AT88RF1354 SPI User Guide For CryptoRF® 8586A—RFID—5/09 Table of Contents Section 1 Introduction............................................................................................................................. 1-1 1.1 Product Description...................................................................................................... 1-1 1.2 System Diagram........................................................................................................... 1-1 1.3 Scope ........................................................................................................................... 1-2 1.4 Conventions ................................................................................................................. 1-2 Section 2 AT88RF1354 Instruction Set.................................................................................................. 2-1 2.1 Abort Command [$0D] ................................................................................................. 2-2 2.2 Clear Command [$0E] ................................................................................................. 2-3 2.3 Poll Continuous (REQB) Command [$02] ................................................................... 2-4 2.4 Poll Single (REQB) Command [$01]............................................................................ 2-7 2.5 Poll Single (WUPB) Command [$01] ........................................................................... 2-9 2.6 Read Buffer Command [$08] ..................................................................................... 2-11 2.7 Read Register Command [$07] ................................................................................. 2-13 2.8 RF OFF Command [$0B] ........................................................................................... 2-14 2.9 RF ON Command [$0A]............................................................................................. 2-15 2.10 Sleep Command [$0C]............................................................................................... 2-16 2.11 TX Data Command [$03] ........................................................................................... 2-17 2.12 Write Buffer Command [$09] ..................................................................................... 2-19 2.13 Write Register Command [$06].................................................................................. 2-21 Section 3 CryptoRF Commands............................................................................................................. 3-1 3.1 Command Overview .................................................................................................... 3-1 3.2 REQB Polling Command [$05] .................................................................................... 3-2 3.3 ATTRIB Command [$1D] ............................................................................................. 3-4 3.4 HLTB Command [$50] ................................................................................................. 3-6 3.5 Set User Zone Command [$c1] ................................................................................... 3-8 3.6 Read User Zone Command [$c2] .............................................................................. 3-10 3.7 Read User Zone (Large Memory) Command [$c2] ................................................... 3-12 3.8 Write User Zone Command [$c3] .............................................................................. 3-14 3.9 Write User Zone (Large Memory) Command [$c3].................................................... 3-16 3.10 Write System Zone Command [$c4] .......................................................................... 3-18 3.11 Read System Zone Command [$c6].......................................................................... 3-20 3.12 DESELECT Command [$cA] ..................................................................................... 3-22 3.13 IDLE Command [$cB] ................................................................................................ 3-24 3.14 Check Password Command [$cC] ............................................................................. 3-26 Section 4 Register Summary.................................................................................................................. 4-1 4.1 Overview ...................................................................................................................... 4-1 4.2 AT88RF1354 Register Set........................................................................................... 4-1 4.3 AT88RF1354 Register Memory Map ........................................................................... 4-2 4.4 AT88RF1354 Register Bit Coding Summary ............................................................... 4-4 Appendix A Initialization Procedure ...................................................................................................... A-1 Appendix B The SPI Serial Interface...................................................................................................... B-1 B.1 SPI Interface ................................................................................................................ B-1 i 8586A—RFID—5/09 Table of Contents (continued) Appendix C ii 8586A—RFID—5/09 Index..................................................................................................................................... C-1 C.1 Figure Index ................................................................................................................. C-1 C.2 Table Index .................................................................................................................. C-1 C.3 Revision History ...........................................................................................................C-2 AT88RF1354 SPI User Guide for CryptoRF Section 1 Introduction Features AT88RF1354 Instruction Set Examples CryptoRF Instruction Set Examples AT88RF1354 Register Definitions Summary Initialization Procedure Description This document describes the instruction set examples for the AT88RF1354 13.56 MHz ISOI/IEC 14443 Type B Reader IC and the CryptoRF PICC. Device initialization examples are included for reference by the software developer or embedded systems programmer using this RF reader. This specification is formatted as a reference document, with each command description and register definition on a separate page. 1.1 Product Description The AT88RF1354 is a smart, high performance ISO/IEC 14443 Type B RF Reader IC. The AT88RF1354 communicates with RFID Transponders or Contactless Smartcards using the industry standard ISO/IEC 14443-2 Type B signal modulation scheme and ISO/IEC 14443-3 Type B frame format. Data is exchanged half duplex at a 106k bit per second rate. A two byte CRC_B provides communication error detection capability. The AT88RF1354 is compatible with 3.3 V and 5 V host microcontrollers with two-wire or SPI serial interfaces. In two-wire interface mode the AT88RF1354 operates as a TWI slave and requires four microcontroller pins for data communication and handshaking. In SPI interface mode the AT88RF1354 operates as a mode 0 SPI slave and requires six microcontroller pins for data communication and handshaking. The AT88RF1354 device performs all RF communication packet formatting, decoding, and communication error checking. The host microcontroller is not burdened with RF encoding, timing, or protocol functions as these tasks are all performed by the AT88RF1354 device. To communicate with a RFID transponder the host microcontroller sends a data packet to the AT88RF1354 for transmission over the RF communications channel. When the response is received from the transponder, the AT88RF1354 extracts the data packet and returns it to the host microcontroller. 1.2 System Diagram Figure 1. Communications in an RFID System Host Microcontroller Serial Interface Reader IC RF Communications Card 1-1 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 1.3 Scope The AT88RF1354 SPI User Guide includes command illustrations and examples necessary to communicate with a CryptoRF PICC. This document summarizes AT88RF1354 and CryptoRF device specific details. All examples assume a microcontroller is being used as a pass-thru device between the PC host and the reader. The microcontroller translates command and data strings from the host into SPI format. Likewise all SPI response data from the AT88RF1354 is translated back to strings by the microcontroller. Refer to the AT88RF1354 Datasheet for electrical details, the AT88RF1354 Command Reference Guide and the CryptoRF Specification for complete device detail. Reference Designs and additional technical information is available at: http://www.atmel.com/dyn/products/product_card.asp?part_id=4418. 1.4 Conventions ISO/IEC 14443 nomenclature is used in this document where applicable. The following terms and abbreviations are utilized throughout this document. Additional terms are defined in the section in which they are used. Card: A Contactless Smart Card or RFID Tag in proximity to the reader antenna. Host: The personal computer connected to the serial interface of the reader IC. PCD: Proximity Coupling Device – is the host and reader with antenna. PICC: Proximity Integrated Circuit Card – is the tag/card containing an IC and antenna. Reader: The AT88RF1354 Integrated Circuit with loop antenna and associated circuitry RFU: Reserved for Future Use – is any feature, memory location, or bit that is held as reserved for future use by the ISO standards committee or by Atmel. $ xx: Hexadecimal Number – denotes a hex number “xx” (Most Significant Bit on left). xxxx b: Binary Number – denotes a binary number “xxxx” (Most Significant Bit on left). See Atmel Application Note Understanding the Requirements of ISO/IEC 14443 for Type B Proximity Contactless Identification Cards at www.atmel.com for detailed information regarding the ISO/IEC 14443 RF communication protocol. 