EM MICROELECTRONIC - MARIN SA EM4056 2KBIT Read/Write with ANTICOLLISION Contactless Identification Device • Description The EM4056 is a CMOS integrated circuit intended for use in contactless Read/Write transponders. The user’s configurable 2 kbits EEPROM memory contained in the chip is organised in 125 words of 16 bits, each word can be irreversibly protected against reading or/and writing attempts. The user can define a password and protect part or all of the memory. Serial and identification numbers are laser programmed during IC manufacturing. A reserved application numbering may be made available and customer specific on request. The EM4056 transmits its data towards the reader by amplitude modulation of the magnetic field and receives the commands from the reader in a similar way. Simple set of commands allow the dialogue between the EM4056 and the reader. Read and write commands access directly to an address of memory. The EM4056 has a built-in anticollision protocol which allows an unlimited number of transponders in the reader field to dialogue simultaneously. The transmission antenna is the only external element required, all the other elements are integrated on chip. Features • • • 2 kBits EEPROM organized in 125 words of 16 bits 3 words of 16 Bits Laser ROM for application number and serial number Programmable (OTP) Read and/or Write Protection on every word • • • • • • • • • • • • • Programmable PIN coverage of the memory (0, 25, 50, 75 or 100 %) Power check for EEPROM Write operation Reader Talk First communication protocol Data transmission performed by Amplitude Modulation (ASK) and Biphase (CDP) coding Data rate 2 KBauds (Bit Period = 64 periods of carrier frequency) 100 to 150kHz carrier frequency Long range Read/Write operations Block check of data transmission (CRC) Anticollision protocol based on unique ID number(unlimited number of tags) PIN Code identification linked with counter of false attempts On chip arithmetic operation (addition, comparison of secret and non secret data, etc.) 340pF ± 3% on chip Resonant Capacitor No external supply buffer capacitance On chip Rectifier and Voltage Limiter Applications • • • • • Ticketing Hands free Access control Prothesis identification Prepayment devices Manufacturing automation with portable database • Industrial logistics Typical Operating Configuration C2 EM4056 L C1 Typical value for inductance L is 4.78mH at fO = 125 KHz Fig. 1 Copyright © 2005, EM Microelectronic-Marin SA 1 www.emmicroelectronic.com EM4056 Block Diagram CLK Analog Circuit Antenna (Coil) Logic Circuit Serial Output EEPROM Power Supply Addressing Memory Safety (incl. PIN Code) Laser ROM 125kHz EM coupling 3x16 bit Modulator Adder Write/Read Protection (OTP) Anticollision 125 x 16 bit EEPROM Demodulator Serial Input Fig. 2 System Principle 125kHz EM coupling Reader EM4056 Command Mode Reader Oscillator Reader Coil Reader Coil Modulator RS232 Serial Interface Decoder Demodulator Transponder Coil Answer Mode Transponder Coil Reader Coil Fig. 3 Copyright © 2005, EM Microelectronic-Marin SA 2 www.emmicroelectronic.com EM4056 Absolute Maximum Ratings Parameter Voltage on Power Supply pads Voltage on other pads Symbol VDD Max. AC peak current induced on COIL1 and COIL2 Storage temperature ICOIL Operating temperature Electrostatic discharge max. to MIL-STS-883C method 3015 VPAD Handling Procedures Min. -0.3 Max. 6.0 This device has built-in protection against high static voltages or electric fields; however, anti-static precautions must be taken as for any other CMOS component. Unless otherwise specified, proper operation can only occur when all terminal voltages are kept within the voltage range. Unused