag in READ / WRITE state in a static memory structure, a NDEF message TLV
and the Terminator TLV.
Table 24
Static Memory Structure - READ / WRITE State (based on my-d™ move)
NFC Block
address
(hex)
Byte Number within a block
0
1
2
3
00H
uid0
uid1
uid2
INT0
01H
uid3
uid4
uid5
uid6
02H
INT1
INT2
LOCK0 = 00H
LOCK1 = 00H
03H
CC0 = E1H
CC1 = 10H
CC2 = 06H
CC3 = 00H
04H
03H1)
13H2)
D1H
01H
05H
0FH
54H
02H
65H
06H
6EH
48H
65H
6CH
07H
6CH
6FH
20H
77H
08H
6FH
72H
6CH
64H
09H
21H
FEH
...
...
...
...
...
...
...
0FH
D44
D45
D46
D47
10H
...
...
...
...
...
...
...
...
...
23H
...
...
...
...
24H
LOCK2
LOCK3
LOCK4
LOCK5
25H
Manufacturing Data
1) NDEF Message TLV
2) Length of value field (NDEF Message TLV)
Settings for the Static Lock bytes LOCK0 and LOCK1 and Capability Containers remain unchanged.
The data area starts at Block 04H and holds two TLV blocks:
•
NDEF message TLV
– T: 03H indicates the NDEF message
– L: 13H defines the length of the stored NDEF message
– V: NDEF record holding the “Hello world!” payload according to the NFC Forum™ Text RTD.
The data area is programmed with the NFC Forum™ Type 2 Tag Write command.
The Static Lock bytes LOCK0 and LOCK1 may be used to lock blocks within the data area.
Application Note
19 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
NFC Forum™ Type 2 Tag Examples
3.1.3
NDEF message in Static Memory Structure: State READ-ONLY, CC3 = 0FH
Based on the example of the NFC Forum™ Type 2 Tag in READ / WRITE state (see Chapter 3.1.2) the NFC
Forum™ Type 2 Tag platform may be set to READ-ONLY state.
The data area of the NFC Forum™ Type 2 Tag platform already contains an NDEF Message TLV and the length
field of the NDEF Message TLV is different to 00H. This data remains unchanged.
In order to set the NFC Forum™ Type 2 Tag platform to READ-ONLY state the Capability Container byte CC3
needs to be modified.
Table 25
Static Memory Structure - READ-ONLY State (based on my-d™ move)
NFC Block
address
(hex)
Byte Number within a block
0
1
2
3
00H
uid0
uid1
uid2
INT0
01H
uid3
uid4
uid5
uid6
02H
INT1
INT2
LOCK0 = 00H
LOCK1 = 00H
03H
CC0 = E1H
CC1 = 10H
CC2 = 06H
CC3 = 0FH1)
04H
03H
13H
D1H
01H
05H
0FH
54H
02H
65H
06H
6EH
48H
65H
6CH
07H
6CH
6FH
20H
77H
08H
6FH
72H
6CH
64H
09H
21H
FEH
...
...
...
...
...
...
...
0FH
D44
D45
D46
D47
10H
...
...
...
...
...
...
...
...
...
23H
...
...
...
...
24H
LOCK2
LOCK3
LOCK4
LOCK5
25H
Manufacturing Data
1) CC3 indicates the access capabilities of the data area
In this example the settings for the Static Lock bytes LOCK0 and LOCK1 remain unchanged.
An NFC Forum™ device shall identify the READ-ONLY state of the NFC Forum™ Type 2 Tag platform.
For CC3 the higher nibble (0H) indicates that read access is granted without any security; the lower nibble (FH)
controls the write access condition. Here: no write access is granted. The READ-ONLY state indicates a soft-lock
only; physical locking of appropriate memory is done by setting dedicated bits within the LOCK bytes.
Application Note
20 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
NFC Forum™ Type 2 Tag Examples
3.2
Dynamic Memory Structure
The Dynamic Memory Structure is defined for tags with memory sizes bigger than 64 bytes.
3.2.1
Empty NDEF message in Dynamic Memory Structure: State INITIALIZED
The example shows an NFC Forum™ Type 2 Tag in INITIALIZED state with a dynamic memory structure with 32
data area block. It holds one Lock Control TLV, one Memory Control TLV, an empty NDEF Message TLV and the
Terminator TLV.
