Intelligent EEPROM with Contactless Interface compliant to ISO/IEC Type A and support of NFC Forum Type 2 Tag Operation

Transcription

1 Intelligent EEPROM with Contactless Interface compliant to ISO/IEC Type A and support of NFC Forum Type 2 Tag Operation Data Book Chip Card & Security

2 Edition Published by Infineon Technologies AG Munich, Germany 2011 Infineon Technologies AG All Rights Reserved. Legal Disclaimer The information given in this document shall in no event be regarded as a guarantee of conditions or characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any information regarding the application of the device, Infineon Technologies hereby disclaims any and all warranties and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual property rights of any third party. Information For further information on technology, delivery terms and conditions and prices, please contact the nearest Infineon Technologies Office ( Warnings Due to technical requirements, components may contain dangerous substances. For information on the types in question, please contact the nearest Infineon Technologies Office. Infineon Technologies components may be used in life-support devices or systems only with the express written approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure of that life-support device or system or to affect the safety or effectiveness of that device or system. Life support devices or systems are intended to be implanted in the human body or to support and/or maintain and sustain and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may be endangered.

3 Revision History - Data Book - my-d NFC Previous Release Page or Item Subjects (major changes since previous revision) All Editorial changes Updated Ordering Information and Delivery Forms Added information about NFC configuration and initialization Technical product update: pre-configured NFC memory map (INITIALIZED state) Trademarks of Infineon Technologies AG AURIX, BlueMoon, C166, CanPAK, CIPOS, CIPURSE, COMNEON, EconoPACK, CoolMOS, CoolSET, CORECONTROL, CROSSAVE, DAVE, EasyPIM, EconoBRIDGE, EconoDUAL, EconoPIM, EiceDRIVER, eupec, FCOS, HITFET, HybridPACK, I²RF, ISOFACE, IsoPACK, MIPAQ, ModSTACK, my-d, NovalithIC, OmniTune, OptiMOS, ORIGA, PRIMARION, PrimePACK, PrimeSTACK, PRO-SIL, PROFET, RASIC, ReverSave, SatRIC, SIEGET, SINDRION, SIPMOS, SMARTi, SmartLEWIS, SOLID FLASH, TEMPFET, thinq!, TRENCHSTOP, TriCore, X-GOLD, X-PMU, XMM, XPOSYS. Other Trademarks Advance Design System (ADS) of Agilent Technologies, AMBA, ARM, MULTI-ICE, KEIL, PRIMECELL, REALVIEW, THUMB, µvision of ARM Limited, UK. AUTOSAR is licensed by AUTOSAR development partnership. Bluetooth of Bluetooth SIG Inc. CAT-iq of DECT Forum. COLOSSUS, FirstGPS of Trimble Navigation Ltd. EMV of EMVCo, LLC (Visa Holdings Inc.). EPCOS of Epcos AG. FLEXGO of Microsoft Corporation. FlexRay is licensed by FlexRay Consortium. HYPERTERMINAL of Hilgraeve Incorporated. IEC of Commission Electrotechnique Internationale. IrDA of Infrared Data Association Corporation. ISO of INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. MATLAB of MathWorks, Inc. MAXIM of Maxim Integrated Products, Inc. MICROTEC, NUCLEUS of Mentor Graphics Corporation. Mifare of NXP. MIPI of MIPI Alliance, Inc. MIPS of MIPS Technologies, Inc., USA. murata of MURATA MANUFACTURING CO., MICROWAVE OFFICE (MWO) of Applied Wave Research Inc., OmniVision of OmniVision Technologies, Inc. Openwave Openwave Systems Inc. RED HAT Red Hat, Inc. RFMD RF Micro Devices, Inc. SIRIUS of Sirius Satellite Radio Inc. SOLARIS of Sun Microsystems, Inc. SPANSION of Spansion LLC Ltd. Symbian of Symbian Software Limited. TAIYO YUDEN of Taiyo Yuden Co. TEAKLITE of CEVA, Inc. TEKTRONIX of Tektronix Inc. TOKO of TOKO KABUSHIKI KAISHA TA. UNIX of X/Open Company Limited. VERILOG, PALLADIUM of Cadence Design Systems, Inc. VLYNQ of Texas Instruments Incorporated. VXWORKS, WIND RIVER of WIND RIVER SYSTEMS, INC. ZETEX of Diodes Zetex Limited. Last Trademarks Update Data Book 3 /

4 Table of Contents Table of Contents Table of Contents List of Figures List of Tables Features Ordering and packaging information my-d Product Family my-d NFC Application Segments my-d NFC Circuit Description Memory Principle Memory Principle for a NFC Forum Type 2 Tag System Overview Product Versions Supported Standards Command Set Memory, Access Rights and Chip States Memory Organization Service Area Unique IDentification number UID (page 0000 H ) Issuer Data and Issuer Tag (page 0001 H ) Manufacturer Data (page 0002 H ) User Area Administration Area NFC Memory Organization Transport Configuration bit Value Counter Counter Mechanism Anti-tearing Value Counter Pages Value Counter Format Initialization of a Value Counter Page Access Conditions and Sector Index Access Conditions Sector Index Frames and Command Set Communication between a Card (PICC) and a Reader (PCD) Start-up Time my-d NFC State Diagram Error Handling and State Transitions ISO/IEC Type A and NFC Forum Type 2 Tag Commands Supported ISO Commands NFC Forum Type 2 Tag Commands Command Format Standard Frame Short Frame Data Book 4 /