inputs must always be tied to a defined logic voltage level. Units V VSS - 0.3 VDD+ 0.3 V - 30 + 30 mAp TSTORE -55 TOP VESD -40 +125 oC +85 oC 1000 V Operating Conditions Parameter Stresses above these listed maximum ratings may cause permanent damages to the device. Exposure beyond specified operating conditions may affect device reliability or cause malfunction. Symbol Min Max Units (Note 1) Vpp -10 +10 mAp fCOIL 100 150 kHz TOP -40 +85 °C Max. AC Voltage on COIL VCOIL Max. AC coil current ICOIL Carrier frequency Operating temperature Note 1: Defined by forcing 10mA on Coil1-Coil2 Electrical Characteristics Unless otherwise specified : VDD = 4.0 V, VSS = 0 V, TOP = 25°C, VCOIL = 4.5 Vpp, fCOIL = 125 KHz Sine wave Parameter Supply voltage (not regulated) Supply voltage (regulated) Symbol Conditions Min Typ Max (Note1) VPOS-REG Unit V V VDD VPOS-REG = max (note 1) 3.4 Min. EEPROM Read voltage VRD Read mode 2.5 Min. EEPROM Write voltage VWR Write mode EEPROM Read current IRD Read mode 19 25 IWR Write mode 60 80 µA IPWCHK VDD = 4.0 V 70 95 µA 2.75 3.10 V EEPROM Write current Power check EEPROM write current EEPROM pwr check threshold voltage EEPROM data endurance EEPROM retention Voltage drop modulator VSS on NCY Erase all / Write all TOP = 55oC after 105 cycles VON ICOIL = 100 µA ICOIL = 5 mA CCOIL POR voltage (high) VPRH MONOFLOP delay TMONO Min. voltage of clock extractor 1 (note 4) Min. voltage of clock extractor 2 (note 5) 2.52 TRET Resonance capacitor 4.3 V 2.5 VPWCHK (note 3) VCOIL- (note 2) V 105 10 330 VDD rising µA cycle year 0.50 2.50 V V 340 350 pF 2.0 2.6 V 50 85 VCLK1min Vcoil1-coil2 (min for extraction) 4.5 µs Vpp VCLK2min Vcoil1-coil2 (min for extraction) 1.0 Vpp 25 Note 1: Max. supply voltage (not regulated) is defined by forcing a DC current 10 mAp in pins COIL1-COIL2 Note 2: The circuit is not functional under low level POR voltage Note 3: Based on 1000 hours measurement at 150oC Copyright © 2005, EM Microelectronic-Marin SA Note 4: Uplink Note 5: downlink 3 www.emmicroelectronic.com EM4056 Timing Characteristics Parameter Symbol Conditions Modulation duration Typ ON OFF ON Tb0 Bit 0 26 8 Tb1 Tab Bit 1 Start bit 36 16 8 8 Emission Bit Period 8 Units RF periods Tbit 64 RF periods Tbitarb 32 RF periods Select processing time Tsp 190 RF periods Read processing time 126 RF periods Write processing time Trp Twp 3134 RF periods Arb1 processing time Ta1p 62 RF periods Arb2 processing time Ta2p 10 RF periods Arbitration format duration Tarb Tro 115 ms 24.5 Select format duration Ts 19.1 Prot format duration Tp 32.2 Read format duration Tr 20.3 Write format duration Tw 36.6 Comp format duration Tc 16.6 Login format duration EEPROM Write duration Tl Reception Bit Period Reception Bit Period Arbitration Read Rom format duration Tee 35.1 20.0 VDD = 3V Functional Description General The EM4056 has a read enable bit (RdEn) realised with a flip-flop cell. If the RdEn bit is set to « 0 », the transponder is always allowed to answer otherwise it answers only on special commands. At power on, the default value of the RdEn bit is 0. Therefore, after switching the field on, the RdEn bit of all known tags may be set by the reader in order to separate them in two groups. The block check sequence uses a 8 bits CRC which is the same polynom for all CRC blocks. In addition, the CRC block from the EM4056 to the reader is sent in the format of the BitVal frame (see arbitration mode) to increase the error detection rate in the reader. 