Proximity reader for 13.56MHz Contactless module MiFare,ISO14443 type A /B

Transcription

1 EBM-RF700 SPECIFICATION Proximity reader for 13.56MHz Contactless module MiFare,ISO14443 type A /B REV 1.0 E2BOX COMPANY E2BO X

2 INDEX 1. FEATURES SYSTEM BLOCK DIAGRAM SYMBOLS AND ABBREVIATED TERMS INTERFACE REQUIREMENTS COMMUNICATION PROTOCOL SEQUENCE COMMUNICATION PROTOCOL DESCRIPTIONS COMMUNICATION DETAILS MEMORY ORGANIZATION PICC Type A state diagram DIMENSIONS EBRF700 Test Program E2BO X 2

3 1. FEATURE Proximity Smart Card reader module for ISO/IEC type A/B, Mifare Contactless transmission of data and energy supply Support Mifare protocol,iso Type A / B protocol Support Cryto_Key for Mifare card. Support anti-collision Carrier Frequency :13.56Mhz Antenna Matching : Direct Matching Supply voltage : 5V ± 0.2V Typical Power consumption :110mA Maximum Power consumption (with card) :180mA PowerDown mode for low power standby current consumption :40mA Module Interface : Serial RS-232C Card Proximity operating distance :up to 70mm Operation Temperature : 0 ~70 Dimension : 53.9 * 55.9 * 6mm E2BO X 3

4 2. SYSTEM BLOCK DIAGRAM 2-1 BLOCK DIAGRAM PCD(EBRF-700) ICs for contactless communication Poximity Interface Circuit Card MCU RS-232C interface HOST 2-2. RS-232 Connection PCD (EBRF-700) HOST TXD RXD SG TXD RXD SG E2BO X 4

5 3. SYMBOLS AND ABBREVIATED TERMS PCD PICC UID ATQA RATS ATS PUPI AFI : Proximity Coupling Device : Proximity Interface Circuit Card : Unique Identifier : Answer To Request, Type A : Request for Answer To Select : Answer To Select : Pseudo-Unique PICC Identifier, Type B : Application Family Identifier. Card preselection criteria by application, Type B etu : elementary time unit -for more information refer to ISO/IEC E2BO X 5

6 4. INTERFACE REQUIREMENTS 4-1. Interface Connector 5Pin description (Module base) Pin No Description VCC GND TXD RXD GND VCC : Power Input (5V) GND :Ground TXD : Serial Data Output (RS232 Level) RXD : Serial Data Input (RS232 Level) 4-2. Serial Port Definition(RS-232C) BAUDRATE :4800 bps ~115200bps (default :38400bps) PARITYBIT : No Parity DATABIT :8Data bits STOPBIT :1Stop bit No H/W flow controls E2BO X 6

7 5. COMMUNICATION PROTOCOL SEQUENCE 5.1. Regular Operations HOST Command PCD Execution Response 5.2. Irregular Operations (Communications Errors ) 100ms timeout HOST Command Command Command PCD Command is canceled Execution HOST Command Command Error PCD CheckSumErr Execution E2BO X 7

8 6. COMMUNICATION PROTOCOL DESCRIPTIONS 6-1. COMMAND &RESPONESE FORMAT STX LENGTH COMMAND (RESPONSE) DATA[n] CheckSum 1byte 1byte 1byte nbyte 1byte STX :(02)hex LENGTH : Length of COMMAND and DATA COMMAND : Command byte DATA[n] : Data byte, 254 n 0 DATA exists value of LENGTH is big than (01)hex Checksum :Inverted value after adding from LENGTH to DATA[n] 1byte The overflow which it exceeds disregards. CheckSum = LENGTH +COMMAND +DATA[n] *EXAMPLE Read firmware version STX LENGTH COMMAND CHK (02)h (01)h (40)h (BE)h Enter PowerDown mode (02)h (02)h (01)h (01)h (FB)h Write Data to Mifare block (02)h (12)h (28)h (10)h ( AABBCCDDEEFF00)h (BD)h E2BO X 8

