ib technology
Data Sheet
MFPROT_LP.pdf
35 Pages
Last Revised 09/08/11
Micro RWD MF (Mifare) Low Power Version
(with auxiliary data outputs)
The MicroRWD MF LP (Low Power) module is a complete read and write solution for 13.56
MHz Mifare Classic cards (1k, 4k and Ultralight versions) and supports “Mifare” contactless
operations to dual-interface cards such as Mifare ProX, Smart MX (JCOP) and other types.
DESfire and Mifare PLUS cards are supported for serial number acquisition only. The
solution is entirely housed within a 24-pin DIL package and only needs an antenna connected
and a 5v DC supply to be a fully featured ISO14443A Mifare read/write system. The
MicroRWD MF LP version behaves in the same manner as the standard reader except that it
has an active, average current consumption of less than 150µ
µA (micro Amps) with 1
second polling rate. As on other RWD modules, all commands and data response are via a
simple TTL level RS232 interface. In addition, the RWD MF LP version has auxiliary data
outputs on the OP0 / OP1 pins that can be programmed to automatically output UID (serial
number) or other block data as asynchronous 9600 baud serial or Wiegand protocol Data
High / Data Low signals. All these features can be configured and turned ON/OFF by setting
RWD EEPROM parameters. The diagram below shows the pin out configuration for the
MicroRWD MF LP module.
Micro RWD MF LP module connections
+5v
1
Red LED
24
CTS
TTL
Tx
1k
Green LED
Rx
RS232 I/F
+5v DC supply
Current limiting
resistor
“BEEP” output
0v GND
Micro
RWD
MF-LP
OP0
OP1
Auxiliary (automatic) data outputs:
9600 baud serial - OP0
OR
24/32-bit Wiegand protocol
DATA HIGH – OP0
DATA LOW – OP1
+5v
1 uH Antenna
12
13
0v GND
Aux out (serial) data can be
redirected from OP0 to Tx, pin 23
With the ultra-low-power current consumption and the additional auxiliary data output
features, this one of the most compact and flexible reader systems available.
1
ib technology
Auxiliary Data Output
The Micro RWD MF LP version uses the 4-byte UID (serial number) or the least significant
(first) 4 bytes of data from a Mifare card memory block to create a 32-bit data frame. The data
frame can then be output as asynchronous 9600 baud serial data on OP0 pin or as 24 / 32 bit
Wiegand protocol with parity bits attached (making 26 or 34 bits of data) on OP0 / OP1 pins.
An RWD EEPROM parameter can redirect the serial auxiliary output on OP0 (pin 20)
to the main TX output (pin 23). This allows both bi-directional command/data
communication and the automatic auxiliary serial data output with the same 3-wire
RS232 interface.
Note that when the auxiliary serial output has been redirected to TX pin, there will be
NO acknowledgement or data response to commands (to avoid confusion of data).
For normal command and data response, the serial auxiliary output MUST be directed
to the OP0 pin or turned OFF.
The auxiliary data outputs on OP0 / OP1 are AUTOMATIC and if enabled, occur when a
card enters the RF field for the first time. The “BEEP” output signal delay, data source, byte
order and Hex/ASCII format for the auxiliary output and the various Wiegand protocol
options are all controlled by programmable RWD EEPROM parameters (see page 8). A zero
data length parameter effectively turns the auxiliary outputs OFF.
In this manner the MicroRWD can be used in battery powered application (down to 150µA
average current consumption) and automatically output blocks of data (such as the UID)
WITHOUT any commands being sent to the module. In addition, the “Green” LED output or
the BEEP output can be used as a control signal to “interrupt” the host computer or
microcontroller just before the automatic data is transmitted.
NOTE that the “BEEP” output (RWD pin 4) idles in a high state and “sinks” current.
External loads can be connected between the supply rail and pin 4 with a series resistor
to ensure “sink” current does not exceed 25ma.
Note that setting Polling rate parameter to minimum value (0x00) means the polling rate
is always as fast as possible and does not change (“SLEEP” and power-down is skipped).
MicroRWD MF (Mifare) operation
The Mifare transponder cards have significantly more memory than most other cards and the
13.56 MHz carrier frequency provides fast transaction times of 106 kbaud. The cards are
available with 64 bytes (Mifare Ultralight), 1024 bytes (Mifare 1k) and 4096 bytes (Mifare
4k) of memory. For the 1k and 4k cards the memory is organised as 16 and 40 Sectors
respectively, each Sector has 64 bytes arranged as 4 Blocks of memory (3 of which are
available for general Read/Write use). Each Sector can be separately locked/unlocked for
access using security keys. Initial communication with the cards can only proceed after
mutual authentication between the RWD and the card has succeeded (as defined by ISO
14443A standard). The Mifare cards are ideally suited to Electronic-Purse applications such
as ticketing and vending applications where each sector can hold entirely separate data for
different applications.
2
ib technology
The MicroRWD MF LP is a proximity system and a Read/Write range of up to 10cm can be
achieved under ideal conditions using the appropriate antenna. For evaluation purposes the
RWD is available on a base board with PCB antenna, LEDs, power-regulation, 9-pin RS232
and optional USB interfaces. When power is first applied to the board the red and green LEDs
flash once to indicate successful power-up (both LEDs stay on if initialisation fails). The
RWD can also check for antenna faults and internal error conditions, these problems are
indicated by the red LED or both LEDs flashing continuously until the fault has been
rectified.
The RWD will normally have the red LED lit until a valid card is brought into the RF field. If
the tag is accepted as valid then the green LED is turned ON (and red LED OFF). If the
auxiliary output features are enabled then the UID (serial number) is acquired, or block data is
internally read and transmitted as serial data or Wiegand protocol data on OP0/OP1 pins.
If the Beep delay is set then the “BEEP” output (pin 4) is pulsed ON/OFF. With auxiliary
output features turned OFF, the RWD responds to host commands on the TTL serial interface
at 9600 baud, 8 bits, 1 stop, no parity, as usual.
Note: Some ISO14443A compliant cards have a SINGLE (4 byte) UID and others have a
DOUBLE (7 byte) UID. These serial numbers are acquired as part of the initial
anticollision/select procedure when a card is brought into the field. This UID information can
be reported using the CARD UID command. For Mifare Classic 1k and 4k cards the SINGLE
UID is acquired and can be reported BUT subsequent block read/write operations will not
function if the Security KEY is incorrect for the particular sector and the authentication fails.
For many applications where only the UID (serial number) is required, the Security KEY
information is therefore NOT required.
MicroRWD MF modes of operation
The Micro RWD has two basic modes of operation:Micro RWD
Chip Module
Micro RWD
Chip Module
Antenna
RS232
Serial
comms
Antenna
Standalone mode with
Internal EEPROM holding
authorised Mifare serial
numbers for acceptance
Host System
Remote mode (connected to a host computer or microcontroller) and Standalone mode.
1) Remote mode involves connecting to a host serial interface. This is where the stored
list of authorised identity codes (serial numbers) can be empty, effectively authorising
any Mifare card for subsequent read/write operations (depending on correct Security
Key. A simple serial protocol allows a host system to communicate with the Micro
RWD in order to program new authorised identity codes, change parameters, load
Security Keys and perform Read/Write operations to the card itself.
3
ib technology
2) Standalone mode is where the Mifare card identity codes (serial numbers) are checked
against a stored list of authorised codes. If an identity code is matched, the output
drives and Green LED are enabled. Effectively standalone mode occurs when there is
no host system communicating with the Micro RWD. Up to 60 serial numbers can be
stored in the authorisation list so this mode of operation can be used to create a “mini
access control” system.
The automatic auxiliary outputs can also be used to send serial number or other card
memory block data to a controller with no command interaction required.
Supported transponder types
The MicroRWD MF is designed to communicate with the following passive RF transponder
types. Note that Mifare cards and transponder devices are fabricated by several companies
under licence from Philips/NXP Semiconductors. They are all fully Mifare compliant and
only differ in having different default Security Keys loaded in the factory:1) Mifare standard 1k card (MF1 IC S50 transponder) and Infineon equivalent.
2) Mifare standard 4k card (MF1 IC S70 transponder)
3) Mifare Ultralight card (MF0 IC U1 transponder)
4) Mifare ProX, Smart MX (JCOP) dual-interface card types are supported to allow
single or double UID to be acquired and “Mifare” operations performed across the
contactless interface. DESFire, Mifare PLUS supported for serial number acquisition.
