Features • Contactless Interface • • • • – Reads and Writes Passive RFID Tags in the Unlicensed 13.56 MHz Band – Employs ISO/IEC14443 Type A Modulation Schemes – Autonomous Operation Capability (can scan and read tags without host intervention – i.e. only passes data following successful read/write operation) – Compatible with NFC Initiation Only Device – User Has Control Over Initiation of all RFID Based Services and Features – Read/write Operation Between 1 cm and 10 cm Read Range, Depending on Reader/Tag Antenna Coil Sizes and Orientation Relative to the Reader – Collision Detection as Standard – Transparent Modes for Software Controlled Modulation Supports Maximum Flexibility and Future Protocols – Fast Data Communication Rate of 106 kbit/s – Suitable for Operation with a Wide Variety of Antenna Coil Sizes and Form Factors – Four Software Adjustable Carrier Field Drive Levels Controller and Software – On-board Powerful Atmel AVR® RISC microcontroler, programmed with Innovision® proprietary software. – Built in Self Test and Diagnostic Modes – Internal 8 MHz RC Oscillator for Micro or External Crystal Operation Host Interface – 3-wire SPI Interface as Standard – Full Software Control via SPI bus at 115 Kbaud as Standard Interface Power Supply – Ultra Low Current Operation and Stand-by Sleep Mode Typically < 1 µA – Ultra Low Voltage Operation: 2.7V - 3.3V Additional features – Packages: LBGA36 – LBGA Requires Only an External Crystal, 10 Passives and the Reader Antenna Coil – Operating temperature range: -30°C to +80°C Integrated 13.56 MHz Contactless Reader with Embeded software AT90RF135602 Description AT90RF135602 is an ultra small footprint low-cost Radio Frequency Identification (RFID) reader developed with Innovision Research & Technology plc to address multi-protocol 13.56 MHz RFID applications. It is optimised for use with the established ISO/IEC14443 type A standard and is available in Low-profile Ball Grid Array (LBGA). The LBGA incorporates a custom transceiver front-end along with a protocol & communications controller. It requires only an external crystal and minimal external passive components to interface to the reader antenna. Protocols are software defined and hence configurable. 4407A–SCR–04/05 1 Benefits Applications • Low-cost – ideal for RFID applications where costs have traditionally proved prohibitive • Ultra miniature footprint for compact reader design • Low voltage operation ideal for rechargeable and/or portable applications • Low operating current for optimal power utilisation • Low quiescent current sleep mode further prolongs battery life of applications • Easily integrated into host reader system • Scalable on-board processor memory size and capacity for custom design solutions • Operation with multiple protocols such as Philips Mifare® Ultralight, Innovision®-R&T Jewel™ and ISO/IEC14443 type A tags ensures multi-platform compatibility and seamless integration into legacy systems • Software performs mapping between a common logical memory structure model and physical memory maps of multiple tags types • Also operates with Innovision R&T proprietary protocols and transparent reader modes for even lower power consumption levels • Powerful on board RISC processor is available to operate at higher levels of application protocol stack than on conventional reader solutions for more autonomous modes of operation • Passive read/write RFID tag applications operating in the unlicensed 13.56 MHz band • Hand-held and low-power battery operated ISO/IEC 14443 type A read/writers • Reader to reader inductive/Near Field Communications 2 4407A–SCR–04/05 Block Diagram The host system, typically containing an application microprocessor, can control the operation of the AT90RF135602 by interfacing commands and application data over a bi-directional Serial Peripheral Interconnect (SPI) interface. Figure 1. Typical System Architecture Low Profile Ball Grid Array (LBGA) Host SPI Micro Controller RF Reader Passive Antenna Coil Regulator (2.8V) 13.56 MHz Xtal The partitioning of the system into its typical protocol layers is shown in Figure 2. The exact boundary of each layer of the protocol stack is dependent on the specific application and, therefore, the optimal architectural split of the protocol layers. Software implementation of the protocol stack allows for operation with multiple parallel stacks as well as greater flexibility for customisation and future updates. 