Preliminary WM71004 / WM71008 / WM71016 4/8/16Kbit Secure F-RAM Memory with Gen-2 RFID Access DESCRIPTION FEATURES The WM710xx is a RFID transponder IC with nonvolatile memory employing an advanced ferroelectric process. A ferroelectric random access memory, or F-RAM, is nonvolatile and performs reads and writes like a RAM. It provides reliable data retention for 20 years while eliminating the complexities, overhead, and system level reliability problems caused by EEPROM and other nonvolatile memories. 4/8/16 Kbit Ferroelectric Nonvolatile RAM Organized as 256/512/1024 x 16 bits Very High Read/Write Endurance (> 1014) 20-Year Data Retention Gamma Stability Demonstrated to > 30 kGy Symmetric Read/Write Operation Advanced High-Reliability Ferroelectric Process Unlike EEPROM‟s, the WM710xx write operations are zero power – there is no power or speed premium paid for executing writes into the WM710xx as compared to read power and speed. Operation of the memory is fully symmetric: it has an equivalent read and write range. The WM710xx‟s RFID interface is compatible with the EPC Class-1 Generation-2 UHF RFID Protocol for Communications at 860 MHz – 960 MHz, Version 1.2.0 Specification for RFID Air Interface. The WM710xx is a two chip configuration offered in various forms: standard IC package or wafers. All specifications discussed herein are applicable to the combined chipset operation. WM71016 RFID Tag with F-RAM RFID Reader (Class-1 Gen-2) Figure 1. System Block Diagram Interface and Security Features EPC Class 1 Gen2 (ISO18000-6C) RFID Compatible Interface (revision 1.2.0) 192-Bit Memory: 96-Bit Electronic Product Code™ (EPC), 32-Bit Access Password, 32-Bit KILL Password, 64-Bit TID Memory (Factory Programmed and Locked) Inventory, Read, Write and Erase features Kill Command Block Permalock Command Access Command UHF carrier frequencies from 860 MHz to 960 MHz ISM band, ASK demodulation Tag-to-reader link frequencies up to 640Kbps Reader-to-tag asymptotical transmission rates up to 128Kbps Supports FM0 and MMS data encoding formats Custom Features Stored Address Pointer to Improve Data Write Speed Stored Address Pointer Lock Block Write Command Variable USER Memory Block Size Support Ultra Low Power Operation Memory Read/Write Sensitivity: < -6 dBm (typ.) Industry Standard Configurations Industrial Temperature -40 C to +85 C Bumped Wafers 8-pin UDFN This is a product that has fixed target specifications but are subject to change pending characterization results. Rev. 1.4 May 2011 Ramtron International Corporation 1850 Ramtron Drive, Colorado Springs, CO 80921 (800) 545-FRAM, (719) 481-7000 http://www.ramtron.com Page 1 of 24 WM710xx – Secure F-RAM with Gen-2 RFID PIN CONFIGURATION (UDFN PACKAGE) Top View (PCB Layout) NC 1 8 ANT- NC 2 7 ANT+ NC 3 6 NC NC 4 5 NC 3.0 mm × 3.0 mm body, 0.65 mm pad pitch PIN DESCRIPTION Pin Name ANT+, ANTNC Rev. 1.4 May 2011 Pin Number 7, 8 1, 2, 3, 4, 5, 6 Type Input - Description RFID Antenna. Connect to external RFID antenna terminals. There is no internal connection. Page 2 of 24 WM710xx – Secure F-RAM with Gen-2 RFID FUNCTIONAL DESCRIPTION The WM710xx is a non-volatile memory device with an industry standard UHF RFID interface that enables processing data in and out of memory as a generic passive RFID transponder. Unlike other transponder ICs, the WM710xx transponder IC contains high density symmetric read/write F-RAM memory that enables unique applications of an RFID solution. When combined with an appropriate antenna design, WM710xx will power up with energy harvested directly from the RF field. Following an internally generated reset state, the IC configures itself according to preprogrammed configuration settings that were stored in F-RAM non-volatile memory at wafer probe, packaged parts test, or end unit transponder personalization at end-user depot. Configuration settings are read out of memory and applied prior to enabling data transmission in or out of memory. As specified in the Gen2 standard, the chip receives and processes commands transmitted by the RFID interrogator (reader). All required and most optional commands are supported. In addition to these, WM710xx supports a number of custom commands that take advantage of F-RAM‟s unique ultra low power and symmetrical characteristics. Referring to Figure 2, the transponder IC‟s consist of an RFID interface, control and authentication logic, FRAM memory, and power management unit. The external antenna is connected directly to the RFID interface where the RF signal is rectified with high efficiency Schottky diode based rectifier. The rectified voltage is multiplied up within the Schottky array and then regulated to supply power to on-chip resources. Also included in the RFID Interface is a modulator/demodulator that detects incoming signals and modulates the input impedance to enable backscattering of returned signals. The control and authentication logic processes commands to enable access in and out of F-RAM memory. RFID Interface Control and Authentication Logic Power Management