Features • • • • • • • • • • • • 125 kHz RFID Chip for Cards and Tags 256 Read/Write EEPROM Bits, Divided into Eight Pages of 32 Bits Password and Write Lock Protection Programmable Send and Receive Protocols Support for Multiple Tags (Anti-collision) Integrated 150 pF Tuning Capacitor ID Length Programmable from 4 - 19 Bytes Optional Start and Stop Bits Bit Reception Rate of 32 to 4096 Clocks/Bit Bit Transmission Rate of 16 to 1024 Clocks/Bit Unique Serial Number -40° to +85°C Temperature Range Description The AT88RF256 is an RFID (radio frequency identification) chip designed to work on the industry-standard carrier frequency of 125 kHz. Applications include access control, asset identification, industrial tagging, animal identification and other applications where modest security capabilities are necessary. Security features include locking of sensitive information to prevent tampering, optional passwords to prevent unauthorized access and unique serial numbers locked into the chip by Atmel. (continued) 125 kHz RFID Transponder Chip AT88RF256-12 Preliminary Block Diagram EEPROM VSS VDD Typical Operating Configuration External Coil L2 RF Power AT88RF256-12 Data L1 Typical Coil Inductance @125 kHz is ~10.1 mH Rev. 1684A–07/00 1 Since the chip includes an internal tuning capacitor, only the addition of an external coil antenna is required to form the complete tag or card. The chip includes an array of read/write EEPROM, of which 224 bits are available for user defined purposes. All necessary power generation, regulation and data modulation/demodulation circuitry is on the chip. The communication details are programmable. Chip Operation Upon power-up the chip will sequence repeatedly through the following frame, which includes an ID transmission and possible reception of a command. A frame is defined as the following sequence: 1. An optional start bit 2. Between 32 and 152 bits from the EEPROM, which are defined as the ID field 3. An optional stop bit 4. An 8-bit listening window, during which commands may be sent to the chip All bits are sent to or read from the chip most significant bit fi r st , in a ma nn er co ns i s ten t wi th s ta nd ar d s er i al E E P R O M s . B i t f i e l d s l i s te d i n t h i s d o c u m e n t a r e correspondingly listed with the MSB on the left and the LSB on the right. Multi-byte information sent to the chip is sent most significant byte first, following typical conventions, and 32bit blocks are listed in this document with the most significant byte on the left. Information is read from the EEPROM and transmitted by the chip in exactly the same order in which it was written: the first bit written is the first bit read. Start/Stop Bits The chip supports an optional start and stop bit (either 0 or 1) that precede and follow the ID data stream, respectively. The START_STOP bit in the configuration page turns this feature on or off. If start and stop bits are enabled for the power-up sequence, the same ones will also appear before and after data words read from the chip as a result of command execution. These bits are the inverse of each other. If a one is selected for the stop (using the STOP_1 bit), the start bit is always a zero. These start and stop bits (if enabled) use the same encoding and modulation scheme as the rest of the user data. 2 AT88RF256-12 ID Field The ID sent by the chip can be between 32 and 152 bits in length (in multiples of 8 bits) depending on the value of the PU_LEN field in the configuration page. EEPROM bytes not utilized for ID storage may be used by the system for any other purpose. When the die are tested at Atmel, a unique 32-bit serial number is programmed into both pages 0 and 7 of the EEPROM. The value is locked into page 7 only and that page can never be written by any application. Atmel ensures that each AT88RF256 die shipped will have a different serial number and the actual value stored in this page cannot be controlled. In many applications, the card or tag manufacturer may choose to overwrite the serial number stored as an ID in page 0 with a specific ID value of their choosing. If so desired, the final ID value can then be locked to prevent further changes. If the ID is not locked, or if additional validation of the ID is required, the manufacturer may choose to hash or encrypt the ID, serial number and another fixed secret. The result can be stored as part of the