AT88RF020

AT88RF020_06 ATMEL | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 14

Technical content

Features

• 13.56 MHz RFID Chip for Cards or Tags  2048-bit Read/Write RFID EEPROM  ISO 14443-2 Type B Compliant  Full ISO 14443-3 Compliant Anticollision  100,000 Write Cycle Reliability  3 ms Write Time  Password and Lockwrite Protection  82 pF Tuning Capacitor  0 – 70°C Operation

Description

The AT88RF020 is a low-end 13.56 MHz RFID (Radio Frequency IDentification) device that includes an on-chip EEPROM-based (nonvolatile) memory. The wireless interface complies with Type B operation of ISO/IEC 14443. The specific sections of compliance are 14443-1, as well as 14443-2:1999(E) (dated 5/2/00) and 14443- This device is designed to be used in applications where one or more RFID devices will be simultaneously placed within an inte lligent reader/writer RF field. Communica- tion between the RF reader/writer and this device will take place through the use of the featured anticollision command set supported by this device. The memory contains a total of 2048 bits, organized as 32 64-bit pages. Write opera- tions are designed to complete in less than three milliseconds (ms). The endurance rating for the memory is 100,000 write cycles per byte. This device supports these security features: password checking, data locking, a one- way counter and a guaranteed unique serial number. The AT88RF020 includes an on-chip internal tuning capacitor that enables it to oper- ate with a single external coil antenna. This antenna completes the RFID channel. Figure 1. Block Diagram

13.56 MHz,

2 AT88RF020

tion is sent to the chip least significant byte first. This specification follows the nomenclat ure found within the ISO/IEC 14443 document. Use. When the reader/writer sends data to this device, RFU bits should always be “0”. When this device sends data to the reader/writer, RFU bits are undefined. Memory Map The memory array within this device is organized as shown in Table 1. fields in the above memory map. written into the device’s nonvolatile memory at the Atmel factory during wafer probe/test. within the memory, including the Reserved field within Page 1. as part of the ATQB command response. instruction is executed. It is factory set to the value of zero upon shipment from Atmel. Table 1. Memory Map

2010C–RFID–2/06 Signature: This field is written unmodified into the first six bytes of Page 2 via the COUNT instruction. It is expected that this value will be related to the count and may be encrypted by the reader/writer. In this manner, the Counter and Signature fields together can provide an additional level of security from tampering. Pages 0, 1 and 2 can always be read by the system; Page 3 may never be read by the system; and all remaining pages can be read only after the proper password has been sent to the chip. The LockBits field within Page 0 can be modified only through the use of the LOCK command and only after the proper password has been sent to the chip. The contents of Page 2 can only be modified using the COUNT command—again, only after the proper password has been sent to the chip. All other pages (1 and 3 through 31) can be written to only after the proper password has been validated by the chip. The first four bytes of Page 0 comprise the serial num- ber (PUPI) and, although the adjacent LockBits field is updateable, the serial number can never be changed during any kind of operation. Communications The electrical signaling of the chip is fully compatible with ISO 14443-2, “Radio Fre- quency Power and Signal Interface,” version 1999(e) for Type B only. Anticollision operation and frame formatting is compatible with ISO 14443-3 Type B, “Initialization and Anticollision,” version 2000(e), Type B only. Command/Data Transmission Frame All data sent between the PICC and PCD is sent as characters (see ISO 14443-3, sec- tion 7.1.1). The character is composed of a start bit (logic “0”), 8 bits of data and a stop bit (logic “1”). Between characters is an extra guard time (EGT) that must not exceed 6 ETUs (~57 microseconds (µs)) for data sent to the PICC and will be two ETUs for data sent to the PCD (see ISO 14443-3, section 7.1.2). The PICC will automatically resynchronize char acter reception (internal clocks) with the start bit of each incoming character. Groups of characters exchanged between th e PCD and PICC comprise a frame, which is delimited by a Start of Frame (SOF) and an End of Frame (EOF) signal protocol (see After the READ command has been received by the PICC , the PICC will respond with the data frame following a delay of 8 ETUs (~75.5 µs) and transmit a sub carrier for a period of 10 ETUs (~94.4 µs) with no phase changes (see ISO 14443-3, section 7.1.6, and ISO 14443-2, section 9.2.5.). Note: This device ignores attempts to reduce the minimum TR0 and TR1 values from the ISO 14443-2 defaults as may be specified by the PCD in the ATTRIB command (see ISO CRC A 2-byte CRC code is included in all fr ame transmissions. The CRC polynomials are defined as: x16 + x12 + x5 + x0 This is a hex polynomial of 1021. The CRC register is initialized to 0xFFFF. When receiving information from the system, the device computes the CRC on the incoming command, data and CRC bytes (start/stop bits, SOT, EOT and EGT are ignored). When the last bit of the CRC has been received, the value in the CRC register should be 0x0000. When the device transmits data, th e CRC is computed based on all outgoing data bits.