5 Table of Contents Anti-Collision Frame Data Integrity Mechanisms Byte and Bit Order Frame Delay Time my-d NFC Responses Answer to Request Command (ATQA) Answer to Anti-Collision and Select Command SAK Response Answer to a regular HLTA Command HLTA Command my-d Family Commands Supported my-d NFC Commands General my-d Command Format General Response Format Data Integrity High Data Rate (HDR) Description my-d Command Description Read Command Read Block 2p Command Write Command Write Block 2p Command Restricted Write Command Write and Reread Command Restricted Write and Reread Command Write Byte Command Set Data Rate Command Electrical Characteristics Operating Range and Conditions RF Interface Absolute Maximum Ratings Timings Data Book 5 /

6 List of Figures List of Figures Figure 1-1 Pin configuration Module Contactless Card - MCC2-2-1 (top / bottom view) Figure 1-2 Pin configuration Module Contactless Card - MCC8-2-6 (top / bottom view) Figure 1-3 Pad configuration die Figure 3-1 Block Diagram of the my-d NFC Figure 3-2 my-d Memory Organization Figure 3-3 NFC Memory Organization Figure 3-4 my-d NFC System Figure 4-1 Chip Information Byte Coding Figure 4-2 Counter Mechanism Figure 4-3 Intermediate Counter States Figure 4-4 Counter (start value) Figure 4-5 Counter (new value) Figure 4-6 Incorrect counter state Figure 4-7 Data structure of a Value Counter page Figure 5-1 State Diagram Figure 5-2 HLTA Command Figure 5-3 Load modulation signals for ISO/IEC Type A at higher data rates Figure 5-4 Read Command Figure 5-5 Read Block 2p Command Figure 5-6 Write Command Figure 5-7 Write Block 2p Command Figure 5-8 Restricted Write Command Figure 5-9 Write and Reread Command Figure 5-10 Restricted Write and Reread Command Figure 5-11 Write Byte Command Figure 5-12 Set Data Rate Command Data Book 6 /

7 List of Tables List of Tables Table 1-1 Ordering information Table 1-2 Pin description and function Table 2-1 my-d family product overview Table 3-1 Chip information for different product variants Table 3-2 Manufacturer ID and Chip Family Identifier Table 4-1 my-d NFC memory configuration (based on SLE 66R16P) Table 4-2 Chip variants of my-d NFC (memory sizes in bytes) Table 4-3 my-d NFC Service Area Table 4-4 Description of page 0000 H content Table 4-5 Chip Family Identification my-d NFC Table 4-6 Manufacturer Data (page 0001 H ) Table 4-7 Mode Configuration Table 4-8 Issuer Tag (IT) of my-d NFC Table 4-9 Manufacturer Data (page 0002 H ) Table 4-10 Chip Information (CI) of my-d NFC Table 4-11 my-d NFC memory configuration (based on SLE 66R16P) Table 4-12 my-d NFC SLE 66R32P memory configuration Table 4-13 NFC Forum Type 2 Tag memory mapping (based on SLE 66R32P) Table 4-14 NFC Forum Type 2 Tag memory in INITIALIZED state (based on SLE 66R32P) Table 4-15 Capability Container settings for my-d NFC Table 4-16 Empty NDEF message Table 4-17 Access Conditions and Access Rights Table 5-1 Responses and State Transitions Table 5-2 ISO/IEC Type A Commands Table 5-3 NFC Forum Type 2 Tag Commands Table 5-4 Standard Frame Table 5-5 Short Frame Table 5-6 Data Integrity Mechanisms Table 5-7 Coding of Answer to Request ATQA Table 5-8 Coding of the Select Acknowledge (SAK) byte Table 5-9 HLTA command parameters Table 5-10 HLTA response parameters Table 5-11 my-d Commands Table 5-12 General my-d Command Format Table 5-13 Command format description Table 5-14 General Response Format Table 5-15 Coding of Acknowledge (ACK) and Not Acknowledge (NACK) Table 5-16 Read command parameters Table 5-17 Read command response parameters Table 5-18 Read Block 2p command parameters Table 5-19 Read Block 2p command response parameters Table 5-20 Write command parameters Table 5-21 Write command response parameters Table 5-22 Write Block 2p command parameters Table 5-23 Write Block 2p command response parameters Table 5-24 Restricted Write command parameters Table 5-25 Restricted Write command response parameters Table 5-26 Write and Reread command parameters Table 5-27 Write and Reread command response parameters Data Book 7 /