3 4407A–SCR–04/05 Figure 2. Overview of Typical Protocol Layers based on OSI 7-layerModel Host Micro Scan/Read/Write Commands, etc. Transmission Protocol Application Layer Innovision R&T Jewel™ Mifare® Ultralight Protocol ISO14443 part 3 Reader Micro Intialisation & Anti-collision Frame Format & Timing Bit Representation & Timing ISO14443 part 3 ISO14443 part 2 Reader ASIC Modulation ISO14443 part 2 4 4407A–SCR–04/05 Pinout Figure 3. LBGA36 Package Pinout F E D C B A PC4 SCK MISO (SDO) MOSI (SDI) /SS XTAL2 VDDQ VCC2 VDD01 VDD02 GND1 XIN PC6 VCC1 GND2 /Reset (/MCLR) 1 2 3 4 PC7 XOUT 5 TX1 XTAL1 6 PD1 VSS PC5 VSS01 VSSQ TX2 RX PC1 PC0 VDD 7 Substrate Substrate VSS02 8 PDO PC3 PC2 Pin Description Table 1. AT90RF15602 Pin Description PIN Name Pin Number i/0/p Type Description VDDQ F2 Power Analogue Supply VDD E6 Power Logic Supply VDDO1 D2 Power Output Stage Supply VDDO2 C2 Power Output Stage Supply VCC1 E3 Power MCU Supply VCC2 E2 Power MCU Supply GND1 B2 Power MCU GND GND2 B3 Power MCU GND VSS B6 Power Logic GND VSSQ B7 Power Analogue GND VSSO1 C7 Power Output Stage GND VSSO2 D7 Power Output Stage GND 5 4407A–SCR–04/05 Table 1. AT90RF15602 Pin Description (Continued) PIN Name Pin Number i/0/p Type Description Substrate 1 F7 Power GND Substrate 2 E7 Power GND /SS B1 Input SPI Slave Select (Active Low) * MOSI (SDI) C1 Input SPI Data Input * MISO (SDO) D1 Output SPI Data Output * SCK E1 Input SPI Clock * /RESET (/MCLR) A3 Input Reset (Active Low) PD0 F8 RESERVED PD1 F6 RESERVED PC0 A8 RESERVED PC1 B8 RESERVED PC2 D8 RESERVED PC3 E8 RESERVED PC4 F1 RESERVED PC5 A6 RESERVED PC6 F3 RESERVED PC7 F4 RESERVED TX1 F5 Output Antenna Drive 1 TX2 A7 Output Antenna Drive 2 RX C8 Input Antenna Receiver XIN A2 Input 13.56 MHz Crystal or CLK input XOUT A4 Output 13.56 MHz Crystal or N/C XTAL1 A5 RESERVED XTAL2 A1 RESERVED 6 4407A–SCR–04/05 Definition of Terms ASIC BIST CRC CSUM ETSI FCC Fc FIFO Fs GUI TWI LBGA OTP PC PCD PCB PICC RAM SPI TBA TBC UART XTAL - Application Specific Integrated Circuit Built In Self Test Cyclic Redundancy Check Check Sum European Telecommunication Standards Institute Federal Communications Commission Frequency of Carrier First In First Out Frequency of Subcarrier Graphical User Interface Two Wires Interface Low-profile Ball Grid Array One Time Programmable Personal Computer (IBM compatible) Proximity Coupling Device Printed Circuit Board Proximity Integrated Circuit Card Random Access Memory Serial Peripheral Interconnect To Be Advised To Be Confirmed Universal Asynchronous Receiver Transmitter Quartz Crystal Functional Specification Outline Functional Specifications The major determination of the functionality is the embedded software. The following specification is designated for the latest V2.7 software release. The AT90RF135602 is designed to achieve the following requirements: Passive RFID reader operation in the unlicensed 13.56 MHz band Read/Write operation using ISO/IEC14443-2 type A modulation schemes at data communication rates of 106 kbit/s Conform to the standard of ISO/IEC14443-3 type A as far as is required to operate with the Mifare Ultralight and the Innovision R&T low-cost Jewel RFID ICs Low voltage operation from a 2.7V supply Low current operation with stand-by sleep mode Interface electrically to the host system controller via an SPI based interface and associated digital control signals Operates with minimal battery power consumption to optimise the battery life in both active and standby modes Operation with Innovision R&T low-cost, low power proprietary tag protocols 7 4407A–SCR–04/05 Reader to reader inductive Near Field Communications capability using Innovision R&T proprietary protocols in software Transparent modes for direct software controlled modulation protocols for maximum flexibility General Specifications • Multi-protocol RFID IC: – ISO/IEC14443A parts 2 & 3 (frame format) – User transparent operation with both the Philips Mifare Ultralight and Innovision R&T low-cost Jewel tags • Operation:Read/Write • Number of bytes: – Ultralight: 48 user Read/Write bytes – Jewel: 96 user Read/Write bytes • Tag scan rate:Variable by host • Carrier frequency:External 13.56 MHz crystal controlled • Carrier field drive level: – Four software adjustable carrier field drive and Q levels determined by selection of output stage drive impedance: Level1 – 40 Ω Level2 – 20 Ω (Default for v2.7) Level3 – 10 Ω Level4 – 5 Ω • Antenna configuration:Balanced “push-pull” output stages driving a symmetrical series resonant antenna coil for optimal carrier field generation when operating from low voltage supply • FCC/ETSI EMC Compliancy:Simple LC low-pass filters used on output stages to achieve harmonic reduction required for EMC compliancy • Operating voltage range: 2.7 – 3.0 V • Maximum voltage rating: 3.3 V • Peak supply current: < 65 mA peak (depending on drive level selection, antenna matching and tuning) • Sleep-mode quiescent current: <10 µA (1 µA typical) • Protocol Control: Atmel pre-programmed RISC Microprocessor • Software program memory: Pre-programmed with Innovision Firmware revision V2.7 • Data memory: Reserved • Non-volatile memory: Reserved • Interfaces: – 3 wire SPI interface at 115 kBaud 8 4407A–SCR–04/05 Figure 4. Recommended Circuit for Extended Range 9 4407A–SCR–04/05 Figure 5. Recommended Circuit For Short Range Application 10 4407A–SCR–04/05 SPI Interface Protocol Serial Peripheral Interface – SPI The Serial Peripheral Interface (SPI) allows high-speed synchronous data transfer between the AT90RF135602 and peripheral devices or between several AVR devices. The AT90RF135602 SPI includes the following features: Features • • • • • • • • Full-duplex, Three-wire Synchronous Data Transfer Master or Slave Operation LSB First or MSB First Data Transfer Seven Programmable Bit Rates End of Transmission Interrupt Flag Write