PN5180A0ET

PN5180 NXP | Alldatasheet

Document overview

• Manufacturer or author: Provided By www.digicamel.com(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 126

Technical content

1. Introduction This document describes the functionality and electrical specification of the high-power NFC IC PN5180. Additional documents for functional chip in description and design support are available from NXP, this information is not part of this document. 2. General description PN5180, the best full NFC frontend of the market. As a highly integrated high-power output NFC frontend IC for contactless communication at 13.56 MHz, this frontend IC utilizes an outstanding modulation and demodulation concept completely integrated for different kinds of contactless communication methods and protocols. The PN5180 ensures maximum interoperability for next generation of NFC enabled mobile phones. The PN5180 is optimized for point of sales terminal applications and implements a high-power NFC frontend functionality which allows to achieve EMV compliance on RF level without additional external active components. The PN5180 frontend IC supports the following operating modes:

• Reader/Writer mode supporting ISO/IEC 14443-A up to 848 kBit/s, MIFARE
• Reader/Writer mode supporting ISO/IEC 14443-B up to 848 kBit/s
• Reader/Writer mode supporting JIS X 6319-4 (comparable with FeliCa scheme)
• Read/write mode supporting ISO/IEC 15693
• Read/write mode supporting ISO/IEC 18000-3 Mode 3
• ISO/IEC18092 (NFC-IP1)
• ISO/IEC21481 (NFC-IP-2)
• NFC-FORUM
• ISO14443-type A Card emulation up to 848 kBit/s Enabled in Reader/Writer mode for ISO/IEC 14443-A, MIFARE the PN5180’s internal transmitter part is able to drive a reader/writer antenna designed to communicate with ISO/IEC 14443A, MIFARE cards and transponders without additional active circuitry. The receiver part provides a robust and efficient implementation of a demodulation and decoding circuitry for signals from ISO/IEC 14443-A, MIFARE compatible cards and transponders. The digital part handles the complete ISO/IEC 14443-A, MIFARE framing and error detection (Parity and CRC). PN5180 High-power NFC frontend solution Rev. 2.2 — 17 December 2015 240922 Preliminary data sheet COMPANY PUBLIC

Rev. 2.2 — 17 December 2015 240922 2 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution The PN5180 supports all layers of the ISO/IEC 14443-B reader/writer communication scheme, given correct implementation of additional components, like oscillator, power supply, coil etc. and provided that standardized protocols, e.g. like ISO/IEC 14443-4 and/or ISO/IEC 14443-B anticollision are correctly implemented by a host microcontroller. Enabled in Reader/Writer mode for JIS X 6319-4, the PN5180 NFC frontend IC supports the FeliCa communication scheme. The receiver part provides a robust and efficient implementation of the demodulation and decoding circuitry for JIS X 6319-4 coded signals. The digital part handles the FeliCa framing and error detection like CRC. The PN5180 supports JIS X 6319-4 contactless reader/writer communication using higher transfer speeds up to 424 kbit/s in both directions. The PN5180 supports the vicinity protocol according to ISO/IEC 15693 and ISO/IEC 18000-3 mode 3. The PN5180 frontend IC supports the ISO/IEC18092 modes reader, P2P (NFC-IP1 and NFC-IP2) and type A card emulation. In Card Operation mode, the PN5180 frontend IC is able to answer to a reader/writer command according to the ISO/IEC 14443A/MIFARE card interface scheme. The Card Operation Mode allows the PN5180 to act like an NFC Forum tag if this functionality is supported by the host firmware. One SPI-based host controller interface is implemented:

• Serial Peripheral Interface (SPI) with data rates up to 7 Mbit/s with MOSI, MISO, NSS and SCK signals
• Interrupt request line to inform host controller on events
• EEPROM configurable pull-up resistor on SPI MISO line
• Busy line to indicate to host availability of data for reading 3. Features and benefits  Transmitter current up to 250 mA  Dynamic Power Control controls antenna current, RF power, and the related waveforms to deliver optimized RF performance even under detuned conditions. It maximizes transmitter current during detuned conditions and thereby compensates for any negative effects generated by nearby metal, cards, or phones. The DPC ensures robust communication with smartcards and smartphones, without using any additional external components.  Includes NXP ISO/IEC14443-A, Innovatron ISO/IEC14443-B and NXP MIFARE Crypto 1 intellectual property licensing rights  Full compliance with all standards relevant to NFC, contactless operation and EMVCo  Automatic EMD handling for faster design of payment terminals  Onboard Dynamic Power Control (DPC) for optimized RF performance, even under detuned conditions  Low-power card detection minimizes current consumption during polling  Active load modulation supports smaller antenna with Card Emulation Mode  Small, industry-standard packages  NFC Cockpit GUI: software-independent register settings

Rev. 2.2 — 17 December 2015 240922 3 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution  Development kit with 32-bit NXP LPC1769 MCU and antenna  NFC Reader Library with source code ready for EMVCo L1 and NFC Forum compliance 4. Applications  Payment terminals  Physical-access readers  eGov readers  Industrial readers  High-performance readers The NXP PN5180 NFC frontend, equipped with unique features that improve performance, save energy, and maximize efficiency, enables best-in-class readers that conform to the requirements for EMVCo and NFC Forum specifications, for the broadest possible interoperability.

Table 1. Quick reference data Table 2. Ordering information in one tray, bakable, MSL=3.

Table 3. Marking codes HVQFN40

1. (Product life cycle status code Before CQS) X
2. (Product life cycle status code CQS): Y

implemented functionality of a device.

7.1 Package marking drawing

1. (Product life cycle status release for sale):

Table 3. Marking codes

9.1 Pin description

Table 4. Pin description HVQFN40

2 I/O Analog test bus or Download request

24 MHz, other clock frequencies not supported)

Table 4. Pin description HVQFN40 …continued

Rev. 2.2 — 17 December 2015 240922 9 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 10. Functional description

10.1 Introduction

The PN5180 is a High-Power NFC frontend. It implements the RF functionality like an antenna driving and receiver circuitry and all the low-level functionality to realize an NFC Forum-compliant reader. The PN5180 needs to be connected to a host microcontroller by means of a SPI interface for configuration, NFC data exchange and high-level NFC protocol implementation. The PN5180 allows different supply voltages for NFC drivers, internal supply and host interface providing a maximum of flexibility. The chip supply voltage and the NFC driver voltage can be chosen independently from each other. The PN5180 makes use of an external 27.12 MHz crystal as clock source for generating the RF field and its internal digital logic. In addition, an internal PLL allows to use an accurate external clock source of either 8, 12, 16, 24 MHz. This allows to save the

27.12 MHz crystal in systems which implement one of the mentioned clock frequencies

(e.g. for USB or system clock). Two types of memory are implemented in the PN5180: RAM and EEPROM. Internal registers of the PN5180 state machine store configuration data. The internal registers are reset to initial values in case of PowerON, and Hardware RESET and standby. The RF configuration for dedicated RF protocols is defined by EEPROM data which is copied by a command issued from the host microcontroller - LOAD_RF_CONFIG- into the registers of the PN5180. The PN5180 is initialized with EEPROM data for the LOAD_RF_CONFIG command which has been tested to work well for one typical antenna. For customer-specific antenna sizes and dedicated antenna environment conditions like metal or ferrite, the pre-defined EEPROM settings can be modified by the user. This allows users to achieve the maximum RF performance from a given antenna design.

10.2 Power-up and Clock

10.2.1 Power Management Unit

10.2.1.1 Supply Connections and Power-up

The Power Management Unit of the PN5180 generates internal supplies required for operation. The following pins are used to supply the IC:

• PVDD - supply voltage for the SPI interface and control connections
• VBAT - Supply Voltage input
• TVDD - Transmitter supply
• AVDD - Analog supply input, connected to VDD
• DVDD - Digital supply input, connected to VDD

Rev. 2.2 — 17 December 2015 240922 10 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

• VDD - 1.8 V output, to be connected to AVDD and DVDD Blocking capacitors shall be placed as close as possible to the pins of the package. Any additional filtering/damping of the transmitter supply, e.g. by ferrite beads, might have an impact on the analog RF signal quality and needs to be monitored carefully. Sequential order for powering up the IC
• First ramp VBAT, PVDD can immediately follow, latest 2 ms after VBAT reaches 1.8 V.
• There is no timing dependency on TVDD, only that TVDD shall rise equal or later to VBAT.
• VBAT must be equal or higher than PVDD
• TVDD has no other relationship to VBAT or PVDD After power-up, the PN5180 is indicating the ability to receive command from a host microcontroller by an IDLE IRQ. There are configurations in EEPROM, which allow to specify the behavior of the PN5180 after start-up. LPCD (Low-power card detection) and DPC (dynamic power control) are functionalities which are configurable in EEPROM. For NFC target functionality, the configuration LOAD_RF_CONFIG General Target Mode is used.

10.2.1.2 Power-down

A hard power-down is enabled with LOW level on pin RESET_N. This puts the internal voltage regulators for the analog and digital core supply as well as the oscillator in a low-power state. All digital input buffers are separated from the input pads and clamped internally (except pin RESET_N itself). IRQ, BUSY , AUX1, AUX2 have an internal pull down resistor which is activated on RESET_N ==0. All other output pins are switched to high impedance. Fig 3. Power-up voltages aaa-020676 1.8 V max Δ2ms PVDD time VBAT voltage

Rev. 2.2 — 17 December 2015 240922 11 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution To leave the power-down mode the level at the pin RESET_N has to be set to HIGH. This starts the internal start-up sequence from Power-Down.

10.2.1.3 Standby

The standby mode is entered immediately after sending the instruction SWITCH_MODE with standby. All internal current sinks are set to low-power state. In opposition to the power-down mode, the digital input buffers are not separated by the input pads and keep their functionality. The digital output pins do not change their state. During standby mode, all registers values, the buffer content and the configuration itself will not be kept, exceptions are the registers with addresses 05h(PADCONFIG_REG), 07h(PADOUT_REG) 25h(TEMP_CONTROL). To leave the standby mode, various possibilities do exist. The conditions for wake-up are configured in the register STBY_CFG_REG.

• Wake-up via Timer
• Wake-up via RF level detector
• Low Level on RESET_N
• PVDD disappears Any host communication (data is not validated) will trigger the internal start-up sequence. The reader IC is in full operation mode again when the internal start-up sequence is finalized.

10.2.1.4 Temperature Sensor

The PN5180 implements a configurable temperature sensor. The temperature sensor is configurable by the TEMP_CONTROL register (25h). The Temperature Sensor supports temperature settings for 85 °C, 115 °C, 125 °C and 135 °C. In case the sensed device temperature is higher than configured, a TEMPSENS_ERROR IRQ is raised. The host is able to react then in an appropriate way by e.g. switching off the RF field. There is no automatic temperature protection implemented which shuts down the device in case of overheating.

10.2.2 Reset and start-up time

A constant low level of at least 10 s at the RESET_N pin starts the internal reset procedure. When the PN5180 has finished the start_up, a IDLE_IRQ is raised and the IC is ready to receive commands on the host interface.

10.2.3 Clock concept

The PN5180 needs to be supplied by an 27.12 MHz crystal for operation. In addition, the internal PLL allows to use an accurate external clock source of either 8, 12, 16, 24 MHz instead of the crystal.

Rev. 2.2 — 17 December 2015 240922 12 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution The clock applied to the PN5180 provides a time basis for the synchronous system’s encoder and decoder. The stability of the clock frequency, is an important factor for correct operation. To obtain optimum performance, clock jitter must be reduced as much as possible. This is best achieved using the internal oscillator buffer with the recommended circuitry. In card mode the clock is also required. If an external clock source of 27.12 MHz is used instead of a crystal, the clock signal must be applied to pin CLK1. In this case, special care must be taken with the clock duty cycle and clock jitter. The crystal is a component which is impacting the overall performance of the system. A high-quality component is recommended here. The resistor RD1 allows to reduce the start-up time of the crystal. A short start-up time is especially desired in case the Low-Power card detection is used. The values of these resistors depend on the crystal which is used.

10.3 Timer and Interrupt system

10.3.1 General Purpose Timer

The Timers are used to measure certain intervals between certain configurable events of the receiver, transmitter and other RF-events. The timer signals its expiration by raising a flag and the value of the timer may be accessed via the register-set. Three general-purpose timers T0, T1, and T2 running with the PN5180 clock with several start conditions, stop conditions, time resolutions, and maximal timer periods are implemented. For automatic time-out handling during MIFARE Authentication Timer2 is blocked during this operation. In case EMVCo EMD is enabled, Timer1 will be automatically restarted when an EMD event occurs. Fig 4. Connection of Crystal aaa-020196 CLK1 CLK2 RD1RD1 CL1 CL1 crystal crystal connection PN518 PN5180 VSS

Rev. 2.2 — 17 December 2015 240922 13 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Timers T0 to T2 have a resolution of 20 bits and may be operated at clock frequencies derived from the 13.56 MHz system clock. Several start events can be configured: start now, start on external RF-field on/off and start on Ex/Tx started/ended. The timers allow reload of the counter value. At expiration of the timers a flag is raised and an IRQ is triggered. The clock may be divided by a prescaler for frequencies of:

• 6.78 MHz
• 3.39 MHz
• 1.70 MHz
• 848 kHz
• 424 kHz
• 212 kHz
• 106 kHz
• 53 kHz

10.3.2 Interrupt System

10.3.2.1 IRQ PIN

The IRQ_ENABLE_REG allows to configure, which of the interrupts are routed to the IRQ pin of the PN5180. All of the interrupts can be enabled and disabled independent from each other. The IRQ on the pin can either be cleared by writing to the IRQ_SET_CLEAR register or by reading the IRQ_STATUS register (EEPROM configuration). If not all enabled IRQ’s are cleared the IRQ pin remains active. The polarity of the external IRQ signal can be configured by EEPROM in IRQ_PIN_CONFIG (01Ah).