8 List of Tables Table 5-28 Restricted Write and Reread command parameters Table 5-29 Restricted Write and Reread command response parameters Table 5-30 Write Byte command parameters Table 5-31 Write Byte command response parameters Table 5-32 Set Data Rate command parameters Table 5-33 Set Data Rate command response parameters Table 6-1 Operating Range and Conditions Table 6-2 RF Interface Table 6-3 Absolute Maximum Ratings Data Book 8 /

9 Features Features Intelligent EEPROM with Contactless Interface compliant to ISO/IEC Type A and support of NFC Forum Type 2 Tag Operation Contactless Interface Physical interface and Anticollision compliant to ISO/IEC Type A Operation frequency MHz Data rate up to 848 kbit/s from PICC to PCD, 106 kbit/s from PCD to PICC Contactless transmission of data and supply energy Anticollision logic: Several cards may be operated in the field simultaneously Unique IDentification number (7-byte double-size UID) Read / write distance up to 10 cm and more (influenced by external circuitry i.e. reader and inlay design) Up to 5120 bytes EEPROM Organized in up to 512 pages Each page organized in 8 bytes for data storage + 2 bytes for administrative purposes Up to 509 pages of user memory (user page size 8 byte) EEPROM programming time per page < 4 ms EEPROM endurance minimum 100,000 erase/write cycles 1) Data retention minimum 10 years 1) NFC Tag Operation Support of NFC Forum - Type 2 Tag Operation Specification Up to 2048 bytes NFC memory available organized in static or dynamic memory structure pre-defined memory size for NFC Forum Type 2 Tag Operation (up to two 1 kbyte sectors) Pre-configured NFC memory with empty NDEF message (INITIALIZED state) Value Counters: up to (value range from 0 to ) Each page in the User Area is configurable as a Value Counter Support of Anti-Tearing Electrical characteristics ESD protection minimum 2 kv Ambient temperature -25 C C (for the chip) 1) Values are temperature dependent Data Book 9 /

10 Ordering and packaging information 1 Ordering and packaging information Table 1-1 Ordering information Type Package 1) SLE 66R04P 3) Total / User Memory 2) Total / User Pages 2) Ordering code 780 / 600 bytes 78 / 75 on request SLE 66R16P NB NiAu Bumped (sawn wafer) 2560 / 2024 bytes 256 / 253 SP SLE 66R16P MCC2 P-MCC2-2-1 (1024 bytes of NFC on request Memory SLE 66R16P MCC8 P-MCC8-2-6 SP SLE 66R32P NB NiAu Bumped (sawn wafer) 5120 / 4072 bytes 512 / 509 SP SLE 66R32P MCC2 P-MCC2-2-1 (2048 bytes NFC on request Memory) SLE 66R32P MCC8 P-MCC8-2-6 SP ) MCC is short for Module Contactless Card 2) Total memory size and page count includes the service area and the two administrative bytes per page whereas user memory size and page count is freely programmable for user data. 3) The SLE 66R04P does not support NFC Forum Type 2 Tag functionality. For more ordering information (wafer thickness and height of NiAu-Bump) please contact your local Infineon sales office. Pin description Figure 1-1 Pin configuration Module Contactless Card - MCC2-2-1 (top / bottom view) Figure 1-2 Pin configuration Module Contactless Card - MCC8-2-6 (top / bottom view) Data Book 10 /

11 Ordering and packaging information L A my-d NFC L B Figure 1-3 Pad configuration die Table 1-2 Symbol L A L B Pin description and function Function Antenna connection Antenna connection Data Book 11 /

12 my-d Product Family 2 my-d Product Family my-d products are available both in plain mode with open memory access and in secure mode with memory access controlled by authentication procedures. The family of contactless memory my-d provides users with different memory sizes and incorporates security features to enable considerable flexibility in the application design. Flexible controls within the my-d devices start with plain mode operation featuring individual page locking; for more complex applications various settings in secure mode can be set for multi user / multi application configurations. In plain mode access to the memory is supported by both 4-byte block as well as 8-byte page structure. In secure mode a cryptographic algorithm based on a 64-bit key is available. Mutual authentication, message authentication codes (MAC) and customized access conditions protect the memory against unauthorized access. The functional architecture, meaning the memory organization and authentication of my-d products is the same for both my-d proximity (ISO/IEC 14443) and my-d vicinity (ISO/IEC mode 1 or ISO/IEC 15693). This eases the system design and allows simple adaptation between applications. Configurable Value Counters featuring anti-tearing functionality are suitable for value token applications, such as limited use transportation tickets. Architectural interoperability of all my-d products enables an easy migration from simple to more demanding applications. In addition, the my-d light (ISO/IEC mode 1 or ISO/IEC 15693) is part of the my-d family. Its optimized command set and memory expands the range of applications to cost sensitive segments. 2.1 my-d NFC The my-d NFC products are members of the my-d family. Once designed-in a migration to different memory sizes can be done easily. my-d NFC products are designed especially for the increasing NFC market demanding smart memories. Infineon's my-d NFC family convinces with fast communication speed and high robustness. Furthermore, the family can be operated as NFC Forum Type 2 Tag. Up to 2 kbytes of memory can be arranged in a dynamic memory structure for NFC applications. my-d NFC products also feature configurable Value Counters which support anti-tearing protection. my-d NFC products are suited for a broad range of applications like smart posters, ringtones, data logging, public transport, event ticketing, access control or consumer good information. Data Book 12 /