Collision Flag Protection Wake-up from Idle Mode Double Speed (CK/2) Master SPI Mode Figure 6. SPI Block Diagram clk IO SPI2X SPI2X DIVIDER /2/4/8/16/32/64/128 11 4407A–SCR–04/05 The interconnection between Master and Slave CPUs with SPI is shown in Figure 7. The system consists of two shift Registers, and a Master clock generator. The SPI Master initiates the communication cycle when pulling low the Slave Select SS pin of the desired Slave. Master and Slave prepare the data to be sent in their respective shift Registers, and the Master generates the required clock pulses on the SCK line to interchange data. Data is always shifted from Master to Slave on the Master Out – Slave In, MOSI, line, and from Slave to Master on the Master In – Slave Out, MISO, line. After each data packet, the Master will synchronize the Slave by pulling high the Slave Select, SS, line. When configured as a Master, the SPI interface has no automatic control of the SS line. This must be handled by user software before communication can start. When this is done, writing a byte to the SPI Data Register starts the SPI clock generator, and the hardware shifts the eight bits into the Slave. After shifting one byte, the SPI clock generator stops, setting the end of transmission flag (SPIF). If the SPI Interrupt Enable bit (SPIE) in the SPCR Register is set, an interrupt is requested. The Master may continue to shift the next byte by writing it into SPDR, or signal the end of packet by pulling high the Slave Select, SS line. The last incoming byte will be kept in the Buffer Register for later use. When configured as a Slave, the SPI interface will remain sleeping with MISO tri-stated as long as the SS pin is driven high. In this state, software may update the contents of the SPI Data Register, SPDR, but the data will not be shifted out by incoming clock pulses on the SCK pin until the SS pin is driven low. As one byte has been completely shifted, the end of transmission flag, SPIF is set. If the SPI Interrupt Enable bit, SPIE, in the SPCR Register is set, an interrupt is requested. The Slave may continue to place new data to be sent into SPDR before reading the incoming data. The last incoming byte will be kept in the Buffer Register for later use. Figure 7. SPI Master-slave Interconnection SHIFT ENABLE The system is single buffered in the transmit direction and double buffered in the receive direction. This means that bytes to be transmitted cannot be written to the SPI Data Register before the entire shift cycle is completed. When receiving data, however, a received character must be read from the SPI Data Register before the next character has been completely shifted in. Otherwise, the first byte is lost. In SPI Slave mode, the control logic will sample the incoming signal of the SCK pin. To ensure correct sampling of the clock signal, the frequency of the SPI clock should never exceed fclkio/4. 12 4407A–SCR–04/05 General This section describes the operation and interface protocol between the typical host controller and the AT90RF135602 for v2.7 of software. The AT90RF135602 always operates as a slave to the host controller device acting as the master. The SPI interface operation is specified by the /SS and /RESET lines as shown in the table below. /RESET /SS Interface Mode Low Low or High Reserved High High Sleep mode High Low SPI interface and AT90RF135602 active To clarify: The AT90RF135602 ignores SCK from the host and tri-states the MOSI and MISO lines whilst /SS is high As the slave, the AT90RF135602 accepts the SCK from the host and produces serial output data from its MISO output only when /SS is low. The MOSI input is used to receive commands and data from the host in conjunction with the SCK clock when /SS is low. Operation from a cold power-up and reset defaults to be in low quiescent current “Sleep Mode” waiting for /SS to go low. SPI Setup AT90RF135602 is slave. /SS idle condition is high. Prior to transmitting a message the /SS line is set low by the host, after the message has been transmitted the /SS line is set back high again. The interval between the host lowering /SS and then generating the first SCK pulse should be a minimum of 3us. SCK idle condition is low. The leading edge is rising and the trailing edge falling. In each direction data is loaded on the rising clock edge and is valid (and sampled) on the falling clock edge. The minimum interval between the 8th SCK of a byte and the 1st SCK of the next byte shall be 10us for status poll commands and 23us for all other commands. SPI Command/Response The host generates the SPI clock signals to send “Command” messages to the AT90RF135602. Message Structure The host generates the SPI clock signals to receive “Response” messages from the AT90RF135602. The generic message structure is independent of message direction and is transparent to the SPI hardware interface. 