1-2 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 1.4.1 SPI Command Format Each command example shown in this document is presented in two formats. First each command is shown as a high level illustration (Figure 2). This illustration shows high level byte information plus processing and signaling information. RF transmissions are denoted by a green text box. Reader and PICC response bytes are shown below the blue text box. All command/response examples in this document assume the Host initiates communication by sending a command string from its serial port. A microcontroller intercepts the Host’s command string and converts the string into SPI format. The SPI formatted command is then passed to the AT88RF1354 SPI interface. The Host’s command string is shown in the left-most column. The reader processes the SPI formatted command passed to it from the microcontroller. The reader’s actions are shown in the middle column. The CryptoRF PICC processes commands received from the reader. The PICC response is RF transmitted back to the reader. PICC actions and responses are shown in the right-most column. The PICC response is processed by the reader. When processing is complete, the AT88RF1354 ISTAT line goes high to indicate data is ready. The AT88RF1354 will not accept additional commands when ISTAT is high. The AT88RF1354 data buffer must be emptied before continuing. Empty the data buffer by clocking data out the SPI interface. Depending upon the command, a response may be generated from just the reader or the response may include data bytes from both the reader and the PICC. The bytes are shown in the order in which they are sent and transmitted. Following each illustration is a detailed description of the command and response string (Figure 3). Command strings sent from the Host to the reader are preceded by the letter “O”. Responses received by the Host are preceded by the letter “I”. 1-3 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF Figure 2. Illustration Example – Serial Communications with the SPI Interface Host Reader PICC Send six bytes AT88RF1354 command Bytes sent to PICC AT88RF1354 PARAM FWI PICC command PICC PARAM Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID N PICC ACK/NACK PICC Status Code ISTAT stays Low 1-4 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF Figure 3. Detail Example – Serial Communications with the SPI Interface String Decode > O0006 Host sends six bytes thru microcontroller to AT88RF1354 serial port. > 03 > 02 Data bytes sent to PICC. In this example 2 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 11 To PICC: Upper nibble is CID assigned in the ATTRIB command. Lower nibble is $1. > 00 To PICC: PARAM. Upper nibble is $0 (disable anti-tearing). Lower nibble is user zone 0. AT88RF1354 TX Data command. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 03 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 11 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $1. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. All examples assume a microcontroller is being used as a pass-thru device between the PC host and the reader. The microcontroller translates command and data strings from the host into SPI format. Likewise all SPI response data from the AT88RF1354 is translated back to strings by the microcontroller. 1-5 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 1.4.2 ACK/NACK Response Byte The first byte of each response is usually an ACK/NACK byte which indicates if the requested operation succeeded or failed. The bit definitions for the ACK/NACK byte are shown in Figure 4 and Figure 5. This response byte contains 6 bits from the Error Register, and 2 bits which indicate the success or failure of the requested operation. 01b in the least significant bits is an ACK, indicating success. 10b in the least significant bits is a NACK, indicating failure. The contents of the error register are not relevant to non-RF commands and can be ignored. Figure 4. ACK/NACK Byte Format for ACK Response Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CRC FRAME BYTE TIME COL SPE 0b 1b Error Register Bits Figure 5. ACK ACK/NACK Byte Format for NACK Response Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CRC FRAME BYTE TIME COL SPE 1b 0b Error Register Bits NACK The three RF communication commands Poll Continuous, Poll Single, and TX Data return the Error Register contents in the first byte of the response. Figure 6 shows the Error Register format. Figure 6. 1-6 8586A—RFID—5/09 Error Register Format in RF Command Responses Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CRC FRAME BYTE TIME COL SPE 0b 0b AT88RF1354 SPI User Guide For CryptoRF 1.4.3 First Response Byte By Command The first byte of each response indicates if the requested operation succeeded or failed. When a command initiates a RF operation where the reader and PICC talk, the first response byte will always be the AT88RF1354 EREG register contents. When the command initiates a non-RF operation where there is no reader and PICC communication the first response byte is usually the AT88RF1354 ACK/NACK response. The exception is the Sleep command. There is no response to the sleep command. The first byte response for the AT88RF1354 command set and the CryptoRF command set are shown in Table 1 and Table 2, respectively. Table 1. AT88RF1354 Command Set – First Response Byte Command Name First Response Byte Abort AT88RF1354 ACK/NACK Clear AT88RF1354 ACK/NACK Poll Continuous AT88RF1354 EREG Register Contents Poll Single (REQB) AT88RF1354 EREG Register Contents Poll Single (WUPB) AT88RF1354 EREG Register Contents Read Buffer AT88RF1354 ACK/NACK Read Register AT88RF1354 ACK/NACK RF OFF AT88RF1354 ACK/NACK RF ON AT88RF1354 ACK/NACK Sleep No Response TX Data AT88RF1354 EREG Register Contents Write Buffer AT88RF1354 ACK/NACK Table 2. CryptoRF Command Set – First Response Byte Command Name All commands First Response Byte AT88RF1354 EREG Register Contents 1-7 8586A—RFID—5/09 Section 2 AT88RF1354 Instruction Set Table 3. Instruction Set Sorted by Command Name Command Name Description Code Abort Exit Command in Progress $0D Clear Exit Command in Progress, Clear Buffer, Turn RF OFF $0E Poll Continuous Poll Continuously for Type B PICCs $02 Poll Single (REQB) Poll Once for Type B PICCs $01 Poll Single (WUPB) Poll Once for Type B PICCs in the Halt or Idle States $01 Read Buffer Read Data Buffer $08 Read Register Read Configuration Register $07 RF OFF Turn Off 13.56 MHz RF Field $0B RF ON Turn On 13.56 MHz RF Field $0A Sleep Activate Standby Mode $0C TX Data Transmit Data to PICC and Receive the Response $03 Write Buffer Write Data Buffer $09 Write Register Write Configuration Register $06 All other command code values are NOT supported Commands in the following sections are listed in alphabetical order. 2-1 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.1 Abort Command [$0D] This command aborts a command in progress and places the reader in the idle state. 2.1.1 Command Format Host Reader PICC Send one byte Abort ($0D) Command Processing ISTAT goes High Get one byte Response Bytes ACK/NACK ISTAT stays Low 2.1.2 Example String Decode > O0001 Host sends one byte thru microcontroller to AT88RF1354 serial port. > 0D AT88RF1354 ABORT command. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > > I0001 Host gets one byte from AT88RF1354 buffer. 01 AT88RF1354 Response: $01 (Acknowledge). ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.1.3 Operation The Abort command stops a command operation in progress. The contents of the RAM buffer and registers are not modified by the Abort command. 2-2 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.2 Clear Command [$0E] This command aborts a command in progress, turns off the RF field, clears the RAM buffer, and places the reader in the idle state. 2.2.1 Command Format Host Reader PICC Send one byte Clear ($0E) Command Processing ISTAT goes High Get one byte Response Bytes ACK/NACK ISTAT stays Low 2.2.2 Example String Decode > O0001 Host sends one byte thru microcontroller to AT88RF1354 serial port. > 0E AT88RF1354 CLEAR command. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > > I0001 Host gets one byte from AT88RF1354 buffer. 01 AT88RF1354 Response: $01 (Acknowledge). ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.2.3 Operation The Clear command stops a command in progress, turns off the RF field, and clears the RAM buffer. The contents of the error register are reset by the Clear command. The contents of the other registers are unchanged. 2-3 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.3 Poll Continuous (REQB) Command [$02] This command performs multiple Type B polling sequences to detect cards near the antenna. The first response is returned to the host. In the event a card response containing a communication error is received, then an error code is returned. If no response is detected, then polling continues until an Abort command is sent by the host. The optional Smart Poll mode modifies the polling operation to include error tolerance. In Smart Poll mode polling continues until an error free card response is received. 2.3.1 Command Format Host PICC Reader Send three bytes Poll Continuous ($02) AFI PARAM Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get thirteen bytes Response Bytes EREG Register Byte $50 PUPI 0 PUPI 1 PUPI 2 PUPI 3 APP 0 APP 1 APP 2 APP 3 Protocol 1 Protocol 2 Protocol 3 ISTAT stays Low 2-4 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.3.2 Example String Decode > O0003 Host sends three bytes thru microcontroller to AT88RF1354 serial port. > 02 AT88RF1354 POLL CONTINUOUS command. Poll for Type B PICC's until a response is received. > 00 To PICC: AFI. A $00 activiates all Type B PICC's. > 00 N To PICC: PARAM. Specify a REQB when bit [3] is 0b, and 2 anti-collision slots where N is bits [2:0]. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I000D Host gets thirteen bytes from AT88RF1354 buffer. > 00 > 50 PICC Response: $50 (Success). > FF PICC Response: PUPI 0 -- CryptoRF System Zone Byte $00 > FF PICC Response: PUPI 1 -- CryptoRF System Zone Byte $01 > FF PICC Response: PUPI 2 -- CryptoRF System Zone Byte $02 > FF PICC Response: PUPI 3 -- CryptoRF System Zone Byte $03 > FF PICC Response: APP 0 -- CryptoRF System Zone Byte $04 > FF PICC Response: APP 1 -- CryptoRF System Zone Byte $05 > FF PICC Response: APP 2 -- CryptoRF System Zone Byte $06 > 22 PICC Response: APP 3 -- CryptoRF System Zone Byte $07 (22 = AT88SC0404CRF density) > 00 PICC Response: Protocol 1 -- $00 > 10 PICC Response: Protocol 2 -- CryptoRF System Zone byte $08 > 51 PICC Response: Protocol 3 -- $51 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.3.3 Operation The functionality of the Poll Continuous command is identical to the Poll Single command, except that after the final Slot-MARKER is sent, if no card response is received, the reader chip repeats the polling procedure. The Poll Continuous command is like an infinite loop of Poll Single commands that is broken when a card response (good or bad) is received. This command performs multiple polling sequences with “N” slots using the ISO/IEC14443-3 Type B commands REQB, WUPB, and Slot-MARKER. The CPR0 default Communication Protocol settings are used by this command. A polling sequence consists of either an REQB or WUPB command, followed by the number of Slot-MARKER commands indicated by “N”. When a response is received, then the polling sequence is stopped and the response is returned to the host. When a communication error is detected, then the polling sequence is stopped and an error code is returned to the host. Subsequent commands will require the PUPI data read from the PICC. A user should expect each PICC will contain a unique PUPI. A system should also utilize the density code stored in APP byte 3. The density code information can easily be used to identify different CryptoRF user memory sizes. Refer to the CryptoRF Specification for a complete list of CryptoRF density codes. 2-5 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.3.4 Smart Poll Mode Operation Smart Poll mode is enabled by sending the Poll Continuous command with N = 111b. In the Smart Poll mode, the reader will continually send REQB/WUPB with N = 000b until it receives a card response. If this response is valid, it will return the response to the host. If the card response generates a communication error, the reader assumes that there was a collision. It will then send the next REQB/WUPB with N = 001b, and if there is no valid card response it will send SlotMARKER for slot two. If there is no response from a card in either slot, then the reader returns to polling with N = 000b. If there is an error free card response, then it will be returned to the host. If there is another collision and no valid response, however, N will again be incremented, and the reader will send the correct sequence of REQB/WUPB and Slot-MARKERs. In the case where Smart Poll mode reaches 16 slots and only collisions are detected, then polling is stopped, and a Smart Poll error code is returned to the host. If no error-free card response is detected, then polling continues until an Abort command is sent by the host. 2-6 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.4 Poll Single (REQB) Command [$01] This command performs a single Type B polling sequence to detect cards near the antenna. The first response is returned to the host. In the event no error free response is detected, then an error code is returned. 2.4.1 Command Format Host Reader PICC Send three bytes Poll Single ($01) AFI PARAM Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get thirteen bytes Response Bytes EREG Register Byte $50 PUPI 0 PUPI 1 PUPI 2 PUPI 3 APP 0 APP 1 APP 2 APP 3 Protocol 1 Protocol 2 Protocol 3 ISTAT stays Low 2-7 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.4.2 Example String Decode > O0003 Host sends three bytes thru microcontroller to AT88RF1354 serial port. > 01 AT88RF1354 POLL SINGLE command. Poll once for Type B PICC's. > 00 To PICC: AFI. A $00 activiates all Type B PICC's. > 00 To PICC: PARAM. Specify a REQB when bit [3] is 0b, and 2N anti-collision slots where N is bits [2:0]. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I000D Host gets thirteen bytes from AT88RF1354 buffer. > 00 > 50 PICC Response: $50 (Success). > FF PICC Response: PUPI 0 -- CryptoRF System Zone Byte $00 > FF PICC Response: PUPI 1 -- CryptoRF System Zone Byte $01 > FF PICC Response: PUPI 2 -- CryptoRF System Zone Byte $02 > FF PICC Response: PUPI 3 -- CryptoRF System Zone Byte $03 > FF PICC Response: APP 0 -- CryptoRF System Zone Byte $04 > FF PICC Response: APP 1 -- CryptoRF System Zone Byte $05 > FF PICC Response: APP 2 -- CryptoRF System Zone Byte $06 > 22 PICC Response: APP 3 -- CryptoRF System Zone Byte $07 (22 = AT88SC0404CRF density code) > 00 PICC Response: Protocol 1 -- $00 > 10 PICC Response: Protocol 2 -- CryptoRF System Zone byte $08 > 51 PICC Response: Protocol 3 -- $51 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.4.3 Operation This command performs one polling sequence with “N” slots using the ISO/IEC14443-3 Type B commands REQB, WUPB, and Slot-MARKER. The CPR0 default Communication Protocol settings are used by this command. A polling sequence consists of either an REQB or WUPB command, followed by the number of Slot-MARKER commands indicated by “N”. When a card response not containing a CRC error is received, then the polling sequence is stopped and the response is returned to the host. Subsequent commands will require the PUPI data read from the PICC. A user should expect each PICC will contain a unique PUPI. A system should also utilize the density code stored in APP byte 3. The density code information can easily be used to identify different CryptoRF user memory sizes. Refer to the CryptoRF Specification for a complete list of CryptoRF density codes. 2-8 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.5 Poll Single (WUPB) Command [$01] This command performs a single Type B polling sequence to detect cards in the Halt State or Idle State near the antenna. The first response is returned to the host. In the event no error free response is detected, then an error code is returned. 2.5.1 Command Format Host Reader PICC Send three bytes Poll Single ($01) AFI PARAM Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get thirteen bytes Response Bytes EREG Register Byte $50 PUPI 0 PUPI 1 PUPI 2 PUPI 3 APP 0 APP 1 APP 2 APP 3 Protocol 1 Protocol 2 Protocol 3 ISTAT stays Low 2-9 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.5.2 Example String Decode > O0003 Host sends three bytes thru microcontroller to AT88RF1354 serial port. > 01 AT88RF1354 POLL SINGLE command. Poll once for Type B PICC's. > 00 To PICC: AFI. A $00 activiates all Type B PICC's. > 08 To PICC: PARAM. Specify a WUPB when bit [3] is 1b, and 2N anti-collision slots where N is bits [2:0]. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I000D Host gets thirteen bytes from AT88RF1354 buffer. > 00 > 50 PICC Response: $50 (Success). > FF PICC Response: PUPI 0 -- CryptoRF System Zone Byte $00 > FF PICC Response: PUPI 1 -- CryptoRF System Zone Byte $01 > FF PICC Response: PUPI 2 -- CryptoRF System Zone Byte $02 > FF PICC Response: PUPI 3 -- CryptoRF System Zone Byte $03 > FF PICC Response: APP 0 -- CryptoRF System Zone Byte $04 > FF PICC Response: APP 1 -- CryptoRF System Zone Byte $05 > FF PICC Response: APP 2 -- CryptoRF System Zone Byte $06 > 22 PICC Response: APP 3 -- CryptoRF System Zone Byte $07 (22 = AT88SC0404CRF density code) > 00 PICC Response: Protocol 1 -- $00 > 10 PICC Response: Protocol 2 -- CryptoRF System Zone byte $08 > 51 PICC Response: Protocol 3 -- $51 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.5.3 Operation This command performs one polling sequence with “N” slots using the ISO/IEC14443-3 Type B commands REQB, WUPB, and Slot-MARKER. The CPR0 default Communication Protocol settings are used by this command. A polling sequence consists of either an REQB or WUPB command, followed by the number of Slot-MARKER commands indicated by “N”. When a card response not containing a CRC error is received, then the polling sequence is stopped and the response is returned to the host. Subsequent commands will require the PUPI data read from the PICC. A user should expect each PICC will contain a unique PUPI. A system should also utilize the density code stored in APP byte 3. The density code information can easily be used to identify different CryptoRF user memory sizes. Refer to the CryptoRF Specification for a complete list of CryptoRF density codes. 2-10 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.6 Read Buffer Command [$08] This command reads data from the RAM Buffer of the reader. This command is not necessary for typical RFID applications. However this command may be useful during code development. 2.6.1 Command Format Host Reader PICC Send three bytes Read Buffer ($08) Starting Address "L", Data Bytes Read Command Processing ISTAT goes High Get five bytes Response Bytes ACK/NACK Data 1 Data 2 Data "L - 1" Data "L" ISTAT stays Low 2-11 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.6.2 Example String Decode > O0003 Host sends three bytes thru microcontroller to AT88RF1354 serial port. > 08 AT88RF1354 Read Data Buffer Command. > 00 Starting address. > 04 Length "L" of data to be read in bytes. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I0005 Host gets five bytes from AT88RF1354 buffer. > 01 AT88RF1354 Response: $01 (Acknowledge). > 12 AT88RF1354 Response: Data 1 > 34 AT88RF1354 Response: Data 2 > 12 AT88RF1354 Response: Data "L - 1" > 34 AT88RF1354 Response: Data "L" ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.6.3 Operation Read the internal 256 byte RAM buffer starting at the Address specified. 2-12 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.7 Read Register Command [$07] This command reads the contents of the specified configuration register. 2.7.1 Command Format Host Reader PICC Send two bytes Read Register ($07) Register Address Command Processing ISTAT goes High Get two bytes Response Bytes ACK/NACK Register Data ISTAT stays Low 2.7.2 Example String Decode > O0002 Host sends two bytes thru microcontroller to AT88RF1354 serial port. > 07 AT88RF1354 Read Register Instruction. > 0F Select Receiver Register. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I0002 Host gets two bytes from AT88RF1354 buffer. > 01 AT88RF1354 Response: $01 (Acknowledge). > 16 AT88RF1354 Response: Value dependent upon last data written into the Receiver Register. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.7.3 Operation Read an AT88RF1354 configuration register. To read a different register, substitute the $0F data byte shown in the example with a different, valid AT88RF1354 register address. A list of valid register addresses are shown in Section 4. 2-13 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.8 RF OFF Command [$0B] This command turns the 13.56 MHz RF field off. 2.8.1 Command Format Host Reader PICC Send one byte RF OFF ($0B) Command Processing ISTAT goes High Get one byte Response Bytes ACK/NACK ISTAT stays Low 2.8.2 Example String Decode > > O0001 Host sends one byte thru microcontroller to AT88RF1354 serial port. 0B AT88RF1354 RF OFF command. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > > I0001 Host gets one byte from AT88RF1354 buffer. 01 AT88RF1354 Response: $01 (Acknowledge). ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.8.3 Operation Turn the RF field off. 2-14 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.9 RF ON Command [$0A] This command turns the 13.56 MHz RF field on. 2.9.1 Command Format Host Reader PICC Send one byte RF ON ($0A) Command Processing ISTAT goes High Get one byte Response Bytes ACK/NACK ISTAT stays Low 2.9.2 Example String Decode > > O0001 Host sends one byte thru microcontroller to AT88RF1354 serial port. 0A AT88RF1354 RF ON command. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > > I0001 Host gets one byte from AT88RF1354 buffer. 01 AT88RF1354 Response: $01 (Acknowledge). ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.9.3 Operation Turn the RF field on. 2-15 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.10 Sleep Command [$0C] This command activates the standby mode. 2.10.1 Command Format Host Reader PICC Send one byte Sleep ($0C) Command Processing No Response No ISTAT transition 2.10.2 Example String Decode > > O0001 Host sends one byte thru microcontroller to AT88RF1354 serial port. 0C AT88RF1354 SLEEP command. AT88RF1354 in standby mode. No response. No ISTAT transition. 2.10.3 Operation The Sleep command places the reader into one of several standby modes. The reader will remain in this mode until the SCK serial interface input transitions from low to high. Sending any command from the host causes the reader to exit sleep mode. Any activity on the serial interface bus will cause the IC to exit sleep mode. The Sleep command should only be sent when the 13.56 MHz RF field is off. When the Sleep command is received, the reader internal circuitry is placed in standby and all internal clocks are stopped. The PLL Configuration Register ($0D) settings determine if the PLL and crystal oscillator are disabled in standby mode. 2-16 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.11 TX Data Command [$03] This command transmits data from the reader and waits for a response. A user can use this reader command to build PICC-specific commands. The example shows a Poll (REQB) command sent via the TX Data command. 2.11.1 Command Format Host Reader PICC Send seven bytes TX Data ($03) Bytes sent to PICC PARAM FWI CryptoRF Poll ($05) AFI PARAM Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get fifteen bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM $50 PUPI 0 PUPI 1 PUPI 2 PUPI 3 APP 0 APP 1 APP 2 APP 3 Protocol 1 Protocol 2 Protocol 3 ISTAT stays Low 2-17 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.11.2 Example String Decode > O0007 Host sends seven bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 03 Data bytes sent to PICC. In this example 3 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 05 To PICC: CryptoRF Poll command, $05. > 00 To PICC: AFI. A $00 activiates all Type B PICC's. > 00 To PICC: PARAM. Specify a REQB when bit [3] is 0b, and 2 anti-collision slots where N is bits [2:0]. N The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I000F Host gets fifteen bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 0C AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 50 PICC Response: $50 (Success). > FF PICC Response: PUPI 0 -- CryptoRF System Zone Byte $00 > FF PICC Response: PUPI 1 -- CryptoRF System Zone Byte $01 > FF PICC Response: PUPI 2 -- CryptoRF System Zone Byte $02 > FF PICC Response: PUPI 3 -- CryptoRF System Zone Byte $03 > FF PICC Response: APP 0 -- CryptoRF System Zone Byte $04 > FF PICC Response: APP 1 -- CryptoRF System Zone Byte $05 > FF PICC Response: APP 2 -- CryptoRF System Zone Byte $06 > 22 PICC Response: APP 3 -- CryptoRF System Zone Byte $07 (22 = AT88SC0404CRF density) > 00 PICC Response: Protocol 1 -- $00 > 10 PICC Response: Protocol 2 -- CryptoRF System Zone byte $08 > 51 PICC Response: Protocol 3 -- $51 The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.11.3 Operation Using the communication settings in the specified Communication Protocol Register, this command transmits the data received in the data field. The reader waits for a response for the time specified. If no response is received before timeout, then a timeout error code is returned to the host. 2-18 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.12 Write Buffer Command [$09] This command writes data to the RAM buffer of the reader. This command is not necessary for typical RFID applications. However this command may be useful during code development. 2.12.1 Command Format Host Reader PICC Send seven bytes Write Buffer ($09) Starting Address "L", Data Bytes Written Data 1 Data 2 Data "L - 1" Data "L" Command Processing ISTAT goes High Get one byte Response Bytes ACK/NACK ISTAT stays Low 2-19 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 2.12.2 Example String Decode > O0007 Host sends seven bytes thru microcontroller to AT88RF1354 serial port. > 09 AT88RF1354 Write Data Buffer Command. > 00 Starting address. > 04 Length "L" of data to be written in bytes. > 12 Data 1 > 34 Data 2 > 12 Data "L - 1" > 34 Data "L" Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > > I0001 Host gets one byte from AT88RF1354 buffer. 01 AT88RF1354 Response: $01 (Acknowledge). ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.12.3 Operation Write the internal 256 byte RAM buffer starting at the Address specified. 2-20 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 2.13 Write Register Command [$06] This command writes a value to the specified configuration register of the reader. 2.13.1 Command Format Host Reader PICC Send three bytes Write Register ($06) Register Address Data Byte Command Processing ISTAT goes High Get one byte Response Bytes ACK/NACK ISTAT stays Low 2.13.2 Example String Decode > O0003 Host sends three bytes thru microcontroller to AT88RF1354 serial port. > 06 > 0F Select Receiver Register. > 16 Set upper nibble for low receiver gain. Set lower nibble for moderate noise immunity. AT88RF1354 Write Register Instruction. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > > I0001 Host gets one byte from AT88RF1354 buffer. 01 AT88RF1354 Response: $01 (Acknowledge). ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 2.13.3 Operation Write a reader configuration register. A list of valid register addresses are shown in Section 4. 2-21 8586A—RFID—5/09 Section 3 CryptoRF Commands 3.1 Command Overview Commands can be transmitted to a PICC using the AT88RF1354 TX Data command. The TX Data command transmits data from the reader and waits for a response. Refer to the CryptoRF Specification for the complete CryptoRF command set and command set details. Table 4. CryptoRF Commands Command Name Description Code REQB Poll Request Command $05 ATTRIB PICC Selection Command $1D HLTB HLTB Command $50 Set User Zone Select User Memory Area to be Addressed for Read Zone and Write Zone Commands $c1 Read User Zone Read Data from the Currently Selected User Zone $c2 Read User Zone (Large Memory) Read Data from the Currently Selected User Zone. This command option only applies to the AT88SC6416CRF. $c2 Write User Zone Write Data to the Currently Selected User Zone $c3 Write User Zone (Large Memory) Write Data to the Currently Selected User Zone. This command option only applies to the AT88SC6416CRF. $c3 Write System Zone Write System Zone Command $c4 Read System Zone Read System Zone Command $c6 DESELECT Deselect Command $cA IDLE Idle Command $cB Check Password Check Password Command $cC 3-1 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.2 REQB Polling Command [$05] This command performs a single Type B polling sequence to detect cards near the antenna. The first response is returned to the host. In the event no error free response is detected, then an error code is returned. By choosing this format of the polling command instead of the AT88RF1354’s native poll commands, a user can control the command’s timing parameters. 