9 6-2. COMMAND CODE LIST SYSTEM COMMAND LIST COMMAND DATA Description POWER DOWN (01)h Exit PowerDown Mode Enter PowerDown Mode (00)h (01)h Power Down Mode, RF field of antenna set Off bps (03)h 57600bps (04)h Set baudrate. SET BAUDRATE (03)h 38400bps 19200bps (05)h (06)h Databit, stopbit, parity is fixed. Stopbit : 1bit Databit : 8bit 9600bps (07)h Parity is none 4800bps (08)h RESET (04)h NONE Reset DLM520 module. WRITE E2P (11)h Addr(1byte) E2p data(nbyte), 1 n 16 Write data to RC531 internal EEPROM READ E2P (12)h Addr(1byte) Size to read(1byte) Read data from RC531 internal EEPROM FIRMWARE VERSION (40)h NONE Sends firmware version to the HOST RC531 INFORMATION (41)h NONE Sends RC531 information to the HOST E2BO X 9

10 ISO14443_TYPE_A COMMAND LIST COMMAND DATA Description REQA (21)h NONE Send Request command WUPA (22)h NONE Send WakeUp command HLTA (23)h NONE Set aselected card into the halt mode SELECT (24)h NONE Select the card after Anticollision Loop. RATS (25)h NONE Send RATS command E2BO X 10

11 MiFare COMMAND LIST COMMAND DATA Description Auth mode(1byte) AUTHENTICATION (26)h Block number of card(1byte) Auth key(6 byte) Starts the authentication sequence. UID(4 byte) READ (27)h Bock number of card(1byte) Reads one block of 16bytes from aselected and authenticated card. WRITE (28)h Block number of card(1byte) Write data(16byte) Writes one block of 16bytes to aselected and authenticated card. Block number of card(1byte) Increases the contents of VALUE INCREMENT (29)h Value(4byte) the value block by the Target Blcok (1byte) transmitted value. Block number of card(1byte) Decreases the contents of VALUE DECREMENT (2A)h Value(4byte) the value block by the Target Blcok (1byte) transmitted value. Auth mode(1byte) Performs Request, Select, REQ_SEL_AUTH (31)h Block number of card(1byte) Authentication operations at Auth key(6 byte) once. Auth mode(1byte) Performs Request, Select, REQ_SEL_AUTH_READ (32)h Block number of card(1byte) Authentication, Read Auth key(6 byte) operations at once. CHANGE_AUTHKEY (34)h Block number of card(1byte) Auth key(6 byte) Change Authentication KeyA of Block. E2BO X 11

12 ISO14443_TYPE_B COMMAND LIST COMMAND DATA Description REQB (51)h NONE Send Request command WUPB (52)h NONE Send WakeUp command ATTRIB (53)H PUPI (4 byte) YN14443_4(1 byte) Send ATTRIB command HLTB (54)H PUPI (4 byte) Set aselected card into the halt mode ISO TYPE A/BCOMMAND LIST COMMAND DATA Description EXCHANGE BLOCK (60)h Data to send(n byte), 0 n 250 Sends data to the accessed card. DESELECT (61)H NONE Set aselected card into the DESELECT mode E2BO X 12

13 6-3. STATUS &ERROR CODE LIST STATUS LIST DESCRIPTION OK (00)h No error. NOTAGERR (01)h No tag error. RCVERR (03)h Faming error or CRC error. INITERR (04)h Initialization error. TXTIMEOUT (10)h Transmission time out. TXTIMEOUT2 (11)h Transmission time out. RXTIMEOUT (12)h Reception time out. RXTIMEOUT2 (13)h Reception time out. RESETERR (20)h Reset error. INTERFACEERR (21)h RF interface error. NOTAUTHERR (22)h Not authentication error. CODEERR (23)h Code error. WRITEERR (24)h Write error. VALUEERR (25)h Invalid value format error. CHKSUMERR (40)h Checksum error. INVALIDFORMAT (41)h Invalid format error. INVALIDCOMMAND (42)h Invalid command. BLOCKERR0 (30)h Block error. BLOCKERR1 (31)h Block error. BLOCKERR2 (32)h Block error. BLOCKERR3 (33)h Block error. E2BO X 13

14 7. COMMUNICATION DETAILS 7-1. SYSTEM COMMAND LIST POWER DOWN Power Down Mode, RF field of antenna set Off. Reduce current consumption. -COMMAND (02)h (02)h (01)h power_on/off power_on/off :(00)h (01)h Exit PowerDown mode. Enter PowerDown mode. -RESPONSE :OK, CHKSUMERR, INVALIDFORMAT SET BAUDRATE Set baudrate. Databit, stopbit, parity is fixed. Stopbit : 1bit, Databit : 8bit, Parity is none. -COMMAND (02)h (02)h (03)h baudrate baudrate : (03)h bps (04)h 57600bps (05)h 38400bps (*default) (06)h 19200bps (07)h 9600bps (08)h 4800bps - RESPONSE : OK, CHKSUMERR, INVALIDFORMAT E2BO X 14