13 my-d Product Family 2.2 Application Segments my-d products are optimized for personal and object identification. Please find in the following table some dedicated examples Table 2-1 my-d family product overview Product my-d move - SLE 66R01P my-d move NFC - SLE 66R01PN my-d move lean - SLE 66R01L my-d NFC - my-d proximity 2 - SLE 66RxxS my-d proximity enhanced - SLE 55RxxE my-d light - SRF 55V01P my-d vicinity plain - SRF 55VxxP my-d vicinity plain HC - SRF 55VxxP HC my-d vicinity secure - SRF 55VxxS Application Public Transport, Smart Posters, NFC Device Pairing Public Transport, Smart Posters, NFC Device Pairing, NFC INITIALIZED state Public Transport, Smart Posters, NFC Device Pairing Smart Posters and Maps, NFC Device Pairing, Loyalty Schemes, Consumer Good Information, Healthcare Monitoring Access Control, Entertainment, Public Transport, Customer Loyalty Schemes, Micro Payment Access Control, Gaming, Entertainment, Customer Loyalty Schemes Libraries, Laundry, Factory Automation, Media Management, Event Ticketing, Leisure Park Access Factory Automation, Healthcare, Ticketing, Access Control Ticketing, Brand Protection, Loyalty Schemes, Ski passes Ticketing, Brand protection, Loyalty Schemes, Access Control Data Book 13 /

14 my-d NFC - 3 my-d NFC - The my-d NFC products are based on the ISO/IEC Type A standard for contactless proximity cards. The my-d NFC family features both my-d commands and NFC Forum Type 2 Tag commands. The products are targeting particular high memory applications such as Smart Posters and Maps, Loyalty Schemes, Healthcare Monitoring as well as NFC Device Pairing applications. They are fulfilling the requirements of state of the art contactless memory ICs with respect to compatibility to the ISO/IEC standard part 1-3, operating range and command as well as feature set. Furthermore, the family can be operated as NFC Forum Type 2 Tag. 3.1 Circuit Description The my-d NFC is made up of an EEPROM memory unit, an analog interface for contactless energy and data transmission and a control unit. LA Analog Contactless Interface POWER CLOCK Operational Mode Memory Unit Power Circuit Antenna Rectifier Clock Extractor Power On Reset Voltage Regulator DATA Serial Parallel LB IO Command Anticollision Control Unit Memory Access Figure 3-1 Block Diagram of the my-d NFC Analog Contactless Interface The Analog Contactless Interface comprises the voltage rectifier, voltage regulator and system clock to supply the IC with appropriate power. Additionally the data stream is modulated and demodulated. Operational mode The access to the memory depends on the actual configuration of the my-d NFC. Memory Unit The Memory Unit consists of up to 5120 bytes memory organized in up to 512 pages each of 8 user and two administration bytes. Control Unit The Control Unit decodes and executes all commands. Additionally the control unit is responsible for the correct anticollision flow. Data Book 14 /

15 my-d NFC Memory Principle The memory is organized in 3 areas: User Area Service Area Administration Area Unique serial number (UID) Service Area SI AC page (plain) page (plain) page (plain) SI SI SI AC AC AC User Area Administration Area page (plain) SI AC Figure 3-2 my-d Memory Organization The Service Area stores the 7-byte UID, manufacturer data and configuration data. This information is programmed at manufacturing of the chip and cannot be changed. The User Area stores User Data in up to 509 pages. The whole NFC memory portion is mapped into the User Area. The Administration Area stores two bytes of information about page administration (SI - Sector Index and AC - Access Condition). The Access Condition and Sector Index byte are corruption protected. Data Book 15 /

16 my-d NFC Memory Principle for a NFC Forum Type 2 Tag Some parts of the my-d NFC memory are configured to be accessible with NFC Forum Type 2 Tag commands. Static or a dynamic memory structures are configurable. The principle of the memory structure is shown in Figure 3-3. UID / Internal UID / Internal Internal / LOCK Capability Container Data Data..... Data Figure 3-3 NFC Memory Organization The block size in the NFC memory organization is 4 bytes. These blocks are accessible with NFC Forum Type 2 Tag commands as well as with my-d commands. The my-d NFC are delivered with pre-configured NFC memory; the Capability Container bytes are programmed and the data area holds an empty NDEF message; this represents the NFC Forum Type 2 Tag INITIALIZED state within the tag life cycle. With this pre-configuration the my-d NFC can be immediately used in NFC infrastructures. For further details regarding the NFC initialization of my-d NFC please refer to the Application Note How to operate my-d devices in NFC Forum Type 2 Tag infrastructures available at Chip Card & Security security.chipcard.ics@infineon.com. Attention: This pre-configuration can be over-written to any value. Initial shipments of the my-d NFC devices have been delivered without this configuration. Data Book 16 /