3.2.1 Command Format Host Reader PICC Send seven bytes TX Data ($03) Bytes sent to PICC PARAM FWI CryptoRF Poll ($05) AFI PARAM Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get fifteen bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM $50 PUPI 0 PUPI 1 PUPI 2 PUPI 3 APP 0 APP 1 APP 2 APP 3 Protocol 1 Protocol 2 Protocol 3 ISTAT stays Low 3-2 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.2.2 Example String Decode > O0007 Host sends seven bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 03 Data bytes sent to PICC. In this example 3 bytes are sent to the PICC. > 01 > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 05 To PICC: CryptoRF Poll command, $05. > 00 To PICC: AFI. A $00 activiates all Type B PICC's. > 00 To PICC: PARAM. Specify a REQB when bit [3] is 0b, and 2 anti-collision slots where N is bits [2:0]. PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). N The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I000F Host gets fifteen bytes from AT88RF1354 buffer. > 00 > 0C AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 50 PICC Response: $50 (Success). > FF PICC Response: PUPI 0 -- CryptoRF System Zone Byte $00 > FF PICC Response: PUPI 1 -- CryptoRF System Zone Byte $01 > FF PICC Response: PUPI 2 -- CryptoRF System Zone Byte $02 > FF PICC Response: PUPI 3 -- CryptoRF System Zone Byte $03 > FF PICC Response: APP 0 -- CryptoRF System Zone Byte $04 > FF PICC Response: APP 1 -- CryptoRF System Zone Byte $05 > FF PICC Response: APP 2 -- CryptoRF System Zone Byte $06 > 22 PICC Response: APP 3 -- CryptoRF System Zone Byte $07 (22 = AT88SC0404CRF density) > 00 PICC Response: Protocol 1 -- $00 > 10 PICC Response: Protocol 2 -- CryptoRF System Zone byte $08 > 51 PICC Response: Protocol 3 -- $51 The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.2.3 Operation This command performs one polling sequence with “N” slots using the ISO/IEC14443-3 Type B commands REQB, WUPB, and Slot-MARKER. The CPR0 default Communication Protocol settings are used by this command. A polling sequence consists of either an REQB or WUPB command, followed by the number of Slot-MARKER commands indicated by “N”. When a card response not containing a CRC error is received, then the polling sequence is stopped and the response is returned to the host. Subsequent commands will require the PUPI data read from the PICC. A user should expect each PICC will contain a unique PUPI. A system should also utilize the density code stored in APP byte 3. The density code information can easily be used to identify different CryptoRF user memory sizes. Refer to the CryptoRF Specification for a complete list of CryptoRF density codes. 3-3 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.3 ATTRIB Command [$1D] The ATTRIB command is used to select a PICC for a transaction. 3.3.1 Command Format Host Reader PICC Send thirteen bytes TX Data ($03) Bytes sent to PICC PARAM FWI ATTRIB ($1D) PUPI 0 PUPI 1 PUPI 2 PUPI 3 PARAM 1 PARAM 2 PARAM 3 PARAM 4 Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get four bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM $0 ISTAT stays Low 3-4 8586A—RFID—5/09 PICC CID AT88RF1354 SPI User Guide For CryptoRF 3.3.2 Example String Decode > O000D Host sends thirteen bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 09 Data bytes sent to PICC. In this example 9 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 1D To PICC: ATTRIB command, $1D. > FF To PICC: PUPI 0. Use the value from the PICC's Poll response. > FF To PICC: PUPI 1. Use the value from the PICC's Poll response. > FF To PICC: PUPI 2. Use the value from the PICC's Poll response. > FF To PICC: PUPI 3. Use the value from the PICC's Poll response. > 00 To PICC: PARAM 1 - $00. Not used by the CryptoRF family. > 00 To PICC: PARAM 2 - $00. Not used by the CryptoRF family. > 00 To PICC: PARAM 3 - $00. Not used by the CryptoRF family. > 01 To PICC: PARAM 4 - Upper nibble is $0. Lower nibble assigns PICC a CID of $1. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. String Decode > I0004 Host gets four bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 01 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 01 PICC Response: Upper nibble is $0. Lower nibble is CID assigned in ATTRIB command. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.3.3 Operation Sending the ATTRIB command (with a matching PUPI) after an ATQB response places the PICC in the Active State and assigns the Card ID number (CID) to the PICC. PICCs already in the Active State or Halt State are not permitted to answer this command. 3-5 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.4 HLTB Command [$50] The HLTB command places an Active State PICC in the Halt State, where it is not allowed to answer an REQB command. The command and response are ISO/IED 14443-3 compliant. 3.4.1 Command Format Host Reader PICC Send nine bytes TX Data ($03) Bytes sent to PICC PARAM FWI HLTB ($50) PUPI 0 PUPI 1 PUPI 2 PUPI 3 Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get fourteen bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM $00 ISTAT stays Low 3-6 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.4.2 Example String Decode > O0009 Host sends nine bytes thru microcontroller to AT88RF1354 serial port. > 03 > 05 Data bytes sent to PICC. In this example 5 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 50 To PICC: HLTB Command. > FF To PICC: PUPI 0. Use the value from the PICC's Poll response. > FF To PICC: PUPI 1. Use the value from the PICC's Poll response. > FF To PICC: PUPI 2. Use the value from the PICC's Poll response. > FF To PICC: PUPI 3. Use the value from the PICC's Poll response. AT88RF1354 TX Data command. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0004 Host gets four bytes from AT88RF1354 buffer. > 00 > 01 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 00 PICC Response: $00 is the success response. No PICC response is sent if the command contained errors. AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.4.3 Operation Sending the “Halt B” (HLTB) command (with a matching PUPI) after an ATQB response places the PICC in the Halt State. A PICC in the Halt State will only respond to a WUPB command. PICCs in the Active State or already in the Halt State are not permitted to answer this command. 3-7 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.5 Set User Zone Command [$c1] The Set User Zone command selects the user memory area to be addressed by the Read User Zone and Write User zone commands. 3.5.1 Command Format Host Reader PICC Send six bytes TX Data ($03) Bytes sent to PICC PARAM FWI Set User Zone ($c1) PARAM Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $1 PICC ACK/NACK PICC Status Code ISTAT stays Low 3-8 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.5.2 Example String Decode > O0006 Host sends six bytes thru microcontroller to AT88RF1354 serial port. > 03 > 02 Data bytes sent to PICC. In this example 2 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 11 To PICC: Upper nibble is CID assigned in the ATTRIB command. Lower nibble is $1. > 00 AT88RF1354 TX Data command. To PICC: PARAM. Upper nibble is $0 (disable anti-tearing). Lower nibble is user zone 0. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 > 03 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 11 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $1. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.5.3 Operation Before reading and writing data to the user memory, the host must select a User Zone with this command. Only one User Zone may be selected at a time. At the time the zone is selected the host also chooses whether anti-tearing should be active for this zone. If anti-tearing is activated, then all writes to the User Zone will utilize anti-tearing until a new Set User Zone command is received. Only PICCs in the Active State are permitted to answer this command. 3-9 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.6 Read User Zone Command [$c2] The Read User Zone command reads data from the currently selected User Zone. See Read User Zone (Large Memory) command for the AT88SC6416CRF read command information. 3.6.1 Command Format Host Reader PICC Send eight bytes TX Data ($03) Bytes sent to PICC PARAM FWI Read Zone ($c2) $00 ADDR "L", Bytes Read - 1 Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get ten bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $2 PICC ACK/NACK Data 1 Data 2 Data "L" Data "L + 1" PICC Status Code ISTAT stays Low 3-10 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.6.2 Example String Decode > O0008 Host sends eight bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 04 Data bytes sent to PICC. In this example 4 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 12 To PICC: Read Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $2. > 00 To PICC: $00 > 00 To PICC: ADDR. Starting address of location to be read. > 03 To PICC: "L". L is the number of bytes to read minus 1. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I000A Host gets ten bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 07 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 12 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $2. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 11 PICC Response: Data 1 > 22 PICC Response: Data 2 > 33 PICC Response: Data "L" > 44 PICC Response: Data "L+1" > 00 PICC Response: PICC status code. Status message $00 is no errors. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.6.3 Operation The Read User Zone command reads data from the device’s currently selected User Zone. The data byte address is internally incremented as each byte is read from memory. If the data byte address is incremented beyond the end of the current zone during a read, then the address will “roll over” to the first byte of the same zone. Only PICCs in the Active State are permitted to answer this command. 3-11 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.7 Read User Zone (Large Memory) Command [$c2] The Read User Zone command reads data from the currently selected User Zone. command format only applies to the AT88SC6416CRF. 3.7.1 Command Format Host Reader PICC Send eight bytes TX Data ($03) Bytes sent to PICC PARAM FWI Read Zone ($c2) ADDR H ADDR L "L", Bytes Read - 1 Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get ten bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $2 PICC ACK/NACK Data 1 Data 2 Data "L" Data "L + 1" PICC Status Code ISTAT stays Low 3-12 8586A—RFID—5/09 This AT88RF1354 SPI User Guide For CryptoRF 3.7.2 Example String Decode > O0008 Host sends eight bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 04 Data bytes sent to PICC. In this example 4 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 12 To PICC: Read Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $2. > 01 To PICC: ADDR H. Starting address. A $01 sets bit A8 to access memory locations above $FF. > 00 To PICC: ADDR L. Starting address, lower address byte. > 03 To PICC: "L". L is the number of bytes to read minus 1. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I000A Host gets ten bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 07 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 12 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $2. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 55 PICC Response: Data 1 > 66 PICC Response: Data 2 > 77 PICC Response: Data "L" > 88 PICC Response: Data "L+1" > 00 PICC Response: PICC status code. Status message $00 is no errors. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.7.3 Operation The Read User Zone (Large Memory) command operates identically to the standard Read User Zone command, but utilizes a two byte address to support large memory sizes. The Read User Zone command reads data from the device’s currently selected User Zone. The data byte address is internally incremented as each byte is read from memory. If the data byte address is incremented beyond the end of the current zone during a read, then the address will “roll over” to the first byte of the same zone. Only PICCs in the Active State are permitted to answer this command. 3-13 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.8 Write User Zone Command [$c3] The Write User Zone command writes data into the currently selected User Zone. See Write User Zone (Large Memory) command for the AT88SC6416CRF write command information. 3.8.1 Command Format Host Reader PICC Send twelve bytes TX Data ($03) Bytes sent to PICC PARAM FWI Write Zone ($c3) $00 ADDR "L", Bytes Written - 1 Data 1 Data 2 Data "L" Data "L + 1" Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $3 PICC ACK/NACK PICC Status Code ISTAT stays Low 3-14 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.8.2 Example String Decode > O000C Host sends twelve bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 08 Data bytes sent to PICC. In this example 8 bytes are sent to the PICC. > 02 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 2 (CPR2). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 13 To PICC: Write Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $3. > 00 To PICC: $00 > 00 To PICC: ADDR. Starting address of location to be written. > 03 To PICC: "L". "L" is the number of bytes to write minus 1. > 11 To PICC: Data 1. > 22 To PICC: Data 2. > 33 To PICC: Data "L" > 44 To PICC: Data "L + 1" Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 03 AT88RF1354 Response: PICC response byte count. > 02 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 13 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $3. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.8.3 Operation The Write User Zone command writes data into the device’s currently selected User Zone. As each byte is clocked into the memory the lower address bits are internally incremented. The upper address bits are not incremented, so the page address remains constant. Write operations cannot cross page boundaries. A Write User Zone command can only write data bytes within a single physical memory page. Attempts to write beyond the end of page boundary will wrap to the beginning of the same page. Only PICCs in the Active State are permitted to answer this command. 3-15 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.9 Write User Zone (Large Memory) Command [$c3] The Write User Zone command writes data into the currently selected User Zone. This command format only applies to the AT88SC6416CRF. 3.9.1 Command Format Host Reader PICC Send twelve bytes TX Data ($03) Bytes sent to PICC PARAM FWI Write Zone ($c3) ADDR H ADDR L "L", Bytes Written - 1 Data 1 Data 2 Data "L" Data "L + 1" Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $3 PICC ACK/NACK PICC Status Code ISTAT stays Low 3-16 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.9.2 Example String Decode > O000C Host sends twelve bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 08 Data bytes sent to PICC. In this example 8 bytes are sent to the PICC. > 02 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 2 (CPR2). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 13 To PICC: Write Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $3. > 01 To PICC: ADDR H. Starting address. A $01 sets bit A8 to access memory locations above $FF. > 00 To PICC: ADDR L. Starting address, lower address byte. > 03 To PICC: "L". "L" is the number of bytes to write minus 1. > 55 To PICC: Data 1. > 66 To PICC: Data 2. > 77 To PICC: Data "L" > 88 To PICC: Data "L + 1" Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 03 AT88RF1354 Response: PICC response byte count. > 02 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 13 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $3. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.9.3 Operation The Write User Zone (Large Memory) command operates identically to the standard Write User Zone command, but utilizes a two byte address to support large memory sizes. The Write User Zone command writes data into the device’s currently selected User Zone. As each byte is clocked into the memory the lower address bits are internally incremented. The upper address bits are not incremented, so the page address remains constant. Write operations cannot cross page boundaries. A Write User Zone command can only write data bytes within a single physical memory page. Attempts to write beyond the end of page boundary will wrap to the beginning of the same page. Only PICCs in the Active State are permitted to answer this command. 3-17 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.10 Write System Zone Command [$c4] The Write System Zone command writes data to the configuration memory. This command is also used to program the security fuses. 3.10.1 Command Format Host Reader PICC Send twelve bytes TX Data ($03) Bytes sent to PICC PARAM FWI Write System Zone ($c4) PARAM ADDR "L", Bytes Written - 1 Data 1 Data 2 Data "L" Data "L + 1" Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $4 PICC ACK/NACK PICC Status Code ISTAT stays Low 3-18 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.10.2 Example String Decode > O000C Host sends twelve bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 08 Data bytes sent to PICC. In this example 8 bytes are sent to the PICC. > 02 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 2 (CPR2). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 14 To PICC: Write System Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $4. > 00 To PICC: PARAM = $00. A $00 selects the write system zone PARAM option. > 00 To PICC: ADDR. Starting address of location to be written. > 03 To PICC: "L". "L" is the number of bytes to write minus 1. > 12 To PICC: Data 1. > 34 To PICC: Data 2. > 56 To PICC: Data "L" > 78 To PICC: Data "L + 1" Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 03 AT88RF1354 Response: PICC response byte count. > 02 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 14 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $4. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.10.3 Operation The Write System Zone command writes data into the configuration memory. As each byte is clocked into the memory the lower bits of the address are internally incremented. The upper address bits are not incremented, so the page address remains constant. Write operations cannot cross page boundaries. A Write System Zone command can only write data bytes within a single physical memory page. Attempts to write beyond the end of page boundary will wrap to the beginning of the same page. Only PICCs in the Active State are permitted to answer this command. A special mode of the Write System Zone programs the security fuses. Once programmed, the fuses cannot be erased. The Check Password command must be successfully executed prior to writing the system zone. 3-19 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.11 Read System Zone Command [$c6] The System Read command allows reading of system data from the configuration memory, from the security fuses, or from the checksum register. 3.11.1 Command Format Host Reader PICC Send eight bytes TX Data ($03) Bytes sent to PICC PARAM FWI Read System Zone ($c6) PARAM ADDR "L", Bytes Read - 1 Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get fourteen bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $6 PICC ACK/NACK Data 1 Data 2 Data 3 Data 4 Data 5 Data 6 Data "L" Data "L + 1" PICC Status Code ISTAT stays Low 3-20 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.11.2 Example String Decode > O0008 Host sends eight bytes thru microcontroller to AT88RF1354 serial port. > 03 > 04 Data bytes sent to PICC. In this example 4 bytes are sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 16 To PICC: Read System Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $6. > 00 To PICC: PARAM = $00. A $00 selects the read system zone PARAM option. > 00 To PICC: ADDR. Starting address of location to be read. > 07 AT88RF1354 TX Data command. To PICC: "L". L is the number of bytes to read minus 1. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I000E Host gets fourteen bytes from AT88RF1354 buffer. > 00 AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). > 0B AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 16 PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $6. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 12 PICC Response: Data 1, PUPI 0 -- CryptoRF System Zone Byte $00 > 34 PICC Response: Data 2, PUPI 1 -- CryptoRF System Zone Byte $01 > 56 PICC Response: Data 3, PUPI 2 -- CryptoRF System Zone Byte $02 > 78 PICC Response: Data 4, PUPI 3 -- CryptoRF System Zone Byte $03 > FF PICC Response: Data 5, APP 0 -- CryptoRF System Zone Byte $04 > FF PICC Response: Data 6, APP 1 -- CryptoRF System Zone Byte $05 > FF PICC Response: Data "L", APP 2 -- CryptoRF System Zone Byte $06 > 22 PICC Response: Data "L+1", APP 3 -- CryptoRF System Zone Byte $07 (22 = AT88SC0404CRF density code) > 00 PICC Response: PICC status code. Status message $00 is no errors. The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.11.3 Operation The Read System Zone command reads from the devices configuration memory. The data byte address is internally incremented as each byte is read from memory. If the data byte address increments into a segment where read access is forbidden, the “fuse byte” is transmitted in place of the forbidden data. Depending on the value of the PARAM byte, the host may read the data in the configuration memory, the fuses, or a checksum. Only PICCs in the Active State or permitted to answer this command. 3-21 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.12 DESELECT Command [$cA] The DESELECT command places an Active State PICC in the Halt State. 