4 AT88RF020

REQB/WUPB, SlotMARKER, ATTRIB and HLTB. ACTIVE state where the data transfer commands described above will be honored. Table 2. Command Codes

2010C–RFID–2/06 The PICC ignores all the PARAM bytes with the exception of the least significant four bits of PARAM4, which are stored within the chip as the CID for future responses. Any higher layer INF command is also ignored. The PICC response to a valid ATTRIB command is always three bytes long. The first byte contains the CID in the lower nibble and 0x0 in the upper nibble. The next two bytes are the CRC. HLTB Command The HLTB command is used to set the PICC to the HALT state, after which only the WUPB command will be acknow ledged. The format of this 7-byte command is 0x50, PUPI (4 bytes), CRC (2 bytes). The chip always responds to a valid HLTB command with the 3-byte sequence: 0x00, CRC_0 and CRC_1. The HLTB command is not valid if the PICC is in the ACTIVE state (see ISO 14443-3 sections 7.4.7 and 7.12 for additional information). SlotMARKER Command The SlotMARKER command provides a way for the reader to query those cards for which the generated random number R is greater than 1. It is a 3-byte command, the last two of which are the CRC bytes. The least significant nibble of the first byte is the slot number, and if this matches the generated random number, then the ATQB response is generated. The chip will truncate the slot number field to match the value of N provided in the REQB command. The most significant nibble of this command is fixed at 0xA.

6 AT88RF020

Figure 2. AT88RF020 Anticollision and State Transition Flow Chart All other commands are ignored when the IC is in the ACTIVE state.

2010C–RFID–2/06 Data Transfer Commands The following commands are supported for data transfer when the chip is in the ACTIVE state (see ISO 14443-3, section 7.4.7). If the command is properly received (CRC cor- rect, legal opcode and address, etc.), the chip will respond either with a NACK command, an ACK command or data. Otherwise, the chip will silently wait for a proper command. The chip supports additional commands as part of the anticollision sequenc- ing; these commands are documented elsewhere in this data sheet. On-chip password checking is required for most operations. The coding of these commands is described in Table 3 and Table 4 on page 9. Below is a description of the individual commands supported. READ Command The addressed 64-bit page referenced in the READ command is returned to the PCD. The PICC will respond with the data if the address is correct, the page is readable and the password has been sent; otherwise, it will respond with a NACK. Password checking is not required to read Pages 0, 1 and 2, bu t all other pages require a previously exe- cuted valid password check to read the chip . There is no byte read capability. Page 3 (the actual password) can never be read dire ctly and is only accessed internally during the PASSWORD command. The chip will NACK any attempt to read Page 3. WRITE Command The 64-bit memory page referenced in the WRITE command is written with the data that follows the command byte. The chip ignores the upper 3 bits of the byte-wide memory address and the lower five bits from the memory address. If the target page cannot be written to because the page is read only or is locked, or if the chip has not been properly opened to ac cess with a valid password, then a NACK command will be issued by the PICC. Other wise, an ACK command will be transmitted after the memory write operation has been completed. Reader/writer modulation is prohibited during the memory write time, which is the time period between the PCD’s EOF and the issuance of the PICC’s ACK command. This period is less than 3 ms and is considered to be an extended TR0 wait interval, as per ISO 14443. Memory is never modified if a NACK command is issued. Pages 0 and 2 (PUPI, Lock- Bits, Signature and Counter) cannot be written with this command. Addressing either Page 0 or Page 2 within the WRITE command will result in a NACK command being issued by the device. LOCK Command The LOCK command can be executed only after proper password validation has been performed. The LOCK command locks the addressed memory location from future changes. The memory locati on can still be read with prope r password validation. The last 31 bits of data within the LOCK command are logically ORed within the device with the 31-bit value stored within the LockBits field of Page 0 (see Memory Map, Table 1 on page 2). The result is then written back into the memory. After the memory has been written, an ACK command will be transmitted. A NACK command is issued if the LOCK command is attempted without previous password validation. If power is interrupted during this write, all bits within LockBits may be set to “1”, and the chip may be disabled. The first 33 bits of data sent within the command to the PICC are ignored. The bits within the LockBits field correspond to the pages within the memory and, if set to “1”, prevent all future writes to the corresponding page; i.e., LockBits field bit 6 locks Page 6 when it is set to a “1”. There is no mechanism to ever “unlock” a page, so once a page is locked, it can never be unlocked and, as such, can never be modified. The 31- bit LockBits field is set to all “0”s upon ship ment from the factory. Bit 0 of the LockBits