5) Any ISO 14443A compliant contactless card can be accessed for Serial Number. Full
Read/Write access will only be possible if card fully supports Philips/NXP
Semiconductors CRYPTO1 algorithm and encrypted data protocols.
The operation of the Micro RWD MF and the Mifare transponders is described in more detail at
the end of this document.
The identification codes described in this text are regarded as the four-byte Mifare SINGLE
UID (Unique Identifier/serial number) or the least significant four bytes of the seven-byte
Ultralight DOUBLE UID.
Serial Interface
This is a basic implementation of RS232. The Micro RWD does not support buffered
interrupt driven input so it must control a BUSY (CTS) line to inhibit communications from
the host when it is fully occupied with card communication. It is assumed that the host (such
as a PC) can buffer received data. This CTS signal must be connected to the host computer
communication port to allow “hardware handshaking” or the host driver software must check
the CTS signal and only send commands/data when it is in a LOW state. The CTS signal is
pulsed LOW for a 6ms period each polling cycle. The host computer must wait for this LOW
signal and then send the command and data.
4
ib technology
The CTS line remains in a LOW state while the command and data bytes are being received.
After the last byte of data the CTS signal “times out” for 6ms and returns HIGH.
This 6ms “window” every polling cycle allows the host computer to send a single command
and associated data to the RWD. Please note that only one command and it’s corresponding
data bytes can be sent during a CTS LOW period, the command and data bytes must be sent
with no gaps between, if there is a pause of more than 6ms between bytes then “time out”
occurs, the CTS line returns high and the command fails (flagged as RS232 error). The CTS
signal idles in this HIGH state (to inhibit host communication) until the next polling cycle
begins.
The communication baud rate is 9600 baud, 8 bits, 1 stop, no parity. The RWD Tx, Rx and
CTS signals are all TTL level and can be converted to +/-10v RS232 levels using a level
converter device such as the MAX202 (note the inversion of the TTL levels).
The Micro RWD MF LP (low-power) version has been specifically designed to operate
with very low average power consumption but still remain responsive to cards entering
and leaving the field and be able to read large amounts of data as quickly as possible.
THE RWD HAS THREE POLLING STATES:
1) NO card present and NO host commands received.
Polling cycle rate (time between subsequent CTS low periods) is determined by the
“polling rate” parameter stored in the RWD EEPROM memory. This is typically set
to a long period (4ms to 8 seconds, default setting 260mS) and is the primary means to
reduce average power consumption. This is because most of the polling cycle period is
spent in a power-down/sleep mode.
Not to scale
TTL levels
5v
CTS
6ms
(CTS timeout)
Polling cycle
repeats
Polling cycle period set by RWD EEPROM
parameter (4ms to 8 seconds, default 1 second)
RF OFF, Power-down/sleep period
0v
RF ON for brief period
(to check for card)
2) Mifare card in field, NO host commands received.
When a card is detected in the field the polling rate changes to approximately 100ms
(between CTS low periods). This is to ensure that the RWD can respond quickly to the
card leaving the field and a new card being presented.
TTL levels
5v
Not to scale
CTS
100ms polling rate
100ms polling rate
6ms (CTS timeout)
RF OFF, Power-down/sleep period
RF ON for brief period (to check for card)
5
Polling cycle
repeats
0v
ib technology
3) Host commands received and processed.
When the RWD receives commands from the host computer, the polling rate increases
to allow a quick response to the command. This means that commands such as READ
or WRITE BLOCK can be repeated quickly and the large amounts of data read from,
or written to the card as fast as possible.
The polling cycle delay in this case is effectively the minimum, so the RWD responds
to the host command immediately after the RF communication is complete.
Example a) NO card present, single CARD UID (0x55) command received.
Note: at 9600 baud serial communication rate, a single byte is received or transmitted in
approximately 1mS (104µS per bit). If no commands follow then the polling rate reverts
back to the stored parameter value as in (1).
Command byte received +
6mS CTS timeout
Not to scale
CTS
1
7ms
10ms
6ms
Polling cycle period set by EEPROM
parameter (4ms to 8 seconds)
TTL levels
5v
Polling cycle
repeats
5v
RWD
RX
2
(1ms) Command byte received
0v
5v
RWD
TX
1
2
3
0v
3
Acknowledge byte reply
(1ms)
0v
Host waits for CTS falling edge then sends command byte.
RWD processes command, RF turned ON for brief period to check if card present.
RWD then replies with acknowledge byte (+ data).
Example b) Mifare card in field, single CARD UID (0x55) command received.
Command byte received +
6mS CTS timeout
Not to scale
CTS
1
RWD
RX
23ms
7ms
6ms
100ms polling delay
(card still present)
TTL levels
5v
Polling cycle
repeats
0v
5v
2
0v
(1ms) Command byte received
5v
RWD
TX
3
Acknowledge byte + 7 byte serial number reply
0v
15ms
8ms
6
ib technology
Example c) Mifare card in field, valid READ BLOCK command received
(Read cmd (0x52) + Keycode number + Block number)
Command + parameters
received + 6mS CTS
TTL levels
5v
Not to scale
CTS
9ms
100 ms polling delay
(card still present)
6ms
37ms
1
RWD
RX
Polling cycle
repeats
0v
5v
2
(3ms) Command byte + parameters received
0v
5v
RWD
TX
3
Acknowledge byte + 16 byte block data reply
0v
20ms
17ms
Auxiliary output and BEEP delay timing (if options are enabled)
Mifare card in field for first time, Auxiliary output enabled and BEEP delay set. Green LED
signal can be used as an interrupt signal to the host to indicate that auxiliary data will follow.
TTL levels
5v
GREEN
LED
Not to scale
AUX
OUT
0v
5v
0v
Representation of Auxiliary (serial/Wiegand) data output on OP0 / OP1 pins
2mS after Green LED signal
5v
CTS
BEEP delay after Aux output
(if enabled)
CTS goes LOW after Aux out/BEEP delay
Summary of Polling rates and command timing
Three polling rates:
1) NO card and NO commands: Polling rate determined by Polling rate parameter in
RWD EEPROM (4mS to 8 seconds, default setting 260mS)
2) Card present but NO commands: 100ms polling delay between CTS pulses.
3) Command (and parameters) received: 10ms polling delay to next CTS pulse.
For lowest power consumption, the Polling rate parameter in EEPROM is typically set to a
long period (> 1 second). Auxiliary output (if enabled) occurs after Green LED signal and
before CTS.
Host communication software must be able to handle the three polling rates.
7
0v
ib technology
Note that Auxiliary outputs (and “BEEP” output) should be turned OFF if standard
RS232 command interface is being used to ensure minimum power consumption and no
additional delays occur in the polling loop.
Transmitted or Received data byte, 9600 baud, 8 bit, 1 stop, No parity (104 µS per bit)
b0
b1
b2
b3
b4
b5
b6
b7
b8
b9
5v
1
0v
idle
0
START
8 bit data
TTL levels
STOP idle
Host Driver software
Communication with the MicroRWD module is via the TTL level RS232 interface (9600
baud, 8 bit, 1 stop bit, no parity) and uses the CTS line for hardware handshaking. The
Windows applications (supplied with the Evaluation kit) can be used to communicate with the
module or the user can write their own application on a PC or a microcontroller. Please note
that the host software must be able to handle the three distinct polling rates (different periods
between CTS pulses). The following basic communication algorithm can be used:-
Typical host computer “pseudo” driver code
if (Green LED ON (pin 2 = 0))
// Optional check for valid tag in field
{
if (CTS = 0)
// Wait for CTS = 0 (RWD ready to receive command / data)
{
// CTS times out after 6ms so command and all parameters must be sent with no// gaps otherwise CTS times out and goes HIGH.
// For example, send READ BLOCK 1 using KEY 0 as KEYA (0x52 0x01 0x00)
SEND_CMD( );
// Sent command + parameters to RWD
// RWD sets CTS = 1 after last parameter received. RWD module processes
// command, turns on RF for short period, then sends reply.
GET_REPLY( );
// Get Acknowledge byte + data
// Response to READ command is 0x80 (no tag) or 0x86 + sixteen bytes of DATA.
}
}
8
ib technology
Command Protocol
The following commands are supported. The corresponding acknowledge code should be read
back by the host and decoded to confirm that the command was received and handled
correctly. The serial bit protocol is 9600 baud, 8 bits, 1 stop, no parity (lsb transmitted first).