13 4407A–SCR–04/05 Messages are either single byte or multi-byte. All messages are terminated by an 8-bit Checksum byte (CSUM) this is calculated as the 8-bit sum of all the proceeding bytes in the message. Multi-byte messages are indicated by the most significant bit set to “1” in the first byte of the message. The length of the additional information is determined by the message type and nature of the additional information bytes. The maximum allowable length of a message including its checksum is 255 bytes. SPI Message Type Byte 1st Byte Description 0x00 – 0x7F Single byte message Single byte message type (1 byte + Checksum) 2 nd Byte CSUM 0x80 – 0xFF 1st Byte Multi-byte message type Multi-byte message (Minimum of 3 bytes + Checksum) nd Byte Information byte 3rd Byte Information byte 0 – 251 Bytes Additional information bytes Last Byte CSUM 2 The host may command Read/Write to the whole of a tag or can restrict the operation to individual pages and sectors using a common message structure which can be independent of tag type. Addressing Modes The v2.7 AT90RF135602 software provides for two modes of addressing tags using either Logical or Physical addressing depending on the command variant. For Logical addressing the application can work independent of tag type as long as the data capacity is not exceeded. The AT90RF135602 software will seamlessly handle the mapping of logical addresses over to either the Innovision Jewel or the Philips Mifare Ultralight depending on the type of tag it recognises as being present. The mapping for logical start address is given in Appendix A. For Physical addressing the application layer must first know which type of tag is present and then address the memory bytes using physical addresses from the tag datasheet. The user is referred to relevant datasheet documentation. AT90RF135602 Command Message Structure To wake-up the AT90RF135602 and to start the tag read or write operations the host as the master must send either a single or a multi-byte Command message. The single byte message consists of a command byte and checksum byte, as follows: To AT90RF135602 = <CMD> <CSUM> 14 4407A–SCR–04/05 The multi-byte message consists of a command byte, start address byte, data length value byte, the data (if relevant to the command) and checksum byte as follows: To AT90RF135602 = <CMD> <ADR> <DLV> <DATA0> <DATA1>…..<CSUM> Where: <CMD> - is the command byte with top bit set (e.g. Read, Write, etc) <ADR> - is the start address byte (0 to 255) for the operation* <DLV> - is the length in number of bytes to read or write (0 to 240) <DATAx> - is data byte(s) - sent least significant byte first - if relevant to the command (e.g. for writing) <CSUM> – is the 8-bit sum of the proceeding bytes The message is sent most significant byte (i.e. <CMD> byte) first. The data bytes are sent least significant byte first. The 8-bit bytes are sent MOST significant bit first. Subsequent to a command message (which both wakes-up the AT90RF135602 and starts the tag read or write operations) the host as the master should poll periodically to assess the status and progress of the commanded operation. * Start address is given in logical terms for user Read/Write area (see Appendix A) Table of Commands <CMD> 0x00 0x70 Explanation Poll Status from AT90RF135602 Bytes <CMD> = 0x00 <CSUM> = 0x00 Built-In Self Test <CMD> = 0x70 (See Built-In self test section for further details) <CSUM> = 0x00 <CMD> = 0x80 Read User Data Logical (Read requested number of user R/W data bytes from requested logical start address of any tag type) 0x80 <DLV> = Number of bytes to be read <CSUM> = Checksum User data starts at logical address 0x00 Read Physical (Read requested number of bytes from requested physical start address of known tag type) 0x86 <ADR> = Start logical address NB Application must know tag type <CMD> = 0x86 <ADR> = Start physical address <DLV> = Number of bytes to be read <CSUM> = Checksum <CMD> = 0x90 <ADR> = Start logical address <DLV> = Number of bytes to be read Read UID/lock/OTP/User Data logical <CSUM> = Checksum (Read requested number of UID, lock, OTP & user data bytes from requested logical start address of any tag type) UID starts at logical address 0x00 to 0x07 Lock bits start at logical address 0x08 to 0x09 OTP bits start at logical address 0x0A to 0x0F 0x90 User data starts at logical address 0x10 15 4407A–SCR–04/05 <CMD> Explanation Bytes <CMD> = 0xA0 <ADR> = Start logical address Write User Data Logical <DLV> = Number of bytes to write (n) (Write requested number of user data bytes starting at requested logical address of any tag type) <DATA0>…<DATAn-1> = n bytes to write 0xA0 <CSUM> = Checksum User data starts at logical address 0x00 <CMD> = 0xA4 <ADR> = Start logical address Write User Data Logical to specific UID <DLV> = Number of bytes to write (n) (Verify specific UID; if equal then write requested number of data bytes starting at requested logical address and verify, if still present) <DATA0>…<DATA7> = UID of specified tag <CSUM> = Checksum User data starts at logical address 0x00 0xA4 Write Physical (Write requested number of bytes starting at requested physical address of known tag type and verify, if still present) 0xA6 <DATA8>…<DATA7+n> = n bytes to write NB: Application must know tag type <CMD> = 0xA6 <ADR> = Start physical address <DLV> = Number of bytes to write (n) <DATA0>…<DATAn-1> = n bytes to write <CSUM> = Checksum <CMD> = 0xA8 Write Physical to specific UID <ADR> = Start physical address (Verify specific UID; if equal then write requested number of bytes starting at requested physical address of known tag type and verify, if still present) <DLV> = Number of bytes to write (n) <DATA0>…<DATA7> = UID of specified tag <DATA8>…<DATA7+n> = n bytes to write <CSUM> = Checksum NB: Application must know tag type 0xA8 User data starts at logical address 0x00 Configuration data – 3 bytes 0xAC010020 – selects 40Ω Driver resistance 0xAC030020 – selects 20Ω Driver resistance 0xAC050020 – selects 10Ω Driver resistance Reader IC Configuration diagnostic command 0xAC070020 – selects 5Ω Driver resistance This setting remains in force for subsequent communications with the tag until the AT90RF135602 is reset. The default driver resistance after reset or power up is 20Ω for software v2.7. 0xAC <CMD> = 0xB0 <ADR> = Start logical address Write Lock/OTP/User Data logical (Write requested number of lock, OTP & user data bytes to requested logical start address of any tag type and verify, if still present) <DLV> = Number of bytes to write(n) <DATA0>…<DATA n-1> = n bytes to write <CSUM> = Checksum UID starts at logical address 0x00 to 0x07 NB: Writing to UID area is not valid Lock bits start at logical address 0x08 to 0x09 OTP bits start at logical address 0x0A to 0x0F 0xB0 User data starts at logical address 0x10 16 4407A–SCR–04/05 <CMD> Explanation Bytes <CMD> = 0xB4 <ADR> = Start logical address <DLV> = Number of bytes to write(n) Write Lock/OTP/User Data Logical to specific UID (Verify specific UID of tag; if equal then write requested number of lock, OTP & user data bytes to requested logical start address of any tag type and verify, if still present) NB: Writing to UID area is not valid. <DATA0>…<DATA7> = UID of specified tag <DATA8>…<DATA7+n> = n bytes to write <CSUM> = Checksum UID starts at logical address 0x00 to 0x07 Lock bits start at logical address 0x08 to 0x09 OTP bits start at logical address 0x0A to 0x0F 0xB4 User data starts at logical address 0x10 See Appendix B for an example Command Response sequence. AT90RF135602 Response Message Structure At the same time as the host sends a message, the AT90RF135602 returns its status response: Single byte response from AT90RF135602 = <STATUS> <CSUM> If the AT90RF135602 is still busy processing the last command then the response data received during the 16 clock periods of the polling command message will be: STATUS = 0x01 which means AT90RF135602 busy. When the AT90RF135602 has finished its operation, or has error conditions, then either a single byte or a multi-byte status message will be returned by SPI clocks from the host. Multi-byte response from AT90RF135602 = <STATUS> <STATUS1> <DLV> <DATA0> <DATA1 ...<CSUM> Where: <STATUS> – Status response <STATUS1> – Status byte 1 which includes further information (e.g. tag type from the previous operation) <DLV> – is the length in number of bytes that were successfully read or written (0 to 240). It is only present if relevant to the status response. <DATAx> - is data byte(s), if relevant to the command (e.g. for reading) <CSUM> – is the 8-bit sum of the proceeding bytes The message is sent <STATUS> byte first. The data bytes are sent least significant byte first. The 8-bit bytes are sent most significant bit first. 17 4407A–SCR–04/05 Table of Responses The checksum byte is not shown in the table below. Single Byte Responses <STATUS> Explanation Bytes 0x00 Normal operation <STATUS> = 0x00 <CSUM> = Checksum 0x01 Busy processing last command <STATUS> = 0x01 <CSUM> = Checksum 0x10 SPI Command Format Error <STATUS> = 0x10 <CSUM> = Checksum 0x20 No Tag Found <STATUS> = 0x20 <CSUM> = Checksum Multi-byte Responses <STATUS> Explanation Bytes 0x80 Read User Data Logical <STATUS> = 0x80 <STATUS1> = tag type <DLV> = number bytes successfully read (n) <DATA0>…<DATA n-1> = n bytes read <CSUM> = Checksum Successful User data starts at logical address 0x00 0x86 Read User Data Physical Successful 0x90 Read UID/Lock/OTP/User Data Logical Successful <STATUS> = 0x86 <STATUS1> = tag type <DLV> = number bytes successfully read (n) <DATA0>…<DATA n-1> = n bytes read <CSUM> = Checksum <STATUS> = 0x90 <STATUS1> = tag type <DLV> = number bytes successfully read (n) <DATA0>…<DATA n-1> = n bytes read <CSUM> = Checksum UID starts at logical address 0x00 to 0x07 Lock bits start at logical address 0x08 to 0x09 OTP bits start at logical address 0x0A to 0x0F User data starts at logical address 0x10 0x8F Read Error <STATUS> = 0x8F <STATUS1> = Error code: 1 byte <CSUM> = Checksum 0xA0 Write User Data Logical <STATUS> = 0xA0 <STATUS1> = tag type <DLV> = number bytes successfully written <CSUM> = Checksum Successful 18 4407A–SCR–04/05 <STATUS> Explanation Bytes 0xA4 Write User Data Logical to specific UID <STATUS> = 0xA4 <STATUS1> = tag type <DLV> = number bytes successfully written <CSUM> = Checksum Successful 0xA6 Write Physical <STATUS> = 0xA6 <STATUS1> = tag type <DLV> = number bytes successfully written <CSUM> = Checksum Successful 0xA8 Write Physical to specific UID <STATUS> = 0xA8 <STATUS1> = tag type <DLV> = number