10.3.2.2 IRQ_STATUS Register

The IRQ_STATUS register contains the status flags. The status flags cannot be disabled. Status Flag can either be cleared by writing to the IRQ_SET_CLEAR register or when the IRQ_STATUS register is read (EEPROM configuration) Fig 5. Target Mode case: Timer stop for started reception aaa-020576 0x00 0x00 ... ... ... 0x7E0x7F0x00 0x07 ...0x7E0x7F0x00 0x08 Register TX WAIT PRESCALER tx_wait time ...0x7E0x7F0x00 0x09 ...TXbit TX bitpha se-1phase TXbit TRANSCEIVE_CONTROL_REG.TX_BITPHASE is loaded in case last PCD bit is 0 TRANSCEIVE_CONTROL_REG.TX_BITPHASE + TX_WAIT_PRESCALER/2 + 1 is loaded in case last PCD bit is 1phase last bit register TX WAIT VAL TX wait counter PN5180 PICC PCD

Rev. 2.2 — 17 December 2015 240922 14 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution The PN5180 indicates certain events by setting bits in the register GENERAL_IRQ_STATUS_REG and additionally, if activated, on the pin IRQ. LPCD_IRQ, GENERAL_ERROR_IRQ and HV_ERROR_IRQ are non-maskable interrupts.

10.4 SPI Host Interface

10.4.1 Physical Host Interface

The interface of the PN5180 to a host microcontroller is based on a SPI interface, extended by signal line BUSY. The maximum SPI speed is 7 Mbps and fixed to CPOL = 0 and CPHA = 0. Only a half duplex data transfer is supported. There is no chaining allowed, meaning that the whole instruction has to be sent or the whole receive buffer has to be read out. The whole transmit buffer has to be written at once as well. No NSS assertion is allowed during data transfer. As the MISO line is per default high-ohmic in case of NSS high, an internal pull-up resistor can be enabled via EEPROM. The BUSY signal is used to indicate the PN5180 is not able to send or receive data over the SPI interface. The host interface is designed to support the typical interface supply voltages of 1.8 V and 3.3 V of today’s CPU’s. A dedicated supply input which defines the host interface supply voltage independent from other supplies is available (PVDD). Note that only a voltage of

• Master In Slave Out (MISO) The MISO line is configured as an output in a slave device. It is used to transfer data from the slave to the master, with the most significant bit sent first. The MISO signal is put into tri-state mode when NSS is high.
• Master Out Slave In (MOSI) The MOSI line is configured as an input in a slave device. It is used to transfer data from the master to a slave, with the most significant bit sent first.
• Serial Clock (SCK) The serial clock is used to synchronize data movement both in and out of the device through its MOSI and MISO lines.
• Not Slave Select (NSS) The slave select input line is used to select a slave device. It has to be low before any data transaction and must stay low of the duration of the transaction. The NSS line on the master side must be tied high.
• Busy During frame reception the BUSY line will go ACTIVE and will go to IDLE when PN5180 is able to receive a new frame or data is available (depending if SET or GET frame is issued). In case of a parameter error, the IRQ will be set to ACTIVE and a GENERAL_ERROR_IRQ is set.

Rev. 2.2 — 17 December 2015 240922 15 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Both master and slave devices must operate with the same timing. The master device always places data on the MOSI line a half cycle before the clock edge SCK, in order for the slave device to latch the data. The BUSY line is used to indicate if the system is BUSY and cannot receive any data from a host. Recommendation for the BUSY line handling by the host: 1. Assert NSS to Low 2. Perform Data Exchange 3. Wait until BUSY is high 4. Deassert NSS 5. Wait until BUSY is low

10.4.2 Timing Specification SPI

The timing condition for SPI interface is as follows: Fig 6. Read RX of SPI data using BUSY line Fig 7. Fig 8. aaa-011438 Set_RegMOSI MISO BUSY (idle low) FF Get_Reg FF FF (data ignored) Rsp Get_Reg aaa-018979 SET instruction SET instruction 0xFF... Host TX Host RX BUSY 0xFF... aaa-018980 GET instruction ignored 0xFF... Host TX Host RX BUSY Response of GET instruction

Rev. 2.2 — 17 December 2015 240922 16 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Remark: To send more bytes in one data stream the NSS signal must be LOW during the send process. To send more than one data stream the NSS signal must be HIGH between each data stream. Any data available to be read from the SPI interface is indicated by the BUSY signal de-asserted.

10.4.3 Logical Host Interface

10.4.3.1 Host Interface Command

A Host Interface Command consists of either 1 or 2 SPI frames depending if the host wants to write or read data from the PN5180. An SPI Frame consists of multiple bytes. The protocol used between the host and the PN5180 uses 1 byte indicating the instruction code and additional bytes for the payload (instruction-specific data). The actual payload size depends on the instruction used. The minimum length of the payload is 1 byte. This provides a constant offset at which message data begins. All commands are packed into one SPI Frame. An SPI Frame consists of multiple bytes. No NSS toggles allowed during sending of an SPI frame. For all 4 byte command parameter transfers (e.g. register values), The payload parameters passed follow the little endian approach (Least Significant Byte first). Direct Instructions are built of a command code (1 Byte) and the instruction parameters (max. 260 bytes). The actual payload size depends on the instruction used. Responses to direct instructions contain only a payload field (no header). All instructions are bound to conditions. If at least one of the conditions is not fulfilled, an exception is raised. In case of an exception, the IRQ line of PN5180 is asserted and corresponding interrupt status register contain information on the exception. Fig 9. Connection to host with SPI aaa-016093 tSCKLtNSSH tSCKH tSCKL tsu(D-SCKH) th(SCKH-D) th(SCKL-Q) t(SCKL-NSSH) SCK MOSI MISO MSB MSB LSB LSB NSS

Rev. 2.2 — 17 December 2015 240922 17 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

10.4.3.2 RF Buffer

Two buffers are implemented in the PN5180. The RF transmission buffer has a buffer size of 260 bytes, the RF reception buffer has a size of 508 bytes. They buffer the input and output data streams between the host and the internal state machine / contactless UART of the PN5180. Thus, it is possible to handle data streams with lengths of up to 260 bytes for RF transmission and up to 508 bytes for RF reception without taking timing constraints into account.

10.4.3.3 Host Interface Command List

Table 5. 1-Byte Direct Commands and Direct Command Codes

Description

WRITE_REGISTER 0x00 Write o ne 32bit register value WRITE_REGISTER_OR_MASK 0x01 Sets one 32bit register value using a 32 bit OR mask WRITE_REGISTER_AND_MASK 0x02 Sets one 32bit register value using a 32 bit AND mask WRITE_REGISTER_MULTIPLE 0x03 Processes an array of re gister addresses in random order and performs the defined action on these addresses. READ_REGISTER 0x04 Reads one 32bit register value READ_REGISTER_MULTIPLE 0x05 Reads from an array of max.18 register addresses in random order WRITE_EEPROM 0x06 Processes an array of EEPROM addresses in random order and writes the value to these addresses READ_EEPROM 0x07 Processes an array of EEPROM addresses from a start address and reads the values from these addresses WRITE_TX_DATA 0x08 This instruction is used to write data into the transmission buffer SEND_DATA 0x09 This instruction is used to write data into the transmission buffer, the START_SEND bit is automatically set. READ_DATA 0x0A This instruction is used to read data from reception buffer, after successful reception. SWITCH_MODE 0x0B This instruction is used to swit ch the mode. It is only possible to switch from NormalMode to Standby, LPCD or Autocoll. MIFARE_AUTHENTICATE 0x0C This instruction is us ed to perform a MIFARE Classic Authentication on an activated card. EPC_INVENTORY 0x0D This instruction is used to perform an inventory of ISO18000-3M3 tags. EPC_RESUME_INVENTORY 0x0E This instruction is used to resume the inventory algorithm in case it is paused. EPC_RETRIEVE_INVENTORY_R ESULT_SIZE 0x0F This instruction is used to retrie ve the size of the inventory result. EPC_RETRIEVE_INVENTORY_R ESULT 0x10 This instruction is used to re trieve the result of a preceding EPC_INVENTORY or EPC_RESUME_INVENTORY instruction. LOAD_RF_CONFIG 0x11 This instruction is used to load the RF configuration from EEPROM into the configuration registers. UPDATE_RF_CONFIG 0x12 This inst ruction is used to update the RF configuration within EEPROM. RETRIEVE_RF_CONFIG_SIZE 0x13 This instruction is used to retrieve the number of registers for a selected RF configuration RETRIEVE_RF_CONFIG 0x14 This instruction is used to read out an RF configuration. The register address-value-pairs are available in the response RF_ON 0x16 This instruction switch on the RF Field

Rev. 2.2 — 17 December 2015 240922 18 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution The following direct instructions are supported on the Host Interface: Detail Description of the instruction WRITE_REGISTER Description: This command is used to write a 32-bit value (little endian) to a configuration register. Condition: The address of the register must exist. WRITE_REGISTER_OR_MASK Description: This command modifies the content of a register using a logical OR operation. The content of the register is read and a logical OR operation is performed with the provided mask. The modified content is written back to the register. Condition: The address of the register must exist. RF_OFF 0x17 This instruction switch off the RF Field ENABLE_TESTBUS_DIGITAL 0x18 Enab les the Digital test bus ENABLE_TESTBUS_ANALOG 0x19 Enables the Analog test bus Table 6. WRITE_REGISTER

4 Register content

Table 7. WRITE_REGISTER

4 OR_MASK

mask. The modified content is written back to the register. The address of the register must exist. This instruction allows to process actions on multiple addresses with a single command. address, an individual ACTION can be defined. Parameter value is either the REGISTER_DATA, the OR MASK or the AND_MASK.

• 0x01 WRITE_REGISTER
• 0x02 WRITE_REGISTER_OR_MASK
• 0x03 WRITE_REGISTER_AND_MASK Note: In case of an exception the operation is not rolled-back, i.e. registers which have been modified until exception occurs remain in modified state. Host has to take proper actions to recover to a defined state. Condition:

Table 8. WRITE_RE GISTER_AND_MAKSK Table 9. WRITE_REGISTER_MULTIPLE

The address of the registers must exist. register is returned in the 4 byte response. The address of the register must exist. addresses within the command parameter. range from 1 – 18, inclusive. Table 10. READ_REGISTER Table 11. READ_REGISTER_MULTIPLE

‘EEPROM Address’. The data is written in sequential order. must not go beyond EEPROM address 254. go beyond EEPROM address 254. Table 12. WRITE_EEPROM Table 13. READ_EEPROM

1 Length Number of bytes to read from EEPROM

by configuring the corresponding registers. inclusive. The command must not be called during an ongoing RF transmission. This command writes data to the RF transmission buffer and starts the RF transmission. just starts the transmission but does not wait for end of transmission. Table 14. WRITE_DATA Table 15. SEND_DATA Table 16. Coding of ‘valid bits in last byte’

0 All bits of last byte are transmitted

1-7 Number of bits within last byte to be transmitted.

with ‘Transceive’ command set. bytes to be read via the SPI interface. reception buffer is invalid. this instruction. The modes Standby, LPCD and Autocoll terminate on specific conditions. Table 17. READ_DATA Table 18. SWITCH_MODE

Rev. 2.2 — 17 December 2015 240922 24 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Parameter ‘mode’ has to be in the range from 0 to– 2, inclusive. Dependent on the selected mode, different parameters have to be passed: In case parameter ‘mode’ is set to 0 (Standby): Field ‘Wake-up Control’ must contain a bit mask indicating the enabled wake-up sources and if GPO is to be used. Field ‘Wake-up Counter Value’ must contain the value used for the wake-up counter (= time PN5180 will remain in standby). The value shall be in the range from 1 – 2690, inclusive. The field has to be present, even if wake-up counter is not defined as wake-up source. In this case the field ‘wake-up Counter value’ is ignored. No instructions must be sent while being in this mode. Termination is indicated using an interrupt. In case field ‘Mode’ is set to 1 (LPCD): Field ‘Wake-up Counter Value’ () defines the period between two LPCD attempts (=time PN5180 will remain in standby) as has to be in the range from 1 to 2690, inclusive. No instructions must be sent while being in this mode. Termination is indicated using an interrupt. In case field ‘Mode’ is set to 2 (Autocoll): Field ‘RF Technologies’ must contain a bit mask indicating the RF Technologies to support during Autocoll, according to Field ‘Autocoll Mode’ must be in the range from 0 to 2, inclusive. No instructions must be sent while being in this mode. Termination is indicated using an interrupt. Table 19. Parameter Length (byte) Value/Description Wake-up Control 1 Bit mask contro lling the wake-up source to be used and GPO handling. Wake-up Counter Value 2 Used value for wake-up counter in msecs. Maximum supported value is 2690 Table 20. b7 b6 b5 b4 b3 b2 b1 b1

000000 R F U

X Wake-up on external RF field, if bit is set to 1b. X Wake-up on wake-up counter expire, if bit is set to 1b. Table 21. Parameter Length (bytes) Value/Description Wake-up Counter Value 2 Used val ue for wake-up counter in msecs. Maximum supported value is 2690.

This command is used to perform a MIFARE Classic Authentication on an activated card. response contains one byte indicating the authentication status. Field ‘Key’ must be 6 bytes long. Field ‘Key Type’ must contain the value 0x60 or 0x61. card should be put into state ACTIVE or ACTIVE* prior to execution of this instruction. Wake-up Counter Value 2 Used val ue for wake-up counter in msecs. Maximum supported value is 2690.

