Download PDFAT88RF020 ATMEL
Document overview
- Manufacturer or author: Provided By digicamel.com
- PDF pages: 14
Technical content
Features
- 13.56 MHz RFID Chip for Cards or Tags 2048-bit Read/Write RFID EEPROM ISO 14443-2 Type B Compliant Full ISO 14443-3 Compliant Anticollision 100,000 Write Cycle Reliability 3m sW r i t eT i m e Password and Lockwrite Protection 82 pF Tuning Capacitor 0–7 0 °C Operation
Description
The A T88RF020 is a low-end 13.56 MHz RFID (Radio Frequency IDentification) device that includes an on-chip EEPROM-based (nonvolatile) memory. The wireless interface complies with Type B operation of ISO/IEC 14443. The specific sections of compliance are 14443-1, as well as 14443-2:1999(E) (dated 5/2/00) and 14443- This device is designed to be used in applications where one or more RFID devices will be simultaneously placed within an intelligent reader/writer RF field. Communica- tion between the RF reader/writer and this device will take place through the use of the featured anticollision command set supported by this device. The memory contains a total of 2048 bits, organized as 32 64-bit pages. Write opera- tions are designed to complete in less than three milliseconds (ms). The endurance rating for the memory is 100,000 write cycles per byte. This device supports these security features: password checking, data locking, a one- way counter and a guaranteed unique serial number. The AT88RF020 includes an on-chip internal tuning capacitor that enables it to oper- ate with a single external coil antenna. This antenna completes the RFID channel. Figure 1. Block Diagram
13.56 MHz,
2 AT88RF020
tion is sent to the chip least significant byte first. This specification follows the nomenclature found within the ISO/IEC 14443 document. Use. When the reader/writer sends data to this device, RFU bits should always be “0”. When this device sends data to the reader/writer, RFU bits are undefined. Memory Map The memory array within this device is organized as shown in Table 1. fields in the above memory map. written into the device’s nonvolatile memory at the Atmel factory during wafer probe/test. within the memory, including the Reserved field within Page 1. as part of the ATQB command response. instruction is executed. It is factory set to the value of zero upon shipment from Atmel. Table 1. Memory Map
2010B–RFID–03/02 Signature: This field is written unmodified into the first six bytes of Page 2 via the COUNT instruction. It is expected that this value will be related to the count and may be encrypted by the reader/writer. In this manner, the Counter and Signature fields together can provide an additional level of security from tampering. Pages 0, 1 and 2 can always be read by the system; Page 3 may never be read by the system; and all remaining pages can be read only after the proper password has been sent to the chip. The LockBits field within Page 0 can be modified only through the use of the LOCK command and only after the proper password has been sent to the chip. The contents of Page 2 can only be modified using the COUNT command—again, only after the proper password has been sent to the chip. All other pages (1 and 3 through 31) can be written to only after the proper password has been validated by the chip. The first four bytes of Page 0 comprise the serial num- ber (PUPI) and, although the adjacent LockBits field is updateable, the serial number can never be changed during any kind of operation. Communications The electrical signaling of the chip is fully compatible with ISO 14443-2, “Radio Fre- quency Power and Signal Interface,” version 1999(e) for Type B only. Anticollision operation and frame formatting is compatible with ISO 14443-3 Type B, “Initialization and Anticollision,” version 2000(e), Type B only. Command/Data Transmission Frame All data sent between the PICC and PCD is sent as characters (see ISO 14443-3, sec- tion 7.1.1). The character is composed of a start bit (logic “0”), 8 bits of data and a stop bit (logic “1”). Between characters is an extra guard time (EGT) that must not exceed 6 ETUs (~57 microseconds (µs)) for data sent to the PICC and will be two ETUs for data sent to the PCD (see ISO 14443-3, section 7.1.2). The PICC will automatically resynchronize character reception (internal clocks) with the start bit of each incoming character. Groups of characters exchanged between the PCD and PICC comprise a frame, which is delimited by a Start of Frame (SOF) and an End of Frame (EOF) signal protocol (see After the READ command has been received by the PICC, the PICC will respond with the data frame following a delay of 8 ETUs (~75.5 µs) and transmit a subcarrier for a period of 10 ETUs (~94.4 µs) with no phase changes (see ISO 14443-3, section 7.1.6, and ISO 14443-2, section 9.2.5.). Note: This device ignores attempts to reduce the minimum TR0 and TR1 values from the ISO 14443-2 defaults as may be specified by the PCD in the ATTRIB command (see ISO CRC A 2-byte CRC code is included in all frame transmissions. The CRC polynomials are defined as: x16 +x 12 +x 5 +x 0 This is a hex polynomial of 1021. The CRC register is initialized to 0xFFFF. When receiving information from the system, the device computes the CRC on the incoming command, data and CRC bytes (start/stop bits, SOT, EOT and EGT are ignored). When the last bit of the CRC has been received, the value in the CRC register should be 0x0000. When the device transmits data, the CRC is computed based on all outgoing data bits.