ID or in one of the unused pages. On presentation of the card, reading of this validation entry and the serial number will permit validation of the ID number. Listening Window After the power-up sequence of bits is transmitted, there is a listening window during which the tag looks for modulation that would initiate the transmission of a command from the reader/writer to the tag. Commands sent at any other time are ignored. The first bit of all commands is a Manchester 0, which is defined as modulation on the first half-bit time and no modulation on the second half-bit time. The leading modulation edge of the command must start within transmit bit times 1, 2, 3, 4, 5 or 6 (starting with 0) of the listening window. The first and last bit time of the 8-bit listening window are ignored to prevent the chip receiver from seeing its own modulation. Parity The chip requires a single, even-parity bit to be sent after the 6 command bits and 32 bits of data on all commands that receive data. Parity will be computed internally on the data transmitted to the chip, and if the internally generated parity value does not agree with the transmitted value, the command is aborted and the chip returns to the power-up ID read sequence. Internally, parity is computed in such a way that the number of 1s in the 39-bit stream is even. AT88RF256-12 Memory Map The EEPROM is composed of 10 pages of 32 bits each for a total of 320 bits. Pages 0-6 are user pages which include ID information and other user defined bytes. Pages 0 and 7 contain the serial number, however, the copy of the serial number in page 0 can be changed at will. Page 8 is the configuration page, which includes the lock and option bits. Page 9 is the password page. Byte 3 Byte 2 Byte 1 Byte 0 Page 0 First ID Byte Second ID Byte Third ID Byte Fourth ID Byte Page 1 Fifth ID Byte/User Data Sixth ID Byte/User Data Seventh ID Byte/User Data Eighth ID Byte/User Data Page 2 ID/User Data ID/User Data ID/User Data ID/User Data Page 3 ID/User Data ID/User Data ID/User Data ID/User Data Page 4 ID/User Data ID/User Data ID/User Data ID/User Data Page 5 User Data User Data User Data User Data Page 6 User Data User Data User Data User Data Page 7 First Byte Serial # Second Byte Serial # Third Byte Serial # Fourth Byte Serial # Page 8 LOCK7…LOCK0 PU_LEN…RANDOM TST_EN…TCLK_GEN RCLK_G…CONFIG_LCK Page 9 First Byte Password Second Byte Password Third Byte Password Fourth Byte Password Commands The explicit commands implemented in this tag permit the reader/writer to directly access individual 32-bit pages within the memory array, prevent future writing of particular pages (locking), temporarily disable the chip or check a password value and are encoded as follows: 0 A2 A1 A0 1 0 Write 32-bit Page A A A (followed by 32 bits of data and 1 bit of parity) 0 A2 A1 A0 0 1 Read 32-bit Page A A A (followed by 32 bits of data) 0 0 0 0 1 1 Write Lock Byte (followed by 8 bits of data, 24 bits of 0101… and parity) 0 1 0 0 1 1 Write Configuration Bits (followed by 8 bits of 0101, 24 bits of data and parity) 0 0 0 1 1 1 Write Password (followed by 32 bits of data and 1 bit of parity) 0 1 1 0 0 0 Disable (Stop) Chip Until Power Down 0 1 1 1 0 0 Check Password (followed by 32 bits of data and 1 bit of parity) For the “Read” and all four “Write” commands, the data stored within the corresponding page of the EEPROM to the accessed page is repeatedly transmitted back to the reader by the chip after the command has completed. This permits a verify function for the commands. For the “Write Lock” and “Write Configuration” commands, the entire contents of page 8 are transmitted. Between each 32 bits transmitted, there is a listening window of 8 bit times to synchronize the reader and/or to permit the reader to issue a new command to the chip. its commands during the first listening window. After the “Disable” command, the chip is held in reset until power is removed. There are a number of features that are used to prevent the inadvertent writing of the chip. The proper command code plus the proper Manchester data encoding must be sent to the chip. If either an illegal code or improper encoding is detected, the command is aborted. There is a single parity bit sent after the command and data string (see Parity section on page 2 for details), which must also be correct. After the “Check Password” command, the chip goes back to the ID transmission