1 Bit 0 Read Prot Address Bit 17 0000000 Write Prot Memory organisation Bit 0 is defined as the first bit output LASER ROM (3 * 18) 0000010 EEPROM (123 * 18) 1111110 1111111 Configuration Word PIN Word Config Word definition + Laser Rom area definition Fig.4 The Read Protected and the Write Protected bit are OTP bit. Once written to one, it is definitively locked. No possibility to erase them to zero. Copyright © 2005, EM Microelectronic-Marin SA 4 www.emmicroelectronic.com EM4056 ROM organisation Address Datas 0000000 0000001 0000010 bit17 B15 B31 L7 bit2 B0 B16 C0 L0 C7 Wp bit1 1 1 1 Rp bit0 0 0 0 B31-B0 unique code number. L7-L0 8-bit customer ID, standard version = 65hex, 101dec. C7 – C0 CRC calculated on bits B31 to B0 and L7 to L0. (CRC block diagram see figure 4). Note : EM4056 with different customer ID will also have a different unique code number. Commands structure Command ReadRom SelToggle SelTag DeselTag Prot Read Write Add Comp Start Arbitration Continue if “0” Continue if “1” Abort Arbitration MSB Code 0010 LSB 0100 0101 0110 1000 1010 1100 1101 1110 0001 00 11 01 or 10 CRC Block Diagram 7 6 5 4 3 2 1 0 MSB Data Input LSB X7 X5 X4 X1 X0=1 Exclusive OR X Shift Register CRC Generating polynomial = X7+X5+X4+X+1 Fig. 5 In uplink the CRC is calculated on all bits of the command (startbit excluded), MSB first. In dowlink the CRC is calculated on all bits of the answer, first bit sent by the chip first. Copyright © 2005, EM Microelectronic-Marin SA 5 www.emmicroelectronic.com EM4056 ReadRom A ReadRomEn command enables only transponders in the field with RdEn bit set to « 0 » to answer. With this command, the address of a single new tag entered in the field can be detected because all known transponders are not allowed to answer if they are deactivated by the RdEn bit (RdEn=1). If more than one transponder answer a CRC error will be detected and it becomes necessary to perform an arbitration to find all new transponder addresses. The command is faster than a full arbitration cycle for new tags. The ReadRomEn command frame consists of three blocks and has a constant length of 13 bits. The Start bit allows the transponder to synchronise to the new command frame. After the Start bit, the frame contains four bits for the Command. A CRC block of 8 bits is calculated over the Command and appended to the end. The transponder frame has a length of 40 bits and starts with the 32 bits ROM block. A CRC block of 8 bits is calculated over the transponder address (ROM) and appended to the end. 1 bit Reader Start 4 bits MSB ReadRom 8 bits X8 CRC Transponder tsp 32 bits MSB ROM 8 bits X8 CRC Fig. 6 SelToggle A SelToggle command addresses a transponder and toggles the RdEn bit (0→1 or 1→0). The transponder returns a frame with the changed value of RdEn bit followed by a CRC. The SelToggle command frame consists of four blocks and has a constant length of 45 bits. The Start bit allows the transponder to synchronise to the new command frame. After the Start bit the frame contains four bits for the Command. Next to the Command, a sequence of 32 bits follows with the transponder address. A CRC block of 8 bits is calculated over the Command and the transponder address and appended to the end. The transponder frame has a length of 10 bits and starts with the RdEn bit and the "not RdEn" bit. A CRC block of 8 bits is calculated over the RdEn and the "not RdEn" and appended to the end. 1 bit Reader Start 4 bits MSB SelToggle 32 bits MSB ROM 8 bits X8 CRC 2 bits Transponder tsp RdEn nRdEn 8 bits X8 CRC Fig. 7 SelTag The SelTag command address a transponder with its 32 bit address (ROM) and set the flag Select to 1. After this command, the selected transponder can answer to commands : Read, Write, Prot, Add, Comp and Login. 