2 Same as 1 but without entering standby

Table 24. MIFARE_AUTHENTICATE

1 Key type to be used:

1 Blockaddress: The address of the block for which the

authentication has to be performed.

4 UID of the card

guarantee the timings specified by this standard. Table 25. Authentication status return value 1 0 Authentication successful. 1 Authentication failed (permission denied). 2 Timeout waiting for card response (card not present). Table 26. EPC_INVENTORY PARAMETERS

0 No Select command is set prior to “BeginRound”

0 All bits of last byte of 'Select command' field are

a BeginRound command. CRC-16c shall not be included.

3 BeginRound: Contains the BeginRound command (according to

ISO18000-3). CRC-5 shall not be included.

1 Timeslot behavior

1 Response contains only one timeslot. valid card response, also the card handle is included.

• If this field is set to ‘0’ a NextSlot command is issued to handle the next time slot. This is repeated until the internal buffer is full
• If this field is set to 1 the algorithm pauses
• If this field is set to 2 a Req_Rn command is issued if, and only if, there has been a valid tag response in this timeslot Condition: EPC_RESUME_INVENTORY Description: This instruction is used to resume the inventory algorithm for the ISO18000-3M3 Inventory in case it is paused. This instruction has to be repeatedly called, as long as 'Response Size' field in EPC_RETRIEVE_INVENTORY_RESULT_SIZE is greater than 0. A typical sequence for a complete EPC GEN2 inventory retrieval is: 1. Execute EPC_INVENTORY to start the inventory 2. Execute EPC_RETRIEVE_INVENTORY_RESULT_SIZE 3. If size is 0, inventory has finished. 4. Otherwise, execute EPC _RETRIEVE_INVENTORY_RESULT 5. Execute EPC_RESUME_INVENTORY and proceed with step 2. Condition: Field 'RFU' must be present and can be set to any value. EPC_RETRIEVE_INVENTORY_RESULT_SIZE

Table 27. EPC_RESUME_INVENTORY PARAMETERS Table 28. EPC_RETRIEVE_INVEN TORY_RESULT PARAMETERS

results are available which means inventory algorithm has finished. Field 'RFU' must be present and can be set to any value. available in the response within 'Tag reply' field and 'Tag Handle' field, respectively. Field 'RFU' must be present and can be set to any value. Table 29. EPC_RETRIEVE_INVEN TORY_RESULT PARAMETERS If Response size == 0: Inventory has finished.

configuration) and transmitter (Transmitter configuration). the transmitter parameter is 0xFF, transmitter configuration is not changed. receiver parameter is 0xFF, the receiver configuration is not changed. Table 30. LOAD_RF_CONFIG PARAMETERS

1 Receiver configuration byte

Table 31. LOAD_RF_CONFIG: Selection of protocol register settings

00 ISO 14443-A / NFC PI-106 106 80 ISO 14443-A / NFC PI-106 106

01 ISO 14443-A 212 81 ISO 14443-A 212

02 ISO 14443-A 424 82 ISO 14443-A 424

03 ISO 14443-A 848 83 ISO 14443-A 848

04 ISO 14443-B 106 84 ISO 14443-B 106

05 ISO 14443-B 212 85 ISO 14443-B 212

06 ISO 14443-B 424 86 ISO 14443-B 424

07 ISO 14443-B 848 87 ISO 14443-B 848

08 Felica / NFC PI 212 212 88 Felica / NFC PI 212 212

09 Felica / NFC PI 424 424 89 Felica / NFC PI 212 424

The size of the array of ‘Configuration data’ must be in the range from 1 – 42, inclusive.

14 ISO 14443-A PICC 212 94 ISO 14443-A PICC 212

15 ISO 14443-A PICC 424 95 ISO 14443-A PICC 424

16 ISO 14443-A PICC 848 96 ISO 14443-A PICC 848

17 NFC Passive Target 212 97 NFC Passive Target 212

18 NFC Passive Target 424 98 NFC Passive Target 424

19 NFC Active Target 106 106 99 ISO 14443-A 106

Table 32. UPDATE_RF_CONFIG PARAMETERS 1 Register Address: Register Address within the given RF technology. 4 Register value: Value which has to be written into the register.

configuration. The size is available in the response to this instruction. RETRIEVE_RF_CONFIGURATION_SIZE has to be executed first. Table 33. RETRIEVE_RF_CONFIG_SIZE PARAMETERS registers has to be retrieved. Table 34. RETRIEVE_RF_CONFIG PARAMETERS registers has to be retrieved.

1 RegisterAddress: Address of the register to read

4 RegisterContent: Data of regist er addressed by this element

set after the field is switched on. is set after the field is switched off. selected. From the selected signal banks the test signals can be routed to different pads. Attention: Test bus must be enabled before in the EEPROM settings. asserted during data transmission when the test bus is enabled via the EEPROM setting. asserted and then perform the data exchange. Table 35. RF_ON Table 36. RF_OFF Table 37. ENABLE_TESTBUS_DIGITAL

This command enables the Analog test bus. Attention: Test bus must be enabled before in the EEPROM settings. asserted during data transmission when the test bus is enabled via the EEPROM setting. asserted and then perform the data exchange.

10.5 Memories

10.5.1 Overview

The PN5180 implements two different memories: EEPROM, RAM for buffers. the registers defining the RF behavior. Table 38. TB_POS Table 39. ENABLE_TESTBUS_ANALOG

1 DAC output to AUX1

10.5.2 EEPROM

(Buffers) will not keep any data stored in this volatile memory. The EEPROM address range is from 0x00 to 0xFF. configuration and RF settings for fast configuration. Table 40. EEPROM Addresses

13.56 MHz Crystal is not used

00 Use EEPROM value of

01 Use on begin of an LPCD a measurement cycle for

value of CHECK_CARD_RESULT for reference value.

10.5.3 RAM

0x7D DPC_THRSH_LOW RW 2 Defines the AGC low threshold for initial gear. 8:11 are not taken into account. 0x91 DPC_GUARD_FAST_MODE RW 2 Guard time after AGC fast mode has been triggered.

10.5.4 Register

done by the command LOAD_RF_CONFIG.

10.6 Debug Signals

10.6.1 General functionality

SET_DIGITAL_TESTOUT and SET_ANALOG_TESTOUT.

10.6.2 Digital Debug Configuration

parameters are passed within this command. signal can be selected for output on a pin of the PN5180 (4 bits). 8 on this position selects the 13.56 MHz clock to be put out on the selected pin. The high nibble of parameter 2 (1 byte) selects the output pin for the selected test signal. Table 41. Debug Signal Group Selection

01 Clock signal group

30 Cardmode protocol group

58 Transceive group

70 Receiver data transfer group

73 Receiver error group

10.6.2.1 Debug signal groups

Table 42. Clock Signal Group

7 CLIF clock reset

6 Signal indicating the PLL is locked

5 Signal indicating an external Field is present

Table 43. Transmitter Encoder Group

1 Output TX envelope

0 Tx-IRQ

Table 44. Timer Group

7 Running flag of timer T0

6 Expiration flag of timer T0

5 Running flag of timer T1

4 Expiration flag of timer T1

3 Running flag of timer T2

2 Expiration flag of timer T2

Table 45. Cardmode Protocol Group

7 Synchronized clock-fail signal

6 Flag indicating that ISO/IEC14443-Type A (Miller) was detected

5 Flag indicating that FeliCa 212 kBd (Manchester) was detected

4 Flag indicating that FeliCa 424 kBd (Manchester) was detected

3 Flag indicating that ISO/IEC14443-Type B (NRZ) was detected

2 Flag indicating that the EOF was detected

1 CM data signal (Miller / Manchester / NRZ)

0 Signal indicating that the current data is valid

Table 46. Transceive Group

7 Signal indicating that the tx prefetch was completed

6 Signal initiating a tx prefetch at the BufferManager

5 Start of transmission signal to TxEncoder

2 Transceive state2

1 Transceive state1

0 Transceive state0

Table 47. Receiver Data Transfer Group

7 Signal from SigPro indicating a collision

6 Signal from SigPro indicating end of data

5 Signal from SigPro indicating that data is valid

4 Signal from SigPro indicating received data

3 Status signal set by rx_start, ends when RX is completely over

2 Status signal indicating actual reception of data

1 Reset signal for receiver chain (at start of RX)

0 Internal RxDec bitclk

Table 48. Receiver Error Group

7 Combination of data/protocol error and collision

Table 45. Cardmode Protocol …continued Group

10.6.2.2 Digital Debug Output Pin Configuration

10.6.3 Analog Debug Configuration

For the output of an analog debug signal, two pins are available, BUSY and AUX2.

10.7 AUX2 / DWL_REQ

10.7.1 Firmware update

The PN5180 offers the possibility to upgrade the internal Firmware. AUX2/DWL_REQ pin during start-up is high, the PN5180 enters the download mode. mode and the pin can be used for general debug purpose.

6 Set if RxMultiple is set, and the LEN byte indicates more than 28 bytes

2 Set if a collision has been detected

1 Protocol error flag

0 Data integrity error flag (Parity, CRC (Collision))

Table 49. Debug Signal Output Pin Configuration

1 GPO (38)

3 AUX1 (40)

0 Analog output of value defined in register DAC_VALUE

1 Receiver Q-channel signal; depending on SIGPRO_IN_SEL

2 Receiver I-channel signal; depending on SIGPRO_IN_SEL either

3 Filtered Q-channel signal (rect-filter)

4 Filtered I-channel signal (rect-filter)

10.7.2 Firmware update command set

firmware. The physical SPI host interface is used for download of a new firmware image. installed on the PN5180 is not possible.

10.8 RF Functionality

10.8.1 Supported RF Protocols

10.8.1.1 ISO/IEC14443 A/MIFARE functionality

The physical level of the communication is shown in Figure 10. The physical parameters are described in Table 51. Table 51. Communication overview for ISO/IEC 14443 A/MIFARE reader/writer

The internal CRC coprocessor calculates the CRC value based on the selected protocol. Table 51. Communication overview for ISO/IEC 14443 A/MIFARE reader/writer …continued

10.8.1.2 ISO/IEC14443 B functionality

The physical level of the communication is shown in Figure 12. The physical parameters are described in Table 52. The PN5180 requires the host to manage the ISO/IEC 14443 B protocol.

10.8.1.3 FeliCa RF functionality

the FeliCa specification. The communication on a physical level is shown in Figure 13. The physical parameters are described in Table 53. Table 52. Communication overview for ISO/IEC 14443 B reader/writer

1. PICC to PCD, > Loadmodulation

The PN5180 needs to be connected to a host which implements the FeliCa protocol. combination with the transceive state machine. allowed per frame is limited to 28. the length byte). All unused bits (RFU) are masked to 0. Table 53. Communication for FeliCa reader/writer

1. Correct reception - Data integrity is correct (no CRC error), and additionally the number
2. Erroneous reception - Data is incorrect (data integrity error - CRC wrong) but frame
3. Erroneous reception - the length byte received indicates a frame length greater than 28.

No data is copied to buffer but status byte with LenError bit set is written.

1. Erroneous reception - the length byte is larger than the number of data bytes, which

the number of received frames. RX_NUM_FRAMES_RECEIVED is cleared.

10.8.1.4 ISO/IEC15693 functionality

The physical parameters are described below. Table 54. Communication for ISO/IEC 15693 reader/writer “reader to card”

[1] Fast inventory (page) read command only (ICODE proprietary command).

10.8.1.5 ISO/IEC18000-3 Mode 3 functionality

explanation of the protocol, refer to the ISO/IEC 18000-3 standard. Table 55. Communication for ISO/IEC 15693 reader/writer “card to reader”

Rev. 2.2 — 17 December 2015 240922 47 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Fig 15. EPC GEN2 Inventory command card detected no Card detected no yes no yes and correct PC/XPC received aaa-017294 EPC_INVENTORY received Send NextTimeSlot EPC_RESUME_INVENTORY received BeginRound command Perform Card Check Card Check Error Correct PC/XPC received Store information in the RX buffer GetHandleFunction SelectCommand wait t4 timesend_tx_buffer bit Only one timeslot Rx buffer fullGetHandle Set Rx_IRQ FINISH State yes no no yes

Rev. 2.2 — 17 December 2015 240922 48 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Fig 16. EPC_GEN2 Card presence check Fig 17. Get Handle Fig 18. Timeslot order EPC Gen2 RX IRQ and no error RX IRQ and error RX IRQ and collision Timer 1 IRQ Timer 1 IRQ Timer 1 IRQ aaa-017295 ACK CardCheck entry WAIT T2 CRC16+CRC5 Rx IRQ and no collision NACK PC/XPC CardCheck EXIT Card Detected - Store PC/XPC CardCheck EXIT ACK collison CardCheck EXIT ACK timeout CardCheck EXIT Collison Error CardCheck EXIT No Card detected RX IRQ and no error RX IRQ and error or Timer 1 lRQ aaa-017296 ReqRN GetHandleFunction START GetHandleFunction EXIT Collision or Recepion Error RX IRQ Handle GetHandleFunction EXIT Store handle, RX_IRQ aaa-017297 timeslot 0 timeslot 1 timeslot ...

Rev. 2.2 — 17 December 2015 240922 49 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

10.8.1.6 NFCIP-1 modes

Overview: The NFCIP-1 communication differentiates between an Active and a Passive Communication Mode.