loop and the reader/writer can issue 3 Passwords For both the “Write Lock” and “Write Configuration” commands, part of the 32-bit block must be the correct sequence of 0101…, starting with 0 in each case. If any bit is improperly received, the command is aborted. If any of these protections are violated, or if there is a transmission or protection failure (lock bit set, password not entered) or if an illegal command is sent, the part will immediately resume its power-up read sequence. If the password mode is enabled with PW_ON, read and write commands are prohibited until the correct password is sent using the “Check Password” command. If the password is correct an internal latch is set and subsequent read, write and lock commands (to any page, including the password page) are permitted. If the wrong password is sent, the command is aborted and the chip reverts to the normal power-up sequence. Writes to locked pages are never permitted regardless of passwords. The password check latch is cleared when power is removed. There is no command that can be used to directly read the password page, regardless of whether or not the password option (PW_ON) is enabled. For the write lock command, a successful “write page” command must have been previously executed since the last power cycle, in order for the “write lock” command to be executed. This is intended as an additional safety feature to prevent inadvertent lock commands. Data Locking Anti-collision Within the lock byte, each lock bit determines whether the corresponding 32-bit user page can be written. If it is a 1, then writes are prohibited, if 0, writes are enabled or permitted. The data sent to the chip with the “write lock byte” operation is OR’ed with the data already in the lock byte and then rewritten to the EEPROM. Once a user page is locked, it may never be unlocked and can never be written to. In order to support multiple tags within the field at the same time, a random delay time between ID transmissions can be enabled. This feature is implemented by having the chip randomly disable its activity (transmission of ID and reception of commands) during selected frames. Commands are only honored during the listening window of those frames in which data was actually transmitted by the chip. There are two additional lock bits for pages 8 (CONFIG_LOCK) and 9 (PW_LOCK). They operate slightly different from the user lock bits because there is no OR function. CONFIG_LOCK, if “1”, prevents the execution of the “Write Configuration Bits” command, while PW_LOCK if “1” prevents execution of the “Write Password” command. Turning on CONFIG_LOCK does NOT lock the value of the bits within the lock byte but does prevent further change to the PW_LOCK bit. Depending on the value of the RANDOM option, frames will be enabled on average once in 8, 32 or 128 times. The maximum delay is twice the average, while at the minimum two frames may be transmitted back to back. To implement this feature, the tags must be programmed with error detection information within the ID field so that the reader can detect the condition when two tags transmit their ID at exactly the same time. Because of the random delay feature, in most cases the next transmissions for these two chips will not overlap. Upon shipment, pages 0 and 7 are loaded with a unique 32-bit serial number derived from various manufacturing information. The 32-bit serial number is derived in such a way that over the manufacturing history of the part, each die will have a unique serial number. Page 7 is locked upon shipment and cannot be changed in the field. The “Disable” command can be used with the random delay feature to permit an increased number of tags to be identified. Once a tag has been properly read by the reader unit, the reader sends the “Disable” command to the tag during the first listening window after the ID transmission. Until the power is removed, that tag no longer sends its ID frame. Command Timing Diagram Power -up Frame Listening Window Listening Window Power-up Frame Ignored 4 AT88RF256-12 Command Ignored Data Write Delay (5ms if write) Parity AT88RF256-12 Data Transmission The bit rate for data transmitted by the chip, either during the ID frame or in response to a command, is determined by the TCLK_GEN bits in the options page. The chip supports multiples of 16 carrier cycles per bit in the range of 16 to 1024 cycles/bit. All