15 RESET Reset DLM520 module. -COMMAND STX LENGTH COMMAND CHK (02)h (01)h (04)h -RESPONSE :OK, CHKSUMERR WRITE E2P Write data to RC531 internal EEPROM. -COMMAND (02)h 1+n (11)h e2p_addr e2p_data[n-1] e2p_addr : Block address in EEPROM. (0x30~0x7f ) e2p_data[n-1] :Data to be written. *e2p write_data length : 1~16 -RESPONSE :OK, CHKSUMERR, INVALIDFORMAT READ E2P Read data from RC531 internal EEPROM. -COMMAND (02)h (03)h (12)h e2p_addr size e2p_addr : Block address in EEPROM. (0x00~0x7f) size :Size to read *e2p read_data length : 1~64 -RESPONSE :OK, CHKSUMERR, INVALIDFORMAT STX LENGTH RESPONSE DATA CHK (02)h 1+n (00)h e2p_data[n] E2BO X 15

16 FIRMWARE VERSION Sends firmware version to the HOST. - COMMAND STX LENGTH COMMAND CHK (02)h (01)h (40)h - RESPONSE : OK, CHKSUMERR STX LENGTH RESPONSE DATA CHK (02)h (05)h (00)h version[4] RC531 INFOMATION Sends RC531 information to the HOST. - COMMAND STX LENGTH COMMAND CHK (02)h (01)h (41)h -RESPONSE :OK, CHKSUMERR STX LENGTH RESPONSE DATA CHK (02)h (11)h (00)h RC531 information[16] RC531 information[16] : Refer to '8-1. Memory Organization of the internal EEPROM of RC531' E2BO X 16

17 7-2. ISO14443_TYPE_A COMMAND LIST REQA Send Request command. -COMMAND STX LENGTH COMMAND CHK (02)h (01)h (21)h -RESPONSE :OK, CHKSUMERR, NOTAGERR STX LENGTH RESPONSE DATA CHK (02)h (03)h (00)h ATQA[0],ATQA[1]* WUPA Send WakeUp command. -COMMAND STX LENGTH COMMAND CHK (02)h (01)h (22)h -RESPONSE :OK, CHKSUMERR, NOTAGERR STX LENGTH RESPONSE DATA CHK (02)h (03)h (00)h ATQA[0],ATQA[1]* Coding of ATQA* b7 b6 b5 b4 b3 b2 b1 b0 b7 b6 b5 b4 b3 b2 b1 b0 RFU Proprietary coding UID size RFU Bit frame anticolision UID size b7 b6 Meaning 0 0 single 0 1 double 1 0 triple 0 0 RFU E2BO X 17

18 HLTA Set aselected card into the halt mode. -COMMAND STX LENGTH COMMAND CHK (02)h (01)h (23)h -RESPONSE :OK, CHKSUMERR SELECT Select the card after Anticollision Loop. -COMMAND STX LENGTH COMMAND CHK (02)h (01)h (24)h -RESPONSE :OK, CHKSUMERR, TIMEOUT, RCVERR STX LENGTH RESPONSE DATA CHK (02)h 3+n (00)h uid_size uid[n] yn uid_size : Number of UID bytes. uid[n] : n bytes UID yn : (00)h PICC not compliant with ISO/IEC (01)h PICC compliant with ISO/IEC RATS Send RATS command. - COMMAND STX LENGTH COMMAND CHK (02)h (01)h (25)h - RESPONSE : OK, CHKSUMERR, TIMEOUT, RCVERR STX LENGTH RESPONSE DATA CHK (02)h 1+n (00)h ATS[n] ATS[n] :nbytes ATS E2BO X 18