3.12.1 Command Format Host Reader PICC Send five bytes TX Data ($03) Bytes sent to PICC PARAM FWI Deselect ($cA) Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $A PICC ACK/NACK PICC Status Code ISTAT stays Low 3-22 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.12.2 Example String Decode > O0005 Host sends five bytes thru microcontroller to AT88RF1354 serial port. > 03 > 01 Data bytes sent to PICC. In this example 1 byte is sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). AT88RF1354 TX Data command. > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 1A To PICC: Deselect Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $A. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 > 03 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 1A PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $A. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.12.3 Operation Sending the DESELECT command (with a matching CID) to a PICC in the Active State places the PICC in the Halt State. The User Zone, password, and authentication registers are cleared before the PICC enters the Halt State. Only PICCs in the Active State are permitted to answer this command. As a suggested usage, use the DESELECT command at the end of a transaction. 3-23 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.13 IDLE Command [$cB] The IDLE command resets an Active State PICC and places it in the Idle State. 3.13.1 Command Format Host Reader PICC Send five bytes TX Data ($03) Bytes sent to PICC PARAM FWI Idle ($cB) Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $B PICC ACK/NACK PICC Status Code ISTAT stays Low 3-24 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.13.2 Example String Decode > O0005 Host sends five bytes thru microcontroller to AT88RF1354 serial port. > 03 > 01 Data bytes sent to PICC. In this example 1 byte is sent to the PICC. > 01 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 1 (CPR1). AT88RF1354 TX Data command. > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 1B To PICC: Idle Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $B. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 > 03 AT88RF1354 Response: PICC response byte count. > 01 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 1B PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $B. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.13.3 Operation Sending the IDLE command (with a matching CID) to a PICC in the Active State resets the PICC and places it in the Idle State. The User Zone, password, and authentication registers are cleared before the PICC enters the Idle State. The PICC responds only to successful IDLE commands. Only PICCs in the Active State are permitted to answer this command. 3-25 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 3.14 Check Password Command [$cC] The Check Password command transmits a password for validation. 3.14.1 Command Format Host Reader PICC Send nine bytes TX Data ($03) Bytes sent to PICC PARAM FWI Check Password ($cC) Password Index PW 1 PW 2 PW 3 Command Processing RF Transmit Command Command Processing RF Transmit Response Response Processing ISTAT goes High Get six bytes Response Bytes EREG Register Byte PICC Bytes Received PARAM PICC CID $C PICC ACK/NACK PICC Status Code ISTAT stays Low 3-26 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF 3.14.2 Example String Decode > O0009 Host sends nine bytes thru microcontroller to AT88RF1354 serial port. > 03 AT88RF1354 TX Data command. > 05 Data bytes sent to PICC. In this example 5 bytes are sent to the PICC. > 02 PARAM. Bits[2:0] select AT88RF1354 Communication Protocol Register 2 (CPR2). > 00 Timeout. A $00 selects the Frame Waiting Interval defined during CPR initialization. > 1C To PICC: Check Password Command. Upper nibble is CID assigned in ATTRIB command. Lower nibble is $C. > 07 To PICC: Password Index (PW). A $07 selects Password Write 7. > 30 To PICC: PW1. Password byte 1 for a 1K, 2K and 4K bit CryptoRF = $30. > 1D To PICC: PW2. Password byte 2 for a 1K, 2K and 4K bit CryptoRF = $1D. > D2 To PICC: PW3. Password byte 3 for a 1K, 2K and 4K bit CryptoRF = $D2. The AT88RF1354 automatically appends RF communication CRC bytes to the transmitted data stream. Wait for AT88RF1354 ISTAT pin state. ISTAT goes High. The AT88RF1354 buffer has data ready. Data must be read before the next command can be issued. > I0006 Host gets six bytes from AT88RF1354 buffer. > 00 > 03 AT88RF1354 Response: PICC response byte count. > 02 AT88RF1354 Response: PARAM. Echo PARAM byte used in prior TX Data command. > 1C PICC Response: Upper nibble is CID assigned in ATTRIB command. Lower nibble is $C. > 00 PICC Response: PICC ACK/NACK. ACK is $00, the command executed correctly. > 00 PICC Response: PICC status code. Status message $00 is no errors. AT88RF1354 Response: $00 (No RF communication error bits set in the EREG register). The AT88RF1354 automatically strips the RF communication CRC bytes. ISTAT stays Low. The AT88RF1354 buffer is empty. The AT88RF1354 will now accept a new command. 3.14.3 Operation To read or write data in User Zones that require a password for access the host must carry out a password validation operation. The host uses the Check Password command to send the password for validation against the password selected with the Password Index byte. Only PICCs in the Active State are permitted to answer this command. If the Check Password is successful, the Password Attempts Counter (PAC) is cleared and the ACK response is issued. Only one password is active at any time. If the Check Password fails, the PAC is incremented and a NACK response is issued. The Check Password success or failure is memorized and active until the PICC is powered down, removed from the Active State, or until a new Check Password command is received. If the password trials limit is reached, subsequent Check Password commands will be rejected. 3-27 8586A—RFID—5/09 Section 4 Register Summary 4.1 Overview The AT88RF1354 registers and their bit values are summarized in the following tables. Refer to the AT88RF1354 Command Reference Guide for detailed information. 4.2 AT88RF1354 Register Set Table 5. Register Set Sorted by Address Register Name Register Address Description Register Type CPR0_L $00 (Default) Communication Protocol Register 0 – Low Byte Read—Only CPR0_H $01 (Default) Communication Protocol Register 0 – High Byte Read—Only CPR1_L $02 Communication Protocol Register 1 – Low Byte [RFU] Read / Write CPR1_H $03 Communication Protocol Register 1 – High Byte Read / Write CPR2_L $04 Communication Protocol Register 2 – Low Byte [RFU] Read / Write CPR2_H $05 Communication Protocol Register 2 – High Byte Read / Write CPR3_L $06 Communication Protocol Register 3 – Low Byte [RFU] Read / Write CPR3_H $07 Communication Protocol Register 3 – High Byte Read / Write CPR4_L $08 Communication Protocol Register 4 – Low Byte [RFU] Read / Write CPR4_H $09 Communication Protocol Register 4 – High Byte Read / Write SREG $0A Status Register Read—Only EREG $0B Error Register Read—Only IDR $0C Hardware ID Register Read—Only PLL $0D PLL Configuration Register Read / Write TXC $0E Transmitter Register Read / Write RXC $0F Receiver Register Read / Write All other register address values are NOT supported 4-1 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 4.3 AT88RF1354 Register Memory Map Table 6. Register Memory Map Register Name Register Address Register Definition Bit 7 Bit 6 Bit 5 CPR0_L $00 CPR0_H $01 CPR1_L $02 CPR1_H $03 CPR2_L $04 CPR2_H $05 CPR3_L $06 CPR3_H $07 CPR4_L $08 CPR4_H $09 SREG $0A RF POR CD EREG $0B CRC FRAME BYTE IDR $0C PLL $0D SL1 TXC $0E TXP RXC $0F Bit 4 Bit 3 8586A—RFID—5/09 Bit 1 Bit 0 Reserved for future use FWI RFU Reserved for future use FWI RFU Reserved for future use FWI RFU Reserved for future use FWI RFU Reserved for future use FWI RFU RFU TIME COL SPE RFU ID SL0 ENB RS1 RFU ML G All other register address values are NOT supported 4-2 Bit 2 SS RS0 AT88RF1354 SPI User Guide For CryptoRF 4.3.1 Memory Map Field Descriptions (alphabetical) BYTE: Byte Error. A one indicates the received packet was incomplete. CD: Carrier Detect. A one indicates the receiver is detecting 847.5 kHz sub-carrier. COL: Collision Error. A one indicates a collision was detected during polling. CRC: CRC Error. A one indicates an error in the received data packet. ENB: CLKO Output Enable Bar. A one disables the CLKO output. FRAME: Framing Error. A one indicates the received packet is not in a valid frame. FWI: Frame Waiting Interval. Used to select the time the reader waits for a response to begin after a command is transmitted. The Frame Waiting Time (FWT) is calculated from FWI using the formula in the un-amended ISO/IEC14443-3 base standard. G: Receiver Gain Adjustment. Typical Setting is $1. ID: Hardware Revision ID. ML: Modulation Level. Adjusts the level of a zero transmitted by the reader. Typical setting is 0001000 b. RF: RF Field Enabled. A one indicates RF field is ON. RFU: Reserved for Future Use. All RFU bits contain 0 b. POR: Power On Reset. A one indicates the RF Interface of the chip is in reset due to low supply voltage. RSx: CLKO Rate Select bit. This field sets the PLL frequency for CLKO pin. SL0: Oscillator Sleep. A one turns the crystal oscillator off in standby mode. SL1: PLL Sleep. A one turns the PLL off in standby mode. SPE: Smart Poll Error. A one indicates that when the maximum specified number of slots was polled, collisions were detected in all slots. SS: Receiver Squelch. Adjust the receiver noise immunity. Typical Setting is $5 to $7. TIME: Timeout Error. A one indicates the specified waiting time has expired with no response received. TXP: Transmit Power. 1 b selects low RF power. 0 b selects high RF power. 4-3 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 4.4 AT88RF1354 Register Bit Coding Summary The bit coding for the write-able AT88RF1354 register fields is summarized below. Refer to the AT88RF1354 Command Reference Guide for detailed information. 