The status flags returned in the Acknowledge byte are as follows:
b7 b6 b5 b4 b3 b2 b1 b0
1 1 1 1 1 1 1 1
| | | | | | EEPROM error (Internal EEPROM write error)
| | | | | Card OK (Card serial number matched to identity code list)
| | | | Rx OK (Card communication and acknowledgement OK)
| | | RS232 error (Host serial communication error)
| | MF type (0 = MF 1k byte card, 1 = MF 4k byte card)
| UL type (0 = MF standard 1k/4k card, SINGLE UID), 1 = MF Ultralight card, DOUBLE UID)
MFRC error (Internal or antenna fault)
Note that bit 7 is fixed so that using a Mifare 1k card, the RWD acknowledge response to a
valid host command would generally be 86 (Hex), indicating that a matched (or authorised)
MF 1k card is present. The MF Ultralight card has a different memory structure to the
standard 1k/4k MF cards so bits 4 and 5 have to be checked to determine which card type is
present. Note also that only the relevant flags are set after each command as indicated in the
following specification.
Card UID
Command to return card status and UID (Unique Identifier or Serial number).
The acknowledge byte flags indicate general Mifare card status.
Command:
B7
B0
0 1 0 1 0 1 0 1
(Ascii “U”, 0x55)
Acknowledge:
1 F F F F F F X
(F = Status flags)
Data only follows if card was selected OK with no errors detected.
Reply1:
Reply2:
Reply3:
Reply4:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
Reply5:
Reply6:
Reply7:
D D D D D D D D
D D D D D D D D
D D D D D D D D
(D = LS Byte of UID/Serial number from card)
Dummy bytes (0x00) for Mifare 1k/4k card types
Note that Mifare 1k and 4k cards have a four-byte serial number but Mifare Ultralight cards
have a seven-byte serial number. To accommodate all card types, the Card UID command
returns a seven-byte field with the last three bytes padded out with 0x00 dummy bytes in the
case of Mifare 1k/4k cards.
9
ib technology
Card STATUS
Command to return card status.
The acknowledge byte flags indicate general Mifare card status.
Command:
B7
B0
0 1 0 1 0 0 1 1
(Ascii “S”, 0x53)
Acknowledge:
1 F F F F F F X
(F = Status flags)
Program EEPROM
The Micro RWD has some internal EEPROM for storing system parameters such as polling
rate and authorised identity codes (serial numbers). This command sequence allows individual
bytes of the EEPROM to be programmed with new data. The data is internally read back after
programming to verify successful operation. Note that due to the fundamental nature of these
system parameters, incorrect data may render the system temporarily inoperable.
Command:
Argument1:
Argument2:
B7
B0
0 1 0 1 0 0 0 0
N N N N N N N N
D D D D D D D D
(Ascii “P”, 0x50)
(N = EEPROM memory location 0 - 255)
(D = data to write to EEPROM)
Acknowledge:
1 X X X F X X F
(F = Status flags)
Internal EEPROM memory map
Polling delay parameter values (EEPROM location 0):
Parameter 0 value
Polling Delay
SLEEP Period
0 mS
8 mS
16 mS
32 mS
65 mS
132 mS
262 mS
524 mS
1 second
2 seconds
4 seconds
8 seconds
0x00
0x10
0x20
0x30
0x40
0x50
0x60
0x70
0x80
0x90
0xA0
0xB0
(SLEEP and power-down is skipped)
Polling delay can be set from 0 to 8 seconds to give complete control over current
consumption and battery life. Note that setting Polling delay = 0x00 skips the SLEEP and
power-down operation so polling is as fast as possible (and current consumption is highest).
10
ib technology
Byte 0: Polling Delay (SLEEP / Power down) period (default = 0x60 = approx 260 milliseconds)
Byte 1: Aux data output: 0x00 = OFF (NO output from OP0 / OP1),
0x01 = 24 (26) bit, Wiegand on OP0 / OP1.
0x02 = 32 (34) bit, Wiegand on OP0 / OP1.
0x03 = 9600 baud serial from OP0 (default)
Byte 2: Reserved (Checksum)
Byte 3: Mifare/ICODE option byte, MIFARE mode = 0x00 (default)
ICODE mode = 0x01 (NOT SUPPORTED ON THIS VERSION)
Byte 4: Wiegand parity option, NO Parity = 0x00 (default)
0x01 = Even/Odd parity added
Byte 5: Aux block address on card (Mifare card block address 0 – 255), default 0x01, block 1
(only used if parameter byte 8 is set to 0x01 for internal Block Read)
Byte 6: Key number / type used for internal Block Read of Aux data:
(TxxKKKKK), (T = Key type, 0 = KeyA, 1 = KeyB)
(K = Key code number, 0 - 31), default = key 0x00 used as typeA
(only used if parameter byte 8 is set to 0x01 for internal Block Read)
Byte 7: “Beep” delay parameter (x 40 mS) default = 0x00 (OFF)
Byte 8: Aux output source data selection.
0x00 = use UID / serial number (default)
0x01 = perform Block Read
Byte 9: Aux out (serial data) redirection (OP0 - pin 20 or Tx – pin 23)
0x00 = Serial aux output from OP0 pin (default)
0x01 = Serial aux output from main Tx pin
Byte 10: Aux output serial format (Hex or ASCII), HEX output = 0x00 (default)
ASCII output = 0x01
Byte 11: Aux output byte order option, plain data as read from card = 0x00 (default)
Byte order reversed = 0x01
Start of authorised card codes. List is terminated with FF FF FF FF sequence.
List is regarded as empty (all identity codes valid) if first code sequence in list is (FF FF FF FF).
List can hold up to 60 identity codes (serial numbers)
Byte 12: 0xFF
Byte 13: 0xFF
Byte 14: 0xFF
Byte 15: 0xFF
Empty list
Byte 16: (MSB) Tag identity code
Byte 17:
Byte 18:
Byte 19: (LSB)
Byte 255:
Last Internal EEPROM location
11
ib technology
Note that the polling delay parameter must be a valid value (as shown in the table above),
other values will give undefined results.
Default RWD EEPROM parameter settings:
Byte
Byte
Byte
Byte
Byte
Byte
Byte
0:
1:
2:
3:
4:
5:
6:
Byte 7:
Byte 8:
Byte 9:
Byte 10:
Byte 11:
0x60,
0x03,
Reserved
0x00
0x00
0x01
0x00
260mS Polling delay / SLEEP period
Aux data output as 9600 baud serial on OP0
MIFARE mode (ICODE mode not supported on this version)
Wiegand NO parity option (only used if Byte 1 = 0x01 / 02)
Aux block address on card (only used if Byte 8 = 0x01)
Key number / type used for internal Block Read of Aux data
(Use Key Code 0 as Key Type A, only used if Byte 8 = 0x01)
“Beep” output delay OFF
Aux output source data is UID (serial number).
Aux output (serial data) directed to OP0 pin.
Aux output serial format, HEX byte format
Aux data byte order, plain as read from card
0x00
0x00
0x00
0x00
0x00
Store Keys
The Micro RWD has additional internal storage for 32 Security KEYs. Six byte Key codes
are required to access individual card sectors for any Read or Write operations. This
command sequence allows 6 byte Key codes to be stored at any one of the 32 key code
locations. Factory defaults are Infineon/Philips specified transport key code pairs (Hex FF FF
FF FF FF FF / Hex FF FF FF FF FF FF)) and (Hex A0 A1 A2 A3 A4 A5 / Hex B0 B1 B2 B3
B4 B5) and these are stored in the RWD non-volatile memory during manufacture. Note that
due to the fundamental nature of these Key codes, incorrect values may render the system
inoperable. Only one or two Security key codes are required to unlock a card sector so the
provision of 32 storage locations allows for many possible applications and card uses.
IT IS STRONGLY ADVISED THAT THE KEY CODES IN THE RWD AND STORED ON
THE MIFARE CARD ARE NOT CHANGED UNTIL THE OPERATION OF THE
MIFARE CARD SECURITY IS FULLY UNDERSTOOD.