• Active Communication mode means both the initiator and the target are using their own RF field to transmit data.
• Passive Communication mode means that the target answers to an initiator command in a load modulation scheme. The initiator is active in terms of generating the RF field.
• Initiator: Generates RF field at 13.56 MHz and starts the NFCIP-1 communication.
• Target: responds to initiator command either in a load modulation scheme in Passive Communication mode or using a self-generated and self-modulated RF field for Active Communication mode. In order to fully support the NFCIP-1 standard the PN5180 supports the Active and Passive Communication mode at the transfer speeds 106 kbit/s, 212 kbit/s and 424 kbit/s as defined in the NFCIP-1 standard. Fig 19. EPC GEN2 possible timeslot answers aaa-017298 status 0x00 Tag Reply length Valid bits in last byte status 0x01 Tag Reply length Valid bits in last byte 1 byte 1 byte 1 byte n bytes (defined in Tag Reply Length) 1 byte status 0x02 status 0x03 Tag response available NO TagHandle Tag response available TagHandle available No Tag replied Two or more tags replied 1 byte 1 byte 1 byte 1 byte 2 bytes n bytes (defined in TagReply Length) Tag Reply Tag handle possible timeslot answers Tag Reply

the target are using their own RF field to transmit data. A dedicated host controller firmware is required to handle the NFCIP-1 protocol. Table 56. Communication overview for active communication mode

1. initiator starts communication at

(powered) to generate the RF field. A dedicated host controller firmware is required to handle the NFCIP-1 protocol. Note: Transfer Speeds above 424 kbit/s are not defined in the NFCIP-1 standard. document. The PN5180 does not implement any of the high-level protocol functions.

• Speed shall not be changed while continuous data exchange in a transaction.
• Transaction includes initialization, anticollision methods and data exchange (in continuous way, meaning no interruption by another transaction). In order not to disturb current infrastructure based on 13.56 MHz, the following general rules to start an NFCIP-1 communication are defined: 1. Per default an NFCIP-1 device is in Target mode - meaning its RF field is switched off. 2. The RF level detector is active. 3. Only if it is required by the applicatio n the NFCIP-1 device shall switch to Initiator mode. Fig 21. Passive communication mode

Table 57. Communication overview for passive communication mode

1. initiator starts communication

Rev. 2.2 — 17 December 2015 240922 52 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 4. An initiator shall only switch on its RF field if no external RF field is detected by the RF Level detector during a time of TIDT. 5. The initiator performs initialization according to the selected mode.

10.8.1.7 ISO/IEC14443 A Card operation mode

PN5180 can be configured to act as an ISO/IEC 14443 A compliant card. This means that PN5180 can generate an answer in a load modulation scheme according to the ISO/IEC 14443 A interface description. Note: PN5180 does not support a complete card protocol. This has to be handled by a connected host controller. Nevertheless, the layer3 type A activation is handled by the NFC frontend. The Card Activated IRQ shall be enabled and notifies if a card activation had been successfully performed. The supports ISO/IEC14443 A card mode for data rates 106, 212, 424 and 848 kbit/s.

10.8.1.8 NFC Configuration

The NFC protocol for the 106 kbps mode defines an additional Sync-Byte (0xF0 + parity) after the normal start bit had been transmitted. As this Sync-Byte includes a parity bit, it can be handled by a host firmware as a normal data byte.

10.8.1.9 Mode Detector

The Mode Detector is a functional block of the PN5180in PICC mode which senses for an RF field generated by another device. The mode detector allows to distinguish between type A and FeliCa target mode. Dependent on the recognized protocol generated by an initiator peer device the host is able to react. Note that the PN5180 is able to emulate type A cards and peer to peer active target modes according to ISO/IEC18092.

10.8.2 RF-field handling

The NFC frontend supports generation of a RF-field dependent on external conditions like presence of another NFC device generating an RF field. A flexible mechanism to control the RF field is available. After power-up, the RF-field is off. The instruction RF_ON enables the generation of a RF-field. The NFC frontend can perform an initial RF collision avoidance according to ISO/IEC18092. Before enabling the RF-field, a field detection is automatically enabled for the period TIDT. In case an external field is detected, the field is not switched on and an RF_ACTIVE_ERROR_IRQ is raised. The cause for the error can be examined in the RF_STATUS_REG. In order to switch off the RF-field generation, the RF_OFF instruction needs to be sent. Active Mode is supported by configuring the RF_ON instruction.

10.8.3 Transmitter TX

The transmitter is able to drive an antenna circuit connected to outputs TX1 and TX2 with a 13.56 MHz carrier signal. The signal delivered on pins TX1 and pin TX2 is the 13.56 MHz carrier modulated by an envelope signal for energy and data transmission. It can be used to drive an antenna directly, using a few passive components for matching and filtering. For a differential antenna configuration either TX1 or TX2 can be configured

protocols as defined by standards ISO/IEC14443 A and B, FeliCa and ISO/IEC18092. basic behavior during modulation cannot be configured independently for TX1 and TX2. loop is implemented to keep the modulation degree as constant as possible. Table 58. Settings for TX1 and TX2

000 High impedance -

110 RF high side push Open-drain, only high side (push) MOS

101 RF low side pull Open-drain, only low side (pull) MOS

10.8.3.3 TX Wait

restarted because of an EMD-event or in case the RX_MULTIPLE_ENABLE bit is set to 1. Table 59. Modulation degree configuration

Rev. 2.2 — 17 December 2015 240922 55 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution In case the register flag TX_WAIT_RFON_ENABLE is set to 1 the guard time counter is started when the devices own RF-Field is switched on. To start a transmission, it is always necessary for the firmware to set the START_SEND bit in the SYSTEM_CONFIG register or sending the instruction SEND_DATA. Having said that it is possible to disable the guard time tx_wait by setting the register TX_WAIT_CONFIG to 00h. Tx_wait can be used for 2 different purposes: On the one hand, it can be used to prevent start of transmission before a certain period has expired - even if FW already finished data processing and set the START_SEND bit. This behavior is mainly intended for reader mode to guaranteed PICC to PCD frame delay time (FDT). On the other hand, the tx_wait time can be used to start the transmission at an exactly defined time. For this purpose data to be sent must be available and the START_SEND flag has to be set by FW before the period expires. In case the START_SEND bit is not set when tx_wait expires and MILLER_SYNC_ENABLE is set the transmission will be started on the bit-grid.

10.8.3.4 Over- and Undershoot prevention

The over- and undershoot protection allows to configure additional signals on the Transmitter output which allows to control the signal shaping of the antenna output. The registers TX_OVERSHOOT_CONFIG_REG and TX_UNDERSHOOT_CONFIG_REG are used to configure the over-and undershoot protection. Additionally, in register RF_CONTROL_TX_CLK (bit TX_CLK_MODE_OVUN_PREV) it is defined which TX clock mode for the period the overshoot/undershoot prevention is active, and RF_CONTROL_TX (bit TX_RESIDUAL_CARRIER_OV_PREV) defines the value for the residual carrier for the period the overshoot prevention pattern is active. Example with overshoot pattern ‘1100’ (binary) with a length of four and undershoot pattern ‘001’ (binary) with a length of three. Fig 23. Overshoot/Undershoot prevention aaa-009147 clk13 env_gen_outstream tx_outstream delay overshoot protection delay undershoot protection

Rev. 2.2 — 17 December 2015 240922 56 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

10.8.4 Dynamic Power Control (DPC)

The Dynamic Power Control allows to adjust the RF output current dependent on the loading condition of the antenna. A lookup table is used to configure the output voltage and by this control the transmitter current. In addition to the control of the transmitter current, wave shaping settings can be controlled as well dependent on the selected protocol and the measured antenna load. The PN5180 allows to measure periodically the RX voltage. The RX voltage is used as indicator for the actual antenna current. The voltage measurement is done with the help of the AGC. The time interval between two measurements can be configured with the OC_TIME byte in the EEPROM. The AGC value is compared to a maximum and minimum threshold value which is stored in EEPROM. If the AGC value is exceeding one of the thresholds, a new gear configuring another transmitter supply driver voltage will be activated. The number of gears - and by these transmitter supply voltage configurations - can be defined by the application, up to 15 gears are available. Fig 24. Lookup tables for AGC value dependent dynamic configuration PWR LUT ENTRY 1 DPC_AGC_GEAR_LUT PCD_SHAPING_LUT PWR LUT ENTRY 2 PWR LUT ENTRY 3 PWR LUT ENTRY 4 PWR LUT ENTRY 5 PWR LUT ENTRY X CONFIGURED PROTOCOL GEARAGC VALUE DPC_THRSH_HIGH DPC_THRISH_LOW SHAPING LUT ENTRY 1 SHAPING LUT ENTRY 2 SHAPING LUT ENTRY 2 SHAPING LUT ENTRY Z aaa-019796

10.8.5 Adaptive Waveform Control (AWC)

stored in a lookup table located in EEPROM, and selected dependent on the actual gear. dependent on the different protocols. TAU_MODE_FALLING, TAU_MODE_RISING and TX_RESIDUAL_CARRIER. Table 60. Wave shaping lookup table

10.8.6 Transceive state machine

data dependent on the conditions of the interface. command is set to transceive. The transceive command does not terminate automatically. SYSTEM_CONFIG.command to IDLE.

Rev. 2.2 — 17 December 2015 240922 59 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution START_SEND can either be triggered by writing to the SYSTEM_CONFIG register start_send or by using the command SET_INSTR_SEND_DATA. Fig 26. Transceive state machine aaa-020626 Initator Tx_skip_send_ enable* Tx_frame_step_ enable All bytes transmitted WAIT_RECEIVE (start RX_WAIT timer) WAIT_FOR_DATA (check for reception) WAIT_TRANSMIT (start TX_WAIT timer) START_SEND TRANSMIT (RF transmission is started) no no Tx-wait timer elapsed yes no yes Transmission done IDLE mode Command set to transceive yes no yes yes RX_wait timer elapsed RECEIVE (RF reception is started) Reception started Reception done no

Rev. 2.2 — 17 December 2015 240922 60 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

10.8.7 Autocoll

The Autocoll state machine performs the time critical activation for Type-A PICC and for NFC-Forum Active and Passive Target activation. The PICC state machine supports three configurations:

• Autocoll mode0: Autocoll mode is left when no RF field is present
• Autocoll mode1: Autocoll mode is left when one technology is activated by an external reader. During RFoff the chip enters standby mode automatically
• Autocoll mode2: Autocoll mode is left when one technology is activated by an external reader. During RFoff the chip does not enter standby mode. At start-up the Autocoll state machine automatically performs a LOAD_RF_CONFIG with the General Target Mode Settings. When a technology is detected during activation the Autocoll state machine performs an additional LOAD_RF_CONFIG with the corresponding technology. The card configuration for the activation is stored in EEPROM. If RandomUID is enabled, a random UID is generated after each RFoff. For all active target modes, the own RF field is automatically switched on after the initiator has switched off its own filed.

Rev. 2.2 — 17 December 2015 240922 61 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

10.8.8 Receiver RX

10.8.8.1 Reader Mode Receiver

In Reader Mode the response of the PICC device is coupled from the PCB antenna to the differential input RXP/RXN. The Reader Mode Receiver extracts this signal by first removing the carrier in passive mixers (direct conversion for I and Q), then filtering and amplifying the baseband signal, and finally converting to digital values with 2 separate ADC’s for I and Q channel. Both the I and Q channels have a differential structure which improves the signal quality. Fig 27. Autocall state machine aaa-020625 ReqA/WupA no no no Passive Target A enabled? IDLE READYREADY* Send SensF response Frame received entry HALT Yes and Autocoll_state_a == HALT Yes and Autocoll_state_a == IDLE ISO14443-3A PICC state machine ACTIVE Passive Target A106 IRQ line is asserted Load Protocol PICC-A106 done RX_IRQ and CARD_ACTIVATED_IRQ are set Passive Target F212/424* IRQ line is asserted Load Protocol PICC-F212 or PICC-F424 done RX_IRQ and CARD_ACTIVATED_IRQ are set *the determined baudrate can be found in the SIGPRO_CONFIG register ** Autocoll_state_a is defined in the register SYSTEM_CONFIG Active Target A106/F212/F424* IRQ line is asserted Load Protocol AT106/AT212/ AT424 done RX_IRQ is set ACTIVE* yes SensF received and Passive Target F enabled SC = 0xFFFF or EE-Value yes yes SensFReq received any other frame received Any CL Error Frame received and no error Active Mode enabled yes no no

Rev. 2.2 — 17 December 2015 240922 62 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution The I/Q-Mixer mixes the differential input RF-signal down to the baseband. The mixer has a band with of 2 MHz. The down mixed differential RX input signals are passed to the BBA and band-pass filtered. In order to consider all the various protocols (Type A/B, FeliCa), the high-pass cut-off frequency of BBA can be configured between 45 kHz and 250 kHz in 4 different steps. The low-pass cut-off frequency is above 2 MHz. This band-passed signal is then further amplified with a gain factor which is configurable between 30 dB and 60 dB. The baseband amplifier (BBA)/ADC I- and Q- channel can be enabled separately. This is required for ADC-based CardMode functionality as only the I-channel is used in this case. The gain and high pass corner frequency of the BBA are not independent from each other: Table 61. Gain setting hpcf setting HPCF (kHz) LPCF (MHz) Gain(sB20) Band width (MHz) Gain3 0 39 3.1 60 3.1 1 78 3.2 59 3.1 21 4 4 3 . 5 5 8 3 . 3 32 6 0 4 . 1 5 6 3 . 8 Gain2 0 42 3.1 51 3.1 1 82 3.3 51 3.2 21 5 0 3 . 7 4 9 3 . 5 32 7 1 4 . 3 4 7 4 . 0 Gain1 0 41 3.7 43 3.7 1 82 4.0 42 3.9 21 5 1 4 . 5 4 1 4 . 3 32 7 6 5 . 5 3 9 5 . 2 Gain0 0 42 3.8 35 3.8 1 84 4.1 34 4.0 21 5 4 4 . 7 3 3 4 . 5 32 8 1 5 . 7 3 1 5 . 4

Rev. 2.2 — 17 December 2015 240922 63 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

10.8.8.2 VMID

The input voltage for PIN Vmid is generated by a resistive divider between AVDD and GND. The resistive divider is connected to the VMID pin, an external blocking capacitor shall be placed there.