4.4.1 FWI: Frame Waiting Interval. Used to select the time the reader waits for a response to begin after a command is transmitted. The Frame Waiting Time (FWT) is calculated from FWI using the formula in the un-amended ISO/IEC14443-3 base standard. When communicating over the RF channel the CPR field of the command is used to select a CPR register set to configure the reader. By storing the timeout setting in the CPR registers it is only necessary to configure the RF protocol once. A transaction can contain a series of commands with different response times; as the reader executes each command it reconfigures the transceiver instantly to the settings in the specified CPR. Transaction time is optimized by specifying FWI no longer than necessary for each PICC operation 4.4.2 RFU: Reserved for Future Use. All RFU bits must contain 0 b. Table 7. 4-4 8586A—RFID—5/09 Coding of Frame Waiting Time in FWI Field Bit 7 Bit 6 Bit 5 Bit 4 FWT 0 0 0 0 32 ETUs 302.1 uS 0 0 0 1 64 ETUs 604.1 uS 0 0 1 0 128 ETUs 1,208.3 uS 0 0 1 1 256 ETUs 2,416.5 uS 0 1 0 0 512 ETUs 4,833.0 uS 0 1 0 1 1024 ETUs 9,666.1 uS 0 1 1 0 2048 ETUs 19,332.2 uS 0 1 1 1 4096 ETUs 38,664.3 uS 1 0 0 0 8192 ETUs 77,328.6 uS 1 0 0 1 16384 ETUs 154,657.2 uS 1 0 1 0 32768 ETUs 309,314.5 uS 1 0 1 1 65536 ETUs 618,628.9 uS 1 1 0 0 131072 ETUs 1,237,257.8 uS 1 1 0 1 262144 ETUs 2,474,515.6 uS 1 1 1 0 524288 ETUs 4,949,031.3 uS 1 1 1 1 RFU FWT Time RFU AT88RF1354 SPI User Guide For CryptoRF 4.4.3 SL1: PLL Sleep. A one turns the PLL off in standby mode. 4.4.4 SL0: Oscillator Sleep. A one turns the crystal oscillator off in standby mode. 4.4.5 ENB: CLKO Output Enable Bar. A one disables the CLKO output. 4.4.6 RFU: Reserved for Future Use. All RFU bits must contain 0 b. 4.4.7 RS1/0: CLKO Rate Select bit. Set the PLL frequency for CLKO pin. Table 8. RS1/0 CLKO Rate Select bit Coding Bit 1 Bit 0 CLKO Frequency 0 0 1.978 MHz 0 1 3.955 MHz 1 0 7.910 MHz 1 1 15.82 MHz 4.4.8 TXP: Transmit Power. 1 b selects low RF power. 0 b selects high RF power. 4.4.9 ML: Modulation Level. Adjusts the level of a zero transmitted by the reader. Typical setting is 11% modulation index, 0001000 b. Table 9. Transmit Modulation Settings ML Bit 2 Bit 1 Bit 0 Modulation index Bit 6 Bit 5 Bit 4 Bit 3 0 0 0 0 0 0 1 8% 0 0 0 0 0 1 0 9% 0 0 0 0 1 0 0 10% 0 0 0 1 0 0 0 11% 0 0 1 0 0 0 0 12% 0 1 0 0 0 0 0 13% 1 0 0 0 0 0 0 14% All other values are NOT supported. Warning: Do not set multiple bits in the ML field to 1 b. Improper configuration of this register can result in permanent damage to the device. 4-5 8586A—RFID—5/09 AT88RF1354 SPI User Guide For CryptoRF® 4.4.10 G: Receiver Gain Adjustment. Typical Setting is $1. Table 10. Receiver Gain Coding G Receiver Gain Bit 7 Bit 6 Bit 5 Bit 4 Hex 0 0 0 0 $0 0 0 0 1 $1 Low 1 0 1 0 $A Medium 1 0 1 1 $B High 1 1 1 1 $F Maximum Minimum All other values are NOT supported 4.4.11 SS: Receiver Squelch. Adjust the receiver noise immunity. Typical Setting is $5 to $7. Table 11. Receiver Squelch Coding SS Bit 3 Bit 2 Bit 1 Bit 0 Hex Receiver Noise Immunity 0 0 0 0 $0 Maximum 0 0 0 1 $1 .. 0 0 1 0 $2 .. 0 0 1 1 $3 High 0 1 0 0 $4 .. 0 1 0 1 $5 Moderate 0 1 1 0 $6 .. 0 1 1 1 $7 Low 1 0 0 0 $8 .. 1 0 0 1 $9 Minimum All other values are NOT supported 4-6 8586A—RFID—5/09 Appendix A Initialization Procedure The procedure for initializing the AT88RF1354 RF Reader is outlined here, starting from power up. The same general procedure applies when the IC ResetB pin is toggled (starting at step 2). 1. Turn Power On to both Vcc and Vcc_Ant. 2. Drive the ResetB pin Low for a minimum of 500 uS, then drive it high and hold it at the Vcc voltage level. Wait 1 mS for the crystal oscillator to stabilize. 3. Initialize the Configuration Registers by sending a Clear Command, followed by Write Register Commands. An ACK response must be received after each command. 4. Clear (Clear all register contents) Write PLL Register $0D to $20 (Disable CLKO Output) Write TXC Register $0E to $08. (High RF Power, 11% Modulation Index) Write RXC Register $0F to $16 (Nominal Receiver Gain and Sensitivity) Write CPR Register $03 to $20 (Set CPR1 for Timeout Wait Time of 1.2 milliseconds) Write CPR Register $05 to $30 (Set CPR2 for Timeout Wait Time of 2.4 milliseconds) 5. Send the RF ON Command. Read SREG using the Read Register Command to verify that the RF Field is on. 6. Perform the RF Transaction. A typical RF Transaction begins with Poll Single Commands, followed by a series of TX Data Commands to select (attrib), set zone, write, and read the CryptoRF PICC. 7. Send the RF OFF Command. Read SREG using the Read Register Command to verify that the RF Field is off. 8. The Reader is ready to be powered off or placed in standby mode using the Sleep Command. A-1 8586A—RFID—5/09 Appendix B The SPI Serial Interface The SPI Interface mode is selected by shorting the ISEL pin to Vcc. Six microcontroller pins are required to operate AT88RF1354 in SPI mode. The ISTAT signal is used for handshaking between the microcontroller and RF reader. B.1 SPI Interface The AT88RF1354 SPI interface operates as a slave device in SPI mode 0. In SPI mode 0 the polarity and phase of the serial clock in relation to the data is as follows: SCK is low when IDLE. Incoming data on SDI is sampled on the positive edge of SCK. Outgoing data on SDO is setup on the negative edge of SCK. (The host microcontroller samples SDO on the positive edge of SCK) ISTAT reports the serial interface status to the microcontroller. Figure 7. Serial Interface Wiring to SPI Microcontroller VCC SCK M icrocontroller (S P I M aster) IS E L SCK A T 88R F 1354 M OSI SDI M IS O SDO R eader IC SSB SSB (S P I S lave) input Istat ou tput R esetB A high level on the ISTAT pin signals the host microcontroller that a byte of data is ready to be read from the AT88RF1354 serial interface. If another byte is immediately available on the serial port, ISTAT will go low for 150 uS, then return high. ISTAT will remain high until the last bit of the byte is read, when it will return low. All data must be clocked out of the AT88RF1354 before it can receive a command. B-1 8586A—RFID—5/09 Appendix C Index C.1 C.2 Figure Index Figure 1. Communications in an RFID System ............................................................................1-1 Figure 2. Illustration Example – Serial Communications with the SPI Interface .......................... 1-4 Figure 3. Detail Example – Serial Communications with the SPI Interface.................................. 1-5 Figure 4. ACK/NACK Byte Format for ACK Response ................................................................ 1-6 Figure 5. ACK/NACK Byte Format for NACK Response.............................................................. 1-6 Figure 6. Error Register Format in RF Command Responses ..................................................... 1-6 Figure 7. Serial Interface Wiring to SPI Microcontroller .............................................................. B-1 Table Index Table 1. AT88RF1354 Command Set – First Response Byte .................................................... 1-7 Table 2. CryptoRF Command Set – First Response Byte .......................................................... 1-7 Table 3. Instruction Set Sorted by Command Name................................................................... 2-1 Table 4. CryptoRF Commands.................................................................................................... 3-1 Table 5. Register Set Sorted by Address .................................................................................... 4-1 Table 6. Register Memory Map ...................................................................................................4-2 Table 7. Coding of Frame Waiting Time in FWI Field ................................................................. 4-4 Table 8. RS1/0 CLKO Rate Select bit Coding............................................................................. 4-5 Table 9. Transmit Modulation Settings........................................................................................ 4-5 Table 10. Receiver Gain Coding ................................................................................................... 4-6 Table 11. Receiver Squelch Coding.............................................................................................. 4-6 C-1 8586A—RFID—5/09 C.3 Revision History Doc. Rev. Date 8586A 5/2009 C-2 8586A—RFID—5/09 Comments Initial document release. Headquarters International Atmel Corporation 2325 Orchard Parkway San Jose, CA 95131 USA Tel: 1(408) 441-0311 Fax: 1(408) 487-2600 Atmel Asia Room 1219 Chinachem Golden Plaza 77 Mody Road Tsimshatsui East Kowloon Hong Kong Tel: (852) 2721-9778 Fax: (852) 2722-1369 Atmel Europe Le Krebs 8, Rue Jean-Pierre Timbaud BP 309 78054 Saint-Quentin-enYvelines Cedex France Tel: (33) 1-30-60-70-00 Fax: (33) 1-30-60-71-11 Atmel Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan Tel: (81) 3-3523-3551 Fax: (81) 3-3523-7581 Technical Support [email protected] Sales Contact www.atmel.com/contacts Product Contact Web Site www.atmel.com Literature Requests www.atmel.com/literature Disclaimer: The information in this document is provided in connection with Atmel products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Atmel products. EXCEPT AS SET FORTH IN ATMEL’S TERMS AND CONDITIONS OF SALE LOCATED ON ATMEL’S WEB SITE, ATMEL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL ATMEL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDEN-TAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION, OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF ATMEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Atmel makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Atmel does not make any commitment to update the information contained herein. Unless specifically provided otherwise, Atmel products are not suitable for, and shall not be used in, automotive applications. Atmel’s products are not intended, authorized, or warranted for use as components in applications intended to support or sustain life. © 2009 Atmel Corporation. All rights reserved. Atmel®, Atmel logo and combinations thereof, CryptoRF® and others are registered trademarks or trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be trademarks of others. 8586A—RFID—5/09