Command:
Argument1:
B7
B0
0 1 0 0 1 0 1 1
x x x K K K K K
Argument2:
Argument3:
Argument4:
Argument5:
Argument6:
Argument7:
D
D
D
D
D
D
Acknowledge:
1 X X X F X X F
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
(Ascii “K”, 0x4B)
(K = Key code number, 0 - 31)
(D = data to write to EEPROM, LS byte)
(D = data to write to EEPROM, MS byte)
(F = Status flags)
12
ib technology
Internal Key Storage memory map (default settings)
Location 0 (0x00):
Location 1 (0x01):
Key code 0 (Default 0xFF FF FF FF FF FF)
Key code 1 (Default 0xFF FF FF FF FF FF)
Location 2 (0x02):
Location 3 (0x03):
Location 28 (0x1C):
Location 29 (0x1D):
Key code 2 (Default 0xA0 A1 A2 A3 A4 A5)
Key code 3 (Default 0xB0 B1 B2 B3 B4 B5)
Key code 28 (Default 0xFF FF FF FF FF FF)
Key code 29 (Default 0xFF FF FF FF FF FF)
Location 30 (0x1E):
Location 31 (0x1F):
Key code 30 (Default 0xA0 A1 A2 A3 A4 A5)
Key code 31 (Default 0xB0 B1 B2 B3 B4 B5)
Note that Mifare cards manufactured by Infineon have default transport key codes of (0xFF
FF FF FF FF FF) and Philips cards have (0xA0 A1 A2 A3 A4 A5 / 0xB0 B1 B2 B3 B4 B5)
default transport keys. The MicroRWD MF has both pairs stored as default settings to allow
ease of use when the system is first used. (More information on the Mifare card memory
maps, Security Keys and the KeyA and KeyB types can be found at the end of this
document).
Write Card Block
Command to write 16 bytes of data to specified Mifare block. A Block is made up of 16 bytes
and there are four blocks in each card sector (sixteen blocks per sector in upper half of Mifare
4k card). Note that blocks 3, 7, 11, 15 etc are sector trailer blocks that contain Security Key
data and Access bits. Writing incorrect information to these blocks can permanently disable
the sector concerned. The first argument is the block number to write data to, the second
argument specifies which key code (0 - 31 from the internal storage area) to use for sector
authentication/unlocking and if the Security Key is to be used as a KeyA or KeyB type code.
If the write was unsuccessful (invalid card, authentication failed or card out of field) then
Status flags in acknowledge byte indicate error.
Command:
Argument1:
Argument2:
B7
B0
0 1 0 1 0 1 1 1
N N N N N N N N
T x x K K K K K
Argument3:
Argument4:
Argument5:
Argument6:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
Argument15:
Argument16:
Argument17:
Argument18:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
Acknowledge:
1 F F F F F F X
(Ascii “W”, 0x57)
(N = MF Card Block Address 0 – 255)
(T = Key Type, 0 = KeyA, 1= KeyB)
(K = Key code number, 0 – 31)
(D = LS Byte of data to write to card)
16 Bytes of data
(D = MS Byte of data to write to card)
(F = Status flags)
13
ib technology
Note that Mifare Ultralight cards DO NOT USE Security Keys or CRYPTO Authentication
and the memory is organised differently as groups of 4 bytes (Pages). Only one Page of 4
bytes can be written at a time so to maintain compatibility and a simple RWD host command
set, the same command as above is used to write data to Ultralight cards. The command and
arguments have the same structure but different meanings. The “Block” address is treated as a
“Page Address” and the KeyType/Key number parameter is a dummy 0x00 byte. In addition
the 4 bytes of data are padded out to 16 bytes with dummy 0x00 bytes.
Command:
Argument1:
Argument2:
B7
B0
0 1 0 1 0 1 1 1
x x x x N N N N
0 0 0 0 0 0 0 0
Argument3:
Argument4:
Argument5:
Argument6:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
(Ascii “W”, 0x57)
(N = UL Card Page Address 0 – 15)
(Dummy byte, 0x00)
(D = LS Byte of data to write to UL card)
(D = MS Byte of data to write to UL card)
Argument7 – Argument18
0 0 0 0 0 0 0 0
12 Dummy padding bytes, 0x00
Acknowledge:
(F = Status flags)
1 F F F F F F X
Read Card Block
Command to read 16 bytes of data from specified Mifare block. The first argument is the
block number to read data from, the second argument specifies which key code (0 - 31 from
the internal storage area) to use for sector authentication/unlocking and if the Security Key is
to be used as a KeyA or KeyB type code. If the read was successful, indicated by
acknowledge status flags then sixteen bytes of block data follow.
Command:
Argument1:
Argument2:
B7
B0
0 1 0 1 0 0 1 0
N N N N N N N N
T x x K K K K K
Acknowledge:
1 F F F F F F X
(Ascii “R”, 0x52)
(N = MF Card Block Address 0 – 255)
(T = Key Type, 0 = KeyA, 1= KeyB)
(K = Key code number, 0 – 31)
(F = Status flags)
Data only follows if Read was successful
Reply1:
Reply2:
Reply3:
Reply4:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
Reply13:
Reply14:
Reply15:
Reply16:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
(D = LS Byte of data Read from card)
16 Bytes of data
(D = MS Byte of data Read from card)
14
ib technology
Note that as mentioned for the WRITE command, Mifare Ultralight cards DO NOT USE
Security Keys or Authentication and the memory is organised differently as groups of 4 bytes
(Pages). However, unlike the Write command, 16 bytes (4 pages) can be read in a single
operation The same Read command as above is used except the “Block” address is treated as
a “Page Address” and the KeyType/Key number parameter is a dummy 0x00 byte. For page
numbers greater than 12, the card data wraps around to page 0 etc.
Command:
Argument1:
Argument2:
B7
B0
0 1 0 1 0 0 1 0
x x x x N N N N
0 0 0 0 0 0 0 0
(Ascii “R”, 0x52)
(N = UL Card Page Address 0 – 15)
(Dummy byte, 0x00)
Acknowledge:
1 F F F F F F X
(F = Status flags)
Data only follows if Read was successful
Reply1:
Reply2:
Reply3:
Reply4:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
Reply13:
Reply14:
Reply15:
Reply16:
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
(D = LS Byte of data Read from UL card)
16 Bytes of data
(D = MS Byte of data Read from UL card)
Inc Value (only operates on Value Data Structure)
Command to increment integer within a Value Data Structure. The command loads the value
from the specified block address, adds the integer parameter and stores the result at the same
or another block address. Note that the source block must have been formatted as a Value
Block beforehand according to the data structure below, using the WRITE command. The
INC Value command only operates on a "Value Block Structure" and will fail if the block
configuration or the specified key type is incorrect.
Value Block Structure
Example format for value = 100 decimal (0x64), at block address 0.
(Value data stored LS byte first, ADR = block address, ADR = inverted block address)
0x64 00 00 00 9B FF FF FF 64 00 00 00 00 FF 00 FF
Byte:
0
1
2
Value
3
4
5
6
7
Inverted Value
8
9 10 11 12 13 14 15
ADR ADR
Value
ADR
ADR
The first argument is the source block address to load data from, the second argument
specifies which key code and type to use for sector authentication (0-31 and if it is KeyA or
KeyB type).
15
ib technology
The third argument specifies the destination block address where the incremented data is
stored. Note that source and destination blocks must be within same authenticated sector. The
four byte positive integer to add follows (least significant byte first).
Command:
Argument1:
Argument2:
B7
B0
0 1 0 0 1 0 0 1
N N N N N N N N
T x x K K K K K
Argument3:
N N N N N N N N
Argument4:
Argument5:
Argument6:
Argument7:
D
D
D
D
Acknowledge:
1 F F F F F F X
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
(Ascii “I”, 0x49)
(N = MF source block address 0 – 255)
(T = Key Type, 0 = KeyA, 1= KeyB)
(K = Key code number, 0 – 31)
(N = MF destination block address 0 – 255)
(D = LS byte of integer to add)
4 byte integer
(D = MS byte of integer to add)
(F = Status flags)
Dec Value (only operates on Value Data Structure)
Command to decrement integer within a Value Data Structure. The DEC Value command
operates as the INC command except the integer parameter is subtracted from the loaded
value. The first argument is the source block address to load data from, the second argument
specifies which key code and type to use for sector authentication (0-31 and if it is KeyA or
KeyB type). The third argument specifies the destination block address where the
decremented data is stored. Note that source and destination blocks must be within same
authenticated sector. The four byte positive integer to subtract follows (least significant byte
first).
Command:
Argument1:
Argument2:
B7
B0
0 1 0 0 0 1 0 0
N N N N N N N N
T x x K K K K K
Argument3:
N N N N N N N N
Argument4:
Argument5:
Argument6:
Argument7:
D
D
D
D
Acknowledge:
1 F F F F F F X
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
(Ascii “D”, 0x44)
(N = MF source block address 0 – 255)
(T = Key Type, 0 = KeyA, 1= KeyB)
(K = Key code number, 0 – 31)
(N = MF destination block address 0 – 255)
(D = LS byte of integer to subtract)
4 byte integer
(D = MS byte of integer to subtract)
(F = Status flags)
Transfer Value (only operates on Value Data Structure)
Command to transfer (copy) Value Data Structure. The command loads the value from the
specified block address and then stores the result at the same or another block address. As
with INC and DEC commands the source block must have been formatted as a Value Block
beforehand and the block addresses must be within same authenticated sector.