1 bit Reader Start 4 bits MSB SelTag 32 bits MSB ROM 8 bits X8 CRC 2 bits Transponder tsp Sel nSel 8 bits X8 CRC Fig. 8 Copyright © 2005, EM Microelectronic-Marin SA 6 www.emmicroelectronic.com EM4056 DeselTag The DeselTag command address a transponder with its 32 bit address (ROM) and reset the flag Select to 0. 1 bit Reader Start 4 bits MSB DeselTag 32 bits MSB ROM 8 bits X8 CRC 2 bits 8 bits X8 Transponder tsp Sel nSel CRC Fig. 9 Prot Prot command for writing the 2 (OTP) protection bit (read and write) at the specified address. 1 bit Reader Start 4 bits MSB Prot 8 bits MSB Address 2 bits MSB Wp/Rp 8 bits X8 CRC 2 bits Transponder twp WOk nWOk 8 bits X8 CRC Fig. 10 Wp=1, the specified address is protected against writing. Rp=1, the specified address is protected against reading. WOk=1, the protection bit has been successfully written to one. Read Read command to get a 16-bit word located at the specified address. If the address is read protected, the circuit transmits a 65535 value. 1 bit Reader Start 4 bits MSB Read 8 bits MSB Address 8 bits X8 CRC 16 bits 3 bits 8 bits MSB X8 trp Datas Prot CRC Prot = (Wp / Rp / Suc) Transponder Fig. 11 Datas 12345 dec 65535 dec 65535 dec 65535 dec Rp 0 0 1 0 Suc 0 0 x 1 Definition Data = 12345 Data = 65535 Read protected Read protected by PIN Wp=1, the specified address is protected against writing. Rp=1, the specified address is protected against reading. Suc=1, the specified address is protected by the PIN against reading. Copyright © 2005, EM Microelectronic-Marin SA 7 www.emmicroelectronic.com EM4056 Write Write command for 16 bits of data at the specified address. 1 bit Reader Start 4 bits MSB Write 8 bits MSB Address 16 bits MSB Datas 8 bits X8 CRC 2 bits Transponder 8 bits X8 CRC twp WOk nWOk Fig. 12 WOk=1, the write operation has been successfully executed. When a word is written at the address (Adr 126), where the configuration is located this command is restricted to write the uppermost data (Dat_15 à Dat_4), the lower address (Dat_3 to Dat_0) being reserved for safeguarding the PIN counter. The data at the address of the configuration are: 15 Z_Suc[2:0] 0 M_Suc No_Ant Sec Conf[2:0] NU NU NU Alm Pin[2:0] Fig. 13 where : • M_suc : selects a internal mode for which no reading nor writing can extract or engrave valid data into the area of the memory presently protected by the PIN code. M_suc=1, area of memory is protected by PIN. • Z_suc[2 :0] : determines the address area which is protected by the PIN code. (0% [000], 25%[100], 50%[101], 75 %[110] or 100%[111]). Z_suc[2:0] 000 100 101 110 111 • • • • • Area protected 00 % 25 % 50 % 75 % 100 % Addresses protected None, incl. PIN Word 127 – Word 96 Word 95 – Word 64 Word 63 – Word 32 Word 31 – Word 0 No_Ant : selects the bit "Egal_ROM" and disables the anticollision mode. No_Ant=1, no anticollision, the tag is always selected (Sel=1). Sec=1, enables the counter of false attempts for the password (PIN). Sec=0, counter is disabled. Conf[2 :0] : represents the maximum number of attempts for finding a valid PIN before definitive lock of the card for writing. Pin[2 :0] : represents the number of remaining attempts for finding the correct PIN. Alm : alarm bit indicates a permanent lock of the card against write attempts. This bit is activated as soon as the number of PIN erroneous introduction is surpassed. Copyright © 2005, EM Microelectronic-Marin SA 8 www.emmicroelectronic.com EM4056 Add Add command to add one 16-bit data word to another 16-bit data word pointed by the specified address, this command writes the sum at the specified address. It is possible to add a value to an already protected memory location that has been protected against reading, but not to a memory location that has been protected against writing attempts. 