Table 26
Dynamic Memory Structure - INITIALIZED State (based on SLE 66R16P)
NFC Block
address
(hex)
Byte Number within a block
0
1
2
3
00H
internal0
internal1
internal2
internal3
01H
internal4
internal5
internal6
internal7
02H
internal8
internal9
LOCK0 = 00H
LOCK1 = 00H
03H
CC0 = E1H
CC1 = 10H
CC2 = 7EH
CC3 = 00H
04H
01H1)
03H
D0H
20H
03H
E0H
05H
1)
2)
3)
4)
24H
02H
2)
06H
2CH
04H
07H
FEH4)
...
03H
3)
00H
...
...
08H
...
...
...
34H
DynLock2 = 00H DynLock3 = 00H DynLock4 = 00H DynLock5 = 00H
35H
Reserved
Reserved
Reserved
Reserved
...
Reserved
Reserved
Reserved
Reserved
3FH
Reserved
Reserved
Reserved
Reserved
40H
...
...
...
FFH
...
Start of Lock Control TLV
Start of Memory Control TLV
NDEF message TLV (here: Empty NDEF)
Terminator TLV
Internal bytes (internal0 - internal9) are reserved to hold application specific internal data like a serial number or
manufacturing data. The NFC Forum™ device shall not use it to store information data.
The Static Lock bytes LOCK0 and LOCK1 are set to 00H indicating that the memory blocks are not locked.
Dynamic Lock bytes (DynLock2 - DynLock5) are located in the data area.
The Capability Containers indicate:
•
•
•
•
CC0 = E1H: present NDEF data inside the tag
CC1 = 10H: support of Version 1.0 of the NFC Forum™ Type 2 Tag specification
CC2 = 7EH: 1008 bytes of memory for data (here: SLE 66R16P, Sector 0)
CC3 = 00H: read and write access is granted without any security
The data area starts at Block 04H and holds following four TLV blocks.
Application Note
21 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
NFC Forum™ Type 2 Tag Examples
3.2.1.1
Lock Control TLV
A Lock Control TLV provides details and control information about the lock area(s) like the location of the dynamic
lock bytes, the number of dynamic lock bits.
•
•
•
T: 01H indicates the Lock Control TLV
L: 03H defines the length of the value field
V: indicates the position and size of the lock area
– D0H: defines the position of the dynamic lock bytes inside the tag
The higher nibble codes the ‘PageAddr’ by the number of pages (DH).
The lower nibble codes the ‘ByteOffset’ within the page (0H).
– 20H: coded as the number of bits. It indicates the size of the dynamic lock area in bits (here: 20H to lock 32
data area blocks)
– 24H: page control information defines the size of a page and the number of bytes each dynamic lock bit is
able to lock.
The higher nibble codes the number of locked bytes: 2BytesLockedPerLockBit = 22 = 4
The lower nibble codes the size of a page: 2BytesPerPage = 24 = 16
Using the settings within the Lock Control TLV an NFC Forum™ device may calculate the byte address of the
dynamic lock area:
(1)
ByteAddr = PageAddr × 2
BytesPerPage
+ ByteOffset
4
ByteAddr = DH × 2 + 0
ByteAddr = 13 × 16 = 208 ( BlockAddr = 34 H )
So the dynamic lock area starts at byte 00H of Block 34H and contains 32 dynamic lock bits, where every lock bit
is able to lock 4 bytes within the data area.
Application Note
22 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
NFC Forum™ Type 2 Tag Examples
3.2.1.2
Memory Control TLV
The Memory Control TLV provides control information about the reserved area(s); this data covers information
about the location and the size of the reserved bytes.
•
•
•
T: 02H indicates the Memory Control TLV which identifies reserved memory areas
L: 03H defines the length of the value field
V: indicates the position of the reserved area and the number of reserved bytes
– E0H: defines the position of the reserved bytes inside the tag
The higher nibble codes the ‘PageAddr’ by the number of pages, the lower nibble codes the ‘ByteOffset’
within the page.
– 2CH: coded as the number of bytes it indicates the size of the reserved area in bytes (here: 2CH to reserve
44 bytes of memory)
– 04H: partial page control information indicates the size of a page (‘BytesPerPage’); this information is coded
to the lower nibble. The higher nibble is RFU.