19 7-3. MiFare COMMAND LIST AUTHENTICATION Starts the authentication sequence. - COMMAND (02)h (0D)h (26)h auth_mode card_addr key[6] uid[4] auth_mode :Authentication with KeyA - (60)h Authentication with KeyB - (61)h card_addr :Block address of acard key[6] :Authentication key uid[4] : uid of selected card - RESPONSE : OK, CHKSUMERR, INVALIDFORMAT READ Reads one block of 16bytes from aselected and authenticated card. - COMMAND (02)h (02)h (27)h card_addr card_addr : Block address of acard to read - RESPONSE : OK, CHKSUMERR, INVALIDFORMAT, TIMEOUT, RCVERR, NOTAUTHERR, CODEERR STX LENGTH RESPONSE DATA CHK (02)h (11)h (00)h read_data[16] read data[16] : LSB is the first byte of the accessed data block. MSB is the last byte of the accedssed data block WRITE Writes one block of 16bytes to aselected and authenticated card. - COMMAND (02)h (12)h (28)h card addr write data[16] card addr : Block address of acard to write - RESPONSE : OK, CHKSUMERR, INVALIDFORMAT, TIMEOUT, RCVERR, NOTAUTHERR, CODEERR E2BO X 19

20 VALUE INCREMENT Increases the contents of the value block by the transmitted value. - COMMAND (02)h (07)h (29)h card_addr value[4] target_addr card_addr : The address on the card from which the value block is read. value :Signifies asigned 4-byte value. target_addr : The address on the card into which the values of incremented block is transferred. - RESPONSE : OK, CHKSUMERR, INVALIDFORMAT, TIMEOUT, RCVERR, NOTAUTHERR, CODEERR, VALUEERR VALUE DECREMENT Decreases the contents of the value block by the transmitted value. - COMMAND (02)h (07)h (2A)h card_addr value[4] target_addr card_addr : The address on the card from which the value block is read. value : Signifies asigned 4-byte value. target_addr : The address on the card into which the values of decremented block is transferred. -RESPONSE :OK, CHKSUMERR, INVALIDFORMAT, TIMEOUT, RCVERR, NOTAUTHERR, CODEERR, VALUEERR E2BO X 20

21 REQ_SEL_AUTH Performs Request, Select, Authentication operations at once. - COMMAND (02)h (09)h (31)h auth_mode card_addr key[6] auth mode :Authentication with KeyA - (60)h Authentication with KeyB - (61)h card addr :Block address of acard key[6] :Authentication key - RESPONSE : OK, CHKSUMERR, INVALIDFORMAT, TIMEOUT STX LENGTH RESPONSE DATA CHK (02)h (05)h (00)h uid[4] uid[4] :uid of selected card REQ_SEL_AUTH_READ Performs Request, Select, Authentication, Read operations at once. - COMMAND (02)h (09)h (32)h auth_mode card_addr key[6] auth mode :Authentication with KeyA - (60)h Authentication with KeyB - (61)h card addr :Block address of acard key[6] :Authentication key -RESPONSE :OK, CHKSUMERR, INVALIDFORMAT, TIMEOUT, RCVERR, NOTAUTHERR, CODEERR STX LENGTH RESPONSE DATA CHK (02)h (15)h (00)h uid[4] read data[16] uid[4] : uid of selected card E2BO X 21

22 CHANGE_AUTHKEY Change Authentication KeyA of Block. - COMMAND (02)h (08)h (34)h card_addr key[6] card_addr key[6] :Block address of acard :Authentication key - RESPONSE : OK, CHKSUMERR, INVALIDFORMAT, TIMEOUT, RCVERR, NOTAUTHERR, CODEERR E2BO X 22

23 7-4. ISO14443_TYPE_B COMMAND LIST REQB Send Request command. -COMMAND STX LENGTH COMMAND CHK (02)h (01)h (51)h -RESPONSE :OK, CHKSUMERR, NOTAGERR STX LENGTH RESPONSE DATA CHK (02)h (07)h (00)h PUPI[4] AFI yn PUPI[4] : PUPI of selected card AFI : Application Family Identifier. yn : (00)h PICC not compliant with ISO/IEC (01)h PICC compliant with ISO/IEC WUPB Send WakeUp command. -COMMAND STX LENGTH COMMAND CHK (02)h (01)h (52)h -RESPONSE :OK, CHKSUMERR, NOTAGERR STX LENGTH RESPONSE DATA CHK (02)h (07)h (00)h PUPI[4] AFI yn PUPI[4] : PUPI of selected card AFI : Application Family Identifier. yn : (00)h PICC not compliant with ISO/IEC (01)h PICC compliant with ISO/IEC E2BO X 23

24 ATTRIB Send ATTRIB command. -COMMAND (02)h (06)h (53)h PUPI[4] yn PUPI[4] : PUPI of selected card yn : (00)h PICC not compliant with ISO/IEC (01)h PICC compliant with ISO/IEC RESPONSE :OK, CHKSUMERR, NOTAGERR, INVALIDFORMAT HLTB Set aselected card into the halt mode. -COMMAND (02)h (05)h (54)h PUPI[4] PUPI[4] : PUPI of selected card -RESPONSE :OK, CHKSUMERR, INVALIDFORMAT E2BO X 24