4 AT88RF020
REQB/WUPB, SlotMARKER, ATTRIB and HLTB. ACTIVE state where the data transfer commands described above will be honored. Table 2. Command Codes
2010B–RFID–03/02 The PICC ignores all the PARAM bytes with the exception of the least significant four bits of PARAM4, which are stored within the chip as the CID for future responses. Any higher layer INF command is also ignored. The PICC response to a valid ATTRIB command is always three bytes long. The first byte contains the CID in the lower nibble and 0x0 in the upper nibble. The next two bytes are the CRC. HLTB Command The HLTB command is used to set the PICC to the HALT state, after which only the WUPB command will be acknowledged. The format of this 7-byte command is 0x50, PUPI (4 bytes), CRC (2 bytes). The chip always responds to a valid HLTB command with the 3-byte sequence: 0x00, CRC_0 and CRC_1. The HLTB command is not valid if the PICC is in the ACTIVE state (see ISO 14443-3 sections 7.4.7 and 7.12 for additional information). SlotMARKER Command The SlotMARKER command provides a way for the reader to query those cards for which the generated random number R is greater than 1. It is a 3-byte command, the last two of which are the CRC bytes. The least significant nibble of the first byte is the slot number, and if this matches the generated random number, then the ATQB response is generated. The chip will truncate the slot number field to match the value of N provided in the REQB command. The most significant nibble of this command is fixed at 0xA.
6 AT88RF020
Figure 2. AT88RF020 Anticollision and State Transition Flow Chart All other commands are ignored when the IC is in the ACTIVE state.
2010B–RFID–03/02 Data Transfer Commands The following commands are supported for data transfer when the chip is in the ACTIVE state (see ISO 14443-3, section 7.4.7). If the command is properly received (CRC cor- rect, legal opcode and address, etc.), the chip will respond either with a NACK command, an ACK command or data. Otherwise, the chip will silently wait for a proper command. The chip supports additional commands as part of the anticollision sequenc- ing; these commands are documented elsewhere in this data sheet. On-chip password checking is required for most operations. The coding of these commands is described in Table 3 and Table 4 on page 9. Below is a description of the individual commands supported. READ Command The addressed 64-bit page referenced in the READ command is returned to the PCD. The PICC will respond with the data if the address is correct, the page is readable and the password has been sent; otherwise, it will respond with a NACK. Password checking is not required to read Pages 0, 1 and 2, but all other pages require a previously exe- cuted valid password check to read the chip. There is no byte read capability. Page 3 (the actual password) can never be read directly and is only accessed internally during the PASSWORD command. The chip will NACK any attempt to read Page 3. WRITE Command The 64-bit memory page referenced in the WRITE command is written with the data that follows the command byte. The chip ignores the upper 3 bits of the byte-wide memory address and the lower five bits from the memory address. If the target page cannot be written to because the page is read only or is locked, or if the chip has not been properly opened to access with a valid password, then a NACK command will be issued by the PICC. Otherwise, an ACK command will be transmitted after the memory write operation has been completed. Reader/writer modulation is prohibited during the memory write time, which is the time period between the PCD’s EOF and the issuance of the PICC’s ACK command. This period is less than 3 ms and is considered to be an extended TR0 wait interval, as per ISO 14443. Memory is never modified if a NACK command is issued. Pages 0 and 2 (PUPI, Lock- Bits, Signature and Counter) cannot be written with this command. Addressing either Page 0 or Page 2 within the WRITE command will result in a NACK command being issued by the device. LOCK Command The LOCK command can be executed only after proper password validation has been performed. The LOCK command locks the addressed memory location from future changes. The memory location can still be read with proper password validation. The last 31 bits of data within the LOCK command are logically ORed within the device with the 