Inv.# 557 ONE CHIP MICROCONTROLLER FOR ELECTRONIC PLASTIC CARDS Preliminary datasheet September 2010 revised January 2012

Size: px

Start display at page:

Download "Inv.# 557 ONE CHIP MICROCONTROLLER FOR ELECTRONIC PLASTIC CARDS Preliminary datasheet September 2010 revised January 2012"

Rosalyn Park
5 years ago
Views:

1 BASIC CHARACTERISTICS RF INTERFACE IN COMPLIANCE WITH ISO/IEC 14443A Contactless energy supply and data transmission Operating distance between the card and the read-write device antenna: up to 100mm (depending on antenna geometry and read-write device power) Operating frequency: MHz Data transfer rate: 106 kbps High data integrity during the transmission: 16-bit cyclic checksum (CRC), parity, bit coding, bit counting Anticollision algorithm Unique 7-byte serial number (Cascade level 2 according to ISO/IEC ) EEPROM SECURITY 640 bits of protected EEPROM for storing data organized in 20 pages with 4 byte each Reprogramming protection function for 13 pages 32-bit one-time programmable data area with a reprogramming protection function 96 bits (3 pages) of one-time programmable memory without reprogramming protection 32 bits (page number 19) of one-time programmable memory with preprogramming data from fab 384 bits (12 pages) available for read/write Data retention: 5 years Not less than rewrite cycles 7-byte serial number for anti-copying protection of each device GENERAL DESCRIPTION The controller has been developed in compliance with ISO/IEC 14443A. An exchange protocol level corresponds to parts 2 and 3 of the ISO/IEC 14443A standard. The controller is a dedicated IC primarily intended for usage as a contactless single trip ticket in the public transport system. CONTACTLESS ENERGY AND DATA TRANSFER The controller does not need an outer or battery power supply. The power supply and high-speed data transmission with 106 kbps is implemented by means of a RF exchange when the controller antenna is positioned near to the reader device antenna. ANTICOLLISION ALGORITHM An intellectual anticollision function enables the reader device to simultaneously process more than one card. The anticollision algorithm allows for preventing interactions of several cards, which are inside the reader field by an independently addressing to each card. The anticollision function is based on an individual controller serial number UID. The controller UID is 7-byte long and supports the Cascade level 2 in compliance with ISO/IEC SECURITY Individual 7-byte serial number is programmed into each controller in the process of manufacturing. It cannot be altered and guarantees the uniqueness of each device. This is an effective anticopying protection mechanism. The serial number can be used for the cryptographic protection of the controller memory data. A unique ID can be used to make various access keys for appropriate cryptographic systems. 96-bit one-time programmable area provides for write-once operations, e.g. for a one-time counter. It may be used for irreversible devalidation of tickets. The programmable lock-to read-only function for 13 pages (e.g., for one one-time programmable page) allows fixing data pagewise. This function enables to program the device for dedicated applications in a unique way. Mikron JSC p.1

2 FUNCTIONAL DESCRIPTION CONTROLLER BLOCK-DIAGRAM The controller microcircuit consists of the 640-bit EEPROM, RF interface and digital control unit. Fig.1 shows a block-diagram of the controller. Energy and data are transmiitted via an antenna, which consists of a coil with several turns directly connected to a controller chip. No external components are needed. Antenna RF interface Control unit Demodulator Anticollision algorithm Clock regenerating circuit Command interpreter Voltage regulator & POR circuit Modulator EEPROM interface EEPROM Radio-frequency (RF) interface includes: Modulator/demodulator Rectifier Clock regenerating circuit Power-on reset (POR) circuit Voltage regulator Fig.1. Controller block-diagram Control unit includes: Anticollision circuit, which ensures independent addressing to several cards and their sequential processing. Command interpreter for processing commands supported by the controller. EEPROM interface EEPROM 640 bits organized in 20 pages with 4 bytes each with 80 bits reserved for manufacturer data, 16 bits used for the lock-toread-only mechanism, 32 bits used for a one-time programmable data area with the reprogramming protection, 92 bits for a one-time programmable data area, and 384 bits user-programmable. CONTROLLER FUNCTIONING ALGORITHM The commands are fed by a reader, which are then processed by controller s command interpreter in accordance with the current state by generating necessary response signals: Fig.2 shows the controller state diagram. Mikron JSC p.2