transmission options are amplitude modulated, using a resistive load across the coil. The protocol for transmitted data is controlled by three option fields; ENCODE, INV_ENC and MODULATE. These fields configure two units that can be connected in a series or individually bypassed to provide various combinations. The first stage (the data encoder) implements Manchester (BiPhase) or Miller data encoding to insert edges into the data stream. The first stage can be bypassed, permitting the NRZ data from the EEPROM to go to the second stage unaltered. This is controlled by the ENCODE option field. If the inverter is not enabled (INV_ENC) and the modulator block is bypassed, then a 1 output of the encoder block will cause the load (modulation device) to be placed across the coil. The second stage (the modulation control block) supports subcarrier and/or PSK schemes, or can be bypassed for ASK (AM) schemes. For subcarrier and PSK options, the high-frequency subcarrier is fixed at 62.5 kHz. This block is controlled by the MODULATE option field. There is an optional inverter that can be connected between the first and second stages controlled by INV_ENC. This option inverts the start and stop bits (if enabled) so that their true sense becomes the inverse of that specified by the STOP_1 option bit. MANCHESTER (sometimes called BiPhase): In the middle of each bit time there is a transition. If this is a high-to-low, the data state is a 0, and if low-to-high, the data state is a 1. MILLER ENCODING: If the data state is a 1, there is a transition in the middle of the bit time. If the data state is a 0, there is no transition if the previous data bit was a 1. There is a transition at the beginning of the bit time if the previous data state is a 0. If the data stream starts with 0 and the data inverter is not enabled, the output of the encoder will be a 1 during the first bit time. PHASE SHIFT KEYING (PSK): The modulator is cycled on and off at a rate of ½ the rate of the carrier frequency. There is a phase shift with either: a) Every data “1”, sampled at the beginning of each bit time or b) With every data state change that occurs at either the beginning or middle of the bit time. This phase shift may occur on either the high (modulated) or low (unmodulated) phase. SUBCARRIER: The output of the encoder stage (Manchester or Miller) gates a subcarrier oscillating at the rate of ½ the carrier frequency. When the encoder output is a 1, the carrier will be modulated and when it is a 0, no modulation will occur. Although the chip permits all combinations of encoding and modulation schemes to be selected, some combinations do not provide useful results. If PSK1 modulation is selected, then only NRZ encoding will provide useful results since the chip samples for 1s at the beginning of the bit time only. If both stages are disabled, it may be difficult to read ID values composed of all 1s or all 0s. The various encoding and modulation schemes are defined as follows: Data Transmission Circuitry Input Data Encode Option Bits Modulation Control Data Encoder Inv_enc To Analog Modulator Modulate 62.5 kHz Clock 5 AT88RF256-12 Data Transmission Protocol (Bit rate equals 16 clocks per bit) NRZ DATA BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 1 0 1 1 0 0 MANCHESTER (BI-PHASE) MILLER PSK2 MANCHESTER SUBCARRIER Data Reception Protocol Two rates for data and/or commands received by the chip are supported. Data is received at either 2x or 4x the transmission rate, selectable by using the RCLK_GEN option bit. Over the range of possible TCLK_GEN values, this translates into a range of 32 cycles/bit to 4096. All data and commands received by the chip must be Manchester encoded by the reader/writer. The part is capable of detecting incoming data at amplitude changes (modulation depth) greater than 15%. At deep modulation levels, the chip may reset at far field during modulation intervals. There is no delay between the last bit of the command transmitted by the reader/writer to the chip and the first data bit sent on a write command. After a read command, the chip will wait one receive bit time to ensure that there is no more modulation, and will then commence with the transmission of the read data. For incoming modulation, a bit time, in which there is low field strength in the first half of the bit time and high field strength in the second half, is interpreted