31-bit value stored within the LockBits field of Page 0 (see Memory Map, Table 1 on page 2). The result is then written back into the memory. After the memory has been written, an ACK command will be transmitted. A NACK command is issued if the LOCK command is attempted without previous password validation. If power is interrupted during this write, all bits within LockBits may be set to “1”, and the chip may be disabled. The first 33 bits of data sent within the command to the PICC are ignored. The bits within the LockBits field correspond to the pages within the memory and, if set to “1”, prevent all future writes to the corresponding page; i.e., LockBits field bit 6 locks Page 6 when it is set to a “1”. There is no mechanism to ever “unlock” a page, so once a page is locked, it can never be unlocked and, as such, can never be modified. The 31- bit LockBits field is set to all “0”s upon shipment from the factory. Bit 0 of the LockBits
8 AT88RF020
2010B–RFID–03/02 field is ignored for obvious reasons, since it would normally point to memory Page 0, which contains the embedded PUPI (serial number) and the actual LockBits field. A command to lock Page 0 with password access will result in an ACK command being issued with no other effects, since Page 0 can never be locked. Attempting to lock Page 0 is not viewed as an error, so the command will be executed in the normal manner. CHECK PASSWORD Command The 64-bit value embedded within the CHECK PASSWORD command is compared to the password stored within Page 3 of the memory (See Memory Map, Table 1 on page 2). If the input password matches the stored password, then the chip will reply with an A C Kc o m m a n d ,a n dt h ed e v i c ew i l lb eo p e nt oa c c e s s .I ft h ei n p u tp a s s w o r dd o e sn o t match the internally stored password, then the chip will reply with a NACK command. This command must be executed (and the proper password sent) before most device accesses are allowed (some accesses are permitted without password validation). The chip will remain accessible until power is removed or an incorrect password is sent to the chip. If a subsequent password check fails, the chip will become inaccessible until a valid password check is again executed. Once the password has been properly acknowledged and device access opened, the current password can be changed using the WRITE command. The device will remain ACTIVE after the new password has been written until power is removed or until a sub- sequent invalid password check occurs. The only password that is not allowed is the “all ones” password. If the CHECK P ASS- WORD command is attempted for an “all ones” password, the device will respond with a NACK command. If the “all ones” password is validly programmed into this device using the WRITE command, the device will forever be locked out of future password validated accesses. It is strongly suggested that the “all zeroes” password be avoided since this password is considered too simplistic and could represent a security risk. The device is delivered with all zeros in the password page. DESELECT Command If the DESELECT command is properly received and the PICC is in the ACTIVE state, the PICC will issue an ACK command and enter the HALT state. Its functionality is iden- tical to HLTB as described in the anticollision section. A NACK response is never issued following this command (see ISO 14443-3, section 7.4.7). COUNT Command The COUNT command is used to write Page 2. The first six bytes sent by the PCD (referred to as the Signature) are written to the first six bytes of Page 2 unmodified. The last two bytes of data sent by the PCD in the COUNT command are only placeholders and will be ignored. The 16-bit value stored in the counter field of Page 2 is incremented by one each time COUNT is executed. Once the value of the counter reaches 0x8000, no further count operations will be executed, and Page 2 will be effectively locked against further modifi- cation. Password validation must occur before the COUNT command is permitted. The chip will compute the new incremented count that will be written into the last two bytes of Page 2 immediately following the incoming 6-byte data field. It is expected that at least part of the 6-byte value will be the result of an externally computed crypto- graphic operation on the new Counter value, thus permitting some degree of transaction validation.