3 CONTROLLER STATES Fig.2. Controller state diagram IDLE After Power-on Reset (POR) the controller goes over into the idle state (IDLE) with reduced power consumption. The controller goes out of this state only after receiving a REQA or a WUPA command from the reader device. Any other data received in this state is interpreted as an error and the controller stays in the IDLE mode. If the HALT command is executed correctly, the controller goes over into the HALT waiting state, of which the controller can be run out by the WUPA command. Henceforth upon receiving an incorrect command in any of the states, the controller shall go over into the HALT waiting state (not in the IDLE state). READY1 In this state the controller enables the reader device to carry the first stage of its identification and to receive the first 3 bytes of controller s UID serial number by a ANTICOLLISION or a SELECT command of Cascade level 1. The controller goes out of this state correctly only upon receiving either of two commands. After executing the SELECT command of Cascade level 1 the controller goes over into the state READY2, in which the second part of controller s UID identification is executable. By executing the READ command (from address 0) the complete anticollision mechanism may be omitted and the controller at once jumps over into the ACTIVE state. Note: If there is more than one controller in the reader device field, the READ command execution (from address 0) shall cause a collision because of different serial numbers of controllers, but in spite of that all controller devices shall be selected! Any other commands received in the READY1 state are interpreted as an error and the controller goes over to the waiting state (IDLE or HALT depending upon its previous state). Mikron JSC p.3

4 READY2 The READY2 state is like the READY1 state, but it enables to conduct the second stage of controller identification and to receive the rest 4 bytes of controller s UID serial number by the ANTICOLLISION command of Cascade level 2. The correct exit from this state is implementable with the SELECT command of Cascade level 2. Similarly, to go over from the READY2 state into the ACTIVE state is possible with the READ command (from address 0) like jumping-over from the READY1 state. Note: If there is more than one controller in the reader device field, the READ command execution (from address 0) shall cause a collision because of different serial numbers of controllers, but in spite of that all controller devices shall be selected! Controller s response to the SELECT command of Cascade level 2 is the transmission of the SAK (Select Acknowledge) byte. In accordance with ISO/IEC this byte content indicates whether the anticollision cascade procedure is ended. It also defines the type of the device selected for the MIFARE architecture platform. After executing the SELECT command of Cascade level 2 solely selected is the controller, which passed all the stages of the anticollision procedure and only this controller shall keep on maintaining the communication with the reader device even if other contactless devices are in the reader device field. Any other commands received in the READY2 state are interpreted as an error and the controller goes over into the waiting state (IDLE or HALT depending upon the previous state). ACTIVE In the ACTIVE state either a READ (16 bytes) or a WRITE (4 bytes) command is performable. The correct way of driving the controller out of this state is executing the HALT command. Any other commands received in this state are interpreted as an error and the controller goes over back into the waiting state (IDLE or HALT depending upon the previous state). HALT The HALT state like the IDLE state is another waiting state realized in the controller. The controller that has already been serviced by the reader device can be set into this state by means of the HALT command. This state helps the reader device during the anticollision procedure with detecting new devices while driving the already processed ones into the waiting state. The only way to drive the controller out of the HALT state is transmitting the WUPA command thereto. Any other data received in this state is interpreted as an error by leaving the controller in that state. DATA INTEGRITY So that to ensure a reliable data transmission between the reader device and controller thru the contactless communication channel the following mechanisms are used: 16-bit cyclic checksum (CRC) per each transmittable block Parity bits for each byte Bit count checking Bit coding for distinguishing ones, zeros and no information Channel monitoring (protocol sequence and bit flow analysis). RF INTERFACE Controller s RF interface corresponds to ISO/IEC 14443A. The RF field from the reader device must be present permanently (with short pauses during the transmission) like it is used for supplying power to the card. For transmitting data in both directions only one start bit in the beginning of each frame is used. Each byte is transmitted with a parity bit (odd parity) in the end. Transmitted first is a least significant bit (LSB) beginning with a byte with the lowest address of the selected data block. The maximum frame length is 163 bits (16 data bytes + 2 CRC bytes = 16*9 + 2*9 + 1 start bit). EEPROM organization 640-bit controller memory consists of 20 pages with 4 bytes each. The memory structure is presented in Fig.3. Bold-faced is the memory area available for a user. A 56-bit serial number, bytes of a serial number checksum and a service information byte are programmed in the process of manufacturing and are inaccessible for alteration after the manufacturing. Mikron JSC p.4