10.8.8.3 Automatic Gain Control

The Automatic Gain Control (AGC) of the receiver is used to control the amplitude of the received 13.56 MHz input sine-wave signal from the antenna (input pins RXP and RXN). It is desirable to achieve an input voltage in the range of 1.5 V to 1.65 V at the pins RXP, RXN. For symmetric antennas, the voltage levels are the same on the pins RXP, RXN. A voltage lower than 1.5 V lead to a low sensitivity of the receiver, a voltage level higher than 1.65 V could result in clipping of the received signal. Both conditions should be avoided for optimum performance of the IC. An antenna detuning of a card result in an RX input level which is outside of the desired input voltage range. Here the AGC helps to simplify the design and to keep the RX voltage as stable as possible even under dynamic changing antenna detuning conditions. Functional description: The peak of the input signal at RXP is regulated to be equal to a reference voltage (internally generated from the supply using a resistive divider). Two external resistors are connected to the RX inputs, the specific value of these resistors in a given design depends on the selected antenna and needs to be determined during development. This external resistor, together with an on-chip variable resistor connected to VMID, forms a resistive voltage divider for the signal processor input voltage. The resolution of the variable resistor is 10 bits. By varying the on-chip resistor, the amplitude of the input signal can be modified. The on-chip resistor value is increased or decreased depending on the output of the sampled comparator, until the peak of the input signal matches the reference voltage. The amplitude of the RX input is thus automatically controlled by the AGC circuit. The internal amplitude controlling resistor in the AGC has a default value of 10 kOhm typ DC coupled. (i.e. when the resistor control bits in AGC_VALUE_REG <9:0> are all 0, the resistance is 10 k). As the control bits are increased, resistors are switched in parallel to the 10k resistor thus lowering the combined resulting resistance value down to 20 OhmDC coupled (AGC_VALUE_REG <9:0>, all bits set to 1). Fig 28. PN5180 Receiver Block diagram aaa-008644 RXP VMID AGC BBA BBA MIX CLK I-CLK Q-CLK RXN DATA DATA

Rev. 2.2 — 17 December 2015 240922 64 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution

10.8.8.4 RX Wait

The guard time rx_wait is started after the end of a transmission. If the register flag RX_WAIT_RFON_ENABLE is set to 1 the guard time is started when the devices did switch off its own RF-Field and an external RF-Field was detected. The guard time rx_wait can be disabled by setting the register RX_WAIT_VALUE to 00h meaning the receiver is immediately enabled.

10.8.8.5 EMD Error handling

The PN5180 supports EMD handling according to the EMVCo standard. To support further extension the EMD block is configurable to allow adoption for further standard updates. The PN5180 supports automatically restart of the receiver and CLIF timer1 is restarted in case of an EMD event. The CLIF timer is selectable in the EMD_CONTROL register. An EMD event is generated:

• Independent of received number of bytes
• Any Residual bits and EMD_CONTROL.emd_transmission_error_above_noise = 0
• When the received number of bytes without CRC is <= EMD_CONTROL.emd_noise_bytes_threshold
• Independent of received number of bytes
• Any Residual bits and EMD_CONTROL.emd_transmission_error_above_noise = 0
• When the received number of bytes without CRC is <= EMD_CONTROL.emd_noise_bytes_threshold
• Missing CRC (1 byte frame) when EMD_CONTROL.emd_missing_crc_is_protocol_error_type_X = 0

10.8.9 Low-Power Card Detection (LPCD)

The low-power card detection is an energy saving configuration option for the PN5180. A low frequency oscillator (LFO) is implemented to drive a wake-up counter, waking-up PN5180 from standby mode. This allows implementation of low-power card detection polling loop at application level. The SWITCH_MODE instruction allows to enter the LPCD mode with a given standby duration value.

Rev. 2.2 — 17 December 2015 240922 65 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Before entering the LPCD mode, an LPCD reference value needs to be determined. Three options do exist for generating this reference value. The LPCD works in two phases: Fig 29. LPCD configuration aaa-020634 Wakeup_counter > 0x3FF Set wakeup_counter = 0x3FF LoadRF config Tx: A106 Rx: A106 yes Boot ReasonAny other Standby Mode left | Reference_value-actual_AGC| > LPCD_THRESHOLD FW command LP CD no no yes LPCD_GPO_REFVAL _CONTROL[1:0] == 10 LPCD_GPO_REFVAL _CONTROL[1:0] == 00 LPCD_GPO_REFVAL _CONTROL[1:0] == 01 Reference_value == LPCD_REFERENCE_ VALUE (EEProm@0x34) Reference_value == AGC_REF_CONFIG (register@0x26) Enter Standby with Wakeup from Wakeup Counter Wakeup counter Function Call RF_CHECKCARD(AGCRefVal=0) AutoCalibration - Measures the actual AGC value&Gear and use this as a reference Function Call RF_CHECKCARD(AGCRefVal == Reference_value) Switch on RF field and measure AGC SET IDLE_IRQ end state SET LPCD_IRQ end state

instruction), which defines the duration of the standby of the PN5180. (EEPROM configuration) and then the AGC value is compared to a reference value.

• If the AGC value exceeds the reference value, a LPCD_IRQ is raised to the host. The register configurations done by the host are not restored after wake-up. command. The host has to configure the NFC frontend for a dedicated protocol operation to allow a polling for a card.
• If the AGC value does not exceed the limit of the reference value, no LPC_IRQ is raised and the IC is set to the first phase (standby mode) again. As an additional feature the GPO1 (general-purpose output) pin can be toggled to wake-up an external LDO from power down for the TVDD supply. The GPO1 allows to be toggled before the transmitter is switched on. This allows the wake-up of an external LDO from power down. The GPO1 can be toggled after the RF field is switched off to set an external LDO into power down. The time of toggling the GPO in relation to the RF-on and RF-off timings can be configured. These two phases are executed in a loop until 1. Card / metal is detected (LPCD_IRQ is raised). 2. Reset occurs, which will rese t all the system configurations. The LPCD is also stopped in this case. 3. NSS on Host IF 4. RF Level Detected The behavior of the generated field is different dependent on the activation state of the DPC function:
• If the DPC feature is not active, the ISO/IEC14443 type A 106 kbit/s settings are used during the sensing time.
• If the DPC is active, the RF_ON command is executed. The RF field is switched on as soon as the timer configured by the SWITCH_MODE command elapses. The RF field is switched on for a duration as defined for an activated DPC. The timer for the LPCD_FIELD_ON_TIME starts to count as soon as the RF_ON command terminates.

Table 62. Low Power Card Detection: EEPROM configuration byte defines the delay multiplied by 8 in microseconds. against the current AGC value during the low-power card detection phase. greater than LPCD_THRESHOLD, the IC wakes up from LPCD.

10.8.9.1 Check Card register

that only the second phase - the detection phase is executed. switched on. The byte defines the time multiplied by 5 in microseconds. 1 byte: This value defines the time between field off and clearing GPO1. The byte defines the time multiplied by 5 in microseconds.

10.9 Register overview

10.9.1 Register overview

Table 63. Register address overview

10.9.2 Register description

Table 63. Register address overview …continued Table 64. SYSTEM_CONFIG register (address 0000h) bit description

9 AUTOCOLL_PICC_STATE R/W 0*,1 Defines the entry state of the PICC TypeA state

machine when Autocoll mode is entered 0.

8 SOFT_RESET W 0*,1 performs a reset of the device by writing a “1” into this

6 MFC_CRYPTO_ON R/W 0*,1 If set to 1, the mfc-crypto is enabled for

5 PRBS_TYPE R/W 0*,1 Defines the PR BS type; If set to 1, PRBS15 is

3 START_SEND R/W 0*,1 If set to 1, this will trigger the data transmission

000 IDLE/StopCom Command; stops all ongoing

001 RFU

010 RFU

011 Transceive command; initiates a transceive cycle.

100 KeepCommand command; This command does not

101 LoopBack command; This command is for test

same time enables the receiver.

110 RFU

111 RFU

Table 65. IRQ_ENABLE register (a ddress 0001h) bit description

17 TEMPSENS_ERROR_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the

16 RX_SC_DET_IRQ_EN R/W 0*, 1 Enable IR Q propagation to the pin for the RX

15 RX_SOF_DET_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RX SOF

14 RFU R/W 0*, 1 -

13 TIMER2_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer2

12 TIMER1_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer1

11 TIMER0_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer0

10 RF_ACTIVE_ERROR_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF active

9 TX_RFON_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field ON

8 TX_RFOFF_IRQ_EN R/W 0*, 1 Enable IRQ pr opagation to the pin for the RF Field

7 RFON_DET_IRQ_EN R/W 0*, 1 Enable IRQ propa gation to the pin for the RF Field ON

6 RFOFF_DETQ_IRQ_EN R/W 0*, 1 Enable IRQ pr opagation to the pin for the RF Field

5 STATE_CHANGE_IRQ_EN R/W 0*, 1 Enable IR Q propagation to the pin for the State

4 CARD_ACTIVATED_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin when PN5180 is

3 MODE_DETECTED_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin when PN5180 is

2 IDLE_IRQ_EN R/W 0*, 1 Enable IRQ prop agation to the pin for the IDLE mode

1 TX_IRQ_EN R/W 0*, 1 Enable IRQ prop agation to the pin for End of RF

0 RX_IRQ_EN R/W 0*, 1 Enable IRQ prop agation to the pin for End of RF

Table 66. IRQ_STATUS register (address 0002h) bit description

20 LPCD_IRQ_STAT R/W 0*, 1 Low-P ower Card Detection IRQ

19 HV_ERROR_IRQ_STAT R/W 0*, 1 EEPROM Failure during Programming IRQ

18 GENERAL_ERROR_IRQ_STAT R/W 0*, 1 General Error IRQ

17 TEMPSENS_ERROR_IRQ_STA

16 RX_SC_DET_IRQ_STAT R/W 0*, 1 RX Subcarrier Detection IRQ

15 RX_SOF_DET_IRQ_STAT R/W 0*, 1 RX SOF Detection IRQ

13 TIMER2_IRQ_STAT R/W 0*, 1 Timer2 IRQ

12 TIMER1_IRQ_STAT R/W 0*, 1 Timer1 IRQ

11 TIMER0_IRQ_STAT R/W 0*, 1 Timer0 IRQ

10 RF_ACTIVE_ERROR_IRQ_STA

9 TX_RFON_IRQ_STAT R/W 0*, 1 RF Field ON in PCD IRQ

8 TX_RFOFF_IRQ_STAT R/W 0*, 1 RF Field OFF in PCD IRQ

7 RFON_DET_IRQ_STAT R/W 0*, 1 RF Field ON detection IRQ

6 RFOFF_DET_IRQ_STAT R/W 0*, 1 RF Field OFF detection IRQ

5 STATE_CHANGE_IRQ_STAT R/W 0*, 1 State Change in the transceive state machine IRQ

4 CARD_ACTIVATED_IRQ_STAT R/W 0*, 1 Activated as a Card IRQ

3 MODE_DETECTED_IRQ_STAT R/W 0*, 1 External modulation scheme detection IRQ

2 IDLE_IRQ_STAT R/W 0*, 1 IDLE IRQ

1 TX_IRQ_STAT R/W 0*, 1 End of RF transmission IRQ

0 RX_IRQ_STAT R/W 0*, 1 End of RF reception IRQ

Table 67. IRQ_CLEAR register (a ddress 0003h) bit description

20 LPCD_IRQ_CLR R/W 0*, 1 Clear Low-Power Card Detection IRQ

19 HV_ERROR_IRQ_CLR R/W 0*, 1 Clear EEPR OM Failure during Programming IRQ

18 GENERAL_ERROR_IRQ_CLR R/W 0*, 1 Clear General Error IRQ

17 TEMPSENS_ERROR_IRQ_CLR R/W 0*, 1 Clear Temperature Sensor IRQ

16 RX_SC_DET_IRQ_STAT R/W 0*, 1 Clear RX Subcarrier Detection IRQ

15 RX_SOF_DET_IRQ_STAT R/W 0*, 1 Clear RX SOF Detection IRQ

13 TIMER2_IRQ_CLR R/W 0*, 1 Clear Timer2 IRQ

12 TIMER1_IRQ_CLR R/W 0*, 1 Clear Timer1 IRQ

11 TIMER0_IRQ_CLR R/W 0*, 1 Clear Timer0 IRQ

10 RF_ACTIVE_ERROR_IRQ_CLR R/W 0*, 1 Clear RF active error IRQ

9 TX_RFON_IRQ_CLR R/W 0*, 1 Clear RF Field ON in PCD IRQ

8 TX_RFOFF_IRQ_CLR R/W 0*, 1 Clear RF Field OFF in PCD IRQ

7 RFON_DET_IRQ_CLR R/W 0*, 1 Clear RF Field ON detection IRQ

6 RFOFF_DET_IRQ_CLR R/W 0*, 1 Clear RF Field OFF detection IRQ

5 STATE_CHANGE_IRQ_CLR R/W 0*, 1 Clear State Change in the transceive state machine

4 CARD_ACTIVATED_IRQ_CLR R/W 0*, 1 Clear Activated as a Card IRQ

3 MODE_DETECTED_IRQ_CLR R/W 0*, 1 Clear Ex ternal modulation scheme detection IRQ

2 IDLE_IRQ_CLR R/W 0*, 1 Clear IDLE IRQ

1 TX_IRQ_CLR R/W 0*, 1 Clear End of RF transmission IRQ

0 RX_IRQ_CLR R/W 0*, 1 Clear End of RF reception IRQ

Table 68. TRANSCEIVE_CONT ROL register (address 0004h) bit description If all bits are 0 no IRQ is triggered.