bytes successfully written <CSUM> = Checksum Successful 0xB0 Write Lock/OTP/User Data Logical <STATUS> = 0xB0 <STATUS1> = tag type <DLV> = number bytes successfully written <CSUM> = Checksum Successful 0xB4 0xAF Write Lock/OTP/User Data Logical to specific <STATUS> = 0xB4 UID <STATUS1> = tag type <DLV> = number bytes successfully written Successful <CSUM> = Checksum Write Error <STATUS> = 0xAF <STATUS1> = Error code: 1 byte <CSUM> = Checksum 0xBA Built-In Self Test Response (See Built-In self test section for further details). <STATUS> = 0xBA <STATUS1> = Test Result <DATA0>…<DATA n-1> = Software Version: 2 bytes Serial Number/Production Information: 8 bytes <CSUM> = Checksum Tag Type <STATUS1> Explanation 0x44 Mifare Ultralight 0x0C Innovision Jewel <STATUS1> Explanation 0x10 Verify error during write 0x11 Wrong serial number tag present for specific write 0x12 Area to be written is locked 0x13 Start address out of range 0x14 Write size exceeds tag capacity Error Code See Appendix B for an example Command Response sequence. 19 4407A–SCR–04/05 Sleep-Mode The AT90RF135602 will enter low quiescent current “Sleep Mode” when /SS is high and all tag operations have been completed. SPI Clock Frequency This is determined by the host micro-controller, since this is the master and hence will generate the SCK signal. The recommended SPI clock frequency is 115kHz. Power On Reset, Reset & Host In-circuit Programming Power On Reset (POR) From cold start the POR will occur followed by initialisation of the microprocessor. From application of power the AT90RF135602 will be ready to receive an SPI command data within 6 mS. Reset The active low /RESET signal from the host will cause the AT90RF135602 to enter the reset condition. From release of this signal high the AT90RF135602 will be ready to receive SPI command data within 6 mS. When /RESET is held low the AT90RF135602 will enter serial programming mode. In this mode the SPI SCK, MISO, MOSI lines may be used to upgrade the firmware. Built-In Self Test (BIST) Mode General The BIST consists of a single sequence of test stages designed as a confidence test that the AT90RF135602 is operational and also as a basic diagnostic aid if operation becomes impaired. Beyond this it is not possible to perform an exhaustive test of operational performance without the presence of a tag for functional test purposes. Initiation The BIST mode is activated by the single byte Host SPI command 0x70. BIST Sequence: • CRC Verification of all Flash Program Memory If this test fails, subsequent tests are not performed. • Integrity of all RAM Memory If this test fails, subsequent tests are not performed. • Loop around Test The Loop around Test is designed to test the Xtal oscillator, antenna drive and demodulator sections of the AT88RF135602 for connectivity and operation to a limited functional extent. 20 4407A–SCR–04/05 BIST Response The BIST response is composed of 12 bytes followed by a checksum. The structure of the response is shown in following table: Byte 1 <STATUS> Name Description Built-In Self Test response 0xBA The test result byte indicates the progress of the self-test. Test errors are indicated in a bitwise fashion as listed below: 2 <STATUS1> 0x00 : All tests passed Test Result 0x01 : Flash CRC verification problem 0x02 : RAM integrity problem 0x04 : Loop back problem 3-4 <DATA0> …. 2 byte (MSB first) data representing the software version of the application in Flash Memory. Software Version For example 0x02, 0x07 represents version V2.7 <DATA1> 5-12 <DATA2> …. Serial number and production information 8 bytes, (MSB first), representing the serial number and production information stored in EEPROM. <DATA9> An example of the BIST response is shown below 0xBA, 0x00, 0x02, 0x07, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88 0xBA: BIST Response 0x00: Successful test result 0x02,0x07: Software Version 2.7 0x11,0x22,0x33,0x44: Serial/Production Information 0x11223344 0x55,0x66,0x77,0x88: Serial/Production information 0x55667788 21 4407A–SCR–04/05 Appendix A – Tag Memory Maps A1 Mapping Between Logical Address & Philips Mifare Ultralight Physical Memory Logical Logical Address for user data only; 0x80 Description Page Byte Number Name Comments Address for; 0x90 0xA0 Physical Address 0xB0 0xB4 0xA4 - 0–2 0 0-2 SN0 – SN2 Serial Number (UID) - 3–6 1 0-3 SN3 – SN6 Serial Number (UID) - 7 - - - - - 8-9 2 2-3 Lock0-Lock1 Lock Bytes - 10–13 3 0-3 OTP0 – OTP3 OTP – writes are bit-wise “ored“ with existing contents - 14-15 - - - - 0-3 16-19 4 0–3 Data0 – Data3 User Data area - read/write 4-7 20-23 5 0–3 Data4 – Data7 User Data area - read/write 8-11 24-27 6 0–3 Data8 – Data11 User Data area - read/write 12-15 28-31 7 0–3 Data12 – Data15 User Data area - read/write 16-19 32-35 8 0–3 Data16 – Data19 User Data area - read/write 20-23 36-39 9 0–3 Data20 – Data23 User Data area - read/write 24-27 40-43 10 0–3 Data24 – Data27 User Data area - read/write 28-31 44-47 11 0–3 Data28 – Data31 User Data area - read/write 32–35 48–51 12 0–3 Data32 – Data35 User Data area - read/write 36-39 52-55 13 0–3 Data36 – Data39 User Data area - read/write 40-43 56-59 14 0–3 