5 Byte Number Page Serial Number SN0 SN1 SN2 BCC0 0 Serial Number SN3 SN4 SN5 SN6 1 Internal/Lock BCC1 Internal Lock0 Lock1 2 OTP OTP0 OTP1 OTP2 OTP3 3 Data read/write Data0 Data1 Data2 Data3 4 Data read/write Data4 Data5 Data6 Data7 5 Data read/write Data8 Data9 Data10 Data11 6 Data read/write Data12 Data13 Data14 Data15 7 Data read/write Data16 Data17 Data18 Data19 8 Data read/write Data20 Data21 Data22 Data23 9 Data read/write Data24 Data25 Data26 Data27 10 Data read/write Data28 Data29 Data30 Data31 11 Data read/write Data32 Data33 Data34 Data35 12 Data read/write Data36 Data37 Data38 Data39 13 Data read/write Data40 Data41 Data42 Data43 14 Data read/write Data44 Data45 Data46 Data47 15 OTP Data48 Data49 Data50 Data51 16 OTP Data52 Data53 Data54 Data55 17 OTP Data56 Data57 Data58 Data59 18 Reserved Data60 Data61 Data62 Data63 19 Fig.3. Microcontroller memory structure SERIAL NUMBER (UID) AND LOCK BITS The unique 7-byte serial number (UID) and its two Checksum Bytes are programmed in the first 9 bytes of the controller memory. Thus the serial number occupies pages 0, 1, and the first byte of page 2. The second byte of page 2 contains the technological information for internal use. These 10 bytes are programmed in the manufacturing process and their alteration is impossible in the user mode. MSB LSB х х х Manufacturer code Page 0 Page 1 Page 2 Byte Serial number Serial number (SN0, SN1, SN2) (SN3, SN4, SN5, SN6) Checksum 1 Checksum 0 Service byte Lock bits Lock bits L L L L L L L L L L L L L L L MSB LSB MSB LSB L 8 Bit Lx locks page to Read-Only Bit BLx-y blocks bits Lx-Ly Fig.4. Serial number and lock bits According to ISO/IEC the Checksum byte 0 (BCC0) is defined as a modulo 2 sum of bytes CT, SN0, SN1 and SN2. The Checksum byte 1 (BCC1) is defined and a modulo 2 sum of bytes SN3, SN4, SN5 and SN6. The byte SN0 is used for writing a manufacturer s code in accordance with ISO/IEC and ISO/IEC AMD.1. Mikron JSC p.5

6 The bits of byte 2 and 3 of page 2 are used for locking pages 3 to 15 to Read-Only. Each page can be writing-protected individually by setting a corresponding locking bit. After setting the protection bit corresponding to the page that page is accessible for read-only. Bit 2 blocks the setting of Lock-to-Read-Only bit for a memory area consisting of pages 10 to 15. Bit 1 manages the same for pages 4 to 9, bit 0 for page 3. That means, that upon setting blocking bit corresponding to a memory area any further alteration of protection bits for pages entering in that memory area is impossible. The locking and block-locking bits are set by the WRITE command. Bytes 10 and 11 are one-time programmable cells, i.e., the setting a bit to 1 is possible, but its changing back to 0 is not. Note: Pages 16 to 18 of one-time programmable memory do not have Lock-to-Read-Only bits. Page 19 reserved for special marks. ONE-TIME PROGRAMMABLE (OTP) BYTES Page 3, as well as pages 16 to 18 of the controller memory consist of one-time programmable bytes. In the manufacturing process the contents of these bytes are set to 0. When writing into this page the new contents are bit-wise OR-ed between the write data and previous contents of the page, i.e. the setting of OTP bits to 1 is possible and its changing back to 0 is not. Thus these memory areas may be used as a tariff counter. Page 3 Example Initial state Bytes One-time programmable bytes (OTP) Write Command to OTP page: Bytes Pages 16 to One-time programmable bytes (OTP) Result Write Command to OTP page: Result ELECTRICAL PARAMETERS Absolute maximum ratings Input current as high as 30 ma Latch current as low as 100 ma Storage temperature -40 o C to +125 o C ESD protection as low as 2kV Table. Electrical parameters Т = -25 to+70с (if not specified otherwise) Fig.5. One-time programmable bytes Designation Parameter Min. Typ. Max. Unit Fin Operating frequency MHz Cin Input capacity, T=22С, Fin = MHz, Vin = 2V pf Twr EEPROM programming time ms Mikron JSC p.6

7 CHIP SIZE AND PAD LOCATION 530 um RF1 NC2 610 um NC1 RF2 67 um 67 um RF1, RF2 antenna inputs NC not connected Pads Coordinates Size RF1 112,0 x 524,0 um 90 x 90 um RF2 356,7 x 84,5 um 90 x 90 um NC1 100,0 x 73,5 um 60 x 60 um NC2 371,5 x 539,0 um 60 x 60 um Fig.6. Chip size and pad location (preliminary) Mikron JSC p.7

MF1ICS General description. Functional specification. 1.1 Key applications. 1.2 Anticollision. Energy. MIFARE card contacts La, Lb.

MF1ICS General description. Functional specification. 1.1 Key applications. 1.2 Anticollision. Energy. MIFARE card contacts La, Lb. Rev. 1.1 29 January 2008 Product data sheet 132211 PUBLIC 1. General description NXP has developed the MIFARE to be used in a contactless smart card according to ISO/IEC 14443 Type A. The MIFARE IC is