17 my-d NFC System Overview The system consists of a host system, one or more my-d NFC or other ISO/IEC compliant cards and an ISO/IEC compatible contactless reader with an antenna. Alternatively, since the my-d NFC is configured to hold a NFC Forum Type 2 Tag memory structure, a NFC Forum Device in card reader/writer mode can be used to operate the chip. Host System µc Analog Circuitry Data my-d NFC Antenna PICC Identification Terminal (PCD) or NFC Forum Device Energy Clock Figure 3-4 my-d NFC System Data Book 17 /

18 my-d NFC Product Versions To identify the different types of my-d NFC contactless memories special chip type information is coded into the manufacturer page (Service Area, page 0002 H, byte 00 H ). The table below briefly describes the values of this byte for the different chip versions. Table 3-1 Chip information for different product variants Sales Code Chip Information Byte 1) SLE 66R04P 2) SLE 66R16P SLE 66R32P 11xx 0101 B 1) Bit [5:3] should not be evaluated as their value may be changed for future revisions. 2) The SLE 66R04P does not support NFC Forum Type 2 Tag functionality. In addition to the chip type information, the manufacturer ID and a chip family identifier are coded into the 7-byte UID (Service Area, page 0000 H ) as described in Table 3-2. The chip family identifier can be used to determine the basic command set for the chip. Table 3-2 Manufacturer ID and Chip Family Identifier UID field Value Description 3.6 Supported Standards Following standards are supported: ISO/IEC Type A (Parts 1, 2 and 3) tested according to ISO/IEC (PICC Test and Validation) Support of NFC Forum Type 2 Tag Operation 3.7 Command Set 11xx 0010 B 11xx 0100 B uid0 05 H Manufacturer ID according to ISO/IEC /AM1 uid1 x0 H The higher nibble of uid1 is the chip family identifier coded as: 1 H... my-d command set 2 H... my-d command set and NFC Forum Type 2 Tag commands The lower nibble is RFU and set to 0 H. The lower nibble shall not be checked for chip family determination. The my-d NFC chip is compliant to the ISO/IEC Type A standard. A set of standard ISO commands is implemented to operate the chip. Additional to the ISO/IEC commands, NFC Forum Type 2 Tag commands and a my-d specific command set is implemented. This facilitates the access to the on-chip integrated memory. Data Book 18 /

19 Memory, Access Rights and Chip States 4 Memory, Access Rights and Chip States Chapter 4.1 describes the memory structure of the my-d NFC chip. Value Counter functionality is detailed in Chapter 4.3. An overview on the chip modes and Access Conditions are given in Chapter Memory Organization The my-d NFC derivatives have memory sizes up to 5120 bytes organized in up to 512 pages. Each page consists of 8 bytes of data storage and 2 bytes for administrative purposes. Table 4-1 details on the memory organization of the my-d NFC. The my-d NFC Memory is organized in 3 Areas: 1. Service Area stores manufacturer data, configuration data and personalization data, which are configured at chip delivery. This area is located from page 0000 H to page 0002 H. 2. User Area which stores User Data in up to 509 pages, depending on the product variant. The NFC memory area is mapped into the User Area. 3. Administration Area stores access rights. Two bytes per page, byte 08 H and byte 09 H, are reserved for Sector Index and Access Condition. Table 4-1 my-d NFC memory configuration (based on SLE 66R16P) my-d Page address Byte Number within a page Administration Area 1) Sector Index Access Condition Service Area 0000 H 55 H 46 H 0001 H my-d Service Area 55 H AA H 0002 H 55 H X6 H 0003 H 55 H AA H 0004 H 55 H AA H my-d User Data H AA H H AA H User Area 007F H 55 H AA H 0080 H 2) 55 H AA H H AA H Dedicated kbyte NFC Forum Type 2 Tag memory H AA H... Sector 0 55 H AA H H AA H 00FF H 3) 1) The Adminstration Area is transparent for the user and cannot be read directly. 2) NFC sector start address depends on the product variant (see Table 4-2) 3) Highest available page address depends on the product variant (see Table 4-2) 55 H AA H The general structure of the memory consists of pages of ten bytes each. Eight bytes (bytes 00 H to 07 H ) are data bytes and the two most significant bytes are administration bytes that carry information about the Access Condition (AC) and the Sector Index (SI, set to 55 H ) valid for that page. The whole memory space may be accessed with page-oriented commands (8 data bytes), bytes 08 H and 09 H can only be written using the Write Byte command. Additional commands to support the Value Counter functionality are implemented (e.g. Restricted Write). Data Book 19 /