Using these settings within the Memory Control TLV an NFC Forum™ device may calculate the byte address of
the reserved area:
(2)
ByteAddr = PageAddr × 2
BytesPerPage
+ ByteOffset
4
ByteAddr = E H × 2 + 0
ByteAddr = 14 × 16 = 212 ( BlockAddr = 35 H )
3.2.1.3
NDEF Message TLV
The NDEF Message TLV stores NDEF coded messages inside the Value field.
•
•
•
T: 03H indicates the NDEF message
L: 00H defines the length of the stored NDEF message (here: empty NDEF)
V: not present
3.2.1.4
Terminator TLV
The Terminator TLV is the last TLV block in the data area of a NFC Forum™ Type 2 Tag.
•
•
•
T: FEH indicates the Terminator TLV
L: not present
V: not present
Application Note
23 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
NFC Forum™ Type 2 Tag Examples
3.2.2
NDEF message in Dynamic Memory Structure: State READ / WRITE, CC3 = 00H
Based on the INITIALIZED NFC Forum™ Type 2 Tag configuration given in Chapter 3.2.1 following example
shows a NFC Forum™ Type 2 Tag in READ/WRITE state with a dynamic memory structure, a NDEF message
TLV and the Terminator TLV.
Table 27
Dynamic Memory Structure - READ/WRITE State (based on SLE 66R16P)
NFC Block
address
(hex)
0
1
2
3
00H
internal0
internal1
internal2
internal3
01H
internal4
internal5
internal6
internal7
02H
internal8
internal9
LOCK0 = 00H
LOCK1 = 00H
03H
CC0 = E1H
CC1 = 10H
CC2 = 7EH
CC3 = 00H
04H
01H
03H
D0H
20H
05H
24H
02H
03H
E0H
Byte Number within a block
1)
06H
2CH
04H
03H
13H
07H
D1H
01H
0FH
54H
08H
02H
64H
65H
48H
09H
65H
6CH
6CH
6FH
0AH
20H
77H
6FH
72H
0BH
6CH
64H
21H
FEH2)
0CH
...
...
...
34H
DynLock2 = 00H DynLock3 = 00H DynLock4 = 00H DynLock5 = 00H
35H
Reserved
Reserved
Reserved
Reserved
...
Reserved
Reserved
Reserved
Reserved
3FH
Reserved
Reserved
Reserved
Reserved
40H
...
...
...
FEH
...
FFH
...
1) Start of changed NDEF message record
2) Terminator TLV
Settings for the Static Lock bytes LOCK0 and LOCK1 and Capability Containers remain unchanged.
The data area starts at block 04H and holds the unchanged values for Lock Control TLV and Memory Control TLV.
The NDEF message record is updated.
•
NDEF message TLV
– T: 03H indicates the NDEF message
– L: 13H defines the length of the stored NDEF message
– V: NDEF record holding the “Hello world!” payload according to the NFC Forum™ Text Record Type
Definition
Note: The Read-only state can be configured by setting the CC3 byte to 0FH (“soft-lock”).
Application Note
24 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
4
Details about my-d™ NFC
The following section focusses on my-d™ NFC and the available derivatives.
4.1
my-d™ NFC Derivatives
The derivatives of the my-d™ NFC will be delivered with different settings to identify the chip. This information is
programmed into the Service Area at manufacturing and cannot be modified. Table 28 gives details on the chip
variants.
Access to the memory can be executed with both the NFC Forum™ Type 2 Tag and the my-d™ command set.
Table 28
Chip variants of my-d™ NFC (memory sizes in bytes)
Chip type
Total memory size Service Area
User Area (my-d™)
NFC memory size
SLE 66R16P
2560
24
2024
1024
SLE 66R32P
5120
24
4072
2048
The my-d™ NFC devices are available in UNINITIALIZED or in INITIALIZED configuration:
•
•
in UNINITIALIZED state the whole memory in the my-d™ Data Area is set to 00H and the memory needs to be
initialized prior to be used in a NFC Forum™ Type 2 Tag infrastructure. The NFC sector can be set up using
NFC Forum™ commands to enter the INITIALIZED and/or READ / WRITE state. Please refer to Chapter 2.3.
in INITIALIZED state the my-d™ NFC devices come with the Capability Container bytes programmed and an
empty NDEF message in the first NFC Forum™ Type 2 Tag sector. Table 44 shows the memory content of a
SLE 66R16P chip in INITIALIZED state. As long as this information is not locked (see Chapter 4.4) the data
may be overwritten to use the my-d™ NFC as plain, standard device again (= UNINITIALIZED state).