16
ib technology
The first argument is the source block address to load data from, the second argument
specifies which key code to use for sector authentication (0-31) and if it is a KeyA or KeyB
code. The third argument specifies where the data is stored.
Command:
Argument1:
Argument2:
B7
B0
0 1 0 1 0 1 0 0
N N N N N N N N
T x x K K K K K
Argument3:
N N N N N N N N
(Ascii “T”, 0x54)
(N = MF source block address 0 – 255)
(T = Key Type, 0 = KeyA, 1= KeyB)
(K = Key code number, 0 – 31)
(N = MF destination block address 0 – 255)
Acknowledge:
1 F F F F F F X
(F = Status flags)
If the Inc, Dec or Transfer function was unsuccessful (invalid card, card out of field,
authentication failed or data structures are incorrect) then Status flags in acknowledge byte
indicate error. Note that the value manipulation commands operate internally on the Mifare
card and no data is transferred back to the MicroRWD. Note also that Ultralight cards do not
support Value Data Structures or the Inc, Dec, Transfer commands.
Type Identification
Command to return the ATQA (Answer to Request, Type A) two-byte codes and the SAK
(Select Acknowledge) single-byte code after the complete UID has been acquired. As part of
the initial communication with the Mifare card (as defined by ISO 14443A specification), the
Mifare transponder responds to REQA (Request Command, Type A) with ATQA. The twobyte ATQA contains information that allows particular transponder types to be indentified.
Following on from this the Mifare transponder responds to the SELECT (Select Command,
Type A) with SAK (Select Acknowledge, Type A). The SAK code is a single byte value that
contains further information about the type of transponder and the length of the UID. The
SAK value reported is the final value after all “cascade levels” and the complete UID has
been acquired.
NOTE THAT THIS COMMAND IS INCLUDED FOR DIAGNOSTIC PURPOSES TO
ALLOW THE USER TO DETERMINE THE EXACT TYPE OF MIFARE CARD
PRESENT IN THE FIELD, IF REQUIRED.
Command:
B7
B0
0 1 1 1 1 0 0 0
(Ascii “x”, 0x78)
Acknowledge:
1 F F F F F F X
(F = Status flags)
Data only follows if card was selected OK with no errors detected.
Reply1:
Reply2:
Reply3:
D D D D D D D D
D D D D D D D D
D D D D D D D D
ATQA - MSB
ATQA - LSB
SAK
17
ib technology
ATQA
- MSB
ATQA
- LSB
ATQA
- MSB
ATQA
- LSB
SAK
MF
UL
0x00
MF
1K
0x00
MF
4K
0x00
MF
DESFire
0x03
MF
Prox
0xXX
MF
Prox
0xXX
MF
Prox
0xXX
MF
Prox
0xXX
MF
Prox
0xXX
MF
Prox
0xXX
0x44
0x04
0x02
0x44
0x08
0x04
0x02
0x48
0x44
0x42
Smart
MX
0xXX
Smart
MX
0xXX
Smart
MX
0xXX
Smart
MX
0xXX
Smart
MX
0xXX
Smart
MX
0xXX
0x08
0x04
0x02
0x48
0x44
0x42
MF
UL
0x00
SAK
MF
ProX
0x28
MF
1K
0x08
INFINEON
1K
0x88
MF
ProX
0x18
MF
ProX
0x38
MF
4K
0x18
Smart
MX
0x00
MF
DESFire
0x20
Smart
MX
0x20
MF
ProX
0x20
Smart
MX
0x08
MF
ProX
0x08
Smart
MX
0x28
MF
ProX
0x28
MF
ProX
0x00
Smart
MX
0x18
Smart
MX
0x38
MF
ProX
0x20
MF
ProX
0x08
Note that many of the “extended” Mifare types are complex dual interface cards with
embedded microcontrollers running “chip and pin” applications. Depending on the
card type the memory map and protocol of the “extended” Mifare card may be different
to the standard card types. In these cases the MicroRWD MF will report the UID using
the Card UID command but read/write operation MAY NOT be fully supported.
Message
Command to return product and firmware identifier string to host.
Command:
Reply:
B7
B0
0 1 1 1 1 0 1 0
(Ascii “z”, 0x7A)
“m IDE RWD Mifare ICODE (SECMFI_CWAX_LP V1.xx DD/MM/YY) copyright: IB
Technology (Eccel Technology Ltd)” 0x00
Returned string identifies product descriptor, project name, firmware version no. and date of
last software change together with IB Technology disclaimer message. Note that the string is
always NULL terminated. The string begins with a unique lower case character that can be
used to identify a particular version of Micro RWD.
18
ib technology
Factory Reset
Command to restore Factory default EEPROM values and Stored Keys and perform hardware
Reset operation. The 0x55 0xAA parameters protect against accidental operation.
After Reset, the Red LED will flash 5 times indicating the successful loading of the Factory
default values.
Command:
Argument1:
Argument1:
B7
B0
0 1 0 0 0 1 1 0
0 1 0 1 0 1 0 1
1 0 1 0 1 0 1 0
(Ascii “F”, 0x46)
0x55
0xAA
Reset occurs after the command is processed so there is no Acknowledge byte reply.
Addition Notes for Commands
NOTE also that for the “Read Card Block” or “Card UID” command, if an error flag has been
set in the Acknowledge code then there will be NO following data.
NOTE that the serial communication uses hardware handshaking to inhibit the host from
sending the Micro RWD commands while Card communication is in progress. The serial
communication system and protocol allows for a 6ms ‘window’ every Card polling cycle
indicated by the CTS/BUSY line being low. During this ‘window’ the host must assert the
first start bit and start transmitting data. The CTS/BUSY goes high again 6ms after the last
stop bit is received. NOTE that only one command sequence is handled at a time. The period
between the CTS pulses (polling delay) can have three rates depending on whether a card is
present or not and if commands are being received by the RWD
NOTE that the commands and parameters must be sent to the RWD with no gaps otherwise
communication timeout occurs and the RWD enters the polling delay period (the command
string would then be incomplete and an RS232 error is flagged).
NOTE that the MicroRWD MF LP version performs fast polling cycles as long as there are
commands to be processed. As soon as the commands stop being sent or the gap between
sending commands is too long then timeout occurs and the polling delay increases to 100ms
(if the card is still present) or the typically longer period (as set by EEPROM parameter) if
there is no card. This is to allow repeated commands to be handled quickly such as for a
“complete card read” where repeated Read Block commands are sent to the RWD.
Commands sent infrequently will have the full polling delay between each CTS/BUSY
period.
Basic RWD Communication
For basic operation of the MicroRWD connected to a host computer, the RWD can either be
polled or communication can be triggered by an interrupt signal (Green LED output). In either
case the user would initially send the “STORE KEYS” command to load a custom security
key into the RWD memory or simply use the pre-loaded default key values.
19
ib technology
For a polling technique, the host computer would then keep sending the “STATUS” or
“CARD UID” command and would monitor the acknowledgement code until a valid Mifare
card was detected.
For the interrupt technique, the Green LED output can be used as an interrupt signal
connected to the host computer. The Green LED output is normally high and goes low only
when a valid card has been detected. This falling-edge signal can trigger a host interrupt to
then send the “STATUS” or “CARD UID” command to determine the card type and serial
number.
In both cases once a valid card has been detected a “READ BLOCK” or “WRITE BLOCK”
command can be sent and the acknowledge code monitored to establish that the operation was
successful.
Method of Operation
The system works on a polling principle whereby the RF field is turned on for a short period
to check if a card is present. Authentication and Read/Write operations can then be performed
before the RF field is turned off again and the process repeats. The polling principle where the
RF is off most of the time allows for low average power consumption.
When a Mifare card is detected in the field a multi-pass handshaking procedure takes place
where card information and serial number data is exchanged and checked for integrity. Once
this procedure has completed successfully an individual card has been selected and is
available for other operations.
The RWD itself has the additional feature of then checking the four byte Mifare UID/serial
number (or least significant four bytes of Ultralight UID) against an internal authorisation list.
The RWD internal EEPROM contains a list of four byte Identity codes (up to 60 of them)
located from byte 12 onwards. If the list has FF FF FF FF (hex) stored at the first location
(EEPROM bytes 12 - 15) then the list is treated as empty so the Identity code check is
skipped.