Data40 – Data43 User Data area - read/write 22 4407A–SCR–04/05 A2 Mapping Between Logical Address & Innovision Jewel Physical Memory Logical Address for user data only; 0x80 0xA0 0xA4 Logical Address for; 0x90 0xB0 0xB4 Physical Address Description Block (Hex) Byte Number Name Comments Unique identification Number (used to verify correct tag is the target of read/write commands) - 0–7 0 0-7 UID0 – UID7 - 8–9 E 0-1 LOCK0 – LOCK1 - 10-15 E 2-7 OTP0 – OTP5 OTP – writes are bit-wise “or-ed“ with existing contents 0–7 16-23 1 0-7 Data0 – Data7 User Data area - read/write 8-15 24-31 2 0-7 Data8 – Data15 User Data area - read/write 16-23 32-39 3 0-7 Data16 – Data23 User Data area - read/write 24-31 40-47 4 0-7 Data24 – Data31 User Data area - read/write 32-39 48-55 5 0-7 Data32 – Data39 User Data area - read/write 40-47 56-63 6 0-7 Data40 – Data47 User Data area - read/write 48-55 64-71 7 0-7 Data48 – Data55 User Data area - read/write 56-63 72-79 8 0-7 Data56 – Data63 User Data area - read/write 64-71 80–87 9 0-7 Data64 – Data71 User Data area - read/write 72-79 88-95 A 0-7 Data72 – Data79 User Data area - read/write 80–87 96-103 B 0-7 Data80 – Data87 User Data area - read/write 88-95 104-111 C 0-7 Data88 – Data95 User Data area - read/write Lock Bytes 23 4407A–SCR–04/05 A3 Lock Bit Functionality This section outlines the operation of the lock bits located at logical address 8 & 9 for commands 0x90, 0xB0, 0xB4. The Lock bits are used to ‘write protect’ blocks of memory. For example, bit 0 of lock byte 0 locks the first 8 data bytes (addresses 0x10 to 0x17 for commands 0x90, 0xB0, 0xB4) Bit 1 of lock byte 0 locks the second block of 8 data bytes (addresses 0x18 to 0x1F for commands 0x90, 0xB0, 0xB4) The correlation between lock bits and areas of logical memory locked is shown in the table below: Lock Byte 0 Bit Memory locations locked (decimal) MSB – 7 6 5 4 3 2 1 LSB - 0 0x80, 0x84, 0xA0, 0xA4 commands 56 – 63* 48 – 55* 40 – 47 32 – 39 24 – 31 16 – 23 08 – 15 00 – 07 0x90, 0xB0, 0xB4 commands 72 – 79* 64 – 71* 56 – 63 48 – 55 40 – 47 32 – 39 24 – 31 16 – 23 Lock Byte 1 Memory locations locked (decimal) Bit MSB – 7 6 5 4 3 2 1 LSB - 0 unused unused unused unused 88 – 95* 80 – 87* 72 – 79* 64 – 71* unused unused unused unused 104 –111* 96 – 103* 88 – 95* 80 – 87* 0x80, 0x84, 0xA0, 0xA4 commands 0x90, 0xB0, 0xB4 commands 24 4407A–SCR–04/05 Appendix B – Command Examples B1 Command Response Sequence Example 1 To read 3 bytes of data starting from logical address DATA4: Command, <CMD> = 0x80 Start address, <ADR> = 0x04 Data length value, <DLV> = 0x03 Checksum, <CSUM> = 0x87 WITH TAG PRESENT Initiate Read; C1: <80><04><03><87> R1: <00><00><XX><XX> Poll status; C2: <00><00> R2: <01><01>AT90RF135602 is busy Poll status; C3: <00><00> R3: <01><01>AT90RF135602 is busy Poll status; C4: <00><00><XX><XX><XX><XX><XX> R4: <80><44><03><44><55><66><C6> Read successful Response = 0x80 Tag type = 0x44 (Mifare Ultralight) Number of bytes successfully read = 0x03 Data4=0x44, Data5=0x55, Data6=0x66 Checksum = 0xC6 B2 Command Response Sequence Example 2 To read 3 bytes of data starting from logical address DATA4: Command, <CMD> = 0x80 Start address, <ADR> = 0x04 Data length value, <DLV> = 0x03 Checksum, <CSUM> = 0x87 NO TAG PRESENT Initiate Read; C1: <80><04><03><87> R1: <00><00><XX><XX> Poll status; 25 4407A–SCR–04/05 C2: <00><00> R2: <01><01>AT90RF135602 is busy Poll status; C3: <00><00> R3: <01><01>AT90RF135602 is busy Poll status; C4: <00><00> R4: <20><20> No tag found Status = 0x20 Checksum = 0x20 B3 Command Response Sequence Example 3 To write 4 bytes of data, starting from logical address DATA5: Command, <CMD> = 0xA0. Start address, <ADR> = 0x05. Data length value, <DLV> = 0x04. DATA5 = 0x55, DATA6 = 0x66, DATA7 = 0x77, DATA8 = 0x88. Checksum, <CSUM> = 0x63. WITH TAG PRESENT Initiate Write; C1: <A0><05><04><55><66><77><88><63> R1: <00><00><XX><XX><XX><XX><XX><XX> Poll status; C2: <00><00> R2: <01><01>AT90RF135602 is busy Poll status; C3: <00><00> R3: <01><01>AT90RF135602 is busy Poll status; C4: <00><00><XX><XX> R4: <A0><44><04><E8> Write successful Response = 0xA0 Tag Type = 0x44 Number of bytes successfully written = 0x04 Checksum = 0xE8 26 4407A–SCR–04/05 Electrical Characteristics Absolute Maximum Ratings Note: I = industrial ........................................................-40°C to 85°C Operating Temperature................................... -30°C to + 80°C StorageTemperature ....................................... -40°C to + 85°C Voltage on VCC to VSS ......................................-0.5V to + 6.5V Voltage on Any Pin to VSS ..........................-0.5V to VCC + 0.5V Power Dissipation Typical........................................... 120 mW Power Dissipation Max ............................................... 