4.2
my-d™ NFC Memory Configuration
Table 29 and Table 30 show the default memory configuration of the my-d™ NFC devices. The whole memory is
configured to be plain memory and the chip is in User mode.
Table 29
my-d™ NFC SLE 66R16P memory configuration
my-d™
Service
Area
my-d™
Page
address
Byte Number within a page
0
1
2
3
4
5
6
7
0000H
0001H
my-d™ Service Area
0002H
0003H
0004H
my-d™ User Data
my-d™
Data
Area
...
007FH
0080H
...
...
Dedicated
1 kByte NFC Forum™ Type 2 Tag memory
Sector 0
...
00FFH
Application Note
25 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
Table 30
my-d™ NFC SLE 66R32P memory configuration
my-d™
Service
Area
my-d™
Page
address
Byte Number within a page
0
1
2
3
4
5
6
7
0000H
0001H
my-d™ Service Area
0002H
0003H
0004H
my-d™ User Data
...
...
my-d™
Data
Area
00FFH
0100H
...
...
Dedicated
1 kByte NFC Forum™ Type 2 Tag memory
Sector 0
017FH
0180H
...
...
Dedicated
1 kByte NFC Forum™ Type 2 Tag memory
Sector 11)
01FFH
1) Sector 1 has to be selected with the ‘Sector Select’ command
The general memory organization consists of pages with 8 bytes each. In the dedicated Type 2 Tag memory area
two 4-byte NFC memory blocks are mapped into one my-d™ page. Additionally the my-d™ NFC provides an
associated byte for each page to control read/write access (Access Condition byte, write-only).
The whole memory area (Service Area and User Area) is accessible with the my-d™ Command set. The given
page address range is valid for the my-d™ Command set.
The NFC Forum™ Type 2 Tag memory is mapped into the my-d™ Data Area; the start address of the dedicated
NFC Forum™ Type 2 Tag memory depends on the chip variant (see Table 34). This portion of the memory is
accessible with the NFC Forum™ Type 2 Tag command set.
Application Note
26 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
my-d™ NFC provides for each page an associated byte to control read/write access.
Table 31
NFC Forum™ Type 2 Tag memory mapping (based on SLE 66R32P)
NFC
Block
address
Byte Number within a block
0
1
2
3
n/a1)
my-d™
page
address
0000H
0001H
my-d™ Service Area and
my-d™ User Data
...
00FFH
0100H
H3)
01H
02H
03H
...
...
0101H
Dedicated
1 kByte NFC Forum™ Type 2 Tag memory
Sector 0
FCH
...
017FH
L
H
00H
Type 2 Tag address range
Sector 1
L
H
FFH
0180H
01H
L
H
02H
...
...
...
017EH
FEH
...
L
H
FDH
03H
L2)
my-d™ address range
Type 2 Tag address range
Sector 0
00H
0181H
Dedicated
1 kByte NFC Forum™ Type 2 Tag memory
Sector 1
FCH
L
H
...
01FEH
FDH
L
H
FEH
01FFH
FFH
L
H
1) n/a ... not addressable with the NFC Forum™ Type 2 Tag command set
2) L ... even NFC block addresses references to byte 0 - 3 of a my-d™ page.
The lower nibble of the access byte controls the read/write access of the byte 0 - 3 of a my-d™ page
3) H ... odd NFC block addresses references to byte 4 - 7 of a my-d™ page.
The higher nibble of the access byte controls the read/write access of the byte 4 - 7 of a my-d™ page
Application Note
27 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
4.2.1
my-d™ NFC Service Area
The Service Area is built-up with three my-d™ pages; they contain the unique chip ID (uid0 - uid6), the Issuer Tag
(IT) and the Chip Information (CI). This information shall be used to determine
•
•
•
chip type incl. memory size
supported command set
NFC memory configuration
Table 32
my-d™ NFC Service Area Content
Byte Number within a page
my-d™
Page
address
Service
Area
0000H
1)
2)
3)
4)
5)
0
88H
1
1)
0001H
uid0
IT
2
2)
3)
uid1
3
4
5
6
7
uid2
uid3
uid4
uid5
uid6
4)
5)
0002H
CI
Cascade Tag = 88H according to ISO/IEC 14443-3 Type A
Manufacturer ID
Chip Family Identifier
Issuer Tag
Chip Information
The Service Area is outside the address range of the NFC Forum™ Type 2 Tag command set; in order to access
the Service Area memory my-d™ commands have to be used. Writing to it is prohibited by the Read-only Access
Condition which is stored in the internal chip administration area.