F-RAM Array (16Kb) External MCU (Optional) Figure 2. Block Diagram Rev. 1.4 May 2011 Page 3 of 24 WM710xx – Secure F-RAM with Gen-2 RFID MEMORY MAP WM710xx‟s memory is partitioned according to the logical and physical mapping shown in Table 1 below. Table 1: Memory Map DSPI Address Gen-2 Memory Bank Gen-2 Address Word Pointer (EBV8) 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 0x009 0x00A 0x00B 0x00C 0x00D 0x00E 0x00F RESERVED RESERVED RESERVED RESERVED EPC EPC EPC EPC EPC EPC EPC EPC EPC EPC SERVICE SERVICE 0x000 0x001 0x002 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 0x009 0x00A 0x00B 0x00 0x01 0x02 0x03 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x010 0x011 0x012 0x013 0x014 0x015 0x016 0x017 0x018 0x019 0x01A 0x01B TID TID TID TID USER USER USER USER USER USER USER USER 0x000 0x001 0x002 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x00 0x01 0x02 0x03 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x0FE 0x0FF 0x100 0x101 … 0x1FE 0x1FF 0x200 0x201 … 0x3BA 0x3BB 0x3BC 0x3BD 0x3BE USER USER USER USER … USER USER USER USER … USER USER USER USER USER 0x0EA 0x0EB 0x0EC 0x0ED … 0x1EA 0x1EB 0x1EC 0x1ED … 0x3A6 0x3A7 0x3A8 0x3A9 0x3AA 0x816A 0x816B 0x816C 0x816D … 0x836A 0x836B 0x836C 0x836D … 0x8726 0x8727 0x8728 0x8729 0x872A Rev. 1.4 May 2011 Description Kill Password[31:16] Kill Password[15:0] Access Password[31:16] Access Password[15:0] CRC PC EPC - Word 0 (MSW) EPC - Word 1 EPC - Word 2 EPC - Word 3 EPC - Word 4 EPC - Word 5 (LSW) EPC - read memory EPC - read memory RESERVED RESERVED TID - Word 0: xE201 TID - Word 1: x6216 TID - Word 2: Serial #1 TID - Word 3: Serial #2 RESERVED RFU Control/Status Register Working Stored Address Register USER Memory - Start 16k Memory: END (BLK_SIZE = 1 word/block) Page 4 of 24 WM710xx – Secure F-RAM with Gen-2 RFID DSPI Address Gen-2 Memory Bank Gen-2 Address Word Pointer (EBV8) … 0x3DA 0x3DB 0x3DC 0x3DD 0x3DE … 0x3EA 0x3EB 0x3EC 0x3ED 0x3EE … 0x3F3 0x3F4 0x3F5 0x3F6 0x3F7 0x3F8 0x3F9 0x3FA … USER USER USER USER USER … USER USER USER USER USER … USER USER USER USER USER USER USER USER … 0x3C6 0x3C7 0x3C8 0x3C9 0x3CA … 0x3D6 0x3D7 0x3D8 0x3D9 0x3DA … 0x3DF 0x3E0 0x3E1 0x3E2 0x3E3 0x3E4 0x3E5 0x3E6 … 0x8746 0x8747 0x8748 0x8749 0x874A … 0x8756 0x8757 0x8758 0x8759 0x875A … 0x875F 0x8760 0x8761 0x8762 0x8763 0x8764 0x8765 0x8766 Description 16k Memory: END (BLK_SIZE = 2 words/block) 16k Memory: END (BLK_SIZE = 4 words/block) 16k Memory: END (BLK_SIZE = 8 words/block) 16k Memory: END (BLK_SIZE = 16 words/block) 16k Memory: END (BLK_SIZE = 32 words/block) 0x3FB USER 0x3E7 0x8767 (BLK_SIZE > 32 words/block) 0x3FC 0x3FD 0x3FE USER USER USER 0x3E8 0x3E9 0x3EA 0x8768 0x8769 0x876A RESERVED RESERVED RESERVED 0x3FF USER 0x3EB 0x876B RESERVED GEN2 WM710XX MEMORY BANKS The RFID memory banks reside in Ramtron‟s non-volatile F-RAM memory. F-RAM brings many benefits to the WM710xx. The first benefit is the size of the memory itself – up to 16k-bit, most of which is available in the USER memory bank. F-RAM‟s impact on the Gen2 protocol is most dramatically seen when writing to WM710xx memory. Unlike EEPROM memory, no charge pump or memory soak time is required to write to WM710xx memory, resulting in zero time and zero power penalties. The write cycle is completed immediately, allowing an interrogator to continue writing additional data to memory with no time penalty incurred due to the memory itself. A comparison between F-RAM and EEPROM memories is shown in Figure 3. The figure shows the minimum number of Gen2 instructions required to perform a SELECT, INVENTORY, and ACCESS sequence of commands to write a data word to memory. The same interrogator command sequence is transmitted to the WM710xx and an EEPROM-based RFID. The effect of the EEPROM time penalty is shown within the context of the protocol. Rev. 1.4 May 2011 Page 5 of 24 WM710xx – Secure F-RAM with Gen-2 RFID MaxArias Write Cycle INTERROGATOR SELECT (385u) QURY (240u) ACK (175u) REQRN (345u) EPC (228u) TAG REQRN (345u) HANDLE (78u) RN (53u) WRITE (495u) RN16 (78u) WR_OK (80u) C h EE a r g PR e p OM um wr p & ite EE dela so y! ak tim e EEPROM-based Write Cycle 4ms Figure 3. Gen2 Memory Write Cycle Comparison: F-RAM vs. EEPROM Memories RESERVED: KILL Password: The kill password provides a mechanism to permanently disable the WM710xx RFID from responding to any and all Gen2 interrogator commands. The mandatory KILL command can be issued by a RFID interrogator in either the OPEN or SECURED states. The WM710xx is permanently killed through a four-instruction sequence of REQRN and KILL commands as detailed in the Gen2 standard. The KILL password is a 32-bit value stored as 2 16-bit data words in reserved memory. The most significant KILL password is stored in reserved memory bank address 0x00 with the least significant word stored in reserved memory bank address 0x01. The kill function can be permanently disabled by setting both KILL password words to 0x0000, and permanently locking the KILL password in the reserved memory bank. Once the kill password has