20 Memory, Access Rights and Chip States Additionally the NFC Forum Type 2 Tag memory space can be accessed with the dedicated NFC command set (see Chapter 5.2.2). Table 4-2 Chip type SLE 66R04P 1) Chip variants of my-d NFC (memory sizes in bytes) Total memory Service Area User Area my-d Administration Area Highest page address (my-d ) NFC memory size D H n.a. n.a. SLE 66R16P FF H H SLE 66R32P FF H H 1) The SLE 66R04P does not support NFC Forum Type 2 Tag functionality. NFC memory start address (page) Service Area The Service Area consists of 3 pages and contains following data (read-only): Page 0000 H holds the 7-byte Unique IDentification number (UID) which is unique for each chip Page 0001 H holds the Issuer Tag (IT) Page 0002 H holds the manufacturer data. Byte 00 H of this page keeps the information about the memory size of the product variant, high data rate support and plain or secure chip information. Table 4-3 Service Area my-d NFC Service Area my-d Page address Byte Number within a page H Unique IDentification number (UID) 0001 H Reserved IT 1) 0002 H CI 2) 1) Issuer Tag 2) Chip Information byte Reserved Manufacturer Data Unique IDentification number UID (page 0000 H ) The UID in page 0000 H has the following structure: Table 4-4 Description of page 0000 H content Byte number Double size UID CT = 88 H uid0 = 05 H uid1 uid2 uid3 uid4 uid5 uid6 For the contents of page 0000 H following definitions apply: The my-d NFC supports only cascade level 2. CT is the cascade tag as defined in ISO/IEC The uid0 byte has a value of 05 H and indicates Infineon as chip manufacturer accord. to ISO/IEC /AM1. The higher nibble of the uid1 byte includes a proprietary chip family identifier which can be used to determine the basic command set for the chip. The coding of this nibble is described in Table 4-5. The lower nibble of the uid1 byte is reserved for future use and is set to 0000 B. It shall not be used to determine the chip family. Data Book 20 /

21 Memory, Access Rights and Chip States Table 4-5 Chip Family Identification my-d NFC UID field Value Description uid0 05 H Manufacturer ID according to ISO/IEC7816-6/AM1 uid1 1) 10 H Identifies the support of the my-d command set only (SLE 66R04P) Lower nibble: RFU and set to 0 H 20 H Identifies the support of the my-d command set and the NFC Forum Type 2 Tag command set (SLE 66R16P and SLE 66R32P) Lower nibble: RFU and set to 0 H 1) Please note that the lower nibble of the uid1 byte shall not be checked for chip family identification! Issuer Data and Issuer Tag (page 0001 H ) The Issuer Tag is located in byte 01 H of page 0001 H. The chip is delivered in User Mode with the higher nibble of the Issuer Tag set to any other value than A H. Table 4-6 Manufacturer Data (page 0001 H ) Byte number ) IT... Issuer Tag The lower nibble of the Issuer Tag defines parts of the user memory to be accessible with NFC Forum Type 2 Tag commands. Table 4-7 Mode Configuration IT 1) Description Higher nibble of the IT Lower nibble of the IT User Mode any other value than A H NFC memory configuration The start address for the Type 2 Tag memory and the available memory size for this functionality is depending on the memory size of the derivative. Table 4-8 Issuer Tag (lower nibble) Issuer Tag (IT) of my-d NFC Type NFC Sector Start address (my-d page address) NFC memory size [bytes] Highest page address (my-d page address) 0 H SLE 66R04P n.a. n.a. 004D H 2 H SLE 66R16P 0080 H FF H 4 H SLE 66R32P 0100 H FF H Data Book 21 /

22 Memory, Access Rights and Chip States Manufacturer Data (page 0002 H ) The manufacturer page contains data which are programmed and locked at manufacturing. It is located in page 0002 H. Byte 00 H holds information about the memory size of the product variant, plain or secure version as well as the product information. Table 4-9 Manufacturer Data (page 0002 H ) Byte number CI 1) 1) CI... Chip Information Byte Manufacturer Data Chip Information Byte (page 0002 H, byte 00 H ) Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit1 Bit0 55R / 66R Secure / Plain x x x RFU 0 B Secure chip 1 B Plain chip Memory size: 010 B kbit (78 pages) 100 B 2 4 = 16 kbit (256 pages) 101 B 2 5 = 32 kbit (512 pages) Figure 4-1 Chip Information Byte Coding The table below details the chip information byte for the different my-d NFC product variants. All bits marked with x shall be ignored for chip identification (RFU). Table 4-10 Chip Information 1) 11xx x000 B 11xx x100 B 0 B SLE 55RxxE my-d proximity enhanced 1 B my-d NFC or SLE 66RxxS my-d proximity 2 Chip Information (CI) of my-d NFC Type SLE 66R04P SLE 66R16P 11xx x101 B SLE 66R32P 1) Please note that Bit[5:3] shall not be evaluated as this information may change for future revisions. Data Book 22 /