erwise, an ACK command will be transmitted after the write has completed. three bits of the byte. Therefore, the device will interpret a value of 0xFF as 0x1F. The command bytes are shown in Table 4. Table 3. Command Summary
0010 R E A D 6 4 - b i t p a g e f r o m m e m o r y
1100 W R I T E 6 4 - b i t p a g e t o m e m o r y
0100 L O C K D a t a i s O R e d w i t h e x i s t i n g L o c k B i t s v a l u e
0110 C H E C K P ASSWORD
0101 D ESELECT
0111 C O U N T
Table 4. Command Bytes
10 AT88RF020
and is formatted as shown in Table 5. PCD and are formatted as shown in Table 6. Table 6): the most significant nibble and the least significant nibble. ond byte will always be a “0” for an ACK and a “1” for a NACK. NACK, the most significant nibble of the second byte contains an error feedback code. This error code represents the error that caused the NACK response command. VDD voltage will be within the range of 2.1 – 2.5 volts. Table 5. PICC Frame Format Table 6. ACK and NACK Table 7. Error Codes
00010001 N A C K , a t t e m p t e d w r i t e t o l o c k e d page
01000001 N A C K , i n v a l i d p a s s w o r d a t t e m p t e d
10000001 N A C K , l o w - v o l t a g e c o n d i t i o n d e t e c t e d
2010B–RFID–03/02 Package Drawing 1 6 S 2–S O I C
2325 Orchard Parkway
San Jose, CA 95131 TITLE DRAWING NO. R REV. 16S2, 16-lead, 0.300" Wide Body, Plastic Gull Wing Small Outline Package (SOIC) 1/9/02 16S2 A COMMON DIMENSIONS (Unit of Measure = inches) SYMBOL MIN NOM MAX NOTE Notes: 1. This drawing is for general information only; refer to JEDEC drawing MS-013, Variation AA for additional information. 2. Dimension D does not include mold Flash, protrusions or gate burrs. Mold Flash, protrusions and gate burrs shall not exceed 0.15 mm (0.006") per side. 3. Dimension E does not include inter-lead Flash or protrusion. Inter-lead Flash and protrusions shall not exceed 0.25 mm (0.010") per side. 4. L is the length of the terminal for soldering to a substrate. 5. The lead width B, as measured 0.36 mm (0.014") or greater above the seating plane, shall not exceed a maximum value of 0.61 mm (0.024") per side. A 0.0926 – 0.1043 A1 0.0040 – 0.0118 b 0.0130 – 0.0200 5 C 0.0091 – 0.0125 D 0.3977 – 0.4133 2 E 0.2914 – 0.2992 3 H 0.3940 – 0.4190 L 0.0160 – 0.050 4 e 0.050 BSC L Side View Top View End View HE b N e A D C
12 AT88RF020
2010B–RFID–03/02 Mechanical Package Sample Pinout P i n1=A C 1 P i n1 6=A C 2 All other pins should float. Pad Information The layout of the die is shown in Figure 3 on page 13. The antenna coil contact pads (ac1 and ac2) and the test 5, 6 and 7 pad passivation openings are 90x90 microns. The antenna coil and test 5, 6 and 7 pads are designed to be compatible with current factory production bump mounting processes.