been set, it should be permanently locked using the LOCK command. The WM710xx is shipped from the factory with the kill password memory unlocked. RESERVED: ACCESS Password: The access password provides a security mechanism to prevent unauthorized RFID interrogators from writing to WM710xx memory. Non-zero access passwords require the WM710xx be placed in the SECURED state prior to writing to it. This is accomplished through four consecutive REQRN and ACCESS commands as described in the Gen2 standard. An access password with a value of zero requires no authentication prior to writing to WM710xx memory. The ACCESS password is a 32-bit value stored as 2 16-bit data words in reserved memory. The most significant ACCESS password is stored in reserved memory bank address 0x02 with the least significant word stored in reserved memory bank address 0x03. Once the access password has been set, it should be permanently locked using the LOCK command. The WM710xx is shipped from the factory with the access password memory unlocked. EPC Memory Bank: The EPC memory bank accommodates 8 words: 1 protocol control (PC) word, a 6-word (96-bit) memory space for an EPC identifier, and a 1-word CRC. The CRC word is calculated as part of the WM710xx power-on initialization routine and written into the EPC memory bank address 0x00. The PC and 6-word EPC identifier are completely programmable. The Protocol Control field is shown in Figure 4. Rev. 1.4 May 2011 Page 6 of 24 WM710xx – Secure F-RAM with Gen-2 RFID bit 15 11 10 9 8 7 0 PROTOCOL CONTROL WORD LEN UMI XPC NT NSI Numbering System Identifier NSI Type Extended Protocol Control User Memory identifier EPC Identifier Word Length DEFAULT 00110 1 0 0 00000000 Figure 4. EPC Protocol Control Word The five most significant bits of the PC indicates the size of the EPC identifier in words – for a 96-bit (6-word) EPC identifier, the PC should be programmed to 0b0011_0xxx_xxxx_xxxx. The LEN parameter of the PC word may not be greater than 0b00110 – a LEN parameter of 0b00000 has an EPC identifier length of zero words resulting in only the PC and CRC words when WM710xx is acknowledged. The UMI bit (User Memory Identifier) is asserted to a logic one by WM710xx and mapped to bit 10 of the PC word. In the event the host writes a logic zero to the UMI bit, the memory location will be written with a logic zero, however the backscattered EPC identifier will assert the UMI bit to a logic one which is also used in the calculation of the CRC. WM710xx does not support extended protocol control and should be written with a logic zero. PC word bits 8 down to 0 of the PC word are factory-initialized to zero. The WM710xx is shipped from the factory with the EPC memory bank unlocked. TID Memory Bank: The TID memory bank consists of 4 words (64 bits), and is defined as shown in Table 2. The TID memory bank is permanently locked at the factory and obeys the ISO/IEC 15963 numbering convention. Table 2: TID memory Bank Fields Bit Field Value (hex) Description 00h – 07h E2 ISO/IEC 15963 class-identifier 08h – 13h 016 Mask-Designer Identifier (MDID) – Ramtron International 14h – 1Fh 216 Tag model number 20h – 3Fh 32-bit unique identifier 0 7 8 15 Class Identifier 16 19 MDID[11:4] 20 31 MDID[3:0] TMN[11:0] 32 47 ID[31:16] 48 63 ID[15:0] Figure 5. TID Memory Bank Fields Rev. 1.4 May 2011 Page 7 of 24 WM710xx – Secure F-RAM with Gen-2 RFID USER Memory Bank: The USER memory bank comprises two special-function control words, factory-reserved words, and up to 993 available memory locations. Refer to Table 1 for detail on the WM710xx memory structure. The USER memory bank may be completely locked through the LOCK command. WM710xx also supports the BLOCKPERMALOCK command providing the ability to lock contiguous words of USER memory, with word block sizes as small as a single word up to a maximum block size of 128 words. The USER memory bank ships from the factory completely unlocked. Rev. 1.4 May 2011 Page 8 of 24 WM710xx – Secure F-RAM with Gen-2 RFID TAG-TO-READER DATA ENCODING The WM710xx supports both encoding formats defined in the Gen2 standard: FM0 baseband (FM0) Miller modulation of a subcarrier (MMS) Data encoding is performed in the WM710xx as described in the Gen2 standard. A FM0 data symbol is transmitted with period T which is defined by the tag-to-reader link frequency. The difference between a logic 0 and a logic 1 is defined by an additional mid-bit transition for a logic 0 as shown below in Figure 6. Data encoding using Miller modulation of a subcarrier (MMS) is further defined by a rate parameter M that defines the number of link frequency cycles per data bit: 2, 4, or 8, resulting in data encoding defined as MMS2, MMS4, or MMS8 respectively. MMS data encoding results in a phase inversion of the sub-carrier frequency when one of the following conditions occurs: At the mid-bit of a logic 1 data bit, or At the bit-boundary of two consecutive logic 0s. The following set of four figures depicts the data bit values “00”, “01”, “10” and “11” for FM0 and MMS data encoding formats. The same link frequency is shown for all cases, however the MMS parameter M lengthens the baseband bit period by 2, 4, or 8 as shown in Figure 7, Figure 8, and Figure 9. 