8 AT88RF020

2010C–RFID–2/06 field is ignored for obvious reasons, since it would normally point to memory Page 0, which contains the embedded PUPI (serial number) and the actual LockBits field. A command to lock Page 0 with password access will result in an ACK command being issued with no other effects, since Page 0 can never be locked. Attempting to lock Page 0 is not viewed as an error, so the command will be executed in the normal manner. CHECK PASSWORD Command The 64-bit value embedd ed within the CHECK PASSWORD command is compared to the password stored within Page 3 of the memory (See Memory Map, Table 1 on page 2). If the input password matches the stored password, then the chip will reply with an ACK command, and the device will be open to access. If the input passw ord does not match the internally stored password, then the chip will reply with a NACK command. This command must be executed (and the proper password sent) before most device accesses are allowed (some accesses are permitted without password validation). The chip will remain accessible until power is removed or an incorrect password is sent to the chip. If a subsequent password check fails, the chip will become inaccessible until a valid password check is again executed. Once the password has been properly acknowledged and device access opened, the current password can be chan ged using the WRIT E command. The de vice will remain ACTIVE after the new password has been written until power is removed or until a sub- sequent invalid password check occurs. The only password that is not allowed is t he “all ones” password. If the CHECK PASS- WORD command is attempted for an “all ones” password, the device will respond with a NACK command. If the “all ones” password is validly programmed into this device using the WRITE command, the device will forever be locked out of future password validated accesses. It is strongly suggested that the “all zeroes” password be avoided since this password is considered too simplistic and could represent a security risk. The device is delivered with all zeros in the password page. DESELECT Command If the DESELECT command is properly received and the PICC is in the ACTIVE state, the PICC will issue an ACK command and enter the HALT state. Its functionality is iden- tical to HLTB as described in the anticollision section. A NACK response is never issued following this command (see ISO 14443-3, section 7.4.7). COUNT Command The COUNT command is used to write Page 2. The first six bytes sent by the PCD (referred to as the Signature) are written to the first six bytes of Page 2 unmodified. The last two bytes of data sent by the PCD in the COUNT command are only placeholders and will be ignored. The 16-bit value stored in the counter field of Page 2 is incremented by one each time COUNT is executed. Once the value of the counter reaches 0x8000, no further count operations will be executed, and Page 2 will be effectively locked against further modifi- cation. Password validation must occur before the COUNT command is permitted. The chip will compute the new in cremented count that will be written into the last two bytes of Page 2 immediately following the incoming 6-byte data field. It is expected that at least part of the 6-byte value will be the result of an externally computed crypto- graphic operation on the new Counter value, thus permitting some degree of transaction validation.

erwise, an ACK command will be transmitted after the write has completed. three bits of the byte. Therefore, the device will interpret a value of 0xFF as 0x1F. The command bytes are shown in Table 4. Table 3. Command Summary

0010 R E A D 6 4 - b i t p a g e f r o m m e m o r y

1100 W R I T E 6 4 - b i t p a g e t o m e m o r y

0100 L O C K D a t a i s O R e d w i t h e x i s t i n g L o c k B i t s v a l u e

0110 C H E C K P ASSWORD

0101 D ESELECT

0111 C O U N T

Table 4. Command Bytes

10 AT88RF020

and is formatted as shown in Table 5. PCD and are formatted as shown in Table 6. Table 6): the most significant nibble and the least significant nibble. ond byte will always be a “0” for an ACK and a “1” for a NACK. NACK, the most significant nibble of the second byte contains an error feedback code. This error code represents the error that caused the NACK response command. VDD voltage will be within the range of 2.1 – 2.5 volts. Table 5. PICC Frame Format Table 6. ACK and NACK Table 7. Error Codes

00010001 N A C K , a t t e m p t e d w r i t e t o l o c k e d p a g e

01000001 N A C K , i n v a l i d p a s s w o r d a t t e m p t e d

10000001 N A C K , l o w - v o l t a g e c o n d i t i o n d e t e c t e d

2010C–RFID–2/06 Package Drawing 16S2 – SOIC

2325 Orchard Parkway

San Jose, CA 95131 TITLE DRAWING NO. R REV. 16S2, 16-lead, 0.300" Wide Body, Plastic Gull Wing Small Outline Package (SOIC) 1/9/02 16S2 A COMMON DIMENSIONS (Unit of Measure = inches) SYMBOL MIN NOM MAX NOTE Notes: 1. This drawing is for general information only; refer to JEDEC drawing MS-013, Variation AA for additional information. 2. Dimension D does not include mold Flash, protrusions or gate burrs. Mold Flash, protrusions and gate burrs shall not exceed 0.15 mm (0.006") per side. 3. Dimension E does not include inter-lead Flash or protrusion. Inter-lead Flash and protrusions shall not exceed 0.25 mm (0.010") per side. 4. L is the length of the terminal for soldering to a substrate. 5. The lead width B, as measured 0.36 mm (0.014") or greater above the seating plane, shall not exceed a maximum value of 0.61 mm (0.024") per side. A 0.0926 – 0.1043 A1 0.0040 – 0.0118 b 0.0130 – 0.0200 5 C 0.0091 – 0.0125 D 0.3977 – 0.4133 2 E 0.2914 – 0.2992 3 H 0.3940 – 0.4190 L 0.0160 – 0.050 4 e 0.050 BSC L Side View Top View End View HE b N e A D C