23 Memory, Access Rights and Chip States User Area All pages from address 0003 H (3 D ) are reserved for my-d User Data. The amout of memory depends on the product variant. The NFC sector(s) is (are) mapped into the my-d User Area. Table 4-11 my-d NFC memory configuration (based on SLE 66R16P) my-d Page address Byte Number within a page Sector Index Administration Area Access Condition Service Area 0000 H 55 H 46 H 0001 H my-d Service Area 55 H AA H 0002 H 55 H X6 H 0003 H 55 H AA H 0004 H 55 H AA H my-d User Data H AA H H AA H User Area 007F H 55 H AA H 0080 H 1) 55 H AA H 1) NFC sector start address depends on the product variant (see Table 4-2) 2) Highest available page address depends on the product variant (see Table 4-2) The Access Condition and the Sector Index of a page are defining the access rights for that page (see Chapter 4.4.1). The data format of one page can be either Value Counter or plain data. Please note: H AA H Dedicated kbyte NFC Forum Type 2 Tag memory H AA H... Sector 0 55 H AA H H AA H 00FF H 2) invalid Sector Indexes (other values than 55 H ) prevent any access to the corresponding page of the my-d NFC Type 2 Tag memory: invalid Access Conditions (other values than xa H or x6 H ) are preventing any access my-d NFC memory: invalid Access Conditions (other values than xa H, x5 H or x6 H ) are preventing any access Administration Area 55 H AA H Two administration bytes are assigned to each page. They hold the Access Condition (see Chapter 4.4.1) and the Sector Index of the page (always preset to 55 H indicating sector 0 for this chip variant). These bytes are only accessible by the use of the Write Byte command and cannot be read. The Access Condition and Sector Index byte are corruption protected (protection against memory preparation). Each bit in each byte is stored non-inverted and inverted. Valid values for each of the two nibbles are: 5 H, 6 H or A H. Data Book 23 /

24 Memory, Access Rights and Chip States 4.2 NFC Memory Organization The NFC Forum Type 2 Tag memory is mapped into the my-d Data Area; the start address of the dedicated NFC Forum Type 2 Tag memory depends on the chip variant (see Table 4-2). This portion of the memory is additionally accessible with the NFC Forum Type 2 Tag command set. Table 4-12 shows the default memory organization of the 2-kByte my-d NFC chip. The whole memory is configured to be plain memory and the chip is in User mode. The memory content at delivery is specifically explained in Table 4-14 Table 4-12 my-d NFC SLE 66R32P memory configuration my-d Page address Byte Number within a page Service Area 0000 H my-d Service Area 0001 H 0002 H 0003 H 0004 H my-d User Data my-d User Area 00FF H 0100 H... Dedicated 1 kbyte NFC Forum Type 2 Tag memory... Sector 0 017F H 0180 H... Dedicated 1 kbyte NFC Forum Type 2 Tag memory... Sector 1 01FF H The general memory organization consists of pages with 8 bytes each. In the dedicated Type 2 Tag memory area two 4-byte NFC memory blocks are mapped into one my-d page. Additionally the my-d NFC provides an associated byte for each page to control read/write access (Access Condition byte, write-only). The whole memory area (Service Area and User Area) is accessible with the my-d Command set. The given page address range is valid for the my-d Command set. The NFC Forum Type 2 Tag memory is mapped into the my-d User Area; the start address of the dedicated NFC Forum Type 2 Tag memory depends on the chip variant (see Table 4-2). This portion of the memory is also accessible with the NFC Forum Type 2 Tag command set. The my-d NFC chips may be in UNINITIALIZED or INITIALIZED state according to the definition of the NFC Forum Type 2 Tag life cycle: in UNINITIALIZED state the whole memory in the NFC sectors is set to 00 H and they need to be initialized prior to be used in a NFC Forum Type 2 Tag infrastructure (see Table 4-13). This affects all deliveries until in INITIALIZED state the my-d NFC chips come with the Capability Container bytes programmed and an empty NDEF message in the first NFC Forum Type 2 Tag sector. Table 4-14 shows the memory content of a SLE 66R32P chip in INITIALIZED state. Deliveries beginning in 2011 will be initialized already. Data Book 24 /

25 Memory, Access Rights and Chip States Table 4-13 NFC Forum Type 2 Tag memory mapping (based on SLE 66R32P) NFC Block address n/a 1) Byte Number within a block my-d page address 88 H 05 H 20 H uid H uid3 uid4 uid5 uid6... IT H CI H my-d User Area 00FF H Type 2 Tag address range Sector 0 Type 2 Tag address range Sector 1 00 H 0100 H L 2) 01 H H 3) 02 H 0101 H L 03 H Dedicated H 04 H 1 kbyte NFC Forum Type 2 Tag memory 0102 H L 05 H Sector 0 H FE H 017F H L FF H 00 H 03 H Dedicated H... 1 kbyte NFC Forum Type 2 Tag memory Sector 1 4)... FF H H 1) n/a... not addressable with the NFC Forum Type 2 Tag command set 2) L... even NFC block addresses references to byte 0-3 of a my-d page. The lower nibble of the access byte controls the read/write access of the byte 0-3 of a my-d page 3) H... odd NFC block addresses references to byte 4-7 of a my-d page. The higher nibble of the access byte controls the read/write access of the byte 4-7 of a my-d page 4) Sector 1 has to be selected with the Sector Select command H 0180 H L 01 H H 02 H 0181 H L FC H 01FE H L FD H FE H 01FF H L H my-d address range Data Book 25 /