Ordering Information
Ordering Code Package Operation Range A T88RF020-WBC-82 AT88RF020-WC-82 A T88RF020-WBC-10 AT88RF020-WC-10 Bumped Wafer, 82 pf D i eo nW a f e r ,8 2p f Bumped Water, 10 pf D i eo nW a f e r ,1 0p f Commercial (0°Ct o7 0°C)
2010B–RFID–03/02 Die Layout Figure 3. Die Layout Overall Die Size: 1 . 8 6 6m mx1 . 9 5 3m m 7 3 . 5m i l sx7 6 . 9m i l s Pad Size: 80 µm (square pad) 90 µm (octagon pad) 3.1 mils 3.5 mils Pad Location AC1 X= 198.44 µm X= 7.813 mils Y= 645.44 µm Y= 25.411 mils AC2 X= 581.40 µm X= 22.890 mils Y= 645.44 µm Y= 25.411 mils Test 1 X= −102.54 µm X= −4.037 mils Y= 854.48 µm Y= 33.641 mils Test 2 X= −235.68 µm X= −9.279 mils Y= 854.48 µm Y= 33.641 mils Test 3 X= −383.44 µm X= −15.096 mils Y= 854.48 µm Y= 33.641 mils Test 4 X= −533.20 µm X= −20.992 mils Y= 854.48 µm Y= 33.641 mils Test 5 X= −776.80 µm X= −30.583 mils Y= 732.00 µm Y= 28.819 mils Test 6 X= −776.80 µm X= −30.583 mils Y= −732.00 µm Y= −28.819 mils Test 7 X= 805.84 µm X= 31.726 mils Y= −732.00 µm Y= 28.819 mils .0735" x .0769" AT29654 Test 6 Test 7 AC2 AC1 Test 5 Test 4 Test 3 Test 2 Test 1
Printed on recycled paper. © Atmel Corporation 2002. Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company’s standard warranty which is detailed in Atmel’s Terms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life support devices or systems. Atmel Headquarters Atmel Operations Corporate Headquarters San Jose, CA 95131 TEL 1(408) 441-0311 FAX 1(408) 487-2600 Europe Atmel SarL Route des Arsenaux 41 Casa Postale 80 CH-1705 Fribourg Switzerland TEL (41) 26-426-5555 FAX (41) 26-426-5500 Asia Atmel Asia, Ltd. Room 1219 Chinachem Golden Plaza
77 Mody Road Tsimhatsui
TEL (852) 2721-9778 FAX (852) 2722-1369 Japan Atmel Japan K.K. 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan TEL (81) 3-3523-3551 FAX (81) 3-3523-7581 Memory Atmel Corporate San Jose, CA 95131 TEL 1(408) 436-4270 FAX 1(408) 436-4314 Microcontrollers Atmel Corporate San Jose, CA 95131 TEL 1(408) 436-4270 FAX 1(408) 436-4314 Atmel Nantes La Chantrerie BP 70602
44306 Nantes Cedex 3, France
13106 Rousset Cedex, France
1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 TEL 1(719) 576-3300 FAX 1(719) 540-1759 Atmel Smart Card ICs Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland TEL (44) 1355-803-000 FAX (44) 1355-242-743 RF/Automotive Atmel Heilbronn Theresienstrasse 2 Postfach 3535
74025 Heilbronn, Germany
FAX (49) 71-31-67-2340 Atmel Colorado Springs 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 TEL 1(719) 576-3300 FAX 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Atmel Grenoble Avenue de Rochepleine BP 123
38521 Saint-Egreve Cedex, France
literature@atmel.com Web Site http://www.atmel.com 2010B–RFID–03/02 ATM EL® is the registered trademark of Atmel. IEC™ is a trademark of the International Electrontechnical Commission. ISO ® is a registered trademark of the International Organization for Standardization. ISO/IEC 1443 can be purchased at http://www.iso.ch or http://www.iec.ch Other terms and product names may be the trademarks of others.