as a logic 0. High field strength in the first half of the bit time, and low field strength in the second half is interpreted as a logic 1. Reset Voltage The chip includes a precision voltage reference to ensure that all write commands are only performed when the power supply voltage on the chip is above a required level of 2.0V. ID reads and the “read” and “disable” commands will take place regardless of voltage (above a minimal POR level), which will result in correct information in most cases. Data transmitted at the lowest voltages may not be valid; therefore, some sort of error detection and/or correction (multiple reads, parity, hamming code, etc.) must be implemented by the system. 6 AT88RF256-12 Option Page Bits are listed below in the order in which they must be sent t o th e c hi p wh e n t h e “ W r i t e Lo c k B y t e ” o r “ W r i t e Configuration Bits” command is sent to the chip. The “Default” column lists the values that will be in the die upon shipment from Atmel. The “Write Lock Byte” command is used for the first byte only, and the “Write Configuration Bits” command is used for the last three bytes. The “Default” column reflects the default value that the options have upon shipment from the Atmel factory. When reading this page, all 32 bits are read in this order. This page cannot be written with a single 32-bit command. Lock Byte Name # Default LOCK[7:0] 8 0x80 Description If 1, locks the corresponding user page against further writes. Page 7 contains the serial number and is locked on shipment from the factory. Configuration Bits Name # Default Description PU_LEN[3:0] 4 0 Number of ID bytes after first 4. Total ID size range: 4 - 19 bytes. STRT_STOP 1 1 Start Stop bit enable. If 1 both start and stop bits will be sent, the default. STOP_1 1 1 Value of stop bit, start bit is opposite value. Default is stop = 1, start = 0. RANDOM[1:0] 2 00 Frames (ID + 8 transmit bit time listening window) between ID transmissions: 00 Continuous frames 01 Random null frames, mean number = 8 10 Random null frames, mean number = 32 11 Random null frames, mean number = 128 TST_EN 1 0 Test mode, leave at 0. PW_ON 1 0 Password enable, if 1 password is page 9 of EEPROM. TCLK_GEN[5:0] 6 0 Transmit range of 16 clocks/bit to 1024 clocks/bit: (value+1)*16 = # clocks/bit. Default is 16 clocks per bit. RCLK_GEN 1 1 Receive range of 32 clocks/bit to 4096 clocks/bit. Default is 64 clocks per bit. 0 = (tclk clocks/bit)*2 1 = (tclk clocks/bit)*4 ENCODE[1:0] 2 10 First stage encoding scheme for transmission. Default is Miller. 00 = No encoding (NRZ) 01 = Manchester 10 = Miller 11 = None (NRZ) INV_ENC 1 0 Output of encoder is inverted before input to modulator. MODULATE[1:0] 2 00 Modulator control scheme for transmission. Default is AM. 00 = No special modulation (AM / ASK) 01 = PSK1, phase shift on every logic 1, sampled at beginning of bit time. 10 = PSK2, phase shift on every state change at beginning or middle of bit. 11 = Subcarrier gating of 62.5 kHz clock PW_LOCK 1 0 Locks the password page against further writes. CONFIG_LOCK 1 0 Locks the configuration page (but not LOCK[7:0] against further writes). 7 Absolute Maximum Ratings *NOTICE: Operating Temperature..........................-40°C to +85°C Storage Temperature (without Bias)........-40°C to + 85°C Maximum Power from RF Field...........................100 mW Maximum Coil Input Voltage..................................24VP-P Maximum ESD Voltage (pins L1 and L2)...............2000V Stresses beyond those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at these or any other conditions beyond those indicated in the operational sections of this specification is not implied. Exposure to absolute maximum rating conditions for extended periods may affect device reliability. Parametric Specifications Unless otherwise noted, all specifications are over the temperature range of -40°C to +85°C. Name Min Typ PCOIL Max Units 160 mW V VCOIL1 1.6 2.2 3.1 VCOIL2 2.7 3.0 3.7 IL1-L2 Notes Maximum Power Dissipation from L1/L2, Peak Coil Voltage(2) for ID Transmission Coil Voltage(2) for EEPROM Writes and Reads 20 mA Peak Clamp Current ICCR 7 10 µA During EEPROM Read, VL1/L2 = 2.2V ICCW 150 200 µA During EEPROM Write, VL1/L2 = 3.0 7.0 V 10V Through 400Ω, Prior to Modulation(3) 4.0 V 10V Through 400Ω, During Modulation(3) V 4.5V Through 5 kΩ, Prior to Modulation(3) V 4.5V Through 5 kΩ, During Modulation(3) V Modulation Voltage Delta During Reception pF Input Capacitance on L1/L2 at 5V, Not Tested VCNF 5.0 VMNF VCFF 4.0 VMFF 3.4 DVRCV 1.0 CL 135 Notes: 150 165 1. Some parametric limits are design targets that may be refined on the basis of production history. 