Otherwise the card serial number is checked against all the entries in the list (until the FF FF
FF FF termination code is reached) and if matched then the RWD allows the card to be
accessed for other operations. If not the Red LED remains on and the card is blocked for
further access. This is an additional level of security that can be used as a “mini access
control” system for simple applications that only involve the serial number or where the
Security Keys are not known.
Once the RWD has selected the card and has matched the serial number against it’s internal
list (or the list is empty) then the Read/Write (or Inc/Dec/Transfer) operations can be
performed. These require an internal high-security Authentication Crypto algorithm to take
place that use the supplied Security Keys to gain access to a particular sector. If the Key
selected does not match the Key stored in the Mifare card sector then the operation fails and
the Red LED is turned on again.
So in summary, a card can be successfully selected but can be blocked by the RWD
authorisation list and fail Read/Write operations because the Keys are incorrect. Even if the
Security Key is incorrect the Serial number can still be read using the “Card UID” command.
20
ib technology
RF ON
Card detected ?
No
Yes
Multi-pass
handshaking procedure
Mifare card successfully selected
(Serial number available)
Yes
RWD Ident code
list empty ?
No
Check Serial number
against RWD internal
Ident code list
No
Ident code
matched ?
Yes
Green LED ON
Polling delay
Read/Write
operation
required ?
Yes
No
Load selected Security
Key
Perform Crypto
Authentication on selected
Sector using selected Key
No
Successful ?
Yes
Perform Read/Write/Inc/Dec/Transfer
operation
RF OFF
LEDs ON/OFF
AUX output
21
ib technology
Auxiliary Asynchronous Serial output
If selected, data can be automatically output from the OP0 or main TX pin as 4-bytes of data
transmitted asynchronously at 9600 baud, 8-bits, 1 stop-bit, no parity. The data source can be
selected as the 4-byte UID (serial number), the least significant 4-bytes of a double UID or
the least significant (first) 4-bytes of a card memory block.
Data bytes transmitted at 9600 baud, 8-bits, 1-stop bit, No parity (104 µS per bit)
b0
b1
b2
b3
b4
b5
b6
b7
b8
b9
5v
1
0v
idle
0
START
8 bit data
TTL levels
STOP idle
Auxiliary Wiegand Output Protocol
If selected, data can be automatically output from the OP0 / OP1 pins as Data HIGH and
Data LOW signals according to the Wiegand protocol.
The Wiegand protocol (24 bit data length) can be made up of a leading even parity bit (for b0
- b11), 24 bits of data (from transponder data) and a trailing odd parity bit (for b12- b23)
creating a 26 bit output stream. The 32-bit mode has the same format except least significant
four bytes of block data are used to form the data sequence. The parity bits are included or
omitted and the byte order is reversed according to the EEPROM parameter settings.
For Example:Mifare block data (least significant 4 bytes): 0x04 60 22 12
(reversed byte option would use 0x12 22 60 04 as base data)
Wiegand 26 bit sequence:-
E
(b0 --------- b11) (b12 -------- b23) O
E
( 0
1
0000 0100 0110 0000 0010 0010
4
6
0
2
2 ) O
1
Where E is EVEN parity bit for bit 0 to 11 and O is ODD parity bit for bits 12 to 23
The base data for the Wiegand output can be the UID (least significant 4-bytes of serial
number) acquired during the initial ISO14443A communication or the least significant
4-bytes of data from a block of card memory (acquired by an internal Block Read
operation). Selection is by means of an RWD EEPROM parameter.
For the internal Block Read operation, the block number, key code number and type (KeyA or
KeyB) are programmable EEPROM parameters. In addition, parameters control whether the
base data byte order is reversed or if parity bits are added before output.
22
ib technology
In this manner the user can select to use the UID (serial number) or user programmed
information within a memory block as the base data for the Wiegand output. The complete
data frame is output whenever the tag is within the RWD’s antenna field and the tag has been
validated. This output is independent of the normal TTL serial interface which responds to
received commands and replies with the data as requested.
The physical Wiegand protocol is asynchronously transmitted as low going 50 µS pulses on
the appropriate DATA low or DATA high pins. These pulses are separated by 2mS periods.
The Wiegand sequence is output a single time whenever a valid tag enters the RF field for the
first time. (NO Wiegand output if AUX OUTPUT parameter is ZERO/OFF).
Wiegand Protocol Timing Diagram
50 µS pulse
5v
DATA High
0v
TTL level
2mS pulse intervals
DATA Low
5v
0v
DATA
1
0
1
23
0
ib technology
Mifare 1k (1024 byte) Memory Map
16 byte Block
Byte 15
Byte 0
Serial number + Manufacturer Information
Block 0 (0x00)
KeyA, Access bits, KeyB
Block 3 (0x03)
Sector 0
16 separate
Sectors with
individual
Authentication
and access
control.
Block 4 (0x04)
Sector 1
KeyA, Access bits, KeyB
Block 7 (0x07)
Block 56 (0x38)
Sector 14
KeyA, Access bits, KeyB
Block 59 (0x3B)
Block 60 (0x3C)
Sector 15
KeyA, Access bits, KeyB
Block 63 (0x3F)
1024 byte memory is organised as sixteen sectors, each of which is made up of four blocks
and each block is 16 bytes long. The first block in the memory (Block 0) is read-only and is
set in the factory to contain the four-byte serial number (UID), check bytes and manufacturers
data.
The last block of each sector (Blocks 3, 7, 11, 15……59, 63) is the Sector Trailer Block
which contains the two security Key codes (KeyA and KeyB) and the Access bits that define
how the sector can be accessed
Taking into account the Serial Number/Manufacturers Block and the Sector Trailer Blocks
then there are 752 bytes of free memory for user storage. For all Read and Write operations
the Mifare card memory is addressed by Block number (in hexadecimal format).
24
ib technology
Mifare 4k (4096 byte) Memory Map
(Lower 2k bytes, sectors 0-31 arranged as 32 x 4 block sectors)
16 byte Block
Byte 15
Byte 0
Serial number + Manufacturer Information
Block 0 (0x00)
KeyA, Access bits, KeyB
Block 3 (0x03)
Sector 0
(4 Blocks)
Block 4 (0x04)
Sector 1
KeyA, Access bits, KeyB
40 separate
Sectors with
individual
Authentication
and access
control.
Block 7 (0x07)
(Upper 2k bytes, sectors 32 - 39 arranged as 8 x 16 block sectors)
Block 224 (0xE0)
Sector 39
(16 Blocks)
KeyA, Access bits, KeyB
Block 255 (0xFF)
The lower 2048 bytes of the 4k card (sectors 0 – 31) are organised in the same way as the 1k
card. However the upper 2048 bytes are organised as eight large sectors of 16 blocks each
(sectors 32 – 39). Taking into account the Serial Number/Manufacturers Block and the Sector
Trailer Blocks then there are 3440 bytes of free memory for user storage.
25
ib technology
Manufacturer Block
The Manufacturer block is the first data block in Sector 0 and it contains the read-only serial
number (UID – Unique Identifier) and the IC manufacture information.
Serial Number (UID)
Byte:
0
1
2
3
(xxxxxxx0)
MSB LSB
4
Manufacturer data
5
6
7
8
9
10
11
12
13
14
15
Check Byte
Data Blocks
Mifare sectors contain 3 blocks (1k card) or 15 blocks (upper half of 4k card) of 16 data bytes
(except Sector 0 that has Manufacturer Block and 2 data blocks). Data blocks can be
configured as standard read/write memory or “Value Blocks” for special electronic-purse
operations. “Value Blocks” can use additional commands such as Increment and Decrement
for direct control of the data field, they have a fixed data format which permits error
detection/correction and backup management. “VALUE” is a signed four byte integer (2’s
complement format) and is stored three times, twice non-inverted and once inverted. “ADR”
signifies a one byte address that can be used to store the block number. “ADR” is stored four
times, twice inverted and twice non-inverted.
Data Block
Byte:
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 bytes of read/write memory for general use.
Value Block
Example format for value = 100 decimal (0x64), at block address 0.
(Value data stored LS byte first, ADR = block address, ADR = inverted block address)
0x64 00 00 00 9B FF FF FF 64 00 00 00 00 FF 00 FF
Byte:
0
1
2
Value
3
4
5
6
7
Inverted Value
8
9
10
Value
11 12 13 14 15
ADR
ADR
ADR
ADR
Note that the ADR and inverted ADR block address is part of the required format for the
Value Data Structure BUT it is not changed by the Inc, Dec or Transfer commands and exists
to allow optional storage of block numbers. For general use, the 0x00 address and 0xFF
inverted address can be used to satisfy the structure format. The Inc, Dec and Transfer
commands first check the structure format before beginning the operations and the commands
fail if the format is not correct.