12 AT88RF020

2010C–RFID–2/06 Mechanical Pin 16 = AC2 All other pins should float. Pad Information The layout of the die is shown in Figure 3 on page 13. The antenna coil contact pads (ac1 and ac2) and the test 5, 6 and 7 pad passivation openings are 90x90 microns. The antenna coil and test 5, 6 and 7 pads are designed to be compatible with current factory production bump mounting processes.

Ordering Information

Ordering Code Package Operation Range AT88RF020-WA1 AT88RF020-MR1 Die on Wafer, 82 pf RF Module R (XOA2), 82 pf, Green Commercial (0°C to 70°C)

2010C–RFID–2/06 Die Layout Figure 3. Die Layout Overall Die Size: 1.866 mm x 1.953 mm 73.5 mils x 76.9 mils Pad Size: 80 µm (square pad) 90 µm (octagon pad) 3.1 mils 3.5 mils Pad Location AC1 X= 198.44 µm X= 7.813 mils Y= 645.44 µm Y= 25.411 mils AC2 X= 581.40 µm X= 22.890 mils Y= 645.44 µm Y= 25.411 mils Test 1 X= −102.54 µm X= −4.037 mils Y= 854.48 µm Y= 33.641 mils Test 2 X= −235.68 µm X= −9.279 mils Y= 854.48 µm Y= 33.641 mils Test 3 X= −383.44 µm X= −15.096 mils Y= 854.48 µm Y= 33.641 mils Test 4 X= −533.20 µm X= −20.992 mils Y= 854.48 µm Y= 33.641 mils Test 5 X= −776.80 µm X= −30.583 mils Y= 732.00 µm Y= 28.819 mils Test 6 X= −776.80 µm X= −30.583 mils Y= −732.00 µm Y= −28.819 mils Test 7 X= 805.84 µm X= 31.726 mils Y= −732.00 µm Y= 28.819 mils .0735" x .0769" AT29654 Test 6 Test 7 AC2 AC1 Test 5 Test 4 Test 3 Test 2 Test 1

Printed on recycled paper. © Atmel Corporation 2006 . All rights reserved. Atmel ®, logo and combinations thereof, Everywhere Y ou Are ® and others, are registered trade- marks or trademarks of Atmel Corporation or its subsidiari es. Other terms and product names may be trademarks of others. Disclaimer: The information in this document is provided in connection with Atmel products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Atmel products. EXCEPT AS SET FORTH IN ATMEL ’S TERMS AND CONDI- TIONS OF SALE LOCATED ON ATMEL ’S WEB SITE, ATMEL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTOR Y WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO , THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICU LAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL ATMEL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR I NCIDEN- TAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION, OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF AT MEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Atmel makes no representations or warranties with respect to the accuracy or co mpleteness of the contents of this document and reserves the rig ht to make changes to specifications and product descriptions at any time without notice. Atmel does not make any commitment to update the information contained her ein. Unless specifically provided otherwise, Atmel products are not suitable for, and shall not be used in, automotive applications. Atmel’s products are not int ended, authorized, or warranted for use as components in applications in tended to support or sustain life. Atmel Corporation Atmel Operations San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 487-2600 Regional Headquarters Europe Atmel Sarl Route des Arsenaux 41 Case Postale 80 CH-1705 Fribourg Switzerland Tel: (41) 26-426-5555 Fax: (41) 26-426-5500 Asia Room 1219 Chinachem Golden Plaza

77 Mody Road Tsimshatsui

Tel: (852) 2721-9778 Fax: (852) 2722-1369 Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan Tel: (81) 3-3523-3551 Fax: (81) 3-3523-7581 Memory San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 Microcontrollers San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 La Chantrerie BP 70602

44306 Nantes Cedex 3, France

13106 Rousset Cedex, France

1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906, USA Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland Tel: (44) 1355-803-000 Fax: (44) 1355-242-743 RF/Automotive Theresienstrasse 2 Postfach 3535

74025 Heilbronn, Germany

1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906, USA Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Avenue de Rochepleine BP 123

38521 Saint-Egreve Cedex, France

www.atmel.com/literature 2010C–RFID–2/06