0 T 2T 00 01 10 11 Figure 6. FM0 Data Encoding 0 2T 4T 00 01 10 11 Figure 7. MMS2 Data Encoding 0 4T 8T 00 01 10 11 Figure 8. MMS4 Data Encoding 0 8T 16T 00 01 10 11 Figure 9. MMS8 Data Encoding Rev. 1.4 May 2011 Page 9 of 24 WM710xx – Secure F-RAM with Gen-2 RFID CONTROL/STATUS REGISTER Accessing the unique features of WM710xx is accomplished through the Control/Status register in F-RAM non-volatile memory. The register is located at physical address 0x016 or USER memory address 0x002. The Control/Status word register is organized as shown in Table 3: below. Care should be exercised when writing the Control/Status register word if it is to remain unlocked. LCK PLCK BW EN RFU BLKSIZ WRP WRP EN ALCK AINC Figure 10. Control/Status Register Table 3: Control/Status Word Register Bit Mnemonic Function 15 LOCK Memory locking of this register. 14 PERMALOCK 13 RFU 1 Reserved for future use 12 RFU Reserved for future use 0 11 RFU Reserved for future use 0 10 RFU Reserved for future use 0 9 RFU Reserved for future use 0 8 RFU Reserved for future use 0 7 BLKWREN Enables use of the custom command BLOCKWRITE. 1 6 BLKSIZ[2] USER memory block size. 1 5 BLKSIZ[1] 4 BLKSIZ[0] 3 WRPSTAT 2 1 0 WRPEN AUTOLOCK AUTOINCR LOCK 0 0 1 PERMALOCK 0 1 0 1 0 DESCRIPTION Register unlocked Register permanently unlocked Register writeable only from the SECURED state Register permanently locked BLKSIZ[2:0] # words BLKSIZ[2:0] 000 1 100 001 2 101 010 4 110 011 8 111 Indicates if the Working Stored Address has wrapped. 0 0 # words 16 32 64 128 Logic State Description 0 Wrapping has not occurred 1 Wrapping has occurred at least once Enables wrapping of the Working Stored Address when it reaches the top of logical memory. Logic State Description 0 DISABLE memory wrapping 1 ENABLE memory wrapping. Enable Automatic Locking of all user memory between the start of USER memory and the Working Stored Address register. Logic State Description 0 Auto-lock DISABLED 1 Auto-lock ENABLED Enable the Working Stored Address word to Auto-Increment when performing an unaddressed write cycle. Logic State 0 1 Rev. 1.4 May 2011 Initial Value 1 0 0 0 0 0 Description DISABLE auto-increment of stored address register ENABLE auto-increment of stored address register Page 10 of 24 WM710xx – Secure F-RAM with Gen-2 RFID Upon power up, WM710xx‟s control logic reads the Control/Status word out of memory and configures itself accordingly. User applications may change the Control Word as needed providing the register has not been permanently locked. The Control/Status word may be read by the application at any time. Register Locking: The LOCK and PERMALOCK control bits are implemented in a similar manner as locking bits used for Gen2 memory bank locking with the exception that the lock control bits are incorporated into the register they are locking. As such, attention needs to be placed on how the contents of the Control/Status word are written when the register is not completely unlocked. Table 4: Control/Status Word Locking LOCK 0 PERMALOCK 0 0 1 1 0 1 1 Description Register unlocked. All control bits, including the LOCK and PERMALOCK bits can be written to from the OPEN or SECURED states. Register permanently unlocked. All control bits can be written from the OPEN or SECURED states. The LOCK and PERMALOCK bits must be set to logic values 0 and 1 respectively when writing the Control/Status word. Register locked. All control bits can be written to only from the SECURED state. The register cannot be written to in the OPEN state. The LOCK and PERMALOCK bits must be set to logic values 1 and 0 respectively when writing the Control/Status word. Register permanently locked. The register cannot be written in any circumstance. Block Write Enable: The BLKWREN control bit enables usage of the WM710xx custom command BLOCKWRITE. The BLKWREN parameter is internally updated during power-on WM710xx initialization. In the event the host application toggles the state of BLKWREN, a WM710xx power cycle is required to reflect the change. Block Size: The 3 BLKSIZ[2:0] control bits adjust the USER memory block sizes as shown in Table 5:. This provides the RFID application the ultimate flexibility in determining a balance between the USER memory requirements and the granularity of the number of USER memory words per block. For the WM71016, the larger the granularity of the block size, the greater amount of available USER memory; block size has no effect on WM71004 or WM71008 memory. The effect of the block size on available USER memory is shown in Table 1. The total number of USER memory words available as a function of the block size is shown in Table 5 below. It is of utmost importance that the 3-bit block size is not modified once set, which would result in corruption of block permalock status bits. Table 5: Available USER Memory Memory BLKSIZ Words/Block 4k 8k 16k 16k 16k 16k 