Value Data Structures must first be formatted as above using a WRITE Block command
before INC, DEC or TRANSFER commands can be used.
26
ib technology
Sector Trailer Block
The last block of each sector (Blocks 3, 7, 11, 15……59, 63 etc) is the Sector Trailer Block
which contains the two security Key codes (KeyA and KeyB) and the Access bits that define
how the data blocks can be accessed (Read/Write, Read or Write only, as data or Value blocks
and using which key). If KeyB is not used then the last 6 bytes of the Sector Trailer Block can
be used for general data storage. Byte 9 (last byte of Access bits) is not used and can also be
used for general storage. Note that the KeyA (and KeyB) value read back as logical 0’s to
ensure system security.
IT IS STRONGLY RECOMMENDED THAT THE KEY CODES AND THE ACCESS BITS
STORED ON THE MIFARE CARD ARE NOT CHANGED UNTIL THEIR OPERATION
IS FULLY UNDERSTOOD.
Sector Trailer Block
Byte:
0
1
2
3
4
KeyA (6 bytes)
5
6
7
8
9
10
Access Bits
11
12
13
14
15
KeyB (optional)
KeyA and KeyB
The security Key codes are each six bytes long and for successful authentication and
read/write communication the RWD device would have to have one or both keys stored in its
internal memory as well (depending on Access Bit settings). To allow “out-of-the-box”
operation with new Mifare transponders and RWD devices, Transport Key values are preloaded into the transponder memory and also into the RWD memory.
Transport Key values as defined by Infineon are:
KeyA:
0xFF FF FF FF FF FF
KeyB: 0xFF FF FF FF FF FF
Transport Key values as defined by Philips Semiconductors are:
KeyA: 0xA0 A1 A2 A3 A4 A5 KeyB: 0xB0 B1 B2 B3 B4 B5
These KeyA and KeyB values are stored as repeated pairs in the MicroRWD MF device as a
factory default.
If the user intends using other Mifare cards then they may have different transport keys
loaded so the user would have to use the STORE KEY command to load the particular Key
codes into the RWD memory first. Once correct communication is established then Keys and
Access bits can be changed on the card and RWD to suit the users final system requirements.
Access Bits
The access conditions for every data block and sector trailer are defined by three bits (C1, C2,
C3), which are stored in a specific non-inverted and inverted pattern in the sector trailer of the
particular sector. The access bits control the memory access rights using the secret KeyA and
KeyB codes. The access bits can be changed provided the relevant Key(s) is known and the
current access conditions allow this operation.
27
ib technology
Note that with each memory access the internal logic of the Mifare transponder verifies the
format of the access conditions. If it detects a format error then the entire sector is irreversibly
locked. Since the access bits themselves can be blocked for read/write operations, care must
be taken when cards are being personalised for a particular application or service provider.
Access Bits
C10
C11
C12
C13
C20
C21
C22
C23
Block Affected within a sector
(1k card and lower half of 4k card)
C30
C31
C32
C33
Block 0
Block 1
Block 2
Block 3
(Data Block)
(Data Block)
(Data Block)
(Sector Trailer)
(Upper half of 4k card)
Blocks 0-4
Blocks 5-9
Blocks 10-14
Block 15
(Data Blocks)
(Data Blocks)
(Data Blocks)
(Sector Trailer)
Note that the Access Conditions for individual blocks can be set on 1k cards and for lower
half of 4k card memory. However for the upper half of 4k cards the Access conditions are set
for groups of five blocks (except for Sector Trailer Block which is still individually set).
Access Conditions
The C1, C2, C3 access bits are stored in a specific non-inverted and inverted pattern in the
sector trailer of the particular sector. These bits control the Access Conditions for every data
block and sector trailer block.
Sector Trailer Block
Byte:
0
1
2
3
4
5
6
KeyA (6 bytes)
Bit 7
Byte 6
Byte 7
Byte 8
Byte 9
C23
C13
C33
(
6
5
C22
C12
C32
C21
C11
C31
7
8
9
10
Access Bits
4
3
C20
C13
C10
C33
C30
C23
not used
11
12
13
14
15
KeyB (optional)
2
1
0
C12
C32
C22
C11
C31
C21
C10
C30
C20
)
1
1
0
1
1
0
Cxy = Inverted bit
Transport settings (factory defaults)
Byte 6
Byte 7
Byte 8
Byte 9
(1
0
1
(
1
0
0
1
0
0
1
0
0
not used
1
0
0
28
1) = 0xFF
1) = 0x07
0) = 0x80
)
ib technology
Access Condition for Sector Trailer Block
The read/write access to the Keys and the Access Bits themselves is controlled by the access
conditions for the Sector Trailer Block. The read/write access is specified as “Never”,
“KeyA”, KeyB” or Key A|B (KeyA OR KeyB).
Access Bits
C1
0
0
0
0
1
1
1
1
C2
0
0
1
1
0
0
1
1
C3
0
1
0
1
0
1
0
1
Access condition for:
KEY A
ACCESS BITS
Read Write
Read Write
never keyA
keyA never
never keyA
keyA keyA
never never
keyA never
never keyB
keyA|B keyB
never keyB
keyA|B never
never never
keyA|B keyB
never never
keyA|B never
never never
keyA|B never
KEY B
Read Write
keyA keyA (KeyB can be read)
keyA keyA (Transport setting)
keyA never (KeyB can be read)
never keyB
never keyB
never never
never never
never never
The new Mifare cards have the access conditions predefined as transport configuration:
C1 C2 C3 = (0 0 1) which means Sector Trailer Block can only be read or written to using
KeyA and KeyA itself can never be read.
Because the Access Bits themselves can be locked great care must be taken when any of these
settings are changed because they may be irreversible making the card unusable.
Access Condition for data areas
The read/write access to the data areas is also controlled by the access conditions defined in
the Sector Trailer Block. The read/write access is specified as “Never”, “KeyA”, KeyB” or
Key A|B (KeyA OR KeyB).
A data block can be a “read/write block” or a “value block”. For a “read/write” block the
basic read and write operations are allowed. For the “value block” the additional increment,
decrement, transfer and restore operations can apply. In one case (001) only read and
decrement are possible for a “non-rechargeable” card application and in another case (110)
recharging is only possible using keyB.
The default transport configuration specifies that the data areas can only be accessed using
KeyA|B, however the operation of the Mifare cards define that “IF KEYB CAN BE READ
IN THE CORRESPONDING SECTOR TRAILER THEN IT CANNOT SERVE FOR
AUTHENTICATION”. This means that for the transport configuration (and 001 and 010
cases), KeyA must be used for access.
Note also that the read-only status of the Manufacturer Block is not affected by the access bits
setting.
29
ib technology
Access Bits
C1 C2 C3
Access condition for:
Read
Write
Increment
0
0
0
0
1
1
1
1
keyA|B
keyA|B
keyA|B
keyB
keyA|B
keyB
keyA|B
never
keyA|B
never
never
never
never
never
keyB
never
0
0
1
1
0
0
1
1
0
1
0
1
0
1
0
1
keyA|B
never
never
keyB
keyB
never
keyB
never
Application
Decrement,
Transfer,
Restore
keyA|B (Transport setting)
keyA|B (value block)
never
(read/write block)
never
(read/write block)
never
(read/write block)
never
(read/write block)
keyA|B (value block)
never
(read/write block)
Combining the transport (default) access conditions for the data areas and the sector trailer
block, the typical setting is:
Sector Trailer Block
Byte:
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
0xA0 A1 A2 A3 A4 A5 FF 07 80 69 B0 B1 B2 B3 B4 B5
KeyA (6 bytes)
Access Bits
KeyB (6 bytes)
The default access bits (0xFF 07 80 69) define that KeyA must used for all operations and
KeyA can never be read, so in the previous example bytes 0 – 5 (keyA) would always read as
zeros.