2. Coil voltages are measured with respect to the on chip ground, which is centered on the AC voltage from the coil. Peak-to-peak coil voltages would be double to those listed above. 3. Reference Transmit Test Circuit: CNF: Carrier Near Field MNF: Modulating Near Field CFF: Carrier Far Field MFF: Modulating Far Field Transmit Test Circuit Test Waveform AT88RF256-12 VCNF, VCFF R VL1 R + - L2 + - 8 DVRCV VMNF, VMFF L1 VL2 GND AT88RF256-12 AT88RF256-12 Mechanical Specifications The chip contains two coil input pads with ESD protection at levels greater than 2k volts along one end of the chip. All remaining pads are for test purposes and use a different structure and size, for which production bonding is not permitted. ESD protection for these test pads is 300V. The chip includes a 150 pF (±10%) tuning capacitor across the coil input pins. In addition, parasitic capacitance will range from 3 to 10 pF depending on voltage, processing and temperature. AT88RF256-12 Die Plot Bond Pad Locations (Center) Bond Pad X Y L1 623 795 L2 -623 795 GND -619 -812 TST -324 -818 I/O -217 -818 CLK -70 -818 VCC 293 -816 R/W 607 -816 L1 L2 Size: X 1.488 mm Y 1.873 mm GND Production units are shipped in full wafer form, with bad dies marked with ink dots. Die size (shown on the Die Plot, below left), is the offset from center to center on the wafer. The actual sawn die size will be smaller based on the kerf width. Wafer thickness is 20.5 mils, ±1.5 mils. Wafer diameter is 6". Other production shipment forms may be available for high-volume applications. Contact your local Atmel sales office for details. TST I/O CLK VCC R/W 9 Ordering Information Part Format AT88RF256-12WI Tested and Inked on 6" wafer, 20.5 mils thick (±1.5 mils) Operation Range Industrial (-40°C to +85°C) Sample Packaging Sample packaging for the AT88RF256-12 is the 8S1, 8lead, plastic SOIC package. Normal shipment form is tested die in wafer form. 8-lead SOIC L2 GND TEST I/O Do not load any pins during normal operation, other than L1 and L2; otherwise, the chip will not function properly. Pin Configuration Pin Description L1 Coil L2 Coil GND Ground TST Test Pad I/O Input/Output (Test) CLK Clock (Test) VCC Operating Voltage R/W Read/Write (Test) Note: 10 8-lead, 0.150" Wide, Plastic Gull Wing Small Outline (JEDEC SOIC) AT88RF256-12 8 7 6 5 L1 R/W VCC CLK Samples are available for customers through local Atmel Sales Offices. Package Type 8S1 1 2 3 4 AT88RF256-12 Packaging Information (samples only) 8S1, 8-lead, 0.150" Wide, Plastic Gull Wing Small Outline (JEDEC SOIC) Dimensions in Inches and (Millimeters) .020 (.508) .013 (.330) .157 (3.99) .150 (3.81) PIN 1 .244 (6.20) .228 (5.79) .050 (1.27) BSC .196 (4.98) .189 (4.80) .068 (1.73) .053 (1.35) .010 (.254) .004 (.102) 0 REF 8 .010 (.254) .007 (.203) .050 (1.27) .016 (.406) 11 Atmel Headquarters Atmel Operations Corporate Headquarters Atmel Colorado Springs 2325 Orchard Parkway San Jose, CA 95131 TEL (408) 441-0311 FAX (408) 487-2600 Europe 1150 E. Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 TEL (719) 576-3300 FAX (719) 540-1759 Atmel Rousset Atmel U.K., Ltd. Coliseum Business Centre Riverside Way Camberley, Surrey GU15 3YL England TEL (44) 1276-686-677 FAX (44) 1276-686-697 Zone Industrielle 13106 Rousset Cedex France TEL (33) 4-4253-6000 FAX (33) 4-4253-6001 Asia Atmel Asia, Ltd. Room 1219 Chinachem Golden Plaza 77 Mody Road Tsimhatsui East Kowloon Hong Kong TEL (852) 2721-9778 FAX (852) 2722-1369 Japan Atmel Japan K.K. 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan TEL (81) 3-3523-3551 FAX (81) 3-3523-7581 Fax-on-Demand North America: 1-(800) 292-8635 International: 1-(408) 441-0732 e-mail [email protected] Web Site http://www.atmel.com BBS 1-(408) 436-4309 © Atmel Corporation 2000. Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company’s standard warranty which is detailed in Atmel’s Terms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life suppor t devices or systems. Marks bearing ® and/or ™ are registered trademarks and trademarks of Atmel Corporation. Terms and product names in this document may be trademarks of others. Printed on recycled paper. 1684A–07/00/xM