16k 16k 16k 16k xxx xxx 000 001 010 011 100 101 110 110 x x 1 2 4 8 16 32 64 128 Free USER Memory (words) 230 486 931 963 979 987 991 993 993 993 Wrap Status: The WRPSTAT status bit is asserted to a logic one when the following conditions are true: (a) WRPEN=1, AUTOINCR=1 and AUTOLOCK=0, (b) The contents of the Working Stored Address register address the last USER memory location, and (c) An unaddressed WRITE command is received. The WRPSTAT can be cleared by the RFID interrogator by writing a logic zero to the WRPSTAT bit. Rev. 1.4 May 2011 Page 11 of 24 WM710xx – Secure F-RAM with Gen-2 RFID Wrap Enable: Asserting the WRPEN control bit to a logic one enables the USER memory wrapping feature. The wrap enable feature allows the stored address pointer to wrap back to the factory-set initial stored address value of 0x006. In this manner, the WM710xx memory acts as a circular buffer. Clearing the WRPEN control bit disables wrapping resulting in a write-once memory. In this case, when the Working Stored Address reaches the end of user memory, no additional unaddressed write cycles will be possible. The WRPEN and AUTOLOCK control bits are mutually exclusive – only one of the two control bits may be asserted at any given time. Auto Lock Enable: Asserting the AUTOLOCK control bit to a logic one enables memory locking of the USER memory span between the start of USER memory and the Working Stored Address. The AUTOLOCK and WRPEN control bits are mutually exclusive – only one of the two control bits may be asserted at any given time. The automatic locking feature can only be used when AUTOINCR is asserted to a logic one. Auto Increment: Asserting AUTOINCR control bit to a logic one enables the Working Stored Address increment function. Upon receiving an unaddressed write cycle, the WM710xx increments the pointer stored in the Working Stored Address register to point to the next free memory location then writes the cover-coded data word to the respective memory location. This functionality removes any requirement for a RFID interrogator to determine where free USER memory is located and manipulating the memory pointer itself. WORKING STORED ADDRESS To better utilize the F-RAM‟s fast write capability, memory has been architected using an optional Working Stored Address register. The stored address function enables automation of the storage of large blocks of user data, such as pedigree or tracking information. This feature enables a RFID interrogator the ability to use a standard Gen2 WRITE command using a designated address of 0x3FFF (0xFF7F EBV-formatted) as a redirect pointer to use the contents of the Working Stored Address register – this is referred to as an unaddressed write (UNADDR_WRITE). The Working Stored Address is a USER memory address pointer addressing the last unaddressed memory write cycle as shown in Figure 12 below. The Working Stored Address is a read/write register located in USER memory, address 0x003. It may be manually updated by simply writing to USER memory address 0x003 or automatically increment when the AUTOINCR control bit in the Control/Status register is asserted to a logic one and an unaddressed write command is received. LCK PLCK RFU INIT EN ADDR[9:0] Figure 11. Working Stored Address Register Table 6: Working Stored Address – Bit Definitions Bit Mnemonic Function 15 LOCK Memory locking of this register. 14 PERMALOCK 13:11 RFU 10 INITEN 9:0 ADDR Rev. 1.4 May 2011 LOCK 0 0 1 Initial Value PERMALOCK 0 1 0 1 Reserved for future use 1 0 DESCRIPTION Register unlocked Register permanently unlocked Register writeable only from the SECURED state Register permanently locked When asserted to a logic ‘1’, sets the contents of the Initial Stored Address register with the value defined in the 10-bit address field in bits 9 through 0 written to this register using a Gen2 write instruction. Working stored address pointer 0 0 0 006 Page 12 of 24 WM710xx – Secure F-RAM with Gen-2 RFID RESERVED EPC SERVICE SERVICE TID USER USER USER USER USER USER USER USER USER USER USER Gen-2 Address 0x000 - 0X003 0x000 - 0x009 0x00A 0x00B 0x000 - 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 … Description RESERVED - passwords EPC RESERVED RESERVED TID RESERVED RFU Control/Status Register Working Stored Address Register: 0x0006 USER Memory - START MEMORY UNAVAILABLE Gen-2 Memory Bank AVAILABLE MEMORY Working Stored Address Pointer … USER Memory - END Figure 12. USER Memory Bank: Working Stored Address Register The syntax for an unaddressed write command is shown in Error! Reference source not found.. All protocol equirements governing implementation of a WRITE command also apply to the UNADDR_WRITE command. WRITE (0xC3) Membank (0b11) WordPtr (0xF7FF) 16-bit Data (cover-coded) (0xNNNN) Handle (0xHHHH) CRC-16 (0xCCCC) Figure 13. Unaddressed Write Syntax Upon reception of a valid UNADDR_WRITE command, the WM710xx examines the state of the AUTOINCR control bit: AUTOINCR=0: The 16-bit data word cover-coded in the unaddressed write instruction is written to the memory address