300 mW Stresses at or above those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at these or any other conditions above those indicated in the operational sections of this specification is not implied. Exposure to absolute maximum rating conditions may affect device reliability. Power dissipation is based on the maximum allowable die temperature and the thermal resistance of the package. DC Parameters Symbol Parameter ICC Supply voltage ICC Power Down Min Typ Max Unit 2.7 2.8 3.0 V Sleep mode current consumption 1uA 10uA µA ICC Active (field off) Operating current 6.6 ICC Active (field on) Transmitting current IOL/H Output current at Tx1 or Tx2 Output resistance at Tx1 or Tx2 Conditions Max drive level 40 -100 mA 65 mA 100 mA Drive level 1 40 Ω Drive level 2 20 Ω Drive level 3 10 Ω Drive level 4 5 Ω µS Rise and fall time for 100% ASK Xtal frequency range 13 Ext clock Xin 1 Rx input resistance 8.8 Rx input capacitance 13.56 11 14 MHz Vcc V (p-p) 13.2 kΩ 4 pF Rx input delta carrier envelope change mV p-p Rx input envelope amplitude 1 2 V p-p VIL Input Low Voltage -0.5 0.3Vcc V VIH Input High Voltage 0.6Vcc Vcc+0.5 V VOL Output Low Voltage IOL=10mA Vcc=2.7V 0.5 V VOH Output High Voltage IOH=-10mA Vcc=2.7V 2.2 V 27 4407A–SCR–04/05 AC Parameters Note: on 1.0 July 2004 active :~6.7mA sleep - ~1uA* Power Consumption low high Slave Select __ SPI SS low 0V 2.8V high _____ RESET Line Power Vcc State Waveform 1 30 2 3 Figure 8. Power Characteristics 1. Sleep current is n~1uA with the PC3-Xin link and ~36uA without the link, (operational mode set appropriately) 28 4407A–SCR–04/05 4407A–SCR–04/05 SCK Clock /SS Line Slave Select low high low high State Waveform 4 5 6 7 8 9 Figure 9. SPI Characteristics 29 Power Consumption SCK Clock high /SS sleep ~ 1uA host communication – ~6.7mA tag communication – ~40mA low high low State Line Slave Select 10 Read Command Waveform Tag Read 11 Read Data transfer 12 Figure 10. Command Execution Characteristics 30 4407A–SCR–04/05 Table 2. Interface Timing Parameters Id 1 2 Description Min (µs) Typical Max (µs) - 498 ms - - 20 us - AT90RF135602 Cold Power up time SPI /SS low to exit from sleep mode (warm power up time) 3 SPI /SS high to entry into sleep mode - 20 us - 4 SPI /SS low to SPI SCK high 3 - - 5 SPI SCK Period 3.2 - - 6 SPI Data Rate - - 7 SPI LSB to MSB period - - 8 SPI SCK low to SPI /SS high 6 - - 9 SPI /SS high time 3 - - 10 transmission of command 0x80 to read 16 bytes 0.8 ms 11 Reading 16 bytes from mifare ultralight tag 8.0 ms 12 polling the response to the read 1.3 ms Note: poll : 40 non-poll : 50 poll : 10 non-poll : 23 /SS high to MISO tri-state - 10 ns - /SS low to MISO output - 15 ns - 1. “-“ No value applicable 2. The AT90RF135602 will enter its power saving sleep mode when the /SS line is inactive (high) and any tag read/write operation has been completed. 3. The AT90RF135602 will exit its sleep mode when /SS goes active (low). 4. The Host should maintain /SS active only for the duration of the communication, this allows the AT90RF135602 to know when it is safe to enter sleep mode or when its SPI transmission buffer may be updated. 5. The AT90RF135602 will tri-state the MISO line when /SS is high. 6. The AT90RF135602 will enter serial programming mode if /RESET is held low. _____ __ RESET SS Interface Mode low - Reserved high high SPI interface sleeping MISO tri-state high low SPI interface active 31 4407A–SCR–04/05 Ordering information Supply Part Number Voltage (V) Temperature Range Package Packing Green Compliance AT90RF135602-7MTUL 2.7 - 3.3 Industrial LBGA36 Tray Yes 32 4407A–SCR–04/05 Packaging Information LBGA 36 Pin 33 4407A–SCR–04/05 34 4407A–SCR–04/05 Atmel Corporation 2325 Orchard Parkway San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 487-2600 Regional Headquarters Europe Atmel Sarl Route des Arsenaux 41 Case Postale 80 CH-1705 Fribourg Switzerland Tel: (41) 26-426-5555 Fax: (41) 26-426-5500 Asia Room 1219 Chinachem Golden Plaza 77 Mody Road Tsimshatsui East Kowloon Hong Kong Tel: (852) 2721-9778 Fax: (852) 2722-1369 Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan Tel: (81) 3-3523-3551 Fax: (81) 3-3523-7581 Atmel Operations Memory 2325 Orchard Parkway San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 RF/Automotive Theresienstrasse 2 Postfach 3535 74025 Heilbronn, Germany Tel: (49) 71-31-67-0 Fax: (49) 71-31-67-2340 Microcontrollers 2325 Orchard Parkway San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 La Chantrerie BP 70602 44306 Nantes Cedex 3, France Tel: (33) 2-40-18-18-18 Fax: (33) 2-40-18-19-60 ASIC/ASSP/Smart Cards 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Avenue de Rochepleine BP 123 38521 Saint-Egreve Cedex, France Tel: (33) 4-76-58-30-00 Fax: (33) 4-76-58-34-80 Zone Industrielle 13106 Rousset Cedex, France Tel: (33) 4-42-53-60-00 Fax: (33) 4-42-53-60-01 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland Tel: (44) 1355-803-000 Fax: (44) 1355-242-743 e-mail [email protected] Web Site http://www.atmel.com Disclaimer: Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company’s standard warranty which is detailed in Atmel’s Terms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life support devices or systems. © Atmel Corporation 2005. All rights reserved. Atmel®, logo and combinations thereof, AVR®, and others, are registered trademarks, and Everywhere You AreSM and others are the trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be trademarks of others. Printed on recycled paper. 4407A–SCR–04/05 xM