3 TX_SKIP_SEND_ENABLE R/W 0*, 1 If set, not tran smission is started after tx_wait is

2 TX_FRAMESTEP_ENABLE R/W 0*, 1 If set, at every start of transmission; each byte of data

1 RX_MULTIPLE_ENABLE R/W 0*, 1 If set, the receiver is reactivated after the end of a

containing all relevant status information of the frame. 0 INITIATOR R/W 0*, 1 If set, the CLIF is configured for initiator mode. Table 69. PINCONFIG register (address 0005h) bit description

7 EN_SLEW_RATE_CONTROL R/W 0*, 1 Enables slew rate control of digital pads

Table 70. PIN_OUT register (address 0007h) bit description Table 71. TIMER0_STATUS register (address 0008h) bit description

20 T0_RUNNING R 0*, 1 Indicates that timer T0 is running (busy)

Table 72. TIMER1_STATUS register (address 0009h) bit description

20 T1_RUNNING R 0*, 1 Indicates that timer T1 is running (busy)

Table 73. TIMER2_STATUS register (address 000Ah) bit description

20 T2_RUNNING R 0*, 1 Indicates that timer T2 is running (busy)

Table 74. TIMER0_RELOAD register (address 000Bh) bit description Reload value of the timer T0. Table 75. TIMER1_RELOAD register (address 000Ch) bit description Reload value of the timer T1.

Table 76. TIMER2_RELOAD register (address 000Dh) bit description Reload value of the timer T2. Table 77. TIMER0_CONFIG register (address 000Eh) bit description

20 T0_STOP_ON_RX_STARTED R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

protocol dependent and listed in the appendix.

19 T0_STOP_ON_TX_STARTED R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

when a data transmission begins.

18 T0_STOP_ON_RF_ON_EXT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

when the external RF field is detected.

17 T0_STOP_ON_RF_OFF_EXT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

when the external RF field vanishes.

16 T0_STOP_ON_RF_ON_INT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

when the internal RF field is turned on.

15 T0_STOP_ON_RF_OFF_INT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

when the internal RF field is turned off.

14 T0_START_ON_RX_STARTED R/W 0* T0_START_EVENT: If set; the timer T0 is started

when a data reception begins (first bit is received).

13 T0_START_ON_RX_ENDED R/W 0* T0_START_EVENT: If set; the timer T0 is started

12 T0_START_ON_TX_STARTED R/W 0* T0_START_EVEN T: If set; the timer T0 is started

when a data transmission begins.

11 T0_START_ON_TX_ENDED R/W 0* T0_START_EVENT : If set; the timer T0 is started

when a data transmission ends.

10 T0_START_ON_RF_ON_EXT R/W 0* T0_START_EVENT: If set; the timer T0 is started

when the external RF field is detected.

9 T0_START_ON_RF_OFF_EXT R/W 0* T0_START_EVEN T: If set; the timer T0 is started

when the external RF field is not detected any more.

8 T0_START_ON_RF_ON_INT R/W 0* T0_START_EVEN T: If set; the timer T0 is started

when an internal RF field is turned on.

7 T0_START_ON_RF_OFF_INT R/W 0* T0_START_EVENT: If set; the timer T0 is started

when an internal RF field is turned off.

6 T0_START_NOW R/W 0* T0_START_EVENT: If set; the timer T0 is started

(chosen by T0_PRESCALE_SEL). reload its preset value and continue counting down.

0 T0_ENABLE R/W 0* Enables the timer T0

Table 78. TIMER1_CONFIG register (address 000Fh) bit description

20 T1_STOP_ON_RX_STARTED R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

protocol dependent and listed in the appendix.

19 T1_STOP_ON_TX_STARTED R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

when a data transmission begins.

18 T1_STOP_ON_RF_ON_EXT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

when the external RF field is detected.

17 T1_STOP_ON_RF_OFF_EXT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

when the external RF field vanishes.

16 T1_STOP_ON_RF_ON_INT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

when the internal RF field is turned on.

15 T1_STOP_ON_RF_OFF_INT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

when the internal RF field is turned off.

14 T1_START_ON_RX_STARTED R/W 0* T1_START_EVENT: If set; the timer T1 is started

when a data reception begins (first bit is received).

13 T1_START_ON_RX_ENDED R/W 0* T1_START_EVENT: If set; the timer T1 is started

12 T1_START_ON_TX_STARTED R/W 0* T1_START_EVEN T: If set; the timer T1 is started

when a data transmission begins.

11 T1_START_ON_TX_ENDED R/W 0* T1_START_EVENT : If set; the timer T1 is started

when a data transmission ends.

10 T1_START_ON_RF_ON_EXT R/W 0* T1_START_EVENT: If set; the timer T1 is started

when the external RF field is detected.

9 T1_START_ON_RF_OFF_EXT R/W 0* T1_START_EVEN T: If set; the timer T1 is started

when the external RF field is not detected any more.

8 T1_START_ON_RF_ON_INT R/W 0* T1_START_EVEN T: If set; the timer T1 is started

when an internal RF field is turned on.

7 T1_START_ON_RF_OFF_INT R/W 0* T1_START_EVENT: If set; the timer T1 is started

when an internal RF field is turned off.

6 T1_START_NOW R/W 0* T1_START_EVENT: If set; the timer T1 is started

(chosen by T1_PRESCALE_SEL). reload its preset value and continue counting down.

0 T1_ENABLE R/W 0* Enables the timer T1

Table 79. TIMER2_CONFIG register (address 0010h) bit description

20 T2_STOP_ON_RX_STARTED R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

protocol dependent and listed in the appendix.

19 T2_STOP_ON_TX_STARTED R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

when a data transmission begins.

18 T2_STOP_ON_RF_ON_EXT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

when the external RF field is detected.

17 T2_STOP_ON_RF_OFF_EXT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

when the external RF field vanishes.

16 T2_STOP_ON_RF_ON_INT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

when the internal RF field is turned on.

15 T2_STOP_ON_RF_OFF_INT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

when the internal RF field is turned off.

14 T2_START_ON_RX_STARTED R/W 0* T2_START_EVENT: If set; the timer T2 is started

when a data reception begins (first bit is received).

13 T2_START_ON_RX_ENDED R/W 0* T2_START_EVENT: If set; the timer T2 is started

12 T2_START_ON_TX_STARTED R/W 0* T2_START_EVEN T: If set; the timer T2 is started

when a data transmission begins.

11 T2_START_ON_TX_ENDED R/W 0* T2_START_EVENT : If set; the timer T2 is started

when a data transmission ends.

10 T2_START_ON_RF_ON_EXT R/W 0* T2_START_EVENT: If set; the timer T2T2 is started

when the external RF field is detected.

9 T2_START_ON_RF_OFF_EXT R/W 0* T2_START_EVEN T: If set; the timer T2 is started

when the external RF field is not detected any more.

8 T2_START_ON_RF_ON_INT R/W 0* T2_START_EVEN T: If set; the timer T2 is started

when an internal RF field is turned on.

7 T2_START_ON_RF_OFF_INT R/W 0* T2_START_EVENT: If set; the timer T2 is started

when an internal RF field is turned off.

6 T2_START_NOW R/W 0* T2_START_EVENT: If set; the timer T2 is started

(chosen by T2_PRESCALE_SEL). reload its preset value and continue counting down.

0 T2_ENABLE R/W 0* Enables the timer T2

Table 80. RX_WAIT_CONFIG (address 0011h) bit description

Table 81. CRC_RX_CONFIG (addre ss 0012h) bit description

11 RX_PARITY_TYPE R/W 0* Defines which type of the parity-bit is used Note: This

10 RX_PARITY_ENABLE R/W 0* If set to 1; a parity-bit for each byte is expected; will be

RX_DATA_INTEGRITY_ERROR flag is set.

9 VALUES_AFTER_COLLISION R/W 0* This bit defi ned the value of bits received after a

the following bit positions. 5:3 RX_CRC_PRESET_SEL R/W 000b* Preset value of the CRC register for the Rx-Decoder. by the Mode detector for FeliCa. detector for ISO14443 type A. detector for ISO14443 type B.

2 RX_CRC_TYPE R/W 0* Controls the type of CRC calculation for the

1 RX_CRC_INV R/W 0* Controls the compar ison of the CRC checksum for the

1 Inverted CRC value: F0B8h Note that this bit is set by

the Mode detector for ISO14443 type B.

0 RX_CRC_ENABLE R/W 0* If set; the Rx-Decoder will check the CRC for

Table 82. RX_STATUS_REG register (address 0013h) bit description value is included in the RX_COLL_POS. 18 RX_COLLISION_DETECTED R 0* This flag is set to 1, when a collision has occurred.

17 RX_PROTOCOL_ERROR R 0* This flag is se t to 1, when a protocol error has

wrong number of received data bytes.

16 RX_DATA_INTEGRITY_ERROR R 0* This flag is set to 1, if a data integrity error has been

is not set to 1 in case of a wrong parity.

updated when the RxIRQ is raised. Table 82. RX_STATUS_REG register (address 0013h) bit description …continued Table 83. TX_UNDERSHOOT_CONFIG register (address 0014h) bit description LSB of the defined pattern; all other bits are ignored.

0 TX_UNDERSHOOT_PROT_ENA

Table 84. TX_OVERSHOOT_CONFIG register (address 0015h) bit description MSB of the defined pattern, all other bits are ignored.

0 TX_OVERSHOOT_PROT

R/W 0*, 1 If set to 1, the over shoot protection is enabled.

Table 85. TX_DATA_MOD register (address 0016h) bit description by the number of carrier clocks + 1. instead of TX_WAIT_PRESCALER. Table 86. TX_WAIT_CONFIG register (address 0017h) bit description Defines the tx_wait timer value. reloaded with the TX_WAIT_PRESCALER value.

Table 87. TX_CONFIG register (address 0018h) bit description

13 TX_PARITY_LAST_INV_ENABL

12 TX_PARITY_TYPE R/W 0 Defines the type of the parity bit 0 Even Parity is

11 TX_PARITY_ENABLE R/W 0 If set to 1; a parity bit is calculated and appended to

then a NO_DATA_ERROR occurs.

10 TX_DATA_ENABLE R/W 0 If set to 1; transmission of data is enabled otherwise

only symbols are transmitted. 3:5 TX_LAST_BITS R/W 0 Defines how many bits of the last data byte to be sent. If set to 000b all bits of the last data byte are sent. 0:2 TX_FIRST_BITS R/W 0 Defines how many bits of the first data byte to be sent. If set to 000b all bits of the last data byte are sent. Table 88. CRC_TX_CONFIG_REG (address 0019h) bit description

6 TX_CRC_BYTE2_ENABLE R/W 0 If set; the CRC is calculated from the second byte

5:3 TX_CRC_PRESET_SEL R/W 000-101b Preset value of the CRC register for the Tx-Encoder.

2 TX_CRC_TYPE R/W 0, 1 Controls the type of CRC calculation for the

1 TX_CRC_INV R/W 0, 1 Controls the sending of an inverted CRC value by the

1 Inverted CRC checksum

0 TX_CRC_ENABLE R/W 0*, 1 If set to one, the Tx-Encoder will compute and

Table 88. CRC_TX_CONFIG_REG (address 0019h) bit description …continued Table 89. SIGPRO_CONFIG register (address 001Ah) bit description is only relevant for reader mode. communication mode is detected.

001 Reserved

010 Reserved

011 Reserved

detector for ISO/IEC14443 type A and B. detector for FeliCa 212 kBd. detector for FeliCa 424 kBd.

Table 90. SIGPRO_CM_CONFIG_REG regist er (address 001Bh) bit description

31 RFU R 0 Reserved

26:28 EDGE_DETECT_TAP_SEL Selects the number of taps of the edge-detector filter.

100 Edge detector filter with 16 taps 101 Edge

0:12 BIT_DETECT_TH Threshold for the “bit” decision block of the ADCBCM. Table 91. SIGPRO_RM_CONFIG1_REG register (address 001Ch) bit description

001 Use only I channel

010 Use only Q channel

011 RFU

100 Use the strongest channel

101 Use the first channel

20 BPSK_FILT6 R/W 0*-1 Reserved for test

19 RESYNC_EQ_ON R/W 0-1* Resynchronization during the SOF for an equal

correlation value is done (default = activated). 18 CORR_RESET_ON R/W 0 The corre lator is reset at a reset (default = activated).

16 DATA_BEFORE_MIN R/W 0 Data is received even before the first minimum at the

SOF (default: = deactivated).

7 USE_SMALL_EVAL R 0 Defines the length of the eval periode for the

11 No Collision

4 PRE_FILTER R/W If set to 1 four samples are combined to one data.

3 RECT_FILTER R/W 0 If set to one; the ADC-values are changed to a more

2 SYNC_HIGH R/W 0*-1 Defines if the bitgri d is fixed at maximum (1) or at a

minimum(0) value of the correlation. 1 FSK R 0 If set to 1; the de modulation scheme is FSK. 0 BPSK R/W 0* If set to 1, the demodulation scheme is BPSK. Table 92. RF_STATUS register (address 001Dh) bit description

1 WaitTransmit state 2 Transmitting state 3

19 DPLL_ENABLE R 0* This bit indicates that the DPLL Controller has

18 CRC_OK R 0 This bit indicates the status of the actual CRC

17 TX_RF_STATUS R 0 If set to 1 this bit indicates that the drivers are turned

16 RF_DET_STATUS R 0 If set to 1 this bit indicates that an external RF-Field is

1 External field was detected on within TIDT timing

2 External field was detected on within TADT timing

3 No external field was detected within TADT timings

4 Peer did switch off RF-Field but no Rx event was

Table 93. AGC_CONFIG register (address 001Eh) bit description 14:15 AGC_VREF_SEL R/W 0* Select the comparison reference voltage.