30
ib technology
Mifare Ultralight (64 byte) Memory Map
4 byte Page
Byte 3
Byte 0
Sn0
Sn1
Sn2
Bcc0
Page 0 (0x00), Serial number
Sn3
Sn4
Sn5
Sn6
Page 1 (0x01), Serial number
Bcc1
Int
Lock0
Lock1
Page 2 (0x02), Internal/Lock
OTP0
OTP1
OTP2
OTP3
Page 3 (0x03), One Time Program
32 bit Data
32 bit Data
16 Pages
(4 bytes each)
32 bit Data
(12 pages)
48 bytes
Read/Write
Data
32 bit Data
32 bit Data
32 bit Data
32 bit Data
32 bit Data
32 bit Data
32 bit Data
32 bit Data
32 bit Data
Page 15 (0x0F)
Note: Ultralight card has 7 byte serial number (+ 2 check bytes)
Bcc0 = CT xor Sn0 xor Sn1 xor SN2 (CT = Cascade Tag = 0x88)
Bcc1 = Sn3 xor Sn4 xor Sn5 xor Sn6
The Mifare Ultralight transponder has a different structure to the standard 1k and 4k
byte Mifare transponders. The 64 byte memory is organised as sixteen pages of four bytes
each. The first two pages (and byte 0 of page 3) contain a seven byte serial number (UID)
together with two check bytes. The other “system” bytes are used for locking card features
and providing a number of OTP (One Time Programmable) data bytes. The remaining 12
pages (48 bytes) can be used for general read/write storage.
Despite having a different memory structure, the Ultralight uses the same Mifare
communication protocol except that a cascaded selection procedure is used and the
Authentication procedure is not used for read/write operations. The security Keys are
therefore NOT required for any operations to an Ultralight card. Because of it’s smaller
memory, more basic operation and lower cost, the Ultralight card is typically used for lowvalue single applications.
The MicroRWD MF reader module fully supports the Ultralight cards and the read and write
commands have the same format as for the standard cards except that dummy data bytes
(0x00 values) are used for the Key number etc. In addition the “block number” argument
becomes a “page number” parameter.
31
ib technology
Mifare Applications and Security
The Mifare “classic” family is the pioneer and market leader in contactless smart card
technology operating in the 13.56 MHz frequency range with read/write capability. The
Mifare technology was originally designed for Electronic-Purse applications for public
transport systems and was a benchmark for the ISO 14443A standard. The cards have up to
40 separate memory sectors or “purses” (on Mifare 4k card) that can be individually locked
and unlocked for access. In addition, the high speed communication of the 13.56 MHz
interface allows for quick increment/decrement operations that are required for rapid ticketing
or e-purse applications. Typical transaction time is less than 100ms for read/modify/write
operations. The multiple memory sectors allow for different service providers to use the same
Mifare card with complete independence and security, the Ultralight card has only one sector
and is designed for single use or disposable applications due to it’s low cost.
Because Mifare was designed originally for Electronic-Purse applications, a very high level of
security was essential to prevent fraud. Each transaction is started with a mutual three pass
authentication procedure according to the ISO 9798-2 standard. RF communication is
protected from replay attack and data communication between RWD and card is encrypted
according to the Philips triple-DES CRYPTO1 algorithm. Separate sets of two security keys
for each memory sector (or application) ensure that service providers have complete security
control over their individual sector. The high level of data integrity for the 106 kbaud RF
communication is achieved by combining a special patented modulation technique, 16 bit
CRC, parity bit coding, bit counting, channel monitoring and an anticollision algorithm.
Finally, the RWD device itself stores up to 32 security keys that the service provider can
change and use for their applications. These keys are non-volatile and cannot be read back
further ensuring system security.
Even though the Mifare technology is ideally suited to e-purse uses, each card has a unique
serial number at the beginning of it’s memory that makes the technology suitable for almost
any application requiring large and secure read/write memory areas. Typical applications
could include:Access Control, Automatic Fare Collection, Bus/Train/Airline ticketing, Electronic Purse,
Vending, Loyalty / Membership Schemes, ID cards, Time and Attendance, Asset
Tracking, Gambling, Electronic Keys, Logistics, Road Tolling, Payphones, Park and Ride
Schemes, pre-paid metering.
IB Technology’s design philosophy has created the “Universal RFID Socket” so that different
technologies such as the 125 kHz MicroRWD (Hitag and EM Marin) modules, QT (Quad
Tag) module and the 13.56 MHz MicroRWD Mifare and I.CODE modules are the same
physical size, have the same pinout and share common serial commands. This concept allows
users to select and migrate between different RFID technologies according to the specific
features they require with the minimum of design changes.
(Hitag, Mifare and I.CODE are registered trademarks of NXP/Philips Semiconductors N.V)
32
ib technology
Micro RWD MF (Mifare) LP (low-power) specification
The MicroRWD MF (Mifare) LOW-POWER version is a complete read/write system for
13.56 MHz Mifare 1k, 4k and Ultralight cards. The module is pin-compatible and virtually
identical in operation and features to the “standard” version (NOTE differences in EEPROM
parameters and the three polling rates).
However the LOW-POWER version uses a different specification microcontroller offering
lower voltage operation and is designed to be powered from four alkaline battery cells.
During the Polling Delay period the microcontroller enters SLEEP mode with the RF device
in hard power-down mode to reduce the current consumption to a very low level.
The module wakes up after the polling delay period and the process repeats. The RWDMIFARE “low-power” Windows applications can be used to configure the parameters and
read/write data.
Parameter
Typical Value
Supply Voltage (performance optimised for 5 volt operation)
4 – 6 volts DC (operation
from 4 x alkaline cells)
-40 deg C to + 85 deg C
Less than 150 µA
Up to 20 mS
Operating temperature
AVERAGE current consumption. (1 second polling)
Active period for RF AND host communication (each
polling cycle).
Peak antenna voltage (optimum tuning)
Peak antenna current (optimum tuning) for short period each
polling cycle (up to 10 mS burst)
Polling Delay (SLEEP / Power-down mode)
Current consumption during Polling delay / SLEEP
Current consumption during RF ON each polling cycle
Maximum data rate (between card and RWD)
Range (dependent on antenna dimensions and tuning)
Auxiliary output drives
Serial Interface
Serial Communication Parameters
30 volts peak-to-peak
150 mA
4 mS to 8 seconds
Less than 20 µA
Less than 20mA
106k baud
25-50 mm
Up to 25mA
TTL level RS232
9600 baud, 8 data bits, no
parity, 1 stop bit protocol
with CTS handshake
Basic electrical specification with LEDs pins and auxiliary outputs NOT connected.
Note that the MicroRWD MF (Mifare) LOW-POWER version is designed for optimum
performance and range at 5-volt operation. Performance will be reduced at maximum and
minimum operating voltage.
During the “Polling Delay” SLEEP/Power-down period the logic levels on the RWD pins
remain active and so for minimum current consumption, the LEDs and the auxiliary output
drives must be disconnected (and the Beep output delay set to zero).
33
ib technology
Micro RWD MIFARE module dimensions and pinout
Standard 0.1inch/ 2.54 mm pitch
1
24
Micro
RWD
Pins mounted to hybrid
flush with substrate.
30.5 mm
PCB Row Spacing
18.5 mm
12
Unconnected pin pads
Pin Name
DIP No.
I/O Type
LED1
LED2
RESET
1
2
3
O
O
I
13
18mm
PINOUT DESCRIPTION
Buffer Type
Description
TTL
TTL
ST
Red LED connection. 25ma max sink current
Green LED connection. 25ma max sink current
Reset pin internally pulled high. Active low.
Normally not connected
BEEP
4
O
TTL
BEEP output pin (active LOW), 25ma max sink
current
5
Not connected
6
Not connected
GND
7
P
Ground reference for logic and analogue pins
VCC
8
P
+5v Positive supply
AN1
9
P
AN
Antenna connection. 1 (connected to Mifare antenna
board)
10
Not connected
11
Not connected
AN2
12
P
AN
Antenna connection 2 (connected to Mifare antenna
board)
GND
13
P
Ground reference for logic and analogue pins.
14
Not connected
15
Not connected
16
Not connected
17
Not connected
18
Not connected
OP1
19
O
TTL
Auxiliary output drive. 25ma max sink current.
OP0
20
O
TTL
Auxiliary output drive. 25ma max sink current.
VCC
21
P
+5v Positive supply
RX
22
I
TTL
Serial communication Receive line. 9600 baud, 8 bit,
1 stop, no parity
TX
23
O
TTL
Serial communication Transmit line
CTS
24
O
TTL
Serial communication CTS handshake. RX enabled
when CTS low and disabled when high.
(I/O = Input/Output, AN = Antenna output, P = Power, ST = Schmitt Trigger input, TTL = TTL logic I/O)
34
ib technology
No responsibility is taken for the method of integration or final use of Micro RWD
More information on the Micro RWD and other products can be found at the Internet web site:
http://www.ibtechnology.co.uk
Or alternatively contact IB Technology by email at:
[email protected]
35