The Chip Family Identifier is available immediately after the anti-collision (page 0000H); the chip manufacturer and
the supported command set can be determined quickly.
Table 33
Chip Family Identification my-d™ NFC
UID field
Value
Description
uid0
05H
Manufacturer ID according to ISO/IEC7816-6/AM1
uid1
20H
1)
Identifies the support of the my-d™ and the
NFC Forum™ Type 2 Tag command set
Lower nibble: RFU and set to 0H
1) Please note that the lower nibble shall not be checked for chip family identification!
In order to determine the exact chip variant it is necessary to select the chip (to read pages 0001H and 0002H).
After selecting the my-d™ NFC chip memory access is possible for further operations.
The lower nibble of the Issuer Tag (IT) defines parts of the memory to be accessible with NFC Forum™ Type 2
Tag commands and the start address of the NFC sector.
Table 34
Issuer Tag (IT) of my-d™ NFC
Issuer Tag
(lower nibble)
Type
NFC Sector
Start address
NFC memory size [bytes] Highest page address
0010B
SLE 66R16P
0080H
1024
00FFH
0100B
SLE 66R32P
0100H
2048
01FFH
Application Note
28 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
Table 35
Chip Information (CI) of my-d™ NFC
Chip Information1)
Type
11xx x100B
SLE 66R16P
11xx x101B
SLE 66R32P
1) Please note that Bit[5:3] shall not be evaluated as this information may change for future revisions.
For more details please refer to the my-d™ NFC data book.
4.3
Command sets
Table 36 and Table 37 list the commands which shall be used to set up the NFC sector in the my-d™ device.
my-d™ NFC devices can be operated using the NFC Forum™ Type 2 Tag command set only within the whole life
cycle of the NFC platform.
Table 36
Command
NFC Forum™ Type 2 Tag command set
1)
Op-Code
Comment
Address range
Sector Select
C2H
Sector selection
-
Read
30H
Reads 16 bytes of data
NFC sector, 00H - FFH
Write
A2H
Writes 4 byte of data
NFC sector, 00H - FFH
2)
1) Please refer to the NFC Forum™ Type 2 Tag specification for detailed command descriptions
2) For variants with more than 1 kByte of Type 2 Tag memory
It is recommended to use the my-d™ commands in order to clearly identify the chip type. This information is
necessary to realize correct block locking within the my-d™ NFC devices. NFC memory block can only be
physically locked with the my-d™ Write Byte command.
Table 37
Command
my-d™ NFC command set
1)
Op-Code
Comment
my-d™ Read
10H
Reads data from one page (8 bytes)
my-d™ Write
30H
Writes data to one page (8 bytes)
my-d™ Write Byte
E0H
Write data to the specified byte within a page
1) Please refer to the my-d™ NFC data book for detailed command descriptions
Application Note
29 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
4.3.1
my-d™ Read
The my-d™ Read command reads 8 bytes of the memory (one page) if the Access Condition permits a read
access.
Command ‚my-d™ Read’
ISO/IEC 14443-3 Type A PCD
Read
(10H)
PageADR
Response my-d™ NFC
CRC
DATA
CRC
or ...
NACK
Figure 6
my-d™ Read Command
Table 38
‘my-d™ Read’ command parameters
Length1)
Name
Read
PageADR
2)
CRC
Remark
1
command opcode: 10H
2
Page address to be read
The valid address range depends on product variant
SLE 66R16P: 0000H - 00FFH
SLE 66R32P: 0000H - 01FFH
2
CRC
1) length of parameter field in [byte(s)]
2) lower byte sent first
Table 39
‘my-d™ Read’ command response parameters
Name
Length
Remark
DATA
8
Page content
CRC
2
CRC
1
Error on Read command; replied without CRC
or
NACK
Application Note
30 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
4.3.2
my-d™ Write
The my-d™ Write command writes data to the specified page (8 bytes).