1 bit Reader Start 4 bits MSB Add 8 bits MSB Address 16 bits MSB Datas 8 bits X8 CRC 2 bits Transponder twp WOk nWOk 8 bits X8 CRC Fig. 14 Comp Compares a 16 bits data word with another word pointed by the specified address. It is possible to perform a comparison with a value pointed by a read protected address. But it is impossible to compare a value with another one in the opaque area without entering the PIN. In the case of PIN violation, the result of the comparison is always false. Ega=1, comparison successful. 1 bit Reader Start 4 bits MSB Comp 8 bits MSB Address 16 bits MSB Datas 8 bits X8 CRC 2 bits Transponder trp Ega nEga 8 bits X8 CRC Fig. 15 Login Compares a 16 bit data word with the PIN word at the address 127. When a PIN comparison is made (Adr 127) and the identity is established, a write operation occurs in the EEPROM, PIN = CONF , the success bit is released (SUC = 0), the PIN counter is decremented (PIN = PIN - 1) and the corresponding new value is written in the EEPROM. After n erroneous attempts (PIN=0), the ALM bit is set (ALM = 1), and written in the EEPROM. Since that moment the entire memory is irreversibly locked. The unprotected data words (Rp=0) remain accessible for reading the information they are containing. 1 bit Reader Start 4 bits 16 bits 8 bits MSB LSB MSB LSB X8 1 Login Datas CRC 4 bits Transponder twp Ega nEga WOk nWOk 8 bits X8 1 CRC Fig. 16 Ega=1, password ok. Wok=1, writing operation successful. Copyright © 2005, EM Microelectronic-Marin SA 9 www.emmicroelectronic.com EM4056 Arbitration commands The arbitration mode is a sophisticated command avoiding collisions among transponders. The arbitration method is based on the method of multiprocessor bus arbitration. This feature allows the identification of a transponder out of a group, even if they entered the electromagnetic field at the same time. At each arbitration, the reader detects one address of a new transponder. The arbitration session starts with a special StartArbitration command. If the RdEn bit of the transponder is « 0 », then the transponder belongs to the active group. The arbitration commands will only act on the transponders of the active group. StartArbitration After the Start bit, the reader sends a command field which indicates the beginning of an arbitration cycle. An 8 bits CRC block calculated over the StartArbitration command completes this information. The transponder returns the first BitVal frame corresponding to the LSB of its 32 bits addresses. Start of arbitration 1 bit Reader Start 4 bits MSB Start_Arbit 8 bits MSB CRC Transponder 1 bit 2 bits MSB Start Continue 6 bits Bit0 Bit0 X X Bit1 Bit1 ta1p LSB ROM ta2p Fig. 17 BitVal Frame The BitVal frame consists of 6 bits. If the Nth bit of its address is logic « 0 », the transponder sends two « 0 » at the position Bit0. If the Nth bit of its address is logic « 1 », the transponder sends two « 0 » at the positions Bit1. The bit repetition increases the transmission reliability. The response value of the different transponders is coded with the time position of the answer. Therefore no answer conflicts are generated. Note: Reception Bit Period is 32 RFclocks for all the arbitration (BitVal frame and CRC). BitVal frame Bit0 Bit0 Å 32 Rf period Æ X BitVal = 0 0 0 X BitVal = 1 X X X X X X Bit1 Bit1 X X 0 0 Fig. 18 Copyright © 2005, EM Microelectronic-Marin SA 10 www.emmicroelectronic.com EM4056 Continue command After receiving the BitVal frame from the different transponders in the field the reader decides whether the tags with « 0 » or « 1 » should continue the arbitration process and communicates this with the Continue frame. The transponders whose last BitVal was not identical with the confirmation