25 7-5. ISO TYPE A / B COMMAND LIST EXCHANGE BLOCK Sends data to the accessed card. - COMMAND (02)h 1+ n (60)h send_data[n] send data[n] : nbyte to be send to card. - RESPONSE : OK, CHKSUMERR, TIMEOUT, RCVERR, BLOCKERR STX LENGTH RESPONSE DATA CHK (02)h 1+n (00)h receive data[n] receive data[n] : n byte received from card DESELECT Set aselected card into the DESELECT mode - COMMAND STX LENGTH COMMAND CHK (02)h (01)h (61)h - RESPONSE : OK, CHKSUMERR, TIMEOUT, RCVERR E2BO X 25

26 8. MEMORY ORGANIZATION 8-1. Memory Organization of the internal EEPROM of RC531 Block Block Byte Access Number Address Address Rights Memory Content F r Product Information Field* F r/w Start Up Register Initialisation File F r/w F r/w F r/w F r/w F r/w F r/w F w F w 10 A A0...AF w 11 B B0...BF w 12 C C0...CF w 13 D D0...DF w 14 E E0...EF w 15 F F0...FF w F w F w F w F w F w F w F w F w F w F w 26 1A 1A0...1AF w 27 1B 1B0...1BF w 28 1C 1C0...1CF w 29 1D 1D0...1DF w 30 1E 1E0...1EF w 31 1F 1F0...1FF w (not used) Register Initialisation File Keys for Crypto1 (not used) Product Information Field* byte Meaning Product Type Identification RFU Product Serial Number Internal RsMaxP CRC E2BO X 26

27 8-2. Memory Organization of the Mifare Card ex) MIFARE 1Kbyte STANDARD CARD BLOCK Byte Number within ablock Description 63 Key A Access Bits Key B Sector Trailer 62 Data 61 Data 60 Data 59 Key A Access Bits Key B Sector Trailer 58 Data 57 Data 56 Data... 7 Key A Access Bits Key B Sector Trailer 6 Data 5 Data 4 Data 3 Key A Access Bits Key B Sector Trailer 2 Data 1 Data 0 Manufacture Blcok* Manufacture Blcok* MSB LSB X X X X X X X 0 Byte Serial Number Check Byte Manufacture Data E2BO X 27

28 9. PICC Type A state diagram E2BO X 28

29 9-1. POWER-OFF State Description : In the POWER-OFF State, the PICC is not powered due to a lack of carrier energy. State exit conditions and transitions : If the PICC is in an energizing magnetic field greater than Hmin (see ISO/IEC ), it shall enter its IDLE State 9-2. IDLE State Description : In the IDLE State, the PICC is powered. It listens for commands and shall recognize REQA and WUPA Commands. State exit conditions and transitions : The PICC enters the READY State after it has received a valid REQA or WUPA Command and transmitted its ATQA READY State Description : In the READY State, either the bit frame anticollision or a proprietary anticollision method can be applied. State exit conditions and transitions : The PICC enters the ACTIVE State when it is selected with its complete UID ACTIVE State Description : In the ACTIVE State, the PICC listens to any higher layer message. State exit conditions and transitions : The PICC enters the HALT State when avalid HLTA Command is received. NOTE In the higher layer protocol, specific commands may be defined to return the PICC to its HALT State HALT State Description : In the HALT State, the PICC shall respond only to awupa Command. State exit conditions and transitions : The PICC enters the READY* State after it has received a valid WUPA Command and transmitted its ATQA READY* State Description : The READY* State is similar to the READY State, either the bit frame anticollision or aproprietary anticollision method can be applied. State exit conditions and transitions : The PICC enters the ACTIVE* State when it is selected with its complete UID ACTIVE* State Description : The ACTIVE* State is similar to the ACTIVE State, the PICC is selected and listens to any higher layer message. State exit conditions and transitions : The PICC enters the HALT State when a valid HLTA Command is received. E2BO X 29

30 10. DIMENSIONS 53.9(W) *55.9(H) * 6(D) mm 53.9mm 55.9mm 32mm 8mm 3.1mm 14mm 8mm E2BO X 30

31 11. EBRF700 Test Program All commands can be tested through EBRF700Tester. E2BO X 31