In case of successful programming the my-d™ chip sends back an acknowledge. In case of an error or if the
Access Conditions do not allow to write a “not acknowledge” will be returned to the PCD.
Command ‚my-d™ Write’
ISO/IEC 14443-3 Type A PCD
Write
(30H)
PageADR
Response my-d™ NFC
DATA
CRC
ACK
or ...
NACK
Figure 7
my-d™ Write Command
Table 40
‘my-d™ Write’ command parameters
Length1)
Name
Write
Remark
1
command opcode: 30H
2
Page address to be written
The valid address range depends on product variant
SLE 66R16P: 0000H - 00FFH
SLE 66R32P: 0000H - 01FFH
DATA
8
Data to be written
CRC
2
CRC
PageADR
2)
1) length of parameter field in [byte(s)]
2) lower byte sent first
Table 41
‘my-d™ Write’ command response parameters
Name
Length
Remark
ACK
1
Write successful; replied without CRC
NACK
1
Error on Write command; replied without CRC
Application Note
31 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
4.3.3
my-d™ Write Byte
The my-d™ Write Byte command writes the data to the specified byte in the specified page. This command shall
be used to modify the Access Condition of a page.
In case of successful programming the chip sends back an acknowledge frame.
In case of an error or if the Access Condition does not allow the access a “not acknowledge” frame will be send
back to the PCD. Please note that the only possible Access Condition for the execution of this command is READ
/ WRITE (AH).
Command ‚my-d™ Write Byte’
ISO/IEC 14443-3 Type A PCD
WrBy
(E0H)
PageADR
ByADR
(09H)
Response my-d™ NFC
DATA
CRC
ACK
or ...
NACK
Figure 8
my-d™ Write Byte Command
Table 42
‘my-d™ Write Byte’ command parameters
Length1)
Name
WrBy
Remark
1
command opcode: E0H
2
Page address to be written
The valid address range depends on product variant
SLE 66R16P: 0000H - 00FFH
SLE 66R32P: 0000H - 01FFH
ByADR
1
Byte address within a page; valid address range: 00H - 09H
ByADR must be set to 09H (address of Access Condition byte)
DATA
1
Data to be written
CRC
2
CRC
PageADR
2)
1) length of parameter field in [byte(s)]
2) lower byte sent first
Table 43
‘my-d™ Write Byte’ command response parameters
Name
Length
Remark
ACK
1
Write successful; replied without CRC
NACK
1
Error on Write command; replied without CRC
Application Note
32 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
4.4
Block locking with my-d™ NFC
my-d™ NFC devices may be in UNINITIALIZED (affects deliveries until 2011) or in INITIALIZED state (deliveries
beginning in 2011 will be initialized already).
In UNINITIALIZED state the NFC sector is not prepared and the chip cannot be operated in an NFC
Forum™ Type 2 Tag infrastructure. The NFC sector can be set up using NFC Forum™ commands to enter the
INITIALIZED and/or READ / WRITE state. Please refer to Chapter 2.3.
In INITIALIZED state the my-d™ NFC chips come with the Capability Container bytes programmed and an empty
NDEF message in the first NFC Forum™ Type 2 Tag sector.
Some applications may require to lock blocks in the NFC Forum™ Type 2 Tag user data area without changing
the setting of the Capability Container to READ-ONLY (CC3 - read and write access capability).
my-d™ NFC offers irreversible block locking. This feature can be used by accessing the internal Adminstration
Area memory of the chip. This portion of the memory can only be addressed with the my-d™ command set (listed
in Table 37).
In order to correctly address the Adminstration area it is necessary to determine the exact chip type; for this reason
the my-d™ Read command has to be used as the Service Area holding this information cannot be read with the
NFC Forum™ Type 2 Tag command set to retrieve the information.
Figure 9 illustrates the sequence to determine the chip type.
my-d™ NFC (selected)
Figure 9
my-d™ Read page 0000H
Manufacturer ID
Chip Family Identifier
my-d™ Read page 0001H
Issuer Tag
my-d™ Read page 0002H
Chip Information
Chip type determination
After reading pages 0000H to 0002H the chip type, memory size and the start address of the NFC sector are
identified.
To lock a block it is necessary to access the internal administration area to modify the Access Condition. For this
reason the my-d™ Write Byte command has to be used. The default setting of the Access Condition allows READ
/ WRITE access.