in the Continue frame stop the arbitration process and wait for a new command. Arbitration in progress 1 bit Reader Start 2 bits MSB Continue Transponder 1 bit 2 bits MSB Start Continue ta1p 6 bits Bit0 Bit0 X X Bit1 Bit1 nth BitVal ta2p ta1p 6 bits Bit0 Bit0 X X Bit1 Bit1 n+1th BitVal Fig. 19 When the Continue frame of the 32nd bit is processed, only one transponder is left. This new identified tag sets the RdEn bit to 1 and belongs no longer to the active group. The arbitration cycle is completed by a transponder frame for selective commands (RdEn,CRC). The CRC is calculated like a transponder frame for general commands. This means the CRC is calculated over ROM and RdEn of the transponder in order to increase the reliability of the arbitration. End of arbitration 1 bit Reader Transponder Start 2 bits MSB Continue 1 bit 2 bits MSB Start Continue ta1p 6 bits Bit0 Bit0 X X Bit1 Bit1 32th BitVal ta2p ta1p 8 bits MSB CRC Fig. 20 To identify the address of a transponder, it takes 115 ms (including overhead as mentioned before). That makes it possible to detect about 8.7 new transponders per second, independent of the number of transponders in the electromagnetic field. Copyright © 2005, EM Microelectronic-Marin SA 11 www.emmicroelectronic.com EM4056 Example of Arbitration protocol * Read ROM No CRC error ? Yes Reset flag Read next bit (from LSB to MSB) Yes No 0 and 1 ? Set flag Yes Chosen bit: 0 0? Chosen bit: 0 No No Chosen bit: 1 Yes MSB ? Chosen bit: 1 No Flag set ? Yes All tags are identified *patented by Biel School of Negineering, MicroLab I3S Fig. 21 Copyright © 2005, EM Microelectronic-Marin SA 12 www.emmicroelectronic.com EM4056 Pad Location Pad Assignment Pin Name 1 C1 2 Description coil connection TEST_CLK test pad with pull down 3 VPOS 4 VDD 5 4 169 positive supply 7 TEST_OUT test pad output 3 1673 2 7 6 VSS negative supply 7 TEST test pad with pull down 8 C2 2607 1850 3175 EM4056 1955 5 6 unregulated positive supply 8 coil connection 1 409 151 666 525 Y 2159 X C1, C2 pad size : 200 X 600 Other pads size : 100 X 100 All dimensions in µm Fig. 22 Package Information CID Package PCB Package FRONT VIEW Y K J TOP VIEW B D Z MARKING AREA A SYMBOL A B D e F g J K R MIN 8.2 3.8 5.8 0.38 1.25 0.3 0.42 0.115 0.4 TYP 8.5 4.0 6.0 0.5 1.3 0.4 0.44 0.127 0.5 MAX 8.8 4.2 6.2 0.62 1.35 0.5 0.46 0.139 0.6 X C2 Dimensions are in mm R SYMBOL X Y Z e C2 C1 F F MIN C1 TYP 8.0 4.0 MAX 1.0 Dimensions are in mm g Fig. 23 Copyright © 2005, EM Microelectronic-Marin SA 13 Fig. 24 www.emmicroelectronic.com EM4056 Ordering Information Part Number EM4056B6WW11E EM4056B6WP11 EM4056B6CI2LC EM4056B6CB2RC Bit coding Bi-phase Bi-phase Bi-phase Bi-phase Cycle/ bit 64 64 64 64 Package / Die Form Unsawn wafer, 11mils thickness Die in waffle pack, 11mils thickness CID package, 2 pins (length = 2.5mm) PCB package, 2 pins Delivery Form / Bumping With gold bumps No bumps Bulk Bulk For other packages, please contact EM Microelectronic-Marin SA Product Support Check our Web Site under Products/RF Identification section. Questions can be sent to cid@emmicroelectronic. com EM Microelectronic-Marin SA (EM) makes no warranty for the use of its products, other than those expressly contained in the Company's standard warranty which is detailed in EM's General Terms of Sale located on the Company's web site. EM assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of EM are granted in connection with the sale of EM products, expressly or by implications. EM's products are not authorized for use as components in life support devices or systems. © EM Microelectronic-Marin SA, 04/05, Rev. E Copyright © 2005, EM Microelectronic-Marin SA 14 www.emmicroelectronic.com