stored in the Working Stored Address register. The contents of the Working Stored Address register remain unaltered. To avoid the memory being over-written, the Working Stored Address register must be manually updated. AUTOINCR=1: The Working Stored Address register is incremented by one, followed by the 16-bit data word being written to memory. The contents of the Working Stored Address register will reflect the memory address just written to. A single unaddressed write cycle is shown in Figure 14 with the AUTOINCR control bit set to a logic one. The Working Stored Address has an initial value of 0x0006 as shown in Figure 12. An unaddressed write cycle (with AUTOINCR=1) increments the address pointer to 0x0007 followed by a write cycle to the WM710xx memory resulting in data word DATA 0 being written to USER memory address 0x007. Figure 15 depicts an additional seven discrete unaddressed write cycles (REQRN command for cover-coding not shown). Prior to unaddressed write commands, the Working Stored Address has a memory address of addrn. An unaddressed write command with data payload DATAn is written to addrn+1; the following unaddressed write command with data payload DATAn+1 is written to addrn+2, and so on. Upon completion of the final unaddressed write command, the memory pointer contents of the Working Stored Address will be addrn+8, reflecting the memory address of the last unaddressed write cycle. In this manner, the RFID interrogator does not have to read the memory contents to discern the next available memory location. This substantially reduces the time required in the RF field yielding greater throughput of a population of tags. The Working Stored Address pointer will be factory-initialized to the start of USER memory then managed by the memory controller or the host application as required. Rev. 1.4 May 2011 Page 13 of 24 WM710xx – Secure F-RAM with Gen-2 RFID Gen-2 Address RESERVED EPC SERVICE SERVICE TID USER USER USER USER USER USER USER USER USER USER 0x000 - 0X003 0x000 - 0x009 0x00A 0x00B 0x000 - 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 … USER Description RESERVED - passwords EPC RESERVED RESERVED TID RESERVED RFU Control/Status Register Working Stored Address Register: 0x0007 USER Memory - START UNADDR_WRITE: DATA0 MEMORY UNAVAILABLE Gen-2 Memory Bank AVAILABLE MEMORY Working Stored Address Pointer … USER Memory - END Figure 14. Single Unaddressed Write Cycle, AUTOINCR=1 Gen-2 Address RESERVED EPC SERVICE SERVICE TID USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER … … 0x000 - 0X003 0x000 - 0x009 0x00A 0x00B 0x000 - 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 0x009 0x00A 0x00B 0x00C 0x00D 0x00E 0x00F 0x010 0x011 … … Description RESERVED - passwords EPC RESERVED RESERVED TID RESERVED RFU Control/Status Register Working Stored Address Register: 0x000E USER Memory - START UNADDR_WRITE: DATA0 UNADDR_WRITE: DATA1 UNADDR_WRITE: DATA2 UNADDR_WRITE: DATA3 UNADDR_WRITE: DATA4 UNADDR_WRITE: DATA5 UNADDR_WRITE: DATA6 UNADDR_WRITE: DATA7 MEMORY UNAVAILABLE Gen-2 Memory Bank AVAILABLE MEMORY Working Stored Address Pointer … … USER Memory - END Figure 15. Multiple Unaddressed Write Cycles, AUTOINCR=1 Rev. 1.4 May 2011 Page 14 of 24 WM710xx – Secure F-RAM with Gen-2 RFID INITIAL STORED ADDRESS The Initial Stored Address is a preset address pointer that is loaded into the Working Stored Address when a memory wrap occurs after an unaddressed write command is executed. A memory wrap only occurs if the WRPEN control bit is asserted to a logic one and the AUTOLOCK control bit is cleared to a logic zero in the Control/Status register and the Working Stored Address points to the last free memory location in the USER memory bank (last memory location depends on the set block size). The contents of the Initial Stored Address may be altered by setting the INITEN bit to a logic one through a Gen2 write cycle to the Working Stored Address register – refer to Table 6 above. When the INITEN control bit is set during a write cycle, the contents of the Working Stored Address register in USER memory 0x003 are not affected. Use of an Initial Stored Address register provides flexibility when using the wrap enable feature of WM710xx. It may be set to the start of USER memory, allowing the entire USER memory bank to be utilized. Alternatively, it may be set to a higher memory address within the USER memory bank. This mechanism would provide for a static USER memory bank and a dynamic USER memory bank as shown in Figure 16 below. In the example shown in Figure 16, the Working Stored Address points to address 0x3F8 after having written user_log_data[n] with an unaddressed write command. The subsequent unaddressed write cycle will increment (wrap) the Working Stored Address to the value defined by the Initial Stored Address, defined in this example as 0x000A, and write the value user_log_data[n+1] to USER memory bank 0x00A, over-writing the previous data contents user_log_data[0]. In the example shown, four memory locations are used for static memory, or memory