26 Memory, Access Rights and Chip States Table 4-14 NFC Forum Type 2 Tag memory in INITIALIZED state (based on SLE 66R32P) NFC Block address n/a Byte Number within a block my-d page address 0000 H my-d Service Area H my-d User Area FF H 00 H Internal0 Internal1 Internal2 Internal H L Type 2 Tag address range Sector 0 Type 2 Tag address range Sector 1 01 H Internal4 Internal5 Internal6 Internal7 H 02 H Internal8 Internal9 LOCK0=00 H LOCK1=00 H 0101 H L 03 H CC0 = E1 H CC1 = 10 H CC2 = FE H CC3 = 00 H H 04 H 03 H 00 H FE H 0102 H L 05 H H FE H 017F H L FF H H 00 H 0180 H L 01 H H 02 H 0181 H L 03 H H FC H 01FE H L FD H H FE H 01FF H L FF H H my-d address range Data Book 26 /

27 Memory, Access Rights and Chip States Transport Configuration my-d NFC devices are delivered with following memory content: my-d Service Area: contains predefined UID and manufacturing information, read-only (see Chapter 4.1.1) NFC Sector 0 1) Internal0 - Internal9 set to 00 H LOCK0, LOCK1 set to 00 H chip dependant setting for CC0 - CC3 as indicated in Table empty NDEF message TLV including Terminator TLV (= FE H ) as indicated in Table 4-16 read / write access (can be overwritten) all other user memory (within my-d User Area, Type 2 Tag Sectors 0 and 1) set to 00 H Table 4-15 Capability Container settings for my-d NFC Chip Type CC0 CC1 1) SLE 66R16P E1 H 10 H (may be changed to 11 H if needed) CC2 2) 7E H CC3 00 H SLE 66R32P E1 H 10 H (may be changed to 11 H if needed) 1) my-d NFC also supports Version 1.1 of the NFC Forum Type 2 Tag specification. 2) CC2 indicates the memory size of the data area of the Type 2 Tag; the given values represent the maximum values for the chips FE H 00 H Table 4-16 defines the empty NDEF Message TLV (identified with the Tag field value of 03 H ). The Length field value is set to 00 H ; due to that the Value field is not present. The Terminator TLV (FE H ) is the last TLV block in the data area. Table 4-16 Empty NDEF message NDEF Message TLV Terminator TLV Tag field Length field Value field Tag Field Length field Value field 03 H 00 H - FE H - - Table 4-14 shows the transport configuration of SLE 66R32P; it is set to INITIALIZED state (life cycle) according to the NFC Forum Type 2 Tag specification. 1) Settings of the NFC Sector are not applicable for SLE 66R04P. Data Book 27 /

28 Memory, Access Rights and Chip States bit Value Counter my-d NFC features Value Counters with integrated Anti-tearing functionality Counter Mechanism Each page of the data area may be defined as counter page. A counter page is a single 8-byte page which is initialized with two 4 byte counters and the Access Conditions set accordingly. Due to the concept only one counter is valid where the other is normally 00 H 00 H 00 H 00 H. This principle allows supporting an anti-tearing mechanism. Counter 0 Counter 1 Byte number within a page Maximum value valid counter 00 H 00 H 00 H 00 H Lower value 00 H 00 H 00 H 00 H valid counter Next lower value valid counter 00 H 00 H 00 H 00 H Zero value 00 H 00 H 00 H 00 H valid counter Figure 4-2 Counter Mechanism Thus a normal decreased counter page always contains 4 byte with a valid counter value and the other 4 byte set to 00 H 00 H 00 H 00 H. Cases with 4 byte containing a valid counter and the other 4 byte with any value indicate an aborted counting operation; for further information please refer to Chapter Counting is done by transmitting counter data fulfilling the condition "lower than the previous value" Debit the Value Counter Using the "Restricted Write" or "Restricted Write and Reread" command. With each successful command my-d NFC switches from Counter 0 to Counter 1 and vice versa. Lower byte / LSB is transmitted first The counter data must fulfill a dedicated counter format to ensure data redundancy. Data Book 28 /

29 Memory, Access Rights and Chip States Anti-tearing my-d NFC supports the detection of an interrupted counting operation due to the concept using two counters in a page defined as counter page. A malfunction of the counting may be caused by a power loss during the update of the counter data stored in the EEPROM. Due to physical characteristics the change of EEPROM data requires an erase / write cycle. Thus the chip needs several intermediate states during a counter update. Counter 0 Counter 1 Byte number within a page Start state valid counter (start value) 00 H 00 H 00 H 00 H or any data Erase unused counter valid counter (start value) erase 00 H 00 H 00 H 00 H Write new counter value valid counter (start value) write valid counter (new value) erase Updated state 00 H 00 H 00 H 00 H valid counter (new value) Figure 4-3 Intermediate Counter States Especially during the erase and write also random data may appear because of the physical process. Thus a PCD shall operate a my-d NFC in the following way: 1. Read counter page valid counter (start value) 00 H 00 H 00 H 00 H Correct counter state Figure 4-4 Counter (start value) 2. Restricted write with new counter value represents the debit command 3. Read counter page 00 H 00 H 00 H 00 H valid counter (new value) Correct counter state Figure 4-5 Counter (new value) This indicates a successfully finished counting operation. Data Book 29 /