As two NFC Forum™ Type 2 Tag blocks are mapped into one my-d™ page also the Access Condition is split into
two parts; each nibble defines the access rights for a single Type 2 Tag block. The lower nibble of the Access
Condition determines the access rights for the block with the even block address, whereas the block when the odd
address is controlled by the higher nibble of the Access Condition of the corresponding my-d™ page.
Application Note
33 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
Table 44 shows the mapping of the NFC Forum™ Type 2 Tag memory blocks into the my-d™ pages. It includes
also the content of the my-d™ Service Area, but this memory portion is outside the Type 2 Tag address range.
Furthermore the allocation of the Access Condition to my-d™ pages respectively NFC Forum™ Type 2 Tag
memory blocks are listed.
Table 44
NFC Forum™ Type 2 Tag memory mapping (based on SLE 66R16P)
NFC
Block
address
Byte Number within a block
0
1
2
3
n/a
88H
05H1)
20H2)
uid2
uid3
uid4
uid5
uid6
...
...
3)
...
IT
...
...
...
...
CI
...
...
...
...
...
...
...
4)
my-d™
Block
page
reference
address
0000H
L
H
0001H
L
H
0002H
L
H
0003H
L
...
...
...
...
007FH
L
my-d™ User Data
H
Type 2 Tag address range
00H
Internal0
Internal1
Internal2
Internal3
Internal7
01H
Internal4
Internal5
Internal6
02H
Internal8
Internal9
LOCK0=00H
LOCK1=00H
CC3 = 00H
03H
CC0 = E1H
CC1 = 10H
CC2 = 7EH
04H
03H
00H
FEH
L
H
0081H
L
H
0082H
L
05H
H
...
...
...
...
FEH
00FFH
FFH
1)
2)
3)
4)
0080H
my-d™ address range
H
...
...
L
H
Manufacturer ID
Chip Family Identifier
Issuer Tag
Chip Information
Application Note
34 / 36
2011-11-14
SLE 66RxxP
Type 2 Tag Operation
Details about my-d™ NFC
The Access Condition for every my-d™ memory page is stored in the internal administration area of the
my-d™ NFC chip. It is located at Byte 09H on any my-d™ page. Table 45 defines the available access rights.
Please be aware that any value different to AH or 6H prevents any access to the corresponding block. Chapter 4.5
summarizes the considerations for my-d™ NFC devices.
Table 45
Access Conditions and access rights
Access
Condition1)
Access Right byte 0 - 3 (even block)
Access Right byte 4 - 7 (odd block)
AAH
READ / WRITE
READ / WRITE
A6H
READ / WRITE
READ-ONLY
6AH
READ-ONLY
READ / WRITE
66H
READ-ONLY
READ-ONLY
any other value
invalid
invalid
1) Access condition value A6H and 66H lock the internal access condition.
4.5
Important Notes
In order to prevent problems using the Type 2 Tag memory within my-d™ NFC it is important to consider the
following:
•
Access Conditions can only be changed with my-d™ commands and not with Type 2 Tag commands
•
to write-protect a certain Type 2 Tag block, the Access Condition in the lower nibble (for even pages) or the
higher nibble (for odd pages) of the corresponding my-d™ page has to be set to 6H (READ-ONLY)
•
any Access Conditions other than AH or 6H prevent access to the Type 2 Tag memory
•
the lower nibble of the Access Condition byte defines the access right for all my-d™ commands. If the lower
nibble is set to 6H, it is not possible to change the data content or the Access Condition anymore. Therefore,
by programming the Access Condition byte to A6H, page data bytes 0 to 3 are set to READ-ONLY whereas
page data bytes 4 to 7 allow READ / WRITE access using the NFC command set.
•
LOCK0 and LOCK1 values have to be programmed by the issuer/user and have no influence on the memory
access rights of the Type 2 Tag memory. The memory can be altered with as long as the Access Condition
allows the execution of the command.
•
my-d™ Write Byte command shall only be used with the byte address parameter set to 09H. Any other value
may change unintentionally the Type 2 Tag memory content or the Access Condition. Access to certain blocks
in the memory may be disrupted.
Application Note
35 / 36
2011-11-14
w w w . i n f i n e o n . c o m
Published by Infineon Technologies AG
36