that will not be over-written when a wrap condition has occurred. Rev. 1.4 May 2011 Page 15 of 24 Gen-2 Address 0x000 - 0X003 0x000 - 0x009 0x00A 0x00B 0x000 - 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 0x009 0x00A 0x00B 0x00C 0x00D 0x00E 0x00F 0x010 0x011 … 0x3F7 0x3F8 Description RESERVED - passwords EPC RESERVED RESERVED TID RESERVED RFU Control/Status Register Working Stored Address Register: 0x03F8 user_static_data0 user_static_data1 user_static_data2 user_static_data3 user_log_data[0], user_log_data[n+1] user_log_data[1] … … … … … … … user_log_data[n-1] user_log_data[n] STATIC Initial Stored Address Gen-2 Memory Bank RESERVED EPC SERVICE SERVICE TID USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER … USER USER DYNAMIC Working Stored Address Pointer MEMORY UNAVAILABLE WM710xx – Secure F-RAM with Gen-2 RFID Figure 16. Initial Stored Address Example – Block Size = 128 words/block The Initial Stored Address is factory-initialized with a value of 0x0006 (USER memory bank address 0x006). Rev. 1.4 May 2011 Page 16 of 24 WM710xx – Secure F-RAM with Gen-2 RFID SUPPORTED COMMANDS The WM710xx supports the following Select, Inventory, and Access commands as described in the EPCglobal class 1 generation 2 UHF RFID Specification. Please refer to the referenced document for detailed descriptions of these commands. Select Query QueryAdjust QueryRep ACK NAK Req_RN Read Write Kill Lock Access BlockWrite * BlockPermalock MAXARIAS GEN2 CUSTOM COMMAND: BLOCKWRITE The WM710xx supports a customized version of the BLOCKWRITE command to support unique features within the device. The BLOCKWRITE command optional feature is enabled by asserting the BLKWREN control bit in the Control/Status register to a logic one, after which the WM710xx will require a power cycle to initialize itself. To support other features within the WM710xx, the BLOCKWRITE command uses the address stored in the Working Stored Address register. The address pointer passed in the BLOCKWRITE command is the physical address 0x3FFF (EBV formatted address = 0xF7FF), representing the same address used for unaddressed write cycles. A single BLOCKWRITE command carries a maximum data payload of 127 words. BLOCKWRITE commands with data payloads greater than 127 words may optionally be written to unlocked memory, however the WM710xx will not acknowledge the BLOCKWRITE command with a success message. In this event, the host interrogator may perform one or more READ cycles to verify USER memory data contents. Prior to transmitting a BLOCKWRITE command, the interrogator must set the Working Stored Address register through a standard Gen2 WRITE command. The BLOCKWRITE command is shown in Figure 17 below. BLKWRITE (0xC7) Membank (0b11) WordPtr (0xF7FF) WordCnt (0xNN) Data (xNN × 16-bit data) Handle (0xHHHH) CRC-16 (0xCCCC) Figure 17. Block Write Syntax BLOCKWRITE commands do not support the auto-increment feature used for UNADDR_WRITE commands. As such, the Working Stored Address must be manually updated by the host interrogator and will not be altered by a BLOCKWRITE command. When using the streaming capabilities of the BLOCKWRITE command, care should be taken to consider the logic state of the AUTOINCR control bit. As with UNADDR_WRITE commands, the Working Stored Address register is incremented prior to writing data to memory when AUTOINCR=1 affecting the first USER memory address written to. Figure 18 shows an 8-word BLOCKWRITE command with AUTOINCR=0; Figure 19 shows a BLOCKWRITE command with AUTOINCR=1. In the respective figures, when AUTOINCR=0, data is written starting at the address defined by the Working Stored Address register – 0x006; when AUTOINCR=1, data is written starting at the next free address defined by the contents of the Working Stored Address incremented by one, or 0x007. It is important Rev. 1.4 May 2011 Page 17 of 24 WM710xx – Secure F-RAM with Gen-2 RFID Gen-2 Memory Bank RESERVED EPC SERVICE SERVICE TID USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER … Gen-2 Address 0x000 - 0X003 0x000 - 0x009 0x00A 0x00B 0x000 - 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 0x009 0x00A 0x00B 0x00C 0x00D 0x00E 0x00F … Description RESERVED - passwords EPC RESERVED RESERVED TID RESERVED RFU Control/Status Register Working Stored Address Register: 0x0006 BLKWRITE: DATA0 BLKWRITE: DATA1 BLKWRITE: DATA2 BLKWRITE: DATA3 BLKWRITE: DATA4 BLKWRITE: DATA5 BLKWRITE: DATA6 BLKWRITE: DATA7 AVAILABLE MEMORY Working Stored Address Pointer MEMORY UNAVAILABLE to note that in both cases, the value stored in the Working Stored Address register does not change for a BLOCKWRITE command – in the example shown, it remains at a value of 0x006. … USER Memory - END Gen-2 Memory Bank Gen-2 Address Description RESERVED EPC SERVICE SERVICE TID USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER … 0x000 - 0X003 0x000 - 0x009 0x00A 0x00B 0x000 - 0x003 0x000 0x001 0x002 0x003 0x004 0x005 0x006 0x007 0x008 0x009 0x00A 0x00B 0x00C 0x00D 0x00E 0x00F … RESERVED - passwords EPC RESERVED RESERVED TID RESERVED RFU