3 AGC_INPUT_SEL R/W 0* Selects the AGC value to be loaded into the AGC and

2 AGC_LOAD R/W 0* If set; one AGC control value is loaded from

register (depending on AGC_INPUT_SEL).

1 AGC_MODE_SEL R/W 0* Selects the operation mode of the AGC: 0* Rx-Divider

register value (dependent on AGC_MODE_SEL). Table 94. AGC_VALUE_REG register (address 001Fh) bit description Table 95. RF_CONTROL_TX register (address 0020h) bit description the overshoot prevention pattern is active.

18 TX_CW_TO_MAX_ALM_CM R/W 0* TX HI output is the maximum voltage obtainable from

TX_CW_AMPLITUDE_CM is overruled.

12 TX_BYPASS_SC_SHAPING R/W 0* Bypasses switched capacitor shaping of the

Table 96. RF_CONTROL_TX_CLK register (address 0021h) bit description

18 TX_ALM_ENABLE R/W 0* If set to 1 ALM is used for transmission in card mode

7 TX2_INV_RM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

6 TX2_INV_CM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

5 TX1_INV_RM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

4 TX1_INV_CM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

0 CLOCK_ENABLE_DPLL R/W 0* Enables the DPLL

Table 97. RF_CONTROL_RX_CLK register (address 0022h) bit description Table 98. RF_LEVEL_DETECTOR_CONTROL register (address 0023h) bit description

14 CM_PD_NFC_DET R/W 0* Power Down NFC level detector

Table 99. SYSTEM_STATUS register (address 0024h) bit description

8 PARAMETER_ERROR R 0* Parameter E rror on Host Communication

7 SYNTAX_ERROR R 0* Syntax Error on Host Communication

6 SEMANTIC_ERROR R 0* Semantic Error on Host Communication

5 STBY_PREVENT_RFLD R 0* Entry of STBY mode prevented due to existing RFLD

4 BOOT_TEMP R 0* Boot Reason Temp Sensor

3 BOOT_SOFT_RESET R 0* Boot Reason due to SOFT RESET

2 BOOT_WUC R 0* Boot Reason wake-up Counter

1 BOOT_RFLD R 0* Boot Reason RF Level Detector

0 BOOT_POR R 0* Boot Reason Power on Reset / RESET_N

Table 100. TEMP_CONTROL register (address 0025h) bit description

3 TEMP_ENABLE_HYST R/W 0* Enable hyst ereses of Temperature Sensor

2 TEMP_ENABLE R/W 0* Enable Temp Sensor

Table 101. CHECK_CARD_RESULT register (address 0026h) bit description value for the LPCD when LPCD mode 2 is used. Table 102. DPC_CONFIG register (address 0027h) bit description

3 TX_CW_TO_MAX_RM R/W 0 Maximum output voltage on TX driver

0 TX_CW_AMP_REF2TVDD RW 0 If set to 1 the reference of the unmodulated carrier is

Table 103. EMD_CONTROL register (address 0028h) bit description R/W 0 Timer used for RF communication.

00 Timer0,

01 Timer1,

10 Timer 2,

11 RFU

7 EMD_MISSING_CRC_IS_PROT

6 EMD_MISSING_CRC_IS_PROT

1 EMD_TRANSMISSION_ERROR

0 EMD_ENABLE R/W 0 Enable EMD handling

Table 104. ANT_CONTROL register (address 0029h) bit description

7 ANT_INVERT_ON_TXACTIVE R/W 0 If set to 1, the ANT short interface in card mode is

transmission). Note: this bit is only valid in card mode.

6 ANT_ALM_AUTO_SWITCH_EN

5 ANT_ALM_FW_RESET R/W 0 If set to 1 the ANT setting for ALM is reset to its initial

1. Recommended operating conditions

4 ANT_SHORT_SELECT_RM R/W 0 Selects the control of the ANT modulation interface in

analog control signals are switched by digital logic. analog control signals are switched by digital logic. Table 105. Limiting values In accordance with the Absolute Maximum Rating System (IEC 60134). Table 106. Operating conditions

Table 107. Thermal characteristics HVQFN40 package

40 K/W

Table 108. Thermal charact eristics TFBGA64 package

66 K/W

Table 109. Current consumption Table 110. Reset pin RESET_N

Table 111. Input Pin REQ Table 112. GPO pin characteristics Table 113. CLK1, CLK2 pin characteristics Table 114. Output pin characteristics IRQ

Table 115. Input pins SCLK, MOSI, NSS Table 116. Output pin MISO Table 117. Timing conditions SPI Table 118. Output pins ANT1 and ANT2 Table 119. Input pins RXp and RXn

receive commands from a host by raising an IDLE IRQ. Table 120. Output pins TX1 and TX2 Table 121. Start-up time Table 122. Crystal requirements for ISO/IEC14443 compliant operation Table 123. Reference input frequency requirements for 8 MHz, 12 MHz, 16 MHz and 24 MHz

Rev. 2.2 — 17 December 2015 240922 96 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 15. Application information Fig 30. Application diagram with minimum components aaa-020597 29 25 26 SCLK MOSI MISO to host microcontroller to microcontroller supply to testpad optional output NSS IRQ BUSY 40AUX1 RESET_N AUX2/DWL_REQ PVDD PVSS 9VSS CLK1 CLK2 TVSS 36 37 19 ANT1 RXP TX1 VMID TX2 RXN ANT2 GPO1

2830 DVDD

n.c. C3 C5 C7C6C4 R1 R2 R_RXP C_S1 C_S2 C_P1 antenna C_P2 R_RXN L1 C_RXP C_MOD1 RA1 RA2 C_MOD2 C_EMC_1 C_EMC_2 C_RXN Q127

12 MHz

Rev. 2.2 — 17 December 2015 240922 97 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 16. Packaging information Moisture Sensitivity Level (MSL) evaluation has been performed according to SNW-FQ-225B rev.04/07/07 (JEDEC J-STD-020C). MSL for theHVQFN40 package is level 3 which means 260 °C convection reflow temperature.

• 1 weekout-of-pack floor life at maximum ambient temperature 30°C/ 60 % RH (Relative Humidity) to limit possible moisture intrusion.
• When used in production, stored under nitrogen conditions for not more than 8 days Fig 31. Packaging information 1 tray 001aaj740 strap 46 mm from corner tray chamfer PIN 1 chamfer PIN 1 printed plano box ESD warning preprinted barcode label (permanent) barcode label (peel-off) QA seal Hyatt patent preprinted The straps around the package of stacked trays inside the plano-box have sufficient pre-tension to avoid loosening of the trays. In the traystack (2 trays) only ONE tray type* allowed *one supplier and one revision number.

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx Preliminary data sheet COMPANY PUBLIC Rev. 2.2 — 17 December 2015 240922 98 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Fig 32. Packaging information 5 tray aaa-004952 PQ-label (permanent) bag strap 46 mm from the corner dry-agent ESD warning preprinted PQ-label (permanent) dry-pack ID preprinted strap QA seal relative humidity indicator tray preprinted: recycling symbol moisture caution label ESD warning manufacturer bag info chamfer chamfer chamfer printed plano box PIN 1 PIN 1 PIN 1 PLCC52

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx Preliminary data sheet COMPANY PUBLIC Rev. 2.2 — 17 December 2015 240922 99 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Fig 33. Packaging information Tray BC BC AK AK 1.55 3.00 (0.30) 1.20 0.56 3.32 (14.40+5°/S SQ.) (1.45) 1.10 2.50 (0.64) 0.35 AN AN aaa-004949 BB BD BA BD AJ AR AJ AL AL AM AMAR BA BB section BC-BC scale 4:1 vacuum cell section BD-BD scale 4:1 section BA-BA scale 4:1 detail AC scale 20:1 section AJ-AJ scale 2:1 section AR-AR scale 2:1 section AL-AL scale 5:1 section AK-AK scale 5:1 section AM-AM scale 4:1 section AN-AN scale 4:1 end lock side lock 12.80-5°/S SQ. B AC0.50 B AC0.50

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx Preliminary data sheet COMPANY PUBLIC Rev. 2.2 — 17 December 2015 240922 100 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Fig 34. Packaging information Reel aaa-004950 tape guard band circular sprocket holes opposite the label side of reel cover tape carrier tape enlongated circular enlongated PIN1 has to be in quadrant 1 QA seal preprinted ESD warning PQ-label dry-pack ID preprinted (permanent) product orientation in carrier tape product orientation ONLY for turned products with 12nc ending 128 HOW TO SECURE LEADER END TO THE GUARD BAND, HOW TO SECURE GUARD BAND unreeling direction (see: HOW TO SECURE) (see: HOW TO SECURE) PIN1 PIN1 PIN1 PIN1 BGA bare die BGA bare die for SOT505-2 ending 125 for SOT765 ending 125 PIN1 PIN1 PIN1 PIN1 PIN1QFP QFPPLCCSO SO (HV)QFN (HV)SON (H)BCC (HV)QFN (HV)SON (H)BCC see: ASSY REEL + LABELS ASSY REEL + LABELS label side embossed ESD logo embossed ESD logo tape printed plano-box Ø 330x44 (hub 6’’) Ø 180x12/16/24 tapeslot label side trailer leader leader : lenght of trailer shall be 400 mm min. and covered with cover tape circular sprocket hole side guard band trailer : lenght of trailer shall be 160 mm min. and covered with cover tape tape (with pull tabs on both ends) guard band lape double-backed onto itself on both ends

Rev. 2.2 — 17 December 2015 240922 101 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 17. Package outline Fig 35. Package outline SOT618-1 ReferencesOutline version European projection Issue date IEC JEDEC JEITA SOT618-1 MO-220 sot618-1_po 02-10-22 13-11-05 Unit mm max nom min 0.4 A(1) Dimensions (mm are the original dimensions) Note 1. Plastic or metal protrusions of 0.075 mm maximum per side are not included. HVQFN40: plastic thermal enhanced very thin quad flat package; no leads; 40 terminals; body 6 x 6 x 0.85 mm SOT618-1 A1 b 0.30 cD (1) Dh E(1) Eh 4.10 ee 1 e2 Lvw 0.05 y 0.05 0.1 e e 1/2 e 1/2 e y terminal 1 index area A A1 c L Eh Dh b 11 20 40 31 2110 D E terminal 1 index area 0 2.5 5 mm scale A C C Bv w Cy1 C X detail X B A

Rev. 2.2 — 17 December 2015 240922 102 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Fig 36. Package outline package version (TFBGA64) ReferencesOutline version European projection Issue date IEC JEDEC JEITA SOT1336-1 - - - sot1336-1_po 12-06-19 12-08-28 Unit mm max nom min 4.55 0.15 0.1 A Dimensions (mm are the original dimensions) TFBGA64: plastic thin fine-pitch ball grid array package; 64 balls A1 A2 0.80 bDEe e 1 4.55 e2 vw 0.08 yy 1 0.1 SOT1336-1 C yCy1 0 5 mm scale X A A2 detail X ball A1 index area ball A1 index area A E BD e A B C D E F G H 2461357 8 e A CBØ v CØ wb 1/2 e 1/2 e

Rev. 2.2 — 17 December 2015 240922 103 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 18. Soldering of SMD packages This text provides a very brief insight into a complex technology. A more in-depth account of soldering ICs can be found in Application Note AN10365 “Surface mount reflow soldering description”.

18.1 Introduction to soldering

Soldering is one of the most common methods through which packages are attached to Printed Circuit Boards (PCBs), to form electrical circuits. The soldered joint provides both the mechanical and the electrical connection. There is no single soldering method that is ideal for all IC packages. Wave soldering is often preferred when through-hole and Surface Mount Devices (SMDs) are mixed on one printed wiring board; however, it is not suitable for fine pitch SMDs. Reflow soldering is ideal for the small pitches and high densities that come with increased miniaturization.

18.2 Wave and reflow soldering

Wave soldering is a joining technology in which the joints are made by solder coming from a standing wave of liquid solder. The wave soldering process is suitable for the following:

• Through-hole components
• Leaded or leadless SMDs, which are glued to the surface of the printed circuit board Not all SMDs can be wave soldered. Packages with solder balls, and some leadless packages which have solder lands underneath the body, cannot be wave soldered. Also, leaded SMDs with leads having a pitch smaller than ~0.6 mm cannot be wave soldered, due to an increased probability of bridging. The reflow soldering process involves applying solder paste to a board, followed by component placement and exposure to a temperature profile. Leaded packages, packages with solder balls, and leadless packages are all reflow solderable. Key characteristics in both wave and reflow soldering are:
• Board specifications, including the board finish, solder masks and vias
• Package footprints, including solder thieves and orientation
• The moisture sensitivity level of the packages
• Package placement
• Inspection and repair
• Lead-free soldering versus SnPb soldering

18.3 Wave soldering

Key characteristics in wave soldering are:

• Process issues, such as application of adhesive and flux, clinching of leads, board transport, the solder wave parameters, and the time during which components are exposed to the wave
• Solder bath specifications, including temperature and impurities

18.4 Reflow soldering

• Lead-free versus SnPb soldering; note that a lead-free reflow process usually leads to higher minimum peak temperatures (see Figure 37) than a SnPb process, thus reducing the process window
• Solder paste printing issues including smearing, release, and adjusting the process window for a mix of large and small components on one board
• Reflow temperature profile; this profile includes preheat, reflow (in which the board is heated to the peak temperature) and cooling down. It is imperative that the peak temperature is high enough for the solder to make reliable solder joints (a solder paste characteristic). In addition, the peak temperature must be low enough that the packages and/or boards are not damaged. The peak temperature of the package depends on package thickness and volume and is classified in accordance with Table 124 and 125 Moisture sensitivity precautions, as indicated on the packing, must be respected at all times. Studies have shown that small packages reach higher temperatures during reflow soldering, see Figure 37.