Control/Status Register Working Stored Address Register: 0x0006 USER Memory - START BLKWRITE: DATA0 BLKWRITE: DATA1 BLKWRITE: DATA2 BLKWRITE: DATA3 BLKWRITE: DATA4 BLKWRITE: DATA5 BLKWRITE: DATA6 BLKWRITE: DATA7 AVAILABLE MEMORY Working Stored Address Pointer MEMORY UNAVAILABLE Figure 18. BLOCKWRITE Command: AUTOINCR=0 … USER Memory - END Figure 19. BLOCKWRITE Command: AUTOINCR=1 Rev. 1.4 May 2011 Page 18 of 24 WM710xx – Secure F-RAM with Gen-2 RFID SPECIFICATIONS WM710xx‟s RFID Interface conforms to the Specification for RFID Air Interface EPC Class-1 Generation-2 UHF RFID Protocol for Communications at 860 MHz – 960 MHz, Version 1.2.0. Options and Exceptions are noted here: State Persistence Requirements WM710xx features infinite state retention for S1, S2, S3, and SL State flags. State flag S0 has no persistence and will always return to state „A‟ upon a power cycle. ELECTRICAL SPECIFICATIONS ABSOLUTE MAXIMUM RATINGS Symbol VIN TSTG TOP TLEAD VESD ME RFexp Description Voltage on ANT+ with respect to ANTStorage Temperature Operating Temperature Lead Temperature (Soldering, 10 seconds) Electrostatic Discharge Voltage - Human Body Model (JEDEC Std JESD22-A114-B) - Charged Device Model (JEDEC Std JESD22-C101-A) - Machine Model (JEDEC Std JESD22-A115-A) Memory Endurance: Read or Write or Erase RF Exposure Package Moisture Sensitivity Level Ratings -1.0V to +4.5V -55C to + 125C -40oC to +85oC 260 C 500V 1kV 50V 1x1014 +10dBm (800 ~ 1000 MHz) MSL-2 Stresses above those listed under Absolute Maximum Ratings may cause permanent damage to the device. This is a stress rating only, and the functional operation of the device at these or any other conditions above those listed in the operational section of this specification is not implied. Exposure to absolute maximum ratings conditions for extended periods may affect device reliability. RF Operating Characteristics (TA = -40 C to + 85 C unless otherwise specified) Symbol Parameter Min Typ SR Read Sensitivity -6 SW Write Sensitivity -6 FR Max Sustainable Read Rate @ SR 640 FW Max Sustainable Write Rate @ Sw 160 tST Power-on time 1.0 Change in Modulator Reflection TBD Coefficient ZIN Input Impedance @ fIN=915MHz 63 – j199 Max 1.5 TBD Units dBm dBm Kbits/s Kbits/s ms Notes Ohms 2 1 1 Note: 1. Actual read & write speeds are constrained by the EPC Class 1 Gen2 data communication standard. 2. ZIN is measured at SR/SW. Rev. 1.4 May 2011 Page 19 of 24 WM710xx – Secure F-RAM with Gen-2 RFID x000 x001 x002 x003 x004 x005 x006 x007 x008 x009 x00A x00B x00C x00D x00E x00F x010 x011 x012 x013 x014 ... BLK:0 BLK:1 BLK:2 BLK:3 BLK:4 BLK:5 BLK:6 BLK:7 BLK:8 BLK:9 BLK:10 BLK:11 BLK:12 BLK:13 BLK:14 BLK:15 BLK:16 BLK:17 ... x01F x020 ... x03F x040 ... x07F x080 ... x0FF x100 BLK_SIZ=111 BLK_SIZ=110 BLK_SIZ=101 BLK:0 BLK:0 BLK:1 BLK:0 BLK:2 BLK:1 BLK:3 BLK:0 BLK:4 BLK:2 BLK:5 BLK:1 BLK:6 BLK:3 BLK:7 BLK:0 BLK:8 BLK:4 ... BLK:2 BLK:0 ... x017 x018 ... BLK_SIZ=100 BLK_SIZ=011 BLK_SIZ=010 BLK_SIZ=001 BLK_SIZ=000 USER MEMORY ADDRESS USER MEMORY BLOCK SIZE DEFINITION BLK:1 BLK:0 ... ... BLK:1 ... BLK:1 ... BLK:1 ... ... Rev. 1.4 May 2011 Page 20 of 24 WM710xx – Secure F-RAM with Gen-2 RFID SPECIFICATION & COMPLIANCE SUMMARY Refer to EPCTM Radio-Frequency Identity Protocols Class-1 Generation-2 UHF RFID Protocol for Communications at 860MHz-960MHz Version 1.2.0 for all critical RFID specifications. Link to specifications page: http://www.epcglobalus.org/Standards/EPCglobalSpecifications/tabid/335/Default.aspx Rev. 1.4 May 2011 Page 21 of 24 WM710xx – Secure F-RAM with Gen-2 RFID MECHANICAL DRAWINGS 8-pin UDFN (3.0 mm x 3.0 mm body, 0.65 mm pad pitch) Note: All dimensions in millimeters. Care must be taken to ensure PCB traces and vias are not placed within the exposed metal pad area. UDFN PACKAGE MARKING SCHEME FOR BODY SIZE 3MM X 3MM XXXXXXXX LLLLLLLL RPN RICYYWW Legend: XXXXXXX= base part number (WM71004, WM71008, WM71016) LLLLLLLL= lot code R=revision, P=package (D=DFN), N=split designator (numeric) RIC=Ramtron Int‟l Corp, YY=year, WW=work week Example: WM71004, “Green” UDFN-8 package, Lot 0411702, Rev B., Year 2010, Work Week 12 WM71004 0411702 BD1 RIC1012 Rev. 1.4 May 2011 Page 22 of 24 WM710xx – Secure F-RAM with Gen-2 RFID ORDERING INFORMATION Product Description Delivery & MOQ WM71004-6-DGTR 8-pin UDFN with 4Kb memory Tape & Reel – 3000 units WM71008-6-DGTR 8-pin UDFN with 8Kb memory Tape & Reel – 3000 units WM71016-6-DGTR 8-pin UDFN with 16Kb memory Tape & Reel – 3000 units Note: Contact Ramtron for other ordering options, i.e. bumped die. Rev. 1.4 May 2011 Page 23 of 24 WM710xx – Secure F-RAM with Gen-2 RFID REVISION HISTORY Revision 0.1 0.2 1.0 1.1 1.2 1.3 1.4 Rev. 1.4 May 2011 Date 12/12/2008 3/8/2010 3/12/2010 8/23/2010 9/7/2010 4/14/2011 5/25/2011 Summary Initial release. Documentation updates. Changed to Preliminary status. Changed read/write sensitivity specs. Changed input impedance and test frequency. Documentation updates and clarifications. Modified Memory Map table on p. 5 (changed line entries for DSPI address 0x3FA – 0x3FB). Page 24 of 24