Table 124. SnPb eutectic process (from J-STD-020D) Table 125. Lead-free process (from J-STD-020D)

Rev. 2.2 — 17 December 2015 240922 105 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution For further information on temperature profiles, refer to Application Note AN10365 “Surface mount reflow soldering description”. MSL: Moisture Sensitivity Level Fig 37. Temperature profiles for large and small components 001aac844 temperature time minimum peak temperature = minimum soldering temperature maximum peak temperature = MSL limit, damage level peak temperature

Rev. 2.2 — 17 December 2015 240922 106 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 19. Soldering Fig 38. Soldering HVQFN40 package SOT618-1Footprint information for reflow soldering of HVQFN40 package sot618-1_fr occupied area solder paste solder resist solder lands Dimensions in mm Ay Bx D SLx SLy SPy totP 7.000 5.200 By 5.200 0.900 0.290 C 4.100 4.100 2.400 SPx tot 2.400 SPx 0.600 SPy 0.600 Gx 6.300 Gy 6.300 Hx 7.250 Hy 7.2500.500 Ax 7.000 nSPx nSPy Issue date 09-06-11 14-08-13 Ax Bx SLx Gx GyHy Hx AyBy SLy P 0.025 0.025D (0.105) SPx tot SPy tot nSPx nSPy SPx SPy C Generic footprint pattern Refer to the package outline drawing for actual layout

20.1 Timer Delay for start of reception measurement

20.2 Default protocol settings fo r LOAD_RF_CONFIG, Transmitter

20.2.1 ISO/IEC 14443 A-106

Table 126. Timer delay for STOP_ON_RX_STARTED configuration Table 127. ISO/IEC 14443 A-106

20.2.2 ISO/IEC 14443 A-212

20.2.3 ISO/IEC 14443 A-424

20.2.4 ISO/IEC 14443 A-848

20.2.5 ISO/IEC 14443 B-106

Table 128. ISO/IEC 14443 A-212 Table 129. ISO/IEC 14443 A-424 Table 130. ISO/IEC 14443 A-848 Table 131. ISO/IEC 14443 B-106

20.2.6 ISO/IEC 14443 B-212

20.2.7 ISO/IEC 14443 B-424

20.2.8 ISO/IEC 14443 B-848

20.2.9 Felica-212

Table 132. ISO/IEC 14443 B-212 Table 133. ISO/IEC 14443 B-424 Table 134. ISO/IEC 14443 B-848 Table 135. Felica-212

20.2.10 Felica-424

20.2.11 NFC active initiator A-106

20.2.12 NFC active initiator A-212

20.2.13 NFC active initiator A-424

Table 136. Felica-424 Table 137. NFC active initiator A-106 Table 138. NFC active initiator A-212 Table 139. NFC active initiator A-424

20.2.14 ISO/IEC15693-26

20.2.15 ISO/IEC15693-53

Table 140. ISO/IEC15693-26 Table 141. ISO/IEC15693-53 Table 142. ISO/IEC18003M3 - TARI=18.88us Table 143. ISO/IEC18003M3 - TARI=9.44us

20.2.18 PICC ISO/IEC14443-A 106

20.2.19 PICC ISO/IEC14443-A 212

20.2.20 PICC ISO/IEC14443-A 424

20.2.21 PICC ISO/IEC14443-A 848

20.2.22 NFC passive target 212

Table 144. PICC ISO/IEC14443-A 106 Table 145. PICC ISO/IEC14443-A 212 Table 146. PICC ISO/IEC14443-A 424 Table 147. PICC ISO/IEC14443-A 848 Table 148. NFC passive target 212

20.2.23 NFC passive target 424

20.2.24 NFC active target 106

20.2.25 NFC active target 212

20.2.26 NFC active target 424

Table 149. NFC passive target 424 Table 150. NFC active target 106 Table 151. NFC active target 212 Table 152. NFC active target 424

20.2.27 NFC general target mode - all data rates

20.3 Default protocol settings for LOAD_RF_CONFIG, Receiver

20.3.1 ISO/IEC 14443 A-106

20.3.2 ISO/IEC 14443 A-212

20.3.3 ISO/IEC 14443 A-424

20.3.4 ISO/IEC 14443 A-848

Table 153. NFC general target mode - all data rates Table 154. ISO/IEC 14443 A-106 Table 155. ISO/IEC 14443 A-212 Table 156. ISO/IEC 14443 A-424 Table 157. ISO/IEC 14443 A-848

20.3.5 ISO/IEC 14443 B-106

20.3.6 ISO/IEC 14443 B-212

20.3.7 ISO/IEC 14443 B-424

20.3.8 ISO/IEC 14443 B-848

Table 158. ISO/IEC 14443 B-106 Table 159. ISO/IEC 14443 B-212 Table 160. ISO/IEC 14443 B-424 Table 161. ISO/IEC 14443 B-848

20.3.9 Felica 212

20.3.10 Felica 424

20.3.11 NFC Active Initiator 106

20.3.12 NFC Active Initiator 212

20.3.13 NFC Active Initiator 424

Table 162. Felica 212 Table 163. Felica 424 Table 164. NFC Active Initiator 106 Table 165. NFC Active Initiator 212 Table 166. NFC Active Initiator 424

20.3.14 ISO/IEC 15693-26

20.3.15 ISO/IEC 15693-53

Table 167. ISO/IEC 15693-26 Table 168. ISO/IEC 15693-53 Table 169. ISO 18003M3- Tari 18.88 Table 170. ISO 18003M3- Tari 9.44 848_2

20.3.19 ISO 14443A-PICC 106

20.3.20 ISO 14443A-PICC 212

20.3.21 ISO 14443A-PICC 424

20.3.22 ISO 14443A-PICC 848

Table 171. ISO18003M3- Tari 9.44 -848_4 Table 172. ISO 14443A-PICC 106 Table 173. ISO 14443A-PICC 212 Table 174. ISO 14443A-PICC 424 Table 175. ISO 14443A-PICC 848

20.3.23 NFC-Passive target -212

20.3.24 NFC-Passive target -424

20.3.25 NFC-active target - 106

20.3.26 NFC-active target - 212

20.3.27 NFC-active target - 424

Table 176. NFC-Passive target -212 Table 177. NFC-Passive target -424 Table 178. NFC-active target - 106 Table 179. NFC-active target - 212 Table 180. NFC-active target - 424

20.3.28 NFC-General target mode - all data rates

Table 181. NFC-General target mode - all data rates

Table 182. Abbreviations

Table 183. Revision history

• Waveform control description added
• Figure 30 “Application diagram with minimum components”: updated PN5180 v. 2.1 20151126 Preliminary data sheet - PN5180 v. 2.0 Modifications:
• Minor updates PN5180 v. 2.0 20151124 Preliminary data sheet - -

Rev. 2.2 — 17 December 2015 240922 123 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution 24. Legal information

24.1 Data sheet status

[1] Please consult the most recently issued document before initiating or completing a design. [2] The term ‘short data sheet’ is explained in section “Definitions”. [3] The product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple devices. The latest product status information is available on the Internet at URL http://www.nxp.com

24.2 Definitions

Draft — The document is a draft version only. The content is still under internal review and subject to formal approval, which may result in modifications or additions. NXP Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall have no liability for the consequences of use of such information. Short data sheet — A short data sheet is an extract from a full data sheet with the same product type number(s) and title. A short data sheet is intended for quick reference only and should not be relied upon to contain detailed and full information. For detailed and full information see the relevant full data sheet, which is available on request via the local NXP Semiconductors sales office. In case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail. Product specification — The information and data provided in a Product data sheet shall define the specification of the product as agreed between NXP Semiconductors and its customer, unless NXP Semiconductors and customer have explicitly agreed otherwise in writing. In no event however, shall an agreement be valid in which the NXP Semiconductors product is deemed to offer functions and qualities beyond those described in the Product data sheet.

24.3 Disclaimers

Limited warranty and liability — Information in this document is believed to be accurate and reliable. However, NXP Semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information. NXP Semiconductors takes no responsibility for the content in this document if provided by an information source outside of NXP Semiconductors. In no event shall NXP Semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. Notwithstanding any damages that customer might incur for any reason whatsoever, NXP Semiconductors’ aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the Terms and conditions of commercial sale of NXP Semiconductors. Right to make changes — NXP Semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice. This document supersedes and replaces all information supplied prior to the publication hereof. Suitability for use — NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an NXP Semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. NXP Semiconductors and its suppliers accept no liability for inclusion and/or use of NXP Semiconductors products in such equipment or applications and therefore such inclusion and/or use is at the customer’s own risk. Applications — Applications that are described herein for any of these products are for illustrative purposes only. NXP Semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. Customers are responsible for the design and operation of their applications and products using NXP Semiconductors products, and NXP Semiconductors accepts no liability for any assistance with applications or customer product design. It is customer’s sole responsibility to determine whether the NXP Semiconductors product is suitable and fit for the customer’s applications and products planned, as well as for the planned application and use of customer’s third party customer(s). Customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. NXP Semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer’s applications or products, or the application or use by customer’s third party customer(s). Customer is responsible for doing all necessary testing for the customer’s applications and products using NXP Semiconductors products in order to avoid a default of the applications and the products or of the application or use by customer’s third party customer(s). NXP does not accept any liability in this respect. Limiting values — Stress above one or more limiting values (as defined in the Absolute Maximum Ratings System of IEC 60134) will cause permanent damage to the device. Limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in the Recommended operating conditions section (if present) or the Characteristics sections of this document is not warranted. Constant or repeated exposure to limiting values will permanently and irreversibly affect the quality and reliability of the device. Terms and conditions of commercial sale — NXP Semiconductors products are sold subject to the general terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms , unless otherwise agreed in a valid written individual agreement. In case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. NXP Semiconductors hereby expressly objects to applying the customer’s general terms and conditions with regard to the purchase of NXP Semiconductors products by customer. No offer to sell or license — Nothing in this document may be interpreted or construed as an offer to sell products that is open for acceptance or the grant, conveyance or implication of any license under any copyrights, patents or other industrial or intellectual property rights. Document status[1][2] Product status[3] Definition Objective [short] data sheet Development This document contains data from the objective specification for product development. Preliminary [short] data sheet Qualification This document contains data from the preliminary specification. Product [short] data sheet Production This document contains the product specification.

Rev. 2.2 — 17 December 2015 240922 124 of 126 NXP Semiconductors PN5180 High-power NFC frontend solution Export control — This document as well as the item(s) described herein may be subject to export control regulations. Export might require a prior authorization from competent authorities. Quick reference data — The Quick reference data is an extract of the product data given in the Limiting values and Characteristics sections of this document, and as such is not complete, exhaustive or legally binding. Non-automotive qualified products — Unless this data sheet expressly states that this specific NXP Semiconductors product is automotive qualified, the product is not suitable for automotive use. It is neither qualified nor tested in accordance with automotive testing or application requirements. NXP Semiconductors accepts no liability for inclusion and/or use of non-automotive qualified products in automotive equipment or applications. In the event that customer uses the product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without NXP Semiconductors’ warranty of the product for such automotive applications, use and specifications, and (b) whenever customer uses the product for automotive applications beyond NXP Semiconductors’ specifications such use shall be solely at customer’s own risk, and (c) customer fully indemnifies NXP Semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive applications beyond NXP Semiconductors’ standard warranty and NXP Semiconductors’ product specifications. Translations — A non-English (translated) version of a document is for reference only. The English version shall prevail in case of any discrepancy between the translated and English versions.

24.4 Licenses

24.5 Trademarks

Notice: All referenced brands, product names, service names and trademarks are the property of their respective owners. MIFARE — is a trademark of NXP Semiconductors N.V. ICODE and I-CODE — are trademarks of NXP Semiconductors N.V. 25. Contact information For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: salesaddresses@nxp.com Purchase of NXP ICs with NFC technology Purchase of an NXP Semiconductors IC that complies with one of the Near Field Communication (NFC) standards ISO/IEC 18092 and ISO/IEC 21481 does not convey an implied license under any patent right infringed by implementation of any of those standards. Purchase of NXP Semiconductors IC does not include a license to any NXP patent (or other IP right) covering combinations of those products with other products, whether hardware or software. Purchase of NXP ICs with ISO/IEC 14443 type B functionality This NXP Semiconductors IC is ISO/IEC 14443 Type B software enabled and is licensed under Innovatron’s Contactless Card patents license for ISO/IEC 14443 B. The license includes the right to use the IC in systems and/or end-user equipment. RATP/Innovatron Technology

Rev. 2.2 — 17 December 2015 240922 125 of 126 continued >> NXP Semiconductors PN5180 High-power NFC frontend solution 26. Contents

High-power NFC frontend solution © NXP Semiconductors N.V. 2015. All rights reserved. For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: salesaddresses@nxp.com Date of release: 17 December 2015 240922 Please be aware that important notices concerning this document and the product(s) described herein, have been included in section ‘Legal information’.

20.1 Timer Delay for start of reception

20.2 Default protocol settings for

20.3 Default protocol settings for

20.3.28 NFC-General target mode - all data rates . . 120